Loading story…
Microsoft disclosed a large-scale phishing campaign that targeted more than 35,000 users at over 13,000 organizations across 26 countries, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals.
Microsoft said the attackers used an adversary-in-the-middle phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as Tycoon 2FA, Kratos, and EvilTokens. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Microsoft publicly disclosed details of the April 2026 phishing campaign, describing it as a sophisticated operation that stole credentials and authentication tokens from more than 35,000 users. The company also recommended layered defenses such as Defender protections, SmartScreen, stronger authentication, conditional access, and automated attack disruption.
At a ZeroDay.Cloud event in London, Wiz publicly detailed PostgreSQL vulnerabilities CVE-2026-2005 and CVE-2026-2006 on May 4, 2026, highlighting their potential for memory corruption and possible code execution. The disclosure also emphasized PostgreSQL's broad cloud exposure and advised administrators to update immediately and review logs for suspicious activity.
In the same April 2026 campaign, victims were routed through PDF links, fake CAPTCHA and document-review pages, and deceptive Microsoft sign-in pages that captured credentials and authentication tokens in real time. This adversary-in-the-middle flow enabled attackers to bypass multifactor authentication and gain immediate account access.
From April 14 to 16, 2026, attackers ran a large-scale phishing and credential theft campaign using code-of-conduct and compliance-themed lures sent through legitimate email delivery services. The operation targeted more than 35,000 users at over 13,000 organizations, with most victims in the United States and sectors including healthcare, finance, professional services, and technology.
MariaDB released patches for the JSON_SCHEMA_VALID vulnerability identified during the Wiz competition. The fixes were made available on February 4, 2026.
PostgreSQL maintainers fixed CVE-2026-2005 and CVE-2026-2006 across supported branches in February 2026 and urged users to upgrade. The fixes were released in versions 18.2, 17.8, 16.12, 15.16, and 14.21.
During Wiz's ZeroDay.Cloud competition in December 2025, Team Xint Code and Team Bugz Bunnies exploited and identified two PostgreSQL vulnerabilities in the pgcrypto extension, while Team Xint Code also found a MariaDB flaw in JSON_SCHEMA_VALID. The PostgreSQL bugs had existed since roughly 2005, making them long-lived issues in widely deployed database software.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourceinfoworld.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A wave of sophisticated phishing campaigns is targeting organizations globally to steal Microsoft 365 credentials by bypassing traditional email security gateways and multi-factor authentication (MFA) protections. Attackers are employing advanced techniques such as multi-stage payload delivery using nested PDF attachments, legitimate content delivery networks, and mouse tracking to evade detection. Once victims interact with these emails and enter their credentials on a credential harvesting site, attackers leverage legitimate Microsoft infrastructure to bypass MFA and gain immediate access to the victim’s Microsoft 365 environment. These campaigns are engineered to filter out security analysts and block standard security tools, making detection and response more challenging. In parallel, threat actors are increasingly using attacker-in-the-middle toolkits like Evilginx and hybrid phishing-as-a-service kits such as Salty2FA and Tycoon2FA to capture both user credentials and session cookies. By stealing session cookies, attackers can impersonate users and maintain access without triggering additional MFA prompts, even after successful authentication. The blending of different phishing kits into hybrid strains is making detection harder, as traditional security rules tuned to individual kits are now being evaded. Security researchers warn that static indicators are no longer sufficient, and behavioral analysis is required to spot these evolving threats.
Jun 29, 2026
Researchers identified **EvilTokens** as a new phishing-as-a-service platform built to hijack **Microsoft 365** accounts by abusing Microsoft’s legitimate OAuth 2.0 **device code** authentication flow. Sold and operated through Telegram bots, the service gives affiliates phishing templates, email harvesting and reconnaissance features, automated Microsoft API interactions, webmail access, and mailbox triage capabilities. Victims are lured into entering attacker-supplied device codes on Microsoft’s real login page, allowing attackers to capture access and refresh tokens—and in some cases a **Primary Refresh Token**—without stealing passwords or directly defeating MFA. Security teams linked a sharp rise in device code phishing to EvilTokens, describing it as the first known turnkey PhaaS offering dedicated Microsoft device code phishing pages and warning that it lowers the barrier for low-skill operators. More than **1,000 phishing domains** were observed by late March, with campaigns affecting organizations worldwide and notable activity in the United States, Australia, Canada, France, India, Switzerland, and the United Arab Emirates; finance, HR, and transportation/logistics staff were highlighted as frequent targets. Researchers from Sekoia and Mnemonic urged defenders to disable or restrict unnecessary device code flows in **Microsoft Entra ID**, monitor device code grant sign-ins for anomalies, train users on device authentication abuse, and revoke refresh tokens when compromise is suspected.
Jul 3, 2026
A phishing campaign abused Microsoft's OAuth 2.0 **Device Authorization Grant** (`Device Code Flow`) to capture valid Microsoft account tokens without sending victims to a counterfeit login page. Victims received emails posing as legal notifications, including password-protected PDF attachments, and were funneled through phishing pages that displayed a one-time device code before directing them to the legitimate `microsoft.com/devicelogin` page. After victims entered the code and completed normal MFA on Microsoft's real site, the attackers obtained `access_token`, `refresh_token`, and `id_token` values tied to attacker-controlled applications. The stolen tokens enabled persistent access to Microsoft services including **email, OneDrive, and Teams**, allowing attackers to read messages, access files, and monitor conversations. Researchers said the activity was observed from early April to mid-May 2026 and included a Brazil-focused variant that used legitimate redirect links, including on **cacoo.com**, to add credibility to the lure chain. Defenders were urged to reject unexpected device authorization prompts, inspect redirect parameters in otherwise legitimate URLs, disable Device Code Flow in Microsoft Entra ID where it is not needed, and monitor **DeviceCodeSignIn** and anomalous sign-in activity for signs of compromise.
Jul 9, 2026