Cases › security breach › LR-2026-0441

AI-assisted phishing campaign via Railway compromises hundreds of organizations

Preliminary Why: 1 report: CyberScoop · subject to change · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: fix reported

Severity major

Reported 23 Mar 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity major: Many third parties affected: the source states a count of 344 victims detailed in the Huntress blog, which meets the major tier test of a stated count of two or more affected parties.

A phishing campaign used Railway, a platform-as-a-service host, to set up credential harvesting infrastructure, with lures that researchers believe were generated by AI tools. The campaign exploited Microsoft's device authentication flow to obtain valid OAuth tokens without a password or multifactor authentication. Huntress reported that hundreds of its customers fell for the scams and that 344 victims were detailed in its blog. Railway said it was first contacted by Huntress on March 6 and banned the associated accounts and blocked the domains. Huntress then issued a conditional access policy update to 60,000 Microsoft cloud tenants on emails from Railway domains. Railway's heuristics are built to catch correlations, and the campaign avoided those signals.

What happened

1 · What went wrongThe campaign exploited Microsoft's device authentication flow, which gave the attacker valid OAuth tokens for up to 90 days without a password or multifactor authentication.

2 · What it reached or didHuntress reported that hundreds of its customers fell for the scams, though it said post-compromise activity was prevented in all cases it saw.

What was done

Fix reported

““The associated accounts were banned and the domains were blocked,” Saraceno said.”

Abuse monitoring and account enforcement

Risks

Credential and privilege abuse
Primary37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Infrastructure / target

Not effective Phishing and fraud filters
Not effective (bypassed) Multi-factor sign-in and password policy

Control failure chain

L1 · Model Not stated in sourcesProvider not named

L2 · Harness Not stated in sourcesHarness not named

L3 · Application Not stated in sourcesDeployer not named

L4 · Infrastructure / target Not effective (bypassed)Organisation hit

L1 · ModelProvider not namedModel provider

No source mentions a control at this layer.

Model version not linked to a model card.

L2 · HarnessHarness not namedAgent framework vendor

No source mentions a control at this layer.

L3 · ApplicationDeployer not namedDeployer

No source mentions a control at this layer.

Other controls for this risk at this layer, not mentioned in the sources: Short-lived, scoped credentials, Secrets kept out of the model's context, Separate identity for each agent, Least-privilege access for the agent, Alerts on unusual tool use, Activity logs, Sensitive-data checks on outbound data.

L4 · Infrastructure / targetOrganisation hit

Not effectivePhishing and fraud filters“By using compromised domains and pumping out bespoke lures, the phishing emails avoid most commercial email filtering solutions.”CyberScoop

Not effective (bypassed)Multi-factor sign-in and password policy“The phishing campaign exploits Microsoft’s authentication flow for devices such as smart TVs, printers and terminals, which gives the attacker valid OAuth tokens for that account for up to 90 days without needing a password or multifactor authentication.”CyberScoop

Other controls for this risk at this layer, not mentioned in the sources: Secrets scanning.

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

Control	Part of the system	Result
Least-privilege access for the agent	L3 Application	Not stated in sources
Separate identity for each agent	L3 Application	Not stated in sources
Short-lived, scoped credentials	L3 Application	Not stated in sources
Secrets kept out of the model's context	L3 Application	Not stated in sources
Activity logs	L3 Application	Not stated in sources
Alerts on unusual tool use	L3 Application	Not stated in sources
Sensitive-data checks on outbound data	L3 Application	Not stated in sources
Multi-factor sign-in and password policy	L4 Infrastructure / target	Not effective (bypassed)
Phishing and fraud filters	L4 Infrastructure / target	Not effective
Secrets scanning	L4 Infrastructure / target	Not stated in sources

Evidence

Other parties affected 344
What was done Huntress issued a conditional access policy update to 60,000 Microsoft cloud tenants on emails from Railway domains

No source states: what the AI was doing, how it was caught, when it happened, when it was found, the direct loss, any court case, the cause, what set it off, what was done.

Show the full account: 5 items from the primary sources

What happened, in order

March 3 The campaign's tempo increased massively, after compromising a few dozen targets a day in early March.
March 6 Railway was first contacted by Huntress about phishing traffic from a specific IP address and three domains.

Not dated in the sources:

Railway banned the associated accounts and blocked the domains.
Huntress issued a conditional access policy update to 60,000 Microsoft cloud tenants on emails from Railway domains.
Huntress continued to see more than 50 compromises a day tied to Railway phishing domains.

Show every field, with its source and grade

What happened

Earliest source we hold

2026-03-23

D inferred by us from the described behaviour, reason shown

Who caused it

an outside attacker