#phishing
- News · Sep 7, 2026BigBear hit 258 organizations by disabling WebAuthn in the browser and catching the fallback
CloudSEK got into BigBear 2.0's admin panel: 5,137 credential records, 4,148 session cookies, and completed MFA bypasses at 258 organizations. The kit runs custom JavaScript that disables FIDO2 so victims fall back to a phishable factor.
- News · Aug 14, 2026RecruitTrap ran 3,000 fake recruitment logins with browser-in-the-browser popups and live MFA relay
CTM360 found over 3,000 phishing URLs impersonating recruiters at 50-plus organizations across 14 sectors. The pages fake a browser window, complete with address bar and padlock, and relay MFA codes in real time.
- News · Jul 31, 2026Device code phishing industrialises: 25 kits, and Microsoft counts new campaigns daily
The OAuth device authorization flow built for smart TVs is now a phishing-as-a-service product line. Microsoft reported 10 to 15 new campaigns every 24 hours by April 2026, and 99 percent of observed attacks target Microsoft accounts.
- News · Jul 25, 2026Insurance phishing kits now relay your OTP live instead of just stealing your password
CTM360 found a phishing operation, centered on Saudi Arabia with activity across Europe, the US, and India, using a kit called InsureOTP that authenticates against real insurance portals in real time and relays victims' one-time passcodes before they expire.
- News · Jul 22, 2026Kratos phishing-as-a-service dismantled: 200 servers, 1,800 customers, MFA walked past every time
German, US, and Indonesian authorities took down Kratos (tracked by Microsoft as SneakyLog), a phishing-as-a-service kit that used a Node.js reverse proxy to relay real Microsoft 365 logins and steal the resulting session, walking straight past two-factor authentication.