“Is it real?” has become a common question across our digital lives thanks to the rise of AI-generated content.

Researchers at Cisco Talos are tracking a significant increase in phishing campaigns that abuse legitimate platforms. Attackers abused more than 25 legitimate services over the past year, including “collaboration, productivity, file-sharing, survey, payment and AI-related platforms.”

In two campaigns, attackers used order notifications from Staples and Dell to distribute phishing messages. The organizations themselves were not compromised, but the threat actors inserted phishing content into the fields that were supposed to contain shipping information.

Researchers at Fortra are tracking a surge in phishing attacks targeting bank accounts via remote monitoring and management (RMM) tools.

The third quarter of 2026 saw the highest number of ransomware attacks to date, with 2,627 total attacks, according to a new report from Comparitech.

Microsoft is tracking phishing campaigns that use various lures to deliver MSP360, a legitimate RMM tool that attackers are abusing to gain a foothold on compromised systems.

Lead Analysts: Karthikeyan D, Prabhakaran Ravichandhiran, Jeewan Singh Jalal

Researchers at Fortra are tracking a new variant of calendar phishing in which threat actors trick employees into sharing meeting links internally.

The attackers pose as prospective customers and contact non-sales employees, asking to be directed to a sales representative in order to discuss a business opportunity. The attacker then sends the employee a meeting link to forward to a sales contact.

Researchers at Netskope are tracking a phishing kit that hijacks users’ browser windows to display fake security alerts. The malicious websites are distributed via Google Ads, and pose as normal online stores. Once a user clicks a link on the page, however, the site will present them with an urgent-looking security warning.

Attackers are continually finding new ways to refine business email compromise (BEC) attacks, according to Douglas McKee, Director of Vulnerability Intelligence at Rapid7.

When attackers compromise trusted tools and accounts, they can manipulate victims’ view of reality. One way attackers can achieve this is through what McKee calls “calendar warfare,” in which attackers use calendar meetings to trick users into falling for attacks.

Let’s face it: inertia is often the most common yet most dangerous adversary when it comes to acquiring new technology, especially in cybersecurity.

China-based cybercriminals are using a sophisticated phishing-as-a-service platform called the “Outsider Phishing Kit” to launch massive phishing campaigns around the world, according to researchers at Group-IB.

Lead Analysts: Shikhar Dalela, Maddhav Grandy and Jeewan Singh Jalal

Attackers have used a new phishing platform called “BigBear 2.0” to target hundreds of organizations across more than forty countries, according to researchers at CloudSEK. In about 10% of cases, the phishing attacks were able to bypass multifactor authentication.

Researchers at Microsoft are tracking a social engineering campaign that uses passkey-themed lures to trick users into granting persistent access to their accounts and online work environments.

Threat actors are using phishing emails with blank SMTP sender fields to bypass Microsoft 365 security filters, according to researchers at ReliaQuest.

Microsoft 365 Exchange Online uses a feature called “RejectDirectSend” to block unauthenticated Direct Send emails from an organization’s trusted domain. If an attacker omits the domain field from these emails, however, RejectDirectSend will no longer block the messages. Attackers can therefore exploit this technique to impersonate internal users.

Researchers at Gen Digital are tracking a sophisticated social engineering campaign that’s using phony NDA documents to trick employees into moving the conversation to WhatsApp and personal email accounts. The attackers targeted an employee at Gen itself, but the employee recognized that it was a scam and played along to see what the attackers would do.

Threat actors are increasingly leveraging AI hallucinations to plant phishing links and other malicious content in AI output, IEEE Spectrum reports. Large language models (LLMs) sometimes fabricate information, including web domains, when answering users’ questions. Attackers are registering these hallucinated web domains to host phishing pages.

Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal

Cloaked SEO poisoning attacks surged by 40% in the second quarter of 2026, according to researchers at Fortra. This tactic, also known as “Chameleon SEO poisoning,” uses cloaked search engine results to spread phishing sites.

Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal, Karthikeyan Dharmaraj and Sripathi Kumar