Phish of the Week

This week's Phish of the Week breaks down a Claude AI impersonation attack that uses a look-alike landing page and a Browser-in-the-Browser pop-up to harvest Google credentials.

A legitimate Temu password reset notification becomes the delivery vehicle in this callback phishing attack, where an attacker-injected phone number poses as customer support.

Attackers impersonate FIFA World Cup 2026 recruitment staff in this credential harvesting campaign, using a fake scheduling page and a Browser-in-the-Browser pop-up to steal Google credentials.

This legitimate Facebook Business Manager partner request highlights how attackers can weaponize a real platform notification to smuggle a malicious link past security filters.

This spoofed incoming message failure alert uses sender address impersonation and a Google domain open redirect to deliver a prefilled Microsoft credential harvester.

This multi-stage HR impersonation attack uses a realistic training quiz to build credibility before funneling the target into a dynamically branded Microsoft credential harvester.

A fake prescription notice uses a QR code to launch a device code phishing flow, giving attackers Microsoft account access without ever needing to steal the recipient's password.

Attackers repurpose a legitimate email marketing platform to deliver a Fastway Couriers impersonation, funneling recipients toward a fake customs duty payment and financial theft.

This Phish of the Week features a personalized Adobe Summit invitation with mismatched event dates and a countdown timer that pressures recipients into signing in through a fake Google pop-up.

Attackers are sending out a team lunch RSVP email featuring a genuine Microsoft sign-in link that quietly hands recipients off to a fake Google credential harvester.

A fake charge alert is delivered through VISA's own account-creation system, luring recipients into calling scammers to "cancel" a payment.

A fake project collaboration invite, where a calm, urgency-free pretext and a simulated live Teams meeting lull recipients into entering their Microsoft password not once, but twice.

A Google Ads on Air impersonation, where genuine branding, a real third-party mailing platform, and zero urgency combine to make a credential-harvesting page feel routine.