Executives targeted by Microsoft 365 data theft extortion scheme
Researchers have reported a wave of data theft and extortion attacks targeting executives at US organizations using Microsoft 365 and other SaaS platforms. Attackers impersonate internal IT staff in phone calls, tricking victims into visiting fake authentication sites to steal credentials and MFA approvals. The stolen tokens are used to access company data, which is then exfiltrated before extortion demands are issued. No malware deployment has been observed.
- Attackers impersonate IT via phone calls
- Targets are mainly executive-level employees
- Stolen session tokens used to access data
- Attacks focus on US-based organizations
- No malware observed in these incidents
Sources covering this
In this story
More in Cybersecurity
Google warns of rising attacks on enterprise AI assets
Google Cloud's security team reports that attackers are increasingly targeting enterprise AI systems, including proprietary models, source code, and cloud resources. Threat actors have shifted from using basic AI prompts to deploying automated, multi-agent AI workflows that can execute breaches rapidly, sometimes in under six hours. The report highlights incidents of mass credential theft and the compromise of cloud infrastructure to run unauthorized AI workloads.
OpenAI pledges $1 billion for AI cyber defense program
OpenAI has pledged $1 billion in credits to help organizations defending critical U.S. infrastructure—including water utilities, electric grids, local governments, banks, and nonprofits—access its AI-powered cybersecurity tools, training, and support. The "Daybreak for Frontline Defenders" initiative aims to help these sectors strengthen their defenses as AI-driven cyberattacks become more advanced. OpenAI says it will expand the program to partner countries in the coming weeks.
Browser-based malware campaign targets cryptocurrency users
Cisco Talos reports a criminal campaign targeting cryptocurrency traders by convincing users to paste or install malicious JavaScript in their browsers. The scheme uses Google Sheets and Docs to host and distribute the code, which then intercepts crypto transactions by modifying deposit addresses and displaying fake bonuses. Victims are lured via messages on Telegram, DarkForums, and paste sites, often under the pretext of exploiting a non-existent API vulnerability for profit.
BigBear 2.0 phishing campaign hits Microsoft 365 accounts
Researchers at CloudSEK have identified a phishing-as-a-service campaign called BigBear 2.0 that stole over 5,100 Microsoft 365 credentials from users in at least 40 countries. Attackers obtained session cookies and passwords, allowing them to bypass multifactor authentication in hundreds of cases. IT service providers were among the most targeted organizations, increasing the possibility of broader downstream attacks.