phishing defense

When a Firefox user encountered a network error while loading a page, the browser could leave the previous page’s content visible while showing an empty address bar — a confusing state that attackers could use to hide the real destination and attempt a spoofing attack. The bug, tracked as...

Windows shortcut (.LNK) files are once again in the crosshairs: researcher Wietze Beukema has publicly documented four previously undocumented ways that crafted LNK files can spoof what users see, hide dangerous command-line arguments, and execute entirely different binaries than the shortcut...

Enterprise-targeted phishing has migrated from dodgy domains and cheap VPSes to the same cloud platforms that companies trust to run their businesses—Microsoft Azure, Google Firebase, AWS and Cloudflare—and that shift is changing how SOCs detect, investigate, and stop credential theft and MFA...

Broadcom’s security team has flagged a focused tech-support scam campaign that weaponizes Microsoft Azure’s static website endpoints—those familiar web.core.windows.net addresses—to host convincing “Windows Defender / Microsoft Security” scare pages aimed primarily at Japanese recipients, and...