---
title: Phish Wire - July 22 2025
description: In mid-July, there was an increase in spear-phishing attacks targeting users who were working from home.
image: https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/Phish%20Wire%20Header%20July%2022.png
---
[Skip to content](https://blog.identityautomation.com/phish-wire/phish-wire-july-22-2025#main-content)
[Identity Automation is now part of Jamf. Visit Jamf.com](https://jamf.com/)
- [Request a Demo](https://www.identityautomation.com/request-a-demo)
- [Contact Us](https://www.identityautomation.com/contact)
[](https://www.identityautomation.com)
Menu
- Products
Show submenu for Products
- Identity Solutions
Show submenu for Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
Show submenu for Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
Show submenu for Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
Show submenu for Resources
- [Knowledge Base](https://blog.identityautomation.com/)
- [PhishWire](https://blog.identityautomation.com/phish-wire)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
Show submenu for About Us
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
- Products
Show submenu for Products
- Identity Solutions
Show submenu for Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
Show submenu for Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
Show submenu for Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
Show submenu for Resources
- [Knowledge Base](https://blog.identityautomation.com/)
- [PhishWire](https://blog.identityautomation.com/phish-wire)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
Show submenu for About Us
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
# Phish Wire - July 22 2025
[by Identity Automation](https://blog.identityautomation.com/phish-wire/author/identity-automation)
In mid-July, there was an increase in spear-phishing attacks targeting users who were working from home. These attacks included MFA relay attacks and phishing links concealed within shared documents. During the same time, hackers also focused on personal accounts, with Amazon phishing campaigns that utilized aggressive user tracking tools for session hijacking and other malicious activities. Here are some examples and highlights.
- click-verify\[.\]net
- vly\[.\]xfsdm\[.\]es
- sidingunlimitedmn\[.\]cimarch\[.\]info
- hosttinsitoutpatzy\[.\]nl
- login\[.\]icustyle\[.\]icu
- confirmation-auth-acc-136\[.\]smtzeventos\[.\]com\[.\]br
- login\[.\]1890records\[.\]org
- managesecure\[.\]log-in\[.\]information-reactivate-statement\[.\]billed\[.\]carlyfall\[.\]com
- managesecure\[.\]log-in\[.\]information-reactivate-statement\[.\]billed\[.\]tinakite\[.\]com
**Outlook and Microsoft Spearphishing**
On July 7, a user at a Washington organization clicked the Outlook phishing attack on an Evite platform below.
This attack contained assets to exfiltrate credentials for multiple accounts, including Outlook, Office365, Yahoo, and AOL. It includes an MFA relay kit to harvest two-factor codes and bypass multi-factor authentication.
A similar attack, perhaps using the same phishing kit, was clicked by an administrator at an Illinois organization on July 14.
Both of these attacks not only stole emails and passwords but also returned a JSON field labeled "details" to indicate the type of credentials that were taken, such as Outlook, Yahoo, AOL, Office365, and Gmail. The phishing pages displayed the message "invalid credentials" three times before redirecting users to google.com, likely to ensure that the correct login information was captured.
On July 8, two employees at a Texas organization, including a procurement manager, clicked the Microsoft spearphish below.
The page included variables pointing to multiple legitimate Microsoft login/logout URLS.
"urlMsaSignUp": "https://login.microsoftonline.com",
"urlMsaLogout": "https://login.live.com/logout.srf",
"urlOtherIdpForget": "https://login.live.com/forgetme.srf"
These can build trust with users while confusing security analysts. On July 14th, a phishing attack likely using the same phishing kit was clicked by a staff member at a Kentucky organization.
Both phishing attacks include the ‘login’ subdomain and contain common features like random nonsensical poetic phrases generated in the \ element, like “The ethereal nitrogen knocks dispute” and “The envious jumbo lies odyssey”.
Numerous other Microsoft phishing attacks targeted users in Kentucky and Minnesota, including the following.
The page used an encrypted payload loader to evade various scanners. It also incorporates clipboard interference, replacing copied text with "awlh", likely to disrupt analysts or incident response.
**E-commerce and streaming phishing**
During the same period, Amazon phishing campaigns utilized aggressive user tracking tools. On July 7, an executive at an Illinois organization clicked the Amazon spearphish below.
As other Amazon phishing attacks recently observed, this page has a set of JavaScript scripts re-running every several milliseconds, suggesting rapid DOM manipulation, session hijacking, and script injection resistance. The following day, another staff member at the same organization clicked on another Amazon phishing attack that was part of the same campaign.
Both attacks targeted the user's personal email and were clicked on their work devices.
On July 14, a Kentucky staff member clicked on the Netflix phishing attack below on their work device.
This attack was a pixel-perfect copy of Netflix, incorporating multiple user tracking mechanisms, including custom canvas elements and invisible UI elements.
**Mitigations**
- Block the specified domains on corporate firewalls and endpoint security solutions.
- Educate users about phishing risks even on pages that purport to use MFA
- Remind users of phishing risks for their personal accounts that they access even if they are on corporate devices
- Enforce multi-factor authentication (MFA) on all corporate logins to reduce the risk of credential compromise.
Dec 19, 2025
### Related Content
[All Resources](https://blog.identityautomation.com/phish-wire)
[](https://blog.identityautomation.com/phish-wire/phish-wire-march-18-2025)
Dec 19, 2025, 7:42:22 AM
##### [Phish Wire - March 18 2025](https://blog.identityautomation.com/phish-wire/phish-wire-march-18-2025)
The past two weeks saw a record surge in zero-day spearphish targeting credentials from Microsoft...
[](https://blog.identityautomation.com/phish-wire/phish-wire-july-8-2025)
Dec 19, 2025, 7:48:31 AM
##### [Phish Wire - July 8 2025](https://blog.identityautomation.com/phish-wire/phish-wire-july-8-2025)
The last week of June and early July saw a surge in zero-day phishing attacks targeting both...
[](https://blog.identityautomation.com/phish-wire/phish-wire-february-25-2026)
Mar 3, 2026, 7:00:00 AM
##### [Phish Wire - February 25, 2026](https://blog.identityautomation.com/phish-wire/phish-wire-february-25-2026)
Between February 12, 2026 and February 25, 2026, analysts identified a sophisticated campaign...
[](https://blog.identityautomation.com/phish-wire/phish-wire-august-19-2025)
Dec 19, 2025, 7:55:07 AM
##### [Phish Wire - August 19 2025](https://blog.identityautomation.com/phish-wire/phish-wire-august-19-2025)
During the first half of August, there has been a significant increase in Microsoft support scams...
[.png?width=276&height=100&name=IA-a-Jamf-Company_stacked-darkmode@451x164%20(1).png "IA-a-Jamf-Company_stacked-darkmode@451x164 (1)")](https://www.identityautomation.com)
- Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
- [Knowledge Base](https://blog.identityautomation.com)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
- DIR-CPO
- [DIR-CPO-4849](https://www.identityautomation.com/dir-cpo-4849)
- [DIR-CPO-5694](https://www.identityautomation.com/dir-cpo-5694)
[Contact Us](https://www.identityautomation.com/contact)
[Request A Demo](https://www.identityautomation.com/request-a-demo)
[Privacy Policy](https://www.identityautomation.com/privacy-policy)
[Terms & Conditions](https://www.identityautomation.com/terms-of-use)
© 2026 | All Rights Reserved
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Identity Automation",
"url" : "https://blog.identityautomation.com/phish-wire/author/identity-automation"
},
"dateModified" : "2025-12-19T13:49:24.890Z",
"datePublished" : "2025-12-19T13:49:24.000Z",
"headline" : "Phish Wire - July 22 2025",
"image" : [ "https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/Phish%20Wire%20Header%20July%2022.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.identityautomation.com/phish-wire/phish-wire-july-22-2025",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.identityautomation.com/hubfs/Singularity/logos/id-auto-logo-mark-black.svg"
},
"name" : "Identity Automation (A Jamf Company)"
}
}
```