Passkeys went mainstream in 2026. Learn how phishing-resistant passwordless authentication works and the 4 new attacks targeting recovery flows and sessions.
Device code phishing surged 37x in 2026. How attackers exploit OAuth 2.0 device authorization grants to turn victims' own MFA against them — plus detection strategies and defense hardening.
June 2026 threat briefing: an AI agent found 21 FFmpeg zero-days, the Miasma worm hit 73 GitHub repos, Cisco SD-WAN sat exploited with no patch, and CISA added three KEV entries on tight deadlines.
AI-powered attacks surged in 2026: autonomous attack agents, AI-generated phishing up 1,200%, and machine-speed exploitation. The top threat vectors and what AppSec professionals must do to defend.
Trace the evolution of phishing attacks from crude 1990s email scams to AI-powered deepfake campaigns. Discover how attackers leverage machine learning and automation to create convincing social engineering attacks.
CISO guide to ransomware incident response: a complete checklist covering preparation, detection, containment, eradication, and recovery phases for enterprise environments under active ransomware attacks.
July 2023's WormGPT — a GPT-J-derived, alignment-free chatbot marketed on criminal forums for BEC and phishing — proved offensive automation had hit commodity pricing, killing the bad-grammar phishing tell forever.
A cloned intranet page harvested an employee's password and MFA code, opening hours of internal access. Phishing-resistant MFA and self-report lessons.
Ransomware forced the Guardian's newsroom off its networks for weeks in late 2022 — yet print and web kept publishing. Editorial continuity lessons.
A forums database with bcrypt hashes and salts hit a criminal forum. The real blast radius was everywhere else users reused passwords.
Fake Okta pages, real-time MFA relay, and one crew harvesting 10,000 identities. Why Cloudflare walked away clean and Twilio didn't.
A 2019 contact-import scrape of 533M users hit every phone number to profile, free-dumped in 2021 and still fueling vishing and SIM-swaps today. Why data age barely dents attacker value.