Every post we’ve published — newest first.
On September 9, 2026, roughly 347,000 people who had signed up for Trezor’s newsletter received an email warning them that a factory defect in the STM32 microcontroller used in their hardware wallet made their …
Every campaign in this series so far has started with a message landing in an inbox. PREY-0058 does not. Arctic Wolf is tracking a widespread cluster of intrusions that begins with a phone call or a text message, and by …
Most phishing kits still fail the moment a target has multi-factor authentication turned on. BigBear 2.0 does not. Researchers on CloudSEK’s TRIAD team found the operator’s control panel and got into it …
Most of the campaigns we cover pass DMARC by routing around it entirely, borrowing a compromised mailbox, an OAuth token, or a reputable ESP’s sending pool. Email security vendor IRONSCALES documented something …
Between June 1 and August 4, email security vendor INKY, now part of Kaseya, tracked a phishing campaign that ran in waves, mostly stopping on weekends, and landed 26,589 messages in 5,527 organizations. The largest …
Research from ANY.RUN, published August 25, started with something narrow: a wave of fake Canada Revenue Agency T4 tax slips landing in Canadian inboxes. By the time the researchers finished tracing the infrastructure …
In June, Google sued the operators behind Outsider, a phishing-as-a-service kit tied to a threat actor known as ChenLun, and the FBI’s Cyber Division opened Operation Ghost Hook the very next day to dismantle it. …
ASCII smuggling started out as a problem for AI systems: hide invisible Unicode characters inside a block of text, and a large language model reading that text can be steered by instructions no human reviewer would ever …
Most phishing analysis assumes a link either leads to something bad or it does not, and that whoever tests it will see the same thing an intended victim sees. Research the SANS Internet Storm Center published on …
Most of the posts in this series look at what a phishing email does while it is still an email: what domain it claims to be from, what link it carries, what attachment it hides behind. Research Huntress published on …
Most email security products still describe themselves by what they scan: links, attachments, headers. On August 31, KnowBe4 announced Defend for Google Workspace, its first extension of behavioral email security to …
Most phishing emails still rely on a link. A recipient clicks it, lands on a hosted page somewhere, and that page’s domain is at least something a security team can flag or block. New research from threat …
