Breakdowns of live phishing campaigns, infostealer operations and MFA bypass techniques — with indicators of compromise and guidance for security teams.
Vishing accounts for 11% of all intrusions and 23% of cloud compromises, where it ranks first. Why email controls do not transfer to the phone, how MFA resets are talked out of the help desk, which caller verification methods hold up, and what to do in the first hour after an incident.
Every major event triggers the same machine: look-alike domains, poisoned search results and an infostealer that takes session cookies along with passwords. The 2026 World Cup as the documented case study, with data, detection and a runbook.
The FBI warned about Kali365, a phishing-as-a-service platform that takes Microsoft 365 tokens without a password. How the PhaaS market works, the affiliate model and the barrier to entry, what the institutions did, and which indicators and hunting queries to wire in on the SOC side.
A five-phase campaign targeting executives across 20+ industries uses adversary-in-the-middle techniques to hijack sessions, rendering MFA ineffective.