Check Point researchers identified a large credential-phishing campaign that used counterfeit calendar invitations to send people to fake Microsoft sign-in pages. The campaign used calendar attachments and deceptive meeting links, and targeted more than 40,000 organizations with over 302,000 phishing emails.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
That unexpected meeting invite? It could be a Microsoft login trap. It says, ‘You have been invited to a meeting.’ Open the calendar attachment or click the meeting link, and a fake Microsoft sign-in page asks for your password. Here’s the giveaway: you expected meeting details, not a login. Check Point found over 302,000 phishing emails targeting more than 40,000 organizations. Unexpected invite asking you to sign in? Skip that link. Open your trusted calendar app to check the meeting.
Proofpoint described real campaigns where attackers used highly tailored, AI-style messages to make phishing and payment fraud requests appear routine. Examples included property enquiries that led to malicious meeting invitations, device-code phishing pages disguised as business services, and fake…
Attackers are using real OAuth sign-in and consent flows to steal access tokens or trick users into authorizing malicious apps. Because the victim signs in through a legitimate identity provider and completes MFA, attackers can gain durable access that may survive password resets. The article…
Threat actors are hijacking existing email conversations, or patiently starting new ones, to build trust before sending a malicious reply. The final message commonly poses as a meeting invitation, secure message, shared file, or important document and leads to credential theft or remote-access…
Cofense analyzed real phishing emails disguised as bidding invitations. The emails send recipients to fake, branded login and device-enrollment pages, then trick them into entering a device code in a genuine Microsoft prompt. Doing so can authorize an attacker’s session without giving them the…
Attackers broke into the email account of a CDU Heilbronn district executive and used the trusted mailbox to send roughly 6,500 fake messages. The emails used an event invitation as a lure and directed recipients to a link for a supposed document, making this a credible internal-email phishing…
Russian-linked group UAC-0099 reportedly used a phishing email with a malicious attachment to enter the network of an unnamed Ukrainian grain logistics company. Researchers believe the group then handed access to Sandworm, which carried out a data-wiping attack two months later, disrupting the…
