Loading story…
Cybercriminals are increasingly adopting a subscription-based model, offering a wide range of crime-as-a-service (CaaS) tools and infrastructure that lower the barrier to entry for less skilled attackers. Services such as phishing-as-a-service (PhaaS) now provide turnkey solutions, including AI-powered tools like SpamGPT for generating convincing phishing emails and malicious document builders like MatrixPDF, all available for recurring fees. These platforms offer features such as customer support and user guides, making sophisticated attacks accessible to a broader audience. The ecosystem also includes the resale of compromised accounts and access, further fueling the underground economy.
Recent campaigns demonstrate the effectiveness and evolution of these services. For example, a targeted phishing operation used fake Calendly invites impersonating over 75 major brands to steal Google Workspace and Facebook business credentials, leveraging AI to craft highly convincing lures. Compromised ad manager accounts are then used for malvertising, malware distribution, and further phishing. Meanwhile, advanced adversary-in-the-middle (AiTM) frameworks like Evilginx are being deployed in attacks against educational institutions, bypassing multi-factor authentication and evading traditional detection methods. These developments highlight the growing sophistication and commercialization of cybercrime, with attackers exploiting both technical innovation and social engineering at scale.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Researchers also linked the broader business-account phishing activity to malicious sponsored ads that spoofed Google login pages to target Google Ads Manager accounts. Compromised accounts could then be abused for malvertising, further phishing, malware delivery, or resale.
Analysis of the campaign revealed Browser-in-the-Browser techniques, adversary-in-the-middle phishing pages, CAPTCHAs, and anti-analysis controls such as blocking VPNs, proxies, and developer tools. These methods were used to improve credential theft success and bypass 2FA protections.
Researchers identified an ongoing phishing campaign using fake Calendly invites and recruiter lures to impersonate more than 75 major brands, including Disney, MasterCard, Uber, Unilever, and LVMH. The operation targeted Google Workspace, Facebook Business, and especially Google MCC ad manager accounts.
DNS-based analysis and fingerprinting uncovered 67 related domains and multiple dedicated IP addresses associated with the university phishing campaign. The findings provided actionable indicators of activity for defenders tracking the Evilginx-based operation.
During the university SSO campaign, the actor moved from using GoDaddy and NameCheap-hosted infrastructure to Cloudflare-proxied phishing domains. The change helped obscure the short-lived brand-impersonating sites used in the attacks.
From April 2025 onward, the threat actor broadened the campaign to at least 18 U.S. universities, with activity increasing mid-year and additional schools added over time. The most targeted institutions included UC Santa Cruz, UC Santa Barbara, the University of San Diego, Virginia Commonwealth University, and the University of Michigan.
Researchers observed the earliest known activity in a recurring phishing campaign against U.S. university single sign-on portals on April 12, 2025. The attackers used Evilginx adversary-in-the-middle phishing to steal credentials and session cookies and bypass MFA.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 83 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceblogs.infoblox.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly utilizing advanced Phishing-as-a-Service (PhaaS) kits to conduct large-scale, targeted phishing campaigns that impersonate trusted brands and institutions. These kits, which have doubled in number over the past year, enable even less-skilled attackers to deploy sophisticated attacks at scale by incorporating features such as URL obfuscation, MFA bypass, CAPTCHA abuse, and the use of malicious QR codes and attachments. Threat analysts have observed a surge in new PhaaS entrants, including Cephas, Whisper 2FA, and GhostFrame, alongside established kits like Tycoon 2FA and Mamba 2FA. Attackers are also leveraging AI, social engineering, and polymorphic techniques to evade detection, making it increasingly difficult for organizations to defend against these threats with static security controls alone. Technical analysis reveals that phishing infrastructure is evolving to include fake verification pages, such as counterfeit Cloudflare Turnstile challenges, which act as intelligent traffic filtering gates. These pages use browser fingerprinting, geolocation, and proxy detection to selectively deliver malicious payloads to high-confidence victims while evading security researchers and automated defenses. The fake verification pages closely mimic legitimate branding and user experience, including fabricated Ray IDs and links to real policy documents, to build trust and bypass scrutiny. Security experts recommend adopting layered defenses, including phishing-resistant MFA, continuous monitoring, and integrated email security, to counter these increasingly sophisticated phishing operations.
Jun 29, 2026
Phishing remains the dominant initial access vector for cyberattacks across Europe, accounting for 60% of incidents between July 2024 and June 2025, as reported by the European Union Agency for Cybersecurity (ENISA). The proliferation of Phishing-as-a-Service (PhaaS) platforms, such as Whisper 2FA, has enabled attackers to automate and scale their operations, targeting a wide range of brands including Microsoft 365, Adobe, and DocuSign. These kits now incorporate advanced features like AJAX-based real-time credential and multi-factor authentication code capture, dense encoding, anti-debugging, and browser freezing to evade detection and analysis. ENISA highlights that AI tools have fundamentally reshaped the threat landscape, with large language models (LLMs) being leveraged to enhance phishing campaigns and automate social engineering, resulting in AI-supported phishing representing over 80% of observed social engineering activity worldwide by early 2025. The report also notes a significant rise in attacks targeting the AI supply chain, with adversaries corrupting components used in AI development and deployment. The sophistication of phishing attacks is further demonstrated by the integration of AI-generated lures, deepfakes, and synthetic media, which are increasingly used in vishing, impersonation, and fraud schemes. The use of AI has not only increased the volume and success rate of phishing campaigns but has also introduced new risks, as AI systems themselves become targets for exploitation. Supply chain attacks have intensified, with threat actors abusing critical digital dependencies to maximize impact, often by targeting customers of compromised organizations. The evolution of phishing tactics is also evident in the widespread adoption of clickbait scams, which use sensationalized headlines and engaging visuals to lure victims into revealing sensitive information or installing malware. Despite increased awareness and training, organizations continue to struggle with the effectiveness of phishing prevention, as attackers adapt their methods to bypass traditional defenses. The ENISA Threat Landscape 2025 report underscores the urgent need for organizations to update their security frameworks, enhance identity and access management, and adopt advanced detection and response strategies to counter the growing threat posed by AI-driven phishing and social engineering attacks. The convergence of AI, automation, and supply chain vulnerabilities has created a complex and rapidly evolving threat environment that demands continuous vigilance and innovation in cybersecurity practices.
Jun 29, 2026
Cybercriminals are increasingly leveraging artificial intelligence and advanced social engineering techniques to conduct sophisticated phishing campaigns targeting both individuals and organizations. Recent reports highlight a surge in phishing attacks that utilize AI and machine learning to craft highly personalized and convincing lures, making detection more challenging for traditional security tools. Attackers are now able to scrape social media for personal data, generate emails in a target’s native language, and automate the creation of malicious content, all with minimal effort. One notable campaign tracked since February targets social media and marketing professionals by impersonating well-known brands such as Tesla, Red Bull, and Ferrari, enticing victims to upload resumes under the guise of job opportunities. These emails employ subtle psychological tactics, such as reducing urgency to build trust, and use multi-step processes to create an illusion of legitimacy. Another observed campaign used AI to obfuscate malicious payloads within SVG files, making them harder for security filters to detect. In this case, attackers sent phishing emails from compromised small business accounts, posing as file-sharing notifications, and used self-addressed email tactics to bypass basic detection heuristics. If recipients opened the attached file, they were redirected to credential-stealing websites. Microsoft researchers noted that the complexity and structure of the malicious code suggested it was generated by a large language model, rather than written by a human. The adoption of AI by threat actors is part of a broader trend, with both defenders and attackers racing to outpace each other in the use of transformative technologies. Security experts emphasize the importance of a layered defense, recommending strong passwords, multi-factor authentication, regular software updates, and ongoing user training to identify and report suspicious content. The rise of AI-driven phishing has increased the frequency and sophistication of attacks, with some security centers now detecting a malicious email every 42 seconds. Organizations are urged to remain vigilant, as even basic threat actors can now execute complex attacks with the help of AI tools. The evolving threat landscape underscores the need for proactive monitoring, rapid incident response, and continuous education to mitigate the risks posed by these advanced phishing campaigns. As attackers continue to refine their methods, defenders must adapt by leveraging AI for detection and response, and by fostering a security-aware culture among users. The convergence of AI and phishing represents a significant escalation in cyber risk, demanding heightened attention from both technical and non-technical stakeholders.
Jul 12, 2026