PIXM Blog

Tech-support scams don’t arrive by email; they’re bought as ads. How fake Microsoft Support pages reach victims through social, native and programmatic ad networks, and why that path evades email security and domain reputation.

  Ask a security team where phishing lives and the answer is reflexive: the inbox. That is where the budget goes — secure email gateways, DMARC enforcement, URL detonation sandboxes, banner warnings, awareness training built around “check the sender.” It is a formidable stack, and it works. Which is exactly why attackers stopped fighting it. […]

Amazon’s Prime Day wrapped on June 26th — and the Amazon phishing wave around it is a case study in how attackers sidestep corporate email security. Leading up to the fourth of July weekend, PIXM observed a surge of post-sale lures — refund, delivery problem, “verify your account” — reaching employees through personal inboxes, text […]

The message looks harmless — a wedding invitation, a shared card, a document someone wants you to see. It’s wedding season after all. Better yet, it arrives from a name you recognize: a colleague, a client, a friend. That is the whole trick. The social-invite phish is engineered to look like the least threatening thing […]

  Between June 23 and 30, the phishing we detected in enterprise browsers clustered around two themes that also dominated the week’s security headlines: fake e-card “invitations” that harvest corporate credentials and fake “virus” warnings that push victims to phone a scammer. Both leaned on infrastructure users are trained to trust to slip past reputation […]

  It didn’t start with an email. The user clicked a Facebook ad — a sponsored post that looked routine — and a tab opened to what looked like an official Microsoft Support page. Within seconds the browser locked up: a dialog they couldn’t dismiss, a fake security scan reporting “1,200 threats,” and their own […]

  Between June 16 and June 22, we detected phishing campaigns spanning tech support scams delivered via Facebook ads on Azure infrastructure, Microsoft credential harvesting hosted on Heroku and promoted through Google Ads, Paperless Post invitation lures targeting multiple email providers. What ties them together: these campaign abused trusted infrastructure both to host and deliver […]

Across Q1 2026, PIXM detected and analyzed over 75 distinct phishing campaigns. What stands out is not the volume — it is how rapidly the campaigns matured across the quarter. January’s attacks relied on credential harvesting forms and consumer brand impersonation. By March, the same threat surface featured 100+ phishing pages hosted on Microsoft’s own […]

  Mid October saw astonishingly widespread phishing campaigns, with a single OneDrive phishing link clicked by over 70 users within 24 hours. Similar to attacks reported in September and early October, these were hosted on Backblaze infrastructure and exfiltrated detailed information about their victims. The same period saw surges in Attack-in-the-Middle (AiTM) phishing, also hosted […]

  Early October and late September saw a concentrated wave of phishing campaigns using document share and billing updates lures, particularly across Outlook, Sharepoint and OneDrive. Many of these were hosted on legitimate infrastructure like Backblaze, Azure, and compromised small business domains, with near 100% adoption of MFA phishing flows and kits. Here are some […]

  Phishing campaigns hosted on Backblaze infrastructure seen earlier in the September substantially ratchetted up in the second half, complete with credential exfiltration through Telegram and lures referencing purchase orders. Other widespread phishing campaigns that hit half a dozen organizations during this period used Attack in the Middle (AiTM) tools to exfiltrate two factor codes […]

  The first half of September witnessed yet new records of Microsoft spearphish volume, with threat actors employing advanced evasion techniques, including payload encryption, device fingerprinting, and infrastructure abuse of reputable hosts like Backblaze, Hostinger, and Telegram’s Bot API. The same period saw sustained phishing targeting of personal accounts on work devices like American Express […]

Later August saw records of phishing activity spanning Microsoft support scams, Adobe file shares and Paperless Post deliveries. Tactics involved MFA relay kits and usage of CloudFlare infrastructure to evade detection. The same period saw continued targeting of personal accounts like Amazon and Yahoo on work devices. Below are some examples and highlights. tgcj86gcjyp[.]z13[.]web[.]core[.]windows[.]net hdbn46dhu[.]z13[.]web[.]core[.]windows[.]net […]

The first half of August has seen a major surge in Microsoft support scams using keyboard locks and other tactics to prod users to calling targeted call centers. Other Microsoft phishing attacks during this period made use of aggressive device fingerprinting, MFA relay tactics, and deliveries through event invites and PDFs. We also observed similar […]

  Phishing targeting users on work devices is not slowing down over the summer, with many employees taking their laptops home for the summer vacation months. The second half of July saw a pronounced surge in Microsoft and Outlook spearphish that demonstrated a number of interesting tactics, including multi-factor authentication phishing kits and distributed phishing […]

  The last week of June and early July saw a surge in zero-day phishing attacks targeting both corporate Microsoft/Outlook logins and personal web services (e-commerce, streaming, and email) on work devices.  Threat actors employed sophisticated tactics – from obfuscated JavaScript and fake OAuth login flows to Telegram-based exfiltration – allowing many of these phishing […]

  Early-mid June saw a surge of phishing campaigns targeting Amazon, Microsoft and Netflix accounts, including phishing kits capable of harvesting extensive personal data, like social security numbers and bank access numbers. Many Microsoft-themed attacks employed advanced evasive tactics – such as heavily obfuscated scripts, anti-scanning measures, and simulated multi-factor authentication steps. Meanwhile, an Amazon […]

  The end of May and first week of June 2025 saw a sharp uptick in zero-day phishing campaigns targeting corporate login credentials, with additional campaigns impersonating Amazon and even U.S. government login services (ID.me for IRS). Threat actors employed sophisticated evasive techniques – from multi-layer code encryption and clipboard hijacking to spoofing Microsoft’s own […]

  A surge of sophisticated zero-day phishing campaigns was observed in mid-May 2025, targeting a wide range of services including social media, e-commerce, enterprise email, telecommunications, and streaming platforms. Attackers leveraged legitimate cloud services and compromised infrastructure – from professional learning platforms to web hosting and cloud app environments – to lend credibility to their […]

The first half of May saw a continued surge in stealthy zero-day phishing attacks bypassing MFA. Between April 25 and May 8, attackers targeted both corporate email accounts (Microsoft 365/Outlook) and personal web services (e-commerce, streaming, personal email) used by employees. Many of these spear phishing pages employed multi-step login flows, fake multi-factor authentication (MFA) […]

The beginning of April has seen continued targeting of corporate credentials via stealthy means and file share platforms as well as personal account phishing on work devices, including a marked increase in financial services and Netflix phishing campaigns, often including a tech support component. Here are a few examples and highlights.   Phishing URLs   […]

A record spearphish surge continued into the second half of March, particularly via Microsoft and Outlook credentials targeted via fileshare platforms like SharePoint, OneDrive and Green Envelope. Additionally, phishing campaigns targeting users of financial services like Paypal, American Express, Chase Bank and Capital One also continued their trend. We saw a number of additional brands […]

Discover Pixm’s Latest Zero-Day Threat Intelligence Report Wondering how we gather this critical information? Take a look at this video we’ve prepared to give you an inside view of how Pixm catches zero-day threats that evade traditional security measures. The past two weeks saw a record surge in zero-day spearphish targeting credentials from Microsoft and Outlook, […]

Overview Over the past two weeks, we observed a rise in phishing activity targeting Microsoft, Google, and Yahoo accounts. Attackers leveraged techniques to flank corporate email protection, like using non-email messenger apps and filesharing tools. They also put geographically targeted content into the URLs to increase their credibility to their target organizations. Below are key […]

Overview The past two weeks saw a spike in phishing activity targeting platforms like Instagram, Microsoft and Chase Bank. Attackers leveraged sophisticated tactics, including hosting phishing pages on legitimate cloud platforms, enabling them to bypass traditional detection mechanisms. We also saw a massive surge in malware hosted on Azure infrastructure. Below are key highlights and […]

Overview PIXM recorded a massive uptick in spearphishing activity as employees returned to work following the holidays and January snow storms. These included sophisticated business email compromises, password protected Google Docs shares and targeting corporate credentials on personal email accounts. We also saw an uptick in Amazon attacks in particular. Here are some examples and […]

Overview December has continued to see targeted spearphish involving compromised mailboxes across Texas and Kentucky, as well as a massive surge in USPS phishing around the holidays. Below are some examples and highlights. Phishing URLs Here is a list of examples of phishing websites that we discovered that we recommend you update your threat intelligence […]

Overview The last two weeks have seen an uptick in spearphish targeting corporate users on their personal accounts as well as a burst of Netflix phishing activity. Here are some examples and highlights. Before we dive in, here is a list of examples of phishing websites that we discovered and we recommend you update your […]

Overview Pixm Security is excited to share our latest threat intelligence from our 500,000+ user base. This blog post covers zero-day phishing attempts we’ve blocked, key threat insights and tactics to help protect your clients. In this post, we focus on the rise of social media phishing targeting Instagram which is a blind-spot for most […]

Overview Multi-Factor Authentication (MFA) phishing campaigns targeting teachers, staff, and executive administrators in large school districts throughout the United States have continued to be on the rise since December 2023. The attacks use dadsec and phishingkit Phishing-as-a-Service (PhaaS) platforms, which include a number of stealthy features, with the purpose of compromising key administrator email accounts […]

Introduction   For many years, Customer Relationship Management (CRM) software has allowed businesses to automate sales outreach and prospecting data collection at scale. A core feature of CRM suites is the ability to automate customer interactions. This is done through the creation of campaigns with custom landing pages or emails that the platform will distribute […]

Introduction PIXM is continuing to track an active criminal group operating four campaigns targeting the users of cryptocurrency exchanges and wallets. The scammers will use an in-browser chat window to initiate a remote desktop session on the victims device, approve their own device as valid to access the users account, and then drain cryptocurrency from […]

Introduction   Cryptocurrency exchanges have been the target of sophisticated adversaries since their inception. At PIXM, we’ve been tracking these attacks since 2021, and initially came across them during the daily analysis of detections we perform for our clients. In late 2021, and continuing into 2022, the attacks we’ve detected at PIXM which are targeting […]