Posts exploring how attackers steal usernames, passwords, and authentication tokens through phishing, keylogging, brute force attacks, and credential stuffing. Includes actionable guidance on multi-factor authentication, password managers, and monitoring for compromised credentials.
posts
That Gmail Account Access Warning Might Be Real — Or a Trap Last month, a mid-sized accounting firm in Texas lost access to every client file they had. It started with a single employee who received what looked like a legitimate Gmail account access warning — a notification claiming someone in another
In 2024, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. Despite billions spent on cybersecurity tools, a single deceptive email still opens the door to catastrophic breaches. If you've ever
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. I've investigated dozens of breaches that started with a single deceptive email. So when someone asks me what is a
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 complaints about phishing scams — making it the most reported cybercrime category for the fifth consecutive year. The real number is almost certainly higher, because most incidents never get reported. I've spent years helping organizations
In 2023, a single compromised password at MGM Resorts helped threat actors trigger a social engineering attack that cost the company over $100 million. The attackers didn't exploit some exotic zero-day vulnerability. They exploited people — and weak credential hygiene handed them the keys. If you've ever
A Single Fraud Ring Stole $75 Million — And Nobody Noticed for Months In 2023, the FBI dismantled a business email compromise (BEC) ring that operated across multiple countries, defrauding companies of tens of millions of dollars. The operation wasn't run by a lone wolf. It was a coordinated
In 2023, the FBI's Internet Crime Complaint Center flagged Remote Desktop Protocol (RDP) as one of the top three initial access vectors used in ransomware incidents. That wasn't a surprise to anyone who's worked an incident response engagement. I've personally investigated breaches
In 2023, the FBI's Internet Crime Complaint Center reported that business email compromise — a category built almost entirely on the fake email — cost victims over $2.9 billion. That wasn't from sophisticated zero-day exploits. It was from emails that looked real but weren't. I&
In March 2024, a single compromised employee credential at Change Healthcare led to a ransomware attack that disrupted pharmacy operations across the United States for weeks. The attackers didn't kick down a digital door — they logged in. That's what account takeover looks like in practice, and
A Single Text Message Cost This Company $15 Million In 2022, Twilio disclosed that a coordinated smishing campaign tricked employees into entering credentials on a fake login page. Attackers used those credentials to access internal systems and compromise data for over 100 customers. The whole thing started with a text
