A tech commentator argues that while Big Tech companies like Google and Microsoft are aggressively pushing users toward passkeys, the technology trades one security risk for another. Passkeys eliminate phishing by binding logins to a specific site, but because they can't be backed up or transferred between hardware keys, users face a higher chance of losing access entirely if devices are lost or accounts are banned.
hawksley.dev
· 2026-09-18
Google's Threat Intelligence Group disclosed a credential-harvesting operation where attackers compromised cloud infrastructure and deployed a multi-agent AI framework that scanned for vulnerabilities, fixed its own errors, and rotated IP addresses largely without human input. The entire campaign, which compromised thousands of third-party credentials, took less than six hours to execute. Separately, Microsoft found AI-assisted phishing messages reaching click-through rates of 54%, compared to roughly 12% for conventional campaigns.
bleepingcomputer.com
· 2026-09-17
Microsoft researchers uncovered a phishing operation in which an unidentified attacker sent over one million fraudulent emails within three days, each tailored to target accounts payable staff at specific companies. The emails impersonated ServiceNow, demanding nearly $50,000 in fake subscription payments, and included fabricated email threads featuring real executives' names to make the scam appear legitimate.
darkreading.com
· 2026-09-11
Trezor disclosed that hackers who compromised 138 accounts at email marketing provider Brevo used the access to send roughly 347,000 phishing emails to its customers. The messages, disguised as security alerts, directed recipients to a fake app designed to steal their wallet backup passwords. Trezor says its own products and account systems were not breached, but the stolen credentials could let attackers drain victims' crypto holdings.
techcrunch.com
· 2026-09-11
Microsoft has detailed a social engineering campaign, active since May 2026, in which attackers tied to groups like ShinyHunters and Helix pose as corporate IT help desks and warn employees their passkey, MFA, or SSO settings need urgent updating. Victims are steered to convincing fake Microsoft login pages—often via SMS to personal phones—where attackers harvest credentials and session tokens using adversary-in-the-middle and device-code phishing techniques, rather than actually registering new passkeys.
bleepingcomputer.com
· 2026-09-11
Trezor disclosed that a breach at its third-party email provider Brevo let attackers send fake security alerts to its opt-in newsletter subscribers, reaching roughly 347,000 email addresses. The fraudulent messages warned of a fake microcontroller vulnerability and pushed recipients to a malicious app requesting wallet backup phrases; Trezor says 2,500 people clicked the link before it disabled the domain within 20 minutes.
bleepingcomputer.com
· 2026-09-11
Prophet Security analyzed every alert across customer environments from May to July 2026, rather than only alerts analysts chose to escalate. Of the incidents fully investigated, 93% were benign and 7% were confirmed malicious, with identity-related attacks accounting for roughly half of that malicious activity. The firm identified session hijacking, token replay, MFA bypass, credential stuffing, and phishing as the dominant attack patterns.
bleepingcomputer.com
· 2026-09-10
Trezor alerted customers that attackers compromised its third-party email provider and used the legitimate [email protected] address to send phishing emails warning of a fake 'STM32 Entropy Vulnerability' in its hardware wallets. The company took down the malicious domain and is investigating how attackers gained access to its email infrastructure. This follows an earlier breach disclosed in August involving shipping partner ShipMonk, which exposed personal data of roughly 81,000 customers across multiple countries.
bleepingcomputer.com
· 2026-09-10
Attackers are exploiting a chain of legitimate Google services, including redirect links, to disguise malicious URLs and slip past email security filters. Victims who follow the multi-hop links are directed either to credential-harvesting phishing pages or prompted to install ScreenConnect remote access software.
darkreading.com
· 2026-09-08
Security researchers found that a Chinese-speaking threat actor has compromised Brazilian government and education websites, using them as a reverse-proxy network to funnel traffic to gambling-themed phishing sites. The attackers exploit the trust and infrastructure of official domains to disguise malicious traffic and evade detection.
darkreading.com
· 2026-09-08
CloudSEK researchers infiltrated the admin panel of a phishing-as-a-service tool called BigBear 2.0 and found it had harvested over 5,000 Microsoft 365 credentials from 258 organizations. The kit uses an Evilginx2-based adversary-in-the-middle proxy to intercept usernames, passwords, and session cookies even after victims complete multi-factor authentication, letting attackers replay stolen sessions to hijack accounts.
bleepingcomputer.com
· 2026-09-07
Microsoft researchers identified a large phishing operation that inserts invisible Unicode 'Tags' characters inside finance-related keywords—splitting words like 'funding' into fragments—to slip past email filters that scan for suspicious terms. The campaign peaked at 2.37 million daily messages in late February and, despite a drop in volume by May, remains active, with Defender for Office 365 tracing it to 148 finance-themed sender domains.
bleepingcomputer.com
· 2026-09-06
GoKawiil