Every post we’ve published — newest first.
In June, Google sued the operators behind Outsider, a phishing-as-a-service kit tied to a threat actor known as ChenLun, and the FBI’s Cyber Division opened Operation Ghost Hook the very next day to dismantle it. …
ASCII smuggling started out as a problem for AI systems: hide invisible Unicode characters inside a block of text, and a large language model reading that text can be steered by instructions no human reviewer would ever …
Most phishing analysis assumes a link either leads to something bad or it does not, and that whoever tests it will see the same thing an intended victim sees. Research the SANS Internet Storm Center published on …
Most of the posts in this series look at what a phishing email does while it is still an email: what domain it claims to be from, what link it carries, what attachment it hides behind. Research Huntress published on …
Most email security products still describe themselves by what they scan: links, attachments, headers. On August 31, KnowBe4 announced Defend for Google Workspace, its first extension of behavioral email security to …
Most phishing emails still rely on a link. A recipient clicks it, lands on a hosted page somewhere, and that page’s domain is at least something a security team can flag or block. New research from threat …
Most credential-phishing kits are automated end to end: a victim lands on a cloned login page, types a username and password, and a script silently forwards whatever was typed to wherever the attacker checks in later. …
Most phishing kits get caught the same way: a security vendor fingerprints the page, hashes it, and pushes that hash into a blocklist that every other vendor eventually inherits. It is slow, but it works, because most …
DMARC’s aggregate reporting was built on a simple idea: publish a rua= address in your DNS, and mailbox providers around the world will mail you a daily digest of who is sending as your domain. Most of this …
Most of the DMARC-authenticated phishing this blog has covered relies on hijacking somebody else’s trusted domain, a compromised Amazon SES account, a genuinely Microsoft-sent Azure Monitor alert, a real vendor …
A link lands in someone’s inbox or chat window pointing to unpkg.com, the CDN that millions of developers use every day to pull JavaScript straight out of the npm registry. It looks exactly like what it claims to …
A recipient opening the email saw an ordinary subject line: “Your Password is About to Expire.” Nothing about it looked unusual. But when Jan Kopriva at the SANS Internet Storm Center pulled the raw headers …
