Generative AI is making fake login pages easier to scale
The 2026 Verizon DBIR linked phishing to 44% of the AI-assisted initial-access techniques it examined.
1
Stories per day · 30 days
6 RSS
Relatedmicrosoft-3655device-code-phishing3entra-id3inbox-rules3mfa3bec2business-email-compromise2entra2phishing2session-hijacking2token-replay2token-theft2account-takeover1credential-theft1huntress1social-engineering1wire-fraud1
40 stories, newest first · one card per story
Stories tagged #aitm
Stolen login tokens used to hijack Microsoft 365 accounts at 79 organizations
Huntress counted 497 successful sign-ins and more than 200,000 failures from July 14 to September 22, 2026.
1
Microsoft 365 token-replay campaign hit 97 accounts at 79 organizations
Huntress logged 497 successful sign-ins and 48 rogue Entra devices between July 14 and September 22, 2026.
1
Stolen Microsoft 365 sessions replayed at 79 organizations
Huntress counted 497 successful sign-ins and over 200,000 failures from July 14 to September 22, with inbox rules hiding mail.
1
Token-spraying campaign hits Microsoft 365 accounts for email fraud
Huntress counted at least 200,000 login attempts and 497 successful sign-ins from July to September 2026.
1
M365 token spray and replay campaign hits 79 organizations
Huntress saw 497 successful sign-ins and more than 200,000 failed attempts from July 14 to September 22, 2026.
3
Business Email Compromise (BEC) Attacks: How to Stop Them
Huntress explains business email compromise, citing $55 billion in global losses and attacks at 36% of surveyed firms.
2
Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time
Cisco Talos says UAT-11985 uses a Google AiTM kit to steal sessions from Taiwan-linked researchers.
Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
UAT-11985 used likely AI-written event invites and an AiTM kit to steal Google sessions from Taiwan researchers.
5
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos says UAT-11985 phished Taiwan researchers with AI-assisted event lures and real-time Google AitM.
We are fighting phishing at the wrong layer
A researcher argues phishing defense should hunt shared AiTM servers that leak their origin via cookies.
Cheapskates wouldn't pay for security help, got hit by ransomware, and went bust months later
A construction firm that declined security help was hit by ransomware, lost its only backup, and went bust; second anecdote details AiTM Microsoft 365 phishing.
2
How RMM abuse gives attackers a way in that looks like business as usual
Huntress reports attacker RMM abuse in 45% of Q1 2026 endpoint incidents, up 277% YoY, delivered via phishing lures stacking multiple remote-access tools.
Chinese spies impersonate White House, Anthropic figures to phish AI policy experts
China-aligned TA419 phished US AI policy experts by impersonating White House and Anthropic figures.
Milk Dragon AiTM Kit Uses Real-Time OTP Relay and WebSocket Keylogging to Bypass MFA
Group-IB says the Milk Dragon kit relays OTPs live to steal shoppers' card payments across 66 countries.
Milk Dragon Phishing Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA
Milk Dragon uses fake social-media discounts to steal cards and intercept 3-D Secure codes.
5
China-Linked Hackers Impersonate AI Experts to Target US Policy Insiders
China-linked TA419 phishes US AI-policy staff using expert impersonation and a Microsoft 365 session-stealing proxy.
Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
Huntress finds RMM abuse, mailbox-rule BEC, and AiTM token theft most often disrupt SMBs.
Know Your Enemy: Browser-Based Attack Techniques in 2026
Push Security survey details six dominant browser attack techniques for 2026, including AiTM phishing, ClickFix, OAuth abuse, and session hijacking.
10
Phishing Risk Across 5 Key US Industries: ANY.RUN Data & Mitigation Strategies
ANY.RUN reports phishing exposure above 70% in US finance and manufacturing, driven by AiTM kits like Sneaky2FA and ClickFix social engineering.
Unmasking EvilTokens: Getting to the root of device code phishing
Microsoft details the EvilTokens/Storm-2992 device-code phishing operation and shares Defender detections after disrupting the AI-powered platform.
5
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
Microsoft details two campaigns: million-email CEO impersonation ACH fraud and passkey-themed vishing that hijacks Microsoft cloud accounts for data theft and extortion.
Passkey-themed phishing attacks lead to Microsoft 365 data theft
Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.
6
Attackers call employees’ personal phones to break into Microsoft 365 accounts
Microsoft tracks vishing campaigns by Storm-3121 and Storm-3032 that impersonate IT staff, phish Microsoft 365 credentials, and steal cloud data.