Tuesday, 4 August 2026

Device-code phishing surges 1,500% as vishing attacks double

A new report shows device-code phishing attacks rose by 1,500% over the past year, while voice phishing (vishing) has doubled. Credential theft is moving away from traditional email lures. Device-code phishing abuses the OAuth device authorization flow used by services such as Microsoft 365 and cloud collaboration tools. The victim is tricked into approving a legitimate-looking sign-in code, which hands the attacker a valid session token. That token bypasses passwords and most multi-factor authentication. These campaigns are increasingly paired with vishing: an attacker poses as IT helpdesk staff on the phone and talks the target through the approval step in real time. MFA alone no longer closes this gap, and the attacks focus on finance teams, executive assistants and IT support staff with access to sensitive systems. Restrict or disable device-code authentication where you don't need it. Move to phishing-resistant, hardware-based MFA (FIDO2/passkeys). Require a callback to verify any request that comes from the helpdesk, and give high-value staff targeted vishing-awareness training. Make monitoring for unusual device-authorization requests a priority detection use case.

Mission Support's cyber security team helps organisations harden identity and access controls against modern phishing techniques like device-code and vishing attacks.

Ukrainian drone strike on Russian beach kills seven, injures 40

Russian authorities report that a Ukrainian drone strike hit a crowded beach, killing seven people and injuring around 40. The war is reaching deeper into Russian civilian and coastal areas far from the front line. The strike follows a pattern of attacks on logistics and energy infrastructure, and now on leisure sites too. It suggests Ukraine's long-range drone campaign is both intensifying and spreading geographically. If you have staff, assets or supply chains linked to Russia, the wider Black Sea region, or transit routes through Russian airspace and territorial waters, expect more disruption. That covers travel, insurance conditions and physical safety near military, energy and now tourist sites. Retaliatory strikes and tighter Russian security at public venues are also likely, which affects any staff still in the country. Reassess travel risk ratings for Russia and neighbouring regions. Review evacuation and duty-of-care plans for remaining staff. Watch airspace and maritime advisories that affect cargo and logistics routes. Stay in close contact with your intelligence and insurance providers as the conflict develops.

Iran says it is talking to Oman, not the US, as Trump claims negotiations are resuming

Iran has confirmed it is holding indirect talks with the United States via Oman, while publicly denying direct negotiations. The confirmation came shortly after President Trump signalled that discussions were set to resume. The carefully worded distinction matters. Both sides appear to be testing the ground for renewed nuclear diplomacy without committing politically to direct engagement. In the past, that dynamic has repeatedly unsettled oil markets and Gulf security. If you operate in or ship through the Gulf, any credible move towards or away from a deal has immediate effects. It touches freight insurance, tanker traffic through the Strait of Hormuz and the wider risk of proxy escalation by Iran-aligned actors across the region. Sanctions-exposed businesses should watch closely too, because a negotiated framework could change compliance obligations at short notice. Treat this as an early warning, not a settled outcome. Keep contingency plans for Gulf shipping disruption current. Track sanctions guidance from the relevant authorities. Build the renewed uncertainty around negotiations into short-term risk assessments for staff and assets in the region.

EU calls for stronger borders after surge in Ceuta migrant crossings

The European Union has called for stronger external borders after a new surge in migrant crossings into the Spanish enclave of Ceuta. Emergency talks among EU ministers show member states shifting towards tougher, better-coordinated border enforcement. Ceuta's land border with Morocco has long been a pressure point for irregular migration into Europe. Surges there tend to trigger wider EU responses, such as changes to Frontex deployment and funding priorities. Sometimes they lead to temporary controls that ripple into wider Schengen movement. If you have facilities, logistics or staff near Mediterranean and North African border crossings, expect tighter security and possible delays at checkpoints. Protests or unrest around reception and processing centres are also possible. The move reflects a broader European political trend towards stricter migration and border policy. That may change compliance requirements for companies running cross-border logistics or workforce mobility programmes in the region. Watch for updated Frontex and national border guidance. Review contingency plans for staff using the affected crossings, and follow the policy decisions that come out of the EU ministerial meeting.

Rhine falls to record low levels as drought strains Europe's rivers

Water levels on the Rhine have fallen to record lows as drought intensifies across Europe. One of the continent's most important inland shipping routes is under strain at the height of the summer logistics season. The Rhine carries a large share of bulk freight, chemicals, fuel and industrial components between the port of Rotterdam and manufacturing hubs in Germany and Switzerland. Low water forces barge operators to cut cargo loads or stop sailing altogether. That hits just-in-time supply chains, energy deliveries and commodity prices. This is a recurring pattern that is getting worse, not a one-off. It adds to the pressure on European logistics networks already stretched by geopolitical disruption elsewhere. Do you rely on Rhine transport, or on raw materials and fuel delivered by barge? Then treat this as a business continuity issue rather than a purely environmental one. Spread transport across other modes and routes before levels drop further. Build buffer stock of critical inputs. Track river-level forecasts next to your supply chain risk dashboards. Check your contracts for force majeure exposure linked to low water.

Mission Support's advisory intelligence service tracks environmental and infrastructure risks such as the Rhine drought, so clients can adjust supply chains before disruption hits.

Explosive device found in garden of Rotterdam home, bomb squad deployed

An explosive device was found in the garden of a house in Rotterdam, and the Dutch bomb disposal unit (EOD) was called in to make the area safe. Details on motive and target are still limited. The incident adds to a pattern of explosives at private addresses in the Netherlands in recent years. They are often linked to criminal score-settling, extortion of residents or businesses, or intimidation connected to organised crime. Even when commercial premises are not the target, such incidents raise the risk for residential security details and executive protection assignments. The same applies to staff housed nearby while EOD operations and cordons are in place. Criminals in the Netherlands increasingly use explosives and incendiary devices as a cheap, high-impact way to intimidate, and security planning for companies and homes has to allow for that. If you provide executive or residential protection in the Netherlands, brief your protection teams on how explosive-related crime is changing. Align response procedures with local police and EOD practice. Review perimeter and access security at the homes of high-profile individuals in areas with high organised-crime activity.

Mission Support's specialist operations team coordinates with police and EOD services to secure sites and residences affected by explosive-related incidents.

20-year-old man arrested in Bergen op Zoom in terrorism investigation

Dutch authorities have arrested a 20-year-old man in Bergen op Zoom as part of a terrorism investigation. It is the latest in a series of counter-terrorism actions against young suspects in the Netherlands. Details of the alleged plot have not been disclosed. The arrest reflects continued vigilance by Dutch intelligence and law enforcement around radicalisation. The focus is on young people, who are often identified through online channels rather than established networks. The terrorism threat level is currently assessed as substantial. That matters if you run public-facing venues, transport hubs, religious or cultural sites or busy commercial locations in the Netherlands. That level is not static, and it can shift quickly around individual cases. Good relationships with local police and intelligence liaison contacts are worth keeping, because early-stage investigations often come before wider public threat assessments. Keep venue and event security plans current. Brief staff on the signs of suspicious behaviour. Actively follow the threat picture from the National Coordinator for Security and Counterterrorism (NCTV). In the near term, that applies most to sites in or near Bergen op Zoom and the wider Brabant region.

Mission Support's advisory intelligence service monitors evolving terrorism threat indicators in the Netherlands to keep clients' venue and personnel security plans current.

Limburg wildfire grows to 100 hectares, NL-Alert remains in effect

A wildfire in Limburg has grown to roughly 100 hectares and is not expected to be under control before tomorrow morning. An NL-Alert remains in effect for residents and businesses in the affected area. The fire follows a broader pattern flagged separately this week. Wildfire risk in the Netherlands has nearly doubled over the past decade, driven by long dry spells and changes in land management. Fires of this size can cut road access, disrupt utilities and put staff at risk with little warning. That applies to facilities, logistics operations and staff in Limburg and other wildfire-prone parts of the southern and eastern Netherlands. Smoke exposure and the evacuation of nearby sites are secondary risks. It is also a good moment to review emergency preparedness more broadly. Any incident that triggers an NL-Alert tests whether staff know how to respond, whatever the hazard. If you are in or near the affected region, confirm the current access and safety status before sending people out. Make sure your own emergency notification systems line up with NL-Alert coverage. Use the incident to test site evacuation and business continuity plans against the growing wildfire risk in the Netherlands.