#phishing

ASOS and Dexcom both traced October breaches to people being talked into access, and India will show a network-asserted caller name on calls from November 1. None of it changes the core problem: an MFA reset issues a new credential, so the help desk decides who gets one. How to verify callers with proof instead of knowledge, and why the passkey migration will test it.

Arctic Wolf Labs said on October 26 it analyzed more than 400 incidents where attackers flooded an inbox with spam, then messaged the employee on Microsoft Teams as IT support and talked them into Quick Assist. Some reached code execution within 15 minutes.

October is Cybersecurity Awareness Month. Instead of another poster, here are seven identity habits for every team, each traced to something that actually happened this month: a phone call to a medical device maker, a fake AI ad portal, a national register allegedly opened with 123456, and a VPN password reused once too often.

Huntress reported on October 22 that one actor replayed tokens stolen by AiTM and device-code phishing into 79 organizations between July 14 and September 22, registering rogue Entra devices and swapping MFA methods within hours to survive password resets.

OpenSourceMalware found a fake GitHub security alert that proxied a maintainer's password and 2FA code, then silently completed an OAuth device flow for repo, workflow and read:org scopes. A second stage planted a credential stealer named fa-solid-400.woff2 in 94 repositories.

Cisco Talos tracks UAT-11985, a spear-phishing campaign that lures Taiwan research affiliates with event invitations, then relays their Google passwords and MFA challenges through an adversary-in-the-middle login page.

Island found a human-operated phishing platform posing as AI advertising tools. A browser-in-the-browser Connect window steals Google and Okta credentials while a live operator picks which MFA challenge to show next.

CloudSEK got into BigBear 2.0's admin panel: 5,137 credential records, 4,148 session cookies, and completed MFA bypasses at 258 organizations. The kit runs custom JavaScript that disables FIDO2 so victims fall back to a phishable factor.

CTM360 found over 3,000 phishing URLs impersonating recruiters at 50-plus organizations across 14 sectors. The pages fake a browser window, complete with address bar and padlock, and relay MFA codes in real time.

The OAuth device authorization flow built for smart TVs is now a phishing-as-a-service product line. Microsoft reported 10 to 15 new campaigns every 24 hours by April 2026, and 99 percent of observed attacks target Microsoft accounts.

CTM360 found a phishing operation, centered on Saudi Arabia with activity across Europe, the US, and India, using a kit called InsureOTP that authenticates against real insurance portals in real time and relays victims' one-time passcodes before they expire.

German, US, and Indonesian authorities took down Kratos (tracked by Microsoft as SneakyLog), a phishing-as-a-service kit that used a Node.js reverse proxy to relay real Microsoft 365 logins and steal the resulting session, walking straight past two-factor authentication.