New AI-Assisted Phishing Kit Targets Microsoft Users to Steal Login Credentials

A phishing kit dubbed “Mycelial Mage” targets Spanish-speaking Microsoft Outlook users by hosting Outlook login clones to harvest credentials and enrich stolen data with IP/geolocation. Researchers observed dozens of domains sharing the fungal emoji marker “🍄🍄0UTL🍄🍄”; early variants exfiltrated via Telegram bot tokens, while newer, AI-assistant–improved variants shifted to Discord webhooks and added anti-analysis features, indicating a modular phishing-as-a-service ecosystem that complicates detection and response.