Threat Intel

Live phishing intelligence, defanged for training

Fresh campaigns, indicators and analyst notes — updated with every case wave so your investigations reflect what attackers are sending right now.

Threat Intel

A simulated multi-source intelligence feed. A fresh drop lands every 24 hours at 00:00 UTC — indicators are defanged and safe to copy into your notes.

Next drop in 18:37:09

Attachment-borne loaders are back after a quiet week

Sun, Nov 8, 2026 · 7 items · current drop

Any.Run

Malicious

Credential theft

confidence 81%

OAuth consent app requesting mailbox scopes

Unverified publisher requesting Mail.ReadWrite and offline_access. Grants survive a password reset — revoke the grant, not just the session.

domain · first seen 10h ago

signin-signin[.]click

T1078 — Valid Accounts

Pivot

URLhaus

Benign

Reputation

confidence 15%

Sender domain cleared after review

Bulk marketing sender previously flagged by two engines; SPF, DKIM and DMARC now align and no phishing content observed. Treat detections as false positive.

domain · first seen 38h ago

auth-secure[.]top

—

Pivot

GreyNoise

Suspicious

Reputation

confidence 66%

Bulletproof hosting range flagged

Sending IP with 65% abuse confidence and 77 reports in the last week. Also seen hosting 8 phishing landing pages.

ip · first seen 21h ago

46[.]105[.]68[.]112

T1566.002 — Spearphishing Link

Pivot

Cisco Talos

Malicious

Campaign

confidence 82%

MFA fatigue push storm reported

Bursts of 21 Authenticator prompts within 15 minutes, followed by a help-desk callback attempting to talk the user into approving.

ip · first seen 14h ago

89[.]142[.]87[.]100

T1621 — MFA Request Generation

Pivot

PhishTank

Suspicious

Credential theft

confidence 55%

QR-code (quishing) wave targeting SharePoint

PDF attachment with an embedded QR pointing at a shortener chain, aimed at moving the victim onto an unmanaged phone outside endpoint controls.

url · first seen 22h ago

hxxps://verify-mailbox[.]sbs/q/aedt

T1566.002 — Spearphishing Link

Pivot

Any.Run

Malicious

Campaign

confidence 85%

Storm-0539 activity against HR mailboxes

Thread hijacking on compromised supplier accounts, followed by an inbox rule that files replies under RSS Feeds to hide the conversation.

sender · first seen 18h ago

secure@docs-portal[.]icu

T1114.003 — Email Forwarding Rule

Pivot

URLhaus

Suspicious

Campaign

confidence 56%

Gift-card BEC pretext circulating

Free-mail sender using a spoofed display name of a real executive, asking for 15 gift cards "for a client thank-you". No links, no attachment — content-only signal.

sender · first seen 3h ago

ceo.signin@mailbox-docs[.]cfd

T1656 — Impersonation

Pivot