Field notes: Threat research
Threat research posts
EvilTokens Is Industrializing Device‑Code Phishing: Inside the Storm‑2992 Campaign
The EvilTokens PhaaS (Storm‑2992) abused Microsoft’s device‑code MFA to breach 12K+ mailboxes. We dissect the attack chain, scale, and detection (what TRACE Engine can see) and share a detailed defender playbook.
Inside Storm-2755: Unpacking the "Payroll Pirates" 6-Stage AiTM Campaign
A technical teardown of Storm-2755's "Payroll Pirates" campaign. See how 6-stage AiTM redirects bypass MFA, abuse Graph API, and hijack enterprise payroll.
The Complete Guide to Legitimate Service Abuse: How Attackers Weaponize Trusted Platforms
Why are phishing emails increasingly coming from trusted platforms instead of suspicious domains? Explore legitimate service abuse, why traditional email security misses it, and how to stop it.
Your Colleague Didn't Send You That Link. Their Ghost Did.
Account hijack downstream attacks abuse trusted Microsoft 365 accounts and SharePoint to deliver phishing that bypasses traditional email security.
Kali365 Unmasked: How a Phishing Kit Defeated MFA Without Breaking It
Kali365 stole Microsoft 365 access without passwords or failed MFA. See how device code phishing and AiTM attacks work — and how to stop the next one.
We Analyzed 2,500+ Email Attacks. Here’s Why the DocuSign Lures Bypassed Your Gateway
We analyzed 2,500 DocuSign attacks that bypassed secure email gateways. Discover why traditional rules fail against AI-native threats and how Reasoning fixes it.
The Chameleon's Trap: Inside the Top 3 Exploit Thriving on 60% of Unpatched MS Office Systems
Attackers aren’t just fooling humans anymore—they’re poisoning AI itself.
Direct Send Deception: How a Microsoft 365 Exploit Fuels Hyper-Personalized Credential Theft
A joint investigation between StrongestLayer’s TRACE AI and a leading security architect uncovers a hyper-personalized spear phishing campaign exploiting Microsoft 365’s Direct Send to bypass defenses and steal credentials with surgical precision.
EXPOSED: How AI-Generated Phantom Companies Are Infiltrating Corporate Hiring
AI-generated fake companies are infiltrating hiring. See how StrongestLayer detects the fraud others miss—before it hits your team.
Unmasking the Imposters: Overseas Scammers Target US Schools with Fake Websites
StrongestLayer uncovers a sophisticated phishing campaign where an overseas actor creates fake elementary school websites to target US families, aiming to steal personal data for online course and admission scams. Read our in-depth threat research on how these imposter sites operate and how to stay protected.
Decoding WebFake: The Rise of Automated Impersonation Attacks
StrongestLayer uncovers sophisticated AI-driven phishing campaign targeting financial institutions with perfect website replicas that evade traditional detection methods.
StrongestLayer Pre-Emptively Intercepts AI generated Amazon Phishing Campaign
StrongestLayer has successfully intercepted a brand new advanced AI-driven phishing campaign that seems to be in the phase of ramping up their domain acquisition and preparedness phase before the holiday season hits.
Zero-Day Microsoft Phishing Campaign caught by StrongestLayer is still largely undetected
This blog delves into the intricacies of this campaign, revealing how it operates and how cutting-edge solutions like StrongestLayer’s Recursive-Predictive AI Detection Model (Zero-Day Detection Engine) are countering these threats.
Threat Intelligence Brief: AI Generated E-Commerce Cyber Threat Targeting Enterprise Procurement
The StrongestLayer Threat Intelligence team has uncovered a global, AI-driven e-commerce scam network that targets enterprise procurement departments and unsuspecting employees involved in purchasing.
The Threat Behind WalmartVisa.com: Analyzing a Sophisticated Phishing Campaign and StrongestLayer’s AI Detection
This article provides an in-depth analysis of how StrongestLayer’s AI-driven detection system identified this threat early, while traditional security platforms failed to do so.
How StrongestLayer Protects Against Zero-Day Phishing Threats Targeting WhatsApp Users
At StrongestLayer, we are meeting this challenge head-on with our predictive threat AI model, enabling organizations to detect and neutralize these threats proactively.
India Times Hijacked: How a DNS Flaw Led to a Microsoft Phishing Scam – Are You Secure?
Threat Intelligence discovered a phishing page hosted on the India times website, redirecting users to a malicious Microsoft login replica. This incident highlights the need for employees to be vigilant and prepared for the next cyber threat.
Deepfake Logistics: AI-Generated Phishing Campaign Targets Global Supply Chain with Fake Logistics Brands
The cybersecurity landscape is evolving rapidly, with AI-driven phishing campaigns becoming increasingly sophisticated.
Global Hybrid AI Phishing Scam: Luxury Cars, Job Portals & Phone Fraud
StrongestLayer recently uncovered an extensive network of deceptive, AI-generated websites operated by a sophisticated phishing group.
StrongestLayer uncovers 3 million malicious domains through investigating AI-Generated brands
This story began with an innocuous-looking domain encountered by one of StrongestLayer’s analysts during routine threat-hunting activities focused on zero-day phishing attacks.
Deconstructing "PhantomStrike": How StrongestLayer Stopped a Multi-Stage Malware Attack
Our LLM-assisted detection capabilities identified and neutralized this threat before it could impact our customers, demonstrating the power of AI-enhanced cybersecurity.
StrongestLayer Threat Intelligence Report: Zero-Day Phishing Threats and Agentic AI Driven Detection
In this blog, we explore the rise of zero-day phishing threats, their dangers, and how StrongestLayer’s revolutionary agentic AI provides a cutting-edge defense.
India Times Hosting Redirect to Newly Discovered Microsoft Phishing Page. Are Your Employees Prepared?
StrongestLayer Threat Intelligence had been encountering phishing traffic that was taking advantage of a mass mailing website called 'exactag.com,' where attackers continuously created new subdomains for nefarious purposes
StrongestLayer Captures yet another Zero-Day Phishing Scam that remains undetected
In this blog, we’ll dive deep into a unique and sophisticated phishing campaign detected by StrongestLayer's Zero-Day Detection Engine, which uses generative AI-based hybrid threat detection models to identify novel threats in real time.
Nothing matches “”. Try a broader word, or
Do you have an AI gap? Find out what’s getting through.
See which generations of defense you’re running and what it takes to close the gap. Two minutes. No signup. Nothing changes in your environment.