Trust is a resource, and July 2026 was a month in which attackers spent it freely. Threat intelligence research from ANY.RUN documents a pattern across the United States, Europe, and Brazil where cybercriminals stopped trying to build convincing fakes from scratch and instead hijacked the credibility of platforms people already trust: Microsoft’s own authentication pages, Zoom’s event registration system, and official government web portals.

Riding on Platform Legitimacy

The common thread across the month’s campaigns was routing victims through genuinely trusted infrastructure before ever delivering a malicious payload. A phishing-as-a-service platform called Kratos used document-sharing and DocuSign-style lures to funnel Microsoft 365 users through SharePoint, OneDrive, and Microsoft Forms on the way to a credential-harvesting page. Because the redirect chain mimicked ordinary administrative workflows, both automated security gateways and cautious employees tended to wave the traffic through.

A separate campaign tracked as Kali365 took a more subtle approach, abusing Microsoft’s legitimate device-code authentication flow. Victims were directed to Microsoft’s actual login endpoints and talked into entering an attacker-generated authorization code, which handed over a valid OAuth token without the attacker ever needing to phish a password. That single technique netted more than 80 weekly sandbox detections spanning manufacturing, healthcare, government, and consulting organizations.

Fake AI Summits and Hijacked Government Domains

Attackers also built counterfeit Zoom Event pages branded around fictitious summits tied to well-known AI companies, including OpenAI, Anthropic, and Meta. Clicking the registration button on these pages routed targets into either device-code phishing flows or adversary-in-the-middle proxy pages designed to capture live credentials.

In Brazil, a campaign dubbed PhantomEnigma took the trust-hijacking strategy even further, compromising more than 20 municipal and police web portals on the .gov.br domain to host malware directly. Because the hijacked accounts were sending mail from legitimate government email infrastructure, the resulting phishing messages passed SPF, DKIM, and DMARC checks without difficulty, sailing past defenses tuned to catch spoofed senders.

What Happens After the Click

Once a single device was compromised, the operational impact frequently cascaded well beyond that one machine. A modular infostealer called DestinyStealer harvested browser credentials, session cookies, Outlook data, VPN profiles, FileZilla logins, and cryptocurrency wallets, exfiltrating everything across parallel HTTP and TCP channels designed to dodge static antivirus signatures.

In one intrusion researchers observed directly, an operator deployed a remote access trojan known as OVERLORD through a live command-and-control channel and exfiltrated 86 megabytes of sensitive files, browser sessions, internal messaging logs, and cryptocurrency wallet data within just 45 minutes of gaining access. Elsewhere, an updated variant of Banana RAT introduced randomized file structures and encrypted WebSocket communications to stay ahead of detection, while a separate strain called DARTHVADER Stealer was delivered through malicious shortcut files that leaned on native Windows utilities, AutoIt, and PowerShell.

The Defensive Takeaway

Perhaps the most important finding from the month’s activity is how quickly this infrastructure moves. Threat actors are rotating domains, redirect chains, and proxy nodes faster than traditional blacklists can keep pace with, and a simple password reset often fails to actually remediate an intrusion when a stolen OAuth token or session cookie is still valid in an attacker’s hands.

That leaves security teams needing to shift emphasis away from static indicator blocking and toward behavior-based telemetry: continuous session monitoring, scrutiny of OAuth consent grants, and campaign-level correlation capable of spotting a multi-stage attack chain before it progresses to lateral movement. As this wave of activity shows, the more a phishing operation resembles a routine, trusted workflow, the harder it becomes to catch with the defenses built for yesterday’s obvious fakes.

A Sector-Spanning Problem

What stands out across these July campaigns is how little industry mattered to attackers. Manufacturing, healthcare, government, and consulting organizations all showed up among the affected sectors, underscoring that the abuse of trusted platforms is a volume play rather than a narrowly targeted operation. Any organization that relies on Microsoft 365, hosts events through Zoom, or interacts with government web portals should treat these tactics as a near-term risk rather than a distant one, and should brief staff specifically on the danger of device-code prompts and conference invitations that ask for a login before anything else.