Every post we’ve published — newest first.
Okta Threat Intelligence published research on July 6, 2026 into a threat actor it tracks as O-UNC-066, and the campaign is notable for what it leaves out rather than what it includes. There is no phishing email, no …
Proofpoint has spent since May 2026 tracking a threat cluster it calls UNK_MassTraction, and the campaign is a useful reminder that some of the most damaging email-borne attacks never touch anything DMARC was built to …
CERT Polska has spent the past several months tracking an intensified phishing campaign from UNC1151, the Belarus-linked threat group also known as Ghostwriter. Since March 2026, the group has shifted its long-running …
Two phishing-as-a-service platforms surfaced in the first week of July 2026, and neither one builds a fake login page. DEBULL, documented by researchers at ZeroBEC, and ARToken, an affiliate panel of the EvilTokens …
A newly disclosed vulnerability in Kirki, a WordPress customizer framework installed on more than 500,000 sites, lets an unauthenticated attacker send phishing email through a site’s own outbound mail server. No …
Researchers at Palo Alto Networks’ Unit 42 have documented an attack pattern that skips the inbox entirely. Large language models, it turns out, are remarkably consistent about inventing web addresses that sound …
Two independent research teams have now mapped the same attack pipeline from different angles. Kaspersky’s Securelist group documented a sharp rise in phishing and business email compromise campaigns abusing Amazon …
A single command-and-control address tied to the RedLine infostealer, flagged on a non-standard high port, turned out to be the loose thread that unraveled an entire phishing operation. Researchers pivoting off that one …
Proofpoint published new research this week on the state of email authentication among India’s Fortune 100 companies, and the headline number cuts against the usual narrative. Adoption is not the problem. …
Researchers at Blackpoint Cyber’s Adversary Pursuit Group have published details on a previously undocumented malware framework they are calling Avalon, a modular toolkit that bundles credential theft, lateral …
Apple’s Hide My Email is one of the more quietly popular privacy features in iCloud+. Type your Apple ID into a sign-up form, tap Hide My Email instead, and Apple generates a random alias, something like …
Between June 12 and June 26, an automated attacker made more than 81 million login attempts against Microsoft 365 accounts monitored by the security firm Huntress. The traffic came from IPv6 address space registered to …
