Live and recent posts from across the Fediverse tagged #phishingcampaign, aggregated by home.social.
China-linked group targets US AI policy experts with phishing campaign
A cunning phishing campaign impersonated top US AI policy voices, including a former White House science advisor and a renowned economist, to gain the trust of targeted experts. The attackers carefully crafted initial messages that seemed to invite recipients into an AI policy advisory committee or a report collaboration, slowly…
#China #AiPolicy #PhishingCampaign #NationState #EmergingThreats
Hackers Exploit M365 Feature in Targeted Phishing Campaign
KnowBe4's Threat Lab team uncovered a massive phishing campaign, detecting 29,785 confirmed phishing emails that exploited Microsoft 365's Direct Send feature over just two months. The attacks followed a surprisingly human pattern, spiking on Mondays and Tuesdays during US business hours.
#PhishingCampaign #Microsoft365 #M365 #EmergingThreats #DirectSend
Microsoft Warns of Phishing Campaign Using Invisible Unicode to Evade Filters
Microsoft uncovered a massive phishing campaign that sent a whopping 1-2.37 million messages daily on weekdays, peaking on February 26, 2026, and cleverly used invisible Unicode characters to slip past filters. The campaign's weekly rhythm was remarkably consistent, with a sharp drop in activity after May 15, 2026.
#PhishingCampaign #InvisibleUnicode #Microsoft #EmergingThreats #EmailSecurity
US Indicts Russian for Infecting 80,000 Freelancers with Malware
A massive phishing campaign infected 80,000 freelancers with malware, using 255 fake accounts to spread malicious Excel attachments with hidden macros that downloaded additional software onto victims' systems. The cleverly designed scam exploited a popular freelance employment platform's online messaging feature to spread its…
#MalwareOperations #PhishingCampaign #NationState #Russia #EmergingThreats
Mirage2FA is a phishing-as-a-service kit active since 2024 that exploits legitimate Microsoft 365 login flows to bypass 2FA entirely. ANY.RUN research shows 48% of targeted emails were potentially compromised, with the US representing 63.7% of victims.
#Mirage2FA #PhishingCampaign #Microsoft365 #MFAEvade
https://cyberworldops.eu/en/mirage2fa-48-of-microsoft-365-phishing-targets-are-potentially
CTM360 Exposes Global Recruitment Phishing Campaign Using Browser-in-the-Browser Traps
Beware of a sneaky recruitment phishing scam that used fake interview pages and a clever Browser-in-the-Browser trick to steal Google and Facebook credentials from over 3,000 unsuspecting victims in just two months. This cunning attack even fooled multi-factor authentication, putting countless…
#RecruitmentPhishing #Browserinthebrowser #MfaBypass #PhishingCampaign #EmergingThreats
Phishing Campaign Exploits COLDCARD Vulnerability to Install Remote Access Tool
Worried COLDCARD owners are being targeted by a sneaky phishing campaign that masquerades as a security audit, tricking them into installing remote-access software on their Windows machines. Scammers are sending fake emails from a spoofed address, claiming a hardware audit is underway to verify the integrity of…
#Coldcard #PhishingCampaign #RemoteAccessTool #Bitcoin #CryptocurrencyTheft
Phishing Campaign Exploits Microsoft Authentication
Cyber attackers have found a sneaky new way to steal corporate accounts by exploiting Microsoft's authentication process, making it harder to spot fake requests. They've been sending emails that look like Microsoft Teams notifications, leading victims to a legitimate Microsoft URL that tricks them into granting access.
#MicrosoftAuthentication #PhishingCampaign #OauthAbuse #MicrosoftTeams #CorporateAccounts
Phishing Campaign Exploits Font File to Deploy Lua Loader
Beware of a sneaky phishing campaign that's using cleverly disguised font files to deploy a powerful Lua Loader - a stark reminder that security controls can't always trust a file's extension. A recent Fortinet analysis reveals the tactics used by attackers to hide malicious JavaScript payloads in seemingly harmless archives.
#PhishingCampaign #LuaLoader #JavascriptMalware #EmergingThreats #MalwareOperations
Phishing Campaign Exploits eCards to Deploy Legitimate RMM Tools
A massive six-month phishing campaign, dubbed SeasonalInvite, used fake electronic greeting cards to trick victims into installing legitimate remote monitoring and management software on their devices. Over 959 domains were used in this scam, which went undetected from January to June 2026.
#PhishingCampaign #RemoteMonitoringAndManagement #RmmTools #EcardPhishing #Seasonalinvite
FortiGuard Labs Exposes Sophisticated Phishing Campaign Targeting Windows Users
Beware of a sneaky phishing campaign that's targeting Windows users with a multi-stage attack chain, starting with a seemingly harmless email attachment that unleashes a powerful malware. This stealthy threat uses clever tactics like process hollowing to inject malicious code into trusted Windows processes.
Microsoft Uncovers Large-Scale Phishing Campaign Using Fake Compliance Emails
In just 48 hours, a massive phishing campaign targeted over 35,000 users across 13,000 organizations in 26 countries, using convincing fake compliance emails to steal login credentials. The sophisticated attack, detected by Microsoft's Defender Research team, hit US firms hard, but its global…
#PhishingCampaign #CredentialTheft #MicrosoftDefenderResearch #EmergingThreats #LargescaleAttack
Phishing Campaign Exploits Signed RMM Software to Plant Persistent Backdoors
A long-running phishing campaign has compromised over 80 US organizations by using legitimately signed remote monitoring software to install silent, persistent backdoors, according to Securonix research. The attack begins with a clever email impersonating the US Social Security…
#RemoteMonitoringAndManagementSoftware #PhishingCampaign #PersistentBackdoors #Us #SocialSecurityAdministration
Microsoft Exposes Large-Scale Phishing Campaign Targeting 35,000 Users Worldwide
A massive phishing campaign targeting over 35,000 users worldwide has been uncovered, using sophisticated email templates that convincingly masquerade as legitimate internal communications. The highly convincing lures successfully hit organizations across 26 countries, with a staggering 92% of targets…
#PhishingCampaign #CredentialTheft #Healthcare #FinancialServices #ProfessionalServices
Phishing Campaign Exploits Legitimate RMM Tools to Hit 80+ Orgs
A sneaky phishing campaign has infiltrated over 80 organizations, mostly in the US, by exploiting legitimate remote monitoring and management (RMM) tools like SimpleHelp and ScreenConnect. The attackers cleverly used customized versions of these tools, already installed by the victims, to bypass defenses and…
#RemoteMonitoringAndManagement #PhishingCampaign #InitialAccessBroker #Ransomware #Venomoushelper
Google Exposes Microsoft Teams Phishing Campaign Using Custom Snow Malware
Beware of scammers posing as helpdesk heroes! They'll flood your inbox with spam, then reach out on Microsoft Teams with a fake fix that actually steals your password using custom Snow malware.
#MicrosoftTeamsPhishing #CustomSnowMalware #GoogleThreatIntelligenceGroup #Gtig #PhishingCampaign
German prosecutors investigate Signal espionage attack
Germany’s Public Prosecutor’s Office is investigating possible espionage in connection with a phishing campaign targeting German politicians via…
#Germany #DE #Europe #EU #Europa #FederalCourtofJustice #Germanpoliticians #lawenforcementauthority #messagingservice #phishingcampaign #Policevehicles #publicprosecutor'soffice
https://www.europesays.com/germany/7399/
This Punchbowl Phish Is Bypassing 90% Of Email Filters Right Now
997 words, 5 minutes read time.
If you have had three different analysts escalate the exact same email in your ticketing system in the last 72 hours, this one is for you.
This is not a Nigerian prince scam. This is not a fake Amazon order. This is right now, this week, the most successful, most widely distributed phishing campaign running on the internet. And almost nobody is talking about just how good it is.
What this scam actually is
You get an email. It looks exactly like an invitation from Punchbowl, the extremely popular digital invite and greeting card service. There’s no misspelled logo. There’s no broken grammar. There is absolutely nothing that jumps out as fake.
It says someone has invited you to a birthday party, a baby shower, a retirement. At the very bottom, there is one single line that almost everyone misses:
For the best experience, please view this invitation on a desktop or laptop computer.
If you click the link, you do not get an invitation. You get malware. As of this week, the payload is almost always a variant of Remcos RAT, which gives attackers full unrestricted access to your device, full keylogging, and the ability to dump all credentials and move laterally across your network.
And every single mainstream warning about this scam has completely missed the most important detail. That line about the desktop? That is not a throwaway line. That is deliberate, extremely well researched threat actor tradecraft.
Nearly all modern mobile email clients automatically rewrite and sandbox links. Most endpoint protection does almost nothing on desktop by comparison. The attackers know this. They are actively telling you to defeat your own security for them. And it works.
Why this is an absolute nightmare for security teams
Let me give you the numbers that no one is putting in the official advisories:
I have seen CISOs, SOC managers and professional penetration testers all admit publicly this week that they almost clicked this link. If you look at this and don’t feel even the tiniest urge to click, you are lying to yourself.
This is what good phishing looks like. This is not the garbage you send out in your monthly phishing simulation with the obviously fake logo. This is the stuff that actually works.
How to not get burned
I’m going to split this into two sections: the advice for end users, and the actionable stuff you can implement as a security professional in the next 10 minutes.
For everyone
@punchbowl.com. There are no exceptions. If it comes from anywhere else, delete it immediately.For SOC Analysts and Security Teams
These are the steps you can go and implement right now before you finish reading this post:
for the best experience please view this on a desktop or laptop. At time of writing this rule has a 0% false positive rate.Closing Thought
The worst part about this scam is how predictable it is. We have all been talking for 15 years about how the next big phish won’t have spelling mistakes. We all said it will look perfect. It will be something you actually expect. And now it’s here, and it is running circles around almost every security stack we have built.
If you see this email, report it. If you are on shift right now, go push that detection rule. And for the love of god, stop laughing at people who almost clicked it.
Call to Action
If this breakdown helped you think a little clearer about the threats out there, don’t just click away. Subscribe for more no-nonsense security insights, drop a comment with your thoughts or questions, or reach out if there’s a topic you want me to tackle next. Stay sharp out there.
D. Bryan King
Sources
Disclaimer:
The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.
Related Posts
Rate this:
#attackVector #boardroomRisk #breachPrevention #CISAAlert #CISO #credentialTheft #cyberResilience #cyberattack #cybercrime #cybersecurityAwareness #defenseInDepth #desktopOnlyPhishing #detectionRule #DKIM #DMARC #emailFilterBypass #emailGateway #emailHygiene #emailSecurity #emailSecurityGateway #endpointProtection #incidentResponse #indicatorsOfCompromise #initialAccess #IoCs #lateralMovement #linkSafety #logAnalysis #maliciousLink #malware #MITREATTCK #mobileEmailRisk #phishingCampaign #phishingDetection #phishingScam #phishingSimulation #phishingStatistics #PunchbowlPhishing #ransomwarePrecursor #RemcosRAT #sandboxEvasion #securityAlert #SecurityAwarenessTraining #securityBestPractices #securityLeadership #securityMonitoring #securityOperationsCenter #securityStack #SOCAnalyst #socialEngineering #spearPhishing #SPF #suspiciousEmail #T1566001 #threatActor #threatHunting #threatIntelligence #userTraining #zeroTrust
Phishing Attacks in Switzerland: NCSC Reports New Scams Targeting Crypto Users and Seniors https://thecyberexpress.com/targeted-phishing-attacks-hit-swiss-users/ #PhishingAttacksinSwitzerland #FederalTaxAdministration #CyberThreatIntelligence #cybersecurityawareness #TheCyberExpressNews #CryptocurrencyScam #phishingcampaign #TheCyberExpress #CantonofZurich #FirewallDaily #onlinefraud #Switzerland #scamemails #CyberNews
🚨 [Threat Advisory] Android Phishing Campaign: Telegram APKs
- Over 600 typosquatting domains deliver fake Telegram APKs
- Domains host QR codes → redirect to zifeiji[.]asia
- APKs signed using v1 scheme → Janus vulnerability exploited
- Targets Android 5.0–8.0 devices
- Permissions abused for remote access, data theft
- The risk surface is broad. Recommend org-wide mobile policy audits.
#JanusVuln #MobileThreatIntel #PhishingCampaign #InfosecUpdate
PoisonSeed isn't your typical phishing scam—it’s targeting high-value users and their crypto wallets with eerily realistic fake login pages. Think twice about your digital security; this threat may hit closer to home than you expect.
https://thedefendopsdiaries.com/understanding-the-poisonseed-phishing-campaign-a-new-cyber-threat/
#poisonseed
#phishingcampaign
#cybersecurity
#cryptocurrency
#infosectrends
Chinese Hacker Targeted NASA, U.S. Military to Steal Critical Software https://thecyberexpress.com/chinese-hacker-indicted-phishing-campaign/ #U.S.DepartmentofJustice #U.S.aviationagencies #TheCyberExpressNews #phishingcampaign #TheCyberExpress #FirewallDaily #Governance #CyberNews #SongWu #NASA
World Agricultural Cycling Competition Targeted in Large-Scale Phishing Scam https://thecyberexpress.com/world-agricultural-cycling-competition-scam/ #WorldAgriculturalCyclingCompetitionphishing #WorldAgriculturalCyclingCompetitionscam #TheCyberExpressNews #CybersecurityNews #phishingcampaign #TheCyberExpress #FirewallDaily #cyble
Iranian APT42 Group Launch A Massive Phishing Campaign To Attack U.S. Presidential Election https://gbhackers.com/iranian-apt42-phishing-us-election/ #CyberSecurityNews #ElectionSecurity #Phishingcampaign #CyberAttack #Phishing
Analyzing ‘EchoSpoofing’: How Cybercriminals Exploited Proofpoint to Send Millions of Phishing Emails https://thecyberexpress.com/decoding-echospoofing-campaign/ #Proofpointsemailsecurity #EchoSpoofingcampaign #EchoSpoofingexploit #TheCyberExpressNews #CybersecurityNews #phishingcampaign #TheCyberExpress #phishingemails #FirewallDaily #EchoSpoofing
Chinese Citizens Targeted in QR Code-Based Phishing Campaign https://thecyberexpress.com/qr-code-based-phishing-campaign/ #QRCodebasedPhishingcampaign #ThreatIntelligenceNews #TheCyberExpressNews #ThreatIntelligence #CybersecurityNews #phishingcampaign #TheCyberExpress #FirewallDaily #Research #Phishing #QRCode #cyble
Researchers Warn About Phishing Emails That Trick Users Into Pasting Malicious Commands https://thecyberexpress.com/researchers-caution-against-phishing-paste/ #TheCyberExpressNews #CybersecurityNews #PhishingTechnique #phishingcampaign #TheCyberExpress #FirewallDaily #cybersecurity #Cyberattack #PasteandRun #Phishing #AhnLab #Ctrl+V
Belvedere Vodka UK X Account Hijacked in Crypto Phishing Amidst Uniswap-SEC Standoff https://thecyberexpress.com/belvedere-vodka-phishing-scam/ #BelvedereVodkaphishingscam #TheCyberExpressNews #phishingcampaign #TheCyberExpress #FirewallDaily #UniswapandSEC #HackerClaims #UniswapVsSEC
ScrubCrypt used to drop VenomRAT along with many malicious plugins – Source: securityaffairs.com https://ciso2ciso.com/scrubcrypt-used-to-drop-venomrat-along-with-many-malicious-plugins-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #phishingcampaign #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hackingnews #CyberCrime #Cybercrime #hacking
Escalation of Fake E-Shop Campaign Threatens Banking Security in Multiple Regions https://thecyberexpress.com/e-shop-campaign-threaten-banking-security/ #e-shopphishingcampaign #TheCyberExpressNews #fakee-shopcampaign #phishingcampaign #TheCyberExpress #e-shopphishing #FirewallDaily #DarkWebNews
ConnectWise Phishing Scam Targets Healthcare and Crypto Sectors in US https://thecyberexpress.com/screenconnect-vulnerability-exploited/ #ScreenConnectvulnerabilities #ScreenConnectVulnerability #phishingcampaign #TheCyberExpress #FirewallDaily #DarkWebNews
MS Excel Vulnerability Exploited To Distribute Agent Tesla – Source: securityboulevard.com https://ciso2ciso.com/ms-excel-vulnerability-exploited-to-distribute-agent-tesla-source-securityboulevard-com/ #CyberAttacksonSpreadsheets #rssfeedpostgeneratorecho #RemoteAccessTrojan(RAT) #SecurityBloggersNetwork #cybersecuritythreats #MSExcelVulnerability #AdvancedKeylogger #AgentTeslaMalware #CyberSecurityNews #CybersecurityNews #DataSecurityRisks #SecurityBoulevard #ZscalerThreatLabz #phishingcampaign
Hackers Attack Domain Registrar Namecheap; Flood of DHL and Metamask Phishing Emails Follow
https://news.bitcoin.com/hackers-attack-domain-registrar-namecheap-flood-of-dhl-and-metamask-phishing-emails-follow/
#marketingcorrespondence #mnemonicrecoveryphrase #BeehiveCybersecurity #FinancialInformation #third-partyprovider #privateinformation #RichardKirkendall #CustomerAccounts #phishingcampaign #immediateaction #phishingattacks #follow-upemail #KYCinformation #affectedusers #emailaccount
Hackers Attack Domain Registrar Namecheap; Flood of DHL and Metamask Phishing Emails Follow - On Sunday, Feb. 12, 2023, the domain registrar Namecheap’s email account was compr... - https://news.bitcoin.com/hackers-attack-domain-registrar-namecheap-flood-of-dhl-and-metamask-phishing-emails-follow/ #marketingcorrespondence #mnemonicrecoveryphrase #beehivecybersecurity #financialinformation #third-partyprovider #privateinformation #richardkirkendall #customeraccounts #phishingcampaign