Every post we’ve published — newest first.
Most credential-phishing kits are automated end to end: a victim lands on a cloned login page, types a username and password, and a script silently forwards whatever was typed to wherever the attacker checks in later. …
Most phishing kits get caught the same way: a security vendor fingerprints the page, hashes it, and pushes that hash into a blocklist that every other vendor eventually inherits. It is slow, but it works, because most …
DMARC’s aggregate reporting was built on a simple idea: publish a rua= address in your DNS, and mailbox providers around the world will mail you a daily digest of who is sending as your domain. Most of this …
Most of the DMARC-authenticated phishing this blog has covered relies on hijacking somebody else’s trusted domain, a compromised Amazon SES account, a genuinely Microsoft-sent Azure Monitor alert, a real vendor …
A link lands in someone’s inbox or chat window pointing to unpkg.com, the CDN that millions of developers use every day to pull JavaScript straight out of the npm registry. It looks exactly like what it claims to …
A recipient opening the email saw an ordinary subject line: “Your Password is About to Expire.” Nothing about it looked unusual. But when Jan Kopriva at the SANS Internet Storm Center pulled the raw headers …
For years, Smart Network Data Services has been the closest thing senders had to a direct line into how Microsoft’s consumer mailboxes, Outlook.com and Hotmail, actually judge their traffic. It is free, it is first …
Researchers at Expel spent this month picking apart a malware family they had never seen before. It calls itself, or at least its file names suggest, SynkLoader, and it reaches victims through a channel that a lot of …
A Dark Reading readership poll released this month found that 48% of security professionals now rank agentic AI as the top attack vector heading into the rest of 2026, ahead of deepfakes, board-level cyber awareness, and …
Most of the phishing campaigns we cover here start with an email. This one does not, and that is exactly why it belongs in this newsletter. Threat intelligence firm ReliaQuest published a Threat Spotlight this month …
Google’s Threat Intelligence Group published a report this week tracking three suspected Russian-nexus hacking clusters running espionage campaigns against academics, diplomats, defense industry professionals, and …
We covered RFC 9989, the DMARCbis update, when it landed earlier this year. One of its headline fixes was the np= tag, a policy specifically for subdomains that do not exist. A DNSSEC researcher’s writeup making …
