Tag
3 articles covering Takedowns across campaign analysis, detection engineering, and defender tradecraft.
Field Analysis
Microsoft's DCU disrupted EvilTokens on September 22, 2026 — a $1,500 device-code phishing platform tied to 12,000 compromised inboxes across 10,000 organisations. The operator is gone. The flow it abused is unchanged, and the serverless infrastructure pattern is the part that outlives the brand.
Read more:Microsoft Security BlogThe Hacker News
Field Analysis
Phishing kits get the headlines, but the hosting underneath them is the durable asset. A May 2026 seizure of 800+ servers, resilient scanning networks, and the routine hop behind a CDN show why takedowns rarely stick and where the defensible signal actually lives.
Read more:CISA (with NSA, DC3, FBI, and international partners)ELLIO
Field Analysis
A longitudinal study tracks how lookalike domains and cloned login flows are assembled and rotated across finance-themed phishing clusters.
Read more:The Hacker News