The Town of Whitsett, North Carolina, found unauthorized access to its Microsoft 365 account on October 22, 2026. An unknown party used an official town email account to send a phishing email titled "Ref: Approved Payment Report from Whitsett, NC" and included attachments recipients were told not to open.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A real town email address can still send a phish. On October twenty-second, someone accessed the Town of Whitsett’s Microsoft 365 account. They sent an email titled, ‘Ref: Approved Payment Report from Whitsett, NC,’ with attachments. That’s the trick: the account was genuine, but the message wasn’t. If you weren’t expecting a payment report, the attachment and request to reply are red flags. Don’t open it or reply. Call your known Whitsett contact to check.
Researchers observed a real phishing campaign that abused Microsoft 365’s “Direct Send” feature to deliver messages that looked like they came from trusted internal addresses (HR, accounting, admin). The emails commonly used familiar business lures like invoices, payment approvals, voicemail…
Researchers say the Kazakhstan-linked group “Silent Lynx” has run real espionage campaigns across Central Asia, targeting government bodies and energy organizations. The reported entry method relied heavily on spear‑phishing sent from compromised government email accounts, sometimes using trusted…
A China-linked espionage group (UAT-11587) targeted Asian government and policy organizations using highly tailored phishing emails and realistic decoy documents. After a click, malware ultimately installed the “Antino” backdoor, which then hid its command-and-control traffic inside normal…
Microsoft reports that the Russia-linked group Star Blizzard expanded from highly targeted spear-phishing to larger email campaigns aimed at Ukraine supporters globally. Lures included tax-audit/unpaid-fine notices and fake conference invitations, followed by a password-protected archive that…
Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly…
Microsoft reports that the Russian state-linked actor Star Blizzard ran large-scale phishing campaigns in 2026 that use convincing lures like tax notices, fines, and “closed-door” event invitations. After a victim replies, the attacker sends a password-protected ZIP/RAR attachment that triggers a…
