The IT Nerd

 Researchers have discovered that cybercriminals have orchestrated a sophisticated phishing campaign using Simplified AI, a legitimate AI marketing platform, to steal Microsoft 365 credentials from the U.S.-based organizations.

During the phishing campaign, threat actors hosted a phishing webpage under the legitimate Simplified AI domain, blending malicious activity into the daily noise of enterprise traffic. By impersonating an executive from a global pharmaceutical distributor, the threat actors delivered a password-protected PDF that appeared legitimate. Once opened, the file redirected the victim to Simplified AI’s website, but instead of generating content, the site became a launchpad to a fake Microsoft 365 login portal designed to harvest enterprise credentials.  

This social engineering combined with phishing highlights a dangerous evolution: threat actors are merging impersonation with sophisticated phishing techniques while exploiting the era of AI adoption in enterprise organizations. They are no longer relying on suspicious servers or cheap lookalike domains. Instead, they abuse the reputation and infrastructure of trusted AI platforms. These are platforms your employees already rely on, or that your security team may implicitly trust, allowing threat actors to bypass defenses and slip into your organization under the cover of legitimacy. 

Javvad Malik, Lead Security Awareness Advocate at KnowBe4, providing the following commentary:

“We’re seeing attackers piggyback our own shortcuts. If a link lands on a whitelisted AI platform everyone already uses, it feels safe. In a busy world, while many are multi-tasking, it’s easy to see branding, a familiar layout, and a PDF and lower their defenses. That’s precisely what this attack is seeking to do.”

“It’s why we need to treat AI platforms like any other third-party app. We should use them, but verify. Turn on phishing-resistant MFA so a stolen password doesn’t result in a breach. Be wary of password-protected attachments, reporting them to IT or Security teams to inspect if unsure. Keep an eye on which AI apps and OAuth consents your teams are actually using. And if an email nudges you to log in somewhere new, pause and verify before you type a single character.”

This is pretty scary as this would be pretty hard to detect. It just shows how threat actors are evolving to make their attacks more effective. And it means that in response we need to find and implement new and stronger defenses to ensure that threat actors don’t win.

Tire giant Bridgestone has confirmed it is investigating a cyberattack that impacts the operation of manufacturing facilities in North America. Bridgestone doesn’t yet know how bad this is.

Rebecca Moody, Head of Data Research at Comparitech had this comment: 

“As our August ransomware roundup report found, manufacturers are facing an increasing number of ransomware attacks (figures rose by 57 percent from July to August). Manufacturers are a prime target for hackers due to the amount of disruption they can cause by encrypting systems–something we’re also seeing with Jaguar Land Rover in the UK. If this is a ransomware attack and Bridgestone hasn’t paid a ransom, it’s likely we’ll see a group claiming the attack in the coming weeks. For example, in the last 24 hours, Scattered Spider has come forward to claim the JLR attack.”

Erich Kron, Security Awareness Advocate at KnowBe4 adds this: 

“While every industry is threatened by modern cyberattacks, organizations in time sensitive industries such as manufacturing or healthcare can really suffer when an attack occurs. Even if the attack doesn’t get very far, it is generally wise to shut down or isolate networks or systems before malicious things can spread. This means that even if the actual production systems are not impacted, the manufacturing lines can stop while things are being checked, then must be restarted again, which is not a trivial matter. Even with those challenges, it is much better to be safe than to risk an actual cyberattack, such as ransomware, getting loose within the organization.”

“Organizations that perform time sensitive tasks need to have a good business continuity plan in place that includes recovery and steps to be taken to minimize damage. This is not something you want to be coming up with on the fly during an attack, so planning for it is essential.”

“Since a majority of malware, including ransomware, is spread through modern social engineering attacks such as email phishing, it has never been more critical to have a good human risk management program in place that helps reduce the chances of a human error causing significant problems.”

Paul Bischoff, Consumer Privacy Advocate at Comparitech provided this comment: 

“This attack has many of the hallmarks of a ransomware attack, although ransomware hasn’t been confirmed as the culprit yet. Bridgestone suffered a previous ransomware attack in 2022 by LockBit, which would make this the second time that the company fell victim to ransomware. This attack actually disrupted the company’s manufacturing facilities, not just non-essential stuff like communications, sales, and payroll like we see with most attacks. Although Bridgestone says it stopped the attack early, it’s best to assume the worst until the investigation is complete.”

Chris Hauk, Consumer Privacy Champion at Pixel Privacy chimes in with this comment:

“We can expect to continue to see cyber-attacks on companies like this, attacks that aren’t aimed at stealing data but that target their manufacturing facilities. While Bridgestone believes no customer or company data was compromised, Bridgestone customers and employees will still want to stay alert for phishing attempts, as well as possible new accounts opened in their name. Firestone customers should also be on alert, as Firestone is a subsidiary of Bridgestone.”

Bridgestone customers should be prepared for attacks as I totally see that coming. I’m basing that on the fact that Bridgestone doesn’t yet know the extent of this incident. But I am willing to bet that it will be bad.