Case talos-softr-ai-phishing-pageAI phishingApr 22, 2026Worldwide

Talos IR: public-sector credential theft via phishing page vibe-coded on Softr AI builder

Cisco Talos IR's Q1 2026 report described a public-sector phishing case where the page targeting Exchange and OWA logins was built on Softr with a few AI prompts and no code, exfiltrating credentials to Google Sheets.

MediumAttack using AIStatus: ResolvedVerified case file

Open in the interactive map Cite this case

Reported: Apr 22, 2026
Location: Worldwide
Target: Public administration employees' Exchange and OWA accounts
Severity: Medium
Triggered by: Unknown
Actor type: Unknown
Reported loss: None reported
CVE: None

What happened

Impact: Phishing was the top initial access vector (over a third of engagements); MFA weaknesses in 35 percent.

Who triggered it

Actor: Unknown

Attribution: Talos IR engagement; Talos has moderate confidence Softr has been abused since May 2023.

Motive: Credential theft

How it happened

Attack vector: Phishing email linking to an AI-built form page mimicking Exchange login, with captured data sent to an external store and email alerts per capture

Root cause: AI app builders let low-skill actors spin up convincing credential pages in minutes

Timeline

Jan 1, 2026Engagement occurs during Q1 2026
Apr 22, 2026Talos publishes Q1 2026 IR trends naming Softr

Response

Talos recommended MFA hardening and user awareness; first documented AI-builder case in a Talos IR engagement.

Current status: Resolved

Sources (open in a new tab)

Cisco Talos blog.talosintelligence.com
SC Media scworld.com

Cite this case

Talos IR: public-sector credential theft via phishing page vibe-coded on Softr AI builder. AI Threat Watch, case talos-softr-ai-phishing-page, Apr 22, 2026. https://aithreat.io/cases/talos-softr-ai-phishing-page/

Permanent link: https://aithreat.io/cases/talos-softr-ai-phishing-page/