Signal
Phishing campaigns target Microsoft 365, AWS, Signal, and WhatsApp accounts using advanced techniques
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-03-09 14:54 UTCUpdated 2026-03-10 14:13 UTC
redditrss
phishingaccount_takeovercloud_securitymalwarethreat_actors
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
Recent phishing campaigns have evolved to exploit legitimate authentication flows and social engineering to compromise high-value accounts across multiple platforms.
Score total
1.48
Momentum 24h
3
Posts
3
Origins
3
Source types
2
Duplicate ratio
0%
Why now
- Rapid rise in OAuth Device Code phishing campaigns targeting Microsoft 365 accounts.
- Ongoing AiTM phishing attacks on AWS accounts observed since late February 2026.
- Large-scale phishing operations by Russian state-backed actors targeting Signal and WhatsApp users reported recently.
Why it matters
- Phishing now exploits legitimate authentication flows, complicating detection and defense.
- High-value cloud and messaging accounts face increased risk of takeover without traditional credential theft.
- Attackers leverage social engineering and token abuse to maintain persistent access across platforms.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- OAuth Device Code phishing enables Microsoft 365 account takeover without credential theft by abusing legitimate authentication flows.
- AiTM phishing kits with typosquatted domains are used to hijack AWS accounts quickly after credential submission.
- Russian state-backed actors target Signal and WhatsApp users via phishing and social engineering to steal verification codes or add malicious linked devices.
How sources frame it
- Redteamsec: neutral
- Help Net Security: neutral
- Malwarebytes Threat Analysis: neutral
This briefing highlights the shift in phishing tactics toward abusing authentication flows and social engineering to compromise cloud and messaging accounts without traditional credential theft.
All evidence
All evidence
OAuth Device Code Phishing: A New Microsoft 365 Account Breach Vector
redteamsec · any.run · 2026-03-10 14:13 UTC
Attackers use AiTM phishing kit, typosquatted domains to hijack AWS accounts
Help Net Security · helpnetsecurity.com · 2026-03-10 13:22 UTC
Signal and WhatsApp accounts targeted in phishing campaign
Malwarebytes Threat Analysis · malwarebytes.com · 2026-03-10 11:19 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 3Origin domains: 3Duplicates: -
Showing 3 / 0
Top publishers (this list)
- redteamsec (1)
- Help Net Security (1)
- Malwarebytes Threat Analysis (1)
Top origin domains (this list)
- any.run (1)
- helpnetsecurity.com (1)
- malwarebytes.com (1)