Posts exploring how attackers steal usernames, passwords, and authentication tokens through phishing, keylogging, brute force attacks, and credential stuffing. Includes actionable guidance on multi-factor authentication, password managers, and monitoring for compromised credentials.
posts
In 2024, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. That number almost certainly undercounts reality. Most phishing attacks never get reported. If you've landed here searching for a phishing
In January 2024, a finance employee at a multinational firm in Hong Kong wired $25.6 million to criminals after a video call with what appeared to be the company's CFO. Every person on that call was a deepfake. The attack started with a single phishing email. If
The Invoice That Took Down a Hospital Network In 2023, a hospital system in Illinois watched helplessly as Qakbot — a trojan horse malware strain — moved laterally through its entire Active Directory environment in under four hours. The initial infection? A single employee opened what looked like an overdue vendor invoice
A Single Misconfigured Bucket Exposed 3 Billion Records In 2021, Cognyte left an unsecured database containing over 5 billion records — scraped from previous breaches — sitting in a cloud storage instance with no authentication required. Anyone with a browser could reach it. That's not a sophisticated nation-state attack. That&
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. But here's what the raw numbers don't tell you: every single one of those incidents started with a
Your Employees Are Hungry — And Threat Actors Are Cooking In 2023, the FBI's Internet Crime Complaint Center (IC3) logged over 298,000 phishing complaints — more than any other cybercrime category for the fifth year running. That's nearly 817 reported phishing attacks per day. And those are
A Single Email That Cost $100 Million In 2019, Toyota Boshoku Corporation lost $37 million after an employee followed wire transfer instructions in a fraudulent email. Facebook and Google collectively lost over $100 million to a Lithuanian threat actor who sent fake invoices posing as a hardware vendor. These aren&
Your Employees' Phones Are Under Siege In March 2024, MGM Resorts was still reeling from one of the most expensive social engineering attacks in corporate history — one that started with a phone call, not an email. That incident cost the company over $100 million. And it's not
The Typo That Costs Billions: Why "Phising" Lands You Here Here's something I find fascinating — "phising" is one of the most commonly misspelled cybersecurity terms on the internet. If you searched for it, you're in exactly the right place. Phishing (with the
In 2023, MGM Resorts lost an estimated $100 million after a threat actor called a help desk, impersonated an employee found on LinkedIn, and talked their way into the network. No zero-day exploit. No nation-state tooling. Just a phone call. If you want to understand what causes a data breach,
