Your employees still look for typos. Attackers stopped making them two years ago. Recent survey data shows more than half of organizations now identify AI-generated phishing as their primary fraud concern. That places it ahead of deepfake video, credential stuffing, and synthetic identity fraud combined. The gap between what employees expect and what actually arrives […]
Your team copies code snippets from ChatGPT. They paste terminal commands from Claude. They click documentation links surfaced by AI assistants without checking the domain. Attackers already registered those hallucinated URLs six months ago. The phishing page loads before anyone realizes the AI fabricated the reference. This is slop squatting. It converts AI output into […]
The Permission Screen You Just Approved Might Be a Backdoor The Slack request looks legitimate. The permission screen is real. So your marketing manager clicks approve. What she doesn't realize is that one click just handed long-term account access to an attacker who will never need her password again. Changing it won't help. MFA won't […]
Most email filters treat SVG files as images. Attackers treat them as executable containers. INKY tracked a phishing campaign that reached 5,527 organizations and generated 26,589 detected emails using SVG files to smuggle malicious JavaScript past standard defenses. The lure: a missed voicemail. The payload: credential-harvesting pages designed to capture Microsoft 365, Google Workspace, and […]
Hook A vice president receives a text about a lawn mower delivery. She replies to clarify the mistake. Two days later, a follow-up message arrives with a malicious link. That first message was not an accident. It was a filter designed to identify responsive targets worth profiling for follow-on attacks. Most security programs focus on […]
Hook Ever clicked a ChatGPT link that wasn't actually OpenAI? Most security teams treat AI tools the same way they treat their firewall vendor: presumed safe until proven otherwise. That assumption is now the entry point. Attackers no longer need sophisticated zero-days when they can fake a Claude installation page or hide behind browser telemetry […]
Hook Your team completed phishing training. They passed the quizzes. They report suspicious emails. But last week, someone installed a browser extension that summarizes customer call transcripts and sends them to a third-party API you never approved. No credential was stolen. No malware was deployed. A helpful productivity tool just became your newest exposure vector. […]
Your Healthcare Org Just Became Their Favorite Target Healthcare breaches cost more, take longer to resolve, and cause more damage than attacks in any other sector. What separates healthcare is the casualty count. A ransomware incident doesn't just disrupt operations. It correlates with a 34% to 38% increase in in-hospital mortality for admitted patients. Most […]
The Filter Said Safe. The User Clicked Anyway. Your email gateway blocked 10,000 messages last month. But it only takes one to get through. Phishing remains the leading initial access vector, appearing in more than half of observed incidents. The problem isn't just volume. It's evolution. Attackers now rotate delivery tactics weekly. They use QR […]
What Half Your Software Budget Hides Most IT teams track perpetual licenses in one system and SaaS subscriptions in another. Finance owns the invoices. IT owns the install base. Nobody owns usage data. By the time duplicate accounts surface or a compliance audit begins, renewal decisions are locked and budgets are committed. This separation made […]
