Volume 343, Issue 3 · 6 articles from 3 issues
Barracuda on building a year-round security culture as AI makes phishing and social engineering more convincing.
For Cybersecurity Awareness Month, Barracuda notes that AI is making phishing, credential theft and social engineering more convincing and scalable.
Security awareness remains essential but works best combined with layered protection.
Strong passwords, multifactor authentication, timely software updates and knowledge of current scams remain among the most effective defenses, while identity security and email protection are critical to stopping modern attacks.
Barracuda found CAPTCHA abuse in 43% of phishing-kit attacks it examined in 2025, now used to profile victims and deliver malware.
Barracuda analysis found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025.
Fake CAPTCHAs are evolving from a simple credential-theft step into evasive tools that profile potential victims and enable malware infection, browser notification abuse, or ClickFix attacks where users run malicious commands themselves.
Barracuda recommends layered security, threat intelligence and user awareness to stop these attacks.
Barracuda shows how infostealers like Lumma and Acreed harvest credentials, session cookies and tokens to hijack identities.
Barracuda's Malware Brief explains that modern infostealers target complete digital identities, including browser credentials, session cookies, authentication tokens and active sessions, not just passwords.
Stolen sessions can weaken MFA by letting attackers hijack already-authenticated accounts.
The brief notes Lumma Stealer's rebound after disruption and the emergence of low-cost tools such as Acreed, and urges organizations to protect identities and browser sessions alongside endpoints and data.
Barracuda explains how malicious emails use indirect prompt injection to target AI assistants reading inboxes.
Barracuda says malicious emails are no longer written only for human readers but also for the AI assistants that process inboxes.
Indirect prompt injection hides malicious instructions in content AI is expected to read, including email, documents, images and websites.
Email is a major exposure because it combines untrusted external content with AI access to sensitive data and business tools, and traditional phishing indicators may be absent.
Barracuda recommends layered defenses including least privilege, separating content from commands, human approval, output validation, monitoring and adversarial testing.
Barracuda reviews ENISA's 2026 Threat Landscape, where phishing and vulnerability exploitation dominate EU incidents.
Barracuda summarizes the ENISA Threat Landscape 2026, which analyzed 8,257 incidents in the European Union during 2025.
Phishing accounted for 78% of social engineering incidents, DDoS appeared in 51% of incidents and 40% resulted in unauthorized access.
Among unauthorized access incidents, 60% involved vulnerability exploitation.
Barracuda notes shared tools are making attribution harder and AI is accelerating how attackers develop and execute attacks.
Barracuda says AI is turning the cybersecurity workforce problem from a head-count gap into a skills gap.
Barracuda argues that AI's impact on threats, defenses and everyday work has shifted the cybersecurity workforce challenge from head count to skills.
It cites findings that 94% of organizations report cybersecurity skills gaps, led by AI risks and advanced identity and phishing threats.
The company says organizations need human judgment and advanced expertise alongside AI and automation.
The post outlines the skills security teams need, including stronger governance.
More from Barracuda Networks · All section posts · This week