'%3e%3cpath%20d='M248.027%20159.993C292.176%20159.993%20328.105%20124.1%20328.105%2079.996C328.105%2035.892%20292.191%200%20248.027%200C203.863%200%20167.95%2035.892%20167.95%2079.996C167.949%20124.101%20203.878%20159.993%20248.027%20159.993ZM213.969%2045.973C223.069%2036.882%20235.155%2031.873%20248.027%2031.873C260.899%2031.873%20272.986%2036.882%20282.086%2045.973C291.186%2055.064%20296.2%2067.154%20296.2%2079.997C296.2%2092.84%20291.186%20104.93%20282.086%20114.021C272.986%20123.112%20260.899%20128.12%20248.027%20128.12C235.155%20128.12%20223.069%20123.111%20213.969%20114.021C204.869%20104.93%20199.871%2092.84%20199.871%2079.997C199.871%2067.154%20204.884%2055.063%20213.969%2045.973Z'%20fill='%23EE4323'/%3e%3cpath%20d='M150.16%200L57.6821%20159.993H94.5381L187%200H150.16Z'%20fill='%23EE4323'/%3e%3cpath%20d='M92.478%200L0%20159.993H36.856L129.334%200H92.478Z'%20fill='%23EE4323'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_296_834'%3e%3crect%20width='328.105'%20height='159.993'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e){kind=small}
Browser threat landscape: mid-year update 2026
PhaaS industrialization, Scattered Spider copycats, and AI-augmented tooling — what the threat landscape looks like in 2026 so far.
Thought leadership
// Read
Non-email phishing
52 posts
Non-email phishing delivers malicious links through channels your secure email gateway never sees — social media messages, IM apps like Slack and Teams, search ads, and SMS. Push has intercepted live campaigns arriving via LinkedIn DMs, malvertising, and messaging platforms, which is why it detects phishing pages in the browser at the point of click, regardless of delivery channel.
Why your training budget belongs in real-time browser security
Organizations spend billions annually on awareness training. Here's why browser-based technical controls can make the difference where training falls short.
Thought leadership
// Read
Your EDR is working exactly as intended. Attackers are getting around it anyway.
This article explains the gap between what EDR sees and what happens inside the browser, and what it takes to close it.
Thought leadership
// Read
Why you can't control AI without being in the browser
Why the right browser security tool makes a separate AI visibility and control purchase unnecessary — and how to decide what you actually need.
Thought leadership
// Read
The Pyramid of Pain in the AI era: Why technique-level detection matters more than ever
AI is accelerating the collapse of indicator-based threat detection. Here's why you need technique-level detection to stay ahead.
Thought leadership
// Read
LLMShare: how attackers are turning AI chatbot pages into malware delivery platforms
How attackers are using shared content features on AI chatbot platforms to deliver malware via pages hosted on legitimate domains, sent via malvertising.
Threat research
// Read
Troy Hunt webinar recap: Lessons from 'Yes, you've been pwned' with Troy Hunt
Here are 7 things we learned from our conversation with Troy Hunt on the "Yes, you've been pwned" webinar.
Thought leadership
// Read
What the Verizon DBIR tells us about how breaches happen in 2026
What we can learn from 2026's installment of the Verizon Data Breach Investigations Report.
Thought leadership
// Read
7 things we learned from ‘Why the browser is the new battleground’ with John Hammond
Here are 7 things we learned from our conversation with John Hammond on the "Why the browser is the new battleground" webinar.
Thought leadership
// Read
The top 10 security problems you can solve in the browser — ranked by value
Ranking the security problems you can solve in the browser by security value and browser fit.
Thought leadership
// Read
The CISO's data problem (and how browser telemetry can help)
How CISOs can use browser telemetry to support cyber risk quantification in areas where traditional data points fall short.
Thought leadership
// Read
Introducing the Browser & Identity Attacks Matrix
We're re-releasing the SaaS attack matrix as the Browser & Identity Attacks Matrix. Here's why we've decided to make the change and what it means.
Thought leadership
// Read
We infiltrated a criminal phishing panel: here’s what we found
We got an inside look at a phishing panel used in criminal campaigns linked to operators like ShinyHunters and BlackFile. Here’s what we found.
Threat research
// Read
Device code phishing attacks have skyrocketed: here’s what you need to know
Device code phishing is seeing a huge spike in adoption in 2026, enabling attackers to steal access tokens while bypassing standard access controls.
Threat research
// Read
Attackers are now targeting business TikTok accounts using session-stealing phishing kits
Investigating a new wave of AITM phishing pages designed to hijack TikTok accounts.
Threat research
// Read
InstallFix: How attackers are weaponizing malvertised install guides
Attackers are impersonating popular developer tools like Claude Code to distribute fake install instructions via malicious search engine ads.
Threat research
// Read
Unpacking the latest SLH campaign — combining vishing with AiTM phishing to hijack SSO accounts
Analyzing the latest Scattered Lapsus$ Hunters (SLH) phishing campaign targeting hundreds of organizations.
Threat research
// Read
How cyber criminals power malvertising scams with stolen accounts
Attackers are going out of their way to target Google Ad Manager accounts, powering malvertising scams. Here’s what you need to know.
Threat research
// Read
Google Search malvertising campaign continues, now impersonating Ahrefs
New samples linked to a Push-tracked malvertising campaign detected, targeting Google accounts via an Ahrefs lure.
Threat research
// Read
2025’s top phishing trends — and what they mean for your 2026 security strategy
Analyzing the key trends that defined phishing attacks in 2025, and what these changes mean for security teams heading into 2026.
Thought leadership
// Read
Analysing a sophisticated Google malvertising attack impersonating TradingView
Push recently detected and blocked a malvertising attack impersonating TradingView designed to hijack Google Workspace accounts.
Threat research
// Read
Analysing a malvertising attack targeting business Google accounts intercepted by Push
Analysing a malvertising attack targeting Google business accounts that was intercepted by Push.
Threat research
// Read
The most advanced ClickFix yet?
Breaking down the most sophisticated ClickFix page we’ve seen in the wild — and what it tells us about the future of malicious copy-and-paste attacks.
Threat research
// Read
New phishing campaign identified targeting LinkedIn users
Diving into the latest sophisticated LinkedIn phishing campaign intercepted by Push.
Threat research
// Read
Introducing malicious copy and paste detection
Push now detects malware delivery in the browser, supporting a layered defense against endpoint attacks.
Product feature
// Read
Why attackers are moving beyond email-based phishing
Why phishing attacks are moving away from exclusively email-based delivery, and what this means for security teams.
Thought leadership
// Read
How Push stopped a high risk LinkedIn spear-phishing attack against a company exec
How Push saved a company exec from a sophisticated Attacker-in-the-Middle phishing attack delivered via a LinkedIn direct message.
Threat research
// Read
6 browser-based attacks every security team should be prepared for
What security teams need to know about the browser-based attack techniques that are the leading cause of breaches.
Thought leadership
// Read
How the browser became the main cyber battleground
How attacks have moved away from endpoints and internal networks to the browser — a blind spot for traditional security tools.
Thought leadership
// Read
How attackers are using Active Directory Federation Services to phish with legit office.com links
Push recently identified a novel phishing attack using Active Directory Federation Services to get Microsoft to send victims to a phishing site.
Threat research
// Read
Introducing our guide to phishing detection evasion techniques
Introducing our latest resource for security teams breaking down the techniques that modern phishing attacks are using to evade detection.
Guide
// Read
Introducing Push Detections: Equipping SecOps and IR teams to stop browser-based attacks
We’re launching a new Detections capability, enabling security teams to more effectively investigate and triage alerts, and build more effective workflows.
Product feature
// Read
Scattered Spider: TTP evolution in 2025
How the notorious Scattered Spider cyber criminal group are switching up their TTPs in 2025 to bypass MFA and breach cloud services via account takeover.
Threat research
// Read
Three reasons why browser is best for stopping phishing attacks
Why being in the browser gives defenders a key advantage over network and email phishing prevention, detection, and response tools.
Thought leadership
// Read
Why most phishing attacks feel like a zero-day
Most phishing attacks involve a phishing page that has never been seen before. When detection relies on known-bad, this makes every attack feel like a zero-day.
Thought leadership
// Read
Investigating a recent malvertising campaign targeting Onfido customers
We recently investigated a malvertising campaign using Evilginx to target Onfido customers via Google ads.
Threat research
// Read
How consent phishing is evolving to defeat detection controls
Consent phishing is where attackers trick users into authorizing access for malicious OAuth apps. Here's how attackers are using this technique in the wild.
Threat research
// Read
Why it's time for phishing prevention to move beyond email
Modern MFA-bypass phishing attacks are routinely defeating primarily email-based security controls. Why are controls failing and what can we do about it?
Thought leadership
// Read
Considering the security implications of Computer-Using Agents (like OpenAI Operator)
CUAs are a new type of AI agent that drives your browser/OS for you, enabling effortless automation of web tasks — including those performed by attackers.
Threat research
// Read
How real-world attacks and research drove Push’s most popular features of 2024
How in-the-wild attacks and our own R&D inspired what we built in 2024 to stop account takeover and reduce security risks across your workforce identities.
Product feature
// Read
A new class of phishing: Verification phishing and cross-IdP impersonation
How phishing for email verification can be combined with cross-IdP impersonation to gain direct access to downstream SaaS and bypass hardened IdP accounts.
Threat research
// Read
Detecting and blocking phishing attacks in the browser
How Push detects and blocks phishing attempts in the browser – explained in less than two minutes.
Product feature
// Read
The SaaS attack matrix: A year in review
It’s been almost exactly a year since we released our open source repository of SaaS-native attack techniques. Let's reflect on what’s changed.
Threat research
// Read
Hackers don’t hack in, they log in: How to prevent account takeover with Push
How Push stops attackers from using identity attack tools and techniques to compromise your employee user accounts.
Product feature
// Read
5 reasons why Push Security shouldn’t exist
Breaking down common misconceptions about identity threats and controls like MFA, SSO, passkeys, password managers, and more.
Thought leadership
// Read
Phishing 2.0 – how phishing toolkits are evolving with AitM
Attackers are using Adversary in the Middle (AitM) phishing toolkits to bypass MFA. We look at what AitM is, how it works, and what you can do about it.
Threat research
// Read
Introducing SSO Password Protection: Stop employees’ IdP credentials being exposed or phished
Use the Push browser agent’s unique vantage point to protect SSO credentials by blocking employees from entering their password into any other site.
Product feature
// Read
Phishing Microsoft Teams for initial access
In this article, we will cover a number of spoofing and phishing strategies that can be employed by external attackers to target an organization using Teams.
Threat research
// Read
Slack Attack: A phisher's guide to persistence and lateral movement
In this post, we're going to demonstrate how to phish via Slack to gain persistence and move laterally.
Threat research
// Read
Slack Attack: A phisher's guide to initial access
In this article, we’ll demonstrate how IM apps, specifically Slack, are an increasingly attractive target for a range of phishing & social engineering attacks.
Threat research
// Read
Let’s talk about SaaS attack techniques
Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face.
Threat research
// Read
Embrace SaaS to move faster than your competitors
Look at enabling SaaS from a broader understanding of the business and not just the impact to security
Thought leadership
// Read
Subscribe to get updates from Push
The latest news, articles, and resources, sent to your inbox.