Research reports
1,224 reports from 387 publishers45 added in the past week
7 reports, newest added first
Added Sun 25 Oct
MoqHao Part 1: Identifying Phishing Infrastructure
In mid-January, Twitter users @NaomiSuzuki_ and @KesaGataMe0 identified nearly 20 malicious phishing domains spoofing AEON Bank in Japan. The domains were tied to MoqHao, a malware family targeting Android OS devices, primarily in Japan, South Korea, and…
Phishing
Added Sun 18 Oct
LARVA-208
(EncryptHub) is a threat actor that has come to the forefront with highly sophisticated spear-phishing attacks since 26 June 2024. In the attacks it has carried out, it exhibits a different operational strategy by carrying out all the processes necessary to…
Phishing
Added Fri 16 Oct
Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety
UNC3944 is a financially motivated threat cluster that has persistently used phone-based social engineering and SMS phishing campaigns (smishing) to obtain credentials to gain and escalate access to victim organizations. At least some UNC3944 threat actors…
RansomwareState-sponsoredPhishing
Added Wed 14 Oct
App-Specific Password phishing and how to prevent it
App-Specific Passwords (ASPs) are a way for users to access applications that do not support MFA or are otherwise incompatible with a platform’s standard login workflows. They are intended to enable a user to login to “legacy” (typically desktop) applications…
Phishing
Same Sea, New Phish: Russian Government-Linked Social Engineering Targets App-Specific Passwords
Keir Giles, a prominent expert on Russian information operations, was targeted with a sophisticated and personalized novel social engineering attack. The attacker took extensive measures to avoid raising Mr. Giles’ suspicions, and deceived him into creating…
State-sponsoredPhishing
Added Sat 10 Oct
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that…
State-sponsoredMalwarePhishing
Added Fri 2 Oct
Unmasking EvilTokens: Getting to the root of device code phishing
By Microsoft Threat Intelligence, Microsoft Defender Experts, Microsoft Security Research Following its emergence in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, providing cybercriminals with AI…
Phishing
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.