Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal

The lure email has been received. This is a fabricated iCloud sign-in alert designed to feel like an official security notification, complete with a fake reference number and a display link that resolves to Apple's own domain."

Most phishing attacks pick a target and commit to a tactic. This one picks the tactic based on the target, which happens dynamically, per device, in milliseconds, without the victim ever knowing a decision was made.

Ransomware and phishing have always been linked, but the old model was blunt: a phishing email carried the payload, the recipient opened it, encryption followed within hours.

Lead Analysts: Jeewan Singh Jalal and Louis Tiley

KnowBe4 ThreatLabs tracked phishing campaign activity from the first week of April through June 22, 2026 — covering the pre-tournament build-up, tournament kickoff and the first twelve days of live match play. Our latest intelligence adds crucial mid-tournament telemetry (June 15-22), a newly identified reply-back campaign track and additional infrastructure intelligence.