PhishLabs has detected attempts to compromise Microsoft Office 365 administrator accounts as part of a broad phishing campaign. In the campaign, the threat actor(s) delivered a phishing lure that impersonated Microsoft and their Office 365 brand but came from multiple validated domains - an educational institution for example - not belonging to Microsoft. If the victim clicked the link, they were...

This week, APWG released its findings from Q3 that compiles insights from their member companies and provides an analysis of how phishing is changing. The key findings from the latest report show that phishing attacks continued to rise throughout the year, 40% of BEC attacks involve domains registered by the threat actor, and now more than two-thirds of all phishing sites are using SSL certs or...

At the height of social media adoption, users willingly shared everything from the lunch they just ate to the exact places they visited throughout the day. While some of this has been reduced as consumers learned how sharing private information could impact their privacy, many people still hide these kinds of updates behind basic security controls. This is just one of the reasons that a flurry of...

This year organizations are estimated to have spent more than $124 billion on security, yet phishing attacks continue to bypass email security technology. Is it possible to proactively stop threats that would otherwise make it past your infrastructure? If you attended our most recent webinar , you know the answer is yes. Before we get into the how , our host and Director of Product Management...

Sometimes when sending phishing simulations to our clients, we setup a reply-to address to see if people will reply to suspicious emails and many do. Many people interpret our simulations as scams and articulate that in colorful language. Others reply to our phishing email and provide information that would be dangerous in the hands of a threat actor, such as contact information for the...

Social media-based phishing attacks have taken off in a big way. According to some estimates, social media now accounts for as much as 5% of all phishing attacks globally. When you consider that phishing volume has grown consistently every year for more than a decade ( up 40% last year alone ), that 5% constitutes a lot of attacks. This increase is no coincidence. Social media phishing attacks are...

Ambassadors of security training programs often struggle with the most effective way to drive success. The ultimate purpose of these programs is to change employee behavior and create a more secure organization. Put simply, behavior is influenced by either reinforcement (i.e., encouraging employees to perform behaviors that we like) or punishment (i.e., discouraging employees from performing...

One way to verify if an email is legitimate is to look at the sender's address, the actual sender's address, not just the sender's name. One tactic cyber criminals employ is using the sender's name to trick the recipients. The cyber criminal may use a known acquaintance's name or the name of a legitimate company they are trying to spoof. This sounds sophisticated, but it is easy to catch when you...

You have carefully selected a training program. Employees are completing the courses. And yet, they are not reporting suspicious emails and their passwords are made up of favorite sports teams and graduation dates. What is missing? Research shows that implementing training alone, as good as it may be, is not enough. We have learned that the transfer of new knowledge and behaviors on-the-job is...

In honor of National Cybersecurity Awareness Month (CSAM), Dane Boyd, PhishLabs' Security Training Manager, and I will share a series of posts covering topics from cybersecurity to organizational learning and development. We are kicking off the series by covering a topic near and dear to my heart: taking a programmatic approach to implementing a security training program. A fatal flaw committed by...

In the past 48 hours, PhishLabs has identified and successfully thwarted a sophisticated phishing campaign targeting the Office 365 credentials of high-value targets. This campaign is still active, and security teams should familiarize themselves with the tactics, indicators, and remain vigilant. In these attacks, the threat actor(s) is posing as private equity firms submitting non-disclosure...

This week APWG released its findings from Q2 of this year that compiles insights from their member companies and provides an analysis of how phishing is changing. This quarter's report shows that phishing attacks continue to increase, both SaaS and email service providers are prime targets, BEC attacks are focused on getting gift cards, and more than half of phishing sites continue to abuse HTTPS...

On a daily basis, around 42% of the global population, or 3.2 billion people , uses some form of social media. Of that number, people spend a daily average of 2.2 hours on these networks, too. These two numbers are exactly why threat actors continue to flock to social media to abuse them for phishing purposes; however, there is far more to this story. Phishing threats extend well beyond Twitter...

Today, social media is a daily medium for communication for much of the modern world, and adoption only continues to grow. Because of this, much like how threat actors started to target mobile users, they have begun to abuse social media, too. While marketing teams have been known to monitor social media to protect their brand and communicate on their behalf, they are not equipped to handle the...

As the manager of a security awareness team, whose primary goal is to educate users on how to spot phishing attacks, I often get asked, “can you make the phishing simulations look like real-world phish?" This is when I show people what real-world phishing attacks look like. Because our SOC analyzes millions of phishing emails each year, we have a great data set to choose from. Outside of the...

Business Email Compromise (BEC) attacks are the most costly and effective forms of phishing. In most cases, these attacks use highly research social engineering to go after the top brass in a company with a motive of stealing corporate dollars or breaching their network. And, because in most cases these top executives hold the keys to the castle, they make the most suitable target for threat...

Although computer-based training has been on the scene for over two decades, it is only recently that learning professionals have begun to optimize it. Often these courses present hours of content in a single learning experience. While the flexibility of computer-based training offers convenience, learners are often overloaded and overwhelmed by the amount of information presented to them. Because...

Business Email Compromise attacks are some of the most costly and vicious forms of phishing. Unlike the standard pray and spray approaches to phishing, they take a great deal of research and personalization to persuade a victim to hand over their credentials or wire them funds. This week we're taking a closer look at how invoice scams work, just one of the many sub-types of BEC or spearphishing...

Everyone will at some point see a standard phishing email. Be it the 409 Scam (Nigerian Prince) or even a fake password reset, these are pretty easy to spot, and most people delete it without flinching. However, for the select few who have been on the receiving end of a spear phish, it's often a more memorable experience. A spear phish or spearphishing attack is an advanced form of phishing that...