Phishing campaigns target organizations and hardware wallet users

A massive phishing campaign has targeted over 40,000 organizations worldwide, involving more than 302,000 unique malicious emails. According to researchers at Check Point Software, the attackers use fake meeting invitations and fraudulent Microsoft Teams links to steal Microsoft account credentials. The campaign, which accelerated in October, utilizes calendar attachments in .ics format to exploit routine corporate habits. To evade traditional security filters, the attackers employed a distributed infrastructure consisting of over 33,800 different domains and 247,000 unique email addresses.

Separately, the Foundation, manufacturer of the Passport hardware wallet, reported a compromise of its email infrastructure on October 26. Attackers gained access to the customer support inbox through compromised Cloudflare API keys and a vulnerability in a self-hosted application. This breach allowed the sending of phishing emails containing user names, addresses, and phone numbers under the guise of product recalls. The Foundation stated that while user data was exposed, Passport devices and user funds remain secure.