Posts exploring how attackers steal usernames, passwords, and authentication tokens through phishing, keylogging, brute force attacks, and credential stuffing. Includes actionable guidance on multi-factor authentication, password managers, and monitoring for compromised credentials.
posts
In January 2020, the FBI and CISA issued a joint advisory warning organizations about a wave of vishing attacks targeting remote workers. By mid-2021, the problem has only gotten worse. The FBI's Internet Crime Complaint Center (IC3) reported over 240,000 phishing, vishing, and smishing complaints in 2020
In July 2021, a single phishing email gave attackers access to an employee's credentials at a Florida-based managed service provider, ultimately cascading into the massive Kaseya VSA supply-chain ransomware attack that hit over 1,500 businesses worldwide. One email. One click. Billions in damages. If you've
Your Old AIM Email Account Is a Ticking Time Bomb In December 2017, AOL officially shut down AIM — AOL Instant Messenger — after two decades of dominance. But here's the thing most people forget: the AIM email addresses tied to those accounts didn't just vanish. Millions of
In March 2021, the FBI's Internet Crime Complaint Center reported that Business Email Compromise — the sophisticated cousin of fake emails — caused over $1.8 billion in losses during 2020 alone. That made it the costliest category of cybercrime they tracked. Not ransomware. Not credit card fraud. Fake emails
The FakeEmail That Cost One Company $75 Million In 2020, the FBI's Internet Crime Complaint Center reported that business email compromise — attacks built on fakeemail techniques — generated over $1.8 billion in losses in a single year. That made it the costliest category of cybercrime, beating ransomware by
In January 2021, a wave of PayPal phishing attacks hit inboxes so convincingly that even security-savvy professionals did a double take. The emails replicated PayPal's branding pixel-for-pixel, warned of "unusual activity" on the recipient's account, and linked to a login page hosted on a
When Trusted Tools Become Trojan Horses In April 2021, security researchers at Kaspersky documented a campaign where threat actors took software that had been removed legitimate from vendor websites — discontinued, deprecated, or pulled due to vulnerabilities — and repackaged it with embedded malware. The attackers then hosted these poisoned versions on
In March 2021, the FBI's Internet Crime Complaint Center reported that Americans lost over $54 million to phone spoofing and vishing schemes in the previous year alone. That number was climbing. And it wasn't just grandparents falling for "IRS" calls — it was finance directors
In July 2021, a single phishing link sent to an employee at a Florida IT management company led to the Kaseya ransomware attack — one of the largest supply chain compromises in history. Over 1,500 businesses were affected downstream. That's the reality of what a phishing link can
A $12 Billion Problem You Can't Ignore In June 2021, Europol dismantled a massive fraud network spanning dozens of countries. The ring had siphoned millions from victims through coordinated romance scams, investment fraud, and business email compromise. This wasn't a lone hacker in a basement. It
