Breakdowns of live phishing campaigns, infostealer operations and MFA bypass techniques — with indicators of compromise and guidance for security teams.
Vishing accounts for 11% of all intrusions and 23% of cloud compromises, where it ranks first. Why email controls do not transfer to the phone, how MFA resets are talked out of the help desk, which caller verification methods hold up, and what to do in the first hour after an incident.
The FBI warned about Kali365, a phishing-as-a-service platform that takes Microsoft 365 tokens without a password. How the PhaaS market works, the affiliate model and the barrier to entry, what the institutions did, and which indicators and hunting queries to wire in on the SOC side.
A five-phase campaign targeting executives across 20+ industries uses adversary-in-the-middle techniques to hijack sessions, rendering MFA ineffective.