Loading story…
CISA reported multiple intrusions into organizations’ cloud environments in which attackers exploited weak security configurations, particularly in remote-work settings that mixed corporate and personal devices. The activity included phishing for cloud credentials, brute-force login attempts, abuse of valid accounts, and manipulation of email services after compromise. In several cases, attackers created or modified email forwarding rules to redirect sensitive messages to attacker-controlled accounts, sent phishing emails from internal compromised mailboxes, and concealed security warnings by moving them into RSS-related folders.
The incidents also showed that multi-factor authentication was not always sufficient on its own: some brute-force attempts were blocked by MFA, but at least one account was still accessed, likely through stolen web session cookies in a pass-the-cookie scenario that bypassed MFA checks. U.S. government guidance urged organizations to harden authentication and cloud access controls by enforcing universal MFA, using conditional access policies, reviewing logs for anomalous sign-ins, restricting external email forwarding, blocking legacy authentication, securing exposed remote access services, and improving user awareness to reduce credential theft and session hijacking risks.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
CISA released Analysis Report AR21-013A describing several successful attacks against organizations’ cloud services observed across multiple incident response engagements. The report detailed tactics including credential phishing, use of valid accounts, brute-force attempts, mailbox rule abuse, and likely pass-the-cookie activity, and provided mitigation guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
us-cert.cisa.gov
Open sourcecisa.gov
Open sourcemedia.defense.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Credential compromise** and identity abuse are increasing as attackers rely more on stolen logins, session artifacts, and phishing rather than noisy exploitation alone. Recorded Future reported a sharp rise in exposed credentials during 2025, including nearly **2 billion** credentials indexed from malware combo lists, with the second half of the year up **50%** over the first and Q4 up **90%** over Q1. The trend is being driven by the industrialization of **infostealer malware**, malware-as-a-service ecosystems, and AI-enabled phishing and social engineering, while weak identity governance continues to expand the attack surface. A separate survey of UK organizations found **77%** fail to promptly disable former employees' accounts, **34%** grant overly broad access, and many still use manual processes such as spreadsheets for account validation, creating persistent opportunities for unauthorized access. A targeted phishing attempt against **Outpost24** illustrates how these identity-focused attacks are being operationalized against even security vendors. Attackers used a convincing fake JP Morgan email, valid **DKIM** authentication via Amazon SES infrastructure, and a **seven-stage redirect chain** leveraging trusted brands including Cisco to steer a C-suite executive toward a Microsoft Office credential-harvesting page while evading email defenses. The broader threat environment shows the same shift toward access abuse and stealthier post-compromise tradecraft: Google Threat Intelligence Group found ransomware actors increasingly favor native Windows tools over **Cobalt Strike**, with data theft present in **77%** of incidents and exploitation of VPNs and firewalls still common for initial access. Together, the reporting shows attackers are increasingly **logging in rather than breaking in**, then using legitimate access and built-in tools to deepen compromise and extort victims.
Jun 29, 2026
Recent coverage emphasized that **phishing and social engineering via email** remain a primary initial access vector, with attackers increasingly blending into routine workflows (emails, meeting invites, and trusted SaaS notifications). TechTarget highlighted that user judgment is often the last control when filters fail, citing the *Microsoft Digital Defense Report 2025* claim that **28% of breaches** trace back to phishing/social engineering, and noting reports of spam relayed through **legitimate Zendesk domains/instances** (e.g., leveraging recognizable brands) to bypass filtering and drive credential theft or follow-on access. Separate reporting and guidance reinforced how attackers operationalize these patterns: The Hacker News described **Operation Nomad Leopard**, a spear-phishing campaign targeting Afghan government entities using government-themed decoys and a **GitHub-hosted ISO** that drops a **LNK** to execute a **FALSECUB** backdoor capable of remote command execution. Other items in the set were largely general best-practice or “common threats” explainers (password hygiene, generic threat overviews) rather than incident-specific intelligence, but they align with the same overarching risk theme: weak/reused passwords and routine email behaviors continue to enable account takeover and downstream compromise.
Jun 29, 2026
Microsoft and other security researchers reported multiple campaigns in which attackers abused trusted cloud email environments to deliver phishing, spam, and business email compromise. In one Microsoft 365 intrusion set, attackers used credential stuffing against privileged accounts that lacked MFA, then registered malicious single-tenant OAuth applications with `Exchange.ManageAsApp` and elevated roles to persist in victim tenants. They modified Exchange Online inbound connectors and mail flow rules to relay scam email from legitimate organizational domains, promoting deceptive sweepstakes offers that harvested payment details for recurring subscriptions. Separately, Spamhaus identified more than 450 compromised Google Workspace education domains being used to send phishing and scam messages from real mailboxes, extending the same account-takeover model beyond Microsoft environments. Related reporting showed the same ecosystem of email abuse also supporting credential theft and financial fraud. Microsoft documented AiTM phishing operations using Evilginx2-style infrastructure to steal Office 365 passwords and session cookies, bypass MFA through cookie replay, and then access Outlook mailboxes, create inbox rules, and conduct payment fraud. Other campaigns used voicemail-themed HTML attachments, open redirect chains, Google reCAPTCHA gates, and spoofed Microsoft notifications such as Power BI alerts to harvest credentials at scale. Across the incidents, defenders were urged to enforce phishing-resistant MFA, disable legacy access, review forwarding rules and connected apps, monitor anomalous sign-ins and suspicious mailbox or transport-rule changes, and rapidly investigate compromised accounts being used as trusted sender infrastructure.
Aug 15, 2026