Researchers at Cisco Talos are tracking a significant increase in phishing campaigns that abuse legitimate platforms. Attackers abused more than 25 legitimate services over the past year, including “collaboration, productivity, file-sharing, survey, payment and AI-related platforms.”

In two campaigns, attackers used order notifications from Staples and Dell to distribute phishing messages. The organizations themselves were not compromised, but the threat actors inserted phishing content into the fields that were supposed to contain shipping information.

During an incident, the most valuable intel is from people on the ground. Security teams rely on their colleagues across the organization to report issues quickly and without trying to fix things themselves.

Phishing attacks are increasingly using legitimate calendar invites to bypass security filters, according to researchers at Netcraft. Attackers send ICS calendar invite files that plant phishing lures directly on users’ calendars, often under the guise of work-related meetings.

The U.S. FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have issued joint advisories warning of election-themed scams targeting voters and spear phishing attacks targeting election officials.

Researchers at Malwarebytes warn that job seekers are increasingly vulnerable to scams as AI enables them to take a “spray-and-pray” approach to job applications.

Users who have automated their job application process are more likely to forget where they’ve applied, and an unsolicited message from a recruiter may seem more plausible. Job seekers can also be more willing to overlook or ignore red flags associated with scams, since they’re anxious to avoid missing an opportunity.

Researchers at Malwarebytes warn that a phishing campaign is using spoofed Calendly pages to trick users into handing over their Facebook and Google account credentials. The phishing sites pose as Calendly booking pages for job interviews at Meta, asking users to enter their information to sign up for a phone call with a recruiter.

Researchers at Fortra are tracking a surge in phishing attacks targeting bank accounts via remote monitoring and management (RMM) tools.

A phishing campaign is targeting YouTubers with phony sponsorship offers, according to researchers at ESET. The emails are personalized to each target, making specific references to their channels, and are designed to trick users into granting access to their Google accounts.

In part one of this NIS2 series, we examined why vendor questionnaires fall short and how third-party breaches impact downstream organizations across Europe. But what happens after a supplier containment phase ends? The long-term danger lies in how attackers leverage exfiltrated supplier data to launch hyper-targeted social engineering attacks against an organization’s employees.

"Someone online shows a 'trick' that feels harmless at first. Then the community pulls you in. Everyone's doing it. It feels like skill, not crime."

A young person from South Africa, describing how their peers slide into cybercrime.

91% of Americans have been targeted by a scam, and 17% have fallen victim to one, according to a new survey by Consumer Reports. Notably, 20% of respondents said the latest scam they encountered was personalized, indicating that attackers are increasingly using automation and public or leaked information to craft targeted phishing attacks.

Microsoft is tracking phishing campaigns that use various lures to deliver MSP360, a legitimate RMM tool that attackers are abusing to gain a foothold on compromised systems.

Researchers at ReliaQuest have observed a surge in voice phishing (vishing) and Microsoft Teams phishing over the past several months, particularly from extortion groups like ShinyHunters.

Ransomware attacks involving data theft have surged by 275% in 2026, according to a new report from Zscaler. Attackers exfiltrated more than 896.2 terabytes of data from victim organizations, more than seven times the amount stolen during the 2023–2024 reporting period.

The digital landscape faces a new and complex challenge: the rise of generative AI. While these tools offer incredible potential for innovation, they also provide malicious actors with sophisticated ways to deceive even the most vigilant users.

Researchers at Fortra are tracking a new variant of calendar phishing in which threat actors trick employees into sharing meeting links internally.

The attackers pose as prospective customers and contact non-sales employees, asking to be directed to a sales representative in order to discuss a business opportunity. The attacker then sends the employee a meeting link to forward to a sales contact.

A phishing campaign is targeting Google accounts with lures that promise free subscriptions to Anthropic’s Claude Max AI model, Malwarebytes warns.

Researchers at Netskope are tracking a phishing kit that hijacks users’ browser windows to display fake security alerts. The malicious websites are distributed via Google Ads, and pose as normal online stores. Once a user clicks a link on the page, however, the site will present them with an urgent-looking security warning.

Attackers are continually finding new ways to refine business email compromise (BEC) attacks, according to Douglas McKee, Director of Vulnerability Intelligence at Rapid7.

When attackers compromise trusted tools and accounts, they can manipulate victims’ view of reality. One way attackers can achieve this is through what McKee calls “calendar warfare,” in which attackers use calendar meetings to trick users into falling for attacks.

Spies have always relied on technology, disguises, secret communications and clever gadgets, at least if the movies are to be believed.

But some of the most effective tools in the espionage business have always been people. Convince the right person to open a door, reveal a secret or trust someone they should not, and suddenly bypassing the sophisticated security system becomes unnecessary.