11 minhigh
Major Cyber Attacks in July 2026: US and EU Organizations Hit by Phishing, RATs, and Stealers
July 2026 saw coordinated phishing and malware campaigns targeting US, European, and Brazilian organizations through abuse of trusted business platforms and legitimate authentication flows. Key threats include Kratos and Kali365 phishing-as-a-service operations targeting Microsoft 365 accounts via credential theft and device code phishing, multiple stealer/RAT families (DestinyStealer, DARTHVADER, Banana RAT, OVERLORD RAT) collecting broad credential and session data, and PhantomEnigma's abuse of compromised Brazilian government infrastructure for malware delivery. Attackers consistently used legitimate tools and rotating infrastructure to evade indicator-based defenses.
Sens:▲ 24h
Detection / Hunteropenrouter
What Happened
In July 2026, cybercriminals launched a series of attacks against organizations in the United States, Europe, and Brazil. The attackers used trusted platforms like SharePoint, Zoom, and Microsoft's own login system to trick employees into giving up their credentials or authorizing malicious access to company accounts. Several types of malware were deployed that steal passwords, browser data, cryptocurrency wallets, and other sensitive information from infected computers. Some attacks specifically targeted banks and government agencies in Brazil by hacking legitimate government websites to distribute malware. Organizations should review their cloud account sign-in activity, limit device-code authentication to only those who need it, and train employees to be suspicious of unexpected document-sharing links and event invitations, even when they appear to come from well-known companies.
Key Takeaways
- Kratos Phishing-as-a-Service targeted Microsoft 365 users across US and Europe using trusted services (SharePoint, OneDrive, Canva, Tilda) as redirect intermediaries before presenting fake Microsoft login pages, with possible adversary-in-the-middle WebSocket activity
- Kali365 abused Microsoft's legitimate device code authentication flow to obtain OAuth access and refresh tokens, making malicious logins appear routine on real Microsoft pages
- PhantomEnigma compromised 20+ Brazilian .gov.br municipal and police portals for malware distribution, with compromised government mailboxes passing SPF/DKIM/DMARC checks
- Multiple stealer and RAT families (DestinyStealer, DARTHVADER, Banana RAT, OVERLORD RAT) demonstrated broad data collection from browsers, VPN clients, cryptocurrency wallets, and Outlook, with exfiltration via dual channels (HTTP and raw TCP)
- Attackers increasingly used legitimate system tools (PowerShell, AutoIt, curl.exe, cmd.exe) and trusted SaaS platforms to hide malicious activity within normal business workflows, delaying detection and containment
Affected Systems
- Microsoft 365 cloud accounts and authentication flows
- Windows endpoints targeted by stealers and RATs
- Brazilian banking and public-sector organizations
- Browser credential stores, VPN clients, FileZilla, Outlook, cryptocurrency wallet extensions
- US organizations across MSSP, manufacturing, technology, government, healthcare, consulting, and energy sectors
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Phishing emails deliver document-sharing lures, fake PDF shortcuts (LNK), or Zoom event invitations impersonating trusted brands and services
- Execution: Victims click links or open LNK files, triggering multi-stage chains using cmd.exe, AutoIt, PowerShell, and curl.exe; or victims enter device codes on legitimate Microsoft authentication pages
- Credential Theft: Fake Microsoft login pages capture credentials via adversary-in-the-middle; stealers collect browser data, cookies, VPN credentials, cryptocurrency wallets, and Outlook data
- Persistence: Malware establishes registry-based persistence or scheduled tasks to survive reboots and endpoint cleanup
- C2 Communication: RATs and backdoors communicate via encrypted WebSocket connections, host-specific subdomains, or live interactive C2 channels for remote control
- Exfiltration: Stolen data packaged into ZIP archives and exfiltrated via HTTP, raw TCP, or live C2 channels; OAuth tokens and refresh tokens used for continued cloud access
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not contain any detection rules, queries, or signatures. It is a monthly threat summary referencing detailed breakdowns available via linked ANY.RUN blog posts and LinkedIn posts.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The article describes multiple behaviors visible to EDR (PowerShell execution with bypass, LNK-to-cmd chains, AutoIt execution, curl.exe downloads, scheduled task creation, registry persistence, mutex creation). However, attackers deliberately used legitimate system tools to blend with normal activity, reducing EDR signal clarity. |
| Network Visibility | Medium | C2 communication via encrypted WebSocket, host-specific subdomains, HTTP, and raw TCP is described, but rotating infrastructure and use of legitimate SaaS platforms as intermediaries make network-based detection challenging without full redirect chain visibility. |
| Detection Difficulty | Hard | Attackers consistently used legitimate tools (PowerShell, AutoIt, curl.exe), trusted SaaS platforms (SharePoint, OneDrive, Zoom, Microsoft authentication), and rotating infrastructure. Device code phishing produces legitimate Microsoft authentication events. Adversary-in-the-middle flows use real Microsoft login pages. Indicator-only defenses are explicitly called out as insufficient due to infrastructure rotation. |
Required Log Sources
- Microsoft 365 sign-in logs and audit logs
- Microsoft Entra ID (Azure AD) authentication logs including device code flow events
- EDR process creation and command-line telemetry
- DNS resolution logs
- Web proxy logs with full redirect chain visibility
- Email security gateway logs
- Windows Task Scheduler logs (Event ID 4698)
- Registry modification monitoring
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for LNK files that launch multi-stage execution chains involving cmd.exe spawning AutoIt or PowerShell, particularly when followed by curl.exe network downloads, as this pattern matches the DARTHVADER Stealer delivery chain | EDR process creation events with parent-child process relationships, command-line arguments, and network connection events | Execution | Medium — legitimate software deployment tools may use similar patterns; focus on LNK files masquerading as PDF documents |
| Consider hunting for Microsoft device code authentication requests that originate from users who recently received phishing emails or clicked links in event invitations, as this may indicate Kali365 device code phishing | Microsoft Entra ID sign-in logs for device code flow authentication events, correlated with email security gateway logs | Initial Access | Medium — device code authentication is legitimate for some workflows; focus on unexpected or out-of-pattern requests |
| Consider hunting for endpoints establishing WebSocket connections shortly after interacting with suspicious URLs or fake login pages, as this may indicate adversary-in-the-middle credential relaying or encrypted C2 communication | Network proxy logs, EDR network connection events, DNS logs | C2 | High — WebSocket connections are common in legitimate web applications; correlate with preceding phishing indicators |
| Consider hunting for data exfiltration via dual channels (HTTP POST and raw TCP connections) originating from the same endpoint within a short time window, as DestinyStealer uses this technique to exfiltrate stolen credential archives | Firewall logs, network flow data, EDR network connection events, proxy logs | Exfiltration | Medium — some legitimate applications use multiple connection types; focus on endpoints with preceding suspicious process activity |
| Consider hunting for scheduled tasks or registry run keys created shortly after suspicious PowerShell or AutoIt execution, as Banana RAT and DARTHVADER use these for persistence following initial infection | Windows Task Scheduler event logs, registry monitoring events, EDR persistence detection events | Persistence | Medium — software installers commonly create scheduled tasks and registry entries; focus on tasks created after suspicious process chains |
Control Gaps
- Indicator-only defenses (IP/domain blocking) are insufficient due to rapid infrastructure rotation across campaigns
- Email authentication checks (SPF/DKIM/DMARC) can be bypassed when attackers compromise legitimate government mailboxes
- Static file analysis may miss malicious behavior when LNK files use legitimate system utilities for execution
- Legitimate Microsoft authentication pages used in device code phishing and adversary-in-the-middle flows may not trigger security alerts
- Trusted SaaS platforms used as redirect intermediaries (SharePoint, OneDrive, Zoom Events) may be allowlisted and bypass URL filtering
Key Behavioral Indicators
- LNK files with PDF icons launching cmd.exe process chains
- PowerShell execution with -ExecutionPolicy Bypass flag following LNK or AutoIt execution
- curl.exe downloading payloads from external URLs following suspicious process ancestry
- AutoIt interpreter execution spawned from cmd.exe or LNK files
- Device code authentication events in Microsoft Entra ID following phishing email receipt
- WebSocket connections established from endpoints after interaction with suspicious URLs
- Scheduled tasks or registry run keys created after suspicious PowerShell or AutoIt activity
- Dual-channel exfiltration (HTTP and raw TCP) from single endpoint within short time window
- Redirects from legitimate SaaS platforms (events.zoom.us, SharePoint) to unexpected authentication flows
False Positive Assessment
Medium — Several detection indicators involve legitimate system tools (PowerShell, AutoIt, curl.exe, scheduled tasks) and trusted SaaS platforms (SharePoint, Zoom Events, Microsoft authentication) that are commonly used in normal business operations. Behavioral detections require correlation across multiple stages to reduce false positives, and device code authentication is legitimate for specific workflows. Single-indicator alerts are likely to produce noise.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing Microsoft 365 sign-in activity for unexpected device code authentication events and adversary-in-the-middle patterns, revoking active sessions and refresh tokens where suspicious activity is confirmed
- If your email security platform supports it, consider adding detection rules for phishing emails containing Zoom event invitations that redirect to authentication flows, particularly those referencing Meta, OpenAI, or Anthropic summits
- Consider hunting for LNK files disguised as PDFs in recent email attachments or downloads, especially those that launch cmd.exe or PowerShell execution chains
- If applicable to your environment, consider reviewing any authentication events involving device code flow for users who do not normally use this authentication method
Infrastructure Hardening
- Consider restricting Microsoft device code authentication to only users and service accounts that genuinely require it, if your Entra ID configuration supports conditional access policies for device code flow
- Evaluate whether your email security gateway can detect phishing emails originating from compromised legitimate mailboxes that pass SPF, DKIM, and DMARC checks
- If supported by your web proxy, consider implementing policies that inspect full redirect chains from legitimate SaaS platforms rather than evaluating only the initial URL or final destination
- Consider reviewing whether your URL filtering allowlists for trusted SaaS domains (sharepoint.com, onedrive.live.com, events.zoom.us, canva.com) could be scoped more narrowly to prevent abuse as redirect intermediaries
User Protection
- Consider deploying EDR detection content for multi-stage execution chains involving LNK files, cmd.exe, AutoIt, and PowerShell with ExecutionPolicy Bypass, if your EDR vendor supports custom detection rules
- If your EDR supports host isolation, consider preparing containment playbooks for endpoints showing stealer or RAT behavior, particularly those with dual-channel exfiltration patterns
- Evaluate whether your endpoint protection can detect and block curl.exe downloads following suspicious process ancestry patterns
Security Awareness
- Consider incorporating training on device code phishing into existing security awareness programs, emphasizing that legitimate Microsoft login pages can be abused through attacker-controlled device codes
- If your organization uses Zoom Events or similar platforms, consider advising employees to verify event invitations through independent channels before clicking registration links
- Consider reminding employees that document-sharing notifications, invoice lures, and DocuSign requests should be verified through separate communication channels when unexpected
- Consider adding guidance on recognizing LNK files disguised as PDFs, particularly for employees who regularly handle external document attachments
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping14 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- Command Lines:
- Purpose: Multi-stage execution chain launched from malicious LNK file disguised as PDF, using cmd.exe to invoke AutoIt and PowerShell for payload delivery and persistence | Tools:
cmd.exe,AutoIt,PowerShell,curl.exe| Stage: Execution and Persistence |cmd.exe /c - Purpose: PowerShell execution with ExecutionPolicy Bypass to run downloaded payload components in DARTHVADER Stealer delivery chain | Tools:
PowerShell| Stage: Execution |powershell.exe -ExecutionPolicy Bypass - Purpose: curl.exe used to download additional payload components in DARTHVADER Stealer multi-stage infection chain | Tools:
curl.exe| Stage: Ingress Tool Transfer |curl.exe -o
- Purpose: Multi-stage execution chain launched from malicious LNK file disguised as PDF, using cmd.exe to invoke AutoIt and PowerShell for payload delivery and persistence | Tools:
