Tuesday, 4 August 2026

Device-code phishing surges 1,500% as vishing attacks double

A new report shows device-code phishing attacks increased by 1,500% over the past year, while voice phishing (vishing) has doubled, marking a decisive pivot in credential-theft tactics away from traditional email lures. Device-code phishing abuses the OAuth device authorization flow used by services such as Microsoft 365 and cloud collaboration tools: victims are tricked into approving a legitimate-looking sign-in code, handing attackers a valid session token that bypasses passwords and, critically, most multi-factor authentication. Increasingly these campaigns are paired with vishing, where attackers impersonate IT helpdesk staff by phone to walk targets through the approval step in real time. For corporate security teams, this closes a gap that MFA alone can no longer cover, and disproportionately targets finance, executive assistants and IT support staff with access to sensitive systems. Organisations should restrict or disable device-code authentication flows where not operationally required, enforce phishing-resistant hardware-based MFA (FIDO2/passkeys), mandate callback verification for any helpdesk-initiated request, and run targeted vishing-awareness training for high-value staff. Continuous monitoring for anomalous device-authorization requests should be treated as a priority detection use case.

Mission Support's cyber security team helps organisations harden identity and access controls against modern phishing techniques like device-code and vishing attacks.

Ukrainian drone strike on Russian beach kills seven, injures 40

Russian authorities report that a Ukrainian drone strike hit a crowded beach, killing seven people and injuring around 40, underscoring how the war's reach is extending deeper into Russian civilian and coastal areas far from the front line. The incident follows a pattern of strikes on logistics, energy and now leisure infrastructure, and signals that Ukraine's long-range drone campaign is both intensifying and expanding geographically. For organisations with personnel, assets or supply chains touching Russia, the wider Black Sea region, or transit routes through Russian airspace and territorial waters, this raises the probability of further disruption to travel, insurance conditions and physical safety near military, energy and now tourist sites. Retaliatory strikes and tightened Russian security measures at public venues are also likely, which can affect the safety of any personnel still present in-country. Companies should reassess travel risk ratings for Russia and adjoining regions, review evacuation and duty-of-care plans for any remaining staff, monitor for airspace and maritime advisories affecting cargo and logistics routes, and maintain close coordination with intelligence and insurance providers on evolving conflict dynamics.

Iran says it is talking to Oman, not the US, as Trump claims negotiations are resuming

Iran has confirmed it is engaged in indirect talks with the United States via Oman, even as it publicly denies direct negotiations, shortly after President Trump signalled that discussions were set to resume. The carefully worded distinction matters: it suggests both sides are testing the ground for renewed nuclear diplomacy without either committing politically to direct engagement, a dynamic that has repeatedly produced volatility in oil markets and Gulf security postures in the past. For organisations operating in or shipping through the Gulf, any credible move toward or away from a deal has immediate implications for freight insurance, tanker traffic through the Strait of Hormuz, and the broader risk of proxy escalation involving Iran-aligned actors across the region. Sanctions-exposed businesses should also watch closely, as a negotiated framework could shift compliance obligations with little notice. Security and procurement teams should treat this as an early-warning signal rather than a resolved outcome: maintain contingency plans for Gulf shipping disruption, track sanctions guidance from relevant authorities, and factor renewed negotiation uncertainty into short-term risk assessments for personnel and assets in the region.

EU calls for stronger borders after surge in Ceuta migrant crossings

The European Union has called for stronger external borders after a fresh surge in migrant crossings into the Spanish enclave of Ceuta, with emergency talks among EU ministers reflecting a shift in tone among member states toward tougher, more coordinated border enforcement. Ceuta's land border with Morocco has long been a pressure point for irregular migration into Europe, and repeated surges there tend to trigger broader EU-level responses, including changes to Frontex deployment, funding priorities and, at times, temporary controls that ripple into wider Schengen movement. For organisations operating facilities, logistics or personnel near Mediterranean and North African border crossings, this signals a period of heightened security posture, potential delays at checkpoints, and possible protest or civil unrest activity around reception and processing centres. It also reflects a broader European political trend toward stricter migration and border policy, which may affect compliance requirements for companies operating cross-border logistics or workforce mobility programmes in the region. Security teams should monitor for updated Frontex and national border guidance, review contingency plans for personnel transiting affected crossings, and watch for follow-on policy decisions from the EU ministerial meeting.

Rhine falls to record low levels as drought strains Europe's rivers

Water levels on the Rhine have fallen to record lows as drought conditions intensify across Europe, straining one of the continent's most critical inland shipping arteries at the height of the summer logistics season. The Rhine carries a substantial share of bulk freight, chemicals, fuel and industrial components between Rotterdam's port and manufacturing hubs in Germany and Switzerland; low water forces barge operators to reduce cargo loads or halt sailings entirely, with knock-on effects for just-in-time supply chains, energy deliveries and commodity pricing. This is a recurring and worsening pattern rather than an isolated event, and it compounds existing pressure on European logistics networks already stretched by geopolitical disruption elsewhere. Organisations reliant on Rhine-based transport, or with facilities dependent on barge-delivered raw materials and fuel, should treat this as a business continuity issue rather than a purely environmental one. Practical steps include diversifying transport modes and routes in advance of further drops, building buffer stock for critical inputs, monitoring river-level forecasts alongside supply chain risk dashboards, and stress-testing contracts for force majeure exposure tied to water-level disruptions.

Mission Support's advisory intelligence service tracks environmental and infrastructure risks like the Rhine drought to keep clients' supply chains and operations ahead of disruption.

Explosive device found in garden of Rotterdam home, bomb squad deployed

An explosive device was discovered in the garden of a residential property in Rotterdam, prompting the deployment of the Dutch bomb disposal unit (EOD) to make the area safe. While details on motive and target remain limited, the incident adds to a pattern of explosive-related incidents at private addresses in the Netherlands over recent years, often linked to criminal score-settling, extortion attempts against residents or businesses, or intimidation connected to organised crime. Such incidents, even when not directed at commercial premises, raise the operating risk profile for residential security details, executive protection assignments and any personnel housed near affected neighbourhoods during EOD operations and cordons. They also underline a broader trend of criminal actors in the Netherlands using explosives and incendiary devices as a low-cost, high-impact intimidation tool, which corporate and residential security planning increasingly needs to account for. Organisations providing executive or residential protection in the Netherlands should ensure protective details are briefed on evolving explosive-related crime patterns, coordinate response protocols with local police and EOD procedures, and review perimeter and access security at residences of high-profile individuals in areas with elevated organised-crime activity.

Mission Support's specialist operations team coordinates with police and EOD services to secure sites and residences affected by explosive-related incidents.

20-year-old man arrested in Bergen op Zoom in terrorism investigation

Dutch authorities have arrested a 20-year-old man in Bergen op Zoom as part of a terrorism investigation, the latest in a series of counter-terrorism actions targeting young suspects in the Netherlands. While specific details of the alleged plot have not been disclosed, the arrest reflects continued vigilance from Dutch intelligence and law enforcement services around radicalisation, particularly among younger individuals often identified through online channels rather than established networks. For organisations operating public-facing venues, transport hubs, religious or cultural sites, and high-footfall commercial locations in the Netherlands, such investigations are a reminder that terrorism threat levels, while currently assessed as substantial, remain dynamic and can shift quickly around individual cases. It also reinforces the value of maintaining strong relationships with local police and intelligence liaison contacts, as early-stage investigations often precede broader public threat assessments. Security teams should ensure venue and event security plans are current, staff are briefed on suspicious behaviour indicators, and reporting channels to the National Coordinator for Security and Counterterrorism (NCTV) threat picture are actively monitored, particularly for sites in or near Bergen op Zoom and the wider Brabant region in the near term.

Mission Support's advisory intelligence service monitors evolving terrorism threat indicators in the Netherlands to keep clients' venue and personnel security plans current.

Limburg wildfire grows to 100 hectares, NL-Alert remains in effect

A wildfire in Limburg has grown to cover roughly 100 hectares and is not expected to be brought under control before tomorrow morning, with an NL-Alert remaining in effect for residents and businesses in the affected area. The fire follows a broader pattern flagged separately this week showing that wildfire risk in the Netherlands has nearly doubled over the past decade, driven by prolonged dry spells and changing land management. For organisations with facilities, logistics operations or personnel in Limburg and other wildfire-prone areas of the southern and eastern Netherlands, active fires of this scale can disrupt road access, utilities and staff safety with little warning, and secondary risks include smoke exposure and evacuation of nearby sites. This is also a useful moment to review broader emergency preparedness, since NL-Alert-triggering incidents test whether staff know how to respond regardless of the specific hazard. Businesses in or near the affected region should confirm current access and safety status before dispatching personnel, ensure emergency notification systems are synced with NL-Alert coverage, and use the incident to validate site evacuation and business continuity plans against a growing wildfire risk profile in the Netherlands.