Threat BriefingMarch 23, 2026

Weekly Threat Briefing: March 17–23, 2026

Surge in AI-generated phishing targeting financial services, new credential harvesting kit exploiting OAuth redirect flows, and community reporting hits all-time high.

Overview

This week saw a notable spike in AI-generated phishing emails targeting financial services employees. The vspam.org community submitted 9,412 reports — a new weekly record — with 7,203 confirmed and 1,089 rejected. Community response time averaged 38 minutes from submission to confirmation.

AI-Generated Phishing Emails

A coordinated campaign targeting banking and insurance employees used large language models to generate highly personalized phishing emails. Unlike traditional template-based phishing, these emails contained contextually accurate industry terminology and mimicked internal communication patterns.

423423 unique phishing URLs identified across 89 domains

—Emails referenced real regulatory changes (Basel IV timelines) to establish credibility

—Sender addresses spoofed legitimate financial compliance firms

—Landing pages used AI-generated profile photos for fake compliance officers

—Detection rate by traditional email filters: 31% (vs. 78% for template phishing)

OAuth Redirect Flow Exploitation

A new credential harvesting kit dubbed 'AuthSnag-2' was discovered exploiting OAuth authorization code redirect flows in enterprise SSO implementations. The kit intercepts OAuth redirect URIs by registering lookalike callback domains.

—Targeting Microsoft Entra ID and Okta primarily

6767 registered redirect domains mimicking legitimate OAuth callbacks

—Exfiltrated tokens grant persistent access without triggering MFA re-prompts

—Kit sold on Telegram for $800/month with managed infrastructure

—Indicators added to vspam.org feeds within 4 hours of first report

Platform Metrics

Key community metrics for the week:

9,4129,412 total reports submitted (+14% week-over-week)

7,2037,203 confirmed, 1,089 rejected, 1,120 pending review

—Median confirmation time: 38 minutes

1212 new Trusted-tier reporters promoted from Newcomer

—DNSBL zone size: 34,891 active entries (+2.1%)

Top Targeted Brands

This week's most impersonated brands by confirmed phishing report volume:

Microsoft

31%driven by the OAuth campaign

JPMorgan Chase

12%AI-generated financial phishing

PayPal

9%steady volume of credential harvesting

DHL

8%package delivery SMS phishing

Amazon

7%fake order confirmation emails

Tagsai-phishingoauth-abusefinancial-servicesweekly-briefing

For automated IOC data from this briefing, check the threat feeds. Questions about our analysis? Contact research@vspam.org.