China-Sponsored Attackers Target 40K Corporate Users in 90 Days

Researchers identified three state-sponsored credential-phishing campaigns—LegalQloud, Eqooqp, and Boomer—that use highly evasive and adaptive techniques (AitM proxies, MFA bypass, dynamic phishing links, server-side generated pages, bot-detection evasion) to harvest Microsoft credentials from corporate users across multiple industries; the activity, linked to a group tracked as Storm-1101/DEV-1101, impacted tens of thousands of users and bypassed legacy URL filtering and other security controls.