A hands-on audit of a WebAuthn passkey login flow showing why FIDO2 credentials still fall to real-time adversary-in-the-middle proxy phishing that steals session tokens, and which layered defenses — token binding, device-bound credentials, conditional access, and short session lifetimes…
A step-by-step technical breakdown of how attackers use Microsoft Teams messages to deliver phishing links that leverage browser Blob URLs to render convincing fake login forms directly on the victim's device.
This post examines how Kimsuky’s use of an OpenCode AI agent to mass-produce LNK phishing decoys exposes build-chain signals defenders can use to detect and disrupt the campaign.
A cybersecurity analysis of how an apparent malware infection exposed hackers’ RATs, phishing kits, and command-and-control infrastructure, with detection-focused takeaways for defenders.
A developer-focused analysis of phishing pages that mutate their JavaScript on every load and how a runtime monitor can help detect and inspect the behavior.
An analysis of how attackers abused npm mirror infrastructure to serve phishing redirect pages, with practical checks developers can use to spot tampered package pages before they reach builds or installs.
An analysis of how attackers abused more than 20 hijacked government websites to deliver malware through trusted links, and what this reveals about modern link-based threat tactics.
A developer-focused analysis of the AI-powered phishing kit targeting Spanish holiday booking travelers, with practical guidance on how the attack works and how to defend booking platforms and users.
Fake Google and Cloudflare verification pages are being used to deliver multiple malware families, making it important for developers to test for phishing-style trust abuse, malicious redirects, and user-interface spoofing.
An analysis of the Ousaban malware campaign that uses phishing PDFs and a VBS downloader to steal banking tokens from Iberian users.
ANY.RUN’s new in-browser DOM inspection helps analysts spot phishing redirect chains and hidden page changes more quickly during malware and scam investigations.
Build a real-time QR code phishing detection workflow in JavaScript using the Safe Browsing API to flag malicious links before users scan them.
An analysis of the GitBait phishing campaign showing how attackers abused GitHub Pages to target financial institutions and what developers can do to harden repositories against similar abuse.
A deep technical walkthrough of how Kali365-style phishing-as-a-service campaigns abuse OAuth flows in Okta and MAX Messenger to steal tokens, and how to audit, harden, and monitor those integrations before attackers can reuse them.
A technical walkthrough of how attackers used fake OpenAI outage pages and ChatGPT-themed lures to distribute malware, and how to detect and defend against similar phishing campaigns.
A deep technical walkthrough of how attackers bypass cloud identity checks after phishing by stealing tokens, abusing sessions, and evading MFA.
A deep-technical walkthrough for JavaScript developers on how to simulate, detect, and harden frontends against AI-generated phishing flows, with concrete testing patterns, controls, and validation steps inspired by emerging AI-driven threat trends.
A technical breakdown of how attackers allegedly used Anthropic’s Claude AI to run phishing operations against 30 global targets while bypassing safety controls and exposing new abuse-detection challenges.