Cybersecurity firm Proofpoint said TA419 impersonated officials and AI industry figures in an effort to gain access to cloud accounts held by U.S. think tank, university and…

Microsoft says the cyberespionage campaign has hit U.S. and U.K. targets, relying on sheer volume and requiring only a single victim interaction.

The popular phishing-as-a-service platform used AI throughout the attack chain, allowing cybercriminals to steal tokens for account takeover and business email compromise.

The ongoing social engineering threat, which dates back to late 2025, tricks victims into granting threat actors long-term access to their accounts.

Laundry Bear exploited a zero-day vulnerability for five months before it was patched in November 2025, and the group is still actively exploiting vulnerable environments.

Proofpoint researchers said attackers targeted physics and engineering departments, and warn that the campaign is likely ongoing.

Cisco Talos’ research on ARToken builds on what’s known about the related EvilTokens phishing-as-a-service.

Abdellah Belmili allegedly ran two black-market websites selling stolen financial credentials and custom-built phishing kits targeting major American banks, federal prosecutors say.

Outsider provided phishing kits and infrastructure for cybercriminals to scam victims with lures claiming they missed packages, had unpaid tolls or parking violations.

Check Point said actors are shifting toward campaign systems and AI-generated content, outpacing the public's ability to understand and respond to the risks.