'%3e%3cpath%20d='M248.027%20159.993C292.176%20159.993%20328.105%20124.1%20328.105%2079.996C328.105%2035.892%20292.191%200%20248.027%200C203.863%200%20167.95%2035.892%20167.95%2079.996C167.949%20124.101%20203.878%20159.993%20248.027%20159.993ZM213.969%2045.973C223.069%2036.882%20235.155%2031.873%20248.027%2031.873C260.899%2031.873%20272.986%2036.882%20282.086%2045.973C291.186%2055.064%20296.2%2067.154%20296.2%2079.997C296.2%2092.84%20291.186%20104.93%20282.086%20114.021C272.986%20123.112%20260.899%20128.12%20248.027%20128.12C235.155%20128.12%20223.069%20123.111%20213.969%20114.021C204.869%20104.93%20199.871%2092.84%20199.871%2079.997C199.871%2067.154%20204.884%2055.063%20213.969%2045.973Z'%20fill='%23EE4323'/%3e%3cpath%20d='M150.16%200L57.6821%20159.993H94.5381L187%200H150.16Z'%20fill='%23EE4323'/%3e%3cpath%20d='M92.478%200L0%20159.993H36.856L129.334%200H92.478Z'%20fill='%23EE4323'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_296_834'%3e%3crect%20width='328.105'%20height='159.993'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e){kind=small}
Why your training budget belongs in real-time browser security
Organizations spend billions annually on awareness training. Here's why browser-based technical controls can make the difference where training falls short.
Thought leadership
// Read
Infostealer
52 posts
Infostealers are malware built to harvest saved passwords, cookies, and session tokens from infected devices, supplying the stolen credentials behind some of the most consequential breaches of recent years. Push traces the ecosystem trading this data and checks employee passwords against threat intel feeds, flagging verified stolen credentials before attackers can log in with them.
Your EDR is working exactly as intended. Attackers are getting around it anyway.
This article explains the gap between what EDR sees and what happens inside the browser, and what it takes to close it.
Thought leadership
// Read
LLMShare: how attackers are turning AI chatbot pages into malware delivery platforms
How attackers are using shared content features on AI chatbot platforms to deliver malware via pages hosted on legitimate domains, sent via malvertising.
Threat research
// Read
What we learned from 'Security Theater vs. Security That Works' with Matt Johansen
What we learned from sitting down with Matt Johansen to discuss the difference between security theater and security that actually works.
Thought leadership
// Read
Troy Hunt webinar recap: Lessons from 'Yes, you've been pwned' with Troy Hunt
Here are 7 things we learned from our conversation with Troy Hunt on the "Yes, you've been pwned" webinar.
Thought leadership
// Read
What the Verizon DBIR tells us about how breaches happen in 2026
What we can learn from 2026's installment of the Verizon Data Breach Investigations Report.
Thought leadership
// Read
The top 10 security problems you can solve in the browser — ranked by value
Ranking the security problems you can solve in the browser by security value and browser fit.
Thought leadership
// Read
The CISO's data problem (and how browser telemetry can help)
How CISOs can use browser telemetry to support cyber risk quantification in areas where traditional data points fall short.
Thought leadership
// Read
The three attack techniques behind ShinyHunters' 2026 campaigns
ShinyHunters' breach of Instructure is the latest in a long series of attacks. Here's our view of the big picture.
Threat research
// Read
Introducing the Browser & Identity Attacks Matrix
We're re-releasing the SaaS attack matrix as the Browser & Identity Attacks Matrix. Here's why we've decided to make the change and what it means.
Thought leadership
// Read
Unpacking the Vercel breach: A cautionary tale for Shadow AI and OAuth sprawl
In April 2026, Vercel was compromised via an OAuth app integrated into their Google Workspace tenant stemming from a compromised third-party AI SaaS provider.
Breach analysis
// Read
Browser sync attacks: Where personal account hacks lead to corporate breaches
Browser sync attacks result in business credentials being compromised via personal account and device breaches. Here's what you need to know.
Threat research
// Read
Attackers are now targeting business TikTok accounts using session-stealing phishing kits
Investigating a new wave of AITM phishing pages designed to hijack TikTok accounts.
Threat research
// Read
The Stryker breach didn't match the playbook. That shouldn't be a surprise.
Analysing the Stryker breach in line with recent changes to the Iran-nexus cyber playbook.
Breach analysis
// Read
InstallFix: How attackers are weaponizing malvertised install guides
Attackers are impersonating popular developer tools like Claude Code to distribute fake install instructions via malicious search engine ads.
Threat research
// Read
How cyber criminals power malvertising scams with stolen accounts
Attackers are going out of their way to target Google Ad Manager accounts, powering malvertising scams. Here’s what you need to know.
Threat research
// Read
Taking the fight to attackers: Push’s top features of 2025
Here’s how real-world attacks and our own R&D informed what we built for Push customers over the last year.
Product feature
// Read
2025’s top phishing trends — and what they mean for your 2026 security strategy
Analyzing the key trends that defined phishing attacks in 2025, and what these changes mean for security teams heading into 2026.
Thought leadership
// Read
"Scattered Lapsus$ Hunters" — how modern attackers exploit the gaps in your security stack
How Scattered Lapsus$ Hunters breaches demonstrate the evolution of attacker TTPs, shaping the future of cyber attacks.
Threat research
// Read
The most advanced ClickFix yet?
Breaking down the most sophisticated ClickFix page we’ve seen in the wild — and what it tells us about the future of malicious copy-and-paste attacks.
Threat research
// Read
Introducing malicious copy and paste detection
Push now detects malware delivery in the browser, supporting a layered defense against endpoint attacks.
Product feature
// Read
How cyber breaches are driving tighter MFA requirements and enforcement
MFA regulators, insurers, and policy-makers are getting tighter on their MFA requirements, fuelled by public cyber breaches.
Regulation & compliance
// Read
Why attackers are moving beyond email-based phishing
Why phishing attacks are moving away from exclusively email-based delivery, and what this means for security teams.
Thought leadership
// Read
6 browser-based attacks every security team should be prepared for
What security teams need to know about the browser-based attack techniques that are the leading cause of breaches.
Thought leadership
// Read
How the browser became the main cyber battleground
How attacks have moved away from endpoints and internal networks to the browser — a blind spot for traditional security tools.
Thought leadership
// Read
3 key takeaways from the Scattered Spider attacks on aviation & insurance firms
Scattered Spider continues to dominate the headlines, with attacks on aviation and insurance companies worldwide.
Breach analysis
// Read
Scattered Spider: TTP evolution in 2025
How the notorious Scattered Spider cyber criminal group are switching up their TTPs in 2025 to bypass MFA and breach cloud services via account takeover.
Threat research
// Read
Series B and Beyond: Securing the New Perimeter
I’m thrilled to share that Push Security has raised our Series B funding. This is a huge moment for us and our customers in the fight against identity attacks.
Company news
// Read
Dissecting a recent MailChimp phishing attack
HIBP creator and well-known security person Troy Hunt recently blogged about a phish he fell for. Here’s what it tells us about how phishing is evolving.
Breach analysis
// Read
Introducing Push password enforcement — for when weak passwords are still plaguing you
Detects when employees have weak, reused, or stolen passwords and guide them to update their password using in-browser messaging on any app.
Product feature
// Read
6 breaches in 5 months: Why attackers are targeting Jira with stolen credentials
Attackers are persistently targeting Jira accounts with stolen credentials. What can we learn from this trend?
Breach analysis
// Read
How new AI agents will transform credential stuffing attacks
Credential stuffing attacks had a huge impact in 2024. But things could be dialled up even further with Computer-Using Agents like OpenAI Operator.
Threat research
// Read
Considering the security implications of Computer-Using Agents (like OpenAI Operator)
CUAs are a new type of AI agent that drives your browser/OS for you, enabling effortless automation of web tasks — including those performed by attackers.
Threat research
// Read
No more hard simple problems: Enforce MFA on third-party apps with Push
Using Push to enforce MFA on third-party apps in the browser — even where MFA enforcement isn't supported by the app itself.
Product feature
// Read
How real-world attacks and research drove Push’s most popular features of 2024
How in-the-wild attacks and our own R&D inspired what we built in 2024 to stop account takeover and reduce security risks across your workforce identities.
Product feature
// Read
Guide to secure browser extension deployment
How extension developers can improve their security controls to prevent extension compromise.
Guide
// Read
Looking back on identity-based breaches in 2024
Reviewing public breaches that stemmed from identity attacks in 2024.
Breach analysis
// Read
Product release: December 2024
Here’s what’s new on the Push platform for December 2024.
Release notes
// Read
Automating SSO password resets using Push
Using Push to automate password resets for your most critical identities when a password vulnerability is detected.
Product feature
// Read
Eliminate false positives with verified stolen credential detections using Push
Push now compares user passwords with TI feeds to alert you when valid credentials are available on the clearweb and darkweb.
Product feature
// Read
Snowflake: Looking back on 2024’s landmark security event
165 Snowflake customers were targeted by criminals using stolen credentials from infostealer infections, impacting hundreds of millions of people.
Breach analysis
// Read
Product release: November 2024
Here’s what’s new on the Push platform for November 2024.
Release notes
// Read
Don’t let attackers find the keys to your kingdom in a personal password manager
Make sure sensitive corporate credentials don’t leave your corporate environment and end up in personal password managers with Push.
Product feature
// Read
What we can learn from the recent ServiceNow/Microsoft disclosure
Account takeover on third-party apps is the flavor of the month for security researchers — what can we learn from it?
Breach analysis
// Read
Shifting detection left for more effective threat detection
Why relying on post-compromise detection and response is no longer an option for modern browser-based attacks.
Thought leadership
// Read
The SaaS attack matrix: A year in review
It’s been almost exactly a year since we released our open source repository of SaaS-native attack techniques. Let's reflect on what’s changed.
Threat research
// Read
Hackers don’t hack in, they log in: How to prevent account takeover with Push
How Push stops attackers from using identity attack tools and techniques to compromise your employee user accounts.
Product feature
// Read
What the rise of infostealers says about identity attacks
What the rise in popularity of infostealers tells us about the cybercrime ecosystem and the shift toward identity attacks.
Threat research
// Read
5 reasons why Push Security shouldn’t exist
Breaking down common misconceptions about identity threats and controls like MFA, SSO, passkeys, password managers, and more.
Thought leadership
// Read
Combining the powers of Push and Panther to stop identity attacks
Push is excited to partner with Panther, bringing our unique browser telemetry to your SIEM.
Partnership
// Read
Introducing session token theft detection: Why browser is best
Push's browser agent identifies session token theft by adding telemetry to the user agent string to create a new high-fidelity signal for your security team.
Product feature
// Read
Tracking identity-based attacks in the wild
To help organizations keep track of how browser-based identity attacks are evolving, we've put together this index of recent breaches.
Threat research
// Read
Subscribe to get updates from Push
The latest news, articles, and resources, sent to your inbox.