EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure,…
Tag: phishing
UK cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites
Used by crims to compromise 12K+ email inboxes across 10K+ global orgs
Deepfake Phishing Attacks: Detection and Prevention Guide
By HOC Team | Updated: September 2026 | Read time: ~18 min A finance manager at a UK…
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus…
Revolut Customers Targeted with New Wave of Phishing Attacks
Following a major data breach, Revolut customers are being sent convincing phishing messages
Hackers Are Using Passkey Updates as a New Microsoft Phishing Hook
Microsoft warns attackers are using passkey and MFA update requests to phish employees, hijack sessions, and access Microsoft 365 data.
ChatGPT Phishing Campaign Targets Both Work and Personal OpenAI Accounts
Threat actors are increasingly impersonating OpenAI’s ChatGPT service in credential-phishing campaigns, exploiting the growing use of generative AI across…
Hackers Use Fake T-Mobile Rewards Expiry Texts to Lure Users to Phishing Sites
A widespread text-message phishing campaign is posing as T-Mobile to pressure customers into visiting fraudulent reward-redemption pages. The messages…
Scammers Tell T-Mobile Users Their Rewards Are Expiring to Trick Them Into Clicking Phishing Links
A large-scale SMS phishing campaign is impersonating T-Mobile and warning recipients that their “rewards points” are about to expire, using fabricated…
Revolut phishing texts appear days after data breach
Revolut customers received phishing texts only days after the digital bank acknowledged disclosing customer data to a government impostor.
T-Mobile rewards points expiry texts are a phishing scam
A large phishing campaign is using fake T-Mobile rewards points and looming expiry dates to pressure recipients into clicking malicious links.
GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds
GhostCode is a newly identified phishing kit that turns a normal Microsoft 365 sign-in into an account takeover. It does not need to steal a password.…
Passkey phishing attack, Anthropic’s blockbuster report, airline cybersecurity loophole
Attackers use passkey phishing to hijack Microsoft cloud accounts Anthropic blockbuster report reveals sophisticated hacks Airlines compliance with new…
Smishing Triad Hackers Use JWR Phishing Kit to Steal Cards, OTPs and Bank Credentials
A large-scale SMS phishing campaign linked to the Smishing Triad is using a sophisticated phishing kit dubbed JWR to harvest payment-card data, one-time…
Phishing Attacks Abuse Trusted Email Infrastructure and URL Cloaking to Evade Security Filters
Phishing operators are increasingly shifting away from malware-laden attachments and toward trusted delivery services, authenticated domains, and…
New Phishing Attacks Use Trusted Email Infrastructure and URL Cloaking to Bypass Security Tools
Phishing is arriving via trusted email systems. Instead of using obvious malicious addresses, attackers send ordinary account alerts, invoices and renewal…
UK Government Enables Passkey Login for 23 Million Users to Fight Phishing Attacks
The UK government has started implementing passkey authentication for GOV. UK One Login,UK One Login, providing over 23 million users with a faster and…
Brevo Breach Sends Trezor Phishing Email to 347,000 Subscribers
A Brevo breach allowed attackers to send Trezor phishing emails to 347,000 subscribers, exposing security risks created by trusted third-party vendors.
Microsoft 365 Passkey Phishing Turns Login Into a Cloud Breach
Microsoft warns that passkey-themed phishing is hijacking Microsoft 365 accounts, adding rogue MFA methods, and slowly stealing business cloud data.
Your Company’s Phishing Tests Are Measuring the Wrong Thing
When a phishing simulation returns a low click rate, security teams tend to relax. Leadership checks a compliance box. The program gets renewed. But a…