'%3e%3cpath%20d='M248.027%20159.993C292.176%20159.993%20328.105%20124.1%20328.105%2079.996C328.105%2035.892%20292.191%200%20248.027%200C203.863%200%20167.95%2035.892%20167.95%2079.996C167.949%20124.101%20203.878%20159.993%20248.027%20159.993ZM213.969%2045.973C223.069%2036.882%20235.155%2031.873%20248.027%2031.873C260.899%2031.873%20272.986%2036.882%20282.086%2045.973C291.186%2055.064%20296.2%2067.154%20296.2%2079.997C296.2%2092.84%20291.186%20104.93%20282.086%20114.021C272.986%20123.112%20260.899%20128.12%20248.027%20128.12C235.155%20128.12%20223.069%20123.111%20213.969%20114.021C204.869%20104.93%20199.871%2092.84%20199.871%2079.997C199.871%2067.154%20204.884%2055.063%20213.969%2045.973Z'%20fill='%23EE4323'/%3e%3cpath%20d='M150.16%200L57.6821%20159.993H94.5381L187%200H150.16Z'%20fill='%23EE4323'/%3e%3cpath%20d='M92.478%200L0%20159.993H36.856L129.334%200H92.478Z'%20fill='%23EE4323'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_296_834'%3e%3crect%20width='328.105'%20height='159.993'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e){kind=small}
Shadow AI: how to discover, govern, and secure AI apps
Blocking AI tools doesn't stop employees from using AI — it stops you seeing how they use it. The solution: make the governed path easier than the workaround.
Guide
// Read
Detection engineering
43 posts
Detection engineering turns threat research into reliable, high-fidelity detections — and as AI accelerates the churn of attacker infrastructure, indicator-based detection is collapsing in favor of technique-level approaches. Here you’ll find teardowns of AiTM kits, ClickFix pages, and malvertising campaigns, alongside Push’s own account of building an agentic threat hunting pipeline that turns hunts into shipped detections.
From IOCs to TTPs: An agentic threat hunting case study
How Push’s agentic detection pipeline turns intel into huntable characteristics of attacker behavior, deriving durable detections from a range of sources.
Thought leadership
// Read
How Push’s agentic threat hunting in the browser benefits every customer
Security outcomes you can achieve when AI agents hunt in the browser, identify new threats, and ship detections that benefit everyone.
Thought leadership
// Read
No, you can’t just vibecode an AI-driven threat hunting pipeline
Push uses commercial AI models to deliver agentic threat hunting. Can’t you just build something yourself with those same models? Well, no.
Thought leadership
// Read
The Pyramid of Pain in the AI era: Why technique-level detection matters more than ever
AI is accelerating the collapse of indicator-based threat detection. Here's why you need technique-level detection to stay ahead.
Thought leadership
// Read
Can AI replace a threat researcher? What we learned building an agentic threat hunting pipeline
How we built an end-to-end threat hunting and detection engineering capability at Push that uses AI agents as a force multiplier.
Thought leadership
// Read
Guide: How to use Push controls to protect your users from modern browser threats
How to use in-browser controls to stop browser-based attacks before compromise can occur
Guide
// Read
Guide: How to manage and block browser extensions using Push
How to detect risky and malicious extensions and block them from running in employee browsers.
Guide
// Read
ConsentFix debrief: latest community insights, recommendations, and predictions
New insights on the ConsentFix campaign stopped by Push.
Threat research
// Read
Analysing a sophisticated Google malvertising attack impersonating TradingView
Push recently detected and blocked a malvertising attack impersonating TradingView designed to hijack Google Workspace accounts.
Threat research
// Read
Analysing a malvertising attack targeting business Google accounts intercepted by Push
Analysing a malvertising attack targeting Google business accounts that was intercepted by Push.
Threat research
// Read
Uncovering a Calendly-themed phishing campaign targeting business ad manager accounts
Investigating a phishing campaign targeting Google Ads Manager MCC accounts to propagate malvertising lures.
Threat research
// Read
Analyzing the latest Sneaky2FA Browser-in-the-Browser phishing page
Analyzing a BITB phishing page linked to the Sneaky2FA Phishing-as-a-Service operation.
Threat research
// Read
The most advanced ClickFix yet?
Breaking down the most sophisticated ClickFix page we’ve seen in the wild — and what it tells us about the future of malicious copy-and-paste attacks.
Threat research
// Read
New phishing campaign identified targeting LinkedIn users
Diving into the latest sophisticated LinkedIn phishing campaign intercepted by Push.
Threat research
// Read
Introducing malicious copy and paste detection
Push now detects malware delivery in the browser, supporting a layered defense against endpoint attacks.
Product feature
// Read
Fixing SecOps alert fatigue with browser telemetry
How browser data can improve detection fidelity and reduce alert fatigue, enabling SecOps teams to save time and detect more attacks.
Thought leadership
// Read
How Push stopped a high risk LinkedIn spear-phishing attack against a company exec
How Push saved a company exec from a sophisticated Attacker-in-the-Middle phishing attack delivered via a LinkedIn direct message.
Threat research
// Read
How attackers are using Active Directory Federation Services to phish with legit office.com links
Push recently identified a novel phishing attack using Active Directory Federation Services to get Microsoft to send victims to a phishing site.
Threat research
// Read
Introducing our guide to phishing detection evasion techniques
Introducing our latest resource for security teams breaking down the techniques that modern phishing attacks are using to evade detection.
Guide
// Read
Introducing Push Detections: Equipping SecOps and IR teams to stop browser-based attacks
We’re launching a new Detections capability, enabling security teams to more effectively investigate and triage alerts, and build more effective workflows.
Product feature
// Read
Detecting phishing pages using obfuscated URL destinations
Push now blocks URL schema obfuscation, countering a common technique used by attackers to bypass URL detections for phishing pages and malicious IPs.
Product feature
// Read
How browser-level controls change the fight against phishing
Attackers are routinely defeating conventional email, network, and endpoint-based security controls. Here's how browser controls can level the playing field.
Thought leadership
// Read
Better together: Identity telemetry from Push + smart storage and searches from Cribl
We’re thrilled to announce our partnership with Cribl to make it much easier to snapshot, transform, and query Push telemetry.
Partnership
// Read
Three reasons why browser is best for stopping phishing attacks
Why being in the browser gives defenders a key advantage over network and email phishing prevention, detection, and response tools.
Thought leadership
// Read
Why most phishing attacks feel like a zero-day
Most phishing attacks involve a phishing page that has never been seen before. When detection relies on known-bad, this makes every attack feel like a zero-day.
Thought leadership
// Read
Investigating a recent malvertising campaign targeting Onfido customers
We recently investigated a malvertising campaign using Evilginx to target Onfido customers via Google ads.
Threat research
// Read
How consent phishing is evolving to defeat detection controls
Consent phishing is where attackers trick users into authorizing access for malicious OAuth apps. Here's how attackers are using this technique in the wild.
Threat research
// Read
Why it's time for phishing prevention to move beyond email
Modern MFA-bypass phishing attacks are routinely defeating primarily email-based security controls. Why are controls failing and what can we do about it?
Thought leadership
// Read
How AitM phishing kits evade detection: Part 2
How attackers are breaking detection signatures designed to identify phishing sites impersonating real login pages.
Threat research
// Read
Shifting detection left for more effective threat detection
Why relying on post-compromise detection and response is no longer an option for modern browser-based attacks.
Thought leadership
// Read
Detecting and blocking phishing attacks in the browser
How Push detects and blocks phishing attempts in the browser – explained in less than two minutes.
Product feature
// Read
Hackers don’t hack in, they log in: How to prevent account takeover with Push
How Push stops attackers from using identity attack tools and techniques to compromise your employee user accounts.
Product feature
// Read
Adding cloned login page detection to your phishing defense arsenal
We've added cloned login page detection, providing yet another layer of protection against phishing attacks.
Product feature
// Read
Our design philosophy: Detecting what matters
This is the first blog in a short series we’re putting together about the ‘why’ behind the ‘what’ at Push. This entry is focused on threat detection.
Thought leadership
// Read
How AitM phishing kits evade detection
Taking a closer look at the steps that AitM phishing kits take to hide from the prying eyes of security teams and threat intelligence vendors.
Threat research
// Read
Introducing set-and-forget controls that stop real-world identity attacks
Enable detections and interventions in the browser using Push’s new security controls.
Product feature
// Read
Combining the powers of Push and Panther to stop identity attacks
Push is excited to partner with Panther, bringing our unique browser telemetry to your SIEM.
Partnership
// Read
Introducing session token theft detection: Why browser is best
Push's browser agent identifies session token theft by adding telemetry to the user agent string to create a new high-fidelity signal for your security team.
Product feature
// Read
Introducing AitM phishing toolkit detection, powered by the Push browser agent
Push analyzes behavioral attributes of malware to identify phishing tools like Evilginx and NakedPages and immediately block end-users from visiting them.
Product feature
// Read
Phishing 2.0 – how phishing toolkits are evolving with AitM
Attackers are using Adversary in the Middle (AitM) phishing toolkits to bypass MFA. We look at what AitM is, how it works, and what you can do about it.
Threat research
// Read
Dev diary: Phishing prevention behind the scenes
Behind the scenes of our approach to designing and developing our latest feature, SSO password protection.
Product feature
// Read
Introducing SSO Password Protection: Stop employees’ IdP credentials being exposed or phished
Use the Push browser agent’s unique vantage point to protect SSO credentials by blocking employees from entering their password into any other site.
Product feature
// Read
Subscribe to get updates from Push
The latest news, articles, and resources, sent to your inbox.