Phishing

The Brand Impersonation Protection feature will begin rolling out in mid-February and will be enabled by default for targeted release users.

The attackers likely initiated access using previously compromised email addresses, sending phishing emails containing a SharePoint URL disguised with subjects like "New Proposal - NDA," according to Microsoft.

Threat actors are poised to launch credential-harvesting phishing and spoofed websites, as well as harness event system software and API flaws ahead of the Milano-Cortina Winter Olympics next month, according to Infosecurity Magazine.

Afghan ministry and administrative office workers have been targeted with malware-spreading phishing emails purporting to be from the office of the country's prime minister as part of the Nomad Leopard campaign, according to The Record, a news site by cybersecurity firm Recorded Future.

The emails claim LastPass will be going into maintenance, requiring action within 24 hours.

Attackers exploit the trusted professional social media platform to deploy a remote access trojan.

PDFSider has been observed in Qilin ransomware attacks and is actively used by multiple ransomware actors.

The technology sector continues to be the primary target for brand impersonation, with Google, Amazon, and Apple also appearing frequently in phishing campaigns.