Deep dives into threat research, security engineering, and the evolving landscape of Microsoft 365 protection.
Secure web gateways inspect traffic. Modern browsers assemble applications. Attackers exploit the difference between what crosses the network and what finally appears, runs, or leaves the device.
IP-based filtering was once a reliable way to control access and block threats. Modern attack patterns have made it a weak anchor. Here is why identity and browser context now carry more weight than the IP address alone.
January 2026 reporting showed attackers skipping lookalike domains entirely and sending phishing that appeared to come from the victim's own organization. The enabling factors were weak mail routing and permissive spoof handling.
A January 2026 campaign abused Microsoft Teams guest invitations to send official-looking billing alerts from legitimate Microsoft infrastructure. The lure did not ask for a click. It asked the victim to call.
January 2026 reporting on a KONNI-linked campaign showed a phishing chain aimed at developers and engineering teams, using project documents, Discord-hosted ZIP files, LNK execution, and an AI-written PowerShell backdoor.
The April 2026 W3LL takedown was not just about one phishing kit. It exposed how credential theft, MFA bypass, stolen accounts, and business email fraud have become a managed marketplace.
A recent payroll-diversion campaign against Canadian employees shows how poisoned search results, adversary-in-the-middle phishing, hidden inbox rules, and HR workflow abuse can turn one login into a stolen paycheck.
Recent VENOM phishing campaigns show why QR phishing keeps evolving. The attack targets executives, renders QR codes from Unicode blocks instead of image files, and moves victims from email to mobile before credential theft begins.
Recent device code phishing campaigns turned a niche device-authorization abuse path into a practical MFA-bypass workflow. The real change is not just better lures. It is that attackers now generate device codes in real time, which makes the attack far easier to scale.
The March 2026 disruption of Tycoon2FA was important, but the bigger takeaway is what the platform proved: session theft and MFA bypass are now available as a subscription service. That changes the scale and economics of enterprise phishing.
TA416's latest campaigns are a useful reminder that state-linked phishing does not stay fixed for long. The group's mission stayed stable, but its delivery chains kept changing, from fake challenge pages to OAuth abuse and newer downloader methods tied to current geopolitical events.
The new Microsoft phishing problem is not just the fake login page. It is the trusted redirect that gets users there. OAuth prompts, consent screens, and legitimate identity-provider hops are now being used as a browser handoff into phishing and adversary-in-the-middle flows.
GhostFrame is a useful wake-up call because it does not just hide phishing behind a new domain or a better lure. It hides the real credential-harvesting experience inside the browser's rendering path, leaving many source-only inspections looking at the wrong thing.
The important change in GenAI-enabled phishing is not better email copy. It is the collapse in time and effort required to produce a convincing login page. Okta's 2025 reporting showed attackers using GenAI web-building tools to generate polished sign-in clones in roughly thirty seconds.
Imagine your CEO receives a perfectly legitimate Microsoft 365 login page. Everything looks normal. They enter their credentials, complete the MFA prompt, and continue with their day.
A sophisticated phishing tactic is gaining traction: attackers are delivering internal-looking emails directly to Microsoft 365 mailboxes, completely bypassing Secure Email Gateways (SEGs) like Proofpoint or Mimecast.
In today's enterprise identity architecture, Okta often acts as the identity provider (IdP) for Microsoft Entra ID federated sign-ins. When a user authenticates through an Okta-integrated browser flow, a session is established and tokens are issued, which are then reused across Microsoft 365 web applications with no additional prompts.
The landscape of phishing and social engineering is shifting. Attackers are moving away from just trying to steal credentials via fake login pages and are increasingly focused on immediate payload delivery. The newest, and particularly insidious, trend is the "ClickFix" attack.
For decades, the corporate approach to cybersecurity has relied on a simple medieval concept: the castle and moat. We build strong perimeter defenses: firewalls, antivirus, and, crucially, Secure Email Gateways (SEGs) to keep the bad things out.
Traditional phishing was simple: send a fake login page, steal a password, log in. Multi-factor authentication (MFA) made that much harder… so attackers evolved. Modern attackers are increasingly using Adversary-in-the-Middle (AiTM) and Browser-in-the-Middle (BitM) techniques.