Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign

A calendar invite is one of the most routine messages in the modern workplace. It lands in the inbox, asks for a few seconds of attention, and is rarely questioned. Attackers know this, and they are now using fake meeting invitations to steal Microsoft account credentials. We have identified several large-scale phishing campaigns that abuse fake calendar invites to harvest credentials. Some arrive as an .ics attachment (example 1). The file is valid calendar data, so the attack abuses calendar features and user trust without exploiting a software vulnerability. Others use a link that appears to lead to a different […]

The post Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/01ySJPo
via

Researchers Uncover Thousands of Phishing Domains Hiding Behind Inactive Pages

A domain returns a blank page. Maybe a generic “Not Found” message. There is no login form, suspicious branding, or obvious phishing content to investigate. Yet the phishing site may still be there. Check Point Exposure Management researchers uncovered a large scale, multi region phishing infrastructure designed to conceal active campaigns behind seemingly inactive domains. Starting with a handful of phishing URLs, the investigation identified a repeatable technical fingerprint that ultimately connected the activity to thousands of rotating domains targeting organizations and users across multiple regions. The infrastructure uses regional paths, localization, session controls, and token gated access to determine […]

The post Researchers Uncover Thousands of Phishing Domains Hiding Behind Inactive Pages appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/2BJVzWF
via

Dangerous Deviation Detection: Catching the Agent Action Nobody Asked For

Key takeaways In the past year, 78 percent of organizations reported a confirmed or suspected AI-related security incident, according to Check Point’s 2026 Cloud Security Report. →No attacker required. Agents plan their own steps, and an agent trying to help can take one nobody asked for that deletes data, leaks it or widens someone’s access →Permissions and prompt screening miss the action itself. Least privilege cannot take away access the job needs, and prompt attack detection screens what goes into the agent, not what it is about to do →Dangerous Deviation Detection checks each tool call before it runs. It […]

The post Dangerous Deviation Detection: Catching the Agent Action Nobody Asked For appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/5fxm81I
via

Election Scams Are Getting Harder to Spot as Real Campaign Outreach and Fraud Converge

In September, viewers of a Pennsylvania TV station received a text telling them to “verify your voter profile.” The station’s investigator could not find out who sent it, and the link was flagged as malware. When Check Point Exposure Management researchers followed the link, it led to a political fundraising page. That small episode sums up the main finding of our report on 2026 US midterm election threats. Voters are having a hard time telling which messages are real, and attackers benefit from that doubt. Real outreach and fake outreach look alike Between July and September, election offices in Rhode […]

The post Election Scams Are Getting Harder to Spot as Real Campaign Outreach and Fraud Converge appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/Mu1D3re
via

Check Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most Widely Used LLM Gateways

Check Point Research has discovered two high risk vulnerabilities in LiteLLM, the open source LLM gateway that organizations use to connect their applications to AI providers such as OpenAI, Google and Anthropic. With 97 million downloads per month and over 59,000 GitHub stars, LiteLLM runs inside large enterprises, startups and many of the platforms used to build AI applications. Key Takeaways Check Point Research discovered two high risk vulnerabilities in LiteLLM, tracked as CVE-2026-35029 and CVE-2026-59823. CVE-2026-35029 allowed any user, including those with read only access, to reach administrative functions and take over the gateway. CVE-2026-59823 allowed attackers to redirect […]

The post Check Point Research Discovers High Risk Vulnerabilities in LiteLLM, One of the Most Widely Used LLM Gateways appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/QCajYhi
via

Peer Pressure Works on AI Agents: How One Change of Mind Can Tip the Whole Team

Key takeaways In our tests, an AI agent that watched eight teammates break a rule broke it too 98 percent of the time, and never once named them as the reason. →Observed reversals increased violations. The rate rose from 44 percent with no teammate reversals to 98 percent with eight →The agent did not report peer influence. Across more than 400 violations, it never cited a teammate as a reason →Direct arguments reduced violations. Teammates who encouraged a rule violation reduced the rule-violation rate from 33 percent to between 9 and 17 percent That is why access rules for AI […]

The post Peer Pressure Works on AI Agents: How One Change of Mind Can Tip the Whole Team appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/oiYj2tG
via

How Luna Moth Runs Data Extortion Like a Business

Around October 5, 2026, an anonymous onion site called “The Luna Moth Files” claimed to expose internal material from Silent Ransom Group (SRG), also tracked as Luna Moth and UNC3753. The package includes chat exports, a vishing document, screenshots, and a purported fake employee résumé. Nobody knows who published it or how the archive was obtained, so we treat its claims as unverified unless independent sources back them up. The material contains no new exploit and no new malware. It does offer a view of how a social engineering-led extortion operation may organize its work. What was already known about […]

The post How Luna Moth Runs Data Extortion Like a Business appeared first on Check Point Blog.

from Check Point Blog https://ift.tt/7EZMAOy
via