Attackers Weaponize Legitimate Services for Credential Theft and Malware Distribution
Cybercriminals exploited Microsoft logins, Zoom events, and government websites in July 2026 to conduct sophisticated phishing and malware campaigns.
In July 2026, threat actors demonstrated a concerning trend of weaponizing trusted business utilities and platforms, including Microsoft authentication pages, Zoom event invitations, and official government portals, to bypass security controls and target enterprise networks. Research from ANY.RUN highlights how attackers systematically exploited routine corporate workflows to harvest credentials, distribute malware, and establish persistent access.
A primary tactic involved routing victims through legitimate cloud infrastructure such as SharePoint, OneDrive, and Microsoft Forms before directing them to credential-harvesting pages. The Kratos Phishing-as-a-Service (PhaaS) platform, for instance, employed lures mimicking document sharing and DocuSign workflows, leveraging trusted cloud redirects to evade detection by both automated security gateways and end-users. This approach mirrored standard administrative processes, significantly increasing the likelihood of success.
Concurrently, a campaign dubbed Kali365 abused Microsoft's legitimate device-code authentication flow. By tricking victims into entering attacker-generated authorization codes on authentic Microsoft login endpoints, adversaries successfully obtained OAuth tokens. These tokens granted persistent cloud access to sensitive data like email archives and shared repositories without the need to steal traditional account passwords. This campaign saw over 80 weekly sandbox detections across critical sectors including manufacturing, healthcare, government, and consulting.
Attackers also expanded their delivery mechanisms by exploiting legitimate Zoom Event pages, creating fake summit invitations for events branded around major AI companies like OpenAI and Anthropic. Clicking the "Continue to register" button on these deceptive pages redirected users to credential-stealing interfaces or adversary-in-the-middle (AiTM) proxies, further compromising their online security.
In Brazil, the PhantomEnigma campaign compromised over 20 municipal and police web portals within the .gov.br domain to host malware. These compromised sites, along with hijacked municipal email accounts, were used to dispatch phishing lures that successfully bypassed SPF, DKIM, and DMARC email authentication checks, underscoring the difficulty in distinguishing legitimate communications from malicious ones.
The impact of these single-device intrusions often cascaded into enterprise-wide operational risks. Modular payloads like DestinyStealer were employed to harvest a wide array of sensitive data, including browser credentials, session cookies, Outlook data, VPN profiles, FileZilla logins, and cryptocurrency wallet information. These infostealers frequently evade traditional static antivirus detection by using parallel HTTP and TCP channels for exfiltration.
Researchers observed operators using live command-and-control (C2) channels, such as the OVERLORD RAT, to exfiltrate significant amounts of sensitive files and session data in near real-time. Variants of Banana RAT introduced randomized file structures and encrypted WebSocket communications, while other campaigns deployed DARTHVADER Stealer using native Windows utilities and script chains. This resilient C2 infrastructure allows adversaries to maintain persistent access long after initial execution.
A critical takeaway from these July campaigns is the rapid rotation of attacker infrastructure, outpacing traditional blacklist updates. Security teams must shift focus from static Indicator of Compromise (IOC) blocking to behavior-based telemetry, continuous session monitoring, and campaign-level correlation to effectively identify and mitigate these multi-stage attack chains before significant lateral movement occurs.