Blog & Resources
Security awareness tips, phishing prevention guides, and best practices.
Former US Air Force members behind million-dollar BEC scheme head to prison
Two men who ran BEC and phishing campaigns against US businesses while serving in the Air Force have been sentenced to a combined 189 months in federal prison. According to public documents and evidence presented at sentencing, Chijioke Timothy Odimegwu, 25,
ip-obfuscation
IP Obfuscator A security testing toolkit for generating obfuscated IP addresses and URLs. Useful for penetration testing, security research, phishing awareness training, and testing URL parsers/filt
Phishing Abuses RMM Tools for Persistent Access
Microsoft observed phishing campaigns that abused MSP360 RMM to deploy ScreenConnect, creating redundant remote-access channels for follow-on activity
How I Handle Fan Mail and Requests, 2026 Edition
I get fan mail, which I think is awesome. Also, in the world we live in, which includes “AI”-generated scams and other phishing expeditions, it’s necessary to set some expectations as to how I handle fan mail and also requests from fans. Here’s how I’m going
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique, tracke
Former US Air Force members sent to prison over BEC attacks
Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns.
antipluto added to PyPI
Anti-Phishing Lexical Utilities and Threat Observation A unified framework for email dataset preprocessing, PII masking, synthetic data generation, and semantic-stylometric phishing classification.
Using Device Linking to Eavesdrop on WhatsApp and Signal
Modern messaging apps allow users to link their phone accounts to their computer desktop. Eavesdroppers are taking advantage of this capability: Apps such as WhatsApp Web and Signal Desktop allow people to use their accounts on other devices, such as laptops or desktop computers. Germany’s Cus
Jamtara Director Returns to Netflix with a Treasure-Hunt Series Starring Vijay Varma, Rahul Bhat and Richa Chadha
Following the success of Jamtara Sabka Number Ayega, the true-events-inspired crime drama about a phishing and cybercrime ring in an eastern Indian state, Netflix India is reuniting with director Sou
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface. Elsewhere, weak service accounts, old bugs, exposed systems
Cybersecurity training doesn’t work – here’s why
Research shows cybersecurity training rarely changes behavior or stops phishing. Here's why compliance courses fail - and what actually reduces risk instead.
The devil is still in the email – but wearing a new mask
Many of today’s phishing attempts are no longer betrayed by poor grammar, a sketchy URL or a crude login page. To be sure, it does still pay to look out for these red flags, but their absence doesn’t