Operation Fake KickOff: Attackers Abuse Recruiters and SaaS to Harvest Work Credentials

Reported 15 Jul 2026 by otx · Severity: medium

A sophisticated multi-stage phishing operation has been active since April 2025, systematically exploiting legitimate SaaS platforms and cloud services to steal corporate credentials. The campaign utilizes 232 phishing domains and 80 command-and-control servers, primarily imperso