The Coworker on the Line Wasn’t Real
Astrana's impersonation breach shows cybersecurity still fails at the helpful employee. See the controls that actually cut that path.
September 2026
A Takedown Does Not Kill a Stolen Session
EvilTokens is down, but stolen device-code sessions still beat most cybersecurity controls. Check your OAuth grants before the next kit stands up.
Who Still Grades Phishing by the Click?
Click rates still run most cybersecurity awareness programs. This week's research, plus a million AI lures, says score the password. Fix the metric.
Passkeys Are Working For the Attacker
Passkey-themed phishing is beating cybersecurity checkboxes and leaving MFA persistence in the tenant. Audit enrollments before the next "IT" call.
One QR Scan. A Stolen Login Session.
QR codes in Teams already steal sessions your cybersecurity stack never sees. Lock down untrusted images before October. Check your gap.
ASCII Smuggling Just Hit Production
ASCII smuggling is hiding phishing from your cybersecurity stack. See what to inspect before the next deal email lands.
August 2026
Your Email Gateway Can’t Hear This Attack
Spring Ring used Teams voice phishing to skip email filters and hunt domain controllers. See the cybersecurity controls your tenant is missing.
The Human Check Is the Attack Path
Fake Cloudflare captchas now walk users into PowerShell. That's a cybersecurity gap in how you design trust. See what to lock down.
Congrats, Your Session Cookie Has a New Owner
A $320 phishing kit skips your password and steals the session instead. Time to check who still has admin rights in your directory.
July 2026
How A Phone Call Breached Clover Health’s Records
Clover Health's breach shows cybersecurity fails at the human layer first. Here's what actually stops social engineering attacks before they spread.