CoFense Scam News

Finance-themed phishing campaigns are evolving toward process-oriented messaging tactics, in which email subject lines are utilizing more process-driven language rather than pressure-driven. Threat actors are shifting away from messaging that uses overt emotional urgency and toward ordinary business language that mirrors daily financial workflows.

Cofense Intelligence is observing a clear shift in phishing operations: threat actors are moving beyond broad, one-size-fits-all campaigns and adopting platform -aware delivery that adapts to the victim’s device, browser, and environment. What began as simple Windows-focused malware distribution campaigns has evolved into more sophisticated campaigns that can selectively deliver credential phishing, remote access tools, or malware across Windows, MacOS, and Android. This trend reflects a broader strategic change in the threat landscape, one that is designed to increase the likelihood of compromise, expand target coverage, and improve threat actor return on investment. 

Today’s attackers are using AI to create polymorphic phishing campaigns that continuously evolve to evade traditional detection systems. They rotate URLs, vary sender identities, change subject lines, and modify content at scale. The result is that many organisations are discovering that even sophisticated email security tools and Microsoft 365 protections cannot stand alone against modern threats. 

Cofense Intelligence has identified an active phishing campaign exploiting excitement around the FIFA World Cup 2026 to deliver a sophisticated malware family known as Voidrift. The campaign is notable for its high degree of personalization. Each email is tailored with the recipient’s name, their company’s name, and even the company’s logo embedded directly into the image of the free t-shirt, indicating that threat actors invested meaningful reconnaissance effort before launching attacks.

Artificial intelligence is accelerating one of the most significant shifts the cybersecurity industry has seen in years. During Cofense’s webinar, Inside the Shape-Shifting Inbox: A Modern Playbook for Security Leaders, CEO Marc Olsen and Board Advisor George Gerchow explored how AI is transforming phishing from a high-effort, tactical attack into a highly scalable, adaptive business risk.

This report analyzes a sophisticated IRS-themed phishing campaign that uses Elon Musk and a fake “Dogecoin Initiative” to lure victims with a promised $5,000 tax refund, then funnels them through credential harvesting and a fraudulent cryptocurrency platform. The attackers collect extensive personally identifiable information, including addresses, employment details, government-issued IDs, bank account and routing numbers, and account credentials, enabling identity theft, account takeovers, social engineering, and potential direct financial fraud. The scam further attempts to extract Bitcoin payments through a fake investment scheme while maintaining victim trust with fabricated platform activity and live support interactions, making it a multi-stage operation designed to maximize both data theft and financial

Modern phishing blends into business communication. Learn what security leaders should do when phishing no longer looks obviously suspicious. One of the biggest shifts in phishing defense is also one of the simplest to describe: phishing no longer has to look wrong to work. For security leaders, that changes the entire operating model.

Organizations face growing pressure to defend against increasingly sophisticated email threats while meeting stricter regulatory requirements. This article argues that effective email security, combining AI-driven automation with human oversight, is essential for both cyber resilience and compliance. It outlines key security controls that help organizations detect threats faster, reduce risk, and satisfy regulatory expectations.

The blog explains why traditional “spot the phish” training is no longer effective against modern phishing attacks in 2026. Today’s threats are more polished, personalized, and behavior-driven, often lacking the obvious red flags employees were trained to identify. Instead of focusing only on visual clues like bad grammar or suspicious links, organizations need awareness programs that teach contextual judgment, reinforce reporting behavior, and support employees with stronger post-delivery detection and response capabilities.

The Cofense Phishing Defense Center has identified an Amazon-themed malware delivery campaign that abuses the ClickFix self-infection technique to deliver a custom monitoring RAT known as HarborWatch Agent. This campaign highlights a growing trend in the threat landscape where attackers are abusing trusted brands and fake verification to turn users into the mechanism of their own infection. 

Threat actors are increasingly weaponizing legitimate business emails by embedding malicious links, phone scams, and spoofed branding into customizable text fields on trusted platforms like Zoom. This Cofense Intelligence report explains how these attacks bypass traditional email security controls such as DMARC, DKIM, and SPF, and highlights why contextual threat intelligence and user awareness training are critical to detecting these highly convincing phishing campaigns.

AI-generated phishing attacks are polished, personalized, and adaptive. Learn why traditional phishing red flags are no longer enough and what modern defense requires.