#phishing
-
Microsoft 365 Token-Replay Campaign Hits 79 Organizations
Huntress detailed a campaign in which attackers captured sign-in sessions via an adversary-in-the-middle relay and replayed the stolen tokens, breaking into 97 accounts.
-
Chrome to Warn Users About ClickFix Command Traps
Google is adding ClickFix protection to Chrome: with Enhanced Protection on, the browser spots suspicious clipboard commands and warns users before they run them.
-
Nikkei discloses breach of employee email accounts at Google and Microsoft
The Japanese media group revealed two incidents: attackers accessed two corporate mailboxes and used one of them to send thousands of phishing emails.
-
China's UTA0565 Chains Chrome and Windows Zero-Days to Drop CLEANGULP
The group leaned on a three-flaw exploit chain and fake media and NGO websites to escape the browser sandbox and infect victims with a new backdoor.
-
SynkLoader: New Malware Strikes Through Microsoft Teams Phishing
Researchers at Expel have discovered a previously unknown piece of malware called SynkLoader that steals corporate passwords through a fake Windows lock screen. The attack begins with a message from a bogus IT support desk in Teams.
-
CSS in Emails: How Mail Styling Turns Into Password and Token Theft
PortSwigger researcher Gareth Heyes showed at Black Hat USA 2026 how an email's contents can break out of their bounds and hijack the webmail interface — from Outlook to Gmail and Proton Mail.