Researchers at Cisco Talos are tracking a significant increase in phishing campaigns that abuse legitimate platforms. Attackers abused more than 25 legitimate services over the past year, including “collaboration, productivity, file-sharing, survey, payment and AI-related platforms.”

In two campaigns, attackers used order notifications from Staples and Dell to distribute phishing messages. The organizations themselves were not compromised, but the threat actors inserted phishing content into the fields that were supposed to contain shipping information.

Phishing attacks are increasingly using legitimate calendar invites to bypass security filters, according to researchers at Netcraft. Attackers send ICS calendar invite files that plant phishing lures directly on users’ calendars, often under the guise of work-related meetings.

As organizations across Africa adopt AI, automated tools and autonomous systems, the digital threat landscape is changing rapidly. Traditional security awareness training historically focused on bridging knowledge gaps, but today's most urgent challenges are fundamentally behavioral, and they involve more than just human employees.

I want to start with a confession that most security leaders will recognize but few will say out loud: almost everyone reuses passwords. Not the reckless or the untrained. Everyone including, if we are honest, a fair number of people in our own profession.

"Someone online shows a 'trick' that feels harmless at first. Then the community pulls you in. Everyone's doing it. It feels like skill, not crime."

A young person from South Africa, describing how their peers slide into cybercrime.

Microsoft is tracking phishing campaigns that use various lures to deliver MSP360, a legitimate RMM tool that attackers are abusing to gain a foothold on compromised systems.

Lead Analysts: Karthikeyan D, Prabhakaran Ravichandhiran, Jeewan Singh Jalal

41% of CISOs said an audio deepfake targeted their organization within the last 12 months, according to a new survey by Gartner. Additionally, 36% of respondents said employees were targeted by deepfake video calls over the past year.

Craig Porter, Director Analyst at Gartner, noted that social engineering and human deception remain at the core of these AI-assisted attacks.

Agent Risk Manager, KnowBe4’s AI agent security product in the KnowBe4 Platform, integrates with the Claude Compliance API to help organizations monitor Claude activity and detect risks in real time.

Let’s face it: inertia is often the most common yet most dangerous adversary when it comes to acquiring new technology, especially in cybersecurity.

Scammers are using AI to generate phishing pages that impersonate antivirus products, according to Malwarebytes.

China-based cybercriminals are using a sophisticated phishing-as-a-service platform called the “Outsider Phishing Kit” to launch massive phishing campaigns around the world, according to researchers at Group-IB.

Lead Analysts: Shikhar Dalela, Maddhav Grandy and Jeewan Singh Jalal

Quantum Readiness Day on September 24 is a useful reminder that the security work we do today is not only about preventing breaches tomorrow. It is about protecting data and digital trust for years to come.

A massive phishing campaign is using invisible Unicode tag characters to evade security filters, according to researchers at Microsoft. This technique, known as “ASCII smuggling,” has grown popular over the past year for launching AI prompt injection attacks, but the same tactic can hide suspicious text in emails.

Attackers have used a new phishing platform called “BigBear 2.0” to target hundreds of organizations across more than forty countries, according to researchers at CloudSEK. In about 10% of cases, the phishing attacks were able to bypass multifactor authentication.

Researchers at Microsoft are tracking a social engineering campaign that uses passkey-themed lures to trick users into granting persistent access to their accounts and online work environments.

Threat actors are using phishing emails with blank SMTP sender fields to bypass Microsoft 365 security filters, according to researchers at ReliaQuest.

Microsoft 365 Exchange Online uses a feature called “RejectDirectSend” to block unauthenticated Direct Send emails from an organization’s trusted domain. If an attacker omits the domain field from these emails, however, RejectDirectSend will no longer block the messages. Attackers can therefore exploit this technique to impersonate internal users.

Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal

Quantum Readiness Day on 24 September is a useful reminder that the security work we do today is not only about preventing breaches tomorrow. It is about protecting data and digital trust for years to come.