Credential-Harvesting

Since September 2026, threat actors have leveraged fake Anthropic AI preview invitations, abused legitimate services, and utilized multi-layer CAPTCHA bypasses to harvest Google and Microsoft credentials.

UNC7017 performed an opportunistic supply chain attack by intermittently compromising AOMEI update servers to deliver backdoors, credential-harvesting pop-ups, and remote administration tools to Windows users.

A coordinated disruption action targeting the CoGUI, CoAceV, and CoFish_Ws phishing kits has impacted an ecosystem responsible for billions of malicious messages harvesting credentials and payment data from global organizations.

Microsoft disrupted a Chinese-language cybercriminal ecosystem where Storm-3119 provided illicit cloud infrastructure to Storm-2990, whose phishing kits facilitated large-scale credential theft globally.

Threat actors are using typosquatted domains to harvest WatchGuard VPN credentials via fake portals before delivering legitimate software to maintain victim trust.

Threat actors are using passkey-themed phishing and adversary-in-the-middle attacks to compromise Microsoft cloud accounts, establish persistent access via registered MFA methods, and exfiltrate data via Microsoft Graph API.

Threat actors are increasingly abusing reputable PaaS providers to host multi-stage AitM phishing campaigns that use browser service workers and the Ultraviolet library to intercept credentials and MFA tokens.

The Atomic Arch campaign compromises orphaned Arch User Repository (AUR) packages, modifying their PKGBUILDs to install malicious npm/Bun dependencies like 'atomic-lockfile,' which deploy a Linux payload with credential harvesting, eBPF-based stealth, anti-debugging, and data exfiltration capabilities, impacting approximately 1,500 packages.

Attackers are abusing notification pipelines in SaaS platforms like GitHub and Jira to deliver phishing and spam emails by exploiting legitimate platform features and bypassing traditional email security measures.

Attackers are leveraging AI to rapidly reconnoiter and tailor content for smaller organizations, making it easier to execute business email compromise (BEC) scams and scam smaller sums from many victims, as demonstrated by a recent attack targeting a small community organization.