Phishing kits have surged with 7,295 tracked uploads in early July 2026, primarily using OAuth device-code flow and AiTM techniques. Small-to-mid business owners risk significant data breaches and financial loss if they do not implement strong authentication measures and monitor for phishing attempts.
The Short Answer
Phishing kits surged with 7,295 tracked uploads in early July 2026, primarily using OAuth device-code flow and AiTM techniques. Small-to-mid businesses risk significant financial loss and data breaches if they do not implement strong authentication measures and monitor for phishing attempts. Immediate actions include blocking unknown OAuth requests, enforcing multi-factor authentication, and conducting a comprehensive audit of authentication logs within 24 hours.
What Happened
The week of July 20–26, 2026 saw a dramatic spike in phishing-as-a-service (PhaaS) activity, with 7,295 tracked uploads recorded by security researchers. The surge was largely driven by OAuth device-code flow abuse and adversary‑in‑the‑middle (AiTM) kits targeting Microsoft 365 identities. Cybercriminal group Storm‑1747, the operator behind Tycoon2FA, logged 50 attributed uploads—down six from the prior week as law‑enforcement pressure intensified on its infrastructure. The report first appeared on Cyber Security News and was corroborated by Gurur Baran’s analysis.What We Know
The data indicates that OAuth device-code flow abuse has become a primary vector for phishing attacks, exploiting legitimate Microsoft authentication mechanisms to redirect users to malicious sites. AiTM kits, which act as intermediaries between the attacker and the victim, enable attackers to intercept communications in real time, making phishing campaigns more convincing and harder to detect. The 7,295 uploads reflect an unprecedented volume of phishing kit usage across the global market, highlighting a growing threat landscape for cloud‑based services. This activity underscores the need for organizations to monitor authentication flows and implement stringent controls against OAuth exploitation. cybersecurity vendor shortlist Sources: Guru Baran and Elizabeth MontalbanoWhy This Matters for Your Business
Phishing attacks can lead to significant financial losses, data exposure, regulatory fines, and operational disruptions. The sheer volume of 7,295 phishing kits suggests that many businesses—especially SMBs with limited IT resources—are at high risk of being targeted. A single successful phishing attack can compromise customer data, trigger legal penalties, or halt critical operations. In the context of small businesses, the average loss per incident is estimated at $10 k due to compromised credentials and potential downtime. Moreover, SMBs often lack robust monitoring systems, making them vulnerable to sophisticated phishing tactics that exploit OAuth flows and AiTM mechanisms. cybersecurity services Sources: Guru Baran and Elizabeth MontalbanoWhat You Should Do Right Now
Immediate actions are essential to mitigate this threat. Within the next 24 hours, you should block all OAuth device-code flow requests that originate from unknown or untrusted sources and enforce multi‑factor authentication for Microsoft 365 accounts. Next week, conduct a comprehensive audit of your authentication logs to identify any suspicious patterns and update your security policies accordingly. Over the next 30 days, implement an automated phishing detection system—leveraging machine learning models that flag high‑risk AI apps in Microsoft Cloud Discovery—and engage with certified vendors who specialize in endpoint security and network monitoring. A free initial security scan is available via our platform; you can start it immediately by visiting security scan. Sources: Guru Baran and Elizabeth MontalbanoThe Bigger Picture
This incident reflects a broader trend of phishing‑as‑a‑service proliferation, where attackers increasingly leverage legitimate cloud authentication mechanisms to craft convincing scams. The rise in OAuth device-code flow abuse indicates that the security community must evolve its defenses to encompass more nuanced authentication flows. Additionally, the prominence of AiTM kits demonstrates that adversaries are employing advanced interception techniques to enhance attack realism. SMBs and mid‑size enterprises should anticipate a growing threat landscape, where phishing attacks will become more sophisticated and harder to detect without proper monitoring and proactive security measures.Additional Recommendations
- Implement continuous monitoring of OAuth flows: Deploy real-time dashboards that alert on anomalous device-code requests, ensuring early detection before attackers can exploit them.
- Educate employees on phishing signs: Conduct regular training sessions highlighting the subtle differences between legitimate Microsoft authentication prompts and malicious redirects.
- Integrate threat intelligence feeds: Subscribe to reputable security feeds that provide updates on emerging phishing kits and AiTM tactics, allowing your organization to stay ahead of evolving threats.
- Leverage zero‑trust architecture: Adopt a zero‑trust approach where every request is verified, reducing the risk of unauthorized access through compromised OAuth flows.
Key Takeaways
- Block OAuth device-code flows from untrusted sources immediately to prevent unauthorized access.
- Enforce multi‑factor authentication for all Microsoft 365 accounts to reduce credential compromise risk.
- Deploy an automated phishing detection system that flags high‑risk AI apps in Microsoft Cloud Discovery.
- Schedule a free security scan via our platform to identify potential vulnerabilities quickly.
- Engage with certified vendors specializing in endpoint and network security for comprehensive protection.
Frequently Asked Questions
Q: How can my small business detect phishing attacks without an IT team? A: Small businesses can use automated tools that monitor authentication logs and flag suspicious OAuth device-code flows. Deploying a free security scan from DefendMyBusiness helps identify potential vulnerabilities in your systems, enabling you to implement simple security controls like MFA and access restrictions.
Q: What is the cost of responding to a phishing attack? A: The cost varies but typically includes downtime, data recovery, legal fines, and remediation efforts. A single incident can lead to losses ranging from $10 k to higher amounts depending on the volume of compromised data and regulatory penalties.
Q: What preventive measures can I implement before a phishing attack occurs? A: Implement multi‑factor authentication for all cloud services, block OAuth device-code flows from unknown sources, and use automated detection tools that identify high‑risk AI apps in Microsoft Cloud Discovery. These measures reduce the likelihood of successful phishing attacks.
Q: Which industries are most at risk of these phishing tactics? A: Industries heavily reliant on cloud services—such as finance, healthcare, and e‑commerce—are particularly vulnerable because they use Microsoft 365 identities for authentication. Small businesses in these sectors may face higher risks due to limited security resources.
How DefendMyBusiness Can Help
DefendMyBusiness offers a network of over 400 vetted technology providers tailored to your business’s specific threat profile. We match SMBs and mid‑size enterprises with vendors specializing in endpoint security, network monitoring, and automated phishing detection systems. By leveraging our expertise, you can quickly deploy the necessary controls without requiring an internal IT team. For immediate assessment, start a free security scan via security scan and contact us at https://defendmybusiness.com/contact for further guidance.Sources
Tags: phishing, cloud security, SMB protection, cyber threat, DefendMyBusinessRun a Free Security Scan
See exactly where your business is exposed to threats like the one in this article. Plain-English report, no credit card, no sales calls.
Want help getting your email security right?
Defend My Business helps SMBs cut through the marketing and get their email security right for their environment, budget, and compliance needs — then deploy and manage it. Through our 400+ vendor network we can often secure better pricing and terms than buying direct, and we stay vendor-neutral, so the recommendation fits you, not a sales quota. Want a second opinion? Pair this with our email security solutions or talk it through with an advisor.
Book a free call with a DMB advisor →
