Posts exploring how attackers steal usernames, passwords, and authentication tokens through phishing, keylogging, brute force attacks, and credential stuffing. Includes actionable guidance on multi-factor authentication, password managers, and monitoring for compromised credentials.
posts
The CEO Who Wired $47 Million to a Stranger In 2016, FACC, an Austrian aerospace parts manufacturer, lost €42 million (roughly $47 million) after a threat actor impersonated the company's CEO via email and instructed an employee to wire funds for a fake acquisition project. The CEO and
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — more than any other cybercrime category. That number has only climbed since. I've investigated breaches at organizations of every size, and the entry point is almost always the same: one employee who
Your Employees Typed the Right URL — And Still Got Hacked In April 2022, researchers at Avast documented a campaign where a threat actor compromised home routers and used DNS hijacking to redirect users from legitimate banking sites to pixel-perfect phishing clones. Victims typed the correct URL into their browser. Their
In 2022, Uber's entire internal network was compromised because a single contractor approved a push notification on their phone. The threat actor had already stolen the contractor's password through social engineering — all they needed was that one tap. That breach exposed internal tools, source code, and
In 2023, MGM Resorts lost an estimated $100 million after a threat actor called Scattered Spider social-engineered their way past the help desk with a single phone call. But that attack started the way most do — with a phishing attack that gathered the intelligence needed to make that call convincing.
A Single FakeEmail Cost This Company $37 Million In 2024, the FBI's Internet Crime Complaint Center reported that business email compromise — attacks built on fakeemail messages that impersonate trusted senders — generated over $2.9 billion in adjusted losses. That made BEC the costliest cybercrime category for the fourth
A Phone Call That Sounds Exactly Like Google Support — But Isn't In late 2024, a Microsoft solutions consultant named Sam Mitrovic nearly lost his Google account to an AI-generated voice that sounded indistinguishable from a real Google support agent. The caller ID showed a legitimate Google number. The
A Single Email Cost This Company Everything In 2023, MGM Resorts lost an estimated $100 million after a threat actor used a phone-based social engineering attack — a technique closely related to phishing — to gain access to their systems. The attackers didn't exploit a zero-day vulnerability or brute-force a
In January 2024, a massive dataset called "Naz.API" surfaced on dark web forums containing over 70 million unique email addresses and their associated passwords. Many of these credentials were still active. The breach wasn't the result of one sophisticated attack — it was an aggregation of
In September 2023, a threat actor called Scattered Spider social-engineered their way into MGM Resorts by calling the company's IT help desk. One phone call. That's all it took to trigger a shutdown that cost MGM an estimated $100 million. No zero-day exploit. No sophisticated malware.
