Loading story…
Q3 2026 phishing campaigns abused trusted email infrastructure, including Amazon Simple Email Service (SES), and DKIM-aligned sender domains to make fraudulent messages pass common authentication checks. The emails used overdue-payment, invoice, antivirus-renewal, and banking/PSD2-consent lures, while hiding malicious or fraudulent content behind multi-stage redirect chains rather than attachments or obviously suspicious initial URLs.
One German invoice-themed campaign used browser fingerprinting, hidden requests, decoy content, iframes, and obfuscated code before redirecting analysis traffic to OpenSea, indicating cloaked crypto or NFT fraud. A separate Romanian operation impersonated BCR S.A., using an IPv6-mapped IP-literal URL and redirects to target banking credentials; defenders should assess the full click path and post-load behavior because SPF, DKIM, and DMARC validate sender authorization, not the legitimacy of the request or final destination.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
In Q3 2026, a Romanian-language phishing campaign impersonated BCR S.A. and claimed that PSD2-consent renewal was needed to avoid restricted banking access. It used the DKIM-aligned but unrelated xmasbrick[.]com domain, an IPv6-mapped IP-literal URL representing 103[.]193[.]179[.]223, and a redirect to web5-4s4c-online-garantibbva[.]vibtee[.]com/ro/; researchers assessed it as credential theft.
In Q3 2026, an antivirus-renewal phishing lure claimed recipients had "631 dangerous viruses," threatened account closure, and offered a discount to create urgency. The flow used 31-59-175-195[.]syd[.]nbn[.]aussiebb[.]net and loadswage[.]com as redirect infrastructure, while eightindigostove[.]com hosted an unsubscribe path.
In Q3 2026, a German-language overdue-payment lure was delivered through Amazon Simple Email Service using the DKIM-aligned moolaah[.]com domain. Its redirect chain used browser and time-zone fingerprinting, decoy content, hidden elements, and obfuscated code before redirecting analysis traffic to opensea[.]io, indicating possible cloaked crypto or NFT fraud.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported a rise in phishing campaigns that abuse Amazon Simple Email Service (**SES**) to deliver convincing messages through trusted cloud infrastructure. The activity is believed to be fueled by exposed AWS Identity and Access Management (**IAM**) access keys discovered in public GitHub repositories, `.env` files, Docker images, backups, and public S3 buckets. After validating stolen credentials—reportedly with automated secret-scanning and access-checking workflows—attackers use SES to send bulk phishing emails that can pass **SPF**, **DKIM**, and **DMARC**, reducing the effectiveness of reputation-based filtering. Observed campaigns included fake **DocuSign** notifications that redirected targets to AWS-hosted credential-harvesting pages, as well as more advanced business email compromise attempts using fabricated email threads and fake invoices. Researchers urged organizations to enforce least-privilege IAM permissions, enable MFA, rotate keys regularly, apply IP-based access restrictions, and strengthen encryption controls around secrets. Amazon said it provides guidance for exposed credentials, responds to abuse reports, and directs suspected misuse of AWS resources to **AWS Trust & Safety**.
Jun 29, 2026
Multiple campaigns are abusing *legitimate* cloud and platform workflows to make phishing and fraud harder to detect. Attackers are generating real Apple and PayPal invoice/dispute emails and embedding scam phone numbers in user-controlled fields (e.g., “seller notes”), resulting in messages that carry valid **DKIM** signatures and originate from high-reputation domains; this “**DKIM replay**” style abuse bypasses many email controls because authentication validates the sender domain, not the safety of the embedded content. In parallel, threat actors are leveraging free **Google Firebase** developer accounts to host brand-mimicking phishing pages on trusted `firebaseapp.com` / `web.app` subdomains, increasing delivery and click-through rates by exploiting domain reputation and common allowlisting of Google infrastructure. A separate but related social-engineering technique targets **Telegram** users by manipulating Telegram’s official authentication workflows to obtain fully authorized sessions rather than simply stealing passwords. Victims are lured to Telegram-lookalike pages (often on ephemeral domains) that prompt QR scanning or phone-number entry; user interaction triggers a real login attempt initiated by the attacker, and once the victim approves the authorization prompt on their device, the attacker gains persistent account access and can pivot to follow-on attacks via the victim’s contacts. These incidents collectively highlight a shift toward “living off trusted services,” where adversaries avoid compromising vendors and instead weaponize legitimate features, trusted domains, and sanctioned authentication flows to reduce detection and increase victim compliance.
Jun 29, 2026
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026