The article describes active campaigns that use familiar business documents, trusted file-sharing services, AI brands, and Microsoft sign-in flows to trick employees into granting account access. The most actionable patterns are phishing emails and document links that lead victims to Microsoft device-code pages or fake DocuSign pages, allowing account takeover without a stolen password.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
“A contract is ready for review.” Sound routine? SkyW4lker uses contract and invoice emails to send you through a CAPTCHA, then to a real Microsoft device-code page. Here’s the catch: the Microsoft page is real. Entering the code can approve someone else’s sign-in, even with MFA. An Adobe Shared Link can lead there, too. If a document asks for a device code, stop. Check with the sender using a contact method you already know.
Microsoft observed real Q3 2026 phishing campaigns that used familiar workplace requests to steal credentials or deliver malware. One campaign targeted legal organizations with personalized salary-review documents containing QR codes, while another used purchase-order and payroll lures in disguised…
Attackers are using real OAuth sign-in and consent flows to steal access tokens or trick users into authorizing malicious apps. Because the victim signs in through a legitimate identity provider and completes MFA, attackers can gain durable access that may survive password resets. The article…
The Skyw4lker campaign targets U.S. manufacturing, technology, and healthcare organizations with password-protected documents disguised as contracts or service proposals. Victims are sent through a Google-hosted page into a legitimate Microsoft authentication process, where completing an…
North Korean-linked attackers reportedly used a fake job opportunity, multiple interviews, and a malicious coding assignment to compromise a Binance engineer. The scheme built trust over weeks before asking the employee to download an interview file, giving attackers a foothold in the company’s…
The report documents how criminals use antidetect browsers to make stolen sessions and phishing logins appear to come from legitimate, local devices. A commercially available Browser-in-the-Middle workflow can relay a victim’s login details to real services such as Google, Microsoft, Facebook, and…
Proofpoint described real campaigns where attackers used highly tailored, AI-style messages to make phishing and payment fraud requests appear routine. Examples included property enquiries that led to malicious meeting invitations, device-code phishing pages disguised as business services, and fake…
