Posts exploring how attackers steal usernames, passwords, and authentication tokens through phishing, keylogging, brute force attacks, and credential stuffing. Includes actionable guidance on multi-factor authentication, password managers, and monitoring for compromised credentials.
posts
That Gmail Notification Might Be Real — Or It Might Be the Attack Itself In January 2024, Google reported blocking over 99.9% of phishing emails from reaching Gmail inboxes. That sounds impressive until you realize that the remaining fraction still amounts to millions of malicious messages daily. Among the most
A Single Email Cost One Company $100 Million In 2019, Toyota Boshoku Corporation lost $37 million to a single business email compromise attack. Facebook and Google collectively lost over $100 million to a Lithuanian man who sent fake invoices via email over a two-year period. These weren't sophisticated
Your Organization Needs a Phish Setlist — Not Just One Test In 2023, the FBI's IC3 received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. Yet most organizations I work with still run the same single phishing simulation once a
In early 2024, researchers at Proofpoint documented a campaign where a single threat actor group rotated through at least six distinct phishing lure templates in under three weeks — targeting financial services, healthcare, and education sectors in sequence. Security teams that recognized the first lure missed the second. Those who caught
In 2024, the FBI's Internet Crime Complaint Center received over 298,000 complaints related to phishing — making it the most reported cybercrime for the fifth consecutive year. Yet when I ask employees in training sessions to give me a phishing definition, most of them describe a Nigerian prince
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. I've spent years helping organizations respond to these attacks, and the pattern is always the same: someone clicks a link
In 2023, MGM Resorts lost roughly $100 million after a threat actor called Scattered Spider used a spear phishing phone call — a single, targeted social engineering attack against an IT help desk employee — to breach one of the largest casino operators on the planet. The attacker found the employee'
The FBI Warns Gmail Users of Sophisticated AI-Driven Phishing Attacks — And Most People Aren't Ready In late 2024, the FBI issued a stark public service announcement: threat actors are using generative AI to craft phishing emails so convincing that even seasoned IT professionals struggle to spot them. The
A Developer Nearly Lost Everything to a Fake Google Support Call In early 2025, a widely reported attack targeted Gmail users with a phone call that appeared to come from Google's actual support number. The caller — using AI-generated voice — told the victim their account had been compromised. They
Last year, a finance director at a mid-size logistics company wired $1.2 million to a threat actor who sent a single phishing email impersonating the CEO. The email contained no malware, no suspicious attachments, and no misspelled words. It simply asked for an urgent wire transfer, referenced a real
