Blog & Resources
Security awareness tips, phishing prevention guides, and best practices.
Attackers Manipulate AI Chatbots in Mass Disinformation, Phishing Campaign
Threat actors are poisoning ChatGPT, Gemini, and Google AI Overview answers by seeding the Web with malicious links and data and then optimizing the content.
New Phishing Attack Promises Claude Max, but Steals Your Google Credentials Instead
The offer is for access to about $200 worth of Anthropic’s Claude Max service. But the real price could be giving scammers access to everything in your Google accounts. A new phishing scam reported
Cofense measures employee readiness against real-world phishing threats
Cofense has announced an expansion of its AI-driven Phishing Defense Platform through Cofense Command Center, its orchestration layer for measurement and reporting. The new Competency Dashboard measures how employees recognize, report and respond to phishing
DarkMe RAT trades zero-days for plain phishing emails
DarkMe, a remote access trojan and info-stealer that has previously been associated with a threat group that targeted financial market traders and cryptocurrency users, has been spotted again. This time around, its distribution has been simplified: instead of
Lookout targets smishing, voice cloning, and vishing with real-time mobile protection
Lookout has launched Social Engineering Protection (SEP), a new module within the Lookout Mobile AI Security Platform. SEP provides automated, real-time protection against the next generation of AI-driven mobile threats, including linkless smishing attacks, s
Fake Claude Max giveaway tricks users into handing over their Google account credentials
A fake Claude Max giveaway uses a spoofed Google sign-in window to steal users’ login credentials, Malwarebytes researchers have found. “Browser-in-the-browser” is not a new technique. Researchers have documented it since 2022, and in June Palo Alto Networks’
Microsoft takes down EvilTokens service that used AI to turn stolen inboxes into payment fraud
The service, marketed through a Telegram channel, combined device-code phishing with automated analysis of stolen inboxes. Microsoft said it has now disrupted the operation, seizing 50 websites and 150 additional domains through legal action and partner coord
Lookout launches mobile module to detect AI-powered text and voice scams
Mobile security company Lookout Inc. today launched Social Engineering Protection, a module that analyzes text messages and phone calls for signs an employee is being manipulated into handing over credentials or money. The release goes after a problem Lookout
Fake Claude Max giveaway hides a Google account phishing trap
Phishing follows whatever people want at the moment, and right now that includes AI subscriptions they don’t have to pay for. We recently uncovered a new variation on this theme: A fake Claude Max gi
Device Code Phishing Circumvents MFA as Congress Weighs Hospital Mandates
A federal MFA mandate for hospitals is on its way, but MFA alone did not stop EvilTokens. Microsoft's fix starts with a sign-in setting built for printers and conference-room gear. Source: Device Code Phishing Circumvents MFA as Congress Weighs Hospital Manda
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
The cybercrime platform leveraged AI at every step of the attack chain, including writing social engineering messages and deciding targets.
EvilTokens made phishing-as-a-service look easy. Then it got taken down
Microsoft, Coinbase and law enforcement took down EvilTokens, a phishing kit that compromised 12,000 inboxes through device-code phishing and AI. EvilTokens showed up in February 2026 and moved fast. Within months it had compromised more than 12,000 inboxes a