Archive

A phishing campaign is using page variation to generate a different credential-harvesting site on each visit. For defenders, that raises the burden on URL reputation, content-based detection, and user reporting, because simple blocklists and static signatures are less effective.

A threat actor is using PackClient malware in phishing campaigns that imitate tax-related messages. Defenders should treat this as an email-delivered malware threat with possible financial and credential-theft impact, and strengthen filtering, user awareness, and endpoint detection around tax-season lures.

Russian-linked attackers are using zero-click email attacks against organizations, which suggests a phishing-like threat path that does not require a victim to open a message. Defenders should treat this as an email-security and threat-monitoring issue, with emphasis on reducing exposure to silent delivery or account-compromise techniques.

Attackers are using legitimate DocuSign notifications as a lure to capture Microsoft 365 sessions. Defenders should treat this as an identity and email-security problem that can bypass user trust in normal business workflows and lead to account compromise.

Attackers are exploiting Zimbra servers that should already have been patched, which means unaddressed exposure remains in a widely used email platform. Defenders should treat this as a patch verification and incident-response issue, not just a vulnerability notice, because successful compromise can affect mail access, sensitive messages, and downstream identity or phishing abuse.

European Union officials were reportedly targeted in spearphishing attempts attributed to Russia-linked hackers. For defenders, this is an intelligence cue to harden email controls, verify authentication on high-value accounts, and increase monitoring for targeted social engineering against government and policy staff.

Phishing-as-a-service is increasing the scale and accessibility of credential theft and account takeover attempts. For defenders, the main impact is higher exposure on identity controls, email security, and user authentication, which raises the priority of stronger identity security and detection around suspicious login activity.

Attackers are abusing widely used workplace applications, which means defenders need to treat collaboration and email platforms as active attack surfaces, not just productivity tools. The immediate priorities are stronger identity controls, tighter attachment and link filtering, and monitoring for abuse of trusted SaaS and messaging workflows.