In July 2026, cybercriminals demonstrated a new level of sophistication by transforming trusted business tools, such as Microsoft logins and Zoom events, into instruments of attack. This alarming trend highlights the vulnerabilities in widely used platforms and the need for enhanced cybersecurity measures.
Exploiting Trusted Platforms
Research by ANY.RUN has unveiled that hackers across regions, including the United States, Europe, and Brazil, have been exploiting legitimate corporate tools to bypass security protocols, steal credentials, and gain prolonged access to various systems. A significant trend observed in July was the misuse of platform legitimacy by phishing operations. Attackers cleverly rerouted targets through familiar platforms like SharePoint and OneDrive before delivering harmful payloads.
The Kratos phishing-as-a-service (PhaaS) platform exemplified this strategy by using document-sharing lures to funnel Microsoft 365 users towards credential-stealing pages. These tactics exploited routine workflows, making it difficult for both automated systems and individuals to identify malicious activity.
Advanced Phishing Techniques
Another campaign, identified as Kali365, abused Microsoft’s device-code authentication. By directing users to genuine Microsoft login pages and tricking them into entering attacker-generated codes, hackers were able to obtain OAuth tokens. These tokens provided continuous access to cloud services without needing passwords, affecting sectors like manufacturing and healthcare.
Simultaneously, adversaries exploited Zoom’s event pages by creating fake summits related to well-known companies. These lures redirected users to phishing interfaces designed to harvest credentials, further proving the adaptability of cyber threats.
Government Websites Under Siege
In Brazil, a campaign named PhantomEnigma targeted government domains, compromising over 20 municipal and police web portals. These hijacked sites were used to distribute malware while bypassing email security checks like SPF and DMARC. The use of legitimate government channels added a layer of credibility to the attacks, increasing their success rate.
Intrusions often started with a single device but quickly escalated to affect entire networks. Attackers deployed specialized malware like DestinyStealer to extract data, including browser credentials and VPN profiles, while evading traditional antivirus detection.
Persistent Threats and Solutions
During one incident, researchers observed a hacker using the OVERLORD RAT to extract sensitive data within minutes. Meanwhile, updates to Banana RAT introduced more complex communication methods to ensure ongoing access.
These campaigns demonstrate that threat actors can adapt faster than traditional defenses. As a result, cybersecurity teams must move beyond static blocking methods to more dynamic strategies like behavior-based monitoring and campaign-level analysis to preemptively identify threats.
Overall, the July 2026 cyber incidents underscore the critical need for robust security measures and the continuous evolution of defense mechanisms to protect against sophisticated cyber threats.
