{"id":1444,"date":"2026-08-20T00:31:58","date_gmt":"2026-08-20T05:31:58","guid":{"rendered":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/?p=1444"},"modified":"2026-08-20T00:31:58","modified_gmt":"2026-08-20T05:31:58","slug":"ghost-phishing-attack-las-vegas","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/blog\/ghost-phishing-attack-las-vegas\/","title":{"rendered":"Ghost Phishing: The New Threat to Las Vegas Businesses"},"content":{"rendered":"
\u26a0 Cybersecurity Alert<\/span><\/p>\n

Ghost Phishing: The Email Attack Las Vegas Businesses Can’t See Coming<\/h2>\n

A new business email compromise technique hides inside an encrypted browser page \u2014 and it is already bypassing the spam filters Las Vegas companies rely on.<\/p>\n

Published by CMIT Solutions of Las Vegas \u00b7 Cybersecurity \u00b7 6 min read<\/p>\n<\/div>\n

What Is “Ghost Phishing,” and Why Does It Matter to Las Vegas Businesses?<\/h2>\n

Security researchers are tracking a new wave of business email compromise attacks built around a technique nicknamed “ghost phishing.”<\/strong> The campaign, identified by threat intelligence firm ANY.RUN and reported by The Hacker News in July 2026, uses a malware kit called EvilTokens<\/strong> to hijack Microsoft 365 accounts without ever stealing a password directly.<\/p>\n

Here is what makes it dangerous for small and mid-sized Las Vegas businesses specifically: the malicious page does not exist until it is already inside your employee’s browser. The email itself passes standard link and attachment scans because the phishing content is encrypted. It only decrypts and renders after the browser opens it \u2014 which means the security tools most local businesses depend on, from basic spam filters to network-level URL checks, never see the actual attack.<\/p>\n

By the Numbers<\/span><\/p>\n

Threat intelligence firm ANY.RUN analyzed sandbox submissions from 15,000 organizations and found phishing exposure reaching 75.6% in consulting firms, 72.8% in financial services, 71.9% in manufacturing, 67.9% in technology, and 66.1% among managed security providers<\/strong> \u2014 sectors with a heavy presence in the Las Vegas and Henderson business community.<\/p>\n<\/div>\n

How the Attack Actually Works<\/h2>\n

Ghost phishing does not rely on a fake login page that looks slightly off. It uses Microsoft Device Code Phishing<\/strong>, a legitimate Microsoft sign-in flow normally used to log in to smart TVs, printers, and other devices without a keyboard. Attackers trick an employee into entering a real, attacker-generated device code on a real Microsoft login screen \u2014 and the employee unknowingly authorizes the attacker’s session themselves.<\/p>\n