Blog & Resources
Security awareness tips, phishing prevention guides, and best practices.
iAuthFlow V2 Phishing Kit Bypasses Password Resets
Researchers warn that iAuthFlow V2 can register attacker-controlled passkeys, allowing persistent access even after password changes and session revoc
Fake Crypto Conference Targets Security Experts
Huntress discovered a ClickFix campaign using fake conference invites to trick security pros into installing AMOS infostealer on macOS.
$10K phishing kit claims it can plant rogue passkeys for persistent access to pwned accounts
A phishing kit for sale on Russian-language cybercrime forums claims it can enroll attacker-controlled passkeys on compromised accounts, providing persistent access after passwords are changed. Adve
Russian snoops add OAuth abuse to targeted phishing campaigns
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics
Google tracks three Russia-linked espionage clusters using phishing and legitimate authentication tools to target researchers, diplomats and defense staff. Google’s Threat Intelligence Group tracked three separate suspected Russia-linked cyber espionage clust
India orders removal of Google Firebase scam accounts
India ordered Google to remove hundreds of Firebase accounts used by criminals to impersonate banks and defraud users.
27% of Veterans Lost Money to Cyber Scams
A survey reveals 27% of veterans have lost money to scams, with 86% encountering scams targeting them via fake benefits or military-related lures.
India orders Google to remove Firebase scam accounts
India directed Google to shut down hundreds of Firebase accounts used by criminals to impersonate banks and defraud users.
India orders Google to remove Firebase scam accounts
India directed Google to shut down hundreds of Firebase accounts used by criminals to impersonate banks and defraud people, per government notices.
Russian spies add OAuth abuse to phishing
Google tracks three suspected Russian cyber-spy groups targeting academia, aerospace, and government.
Russian Hackers Abuse OAuth, WhatsApp to Hijack Accounts
Three suspected Russian espionage clusters exploit Google OAuth and WhatsApp linking to hijack accounts of academics and defense workers in Europe and
BEC Attack Hijacks Session Token to Steal Vendor Payments
TrendAI uncovered a BEC scheme where attackers tricked a victim into clicking a link, hijacking a session token to reroute vendor payments.