When Security Theater Meets Social Engineering Your staff receives a call from someone who sounds like internal IT. The request seems routine: update your passkey, re-authenticate your Microsoft account, verify your MFA setup. Most comply without hesitation. The attacker never needs to crack encryption or exploit zero-days. They manipulate the employee into authorizing access themselves. […]
When Attackers Can Personalize Faster Than You Can Review Microsoft recently tracked an AI-assisted phishing campaign that sent over a million emails. Each one targeted accounts payable with fake invoices, vendor branding, and payment diversion requests. Most passed through email filters because the personalization looked legitimate. These templates were likely crafted using generative AI, allowing […]
Your Filter Scans the Email. Your Team Approves It. Then Someone Clicks. The email looks clean. No flagged keywords. No suspicious links. But buried in the HTML, invisible characters wrap every word your scanner would normally catch. The filter reads the code literally and sees nothing. Your user sees a convincing message and acts on […]
Reconnaissance Just Became a Commodity Service Attackers no longer spend weeks profiling targets. AI tools scan publicly accessed profiles, extract organizational hierarchies, and generate personalized phishing lures in minutes. The reconnaissance phase that once required human effort now runs continuously in the background. This creates a structural problem. Your team updates their LinkedIn profiles to […]
Your employees still look for typos. Attackers stopped making them two years ago. Recent survey data shows more than half of organizations now identify AI-generated phishing as their primary fraud concern. That places it ahead of deepfake video, credential stuffing, and synthetic identity fraud combined. The gap between what employees expect and what actually arrives […]
Your team copies code snippets from ChatGPT. They paste terminal commands from Claude. They click documentation links surfaced by AI assistants without checking the domain. Attackers already registered those hallucinated URLs six months ago. The phishing page loads before anyone realizes the AI fabricated the reference. This is slop squatting. It converts AI output into […]
The Permission Screen You Just Approved Might Be a Backdoor The Slack request looks legitimate. The permission screen is real. So your marketing manager clicks approve. What she doesn't realize is that one click just handed long-term account access to an attacker who will never need her password again. Changing it won't help. MFA won't […]
Most email filters treat SVG files as images. Attackers treat them as executable containers. INKY tracked a phishing campaign that reached 5,527 organizations and generated 26,589 detected emails using SVG files to smuggle malicious JavaScript past standard defenses. The lure: a missed voicemail. The payload: credential-harvesting pages designed to capture Microsoft 365, Google Workspace, and […]
Hook A vice president receives a text about a lawn mower delivery. She replies to clarify the mistake. Two days later, a follow-up message arrives with a malicious link. That first message was not an accident. It was a filter designed to identify responsive targets worth profiling for follow-on attacks. Most security programs focus on […]
Hook Ever clicked a ChatGPT link that wasn't actually OpenAI? Most security teams treat AI tools the same way they treat their firewall vendor: presumed safe until proven otherwise. That assumption is now the entry point. Attackers no longer need sophisticated zero-days when they can fake a Claude installation page or hide behind browser telemetry […]
