Token-spraying campaign hits Microsoft 365 accounts for email fraud
Huntress counted at least 200,000 login attempts and 497 successful sign-ins from July to September 2026.
1
Stories per day · 30 days
6 RSS
Relatedsocial-engineering4account-takeover3phishing3africa2aitm2cryptocurrency2huntress2interpol2mfa2microsoft-3652proofpoint2serengeti2ai1business-email-compromise1chatgpt1clickfix1deepfake1email-bombing1
48 stories, newest first · one card per story
Stories tagged #bec
Interpol Serengeti III nets 1,462 arrests and $105 million
Twenty African countries and the United States took part; identified victims lost more than $385 million.
Interpol operation disrupts nearly 11,000 cybercrime networks in Africa
Serengeti III brought 1,462 arrests, identified 65,929 victims, and recovered more than $105 million.
Inbox flooded with sign-up messages? Email bombing explained
Email bombing floods inboxes with signup mail to hide fraud alerts or enable fake tech-support scams.
3
AI Slop Isn't Just for Social Media; It's Ruining Cyberattacks, Too
Proofpoint research argues AI is degrading threat actor quality, with once-sophisticated TA4903 now producing sloppier credential phishing and BEC attacks.
4
Business Email Compromise (BEC) Attacks: How to Stop Them
Huntress explains business email compromise, citing $55 billion in global losses and attacks at 36% of surveyed firms.
2
How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team
Teams are urged to drill out-of-band checks against cloned-voice payment, help-desk, and admin-access fraud.
3
Healthcare Sees No Relief from Cyberattacks Disrupting Patient Care
Proofpoint and Ponemon say 74% of surveyed U.S. healthcare organizations saw patient-care disruption from cyberattacks.
3
ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress
Huntress shows ClickFix and a malicious custom GPT stealing a Microsoft 365 cookie to enable BEC within a day.
Social Engineering AI Agents: The New BEC for 2026
Attackers can socially engineer AI agents that control business systems, creating a new business email compromise risk.
Alert Overload, Tool Sprawl and Evasive Phishing: The 5 Bottlenecks Slowing Down US SOCs
ANY.RUN says US SOCs are slowed by alert overload, tool sprawl, and evasive phishing.
Attackers Hide AI Prompt Injections Inside Phishing Emails
Barracuda found phishing emails hiding prompt injections aimed at AI inbox assistants and human recipients.
2
De Kalb County, Indiana fell prey to vendor impersonation billing
DeKalb County, Indiana paid a fraudulent invoice after attackers impersonated a vendor.
2
Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
Huntress finds RMM abuse, mailbox-rule BEC, and AiTM token theft most often disrupt SMBs.
Former US Air Force members behind million-dollar BEC scheme head to prison
Two former US Air Force members received a combined 189 months for a million-dollar BEC and phishing scheme.
US Air Force members given over 6 years in prison for cyber theft of more than $2 million
Two U.S. Air Force members received 9- and 6.5-year sentences for a BEC scheme that diverted over $2 million from at least 15 organizations.
1
Former US Air Force members sent to prison over BEC attacks
Two former US Air Force airmen received a combined 189 months in prison for BEC and phishing schemes diverting over $2.4 million.
Social Engineering in the Age of Synthetic Media
Recorded Future details how threat actors abuse jailbroken and legitimate AI tools to scale phishing, deepfake impersonation, and phishing-as-a-service operations.
19
The devil is still in the email – but wearing a new mask
ESET details modern phishing evolution: QR codes, OAuth token theft via ConsentFix, ClickFix paste attacks, and deepfake-assisted BEC.
3
When Business Email Compromise Starts Rewriting Reality
Rapid7 and Zimbra research details 50+ Zimbra flaws enabling BEC attacks that impersonate senders, rewrite documents, and manipulate calendars.
Aviation solved the vigilance problem. AI just gave security a worse one
Opinion piece argues AI multiplies concurrent tasks and worsens vigilance failures, urging deterministic payment controls over reliance on human attention.
2
Data Overtakes Skills as Top Threat Hunting Challenge, SANS Study Finds
SANS 2026 Threat Hunting Survey: data quality/quantity (50%) overtook skills (45%) as hunters' top barrier, while ransomware remains the most-found threat.
1
Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes
Microsoft and partners seized EvilTokens infrastructure after the phishing service compromised over 12,000 inboxes.
1
Microsoft disrupts AI-assisted platform that compromised 12,000
Microsoft seized EvilTokens, an AI-chatbot BEC platform that compromised 12,000 accounts across 10,000 organizations.