Blog & Resources
Security awareness tips, phishing prevention guides, and best practices.
119,000 fake online stores steal card details
Researchers at Nebty found DoppelCart, a network of nearly 119,000 domains mimicking online stores to steal payment card details.
Amazon Launches Tool to Verify Messages Amid Phishing
Amazon introduced a new tool that lets customers verify whether messages from the company are real, as phishing attacks become harder to spot.
Show HN: Email Where Address Is a Keypair, With SMTP Bridge
A developer proposes an email system where addresses are keypairs, with an SMTP bridge, after nearly falling for a phishing attack.
119K Fake Shops Impersonate Brands to Steal Payment Data
Nebty uncovered a fake-shop fraud operation using 118,996 domains to impersonate legitimate brands and steal names, addresses, and banking information
600+ Emails Hide $1,200 Fraudulent Purchase
A Virginia woman received over 600 emails in an inbox flood that scammers used to hide a $1,200 fraudulent purchase.
MFA's Weakest Link: Account Recovery Is the New Attack Path
Attackers increasingly target account recovery processes to bypass MFA. Service desks are now a key identity security boundary, as seen in Scattered S
Phishing Uses Blob URLs in Microsoft Services
Attackers abuse Microsoft services and blob URLs to create phishing pages in-browser, leaving no static site for defenders to block.
Google Redirects Abused in Multi-Hop Phishing
Attackers chain Google redirects to hide phishing pages, stealing credentials or installing ScreenConnect remote access.
Microsoft Warns of ASCII Smuggling in Emails
Microsoft warns that attackers are using ASCII smuggling, a Unicode trick, to hide malicious keywords in millions of emails and bypass security filter
Yes, You Too Can Fall for a Scam
A personal account reveals how emotional distress can make anyone vulnerable to phishing scams, highlighting the importance of vigilance.
ClickFix Attacks Abuse Legit Services for Persistence
Two campaigns use ClickFix social engineering to compromise organizations, abusing legitimate services for persistent access.
Microsoft 365 users hit by phishing and fake IT calls
Two campaigns target Microsoft 365 users: phishing with BigBear 2.0 and AiTM proxies, plus fake IT calls to bypass MFA.