Loading story…
Cisco Talos Incident Response reported that phishing became the leading initial access vector in more than half of investigated incidents, with authentication abuse rising to 65% of cases. The firm highlighted an ongoing QR-code phishing campaign attributed to UAT-11764 that targeted mainly Australian organizations using compromised Microsoft 365 accounts, tailored PDF attachments, and SharePoint- or other trusted cloud-hosted credential harvesting pages. After stealing credentials, the attackers accessed victim inboxes, created inbox rules to evade detection, and used the compromised accounts to spread additional phishing internally and externally.
Talos also warned that phishing-as-a-service platforms such as ARToken are expanding attacker capabilities with device-code phishing, token abuse, OAuth device authorization flow abuse, persistent access via Primary Refresh Tokens, business email compromise, and SharePoint data exfiltration. In ransomware and pre-ransomware cases, including Sinobi and Warlock activity, operators maintained stealthy access by abusing legitimate remote management tools such as a trojanized MeshAgent binary and Zoho Assist. Healthcare was the most targeted sector, and Talos urged organizations to deploy phishing-resistant MFA, improve logging, patch exposed systems faster, and limit outbound email rates to reduce propagation.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
On July 28, 2026, Cisco Talos Incident Response published its Q2 2026 trends report covering incidents from March to June 2026. The report said phishing was the leading initial access vector in just over half of engagements, authentication abuse rose to 65 percent of cases, and ransomware/pre-ransomware made up over 20 percent of engagements.
Talos reported that the UAT-11764 QR-code phishing campaign was still ongoing as of late June 2026. After stealing credentials, the actor accessed victim inboxes, created inbox rules for evasion, and sent additional phishing messages from compromised accounts using trusted services such as SharePoint and Microsoft 365.
In an April engagement, Cisco Talos Incident Response observed Sinobi ransomware actors using a trojanized MeshAgent binary for command and control. The attackers maintained access for about three days, moved laterally via RDP and WinRM, staged exfiltration with rclone, and deployed ransomware domain-wide via a malicious Group Policy Object logon script.
Cisco Talos said a persistent QR-code phishing campaign began in April 2026, primarily targeting Australian organizations. The operation used compromised Microsoft 365 accounts and victim-tailored PDF attachments with QR codes leading to credential-harvesting pages.
During a Q2 2026 engagement, Talos uncovered the ARToken phishing-as-a-service platform and found it closely linked to EvilTokens. Talos said the platform exposed more than 80 API endpoints and supported device-code phishing, token abuse, business email compromise, SharePoint exfiltration, and other post-compromise functions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourceinfosecurity-magazine.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports highlight **social engineering and phishing** as primary initial-access vectors, with attackers increasingly targeting **identity systems** rather than exploiting software vulnerabilities. Microsoft was again the most spoofed brand in phishing during Q4 2025 (22% of observed brand-impersonation attempts), reflecting how attackers abuse trust in major identity and productivity platforms to harvest credentials; examples cited include lures mimicking Netflix account recovery, Roblox-related pages, and Spanish-language Facebook scams. Separately, an incident response case described payroll fraud achieved without malware or a network breach: an attacker impersonated employees to help desks, reset passwords, re-enrolled MFA, and registered an external email as an authentication method in **Azure Active Directory**, then altered direct-deposit details to redirect paychecks—underscoring how **help-desk processes and MFA reset workflows** can be exploited for persistence and financial theft. Targeted campaigns also show continued evolution in delivery tradecraft for **remote access**. A spear-phishing operation against Argentina’s judicial sector used ZIP attachments containing a weaponized Windows shortcut (`.lnk`) masquerading as a PDF plus scripts and a decoy court document to deploy a **Remote Access Trojan** while minimizing user suspicion. In parallel, research described **Pulsar RAT** (a Quasar RAT derivative) emphasizing stealth via **memory-only execution** and **HVNC**, with TLS-encrypted C2 and configuration retrieval from public paste sites, alongside persistence mechanisms such as scheduled tasks and UAC-bypass techniques. Another campaign attributed to **Konni APT** (“Operation Poseidon”) abused **Google and Naver ad redirection** (e.g., `ad.doubleclick[.]net`, `mkt.naver[.]com`) to launder clicks through trusted ad infrastructure before landing victims on compromised sites hosting malware, demonstrating how open-redirect and ad-tech trust can bypass reputation-based controls.
Jun 29, 2026
Huntress investigated three phishing-led intrusions in which attackers abused legitimate remote monitoring and management (RMM) tools to gain persistent access. One campaign used a TransferXL-hosted ZIP archive and malicious PDF lure to prompt installation of **ITarian**, then deployed **ScreenConnect**; two others used fraudulent document-sharing emails branded as ScreenConnect to install multiple ScreenConnect clients. The attackers configured rogue RMM agents for `SYSTEM`-level persistence, created redundant remote-access channels, and used defense-evasion tooling including `HideUL_x64.exe`. Huntress reported RMM abuse rose **277%** during 2025 and appeared in nearly 40% of incidents investigated by its Tactical Response team, underscoring the need to restrict, inventory, and monitor authorized remote-management software.
Sep 23, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026