This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.
Microsoft: Multi-Stage "Code of Conduct" Phishing Leads to AiTM Compromise
Summary Microsoft Threat Intelligence has uncovered a sophisticated phishing campaign that exploits corporate compliance workflows. Attackers send a "mandatory" request for employees to review and sign a new "Code of Conduct" via a fake DocuSign or Adobe Sign link. This campaign uses Adversary-in-the-Middle (AiTM) techniques to bypass Multi-Factor Authentication (MFA) and steal session tokens, giving attackers full access to the victim's account without needing their password again.
Key Takeaways
Psychological Lure: By using "Code of Conduct" or "HR Policy" updates, attackers trigger a sense of professional obligation, making users more likely to click through security warnings.
Token Theft (AiTM): The phishing site acts as a transparent proxy. When the user enters their credentials and MFA code, the attacker captures the session token, allowing them to "clone" the user's logged-in state.
Bypassing MFA: Because the attacker steals a live session token, traditional MFA (like SMS or push notifications) is ineffective once the initial login is completed on the proxy site.
Post-Compromise Activity: Once inside, attackers quickly register their own MFA devices, set up email forwarding rules to hide their activity, and pivot to financial systems to initiate fraudulent wire transfers.
The Fix: Move toward Phishing-Resistant MFA (such as FIDO2 security keys or Windows Hello for Business) and implement Conditional Access policies that require "Compliant Devices" to access sensitive resources.
Further Reading: Breaking the Code: Multi-stage Phishing Leads to AiTM Token Compromise
Steal Smarter, Not Harder: Malicious Use of Vercel for Phishing
Summary Cofense Intelligence has identified a surge in threat actors leveraging Vercel, a popular cloud platform for frontend developers, to host high-fidelity credential phishing pages. By utilizing Vercel’s legitimate infrastructure and "trusted" subdomains, attackers can easily bypass email security filters and reputation-based blockers that typically flag newly registered malicious domains.
Key Takeaways
Infrastructure Hijacking: Attackers use Vercel’s free tier to deploy phishing sites. Because the URLs often end in *.vercel.app, they inherit the high reputation of Vercel’s global infrastructure, making them invisible to many automated security tools.
Automated Scaling: Scammers are using Vercel’s deployment "slugs" to generate unique, personalized URLs for thousands of targets simultaneously, preventing simple URL-based blacklisting.
Evading Scanners: Many email gateways are configured to trust major cloud providers (like Vercel, Netlify, or Azure). Attackers exploit this "trusted cloud" status to deliver malicious links directly to the inbox.
Targeted Lures: The campaign primarily targets Microsoft 365 credentials, using fake "Document Shared with You" or "Action Required" notifications that redirect to a Vercel-hosted login portal.
The Fix: Implement Content Disarming and Reconstruction (CDR) or advanced browser isolation. Security teams should also consider auditing traffic to *.vercel.app and treating cloud-hosted subdomains with increased scrutiny.
Further Reading: Steal Smarter, Not Harder: Malicious Use of Vercel
Proofpoint: Phishing via Device Code Authorization
Summary Proofpoint researchers have identified a rising trend in Device Code Authentication phishing. Attackers exploit a feature designed for "headless" devices (like Smart TVs or printers) to trick users into authorizing a malicious application on their primary corporate account. By convincing a user to enter a short alphanumeric code on a legitimate Microsoft or Google page, the attacker gains a persistent access token, bypassing Multi-Factor Authentication (MFA) entirely.
Key Takeaways
Abuse of "Device Flow": The attack leverages the OAuth 2.0 Device Authorization Grant. It sends the victim a code and a link to a legitimate Microsoft/Google URL (e.g., microsoft.com/devicelogin), making the request appear highly trustworthy.
Persistent Access: Once the victim enters the code and clicks "Continue," the attacker receives an access token and a refresh token. This allows them to stay logged in indefinitely, even if the user changes their password.
MFA Bypass: Since the user is performing the authorization on their own trusted device and browser, the "approval" satisfies MFA requirements, essentially using the user as a proxy for the attacker’s login.
Invisible Presence: There is no "phishing site" to block. The entire interaction happens on the legitimate service provider's domain, rendering traditional URL filters and web scanners useless.
The Fix: Disable the Device Code Flow in your tenant for users who do not require it. If it must be used, implement Conditional Access policies to restrict device code logins to known, managed IP ranges.
Further Reading: Access Granted: Phishing with Device Code Authorization
New Phishing Attack Weaponizing Event Invitations
Summary Security researchers have identified a surge in phishing attacks that weaponize calendar and event invitations (ICS files) to bypass email gateways. By sending a malicious invite through platforms like Outlook or Google Calendar, attackers place a clickable "Join Meeting" link directly onto a victim’s calendar. This bypasses traditional email filters because the "malicious" content isn't in the email body, but embedded within a trusted system notification.
Key Takeaways
Trusted Notification Abuse: Because the notification comes from the user’s own calendar service (e.g., "New Meeting Added"), it inherits a high level of trust and often bypasses spam folders.
The "Auto-Add" Vulnerability: Many calendar settings are configured to automatically add invitations to the calendar even before the user accepts them, making the malicious link persistent on their schedule.
Credential Harvesting: The "Meeting Link" typically leads to a sophisticated spoofed login page (often masquerading as Microsoft Teams or Zoom) designed to steal corporate credentials.
Mobile Exploitation: These attacks are particularly effective on mobile devices, where calendar notifications are prominent and users are less likely to inspect the underlying URL before clicking.
The Fix: Configure calendar settings to disable "Automatically add invitations" from unknown senders. Security teams should also implement URL rewriting and "Time of Click" protection for links found within calendar events.
Further Reading: New Phishing Attack Weaponizing Event Invitations
ClickFix: Fake macOS Utility Lures Deliver Infostealers
Summary Microsoft Threat Intelligence has analyzed a new wave of ClickFix attacks specifically targeting macOS users. Attackers compromise legitimate websites to display fake "browser update" or "system error" overlays. These overlays prompt users to fix the issue by copying a malicious command and running it via the macOS Terminal or Script Editor. This "copy-paste" tactic allows the malware to bypass macOS Gatekeeper and XProtect to install the Atomic Stealer (AMOS).
Key Takeaways
The "Copy-Paste" Bypass: By tricking the user into manually executing the command, the attacker circumvents many of Apple's built-in security features that normally prevent the execution of unsigned or untrusted software.
Malicious Scripting: The pasted commands typically use osascript (AppleScript) or curl to download and execute the primary payload—often Atomic Stealer (AMOS)—directly in memory or hidden directories.
Data Exfiltration: Once the stealer is active, it targets high-value data, including keychain passwords, browser cookies, credit card info, and cryptocurrency wallets.
High-Pressure Lures: The attack uses sophisticated "system-style" pop-ups that mimic macOS system notifications, creating a false sense of urgency and legitimacy for the "required" fix.
The Fix: Users should be trained that no website will ever require a Terminal command to "fix" a browser error. Organizations should monitor for unusual osascript or curl execution patterns via EDR.
Further Reading: ClickFix campaign uses fake macOS utilities lures to deliver infostealers
Hackers Abuse Google Ads and Claude AI Chats to Push Mac Malware
Summary Security researchers have identified a sophisticated campaign where hackers are buying Google Ads to promote fake versions of Claude AI. These ads lead victims to highly convincing websites that mimic Anthropic’s interface but deliver a "ClickFix" style lure. Instead of a chat interface, users are told they need to "update their system" or "install a browser component" to use the AI, which results in the installation of the Atomic Stealer (AMOS) on macOS.
Key Takeaways
Search Engine Hijacking: Attackers are outbidding legitimate companies for top search spots. When a user searches for "Claude AI," the top "Sponsored" result leads to a malware distribution site rather than the real claude.ai.
AI Brand Impersonation: The campaign exploits the current high demand for AI tools. By using the Claude brand, attackers target professional and creative users who are likely to be using high-value macOS workstations.
The "ClickFix" Evolution: The site uses a fake "terminal fix" pop-up. It provides a string of code for the user to copy and paste into their macOS Terminal, claiming it will "unlock" the AI chat features.
Stealer Capabilities: Once the command is run, Atomic Stealer (AMOS) is installed. It immediately targets the macOS Keychain, browser-stored passwords, credit card information, and cryptocurrency wallet extensions.
The Fix: Never click on "Sponsored" search results for software downloads. Always navigate directly to the official domain or use the Mac App Store. Organizations should use ad-blocking at the network level and restrict Terminal usage via MDM for non-technical staff.
Further Reading: Hackers abuse Google Ads, Claude AI chats to push Mac malware
FBI Alert: ShinyHunters Attacks Learning Management System
Summary
The FBI’s Internet Crime Complaint Center (IC3) issued a Public Service Announcement regarding a massive cyber-attack claimed by the cybercriminal group ShinyHunters. The breach targeted a widely used online Learning Management System (LMS)—extensively reported to be Canvas—resulting in widespread service interruptions for educational institutions nationwide and the theft of massive troves of student and faculty data.
Key Takeaways
High-Pressure Extortion: ShinyHunters is known for aggressive pressure tactics. Beyond emailing institutions, they frequently escalate extortion by sending threatening text messages, placing phone calls to victims and their families, and executing dangerous swatting attacks.
Bluffing with Sensitive Data: Attackers often exaggerate their access, falsely claiming to possess highly compromised or embarrassing photographs and videos of victims to force quick extortion payments.
Follow-on Spearphishing: The stolen database allows threat actors to craft highly convincing, personalized spearphishing campaigns using real-world academic contexts to target students, parents, and faculty.
Identity Reuse and Resale: Stolen credentials and profile details are frequently sold to other criminals or reused to impersonate financial aid offices, school faculty, and local campus IT support.
The Fix: Educational entities must audit exposed cloud-management platforms and third-party SaaS integrations. Affected individuals should wait for formal institution guidance, treat any out-of-the-blue school or law enforcement communication with extreme skepticism, and immediately protect associated accounts.
Further Reading: ShinyHunters: Cyber Criminal Group Attacks Learning Management System
Before the First Whistle: The 2026 World Cup Scams
The Big Picture With the 2026 World Cup just around the corner, cybercriminals are already working overtime to cash in on the excitement. Fraudsters are using automated artificial intelligence (AI) tools to flood the internet with thousands of fake websites. These sites are designed to look exactly like official platforms but exist solely to steal your hard-earned money and personal information.
How the Scams Work
The "Too Good to Be True" Official Store: Scammers create professional-looking online shops using fake addresses like fifaofficialstore[.]shop. They offer World Cup jerseys, hats, and souvenirs at massive discounts (like "80% off") to trick you into entering your credit card details.
The "Guaranteed Cash" Prediction Games: Fraudsters are launching fake online forums and mobile apps (such as fifa2026guess[.]com). They promise that if you deposit a small amount of money and "vote" or predict who will win a match, you will earn guaranteed daily cash profits. In reality, once you deposit your money, it disappears.
Shady Betting Hubs: Unofficial betting websites are popping up everywhere, often pushing users to "Download our app now" to get free betting credits. These downloadable apps are actually hidden viruses (malware) that can spy on your phone or computer.
Further Reading: Before the First Whistle: How Cyber Criminals Are Targeting World Cup 2026
Microsoft to Stop Sending SMS Codes for Personal Accounts
Summary In a major shift to digital safety, Microsoft has announced it is phasing out text message (SMS) verification codes for personal accounts. For years, typing in a code sent via text has been the standard way to log in or reset a password. However, Microsoft is pulling the plug on this feature because text messages are no longer safe enough to protect your digital identity.
How the Changes Work
Why SMS is Leaving: Microsoft states that text-message verification has become a leading source of fraud. Scammers have found easy ways to intercept text messages through tricks like "SIM-swapping" (where they steal your phone number) or fake login pages that trick you into typing your code.
The New Standards: Microsoft is completely removing the option to add or use a phone number for login codes. Instead, they are forcing a move to more modern, "passwordless" alternatives that hackers cannot easily steal.
The "Passkey" Alternative: When logging in, users will see a prompt to "Sign in faster" and create a passkey. A passkey links your account directly to your specific device (like your smartphone or computer) and lets you log in instantly using your face (Face ID), fingerprint, or device PIN.
Backup Account Recovery: To ensure you don't get locked out if you lose your device, Microsoft is moving account recovery entirely over to verified secondary email addresses, which will act as the primary safety net alongside passkeys.
Further Reading: Microsoft to stop sending SMS codes for personal accounts
Inside a Criminal Phishing Panel
Summary
Security researchers at Push Security infiltrated an active, real-time phishing command center used by notorious hacking groups like ShinyHunters and BlackFile. Unlike traditional automated scams, these operations are human-led and highly interactive. Attackers use live admin dashboards (such as "Doko's Panel") to manually manipulate victims in real time, tricking them into handing over passwords and security codes for corporate accounts like Google, Microsoft, Okta, and major cryptocurrency exchanges.
How the Attacks Work
The Live Phone Trap: The attack often begins with a voice call (vishing). A scammer spoofing your company’s IT helpdesk phone number calls you, using real employee names or internal support ticket numbers to sound highly legitimate. They direct you to a fake login web address under the guise of a "mandatory security update."
The Real-Time Middleman: When you enter the fake website, you are faced with a spinning loading wheel. Behind the scenes, the hacker is sitting at their admin panel, manually watching you connect. Once they click "accept," the site mirrors a flawless login page for your organization.
Stealing Your Multi-Factor Code: When you type in your username and password, it instantly pops up on the hacker's screen or their private Telegram channel. The hacker manually typed those credentials into the real company login portal. If the real portal asks for an SMS code or an authenticator prompt, the hacker pushes a button on their panel to make your screen say "Please enter your SMS code."
The Final Deception: You type in your security code, thinking it's a standard login. The hacker steals that code, inputs it into the real system, and completely hijacks your logged-in session. To keep you from realizing what just happened, their panel automatically redirects your browser to a harmless page, like Google Drive or a fake "Support Ticket Closed" confirmation.
Further Reading: We infiltrated a criminal phishing panel: here's what we found
How Three Techniques Are Behind ShinyHunters' 2026 Campaigns
Summary
Security researchers at Push Security analyzed the massive hack of Instructure, the parent company behind the widely used Canvas learning management platform. The cybercriminal group ShinyHunters claimed responsibility for the breach, which exposed 3.65 terabytes of data across nearly 9,000 schools and universities globally. Investigators revealed that this breach was part of a broader cyber campaign where attackers use sophisticated, browser-based identity tricks to completely bypass a company’s standard network firewalls and security defenses.
How the Attacks Work
The "Helpdesk" Phone Trap (Vishing & AiTM): Scammers call an employee pretending to be company IT support, creating fake urgency about a "mandatory security update." They direct the victim to a fake login website. Working live in the background, the attacker captures the employee's username, password, and multi-factor authentication (MFA) code, using it to completely clone their logged-in browser session.
The Fake App Trick (Device Code Phishing): Attackers exploit a login feature meant for smart TVs and office printers. The hacker sets up a malicious application that mimics a trusted business tool (like Salesforce). They call the employee and trick them into typing a short confirmation code into their real work account, which unknowingly grants the hacker permanent, invisible access to the company’s internal records.
The Domino Effect (SaaS Supply Chain Attacks): Many business applications and learning tools are linked together online to share data automatically. The analysis showed that instead of attacking every school individually, hackers target the third-party platforms themselves. Once a master system or vendor like Instructure is breached, the attacker can use those pre-existing technical pathways to slide into thousands of connected downstream school and business accounts.
Further Reading: How three techniques are behind ShinyHunters' 2026 campaigns - Push Security
Fake Gemini and Claude Code Sites Deliver Infostealer Malware
Summary
Security researchers at EclecticIQ have discovered a cyber campaign targeting software developers and technical workers. Threat actors are creating highly convincing fake websites that impersonate official AI development tools—specifically Google's Gemini command-line interface (CLI) and Anthropic's Claude Code. Instead of getting helpful AI programming assistants, unsuspecting users who download from these sites are infected with a hidden virus that steals sensitive corporate data.
How the Scams Work
The Search Engine Trap (SEO Poisoning): When developers search online for installation instructions for tools like Gemini CLI or Claude Code, hackers use search engine manipulation (SEO poisoning) to push their fraudulent websites (like geminicli[.]co[.]com or claudecode[.]co[.]com) to the very top of the results page, above the real sites.
The Visual Clone: The fake sites are exact visual clones of official Google and Anthropic documentation pages. This high level of detail tricks even tech-savvy professionals into believing they are in the right place.
The Copy-and-Paste Trick: The fake website presents the user with a standard-looking setup command and instructs them to copy and paste it into their computer's terminal or PowerShell window to "install" the AI tool.
The Silent Takeover: Once pasted and run, the command silently reaches out to an attacker-controlled server to download an "infostealer" program. The virus runs entirely in the computer's memory to avoid triggering standard security software warnings. It immediately sweeps the system to steal saved browser passwords, corporate VPN logins, security tokens, and sensitive work files.
Further Reading: SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer
Scammers Weaponize Official Microsoft Email System
Summary
Security researchers have discovered that cybercriminals are exploiting a loophole in an internal Microsoft system to send spam and phishing messages directly from an official Microsoft email address (msonlineservicesteam@microsoftonline.com). Because the emails originate from Microsoft's actual servers, they easily bypass traditional spam filters and inbox security measures, making them exceptionally dangerous to everyday users.
How the Scams Work
The Trusted Address: The email address being abused is normally used by Microsoft to send important notices, such as multi-factor authentication (MFA) security codes or billing updates.
The "Tenant Branding" Loophole: Scammers start by creating a free, temporary Microsoft business account. They navigate to the account profile settings and change the "Organization Name" or "Tenant Name" field to a fraudulent scam message—such as a fake notice about a Bitcoin purchase or a fake financial emergency.
The Forced Notification: Once the scammer inputs their fake message into the name field, they trigger an automated verification email from Microsoft to be sent to the victim (for instance, by attempting to add the victim's email address to their fraudulent account).
The Inbox Delivery: When the official email arrives in the victim's inbox, Microsoft’s automated template places the scammer’s text right into the subject line or body text. Since the email is technically authentic, signed by Microsoft, and contains no malicious attachments, your email provider assumes it is completely safe and delivers it straight to your primary inbox.
The Tech Support Trap: The text pushed into the email usually includes an urgent call-to-action, such as a fraudulent customer support phone number. Victims who call the number are connected to scammers who attempt to steal their credit card details or trick them into downloading remote-control malware.
Further Reading: Internal Microsoft account being used to send scams, phishing links
YouTube Simplifies and Automates AI Video Labels
Summary YouTube has updated its AI transparency systems to make it easier for viewers to spot AI-generated content. While video creators have been required to manually disclose realistic AI usage since 2024, YouTube is now moving these labels to highly visible locations and introducing automated scanners to automatically flag unlabeled AI videos.
Key Takeaways
Highly Visible Labels: AI disclosures are moving to prominent locations. For standard long-form videos, the label will sit directly under the video player. For short-form YouTube Shorts, the AI tag will appear as a permanent visual overlay right on top of the video.
Automated AI Scanners: If a video uses photorealistic AI but the creator fails to disclose it during upload, YouTube's built-in detection systems will automatically scan the video and apply the AI label.
Creator Appeal System: Creators can manually remove an automated label through YouTube Studio if they believe the system made a mistake. However, labels are permanent for videos made with YouTube’s own AI tools or those carrying verifiable AI digital metadata.
No Revenue Penalties: Applying an AI label does not negatively impact a video's performance. It will not restrict how the video is recommended to other viewers, nor will it affect the creator's ability to earn advertising money.
Further Reading: Improving AI labels for viewers and creators - YouTube Blog
Hackers Hijack Thousands of Sites for ClickFix and FakeUpdate Attacks
Summary A large-scale cyber campaign has hijacked thousands of legitimate websites to display fake system warnings. These alerts use "ClickFix" and "FakeUpdate" tactics to trick visitors into manually running commands that download data-stealing viruses onto their computers.
Key Items
Mass Website Compromise: Attackers inject malicious scripts into regular websites to display full-screen overlays mimicking official Windows Updates or security checks.
The Pastejacking Trick: The fake screens instruct users to click a button that copies a hidden script, then guide them to paste and run it in their computer's Command Prompt or Terminal.
Hidden in Pictures: The malicious code is hidden inside the microscopic color pixels of normal background images, allowing the virus to bypass standard security software.
Silent Data Theft: Once executed, the system installs an infostealer virus that instantly sweeps the device for saved browser passwords, corporate logins, and crypto wallets.
Further Reading: Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks