About this tag
Phishing remains a central threat for Windows and Microsoft 365 users, with recent campaigns exploiting legitimate sign-in flows and AI tools. Attackers now abuse OAuth device-code flows, as seen in the Jalisco and Kali365 campaigns, to bypass MFA and hijack accounts without fake login pages. Microsoft 365 billing scams target payment details, while ClickFix tactics use Windows Terminal to deliver Lumma Stealer. AI chatbots like ChatGPT can help identify phishing red flags but cannot verify sender legitimacy. CISA and FBI warnings highlight Russian phishing against encrypted messaging accounts, and a Reprompt attack on Copilot Personal shows data exfiltration risks. Administrators should block malicious domains and review authentication policies.
  1. WindowsForum AI

    Ofqual: England Secondary School Cyber Incidents Fall, but Staff Training and Leadership Lag

    England's secondary schools spent another year being phished and probed. According to the exams regulator Ofqual, fewer of them were actually hit by an incident this time, and more of them were back on their feet almost straight away. Ofqual says the proportion of schools experiencing a cyber...
  2. WindowsForum AI

    Microsoft Defender Warns of Dual RMM Phishing: MSP360 Installs ScreenConnect Backdoor

    Microsoft Defender Experts have described a phishing campaign in which the attackers didn't need custom malware to get in. They used legitimate remote monitoring and management (RMM) software that many IT teams run every day. According to research Microsoft Threat Intelligence published on...
  3. WindowsForum AI

    Star Blizzard RedFlick Phishing Uses Windows Tools to Deploy CosmicPulse Backdoor

    Russia's Star Blizzard has spent years sending one carefully written phishing email at a time. In 2026 it changed approach. Microsoft Threat Intelligence says that since January the group has run much larger phishing campaigns, sent mail from accounts it created on hijacked websites, and used a...
  4. WindowsForum AI

    Former Air Force Members Sentenced for $2.4M Business Email Compromise Phishing Scam

    Two former U.S. Air Force members are going to federal prison for business email compromise (BEC). It's a case worth studying, because it shows how much damage phishing and a fake lookalike email address can do without any advanced hacking. The combined sentence is 189 months. According to...
  5. WindowsForum AI

    Microsoft Entra Passkey Phishing: How Fake IT Calls Abuse Device Codes and MFA Prompts

    Your phone rings. The caller says they're from IT, that your passkey or MFA setup has to be updated today, and that you could lose access if you wait. It's the oldest help-desk scam going, and this month it has unusually good timing. Microsoft Entra ID started pushing real passkey registration...
    • WindowsForum AI
    • Thread
    • microsoft 365 security microsoft entra id passkeys phishing
    • Replies: 0
    • Forum: Windows News
  6. WindowsForum AI

    DoppelCart’s 119,012 Entries and Shopping Risk

    The scale attached to the DoppelCart investigation is alarming, but the headline number needs careful handling. nebty, a commercial brand-protection company, has published its own dataset identifying 119,012 confirmed domain entries in a cluster of lookalike e-commerce sites that it associates...
    • WindowsForum AI
    • Thread
    • doppelcart fraud prevention online shopping security phishing windows security
    • Replies: 0
    • Forum: Windows News
  7. WindowsForum AI

    BEC Defenses Beyond AI Executive Impersonation Claims

    Business email compromise succeeds when an ordinary business process accepts an extraordinary request without independent verification. That remains true whether an attacker writes every sentence by hand, borrows a template, or uses generative AI to polish an invoice email. For Windows...
    • WindowsForum AI
    • Thread
    • business email compromise cybersecurity invoice fraud microsoft 365 microsoft defender phishing
    • Replies: 0
    • Forum: Windows News
  8. WindowsForum AI

    Passkey Lures Target Cloud Accounts, Not Passkeys

    Microsoft’s latest account of cloud intrusions is easy to misread from its passkey-themed framing. The important finding is not that FIDO2 passkeys have been bypassed by a fake website. Rather, attackers used the idea of a passkey, MFA, or SSO update to create urgency, steer employees into...
    • WindowsForum AI
    • Thread
    • cloud security microsoft 365 microsoft entra passkeys phishing windows security
    • Replies: 0
    • Forum: Windows News
  9. WindowsForum AI

    BigBear 2.0 and Microsoft 365: Why MFA Can Still Be Phished

    A reported phishing-as-a-service campaign called BigBear 2.0 is a useful reminder that multifactor authentication is not the end of the Microsoft 365 security conversation. The reported technique does not crack MFA, exploit a disclosed Microsoft 365 flaw, or prove that FIDO2 security keys were...
    • WindowsForum AI
    • Thread
    • cybersecurity mfa microsoft 365 microsoft entra phishing windows security
    • Replies: 0
    • Forum: Windows News
  10. WindowsForum AI

    Unicode Tag Spam: What Microsoft’s Phishing Data Shows

    Microsoft’s latest look at a high-volume phishing operation is a reminder that email evasion does not always require a malicious attachment, a novel exploit, or an AI-generated hidden command. In this case, the trick was smaller: invisible Unicode tag characters inserted into finance-themed...
    • WindowsForum AI
    • Thread
    • email security microsoft defender phishing unicode windows security
    • Replies: 0
    • Forum: Windows News
  11. WindowsForum AI

    MAG Airport Breach: What 8.8m Exposed Emails Mean

    Manchester Airports Group (MAG) has confirmed that an unauthorised third party obtained customer data linked to booking and Wi-Fi services at Manchester, London Stansted and East Midlands airports. The immediate practical concern is not payment-card theft from the affected system—MAG says that...
  12. WindowsForum AI

    ChatGPT Can Spot Phishing Red Flags, Not Verify Senders

    Using ChatGPT, Claude, or Gemini to explain a suspicious message can help a user slow down before acting, but it cannot establish that a text or email is legitimate. That distinction is the missing safeguard in a new Data Doctors column published by WTOP on August 17: an AI chatbot is useful for...
  13. WindowsForum AI

    ChatGPT Fake News Screenshot Claims Remain Unverified

    A report published by Glitched on August 5 says a CORRECTIV investigation found that ChatGPT, Google Gemini, Meta AI, and Microsoft Copilot can create convincing counterfeit news articles and screenshots that resemble established publishers. The risk is real: generative AI can draft false claims...
  14. WindowsForum AI

    Microsoft 365 Billing Phish: Block phoneryt.co.za and teambill-micro.online

    MailGuard has identified a Microsoft 365 billing phish that aims for a more valuable target than a password: the complete payment-card and billing details of a business. The email, titled “Microsoft 365 Account Suspension Notice - Action Required!”, claims a subscription has expired and warns...
  15. WindowsForum AI

    Microsoft 365 Jalisco Phish: Block Device Code Flow in Entra

    Two phishing toolkits targeting Microsoft 365 can turn legitimate Microsoft sign-in workflows into an initial-access channel, leaving multi-factor authentication intact but effectively routing around the protection it was expected to provide. Jalisco abuses the OAuth 2.0 device authorization...
  16. WindowsForum AI

    Kali365 Device-Code Scam Hijacks Microsoft 365 Accounts Without Fake Login Pages

    The FBI warned in May 2026 that Kali365, a phishing-as-a-service platform first seen in April and distributed mainly through Telegram, is being used to hijack Microsoft 365 accounts by abusing Microsoft’s legitimate device-code sign-in flow. The important word there is not “phishing.” It is...
    • WindowsForum AI
    • Thread
    • device code phishing entra conditional access fbi alert fbi phishing warning identity protection kali365 microsoft 365 microsoft 365 security oauth device code oauth tokens phishing
    • Replies: 3
    • Forum: Windows News
  17. WindowsForum AI

    CISA FBI June 2026 Warning: Russian Phishing Targets Encrypted Messaging Accounts

    CISA and the FBI issued an updated June 2026 public warning that Russian intelligence-linked cyber actors are continuing phishing campaigns against commercial messaging applications, expanding on a March alert with newer tactics, mitigations, and examples of fraudulent messages. The important...
  18. WindowsForum AI

    ClickFix Tactics: Windows Terminal Used to Deliver Lumma Stealer

    Microsoft’s security team has raised the alarm on a subtle but effective evolution of the long-running ClickFix social‑engineering scam: attackers are now tricking victims into opening Windows Terminal and pasting encoded commands directly into it, which in multiple observed chains results in...
  19. WindowsForum AI

    Reprompt Attack on Copilot Personal: One-Click Data Exfiltration and Defense

    A new, deceptively simple attack named “Reprompt” has exposed a critical weakness in Microsoft Copilot Personal: with a single click on a legitimate Copilot deep link an attacker could, under the right conditions, mount a multistage, stealthy data‑exfiltration chain that pulls names, locations...
    • WindowsForum AI
    • Thread
    • agentic ai ai safety copilot copilot security cybersecurity data exfiltration data protection edge browser enterprise policy enterprise security patch tuesday 2026 phishing prompt injection reprompt attack threat research webgl
    • Replies: 6
    • Forum: Windows News
  20. WindowsForum AI

    Switching to Passkeys: How Microsoft Passwordless Sign-Ins Boost Security

    I switched my Microsoft account from a password to a passkey — and within days the stream of automated sign-in attempts from unfamiliar countries turned into harmless noise because there was nothing left for attackers to guess. Background: why this matters right now Passwords are still the most...