Researchers warn that the Kali365 phishing kit abuses Microsoft device authentication to steal access tokens, putting Microsoft 365 accounts, business data, and cloud resources at risk.
This week’s cybersecurity roundup highlights AI powered attacks, hundreds of Chrome security fixes, SonicWall credential stuffing, DNS hijacking, ransomware campaigns, and emerging malware threats.
A fake website impersonating Dawn published false claims about an AI investment platform while using misleading branding and embedded forms to collect user information.
F6 has uncovered a fraud campaign active since 2017 that uses cloned websites of major Russian companies to steal advance payments from international businesses through fake contracts and banking details.
CERT UA has warned of a phishing campaign by UAC 0099 that uses a fake Notepad++ plugin to deploy MATCHBOIL.V2 malware and establish persistent access on Windows systems.
Kaspersky has introduced AI generated email detection technology in Security for Mail Server to identify sophisticated business email compromise attacks created using large language models across eight languages.
NCCIA has dismantled part of an international phishing syndicate involved in online financial fraud, seizing digital evidence and launching efforts to trace suspects who fled abroad.
German, US, and Indonesian authorities dismantled the Kratos phishing infrastructure used to steal Microsoft 365 sessions, bypass MFA, and target victims across more than 30 countries.
Security researchers have linked the April 2026 DigiCert security incident to a GoldenEyeDog subgroup that allegedly stole code signing certificates and used them to sign malware.
A phishing campaign targeting Punjab DLMIS users has been identified, using a fake driving license application website promoted through Facebook sponsored advertisements to harvest sensitive user information.
