Phishing awareness articles teach readers to identify and avoid phishing attacks across email, SMS, voice calls, and social media. Content includes real-world phishing examples, red flags to watch for, reporting procedures, and tips for running phishing simulation campaigns.
posts
In 2019, a Lithuanian man named Evaldas Rimasauskas pleaded guilty to stealing over $100 million from Google and Facebook — using nothing more than a series of fake email messages. He impersonated a legitimate hardware vendor, sent invoices from spoofed email addresses, and two of the most sophisticated tech companies on
In September 2023, a threat actor called Scattered Spider social-engineered their way into MGM Resorts by calling the company's IT help desk. One phone call. That's all it took to trigger a shutdown that cost MGM an estimated $100 million. No zero-day exploit. No sophisticated malware.
In 2023, MGM Resorts lost roughly $100 million after a threat actor called Scattered Spider impersonated an employee on a help desk call — a textbook spear phishing technique that bypassed every technical control the company had. The attacker didn't blast out a million generic emails. They researched one
In 2024, the FBI's Internet Crime Complaint Center (IC3) reported that compromised credentials were a factor in a staggering number of the complaints they received, driving billions of dollars in losses. I've personally worked incident response cases where a single set of stolen credentials — purchased on
The $11 Billion Problem You're Probably Ignoring In 2023, the FBI's IC3 received over 21,000 complaints related to business email compromise alone — a category deeply intertwined with account takeover attacks — with adjusted losses exceeding $2.9 billion. That number keeps climbing. And those are just
In 2023, a single compromised employee phone at MGM Resorts led to a social engineering attack that cost the company over $100 million. The threat actor didn't hack a firewall or exploit a zero-day. They called the help desk from information scraped off LinkedIn and a mobile device.
A Hospital Paid $475,000 Because Someone Skipped the Basics In 2023, the U.S. Department of Health and Human Services settled with a healthcare provider for $475,000 after a phishing attack exposed patient records. The root cause wasn't a sophisticated zero-day exploit. It was a lack
A single employee at MGM Resorts answered a phone call from someone pretending to be a coworker. That one social engineering attack in September 2023 led to roughly $100 million in losses, a crippled reservation system, and slot machines going dark across Las Vegas. The attacker didn't exploit
The AI-Generated Email That Fooled a Security Engineer In early 2025, a Google Workspace consultant named Sam Mitrovic publicly documented how he nearly fell for an AI-driven phishing attack targeting his Gmail account. The attacker spoofed Google's support number, used a perfectly natural AI-generated voice, and referenced real
Your Old AIM Email Is Still a Threat Vector In December 2017, AOL officially shut down AIM — AOL Instant Messenger — along with the ecosystem of AIM email accounts that millions of people had used for over two decades. Most users moved on. But here's the problem: their credentials
