Latest News About Phishing

Here's a concise update on the latest phishing news as of now.

• FBI warns of Kali365 phishing service targeting Microsoft 365 accounts (phishing-as-a-service that abuses OAuth device code authentication to steal session tokens and bypass MFA). This indicates attackers increasingly rely on PhaaS to monetize credential theft, raising the bar for defense in corporate environments.[2]
• ATHR vishing platform uses AI voice agents for automated credential harvesting via social-engineering calls, signaling a rise in AI-powered voice phishing alongside traditional methods.[2]
• W3LL phishing service takedown: US and Indonesian authorities dismantled a global phishing platform, marking a notable law-enforcement action against phishing infrastructure in 2026.[2]
• General trend: phishing activity, including AI-assisted campaigns and credential theft via legitimate-looking OAuth flows, continues to rise, with reports noting spikes in phishing sophistication and scale.[10][2]

If you’d like, I can tailor a quick security briefing for your organization or provide practical defenses (email filtering rules, MFA recommendations, user training prompts, and detection indicators) and cite specific sources after I fetch them.