Loading story…
Researchers reported a phishing campaign that abused Kuse.ai, a legitimate AI workplace collaboration platform, to host a malicious intermediary document on the trusted app.kuse.ai domain. The attack combined vendor email compromise (VEC) with a shared Markdown file link whose document-like .md filename included a vendor company name, helping the lure appear legitimate. When opened, the page displayed a blurred fake document and prompted the recipient to click through, ultimately redirecting victims to a counterfeit Microsoft sign-in page designed to harvest credentials.
The final phishing infrastructure was hosted at onlineapp.ooraikaoo.info, with reporting also linking related activity to IP address 91.92.41.64. Researchers said the campaign shows how attackers can weaponize trusted AI collaboration and file-sharing features to evade suspicion and some automated defenses. Recommended mitigations included stronger user awareness training, secondary verification for vendor-related email requests, phishing-resistant MFA, monitoring of AI platform sharing activity, and time-of-click URL inspection to catch malicious redirects delivered through otherwise trusted services.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Gurucul released a follow-on threat research notice that highlighted the same Kuse.ai phishing technique and provided indicators of compromise, including Kuse.ai shared-note URLs, onlineapp.ooraikaoo.info, and detection queries for related activity.
Trend Micro published research detailing the Kuse.ai abuse, including the attack chain, use of deceptive .md filenames, and defensive recommendations such as phishing-resistant MFA, secondary verification for vendor emails, and time-of-click URL inspection.
Researchers identified the final phishing page in the campaign as being hosted on onlineapp.ooraikaoo.info, with related reporting also listing IP address 91.92.41.64 as associated infrastructure. The campaign showed how attackers could weaponize trusted collaboration-platform sharing features to evade suspicion and some automated detections.
On April 9, 2026, researchers observed a phishing campaign using Kuse.ai, a legitimate AI workplace web application, to host a shared Markdown document on the trusted app.kuse.ai domain. The lure used vendor email compromise-style social engineering, a blurred fake document, and a click-through flow leading victims toward credential theft.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026
Security researchers reported several **social-engineering campaigns** that abuse trusted platforms to increase credibility and bypass controls. One campaign targeted wedding planners and related vendors by hijacking trust in *Microsoft Teams*: attackers used compromised legitimate email threads and impersonated legal professionals (e.g., `czimmerman@craigzlaw[.]com`) to lure victims into clicking a fake Teams meeting link that ultimately redirected to `ussh[.]life/connect/teamsfinal/9/windows`, a site masquerading as a Teams download page. Victims were prompted to download Windows executables consistent with **information-stealer** behavior (credential/browser/session-token theft and C2 exfiltration), enabling follow-on account takeover and additional phishing. Separately, a report highlighted **DKIM replay**-style phishing in which criminals abuse legitimate notification/invoice workflows from **PayPal, Apple, and DocuSign** to generate cryptographically signed emails that pass DKIM/DMARC checks; attackers place scam content (often a fake support phone number and urgency) into user-controlled fields, send the message to themselves to obtain a “clean” vendor-signed email, then forward it to targets. Another campaign used **Bing search ads** to funnel users through a newly registered domain (`highswit[.]space`) to scam pages hosted on **Microsoft Azure Blob Storage** (consistent path pattern including `werrx01USAHTML/index.html` and a phone-number parameter), presenting fake Microsoft security warnings and directing victims to call numbers such as `1-866-520-2041` and `1-833-445-4045`; Netskope observed impact across dozens of US organizations.
Jun 29, 2026
Attackers leveraged artificial intelligence to generate highly obfuscated code within phishing campaigns, using complex and verbose scripts embedded in SVG files to evade detection. Microsoft Threat Intelligence identified and blocked a credential phishing operation that utilized AI-generated code, making the malicious payload difficult to analyze and detect with traditional security tools. The phishing emails mimicked file-sharing notifications and used self-address tactics to bypass basic email filters, with attachments designed to appear as legitimate PDF documents but actually being SVG files containing hidden JavaScript. The campaign primarily targeted US-based organizations and highlights the growing trend of cybercriminals adopting AI to enhance the sophistication and stealth of their attacks. Despite the advanced obfuscation, Microsoft's AI-powered security systems successfully detected and mitigated the threat, underscoring the importance of AI-driven defenses against evolving attacker techniques.
Jun 29, 2026