Threat Intelligence

Milk Dragon uses social ads and fake discounts to steal payment details. Learn how the scam works and how brands can disrupt it before it reaches customers.

Explore how Microsoft 365 phishing kits turn everyday requests into session theft, plus the identity controls, investigations, and training that help stop them.

Darcula V3 turns real brand websites into customizable phishing pages. See how its smishing, payment fraud, and evasion tactics shape a practical response.

Bluekit's AI assistant mostly produces placeholders. The real threat is the automation around it: domains, templates, and now browser-in-the-middle logins.

ReliaQuest published the full playbook of a ShinyHunters-linked vishing attempt against its own employees. See what stopped it, what almost didn't, and what defenders can catch earlier.

Device code phishing kits send victims to real Microsoft sign-in pages. See what changed in 2026, what to hunt in Entra, and how to reduce the risk.

Inside BigBear 2.0's live phishing panel, MFA-bypass workflow, affiliate model, and the case for measuring takedown speed over alert volume.

The SSO enrollment phishing kit hosts no branded content of its own. It asks Microsoft for your organization's genuine tenant branding at the moment a victim types their address, so every Microsoft 365 tenant with custom branding is a target at no extra cost to the attacker. Nothing brand-specific reaches a certificate log, and the same page broadcasts every credential it steals to everyone who loads it.

Kali365 is a new phishing kit that steals Microsoft 365 access tokens without harvesting passwords or triggering MFA prompts. Learn how this FBI-highlighted threat abuses legitimate Microsoft authentication workflows—and what security teams must do to stop it.