[NEW THREAT INTELLIGENCE] EUROPEAN SECURITY VENDOR TARGETED BY HACKERS FRONTING AS CISCO DOMAIN

Summary from the TLDR InfoSec newsletter

Outpost24's threat intel team uncovered a multi-stage phishing campaign that starts with DKIM-validated JP Morgan–themed emails and abused Cisco Secure Email Gateway links, then chains through Nylas tracking, a compromised Indian development company's infrastructure, and a re-registered legacy domain before landing on Cloudflare-protected infrastructure. An anti-bot “human validation” step filters out automated analysis and ultimately delivers a highly convincing Microsoft 365 credential-harvesting page, likely powered by the Kratos Phishing-as-a-Service kit.