Phishing awareness articles teach readers to identify and avoid phishing attacks across email, SMS, voice calls, and social media. Content includes real-world phishing examples, red flags to watch for, reporting procedures, and tips for running phishing simulation campaigns.
posts
In 2024, the FBI's Internet Crime Complaint Center (IC3) reported that compromised credentials were a factor in a staggering number of the complaints they received, driving billions of dollars in losses. I've personally worked incident response cases where a single set of stolen credentials — purchased on
The $11 Billion Problem You're Probably Ignoring In 2023, the FBI's IC3 received over 21,000 complaints related to business email compromise alone — a category deeply intertwined with account takeover attacks — with adjusted losses exceeding $2.9 billion. That number keeps climbing. And those are just
In 2023, a single compromised employee phone at MGM Resorts led to a social engineering attack that cost the company over $100 million. The threat actor didn't hack a firewall or exploit a zero-day. They called the help desk from information scraped off LinkedIn and a mobile device.
A Hospital Paid $475,000 Because Someone Skipped the Basics In 2023, the U.S. Department of Health and Human Services settled with a healthcare provider for $475,000 after a phishing attack exposed patient records. The root cause wasn't a sophisticated zero-day exploit. It was a lack
A single employee at MGM Resorts answered a phone call from someone pretending to be a coworker. That one social engineering attack in September 2023 led to roughly $100 million in losses, a crippled reservation system, and slot machines going dark across Las Vegas. The attacker didn't exploit
The AI-Generated Email That Fooled a Security Engineer In early 2025, a Google Workspace consultant named Sam Mitrovic publicly documented how he nearly fell for an AI-driven phishing attack targeting his Gmail account. The attacker spoofed Google's support number, used a perfectly natural AI-generated voice, and referenced real
Your Old AIM Email Is Still a Threat Vector In December 2017, AOL officially shut down AIM — AOL Instant Messenger — along with the ecosystem of AIM email accounts that millions of people had used for over two decades. Most users moved on. But here's the problem: their credentials
In 2023, the FBI's Internet Crime Complaint Center reported over 43,000 victims of spoofing-related fraud, with losses exceeding $300 million. That number has only climbed since. And here's the part that should keep you up at night: a spoofing caller doesn't need malware,
In January 2024, Microsoft disclosed that a Russian state-sponsored threat actor — Midnight Blizzard — breached corporate email accounts by exploiting a legacy test tenant that lacked multi-factor authentication. No zero-day exploit. No sophisticated malware. Just a password spray against a forgotten cloud account. That single oversight gave attackers months of access
The Breach That Changed How I Think About Cybersecurity In February 2024, Change Healthcare suffered a ransomware attack that disrupted pharmacy operations and medical claims processing across the entire United States. UnitedHealth Group later confirmed that roughly one-third of all Americans may have had their data exposed. The attack vector?
