July 2023’s WormGPT — a GPT-J-derived, alignment-free chatbot marketed on criminal forums for BEC and phishing — proved offensive automation had hit commodity pricing, killing the bad-grammar phishing tell forever.
A forums database with bcrypt hashes and salts hit a criminal forum. The real blast radius was everywhere else users reused passwords.
Fake Okta pages, real-time MFA relay, and one crew harvesting 10,000 identities. Why Cloudflare walked away clean and Twilio didn’t.
Passkeys went mainstream in 2026. Learn how phishing-resistant passwordless authentication works and the 4 new attacks targeting recovery flows and sessions.
Device code phishing surged 37x in 2026. How attackers exploit OAuth 2.0 device authorization grants to turn victims’ own MFA against them — plus detection strategies and defense hardening.
June 2026 threat briefing: an AI agent found 21 FFmpeg zero-days, the Miasma worm hit 73 GitHub repos, Cisco SD-WAN sat exploited with no patch, and CISA added three KEV entries on tight deadlines.
AI-powered attacks surged in 2026: autonomous attack agents, AI-generated phishing up 1,200%, and machine-speed exploitation. The top threat vectors and what AppSec professionals must do to defend.