[{"data":1,"prerenderedAt":2837},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":35,"trust-badges":98,"solution-nav":119,"mega-nav":264,"fa-icon-solid-faDisplay":419,"fa-icon-solid-faFilter":422,"fa-icon-solid-faCloudArrowUp":424,"fa-icon-solid-faEnvelope":427,"fa-icon-sharp-regular-faUserSecret":429,"fa-icon-sharp-regular-faBrainCircuit":432,"fa-icon-sharp-regular-faShieldCheck":434,"fa-icon-sharp-regular-faRadar":436,"fa-icon-solid-faMobileScreenButton":438,"fa-icon-sharp-regular-faSatelliteDish":441,"fa-icon-brands-faChrome":443,"fa-icon-sharp-regular-faPenNib":445,"fa-icon-sharp-regular-faBooks":447,"fa-icon-sharp-regular-faBriefcase":449,"fa-icon-sharp-regular-faBookOpenCover":451,"fa-icon-sharp-regular-faBrowser":453,"fa-icon-sharp-regular-faBook":455,"fa-icon-sharp-regular-faGrid":457,"fa-icon-sharp-regular-faBuilding":459,"fa-icon-sharp-regular-faHandshakeSimple":461,"fa-icon-sharp-regular-faArrowTrendUp":463,"fa-icon-sharp-regular-faCalendarStar":465,"fa-icon-sharp-regular-faNewspaper":467,"fa-icon-sharp-regular-faUsers":469,"fa-icon-sharp-regular-faMessagesQuestion":471,"blog\u002Franking-the-best-anti-phishing-tools-and-software":473,"blog-topics":2456},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"meta":14,"query":20,"data":21,"variations":26,"lastUpdated":27,"firstPublished":28,"testRatio":29,"createdBy":30,"lastUpdatedBy":31,"folders":32,"lastUpdateSource":33,"stageModifiedSincePublish":6,"rev":34},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",{"breakpoints":15,"hasAutosaves":6,"hasErrors":6,"kind":19},{"medium":16,"small":17,"xsmall":18},768,640,320,"data",[],{"link":22,"text":23,"type":24,"url":25},{},"Get the latest stats and analysis on browser-based attacks","web-banner","https:\u002F\u002Fpushsecurity.com\u002Fresources\u002Fbrowser-attacks",{},1790775413052,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],null,"wxeodurrwme",{"createdBy":36,"createdDate":37,"data":38,"folders":86,"id":87,"lastUpdated":88,"lastUpdatedBy":36,"meta":89,"modelId":92,"name":93,"published":13,"query":94,"testRatio":29,"variations":95,"firstPublished":96,"stageModifiedSincePublish":6,"lastUpdateSource":33,"rev":97},"ST0tXQM8slWpFrmioqKHmENB2qe2",1774965361051,{"ctaText":39,"text":40,"url":41,"blocks":42,"state":82},"ewrererw","testrfesssssssssss","",[43,71],{"@type":44,"@version":45,"id":46,"component":47,"responsiveStyles":61},"@builder.io\u002Fsdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":48,"tag":48,"options":49,"isRSC":33},"TopBannerContent",{"text":50,"ctaText":51,"url":52,"mainText":53,"cta":56,"styleVariant":59,"showMonsters":60},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https:\u002F\u002Fpushsecurity.com\u002Fwebinar\u002Fstate-of-browser-security",{"content":54,"fontSize":55},"\u003Cp class=\"\">Shadow AI monsters are lurking in the dark! Bust them all in our retro-inspired arcade game.\u003C\u002Fp>","text-base",{"content":57,"fontSize":55,"url":58},"\u003Cp class=\"\">Press start >>\u003C\u002Fp>","https:\u002F\u002Fpushsecurity.com\u002Flp\u002Fshadow-ai-busters","arcade",true,{"large":62},{"display":63,"flexDirection":64,"position":65,"flexShrink":66,"boxSizing":67,"marginTop":68,"marginBottom":68,"fontSize":69,"fontWeight":70},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"id":72,"@type":44,"tagName":73,"properties":74,"responsiveStyles":77},"builder-pixel-2g0hs80umr5","img",{"src":75,"aria-hidden":76,"alt":41,"width":66,"height":66},"https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fpixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true",{"large":78},{"height":66,"width":66,"display":79,"opacity":66,"overflow":80,"pointerEvents":81},"block","hidden","none",{"deviceSize":83,"location":84},"large",{"path":41,"query":85},{},[],"fd266d0172cc47429be7ad10f48c99ad",1789552629325,{"breakpoints":90,"hasAutosaves":60,"hasErrors":6,"hasLinks":6,"kind":91},{"medium":16,"small":17,"xsmall":18},"component","0678d178ec8b41efb8a23c09dba7874d","always visible banner",[],{},1774968080803,"c3gly4il6ih",[99,103,107,111,115],{"title":100,"logo":101,"createdDate":102},"SOC2","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fb6727a5e00004d6e9e69fc3068b8b64c",1784291539953,{"title":104,"logo":105,"createdDate":106},"GDPR","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffe49f53211674deaa5a6640d929cdf42?format=webp",1784291672535,{"title":108,"logo":109,"createdDate":110},"Cyber essentials","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F53558c1045a342a7a28def960cd54ae7?format=webp",1784291702710,{"title":112,"logo":113,"createdDate":114},"ISO IEC 27001","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F578a404a61cf45db951a41fe3554d12d",1784291766222,{"title":116,"logo":117,"createdDate":118},"ISO IEC 27701","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fbe219844b13242fbba531959579a753c",1784291858848,[120,189,234],{"id":121,"label":122,"text":41,"navIcon":123,"items":124},"stop-browser-based-attacks","Stop browser-based attacks","solid:faShieldHalved",[125,130,135,140,145,150,155,160,165,169,174,179,184],{"title":126,"text":127,"url":128,"navIcon":129},"Phishing","Detect phishing behaviorally in the browser, regardless of the payload or delivery channel.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fzero-day-phishing","sharp-regular:faFishingRod",{"title":131,"text":132,"url":133,"navIcon":134},"Adversary-in-the-Middle","Detect and block MFA-bypassing AiTM phishing pages in real-time.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fadversary-in-the-middle-attacks","solid:faUserSecret",{"title":136,"text":137,"url":138,"navIcon":139},"ClickFix (and variants)","Intercept malicious copy and paste attacks at the point of interaction.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fclickfix-fix-variants","sharp-regular:faLaptopCode",{"title":141,"text":142,"url":143,"navIcon":144},"Device code phishing","Detect and block device code phishing kits designed to get around passkeys.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fdevice-code-phishing","solid:faTabletScreenButton",{"title":146,"text":147,"url":148,"navIcon":149},"Consent phishing","Detect and block malicious OAuth consent grants before access is authorized.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fconsent-phishing","solid:faThumbsUp",{"title":151,"text":152,"url":153,"navIcon":154},"Malicious OAuth integrations","Detect and block the root cause of SaaS supply chain attacks.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmalicious-oauth-integrations","solid:faPlugCircleXmark",{"title":156,"text":157,"url":158,"navIcon":159},"Malicious browser extensions","Inventory, monitor, and block risky browser extensions.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmalicious-browser-extensions","sharp-regular:faPuzzlePiece",{"title":161,"text":162,"url":163,"navIcon":164},"Malicious file downloads","Control which files users can download by type, source, and user group.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmalicious-file-downloads","solid:faFileCircleXmark",{"title":166,"text":167,"url":168,"navIcon":164},"Infostealers","Detect infostealer delivery and respond to a compromise.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Finfostealer-malware",{"title":170,"text":171,"url":172,"navIcon":173},"Ghost logins","Surface hidden login paths that bypass SSO and expose accounts.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fghost-logins","solid:faGhost",{"title":175,"text":176,"url":177,"navIcon":178},"Mobile phishing (QR & SMS)","Detect phishing regardless of whether it arrives via email, SMS, or QR code.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmobile-phishing-qr-code-sms","solid:faQrcode",{"title":180,"text":181,"url":182,"navIcon":183},"Credential stuffing","Identify reused and compromised credentials across SaaS logins.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fcredential-stuffing","custom:credentialStuffing",{"title":185,"text":186,"url":187,"navIcon":188},"Session hijacking","Detect and respond to stolen session token replay with browser session markers.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fsession-hijacking","solid:faCookieBite",{"id":190,"label":191,"text":41,"navIcon":192,"items":193},"achieve-security-outcomes","Achieve security outcomes","solid:faCheckToSlot",[194,199,204,209,214,219,224,229],{"title":195,"text":196,"url":197,"navIcon":198},"Stop account takeover","Stop ATO before it happens, in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Fstop-account-takeover","sharp-regular:faUserSecret",{"title":200,"text":201,"url":202,"navIcon":203},"Harden unmanaged identities","Identify gaps and harden them with guardrails","\u002Fsolution\u002Fachieve-security-outcomes\u002Fharden-unmanaged-identities","sharp-regular:faRadar",{"title":205,"text":206,"url":207,"navIcon":208},"Investigate browser-related incidents","Investigate and respond faster with browser telemetry","\u002Fsolution\u002Fachieve-security-outcomes\u002Finvestigate-browser-related-incidents","sharp-regular:faSatelliteDish",{"title":210,"text":211,"url":212,"navIcon":213},"Secure shadow IT","See and control shadow SaaS in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-shadow-saas","sharp-regular:faShieldCheck",{"title":215,"text":216,"url":217,"navIcon":218},"Secure AI","See and control AI apps in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-ai","sharp-regular:faBrainCircuit",{"title":220,"text":221,"url":222,"navIcon":223},"Secure BYOD","Extend security to unmanaged devices without MDM","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-bring-your-own-device","solid:faMobileScreenButton",{"title":225,"text":226,"url":227,"navIcon":228},"Secure Chromebooks","Protect Chromebooks against in-browser attacks","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-chromebooks","brands:faChrome",{"title":230,"text":231,"url":232,"navIcon":233},"Data loss prevention","Enforce DLP at the point of interaction in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Finvestigate-and-stop-data-loss","custom:investigateAndStopDataLoss",{"id":235,"label":236,"text":41,"navIcon":237,"items":238},"tool-replacements","Tool replacements","solid:faScrewdriverWrench",[239,244,249,254,259],{"title":240,"text":241,"url":242,"navIcon":243},"Email Security","Stop phishing outside of the inbox.","\u002Fsolution\u002Ftool-replacements\u002Femail-security","faEnvelope",{"title":245,"text":246,"url":247,"navIcon":248},"Remote browser isolation","Detect attacks that happen inside the browser session.","\u002Fsolution\u002Ftool-replacements\u002Fremote-browser-isolation","solid:faDisplay",{"title":250,"text":251,"url":252,"navIcon":253},"Secure web gateways","Detect attacks inside the browser after SWGs allowed the connection.","\u002Fsolution\u002Ftool-replacements\u002Fsecure-web-gateways","solid:faFilter",{"title":255,"text":256,"url":257,"navIcon":258},"CASB alternative","Catch browser-based identity threats in real time, not after the fact.","\u002Fsolution\u002Ftool-replacements\u002Fcloud-access-security-broker","solid:faCloudArrowUp",{"title":260,"text":261,"url":262,"navIcon":263},"Security awareness training","Block real phishing instead of training users on simulations.","\u002Fsolution\u002Ftool-replacements\u002Fsecurity-awareness-training","custom:securityAwareness",[265,293,354],{"id":266,"columns":267},"Solution",[268,283],{"kind":269,"heading":270,"span":29,"links":271},"links","Compare Push",[272,275,277,279,281],{"title":273,"url":247,"text":246,"navIcon":248,"variant":274},"vs Remote Browser Isolation","compact",{"title":276,"url":252,"text":251,"navIcon":253,"variant":274},"vs Secure Web Gateways",{"title":278,"url":257,"text":256,"navIcon":258,"variant":274},"vs Cloud Access Security Broker",{"title":280,"url":262,"text":261,"navIcon":263,"variant":274},"vs Security Awareness Training",{"title":282,"url":242,"text":241,"navIcon":243,"variant":274},"+ Email Security",{"kind":269,"heading":266,"span":45,"links":284},[285,286,287,288,289,290,291,292],{"title":195,"url":197,"text":196,"navIcon":198},{"title":215,"url":217,"text":216,"navIcon":218},{"title":230,"url":232,"text":231,"navIcon":233},{"title":210,"url":212,"text":211,"navIcon":213},{"title":200,"url":202,"text":201,"navIcon":203},{"title":220,"url":222,"text":221,"navIcon":223},{"title":205,"url":207,"text":206,"navIcon":208},{"title":225,"url":227,"text":226,"navIcon":228},{"id":294,"columns":295},"resources",[296,321,339],{"kind":269,"heading":297,"span":29,"links":298},"Resources",[299,306,311,316],{"title":300,"url":301,"text":302,"navIcon":303,"variant":304,"badge":305},"Research blog","\u002Fblog","Latest threat research and insights","sharp-regular:faPenNib","featured","Latest",{"title":307,"url":308,"text":309,"navIcon":310},"Resource library","\u002Fresources","Check out our webinars and downloads","sharp-regular:faBooks",{"title":312,"url":313,"text":314,"navIcon":315},"Customer stories","\u002Fcustomer-stories","What customers love about Push","sharp-regular:faBriefcase",{"title":317,"url":318,"text":319,"navIcon":320},"Help center","\u002Fhelp\u002Faudience\u002Fadministrators","Guides for employees and admins","sharp-regular:faBookOpenCover",{"kind":269,"heading":322,"span":29,"links":323},"Learn",[324,329,334],{"title":325,"url":326,"text":327,"navIcon":328},"Browser attacks in 2026","\u002Fresources\u002Fbrowser-attacks","The latest stats & analysis","sharp-regular:faBrowser",{"title":330,"url":331,"text":332,"navIcon":333},"Browser attacks glossary","\u002Fresources\u002Fbrowser-attacks-glossary","Understand the threat landscape","sharp-regular:faBook",{"title":335,"url":336,"text":337,"navIcon":338},"Browser attacks matrix","\u002Fresources\u002Fbrowser-identity-attacks-matrix","MITRE-inspired resource for red & blue teams","sharp-regular:faGrid",{"kind":294,"heading":340,"cards":341},"Latest resources",[342,348],{"title":343,"description":344,"cta":345,"background":347},"Browser-based attacks: the 2026 threat landscape","Half of attacks now reach victims outside of email. ClickFix is now the dominant browser attack technique. Get the latest stats and analysis from the Push Security team.",{"text":346,"url":326},"Read the report","orange",{"title":349,"description":350,"cta":351,"background":353},"The browser & identity attacks matrix","Check out the MITRE-inspired matrix of browser & identity attack techniques for red and blue teams. Get involved on GitHub.",{"text":352,"url":336},"Explore the matrix","black",{"id":355,"columns":356},"About",[357,375,398],{"kind":269,"heading":358,"span":29,"links":359},"Get to know us",[360,365,370],{"title":361,"url":362,"text":363,"navIcon":364},"About us","\u002Fabout","Meet the team and learn what drives us","sharp-regular:faBuilding",{"title":366,"url":367,"text":368,"navIcon":369},"Partners","\u002Fpartner","Become a partner and access resources","sharp-regular:faHandshakeSimple",{"title":371,"url":372,"text":373,"navIcon":374},"Investors","\u002Fabout#investors","Learn more about our investors and advisors","sharp-regular:faArrowTrendUp",{"kind":269,"heading":376,"span":29,"links":377},"Keep up with us",[378,383,388,393],{"title":379,"url":380,"text":381,"navIcon":382},"Events","\u002Fevents","See upcoming webinars and in-person events","sharp-regular:faCalendarStar",{"title":384,"url":385,"text":386,"navIcon":387},"News","\u002Fnews","Stay up to date on company news","sharp-regular:faNewspaper",{"title":389,"url":390,"text":391,"navIcon":392},"Careers","\u002Fcareers","Explore open roles","sharp-regular:faUsers",{"title":394,"url":395,"text":396,"navIcon":397},"Contact us","\u002Fcontact","Have a question? We're here to help","sharp-regular:faMessagesQuestion",{"kind":399,"heading":400,"testimonials":401},"testimonials","What customers say",[402,409,414],{"quote":403,"author":404,"jobTitle":405,"image":406,"url":313,"ctaText":407,"background":408},"Security is only as good as its weakest link. From day one, Push found the gaps that would allow attackers to circumvent our controls. We use Push every day — they're one of my favourite teams to work with.","Jason Waits","\u003Cp>CISO, Inductive Automation\u003C\u002Fp>","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07","Read the customer story","white",{"quote":410,"author":411,"jobTitle":412,"image":413,"url":313,"ctaText":407,"background":408},"I'm not going to be able to shove a browser on everybody. I need to be able to support them where they are. Push gave us the visibility and control we needed while allowing people to choose their paths.","Myke Lyons","\u003Cp>CISO, Cribl\u003C\u002Fp>","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F61920ec05c7a45b4b2259b8dded43c9b",{"quote":415,"author":416,"jobTitle":417,"image":418,"url":313,"ctaText":407,"background":408},"No matter the channel for phishing — email, LinkedIn, text — the employee clicks a link that opens a browser session. We see the main control point moving from the endpoint to the browser.","Ash Devata","\u003Cp>CEO, GreyNoise\u003C\u002Fp>","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F392c75ae282342008130cf1147c20e82",{"w":420,"h":420,"d":421},512,"M448 96l0 256-384 0 0-256 384 0zM64 32C28.7 32 0 60.7 0 96L0 352c0 35.3 28.7 64 64 64l144 0-16 48-72 0c-13.3 0-24 10.7-24 24s10.7 24 24 24l272 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-72 0-16-48 144 0c35.3 0 64-28.7 64-64l0-256c0-35.3-28.7-64-64-64L64 32z",{"w":420,"h":420,"d":423},"M32 64C19.1 64 7.4 71.8 2.4 83.8S.2 109.5 9.4 118.6L192 301.3 192 416c0 8.5 3.4 16.6 9.4 22.6l64 64c9.2 9.2 22.9 11.9 34.9 6.9S320 492.9 320 480l0-178.7 182.6-182.6c9.2-9.2 11.9-22.9 6.9-34.9S492.9 64 480 64L32 64z",{"w":425,"h":420,"d":426},576,"M144 480c-79.5 0-144-64.5-144-144 0-63.4 41-117.2 97.9-136.5-1.3-7.7-1.9-15.5-1.9-23.5 0-79.5 64.5-144 144-144 55.4 0 103.5 31.3 127.6 77.1 14.2-8.3 30.8-13.1 48.4-13.1 53 0 96 43 96 96 0 15.7-3.8 30.6-10.5 43.7 44 20.3 74.5 64.7 74.5 116.3 0 70.7-57.3 128-128 128l-304 0zM305 191c-9.4-9.4-24.6-9.4-33.9 0l-72 72c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l31-31 0 102.1c0 13.3 10.7 24 24 24s24-10.7 24-24l0-102.1 31 31c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-72-72z",{"w":420,"h":420,"d":428},"M48 64c-26.5 0-48 21.5-48 48 0 15.1 7.1 29.3 19.2 38.4l208 156c17.1 12.8 40.5 12.8 57.6 0l208-156c12.1-9.1 19.2-23.3 19.2-38.4 0-26.5-21.5-48-48-48L48 64zM0 196L0 384c0 35.3 28.7 64 64 64l384 0c35.3 0 64-28.7 64-64l0-188-198.4 148.8c-34.1 25.6-81.1 25.6-115.2 0L0 196z",{"w":430,"h":420,"d":431},448,"M144-16l-48 112-48 0 0 48 48 0 0 32c0 17 3.3 33.2 9.3 48l-73.3 0 0 32 5.3 16 26.7 80-64 160 51.7 0 56.9-142.2 6.5-16.3c-1-3.1-10.1-30.3-27.2-81.5l51.4 0c22.6 19.9 52.2 32 84.7 32s62.1-12.1 84.7-32l51.4 0c-17.1 51.2-26.1 78.4-27.2 81.5l6.5 16.3 56.9 142.2 51.7 0-64-160 26.7-80 5.3-16 0-32-73.3 0c6-14.8 9.3-31 9.3-48l0-32 48 0 0-48-48 0-48-112-32 0-48 32-48-32-32 0zm80 272c-32.8 0-61-19.7-73.3-48l57.3 0 16-40 16 40 57.3 0c-12.3 28.3-40.5 48-73.3 48zm17.5 139.6l30.5-35.6 0-24-96 0 0 24 30.5 35.6-46.5 116.4 128 0-46.5-116.4z",{"w":420,"h":420,"d":433},"M192 48l40 0 0 108-12.4 0c-7.6-16.5-24.3-28-43.6-28-26.5 0-48 21.5-48 48s21.5 48 48 48c19.4 0 36.1-11.5 43.6-28l12.4 0 0 56-92 0 0 56.4c-16.5 7.6-28 24.3-28 43.6 0 26.5 21.5 48 48 48s48-21.5 48-48c0-19.4-11.5-36.1-28-43.6l0-16.4 52 0 0 172-40 0c-16.8 0-31.2-10.3-37.1-25.1l-6.4-16-17.2 1c-1.1 .1-2.2 .1-3.2 .1-30.9 0-56-25.1-56-56 0-9.5 2.4-18.5 6.5-26.3l8.7-16.2-13.4-12.6c-11-10.2-17.8-24.8-17.8-40.9 0-21.6 12.2-40.4 30.3-49.8l22.6-11.7-13.1-21.9c-5-8.4-7.9-18.1-7.9-28.6 0-30.9 25.1-56 56-56l24 0 0-32c0-13.3 10.7-24 24-24zm88 148l12.4 0c7.6 16.5 24.3 28 43.6 28 26.5 0 48-21.5 48-48s-21.5-48-48-48c-19.4 0-36.1 11.5-43.6 28l-12.4 0 0-108 40 0c13.3 0 24 10.7 24 24l0 32 24 0c30.9 0 56 25.1 56 56 0 10.5-2.9 20.3-7.9 28.6l-13.1 21.9 22.6 11.7c18 9.3 30.3 28.1 30.3 49.8 0 16.1-6.8 30.7-17.8 40.9l-13.4 12.6 8.7 16.2c4.2 7.8 6.5 16.7 6.5 26.3 0 30.9-25.1 56-56 56-1.1 0-2.2 0-3.2-.1l-17.2-1-6.4 16C351.2 453.7 336.8 464 320 464l-40 0 0-76 92 0 0-56.4c16.5-7.6 28-24.3 28-43.6 0-26.5-21.5-48-48-48s-48 21.5-48 48c0 19.4 11.5 36.1 28 43.6l0 16.4-52 0 0-152zM192 512l128 0c31.1 0 58.4-16.2 74.1-40.5 52.7-5.1 93.9-49.5 93.9-103.5 0-11.5-1.9-22.5-5.3-32.9 13.4-17.5 21.3-39.4 21.3-63.1 0-32-14.5-60.6-37.1-79.7 3.3-10.2 5.1-21.1 5.1-32.3 0-49.6-34.8-91.1-81.3-101.5-6.3-33.3-35.6-58.5-70.7-58.5L192 0c-35.1 0-64.4 25.2-70.7 58.5-46.5 10.4-81.3 51.9-81.3 101.5 0 11.3 1.8 22.2 5.1 32.3-22.7 19.1-37.1 47.7-37.1 79.7 0 23.7 8 45.6 21.3 63.1-3.5 10.4-5.3 21.4-5.3 32.9 0 54 41.2 98.5 93.9 103.5 15.6 24.3 42.9 40.5 74.1 40.5zM336 192a16 16 0 1 1 0-32 16 16 0 1 1 0 32zm32 96a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zM176 352a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zm16-176a16 16 0 1 1 -32 0 16 16 0 1 1 32 0z",{"w":420,"h":420,"d":435},"M267.6 4.5l207.5 80.5 19.2 7.4 1.2 20.5c2.9 50-4.9 126.3-37.3 200.9-32.7 75.2-91.1 150-189.4 192.5l-12.7 5.5-12.7-5.5C144.9 463.9 86.6 389.2 53.9 313.9 21.5 239.3 13.7 162.9 16.6 113L17.8 92.5 37 85 244.5 4.5 256 0 267.6 4.5zM64.1 126C63.1 169.5 71 232.9 97.9 294.8 126.1 359.7 175 422.4 256 459.6 337.1 422.4 385.9 359.7 414.2 294.8 441 232.9 449 169.5 448 126L256 51.5 64.1 126zm302.3 44.7L352.3 190.1 249.8 330.9 233 354c-8.8-9.1-30.9-32-66.2-68.6l-16.7-17.3 34.5-33.3c9.5 9.8 23.9 24.7 43.2 44.7l85.6-117.7 14.1-19.4 38.8 28.2z",{"w":420,"h":420,"d":437},"M497.4 49l17-17-33.9-33.9C473.6 4.9 453.3 25.2 419.7 58.8 375.4 22.1 318.5 0 256.4 0 115.1 0 .4 114.6 .4 256s114.6 256 256 256 256-114.6 256-256l-48 0c0 114.9-93.1 208-208 208s-208-93.1-208-208 93.1-208 208-208c48.8 0 93.7 16.8 129.1 44.9l-45.7 45.7c-23.5-16.8-52.3-26.6-83.4-26.6-79.5 0-144 64.5-144 144s64.5 144 144 144 144-64.5 144-144l-48 0c0 53-43 96-96 96s-96-43-96-96 43-96 96-96c17.8 0 34.5 4.8 48.8 13.3-52 52-79.5 79.5-82.7 82.7l33.9 33.9 17-17 224-224z",{"w":439,"h":420,"d":440},384,"M16 64C16 28.7 44.7 0 80 0L304 0c35.3 0 64 28.7 64 64l0 384c0 35.3-28.7 64-64 64L80 512c-35.3 0-64-28.7-64-64L16 64zm64 0l0 304 224 0 0-304-224 0zM192 472c17.7 0 32-14.3 32-32s-14.3-32-32-32-32 14.3-32 32 14.3 32 32 32z",{"w":420,"h":420,"d":442},"M208 0l24 0C386.6 0 512 125.4 512 280l0 24-48 0 0-24C464 151.9 360.1 48 232 48l-24 0 0-48zm24 96c101.6 0 184 82.4 184 184l0 24-48 0 0-24c0-75.1-60.9-136-136-136l-24 0 0-48 24 0zM48 256c0 114.9 93.1 208 208 208 22.9 0 45-3.7 65.6-10.5l-263-263C51.7 211 48 233.1 48 256zM0 256c0-36.5 7.6-71.3 21.4-102.7 6.7-15.3 14.9-29.9 24.4-43.5 7.7 7.7 61.5 61.5 161.2 161.2 30.5-30.5 49.5-49.5 57-57L297.9 248c-7.5 7.5-26.5 26.5-57 57 99.7 99.7 153.5 153.5 161.2 161.2-13.6 9.5-28.2 17.7-43.5 24.4-31.4 13.8-66.2 21.4-102.7 21.4-141.4 0-256-114.6-256-256z",{"w":420,"h":420,"d":444},"M0 256c0-46.6 12.5-90.4 34.3-128.9L144.1 318.3c21.9 39.2 63.8 65.7 111.9 65.7 14.3 0 27.1-2.3 40.8-6.6L220.5 509.6C95.9 492.3 0 385.3 0 256zm365.1 65.6c12.3-19.2 18.9-42.5 18.9-65.6 0-38.2-16.8-72.5-43.3-96l152.7 0c12 29.6 18.6 62.1 18.6 96 0 141.4-114.6 255.1-256 256L365.1 321.6zM477.8 128L256 128c-62.9 0-113.7 44.1-125.5 102.7L54.2 98.5C101 38.5 174 0 256 0 350.8 0 433.5 51.5 477.8 128zM344 256a88 88 0 1 1 -176 0 88 88 0 1 1 176 0z",{"w":425,"h":420,"d":446},"M406.1 198.1l0 0-3.6 10.7-56.3 168.8-221.5 69.9 98.5-98.5c5.2 1.9 10.8 3 16.7 3 26.5 0 48-21.5 48-48s-21.5-48-48-48-48 21.5-48 48c0 5.9 1.1 11.5 3 16.7l-98.5 98.5 69.9-221.5 168.8-56.3 10.8-3.6 0 0 60.1 60.1zM80 512l304-96 64-192c59.4-59.4 96.7-96.7 112-112-18.3-18.3-49.6-49.6-94.1-94.1L432-16C416.7-.7 379.4 36.6 320 96l-192 64-96 304 48 48z",{"w":425,"h":420,"d":448},"M404.8 45.3l12.4 46.4-77.3 20.7-12.4-46.4 77.3-20.7zm5.5 329.8l-58-216.4 77.3-20.7 58 216.4-77.3 20.7zm12.4 46.4l77.3-20.7 12.4 46.4-77.3 20.7-12.4-46.4zM315.1 19.6l-46.4 12.4 8.6 32-69.2 0 0-64-176 0 0 512 304 0 0-228.4c41.8 156.2 63.5 237.1 65.1 243 64.4-17.3 167.4-44.9 170-45.6l-12.4-46.4-107.7-401.8-12.4-46.4C413-6.6 371.7 4.4 315.1 19.6zM208.1 464l0-352 80 0 0 352-80 0zm-48-400l0 32-80 0 0-48 80 0 0 16zm0 80l0 224-80 0 0-224 80 0zm0 272l0 48-80 0 0-48 80 0z",{"w":420,"h":420,"d":450},"M168 0l-24 0 0 96-144 0 0 384 512 0 0-384-144 0 0-96-200 0zM464 256l-416 0 0-112 416 0 0 112zM320 304l144 0 0 128-416 0 0-128 144 0 0 48 128 0 0-48zm0-208l-128 0 0-48 128 0 0 48z",{"w":425,"h":420,"d":452},"M312 114.4l0 282.1 9.2-3.3C367.8 376.5 417 368 466.5 368l61.5 0 0-288-61.5 0c-38.5 0-76.7 6.6-113 19.6L312 114.4zM264 396.5l0-282.1-41.5-14.8C186.2 86.6 148 80 109.5 80l-61.5 0 0 288 61.5 0c49.5 0 98.7 8.5 145.3 25.2l9.2 3.3zM528 32l48 0 0 384-109.5 0c-44 0-87.7 7.6-129.2 22.4L288 456 238.6 438.4C197.2 423.6 153.5 416 109.5 416L0 416 0 32 109.5 32c44 0 87.7 7.6 129.2 22.4L288 72 337.4 54.4C378.8 39.6 422.5 32 466.5 32L528 32zM0 464l91.7 0c36.9 0 73.6 5 109.2 14.9l86.2 24 42.2-15.1c44-15.7 90.5-23.8 137.2-23.8l109.5 0 0 48-109.5 0c-41.3 0-82.2 7.1-121.1 21l-49.4 17.6-7.2 2.6-7.3-2-93.6-26c-31.4-8.7-63.8-13.1-96.4-13.1L0 512 0 464z",{"w":420,"h":420,"d":454},"M48 256l0 144 416 0 0-144-416 0zM0 64l512 0 0 384-512 0 0-384zm64 64l0 64 64 0 0-64-64 0zm120 8l-24 0 0 48 288 0 0-48-264 0z",{"w":430,"h":420,"d":456},"M24 0L0 0 0 432 .4 432c-.2 2.6-.4 5.3-.4 8l0 72 448 0 0-48-32 0 0-64 32 0 0-400-424 0zM368 400l0 64-320 0 0-24c0-22.1 17.9-40 40-40l280 0zM88 352c-14.4 0-28 3.5-40 9.6l0-313.6 352 0 0 304-312 0zm40-224l0 48 224 0 0-48-224 0zm224 96l-224 0 0 48 224 0 0-48z",{"w":420,"h":420,"d":458},"M112 64l0 48-48 0 0-48 48 0zM64 24l-40 0 0 128 128 0 0-128-88 0zm48 208l0 48-48 0 0-48 48 0zM64 192l-40 0 0 128 128 0 0-128-88 0zm0 208l48 0 0 48-48 0 0-48zM24 360l0 128 128 0 0-128-128 0zM280 64l0 48-48 0 0-48 48 0zM232 24l-40 0 0 128 128 0 0-128-88 0zm0 208l48 0 0 48-48 0 0-48zm-40-40l0 128 128 0 0-128-128 0zm88 208l0 48-48 0 0-48 48 0zm-48-40l-40 0 0 128 128 0 0-128-88 0zM400 64l48 0 0 48-48 0 0-48zM360 24l0 128 128 0 0-128-128 0zm88 208l0 48-48 0 0-48 48 0zm-48-40l-40 0 0 128 128 0 0-128-88 0zm0 208l48 0 0 48-48 0 0-48zm-40-40l0 128 128 0 0-128-128 0z",{"w":439,"h":420,"d":460},"M48 48l0 416 96 0 0-112 96 0 0 112 96 0 0-416-288 0zM0 0L384 0 384 512 0 512 0 0zM96 96l64 0 0 64-64 0 0-64zm192 0l0 64-64 0 0-64 64 0zM96 224l64 0 0 64-64 0 0-64zm192 0l0 64-64 0 0-64 64 0z",{"w":17,"h":420,"d":462},"M598.6 75.4L618 61.3 589.7 22.5C586 25.2 554.7 48 495.8 90.8l-34.1-22.7-6-4-145.2 0 0 0-144 0c-2.9 2.9-11.1 11.1-24.5 24.5-56.3-40.9-86.6-62.9-90.8-66.1L22.9 61.3c1.5 1.1 37.3 27.1 107.4 78.1l16.6 12.1c7.9-7.9 21.1-21.1 39.5-39.5l76.1 0-103 103-17 17c12.1 12.1 21.8 21.8 29.1 29.1 46.9 46.9 122.8 46.9 169.7 0L368.4 233.9 494.5 360c-16.7 16.7-29.4 29.4-38.1 38.1l-47-47-33.9 33.9 47 47-16 16-44.1 0-65-65-33.9 33.9 31 31-60.1 0-169-169-17-17-33.9 33.9 17 17 176 176 7 7 128 0 1 1 1-1 81.9 0 7-7c225.8-225.8 167.2-167.2 193-193l-33.9-33.9-64 64-143-143-17-17c-6.8 6.8-27.2 27.2-61.1 61.1-26.5 26.5-68.5 28-96.7 4.6l119.8-119.8 62.1 0 0 0 48.7 0c32.6 21.8 51.3 34.2 55.9 37.2l13.5-9.8 88-64z",{"w":425,"h":420,"d":464},"M352 96l224 0 0 224-48 0 0-142.1-191 191-17 17-17-17-111-111-139.8 139.8-17 17-33.9-33.9 17-17 156.8-156.8 17-17 17 17 111 111 174.1-174.1-142.1 0 0-48z",{"w":430,"h":420,"d":466},"M144 0l0 64 160 0 0-64 48 0 0 64 96 0 0 416-448 0 0-416 96 0 0-64 48 0zm0 112l-96 0 0 320 352 0 0-320-256 0zM261.6 228.2l84.1 12.2-60.9 59.3 14.4 83.8-75.2-39.6-75.2 39.6 14.4-83.8-60.9-59.3 84.1-12.2 37.6-76.2 37.6 76.2z",{"w":420,"h":420,"d":468},"M96 32l416 0 0 448-512 0 0-392 48 0 0 344 8 0c22.1 0 40-17.9 40-40L96 32zm38.4 400l329.6 0 0-352-320 0 0 312c0 14.4-3.5 28-9.6 40zM192 128l96 0 0 96-96 0 0-96zm152 48l72 0 0 48-96 0 0-48 24 0zM216 256l200 0 0 48-224 0 0-48 24 0zm0 80l200 0 0 48-224 0 0-48 24 0z",{"w":17,"h":420,"d":470},"M384 128a64 64 0 1 0 -128 0 64 64 0 1 0 128 0zm-176 0a112 112 0 1 1 224 0 112 112 0 1 1 -224 0zm252.8 76c5.9 2.6 12.4 4 19.2 4 26.5 0 48-21.5 48-48s-21.5-48-48-48l-.8 0c-1.6-16.6-5.8-32.4-12.1-47.1 4.2-.6 8.6-.9 12.9-.9 53 0 96 43 96 96s-43 96-96 96c-17.7 0-34.3-4.8-48.6-13.2 11.7-11.3 21.6-24.4 29.4-38.8zM208.6 242.8c-14.2 8.4-30.8 13.2-48.6 13.2-53 0-96-43-96-96s43-96 96-96c4.4 0 8.7 .3 12.9 .9-6.3 14.7-10.5 30.6-12.1 47.1l-.8 0c-26.5 0-48 21.5-48 48s21.5 48 48 48c6.8 0 13.3-1.4 19.2-4 7.8 14.4 17.7 27.5 29.4 38.8zM432 288l69.8 192-51.1 0-52.4-144-156.8 0-52.4 144-51.1 0 69.8-192 224 0zM151.2 304l-17.3 48-36.3 0-46.5 128-51.1 0 64-176 87.2 0zm354.8 48l-17.3-48 87.2 0 64 176-51.1 0-46.5-128-36.3 0z",{"w":425,"h":420,"d":472},"M144 354l-48 30 0-80-96 0 0-336 384 0 0 336-160 0-80 50zm0-56.6c43.5-27.2 65.6-41 66.2-41.4l125.8 0 0-240-288 0 0 240 96 0 0 41.4zM192 416l0-35.4 45.8-28.6 2.2 0 0 64 125.8 0c.6 .4 22.7 14.2 66.2 41.4l0-41.4 96 0 0-240-96 0 0-48 144 0 0 336-96 0 0 80-128-80-160 0 0-48zm0-340c-14.4 0-26.1 11.7-26.1 26.1l-40 0C125.9 65.6 155.5 36 192 36s66.1 29.6 66.1 66.1c0 29.7-17.7 46.9-33.3 55.6-4.5 2.5-8.9 4.8-12.9 6.2l-40 0 0-33.4c1.8-.2 3.6-.4 5.4-.6 9.7-1.1 19-2.1 27.9-7.1 7.5-4.2 12.9-10.1 12.9-20.8 0-14.4-11.7-26.1-26.1-26.1zM172 188l40 0 0 40-40 0 0-40z",{"id":474,"title":475,"authorsCollection":476,"content":484,"extension":1994,"faqItemsCollection":1995,"faqTitle":2352,"featured":6,"hashTags":33,"meta":2353,"metaTitle":2354,"ogImage":33,"postType":2355,"publishedDate":2356,"relatedBlogPostsCollection":2357,"slug":2359,"stem":2360,"subtitle":33,"summary":2361,"synopsis":2371,"sys":2372,"tagsCollection":2375,"topicsCollection":2380,"__hash__":2455},"blog\u002Fblog\u002Franking-the-best-anti-phishing-tools-and-software.json","Ranking the best anti-phishing tools and software in 2026",{"items":477},[478],{"fullName":479,"firstName":480,"jobTitle":481,"socialLinks":33,"profilePicture":482},"Peyton Padfield","Peyton","Product Team",{"url":483},"https:\u002F\u002Fimages.ctfassets.net\u002Fy1cdw1ablpvd\u002F1GU01HXElmc07nwi89qP3b\u002F3188050420106c62e9df2ed4e4893b7f\u002F1677005177901__1_.jpeg",{"json":485,"links":1950},{"nodeType":486,"data":487,"content":488},"document",{},[489,498,507,526,533,537,545,553,562,573,607,613,637,640,647,655,686,710,713,720,728,747,758,761,768,776,795,817,820,827,835,854,865,868,875,883,914,925,928,935,943,974,985,988,995,1003,1022,1044,1047,1054,1062,1092,1115,1118,1125,1133,1140,1151,1158,1189,1192,1199,1784,1787,1794,1801,1908,1911,1918,1925,1932],{"nodeType":490,"data":491,"content":497},"embedded-entry-block",{"target":492},{"sys":493},{"id":494,"type":495,"linkType":496},"2lJY0amP1Sda1iJGs51X53","Link","Entry",[],{"nodeType":499,"data":500,"content":501},"paragraph",{},[502],{"nodeType":503,"value":504,"marks":505,"data":506},"text","Most organizations already pay for some form of anti-phishing software. Email security filters the inbox, training teaches people what to look for, and EDR catches what runs on a device. All three were built around the same assumption: that phishing arrives by email.",[],{},{"nodeType":499,"data":508,"content":509},{},[510,514,522],{"nodeType":503,"value":511,"marks":512,"data":513},"That assumption doesn't hold anymore. Employees get phishing links in LinkedIn messages, Teams chats, text messages and search results, and ",[],{},{"nodeType":515,"data":516,"content":517},"hyperlink",{"uri":25},[518],{"nodeType":503,"value":519,"marks":520,"data":521},"1 in 2 payloads Push intercepts",[],{},{"nodeType":503,"value":523,"marks":524,"data":525}," are sent over channels like search engines and social media, where email tools never see them. The phishing that does arrive by email is harder to catch too, because attackers send it through legitimate services that pass authentication checks and hide the page behind bot checks that show scanners something harmless.",[],{},{"nodeType":499,"data":527,"content":528},{},[529],{"nodeType":503,"value":530,"marks":531,"data":532},"For each tool, we look at how it detects phishing, which delivery channels it can see, and where its coverage ends.",[],{},{"nodeType":534,"data":535,"content":536},"hr",{},[],{"nodeType":538,"data":539,"content":540},"heading-1",{},[541],{"nodeType":503,"value":542,"marks":543,"data":544},"How the 10 best anti-phishing solutions compare",[],{},{"nodeType":546,"data":547,"content":548},"heading-2",{},[549],{"nodeType":503,"value":550,"marks":551,"data":552},"1. Push Security – Browser security",[],{},{"nodeType":499,"data":554,"content":555},{},[556],{"nodeType":503,"value":557,"marks":558,"data":561},"Best for: detecting and blocking phishing pages however and wherever a link was clicked.",[559],{"type":560},"bold",{},{"nodeType":499,"data":563,"content":564},{},[565,569],{"nodeType":503,"value":566,"marks":567,"data":568},"Push is a browser extension that detects and blocks phishing pages as your employees land on and interact with them. Instead of checking URLs against a list of known bad sites, ",[],{},{"nodeType":503,"value":570,"marks":571,"data":572},"Push looks at how the page behaves: how it's built, what its scripts do and what happens when you try to interact with it. That's how it catches AiTM kits, cloned login pages and fake browser pop-ups, even on a domain that was registered an hour ago and hasn't been flagged as suspicious or malicious. ",[],{},{"nodeType":499,"data":574,"content":575},{},[576,580,590,594,603],{"nodeType":503,"value":577,"marks":578,"data":579},"Because Push works inside the browser, it doesn't matter how the link got there. An email, a LinkedIn message, a search ad, and an instant message all lead to the same place. Push also stops ClickFix attacks, device code and OAuth consent phishing, and ",[],{},{"nodeType":515,"data":581,"content":583},{"uri":582},"https:\u002F\u002Fpushsecurity.com\u002Fsolution\u002Fachieve-security-outcomes\u002Fstop-account-takeover",[584],{"nodeType":503,"value":585,"marks":586,"data":589},"attackers reusing stolen sessions",[587],{"type":588},"underline",{},{"nodeType":503,"value":591,"marks":592,"data":593},". Behind the scenes, AI agents hunt for new attack techniques and roll out new detections without waiting for a person to step in. It works in the browsers your team already uses, including on ",[],{},{"nodeType":515,"data":595,"content":597},{"uri":596},"https:\u002F\u002Fpushsecurity.com\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-bring-your-own-device",[598],{"nodeType":503,"value":599,"marks":600,"data":602},"contractor and unmanaged devices",[601],{"type":588},{},{"nodeType":503,"value":604,"marks":605,"data":606},".",[],{},{"nodeType":490,"data":608,"content":612},{"target":609},{"sys":610},{"id":611,"type":495,"linkType":496},"77ZQz64rjzH1c8cwWsvBsg",[],{"nodeType":499,"data":614,"content":615},{},[616,621,625,633],{"nodeType":503,"value":617,"marks":618,"data":620},"Where it stops:",[619],{"type":560},{},{"nodeType":503,"value":622,"marks":623,"data":624}," Push doesn't scan email content, attachments or headers. If a BEC email never links to a malicious page, that's a job for your ",[],{},{"nodeType":515,"data":626,"content":628},{"uri":627},"https:\u002F\u002Fpushsecurity.com\u002Fsolution\u002Ftool-replacements\u002Femail-security",[629],{"nodeType":503,"value":630,"marks":631,"data":632},"email security",[],{},{"nodeType":503,"value":634,"marks":635,"data":636},". Anything that executes on the device is EDR territory, but while Push can't see on-device execution, it can detect and stop attacks before they break through to the endpoint. ",[],{},{"nodeType":534,"data":638,"content":639},{},[],{"nodeType":546,"data":641,"content":642},{},[643],{"nodeType":503,"value":644,"marks":645,"data":646},"2. Proofpoint – Email security",[],{},{"nodeType":499,"data":648,"content":649},{},[650],{"nodeType":503,"value":651,"marks":652,"data":654},"Best for: large enterprises with complex email environments.",[653],{"type":560},{},{"nodeType":499,"data":656,"content":657},{},[658,662,670,674,682],{"nodeType":503,"value":659,"marks":660,"data":661},"Proofpoint is one of the most established names in enterprise email security, with two decades of insight into how attacks reach people through email. Its ",[],{},{"nodeType":515,"data":663,"content":665},{"uri":664},"https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection",[666],{"nodeType":503,"value":667,"marks":668,"data":669},"Core Email Protection",[],{},{"nodeType":503,"value":671,"marks":672,"data":673}," uses behavioral AI to catch phishing and BEC, and it protects messages before delivery, in the mailbox and again when someone clicks a link. Proofpoint's wider collaboration security platform extends that protection to messaging and collaboration tools. Email security like this still does a huge amount of work in most stacks: in the ",[],{},{"nodeType":515,"data":675,"content":677},{"uri":676},"https:\u002F\u002Fpushsecurity.com\u002Fblog\u002Fverizon-dbir-2026-review",[678],{"nodeType":503,"value":679,"marks":680,"data":681},"2026 DBIR",[],{},{"nodeType":503,"value":683,"marks":684,"data":685},", 80% of attacks blocked by email security gateways were credential or session phishing.",[],{},{"nodeType":499,"data":687,"content":688},{},[689,694,698,706],{"nodeType":503,"value":690,"marks":691,"data":693},"Where it's heading:",[692],{"type":560},{},{"nodeType":503,"value":695,"marks":696,"data":697}," Like other email security tools, Proofpoint has traditionally lost sight of an attack once someone clicks through to the web page. Proofpoint has acknowledged that gap and chosen to partner with Push to close it. ",[],{},{"nodeType":515,"data":699,"content":701},{"uri":700},"https:\u002F\u002Fpushsecurity.com\u002Fblog\u002Fproofpoint-x-push-partnership-announcement",[702],{"nodeType":503,"value":703,"marks":704,"data":705},"Announced in September 2026",[],{},{"nodeType":503,"value":707,"marks":708,"data":709},", Proofpoint Advanced Browser Protection uses Push's behavioral detection to extend Proofpoint's coverage from the inbox into the browser session, with browser telemetry feeding back into Proofpoint's investigation tools. It's a strong signal of where phishing defense is heading: even the leading vendors in email security now see the browser as the place to stop modern threats.",[],{},{"nodeType":534,"data":711,"content":712},{},[],{"nodeType":546,"data":714,"content":715},{},[716],{"nodeType":503,"value":717,"marks":718,"data":719},"3. Abnormal AI – Email security",[],{},{"nodeType":499,"data":721,"content":722},{},[723],{"nodeType":503,"value":724,"marks":725,"data":727},"Best for: catching BEC and social engineering emails.",[726],{"type":560},{},{"nodeType":499,"data":729,"content":730},{},[731,735,743],{"nodeType":503,"value":732,"marks":733,"data":734},"Abnormal connects to Microsoft 365 and Google Workspace by API and learns who normally emails whom. That makes it very good at catching BEC, vendor fraud and the plain-text emails that older gateways miss. In July 2026, it ",[],{},{"nodeType":515,"data":736,"content":738},{"uri":737},"https:\u002F\u002Fabnormal.ai\u002Fnewsroom\u002Fpress-releases\u002Fabnormal-extends-behavioral-security-platform",[739],{"nodeType":503,"value":740,"marks":741,"data":742},"extended its platform",[],{},{"nodeType":503,"value":744,"marks":745,"data":746}," with Identity Threat Protection and AI Governance, applying the same behavioral model to sign-in and identity signals.",[],{},{"nodeType":499,"data":748,"content":749},{},[750,754],{"nodeType":503,"value":617,"marks":751,"data":753},[752],{"type":560},{},{"nodeType":503,"value":755,"marks":756,"data":757}," Abnormal's view is built from email, sign-in and communication signals. It can flag an account that starts behaving strangely after a compromise, but if the phishing link arrives by text message or search ad, Abnormal never sees the page that captured the credentials.",[],{},{"nodeType":534,"data":759,"content":760},{},[],{"nodeType":546,"data":762,"content":763},{},[764],{"nodeType":503,"value":765,"marks":766,"data":767},"4. Mimecast – Email security",[],{},{"nodeType":499,"data":769,"content":770},{},[771],{"nodeType":503,"value":772,"marks":773,"data":775},"Best for: email security and human risk.",[774],{"type":560},{},{"nodeType":499,"data":777,"content":778},{},[779,783,791],{"nodeType":503,"value":780,"marks":781,"data":782},"Mimecast combines a mature secure email gateway with a human risk management platform. Its 2024 ",[],{},{"nodeType":515,"data":784,"content":786},{"uri":785},"https:\u002F\u002Fwww.bankinfosecurity.com\u002Fmimecast-acquires-aware-to-advance-collaboration-security-a-26027",[787],{"nodeType":503,"value":788,"marks":789,"data":790},"acquisition of Aware",[],{},{"nodeType":503,"value":792,"marks":793,"data":794}," added AI analysis of messages in collaboration tools like Slack and Teams, aimed mainly at data loss and compliance risk.",[],{},{"nodeType":499,"data":796,"content":797},{},[798,802,806,813],{"nodeType":503,"value":617,"marks":799,"data":801},[800],{"type":560},{},{"nodeType":503,"value":803,"marks":804,"data":805}," Like most email security solutions, Mimecast judges links from outside the employee's browser. Phishing kits that hide behind bot checks show those scanners a harmless page, and ",[],{},{"nodeType":515,"data":807,"content":808},{"uri":25},[809],{"nodeType":503,"value":810,"marks":811,"data":812},"95% of in-browser attacks Push detected",[],{},{"nodeType":503,"value":814,"marks":815,"data":816}," used bot-protection services to hide. Links from channels Mimecast doesn't connect to never pass through it at all.",[],{},{"nodeType":534,"data":818,"content":819},{},[],{"nodeType":546,"data":821,"content":822},{},[823],{"nodeType":503,"value":824,"marks":825,"data":826},"5. Microsoft Defender for Office 365 – Email security",[],{},{"nodeType":499,"data":828,"content":829},{},[830],{"nodeType":503,"value":831,"marks":832,"data":834},"Best for: Microsoft 365 organizations that want built-in protection.",[833],{"type":560},{},{"nodeType":499,"data":836,"content":837},{},[838,842,850],{"nodeType":503,"value":839,"marks":840,"data":841},"If you're on Microsoft 365, Defender for Office 365 may already be part of your license, which makes it a natural starting point. ",[],{},{"nodeType":515,"data":843,"content":845},{"uri":844},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fsafe-links-about",[846],{"nodeType":503,"value":847,"marks":848,"data":849},"Safe Links",[],{},{"nodeType":503,"value":851,"marks":852,"data":853}," scans links during mail flow and checks them again at click time in Outlook, Teams and supported Office apps, and Microsoft sees an enormous volume of phishing to learn from.",[],{},{"nodeType":499,"data":855,"content":856},{},[857,861],{"nodeType":503,"value":617,"marks":858,"data":860},[859],{"type":560},{},{"nodeType":503,"value":862,"marks":863,"data":864}," Safe Links protects links clicked inside Microsoft's own apps, so a link opened from personal email, LinkedIn or a search result never reaches it. Its click-time check leans on a list of known malicious URLs, with unknown ones detonated in the background, so a phishing domain registered that morning has little reputation to go on. Microsoft's own documentation describes a configuration in which a link that was clean on delivery and weaponized later gets through.",[],{},{"nodeType":534,"data":866,"content":867},{},[],{"nodeType":546,"data":869,"content":870},{},[871],{"nodeType":503,"value":872,"marks":873,"data":874},"6. Varonis Interceptor (built on SlashNext) – Email security",[],{},{"nodeType":499,"data":876,"content":877},{},[878],{"nodeType":503,"value":879,"marks":880,"data":882},"Best for: phishing across email and collaboration apps.",[881],{"type":560},{},{"nodeType":499,"data":884,"content":885},{},[886,890,898,902,910],{"nodeType":503,"value":887,"marks":888,"data":889},"SlashNext made its name catching phishing by opening links in cloud-hosted virtual browsers at scale. Varonis ",[],{},{"nodeType":515,"data":891,"content":893},{"uri":892},"https:\u002F\u002Fsiliconangle.com\u002F2025\u002F09\u002F02\u002Fvaronis-acquires-slashnext-boost-phishing-social-engineering-defenses\u002F",[894],{"nodeType":503,"value":895,"marks":896,"data":897},"agreed to acquire SlashNext in September 2025",[],{},{"nodeType":503,"value":899,"marks":900,"data":901}," and ",[],{},{"nodeType":515,"data":903,"content":905},{"uri":904},"https:\u002F\u002Fsecuritybrief.news\u002Fstory\u002Fvaronis-unveils-interceptor-ai-platform-to-combat-email-phishing",[906],{"nodeType":503,"value":907,"marks":908,"data":909},"launched Interceptor",[],{},{"nodeType":503,"value":911,"marks":912,"data":913}," on its technology a month later. Interceptor is an API-based email security platform that combines language analysis, computer vision, behavioral analysis and a phishing sandbox that follows links and simulates what a person would do after the click. It also covers Teams, Slack and WhatsApp, and it can look back through your mail for threats your current tools missed.",[],{},{"nodeType":499,"data":915,"content":916},{},[917,921],{"nodeType":503,"value":617,"marks":918,"data":920},[919],{"type":560},{},{"nodeType":503,"value":922,"marks":923,"data":924}," Simulating the post-click journey is a smart answer to the scanner problem. But it still happens in a virtual browser in Varonis's cloud, not in your employee's browser, so a sandbox-aware kit that checks who's visiting can still show it a harmless page. Coverage also depends on the channels Interceptor connects to, which leaves a link from a search ad outside its view.",[],{},{"nodeType":534,"data":926,"content":927},{},[],{"nodeType":546,"data":929,"content":930},{},[931],{"nodeType":503,"value":932,"marks":933,"data":934},"7. Google Safe Browsing – Built-in web browsing protection",[],{},{"nodeType":499,"data":936,"content":937},{},[938],{"nodeType":503,"value":939,"marks":940,"data":942},"Best for: a free baseline that's already switched on.",[941],{"type":560},{},{"nodeType":499,"data":944,"content":945},{},[946,950,958,962,970],{"nodeType":503,"value":947,"marks":948,"data":949},"Google Safe Browsing is the phishing protection most of your employees already have. It's built into Chrome and used by other browsers too, and Google says it ",[],{},{"nodeType":515,"data":951,"content":953},{"uri":952},"https:\u002F\u002Fsafebrowsing.google.com\u002F",[954],{"nodeType":503,"value":955,"marks":956,"data":957},"protects more than five billion devices",[],{},{"nodeType":503,"value":959,"marks":960,"data":961}," by warning people before they open a dangerous site or download a harmful file. By default, Chrome checks each site against a list of known dangerous sites. Enhanced Protection, which admins can turn on with the SafeBrowsingProtectionLevel policy, adds real-time checks on uncommon sites and computer-vision analysis of suspicious pages. Google ",[],{},{"nodeType":515,"data":963,"content":965},{"uri":964},"https:\u002F\u002Fsecurity.googleblog.com\u002F2022\u002F12\u002Fenhanced-protection-strongest-level-of.html",[966],{"nodeType":503,"value":967,"marks":968,"data":969},"reports",[],{},{"nodeType":503,"value":971,"marks":972,"data":973}," that Enhanced Protection users are phished 20–35% less than users on the standard setting.",[],{},{"nodeType":499,"data":975,"content":976},{},[977,981],{"nodeType":503,"value":617,"marks":978,"data":980},[979],{"type":560},{},{"nodeType":503,"value":982,"marks":983,"data":984}," Google itself describes the default hash-based checks as \"inherently limited as they rely on lookups to a list of known bad sites,\" which means a new phishing domain has to be found and listed before it's blocked. Enhanced Protection narrows that gap, but it still judges whether a site is dangerous, so it has little to go on when the attack runs on a legitimate one. Device code phishing uses Microsoft's real login page, and phishing pages hosted on trusted services like SharePoint or Cloudflare inherit their reputation.",[],{},{"nodeType":534,"data":986,"content":987},{},[],{"nodeType":546,"data":989,"content":990},{},[991],{"nodeType":503,"value":992,"marks":993,"data":994},"8. Zscaler – Secure web gateway",[],{},{"nodeType":499,"data":996,"content":997},{},[998],{"nodeType":503,"value":999,"marks":1000,"data":1002},"Best for: organizations that route web traffic through a proxy.",[1001],{"type":560},{},{"nodeType":499,"data":1004,"content":1005},{},[1006,1010,1018],{"nodeType":503,"value":1007,"marks":1008,"data":1009},"Zscaler Internet Access is a cloud secure web gateway (SWG) that inspects web traffic in Zscaler's cloud and filters URLs by category and risk. Zscaler says it uses AI and ThreatLabz threat intelligence to detect new phishing domains, and its AI Smart Isolation opens risky-looking sites in an isolated browser instead of blocking them outright. Zscaler also ",[],{},{"nodeType":515,"data":1011,"content":1013},{"uri":1012},"https:\u002F\u002Fpushsecurity.com\u002Fblog\u002Fthe-top-10-browser-security-solutions-in-2026",[1014],{"nodeType":503,"value":1015,"marks":1016,"data":1017},"acquired the browser security startup SquareX",[],{},{"nodeType":503,"value":1019,"marks":1020,"data":1021}," in early 2026 to bolster its browser isolation capabilities and tackle threats passing through the browser to the endpoint.",[],{},{"nodeType":499,"data":1023,"content":1024},{},[1025,1029,1033,1041],{"nodeType":503,"value":617,"marks":1026,"data":1028},[1027],{"type":560},{},{"nodeType":503,"value":1030,"marks":1031,"data":1032}," An SWG sees network traffic, not the page your employee sees. It can block a URL it knows is bad, but phishing kits that rotate domains, hide behind bot checks or run on trusted infrastructure look like ordinary web traffic, and device code phishing happens on Microsoft's own login page. Coverage also depends on traffic going through the proxy, which leaves out unmanaged and contractor devices that don't run the Zscaler client. We compare the two approaches in more detail on our ",[],{},{"nodeType":515,"data":1034,"content":1036},{"uri":1035},"https:\u002F\u002Fpushsecurity.com\u002Fsolution\u002Ftool-replacements\u002Fsecure-web-gateways",[1037],{"nodeType":503,"value":1038,"marks":1039,"data":1040},"SWG comparison page",[],{},{"nodeType":503,"value":604,"marks":1042,"data":1043},[],{},{"nodeType":534,"data":1045,"content":1046},{},[],{"nodeType":546,"data":1048,"content":1049},{},[1050],{"nodeType":503,"value":1051,"marks":1052,"data":1053},"9. KnowBe4 – Security awareness training",[],{},{"nodeType":499,"data":1055,"content":1056},{},[1057],{"nodeType":503,"value":1058,"marks":1059,"data":1061},"Best for: security awareness training and phishing simulations for compliance.",[1060],{"type":560},{},{"nodeType":499,"data":1063,"content":1064},{},[1065,1069,1077,1081,1088],{"nodeType":503,"value":1066,"marks":1067,"data":1068},"KnowBe4 is one of the most widely used awareness training platforms, ",[],{},{"nodeType":515,"data":1070,"content":1072},{"uri":1071},"https:\u002F\u002Fwww.knowbe4.com\u002Fpress\u002Fknowbe4-honours-2024-emea-partner-programme-award-winners",[1073],{"nodeType":503,"value":1074,"marks":1075,"data":1076},"trusted by more than 70,000 organizations",[],{},{"nodeType":503,"value":1078,"marks":1079,"data":1080},". It pairs simulated phishing with PhishER, which helps your team sort through the emails employees report, and since buying Egress in 2024 it also offers ",[],{},{"nodeType":515,"data":1082,"content":1084},{"uri":1083},"https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Femail-collaboration-security",[1085],{"nodeType":503,"value":630,"marks":1086,"data":1087},[],{},{"nodeType":503,"value":1089,"marks":1090,"data":1091},". Training matters most for phishing that never involves a web page, like a phone call to the help desk or an email asking finance to pay a new invoice.",[],{},{"nodeType":499,"data":1093,"content":1094},{},[1095,1099,1103,1111],{"nodeType":503,"value":617,"marks":1096,"data":1098},[1097],{"type":560},{},{"nodeType":503,"value":1100,"marks":1101,"data":1102}," Training helps people recognize the signs of phishing, but AI is making those signs harder to find. A ",[],{},{"nodeType":515,"data":1104,"content":1106},{"uri":1105},"https:\u002F\u002Ftoday.ucsd.edu\u002Fstory\u002Fcybersecurity-training-programs-dont-prevent-employees-from-falling-for-phishing-scams",[1107],{"nodeType":503,"value":1108,"marks":1109,"data":1110},"study of more than 19,500 UC San Diego Health employees",[],{},{"nodeType":503,"value":1112,"marks":1113,"data":1114}," found no significant link between recent annual training and whether people fell for phishing, and training shown after a click reduced the likelihood of clicking by only about 2%. Your employees aren't the weakest link. They're the ones being targeted, and they deserve help in the moment it matters, not a reminder from last quarter's training.",[],{},{"nodeType":534,"data":1116,"content":1117},{},[],{"nodeType":546,"data":1119,"content":1120},{},[1121],{"nodeType":503,"value":1122,"marks":1123,"data":1124},"10. CrowdStrike – Endpoint security",[],{},{"nodeType":499,"data":1126,"content":1127},{},[1128],{"nodeType":503,"value":1129,"marks":1130,"data":1132},"Best for: catching what runs on a device after a phishing lure lands.",[1131],{"type":560},{},{"nodeType":499,"data":1134,"content":1135},{},[1136],{"nodeType":503,"value":1137,"marks":1138,"data":1139},"CrowdStrike Falcon is one of the leading EDR platforms. It's built to detect what phishing leaves behind on a device, like an infostealer, a malicious attachment opened in a desktop email client, or a command someone ran after falling for a ClickFix lure. ",[],{},{"nodeType":499,"data":1141,"content":1142},{},[1143,1147],{"nodeType":503,"value":617,"marks":1144,"data":1146},[1145],{"type":560},{},{"nodeType":503,"value":1148,"marks":1149,"data":1150}," All EDR solutions have the same problem: it watches the operating system, and most phishing never touches it. To EDR, Chrome looks like a normal process while a session token is being stolen inside it, and CrowdStrike's own 2026 Global Threat Report found that 82% of detections are now malware-free. ",[],{},{"nodeType":499,"data":1152,"content":1153},{},[1154],{"nodeType":503,"value":1155,"marks":1156,"data":1157},"To solve this gap, CrowdStrike acquired Seraphic in early 2026 and now sells it as Falcon Seraphic Enterprise Browser, which CrowdStrike says monitors activity inside the browser session to block threats. That makes Seraphic the part of the CrowdStrike ecosystem to evaluate for phishing upstream: an acknowledgement that focusing your defenses at the endpoint is no longer enough. ",[],{},{"nodeType":499,"data":1159,"content":1160},{},[1161,1165,1173,1177,1185],{"nodeType":503,"value":1162,"marks":1163,"data":1164},"For buyers evaluating CrowdStrike as a long-term platform bet, the ",[],{},{"nodeType":515,"data":1166,"content":1168},{"uri":1167},"https:\u002F\u002Fpushsecurity.com\u002Fblog\u002Fthe-case-for-best-of-breed-browser-security",[1169],{"nodeType":503,"value":1170,"marks":1171,"data":1172},"question is what the roadmap looks like 18 months post-close",[],{},{"nodeType":503,"value":1174,"marks":1175,"data":1176},", as development resource is inevitably funnelled into making the integration work rather than staying ahead of the latest threats (in an extremely fast-changing space fuelled by ",[],{},{"nodeType":515,"data":1178,"content":1180},{"uri":1179},"https:\u002F\u002Fpushsecurity.com\u002Fblog\u002Fbrowser-threat-landscape-mid-year-update-2026",[1181],{"nodeType":503,"value":1182,"marks":1183,"data":1184},"AI-assisted attacker tool development",[],{},{"nodeType":503,"value":1186,"marks":1187,"data":1188},"). ",[],{},{"nodeType":534,"data":1190,"content":1191},{},[],{"nodeType":546,"data":1193,"content":1194},{},[1195],{"nodeType":503,"value":1196,"marks":1197,"data":1198},"Comparison table",[],{},{"nodeType":1200,"data":1201,"content":1202},"table",{},[1203,1258,1312,1365,1417,1469,1521,1573,1626,1679,1731],{"nodeType":1204,"data":1205,"content":1206},"table-row",{},[1207,1218,1228,1238,1248],{"nodeType":1208,"data":1209,"content":1210},"table-header-cell",{},[1211],{"nodeType":499,"data":1212,"content":1213},{},[1214],{"nodeType":503,"value":1215,"marks":1216,"data":1217},"Tool",[],{},{"nodeType":1208,"data":1219,"content":1220},{},[1221],{"nodeType":499,"data":1222,"content":1223},{},[1224],{"nodeType":503,"value":1225,"marks":1226,"data":1227},"Type",[],{},{"nodeType":1208,"data":1229,"content":1230},{},[1231],{"nodeType":499,"data":1232,"content":1233},{},[1234],{"nodeType":503,"value":1235,"marks":1236,"data":1237},"How it detects phishing",[],{},{"nodeType":1208,"data":1239,"content":1240},{},[1241],{"nodeType":499,"data":1242,"content":1243},{},[1244],{"nodeType":503,"value":1245,"marks":1246,"data":1247},"Delivery channels it sees",[],{},{"nodeType":1208,"data":1249,"content":1250},{},[1251],{"nodeType":499,"data":1252,"content":1253},{},[1254],{"nodeType":503,"value":1255,"marks":1256,"data":1257},"Where it stops",[],{},{"nodeType":1204,"data":1259,"content":1260},{},[1261,1272,1282,1292,1302],{"nodeType":1262,"data":1263,"content":1264},"table-cell",{},[1265],{"nodeType":499,"data":1266,"content":1267},{},[1268],{"nodeType":503,"value":1269,"marks":1270,"data":1271},"Push Security",[],{},{"nodeType":1262,"data":1273,"content":1274},{},[1275],{"nodeType":499,"data":1276,"content":1277},{},[1278],{"nodeType":503,"value":1279,"marks":1280,"data":1281},"Browser security",[],{},{"nodeType":1262,"data":1283,"content":1284},{},[1285],{"nodeType":499,"data":1286,"content":1287},{},[1288],{"nodeType":503,"value":1289,"marks":1290,"data":1291},"Behavioral analysis of the rendered page in the employee's own browser",[],{},{"nodeType":1262,"data":1293,"content":1294},{},[1295],{"nodeType":499,"data":1296,"content":1297},{},[1298],{"nodeType":503,"value":1299,"marks":1300,"data":1301},"Any channel that ends in a browser: email, SMS, social media, search, QR codes, chat",[],{},{"nodeType":1262,"data":1303,"content":1304},{},[1305],{"nodeType":499,"data":1306,"content":1307},{},[1308],{"nodeType":503,"value":1309,"marks":1310,"data":1311},"Doesn't scan email content; doesn't see execution on the device",[],{},{"nodeType":1204,"data":1313,"content":1314},{},[1315,1325,1335,1345,1355],{"nodeType":1262,"data":1316,"content":1317},{},[1318],{"nodeType":499,"data":1319,"content":1320},{},[1321],{"nodeType":503,"value":1322,"marks":1323,"data":1324},"Proofpoint",[],{},{"nodeType":1262,"data":1326,"content":1327},{},[1328],{"nodeType":499,"data":1329,"content":1330},{},[1331],{"nodeType":503,"value":1332,"marks":1333,"data":1334},"Email security",[],{},{"nodeType":1262,"data":1336,"content":1337},{},[1338],{"nodeType":499,"data":1339,"content":1340},{},[1341],{"nodeType":503,"value":1342,"marks":1343,"data":1344},"Behavioral AI on email, with protection before delivery, in the mailbox and at click time",[],{},{"nodeType":1262,"data":1346,"content":1347},{},[1348],{"nodeType":499,"data":1349,"content":1350},{},[1351],{"nodeType":503,"value":1352,"marks":1353,"data":1354},"Email, plus messaging and collaboration tools through its wider platform",[],{},{"nodeType":1262,"data":1356,"content":1357},{},[1358],{"nodeType":499,"data":1359,"content":1360},{},[1361],{"nodeType":503,"value":1362,"marks":1363,"data":1364},"Loses sight after the click today; browser protection powered by Push due early 2027",[],{},{"nodeType":1204,"data":1366,"content":1367},{},[1368,1378,1387,1397,1407],{"nodeType":1262,"data":1369,"content":1370},{},[1371],{"nodeType":499,"data":1372,"content":1373},{},[1374],{"nodeType":503,"value":1375,"marks":1376,"data":1377},"Abnormal AI",[],{},{"nodeType":1262,"data":1379,"content":1380},{},[1381],{"nodeType":499,"data":1382,"content":1383},{},[1384],{"nodeType":503,"value":1332,"marks":1385,"data":1386},[],{},{"nodeType":1262,"data":1388,"content":1389},{},[1390],{"nodeType":499,"data":1391,"content":1392},{},[1393],{"nodeType":503,"value":1394,"marks":1395,"data":1396},"Behavioral baselines of who emails whom, via API",[],{},{"nodeType":1262,"data":1398,"content":1399},{},[1400],{"nodeType":499,"data":1401,"content":1402},{},[1403],{"nodeType":503,"value":1404,"marks":1405,"data":1406},"Microsoft 365 and Google Workspace email, plus sign-in signals",[],{},{"nodeType":1262,"data":1408,"content":1409},{},[1410],{"nodeType":499,"data":1411,"content":1412},{},[1413],{"nodeType":503,"value":1414,"marks":1415,"data":1416},"Doesn't see links or pages delivered outside email",[],{},{"nodeType":1204,"data":1418,"content":1419},{},[1420,1430,1439,1449,1459],{"nodeType":1262,"data":1421,"content":1422},{},[1423],{"nodeType":499,"data":1424,"content":1425},{},[1426],{"nodeType":503,"value":1427,"marks":1428,"data":1429},"Mimecast",[],{},{"nodeType":1262,"data":1431,"content":1432},{},[1433],{"nodeType":499,"data":1434,"content":1435},{},[1436],{"nodeType":503,"value":1332,"marks":1437,"data":1438},[],{},{"nodeType":1262,"data":1440,"content":1441},{},[1442],{"nodeType":499,"data":1443,"content":1444},{},[1445],{"nodeType":503,"value":1446,"marks":1447,"data":1448},"Secure email gateway that scans messages and links",[],{},{"nodeType":1262,"data":1450,"content":1451},{},[1452],{"nodeType":499,"data":1453,"content":1454},{},[1455],{"nodeType":503,"value":1456,"marks":1457,"data":1458},"Email, plus collaboration tools through Aware",[],{},{"nodeType":1262,"data":1460,"content":1461},{},[1462],{"nodeType":499,"data":1463,"content":1464},{},[1465],{"nodeType":503,"value":1466,"marks":1467,"data":1468},"Scanners can be shown a decoy page; channels outside its integrations",[],{},{"nodeType":1204,"data":1470,"content":1471},{},[1472,1482,1491,1501,1511],{"nodeType":1262,"data":1473,"content":1474},{},[1475],{"nodeType":499,"data":1476,"content":1477},{},[1478],{"nodeType":503,"value":1479,"marks":1480,"data":1481},"Microsoft Defender for Office 365",[],{},{"nodeType":1262,"data":1483,"content":1484},{},[1485],{"nodeType":499,"data":1486,"content":1487},{},[1488],{"nodeType":503,"value":1332,"marks":1489,"data":1490},[],{},{"nodeType":1262,"data":1492,"content":1493},{},[1494],{"nodeType":499,"data":1495,"content":1496},{},[1497],{"nodeType":503,"value":1498,"marks":1499,"data":1500},"Safe Links checks against known malicious URLs, with background detonation of unknown ones",[],{},{"nodeType":1262,"data":1502,"content":1503},{},[1504],{"nodeType":499,"data":1505,"content":1506},{},[1507],{"nodeType":503,"value":1508,"marks":1509,"data":1510},"Outlook, Teams and supported Office apps",[],{},{"nodeType":1262,"data":1512,"content":1513},{},[1514],{"nodeType":499,"data":1515,"content":1516},{},[1517],{"nodeType":503,"value":1518,"marks":1519,"data":1520},"Links opened outside Microsoft's apps; fresh domains with no reputation",[],{},{"nodeType":1204,"data":1522,"content":1523},{},[1524,1534,1543,1553,1563],{"nodeType":1262,"data":1525,"content":1526},{},[1527],{"nodeType":499,"data":1528,"content":1529},{},[1530],{"nodeType":503,"value":1531,"marks":1532,"data":1533},"Varonis Interceptor",[],{},{"nodeType":1262,"data":1535,"content":1536},{},[1537],{"nodeType":499,"data":1538,"content":1539},{},[1540],{"nodeType":503,"value":1332,"marks":1541,"data":1542},[],{},{"nodeType":1262,"data":1544,"content":1545},{},[1546],{"nodeType":499,"data":1547,"content":1548},{},[1549],{"nodeType":503,"value":1550,"marks":1551,"data":1552},"Language analysis, computer vision and a cloud phishing sandbox, via API",[],{},{"nodeType":1262,"data":1554,"content":1555},{},[1556],{"nodeType":499,"data":1557,"content":1558},{},[1559],{"nodeType":503,"value":1560,"marks":1561,"data":1562},"Email, Teams, Slack and WhatsApp",[],{},{"nodeType":1262,"data":1564,"content":1565},{},[1566],{"nodeType":499,"data":1567,"content":1568},{},[1569],{"nodeType":503,"value":1570,"marks":1571,"data":1572},"The sandbox runs in Varonis's cloud, not the employee's browser",[],{},{"nodeType":1204,"data":1574,"content":1575},{},[1576,1586,1596,1606,1616],{"nodeType":1262,"data":1577,"content":1578},{},[1579],{"nodeType":499,"data":1580,"content":1581},{},[1582],{"nodeType":503,"value":1583,"marks":1584,"data":1585},"Google Safe Browsing",[],{},{"nodeType":1262,"data":1587,"content":1588},{},[1589],{"nodeType":499,"data":1590,"content":1591},{},[1592],{"nodeType":503,"value":1593,"marks":1594,"data":1595},"Built-in browsing protection",[],{},{"nodeType":1262,"data":1597,"content":1598},{},[1599],{"nodeType":499,"data":1600,"content":1601},{},[1602],{"nodeType":503,"value":1603,"marks":1604,"data":1605},"Checks sites against Google's list of known dangerous sites; Enhanced Protection adds real-time and vision-based checks",[],{},{"nodeType":1262,"data":1607,"content":1608},{},[1609],{"nodeType":499,"data":1610,"content":1611},{},[1612],{"nodeType":503,"value":1613,"marks":1614,"data":1615},"Any link opened in Chrome and other browsers that use it",[],{},{"nodeType":1262,"data":1617,"content":1618},{},[1619],{"nodeType":499,"data":1620,"content":1621},{},[1622],{"nodeType":503,"value":1623,"marks":1624,"data":1625},"Attacks on legitimate pages; new domains not yet listed",[],{},{"nodeType":1204,"data":1627,"content":1628},{},[1629,1639,1649,1659,1669],{"nodeType":1262,"data":1630,"content":1631},{},[1632],{"nodeType":499,"data":1633,"content":1634},{},[1635],{"nodeType":503,"value":1636,"marks":1637,"data":1638},"Zscaler",[],{},{"nodeType":1262,"data":1640,"content":1641},{},[1642],{"nodeType":499,"data":1643,"content":1644},{},[1645],{"nodeType":503,"value":1646,"marks":1647,"data":1648},"Secure web gateway",[],{},{"nodeType":1262,"data":1650,"content":1651},{},[1652],{"nodeType":499,"data":1653,"content":1654},{},[1655],{"nodeType":503,"value":1656,"marks":1657,"data":1658},"URL filtering, threat intelligence and AI phishing domain detection on proxied traffic, with isolation for risky sites",[],{},{"nodeType":1262,"data":1660,"content":1661},{},[1662],{"nodeType":499,"data":1663,"content":1664},{},[1665],{"nodeType":503,"value":1666,"marks":1667,"data":1668},"Web traffic routed through Zscaler",[],{},{"nodeType":1262,"data":1670,"content":1671},{},[1672],{"nodeType":499,"data":1673,"content":1674},{},[1675],{"nodeType":503,"value":1676,"marks":1677,"data":1678},"Sees traffic, not the rendered page; devices outside the proxy",[],{},{"nodeType":1204,"data":1680,"content":1681},{},[1682,1692,1701,1711,1721],{"nodeType":1262,"data":1683,"content":1684},{},[1685],{"nodeType":499,"data":1686,"content":1687},{},[1688],{"nodeType":503,"value":1689,"marks":1690,"data":1691},"KnowBe4",[],{},{"nodeType":1262,"data":1693,"content":1694},{},[1695],{"nodeType":499,"data":1696,"content":1697},{},[1698],{"nodeType":503,"value":260,"marks":1699,"data":1700},[],{},{"nodeType":1262,"data":1702,"content":1703},{},[1704],{"nodeType":499,"data":1705,"content":1706},{},[1707],{"nodeType":503,"value":1708,"marks":1709,"data":1710},"Simulated phishing, training and triage of reported emails",[],{},{"nodeType":1262,"data":1712,"content":1713},{},[1714],{"nodeType":499,"data":1715,"content":1716},{},[1717],{"nodeType":503,"value":1718,"marks":1719,"data":1720},"Email",[],{},{"nodeType":1262,"data":1722,"content":1723},{},[1724],{"nodeType":499,"data":1725,"content":1726},{},[1727],{"nodeType":503,"value":1728,"marks":1729,"data":1730},"Relies on people spotting lures that AI is making harder to spot",[],{},{"nodeType":1204,"data":1732,"content":1733},{},[1734,1744,1754,1764,1774],{"nodeType":1262,"data":1735,"content":1736},{},[1737],{"nodeType":499,"data":1738,"content":1739},{},[1740],{"nodeType":503,"value":1741,"marks":1742,"data":1743},"CrowdStrike",[],{},{"nodeType":1262,"data":1745,"content":1746},{},[1747],{"nodeType":499,"data":1748,"content":1749},{},[1750],{"nodeType":503,"value":1751,"marks":1752,"data":1753},"Endpoint security",[],{},{"nodeType":1262,"data":1755,"content":1756},{},[1757],{"nodeType":499,"data":1758,"content":1759},{},[1760],{"nodeType":503,"value":1761,"marks":1762,"data":1763},"EDR on the operating system, with Seraphic added for the browser",[],{},{"nodeType":1262,"data":1765,"content":1766},{},[1767],{"nodeType":499,"data":1768,"content":1769},{},[1770],{"nodeType":503,"value":1771,"marks":1772,"data":1773},"Whatever reaches the device",[],{},{"nodeType":1262,"data":1775,"content":1776},{},[1777],{"nodeType":499,"data":1778,"content":1779},{},[1780],{"nodeType":503,"value":1781,"marks":1782,"data":1783},"EDR doesn't see in-browser phishing; Seraphic's phishing coverage is worth testing",[],{},{"nodeType":534,"data":1785,"content":1786},{},[],{"nodeType":538,"data":1788,"content":1789},{},[1790],{"nodeType":503,"value":1791,"marks":1792,"data":1793},"How to evaluate anti-phishing tools",[],{},{"nodeType":499,"data":1795,"content":1796},{},[1797],{"nodeType":503,"value":1798,"marks":1799,"data":1800},"Whichever vendors make your shortlist, a few questions separate the tools that will keep up with modern phishing from the ones that won't:",[],{},{"nodeType":1802,"data":1803,"content":1804},"unordered-list",{},[1805,1833,1848,1863,1878,1893],{"nodeType":1806,"data":1807,"content":1808},"list-item",{},[1809],{"nodeType":499,"data":1810,"content":1811},{},[1812,1817,1821,1829],{"nodeType":503,"value":1813,"marks":1814,"data":1816},"Does it detect behavior or reputation? ",[1815],{"type":560},{},{"nodeType":503,"value":1818,"marks":1819,"data":1820},"Ask what happens with a phishing page on a domain registered an hour ago. Most phishing domains ",[],{},{"nodeType":515,"data":1822,"content":1824},{"uri":1823},"https:\u002F\u002Fpushsecurity.com\u002Fblog\u002Fthe-pyramid-of-pain-in-the-ai-era",[1825],{"nodeType":503,"value":1826,"marks":1827,"data":1828},"are active for less than two days",[],{},{"nodeType":503,"value":1830,"marks":1831,"data":1832},", so a tool that waits for a blocklist update will usually be too late.",[],{},{"nodeType":1806,"data":1834,"content":1835},{},[1836],{"nodeType":499,"data":1837,"content":1838},{},[1839,1844],{"nodeType":503,"value":1840,"marks":1841,"data":1843},"Which delivery channels does it actually see?",[1842],{"type":560},{},{"nodeType":503,"value":1845,"marks":1846,"data":1847}," Map where your employees really receive links — email, Teams, Slack, LinkedIn, SMS, search — against what each tool connects to.",[],{},{"nodeType":1806,"data":1849,"content":1850},{},[1851],{"nodeType":499,"data":1852,"content":1853},{},[1854,1859],{"nodeType":503,"value":1855,"marks":1856,"data":1858},"Does it see the page your employee sees? ",[1857],{"type":560},{},{"nodeType":503,"value":1860,"marks":1861,"data":1862},"Scanners and sandboxes can be fed a decoy by kits that check who's visiting, so ask how the tool handles bot-protection services like Cloudflare Turnstile.",[],{},{"nodeType":1806,"data":1864,"content":1865},{},[1866],{"nodeType":499,"data":1867,"content":1868},{},[1869,1874],{"nodeType":503,"value":1870,"marks":1871,"data":1873},"What techniques are covered?",[1872],{"type":560},{},{"nodeType":503,"value":1875,"marks":1876,"data":1877}," Phishing isn’t just about stealing passwords anymore. AiTM kits steal the session after MFA completes, device code and consent phishing get the user to authorize the attacker on a real login page, and ClickFix gets them to paste and run a malicious command. Ask which of these each tool detects, and how.",[],{},{"nodeType":1806,"data":1879,"content":1880},{},[1881],{"nodeType":499,"data":1882,"content":1883},{},[1884,1889],{"nodeType":503,"value":1885,"marks":1886,"data":1888},"Does it cover unmanaged devices?",[1887],{"type":560},{},{"nodeType":503,"value":1890,"marks":1891,"data":1892}," Contractors and BYOD users get phished too, and many tools need MDM or a managed endpoint to work.",[],{},{"nodeType":1806,"data":1894,"content":1895},{},[1896],{"nodeType":499,"data":1897,"content":1898},{},[1899,1904],{"nodeType":503,"value":1900,"marks":1901,"data":1903},"Can you test it on your own traffic?",[1902],{"type":560},{},{"nodeType":503,"value":1905,"marks":1906,"data":1907}," A proof-of-value against real activity in your environment tells you more than any detection-rate claim.",[],{},{"nodeType":534,"data":1909,"content":1910},{},[],{"nodeType":538,"data":1912,"content":1913},{},[1914],{"nodeType":503,"value":1915,"marks":1916,"data":1917},"Learn more about Push Security",[],{},{"nodeType":499,"data":1919,"content":1920},{},[1921],{"nodeType":503,"value":1922,"marks":1923,"data":1924},"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.",[],{},{"nodeType":499,"data":1926,"content":1927},{},[1928],{"nodeType":503,"value":1929,"marks":1930,"data":1931},"Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",[],{},{"nodeType":499,"data":1933,"content":1934},{},[1935,1938,1946],{"nodeType":503,"value":41,"marks":1936,"data":1937},[],{},{"nodeType":515,"data":1939,"content":1941},{"uri":1940},"https:\u002F\u002Fpushsecurity.com\u002Fdemo",[1942],{"nodeType":503,"value":1943,"marks":1944,"data":1945},"Book a live demo",[],{},{"nodeType":503,"value":1947,"marks":1948,"data":1949}," to learn more.",[],{},{"entries":1951},{"hyperlink":1952,"inline":1953,"block":1954},[],[],[1955,1975],{"sys":1956,"__typename":1957,"content":1958,"name":1974,"title":33},{"id":494},"InsightTextBlockComponent",{"json":1959},{"data":1960,"content":1961,"nodeType":486},{},[1962],{"data":1963,"content":1964,"nodeType":499},{},[1965,1970],{"data":1966,"marks":1967,"value":1969,"nodeType":503},{},[1968],{"type":560},"The short answer: ",{"data":1971,"marks":1972,"value":1973,"nodeType":503},{},[],"Almost every phishing attack ends up in your employee's browser, whether the link arrived by email, text message, LinkedIn or a search ad. That makes browser-based phishing detection the one control that sees phishing across every delivery channel. Email security, phishing-resistant MFA, training and EDR still matter for the attacks that never touch the browser: BEC emails with no link, phone-only scams, and attachments opened in a desktop email client like Outlook. The best anti-phishing tools in 2026 are Push Security, Proofpoint, Abnormal AI, Mimecast, Microsoft Defender for Office 365, Varonis Interceptor, KnowBe4 and CrowdStrike.","Phishing listicle IB1",{"sys":1976,"__typename":1957,"content":1977,"name":1993,"title":33},{"id":611},{"json":1978},{"nodeType":486,"data":1979,"content":1980},{},[1981],{"nodeType":499,"data":1982,"content":1983},{},[1984,1988],{"nodeType":503,"value":1985,"marks":1986,"data":1987},"Push detected 6 ClickFix attacks and 10 AiTM phishing attempts during a 30-day proof-of-value at a financial services organization of around 4,500 employees. ",[],{},{"nodeType":503,"value":1989,"marks":1990,"data":1992},"None of them were visible to the security stack already in place that included email security, EDR, a network proxy, and user awareness training.",[1991],{"type":560},{},"Phishing listicle IB2","json",{"items":1996},[1997,2010,2034,2093,2106,2143,2156,2193,2259,2272,2296,2332],{"answer":1998,"question":2009},{"json":1999},{"nodeType":486,"data":2000,"content":2001},{},[2002],{"nodeType":499,"data":2003,"content":2004},{},[2005],{"nodeType":503,"value":2006,"marks":2007,"data":2008},"Most organizations rely on a mix of tools covering different vantage points. Email security like Proofpoint, Abnormal AI, Mimecast, Microsoft Defender for Office 365 and Varonis Interceptor analyzes messages and links, which makes it strong on BEC, but it can't see phishing that arrives through any other channel. Built-in browser protection like Google Safe Browsing and secure web gateways like Zscaler block sites already known to be dangerous, which leaves brand-new domains and attacks using legitimate pages and infrastructure in the chain. EDR platforms like CrowdStrike detect what executes on a device, but most phishing never touches the operating system. The best phishing detection happens in the browser, where almost every phishing attack ends up executing or passing through. Browser-based detection like Push analyzes every page accessed in employee browsers in real time, so it catches phishing from any delivery channel and infrastructure and blocks it before the user can interact with it.",[],{},"What are the best tools to detect phishing?",{"answer":2011,"question":2033},{"json":2012},{"nodeType":486,"data":2013,"content":2014},{},[2015],{"nodeType":499,"data":2016,"content":2017},{},[2018,2022,2029],{"nodeType":503,"value":2019,"marks":2020,"data":2021},"Start where the attacks meet. Almost every phishing attack ends on a web page in the browser, so browser security like Push is the core phishing prevention tool: it blocks the phishing page however the link arrived, and when someone is about to do something risky, it gives them a clear warning in the moment rather than relying on training they took months ago. Then cover the rest. Email security like Proofpoint or Abnormal AI filters email-borne phishing and catches link-free BEC, phishing-resistant MFA such as passkeys stops most credential replay once the weaker fallback methods are removed, and awareness platforms like KnowBe4 help people spot and report the scams that never involve a web page. Our ",[],{},{"nodeType":515,"data":2023,"content":2024},{"uri":1012},[2025],{"nodeType":503,"value":2026,"marks":2027,"data":2028},"top 10 browser security solutions",[],{},{"nodeType":503,"value":2030,"marks":2031,"data":2032}," guide covers the browser layer in more depth.",[],{},"How do you prevent phishing attacks, and what are the best phishing prevention tools?",{"answer":2035,"question":2092},{"json":2036},{"nodeType":486,"data":2037,"content":2038},{},[2039],{"nodeType":499,"data":2040,"content":2041},{},[2042,2046,2054,2058,2065,2069,2076,2080,2088],{"nodeType":503,"value":2043,"marks":2044,"data":2045},"Not anymore, or at least not only. Your employees can get a ",[],{},{"nodeType":515,"data":2047,"content":2049},{"uri":2048},"https:\u002F\u002Fpushsecurity.com\u002Fblog\u002Fhow-push-stopped-a-high-risk-linkedin-spear-phishing-attack",[2050],{"nodeType":503,"value":2051,"marks":2052,"data":2053},"phishing link in a LinkedIn DM",[],{},{"nodeType":503,"value":2055,"marks":2056,"data":2057},", a sponsored search result, a text message, a QR code or a Slack message. ",[],{},{"nodeType":515,"data":2059,"content":2060},{"uri":25},[2061],{"nodeType":503,"value":2062,"marks":2063,"data":2064},"Push data",[],{},{"nodeType":503,"value":2066,"marks":2067,"data":2068}," shows that 1 in 2 payloads intercepted by Push were sent over channels like search engines and social media rather than email, and 4 in 5 ClickFix pages Push intercepted were accessed from search engines via malvertising, SEO poisoning and compromised webpages. The ",[],{},{"nodeType":515,"data":2070,"content":2071},{"uri":676},[2072],{"nodeType":503,"value":2073,"marks":2074,"data":2075},"Verizon 2026 DBIR",[],{},{"nodeType":503,"value":2077,"marks":2078,"data":2079}," found that 41% of social engineering breaches involved channels beyond email, and ",[],{},{"nodeType":515,"data":2081,"content":2083},{"uri":2082},"https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fm-trends-2026",[2084],{"nodeType":503,"value":2085,"marks":2086,"data":2087},"Mandiant's M-Trends 2026",[],{},{"nodeType":503,"value":2089,"marks":2090,"data":2091}," saw email phishing fall from 14% to 6% of initial infection vectors in a single year.",[],{},"Is phishing still an email problem?",{"answer":2094,"question":2105},{"json":2095},{"nodeType":486,"data":2096,"content":2097},{},[2098],{"nodeType":499,"data":2099,"content":2100},{},[2101],{"nodeType":503,"value":2102,"marks":2103,"data":2104},"Many skip email altogether and arrive through social media, search ads, text messages or chat apps. Others are sent through legitimate services, so they pass SPF, DKIM and DMARC. Many hide behind bot checks, so link scanners only ever see a harmless page. Attackers also swap domains faster than blocklists can keep up, with 89% of phishing domains are active for less than two days.",[],{},"How do phishing attacks get through email controls?",{"answer":2107,"question":2142},{"json":2108},{"nodeType":486,"data":2109,"content":2110},{},[2111],{"nodeType":499,"data":2112,"content":2113},{},[2114,2118,2126,2130,2138],{"nodeType":503,"value":2115,"marks":2116,"data":2117},"Treat phishing as a technical problem, not a human one you can out-train. ",[],{},{"nodeType":515,"data":2119,"content":2121},{"uri":2120},"https:\u002F\u002Fpushsecurity.com\u002Fblog\u002Fwhy-your-training-budget-belongs-in-real-time-browser-security",[2122],{"nodeType":503,"value":2123,"marks":2124,"data":2125},"Training can't keep up",[],{},{"nodeType":503,"value":2127,"marks":2128,"data":2129}," with how varied phishing has become. A lure might arrive by email, LinkedIn, text message, Teams or a search ad, and the payload might be a fake login page, a device code prompt on a real Microsoft page, an OAuth consent request or a fake CAPTCHA asking them to paste a command. New techniques spread fast too. Attackers abuse interactions that don't feel like phishing at all: entering a code on a real Microsoft login page, or following the steps on what looks like a routine CAPTCHA. No training program can teach people to spot every variation, especially when nothing about the interaction looks wrong. Instead, block the phishing page as soon as someone lands on it, and ",[],{},{"nodeType":515,"data":2131,"content":2133},{"uri":2132},"https:\u002F\u002Fpushsecurity.com\u002Fsolution\u002Ftool-replacements\u002Fsecurity-awareness-training",[2134],{"nodeType":503,"value":2135,"marks":2136,"data":2137},"use the block as a teachable moment",[],{},{"nodeType":503,"value":2139,"marks":2140,"data":2141},": a real attack, explained at the exact moment your employee met it, rather than training delivered in a vacuum.",[],{},"How do I stop employees getting phished?",{"answer":2144,"question":2155},{"json":2145},{"nodeType":486,"data":2146,"content":2147},{},[2148],{"nodeType":499,"data":2149,"content":2150},{},[2151],{"nodeType":503,"value":2152,"marks":2153,"data":2154},"AiTM kits like Tycoon 2FA and Evilginx sit between the user and the real login page, relaying credentials and MFA in real time and stealing the session that results. Because the domains rotate constantly, the most reliable way to detect them is by behavior: how the page is built, what its scripts do and how it handles credentials. Push detects AiTM pages this way in the browser and blocks them before the user hands over anything. ",[],{},"How do I detect and block AiTM phishing?",{"answer":2157,"question":2192},{"json":2158},{"nodeType":486,"data":2159,"content":2160},{},[2161],{"nodeType":499,"data":2162,"content":2163},{},[2164,2168,2176,2180,2188],{"nodeType":503,"value":2165,"marks":2166,"data":2167},"Not on its own. AiTM kits relay the login in real time, so the user completes MFA as normal and the attacker leaves with their session. AiTM is now the dominant phishing technique: the ",[],{},{"nodeType":515,"data":2169,"content":2171},{"uri":2170},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fsecurity-insider\u002Fthreat-landscape\u002F2026-digital-defense-report",[2172],{"nodeType":503,"value":2173,"marks":2174,"data":2175},"2026 Microsoft Digital Defense Report",[],{},{"nodeType":503,"value":2177,"marks":2178,"data":2179}," found it accounts for 44.6% of all phishing techniques Microsoft identified. Passkeys close a lot of this gap, because a passkey only works on the real website and an AiTM kit can't relay it. They don't close all of it. Accounts that still accept SMS or authenticator codes as a fallback can be downgraded to the weaker method, and ",[],{},{"nodeType":515,"data":2181,"content":2183},{"uri":2182},"https:\u002F\u002Fpushsecurity.com\u002Fblog\u002Fauthorization-phishing",[2184],{"nodeType":503,"value":2185,"marks":2186,"data":2187},"authorization-layer phishing attacks",[],{},{"nodeType":503,"value":2189,"marks":2190,"data":2191}," get the user to authorize the attacker on the real login page, where the passkey works exactly as intended.",[],{},"Does MFA stop phishing?",{"answer":2194,"question":2258},{"json":2195},{"nodeType":486,"data":2196,"content":2197},{},[2198,2240],{"nodeType":499,"data":2199,"content":2200},{},[2201,2205,2213,2217,2224,2228,2236],{"nodeType":503,"value":2202,"marks":2203,"data":2204},"Passkeys stop a lot of phishing, and they're well worth rolling out. A passkey only works on the real website, so an AiTM kit on a lookalike domain can't use it or pass it along. Passkey logins can't be phished directly, but they can be sidestepped, because passkeys protect one step: the login itself. If an account still accepts SMS or authenticator codes as a backup, ",[],{},{"nodeType":515,"data":2206,"content":2208},{"uri":2207},"https:\u002F\u002Fpushsecurity.com\u002Fblog\u002Fmfa-downgrade-attacks\u002F",[2209],{"nodeType":503,"value":2210,"marks":2211,"data":2212},"MFA downgrade attacks",[],{},{"nodeType":503,"value":2214,"marks":2215,"data":2216}," push the user toward the weaker option. ",[],{},{"nodeType":515,"data":2218,"content":2219},{"uri":2182},[2220],{"nodeType":503,"value":2221,"marks":2222,"data":2223},"Authorization-layer phishing attacks",[],{},{"nodeType":503,"value":2225,"marks":2226,"data":2227}," like ",[],{},{"nodeType":515,"data":2229,"content":2231},{"uri":2230},"https:\u002F\u002Fpushsecurity.com\u002Fblog\u002Fdevice-code-phishing\u002F",[2232],{"nodeType":503,"value":2233,"marks":2234,"data":2235},"device code phishing",[],{},{"nodeType":503,"value":2237,"marks":2238,"data":2239}," and ConsentFix trick the user into authorizing the attacker on a legitimate login page, so the passkey works exactly as designed and the attacker still gets a token. Some attackers have even talked employees into registering the attacker's passkey during a phone call. ",[],{},{"nodeType":499,"data":2241,"content":2242},{},[2243,2247,2254],{"nodeType":503,"value":2244,"marks":2245,"data":2246},"Removing fallback methods closes part of the gap, but only if you know where they are. Your IdP only sees the logins that go through it, and many apps still accept a password directly or keep a local account alongside SSO: ",[],{},{"nodeType":515,"data":2248,"content":2249},{"uri":25},[2250],{"nodeType":503,"value":2251,"marks":2252,"data":2253},"2 in 5 logins",[],{},{"nodeType":503,"value":2255,"marks":2256,"data":2257}," aren't protected by MFA. Measuring how employees actually log in to every app, including which use passkeys and which still use passwords, shows you where the rollout has gaps. Browser-based detection handles the rest of these attacks, detecting and stopping them in the browser before the user completes the authentication or authorization.",[],{},"Do passkeys and FIDO2 stop phishing, and can passkey logins be phished?",{"answer":2260,"question":2271},{"json":2261},{"nodeType":486,"data":2262,"content":2263},{},[2264],{"nodeType":499,"data":2265,"content":2266},{},[2267],{"nodeType":503,"value":2268,"marks":2269,"data":2270},"Because most phishing sites are gone before they're listed. 89% of phishing domains are active for less than two days, so by the time a URL lands on a blocklist, the attacker has usually moved on. Many kits also hide behind bot checks (95% of phish kits we see use bot protection) which means security scanners see a harmless page while real people see the phishing page.",[],{},"Why don't blocklists stop phishing sites?",{"answer":2273,"question":2295},{"json":2274},{"nodeType":486,"data":2275,"content":2276},{},[2277],{"nodeType":499,"data":2278,"content":2279},{},[2280,2284,2291],{"nodeType":503,"value":2281,"marks":2282,"data":2283},"It can be tough to tell AI-generated phishing apart from the real thing. The emails are well written and the pages look right, and ",[],{},{"nodeType":515,"data":2285,"content":2286},{"uri":25},[2287],{"nodeType":503,"value":2288,"marks":2289,"data":2290},"90% of phishing kits analyzed by Push in 2026",[],{},{"nodeType":503,"value":2292,"marks":2293,"data":2294}," involve some kind of AI-generated tell. What helps is focusing on what a phishing page has to do rather than how it looks. Whoever (or whatever) built it, the page still needs to capture a login, steal credentials or get someone to paste a malicious command. Browser-based detection looks for that behavior, so it can catch the attack even when nothing looks wrong.",[],{},"How do I detect AI-generated phishing?",{"answer":2297,"question":2331},{"json":2298},{"nodeType":486,"data":2299,"content":2300},{},[2301],{"nodeType":499,"data":2302,"content":2303},{},[2304,2308,2316,2320,2327],{"nodeType":503,"value":2305,"marks":2306,"data":2307},"ClickFix tricks people into copying a malicious command and running it themselves, usually behind a fake CAPTCHA or error message. It's now the most common technique Push sees: ClickFix averaged ",[],{},{"nodeType":515,"data":2309,"content":2311},{"uri":2310},"https:\u002F\u002Fpushsecurity.com\u002Fblog\u002Fthe-state-of-clickfix-by-detection-data",[2312],{"nodeType":503,"value":2313,"marks":2314,"data":2315},"52% of Push's detections through Q2 2026",[],{},{"nodeType":503,"value":2317,"marks":2318,"data":2319},", and ",[],{},{"nodeType":515,"data":2321,"content":2322},{"uri":25},[2323],{"nodeType":503,"value":2324,"marks":2325,"data":2326},"4 in 5 ClickFix pages Push intercepted",[],{},{"nodeType":503,"value":2328,"marks":2329,"data":2330}," were reached from search engines. Stopping it takes tools at two points. Push detects the page writing a malicious command to the clipboard and blocks it, whatever the lure looks like. EDR like CrowdStrike catches payload after the command is run, but leaves detection until the last minute — if this last line of defense fails or doesn't block in real time (not uncommon in the cat-and-mouse detection evasion game) then the attacker gets in. ",[],{},"What tools stop ClickFix attacks?",{"answer":2333,"question":2351},{"json":2334},{"nodeType":486,"data":2335,"content":2336},{},[2337,2344],{"nodeType":499,"data":2338,"content":2339},{},[2340],{"nodeType":503,"value":2341,"marks":2342,"data":2343},"Microsoft 365 is one of the most common targets for phishing kits, and more and more of those attacks run on Microsoft's own login pages and apps, where URL reputation has nothing to flag. AiTM kits put a convincing Microsoft sign-in page in front of a reverse proxy. Device code phishing sends users to the real Microsoft device login page, and ConsentFix abuses first-party apps like Azure CLI. ",[],{},{"nodeType":499,"data":2345,"content":2346},{},[2347],{"nodeType":503,"value":2348,"marks":2349,"data":2350},"Push detects and stops all three in the browser. It identifies AiTM kits by how the page behaves, blocks device code phishing kits and can warn or block on the device code login page itself, and monitors OAuth consent grants so it can block a malicious app before it gets access. Email security still filters what arrives by email, but the browser is where these attacks have to finish, so that's where to stop them.",[],{},"How do I stop Microsoft phishing?","Anti-phishing software and tools: frequently asked questions",{},"The 10 best anti-phishing tools and software in 2026","guide","2026-10-12T00:00:00.000Z",{"items":2358},[],"ranking-the-best-anti-phishing-tools-and-software","blog\u002Franking-the-best-anti-phishing-tools-and-software",{"json":2362},{"data":2363,"content":2364,"nodeType":486},{},[2365],{"data":2366,"content":2367,"nodeType":499},{},[2368],{"data":2369,"marks":2370,"value":2371,"nodeType":503},{},[],"Your guide to enterprise phishing protection in 2026: what each anti-phishing tool focuses on, the layer it protects, and where phishing still slips through.",{"id":2373,"publishedAt":2374},"3iknT74OE9mYtsK9D0QYkA","2026-10-12T12:56:51.098Z",{"items":2376},[2377],{"sys":2378,"name":1279},{"id":2379},"3pjES4THCIfSAwhGdNwBcy",{"items":2381},[2382,2386,2391,2396,2400,2405,2410,2415,2420,2425,2430,2435,2440,2445,2450],{"sys":2383,"name":126,"slug":2385,"tier":29},{"id":2384},"topic-phishing","phishing",{"sys":2387,"name":2389,"slug":2390,"tier":45},{"id":2388},"topic-social-engineering","Social engineering","social-engineering",{"sys":2392,"name":2394,"slug":2395,"tier":45},{"id":2393},"topic-identity-attacks","Identity attacks","identity-attacks",{"sys":2397,"name":185,"slug":2399,"tier":45},{"id":2398},"topic-session-hijacking","session-hijacking",{"sys":2401,"name":2403,"slug":2404,"tier":45},{"id":2402},"topic-credential-phishing","Credential phishing","credential-phishing",{"sys":2406,"name":2408,"slug":2409,"tier":45},{"id":2407},"topic-non-email-phishing","Non-email phishing","non-email-phishing",{"sys":2411,"name":2413,"slug":2414,"tier":45},{"id":2412},"topic-aitm","AiTM phishing","aitm",{"sys":2416,"name":2418,"slug":2419,"tier":45},{"id":2417},"topic-swg","SWG","swg",{"sys":2421,"name":2423,"slug":2424,"tier":45},{"id":2422},"topic-edr","EDR","edr",{"sys":2426,"name":2428,"slug":2429,"tier":45},{"id":2427},"topic-casb","CASB","casb",{"sys":2431,"name":2433,"slug":2434,"tier":45},{"id":2432},"topic-siem","SIEM","siem",{"sys":2436,"name":2438,"slug":2439,"tier":45},{"id":2437},"topic-browser-extensions","Browser extensions","browser-extensions",{"sys":2441,"name":2443,"slug":2444,"tier":45},{"id":2442},"topic-security-training","Security training","security-training",{"sys":2446,"name":2448,"slug":2449,"tier":45},{"id":2447},"topic-bec","BEC","bec",{"sys":2451,"name":2453,"slug":2454,"tier":45},{"id":2452},"topic-vishing","Vishing","vishing","LMcmosr3DDM6jpXTrm0Py3mLVISB5pk_MEW1W45g7Ho",{"id":2457,"extension":1994,"items":2458,"meta":2834,"stem":2835,"__hash__":2836},"blogTopics\u002Fblogtopics.json",[2459,2468,2477,2486,2492,2498,2507,2513,2521,2527,2536,2542,2550,2559,2567,2574,2583,2589,2598,2606,2612,2621,2630,2638,2647,2655,2664,2672,2678,2687,2696,2705,2714,2720,2729,2737,2746,2752,2761,2767,2776,2785,2790,2796,2805,2811,2820,2829],{"sys":2460,"faqItemsCollection":2462,"name":2464,"slug":2465,"tier":29,"intro":2466,"faqTitle":33,"postCount":2467,"hasPage":60},{"id":2461},"topic-ai",{"items":2463},[],"AI","ai","AI is reshaping both sides of the security equation: employees adopt AI tools faster than security teams can track them, while attackers use AI to scale and automate campaigns. Shadow AI adoption may now outpace wider shadow SaaS, and attackers are already turning AI chatbot platforms into malware delivery channels. Push has researched the offensive potential of computer-using agents and now applies AI agents to its own threat hunting. This hub covers AI as risk, target, and defensive tool.",24,{"sys":2469,"faqItemsCollection":2471,"name":2473,"slug":2474,"tier":45,"intro":2475,"faqTitle":33,"postCount":2476,"hasPage":60},{"id":2470},"topic-ai-attacks",{"items":2472},[],"AI attacks","ai-attacks","AI attacks run in both directions: attackers using AI to scale phishing, malware delivery, and identity attacks, and AI platforms themselves becoming the attack surface. Push has researched how computer-using agents can automate identity attacks, and has seen the poisoned tenant technique it coined used against its own employees in the wild.",26,{"sys":2478,"faqItemsCollection":2480,"name":2482,"slug":2483,"tier":45,"intro":2484,"faqTitle":33,"postCount":2485,"hasPage":60},{"id":2479},"topic-ai-governance",{"items":2481},[],"AI governance","ai-governance","AI governance is how organizations set and enforce rules for workplace AI use — which tools are allowed, what data can enter them, and how to evidence it to regulators. With US, EU, and UK AI regulations converging on obligations most organizations can’t yet meet, Push’s research makes the case that enforcement starts in the browser, where AI tools are actually used.",11,{"sys":2487,"faqItemsCollection":2488,"name":2413,"slug":2414,"tier":45,"intro":2490,"faqTitle":33,"postCount":2491,"hasPage":60},{"id":2412},{"items":2489},[],"Adversary-in-the-middle (AiTM) phishing proxies a real login page through an attacker-controlled site, capturing credentials, MFA codes, and session tokens in real time to bypass multi-factor authentication. Push’s research into kits like Evilginx and Sneaky2FA documents how they evade URL- and signature-based detection — and why analyzing toolkit behavior in the browser catches attacks that blocklists miss.",79,{"sys":2493,"faqItemsCollection":2494,"name":2448,"slug":2449,"tier":45,"intro":2496,"faqTitle":33,"postCount":2497,"hasPage":60},{"id":2447},{"items":2495},[],"Business email compromise (BEC) turns a hijacked mailbox into a fraud tool: attackers use mail rules, auto-forwarding, and payment redirection to steal money while staying invisible to the account owner. Alongside a first-hand case study of a BEC attack that nearly cost an engineering firm millions, Push breaks down these mailbox persistence tricks and how to detect them.",6,{"sys":2499,"faqItemsCollection":2501,"name":2503,"slug":2504,"tier":29,"intro":2505,"faqTitle":33,"postCount":2506,"hasPage":60},{"id":2500},"topic-browser-attacks",{"items":2502},[],"Browser attacks","browser-attacks","Browser attacks target users through the web pages, sessions, and extensions they rely on every day — bypassing endpoint and network defenses that never see inside the browser. Techniques like AiTM phishing kits, ClickFix-style copy-paste attacks, OAuth consent abuse, malvertising, and browser sync abuse have become a leading path to account takeover. Push researchers analyze these attacks in the wild, from infiltrating criminal phishing panels to dissecting toolkits like ConsentFix and Sneaky2FA. Use this hub to track how the techniques evolve and how to defend against them.",126,{"sys":2508,"faqItemsCollection":2509,"name":2438,"slug":2439,"tier":45,"intro":2511,"faqTitle":33,"postCount":2512,"hasPage":60},{"id":2437},{"items":2510},[],"Browser extensions cut both ways for security teams: malicious or compromised extensions are a growing attack vector, while an extension is also the lightest-weight way to deploy security controls into the browsers employees already use. These posts cover both sides — extension-borne risks like browser sync attacks and the limits of risk scoring, and how Push uses its extension to detect threats and block risky extensions.",33,{"sys":2514,"faqItemsCollection":2516,"name":1279,"slug":2518,"tier":29,"intro":2519,"faqTitle":33,"postCount":2520,"hasPage":60},{"id":2515},"topic-browser-security",{"items":2517},[],"browser-security","Work now happens in the browser, making browser security — visibility and control at the point where users meet the web — a core layer of enterprise defense. Endpoint, network, and email tools miss attacks that unfold inside the browser session, from AiTM phishing to risky extensions and shadow SaaS. Push has published extensively on choosing between enterprise browsers and browser extensions, using browser telemetry, and making the business case for browser security. Start here for both strategy and hands-on guidance.",130,{"sys":2522,"faqItemsCollection":2523,"name":2428,"slug":2429,"tier":45,"intro":2525,"faqTitle":33,"postCount":2526,"hasPage":60},{"id":2427},{"items":2524},[],"Cloud access security brokers (CASBs) govern cloud app usage through API integrations and network proxies — an approach that works for sanctioned apps but struggles with the long tail of shadow SaaS employees adopt on their own. Because every SaaS signup happens in a browser, Push captures that adoption in real time at the point of login, and these posts cover what proxy-based discovery misses.",14,{"sys":2528,"faqItemsCollection":2530,"name":2532,"slug":2533,"tier":45,"intro":2534,"faqTitle":33,"postCount":2535,"hasPage":60},{"id":2529},"topic-clickfix",{"items":2531},[],"ClickFix","clickfix","ClickFix attacks trick users into copying and running malicious commands themselves — typically through fake CAPTCHA, error, or fix-it prompts — so malware executes without a download for security tools to scan. Push researchers track the technique’s evolution in the wild and identified the ConsentFix and InstallFix variants, which extend it to OAuth consent grants and fake install guides.",43,{"sys":2537,"faqItemsCollection":2538,"name":2403,"slug":2404,"tier":45,"intro":2540,"faqTitle":33,"postCount":2541,"hasPage":60},{"id":2402},{"items":2539},[],"Credential phishing steals usernames and passwords through fake login pages impersonating the services employees use, handing attackers direct access to corporate accounts. Attackers don’t hack in — they log in. Push’s browser extension analyzes login pages as users actually see them, blocking cloned pages and stopping employees from entering company passwords on lookalike sites.",91,{"sys":2543,"faqItemsCollection":2545,"name":180,"slug":2547,"tier":45,"intro":2548,"faqTitle":33,"postCount":2549,"hasPage":60},{"id":2544},"topic-credential-stuffing",{"items":2546},[],"credential-stuffing","Credential stuffing is an attack where criminals replay username-password pairs stolen from one breach against other services, exploiting password reuse to take over accounts. Major breaches have shown how far a single set of stolen credentials can travel. Push detects verified stolen credentials by comparing employee passwords against breach datasets and dark-web threat intelligence, eliminating false positives.",64,{"sys":2551,"faqItemsCollection":2553,"name":2555,"slug":2556,"tier":29,"intro":2557,"faqTitle":33,"postCount":2558,"hasPage":60},{"id":2552},"topic-detection-and-response",{"items":2554},[],"Detection & response","detection-and-response","Detection and response is being reshaped as attacks move into the browser, where EDR, SIEM, and network tools have limited visibility. Modern phishing kits evade signature-based detection, and most malicious pages have never been seen before — so technique-level, in-browser detection matters more than known-bad indicators. Push’s work here spans high-fidelity browser telemetry, session token theft detection, and agentic threat hunting, plus practical IR guidance for compromised SaaS accounts and malicious OAuth apps. These posts cover both the philosophy and the workflows.",103,{"sys":2560,"faqItemsCollection":2562,"name":2564,"slug":2565,"tier":45,"intro":2566,"faqTitle":33,"postCount":2535,"hasPage":60},{"id":2561},"topic-detection-engineering",{"items":2563},[],"Detection engineering","detection-engineering","Detection engineering turns threat research into reliable, high-fidelity detections — and as AI accelerates the churn of attacker infrastructure, indicator-based detection is collapsing in favor of technique-level approaches. Here you’ll find teardowns of AiTM kits, ClickFix pages, and malvertising campaigns, alongside Push’s own account of building an agentic threat hunting pipeline that turns hunts into shipped detections.",{"sys":2568,"faqItemsCollection":2570,"name":141,"slug":2572,"tier":45,"intro":2573,"faqTitle":33,"postCount":2467,"hasPage":60},{"id":2569},"topic-device-code-phishing",{"items":2571},[],"device-code-phishing","Device code phishing abuses the OAuth device authorization flow: attackers generate a legitimate sign-in code, trick the victim into entering it on the vendor’s real login page, and walk away with access tokens — no fake site or password capture required. Push research tracked a sharp spike in adoption during 2026 as attackers use the technique to sidestep standard access controls.",{"sys":2575,"faqItemsCollection":2577,"name":2579,"slug":2580,"tier":45,"intro":2581,"faqTitle":33,"postCount":2582,"hasPage":60},{"id":2576},"topic-dlp",{"items":2578},[],"DLP","dlp","Data loss prevention (DLP) is the practice of stopping sensitive data from leaving your control — a problem that has shifted from email and endpoints to the browser, where employees move data into SaaS and AI tools. Push applies controls at that point of use, from keeping corporate credentials out of personal password managers to governing what flows into unsanctioned apps.",17,{"sys":2584,"faqItemsCollection":2585,"name":2423,"slug":2424,"tier":45,"intro":2587,"faqTitle":33,"postCount":2588,"hasPage":60},{"id":2422},{"items":2586},[],"Endpoint detection and response (EDR) watches processes, files, and memory on the device — a vantage point that never sees the phishing pages, stolen sessions, and identity attacks playing out inside the browser. That’s not an EDR failure; attackers have simply moved where it can’t follow. These posts map that gap and show how Push pairs browser-level detection and response with endpoint security to close it.",29,{"sys":2590,"faqItemsCollection":2592,"name":2594,"slug":2595,"tier":45,"intro":2596,"faqTitle":33,"postCount":2597,"hasPage":60},{"id":2591},"topic-enterprise-browser",{"items":2593},[],"Enterprise browser","enterprise-browser","An enterprise browser is a standalone, security-hardened browser that organizations deploy in place of Chrome, Edge, or other defaults. The real buying question is whether replacing the browser beats securing the browsers employees already use — a trade-off these posts examine directly, alongside analysis of Omdia’s secure enterprise browser market report and Push’s framework for weighing full browsers against extension-based deployment.",10,{"sys":2599,"faqItemsCollection":2601,"name":170,"slug":2603,"tier":45,"intro":2604,"faqTitle":33,"postCount":2605,"hasPage":60},{"id":2600},"topic-ghost-logins",{"items":2602},[],"ghost-logins","Ghost logins are overlooked authentication routes into an account — like a password login lingering behind SSO, or a forgotten secondary auth method — that attackers exploit for account takeover and persistence. Push coined the term after research showing how these forgotten login paths let attackers sidestep the MFA and SSO controls guarding an account’s primary sign-in method.",48,{"sys":2607,"faqItemsCollection":2608,"name":2394,"slug":2395,"tier":45,"intro":2610,"faqTitle":33,"postCount":2611,"hasPage":60},{"id":2393},{"items":2609},[],"Identity attacks target user accounts rather than infrastructure — phishing credentials, stealing sessions, abusing OAuth grants — because logging in is easier than hacking in. Identity-based techniques are now the leading cause of breaches. Push’s offensive research maps these techniques continuously, coining attacks like SAMLjacking and the poisoned tenant before they appeared in the wild.",60,{"sys":2613,"faqItemsCollection":2615,"name":2617,"slug":2618,"tier":29,"intro":2619,"faqTitle":33,"postCount":2620,"hasPage":60},{"id":2614},"topic-identity-security",{"items":2616},[],"Identity security","identity-security","Identity security is the practice of protecting workforce accounts, credentials, and sessions — the primary route attackers now use to breach organizations. Instead of hacking in, attackers log in: through phished credentials, stolen session tokens, MFA bypass, and forgotten ghost logins. Push’s research team documents these techniques continuously, from cross-IdP impersonation and SAMLjacking to analyses of major identity-driven breaches. This hub collects that research alongside practical guidance on MFA, SSO, and stopping account takeover.",154,{"sys":2622,"faqItemsCollection":2624,"name":2626,"slug":2627,"tier":45,"intro":2628,"faqTitle":33,"postCount":2629,"hasPage":60},{"id":2623},"topic-infostealer",{"items":2625},[],"Infostealer","infostealer","Infostealers are malware built to harvest saved passwords, cookies, and session tokens from infected devices, supplying the stolen credentials behind some of the most consequential breaches of recent years. Push traces the ecosystem trading this data and checks employee passwords against threat intel feeds, flagging verified stolen credentials before attackers can log in with them.",56,{"sys":2631,"faqItemsCollection":2633,"name":2635,"slug":2636,"tier":45,"intro":2637,"faqTitle":33,"postCount":2588,"hasPage":60},{"id":2632},"topic-legitimate-service-abuse",{"items":2634},[],"Legitimate service abuse","legitimate-service-abuse","Legitimate service abuse means staging attacks on trusted platforms — Google Ads, AI chatbot share pages, office.com links, Slack, SaaS tenants — so malicious content inherits the reputation of the service hosting it. Push research has documented the pattern repeatedly, from malvertising run through hijacked Google Ad Manager accounts to phishing links generated by Active Directory Federation Services.",{"sys":2639,"faqItemsCollection":2641,"name":2643,"slug":2644,"tier":45,"intro":2645,"faqTitle":33,"postCount":2646,"hasPage":60},{"id":2640},"topic-malvertising",{"items":2642},[],"Malvertising","malvertising","Malvertising uses paid search and display ads to put phishing pages and malware in front of users, often by impersonating trusted brands at the top of Google results. Push tracks these campaigns continuously — intercepting live attacks spoofing well-known brands — and has documented how criminals hijack Google Ads accounts to fund and run them.",34,{"sys":2648,"faqItemsCollection":2650,"name":2652,"slug":2653,"tier":45,"intro":2654,"faqTitle":33,"postCount":2582,"hasPage":60},{"id":2649},"topic-malware-delivery",{"items":2651},[],"Malware delivery","malware-delivery","Malware delivery has moved into the browser: rather than email attachments, attackers now rely on malvertising, fake install guides, and ClickFix-style copy-paste lures to get code running on endpoints. Push research on techniques like InstallFix maps the playbook, and in-browser detection of malicious copy and paste blocks these attacks before commands reach the endpoint.",{"sys":2656,"faqItemsCollection":2658,"name":2660,"slug":2661,"tier":45,"intro":2662,"faqTitle":33,"postCount":2663,"hasPage":60},{"id":2657},"topic-mfa",{"items":2659},[],"MFA","mfa","Multi-factor authentication (MFA) requires a second proof of identity beyond a password, and it remains one of the most effective controls against account takeover. Regulators from Cyber Essentials to NYDFS now mandate it across cloud services. Push enforces MFA in the browser on third-party apps — even those with no native enforcement option — and shows security teams where coverage gaps remain.",83,{"sys":2665,"faqItemsCollection":2667,"name":2669,"slug":2670,"tier":45,"intro":2671,"faqTitle":33,"postCount":2611,"hasPage":60},{"id":2666},"topic-mfa-bypass",{"items":2668},[],"MFA bypass","mfa-bypass","MFA bypass covers the techniques attackers use to defeat multi-factor authentication — AiTM phishing kits, consent phishing, device code phishing, and MFA downgrade attacks among them. None of these break the second factor; they route around it. Push researchers regularly get hands-on with phishing kits like Evilginx and Sneaky2FA, analyzing how these attacks work in the wild and how they evolve.",{"sys":2673,"faqItemsCollection":2674,"name":2408,"slug":2409,"tier":45,"intro":2676,"faqTitle":33,"postCount":2677,"hasPage":60},{"id":2407},{"items":2675},[],"Non-email phishing delivers malicious links through channels your secure email gateway never sees — social media messages, IM apps like Slack and Teams, search ads, and SMS. Push has intercepted live campaigns arriving via LinkedIn DMs, malvertising, and messaging platforms, which is why it detects phishing pages in the browser at the point of click, regardless of delivery channel.",54,{"sys":2679,"faqItemsCollection":2681,"name":2683,"slug":2684,"tier":45,"intro":2685,"faqTitle":33,"postCount":2686,"hasPage":60},{"id":2680},"topic-oauth-abuse",{"items":2682},[],"OAuth abuse","oauth-abuse","OAuth abuse is attackers exploiting app-to-app authorization — consent phishing, malicious OAuth apps, stolen tokens, and device code flows — to gain persistent access to cloud tenants without touching a password or MFA prompt. Push tracks these techniques continuously and discovered ConsentFix, a browser-native attack in the wild that pairs OAuth consent phishing with a ClickFix-style prompt.",70,{"sys":2688,"faqItemsCollection":2690,"name":2692,"slug":2693,"tier":45,"intro":2694,"faqTitle":33,"postCount":2695,"hasPage":60},{"id":2689},"topic-passkeys",{"items":2691},[],"Passkeys","passkeys","Passkeys are phishing-resistant credentials that replace passwords with cryptographic key pairs bound to a user’s device. They defeat conventional credential phishing, but attackers adapt: Push research has documented MFA downgrade, app-specific password phishing, and device code phishing being used in the wild to route around passkey-protected accounts. Deploying passkeys is step one; closing those fallback paths is step two.",23,{"sys":2697,"faqItemsCollection":2699,"name":2701,"slug":2702,"tier":45,"intro":2703,"faqTitle":33,"postCount":2704,"hasPage":60},{"id":2698},"topic-password-security",{"items":2700},[],"Password security","password-security","Password security is the practice of keeping workforce credentials strong, unique, and out of attackers’ hands — still a frontline defense while most SaaS logins depend on passwords. Expiration policies don’t fix weak or reused passwords; visibility does. Push observes real logins in the browser to flag weak, reused, and breached passwords and guide employees to reset them on any app.",80,{"sys":2706,"faqItemsCollection":2708,"name":2710,"slug":2711,"tier":45,"intro":2712,"faqTitle":33,"postCount":2713,"hasPage":60},{"id":2707},"topic-phaas",{"items":2709},[],"PhaaS","phaas","Phishing-as-a-service (PhaaS) platforms sell ready-made phishing kits, hosted infrastructure, and management panels on subscription, letting low-skill criminals run MFA-bypassing campaigns at scale. Kits like Evilginx, Tycoon2FA, Sneaky2FA, FlowerStorm, and EvilTokens each add their own evasion and session-theft capabilities, and new entrants appear regularly. Push researchers continuously get hands-on with these tools — investigating attacks in the wild, reverse-engineering kit behavior, and turning that research into detections.",41,{"sys":2715,"faqItemsCollection":2716,"name":126,"slug":2385,"tier":29,"intro":2718,"faqTitle":33,"postCount":2719,"hasPage":60},{"id":2384},{"items":2717},[],"Phishing remains the most common way attackers compromise business accounts — and it has moved far beyond suspicious emails. Modern campaigns use AiTM toolkits that bypass MFA, consent phishing against OAuth, device code phishing, and lures delivered through malvertising, LinkedIn, and Slack. Push detects and blocks these attacks in the browser, and its researchers publish teardowns of live campaigns and kits like Evilginx and Sneaky2FA. Read on for how phishing actually works today and what stops it.",95,{"sys":2721,"faqItemsCollection":2723,"name":2725,"slug":2726,"tier":45,"intro":2727,"faqTitle":33,"postCount":2728,"hasPage":60},{"id":2722},"topic-public-breach",{"items":2724},[],"Public breach","public-breach","Public breaches are the disclosed incidents that show how attacks actually unfold once the headlines fade. Push’s breach analyses keep finding identity at the entry point: stolen credentials, OAuth abuse, and missing MFA recur across the incidents analyzed here.",30,{"sys":2730,"faqItemsCollection":2732,"name":2734,"slug":2735,"tier":45,"intro":2736,"faqTitle":33,"postCount":2526,"hasPage":60},{"id":2731},"topic-ransomware",{"items":2733},[],"Ransomware","ransomware","Ransomware attacks increasingly begin with an identity, not an exploit: stolen credentials, MFA bypass, and help desk scams give operators their initial foothold. The analysis here follows that front end of the kill chain — how identity compromise leads to ransomware deployment, and the breaches driving regulators toward tighter MFA requirements.",{"sys":2738,"faqItemsCollection":2740,"name":2742,"slug":2743,"tier":29,"intro":2744,"faqTitle":33,"postCount":2745,"hasPage":60},{"id":2739},"topic-saas-security",{"items":2741},[],"SaaS security","saas-security","SaaS security means protecting the sprawl of cloud apps, accounts, and integrations your employees adopt — often without IT ever knowing. Shadow SaaS, risky OAuth grants, ghost logins, and unmanaged third-party access create attack paths traditional controls can’t see, as recent high-profile breaches have demonstrated. Building on the original SaaS attack matrix, Push continues to map SaaS-native attack techniques alongside practical guides for discovering and securing unsanctioned apps, and this hub gathers all of it.",97,{"sys":2747,"faqItemsCollection":2748,"name":2443,"slug":2444,"tier":45,"intro":2750,"faqTitle":33,"postCount":2751,"hasPage":60},{"id":2442},{"items":2749},[],"Security training aims to teach employees to recognize and avoid attacks — yet modern phishing routinely fools even seasoned security professionals. Push argues that training budgets work harder as real-time, in-browser intervention: guardrails and warnings at the moment of risk, rather than lessons employees must recall under pressure.",5,{"sys":2753,"faqItemsCollection":2755,"name":2757,"slug":2758,"tier":45,"intro":2759,"faqTitle":33,"postCount":2760,"hasPage":60},{"id":2754},"topic-seo-poisoning",{"items":2756},[],"SEO poisoning","seo-poisoning","SEO poisoning manipulates search engine results so malicious pages rank prominently for the software, tools, or services users are actively searching for, turning a routine search into an infection vector. It often pairs with malvertising and ClickFix-style payloads — Push has documented attackers abusing shared pages on legitimate AI chatbot domains to deliver malware from trusted infrastructure.",8,{"sys":2762,"faqItemsCollection":2763,"name":185,"slug":2399,"tier":45,"intro":2765,"faqTitle":33,"postCount":2766,"hasPage":60},{"id":2398},{"items":2764},[],"Session hijacking is the theft of an authenticated session — usually via stolen session cookies or tokens — letting attackers walk past passwords and MFA into a live account. AiTM phishing kits and infostealers have made it a mainstream attack technique across both criminal and targeted intrusions. Push’s browser agent detects session token theft by adding telemetry to the user agent string, creating a high-fidelity signal for security teams.",78,{"sys":2768,"faqItemsCollection":2770,"name":2772,"slug":2773,"tier":45,"intro":2774,"faqTitle":33,"postCount":2775,"hasPage":60},{"id":2769},"topic-shadow-ai",{"items":2771},[],"Shadow AI","shadow-ai","Shadow AI is employees’ unsanctioned use of AI tools at work, putting corporate data into chatbots and assistants that security teams never approved and can’t see. Push’s own browser telemetry shows AI adoption acting as a force multiplier for shadow IT — potentially now outscaling shadow SaaS — and this hub tracks that research, real-world breach examples, and practical controls.",22,{"sys":2777,"faqItemsCollection":2779,"name":2781,"slug":2782,"tier":45,"intro":2783,"faqTitle":33,"postCount":2784,"hasPage":60},{"id":2778},"topic-shadow-saas",{"items":2780},[],"Shadow SaaS","shadow-saas","Shadow SaaS is the cloud applications employees adopt for work without IT approval, each one creating unmanaged accounts, identities, and data outside your security controls. Push covers the problem end to end — from browser-based SaaS discovery to in-browser app banners and MFA enforcement — alongside breach analyses that show where unmanaged accounts lead.",77,{"sys":2786,"faqItemsCollection":2787,"name":2433,"slug":2434,"tier":45,"intro":2789,"faqTitle":33,"postCount":2775,"hasPage":60},{"id":2432},{"items":2788},[],"A SIEM is only as good as the telemetry feeding it, and most log sources never see what happens inside the browser — where phishing, session token theft, and account takeover actually play out. Push streams browser-level detections and identity telemetry into SIEMs, and these posts show how that data improves detection fidelity and cuts alert fatigue.",{"sys":2791,"faqItemsCollection":2792,"name":2389,"slug":2390,"tier":45,"intro":2794,"faqTitle":33,"postCount":2795,"hasPage":60},{"id":2388},{"items":2793},[],"Social engineering is the manipulation of people — through phishing pages, help desk impersonation, vishing calls, and poisoned tenant invites — into handing over access that no exploit could take. Coverage here tracks how threat actors run these plays — drawing on Push’s ongoing investigation of live phishing infrastructure and criminal tooling.",65,{"sys":2797,"faqItemsCollection":2799,"name":2801,"slug":2802,"tier":29,"intro":2803,"faqTitle":33,"postCount":2804,"hasPage":6},{"id":2798},"topic-supply-chain-security",{"items":2800},[],"Supply chain security","supply-chain-security","Supply chain security extends beyond your own perimeter to the vendors, platforms, and browser extensions your organization depends on. A compromised third party can hand attackers legitimate access — as recent campaigns against SaaS providers have shown. Push’s research examines the browser-extension supply chain in particular: why extension risk scores fail to predict compromise, and how developers can harden extensions against takeover. These posts frame supply chain risk through a browser and identity lens.",4,{"sys":2806,"faqItemsCollection":2807,"name":2418,"slug":2419,"tier":45,"intro":2809,"faqTitle":33,"postCount":2810,"hasPage":60},{"id":2417},{"items":2808},[],"A secure web gateway (SWG) filters and inspects web traffic in transit, sitting in the network path between users and the internet. That position shows you the packet but not the session: Push’s research on AitM phishing kits documents how attackers break the signatures proxies rely on, and these posts explain why phishing detection is moving from the network path into the browser itself.",20,{"sys":2812,"faqItemsCollection":2814,"name":2816,"slug":2817,"tier":45,"intro":2818,"faqTitle":33,"postCount":2819,"hasPage":60},{"id":2813},"topic-third-party-risk",{"items":2815},[],"Third-party risk","third-party-risk","Third-party risk is the exposure your organization inherits from vendors, SaaS providers, and integrations that hold your data or access your tenants — a chain now extended one employee sign-up at a time. This hub collects Push’s breach analyses and guides for assessing OAuth integrations, managing browser extensions, and responding when a supplier is compromised.",45,{"sys":2821,"faqItemsCollection":2823,"name":2825,"slug":2826,"tier":29,"intro":2827,"faqTitle":33,"postCount":2828,"hasPage":60},{"id":2822},"topic-threat-landscape",{"items":2824},[],"Threat landscape","threat-landscape","The enterprise threat landscape is now defined by identity attacks: criminals log in with phished, stolen, or stuffed credentials rather than breaking infrastructure. Threat actors keep proving how effective help desk scams, MFA bypass, and session theft are against well-defended organizations. Drawing on breach analyses, annual phishing trend reviews, and in-the-wild campaign tracking, Push documents how attacker TTPs are shifting. This hub is where to follow those changes.",52,{"sys":2830,"faqItemsCollection":2831,"name":2453,"slug":2454,"tier":45,"intro":2833,"faqTitle":33,"postCount":2582,"hasPage":60},{"id":2452},{"items":2832},[],"Vishing — voice phishing — uses phone calls to impersonate IT support, help desks, or employees, talking targets into password resets, MFA approvals, or opening attacker-controlled pages. Threat actors now routinely pair calls with AiTM phishing to hijack SSO accounts, a chain Push has analyzed across campaigns targeting hundreds of organizations.",{},"blogtopics","r6TN7pE6So8kuOd7LYEg2LfTCcgLetMGf2c8nvGnDCY",1791810017419]