---
title: Phish Wire - March 11 2025
description: There have been record surges in zero day phishing activity via social media and business collaboration platforms, completely flanking traditional security architecture that exclusively protects the inbox.
image: https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/Phish%20Wire%20Header%2031125.png
---
[Skip to content](https://blog.identityautomation.com/phish-wire/phish-wire-march-11-2025#main-content)
[Identity Automation is now part of Jamf. Visit Jamf.com](https://jamf.com/)
- [Request a Demo](https://www.identityautomation.com/request-a-demo)
- [Contact Us](https://www.identityautomation.com/contact)
[](https://www.identityautomation.com)
Menu
- Products
Show submenu for Products
- Identity Solutions
Show submenu for Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
Show submenu for Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
Show submenu for Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
Show submenu for Resources
- [Knowledge Base](https://blog.identityautomation.com/)
- [PhishWire](https://blog.identityautomation.com/phish-wire)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
Show submenu for About Us
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
- Products
Show submenu for Products
- Identity Solutions
Show submenu for Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
Show submenu for Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
Show submenu for Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
Show submenu for Resources
- [Knowledge Base](https://blog.identityautomation.com/)
- [PhishWire](https://blog.identityautomation.com/phish-wire)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
Show submenu for About Us
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
# Phish Wire - March 11 2025
[by Identity Automation](https://blog.identityautomation.com/phish-wire/author/identity-automation)
There have been record surges in zero day phishing activity via social media and business collaboration platforms, completely flanking traditional security architecture that exclusively protects the inbox.
Here are some examples and highlights.
- managepages\[.\]gsj\[.\]wax\[.\]mybluehost\[.\]me/ap/t5aqg…
- filerdcyrus\[.\]site/?zo51p
- youn\[.\]watchstreamin-tv\[.\]io/
- 1ping-tck\[.\]com/o8iu3/
- ctrlrmmlxdoccssecured3d3267893receipt\[.\]filemanagepro\[.\]com/jNgE5
- g01q\[.\]dianausil\[.\]com
- www-amzonmembershipserb\[.\]ampes\[.\]org/signin
- myevitetoyou\[.\]info/aol\[.\]html
- placevotespotifyprogram\[.\]ct\[.\]ws/en/2
- busines\[.\]metaverificationofaccount\[.\]com/business-help-center
- ywnjb\[.\]ms87569\[.\]de
**Document Share Spearphish**
A staff member at a Florida organization clicked on a Microsoft phishing link through a document share.
As the phishing link was delivered via a fileshare instead of traditional email phishing, it was 100% undetected by the Virus Total community. The same period saw a record surge in stealthy Microsoft phishing across organizations in Texas, Idaho, Minnesota, Florida, Tennessee, among others.
These links reference a number of fileshare and non-email applications like Spotify and Adobe. A notable tactic also included URL parameters that mimicked Microsoft's authentication flow.
**Social Media Phishing Through Policy Violations**
Multiple users were targeted via Meta’s Facebook and Instagram platforms. For example, a staff member at a Texas organization received a message about a Facebook policy violation that warned them of an imminent account suspension pending an appeal. The phishing link itself led to a fake appeal page.
Fear of social media account suspensions is a powerful driver for many people, particularly if there is a livelihood based on a social following. Another staff member at the same organization fell for an Instagram phishing attack the day before.
As these phishing links tend to be delivered via native messaging apps, they completely flank typical corporate protections.
**Personal Phishing Attacks on Work Devices**
The surge included a wave of personal phishing attacks targeting work devices associated with Amazon, Netflix, Yahoo, and other personal accounts.
- 
As seen in prior reports, staff are increasingly accessing personal accounts and applications on work devices, which remains a key vulnerability even in otherwise well protected corporate environments.
**Mitigations**
- Block the specified domains on corporate firewalls and endpoint security solutions.
- Increase awareness about phishing on business collaboration, personal, and social media platforms. Phishing is not only a corporate email issue.
- Enforce multi-factor authentication (MFA) on all corporate logins to reduce the risk of credential compromise.
Dec 19, 2025
### Related Content
[All Resources](https://blog.identityautomation.com/phish-wire)
[](https://blog.identityautomation.com/phish-wire/phish-wire-december-8-2025)
Jan 15, 2026, 11:53:13 AM
##### [Phish Wire - December 8, 2025](https://blog.identityautomation.com/phish-wire/phish-wire-december-8-2025)
The last two weeks have experienced an increase in spearphishing targeting corporate users on their...
[](https://blog.identityautomation.com/phish-wire/phish-wire-december-22-2025)
Jan 15, 2026, 11:53:31 AM
##### [Phish Wire - December 22, 2025](https://blog.identityautomation.com/phish-wire/phish-wire-december-22-2025)
Between December 06 and December 18, 2025, analysts identified a sophisticated phishing campaign...
[](https://blog.identityautomation.com/phish-wire/phish-wire-april-27-2026)
May 5, 2026, 2:36:38 PM
##### [Phish Wire - April 27, 2026](https://blog.identityautomation.com/phish-wire/phish-wire-april-27-2026)
Between April 09, 2026 and April 22, 2026, analysts identified a highly sophisticated phishing...
[](https://blog.identityautomation.com/phish-wire/phish-wire-feb-11-2025)
Dec 19, 2025, 7:37:05 AM
##### [Phish Wire - Feb 11 2025](https://blog.identityautomation.com/phish-wire/phish-wire-feb-11-2025)
Online threats continue to evolve quickly, with recent reports highlighting a substantial rise in...
[.png?width=276&height=100&name=IA-a-Jamf-Company_stacked-darkmode@451x164%20(1).png "IA-a-Jamf-Company_stacked-darkmode@451x164 (1)")](https://www.identityautomation.com)
- Identity Solutions
- [Identity Lifecycle Management](https://www.identityautomation.com/products/identity-lifecycle-management/)
- [Access Governance](https://www.identityautomation.com/products/access-governance)
- [Authentication](https://www.identityautomation.com/products/authentication)
- [Threat Detection & Response](https://www.identityautomation.com/products/threat-detection-and-response)
- [FusionID](https://www.identityautomation.com/fusionid)
- Classroom Solutions
- [Student-Teacher Portal](https://www.identityautomation.com/products/student-teacher-portal)
- [Rostering](https://www.identityautomation.com/products/rostering)
- [Insights](https://www.identityautomation.com/products/insights)
- Industries
- [K-12](https://www.identityautomation.com/industries/k-12-education)
- [Higher Ed](https://www.identityautomation.com/industries/higher-ed)
- [Healthcare](https://www.identityautomation.com/industries/healthcare)
- Resources
- [Knowledge Base](https://blog.identityautomation.com)
- [Events](https://www.identityautomation.com/resources/events)
- [Support](https://help.rapididentity.com/)
- [Trust Center](https://www.identityautomation.com/trust-center)
- [SSO & Rostering Integrations](https://www.identityautomation.com/sso-rostering-integration)
- [About Us](https://www.identityautomation.com/about-us)
- [Why IA?](https://www.identityautomation.com/why-ia)
- [Careers](https://www.jamf.com/about/careers/)
- DIR-CPO
- [DIR-CPO-4849](https://www.identityautomation.com/dir-cpo-4849)
- [DIR-CPO-5694](https://www.identityautomation.com/dir-cpo-5694)
[Contact Us](https://www.identityautomation.com/contact)
[Request A Demo](https://www.identityautomation.com/request-a-demo)
[Privacy Policy](https://www.identityautomation.com/privacy-policy)
[Terms & Conditions](https://www.identityautomation.com/terms-of-use)
© 2026 | All Rights Reserved
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Identity Automation",
"url" : "https://blog.identityautomation.com/phish-wire/author/identity-automation"
},
"dateModified" : "2025-12-19T13:41:32.930Z",
"datePublished" : "2025-12-19T13:41:32.000Z",
"headline" : "Phish Wire - March 11 2025",
"image" : [ "https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/Phish%20Wire%20Header%2031125.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.identityautomation.com/phish-wire/phish-wire-march-11-2025",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.identityautomation.com/hubfs/Singularity/logos/id-auto-logo-mark-black.svg"
},
"name" : "Identity Automation (A Jamf Company)"
}
}
```