Rebecca WarrenWhat's happening in email security: July 27 - August 2, 2026
The best phishing this week didn't bother faking anything. Check Point watched attackers walk victims through Microsoft's genuine consent screen, Talos said phishing showed up in more than half of the incidents it worked last quarter, and law firms turned out to be a favorite stop for kits that proxy the login. Add an ad operation borrowing the faces of more than 400 brands, and IBM's finding that the priciest phishing arrives by phone and text.
Phishers stopped faking Microsoft's login page and started using the real one
Check Point published research on July 29 about a campaign that sent more than 200 phishing emails to about 120 organizations between June 25 and the second week of July. The lure looked like a Microsoft Planner notice saying HR had sent three Teams messages about a "Payroll, Compensation + Benefits Update," with a counter of overdue tasks for urgency. The link went to a genuine login.microsoftonline.com OAuth authorize URL. No lookalike domain, no cloned page. The victim was asked to approve permissions for an attacker-controlled app, and once they did, the authorization code or token went to an AWS API Gateway endpoint the attackers controlled.
Check Point put it well, writing that "the only fake thing in this entire chain is the intent behind the app requesting access." Users have been trained to check the URL, the padlock and the branding, and all three pass here. Depending on what was approved, the app could read and send mail and reach files, calendars, Teams, SharePoint and OneDrive, which makes it a BEC platform holding a valid token.
Two follow-ups for your own environment. First, who in your tenant can grant consent to third-party apps. If any user can approve any app, an OAuth grant becomes a credential they can hand over without typing a password, so route consent through admin approval and review which apps were recently granted mail or file access. Second, the sender. The visible sender address belonged to the target's own organization. Check Point doesn't say how that was pulled off, so treat it as a question about your own setup. If a message from outside can show your exact domain in the From line and still land, find out why.
Phishing showed up in more than half of Talos's incident response cases
Cisco Talos published its Q2 incident response trends on July 28, and the headline is blunt. Phishing appeared in over half of Talos IR engagements, up from about a third the quarter before, and Talos calls it the primary means of initial access. Authentication abuse showed up in 65% of engagements, up from 35%. These are cases where someone called in an incident response team, not survey answers.
The campaign worth reading closely is UAT-11764, which began in April and was still running in late June, mainly against Australian organizations. It sends auto-generated PDFs tailored to each victim, each carrying a QR code that leads to a Microsoft 365 credential harvesting page. Once inside, the operators create inbox rules to hide their tracks, host malicious documents on SharePoint and send fresh phishing through the victim's contact lists, so every compromised account becomes the next sender. Talos also describes ARToken, a phishing-as-a-service platform closely linked to EvilTokens, with device code phishing, primary refresh token persistence, BEC tooling and a panel exposing more than 80 API endpoints.
The most useful finding is about something cheap. Unlimited outbound email thresholds let attackers keep the chain going in almost 15% of engagements, and Talos calls fixing that "a low-effort, high-impact mitigation strategy." Put a ceiling on outbound volume per account, alert when someone hits it, and follow Talos's advice to block or flag emails with QR codes inside PDF attachments.
Law firms are now a top target for adversary-in-the-middle phishing
eSentire shared a legal-sector threat report with Infosecurity Magazine, which covered it on July 30, and it reads like a BEC risk assessment for anyone who moves money through outside counsel. Adversary-in-the-middle phishing accounted for 28.57% of initial access events at law firms, the single most common way in, and incidents against legal organizations rose 20% year over year. Tycoon2FA drove 52.3% of AiTM-related legal account compromises across 2025. Microsoft reported last week that the kit's phishing volume was down 92% after a March 2026 takedown led by Microsoft and Europol, but eSentire says its activity quickly returned to early 2026 levels.
The telling number is the low one. Conventional credential theft is rarer at law firms (16.96%) than across industries (26.01%), which eSentire reads as wide MFA adoption. Attackers didn't leave. They switched to kits that proxy the sign-in and leave with a working session. ClickFix lures posing as document viewer, e-filing or court portal errors turned up in 13.39% of legal incidents against 8.77% elsewhere. A day later, The Hacker News covered Blackpoint Cyber research on an intrusion that targeted two endpoints at a law firm, starting with a spear-phishing link to an encrypted archive holding a shortcut disguised as "Case Documents" and ending in a previously undocumented loader and a backdoor.
Law firms hold client funds, settlement instructions and closing details, so a hijacked legal mailbox sends payment changes to people who already trust it. If outside counsel sits in your payment flow, confirm any bank detail change by phone on a number you already have, and ask your firms whether they've moved to the phishing-resistant MFA eSentire recommends.
Scammers borrowed more than 400 brands to sell unlicensed casinos
In research reported on July 28, NordVPN's Threat Intelligence team described a campaign it calls pwa_betterlinks, which impersonates more than 400 well-known brands in paid Facebook and Instagram ads. Google Authenticator, Disney+, Duolingo, Delta Air Lines, Kalshi and several national lotteries are among them. Click an ad and you land on a counterfeit Google Play page that redirects to an unlicensed online casino, and the "app" you install is a Progressive Web App that drops a shortcut on your device and signs you up for gambling push notifications. NordVPN says the setup appears to operate as a commercial affiliate platform, marketed through Betterlinks and used by hundreds of affiliate accounts.
The part brand teams should study is the cloaking. Ad reviewers and automated checkers get a harmless decoy page, and real users get the casino. Researchers counted more than 7,200 instances of casino pages served to users and more than 3,100 decoys shown to checkers. NordVPN CTO Marijus Briedis calls it "trust laundering," and that's exactly right. Your logo does the selling in an ad your own team will probably never see, because the platform's reviewers saw something else. Search the Meta Ad Library for your brand now and then, watch for app store lookalike pages carrying your logo, and give customers one clear place to confirm which apps and domains are really yours.
IBM's breach study says the priciest phishing arrives by phone and text
IBM's 2026 Cost of a Data Breach study put the average breach at a record $4.99 million, up more than a tenth on the year, with US breaches averaging more than twice the global figure. Phishing led all entry points for the fourth year running. The voice and SMS variety carried the highest average cost of any vector, with help desk impersonation next. Mean time to identify and contain rose to 247 days, ending five straight years of decline.
The AI numbers are where it gets interesting. More than one in four organizations hit by a malicious attack say AI drove it, and those breaches cost about $1 million more. Look at what the AI was used for, though. Deepfake impersonation drove close to half of AI-driven attacks, while AI-generated malware was about a fifth. Attackers are spending their AI budget on pretending to be someone, not on writing better code. That puts the best return on the boring checks, a callback number for payment changes, a help desk script that verifies the caller, a domain nobody else can send as. Cheap controls, expensive failures.
- Microsoft pins the hotel Wi-Fi hijacking on a Midnight Blizzard sub-cluster
Following the ReliaQuest research we covered last week, Microsoft attributes the campaign it calls CaptiveCrunch to Storm-2945, an operational sub-cluster of Midnight Blizzard that has manipulated DNS and HTTP traffic on captive-portal networks since early May and, since July 16, sent some guests into device code sign-ins.
- Adobe Campaign Classic patched a CVSS 10.0 code execution flaw
CVE-2026-48449 could allow code execution without user interaction and is fixed, along with a CVSS 8.6 SQL injection (CVE-2026-48448), in ACC v7 7.4.3 build 9398, and since campaign platforms send mail on your domain's behalf they belong on the same patch list as your mail servers.
- A fake bank email is still a reliable way to deliver a keylogger
SANS ISC's Xavier Mertens took apart a "Bank_account_details.rar" attachment whose VBS script kicked off a chain that used AutoIt to inject shellcode into a freshly launched charmap.exe and deliver VIPKeylogger, a good argument for blocking script files inside archives at the gateway.
- Teams help desk calls are feeding a likely ransomware access broker
Zscaler ThreatLabz tracked a likely initial access broker that poses as IT on Teams, gets victims into a Quick Assist session and installs a Go-based backdoor called GoGRPC, likely after spam bombing their inbox first, so a sudden spam flood followed by an external Teams call is worth an alert.
Want email security news in your inbox every week?
Subscribe here and stay up to date with what's happening in email security.