Security Experts:

long dotted

NEWS & INDUSTRY UPDATES

University of Utah Health revealed last week that it discovered unauthorized access to some employee email accounts, along with a malware infection on one of its workstations. [Read More]
Most ransomware is deployed after hours, and usually several days after the initial compromise, newly published research from FireEye reveals. [Read More]
It may look like an email from a supervisor with an attachment on the new "work from home policy." But it could be a cleverly designed scheme to hack into your network. [Read More]
Akamai discovered 1,221 active phishing domains by using its CDN logs to identify users that were redirected from phishing landing pages. [Read More]
Facebook has sued domain registrar Namecheap over its refusal to provide information on tens of domains that impersonated the social media company. [Read More]
Researchers say there are over 600 legitimate Microsoft subdomains that can be hijacked and abused for phishing, malware delivery and scams. [Read More]
What started as almost casual research in November 2019 and disclosed to various vendors as a vulnerability, was abruptly reclassified and treated as a zero-day vulnerability on February 13, 2020. [Read More]
Puerto Rico’s government has suspended three employees as federal agents investigate an online scam that attempted to steal more than $4 million from the U.S. territory. [Read More]
Puerto Rico’s government has lost more than $2.6 million after falling for an email phishing scam, according to a senior official. [Read More]
Several cybersecurity companies have spotted various campaigns that leverage coronavirus-themed emails to deliver malware, phishing and scams. [Read More]

FEATURES, INSIGHTS // Phishing

rss icon

Alastair Paterson's picture
The barriers to entering the field of cybercrime have been significantly lowered, and for modest amounts of money, would-be scammers can buy high-quality phishing tools online.
Torsten George's picture
Most of today’s cyber-attacks are front ended by phishing campaigns. So, what can organizations do to prevent their users from falling for the bait of these attacks?
Laurence Pitt's picture
Many of us are familiar with the two most common types of socially engineered attacks – phishing and spear-phishing – but there are many more to be aware of.
Alastair Paterson's picture
Domain name typo-squatting is an established tactic in the world of cybercrime.
Alastair Paterson's picture
Cybercriminals rely on tried and trusted methods for phishing; as long as there is even a four percent chance that phishing techniques will be successful, they will continue to use them.
Siggi Stefnisson's picture
“Evasive phishing" is not a term much heard, but we all will—and need to—start talking a lot more about it than we have in the past.
Alastair Paterson's picture
BEC is becoming increasingly profitable for threat actors as organizations are making it easy for adversaries to gain access to the valuable information that sits within these inboxes.
Siggi Stefnisson's picture
We should be thinking about how users work, what they do and how it affects the security posture of the business, but does security really start with them?
Devon Kerr's picture
If phishing attacks slip past the first line of defense, security teams need to be able to identify suspicious activity and stop it before hackers can learn enough about their enterprise to execute a full attack.
Josh Lefkowitz's picture
Even organizations with the most robust defense solutions and advanced automated technologies cannot effectively combat threats such as BEC without the adequate support and nuanced expertise of humans.