Loading story…
Attackers are leveraging AI to automate large-scale sign-up fraud and create convincing phishing sites, bypassing improved MFA defenses. In 2024, 46% of all registration attempts on one platform were flagged as fraudulent, with some retail attacks seeing fake sign-ups outnumber legitimate ones by 120:1. Security teams are urged to implement adaptive bot detection, intelligent CAPTCHAs, and move toward passkey-based authentication to mitigate these threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
4 references tracked. Mallory keeps watching after this page renders.
socket.dev
Open sourcescworld.com
Open sourceresilientcyber.io
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Phishing-as-a-service platforms continued to industrialize account takeover operations, with kits such as **Tycoon2FA**, **EvilProxy**, **Sneaky 2FA**, **CryptoChameleon**, **Darcula**, **Evilginx**, and **EvilTokens** enabling attackers to steal credentials, session cookies, MFA responses, payment-card data, and OAuth tokens at scale. Reporting across 2025 and 2026 described more than a million PhaaS attacks in a two-month period, a possible **CryptoChameleon** social-engineering campaign targeting LastPass and cryptocurrency users, and a targeted adversary-in-the-middle campaign against **RBC Express** online banking customers that used malvertising and cloaking to bypass multi-factor authentication. Researchers also documented a shift from fake login pages toward token theft and abuse of legitimate authentication workflows. A July 2026 analysis tied a bulk phishing platform dubbed **Mailer-Go Mission Control** to **EvilTokens** operations abusing Microsoft's OAuth device-code flow, while sector reporting said AiTM phishing had become the top initial access vector for law firms, with **Tycoon2FA** responsible for over half of AiTM-related compromises in that sector during 2025 despite a March 2026 disruption. The combined reporting warned that modern phishing kits lower the barrier to entry with automation, domain management, and real-time victim interaction, and recommended **phishing-resistant MFA** such as FIDO2/WebAuthn, conditional access, managed-device controls, and rapid revocation of compromised sessions and refresh tokens.
Aug 15, 2026
Cybercriminals are increasingly leveraging advanced AI technologies, including large language models (LLMs) and agentic AI, to automate and scale online fraud, abuse, and credential theft campaigns. These AI-driven attacks enable adversaries to craft convincing phishing emails, create fake websites, and even execute deepfake voice or video calls, making it more difficult for organizations to detect and defend against malicious activity. The rise of agentic AI, which can autonomously gather inputs, evaluate options, and take actions such as infiltrating networks and stealing credentials, marks a significant escalation in attacker sophistication and persistence. Recent research highlights a 300% increase in AI-powered bot traffic, complicating the application and API threat landscape and lowering the barrier to entry for cybercriminals through fraud-as-a-service (FaaS) offerings. These developments have led to a surge in digital fraud and abuse, impacting key industries and regions globally. Organizations are advised to adopt AI-driven defenses and maintain regulatory compliance to counteract the growing threat posed by malicious AI bots and automated credential theft campaigns.
Jun 29, 2026
Phishing remains the dominant initial access vector for cyberattacks across Europe, accounting for 60% of incidents between July 2024 and June 2025, as reported by the European Union Agency for Cybersecurity (ENISA). The proliferation of Phishing-as-a-Service (PhaaS) platforms, such as Whisper 2FA, has enabled attackers to automate and scale their operations, targeting a wide range of brands including Microsoft 365, Adobe, and DocuSign. These kits now incorporate advanced features like AJAX-based real-time credential and multi-factor authentication code capture, dense encoding, anti-debugging, and browser freezing to evade detection and analysis. ENISA highlights that AI tools have fundamentally reshaped the threat landscape, with large language models (LLMs) being leveraged to enhance phishing campaigns and automate social engineering, resulting in AI-supported phishing representing over 80% of observed social engineering activity worldwide by early 2025. The report also notes a significant rise in attacks targeting the AI supply chain, with adversaries corrupting components used in AI development and deployment. The sophistication of phishing attacks is further demonstrated by the integration of AI-generated lures, deepfakes, and synthetic media, which are increasingly used in vishing, impersonation, and fraud schemes. The use of AI has not only increased the volume and success rate of phishing campaigns but has also introduced new risks, as AI systems themselves become targets for exploitation. Supply chain attacks have intensified, with threat actors abusing critical digital dependencies to maximize impact, often by targeting customers of compromised organizations. The evolution of phishing tactics is also evident in the widespread adoption of clickbait scams, which use sensationalized headlines and engaging visuals to lure victims into revealing sensitive information or installing malware. Despite increased awareness and training, organizations continue to struggle with the effectiveness of phishing prevention, as attackers adapt their methods to bypass traditional defenses. The ENISA Threat Landscape 2025 report underscores the urgent need for organizations to update their security frameworks, enhance identity and access management, and adopt advanced detection and response strategies to counter the growing threat posed by AI-driven phishing and social engineering attacks. The convergence of AI, automation, and supply chain vulnerabilities has created a complex and rapidly evolving threat environment that demands continuous vigilance and innovation in cybersecurity practices.
Jun 29, 2026