Volume 342, Issue 3 · 11 articles from 2 issues
KnowBe4 Threat Lab examines abuse of Microsoft 365 Direct Send to deliver mail that appears internal. Read more
Phishing campaigns exploit passkey enrollment flows to register attacker-controlled authenticators in cloud tenants. Read more
Attackers register domains matching hallucinated URLs that AI assistants invent, then host phishing pages there. Read more
The FBI warns of OAuth consent attacks granting account access without ever needing a password. Read more
As email defenses improve, attackers are moving to the phone, where almost no organization trains or monitors. Read more
Attackers send fake non-disclosure agreements as lures because NDA attachments draw less scrutiny from filters and recipients. Read more
KnowBe4 reports that generative AI is compressing the time and cost of building highly targeted social engineering attacks. Read more
A new evasion technique lets phishing mail slip past Microsoft 365 filtering and reach user inboxes. Read more
An Experian survey finds 60 percent of companies reporting higher fraud losses, with AI phishing the leading concern. Read more
SVG images carrying embedded JavaScript have become a rapidly growing phishing delivery method. Read more
KnowBe4's weekly roundup leads with phishing operations that route through Google services to borrow their trust. Read more