---
title: Phish Wire - April 29 2025
description: Over the past two weeks, there has been a significant increase in spear phishing attempts targeting Microsoft credentials and personal accounts on platforms like Yahoo, Netflix, and Amazon.
image: https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/Phish%20Wire%20Header%2042925.png
---
[Skip to content](https://blog.identityautomation.com/phish-wire/phish-wire-april-29-2025#main-content)
[Identity Automation is now part of Jamf. Visit Jamf.com](https://jamf.com/)
- [Request a Demo](https://www.identityautomation.com/request-a-demo)
- [Contact Us](https://www.identityautomation.com/contact)
[](https://www.identityautomation.com)
Menu
- Products
Show submenu for Products
- Identity Solutions
Show submenu for Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
Show submenu for Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
Show submenu for Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
Show submenu for Resources
- [Knowledge Base](https://blog.identityautomation.com/)
- [PhishWire](https://blog.identityautomation.com/phish-wire)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
Show submenu for About Us
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
- Products
Show submenu for Products
- Identity Solutions
Show submenu for Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
Show submenu for Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
Show submenu for Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
Show submenu for Resources
- [Knowledge Base](https://blog.identityautomation.com/)
- [PhishWire](https://blog.identityautomation.com/phish-wire)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
Show submenu for About Us
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
# Phish Wire - April 29 2025
[by Identity Automation](https://blog.identityautomation.com/phish-wire/author/identity-automation)
Over the past two weeks, there has been a significant increase in spear phishing attempts targeting Microsoft credentials and personal accounts on platforms like Yahoo, Netflix, and Amazon. During this time, we observed an unusual volume of attacks employing device fingerprinting to track users, along with other tactics such as MFA bypass tools and hosting on legitimate infrastructure. Here are some examples and highlights of these attacks.
- punchbolwinvitees\[.\]de/g/
- jikeeiiyhjj\[.\]org/
- e9lqcsobfhffcdcp0w1e\[.\]richotillomaniad\[.\]ru
- resolve-caseauthentification-netflix-id\[.\]cricketshoe\[.\]com
- hadewiumimiforlongway\[.\]com/vic/yio/invite/Yahoo\[.\]html
- behymbleeye\[.\]online
- secure\[.\]notificationupdate-statement\[.\]ntflx-en\[.\]cricketshoe\[.\]com/
- prime\[.\]20-57-0-20\[.\]cprapid\[.\]com
- gjccpe\[.\]com/invite/Yahoo\[.\]html
- 108\[.\]181\[.\]34\[.\]45
- 5e90760024404e1fb75ad0fd502ca47c\[.\]eafci\[.\]com
- kitaawurademu\[.\]shop
- ameuricoslamnpexjea\[.\]com/
- dkrl\[.\]idrvlqvkov\[.\]es
- sigmaman-name\[.\]global\[.\]ssl\[.\]fastly\[.\]net/
**Microsoft and Outlook MFA Bypass**
On April 11, an employee at a school organization clicked on a spearphishing email that contained an Adobe fileshare link.
This phishing attack operates in two stages. The first stage prompts the user to enter their email and password, while the second stage requests a one-time password or other additional credentials. The attack features logos that have been customized to resemble those of Adobe, Yahoo, AOL, and Outlook.
On April 14th, a user clicked a Microsoft phishing link hosted on the Fastly CDN domain, a legitimate CDN service that was likely abused to deliver phishing payloads.
Some additional attacks attributed to Microsoft are hosted on Russian infrastructure. They impersonate Microsoft’s OAuth2 parameters, engage in SSO flow manipulation, and utilize header injection of security controls. Additionally, these attacks contain inspirational quotes sourced from the homepages of their targeted organizations.
**Yahoo Phishing Attacks with Device Fingerprinting**
This period experienced a surge of Yahoo phishing attacks that used aggressive tracking techniques on their victims. On April 14th, an employee of a school organization clicked on the Yahoo spear phishing email below.
This attack collects detailed fingerprint data from the browser and device, including information such as device memory, the number of processors, operating system platform, and browser details. Fingerprinting enables attackers to connect stolen credentials to a specific device. As a result, they can replicate the device environment to bypass two-factor authentication using the stolen credentials.
Below are several other Yahoo examples using device fingerprinting, clicked by employees in Florida and Nevada.
**Widespread Netflix Phishing **
During this period, there was a notable increase in personal account phishing targeting users on their work devices. This included phishing attempts related to Netflix, American Express, and Amazon. A particularly widespread Netflix phishing campaign was hosted on the domain 'cricketshoe\[.\]com' and specifically targeted users in organizations located in Kentucky, Florida, and Nevada. Below are a few examples of these phishing attempts.
Some of these attacks involved a fraudulent support phone number, likely part of a callback scam.
**Mitigations**
- Block the specified domains on firewalls and endpoint security solutions.
- Educate users about phishing risks in file-sharing applications like SharePoint and OneDrive.
- Remind users about the phishing risks associated with their accounts, even when accessed from district devices.
- Instruct users to verify the support number for their financial service institution through Google, rather than calling a number found on an unverified webpage.
- Enforce multi-factor authentication (MFA) on all corporate logins to reduce the risk of credential compromise.
Dec 19, 2025
### Related Content
[All Resources](https://blog.identityautomation.com/phish-wire)
[](https://blog.identityautomation.com/phish-wire/phish-wire-october-28-2025)
Dec 19, 2025, 7:59:05 AM
##### [Phish Wire - October 28 2025](https://blog.identityautomation.com/phish-wire/phish-wire-october-28-2025)
In mid-October, there were remarkably widespread phishing campaigns, with a single OneDrive...
[](https://blog.identityautomation.com/phish-wire/phish-wire-april-3-2025)
Dec 19, 2025, 7:43:07 AM
##### [Phish Wire - April 3 2025](https://blog.identityautomation.com/phish-wire/phish-wire-april-3-2025)
A record spearphish surge continued into the second half of March, particularly with Microsoft and...
[](https://blog.identityautomation.com/phish-wire/phish-wire-august-19-2025)
Dec 19, 2025, 7:55:07 AM
##### [Phish Wire - August 19 2025](https://blog.identityautomation.com/phish-wire/phish-wire-august-19-2025)
During the first half of August, there has been a significant increase in Microsoft support scams...
[](https://blog.identityautomation.com/phish-wire/phish-wire-march-16-2026)
Mar 23, 2026, 9:15:00 AM
##### [Phish Wire - March 16, 2026](https://blog.identityautomation.com/phish-wire/phish-wire-march-16-2026)
Between February 26, 2026 and March 11, 2026, analysts identified a significant shift toward...
[.png?width=276&height=100&name=IA-a-Jamf-Company_stacked-darkmode@451x164%20(1).png "IA-a-Jamf-Company_stacked-darkmode@451x164 (1)")](https://www.identityautomation.com)
- Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
- [Knowledge Base](https://blog.identityautomation.com)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
- DIR-CPO
- [DIR-CPO-4849](https://www.identityautomation.com/dir-cpo-4849)
- [DIR-CPO-5694](https://www.identityautomation.com/dir-cpo-5694)
[Contact Us](https://www.identityautomation.com/contact)
[Request A Demo](https://www.identityautomation.com/request-a-demo)
[Privacy Policy](https://www.identityautomation.com/privacy-policy)
[Terms & Conditions](https://www.identityautomation.com/terms-of-use)
© 2026 | All Rights Reserved
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Identity Automation",
"url" : "https://blog.identityautomation.com/phish-wire/author/identity-automation"
},
"dateModified" : "2025-12-19T13:44:45.227Z",
"datePublished" : "2025-12-19T13:44:45.000Z",
"headline" : "Phish Wire - April 29 2025",
"image" : [ "https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/Phish%20Wire%20Header%2042925.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.identityautomation.com/phish-wire/phish-wire-april-29-2025",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.identityautomation.com/hubfs/Singularity/logos/id-auto-logo-mark-black.svg"
},
"name" : "Identity Automation (A Jamf Company)"
}
}
```