Blog & Resources
Security awareness tips, phishing prevention guides, and best practices.
Cartero: New Phishing Framework with Full CLI
Cartero is a robust phishing framework with a full-featured CLI, developed from years of engagement experience.
Muraena: Automated Phishing Reverse Proxy Tool
Muraena is a reverse proxy tool that automates phishing and post-phishing activities, reviving a 15-year-old technique.
Mimic: New BitB Phishing Kit Bypasses Frame Detection
Mimic is a frameless browser-in-the-browser phishing tool using Shadow DOM and MutationObserver, evading iframe-based detection and enabling realistic
phish-signals 0.2.0: New Phishing Detection Engine
phish-signals 0.2.0 is a heuristic phishing-detection engine with typosquat checks, email authentication analysis, and IOC handling.
Google Docs Link Used in Malware Trap for Security Experts
A phishing campaign used a fake crypto conference invite and a malicious Google Docs link to target cybersecurity experts.
QR codes increasingly used in phishing scams, NCSC warns
The NCSC warns QR codes are increasingly used in phishing emails to hide malicious links.
phish-signals 0.1.0: Heuristic Phishing Detection Engine
phish-signals 0.1.0 is a new open-source engine for detecting phishing emails via typosquatting, header analysis, and IOC handling.
Phish-Signals Phishing Detection Tool Added to PyPI
A new heuristic phishing-detection engine, phish-signals, is now on PyPI. It checks typosquats, email authentication, and generates Sigma rules.
Scammers cost Irish adults €760m last year
A new Ekco survey reveals scammers cost Irish adults €760 million last year, with 96% of people targeted by scams.
Phishing Kit Claims Rogue Passkey Persistence
A $10K phishing kit claims to plant rogue passkeys for persistent access to compromised accounts, raising new security concerns.
EIP-7702 Wallet Delegation Under Fire After Phishing Study
Research at USENIX Security Symposium links many EIP-7702 authorization transactions to phishing, raising concerns about the feature's safety.
Govt asks Google to remove fake Firebase bank sites
India's I4C asked Google to remove Firebase accounts impersonating bank websites and apps to defraud users via fake reward offers.