10 stories, newest first · one card per story
Fraudulent ChatGPT Plus billing emails direct victims to interactive phishing pages on nxcli.io that collect card details and allow operators to capture OTPs in real time.
ANY.RUN linked 618 analyses from June through October 21, 2026, with monthly cases rising from 20 to 200.
Resecurity says a Chinese phishing-as-a-service kit, Iron Man System, offered thousands of lures and a claimed billion messages.
Microsoft details a Chinese-language phishing-kit market that enabled over one billion messages to 75,000 organizations.
Group-IB details the Milk Dragon phishing kit using fake social-media discounts to steal payment cards and 3DS one-time passwords across 66 countries.
Malwarebytes found 70 cloned crypto sites impersonating xStocks, Pendle, Zama and others that trick users into wallet connections and malicious token approvals.
Group-IB attributes large-scale smishing using the JWR real-time phishing kit to the Smishing Triad's Outsider cluster, harvesting card data, OTPs, and bank credentials.
ANY.RUN marketing piece argues SOC detection lags rotating malware and phishing infrastructure, citing a 46-country campaign and 3DBlast kit to promote TI feeds.
Group-IB found the Outsider phishing kit kept generating 700+ new phishing pages within a month of Operation Ghost Hook's takedown.
Abnormal Security details iAuthFlow v2, a $10,000 phishing kit that enrolls attacker-controlled passkeys on Google accounts, persisting through password resets.
Today 1.6K readers · 2.4K views · 776 reads · all time 189K views