Comprehensive guides on protecting email accounts and infrastructure from cyber threats. Covers email authentication protocols like SPF, DKIM, and DMARC, encryption best practices, spam filtering, and organizational policies that reduce the risk of email-based attacks.
posts
In 2020, a single spear phishing email sent to a Twitter employee gave attackers access to internal admin tools — and ultimately let them hijack verified accounts belonging to Barack Obama, Elon Musk, and Apple. The attackers walked away with over $100,000 in Bitcoin. That breach didn't start
A Single Email Cost This Company $47 Million In 2015, Ubiquiti Networks disclosed that attackers impersonating company executives tricked finance employees into wiring $46.7 million to overseas accounts controlled by threat actors. No malware. No zero-day exploit. Just a carefully crafted CEO fraud email scam that exploited trust, urgency,
The Email That Cost One Company $37 Million In 2024, the FBI's Internet Crime Complaint Center reported that business email compromise — a sophisticated form of phishing — accounted for over $2.9 billion in adjusted losses. That's not a typo. Billions. And it all starts with a
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime for the fifth consecutive year. And those are just the ones people reported. I've spent years helping organizations respond to breaches, and the vast majority start
That Gmail Account Access Warning Might Be Real — Or It Might Be the Attack Itself In early 2024, a sophisticated phishing campaign targeted Gmail users with emails that looked exactly like legitimate Google security alerts. The messages warned of suspicious sign-in activity and directed users to a pixel-perfect fake login
In 2023, the FBI's Internet Crime Complaint Center reported that business email compromise — a sophisticated category of fake email — caused adjusted losses exceeding $2.9 billion in a single year. That wasn't from exotic zero-day exploits. It was from emails that looked real but weren'
In 2024, MGM Resorts lost an estimated $100 million after a threat actor called a help desk, impersonated an employee, and gained access to internal systems. The initial vector? A social engineering call informed by information harvested through phishing. One phone call. One convincing story. Nine figures in damages. If
They Don't Just Send One Email — They Run a Phish Tour In 2023, the FBI's IC3 received over 298,000 phishing complaints, making it the most reported cybercrime category for the fifth consecutive year. But here's the part that doesn't make the
In March 2024, MGM Resorts was still tallying the damage from a social engineering attack that started with a single phone call to their help desk. The total cost exceeded $100 million. The attacker didn't exploit a zero-day vulnerability or crack military-grade encryption. They impersonated an employee found
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 complaints about phishing — making it the single most reported cybercrime for the fifth consecutive year. Yet when I ask executives what phishing actually is, most give me a vague answer about "fake emails." That&
