Report
The New Rules of Attacking Education in 2026
How are cyber attacks on schools and universities changing in 2026? See the threat patterns, real examples, and resilience strategies in the Huntress education report.
EvilTokens: Big Cybercrime’s AI Platform Built to Bypass Your MFA
If you missed this session on May 5, you can now watch it on demand.
Hear experts from Microsoft and Huntress break down the EvilTokens campaign and learn what it reveals about the next phase of AI-enabled cybercrime.
You’ll understand how attackers used trusted services and legitimate authentication flows to make highly tailored phishing harder to spot and easier to scale. You’ll also come away with a clearer view of why this campaign felt different and what defenders should be rethinking now.
Watch Now
Sherrod DeGrippo
GM Global Threat Intelligence, Microsoft
Lindsey O'Donnell-Welch
Principal Technical Community Engagement Writer
Jamie Levy
Senior Director, Adversary Tactics
Related Resources
- Read more about The New Rules of Attacking Education in 2026
- Read more about The AI-Powered AdversaryEbook
The AI-Powered Adversary
Learn how today’s AI-powered adversary weaponizes phishing and social engineering with real incidents Huntress has investigated. Get the download.
- Read more about Unfriendly Followers: The Black Market For Your IdentityOn-Demand Virtual Event
Unfriendly Followers: The Black Market For Your Identity
Learn how scattered public data turns into cyber threats. Watch Huntress Truman Kain and Cybersecurity Girl Caitlin Sarian break down identity risks.
- Read more about What is Device Code Phishing?Video
What is Device Code Phishing?
Device code phishing doesn’t hack its way in. It uses a legitimate authentication flow to walk right through the front door, with no password required, MFA bypassed, and session tokens handed straight to the attacker.
- Read more about EvilTokens and the Rise of AI-Powered PhishingReport
EvilTokens and the Rise of AI-Powered Phishing
See how the EvilTokens Phishing-as-a-Service campaign uses AI and device code phishing to steal Microsoft 365 tokens at scale — and the steps defenders can take to get ahead of it.
- Read more about Inside the Breaches: Lessons from M&S, Co-Op & Harrods’ Cyber IntrusionsOn-Demand Virtual Event
Inside the Breaches: Lessons from M&S, Co-Op & Harrods’ Cyber Intrusions
In April 2025, UK retailers M&S, Co-op, and Harrods suffered major cyberattacks that exposed gaps in supply chain security, credential protection, and threat response. Join Huntress investigators as they break down how these breaches unfolded, why they were effective, and what security teams can learn. This session will blend technical analysis with actionable guidance to help you strengthen defences, improve detection, and prepare for evolving threats.
- Read more about Known Gaps, Open DoorsReport
Known Gaps, Open Doors
This report, based on research from 521 security and IT professionals, examines why endpoint and identity security keeps breaking down, and why the answer isn't to add more self-managed point solutions.
- Read more about Your Hidden Competition: Inside the Business of Modern CybercrimeOn-Demand Virtual Event
Your Hidden Competition: Inside the Business of Modern Cybercrime
Modern cybercrime groups run like standard enterprises. Watch real attack demos with John Hammond and Jim Browning to learn how attackers operate and outsmart them.
- Read more about The Huntress Tragic QuadrantReport
The Huntress Tragic Quadrant
Which cyber tactics are wrecking businesses? The Huntress Tragic Quadrant ranks today’s top attacker techniques by impact and shows how to stop them.
