https://calebgarber.com/tags/phishing/ Recent content in Phishing on Caleb Garber Hugo -- 0.165.0 en-us Tue, 22 Sep 2026 00:00:00 +0000 https://calebgarber.com/posts/fake-sexual-misconduct-and-title-ix-emails-are-pushing-zoho-assist-onto-university-staff-breaking-down-the-google-drive-lure-and-how-to-spot-abused-legitimate-remote-access-tools-before-they-install/ Tue, 22 Sep 2026 00:00:00 +0000 https://calebgarber.com/posts/fake-sexual-misconduct-and-title-ix-emails-are-pushing-zoho-assist-onto-university-staff-breaking-down-the-google-drive-lure-and-how-to-spot-abused-legitimate-remote-access-tools-before-they-install/ The infection chain behind the fake sexual misconduct campaign: the spoofed leadership email, the Google Drive hop, the Zoho Assist install, and the red flags that catch it before the software lands. https://calebgarber.com/posts/bigbear-2-0-aitm-phishing-mfa-bypass/ Sun, 13 Sep 2026 00:00:00 +0000 https://calebgarber.com/posts/bigbear-2-0-aitm-phishing-mfa-bypass/ BigBear 2.0 is an Evilginx2-based phishing-as-a-service that captured finished Microsoft 365 sessions after victims completed MFA, compromising 258 organizations. I break down the offy phishlet, the infrastructure, and the controls that hold. https://calebgarber.com/posts/what-the-kali365-device-code-phishing-wave-means-for-our-mfa-posture-blocking-oauth-device-code-flow-with-conditional-access/ Sat, 12 Sep 2026 16:14:00 -0500 https://calebgarber.com/posts/what-the-kali365-device-code-phishing-wave-means-for-our-mfa-posture-blocking-oauth-device-code-flow-with-conditional-access/ A Telegram-distributed phishing kit is bypassing MFA on Microsoft 365 with the OAuth device code flow. Here is how I detect and block it.