Search — “lincoln.ps1”

Microsoft reports ~7.3B email phishing threats in Q3 2026, dominated by credential theft, with SVG-driven CAPTCHA-gated phishing rebounding and spoofed business-service domains often delivered due to tenant/user overrides. Two campaigns are detailed: an Aug 19 'Salary Review' DOCX QR-code lure leading to device code phishing against US legal organizations, and a Sep 21 Spanish-language purchase order/payroll campaign attempting to deliver Agent Tesla via RAR archives with double extensions (.pdf.js downloader fetching Lincoln.ps1 from Firebase Storage, or .xml.exe). Microsoft does not report confirmed compromises from these campaigns; hunt for device code sign-ins following email delivery, script hosts spawning PowerShell, and the listed sender addresses.