LLM-obfuscated SVG phishing campaign targeting U.S.-based organizations
Campaign
Summary
Hide ▲
Show ▼
The new phishing campaign targeted U.S.-based organizations and used LLM-obfuscated SVG files to hide malicious content and steal credentials. Detected on August 28, 2025, the operation matters because it combined a compromised email account, BCC-hidden targets, and a fake login flow to evade security defenses. Microsoft said the campaign was limited in scope and was effectively blocked.
Related Happenings
Fake Gemini CLI and Claude Code SEO-poisoning infostealer campaign
Campaign
H score33
First: 22.05.2026 14:30
Last: 22.05.2026 14:30
Sources 1
About this happening:
Cyber threat actors ran a malicious SEO-poisoning campaign that impersonated Google Gemini CLI and Anthropic Claude Code to push malicious downloads. The operation...
Fake Gemini CLI and Claude Code SEO-poisoning infostealer campaign
CampaignAbout this happening: Cyber threat actors ran a malicious SEO-poisoning campaign that impersonated Google Gemini CLI and Anthropic Claude Code to push malicious downloads. The operation...
Microsoft civil action against Fox Tempest infrastructure takedown
Regulatory/Legal Action
H score24
First: 19.05.2026 18:00
Last: 19.05.2026 18:00
Sources 1
About this happening:
Microsoft filed a civil action against Fox Tempest in the US District Court for the Southern District of New York, securing a court order that enabled a broad disr...
Microsoft civil action against Fox Tempest infrastructure takedown
Regulatory/Legal ActionAbout this happening: Microsoft filed a civil action against Fox Tempest in the US District Court for the Southern District of New York, securing a court order that enabled a broad disr...
Code of conduct-themed Microsoft AiTM phishing campaign
Campaign
H score53
First: 05.05.2026 09:35
Last: 05.05.2026 09:35
Sources 1
About this happening:
A large-scale phishing campaign used code of conduct-themed lures and legitimate email services to push victims to attacker-controlled domains and steal authentication t...
Code of conduct-themed Microsoft AiTM phishing campaign
CampaignAbout this happening: A large-scale phishing campaign used code of conduct-themed lures and legitimate email services to push victims to attacker-controlled domains and steal authentication t...
FBI-led takedown of W3LL phishing network
Law Enforcement
H score33
First: 13.04.2026 13:35
Last: 13.04.2026 13:35
Sources 1
About this happening:
FBI Atlanta and US and Indonesian law enforcement took down the W3LL phishing network, escalating a cross-border cybercrime case tied to more than $20 million in fra...
FBI-led takedown of W3LL phishing network
Law EnforcementAbout this happening: FBI Atlanta and US and Indonesian law enforcement took down the W3LL phishing network, escalating a cross-border cybercrime case tied to more than $20 million in fra...
OAuth device-code phishing campaign targeting SaaS accounts
Campaign
H score43
First: 04.04.2026 17:17
Last: 04.04.2026 17:17
Sources 1
About this happening:
A device code phishing campaign now includes EvilTokens, a phishing-as-a-service kit sold on Telegram that uses the OAuth 2.0 device authorization flow to hija...
OAuth device-code phishing campaign targeting SaaS accounts
CampaignAbout this happening: A device code phishing campaign now includes EvilTokens, a phishing-as-a-service kit sold on Telegram that uses the OAuth 2.0 device authorization flow to hija...
Timeline
-
29.09.2025 11:52 2 articles · 9mo ago
Phishing campaign detected against U.S.-based organizations
Exploitation ObservedMicrosoft detected a phishing campaign aimed at U.S.-based organizations on August 28, 2025 that used a compromised business email account and an SVG lure disguised as a PDF to push recipients toward a CAPTCHA step and a fake login page for credential theft. The activity also used a self-addressed sending pattern with targets hidden in BCC, and Microsoft said its systems flagged and neutralized the threat.
Show sources
- Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security — thehackernews.com — 29.09.2025 11:52
- Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security — thehackernews.com — 29.09.2025 11:52
-
29.09.2025 11:52 1 articles · 9mo ago
Microsoft details AI-style SVG obfuscation in phishing analysis
Initial DisclosureMicrosoft's analysis described the same phishing campaign as likely aided by an LLM, citing an SVG file that used business terminology and a synthetic dashboard-like structure to disguise malicious behavior. The analysis said Security Copilot found the code unusually complex, verbose, and lacking practical utility, consistent with AI-assisted obfuscation.
Show sources
- Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security — thehackernews.com — 29.09.2025 11:52