Phishing

Phishing attacks are becoming easier for cybercriminals to launch with ready-made tools that imitate trusted brands and steal sensitive information. On October 14, 2026, Microsoft announced action against three phishing kits known as CoGUI, Haozi and Iron Man System, which were reportedly sold through an underground marketplace.

AI-powered advertising tools are becoming popular with businesses, agencies and freelancers looking for easier ways to manage campaigns. But attackers are now using fake AI advertising portals that imitate well-known services such as ChatGPT, Gemini and Claude to trick users into handing over their login details.

Multi-factor authentication (MFA) remains an important security layer, but it cannot stop every phishing attack. A recent campaign shows how attackers can steal Microsoft login details and session cookies even after a victim completes MFA.

Microsoft has taken down EvilTokens, an AI-powered phishing-as-a-service (PhaaS) platform linked to more than 12,000 compromised email inboxes across 10,000+ organizations worldwide.

AI-powered phishing, fake invoices and passkey attacks are targeting businesses. Learn how organizations can strengthen cybersecurity against identity and data theft.

Hackers are poisoning Google and Bing results with cloaked banking phishing pages designed to steal credentials. Learn how users can stay protected.

NetProtector researchers uncovered a Japan-India Summit themed phishing campaign using malicious LNK files, PowerShell, and C2 beaconing to target diplomatic and government organizations.

AI-generated phishing attacks can steal browser sessions and bypass MFA without malware. Learn how AiTM attacks target session tokens and how businesses can improve security.

Law enforcement dismantled the Kratos phishing kit used to steal Microsoft 365 sessions and bypass MFA. Learn how to protect your organization from advanced phishing attacks.

Google has filed a lawsuit against an alleged cybercrime network linked to 9,000 fake websites and over one million phishing URLs used to steal user credentials and financial data.