Canadian help-desk vishing campaign bypasses MFA in real time
Callers send staff to branded relay pages, then register MFA methods and steal Microsoft 365 data before extortion.
1
Stories per day · 30 days
3 RSS
Relatedbusiness-email-compromise1canada1cisco-talos1clickfix1device-code-phishing1google1mfa1mfa-bypass1microsoft-3651quishing1rmm1spear-phishing1taiwan1uat-119851vishing1
14 stories, newest first · one card per story
Stories tagged #adversary-in-the-middle
Huntress ranks RMM abuse and mailbox attacks atop SMB threats
Huntress says RMM abuse was 45% of Q1 2026 endpoint incidents and mailbox manipulation 24.6% of 2026 ITDR signals.
1
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cisco Talos says UAT-11985 uses fake event invites and Google AitM phishing against Taiwan research affiliates.
9
We are fighting phishing at the wrong layer
A researcher argues phishing defense should hunt shared AiTM servers that leak their origin via cookies.
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
China-aligned TA419 phished U.S. AI policy experts using Microsoft adversary-in-the-middle credential theft.
China-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing Attacks
China-linked TA419 used AiTM phishing to steal Microsoft 365 sessions from U.S. AI policy experts.
Chinese Hackers Posing as Senior Anthropic Employee Targeting US AI Policy Experts
China-linked TA419 impersonated an Anthropic employee to phish US AI policy experts for Microsoft 365 sessions.
Credential Theft: How Attackers Steal & Use Stolen Credentials
Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.
Detect and disrupt AI-themed attacks with Microsoft Defender
Microsoft Threat Intelligence reports criminal campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek in phishing, AiTM, and malvertising attacks reaching 100,000 emails daily.
4
BigBear phishing crew nets thousands of Microsoft 365 credentials
CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.
2
IT Help Desk Impersonation Lets Hackers Bypass MFA
Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.
2
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.
4
Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US
Mirage2FA phishing-as-a-service kit uses AiTM attacks to hijack Microsoft 365 sessions, with over 4,000 US victims.
3
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
Researchers found 737 Chrome VPN extensions, many impersonating brands like NordVPN, routing roughly 75,000 users' browser traffic through attacker-controlled SOCKS5 proxies.
2