The Rise of Legitimate-Service Phishing: 1 in 10 Phishing Emails Now Comes From a Platform You Trust blog.knowbe4.com/the-rise-of…

Many Brands, One Kit: How Shared Infrastructure Ties Together a Sprawling Phishing Campaign KnowBe4 ThreatLabs is tracking an evolving phishing campaign that keeps changing its brand skin but never its underlying kit. In mid-September 2026, it started as cPanel mail-quota notifications, then pivoted to spoofed Microsoft and Dell delivery-failure alerts, and most recently to fake QuickBooks payment notices with the same structure, same click-tracking layer, new branding and copy every few days. HOW IT WORKS: The Lure: Each wave swaps the brand and pretends a mail-quota warning, a failed delivery, an unpaid invoice but reuses the same email template underneath. The Link: Every lure’s call-to-action routes through a compromised domain dressed up as a marketing-platform click-tracking link (the CL0/ path resembles a Constant Contact–style tracking format), which then redirects to a parked domain or a hijacked site harvesting M365 credentials. WHY IT MATTERS: On the surface, these domains have nothing in common. Underneath, three signals tie them to the same operator: Shared IP: send.smnambijabajo[.]com and cp.preparationguru[.]com both resolve to 209.94.57[.]48. Shared Certificate History : preparationguru[.]com a domain with a TLS certificate history dating to 2018, since re-registered and repurposed shares certificates with five newly surfaced domains, tying all six to the same hosting account. Naming Pattern: the click-tracking subdomains all follow the same convention — links, click, clicks, clickxs. WHAT DEFENDERS SHOULD DO: Block the shared IP and hunt your logs for subdomains matching links|click|clicks|clickxs. A shared certificate or IP is often the fastest way to burn an entire multi-brand operation in one move, instead of chasing each lure individually. #Phishing #ThreatIntel #KnowBe4ThreatLabs #CyberSecurity #InfrastructureAnalysis #M365 #CredentialHarvesting #InfoSec

Are Your AI Assistants the Next Attack Surface? blog.knowbe4.com/are-your-ai…