Loading story…
Phishing attacks not only deceive users into surrendering sensitive information such as credentials and payment details, but also initiate a complex process where the stolen data is rapidly commoditized and funneled into the cybercriminal underground. After collection, data is transmitted using various methods including email, Telegram bots, and specialized administration panels, with a growing trend toward leveraging legitimate services like Google Forms or Discord to evade detection. Attackers use these channels to efficiently harvest, sort, and manage the stolen information, often employing disposable infrastructure to hinder tracking and takedown efforts.
Once obtained, the compromised data enters a shadow-market pipeline where it is resold, aggregated into digital dossiers, and reused in subsequent attacks—sometimes years after the initial breach. Cybercriminals exploit both recent and historical leaks for targeted campaigns, and the persistence of this data in underground markets underscores the long-term risks for victims. Technical research highlights the sophistication of these operations and the enduring value of stolen credentials and personal information within the cybercrime ecosystem.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
On publication, Kaspersky and related coverage described research into what happens after phishing theft, showing that stolen credentials and other data are funneled through email scripts, Telegram bots, and phishing administration panels, then sorted, verified, and sold or reused in underground markets. The reporting also noted that most phishing attacks in early 2025 targeted online account credentials and that older stolen data can remain valuable for later fraud and targeted attacks.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
kaspersky.com
Open sourcecybersecuritynews.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe a broader **credential-theft trend** in which attackers abuse trusted services and familiar business workflows to make phishing more convincing and harder to detect. One campaign used **compromised WordPress sites** and redirects through `skimresources[.]com` to deliver pixel-perfect fake login pages for **Microsoft Teams**, **Xfinity**, and **UAE Pass**, with lures such as missed voicemail and shared-document alerts. Another campaign abused **LiveChat**'s `lc[.]chat` infrastructure to impersonate brands like **PayPal** and **Amazon**, moving victims into fake support conversations designed to extract sensitive information under the guise of refunds or order issues. A separate industry report reinforces the same operational pattern: attackers increasingly rely on **valid credentials** and trusted collaboration tools rather than software exploits, with cloud identity compromise driving most investigated incidents and some intrusions using **Microsoft Teams voice phishing** and **Quick Assist** to gain access, move laterally, and deploy ransomware. Other references in the set cover different stories entirely, including the **CamelClone** espionage operation, a **FancyBear/APT28** infrastructure exposure, and a general weekly security recap, and do not describe the same phishing activity. This is **not fluff** because the relevant items contain substantive threat intelligence on active attack methods, delivery infrastructure, and attacker tradecraft.
Jun 29, 2026
Threat actors are continuing to prioritize **credential theft** while using defensive and trusted services to evade detection. DomainTools reported a Microsoft 365 phishing operation that **weaponizes Cloudflare protections** (including *Turnstile* human verification) to block automated analysis and security crawlers, then selectively serves a credential-harvesting flow only to “clean” visitors. The infrastructure used additional gatekeeping such as IP reputation checks (including lookups via `api.ipify.org`), hardcoded blocks for security-vendor and cloud-provider ranges, and user-agent filtering that returns a fake `404` page to bots, with the theft logic hidden behind heavy obfuscation. Separately, Hunt.io documented **Operation Roundish**, assessed with medium-high confidence as aligned to **APT28 (Fancy Bear)**, after discovering an exposed open directory hosting a Roundcube exploitation toolkit used against Ukrainian targets (including `mail.dmsu.gov.ua`). The toolkit included XSS payloads, a Flask-based C2, and modules for credential harvesting, mail forwarding persistence, bulk email exfiltration, address book theft, and 2FA secret extraction, plus a Go-based Linux implant (`httd`) found on a compromised Ukrainian web application. In parallel reporting on credential-access tradecraft, Flashpoint analysis highlighted the low-cost **DarkCloud infostealer** (sold for about **$30**) that steals browser logins/cookies and other data and exfiltrates via common channels (email/FTP/Telegram/HTTP), while Aryaka Threat Labs described the **BlackSanta** campaign using steganographic lures and **BYOVD** techniques to disable EDR and enable stealthy data theft over HTTPS—underscoring that credential access and defense evasion remain common precursors to broader enterprise compromise.
Jul 1, 2026
Cybercriminals are increasingly adopting a subscription-based model, offering a wide range of crime-as-a-service (CaaS) tools and infrastructure that lower the barrier to entry for less skilled attackers. Services such as phishing-as-a-service (PhaaS) now provide turnkey solutions, including AI-powered tools like SpamGPT for generating convincing phishing emails and malicious document builders like MatrixPDF, all available for recurring fees. These platforms offer features such as customer support and user guides, making sophisticated attacks accessible to a broader audience. The ecosystem also includes the resale of compromised accounts and access, further fueling the underground economy. Recent campaigns demonstrate the effectiveness and evolution of these services. For example, a targeted phishing operation used fake Calendly invites impersonating over 75 major brands to steal Google Workspace and Facebook business credentials, leveraging AI to craft highly convincing lures. Compromised ad manager accounts are then used for malvertising, malware distribution, and further phishing. Meanwhile, advanced adversary-in-the-middle (AiTM) frameworks like Evilginx are being deployed in attacks against educational institutions, bypassing multi-factor authentication and evading traditional detection methods. These developments highlight the growing sophistication and commercialization of cybercrime, with attackers exploiting both technical innovation and social engineering at scale.
Jun 29, 2026