There is growing commercial availability of AI-enabled cyberattack packages that automate attack workflows at high prices.

Attackers seek app passwords, OAuth consents, QR/device links, or tokens to trigger malware and data exfiltration.

Defenses emphasize threat intelligence and tools like Bitdefender Scamio and Bitdefender Ultimate Security to analyze suspicious messages, links, and QR codes.

EU officials face state-supported spearphishing campaigns that exploit social engineering to hijack senior officials’ messaging accounts.

The EU Joint Cyber Unit warns eight spear-phishing attacks pose a major risk to high-ranking officials and government operations in 2026.

German security agencies have flagged phishing tied to state-backed actors targeting Signal users—politicians, diplomats, and journalists—since early this year.

Practical defenses include avoiding unfamiliar app passwords, revoking unknown credentials, auditing linked devices, treating unsolicited OAuth prompts with suspicion, and considering the Google Advanced Protection Program for high-risk individuals.

Attackers favor DeepSeek for its power and lax guardrails, making scale cheaper compared to tightly regulated models.

Campaigns risk broader supply-chain exposure as attackers may compromise MSPs and leverage trusted networks to extend access.

UNC5976 uses automated OAuth phishing from cloud infrastructure, harvesting tokens since March 2026 and creating attacker-controlled domains.

UNC5976 targets Ukraine, Armenia, and defense/NGO sectors with cloud-hosted scripts and token harvesting, distributing tools linked to a Ukrainian research institute.

From August 2026, cloud-based OAuth phishing dominates across groups, with UNC6293 and UNC5976 showing post-compromise infrastructure and increased malware use.