[{"data":1,"prerenderedAt":70384},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":36,"navbar-about-highlight":108,"navbar-resource-highlight":182,"blog-topics":226,"trust-badges":656,"solution-nav":677,"fa-icon-solid-faUserSecret":800,"fa-icon-sharp-regular-faLaptopCode":804,"fa-icon-solid-faPlugCircleXmark":806,"fa-icon-sharp-regular-faPuzzlePiece":808,"fa-icon-solid-faFileCircleXmark":810,"fa-icon-solid-faGhost":813,"fa-icon-solid-faQrcode":816,"fa-icon-solid-faCookieBite":818,"fa-icon-sharp-regular-faFishingRod":820,"fa-icon-sharp-regular-faUserSecret":822,"fa-icon-sharp-regular-faRadar":824,"fa-icon-sharp-regular-faSatelliteDish":826,"fa-icon-sharp-regular-faShieldCheck":828,"fa-icon-sharp-regular-faBrainCircuit":830,"fa-icon-solid-faMobileScreenButton":832,"fa-icon-brands-faChrome":834,"fa-icon-solid-faDisplay":836,"fa-icon-solid-faFilter":838,"fa-icon-solid-faCloudArrowUp":840,"blog-topic-passkeys":842},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"meta":14,"query":22,"data":23,"variations":28,"lastUpdated":29,"firstPublished":30,"testRatio":31,"createdBy":32,"lastUpdatedBy":33,"folders":34,"rev":35},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",{"breakpoints":15,"hasAutosaves":19,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},768,640,320,true,"data","",[],{"link":24,"text":25,"type":26,"url":27},{},"Get our latest report analyzing browser attack techniques in 2026","web-banner","https://pushsecurity.com/resources/browser-attacks-report",{},1774258294825,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],"j7ew2tin4q",{"createdBy":37,"createdDate":38,"data":39,"folders":94,"id":95,"lastUpdated":96,"lastUpdatedBy":97,"meta":98,"modelId":102,"name":103,"published":13,"query":104,"testRatio":31,"variations":105,"firstPublished":106,"stageModifiedSincePublish":6,"rev":107},"ST0tXQM8slWpFrmioqKHmENB2qe2",1774965361051,{"ctaText":40,"text":41,"url":21,"blocks":42,"state":90},"ewrererw","testrfesssssssssss",[43,70,78],{"@type":44,"@version":45,"id":46,"component":47,"responsiveStyles":60},"@builder.io/sdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":48,"tag":48,"options":49,"isRSC":59},"TopBannerContent",{"text":50,"ctaText":51,"url":52,"mainText":53,"cta":56},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https://pushsecurity.com/webinar/state-of-browser-security",{"content":54,"fontSize":55},"\u003Cp class=\"\">Do you know how much AI is in your workforce? Find out August 20th.\u003C/p>","text-base",{"content":57,"fontSize":55,"url":58},"\u003Cp class=\"\">Save your seat →\u003C/p>","https://pushsecurity.com/webinar/shadow-ai",null,{"large":61},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66,"marginTop":67,"marginBottom":67,"fontSize":68,"fontWeight":69},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"@type":44,"@version":45,"id":71,"component":72,"responsiveStyles":76},"builder-a2e1f4b9f30b464bb814d7f5de5b0aa7",{"name":73,"options":74,"isRSC":59},"Custom Code",{"code":75,"scriptsClientOnly":6},"\u003Cstyle>\n  .top-banner.bg-web-orange{background:rgb(114, 79, 255);}\n\u003C/style>\n",{"large":77},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66},{"id":79,"@type":44,"tagName":80,"properties":81,"responsiveStyles":85},"builder-pixel-k74nkzlquog","img",{"src":82,"aria-hidden":83,"alt":21,"role":84,"width":65,"height":65},"https://cdn.builder.io/api/v1/pixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true","presentation",{"large":86},{"height":65,"width":65,"display":87,"opacity":65,"overflow":88,"pointerEvents":89},"block","hidden","none",{"deviceSize":91,"location":92},"large",{"path":21,"query":93},{},[],"fd266d0172cc47429be7ad10f48c99ad",1786155414606,"kYgMv6WsbvfmlOUYqR2SFwGzw6e2",{"breakpoints":99,"hasAutosaves":6,"hasErrors":6,"hasLinks":6,"kind":100,"lastPreviewUrl":101},{"medium":16,"small":17,"xsmall":18},"component","https://pushsecurity.com/?builder.space=f3a1111ff5be48cdbb123cd9f5795a05&builder.user.permissions=read%2Ccreate%2Cpublish%2CeditDesigns%2CeditLayouts%2CeditLayers%2CeditContentPriority%2CeditFolders%2CcreateProjects%2CsendPullRequests%2CfusionHostingPublish&builder.user.role.name=Designer&builder.user.role.id=creator&builder.cachebust=true&builder.preview=always-visible-banner&builder.noCache=true&builder.allowTextEdit=true&__builder_editing__=true&builder.overrides.always-visible-banner=fd266d0172cc47429be7ad10f48c99ad&builder.overrides.fd266d0172cc47429be7ad10f48c99ad=fd266d0172cc47429be7ad10f48c99ad&builder.options.locale=Default","0678d178ec8b41efb8a23c09dba7874d","always visible banner",[],{},1774968080803,"1lcyl36j3gz",[109,145],{"createdBy":32,"createdDate":110,"data":111,"folders":134,"id":135,"lastUpdated":136,"lastUpdatedBy":32,"meta":137,"modelId":139,"name":140,"published":13,"query":141,"stageModifiedSincePublish":6,"testRatio":31,"variations":142,"firstPublished":143,"rev":144},1776247359804,{"link":112,"testimonial":113,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":117},"@builder.io/core:Reference","f028f2b685bb47cd8bf9e82a26dd5a79","testimonial",{"query":118,"folders":119,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":123,"variations":127,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":130,"rev":132},[],[],1735823466309,"We found Push to be more accurate when compared to competitors and the browser agent offered features that others couldn’t match.","42035571a56940ac98bff4544aa79aa5",{"author":124,"jobTitle":125,"quote":121,"image":126},"Jason Waits","\u003Cp>CISO at Inductive Automation\u003C/p>","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07",{},1735910703862,1735823501152,{"kind":20,"lastPreviewUrl":21,"breakpoints":131,"hasAutosaves":19},{"small":17,"medium":16},"xal7chkxmdh","/customer-stories/inductive-automation",[],"9136a8f18b3b4a6ba29b8653a99372b1",1776247404986,{"breakpoints":138,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"20d9eaa352304613b3d1a794b400703d","testimonial-inductive-automation",[],{},1776247404973,"5mqgwlt47hs",{"createdBy":32,"createdDate":146,"data":147,"folders":174,"id":175,"lastUpdated":176,"lastUpdatedBy":32,"meta":177,"modelId":139,"name":172,"published":13,"query":179,"stageModifiedSincePublish":6,"testRatio":31,"variations":180,"firstPublished":181,"rev":144},1776255761419,{"description":148,"image":149,"link":150,"testimonial":153,"title":172,"type":173},"Learn about the latest techniques being used in the wild.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F7b4a5ebf81d64e8c9d7fc35f6c96c4a9",{"text":151,"url":152},"Download now","/resources/browser-attacks-report",{"@type":114,"id":154,"model":116,"value":155},"192acbb1f9ca4cac918c0ec435a8bae3",{"query":156,"folders":157,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":160,"variations":166,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":169,"rev":171},[],[],1728981467463,"Push does for identity what CrowdStrike did for the endpoint",{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},"https://cdn.builder.io/o/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F8b30e8ca50064058bbaef0f3c6164575%2Fcompressed?apiKey=f3a1111ff5be48cdbb123cd9f5795a05&token=8b30e8ca50064058bbaef0f3c6164575&alt=media&optimized=true","\u003Cp>Deputy CISO at Microsoft\u003C/p>\u003Cp>Former LinkedIn, Slack, Palantir\u003C/p>","Geoff Belknap","Push does for identity what CrowdStrike did for the endpoint.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F748f0ad0a5064a00a13f4721fcc8dea1",{},1742902158597,1728981782923,{"kind":20,"lastPreviewUrl":21,"breakpoints":170,"hasAutosaves":19},{"small":17,"medium":16},"kg131t0jkvo","Report: 2026 Browser Attack Techniques","resource",[],"05a9322735fc427db12e2740e4302300",1776255810913,{"breakpoints":178,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},[],{},1776255810900,[183,205],{"createdBy":32,"createdDate":184,"data":185,"folders":195,"id":196,"lastUpdated":197,"lastUpdatedBy":32,"meta":198,"modelId":200,"name":172,"published":13,"query":201,"stageModifiedSincePublish":6,"testRatio":31,"variations":202,"firstPublished":203,"rev":204},1776256900280,{"description":148,"image":149,"link":186,"testimonial":187,"title":172,"type":173},{"text":151,"url":152},{"@type":114,"id":154,"model":116,"value":188},{"query":189,"folders":190,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":191,"variations":192,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":193,"rev":171},[],[],{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":194,"hasAutosaves":19},{"small":17,"medium":16},[],"1f429607996e4e5fae8fe3f9b9610e55",1776256937553,{"breakpoints":199,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"4829faa81e7c4ee8bd2d000e160e8d3c",[],{},1776256937540,"470xio0yv7r",{"createdBy":32,"createdDate":206,"data":207,"folders":217,"id":218,"lastUpdated":219,"lastUpdatedBy":32,"meta":220,"modelId":200,"name":222,"published":13,"query":223,"stageModifiedSincePublish":6,"testRatio":31,"variations":224,"firstPublished":225,"rev":204},1776256949234,{"link":208,"testimonial":209,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":210},{"query":211,"folders":212,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":213,"variations":214,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":215,"rev":132},[],[],{"author":124,"jobTitle":125,"quote":121,"image":126},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":216,"hasAutosaves":19},{"small":17,"medium":16},[],"ce043785b71b4ece98eac811ecf4ba10",1776256974140,{"breakpoints":221,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"inductive-automation",[],{},1776256974130,{"id":227,"extension":228,"items":229,"meta":653,"stem":654,"__hash__":655},"blogTopics/blogtopics.json","json",[230,239,247,256,265,274,283,292,301,310,319,328,337,346,355,363,372,381,390,399,408,417,426,435,443,452,461,470,479,488,497,506,514,523,532,540,549,558,566,575,584,593,602,611,619,628,637,645],{"sys":231,"faqItemsCollection":233,"name":235,"slug":236,"tier":31,"intro":237,"faqTitle":59,"postCount":238,"hasPage":19},{"id":232},"topic-ai",{"items":234},[],"AI","ai","AI is reshaping both sides of the security equation: employees adopt AI tools faster than security teams can track them, while attackers use AI to scale and automate campaigns. Shadow AI adoption may now outpace wider shadow SaaS, and attackers are already turning AI chatbot platforms into malware delivery channels. Push has researched the offensive potential of computer-using agents and now applies AI agents to its own threat hunting. This hub covers AI as risk, target, and defensive tool.",22,{"sys":240,"faqItemsCollection":242,"name":244,"slug":245,"tier":45,"intro":246,"faqTitle":59,"postCount":238,"hasPage":19},{"id":241},"topic-ai-attacks",{"items":243},[],"AI attacks","ai-attacks","AI attacks run in both directions: attackers using AI to scale phishing, malware delivery, and identity attacks, and AI platforms themselves becoming the attack surface. Push has researched how computer-using agents can automate identity attacks, and has seen the poisoned tenant technique it coined used against its own employees in the wild.",{"sys":248,"faqItemsCollection":250,"name":252,"slug":253,"tier":45,"intro":254,"faqTitle":59,"postCount":255,"hasPage":19},{"id":249},"topic-ai-governance",{"items":251},[],"AI governance","ai-governance","AI governance is how organizations set and enforce rules for workplace AI use — which tools are allowed, what data can enter them, and how to evidence it to regulators. With US, EU, and UK AI regulations converging on obligations most organizations can’t yet meet, Push’s research makes the case that enforcement starts in the browser, where AI tools are actually used.",9,{"sys":257,"faqItemsCollection":259,"name":261,"slug":262,"tier":45,"intro":263,"faqTitle":59,"postCount":264,"hasPage":19},{"id":258},"topic-aitm",{"items":260},[],"AiTM phishing","aitm","Adversary-in-the-middle (AiTM) phishing proxies a real login page through an attacker-controlled site, capturing credentials, MFA codes, and session tokens in real time to bypass multi-factor authentication. Push’s research into kits like Evilginx and Sneaky2FA documents how they evade URL- and signature-based detection — and why analyzing toolkit behavior in the browser catches attacks that blocklists miss.",77,{"sys":266,"faqItemsCollection":268,"name":270,"slug":271,"tier":45,"intro":272,"faqTitle":59,"postCount":273,"hasPage":6},{"id":267},"topic-bec",{"items":269},[],"BEC","bec","Business email compromise (BEC) turns a hijacked mailbox into a fraud tool: attackers use mail rules, auto-forwarding, and payment redirection to steal money while staying invisible to the account owner. Alongside a first-hand case study of a BEC attack that nearly cost an engineering firm millions, Push breaks down these mailbox persistence tricks and how to detect them.",3,{"sys":275,"faqItemsCollection":277,"name":279,"slug":280,"tier":31,"intro":281,"faqTitle":59,"postCount":282,"hasPage":19},{"id":276},"topic-browser-attacks",{"items":278},[],"Browser attacks","browser-attacks","Browser attacks target users through the web pages, sessions, and extensions they rely on every day — bypassing endpoint and network defenses that never see inside the browser. Techniques like AiTM phishing kits, ClickFix-style copy-paste attacks, OAuth consent abuse, malvertising, and browser sync abuse have become a leading path to account takeover. Push researchers analyze these attacks in the wild, from infiltrating criminal phishing panels to dissecting toolkits like ConsentFix and Sneaky2FA. Use this hub to track how the techniques evolve and how to defend against them.",118,{"sys":284,"faqItemsCollection":286,"name":288,"slug":289,"tier":45,"intro":290,"faqTitle":59,"postCount":291,"hasPage":19},{"id":285},"topic-browser-extensions",{"items":287},[],"Browser extensions","browser-extensions","Browser extensions cut both ways for security teams: malicious or compromised extensions are a growing attack vector, while an extension is also the lightest-weight way to deploy security controls into the browsers employees already use. These posts cover both sides — extension-borne risks like browser sync attacks and the limits of risk scoring, and how Push uses its extension to detect threats and block risky extensions.",30,{"sys":293,"faqItemsCollection":295,"name":297,"slug":298,"tier":31,"intro":299,"faqTitle":59,"postCount":300,"hasPage":19},{"id":294},"topic-browser-security",{"items":296},[],"Browser security","browser-security","Work now happens in the browser, making browser security — visibility and control at the point where users meet the web — a core layer of enterprise defense. Endpoint, network, and email tools miss attacks that unfold inside the browser session, from AiTM phishing to risky extensions and shadow SaaS. Push has published extensively on choosing between enterprise browsers and browser extensions, using browser telemetry, and making the business case for browser security. Start here for both strategy and hands-on guidance.",127,{"sys":302,"faqItemsCollection":304,"name":306,"slug":307,"tier":45,"intro":308,"faqTitle":59,"postCount":309,"hasPage":19},{"id":303},"topic-casb",{"items":305},[],"CASB","casb","Cloud access security brokers (CASBs) govern cloud app usage through API integrations and network proxies — an approach that works for sanctioned apps but struggles with the long tail of shadow SaaS employees adopt on their own. Because every SaaS signup happens in a browser, Push captures that adoption in real time at the point of login, and these posts cover what proxy-based discovery misses.",12,{"sys":311,"faqItemsCollection":313,"name":315,"slug":316,"tier":45,"intro":317,"faqTitle":59,"postCount":318,"hasPage":19},{"id":312},"topic-clickfix",{"items":314},[],"ClickFix","clickfix","ClickFix attacks trick users into copying and running malicious commands themselves — typically through fake CAPTCHA, error, or fix-it prompts — so malware executes without a download for security tools to scan. Push researchers track the technique’s evolution in the wild and identified the ConsentFix and InstallFix variants, which extend it to OAuth consent grants and fake install guides.",39,{"sys":320,"faqItemsCollection":322,"name":324,"slug":325,"tier":45,"intro":326,"faqTitle":59,"postCount":327,"hasPage":19},{"id":321},"topic-credential-phishing",{"items":323},[],"Credential phishing","credential-phishing","Credential phishing steals usernames and passwords through fake login pages impersonating the services employees use, handing attackers direct access to corporate accounts. Attackers don’t hack in — they log in. Push’s browser extension analyzes login pages as users actually see them, blocking cloned pages and stopping employees from entering company passwords on lookalike sites.",89,{"sys":329,"faqItemsCollection":331,"name":333,"slug":334,"tier":45,"intro":335,"faqTitle":59,"postCount":336,"hasPage":19},{"id":330},"topic-credential-stuffing",{"items":332},[],"Credential stuffing","credential-stuffing","Credential stuffing is an attack where criminals replay username-password pairs stolen from one breach against other services, exploiting password reuse to take over accounts. Major breaches have shown how far a single set of stolen credentials can travel. Push detects verified stolen credentials by comparing employee passwords against breach datasets and dark-web threat intelligence, eliminating false positives.",64,{"sys":338,"faqItemsCollection":340,"name":342,"slug":343,"tier":31,"intro":344,"faqTitle":59,"postCount":345,"hasPage":19},{"id":339},"topic-detection-and-response",{"items":341},[],"Detection & response","detection-and-response","Detection and response is being reshaped as attacks move into the browser, where EDR, SIEM, and network tools have limited visibility. Modern phishing kits evade signature-based detection, and most malicious pages have never been seen before — so technique-level, in-browser detection matters more than known-bad indicators. Push’s work here spans high-fidelity browser telemetry, session token theft detection, and agentic threat hunting, plus practical IR guidance for compromised SaaS accounts and malicious OAuth apps. These posts cover both the philosophy and the workflows.",101,{"sys":347,"faqItemsCollection":349,"name":351,"slug":352,"tier":45,"intro":353,"faqTitle":59,"postCount":354,"hasPage":19},{"id":348},"topic-detection-engineering",{"items":350},[],"Detection engineering","detection-engineering","Detection engineering turns threat research into reliable, high-fidelity detections — and as AI accelerates the churn of attacker infrastructure, indicator-based detection is collapsing in favor of technique-level approaches. Here you’ll find teardowns of AiTM kits, ClickFix pages, and malvertising campaigns, alongside Push’s own account of building an agentic threat hunting pipeline that turns hunts into shipped detections.",42,{"sys":356,"faqItemsCollection":358,"name":360,"slug":361,"tier":45,"intro":362,"faqTitle":59,"postCount":238,"hasPage":19},{"id":357},"topic-device-code-phishing",{"items":359},[],"Device code phishing","device-code-phishing","Device code phishing abuses the OAuth device authorization flow: attackers generate a legitimate sign-in code, trick the victim into entering it on the vendor’s real login page, and walk away with access tokens — no fake site or password capture required. Push research tracked a sharp spike in adoption during 2026 as attackers use the technique to sidestep standard access controls.",{"sys":364,"faqItemsCollection":366,"name":368,"slug":369,"tier":45,"intro":370,"faqTitle":59,"postCount":371,"hasPage":19},{"id":365},"topic-dlp",{"items":367},[],"DLP","dlp","Data loss prevention (DLP) is the practice of stopping sensitive data from leaving your control — a problem that has shifted from email and endpoints to the browser, where employees move data into SaaS and AI tools. Push applies controls at that point of use, from keeping corporate credentials out of personal password managers to governing what flows into unsanctioned apps.",15,{"sys":373,"faqItemsCollection":375,"name":377,"slug":378,"tier":45,"intro":379,"faqTitle":59,"postCount":380,"hasPage":19},{"id":374},"topic-edr",{"items":376},[],"EDR","edr","Endpoint detection and response (EDR) watches processes, files, and memory on the device — a vantage point that never sees the phishing pages, stolen sessions, and identity attacks playing out inside the browser. That’s not an EDR failure; attackers have simply moved where it can’t follow. These posts map that gap and show how Push pairs browser-level detection and response with endpoint security to close it.",24,{"sys":382,"faqItemsCollection":384,"name":386,"slug":387,"tier":45,"intro":388,"faqTitle":59,"postCount":389,"hasPage":19},{"id":383},"topic-enterprise-browser",{"items":385},[],"Enterprise browser","enterprise-browser","An enterprise browser is a standalone, security-hardened browser that organizations deploy in place of Chrome, Edge, or other defaults. The real buying question is whether replacing the browser beats securing the browsers employees already use — a trade-off these posts examine directly, alongside analysis of Omdia’s secure enterprise browser market report and Push’s framework for weighing full browsers against extension-based deployment.",6,{"sys":391,"faqItemsCollection":393,"name":395,"slug":396,"tier":45,"intro":397,"faqTitle":59,"postCount":398,"hasPage":19},{"id":392},"topic-ghost-logins",{"items":394},[],"Ghost logins","ghost-logins","Ghost logins are overlooked authentication routes into an account — like a password login lingering behind SSO, or a forgotten secondary auth method — that attackers exploit for account takeover and persistence. Push coined the term after research showing how these forgotten login paths let attackers sidestep the MFA and SSO controls guarding an account’s primary sign-in method.",48,{"sys":400,"faqItemsCollection":402,"name":404,"slug":405,"tier":45,"intro":406,"faqTitle":59,"postCount":407,"hasPage":19},{"id":401},"topic-identity-attacks",{"items":403},[],"Identity attacks","identity-attacks","Identity attacks target user accounts rather than infrastructure — phishing credentials, stealing sessions, abusing OAuth grants — because logging in is easier than hacking in. Identity-based techniques are now the leading cause of breaches. Push’s offensive research maps these techniques continuously, coining attacks like SAMLjacking and the poisoned tenant before they appeared in the wild.",56,{"sys":409,"faqItemsCollection":411,"name":413,"slug":414,"tier":31,"intro":415,"faqTitle":59,"postCount":416,"hasPage":19},{"id":410},"topic-identity-security",{"items":412},[],"Identity security","identity-security","Identity security is the practice of protecting workforce accounts, credentials, and sessions — the primary route attackers now use to breach organizations. Instead of hacking in, attackers log in: through phished credentials, stolen session tokens, MFA bypass, and forgotten ghost logins. Push’s research team documents these techniques continuously, from cross-IdP impersonation and SAMLjacking to analyses of major identity-driven breaches. This hub collects that research alongside practical guidance on MFA, SSO, and stopping account takeover.",154,{"sys":418,"faqItemsCollection":420,"name":422,"slug":423,"tier":45,"intro":424,"faqTitle":59,"postCount":425,"hasPage":19},{"id":419},"topic-infostealer",{"items":421},[],"Infostealer","infostealer","Infostealers are malware built to harvest saved passwords, cookies, and session tokens from infected devices, supplying the stolen credentials behind some of the most consequential breaches of recent years. Push traces the ecosystem trading this data and checks employee passwords against threat intel feeds, flagging verified stolen credentials before attackers can log in with them.",52,{"sys":427,"faqItemsCollection":429,"name":431,"slug":432,"tier":45,"intro":433,"faqTitle":59,"postCount":434,"hasPage":19},{"id":428},"topic-legitimate-service-abuse",{"items":430},[],"Legitimate service abuse","legitimate-service-abuse","Legitimate service abuse means staging attacks on trusted platforms — Google Ads, AI chatbot share pages, office.com links, Slack, SaaS tenants — so malicious content inherits the reputation of the service hosting it. Push research has documented the pattern repeatedly, from malvertising run through hijacked Google Ad Manager accounts to phishing links generated by Active Directory Federation Services.",28,{"sys":436,"faqItemsCollection":438,"name":440,"slug":441,"tier":45,"intro":442,"faqTitle":59,"postCount":291,"hasPage":19},{"id":437},"topic-malvertising",{"items":439},[],"Malvertising","malvertising","Malvertising uses paid search and display ads to put phishing pages and malware in front of users, often by impersonating trusted brands at the top of Google results. Push tracks these campaigns continuously — intercepting live attacks spoofing well-known brands — and has documented how criminals hijack Google Ads accounts to fund and run them.",{"sys":444,"faqItemsCollection":446,"name":448,"slug":449,"tier":45,"intro":450,"faqTitle":59,"postCount":451,"hasPage":19},{"id":445},"topic-malware-delivery",{"items":447},[],"Malware delivery","malware-delivery","Malware delivery has moved into the browser: rather than email attachments, attackers now rely on malvertising, fake install guides, and ClickFix-style copy-paste lures to get code running on endpoints. Push research on techniques like InstallFix maps the playbook, and in-browser detection of malicious copy and paste blocks these attacks before commands reach the endpoint.",13,{"sys":453,"faqItemsCollection":455,"name":457,"slug":458,"tier":45,"intro":459,"faqTitle":59,"postCount":460,"hasPage":19},{"id":454},"topic-mfa",{"items":456},[],"MFA","mfa","Multi-factor authentication (MFA) requires a second proof of identity beyond a password, and it remains one of the most effective controls against account takeover. Regulators from Cyber Essentials to NYDFS now mandate it across cloud services. Push enforces MFA in the browser on third-party apps — even those with no native enforcement option — and shows security teams where coverage gaps remain.",83,{"sys":462,"faqItemsCollection":464,"name":466,"slug":467,"tier":45,"intro":468,"faqTitle":59,"postCount":469,"hasPage":19},{"id":463},"topic-mfa-bypass",{"items":465},[],"MFA bypass","mfa-bypass","MFA bypass covers the techniques attackers use to defeat multi-factor authentication — AiTM phishing kits, consent phishing, device code phishing, and MFA downgrade attacks among them. None of these break the second factor; they route around it. Push researchers regularly get hands-on with phishing kits like Evilginx and Sneaky2FA, analyzing how these attacks work in the wild and how they evolve.",58,{"sys":471,"faqItemsCollection":473,"name":475,"slug":476,"tier":45,"intro":477,"faqTitle":59,"postCount":478,"hasPage":19},{"id":472},"topic-non-email-phishing",{"items":474},[],"Non-email phishing","non-email-phishing","Non-email phishing delivers malicious links through channels your secure email gateway never sees — social media messages, IM apps like Slack and Teams, search ads, and SMS. Push has intercepted live campaigns arriving via LinkedIn DMs, malvertising, and messaging platforms, which is why it detects phishing pages in the browser at the point of click, regardless of delivery channel.",51,{"sys":480,"faqItemsCollection":482,"name":484,"slug":485,"tier":45,"intro":486,"faqTitle":59,"postCount":487,"hasPage":19},{"id":481},"topic-oauth-abuse",{"items":483},[],"OAuth abuse","oauth-abuse","OAuth abuse is attackers exploiting app-to-app authorization — consent phishing, malicious OAuth apps, stolen tokens, and device code flows — to gain persistent access to cloud tenants without touching a password or MFA prompt. Push tracks these techniques continuously and discovered ConsentFix, a browser-native attack in the wild that pairs OAuth consent phishing with a ClickFix-style prompt.",70,{"sys":489,"faqItemsCollection":491,"name":493,"slug":494,"tier":45,"intro":495,"faqTitle":59,"postCount":496,"hasPage":19},{"id":490},"topic-passkeys",{"items":492},[],"Passkeys","passkeys","Passkeys are phishing-resistant credentials that replace passwords with cryptographic key pairs bound to a user’s device. They defeat conventional credential phishing, but attackers adapt: Push research has documented MFA downgrade, app-specific password phishing, and device code phishing being used in the wild to route around passkey-protected accounts. Deploying passkeys is step one; closing those fallback paths is step two.",21,{"sys":498,"faqItemsCollection":500,"name":502,"slug":503,"tier":45,"intro":504,"faqTitle":59,"postCount":505,"hasPage":19},{"id":499},"topic-password-security",{"items":501},[],"Password security","password-security","Password security is the practice of keeping workforce credentials strong, unique, and out of attackers’ hands — still a frontline defense while most SaaS logins depend on passwords. Expiration policies don’t fix weak or reused passwords; visibility does. Push observes real logins in the browser to flag weak, reused, and breached passwords and guide employees to reset them on any app.",79,{"sys":507,"faqItemsCollection":509,"name":511,"slug":512,"tier":45,"intro":513,"faqTitle":59,"postCount":318,"hasPage":19},{"id":508},"topic-phaas",{"items":510},[],"PhaaS","phaas","Phishing-as-a-service (PhaaS) platforms sell ready-made phishing kits, hosted infrastructure, and management panels on subscription, letting low-skill criminals run MFA-bypassing campaigns at scale. Kits like Evilginx, Tycoon2FA, Sneaky2FA, FlowerStorm, and EvilTokens each add their own evasion and session-theft capabilities, and new entrants appear regularly. Push researchers continuously get hands-on with these tools — investigating attacks in the wild, reverse-engineering kit behavior, and turning that research into detections.",{"sys":515,"faqItemsCollection":517,"name":519,"slug":520,"tier":31,"intro":521,"faqTitle":59,"postCount":522,"hasPage":19},{"id":516},"topic-phishing",{"items":518},[],"Phishing","phishing","Phishing remains the most common way attackers compromise business accounts — and it has moved far beyond suspicious emails. Modern campaigns use AiTM toolkits that bypass MFA, consent phishing against OAuth, device code phishing, and lures delivered through malvertising, LinkedIn, and Slack. Push detects and blocks these attacks in the browser, and its researchers publish teardowns of live campaigns and kits like Evilginx and Sneaky2FA. Read on for how phishing actually works today and what stops it.",91,{"sys":524,"faqItemsCollection":526,"name":528,"slug":529,"tier":45,"intro":530,"faqTitle":59,"postCount":531,"hasPage":19},{"id":525},"topic-public-breach",{"items":527},[],"Public breach","public-breach","Public breaches are the disclosed incidents that show how attacks actually unfold once the headlines fade. Push’s breach analyses keep finding identity at the entry point: stolen credentials, OAuth abuse, and missing MFA recur across the incidents analyzed here.",29,{"sys":533,"faqItemsCollection":535,"name":537,"slug":538,"tier":45,"intro":539,"faqTitle":59,"postCount":451,"hasPage":19},{"id":534},"topic-ransomware",{"items":536},[],"Ransomware","ransomware","Ransomware attacks increasingly begin with an identity, not an exploit: stolen credentials, MFA bypass, and help desk scams give operators their initial foothold. The analysis here follows that front end of the kill chain — how identity compromise leads to ransomware deployment, and the breaches driving regulators toward tighter MFA requirements.",{"sys":541,"faqItemsCollection":543,"name":545,"slug":546,"tier":31,"intro":547,"faqTitle":59,"postCount":548,"hasPage":19},{"id":542},"topic-saas-security",{"items":544},[],"SaaS security","saas-security","SaaS security means protecting the sprawl of cloud apps, accounts, and integrations your employees adopt — often without IT ever knowing. Shadow SaaS, risky OAuth grants, ghost logins, and unmanaged third-party access create attack paths traditional controls can’t see, as recent high-profile breaches have demonstrated. Building on the original SaaS attack matrix, Push continues to map SaaS-native attack techniques alongside practical guides for discovering and securing unsanctioned apps, and this hub gathers all of it.",96,{"sys":550,"faqItemsCollection":552,"name":554,"slug":555,"tier":45,"intro":556,"faqTitle":59,"postCount":557,"hasPage":6},{"id":551},"topic-security-training",{"items":553},[],"Security training","security-training","Security training aims to teach employees to recognize and avoid attacks — yet modern phishing routinely fools even seasoned security professionals. Push argues that training budgets work harder as real-time, in-browser intervention: guardrails and warnings at the moment of risk, rather than lessons employees must recall under pressure.",4,{"sys":559,"faqItemsCollection":561,"name":563,"slug":564,"tier":45,"intro":565,"faqTitle":59,"postCount":389,"hasPage":19},{"id":560},"topic-seo-poisoning",{"items":562},[],"SEO poisoning","seo-poisoning","SEO poisoning manipulates search engine results so malicious pages rank prominently for the software, tools, or services users are actively searching for, turning a routine search into an infection vector. It often pairs with malvertising and ClickFix-style payloads — Push has documented attackers abusing shared pages on legitimate AI chatbot domains to deliver malware from trusted infrastructure.",{"sys":567,"faqItemsCollection":569,"name":571,"slug":572,"tier":45,"intro":573,"faqTitle":59,"postCount":574,"hasPage":19},{"id":568},"topic-session-hijacking",{"items":570},[],"Session hijacking","session-hijacking","Session hijacking is the theft of an authenticated session — usually via stolen session cookies or tokens — letting attackers walk past passwords and MFA into a live account. AiTM phishing kits and infostealers have made it a mainstream attack technique across both criminal and targeted intrusions. Push’s browser agent detects session token theft by adding telemetry to the user agent string, creating a high-fidelity signal for security teams.",74,{"sys":576,"faqItemsCollection":578,"name":580,"slug":581,"tier":45,"intro":582,"faqTitle":59,"postCount":583,"hasPage":19},{"id":577},"topic-shadow-ai",{"items":579},[],"Shadow AI","shadow-ai","Shadow AI is employees’ unsanctioned use of AI tools at work, putting corporate data into chatbots and assistants that security teams never approved and can’t see. Push’s own browser telemetry shows AI adoption acting as a force multiplier for shadow IT — potentially now outscaling shadow SaaS — and this hub tracks that research, real-world breach examples, and practical controls.",20,{"sys":585,"faqItemsCollection":587,"name":589,"slug":590,"tier":45,"intro":591,"faqTitle":59,"postCount":592,"hasPage":19},{"id":586},"topic-shadow-saas",{"items":588},[],"Shadow SaaS","shadow-saas","Shadow SaaS is the cloud applications employees adopt for work without IT approval, each one creating unmanaged accounts, identities, and data outside your security controls. Push covers the problem end to end — from browser-based SaaS discovery to in-browser app banners and MFA enforcement — alongside breach analyses that show where unmanaged accounts lead.",75,{"sys":594,"faqItemsCollection":596,"name":598,"slug":599,"tier":45,"intro":600,"faqTitle":59,"postCount":601,"hasPage":19},{"id":595},"topic-siem",{"items":597},[],"SIEM","siem","A SIEM is only as good as the telemetry feeding it, and most log sources never see what happens inside the browser — where phishing, session token theft, and account takeover actually play out. Push streams browser-level detections and identity telemetry into SIEMs, and these posts show how that data improves detection fidelity and cuts alert fatigue.",19,{"sys":603,"faqItemsCollection":605,"name":607,"slug":608,"tier":45,"intro":609,"faqTitle":59,"postCount":610,"hasPage":19},{"id":604},"topic-social-engineering",{"items":606},[],"Social engineering","social-engineering","Social engineering is the manipulation of people — through phishing pages, help desk impersonation, vishing calls, and poisoned tenant invites — into handing over access that no exploit could take. Coverage here tracks how threat actors run these plays — drawing on Push’s ongoing investigation of live phishing infrastructure and criminal tooling.",59,{"sys":612,"faqItemsCollection":614,"name":616,"slug":617,"tier":31,"intro":618,"faqTitle":59,"postCount":557,"hasPage":6},{"id":613},"topic-supply-chain-security",{"items":615},[],"Supply chain security","supply-chain-security","Supply chain security extends beyond your own perimeter to the vendors, platforms, and browser extensions your organization depends on. A compromised third party can hand attackers legitimate access — as recent campaigns against SaaS providers have shown. Push’s research examines the browser-extension supply chain in particular: why extension risk scores fail to predict compromise, and how developers can harden extensions against takeover. These posts frame supply chain risk through a browser and identity lens.",{"sys":620,"faqItemsCollection":622,"name":624,"slug":625,"tier":45,"intro":626,"faqTitle":59,"postCount":627,"hasPage":19},{"id":621},"topic-swg",{"items":623},[],"SWG","swg","A secure web gateway (SWG) filters and inspects web traffic in transit, sitting in the network path between users and the internet. That position shows you the packet but not the session: Push’s research on AitM phishing kits documents how attackers break the signatures proxies rely on, and these posts explain why phishing detection is moving from the network path into the browser itself.",17,{"sys":629,"faqItemsCollection":631,"name":633,"slug":634,"tier":45,"intro":635,"faqTitle":59,"postCount":636,"hasPage":19},{"id":630},"topic-third-party-risk",{"items":632},[],"Third-party risk","third-party-risk","Third-party risk is the exposure your organization inherits from vendors, SaaS providers, and integrations that hold your data or access your tenants — a chain now extended one employee sign-up at a time. This hub collects Push’s breach analyses and guides for assessing OAuth integrations, managing browser extensions, and responding when a supplier is compromised.",44,{"sys":638,"faqItemsCollection":640,"name":642,"slug":643,"tier":31,"intro":644,"faqTitle":59,"postCount":398,"hasPage":19},{"id":639},"topic-threat-landscape",{"items":641},[],"Threat landscape","threat-landscape","The enterprise threat landscape is now defined by identity attacks: criminals log in with phished, stolen, or stuffed credentials rather than breaking infrastructure. Threat actors keep proving how effective help desk scams, MFA bypass, and session theft are against well-defended organizations. Drawing on breach analyses, annual phishing trend reviews, and in-the-wild campaign tracking, Push documents how attacker TTPs are shifting. This hub is where to follow those changes.",{"sys":646,"faqItemsCollection":648,"name":650,"slug":651,"tier":45,"intro":652,"faqTitle":59,"postCount":371,"hasPage":19},{"id":647},"topic-vishing",{"items":649},[],"Vishing","vishing","Vishing — voice phishing — uses phone calls to impersonate IT support, help desks, or employees, talking targets into password resets, MFA approvals, or opening attacker-controlled pages. Threat actors now routinely pair calls with AiTM phishing to hijack SSO accounts, a chain Push has analyzed across campaigns targeting hundreds of organizations.",{},"blogtopics","w0ITersBlkytyrxHNkTEFmGsSW5X9NfdbmeXV1u8bAo",[657,661,665,669,673],{"title":658,"logo":659,"createdDate":660},"SOC2","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fb6727a5e00004d6e9e69fc3068b8b64c",1784291539953,{"title":662,"logo":663,"createdDate":664},"GDPR","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffe49f53211674deaa5a6640d929cdf42?format=webp",1784291672535,{"title":666,"logo":667,"createdDate":668},"Cyber essentials","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F53558c1045a342a7a28def960cd54ae7?format=webp",1784291702710,{"title":670,"logo":671,"createdDate":672},"ISO IEC 27001","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F578a404a61cf45db951a41fe3554d12d",1784291766222,{"title":674,"logo":675,"createdDate":676},"ISO IEC 27701","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fbe219844b13242fbba531959579a753c",1784291858848,[678,730,775],{"id":679,"label":680,"text":21,"navIcon":681,"items":682},"stop-browser-based-attacks","Stop browser-based attacks","solid:faShieldHalved",[683,688,693,698,703,708,712,717,721,725],{"title":684,"text":685,"url":686,"navIcon":687},"Adversary-in-the-Middle","Detect and block AiTM proxies stealing session tokens.","/solution/stop-browser-based-attacks/adversary-in-the-middle-attacks","solid:faUserSecret",{"title":689,"text":690,"url":691,"navIcon":692},"ClickFix (+Fix variants)","Block attacks that trick users into running malicious code.","/solution/stop-browser-based-attacks/clickfix-fix-variants","sharp-regular:faLaptopCode",{"title":694,"text":695,"url":696,"navIcon":697},"Malicious OAuth integrations","Detect suspicious OAuth consent flows and stop persistent access.","/solution/stop-browser-based-attacks/malicious-oauth-integrations","solid:faPlugCircleXmark",{"title":699,"text":700,"url":701,"navIcon":702},"Malicious browser extensions","Shine a light on risky browser extensions.","/solution/stop-browser-based-attacks/malicious-browser-extensions","sharp-regular:faPuzzlePiece",{"title":704,"text":705,"url":706,"navIcon":707},"Malicious file downloads","Gain visibility into browser downloads and block malicious files.","/solution/stop-browser-based-attacks/malicious-file-downloads","solid:faFileCircleXmark",{"title":395,"text":709,"url":710,"navIcon":711},"Surface hidden login paths that bypass SSO and expose accounts.","/solution/stop-browser-based-attacks/ghost-logins","solid:faGhost",{"title":713,"text":714,"url":715,"navIcon":716},"Mobile phishing (QR & SMS)","Detect phishing links delivered via SMS and QR codes.","/solution/stop-browser-based-attacks/mobile-phishing-qr-code-sms","solid:faQrcode",{"title":333,"text":718,"url":719,"navIcon":720},"Identify reused and compromised credentials across SaaS logins.","/solution/stop-browser-based-attacks/credential-stuffing","custom:credentialStuffing",{"title":571,"text":722,"url":723,"navIcon":724},"Detect and block stolen session tokens before attackers get access.","/solution/stop-browser-based-attacks/session-hijacking","solid:faCookieBite",{"title":726,"text":727,"url":728,"navIcon":729},"Zero-day phishing","Detect phishing TTPs directly in the browser and stop credential theft.","/solution/stop-browser-based-attacks/zero-day-phishing","sharp-regular:faFishingRod",{"id":731,"label":732,"text":21,"navIcon":733,"items":734},"achieve-security-outcomes","Achieve security outcomes","solid:faCheckToSlot",[735,740,745,750,755,760,765,770],{"title":736,"text":737,"url":738,"navIcon":739},"Stop account takeover","Stop ATO with stolen credential and compromised token detection.","/solution/achieve-security-outcomes/stop-account-takeover","sharp-regular:faUserSecret",{"title":741,"text":742,"url":743,"navIcon":744},"Harden unmanaged identities","Harden access paths with visibility, detection, and guardrails.","/solution/achieve-security-outcomes/harden-unmanaged-identities","sharp-regular:faRadar",{"title":746,"text":747,"url":748,"navIcon":749},"Investigate browser-related incidents","Investigate and respond faster with unique browser telemetry.","/solution/achieve-security-outcomes/investigate-browser-related-incidents","sharp-regular:faSatelliteDish",{"title":751,"text":752,"url":753,"navIcon":754},"Secure shadow SaaS","See and control shadow SaaS in the browser.","/solution/achieve-security-outcomes/secure-shadow-saas","sharp-regular:faShieldCheck",{"title":756,"text":757,"url":758,"navIcon":759},"Secure AI","See and control AI apps in the browser.","/solution/achieve-security-outcomes/secure-ai","sharp-regular:faBrainCircuit",{"title":761,"text":762,"url":763,"navIcon":764},"Secure BYOD","Extend consistent browser-based protection to unmanaged devices.","/solution/achieve-security-outcomes/secure-bring-your-own-device","solid:faMobileScreenButton",{"title":766,"text":767,"url":768,"navIcon":769},"Secure Chromebooks","Secure browser activity on Chromebooks without endpoint agents.","/solution/achieve-security-outcomes/secure-chromebooks","brands:faChrome",{"title":771,"text":772,"url":773,"navIcon":774},"Investigate and stop data loss","Detect and prevent data loss across AI tools, apps, and sessions.","/solution/achieve-security-outcomes/investigate-and-stop-data-loss","custom:investigateAndStopDataLoss",{"id":776,"label":777,"text":21,"navIcon":778,"items":779},"tool-replacements","Tool replacements","solid:faScrewdriverWrench",[780,785,790,795],{"title":781,"text":782,"url":783,"navIcon":784},"Remote browser isolation","Detect attacks that look like normal browsing.","/solution/tool-replacements/remote-browser-isolation","solid:faDisplay",{"title":786,"text":787,"url":788,"navIcon":789},"Secure web gateways","Detect attacks inside the browser after SWGs allowed the connection.","/solution/tool-replacements/secure-web-gateways","solid:faFilter",{"title":791,"text":792,"url":793,"navIcon":794},"Cloud access security broker","Catch browser-based identity threats in real time, not after the fact.","/solution/tool-replacements/cloud-access-security-broker","solid:faCloudArrowUp",{"title":796,"text":797,"url":798,"navIcon":799},"Security awareness training","Block real phishing instead of training users on simulations.","/solution/tool-replacements/security-awareness-training","custom:securityAwareness",{"w":801,"h":802,"d":803},448,512,"M171-16c-36.4 0-57.8 58.3-68.3 112L72 96c-13.3 0-24 10.7-24 24s10.7 24 24 24l24 0 0 32c0 17 3.3 33.2 9.3 48l-9.3 0 0 0-20.5 0c-15.2 0-27.5 12.3-27.5 27.5 0 3 .5 5.9 1.4 8.7l28.9 86.6C40.2 379.6 16 428.1 16 482.3 16 498.7 29.3 512 45.7 512l356.6 0c16.4 0 29.7-13.3 29.7-29.7 0-54.2-24.2-102.7-62.3-135.4l28.9-86.6c.9-2.8 1.4-5.7 1.4-8.7 0-15.2-12.3-27.5-27.5-27.5l-20.5 0 0 0-9.3 0c6-14.8 9.3-31 9.3-48l0-32 24 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-30.7 0c-10.4-53.7-31.9-112-68.3-112-9.6 0-19 3.9-27.5 8.2-8.2 4.1-18.4 7.8-25.5 7.8s-17.3-3.7-25.5-7.8C190-12.1 180.6-16 171-16zm93.7 484.4l-24.8-70.9 27.9-32.5c2.7-3.2 4.2-7.2 4.2-11.4 0-9.7-7.8-17.5-17.5-17.5l-61 0c-9.7 0-17.5 7.8-17.5 17.5 0 4.2 1.5 8.2 4.2 11.4l27.9 32.5-24.8 70.9-57-180.4 35.7 0c18.4 10.2 39.5 16 62 16s43.6-5.8 62-16l35.7 0-57 180.4zM224 256c-34.7 0-64.2-22.1-75.3-53 5.7 3.2 12.3 5 19.3 5l12.4 0c16.5 0 31.1-10.6 36.3-26.2 2.3-7 12.2-7 14.5 0 5.2 15.6 19.9 26.2 36.3 26.2l12.4 0c7 0 13.6-1.8 19.3-5-11.1 30.9-40.6 53-75.3 53z",{"w":17,"h":802,"d":805},"M112 80l416 0 0 224 48 0 0-272-512 0 0 272 48 0 0-224zM48 404.1l0-4.1 544 0 0 4.1-27.9 27.9-488.2 0-27.9-27.9zM592 352l-592 0 0 72 56 56 528 0 56-56 0-72-48 0zM281 169l17-17-33.9-33.9c-6.1 6.1-27.8 27.8-65 65l-17 17c6.1 6.1 27.8 27.8 65 65l17 17 33.9-33.9c-9-9-25-25-48-48l31-31zM393 135l-17-17-33.9 33.9c9 9 25 25 48 48-23 23-39 39-48 48L376 281.9c6.1-6.1 27.8-27.8 65-65l17-17c-6.1-6.1-27.8-27.8-65-65z",{"w":17,"h":802,"d":807},"M192-32c17.7 0 32 14.3 32 32l0 96 128 0 0-96c0-17.7 14.3-32 32-32s32 14.3 32 32l0 96 64 0c17.7 0 32 14.3 32 32s-14.3 32-32 32l0 48.7c-98.6 8.1-176 90.7-176 191.3 0 27.3 5.7 53.3 16 76.9l0 3.1c0 17.7-14.3 32-32 32s-32-14.3-32-32l0-66.7C165.2 398.1 96 319.1 96 224l0-64c-17.7 0-32-14.3-32-32S78.3 96 96 96l64 0 0-96c0-17.7 14.3-32 32-32zM496 256a144 144 0 1 1 0 288 144 144 0 1 1 0-288zm59.3 107.3c6.2-6.2 6.2-16.4 0-22.6s-16.4-6.2-22.6 0l-36.7 36.7-36.7-36.7c-6.2-6.2-16.4-6.2-22.6 0s-6.2 16.4 0 22.6l36.7 36.7-36.7 36.7c-6.2 6.2-6.2 16.4 0 22.6s16.4 6.2 22.6 0l36.7-36.7 36.7 36.7c6.2 6.2 16.4 6.2 22.6 0s6.2-16.4 0-22.6l-36.7-36.7 36.7-36.7z",{"w":802,"h":802,"d":809},"M201.1 57.3c-7 5.3-9.1 10.7-9.1 14.7 0 4.5 2.8 11.2 12.4 16.9l11.6 7 0 48.1-168 0 0 60.5c7.4-2.9 15.5-4.5 24-4.5 43.1 0 72 39.4 72 80s-28.9 80-72 80c-8.5 0-16.6-1.6-24-4.5l0 108.5 108.5 0c-2.9-7.4-4.5-15.5-4.5-24 0-43.1 39.4-72 80-72s80 28.9 80 72c0 8.5-1.6 16.6-4.5 24l60.5 0 0-168 48.1 0 7 11.6c5.8 9.6 12.4 12.4 16.9 12.4 4 0 9.5-2.1 14.7-9.1s9.3-17.9 9.3-30.9-4-23.8-9.3-30.9-10.7-9.1-14.7-9.1c-4.5 0-11.2 2.8-16.9 12.4l-7 11.6-48.1 0 0-120-120 0 0-48.1 11.6-7c9.6-5.8 12.4-12.4 12.4-16.9 0-4-2.1-9.5-9.1-14.7S245 48 232 48 208.2 52 201.1 57.3zM172.3 18.9C188.5 6.8 209.6 0 232 0S275.5 6.8 291.7 18.9 320 49.5 320 72c0 8.6-1.8 16.7-4.9 24l100.9 0 0 100.9c7.3-3.1 15.4-4.9 24-4.9 22.5 0 41 12.2 53.1 28.3s18.9 37.3 18.9 59.7-6.8 43.5-18.9 59.7-30.6 28.3-53.1 28.3c-8.6 0-16.7-1.8-24-4.9l0 148.9-168 0 0-49.3 8.2-7.2c5.4-4.7 7.8-10.3 7.8-15.5 0-9.9-10.7-24-32-24s-32 14.1-32 24c0 5.3 2.4 10.8 7.8 15.5l8.2 7.2 0 49.3-216 0 0-216 49.3 0 7.2 8.2c4.7 5.4 10.3 7.8 15.5 7.8 9.9 0 24-10.7 24-32s-14.1-32-24-32c-5.3 0-10.8 2.4-15.5 7.8L49.3 264 0 264 0 96 148.9 96c-3.1-7.3-4.9-15.4-4.9-24 0-22.5 12.2-41 28.3-53.1z",{"w":811,"h":802,"d":812},576,"M96 0C60.7 0 32 28.7 32 64l0 384c0 35.3 28.7 64 64 64l180 0c-22.7-31.5-36-70.2-36-112 0-100.6 77.4-183.2 176-191.3l0-38.1c0-17-6.7-33.3-18.7-45.3L290.7 18.7C278.7 6.7 262.5 0 245.5 0L96 0zM357.5 176L264 176c-13.3 0-24-10.7-24-24L240 58.5 357.5 176zM432 544a144 144 0 1 0 0-288 144 144 0 1 0 0 288zm59.3-180.7l-36.7 36.7 36.7 36.7c6.2 6.2 6.2 16.4 0 22.6s-16.4 6.2-22.6 0l-36.7-36.7-36.7 36.7c-6.2 6.2-16.4 6.2-22.6 0s-6.2-16.4 0-22.6l36.7-36.7-36.7-36.7c-6.2-6.2-6.2-16.4 0-22.6s16.4-6.2 22.6 0l36.7 36.7 36.7-36.7c6.2-6.2 16.4-6.2 22.6 0s6.2 16.4 0 22.6z",{"w":814,"h":802,"d":815},384,"M40.1 467.1l-11.2 9C25.7 478.6 21.8 480 17.8 480 8 480 0 472 0 462.2L0 192C0 86 86 0 192 0S384 86 384 192l0 270.2c0 9.8-8 17.8-17.8 17.8-4 0-7.9-1.4-11.1-3.9l-11.2-9c-13.4-10.7-32.8-9-44.1 3.9L269.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6l-26.6-30.5c-12.7-14.6-35.4-14.6-48.2 0L141.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6L84.2 471c-11.3-12.9-30.7-14.6-44.1-3.9zM160 192a32 32 0 1 0 -64 0 32 32 0 1 0 64 0zm96 32a32 32 0 1 0 0-64 32 32 0 1 0 0 64z",{"w":801,"h":802,"d":817},"M64 160l64 0 0-64-64 0 0 64zM0 80C0 53.5 21.5 32 48 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48L0 80zM64 416l64 0 0-64-64 0 0 64zM0 336c0-26.5 21.5-48 48-48l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96zM320 96l0 64 64 0 0-64-64 0zM304 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96c0-26.5 21.5-48 48-48zM288 352a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm0 64c17.7 0 32 14.3 32 32s-14.3 32-32 32-32-14.3-32-32 14.3-32 32-32zm96 32c0-17.7 14.3-32 32-32s32 14.3 32 32-14.3 32-32 32-32-14.3-32-32zm32-96a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm-32 32a32 32 0 1 1 -64 0 32 32 0 1 1 64 0z",{"w":802,"h":802,"d":819},"M257.5 27.6c-.8-5.4-4.9-9.8-10.3-10.6-22.1-3.1-44.6 .9-64.4 11.4l-74 39.5C89.1 78.4 73.2 94.9 63.4 115L26.7 190.6c-9.8 20.1-13 42.9-9.1 64.9l14.5 82.8c3.9 22.1 14.6 42.3 30.7 57.9l60.3 58.4c16.1 15.6 36.6 25.6 58.7 28.7l83 11.7c22.1 3.1 44.6-.9 64.4-11.4l74-39.5c19.7-10.5 35.6-27 45.4-47.2l36.7-75.5c9.8-20.1 13-42.9 9.1-64.9-.9-5.3-5.3-9.3-10.6-10.1-51.5-8.2-92.8-47.1-104.5-97.4-1.8-7.6-8-13.4-15.7-14.6-54.6-8.7-97.7-52-106.2-106.8zM208 144a32 32 0 1 1 0 64 32 32 0 1 1 0-64zM144 336a32 32 0 1 1 64 0 32 32 0 1 1 -64 0zm224-64a32 32 0 1 1 0 64 32 32 0 1 1 0-64z",{"w":801,"h":802,"d":821},"M284.6 0l91.4 0 0 160-48 0 0-112-36.6 0-203.4 58.1 0 181.9 40 0 0 224-128 0 0-224 40 0 0-218.1 17.4-5 224-64 3.2-.9zM80 336l-32 0 0 128 32 0 0-128zm176 8c0-76.8 64-136 96-152 32 16 96 75.2 96 152 0 32-16 80-64 112l32 40 0 16-128 0 0-16 32-40c-48-32-64-80-64-112zm128-32a24 24 0 1 0 -48 0 24 24 0 1 0 48 0z",{"w":801,"h":802,"d":823},"M144-16l-48 112-48 0 0 48 48 0 0 32c0 17 3.3 33.2 9.3 48l-73.3 0 0 32 5.3 16 26.7 80-64 160 51.7 0 56.9-142.2 6.5-16.3c-1-3.1-10.1-30.3-27.2-81.5l51.4 0c22.6 19.9 52.2 32 84.7 32s62.1-12.1 84.7-32l51.4 0c-17.1 51.2-26.1 78.4-27.2 81.5l6.5 16.3 56.9 142.2 51.7 0-64-160 26.7-80 5.3-16 0-32-73.3 0c6-14.8 9.3-31 9.3-48l0-32 48 0 0-48-48 0-48-112-32 0-48 32-48-32-32 0zm80 272c-32.8 0-61-19.7-73.3-48l57.3 0 16-40 16 40 57.3 0c-12.3 28.3-40.5 48-73.3 48zm17.5 139.6l30.5-35.6 0-24-96 0 0 24 30.5 35.6-46.5 116.4 128 0-46.5-116.4z",{"w":802,"h":802,"d":825},"M497.4 49l17-17-33.9-33.9C473.6 4.9 453.3 25.2 419.7 58.8 375.4 22.1 318.5 0 256.4 0 115.1 0 .4 114.6 .4 256s114.6 256 256 256 256-114.6 256-256l-48 0c0 114.9-93.1 208-208 208s-208-93.1-208-208 93.1-208 208-208c48.8 0 93.7 16.8 129.1 44.9l-45.7 45.7c-23.5-16.8-52.3-26.6-83.4-26.6-79.5 0-144 64.5-144 144s64.5 144 144 144 144-64.5 144-144l-48 0c0 53-43 96-96 96s-96-43-96-96 43-96 96-96c17.8 0 34.5 4.8 48.8 13.3-52 52-79.5 79.5-82.7 82.7l33.9 33.9 17-17 224-224z",{"w":802,"h":802,"d":827},"M208 0l24 0C386.6 0 512 125.4 512 280l0 24-48 0 0-24C464 151.9 360.1 48 232 48l-24 0 0-48zm24 96c101.6 0 184 82.4 184 184l0 24-48 0 0-24c0-75.1-60.9-136-136-136l-24 0 0-48 24 0zM48 256c0 114.9 93.1 208 208 208 22.9 0 45-3.7 65.6-10.5l-263-263C51.7 211 48 233.1 48 256zM0 256c0-36.5 7.6-71.3 21.4-102.7 6.7-15.3 14.9-29.9 24.4-43.5 7.7 7.7 61.5 61.5 161.2 161.2 30.5-30.5 49.5-49.5 57-57L297.9 248c-7.5 7.5-26.5 26.5-57 57 99.7 99.7 153.5 153.5 161.2 161.2-13.6 9.5-28.2 17.7-43.5 24.4-31.4 13.8-66.2 21.4-102.7 21.4-141.4 0-256-114.6-256-256z",{"w":802,"h":802,"d":829},"M267.6 4.5l207.5 80.5 19.2 7.4 1.2 20.5c2.9 50-4.9 126.3-37.3 200.9-32.7 75.2-91.1 150-189.4 192.5l-12.7 5.5-12.7-5.5C144.9 463.9 86.6 389.2 53.9 313.9 21.5 239.3 13.7 162.9 16.6 113L17.8 92.5 37 85 244.5 4.5 256 0 267.6 4.5zM64.1 126C63.1 169.5 71 232.9 97.9 294.8 126.1 359.7 175 422.4 256 459.6 337.1 422.4 385.9 359.7 414.2 294.8 441 232.9 449 169.5 448 126L256 51.5 64.1 126zm302.3 44.7L352.3 190.1 249.8 330.9 233 354c-8.8-9.1-30.9-32-66.2-68.6l-16.7-17.3 34.5-33.3c9.5 9.8 23.9 24.7 43.2 44.7l85.6-117.7 14.1-19.4 38.8 28.2z",{"w":802,"h":802,"d":831},"M192 48l40 0 0 108-12.4 0c-7.6-16.5-24.3-28-43.6-28-26.5 0-48 21.5-48 48s21.5 48 48 48c19.4 0 36.1-11.5 43.6-28l12.4 0 0 56-92 0 0 56.4c-16.5 7.6-28 24.3-28 43.6 0 26.5 21.5 48 48 48s48-21.5 48-48c0-19.4-11.5-36.1-28-43.6l0-16.4 52 0 0 172-40 0c-16.8 0-31.2-10.3-37.1-25.1l-6.4-16-17.2 1c-1.1 .1-2.2 .1-3.2 .1-30.9 0-56-25.1-56-56 0-9.5 2.4-18.5 6.5-26.3l8.7-16.2-13.4-12.6c-11-10.2-17.8-24.8-17.8-40.9 0-21.6 12.2-40.4 30.3-49.8l22.6-11.7-13.1-21.9c-5-8.4-7.9-18.1-7.9-28.6 0-30.9 25.1-56 56-56l24 0 0-32c0-13.3 10.7-24 24-24zm88 148l12.4 0c7.6 16.5 24.3 28 43.6 28 26.5 0 48-21.5 48-48s-21.5-48-48-48c-19.4 0-36.1 11.5-43.6 28l-12.4 0 0-108 40 0c13.3 0 24 10.7 24 24l0 32 24 0c30.9 0 56 25.1 56 56 0 10.5-2.9 20.3-7.9 28.6l-13.1 21.9 22.6 11.7c18 9.3 30.3 28.1 30.3 49.8 0 16.1-6.8 30.7-17.8 40.9l-13.4 12.6 8.7 16.2c4.2 7.8 6.5 16.7 6.5 26.3 0 30.9-25.1 56-56 56-1.1 0-2.2 0-3.2-.1l-17.2-1-6.4 16C351.2 453.7 336.8 464 320 464l-40 0 0-76 92 0 0-56.4c16.5-7.6 28-24.3 28-43.6 0-26.5-21.5-48-48-48s-48 21.5-48 48c0 19.4 11.5 36.1 28 43.6l0 16.4-52 0 0-152zM192 512l128 0c31.1 0 58.4-16.2 74.1-40.5 52.7-5.1 93.9-49.5 93.9-103.5 0-11.5-1.9-22.5-5.3-32.9 13.4-17.5 21.3-39.4 21.3-63.1 0-32-14.5-60.6-37.1-79.7 3.3-10.2 5.1-21.1 5.1-32.3 0-49.6-34.8-91.1-81.3-101.5-6.3-33.3-35.6-58.5-70.7-58.5L192 0c-35.1 0-64.4 25.2-70.7 58.5-46.5 10.4-81.3 51.9-81.3 101.5 0 11.3 1.8 22.2 5.1 32.3-22.7 19.1-37.1 47.7-37.1 79.7 0 23.7 8 45.6 21.3 63.1-3.5 10.4-5.3 21.4-5.3 32.9 0 54 41.2 98.5 93.9 103.5 15.6 24.3 42.9 40.5 74.1 40.5zM336 192a16 16 0 1 1 0-32 16 16 0 1 1 0 32zm32 96a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zM176 352a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zm16-176a16 16 0 1 1 -32 0 16 16 0 1 1 32 0z",{"w":814,"h":802,"d":833},"M16 64C16 28.7 44.7 0 80 0L304 0c35.3 0 64 28.7 64 64l0 384c0 35.3-28.7 64-64 64L80 512c-35.3 0-64-28.7-64-64L16 64zm64 0l0 304 224 0 0-304-224 0zM192 472c17.7 0 32-14.3 32-32s-14.3-32-32-32-32 14.3-32 32 14.3 32 32 32z",{"w":802,"h":802,"d":835},"M0 256c0-46.6 12.5-90.4 34.3-128.9L144.1 318.3c21.9 39.2 63.8 65.7 111.9 65.7 14.3 0 27.1-2.3 40.8-6.6L220.5 509.6C95.9 492.3 0 385.3 0 256zm365.1 65.6c12.3-19.2 18.9-42.5 18.9-65.6 0-38.2-16.8-72.5-43.3-96l152.7 0c12 29.6 18.6 62.1 18.6 96 0 141.4-114.6 255.1-256 256L365.1 321.6zM477.8 128L256 128c-62.9 0-113.7 44.1-125.5 102.7L54.2 98.5C101 38.5 174 0 256 0 350.8 0 433.5 51.5 477.8 128zM344 256a88 88 0 1 1 -176 0 88 88 0 1 1 176 0z",{"w":802,"h":802,"d":837},"M448 96l0 256-384 0 0-256 384 0zM64 32C28.7 32 0 60.7 0 96L0 352c0 35.3 28.7 64 64 64l144 0-16 48-72 0c-13.3 0-24 10.7-24 24s10.7 24 24 24l272 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-72 0-16-48 144 0c35.3 0 64-28.7 64-64l0-256c0-35.3-28.7-64-64-64L64 32z",{"w":802,"h":802,"d":839},"M32 64C19.1 64 7.4 71.8 2.4 83.8S.2 109.5 9.4 118.6L192 301.3 192 416c0 8.5 3.4 16.6 9.4 22.6l64 64c9.2 9.2 22.9 11.9 34.9 6.9S320 492.9 320 480l0-178.7 182.6-182.6c9.2-9.2 11.9-22.9 6.9-34.9S492.9 64 480 64L32 64z",{"w":811,"h":802,"d":841},"M144 480c-79.5 0-144-64.5-144-144 0-63.4 41-117.2 97.9-136.5-1.3-7.7-1.9-15.5-1.9-23.5 0-79.5 64.5-144 144-144 55.4 0 103.5 31.3 127.6 77.1 14.2-8.3 30.8-13.1 48.4-13.1 53 0 96 43 96 96 0 15.7-3.8 30.6-10.5 43.7 44 20.3 74.5 64.7 74.5 116.3 0 70.7-57.3 128-128 128l-304 0zM305 191c-9.4-9.4-24.6-9.4-33.9 0l-72 72c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l31-31 0 102.1c0 13.3 10.7 24 24 24s24-10.7 24-24l0-102.1 31 31c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-72-72z",[843,6433,11816,17292,20970,24249,27261,29872,32731,35454,38042,40080,42351,45933,48859,52209,54721,56954,60154,63692,69548],{"id":844,"title":845,"authorsCollection":846,"content":854,"extension":228,"faqItemsCollection":1476,"faqTitle":59,"featured":6,"hashTags":59,"meta":1478,"metaTitle":1479,"ogImage":59,"postType":1480,"publishedDate":1481,"relatedBlogPostsCollection":1482,"slug":6362,"stem":6363,"subtitle":59,"summary":6364,"synopsis":6375,"sys":6376,"tagsCollection":6379,"topicsCollection":6386,"__hash__":6432},"blog/blog/7-things-we-learned-from-john-hammond.json","7 things we learned from ‘Why the browser is the new battleground’ with John Hammond",{"items":847},[848],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":852},"Daniel Park","Daniel","Technical Content",{"url":853},"https://images.ctfassets.net/y1cdw1ablpvd/6Cwg1xVeCdzUvxBIMfnDO5/6b18ed126b53611e7b521da34f900d29/254-0-2.jpg",{"json":855,"links":1464},{"data":856,"content":857,"nodeType":1463},{},[858,882,891,895,905,960,971,974,982,1001,1008,1033,1052,1055,1063,1082,1089,1096,1106,1109,1117,1149,1167,1170,1178,1197,1204,1211,1214,1222,1241,1248,1266,1276,1283,1286,1294,1311,1318,1325,1337,1347,1366,1369,1377,1384,1432],{"data":859,"content":860,"nodeType":881},{},[861,866,877],{"data":862,"marks":863,"value":864,"nodeType":865},{},[],"We recently sat down with ","text",{"data":867,"content":869,"nodeType":876},{"uri":868},"https://www.youtube.com/@_JohnHammond",[870],{"data":871,"marks":872,"value":875,"nodeType":865},{},[873],{"type":874},"underline","John Hammond","hyperlink",{"data":878,"marks":879,"value":880,"nodeType":865},{},[]," — Senior Principal Security Researcher at Huntress — for a live deep-dive into the browser-based attack techniques defining the 2026 threat landscape. The session covered AiTM phishing, ClickFix, ConsentFix, device code phishing, and the structural shifts making traditional security controls less effective against all of them. Here are seven takeaways.","paragraph",{"data":883,"content":889,"nodeType":890},{"target":884},{"sys":885},{"id":886,"type":887,"linkType":888},"5lJ49aLY0nApDeY69tNvUi","Link","Entry",[],"embedded-entry-block",{"data":892,"content":893,"nodeType":894},{},[],"hr",{"data":896,"content":897,"nodeType":904},{},[898],{"data":899,"marks":900,"value":903,"nodeType":865},{},[901],{"type":902},"bold","1. Browser attacks are evolving faster than defenses can adapt","heading-1",{"data":906,"content":907,"nodeType":881},{},[908,912,920,924,932,936,944,948,956],{"data":909,"marks":910,"value":911,"nodeType":865},{},[],"The overriding theme of the session wasn't any single technique — it was the pace of change across all of them. AiTM phishing has been ",{"data":913,"content":915,"nodeType":876},{"uri":914},"https://pushsecurity.com/blog/2025-top-phishing-trends/",[916],{"data":917,"marks":918,"value":919,"nodeType":865},{},[],"the dominant phishing technique",{"data":921,"marks":922,"value":923,"nodeType":865},{},[]," for a couple of years now, but the variants layered on top of it are arriving faster than most security teams can evaluate, let alone deploy defenses against. ClickFix went from novel to ",{"data":925,"content":927,"nodeType":876},{"uri":926},"https://pushsecurity.com/blog/introducing-the-browser-and-identity-attacks-matrix/",[928],{"data":929,"marks":930,"value":931,"nodeType":865},{},[],"the most common initial access vector observed by Microsoft",{"data":933,"marks":934,"value":935,"nodeType":865},{},[]," within about a year. Device code phishing went from near-zero to ",{"data":937,"content":939,"nodeType":876},{"uri":938},"https://pushsecurity.com/blog/device-code-phishing/",[940],{"data":941,"marks":942,"value":943,"nodeType":865},{},[],"at least 12 distinct kits",{"data":945,"marks":946,"value":947,"nodeType":865},{},[]," in a matter of months. ConsentFix was detected as a zero-day technique by Push in late 2025 and has already been ",{"data":949,"content":951,"nodeType":876},{"uri":950},"https://pushsecurity.com/blog/consentfix-v3-analyzing-a-new-toolkit/",[952],{"data":953,"marks":954,"value":955,"nodeType":865},{},[],"operationalized on criminal forums",{"data":957,"marks":958,"value":959,"nodeType":865},{},[],".",{"data":961,"content":962,"nodeType":970},{},[963],{"data":964,"content":965,"nodeType":881},{},[966],{"data":967,"marks":968,"value":969,"nodeType":865},{},[],"As Luke put it toward the end of the session: \"I've seen this develop so fast over the last two years. This isn't what's coming — this is now. This is where the battleground is.\"","blockquote",{"data":972,"content":973,"nodeType":894},{},[],{"data":975,"content":976,"nodeType":904},{},[977],{"data":978,"marks":979,"value":981,"nodeType":865},{},[980],{"type":902},"2. AiTM phishing is table stakes for attackers ",{"data":983,"content":984,"nodeType":881},{},[985,989,997],{"data":986,"marks":987,"value":988,"nodeType":865},{},[],"Adversary-in-the-middle phishing — where a reverse proxy sits between the victim and the real login page, intercepting session tokens in real time to bypass MFA — is no longer an advanced technique. It's available as a commodity for-hire through Phishing-as-a-Service platforms like Tycoon2FA, Sneaky2FA, and others",{"data":990,"content":991,"nodeType":876},{"uri":914},[992],{"data":993,"marks":994,"value":996,"nodeType":865},{},[995],{"type":874},",",{"data":998,"marks":999,"value":1000,"nodeType":865},{},[]," and the kits are getting harder to detect through traditional means.",{"data":1002,"content":1003,"nodeType":881},{},[1004],{"data":1005,"marks":1006,"value":1007,"nodeType":865},{},[],"Luke demoed the attacker's perspective using Evilginx — an open-source tool now commonly seen in criminal operations — showing how session tokens are captured in real time even when the victim enters their MFA code correctly. From the victim's side, the login feels completely normal.",{"data":1009,"content":1010,"nodeType":881},{},[1011,1016,1020,1029],{"data":1012,"marks":1013,"value":1015,"nodeType":865},{},[1014],{"type":902},"One of the key focuses in the session was how attackers are abusing legitimate infrastructure for both hosting and delivery of phishing pages. .",{"data":1017,"marks":1018,"value":1019,"nodeType":865},{},[]," The in-the-wild examples showed attack chains routing through multiple legitimate services — file-sharing platforms, TinyURL, Cloudflare Turnstile, Google Search redirects — before finally landing on the phishing page. This is a well established technique for ",{"data":1021,"content":1023,"nodeType":876},{"uri":1022},"https://phishing-techniques.pushsecurity.com/",[1024],{"data":1025,"marks":1026,"value":1028,"nodeType":865},{},[1027],{"type":874},"detection evasion",{"data":1030,"marks":1031,"value":1032,"nodeType":865},{},[],". ",{"data":1034,"content":1035,"nodeType":881},{},[1036,1040,1048],{"data":1037,"marks":1038,"value":1039,"nodeType":865},{},[],"As John observed, \"the end user doesn't have that wherewithal or that observability understanding of how far they drove around across the internet\" before arriving at the credential-harvesting page. Push reconstructs these multi-hop chains into a ",{"data":1041,"content":1043,"nodeType":876},{"uri":1042},"https://pushsecurity.com/blog/guide-how-to-use-push-controls-to-protect-your-users-from-modern-attacks/",[1044],{"data":1045,"marks":1046,"value":1047,"nodeType":865},{},[],"complete timeline",{"data":1049,"marks":1050,"value":1051,"nodeType":865},{},[],", mapping the full redirect sequence even when individual hops are through trusted domains that wouldn't trigger any reputation-based alert — and crucially, detects malicious content on the phishing page itself rather than relying on known-bad IP and domain based checks that can only see the known-good sites used early in the chain.",{"data":1053,"content":1054,"nodeType":894},{},[],{"data":1056,"content":1057,"nodeType":904},{},[1058],{"data":1059,"marks":1060,"value":1062,"nodeType":865},{},[1061],{"type":902},"3. Email is losing its market share as a delivery vector",{"data":1064,"content":1065,"nodeType":881},{},[1066,1070,1078],{"data":1067,"marks":1068,"value":1069,"nodeType":865},{},[],"One of the most striking examples in the webinar was a targeted AiTM campaign ",{"data":1071,"content":1073,"nodeType":876},{"uri":1072},"https://pushsecurity.com/blog/new-phishing-campaign-identified-targeting-linkedin-users/",[1074],{"data":1075,"marks":1076,"value":1077,"nodeType":865},{},[],"Push detected last year",{"data":1079,"marks":1080,"value":1081,"nodeType":865},{},[]," that was delivered entirely via LinkedIn. Senior executives at tech companies received direct messages from compromised contacts — people they already knew, in some cases other employees of the same companies — offering involvement in private equity fundraising rounds connected to companies they had real involvement with. The targeting was precise and personal, and the redirect chain ran through sites.google.com and Microsoft Dynamics before landing on a cloned login page.",{"data":1083,"content":1084,"nodeType":881},{},[1085],{"data":1086,"marks":1087,"value":1088,"nodeType":865},{},[],"As Luke noted, LinkedIn occupies an unusual middle ground: \"It's this great way of targeting companies, but through a vector that can't really be monitored in the same way as other corporate systems, because it's kind of a personal platform.\" It's personal enough that companies can't realistically monitor it, but professional enough that employees routinely access it from corporate devices.",{"data":1090,"content":1091,"nodeType":881},{},[1092],{"data":1093,"marks":1094,"value":1095,"nodeType":865},{},[],"LinkedIn is only part of the shift. ClickFix attacks most commonly arrive via search results in 4 of 5 cases based on Push data. Luke noted \"not even malvertising, just organic search, uncovering legit websites that have been compromised.\" InstallFix pages appear as sponsored Google ads. ConsentFix pages were seeded on compromised websites found through normal browsing. In every case, the email gateway never sees the lure because the lure was never in an email. And of course, even if a compromised website is reported and removed, it’s easier than ever for an attacker to quickly tear down and rotate their sites to stay ahead of blocklists. ",{"data":1097,"content":1098,"nodeType":970},{},[1099],{"data":1100,"content":1101,"nodeType":881},{},[1102],{"data":1103,"marks":1104,"value":1105,"nodeType":865},{},[],"As John put it: \"You could set up this lure or this trap out on the open internet so that anyone could fall for it at any point.\"",{"data":1107,"content":1108,"nodeType":894},{},[],{"data":1110,"content":1111,"nodeType":904},{},[1112],{"data":1113,"marks":1114,"value":1116,"nodeType":865},{},[1115],{"type":902},"4. ClickFix keeps evolving with multiple *Fix derivatives",{"data":1118,"content":1119,"nodeType":881},{},[1120,1124,1133,1137,1145],{"data":1121,"marks":1122,"value":1123,"nodeType":865},{},[],"ClickFix — where a malicious page silently writes a payload to the victim's clipboard and instructs them to paste and execute it — ",{"data":1125,"content":1127,"nodeType":876},{"uri":1126},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection/",[1128],{"data":1129,"marks":1130,"value":1132,"nodeType":865},{},[1131],{"type":874},"spawned an entire family of variants since its emergence, according to Push’s research",{"data":1134,"marks":1135,"value":1136,"nodeType":865},{},[],". The webinar showed how far the social engineering has come: Luke demonstrated a ",{"data":1138,"content":1140,"nodeType":876},{"uri":1139},"https://pushsecurity.com/blog/the-most-advanced-clickfix-yet/",[1141],{"data":1142,"marks":1143,"value":1144,"nodeType":865},{},[],"particularly sophisticated variant",{"data":1146,"marks":1147,"value":1148,"nodeType":865},{},[]," on a compromised legitimate website with an embedded instructional video and a countdown timer to manufacture urgency, targeting macOS. As John noted: \"It can be cross-platform because you're just preying on the human weakness. The video smooths it over for the user experience.\"",{"data":1150,"content":1151,"nodeType":881},{},[1152,1156,1163],{"data":1153,"marks":1154,"value":1155,"nodeType":865},{},[],"The more important point was structural. Because the user manually pastes and executes the command, \"from the EDR's perspective, the user just manually ran this command,\" Luke explained. \"It actually breaks that link from an EDR's perspective.\" EDR behavioral detections weigh execution context heavily — a PowerShell command spawned from a browser process tree is suspicious, but the same command initiated through the Run dialog looks like normal activity. Push ",{"data":1157,"content":1158,"nodeType":876},{"uri":1126},[1159],{"data":1160,"marks":1161,"value":1162,"nodeType":865},{},[],"detects ClickFix at the clipboard-injection stage",{"data":1164,"marks":1165,"value":1166,"nodeType":865},{},[],", before the payload ever reaches the endpoint, to bolster endpoint-level detections and extend protection to machines like BYOD, contractor, or developer devices where EDR is often missing or tuned-down.",{"data":1168,"content":1169,"nodeType":894},{},[],{"data":1171,"content":1172,"nodeType":904},{},[1173],{"data":1174,"marks":1175,"value":1177,"nodeType":865},{},[1176],{"type":902},"5. InstallFix turned the AI tool boom into an attack surface overnight",{"data":1179,"content":1180,"nodeType":881},{},[1181,1184,1193],{"data":1182,"marks":1183,"value":21,"nodeType":865},{},[],{"data":1185,"content":1187,"nodeType":876},{"uri":1186},"https://pushsecurity.com/blog/installfix/",[1188],{"data":1189,"marks":1190,"value":1192,"nodeType":865},{},[1191],{"type":874},"InstallFix",{"data":1194,"marks":1195,"value":1196,"nodeType":865},{},[]," — a ClickFix variant that clones legitimate developer tool installation pages and swaps the install command for a malicious payload — was one of the clearest examples of how quickly a new attack pattern can go from zero to dominant. Luke showed side-by-side comparisons of real and fake Claude Code installation pages that were visually identical except for the payload itself, and fake Notebook LM pages appearing as top Google sponsored results.",{"data":1198,"content":1199,"nodeType":881},{},[1200],{"data":1201,"marks":1202,"value":1203,"nodeType":865},{},[],"The trajectory Luke described was striking: \"It literally started one day and then it's just been nonstop for the last couple of months since it started. It obviously is working really well.\" John added that the Claude Code variant in particular has been \"running rampant,\" and that he personally knows someone who fell for it.",{"data":1205,"content":1206,"nodeType":881},{},[1207],{"data":1208,"marks":1209,"value":1210,"nodeType":865},{},[],"What makes InstallFix effective is that it exploits a workflow that's become completely normalized — the rise of AI tools has encouraged even non-technical users to install software via terminal commands copied from documentation pages. When the fake page looks identical to the real one and the install method is exactly what you'd expect, the only tell is a base64-encoded payload that most users wouldn't think to scrutinize.",{"data":1212,"content":1213,"nodeType":894},{},[],{"data":1215,"content":1216,"nodeType":904},{},[1217],{"data":1218,"marks":1219,"value":1221,"nodeType":865},{},[1220],{"type":902},"6. ConsentFix plays out entirely in the browser, and criminals just got the playbook",{"data":1223,"content":1224,"nodeType":881},{},[1225,1228,1237],{"data":1226,"marks":1227,"value":21,"nodeType":865},{},[],{"data":1229,"content":1231,"nodeType":876},{"uri":1230},"https://pushsecurity.com/blog/consentfix/",[1232],{"data":1233,"marks":1234,"value":1236,"nodeType":865},{},[1235],{"type":874},"ConsentFix",{"data":1238,"marks":1239,"value":1240,"nodeType":865},{},[]," was a key focus in the webinar, and for good reason — it represents a fundamentally different class of browser attack. Rather than proxying credentials (AiTM) or injecting endpoint payloads (ClickFix), ConsentFix abuses the OAuth authorization code flow via the Azure CLI's localhost redirect to obtain access tokens without ever touching a password or MFA prompt. As John put it: \"This one is really tricky because the entire attack and technique lives only within the browser. There are no little EDR artifacts to poke and play at.\"",{"data":1242,"content":1243,"nodeType":881},{},[1244],{"data":1245,"marks":1246,"value":1247,"nodeType":865},{},[],"Luke described how Push first detected ConsentFix in the wild — a genuine zero-day discovery that took multiple encounters to fully understand. The attackers were fingerprinting visitors by IP and browser, triggering the payload only once per visitor across all compromised sites, and performing conditional access checks on the email address provided before deciding whether to proceed. \"It took us seeing it a few times before we cracked it,\" Luke explained. \"And then we were like — wow. What is this? I've never seen this before.\"",{"data":1249,"content":1250,"nodeType":881},{},[1251,1255,1262],{"data":1252,"marks":1253,"value":1254,"nodeType":865},{},[],"The session then took an interesting turn when John revealed something he hadn't previously shared publicly: a  ",{"data":1256,"content":1257,"nodeType":876},{"uri":950},[1258],{"data":1259,"marks":1260,"value":1261,"nodeType":865},{},[],"ConsentFix v3 toolkit",{"data":1263,"marks":1264,"value":1265,"nodeType":865},{},[]," posted on a well-known criminal forum, complete with a tutorial video, step-by-step instructions, and a zero-infrastructure approach using Cloudflare Workers for hosting, Dropbox for PDF delivery, and Pipedream as an automated exfiltration channel. \"They don’t need any infrastructure,\" John noted. \"They don’t have to host any servers or VPS. They could just cast this out to the whole wide world on the open internet.\"",{"data":1267,"content":1268,"nodeType":970},{},[1269],{"data":1270,"content":1271,"nodeType":881},{},[1272],{"data":1273,"marks":1274,"value":1275,"nodeType":865},{},[],"Luke's assessment was clear: \"When we published our first article, we were thinking, surely we're going to see a huge increase in this technique. We haven't really — until now.\" ",{"data":1277,"content":1278,"nodeType":881},{},[1279],{"data":1280,"marks":1281,"value":1282,"nodeType":865},{},[],"With the criminal ecosystem now tooled up, the expectation is that ConsentFix will follow the same commoditization arc as other techniques discussed in the session.",{"data":1284,"content":1285,"nodeType":894},{},[],{"data":1287,"content":1288,"nodeType":904},{},[1289],{"data":1290,"marks":1291,"value":1293,"nodeType":865},{},[1292],{"type":902},"7. Device code phishing is the technique both speakers fear most (and it's just getting started)",{"data":1295,"content":1296,"nodeType":881},{},[1297,1301,1308],{"data":1298,"marks":1299,"value":1300,"nodeType":865},{},[],"When John asked Luke which technique felt most dangerous, the answer was immediate: ",{"data":1302,"content":1303,"nodeType":876},{"uri":938},[1304],{"data":1305,"marks":1306,"value":1307,"nodeType":865},{},[],"device code phishing",{"data":1309,"marks":1310,"value":1032,"nodeType":865},{},[],{"data":1312,"content":1313,"nodeType":881},{},[1314],{"data":1315,"marks":1316,"value":1317,"nodeType":865},{},[],"The technique abuses the OAuth 2.0 device authorization grant flow — originally designed for input-constrained devices like TVs, but now primarily used in enterprise environments for CLI tool authentication (Azure CLI, GitHub CLI, AWS CLI). That everyday enterprise usage is exactly what makes the phishing so effective: users in developer-heavy organizations are already habituated to entering short codes as part of their normal workflow. The victim enters a code on a legitimate Microsoft login page, and if they're already authenticated, the entire compromise happens without entering a password or completing an MFA challenge.",{"data":1319,"content":1320,"nodeType":881},{},[1321],{"data":1322,"marks":1323,"value":1324,"nodeType":865},{},[],"Push is now tracking at least 12 distinct device code phishing kits, \"literally within the last couple of months — from basically zero to this.\" EvilTokens dominates at an estimated 90–95% of detected volume, but the kit landscape is diversifying fast. Luke's theory: every existing AiTM vendor is adding device code phishing as a module. When Push investigated the Venom kit, its AiTM component triggered existing Sneaky2FA detections — suggesting the same actors or codebase behind both. \"That's why we've seen such a rapid increase — it's worked so well that everyone is just doing the same thing now.\"",{"data":1326,"content":1327,"nodeType":881},{},[1328,1333],{"data":1329,"marks":1330,"value":1332,"nodeType":865},{},[1331],{"type":902},"What makes device code phishing uniquely dangerous is how little friction it presents to the victim.",{"data":1334,"marks":1335,"value":1336,"nodeType":865},{},[]," As Luke explained: \"It's purely identity-driven. It completely bypasses 2FA, even bypasses phishing-resistant factors like passkeys. And it's just not something that seems malicious to your average user. We haven't trained people to worry about being given a code and being told to type that code.\"",{"data":1338,"content":1339,"nodeType":970},{},[1340],{"data":1341,"content":1342,"nodeType":881},{},[1343],{"data":1344,"marks":1345,"value":1346,"nodeType":865},{},[],"John's closing take: \"It still feels early and emergent, even though the technique has been known for a while. It hasn't been weaponized like it has right now. I think device code is just at the starting gun.\" ",{"data":1348,"content":1349,"nodeType":881},{},[1350,1354,1363],{"data":1351,"marks":1352,"value":1353,"nodeType":865},{},[],"The blast radius extends beyond Microsoft too — GitHub, Salesforce, and other platforms support the same underlying flow, and was exploited in 2025’s massive Salesforce campaign operated by ",{"data":1355,"content":1357,"nodeType":876},{"uri":1356},"https://pushsecurity.com/blog/analyzing-the-instructure-breach/",[1358],{"data":1359,"marks":1360,"value":1362,"nodeType":865},{},[1361],{"type":874},"ShinyHunters",{"data":1364,"marks":1365,"value":959,"nodeType":865},{},[],{"data":1367,"content":1368,"nodeType":894},{},[],{"data":1370,"content":1371,"nodeType":904},{},[1372],{"data":1373,"marks":1374,"value":1376,"nodeType":865},{},[1375],{"type":902},"What ties all of this together",{"data":1378,"content":1379,"nodeType":881},{},[1380],{"data":1381,"marks":1382,"value":1383,"nodeType":865},{},[],"Every technique covered in the webinar — AiTM, ClickFix, InstallFix, ConsentFix, device code phishing — is designed to operate in or through the browser, abuse legitimate infrastructure and authentication flows, and evade the traditional security stack. Email gateways don't see them because the delivery vector increasingly isn't email. EDR doesn't reliably block them because the attack either breaks the process tree attribution (ClickFix) or never touches the endpoint at all (ConsentFix, device code phishing). Network proxies don't see them because the attack plays out in client-side page content, DOM interactions, and OAuth flows that are invisible to traffic inspection.",{"data":1385,"content":1386,"nodeType":881},{},[1387,1391,1397,1400,1407,1410,1417,1421,1428],{"data":1388,"marks":1389,"value":1390,"nodeType":865},{},[],"Push detects all of them — ",{"data":1392,"content":1393,"nodeType":876},{"uri":1042},[1394],{"data":1395,"marks":1396,"value":261,"nodeType":865},{},[],{"data":1398,"marks":1399,"value":996,"nodeType":865},{},[],{"data":1401,"content":1402,"nodeType":876},{"uri":1126},[1403],{"data":1404,"marks":1405,"value":1406,"nodeType":865},{},[]," ClickFix and the *Fix family",{"data":1408,"marks":1409,"value":996,"nodeType":865},{},[],{"data":1411,"content":1412,"nodeType":876},{"uri":1230},[1413],{"data":1414,"marks":1415,"value":1416,"nodeType":865},{},[]," ConsentFix",{"data":1418,"marks":1419,"value":1420,"nodeType":865},{},[],", and",{"data":1422,"content":1423,"nodeType":876},{"uri":938},[1424],{"data":1425,"marks":1426,"value":1427,"nodeType":865},{},[]," device code phishing",{"data":1429,"marks":1430,"value":1431,"nodeType":865},{},[]," — through behavioral detection at the browser layer, regardless of delivery channel, domain reputation, or infrastructure rotation. The detections target technique-class behaviors rather than specific kits or indicators, which is why Push detected ConsentFix as a zero-day and why new kit variants are typically caught by existing detection logic before a kit-specific rule is even written.",{"data":1433,"content":1434,"nodeType":881},{},[1435,1438,1447,1451,1459],{"data":1436,"marks":1437,"value":21,"nodeType":865},{},[],{"data":1439,"content":1441,"nodeType":876},{"uri":1440},"https://pushsecurity.com/resources/browser-attacks-why-browser-new-battleground",[1442],{"data":1443,"marks":1444,"value":1446,"nodeType":865},{},[1445],{"type":874},"Watch the full webinar",{"data":1448,"marks":1449,"value":1450,"nodeType":865},{},[]," to see the demos, attack chain timelines, and in-the-wild examples discussed in this post — or ",{"data":1452,"content":1454,"nodeType":876},{"uri":1453},"https://pushsecurity.com/demo",[1455],{"data":1456,"marks":1457,"value":1458,"nodeType":865},{},[],"book a demo",{"data":1460,"marks":1461,"value":1462,"nodeType":865},{},[]," to see how Push handles them.","document",{"entries":1465},{"hyperlink":1466,"inline":1467,"block":1468},[],[],[1469],{"sys":1470,"__typename":1471,"type":1472,"ctaText":1473,"buttonLabel":1474,"buttonColour":1475,"buttonUrl":1440},{"id":886},"CtaWidget","Custom","Watch the full webinar on demand.","Watch now","sunny orange",{"items":1477},[],{},"7 things we learned from our conversation with John Hammond","thought-leadership","2026-05-19T00:00:00.000Z",{"items":1483},[1484,4519,5378],{"__typename":1485,"sys":1486,"content":1488,"title":4499,"synopsis":4500,"hashTags":59,"publishedDate":4501,"slug":361,"tagsCollection":4502,"authorsCollection":4511},"BlogPosts",{"id":1487},"5DmCqTU2Tg4adYScA5vT2x",{"json":1489},{"data":1490,"content":1491,"nodeType":1463},{},[1492,1498,1518,1536,1543,1549,1556,1563,1566,1574,1580,1665,1685,1691,1698,1819,1825,1828,1836,1843,1849,1852,1861,1903,1909,1916,1923,1930,1937,1956,1962,1968,1974,1980,1986,1992,1998,2004,2271,2274,2282,2417,2423,2426,2434,2474,2608,2614,2617,2625,2772,2778,2781,2789,2795,2936,2942,2948,2951,2959,3106,3112,3115,3123,3269,3275,3278,3286,3381,3387,3390,3398,3492,3498,3501,3509,3515,3648,3654,3657,3665,3714,3720,3723,3731,3870,3876,3879,3887,4019,4025,4028,4036,4048,4055,4061,4067,4074,4095,4111,4117,4120,4128,4136,4157,4178,4183,4190,4197,4205,4212,4219,4226,4234,4241,4292,4298,4301,4309,4316,4323,4370,4376,4383,4386,4394,4401,4408,4428,4434,4441,4449,4456],{"data":1493,"content":1497,"nodeType":890},{"target":1494},{"sys":1495},{"id":1496,"type":887,"linkType":888},"XOFOeNqmRHeiRbkPOJrP1",[],{"data":1499,"content":1500,"nodeType":881},{},[1501,1505,1514],{"data":1502,"marks":1503,"value":1504,"nodeType":865},{},[],"The OAuth 2.0 ",{"data":1506,"content":1508,"nodeType":876},{"uri":1507},"https://www.rfc-editor.org/rfc/rfc8628",[1509],{"data":1510,"marks":1511,"value":1513,"nodeType":865},{},[1512],{"type":874},"device authorization grant",{"data":1515,"marks":1516,"value":1517,"nodeType":865},{},[]," was designed to enable input-constrained devices to sign-in to apps by asking the user to complete the login on a separate device by entering a code. But today, it’s mainly used when accessing CLI tools, meaning that many users encounter the device code flow daily. ",{"data":1519,"content":1520,"nodeType":881},{},[1521,1524,1532],{"data":1522,"marks":1523,"value":21,"nodeType":865},{},[],{"data":1525,"content":1527,"nodeType":876},{"uri":1526},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/device_code_phishing/description.md",[1528],{"data":1529,"marks":1530,"value":360,"nodeType":865},{},[1531],{"type":874},{"data":1533,"marks":1534,"value":1535,"nodeType":865},{},[]," attacks designed to exploit this authorization flow are not new — it was among the first techniques that we added to the SaaS attacks matrix back in 2023. But it’s taken until now for it to really enter mainstream adoption. ",{"data":1537,"content":1538,"nodeType":881},{},[1539],{"data":1540,"marks":1541,"value":1542,"nodeType":865},{},[],"The technique tricks a user into issuing access tokens for an attacker-controlled application (not a device, confusingly). Any app that supports device code logins can be a target. Popular examples include Microsoft, Google, Salesforce, GitHub, and AWS. That said, Microsoft is, as always, much more heavily targeted at scale now than any other app.",{"data":1544,"content":1548,"nodeType":890},{"target":1545},{"sys":1546},{"id":1547,"type":887,"linkType":888},"Al0pGH8vmOYiufDFiAbt0",[],{"data":1550,"content":1551,"nodeType":881},{},[1552],{"data":1553,"marks":1554,"value":1555,"nodeType":865},{},[],"We’ve always been surprised that attackers haven’t commonly used device code phishing in their standard toolkit, preferring session-stealing AITM phishing and other social engineering attacks like ClickFix. But it’s pretty clear from the recent data that the shift to mainstream adoption has now happened. ",{"data":1557,"content":1558,"nodeType":881},{},[1559],{"data":1560,"marks":1561,"value":1562,"nodeType":865},{},[],"In this blog post, we’ll explore the history of device code phishing, what’s changed for it to enter mainstream adoption, how it works under the hood (with recent examples), and what security teams can do about it. ",{"data":1564,"content":1565,"nodeType":894},{},[],{"data":1567,"content":1568,"nodeType":904},{},[1569],{"data":1570,"marks":1571,"value":1573,"nodeType":865},{},[1572],{"type":902},"A brief history of device code phishing",{"data":1575,"content":1579,"nodeType":890},{"target":1576},{"sys":1577},{"id":1578,"type":887,"linkType":888},"6u3DgvSGChtTJu7l9I7PG1",[],{"data":1581,"content":1582,"nodeType":881},{},[1583,1587,1596,1600,1609,1613,1622,1626,1635,1639,1648,1652,1661],{"data":1584,"marks":1585,"value":1586,"nodeType":865},{},[],"The technique was first documented in 2020, before Secureworks released the first tooling framework ",{"data":1588,"content":1590,"nodeType":876},{"uri":1589},"https://github.com/secureworks/PhishInSuits",[1591],{"data":1592,"marks":1593,"value":1595,"nodeType":865},{},[1594],{"type":874},"PhishInSuits",{"data":1597,"marks":1598,"value":1599,"nodeType":865},{},[]," a year later. A host of research followed, including ",{"data":1601,"content":1603,"nodeType":876},{"uri":1602},"https://github.com/secureworks/squarephish",[1604],{"data":1605,"marks":1606,"value":1608,"nodeType":865},{},[1607],{"type":874},"SquarePhish",{"data":1610,"marks":1611,"value":1612,"nodeType":865},{},[]," v1 (using QR codes to trigger the 15 minute code expiration window), Dirk-Jan Mollema’s ",{"data":1614,"content":1616,"nodeType":876},{"uri":1615},"https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/",[1617],{"data":1618,"marks":1619,"value":1621,"nodeType":865},{},[1620],{"type":874},"key research",{"data":1623,"marks":1624,"value":1625,"nodeType":865},{},[]," (chaining device code phishing via Microsoft apps into Primary Refresh Token (PRT) acquisition to gain full browser-level access) and Dennis Kniep’s ",{"data":1627,"content":1629,"nodeType":876},{"uri":1628},"https://github.com/denniskniep/DeviceCodePhishing",[1630],{"data":1631,"marks":1632,"value":1634,"nodeType":865},{},[1633],{"type":874},"DeviceCodePhishing tool",{"data":1636,"marks":1637,"value":1638,"nodeType":865},{},[]," which automates the entire flow with a headless browser. (Other recent noteworthy tools include ",{"data":1640,"content":1642,"nodeType":876},{"uri":1641},"https://github.com/nromsdahl/squarephish2",[1643],{"data":1644,"marks":1645,"value":1647,"nodeType":865},{},[1646],{"type":874},"SquarePhish2",{"data":1649,"marks":1650,"value":1651,"nodeType":865},{},[]," and ",{"data":1653,"content":1655,"nodeType":876},{"uri":1654},"https://github.com/praetorian-inc/GitPhish",[1656],{"data":1657,"marks":1658,"value":1660,"nodeType":865},{},[1659],{"type":874},"GitPhish",{"data":1662,"marks":1663,"value":1664,"nodeType":865},{},[],", so shout out to those too). ",{"data":1666,"content":1667,"nodeType":881},{},[1668,1672,1681],{"data":1669,"marks":1670,"value":1671,"nodeType":865},{},[],"It wasn’t until August 2024 that in-the-wild exploitation was first identified, with Russia-linked campaigns then continuing into 2025 before entering mainstream criminal adoption. This trend has continued to gather momentum in 2026 with ",{"data":1673,"content":1675,"nodeType":876},{"uri":1674},"https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html",[1676],{"data":1677,"marks":1678,"value":1680,"nodeType":865},{},[1679],{"type":874},"EvilTokens",{"data":1682,"marks":1683,"value":1684,"nodeType":865},{},[],", the first reported criminal PhaaS kit for device code phishing, already powering massive campaigns after launching in February. ",{"data":1686,"content":1690,"nodeType":890},{"target":1687},{"sys":1688},{"id":1689,"type":887,"linkType":888},"6xsfmbYEzpW7CdDiNzO6cu",[],{"data":1692,"content":1693,"nodeType":881},{},[1694],{"data":1695,"marks":1696,"value":1697,"nodeType":865},{},[],"Some of the noteworthy in-the-wild campaigns include:",{"data":1699,"content":1700,"nodeType":1818},{},[1701,1735,1757],{"data":1702,"content":1703,"nodeType":1734},{},[1704],{"data":1705,"content":1706,"nodeType":881},{},[1707,1711,1719,1722,1730],{"data":1708,"marks":1709,"value":1710,"nodeType":865},{},[],"Storm-2372, tracked by ",{"data":1712,"content":1714,"nodeType":876},{"uri":1713},"https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/",[1715],{"data":1716,"marks":1717,"value":1718,"nodeType":865},{},[],"Microsoft",{"data":1720,"marks":1721,"value":1651,"nodeType":865},{},[],{"data":1723,"content":1725,"nodeType":876},{"uri":1724},"https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/",[1726],{"data":1727,"marks":1728,"value":1729,"nodeType":865},{},[],"Volexity",{"data":1731,"marks":1732,"value":1733,"nodeType":865},{},[],", linked to multiple Russia-aligned clusters, combining spear-phishing and social engineering with device code phishing payloads against strategic intelligence targets.","list-item",{"data":1736,"content":1737,"nodeType":1734},{},[1738],{"data":1739,"content":1740,"nodeType":881},{},[1741,1745,1753],{"data":1742,"marks":1743,"value":1744,"nodeType":865},{},[],"The massive Salesforce campaign operated by ",{"data":1746,"content":1748,"nodeType":876},{"uri":1747},"https://pushsecurity.com/blog/scattered-lapsus-hunters/",[1749],{"data":1750,"marks":1751,"value":1752,"nodeType":865},{},[],"Scattered Lapsus$ Hunters",{"data":1754,"marks":1755,"value":1756,"nodeType":865},{},[]," (SLH) combined vishing with a device code phishing payload targeting Salesforce. The attacks morphed into a broader supply chain campaign using stolen credentials, ultimately resulting in 1000+ organizations being compromised and over 1.5 billion stolen records claimed. ",{"data":1758,"content":1759,"nodeType":1734},{},[1760],{"data":1761,"content":1762,"nodeType":881},{},[1763,1767,1775,1779,1788,1792,1801,1805,1814],{"data":1764,"marks":1765,"value":1766,"nodeType":865},{},[],"A massive spike in activity in late 2025 and 2026. This includes ",{"data":1768,"content":1770,"nodeType":876},{"uri":1769},"https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover",[1771],{"data":1772,"marks":1773,"value":1774,"nodeType":865},{},[],"multiple threat clusters",{"data":1776,"marks":1777,"value":1778,"nodeType":865},{},[]," tracked using device code phishing techniques, more ",{"data":1780,"content":1782,"nodeType":876},{"uri":1781},"https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-entra-accounts-in-device-code-vishing-attacks/",[1783],{"data":1784,"marks":1785,"value":1787,"nodeType":865},{},[1786],{"type":874},"criminal operations linked to SLH",{"data":1789,"marks":1790,"value":1791,"nodeType":865},{},[],", and ",{"data":1793,"content":1795,"nodeType":876},{"uri":1794},"https://newtonpaul.com/blog/device-code-phish-update/",[1796],{"data":1797,"marks":1798,"value":1800,"nodeType":865},{},[1799],{"type":874},"hundreds of organizations being targeted via PhaaS architecture,",{"data":1802,"marks":1803,"value":1804,"nodeType":865},{},[]," which looks to be the same campaign as the recently uncovered EvilTokens PhaaS reported by ",{"data":1806,"content":1808,"nodeType":876},{"uri":1807},"https://www.huntress.com/blog/railway-paas-m365-token-replay-campaign",[1809],{"data":1810,"marks":1811,"value":1813,"nodeType":865},{},[1812],{"type":874},"Huntress",{"data":1815,"marks":1816,"value":1817,"nodeType":865},{},[]," (featuring abuse of the Railway PaaS platform). ","unordered-list",{"data":1820,"content":1824,"nodeType":890},{"target":1821},{"sys":1822},{"id":1823,"type":887,"linkType":888},"3WLt6qLCK8CSwr0QZxZiMv",[],{"data":1826,"content":1827,"nodeType":894},{},[],{"data":1829,"content":1830,"nodeType":904},{},[1831],{"data":1832,"marks":1833,"value":1835,"nodeType":865},{},[1834],{"type":902},"What we’re seeing in the wild",{"data":1837,"content":1838,"nodeType":881},{},[1839],{"data":1840,"marks":1841,"value":1842,"nodeType":865},{},[],"As mentioned, we’ve also seen a huge spike in device code phishing activity this year, with multiple kits, page designs, and lure types. We’ve now identified 14+ distinct kits in circulation in the wild, with EvilTokens being the most prevalent. It’s clear that attackers are both spinning up their own kits and creative derivatives of others — we’ve seen kits that are visually similar to EvilTokens (close enough to be clones or forks) but with very different backends, for example AWS, Digital Ocean, 2cloud, and more. ",{"data":1844,"content":1848,"nodeType":890},{"target":1845},{"sys":1846},{"id":1847,"type":887,"linkType":888},"nJCbTw85GKXdqrlIkzZwi",[],{"data":1850,"content":1851,"nodeType":894},{},[],{"data":1853,"content":1854,"nodeType":1860},{},[1855],{"data":1856,"marks":1857,"value":1859,"nodeType":865},{},[1858],{"type":902},"“ANTIBOT” (EvilTokens)","heading-2",{"data":1862,"content":1863,"nodeType":881},{},[1864,1867,1874,1878,1887,1891,1899],{"data":1865,"marks":1866,"value":21,"nodeType":865},{},[],{"data":1868,"content":1869,"nodeType":876},{"uri":1807},[1870],{"data":1871,"marks":1872,"value":1813,"nodeType":865},{},[1873],{"type":874},{"data":1875,"marks":1876,"value":1877,"nodeType":865},{},[],", ",{"data":1879,"content":1881,"nodeType":876},{"uri":1880},"https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/",[1882],{"data":1883,"marks":1884,"value":1886,"nodeType":865},{},[1885],{"type":874},"Sekoia",{"data":1888,"marks":1889,"value":1890,"nodeType":865},{},[],", and researcher ",{"data":1892,"content":1893,"nodeType":876},{"uri":1794},[1894],{"data":1895,"marks":1896,"value":1898,"nodeType":865},{},[1897],{"type":874},"Paul Newton",{"data":1900,"marks":1901,"value":1902,"nodeType":865},{},[]," have already done a great job of providing IOCs for the recent EvilTokens activity spike, including multiple backend Railway IPs in authentication events. ",{"data":1904,"content":1908,"nodeType":890},{"target":1905},{"sys":1906},{"id":1907,"type":887,"linkType":888},"1XNviq5OvMf5TEAc59F6g5",[],{"data":1910,"content":1911,"nodeType":881},{},[1912],{"data":1913,"marks":1914,"value":1915,"nodeType":865},{},[],"Beyond the most widely observed implementation featuring a Cloudflare Workers frontend and Railway backend for authentication, we’ve also tracked additional versions of EvilTokens in circulation since January 2026 (many of which remain live along with the current “production” version of the kit). ",{"data":1917,"content":1918,"nodeType":881},{},[1919],{"data":1920,"marks":1921,"value":1922,"nodeType":865},{},[],"You can see an evolution of the kit in the videos and screenshots below, from early precursors seen in mid-January, the first mentions of ANTIBOT in the page code in late-January, the parallel development of a “Courts Access” fork that lacks the ANTIBOT references, and finally production EvilTokens in February. One of the key threads between the versions is the presence of a generateFallbackCode() JS function and use of a /generate-codes API call. ",{"data":1924,"content":1925,"nodeType":881},{},[1926],{"data":1927,"marks":1928,"value":1929,"nodeType":865},{},[],"Early implementations were quite different, for example using ScrapingBee to generate the displayed code, and varied hosting on vercel, fastly, edgeone, and others. ",{"data":1931,"content":1932,"nodeType":881},{},[1933],{"data":1934,"marks":1935,"value":1936,"nodeType":865},{},[],"After initially appearing on custom domains, the production version is now predominantly hosted on Cloudflare Workers, as per the broader tracking of the campaign. The descriptive HTML comments around ANTIBOT functions have also been removed in later versions. ",{"data":1938,"content":1939,"nodeType":881},{},[1940,1944,1952],{"data":1941,"marks":1942,"value":1943,"nodeType":865},{},[],"The production version of EvilTokens showcases common ",{"data":1945,"content":1946,"nodeType":876},{"uri":1022},[1947],{"data":1948,"marks":1949,"value":1951,"nodeType":865},{},[1950],{"type":874},"detection evasion techniques",{"data":1953,"marks":1954,"value":1955,"nodeType":865},{},[]," we've come to associate with PhaaS kits in the AiTM space — using multiple redirects through trusted sites before serving the malicious page, using bot protection to block security tools from analyzing the page, and so on. It also uses a pop-up window for the device code entry rather than a redirect, reducing the friction for the victim (it looks pretty convincing, too).",{"data":1957,"content":1961,"nodeType":890},{"target":1958},{"sys":1959},{"id":1960,"type":887,"linkType":888},"73rNOIEDPfP5IJwpFaxVc2",[],{"data":1963,"content":1967,"nodeType":890},{"target":1964},{"sys":1965},{"id":1966,"type":887,"linkType":888},"5BJSvOQUW9UpsQtoDNtgTC",[],{"data":1969,"content":1973,"nodeType":890},{"target":1970},{"sys":1971},{"id":1972,"type":887,"linkType":888},"3dbePPxVb4h4SauGg3glIL",[],{"data":1975,"content":1979,"nodeType":890},{"target":1976},{"sys":1977},{"id":1978,"type":887,"linkType":888},"1UOLcmNQvOsL5tdLSVuviq",[],{"data":1981,"content":1985,"nodeType":890},{"target":1982},{"sys":1983},{"id":1984,"type":887,"linkType":888},"55XRqLSwUUi2D4ZVpJboml",[],{"data":1987,"content":1991,"nodeType":890},{"target":1988},{"sys":1989},{"id":1990,"type":887,"linkType":888},"5wg5yr2Lo8t3f72ZV815c",[],{"data":1993,"content":1997,"nodeType":890},{"target":1994},{"sys":1995},{"id":1996,"type":887,"linkType":888},"35cowlL6i3rkGXOGmSxlI1",[],{"data":1999,"content":2000,"nodeType":881},{},[2001],{"data":2002,"marks":2003,"value":21,"nodeType":865},{},[],{"data":2005,"content":2006,"nodeType":2270},{},[2007,2033,2117,2169,2193],{"data":2008,"content":2009,"nodeType":2032},{},[2010,2022],{"data":2011,"content":2012,"nodeType":2021},{},[2013],{"data":2014,"content":2015,"nodeType":881},{},[2016],{"data":2017,"marks":2018,"value":2020,"nodeType":865},{},[2019],{"type":902},"Frontend infrastructure","table-cell",{"data":2023,"content":2024,"nodeType":2021},{},[2025],{"data":2026,"content":2027,"nodeType":881},{},[2028],{"data":2029,"marks":2030,"value":2031,"nodeType":865},{},[],"Workers.dev, vercel.app, github.io, fastly.net, edgeone.dev","table-row",{"data":2034,"content":2035,"nodeType":2032},{},[2036,2047],{"data":2037,"content":2038,"nodeType":2021},{},[2039],{"data":2040,"content":2041,"nodeType":881},{},[2042],{"data":2043,"marks":2044,"value":2046,"nodeType":865},{},[2045],{"type":902},"Backend infrastructure",{"data":2048,"content":2049,"nodeType":2021},{},[2050,2080],{"data":2051,"content":2052,"nodeType":881},{},[2053,2058,2062,2067,2071,2076],{"data":2054,"marks":2055,"value":2057,"nodeType":865},{},[2056],{"type":902},"Example IP: (V3) ",{"data":2059,"marks":2060,"value":2061,"nodeType":865},{},[],"162.220.232.71 (Railway AS400940) ",{"data":2063,"marks":2064,"value":2066,"nodeType":865},{},[2065],{"type":902},"(V2)",{"data":2068,"marks":2069,"value":2070,"nodeType":865},{},[]," 71.11.42.193 ",{"data":2072,"marks":2073,"value":2075,"nodeType":865},{},[2074],{"type":902},"(V1) ",{"data":2077,"marks":2078,"value":2079,"nodeType":865},{},[],"72.218.25.107",{"data":2081,"content":2082,"nodeType":881},{},[2083,2088,2092,2097,2101,2105,2109,2113],{"data":2084,"marks":2085,"value":2087,"nodeType":865},{},[2086],{"type":902},"Backend User Agent:",{"data":2089,"marks":2090,"value":2091,"nodeType":865},{},[]," ",{"data":2093,"marks":2094,"value":2096,"nodeType":865},{},[2095],{"type":902},"(V3) ",{"data":2098,"marks":2099,"value":2100,"nodeType":865},{},[],"node, ",{"data":2102,"marks":2103,"value":2066,"nodeType":865},{},[2104],{"type":902},{"data":2106,"marks":2107,"value":2108,"nodeType":865},{},[],", Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683 Safari/537.36 OPR/57.0.3098.91 ",{"data":2110,"marks":2111,"value":2075,"nodeType":865},{},[2112],{"type":902},{"data":2114,"marks":2115,"value":2116,"nodeType":865},{},[],"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/56.0.3051.52 ",{"data":2118,"content":2119,"nodeType":2032},{},[2120,2131],{"data":2121,"content":2122,"nodeType":2021},{},[2123],{"data":2124,"content":2125,"nodeType":881},{},[2126],{"data":2127,"marks":2128,"value":2130,"nodeType":865},{},[2129],{"type":902},"Network paths",{"data":2132,"content":2133,"nodeType":2021},{},[2134,2141,2148,2155,2162],{"data":2135,"content":2136,"nodeType":881},{},[2137],{"data":2138,"marks":2139,"value":2140,"nodeType":865},{},[],"/api/rate-limit ",{"data":2142,"content":2143,"nodeType":881},{},[2144],{"data":2145,"marks":2146,"value":2147,"nodeType":865},{},[],"/api/fingerprint ",{"data":2149,"content":2150,"nodeType":881},{},[2151],{"data":2152,"marks":2153,"value":2154,"nodeType":865},{},[],"/api/captcha-verify ",{"data":2156,"content":2157,"nodeType":881},{},[2158],{"data":2159,"marks":2160,"value":2161,"nodeType":865},{},[],"/api/init /api/generate-code ",{"data":2163,"content":2164,"nodeType":881},{},[2165],{"data":2166,"marks":2167,"value":2168,"nodeType":865},{},[],"/api/check-auth",{"data":2170,"content":2171,"nodeType":2032},{},[2172,2183],{"data":2173,"content":2174,"nodeType":2021},{},[2175],{"data":2176,"content":2177,"nodeType":881},{},[2178],{"data":2179,"marks":2180,"value":2182,"nodeType":865},{},[2181],{"type":902},"Lure themes",{"data":2184,"content":2185,"nodeType":2021},{},[2186],{"data":2187,"content":2188,"nodeType":881},{},[2189],{"data":2190,"marks":2191,"value":2192,"nodeType":865},{},[],"Various MS lures (e.g. Outlook, SharePoint, Teams) DocuSign, Adobe",{"data":2194,"content":2195,"nodeType":2032},{},[2196,2207],{"data":2197,"content":2198,"nodeType":2021},{},[2199],{"data":2200,"content":2201,"nodeType":881},{},[2202],{"data":2203,"marks":2204,"value":2206,"nodeType":865},{},[2205],{"type":902},"Example Domain",{"data":2208,"content":2209,"nodeType":2021},{},[2210,2222,2234,2246,2258],{"data":2211,"content":2212,"nodeType":881},{},[2213,2218],{"data":2214,"marks":2215,"value":2217,"nodeType":865},{},[2216],{"type":902},"Precursor A:",{"data":2219,"marks":2220,"value":2221,"nodeType":865},{},[]," teams-zpfvwnpxuc[.]edgeone.dev",{"data":2223,"content":2224,"nodeType":881},{},[2225,2230],{"data":2226,"marks":2227,"value":2229,"nodeType":865},{},[2228],{"type":902},"Precursor B: ",{"data":2231,"marks":2232,"value":2233,"nodeType":865},{},[],"authenticate-m365-accountsecurity-m-pi[.]vercel.app",{"data":2235,"content":2236,"nodeType":881},{},[2237,2242],{"data":2238,"marks":2239,"value":2241,"nodeType":865},{},[2240],{"type":902},"Courts Access: ",{"data":2243,"marks":2244,"value":2245,"nodeType":865},{},[],"secure-systems-validations-courts[.]vercel.app",{"data":2247,"content":2248,"nodeType":881},{},[2249,2254],{"data":2250,"marks":2251,"value":2253,"nodeType":865},{},[2252],{"type":902},"Early ANTIBOT:",{"data":2255,"marks":2256,"value":2257,"nodeType":865},{},[]," interface-auth-en-useast[.]global.ssl.fastly.net",{"data":2259,"content":2260,"nodeType":881},{},[2261,2266],{"data":2262,"marks":2263,"value":2265,"nodeType":865},{},[2264],{"type":902},"Production ANTIBOT: ",{"data":2267,"marks":2268,"value":2269,"nodeType":865},{},[],"index-z059-document-pending-reviewsign-xlss7994824[.]awalizer[.]workers.dev","table",{"data":2272,"content":2273,"nodeType":894},{},[],{"data":2275,"content":2276,"nodeType":1860},{},[2277],{"data":2278,"marks":2279,"value":2281,"nodeType":865},{},[2280],{"type":902},"“SHAREFILE”",{"data":2283,"content":2284,"nodeType":2270},{},[2285,2308,2347,2370,2393],{"data":2286,"content":2287,"nodeType":2032},{},[2288,2298],{"data":2289,"content":2290,"nodeType":2021},{},[2291],{"data":2292,"content":2293,"nodeType":881},{},[2294],{"data":2295,"marks":2296,"value":2020,"nodeType":865},{},[2297],{"type":902},{"data":2299,"content":2300,"nodeType":2021},{},[2301],{"data":2302,"content":2303,"nodeType":881},{},[2304],{"data":2305,"marks":2306,"value":2307,"nodeType":865},{},[],"No hosting markers visible.",{"data":2309,"content":2310,"nodeType":2032},{},[2311,2321],{"data":2312,"content":2313,"nodeType":2021},{},[2314],{"data":2315,"content":2316,"nodeType":881},{},[2317],{"data":2318,"marks":2319,"value":2046,"nodeType":865},{},[2320],{"type":902},{"data":2322,"content":2323,"nodeType":2021},{},[2324,2336],{"data":2325,"content":2326,"nodeType":881},{},[2327,2332],{"data":2328,"marks":2329,"value":2331,"nodeType":865},{},[2330],{"type":902},"Example IP:",{"data":2333,"marks":2334,"value":2335,"nodeType":865},{},[]," 147.45.60.47 (Global Connectivity Solutions LLP AS215540)",{"data":2337,"content":2338,"nodeType":881},{},[2339,2343],{"data":2340,"marks":2341,"value":2087,"nodeType":865},{},[2342],{"type":902},{"data":2344,"marks":2345,"value":2346,"nodeType":865},{},[]," node",{"data":2348,"content":2349,"nodeType":2032},{},[2350,2360],{"data":2351,"content":2352,"nodeType":2021},{},[2353],{"data":2354,"content":2355,"nodeType":881},{},[2356],{"data":2357,"marks":2358,"value":2130,"nodeType":865},{},[2359],{"type":902},{"data":2361,"content":2362,"nodeType":2021},{},[2363],{"data":2364,"content":2365,"nodeType":881},{},[2366],{"data":2367,"marks":2368,"value":2369,"nodeType":865},{},[],"POST /api/device/start  POST /api/device/poll",{"data":2371,"content":2372,"nodeType":2032},{},[2373,2383],{"data":2374,"content":2375,"nodeType":2021},{},[2376],{"data":2377,"content":2378,"nodeType":881},{},[2379],{"data":2380,"marks":2381,"value":2182,"nodeType":865},{},[2382],{"type":902},{"data":2384,"content":2385,"nodeType":2021},{},[2386],{"data":2387,"content":2388,"nodeType":881},{},[2389],{"data":2390,"marks":2391,"value":2392,"nodeType":865},{},[],"Citrix ShareFile document transfer — file card with sender info, expiry warning, download/preview buttons",{"data":2394,"content":2395,"nodeType":2032},{},[2396,2407],{"data":2397,"content":2398,"nodeType":2021},{},[2399],{"data":2400,"content":2401,"nodeType":881},{},[2402],{"data":2403,"marks":2404,"value":2406,"nodeType":865},{},[2405],{"type":902},"Example domain",{"data":2408,"content":2409,"nodeType":2021},{},[2410],{"data":2411,"content":2412,"nodeType":881},{},[2413],{"data":2414,"marks":2415,"value":2416,"nodeType":865},{},[],"cghdfg[.]vbchkioi[.]su",{"data":2418,"content":2422,"nodeType":890},{"target":2419},{"sys":2420},{"id":2421,"type":887,"linkType":888},"1TtZ6VsMSTlPvy7W996w9E",[],{"data":2424,"content":2425,"nodeType":894},{},[],{"data":2427,"content":2428,"nodeType":1860},{},[2429],{"data":2430,"marks":2431,"value":2433,"nodeType":865},{},[2432],{"type":902},"Kali365 (internal name “CLURE”)",{"data":2435,"content":2436,"nodeType":881},{},[2437,2441,2446,2450,2458,2462,2470],{"data":2438,"marks":2439,"value":2440,"nodeType":865},{},[],"Clure was recently linked to the ",{"data":2442,"marks":2443,"value":2445,"nodeType":865},{},[2444],{"type":902},"Kali365",{"data":2447,"marks":2448,"value":2449,"nodeType":865},{},[]," PhaaS platform based on an ",{"data":2451,"content":2453,"nodeType":876},{"uri":2452},"https://www.ic3.gov/PSA/2026/PSA260521",[2454],{"data":2455,"marks":2456,"value":2457,"nodeType":865},{},[],"FBI advisory",{"data":2459,"marks":2460,"value":2461,"nodeType":865},{},[]," and additional research from ",{"data":2463,"content":2465,"nodeType":876},{"uri":2464},"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/",[2466],{"data":2467,"marks":2468,"value":2469,"nodeType":865},{},[],"Arctic Wolf",{"data":2471,"marks":2472,"value":2473,"nodeType":865},{},[],". This is yet another example of Device Code Phishing and AiTM phishing capabilities being integrated into unified phishing platforms. ",{"data":2475,"content":2476,"nodeType":2270},{},[2477,2500,2539,2562,2585],{"data":2478,"content":2479,"nodeType":2032},{},[2480,2490],{"data":2481,"content":2482,"nodeType":2021},{},[2483],{"data":2484,"content":2485,"nodeType":881},{},[2486],{"data":2487,"marks":2488,"value":2020,"nodeType":865},{},[2489],{"type":902},{"data":2491,"content":2492,"nodeType":2021},{},[2493],{"data":2494,"content":2495,"nodeType":881},{},[2496],{"data":2497,"marks":2498,"value":2499,"nodeType":865},{},[],"API on api.duemineral.uk:8443 and api.loadingdocuments.uk:8443 (rotates). ",{"data":2501,"content":2502,"nodeType":2032},{},[2503,2513],{"data":2504,"content":2505,"nodeType":2021},{},[2506],{"data":2507,"content":2508,"nodeType":881},{},[2509],{"data":2510,"marks":2511,"value":2046,"nodeType":865},{},[2512],{"type":902},{"data":2514,"content":2515,"nodeType":2021},{},[2516,2528],{"data":2517,"content":2518,"nodeType":881},{},[2519,2524],{"data":2520,"marks":2521,"value":2523,"nodeType":865},{},[2522],{"type":902},"Example IP: ",{"data":2525,"marks":2526,"value":2527,"nodeType":865},{},[],"162.243.166.119 (DigitalOcean AS14061)",{"data":2529,"content":2530,"nodeType":881},{},[2531,2535],{"data":2532,"marks":2533,"value":2087,"nodeType":865},{},[2534],{"type":902},{"data":2536,"marks":2537,"value":2538,"nodeType":865},{},[]," python-requests/2.32.5",{"data":2540,"content":2541,"nodeType":2032},{},[2542,2552],{"data":2543,"content":2544,"nodeType":2021},{},[2545],{"data":2546,"content":2547,"nodeType":881},{},[2548],{"data":2549,"marks":2550,"value":2130,"nodeType":865},{},[2551],{"type":902},{"data":2553,"content":2554,"nodeType":2021},{},[2555],{"data":2556,"content":2557,"nodeType":881},{},[2558],{"data":2559,"marks":2560,"value":2561,"nodeType":865},{},[],"GET /api/status/{numeric_SID} (port :8443)",{"data":2563,"content":2564,"nodeType":2032},{},[2565,2575],{"data":2566,"content":2567,"nodeType":2021},{},[2568],{"data":2569,"content":2570,"nodeType":881},{},[2571],{"data":2572,"marks":2573,"value":2182,"nodeType":865},{},[2574],{"type":902},{"data":2576,"content":2577,"nodeType":2021},{},[2578],{"data":2579,"content":2580,"nodeType":881},{},[2581],{"data":2582,"marks":2583,"value":2584,"nodeType":865},{},[],"SharePoint \"Team Site\" doc library, SharePoint \"Shared Document\" individual share",{"data":2586,"content":2587,"nodeType":2032},{},[2588,2598],{"data":2589,"content":2590,"nodeType":2021},{},[2591],{"data":2592,"content":2593,"nodeType":881},{},[2594],{"data":2595,"marks":2596,"value":2406,"nodeType":865},{},[2597],{"type":902},{"data":2599,"content":2600,"nodeType":2021},{},[2601],{"data":2602,"content":2603,"nodeType":881},{},[2604],{"data":2605,"marks":2606,"value":2607,"nodeType":865},{},[],"auth[.]duemineral[.]uk",{"data":2609,"content":2613,"nodeType":890},{"target":2610},{"sys":2611},{"id":2612,"type":887,"linkType":888},"Y1AiT3dJRTXz64pb68kca",[],{"data":2615,"content":2616,"nodeType":894},{},[],{"data":2618,"content":2619,"nodeType":1860},{},[2620],{"data":2621,"marks":2622,"value":2624,"nodeType":865},{},[2623],{"type":902},"“LINKID”",{"data":2626,"content":2627,"nodeType":2270},{},[2628,2651,2696,2726,2749],{"data":2629,"content":2630,"nodeType":2032},{},[2631,2641],{"data":2632,"content":2633,"nodeType":2021},{},[2634],{"data":2635,"content":2636,"nodeType":881},{},[2637],{"data":2638,"marks":2639,"value":2020,"nodeType":865},{},[2640],{"type":902},{"data":2642,"content":2643,"nodeType":2021},{},[2644],{"data":2645,"content":2646,"nodeType":881},{},[2647],{"data":2648,"marks":2649,"value":2650,"nodeType":865},{},[],"Adobe variant has Cloudflare challenge-platform iframe (CF-protected origin). Relative API paths — self-hosted.",{"data":2652,"content":2653,"nodeType":2032},{},[2654,2664],{"data":2655,"content":2656,"nodeType":2021},{},[2657],{"data":2658,"content":2659,"nodeType":881},{},[2660],{"data":2661,"marks":2662,"value":2046,"nodeType":865},{},[2663],{"type":902},{"data":2665,"content":2666,"nodeType":2021},{},[2667,2678,2685],{"data":2668,"content":2669,"nodeType":881},{},[2670,2674],{"data":2671,"marks":2672,"value":2523,"nodeType":865},{},[2673],{"type":902},{"data":2675,"marks":2676,"value":2677,"nodeType":865},{},[],"185.176.220.22 (2cloud.eu AS39845)",{"data":2679,"content":2680,"nodeType":881},{},[2681],{"data":2682,"marks":2683,"value":2684,"nodeType":865},{},[],"2600:1f10:470d:9a00:1437:ec30:be61:3494 (AWS AS16509)",{"data":2686,"content":2687,"nodeType":881},{},[2688,2692],{"data":2689,"marks":2690,"value":2087,"nodeType":865},{},[2691],{"type":902},{"data":2693,"marks":2694,"value":2695,"nodeType":865},{},[]," axios/1.10.0 , axios/1.13.6",{"data":2697,"content":2698,"nodeType":2032},{},[2699,2709],{"data":2700,"content":2701,"nodeType":2021},{},[2702],{"data":2703,"content":2704,"nodeType":881},{},[2705],{"data":2706,"marks":2707,"value":2130,"nodeType":865},{},[2708],{"type":902},{"data":2710,"content":2711,"nodeType":2021},{},[2712,2719],{"data":2713,"content":2714,"nodeType":881},{},[2715],{"data":2716,"marks":2717,"value":2718,"nodeType":865},{},[],"POST /api/device/start",{"data":2720,"content":2721,"nodeType":881},{},[2722],{"data":2723,"marks":2724,"value":2725,"nodeType":865},{},[],"GET /api/device/status/{sessionId}",{"data":2727,"content":2728,"nodeType":2032},{},[2729,2739],{"data":2730,"content":2731,"nodeType":2021},{},[2732],{"data":2733,"content":2734,"nodeType":881},{},[2735],{"data":2736,"marks":2737,"value":2182,"nodeType":865},{},[2738],{"type":902},{"data":2740,"content":2741,"nodeType":2021},{},[2742],{"data":2743,"content":2744,"nodeType":881},{},[2745],{"data":2746,"marks":2747,"value":2748,"nodeType":865},{},[],"MS Teams meeting invitation (with interactive date/time picker), Adobe Acrobat Sign document review",{"data":2750,"content":2751,"nodeType":2032},{},[2752,2762],{"data":2753,"content":2754,"nodeType":2021},{},[2755],{"data":2756,"content":2757,"nodeType":881},{},[2758],{"data":2759,"marks":2760,"value":2406,"nodeType":865},{},[2761],{"type":902},{"data":2763,"content":2764,"nodeType":2021},{},[2765],{"data":2766,"content":2767,"nodeType":881},{},[2768],{"data":2769,"marks":2770,"value":2771,"nodeType":865},{},[],"sdtr-site[.]cfd",{"data":2773,"content":2777,"nodeType":890},{"target":2774},{"sys":2775},{"id":2776,"type":887,"linkType":888},"22hsIzlkptC2JTIUtbOuUn",[],{"data":2779,"content":2780,"nodeType":894},{},[],{"data":2782,"content":2783,"nodeType":1860},{},[2784],{"data":2785,"marks":2786,"value":2788,"nodeType":865},{},[2787],{"type":902},"Device Code Lab (formerly codename \"AUTHOV”)",{"data":2790,"content":2794,"nodeType":890},{"target":2791},{"sys":2792},{"id":2793,"type":887,"linkType":888},"5vllVaa0Ry0wKs46ssrZLC",[],{"data":2796,"content":2797,"nodeType":2270},{},[2798,2821,2867,2890,2913],{"data":2799,"content":2800,"nodeType":2032},{},[2801,2811],{"data":2802,"content":2803,"nodeType":2021},{},[2804],{"data":2805,"content":2806,"nodeType":881},{},[2807],{"data":2808,"marks":2809,"value":2020,"nodeType":865},{},[2810],{"type":902},{"data":2812,"content":2813,"nodeType":2021},{},[2814],{"data":2815,"content":2816,"nodeType":881},{},[2817],{"data":2818,"marks":2819,"value":2820,"nodeType":865},{},[],"workers.dev",{"data":2822,"content":2823,"nodeType":2032},{},[2824,2834],{"data":2825,"content":2826,"nodeType":2021},{},[2827],{"data":2828,"content":2829,"nodeType":881},{},[2830],{"data":2831,"marks":2832,"value":2046,"nodeType":865},{},[2833],{"type":902},{"data":2835,"content":2836,"nodeType":2021},{},[2837,2848],{"data":2838,"content":2839,"nodeType":881},{},[2840,2844],{"data":2841,"marks":2842,"value":2523,"nodeType":865},{},[2843],{"type":902},{"data":2845,"marks":2846,"value":2847,"nodeType":865},{},[],"192.3.225.100 (HostPapa / ColoCrossing AS36352)",{"data":2849,"content":2850,"nodeType":881},{},[2851,2855,2858,2863],{"data":2852,"marks":2853,"value":2087,"nodeType":865},{},[2854],{"type":902},{"data":2856,"marks":2857,"value":2091,"nodeType":865},{},[],{"data":2859,"marks":2860,"value":2862,"nodeType":865},{},[2861],{"type":902}," ",{"data":2864,"marks":2865,"value":2866,"nodeType":865},{},[],"python-httpx/0.28.1",{"data":2868,"content":2869,"nodeType":2032},{},[2870,2880],{"data":2871,"content":2872,"nodeType":2021},{},[2873],{"data":2874,"content":2875,"nodeType":881},{},[2876],{"data":2877,"marks":2878,"value":2130,"nodeType":865},{},[2879],{"type":902},{"data":2881,"content":2882,"nodeType":2021},{},[2883],{"data":2884,"content":2885,"nodeType":881},{},[2886],{"data":2887,"marks":2888,"value":2889,"nodeType":865},{},[],"GET /landing/api/session-status?session_id=&token=",{"data":2891,"content":2892,"nodeType":2032},{},[2893,2903],{"data":2894,"content":2895,"nodeType":2021},{},[2896],{"data":2897,"content":2898,"nodeType":881},{},[2899],{"data":2900,"marks":2901,"value":2182,"nodeType":865},{},[2902],{"type":902},{"data":2904,"content":2905,"nodeType":2021},{},[2906],{"data":2907,"content":2908,"nodeType":881},{},[2909],{"data":2910,"marks":2911,"value":2912,"nodeType":865},{},[],"Adobe Acrobat document sharing (PDF preview, sender avatar)",{"data":2914,"content":2915,"nodeType":2032},{},[2916,2926],{"data":2917,"content":2918,"nodeType":2021},{},[2919],{"data":2920,"content":2921,"nodeType":881},{},[2922],{"data":2923,"marks":2924,"value":2406,"nodeType":865},{},[2925],{"type":902},{"data":2927,"content":2928,"nodeType":2021},{},[2929],{"data":2930,"content":2931,"nodeType":881},{},[2932],{"data":2933,"marks":2934,"value":2935,"nodeType":865},{},[],"milosh-solibella-0dcio[.]sgttommy.workers.dev",{"data":2937,"content":2941,"nodeType":890},{"target":2938},{"sys":2939},{"id":2940,"type":887,"linkType":888},"6szO6IKJ32usyxIKX1efZy",[],{"data":2943,"content":2947,"nodeType":890},{"target":2944},{"sys":2945},{"id":2946,"type":887,"linkType":888},"lEqV3RTMIY8y011lnhX7P",[],{"data":2949,"content":2950,"nodeType":894},{},[],{"data":2952,"content":2953,"nodeType":1860},{},[2954],{"data":2955,"marks":2956,"value":2958,"nodeType":865},{},[2957],{"type":902},"“DOCUPOLL”",{"data":2960,"content":2961,"nodeType":2270},{},[2962,2985,3023,3060,3083],{"data":2963,"content":2964,"nodeType":2032},{},[2965,2975],{"data":2966,"content":2967,"nodeType":2021},{},[2968],{"data":2969,"content":2970,"nodeType":881},{},[2971],{"data":2972,"marks":2973,"value":2020,"nodeType":865},{},[2974],{"type":902},{"data":2976,"content":2977,"nodeType":2021},{},[2978],{"data":2979,"content":2980,"nodeType":881},{},[2981],{"data":2982,"marks":2983,"value":2984,"nodeType":865},{},[],"Github.io and workers.dev hosting",{"data":2986,"content":2987,"nodeType":2032},{},[2988,2998],{"data":2989,"content":2990,"nodeType":2021},{},[2991],{"data":2992,"content":2993,"nodeType":881},{},[2994],{"data":2995,"marks":2996,"value":2046,"nodeType":865},{},[2997],{"type":902},{"data":2999,"content":3000,"nodeType":2021},{},[3001,3012],{"data":3002,"content":3003,"nodeType":881},{},[3004,3008],{"data":3005,"marks":3006,"value":2523,"nodeType":865},{},[3007],{"type":902},{"data":3009,"marks":3010,"value":3011,"nodeType":865},{},[],"144.172.103.240 (FranTech Solutions / RouterHosting / Cloudzy AS14956)",{"data":3013,"content":3014,"nodeType":881},{},[3015,3019],{"data":3016,"marks":3017,"value":2087,"nodeType":865},{},[3018],{"type":902},{"data":3020,"marks":3021,"value":3022,"nodeType":865},{},[]," Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19042",{"data":3024,"content":3025,"nodeType":2032},{},[3026,3036],{"data":3027,"content":3028,"nodeType":2021},{},[3029],{"data":3030,"content":3031,"nodeType":881},{},[3032],{"data":3033,"marks":3034,"value":2130,"nodeType":865},{},[3035],{"type":902},{"data":3037,"content":3038,"nodeType":2021},{},[3039,3046,3053],{"data":3040,"content":3041,"nodeType":881},{},[3042],{"data":3043,"marks":3044,"value":3045,"nodeType":865},{},[],"POST /api/v1/landing-pages/public/{slug}/init",{"data":3047,"content":3048,"nodeType":881},{},[3049],{"data":3050,"marks":3051,"value":3052,"nodeType":865},{},[],"POST .../poll",{"data":3054,"content":3055,"nodeType":881},{},[3056],{"data":3057,"marks":3058,"value":3059,"nodeType":865},{},[],"POST .../track",{"data":3061,"content":3062,"nodeType":2032},{},[3063,3073],{"data":3064,"content":3065,"nodeType":2021},{},[3066],{"data":3067,"content":3068,"nodeType":881},{},[3069],{"data":3070,"marks":3071,"value":2182,"nodeType":865},{},[3072],{"type":902},{"data":3074,"content":3075,"nodeType":2021},{},[3076],{"data":3077,"content":3078,"nodeType":881},{},[3079],{"data":3080,"marks":3081,"value":3082,"nodeType":865},{},[],"DocuSign document signing. One sample is a full scrape of real docusign.com (free-account page) with kit injected.",{"data":3084,"content":3085,"nodeType":2032},{},[3086,3096],{"data":3087,"content":3088,"nodeType":2021},{},[3089],{"data":3090,"content":3091,"nodeType":881},{},[3092],{"data":3093,"marks":3094,"value":2406,"nodeType":865},{},[3095],{"type":902},{"data":3097,"content":3098,"nodeType":2021},{},[3099],{"data":3100,"content":3101,"nodeType":881},{},[3102],{"data":3103,"marks":3104,"value":3105,"nodeType":865},{},[],"docufirmar[.]github.io",{"data":3107,"content":3111,"nodeType":890},{"target":3108},{"sys":3109},{"id":3110,"type":887,"linkType":888},"6Y1XABHnQD82R3MW80HnQZ",[],{"data":3113,"content":3114,"nodeType":894},{},[],{"data":3116,"content":3117,"nodeType":1860},{},[3118],{"data":3119,"marks":3120,"value":3122,"nodeType":865},{},[3121],{"type":902},"“FLOW_TOKEN”",{"data":3124,"content":3125,"nodeType":2270},{},[3126,3148,3193,3223,3246],{"data":3127,"content":3128,"nodeType":2032},{},[3129,3139],{"data":3130,"content":3131,"nodeType":2021},{},[3132],{"data":3133,"content":3134,"nodeType":881},{},[3135],{"data":3136,"marks":3137,"value":2020,"nodeType":865},{},[3138],{"type":902},{"data":3140,"content":3141,"nodeType":2021},{},[3142],{"data":3143,"content":3144,"nodeType":881},{},[3145],{"data":3146,"marks":3147,"value":2820,"nodeType":865},{},[],{"data":3149,"content":3150,"nodeType":2032},{},[3151,3161],{"data":3152,"content":3153,"nodeType":2021},{},[3154],{"data":3155,"content":3156,"nodeType":881},{},[3157],{"data":3158,"marks":3159,"value":2046,"nodeType":865},{},[3160],{"type":902},{"data":3162,"content":3163,"nodeType":2021},{},[3164,3175],{"data":3165,"content":3166,"nodeType":881},{},[3167,3171],{"data":3168,"marks":3169,"value":2523,"nodeType":865},{},[3170],{"type":902},{"data":3172,"marks":3173,"value":3174,"nodeType":865},{},[],"43.166.163.163 (Tencent Cloud AS132203)",{"data":3176,"content":3177,"nodeType":881},{},[3178,3182,3185,3189],{"data":3179,"marks":3180,"value":2087,"nodeType":865},{},[3181],{"type":902},{"data":3183,"marks":3184,"value":2091,"nodeType":865},{},[],{"data":3186,"marks":3187,"value":2862,"nodeType":865},{},[3188],{"type":902},{"data":3190,"marks":3191,"value":3192,"nodeType":865},{},[],"(null)",{"data":3194,"content":3195,"nodeType":2032},{},[3196,3206],{"data":3197,"content":3198,"nodeType":2021},{},[3199],{"data":3200,"content":3201,"nodeType":881},{},[3202],{"data":3203,"marks":3204,"value":2130,"nodeType":865},{},[3205],{"type":902},{"data":3207,"content":3208,"nodeType":2021},{},[3209,3216],{"data":3210,"content":3211,"nodeType":881},{},[3212],{"data":3213,"marks":3214,"value":3215,"nodeType":865},{},[],"POST /api/handler.php ",{"data":3217,"content":3218,"nodeType":881},{},[3219],{"data":3220,"marks":3221,"value":3222,"nodeType":865},{},[],"(actions: device_code_generate, device_code_poll_public)",{"data":3224,"content":3225,"nodeType":2032},{},[3226,3236],{"data":3227,"content":3228,"nodeType":2021},{},[3229],{"data":3230,"content":3231,"nodeType":881},{},[3232],{"data":3233,"marks":3234,"value":2182,"nodeType":865},{},[3235],{"type":902},{"data":3237,"content":3238,"nodeType":2021},{},[3239],{"data":3240,"content":3241,"nodeType":881},{},[3242],{"data":3243,"marks":3244,"value":3245,"nodeType":865},{},[],"DocuSign \"Salary Adjustment Document — 2026\", Microsoft banner · HR Department sender",{"data":3247,"content":3248,"nodeType":2032},{},[3249,3259],{"data":3250,"content":3251,"nodeType":2021},{},[3252],{"data":3253,"content":3254,"nodeType":881},{},[3255],{"data":3256,"marks":3257,"value":2406,"nodeType":865},{},[3258],{"type":902},{"data":3260,"content":3261,"nodeType":2021},{},[3262],{"data":3263,"content":3264,"nodeType":881},{},[3265],{"data":3266,"marks":3267,"value":3268,"nodeType":865},{},[],"salaryadjustment-2afb52.pmb6fefc52b3f9aa5c2dbf[.]workers.dev",{"data":3270,"content":3274,"nodeType":890},{"target":3271},{"sys":3272},{"id":3273,"type":887,"linkType":888},"6xiTDHStbiJh7LMhjAZcPd",[],{"data":3276,"content":3277,"nodeType":894},{},[],{"data":3279,"content":3280,"nodeType":1860},{},[3281],{"data":3282,"marks":3283,"value":3285,"nodeType":865},{},[3284],{"type":902},"“PAPRIKA”",{"data":3287,"content":3288,"nodeType":2270},{},[3289,3312,3335,3358],{"data":3290,"content":3291,"nodeType":2032},{},[3292,3302],{"data":3293,"content":3294,"nodeType":2021},{},[3295],{"data":3296,"content":3297,"nodeType":881},{},[3298],{"data":3299,"marks":3300,"value":2020,"nodeType":865},{},[3301],{"type":902},{"data":3303,"content":3304,"nodeType":2021},{},[3305],{"data":3306,"content":3307,"nodeType":881},{},[3308],{"data":3309,"marks":3310,"value":3311,"nodeType":865},{},[],"AWS S3 hosting",{"data":3313,"content":3314,"nodeType":2032},{},[3315,3325],{"data":3316,"content":3317,"nodeType":2021},{},[3318],{"data":3319,"content":3320,"nodeType":881},{},[3321],{"data":3322,"marks":3323,"value":2130,"nodeType":865},{},[3324],{"type":902},{"data":3326,"content":3327,"nodeType":2021},{},[3328],{"data":3329,"content":3330,"nodeType":881},{},[3331],{"data":3332,"marks":3333,"value":3334,"nodeType":865},{},[],"POST /api/v1/loader",{"data":3336,"content":3337,"nodeType":2032},{},[3338,3348],{"data":3339,"content":3340,"nodeType":2021},{},[3341],{"data":3342,"content":3343,"nodeType":881},{},[3344],{"data":3345,"marks":3346,"value":2182,"nodeType":865},{},[3347],{"type":902},{"data":3349,"content":3350,"nodeType":2021},{},[3351],{"data":3352,"content":3353,"nodeType":881},{},[3354],{"data":3355,"marks":3356,"value":3357,"nodeType":865},{},[],"MS login clone (\"Sign in to your account\"), \"Office 365\" branding, fake \"Powered by Okta\" footer",{"data":3359,"content":3360,"nodeType":2032},{},[3361,3371],{"data":3362,"content":3363,"nodeType":2021},{},[3364],{"data":3365,"content":3366,"nodeType":881},{},[3367],{"data":3368,"marks":3369,"value":2406,"nodeType":865},{},[3370],{"type":902},{"data":3372,"content":3373,"nodeType":2021},{},[3374],{"data":3375,"content":3376,"nodeType":881},{},[3377],{"data":3378,"marks":3379,"value":3380,"nodeType":865},{},[],"redirect-523346-d95027ec[.]s3.amazonaws.com",{"data":3382,"content":3386,"nodeType":890},{"target":3383},{"sys":3384},{"id":3385,"type":887,"linkType":888},"6WFXqUDzcJHKWSwVIcDZAf",[],{"data":3388,"content":3389,"nodeType":894},{},[],{"data":3391,"content":3392,"nodeType":1860},{},[3393],{"data":3394,"marks":3395,"value":3397,"nodeType":865},{},[3396],{"type":902},"“DCSTATUS”",{"data":3399,"content":3400,"nodeType":2270},{},[3401,3423,3446,3469],{"data":3402,"content":3403,"nodeType":2032},{},[3404,3414],{"data":3405,"content":3406,"nodeType":2021},{},[3407],{"data":3408,"content":3409,"nodeType":881},{},[3410],{"data":3411,"marks":3412,"value":2020,"nodeType":865},{},[3413],{"type":902},{"data":3415,"content":3416,"nodeType":2021},{},[3417],{"data":3418,"content":3419,"nodeType":881},{},[3420],{"data":3421,"marks":3422,"value":2307,"nodeType":865},{},[],{"data":3424,"content":3425,"nodeType":2032},{},[3426,3436],{"data":3427,"content":3428,"nodeType":2021},{},[3429],{"data":3430,"content":3431,"nodeType":881},{},[3432],{"data":3433,"marks":3434,"value":2130,"nodeType":865},{},[3435],{"type":902},{"data":3437,"content":3438,"nodeType":2021},{},[3439],{"data":3440,"content":3441,"nodeType":881},{},[3442],{"data":3443,"marks":3444,"value":3445,"nodeType":865},{},[],"GET /dc/status/{base64url_sid}",{"data":3447,"content":3448,"nodeType":2032},{},[3449,3459],{"data":3450,"content":3451,"nodeType":2021},{},[3452],{"data":3453,"content":3454,"nodeType":881},{},[3455],{"data":3456,"marks":3457,"value":2182,"nodeType":865},{},[3458],{"type":902},{"data":3460,"content":3461,"nodeType":2021},{},[3462],{"data":3463,"content":3464,"nodeType":881},{},[3465],{"data":3466,"marks":3467,"value":3468,"nodeType":865},{},[],"Generic \"Microsoft 365 - Secure Access\" verification page",{"data":3470,"content":3471,"nodeType":2032},{},[3472,3482],{"data":3473,"content":3474,"nodeType":2021},{},[3475],{"data":3476,"content":3477,"nodeType":881},{},[3478],{"data":3479,"marks":3480,"value":2406,"nodeType":865},{},[3481],{"type":902},{"data":3483,"content":3484,"nodeType":2021},{},[3485],{"data":3486,"content":3487,"nodeType":881},{},[3488],{"data":3489,"marks":3490,"value":3491,"nodeType":865},{},[],"owa[.]apmmacleans[.]ca",{"data":3493,"content":3497,"nodeType":890},{"target":3494},{"sys":3495},{"id":3496,"type":887,"linkType":888},"ugYhHeXY1lQdKooALmrIs",[],{"data":3499,"content":3500,"nodeType":894},{},[],{"data":3502,"content":3503,"nodeType":1860},{},[3504],{"data":3505,"marks":3506,"value":3508,"nodeType":865},{},[3507],{"type":902},"“DOLCE”",{"data":3510,"content":3514,"nodeType":890},{"target":3511},{"sys":3512},{"id":3513,"type":887,"linkType":888},"7TzU6kk01Un45NB0buEz2",[],{"data":3516,"content":3517,"nodeType":2270},{},[3518,3541,3579,3602,3625],{"data":3519,"content":3520,"nodeType":2032},{},[3521,3531],{"data":3522,"content":3523,"nodeType":2021},{},[3524],{"data":3525,"content":3526,"nodeType":881},{},[3527],{"data":3528,"marks":3529,"value":2020,"nodeType":865},{},[3530],{"type":902},{"data":3532,"content":3533,"nodeType":2021},{},[3534],{"data":3535,"content":3536,"nodeType":881},{},[3537],{"data":3538,"marks":3539,"value":3540,"nodeType":865},{},[],"Microsoft PowerApps hosting",{"data":3542,"content":3543,"nodeType":2032},{},[3544,3554],{"data":3545,"content":3546,"nodeType":2021},{},[3547],{"data":3548,"content":3549,"nodeType":881},{},[3550],{"data":3551,"marks":3552,"value":2046,"nodeType":865},{},[3553],{"type":902},{"data":3555,"content":3556,"nodeType":2021},{},[3557,3568],{"data":3558,"content":3559,"nodeType":881},{},[3560,3564],{"data":3561,"marks":3562,"value":2523,"nodeType":865},{},[3563],{"type":902},{"data":3565,"marks":3566,"value":3567,"nodeType":865},{},[],"34.53.159.84 (Google Cloud AS396982)",{"data":3569,"content":3570,"nodeType":881},{},[3571,3575],{"data":3572,"marks":3573,"value":2087,"nodeType":865},{},[3574],{"type":902},{"data":3576,"marks":3577,"value":3578,"nodeType":865},{},[]," Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36",{"data":3580,"content":3581,"nodeType":2032},{},[3582,3592],{"data":3583,"content":3584,"nodeType":2021},{},[3585],{"data":3586,"content":3587,"nodeType":881},{},[3588],{"data":3589,"marks":3590,"value":2130,"nodeType":865},{},[3591],{"type":902},{"data":3593,"content":3594,"nodeType":2021},{},[3595],{"data":3596,"content":3597,"nodeType":881},{},[3598],{"data":3599,"marks":3600,"value":3601,"nodeType":865},{},[],"GET /api/generatecode (CloudFront)",{"data":3603,"content":3604,"nodeType":2032},{},[3605,3615],{"data":3606,"content":3607,"nodeType":2021},{},[3608],{"data":3609,"content":3610,"nodeType":881},{},[3611],{"data":3612,"marks":3613,"value":2182,"nodeType":865},{},[3614],{"type":902},{"data":3616,"content":3617,"nodeType":2021},{},[3618],{"data":3619,"content":3620,"nodeType":881},{},[3621],{"data":3622,"marks":3623,"value":3624,"nodeType":865},{},[],"Dolce & Gabbana branded, Italian language, MS account verification",{"data":3626,"content":3627,"nodeType":2032},{},[3628,3638],{"data":3629,"content":3630,"nodeType":2021},{},[3631],{"data":3632,"content":3633,"nodeType":881},{},[3634],{"data":3635,"marks":3636,"value":2406,"nodeType":865},{},[3637],{"type":902},{"data":3639,"content":3640,"nodeType":2021},{},[3641],{"data":3642,"content":3643,"nodeType":881},{},[3644],{"data":3645,"marks":3646,"value":3647,"nodeType":865},{},[],"data-migration-dolcegabbana[.]powerappsportals.com",{"data":3649,"content":3653,"nodeType":890},{"target":3650},{"sys":3651},{"id":3652,"type":887,"linkType":888},"4ayQDvpf5NNOBrj9wZZRiO",[],{"data":3655,"content":3656,"nodeType":894},{},[],{"data":3658,"content":3659,"nodeType":1860},{},[3660],{"data":3661,"marks":3662,"value":3664,"nodeType":865},{},[3663],{"type":902},"Venom",{"data":3666,"content":3667,"nodeType":2270},{},[3668,3691],{"data":3669,"content":3670,"nodeType":2032},{},[3671,3681],{"data":3672,"content":3673,"nodeType":2021},{},[3674],{"data":3675,"content":3676,"nodeType":881},{},[3677],{"data":3678,"marks":3679,"value":2130,"nodeType":865},{},[3680],{"type":902},{"data":3682,"content":3683,"nodeType":2021},{},[3684],{"data":3685,"content":3686,"nodeType":881},{},[3687],{"data":3688,"marks":3689,"value":3690,"nodeType":865},{},[],"POST /token/api/device/start\nGET /token/api/device/status/{sessionId}",{"data":3692,"content":3693,"nodeType":2032},{},[3694,3704],{"data":3695,"content":3696,"nodeType":2021},{},[3697],{"data":3698,"content":3699,"nodeType":881},{},[3700],{"data":3701,"marks":3702,"value":2182,"nodeType":865},{},[3703],{"type":902},{"data":3705,"content":3706,"nodeType":2021},{},[3707],{"data":3708,"content":3709,"nodeType":881},{},[3710],{"data":3711,"marks":3712,"value":3713,"nodeType":865},{},[],"Various: examples include DocuSign \"Verification\" (Microsoft sign-in pretext); DHL \"Delivery Checkpoint\" package shipment pretext",{"data":3715,"content":3719,"nodeType":890},{"target":3716},{"sys":3717},{"id":3718,"type":887,"linkType":888},"79C3fces0hgTdf3G68cIrf",[],{"data":3721,"content":3722,"nodeType":894},{},[],{"data":3724,"content":3725,"nodeType":1860},{},[3726],{"data":3727,"marks":3728,"value":3730,"nodeType":865},{},[3729],{"type":902},"Tycoon2FA",{"data":3732,"content":3733,"nodeType":2270},{},[3734,3764,3801,3824,3847],{"data":3735,"content":3736,"nodeType":2032},{},[3737,3747],{"data":3738,"content":3739,"nodeType":2021},{},[3740],{"data":3741,"content":3742,"nodeType":881},{},[3743],{"data":3744,"marks":3745,"value":2020,"nodeType":865},{},[3746],{"type":902},{"data":3748,"content":3749,"nodeType":2021},{},[3750,3757],{"data":3751,"content":3752,"nodeType":881},{},[3753],{"data":3754,"marks":3755,"value":3756,"nodeType":865},{},[],"Github.io and Cloudflare Workers (workers.dev) hosting",{"data":3758,"content":3759,"nodeType":881},{},[3760],{"data":3761,"marks":3762,"value":3763,"nodeType":865},{},[],"Compromised-site landing pages and CF Workers (*.workers.dev) used as frontends; victim email passed in URL as last path segment ($base64) or ?acct/?encoded query",{"data":3765,"content":3766,"nodeType":2032},{},[3767,3777],{"data":3768,"content":3769,"nodeType":2021},{},[3770],{"data":3771,"content":3772,"nodeType":881},{},[3773],{"data":3774,"marks":3775,"value":2046,"nodeType":865},{},[3776],{"type":902},{"data":3778,"content":3779,"nodeType":2021},{},[3780,3791],{"data":3781,"content":3782,"nodeType":881},{},[3783,3787],{"data":3784,"marks":3785,"value":2523,"nodeType":865},{},[3786],{"type":902},{"data":3788,"marks":3789,"value":3790,"nodeType":865},{},[],"47.253.5.88 (Alibaba Cloud)",{"data":3792,"content":3793,"nodeType":881},{},[3794,3798],{"data":3795,"marks":3796,"value":2087,"nodeType":865},{},[3797],{"type":902},{"data":3799,"marks":3800,"value":2346,"nodeType":865},{},[],{"data":3802,"content":3803,"nodeType":2032},{},[3804,3814],{"data":3805,"content":3806,"nodeType":2021},{},[3807],{"data":3808,"content":3809,"nodeType":881},{},[3810],{"data":3811,"marks":3812,"value":2130,"nodeType":865},{},[3813],{"type":902},{"data":3815,"content":3816,"nodeType":2021},{},[3817],{"data":3818,"content":3819,"nodeType":881},{},[3820],{"data":3821,"marks":3822,"value":3823,"nodeType":865},{},[],"GET /api/session/{UUIDv4} polled with header X-API-Key: \u003Cprefix>_\u003C64-hex> (key materialised at runtime via atob(window.__cyb3r.k)) \nPOST /api/device-code with body {\"prt_foci_session_id\": \"\u003CUUID>\"} (second-stage code retrieval after initial session error)",{"data":3825,"content":3826,"nodeType":2032},{},[3827,3837],{"data":3828,"content":3829,"nodeType":2021},{},[3830],{"data":3831,"content":3832,"nodeType":881},{},[3833],{"data":3834,"marks":3835,"value":2182,"nodeType":865},{},[3836],{"type":902},{"data":3838,"content":3839,"nodeType":2021},{},[3840],{"data":3841,"content":3842,"nodeType":881},{},[3843],{"data":3844,"marks":3845,"value":3846,"nodeType":865},{},[],"Various: SharePoint \"Remittance Advice\"; Microsoft 365 generic sign-in; Microsoft 365 Voicemail (.mp3 attachment); OneDrive \"Shared file\"; German \"Sicheres Dokumentenportal\" PDF lure",{"data":3848,"content":3849,"nodeType":2032},{},[3850,3860],{"data":3851,"content":3852,"nodeType":2021},{},[3853],{"data":3854,"content":3855,"nodeType":881},{},[3856],{"data":3857,"marks":3858,"value":2406,"nodeType":865},{},[3859],{"type":902},{"data":3861,"content":3862,"nodeType":2021},{},[3863],{"data":3864,"content":3865,"nodeType":881},{},[3866],{"data":3867,"marks":3868,"value":3869,"nodeType":865},{},[],"afriqbeauglobal[.]com/homepage/index[.]html",{"data":3871,"content":3875,"nodeType":890},{"target":3872},{"sys":3873},{"id":3874,"type":887,"linkType":888},"3UDzUCCizPJhXp3SsoZuSK",[],{"data":3877,"content":3878,"nodeType":894},{},[],{"data":3880,"content":3881,"nodeType":1860},{},[3882],{"data":3883,"marks":3884,"value":3886,"nodeType":865},{},[3885],{"type":902},"\"CYB3R\"",{"data":3888,"content":3889,"nodeType":2270},{},[3890,3913,3951,3973,3996],{"data":3891,"content":3892,"nodeType":2032},{},[3893,3903],{"data":3894,"content":3895,"nodeType":2021},{},[3896],{"data":3897,"content":3898,"nodeType":881},{},[3899],{"data":3900,"marks":3901,"value":2020,"nodeType":865},{},[3902],{"type":902},{"data":3904,"content":3905,"nodeType":2021},{},[3906],{"data":3907,"content":3908,"nodeType":881},{},[3909],{"data":3910,"marks":3911,"value":3912,"nodeType":865},{},[],"Cloudflare Workers (workers.dev) hosting",{"data":3914,"content":3915,"nodeType":2032},{},[3916,3926],{"data":3917,"content":3918,"nodeType":2021},{},[3919],{"data":3920,"content":3921,"nodeType":881},{},[3922],{"data":3923,"marks":3924,"value":2046,"nodeType":865},{},[3925],{"type":902},{"data":3927,"content":3928,"nodeType":2021},{},[3929,3940],{"data":3930,"content":3931,"nodeType":881},{},[3932,3936],{"data":3933,"marks":3934,"value":2523,"nodeType":865},{},[3935],{"type":902},{"data":3937,"marks":3938,"value":3939,"nodeType":865},{},[],"2400:8d60:2::1:c116:843e (Evoxt VPS)",{"data":3941,"content":3942,"nodeType":881},{},[3943,3947],{"data":3944,"marks":3945,"value":2087,"nodeType":865},{},[3946],{"type":902},{"data":3948,"marks":3949,"value":3950,"nodeType":865},{},[]," axios/1.13.6",{"data":3952,"content":3953,"nodeType":2032},{},[3954,3964],{"data":3955,"content":3956,"nodeType":2021},{},[3957],{"data":3958,"content":3959,"nodeType":881},{},[3960],{"data":3961,"marks":3962,"value":2130,"nodeType":865},{},[3963],{"type":902},{"data":3965,"content":3966,"nodeType":2021},{},[3967],{"data":3968,"content":3969,"nodeType":881},{},[3970],{"data":3971,"marks":3972,"value":3823,"nodeType":865},{},[],{"data":3974,"content":3975,"nodeType":2032},{},[3976,3986],{"data":3977,"content":3978,"nodeType":2021},{},[3979],{"data":3980,"content":3981,"nodeType":881},{},[3982],{"data":3983,"marks":3984,"value":2182,"nodeType":865},{},[3985],{"type":902},{"data":3987,"content":3988,"nodeType":2021},{},[3989],{"data":3990,"content":3991,"nodeType":881},{},[3992],{"data":3993,"marks":3994,"value":3995,"nodeType":865},{},[],"DocuSign in Spanish (\"Documento Firmar — COTIZACIÓN/ESTIMACIÓN.pdf\", \"Complete su firma\", \"Verifique su identidad\", \"Continuar a Microsoft\").",{"data":3997,"content":3998,"nodeType":2032},{},[3999,4009],{"data":4000,"content":4001,"nodeType":2021},{},[4002],{"data":4003,"content":4004,"nodeType":881},{},[4005],{"data":4006,"marks":4007,"value":2406,"nodeType":865},{},[4008],{"type":902},{"data":4010,"content":4011,"nodeType":2021},{},[4012],{"data":4013,"content":4014,"nodeType":881},{},[4015],{"data":4016,"marks":4017,"value":4018,"nodeType":865},{},[],"muzagestion[.]secure-share[.]workers.dev",{"data":4020,"content":4024,"nodeType":890},{"target":4021},{"sys":4022},{"id":4023,"type":887,"linkType":888},"5EU0QNteiQcYybKG1W1cS3",[],{"data":4026,"content":4027,"nodeType":894},{},[],{"data":4029,"content":4030,"nodeType":904},{},[4031],{"data":4032,"marks":4033,"value":4035,"nodeType":865},{},[4034],{"type":902},"Device code phishing under the hood",{"data":4037,"content":4038,"nodeType":881},{},[4039,4043],{"data":4040,"marks":4041,"value":4042,"nodeType":865},{},[],"The attacker POSTs to the authorization server's device authorization endpoint with its client_id (i.e. an application ID) and requested scopes or resources. The server responds with a device_code (used for polling), a user_code, a verification_uri, an expires_in value, and a polling interval. The user visits the URL, enters the code and approves the request. Meanwhile, the device polls the token endpoint. Once approved, the server returns an access token, a refresh token (if offline_access was requested), and an ID token (if openid was included). ",{"data":4044,"marks":4045,"value":4047,"nodeType":865},{},[4046],{"type":902},"The attacker now has API access to the victim's account. ",{"data":4049,"content":4050,"nodeType":881},{},[4051],{"data":4052,"marks":4053,"value":4054,"nodeType":865},{},[],"Broadly, this gives the attacker a comparable level of control to a “normal” phishing attack (with conditions based on the scopes granted and specific app being targeted) while API access grants additional capabilities beyond standard browser sessions. When combined with other techniques, this access can be exchanged to open normal browser app sessions and access SSO connected apps.",{"data":4056,"content":4060,"nodeType":890},{"target":4057},{"sys":4058},{"id":4059,"type":887,"linkType":888},"4WtQR2xsE236yoyhSXj58Z",[],{"data":4062,"content":4066,"nodeType":890},{"target":4063},{"sys":4064},{"id":4065,"type":887,"linkType":888},"1x7Lip7JdY2xlHKKurT7qJ",[],{"data":4068,"content":4069,"nodeType":881},{},[4070],{"data":4071,"marks":4072,"value":4073,"nodeType":865},{},[],"At this point, you can achieve a number of objectives both inside the app ecosystem and across SSO connected apps — e.g. data theft, disruption, and ultimately extortion.",{"data":4075,"content":4076,"nodeType":881},{},[4077,4081,4086,4090],{"data":4078,"marks":4079,"value":4080,"nodeType":865},{},[],"Critically, the initial request to generate a device code is typically ",{"data":4082,"marks":4083,"value":4085,"nodeType":865},{},[4084],{"type":902},"unauthenticated",{"data":4087,"marks":4088,"value":4089,"nodeType":865},{},[]," across all providers — ",{"data":4091,"marks":4092,"value":4094,"nodeType":865},{},[4093],{"type":902},"anyone can generate one, from any machine, without proving any relationship to the target organization.",{"data":4096,"content":4097,"nodeType":881},{},[4098,4102,4107],{"data":4099,"marks":4100,"value":4101,"nodeType":865},{},[],"So, the attacker has to deliver a set of instructions via a phishing channel (e.g. email, social media DM, corp IM platform, and so on) with a device code that they have generated. The victim then enters this code on the ",{"data":4103,"marks":4104,"value":4106,"nodeType":865},{},[4105],{"type":902},"legitimate device code login page",{"data":4108,"marks":4109,"value":4110,"nodeType":865},{},[]," for that app and issues the tokens to the attacker.",{"data":4112,"content":4116,"nodeType":890},{"target":4113},{"sys":4114},{"id":4115,"type":887,"linkType":888},"1txUYuQjH9FlbDGTo8AbZB",[],{"data":4118,"content":4119,"nodeType":894},{},[],{"data":4121,"content":4122,"nodeType":904},{},[4123],{"data":4124,"marks":4125,"value":4127,"nodeType":865},{},[4126],{"type":902},"Why device code phishing is so dangerous",{"data":4129,"content":4130,"nodeType":1860},{},[4131],{"data":4132,"marks":4133,"value":4135,"nodeType":865},{},[4134],{"type":902},"Device code phishing bypasses authentication controls (including passkeys)",{"data":4137,"content":4138,"nodeType":881},{},[4139,4143,4148,4152],{"data":4140,"marks":4141,"value":4142,"nodeType":865},{},[],"A device code phishing attack ",{"data":4144,"marks":4145,"value":4147,"nodeType":865},{},[4146],{"type":902},"cannot be prevented with authentication controls",{"data":4149,"marks":4150,"value":4151,"nodeType":865},{},[],". This includes all forms of MFA and ",{"data":4153,"marks":4154,"value":4156,"nodeType":865},{},[4155],{"type":902},"even “phishing-resistant” authentication methods such as passkeys. ",{"data":4158,"content":4159,"nodeType":881},{},[4160,4165,4169,4174],{"data":4161,"marks":4162,"value":4164,"nodeType":865},{},[4163],{"type":902},"The device code authorization is effectively performed post-authentication. ",{"data":4166,"marks":4167,"value":4168,"nodeType":865},{},[],"If you already have an active session in your browser, entering the device code and selecting your account from a drop-down menu is all that's needed. ",{"data":4170,"marks":4171,"value":4173,"nodeType":865},{},[4172],{"type":902},"No password or MFA required. ",{"data":4175,"marks":4176,"value":4177,"nodeType":865},{},[],"You can see an example in the video below.",{"data":4179,"content":4182,"nodeType":890},{"target":4180},{"sys":4181},{"id":3110,"type":887,"linkType":888},[],{"data":4184,"content":4185,"nodeType":881},{},[4186],{"data":4187,"marks":4188,"value":4189,"nodeType":865},{},[],"Even if you do have to sign in again (because you're not already signed in for some reason), the attack still works because it isn't targeting the login — it's targeting the authorization layer instead.",{"data":4191,"content":4192,"nodeType":881},{},[4193],{"data":4194,"marks":4195,"value":4196,"nodeType":865},{},[],"This is what makes device code phishing different to other standard phishing methods like AiTM phishing (and arguably even more effective in environments with strict identity control enforcement). ",{"data":4198,"content":4199,"nodeType":1860},{},[4200],{"data":4201,"marks":4202,"value":4204,"nodeType":865},{},[4203],{"type":902},"Device code logins are a feature, not a vulnerability, making attacks difficult to block",{"data":4206,"content":4207,"nodeType":881},{},[4208],{"data":4209,"marks":4210,"value":4211,"nodeType":865},{},[],"Device code authorization is a legitimate mechanism regularly used in enterprise environments, particularly for CLI logins. Tools like Azure CLI, GitHub CLI, and AWS CLI all use (or have used) the device code flow as a primary or fallback authentication method. This creates a dual problem for defenders. ",{"data":4213,"content":4214,"nodeType":881},{},[4215],{"data":4216,"marks":4217,"value":4218,"nodeType":865},{},[],"First, the phishing attack happens entirely on a legitimate site — there's no fake login page, no malicious payload to scan for, and the URL in the browser is genuine. Since there's no traditional phishing content being delivered, these attacks are more resistant to detection by email and network security tools.",{"data":4220,"content":4221,"nodeType":881},{},[4222],{"data":4223,"marks":4224,"value":4225,"nodeType":865},{},[],"Second, the widespread legitimate use of device code flow — particularly among developers and technical users — normalizes the experience of entering device codes. A phishing lure asking them to do the same thing is indistinguishable from a legitimate IT request. And for non-technical users, this experience isn't much different to, for example, entering a code sent via email or authenticator app. ",{"data":4227,"content":4228,"nodeType":1860},{},[4229],{"data":4230,"marks":4231,"value":4233,"nodeType":865},{},[4232],{"type":902},"Multiple apps are vulnerable, with different risk profiles",{"data":4235,"content":4236,"nodeType":881},{},[4237],{"data":4238,"marks":4239,"value":4240,"nodeType":865},{},[],"Various apps implement the device code flow, each with different levels of control and default security, but the risk is not uniform across platforms. ",{"data":4242,"content":4243,"nodeType":1818},{},[4244,4259,4273],{"data":4245,"content":4246,"nodeType":1734},{},[4247],{"data":4248,"content":4249,"nodeType":881},{},[4250,4255],{"data":4251,"marks":4252,"value":4254,"nodeType":865},{},[4253],{"type":902},"Google Workspace ",{"data":4256,"marks":4257,"value":4258,"nodeType":865},{},[],"is a significantly lower-risk target because Google explicitly limits which scopes are available to the device code flow — Gmail, Calendar, and most Workspace APIs are simply unavailable through this mechanism. ",{"data":4260,"content":4261,"nodeType":1734},{},[4262],{"data":4263,"content":4264,"nodeType":881},{},[4265,4269],{"data":4266,"marks":4267,"value":1718,"nodeType":865},{},[4268],{"type":902},{"data":4270,"marks":4271,"value":4272,"nodeType":865},{},[]," offers the broadest attack surface due to unrestricted scopes, reusable first-party client IDs, and the FOCI/PRT escalation paths. ",{"data":4274,"content":4275,"nodeType":1734},{},[4276],{"data":4277,"content":4278,"nodeType":881},{},[4279,4283,4288],{"data":4280,"marks":4281,"value":4282,"nodeType":865},{},[],"Apps like ",{"data":4284,"marks":4285,"value":4287,"nodeType":865},{},[4286],{"type":902},"GitHub",{"data":4289,"marks":4290,"value":4291,"nodeType":865},{},[]," sit in between — broad scopes are available (including full repository access), but the attacker must control their own OAuth app and the victim sees an explicit consent screen. ",{"data":4293,"content":4297,"nodeType":890},{"target":4294},{"sys":4295},{"id":4296,"type":887,"linkType":888},"ejNSC76jge1p1zzz9wwiG",[],{"data":4299,"content":4300,"nodeType":894},{},[],{"data":4302,"content":4303,"nodeType":904},{},[4304],{"data":4305,"marks":4306,"value":4308,"nodeType":865},{},[4307],{"type":902},"Security recommendations",{"data":4310,"content":4311,"nodeType":881},{},[4312],{"data":4313,"marks":4314,"value":4315,"nodeType":865},{},[],"Security teams need to consider the risk posed by device code phishing across multiple apps where device code authorization grants are common, particularly for developers and technical users. ",{"data":4317,"content":4318,"nodeType":881},{},[4319],{"data":4320,"marks":4321,"value":4322,"nodeType":865},{},[],"In an ideal world, you would simply block device code logins. But this can’t be done without causing serious disruption in some environments, while some apps simply don’t provide the tools required to do so. For example, device code is the default CLI sign-in method for GitHub. Developer-heavy organizations are likely to encounter higher levels of legitimate use.",{"data":4324,"content":4325,"nodeType":881},{},[4326,4330,4339,4343,4348,4352,4357,4361,4366],{"data":4327,"marks":4328,"value":4329,"nodeType":865},{},[],"Microsoft arguably offers the strongest control options (other than Google, who negate it right out of the gate), though they do require a fair amount of work. ",{"data":4331,"content":4333,"nodeType":876},{"uri":4332},"https://techcommunity.microsoft.com/blog/microsoft-entra-blog/new-microsoft-managed-policies-to-raise-your-identity-security-posture/4286758",[4334],{"data":4335,"marks":4336,"value":4338,"nodeType":865},{},[4337],{"type":874},"Microsoft now explicitly recommends",{"data":4340,"marks":4341,"value":4342,"nodeType":865},{},[]," blocking device code flow for tenants that haven't used it in the past 25 days. Their guidance is to create a custom CA policy: target relevant users, set the ",{"data":4344,"marks":4345,"value":4347,"nodeType":865},{},[4346],{"type":902},"Authentication Flows",{"data":4349,"marks":4350,"value":4351,"nodeType":865},{},[]," condition to block ",{"data":4353,"marks":4354,"value":4356,"nodeType":865},{},[4355],{"type":902},"Device Code Flow",{"data":4358,"marks":4359,"value":4360,"nodeType":865},{},[],", and set the grant control to ",{"data":4362,"marks":4363,"value":4365,"nodeType":865},{},[4364],{"type":902},"Block Access",{"data":4367,"marks":4368,"value":4369,"nodeType":865},{},[],". Deploy in report-only mode first to identify any legitimate device code usage, then enforce with narrow exceptions.",{"data":4371,"content":4375,"nodeType":890},{"target":4372},{"sys":4373},{"id":4374,"type":887,"linkType":888},"mQIj2o9xRzkZYKNmanB25",[],{"data":4377,"content":4378,"nodeType":881},{},[4379],{"data":4380,"marks":4381,"value":4382,"nodeType":865},{},[],"For other apps, you’re mainly limited to monitoring and response. Ensuring you’re getting authentication logs for these apps is vital, and searching for unusual access patterns (e.g. unusual login protocols, having different IPs for the authorization grant and subsequent account activity). ",{"data":4384,"content":4385,"nodeType":894},{},[],{"data":4387,"content":4388,"nodeType":904},{},[4389],{"data":4390,"marks":4391,"value":4393,"nodeType":865},{},[4392],{"type":902},"How Push Security can help",{"data":4395,"content":4396,"nodeType":881},{},[4397],{"data":4398,"marks":4399,"value":4400,"nodeType":865},{},[],"Push customers can use our browser-based capabilities to overcome the limitations of app-level controls and detect, intercept, and shut down attacks in real time. ",{"data":4402,"content":4403,"nodeType":881},{},[4404],{"data":4405,"marks":4406,"value":4407,"nodeType":865},{},[],"Our research team is already tracking multiple device code phishing campaigns and toolkits, including the EvilTokens kit. Blocking controls are already in place to prevent customers from interacting with malicious pages that match our detections for these new toolkits, ensuring that these pages can be identified and blocked in real time regardless of the infrastructure. ",{"data":4409,"content":4410,"nodeType":881},{},[4411,4415,4424],{"data":4412,"marks":4413,"value":4414,"nodeType":865},{},[],"Using Push you can also ",{"data":4416,"content":4418,"nodeType":876},{"uri":4417},"https://pushsecurity.com/help/can-i-use-push-to-help-protect-against-device-code-phishing-scenarios/",[4419],{"data":4420,"marks":4421,"value":4423,"nodeType":865},{},[4422],{"type":874},"configure in-browser warnings",{"data":4425,"marks":4426,"value":4427,"nodeType":865},{},[]," whenever a user accesses a URL used for device code logins. This provides universal, last-mile protection against even ‘zero-day’ device code phishing attacks using previously unidentified toolkits.  ",{"data":4429,"content":4433,"nodeType":890},{"target":4430},{"sys":4431},{"id":4432,"type":887,"linkType":888},"3JsbGaOKSS3INzBUJpoh1W",[],{"data":4435,"content":4436,"nodeType":881},{},[4437],{"data":4438,"marks":4439,"value":4440,"nodeType":865},{},[],"When a user visits those URLs, Push will also emit a webhook event that the banner was shown and acknowledged. If a user opts to proceed, you can treat this as a high-fidelity alert for your security team to investigate, providing app-agnostic telemetry that may not already be provided in your logs from that particular vendor. You can also simply use Push to block users from accessing device login pages if you’re confident that disruption won’t be caused. ",{"data":4442,"content":4443,"nodeType":1860},{},[4444],{"data":4445,"marks":4446,"value":4448,"nodeType":865},{},[4447],{"type":902},"Learn more about Push",{"data":4450,"content":4451,"nodeType":881},{},[4452],{"data":4453,"marks":4454,"value":4455,"nodeType":865},{},[],"Push Security's browser-based security platform detects and blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking. You don't need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your attack surface.",{"data":4457,"content":4458,"nodeType":881},{},[4459,4463,4472,4475,4484,4488,4496],{"data":4460,"marks":4461,"value":4462,"nodeType":865},{},[],"To learn more about Push, ",{"data":4464,"content":4466,"nodeType":876},{"uri":4465},"https://pushsecurity.com/resources/product-brochure",[4467],{"data":4468,"marks":4469,"value":4471,"nodeType":865},{},[4470],{"type":874},"check out our latest product overview",{"data":4473,"marks":4474,"value":1877,"nodeType":865},{},[],{"data":4476,"content":4478,"nodeType":876},{"uri":4477},"https://pushsecurity.com/product-demo/",[4479],{"data":4480,"marks":4481,"value":4483,"nodeType":865},{},[4482],{"type":874},"view our demo library",{"data":4485,"marks":4486,"value":4487,"nodeType":865},{},[],", or ",{"data":4489,"content":4490,"nodeType":876},{"uri":1453},[4491],{"data":4492,"marks":4493,"value":4495,"nodeType":865},{},[4494],{"type":874},"book some time with one of our team for a live demo",{"data":4497,"marks":4498,"value":959,"nodeType":865},{},[],"Device code phishing attacks have skyrocketed: here’s what you need to know","Device code phishing is seeing a huge spike in adoption in 2026, enabling attackers to steal access tokens while bypassing standard access controls.","2026-04-04T00:00:00.000Z",{"items":4503},[4504,4508],{"sys":4505,"name":4507},{"id":4506},"6A5RXS31ZQx3PwryGb1IMy","Browser-based attacks",{"sys":4509,"name":342},{"id":4510},"4ksQNCFeBf8H4QIORqpRLw",{"items":4512},[4513],{"fullName":4514,"firstName":4515,"jobTitle":4516,"profilePicture":4517},"Luke Jennings","Luke","Vice President, R&D",{"url":4518},"https://images.ctfassets.net/y1cdw1ablpvd/4Hosb4zKi1dA0PUyDLMe1h/27e09d894861f2196ba794037986fb08/T016S22KZ96-U02NVQM7ZD4-57761d542d83-512.jpeg",{"__typename":1485,"sys":4520,"content":4522,"title":5360,"synopsis":5361,"hashTags":59,"publishedDate":5362,"slug":5363,"tagsCollection":5364,"authorsCollection":5370},{"id":4521},"211Dd0EIrXPOFpvRgs0fEE",{"json":4523},{"data":4524,"content":4525,"nodeType":1463},{},[4526,4545,4564,4583,4589,4592,4600,4607,4614,4621,4628,4636,4639,4647,4654,4661,4668,4674,4682,4700,4707,4714,4730,4738,4769,4785,4792,4819,4827,4857,4864,4872,4890,4897,4904,4910,4917,4925,4944,4951,4970,4977,4980,4988,4995,5082,5089,5105,5108,5139,5158,5165,5172,5175,5183,5201,5208,5215,5232,5235,5243,5250,5283,5290,5307,5326,5332,5335,5342],{"data":4527,"content":4528,"nodeType":881},{},[4529,4533,4541],{"data":4530,"marks":4531,"value":4532,"nodeType":865},{},[],"When we released the ",{"data":4534,"content":4536,"nodeType":876},{"uri":4535},"https://pushsecurity.com/blog/saas-attack-techniques/",[4537],{"data":4538,"marks":4539,"value":4540,"nodeType":865},{},[],"SaaS attack matrix",{"data":4542,"marks":4543,"value":4544,"nodeType":865},{},[]," in 2023, we were anticipating a shift that was just beginning to take shape. The techniques that attackers were using to compromise cloud applications and identities weren't well represented in existing frameworks, and many of the ones we documented hadn't yet been widely observed in the wild.",{"data":4546,"content":4547,"nodeType":881},{},[4548,4552,4560],{"data":4549,"marks":4550,"value":4551,"nodeType":865},{},[],"A year later, we ",{"data":4553,"content":4555,"nodeType":876},{"uri":4554},"https://pushsecurity.com/blog/the-saas-attack-matrix-one-year-on/",[4556],{"data":4557,"marks":4558,"value":4559,"nodeType":865},{},[],"reviewed what had changed",{"data":4561,"marks":4562,"value":4563,"nodeType":865},{},[]," and found that the initial access phase — the techniques designed to compromise an identity in the first place — was where almost all of the attacker innovation was concentrated. And two years on, that trend has become the story of the modern threat landscape. ",{"data":4565,"content":4566,"nodeType":881},{},[4567,4571,4579],{"data":4568,"marks":4569,"value":4570,"nodeType":865},{},[],"Today, we're re-releasing the matrix as the ",{"data":4572,"content":4574,"nodeType":876},{"uri":4573},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/",[4575],{"data":4576,"marks":4577,"value":4578,"nodeType":865},{},[],"Browser & Identity Attacks Matrix",{"data":4580,"marks":4581,"value":4582,"nodeType":865},{},[],". The name change isn't cosmetic. It reflects that the attacks driving the most consequential breaches are browser-based and identity-first.",{"data":4584,"content":4588,"nodeType":890},{"target":4585},{"sys":4586},{"id":4587,"type":887,"linkType":888},"MSnrBRJtiQxpv2qxFLCVE",[],{"data":4590,"content":4591,"nodeType":894},{},[],{"data":4593,"content":4594,"nodeType":904},{},[4595],{"data":4596,"marks":4597,"value":4599,"nodeType":865},{},[4598],{"type":902},"Why the scope needed to change",{"data":4601,"content":4602,"nodeType":881},{},[4603],{"data":4604,"marks":4605,"value":4606,"nodeType":865},{},[],"The original SaaS attack matrix was built around a specific insight: that attacks targeting modern business applications played out entirely over the internet, without touching endpoints or internal networks in any way that EDR or network detection tools would recognize.",{"data":4608,"content":4609,"nodeType":881},{},[4610],{"data":4611,"marks":4612,"value":4613,"nodeType":865},{},[],"That framing was useful, and it remains true. But it anchored the matrix to the post-access phase — what attackers do once they're inside a SaaS application — and didn't give enough weight to the initial access techniques that determine whether attackers get there in the first place.",{"data":4615,"content":4616,"nodeType":881},{},[4617],{"data":4618,"marks":4619,"value":4620,"nodeType":865},{},[],"The problem is that initial access is where the overwhelming majority of attacker innovation and investment is concentrated, and the techniques being used to achieve it are best understood as browser and identity attacks rather than SaaS-specific ones. AiTM phishing, ClickFix and its growing family of clipboard-injection variants, device code phishing, OAuth consent abuse, credential stuffing powered by infostealer supply chains, malicious browser extensions all happen in or via the browser.",{"data":4622,"content":4623,"nodeType":881},{},[4624],{"data":4625,"marks":4626,"value":4627,"nodeType":865},{},[],"Another issue is that \"SaaS\" has arguably ceased to be a meaningful category. When we consider that most organizations run the majority of their business on cloud applications, the difference between what constitutes \"SaaS\" versus cloud versus just \"business IT\" is pretty blurry (and feels like an academic rather than practical difference).",{"data":4629,"content":4630,"nodeType":881},{},[4631],{"data":4632,"marks":4633,"value":4635,"nodeType":865},{},[4634],{"type":902},"So it's less about whether an attack is a \"SaaS attack\" and more about how these attacks actually play out. ",{"data":4637,"content":4638,"nodeType":894},{},[],{"data":4640,"content":4641,"nodeType":904},{},[4642],{"data":4643,"marks":4644,"value":4646,"nodeType":865},{},[4645],{"type":902},"The technique landscape has transformed",{"data":4648,"content":4649,"nodeType":881},{},[4650],{"data":4651,"marks":4652,"value":4653,"nodeType":865},{},[],"The second part to the change is the fact that scale and speed of attacker innovation in the space justifies it.",{"data":4655,"content":4656,"nodeType":881},{},[4657],{"data":4658,"marks":4659,"value":4660,"nodeType":865},{},[],"When we launched the matrix in mid-2023, AiTM phishing was emerging as a serious concern but was far from ubiquitous. ClickFix didn't exist as a named technique. Device code phishing was a curiosity documented by a handful of researchers. ConsentFix was years away from being discovered. Browser extension supply chain attacks were rare enough to be individually notable.",{"data":4662,"content":4663,"nodeType":881},{},[4664],{"data":4665,"marks":4666,"value":4667,"nodeType":865},{},[],"In the two and a half years since, every one of these has become a mainstream, industrialized attack technique — and several have converged in ways that would have been hard to predict.",{"data":4669,"content":4673,"nodeType":890},{"target":4670},{"sys":4671},{"id":4672,"type":887,"linkType":888},"5Kw2kSrL8u4VyslxK8HCtR",[],{"data":4675,"content":4676,"nodeType":1860},{},[4677],{"data":4678,"marks":4679,"value":4681,"nodeType":865},{},[4680],{"type":902},"AiTM phishing has become the default phishing method",{"data":4683,"content":4684,"nodeType":881},{},[4685,4689,4696],{"data":4686,"marks":4687,"value":4688,"nodeType":865},{},[],"AiTM phishing is now the standard, powered by Phishing-as-a-Service kits that operate with the release cycles and customer support of legitimate SaaS products. Tycoon 2FA alone accounted for ",{"data":4690,"content":4691,"nodeType":876},{"uri":914},[4692],{"data":4693,"marks":4694,"value":4695,"nodeType":865},{},[],"62% of phishing detected by Microsoft",{"data":4697,"marks":4698,"value":4699,"nodeType":865},{},[]," and over 64,000 confirmed incidents, with Sneaky2FA, FlowerStorm, Evilginx, and a growing roster of competitors filling out the marketplace.",{"data":4701,"content":4702,"nodeType":881},{},[4703],{"data":4704,"marks":4705,"value":4706,"nodeType":865},{},[],"AiTM is constantly evolving, with vendors adding new features, capabilities, detection evasion techniques, and so on. Abuse of legitimate platforms, and increasingly AI-assisted development means that it’s trivial for attackers to spin up and tear down infrastructure, scale their campaigns, target specific organizations with crafted pages and lures, and generally means that attackers can operate highly sophisticated attacks with minimal effort and complexity. This makes AiTM and other PhaaS-powered techniques extremely accessible to all kinds of criminals.  ",{"data":4708,"content":4709,"nodeType":881},{},[4710],{"data":4711,"marks":4712,"value":4713,"nodeType":865},{},[],"These kits are delivered across several browser-based channels — not just email. Push data consistently shows that roughly 1 in 3 phishing payloads we intercept arrive via social media, search ads, messaging apps, or other non-email vectors.",{"data":4715,"content":4716,"nodeType":881},{},[4717,4721,4726],{"data":4718,"marks":4719,"value":4720,"nodeType":865},{},[],"Vishing has also surged as a delivery channel — CrowdStrike documented a ",{"data":4722,"marks":4723,"value":4725,"nodeType":865},{},[4724],{"type":902},"442% year-over-year increase",{"data":4727,"marks":4728,"value":4729,"nodeType":865},{},[],", and Mandiant found it was the single most common initial vector in cloud compromises at 23%. But the trend that matters isn't voice calls in isolation; it's voice calls combined with browser-based payloads, where a live operator guides the victim into an AiTM page or device code flow that the call alone could not execute.",{"data":4731,"content":4732,"nodeType":1860},{},[4733],{"data":4734,"marks":4735,"value":4737,"nodeType":865},{},[4736],{"type":902},"ClickFix is the top reported initial access vector",{"data":4739,"content":4740,"nodeType":881},{},[4741,4745,4753,4757,4765],{"data":4742,"marks":4743,"value":4744,"nodeType":865},{},[],"ClickFix has gone from nonexistent to one of the most prevalent initial access techniques in under 18 months. Microsoft reported it as the ",{"data":4746,"content":4748,"nodeType":876},{"uri":4747},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf",[4749],{"data":4750,"marks":4751,"value":4752,"nodeType":865},{},[],"most common initial access vector in 2025",{"data":4754,"marks":4755,"value":4756,"nodeType":865},{},[],", accounting for 47% of observed attacks, while CrowdStrike documented a ",{"data":4758,"content":4760,"nodeType":876},{"uri":4759},"https://www.crowdstrike.com/explore/2026-global-threat-report",[4761],{"data":4762,"marks":4763,"value":4764,"nodeType":865},{},[],"563% increase",{"data":4766,"marks":4767,"value":4768,"nodeType":865},{},[]," in fake CAPTCHA lures (a top ClickFix style).",{"data":4770,"content":4771,"nodeType":881},{},[4772,4776,4781],{"data":4773,"marks":4774,"value":4775,"nodeType":865},{},[],"ClickFix is admittedly an outlier in a browser attacks matrix — the payload ultimately executes on the endpoint, not in the browser — but the delivery is overwhelmingly browser-based: ",{"data":4777,"marks":4778,"value":4780,"nodeType":865},{},[4779],{"type":902},"4 in 5 ClickFix payloads",{"data":4782,"marks":4783,"value":4784,"nodeType":865},{},[]," intercepted by Push arrive via search engines as a result of malvertising or compromised web pages, not email, which means the browser is the only control point that actually sees the attack before the user pastes the malicious command.",{"data":4786,"content":4787,"nodeType":881},{},[4788],{"data":4789,"marks":4790,"value":4791,"nodeType":865},{},[],"ClickFix is now the primary delivery mechanism for infostealer malware, which is in turn the primary source of the stolen credentials and session tokens that power credential stuffing and session hijacking — which means the technique sits at the start of a cycle where one class of browser-delivered attack generates the raw material for the next.",{"data":4793,"content":4794,"nodeType":881},{},[4795,4799,4805,4809,4815],{"data":4796,"marks":4797,"value":4798,"nodeType":865},{},[],"The success of ClickFix has predictably spawned a growing family of derivatives — FileFix, CrashFix, ",{"data":4800,"content":4801,"nodeType":876},{"uri":1186},[4802],{"data":4803,"marks":4804,"value":1192,"nodeType":865},{},[],{"data":4806,"marks":4807,"value":4808,"nodeType":865},{},[]," — and much of the naming is marketing hype around variations on the same clipboard-injection mechanic. But ",{"data":4810,"content":4811,"nodeType":876},{"uri":1230},[4812],{"data":4813,"marks":4814,"value":1236,"nodeType":865},{},[],{"data":4816,"marks":4817,"value":4818,"nodeType":865},{},[]," was a genuinely novel development.",{"data":4820,"content":4821,"nodeType":1860},{},[4822],{"data":4823,"marks":4824,"value":4826,"nodeType":865},{},[4825],{"type":902},"Browser-native ClickFix: ConsentFix",{"data":4828,"content":4829,"nodeType":881},{},[4830,4834,4842,4846,4853],{"data":4831,"marks":4832,"value":4833,"nodeType":865},{},[],"ConsentFix is a fully browser-native attack that merged ClickFix-style social engineering with OAuth consent abuse, compromising accounts through a legitimate Microsoft authorization flow with no endpoint component at all. ConsentFix was ",{"data":4835,"content":4837,"nodeType":876},{"uri":4836},"https://pushsecurity.com/blog/consentfix-debrief/",[4838],{"data":4839,"marks":4840,"value":4841,"nodeType":865},{},[],"traced to APT29",{"data":4843,"marks":4844,"value":4845,"nodeType":865},{},[]," and has since been ",{"data":4847,"content":4848,"nodeType":876},{"uri":950},[4849],{"data":4850,"marks":4851,"value":4852,"nodeType":865},{},[],"commercialized on criminal forums",{"data":4854,"marks":4855,"value":4856,"nodeType":865},{},[],", following the same path from state-sponsored technique to commodity criminal tooling that we've seen repeatedly in this space.",{"data":4858,"content":4859,"nodeType":881},{},[4860],{"data":4861,"marks":4862,"value":4863,"nodeType":865},{},[],"ConsentFix demonstrates that the clipboard-injection mechanic can evolve into something that operates entirely within the browser, eliminating the endpoint detection surface that traditional ClickFix still exposed.",{"data":4865,"content":4866,"nodeType":1860},{},[4867],{"data":4868,"marks":4869,"value":4871,"nodeType":865},{},[4870],{"type":902},"Attackers have pivoted to authorization attacks to get around login controls",{"data":4873,"content":4874,"nodeType":881},{},[4875,4879,4886],{"data":4876,"marks":4877,"value":4878,"nodeType":865},{},[],"Authorization attacks like device code phishing have seen a ",{"data":4880,"content":4881,"nodeType":876},{"uri":938},[4882],{"data":4883,"marks":4884,"value":4885,"nodeType":865},{},[],"37.5x increase",{"data":4887,"marks":4888,"value":4889,"nodeType":865},{},[]," since the start of 2026, with at least 12 distinct kits now offering the technique. It bypasses standard authentication controls — including passkeys — because the attack occurs through the OAuth device authorization flow rather than the standard login flow. ",{"data":4891,"content":4892,"nodeType":881},{},[4893],{"data":4894,"marks":4895,"value":4896,"nodeType":865},{},[],"The technique was first associated with nation-state actors like Storm-2372, but went from espionage-grade to commodity PhaaS tooling in roughly eighteen months, with kits like EvilTokens and Venom now offering turnkey device code phishing as a service.",{"data":4898,"content":4899,"nodeType":881},{},[4900],{"data":4901,"marks":4902,"value":4903,"nodeType":865},{},[],"The device code authorization is effectively performed post-authentication. If you already have an active session in your browser, entering the device code and selecting your account from a drop-down menu is all that's needed. No password or MFA required. You can see an example in the video below.",{"data":4905,"content":4909,"nodeType":890},{"target":4906},{"sys":4907},{"id":4908,"type":887,"linkType":888},"2WPb41lNRajdpt5pogQg8M",[],{"data":4911,"content":4912,"nodeType":881},{},[4913],{"data":4914,"marks":4915,"value":4916,"nodeType":865},{},[],"And the ecosystem is adapting to this opportunity: established AiTM vendors like Tycoon are adding authorization-focused options alongside their existing credential-harvesting capabilities, which points toward multi-technique platforms where operators pick the right tool for whatever defenses the target has in place.",{"data":4918,"content":4919,"nodeType":1860},{},[4920],{"data":4921,"marks":4922,"value":4924,"nodeType":865},{},[4923],{"type":902},"Malicious and hacked browser extensions are one of the fastest growing threats",{"data":4926,"content":4927,"nodeType":881},{},[4928,4932,4940],{"data":4929,"marks":4930,"value":4931,"nodeType":865},{},[],"Malicious browser extensions have matured from an occasional nuisance into a scalable supply chain attack vector. The ",{"data":4933,"content":4935,"nodeType":876},{"uri":4934},"https://pushsecurity.com/blog/why-browser-extension-risk-scoring-wont-predict-your-next-breach/",[4936],{"data":4937,"marks":4938,"value":4939,"nodeType":865},{},[],"Cyberhaven compromise",{"data":4941,"marks":4942,"value":4943,"nodeType":865},{},[]," in December 2024 — where approximately 35 extensions were weaponized through a single OAuth phishing campaign targeting developers — impacted 2.6 million users and demonstrated that extension supply chain attacks can achieve the kind of reach that used to require a compromised software update server.",{"data":4945,"content":4946,"nodeType":881},{},[4947],{"data":4948,"marks":4949,"value":4950,"nodeType":865},{},[],"Since Cyberhaven, the pace has only accelerated. In 2026 alone, researchers have publicly disclosed at least 250 confirmed malicious browser extensions affecting roughly 1.75 million users, alongside a further 370+ extensions engaged in undisclosed or policy-disclosed data harvesting affecting an additional 44 million users. That doesn't count the extensions from late-2025 campaigns (DarkSpectre, AITOPIA, Trust Wallet) whose impacts carried into 2026.",{"data":4952,"content":4953,"nodeType":881},{},[4954,4958,4966],{"data":4955,"marks":4956,"value":4957,"nodeType":865},{},[],"The attack paths have also expanded. Beyond phishing developers for take over Web Store accounts (the Cyberhaven playbook), attackers are buying existing extensions from developers, waiting for ownership transfers or abandonments to take over, and increasingly vibe-coding their own functional extensions from scratch to build an audience that can later be weaponized. The common thread is that ",{"data":4959,"content":4960,"nodeType":876},{"uri":4934},[4961],{"data":4962,"marks":4963,"value":4965,"nodeType":865},{},[4964],{"type":874},"most malicious extensions didn't start out malicious",{"data":4967,"marks":4968,"value":4969,"nodeType":865},{},[]," — they started as legitimate tools and were turned into weapons after the fact.",{"data":4971,"content":4972,"nodeType":881},{},[4973],{"data":4974,"marks":4975,"value":4976,"nodeType":865},{},[],"None of this is happening in isolation. The threat landscape has reoriented around browser-based initial access and identity compromise — and the matrix needed to catch up.",{"data":4978,"content":4979,"nodeType":894},{},[],{"data":4981,"content":4982,"nodeType":904},{},[4983],{"data":4984,"marks":4985,"value":4987,"nodeType":865},{},[4986],{"type":902},"The evolution is playing out in public breaches",{"data":4989,"content":4990,"nodeType":881},{},[4991],{"data":4992,"marks":4993,"value":4994,"nodeType":865},{},[],"It’s worth reinforcing that when the SaaS matrix was first released, many of these attacks hadn’t been seen in the wild. The change today is staggering:",{"data":4996,"content":4997,"nodeType":1818},{},[4998,5018,5040,5060],{"data":4999,"content":5000,"nodeType":1734},{},[5001],{"data":5002,"content":5003,"nodeType":881},{},[5004,5008,5014],{"data":5005,"marks":5006,"value":5007,"nodeType":865},{},[],"When ",{"data":5009,"content":5010,"nodeType":876},{"uri":1747},[5011],{"data":5012,"marks":5013,"value":1752,"nodeType":865},{},[],{"data":5015,"marks":5016,"value":5017,"nodeType":865},{},[]," compromised over a thousand organizations' Salesforce tenants through device code phishing, the attack started with a phone call, moved through a browser-based authorization flow for the attacker’s app, and ended with mass data exfiltration via API.",{"data":5019,"content":5020,"nodeType":1734},{},[5021],{"data":5022,"content":5023,"nodeType":881},{},[5024,5028,5036],{"data":5025,"marks":5026,"value":5027,"nodeType":865},{},[],"When the same collective launched ",{"data":5029,"content":5031,"nodeType":876},{"uri":5030},"https://pushsecurity.com/blog/unpacking-the-latest-slh-campaign/",[5032],{"data":5033,"marks":5034,"value":5035,"nodeType":865},{},[],"AiTM phishing campaigns",{"data":5037,"marks":5038,"value":5039,"nodeType":865},{},[]," targeting Okta and Entra SSO, the phishing page was operated by a human in real time and delivered over a voice call — not email.",{"data":5041,"content":5042,"nodeType":1734},{},[5043],{"data":5044,"content":5045,"nodeType":881},{},[5046,5049,5056],{"data":5047,"marks":5048,"value":5007,"nodeType":865},{},[],{"data":5050,"content":5051,"nodeType":876},{"uri":1230},[5052],{"data":5053,"marks":5054,"value":5055,"nodeType":865},{},[],"APT29 deployed ConsentFix",{"data":5057,"marks":5058,"value":5059,"nodeType":865},{},[]," across dozens of compromised websites, the entire attack chain was browser-native, abusing a legitimate Microsoft OAuth flow to bypass MFA without proxying a single credential.",{"data":5061,"content":5062,"nodeType":1734},{},[5063],{"data":5064,"content":5065,"nodeType":881},{},[5066,5070,5078],{"data":5067,"marks":5068,"value":5069,"nodeType":865},{},[],"The ",{"data":5071,"content":5073,"nodeType":876},{"uri":5072},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-snowflake-june-2024",[5074],{"data":5075,"marks":5076,"value":5077,"nodeType":865},{},[],"Snowflake breach",{"data":5079,"marks":5080,"value":5081,"nodeType":865},{},[]," — arguably the most consequential credential-based campaign of the past several years — saw 165 organizations breached using credentials that had been sitting in infostealer dumps for years, replayed against Snowflake tenants that lacked mandatory MFA. The attack surface wasn't Snowflake's application logic; it was the identity hygiene gap that every organization carries across hundreds of apps.",{"data":5083,"content":5084,"nodeType":881},{},[5085],{"data":5086,"marks":5087,"value":5088,"nodeType":865},{},[],"And that’s just the big picture. Every month we’re tracking new public breaches involving browser and identity TTPs — which again, are just the tip of the iceberg when you consider that many breaches are settled quietly without hitting the headlines. ",{"data":5090,"content":5091,"nodeType":881},{},[5092,5096,5101],{"data":5093,"marks":5094,"value":5095,"nodeType":865},{},[],"One of the key drivers here is the shrinking time-to-exploit. CrowdStrike's average e-crime breakout time is down to ",{"data":5097,"marks":5098,"value":5100,"nodeType":865},{},[5099],{"type":902},"29 minutes",{"data":5102,"marks":5103,"value":5104,"nodeType":865},{},[],", with the fastest recorded at 27 seconds. When attackers can move from initial access to data exfiltration within minutes, the window for post-compromise detection collapses to near zero. The best chance of stopping the attack is at the point of initial access before the identity is compromised.",{"data":5106,"content":5107,"nodeType":894},{},[],{"data":5109,"content":5110,"nodeType":904},{},[5111,5116,5123,5128,5134],{"data":5112,"marks":5113,"value":5115,"nodeType":865},{},[5114],{"type":902},"Sidenote: why we're looking at attacks ",{"data":5117,"marks":5118,"value":5122,"nodeType":865},{},[5119,5121],{"type":5120},"italic",{"type":902},"in",{"data":5124,"marks":5125,"value":5127,"nodeType":865},{},[5126],{"type":902}," the browser, not ",{"data":5129,"marks":5130,"value":5133,"nodeType":865},{},[5131,5132],{"type":5120},{"type":902},"on",{"data":5135,"marks":5136,"value":5138,"nodeType":865},{},[5137],{"type":902}," the browser",{"data":5140,"content":5141,"nodeType":881},{},[5142,5146,5154],{"data":5143,"marks":5144,"value":5145,"nodeType":865},{},[],"Calling this a \"browser attacks\" matrix needs clarification. We're not talking about browser exploits — RCE vulnerabilities, sandbox escapes, memory corruption bugs. Those attacks target the browser itself, they're extraordinarily expensive to develop, and they're increasingly rare. Browser zero-days hit a ",{"data":5147,"content":5149,"nodeType":876},{"uri":5148},"https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review",[5150],{"data":5151,"marks":5152,"value":5153,"nodeType":865},{},[],"historic low of 9%",{"data":5155,"marks":5156,"value":5157,"nodeType":865},{},[]," of all zero-days reported to Google, and a Chrome RCE commands a $250,000 bug bounty.",{"data":5159,"content":5160,"nodeType":881},{},[5161],{"data":5162,"marks":5163,"value":5164,"nodeType":865},{},[],"In comparison, a one-year phishing kit rental costs $1,000. A bulk stolen credential list costs $15. An initial-access-broker-provided IdP admin account costs $3,000. When it costs orders of magnitude less to exploit the person using the browser than to exploit the browser itself, attackers will take the cheaper option every time.",{"data":5166,"content":5167,"nodeType":881},{},[5168],{"data":5169,"marks":5170,"value":5171,"nodeType":865},{},[],"It's worth heading off the obvious counterargument: won't AI-assisted vulnerability discovery eventually make browser exploits cheaper? Perhaps — but it will simultaneously make them easier for browser vendors to find and patch, and vendors like Google and Microsoft have the engineering capacity and financial incentive to scale AI-driven remediation far faster than attackers can scale exploit development.",{"data":5173,"content":5174,"nodeType":894},{},[],{"data":5176,"content":5177,"nodeType":904},{},[5178],{"data":5179,"marks":5180,"value":5182,"nodeType":865},{},[5181],{"type":902},"What hasn't changed",{"data":5184,"content":5185,"nodeType":881},{},[5186,5190,5197],{"data":5187,"marks":5188,"value":5189,"nodeType":865},{},[],"The matrix remains open-source, community-maintained, and available on ",{"data":5191,"content":5193,"nodeType":876},{"uri":5192},"https://github.com/pushsecurity/saas-attacks",[5194],{"data":5195,"marks":5196,"value":4287,"nodeType":865},{},[],{"data":5198,"marks":5199,"value":5200,"nodeType":865},{},[],". The goal is the same as it was in 2023: to give offensive and defensive security teams a shared reference point for the techniques that matter most.",{"data":5202,"content":5203,"nodeType":881},{},[5204],{"data":5205,"marks":5206,"value":5207,"nodeType":865},{},[],"We built it because there was a gap in how the industry talked about these techniques, and that gap still exists — MITRE ATT&CK remains essential for endpoint and network TTPs, but the browser-based, identity-first techniques behind most modern breaches are still underrepresented in traditional frameworks.",{"data":5209,"content":5210,"nodeType":881},{},[5211],{"data":5212,"marks":5213,"value":5214,"nodeType":865},{},[],"We continue to maintain the matrix with input from red teams, detection engineers, and threat researchers across the community. Some of the most valuable additions over the past two years have come from practitioners who encountered a technique on an engagement or in an investigation and contributed it back to the repository.",{"data":5216,"content":5217,"nodeType":881},{},[5218,5222,5229],{"data":5219,"marks":5220,"value":5221,"nodeType":865},{},[],"If you're an offensive security professional using these techniques on engagements, or a defender building detections against them, we want to hear from you. Submit a PR, open a discussion, or flag a technique we've missed on ",{"data":5223,"content":5225,"nodeType":876},{"uri":5224},"https://github.com/pushsecurity/browser-identity-attacks-matrix",[5226],{"data":5227,"marks":5228,"value":4287,"nodeType":865},{},[],{"data":5230,"marks":5231,"value":959,"nodeType":865},{},[],{"data":5233,"content":5234,"nodeType":894},{},[],{"data":5236,"content":5237,"nodeType":904},{},[5238],{"data":5239,"marks":5240,"value":5242,"nodeType":865},{},[5241],{"type":902},"Looking ahead",{"data":5244,"content":5245,"nodeType":881},{},[5246],{"data":5247,"marks":5248,"value":5249,"nodeType":865},{},[],"The pace of attacker innovation in browser-based initial access techniques over the past 18 months has been unlike anything we've tracked before — technique after technique moving from research curiosity to industrialized criminal tooling within months, not years.",{"data":5251,"content":5252,"nodeType":1818},{},[5253,5263,5273],{"data":5254,"content":5255,"nodeType":1734},{},[5256],{"data":5257,"content":5258,"nodeType":881},{},[5259],{"data":5260,"marks":5261,"value":5262,"nodeType":865},{},[],"AiTM platforms are adding authorization-based attack options alongside their credential-harvesting capabilities.",{"data":5264,"content":5265,"nodeType":1734},{},[5266],{"data":5267,"content":5268,"nodeType":881},{},[5269],{"data":5270,"marks":5271,"value":5272,"nodeType":865},{},[],"ClickFix has spawned fully browser-native variants.",{"data":5274,"content":5275,"nodeType":1734},{},[5276],{"data":5277,"content":5278,"nodeType":881},{},[5279],{"data":5280,"marks":5281,"value":5282,"nodeType":865},{},[],"AI is lowering the cost of producing convincing social engineering and phishing infrastructure at scale.",{"data":5284,"content":5285,"nodeType":881},{},[5286],{"data":5287,"marks":5288,"value":5289,"nodeType":865},{},[],"We don't see any of this slowing down, and that's exactly why thinking about these attacks as a browser problem instead of siloing them across email, endpoint, network, and cloud categories, each with a partial view of the picture (and still missing the whole when combined).",{"data":5291,"content":5292,"nodeType":881},{},[5293,5297,5304],{"data":5294,"marks":5295,"value":5296,"nodeType":865},{},[],"The Browser & Identity Attacks Matrix is our contribution to keeping that shared understanding current. You can ",{"data":5298,"content":5299,"nodeType":876},{"uri":4573},[5300],{"data":5301,"marks":5302,"value":5303,"nodeType":865},{},[],"explore the matrix here",{"data":5305,"marks":5306,"value":959,"nodeType":865},{},[],{"data":5308,"content":5309,"nodeType":881},{},[5310,5314,5322],{"data":5311,"marks":5312,"value":5313,"nodeType":865},{},[],"You can also read our recent ",{"data":5315,"content":5317,"nodeType":876},{"uri":5316},"https://pushsecurity.com/thank-you/browser-attacks-report",[5318],{"data":5319,"marks":5320,"value":5321,"nodeType":865},{},[],"browser attack techniques report",{"data":5323,"marks":5324,"value":5325,"nodeType":865},{},[]," for more information.",{"data":5327,"content":5331,"nodeType":890},{"target":5328},{"sys":5329},{"id":5330,"type":887,"linkType":888},"1hx6sxpyEzxn4F4jc1RGQi",[],{"data":5333,"content":5334,"nodeType":894},{},[],{"data":5336,"content":5337,"nodeType":881},{},[5338],{"data":5339,"marks":5340,"value":5341,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",{"data":5343,"content":5344,"nodeType":881},{},[5345,5349,5356],{"data":5346,"marks":5347,"value":5348,"nodeType":865},{},[],"Book a ",{"data":5350,"content":5351,"nodeType":876},{"uri":1453},[5352],{"data":5353,"marks":5354,"value":5355,"nodeType":865},{},[],"live demo",{"data":5357,"marks":5358,"value":5359,"nodeType":865},{},[]," to learn more.","Introducing the Browser & Identity Attacks Matrix","We're re-releasing the SaaS attack matrix as the Browser & Identity Attacks Matrix. Here's why we've decided to make the change and what it means.","2026-05-08T00:00:00.000Z","introducing-the-browser-and-identity-attacks-matrix",{"items":5365},[5366,5368],{"sys":5367,"name":4507},{"id":4506},{"sys":5369,"name":342},{"id":4510},{"items":5371},[5372],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":5376},"Dan Green","Dan","Threat Research",{"url":5377},"https://images.ctfassets.net/y1cdw1ablpvd/7jik1VhFgA3kgzXBXTm2Vw/fcd8c171da644903d0827eafcfbcaad0/Dan_Headshot_2025.png",{"__typename":1485,"sys":5379,"content":5381,"title":6349,"synopsis":6350,"hashTags":59,"publishedDate":5362,"slug":6351,"tagsCollection":6352,"authorsCollection":6358},{"id":5380},"3jF1fypt08TNlSoWuoMWhj",{"json":5382},{"data":5383,"content":5384,"nodeType":1463},{},[5385,5411,5442,5485,5528,5534,5546,5549,5557,5608,5615,5638,5644,5647,5655,5683,5690,5698,5704,5707,5715,5722,5740,5747,5790,5797,5800,5808,5827,5882,5885,5893,5911,5929,5937,5944,5956,5968,5980,5992,6008,6016,6023,6026,6033,6040,6057,6060,6068,6086,6343],{"data":5386,"content":5387,"nodeType":881},{},[5388,5392,5398,5402,5407],{"data":5389,"marks":5390,"value":5391,"nodeType":865},{},[],"ShinyHunters and the broader SLH (",{"data":5393,"content":5394,"nodeType":876},{"uri":1747},[5395],{"data":5396,"marks":5397,"value":1752,"nodeType":865},{},[],{"data":5399,"marks":5400,"value":5401,"nodeType":865},{},[],") collective have claimed breaches at thousands of organizations over the past twelve months across retail, technology, aviation, financial services, media, gaming, and education, in what amounts to the most sustained data theft and extortion operation in recent cybercrime history. SLH's genealogy traces through a merger of Scattered Spider, Lapsus$, and ShinyHunters, all parts of ",{"data":5403,"marks":5404,"value":5406,"nodeType":865},{},[5405],{"type":902},"the Com",{"data":5408,"marks":5409,"value":5410,"nodeType":865},{},[],", a broader community of English-speaking cybercriminals with international links. ",{"data":5412,"content":5413,"nodeType":881},{},[5414,5418,5426,5430,5438],{"data":5415,"marks":5416,"value":5417,"nodeType":865},{},[],"The confirmed victim list reads like a Fortune 500 directory: Coca-Cola, Cisco, Qantas, Coinbase, ADT, Aflac, SoundCloud, Rockstar Games, Charter Communications, and recently ",{"data":5419,"content":5421,"nodeType":876},{"uri":5420},"https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attack/",[5422],{"data":5423,"marks":5424,"value":5425,"nodeType":865},{},[],"Instructure",{"data":5427,"marks":5428,"value":5429,"nodeType":865},{},[]," — whose breach ",{"data":5431,"content":5433,"nodeType":876},{"uri":5432},"https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/",[5434],{"data":5435,"marks":5436,"value":5437,"nodeType":865},{},[],"disrupted schools and universities nationwide",{"data":5439,"marks":5440,"value":5441,"nodeType":865},{},[]," during final exams — among dozens more named publicly and likely many more that haven't been (breaches settled quickly behind closed doors don't always make it into the public eye). ShinyHunters alone claimed over 1.5 billion stolen Salesforce records from a single campaign targeting more than 1,000 organizations.",{"data":5443,"content":5444,"nodeType":881},{},[5445,5449,5457,5461,5469,5473,5481],{"data":5446,"marks":5447,"value":5448,"nodeType":865},{},[],"Additional operating clusters, including Cordial Spider and Snarky Spider (which CrowdStrike ",{"data":5450,"content":5452,"nodeType":876},{"uri":5451},"https://cyberscoop.com/crowdstrike-cordial-spider-snarky-spider-extortion-attacks/",[5453],{"data":5454,"marks":5455,"value":5456,"nodeType":865},{},[],"characterizes as the new generation of Scattered Spider",{"data":5458,"marks":5459,"value":5460,"nodeType":865},{},[],") run parallel campaigns against different target sectors, unified not by shared infrastructure but by a shared playbook of techniques that exploit the structural weakness in modern SaaS-first organizations. ",{"data":5462,"content":5464,"nodeType":876},{"uri":5463},"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-03-12-Vishing-Campaigns-Lead-to-Data-Theft-and-Extortion.txt",[5465],{"data":5466,"marks":5467,"value":5468,"nodeType":865},{},[],"Unit 42 documented",{"data":5470,"marks":5471,"value":5472,"nodeType":865},{},[]," these groups moving from initial compromise to complete data exfiltration in under an hour — faster than most organizations can even begin to respond. Newer groups with links to the SLH ecosystem like CoinbaseCartel have also continued the tradition of weaponizing stolen credentials from the infostealer economy at scale, as ShinyHunters did in the ",{"data":5474,"content":5476,"nodeType":876},{"uri":5475},"https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/",[5477],{"data":5478,"marks":5479,"value":5480,"nodeType":865},{},[],"2024 Snowflake breach",{"data":5482,"marks":5483,"value":5484,"nodeType":865},{},[]," that compromised over 165 customer environments (and claimed another billion-plus records).",{"data":5486,"content":5487,"nodeType":881},{},[5488,5492,5500,5504,5512,5516,5524],{"data":5489,"marks":5490,"value":5491,"nodeType":865},{},[],"Not every SLH breach is browser-based — the Instructure breach (275 million individuals, ~330 school login portals defaced) began with a Salesforce tenant compromise in September 2025, but resurfaced in May 2026 after attackers exploited a ",{"data":5493,"content":5495,"nodeType":876},{"uri":5494},"https://www.bitdefender.com/en-gb/blog/businessinsights/technical-advisory-shinyhunters-breach-instructure-canvas-lms",[5496],{"data":5497,"marks":5498,"value":5499,"nodeType":865},{},[],"vulnerability affecting Canvas's Free-For-Teacher program",{"data":5501,"marks":5502,"value":5503,"nodeType":865},{},[]," (it's now been confirmed that Instructure \"",{"data":5505,"content":5507,"nodeType":876},{"uri":5506},"https://www.instructure.com/incident_update",[5508],{"data":5509,"marks":5510,"value":5511,"nodeType":865},{},[],"reached a settlement",{"data":5513,"marks":5514,"value":5515,"nodeType":865},{},[],"\" for the deletion of the data, and shut down the free account tier), while the Coinbase breach cost ",{"data":5517,"content":5519,"nodeType":876},{"uri":5518},"https://www.bleepingcomputer.com/news/security/coinbase-discloses-breach-faces-up-to-400-million-in-losses/",[5520],{"data":5521,"marks":5522,"value":5523,"nodeType":865},{},[],"$180M–400M through insider bribery",{"data":5525,"marks":5526,"value":5527,"nodeType":865},{},[]," — but these are the exceptions that prove the rule. ",{"data":5529,"content":5533,"nodeType":890},{"target":5530},{"sys":5531},{"id":5532,"type":887,"linkType":888},"4qNrbDyMJIumQfdbh9YVkU",[],{"data":5535,"content":5536,"nodeType":881},{},[5537,5542],{"data":5538,"marks":5539,"value":5541,"nodeType":865},{},[5540],{"type":902},"The vast majority of SLH campaigns over the past year converge on three browser-based attack vectors: vishing combined with AiTM phishing, device code phishing exploiting account authorization flows, and OAuth supply chain attacks through compromised third-party integrators.",{"data":5543,"marks":5544,"value":5545,"nodeType":865},{},[]," Each is well-documented, each has produced confirmed victims at scale, and each is detectable or preventable through browser-layer security controls.",{"data":5547,"content":5548,"nodeType":894},{},[],{"data":5550,"content":5551,"nodeType":904},{},[5552],{"data":5553,"marks":5554,"value":5556,"nodeType":865},{},[5555],{"type":902},"Vector 1: Vishing combined with AiTM phishing",{"data":5558,"content":5559,"nodeType":881},{},[5560,5564,5572,5575,5583,5586,5593,5597,5605],{"data":5561,"marks":5562,"value":5563,"nodeType":865},{},[],"The most visible campaign right now pairs targeted voice calls with adversary-in-the-middle phishing pages — an approach that ",{"data":5565,"content":5567,"nodeType":876},{"uri":5566},"https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft",[5568],{"data":5569,"marks":5570,"value":5571,"nodeType":865},{},[],"Mandiant",{"data":5573,"marks":5574,"value":996,"nodeType":865},{},[],{"data":5576,"content":5578,"nodeType":876},{"uri":5577},"https://www.crowdstrike.com/en-us/blog/defending-against-cordial-spider-and-snarky-spider-with-falcon-shield/",[5579],{"data":5580,"marks":5581,"value":5582,"nodeType":865},{},[]," CrowdStrike",{"data":5584,"marks":5585,"value":1420,"nodeType":865},{},[],{"data":5587,"content":5588,"nodeType":876},{"uri":5463},[5589],{"data":5590,"marks":5591,"value":5592,"nodeType":865},{},[]," Unit 42",{"data":5594,"marks":5595,"value":5596,"nodeType":865},{},[]," have all documented from the incident response side, and which Push has ",{"data":5598,"content":5600,"nodeType":876},{"uri":5599},"https://pushsecurity.com/blog/inside-criminal-phishing-panel/",[5601],{"data":5602,"marks":5603,"value":5604,"nodeType":865},{},[],"documented from inside the attacker's own operator panels",{"data":5606,"marks":5607,"value":959,"nodeType":865},{},[],{"data":5609,"content":5610,"nodeType":881},{},[5611],{"data":5612,"marks":5613,"value":5614,"nodeType":865},{},[],"An attacker impersonating IT support calls the target employee, establishes urgency — often citing a \"mandatory passkey rollout\" or a \"security compliance update\" — and directs them to a victim-branded AiTM phishing page (typically at a domain like \u003Ccompany>sso.com or \u003Ccompany>internal.com). The attack is processed by a live human in real time, relaying credentials and MFA codes to the legitimate identity provider as they are entered, capturing the resulting session token, and granting the attacker an authenticated session. ",{"data":5616,"content":5617,"nodeType":881},{},[5618,5622,5629,5633],{"data":5619,"marks":5620,"value":5621,"nodeType":865},{},[],"One of the reasons that this method is becoming so widespread is the commoditization of effective tools. Push's ",{"data":5623,"content":5624,"nodeType":876},{"uri":5599},[5625],{"data":5626,"marks":5627,"value":5628,"nodeType":865},{},[],"infiltration of the criminal phishing panels",{"data":5630,"marks":5631,"value":5632,"nodeType":865},{},[]," identified over 400 linked domains across four distinct infrastructure clusters. ",{"data":5634,"marks":5635,"value":5637,"nodeType":865},{},[5636],{"type":902},"This mirrors the pattern that turned AiTM phishing from a specialist capability into an industrialized market with competing PhaaS platforms, but with the added complication that voice phishing as the delivery vector makes the attack invisible to traditional anti-phishing controls at the email layer.",{"data":5639,"content":5643,"nodeType":890},{"target":5640},{"sys":5641},{"id":5642,"type":887,"linkType":888},"1Yhthl0PILGW7EmCcZUrNv",[],{"data":5645,"content":5646,"nodeType":894},{},[],{"data":5648,"content":5649,"nodeType":904},{},[5650],{"data":5651,"marks":5652,"value":5654,"nodeType":865},{},[5653],{"type":902},"Vector 2: Vishing combined with device code phishing",{"data":5656,"content":5657,"nodeType":881},{},[5658,5661,5668,5672,5679],{"data":5659,"marks":5660,"value":5069,"nodeType":865},{},[],{"data":5662,"content":5663,"nodeType":876},{"uri":5030},[5664],{"data":5665,"marks":5666,"value":5667,"nodeType":865},{},[],"ShinyHunters Salesforce campaign",{"data":5669,"marks":5670,"value":5671,"nodeType":865},{},[]," that ran through 2025 and into 2026 used device code phishing as one of its core methods, ",{"data":5673,"content":5674,"nodeType":876},{"uri":5475},[5675],{"data":5676,"marks":5677,"value":5678,"nodeType":865},{},[],"compromising over 1,000 organizations and claiming 1.5 billion stolen records",{"data":5680,"marks":5681,"value":5682,"nodeType":865},{},[]," — including an attempted extortion of Salesforce itself. The attack involved registering an attacker-controlled \"DataLoader\" application mimicking a legitimate Salesforce tool, configuring it to request broad OAuth scopes including full API access and refresh token generation, and guiding victims through the device authorization flow via vishing calls.",{"data":5684,"content":5685,"nodeType":881},{},[5686],{"data":5687,"marks":5688,"value":5689,"nodeType":865},{},[],"Device code phishing exploits the OAuth 2.0 device authorization grant — a flow designed for devices without browsers, like smart TVs, but used in a wide range of scenarios including CLI logins — by tricking users into entering a code on Microsoft's (or another identity provider's) legitimate verification page. Since the victim is usually signed into the app in their browser, there’s no login at all. They simply navigate to the app’s device code login page and enter an attacker-provided code to grant the attacker an access token. ",{"data":5691,"content":5692,"nodeType":881},{},[5693],{"data":5694,"marks":5695,"value":5697,"nodeType":865},{},[5696],{"type":902},"This is what makes device code phishing structurally different from AiTM: it defeats all MFA (including passkeys) because the attack doesn’t target the login, but the authorization layer instead.",{"data":5699,"content":5703,"nodeType":890},{"target":5700},{"sys":5701},{"id":5702,"type":887,"linkType":888},"3ElQz8sLATnR8RY5nVlBGM",[],{"data":5705,"content":5706,"nodeType":894},{},[],{"data":5708,"content":5709,"nodeType":904},{},[5710],{"data":5711,"marks":5712,"value":5714,"nodeType":865},{},[5713],{"type":902},"Vector 3: OAuth supply chain attacks through compromised integrators",{"data":5716,"content":5717,"nodeType":881},{},[5718],{"data":5719,"marks":5720,"value":5721,"nodeType":865},{},[],"The third vector does not require the attacker to phish the victim organization's employees at all. Instead, it exploits the OAuth trust relationships that organizations create when they connect third-party SaaS vendors into their environments — and the consequence is that every organization that authorized one of these integrations effectively extended its security boundary to include the vendor's own security posture.",{"data":5723,"content":5724,"nodeType":881},{},[5725,5728,5736],{"data":5726,"marks":5727,"value":5069,"nodeType":865},{},[],{"data":5729,"content":5731,"nodeType":876},{"uri":5730},"https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift",[5732],{"data":5733,"marks":5734,"value":5735,"nodeType":865},{},[],"Salesloft/Drift supply chain attack",{"data":5737,"marks":5738,"value":5739,"nodeType":865},{},[]," demonstrated this at scale in 2025: in an extension of the previously mentioned device code phishing campaign, the attacker compromised Salesloft's GitHub environment, used TruffleHog to find secrets, stole Drift OAuth tokens, and used them to access downstream Salesforce environments. The same pattern was later repeated at Gainsight. ",{"data":5741,"content":5742,"nodeType":881},{},[5743],{"data":5744,"marks":5745,"value":5746,"nodeType":865},{},[],"Along with the previously mentioned device code phishing attacks,  more than 1000 organizations were breached. The attackers then harvested AWS keys, Snowflake credentials, and stored passwords from breached Salesforce instances, compounding the access into progressively wider reach.",{"data":5748,"content":5749,"nodeType":881},{},[5750,5754,5762,5766,5774,5778,5786],{"data":5751,"marks":5752,"value":5753,"nodeType":865},{},[],"The same structural pattern has continued into 2026 with the Anodot supply chain compromise, which has produced confirmed breaches at ",{"data":5755,"content":5757,"nodeType":876},{"uri":5756},"https://www.bleepingcomputer.com/news/security/vimeo-data-breach-exposes-personal-information-of-119-000-people/",[5758],{"data":5759,"marks":5760,"value":5761,"nodeType":865},{},[],"Vimeo",{"data":5763,"marks":5764,"value":5765,"nodeType":865},{},[]," (119,000 users), Rockstar Games (78.6 million records), and ",{"data":5767,"content":5769,"nodeType":876},{"uri":5768},"https://www.bleepingcomputer.com/news/security/zara-data-breach-exposed-personal-information-of-197-000-people/",[5770],{"data":5771,"marks":5772,"value":5773,"nodeType":865},{},[],"Zara/Inditex",{"data":5775,"marks":5776,"value":5777,"nodeType":865},{},[]," (197,000 people), with further downstream victims likely still emerging. The ",{"data":5779,"content":5781,"nodeType":876},{"uri":5780},"https://pushsecurity.com/blog/unpacking-the-vercel-breach/",[5782],{"data":5783,"marks":5784,"value":5785,"nodeType":865},{},[],"Vercel breach",{"data":5787,"marks":5788,"value":5789,"nodeType":865},{},[],", which involved compromised OAuth tokens from Context.ai cascading into Google Workspace, also reinforces the same attack pattern (though it was likely not a ShinyHunters operation despite being claimed by someone pretending to be them).",{"data":5791,"content":5792,"nodeType":881},{},[5793],{"data":5794,"marks":5795,"value":5796,"nodeType":865},{},[],"A forgotten SaaS integration can easily become the pivot point for downstream compromise. The moment you authorize a third-party integration, your security boundary extends to include that vendor. If the third-party is compromised, every downstream customer organization with an active integration is exposed.",{"data":5798,"content":5799,"nodeType":894},{},[],{"data":5801,"content":5802,"nodeType":904},{},[5803],{"data":5804,"marks":5805,"value":5807,"nodeType":865},{},[5806],{"type":902},"The infostealer credential playbook sits alongside these attacks",{"data":5809,"content":5810,"nodeType":881},{},[5811,5815,5823],{"data":5812,"marks":5813,"value":5814,"nodeType":865},{},[],"Alongside the three vectors above, ShinyHunters has a track record of exploiting the infostealer credential economy at scale — and it predates any of them. The 2024 Snowflake campaign — 165+ customer environments compromised, over a billion records stolen from AT&T, Ticketmaster, Santander, and Advance Auto Parts among others — was built entirely on infostealer-harvested credentials replayed against MFA-less tenants, with ",{"data":5816,"content":5818,"nodeType":876},{"uri":5817},"https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",[5819],{"data":5820,"marks":5821,"value":5822,"nodeType":865},{},[],"Mandiant's investigation",{"data":5824,"marks":5825,"value":5826,"nodeType":865},{},[]," finding that 80% of compromised accounts had prior breach exposure in datasets dating back to 2020. The credentials were already circulating in criminal marketplaces; ShinyHunters simply purchased and operationalized them at industrial scale.",{"data":5828,"content":5829,"nodeType":881},{},[5830,5834,5842,5846,5854,5858,5866,5870,5878],{"data":5831,"marks":5832,"value":5833,"nodeType":865},{},[],"The same methodology powered the ",{"data":5835,"content":5837,"nodeType":876},{"uri":5836},"https://pushsecurity.com/blog/why-attackers-are-targeting-jira-with-stolen-credentials/",[5838],{"data":5839,"marks":5840,"value":5841,"nodeType":865},{},[],"HellCat Jira campaign",{"data":5843,"marks":5844,"value":5845,"nodeType":865},{},[]," through 2024–2025, and has now been industrialized as a standalone operation by ",{"data":5847,"content":5849,"nodeType":876},{"uri":5848},"https://www.halcyon.ai/jp/threat-group/coinbasecartel",[5850],{"data":5851,"marks":5852,"value":5853,"nodeType":865},{},[],"CoinbaseCartel",{"data":5855,"marks":5856,"value":5857,"nodeType":865},{},[],", another criminal group reported to be an offshoot of SLH. CoinbaseCartel's model is familiar: purchase old infostealer credentials, use them to access cloud and development environments, exfiltrate data, and demand ransom. ",{"data":5859,"content":5861,"nodeType":876},{"uri":5860},"https://www.infostealers.com/article/inside-the-coinbase-cartel-how-infostealer-credentials-fueled-a-100-company-ransomware-spree/",[5862],{"data":5863,"marks":5864,"value":5865,"nodeType":865},{},[],"Hudson Rock's analysis",{"data":5867,"marks":5868,"value":5869,"nodeType":865},{},[]," of the group's 170+ claimed victims confirms that roughly 80% had prior infostealer infections predating the attacks. The most recent named victim is ",{"data":5871,"content":5873,"nodeType":876},{"uri":5872},"https://www.bleepingcomputer.com/news/security/grafana-says-stolen-github-token-let-hackers-steal-codebase/",[5874],{"data":5875,"marks":5876,"value":5877,"nodeType":865},{},[],"Grafana",{"data":5879,"marks":5880,"value":5881,"nodeType":865},{},[],", where a GitHub token compromised via the TanStack npm supply chain attack and missed during credential rotation was used to download the codebase and attempt extortion. ",{"data":5883,"content":5884,"nodeType":894},{},[],{"data":5886,"content":5887,"nodeType":904},{},[5888],{"data":5889,"marks":5890,"value":5892,"nodeType":865},{},[5891],{"type":902},"These attacks all happen in the browser",{"data":5894,"content":5895,"nodeType":881},{},[5896,5900,5907],{"data":5897,"marks":5898,"value":5899,"nodeType":865},{},[],"Every one of these attack chains is a browser-based attack that either occurs in the browser (AiTM phishing, device code phishing) or could have been prevented at the browser layer (OAuth consent governance). The techniques are interchangeable — the",{"data":5901,"content":5902,"nodeType":876},{"uri":938},[5903],{"data":5904,"marks":5905,"value":5906,"nodeType":865},{},[]," same criminal kits now offer AiTM and device code phishing side by side",{"data":5908,"marks":5909,"value":5910,"nodeType":865},{},[],", and the same threat actor (ShinyHunters) has used all three vectors across different campaigns within the same twelve-month period.",{"data":5912,"content":5913,"nodeType":881},{},[5914,5918,5925],{"data":5915,"marks":5916,"value":5917,"nodeType":865},{},[],"Additionally, infostealer infections themselves are increasingly delivered through browser-based methods like ",{"data":5919,"content":5921,"nodeType":876},{"uri":5920},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection",[5922],{"data":5923,"marks":5924,"value":315,"nodeType":865},{},[],{"data":5926,"marks":5927,"value":5928,"nodeType":865},{},[],", closing the loop between the credential supply side and the browser-layer detection point.",{"data":5930,"content":5931,"nodeType":1860},{},[5932],{"data":5933,"marks":5934,"value":5936,"nodeType":865},{},[5935],{"type":902},"How Push can help",{"data":5938,"content":5939,"nodeType":881},{},[5940],{"data":5941,"marks":5942,"value":5943,"nodeType":865},{},[],"Push operates at the exact point in each of these attack chains where automated intervention can still prevent the compromise. ",{"data":5945,"content":5946,"nodeType":881},{},[5947,5952],{"data":5948,"marks":5949,"value":5951,"nodeType":865},{},[5950],{"type":902},"For vishing + AiTM attacks, ",{"data":5953,"marks":5954,"value":5955,"nodeType":865},{},[],"Push's behavioral phishing detection analyzes and blocks the phishing page in real time by detecting it from the user's browser — regardless of the domains used, hosting infrastructure, or where the URL was delivered.  ",{"data":5957,"content":5958,"nodeType":881},{},[5959,5964],{"data":5960,"marks":5961,"value":5963,"nodeType":865},{},[5962],{"type":902},"For device code phishing,",{"data":5965,"marks":5966,"value":5967,"nodeType":865},{},[]," Push detects the phishing pages associated with device code phishing kits — including generic, technique-class detections that catch new kits without requiring kit-specific signatures. Second, Push provides an additional layer of protection on the legitimate device code authentication pages themselves, preventing users from entering attacker-supplied codes into them. Together, these detections cover both the kit-operated phishing infrastructure and the legitimate auth pages that the attack flow depends on.",{"data":5969,"content":5970,"nodeType":881},{},[5971,5976],{"data":5972,"marks":5973,"value":5975,"nodeType":865},{},[5974],{"type":902},"For OAuth supply chain attacks,",{"data":5977,"marks":5978,"value":5979,"nodeType":865},{},[]," Push's detects and controls OAuth consent flows at the browser layer — capturing which application is requesting access, what scopes it's requesting, and whether the grant should be permitted under organizational policy. Push customers can also block OAuth connection requests as they transit the browser, enabling security teams to stop unwanted integrations being added in the first place. ",{"data":5981,"content":5982,"nodeType":881},{},[5983,5988],{"data":5984,"marks":5985,"value":5987,"nodeType":865},{},[5986],{"type":902},"For the infostealer credential playbook,",{"data":5989,"marks":5990,"value":5991,"nodeType":865},{},[]," Push's stolen credential detection identifies when employees are using credentials that have appeared in breach datasets or dark web feeds — catching the moment a dormant infostealer credential surfaces at a browser-based login, as well as surfacing insecure login methods missing mitigating controls like MFA and enforcing them through in-browser guardrails. And on the supply side, Push's ClickFix detection addresses the browser-based delivery vector that is now the primary method for distributing infostealer malware in the first place.",{"data":5993,"content":5994,"nodeType":881},{},[5995,5998,6005],{"data":5996,"marks":5997,"value":21,"nodeType":865},{},[],{"data":5999,"content":6000,"nodeType":876},{"uri":1042},[6001],{"data":6002,"marks":6003,"value":6004,"nodeType":865},{},[],"Learn more about how you can use Push controls to protect your users from in-browser threats here. ",{"data":6006,"marks":6007,"value":21,"nodeType":865},{},[],{"data":6009,"content":6010,"nodeType":1860},{},[6011],{"data":6012,"marks":6013,"value":6015,"nodeType":865},{},[6014],{"type":902},"Closing thoughts",{"data":6017,"content":6018,"nodeType":881},{},[6019],{"data":6020,"marks":6021,"value":6022,"nodeType":865},{},[],"The campaigns documented in this post are not historical — they are ongoing, with new victims surfacing weekly and the underlying criminal infrastructure still actively developing. But the defensive strategy does not require anticipating which specific group, vector, or target sector comes next, because all of them converge on the same control point: the browser, where the attack begins or the integration decision is made. Organizations with browser-layer detection and OAuth governance in place have defense-in-depth against the full range of techniques these groups employ, regardless of which specific vector any given campaign uses.",{"data":6024,"content":6025,"nodeType":894},{},[],{"data":6027,"content":6028,"nodeType":881},{},[6029],{"data":6030,"marks":6031,"value":6032,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. ",{"data":6034,"content":6035,"nodeType":881},{},[6036],{"data":6037,"marks":6038,"value":6039,"nodeType":865},{},[],"Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",{"data":6041,"content":6042,"nodeType":881},{},[6043,6046,6054],{"data":6044,"marks":6045,"value":21,"nodeType":865},{},[],{"data":6047,"content":6049,"nodeType":876},{"uri":6048},"https://pushsecurity.com/demo/",[6050],{"data":6051,"marks":6052,"value":6053,"nodeType":865},{},[],"Book a live demo to learn more.",{"data":6055,"marks":6056,"value":21,"nodeType":865},{},[],{"data":6058,"content":6059,"nodeType":894},{},[],{"data":6061,"content":6062,"nodeType":904},{},[6063],{"data":6064,"marks":6065,"value":6067,"nodeType":865},{},[6066],{"type":902},"Appendix: named ShinyHunters victims since May 2025",{"data":6069,"content":6070,"nodeType":881},{},[6071,6075,6082],{"data":6072,"marks":6073,"value":6074,"nodeType":865},{},[],"To give an indication of the scale, the following table documents all publicly named victims attributed to ShinyHunters specifically since the Salesforce campaign began in May 2025. It is not exhaustive: ShinyHunters has claimed over 1,000 organizations in aggregate across its Salesforce campaigns alone, and many victims have not been publicly named. This list also doesn’t include the billion-plus records compromised in the 2024 Snowflake breaches. The major ransomware attacks executed against M&S, Co-op, and Jaguar Land Rover claimed by the ",{"data":6076,"content":6077,"nodeType":876},{"uri":1747},[6078],{"data":6079,"marks":6080,"value":6081,"nodeType":865},{},[],"Scattered Lapsus$ Hunters \"brand\"",{"data":6083,"marks":6084,"value":6085,"nodeType":865},{},[]," also aren't listed below. ",{"data":6087,"content":6088,"nodeType":2270},{},[6089,6136,6200,6248,6296],{"data":6090,"content":6091,"nodeType":2032},{},[6092,6103,6114,6125],{"data":6093,"content":6094,"nodeType":2021},{},[6095],{"data":6096,"content":6097,"nodeType":881},{},[6098],{"data":6099,"marks":6100,"value":6102,"nodeType":865},{},[6101],{"type":902},"Campaign",{"data":6104,"content":6105,"nodeType":2021},{},[6106],{"data":6107,"content":6108,"nodeType":881},{},[6109],{"data":6110,"marks":6111,"value":6113,"nodeType":865},{},[6112],{"type":902},"Began",{"data":6115,"content":6116,"nodeType":2021},{},[6117],{"data":6118,"content":6119,"nodeType":881},{},[6120],{"data":6121,"marks":6122,"value":6124,"nodeType":865},{},[6123],{"type":902},"Named victims",{"data":6126,"content":6127,"nodeType":2021},{},[6128],{"data":6129,"content":6130,"nodeType":881},{},[6131],{"data":6132,"marks":6133,"value":6135,"nodeType":865},{},[6134],{"type":902},"Confirmed impact",{"data":6137,"content":6138,"nodeType":2032},{},[6139,6163,6173,6183],{"data":6140,"content":6141,"nodeType":2021},{},[6142],{"data":6143,"content":6144,"nodeType":881},{},[6145,6150,6154,6159],{"data":6146,"marks":6147,"value":6149,"nodeType":865},{},[6148],{"type":902},"ShinyHunters Salesforce Vishing",{"data":6151,"marks":6152,"value":6153,"nodeType":865},{},[]," (vishing + device code phishing → Salesforce connected app authorization) \n\n& ",{"data":6155,"marks":6156,"value":6158,"nodeType":865},{},[6157],{"type":902},"Salesloft/Drift Supply Chain",{"data":6160,"marks":6161,"value":6162,"nodeType":865},{},[]," (stolen OAuth tokens → downstream Salesforce access)",{"data":6164,"content":6165,"nodeType":2021},{},[6166],{"data":6167,"content":6168,"nodeType":881},{},[6169],{"data":6170,"marks":6171,"value":6172,"nodeType":865},{},[],"May 2025",{"data":6174,"content":6175,"nodeType":2021},{},[6176],{"data":6177,"content":6178,"nodeType":881},{},[6179],{"data":6180,"marks":6181,"value":6182,"nodeType":865},{},[],"Coca-Cola Europacific Partners, Cisco, Qantas, LVMH, Adidas, Google, Chanel, Pandora, Allianz Life, Air France-KLM, Farmers Insurance, Workday, TransUnion, Stellantis, Kering, Odido, Hallmark, Salesloft (origin), Toast, Avalara, Fastly, Cato Networks, Cloudflare, Palo Alto Networks, Zscaler, Tenable, Elastic, JFrog, CyberArk, Rubrik, BeyondTrust, Proofpoint, Workiva, Mercer Advisors, Beacon Pointe, Ameriprise, Kemper, Udemy, 7-Eleven, Mytheresa, Marcus & Millichap, Carnival, Pitney Bowes, Alert 360, Amtrak, McGraw-Hill, Canada Life, Charter Communications",{"data":6184,"content":6185,"nodeType":2021},{},[6186,6193],{"data":6187,"content":6188,"nodeType":881},{},[6189],{"data":6190,"marks":6191,"value":6192,"nodeType":865},{},[],"49 named victims. Confirmed individual impact includes 23M+ records (Coca-Cola), 5.7M records (Qantas), 6.2M customers (Odido), 4.4M consumers (TransUnion), up to 18M records (Stellantis), 13.5M emails (McGraw-Hill), 8.2M emails (Pitney Bowes), 7.5M emails (Carnival), 7-Eleven: 185K confirmed by HIBP (SSNs, driver's licenses; franchisee data), Charter Communications: millions of records claimed (company disputes scope). ",{"data":6194,"content":6195,"nodeType":881},{},[6196],{"data":6197,"marks":6198,"value":6199,"nodeType":865},{},[],"ShinyHunters claims 1.5B+ Salesforce records across 1,000+ organizations total.",{"data":6201,"content":6202,"nodeType":2032},{},[6203,6218,6228,6238],{"data":6204,"content":6205,"nodeType":2021},{},[6206],{"data":6207,"content":6208,"nodeType":881},{},[6209,6214],{"data":6210,"marks":6211,"value":6213,"nodeType":865},{},[6212],{"type":902},"Vishing + AiTM SSO",{"data":6215,"marks":6216,"value":6217,"nodeType":865},{},[]," (vishing → AiTM phishing page → SSO session capture → SaaS data exfiltration)",{"data":6219,"content":6220,"nodeType":2021},{},[6221],{"data":6222,"content":6223,"nodeType":881},{},[6224],{"data":6225,"marks":6226,"value":6227,"nodeType":865},{},[],"Aug 2025",{"data":6229,"content":6230,"nodeType":2021},{},[6231],{"data":6232,"content":6233,"nodeType":881},{},[6234],{"data":6235,"marks":6236,"value":6237,"nodeType":865},{},[],"SoundCloud, GrubHub, Panera Bread, Match Group, Crunchbase, Betterment, CarMax, Edmunds, CarGurus, Hims & Hers, University of Pennsylvania, Harvard University, Optimizely, TELUS Digital, Crunchyroll, ADT",{"data":6239,"content":6240,"nodeType":2021},{},[6241],{"data":6242,"content":6243,"nodeType":881},{},[6244],{"data":6245,"marks":6246,"value":6247,"nodeType":865},{},[],"16 named victims. Confirmed individual impact includes ~30M records (SoundCloud), ~14M records (Panera), 10M+ records (Match Group), ~20M records (Betterment), 5.5M people (ADT), 1M+ records (UPenn), ~1PB stolen from TELUS Digital ($65M ransom refused).",{"data":6249,"content":6250,"nodeType":2032},{},[6251,6266,6276,6286],{"data":6252,"content":6253,"nodeType":2021},{},[6254],{"data":6255,"content":6256,"nodeType":881},{},[6257,6262],{"data":6258,"marks":6259,"value":6261,"nodeType":865},{},[6260],{"type":902},"Anodot Supply Chain",{"data":6263,"marks":6264,"value":6265,"nodeType":865},{},[]," (stolen OAuth tokens → downstream Snowflake/BigQuery access)",{"data":6267,"content":6268,"nodeType":2021},{},[6269],{"data":6270,"content":6271,"nodeType":881},{},[6272],{"data":6273,"marks":6274,"value":6275,"nodeType":865},{},[],"Apr 2026",{"data":6277,"content":6278,"nodeType":2021},{},[6279],{"data":6280,"content":6281,"nodeType":881},{},[6282],{"data":6283,"marks":6284,"value":6285,"nodeType":865},{},[],"Anodot/Glassbox (origin), Rockstar Games, Vimeo, Zara/Inditex",{"data":6287,"content":6288,"nodeType":2021},{},[6289],{"data":6290,"content":6291,"nodeType":881},{},[6292],{"data":6293,"marks":6294,"value":6295,"nodeType":865},{},[],"4 named victims (12+ total claimed). 78.6M records (Rockstar Games), 197K individuals (Zara), 119K individuals (Vimeo).",{"data":6297,"content":6298,"nodeType":2032},{},[6299,6314,6323,6333],{"data":6300,"content":6301,"nodeType":2021},{},[6302],{"data":6303,"content":6304,"nodeType":881},{},[6305,6310],{"data":6306,"marks":6307,"value":6309,"nodeType":865},{},[6308],{"type":902},"Other SLH-attributed",{"data":6311,"marks":6312,"value":6313,"nodeType":865},{},[]," (misc. vectors including infostealer chains, CI/CD supply chain, SaaS platform compromise)",{"data":6315,"content":6316,"nodeType":2021},{},[6317],{"data":6318,"content":6319,"nodeType":881},{},[6320],{"data":6321,"marks":6322,"value":6172,"nodeType":865},{},[],{"data":6324,"content":6325,"nodeType":2021},{},[6326],{"data":6327,"content":6328,"nodeType":881},{},[6329],{"data":6330,"marks":6331,"value":6332,"nodeType":865},{},[],"UK Legal Aid Agency, Mixpanel, Wynn Resorts, Woflow, Vercel, European Commission, Mercor, Medtronic, Instructure",{"data":6334,"content":6335,"nodeType":2021},{},[6336],{"data":6337,"content":6338,"nodeType":881},{},[6339],{"data":6340,"marks":6341,"value":6342,"nodeType":865},{},[],"10 named victims across varied vectors. Notable: Vercel (Lumma Stealer → Context.ai OAuth app → Google Workspace), European Commission (poisoned Trivy GitHub Action → 340GB across 71 EU entities)",{"data":6344,"content":6345,"nodeType":881},{},[6346],{"data":6347,"marks":6348,"value":21,"nodeType":865},{},[],"The three attack techniques behind ShinyHunters' 2026 campaigns ","ShinyHunters' breach of Instructure is the latest in a long series of attacks. Here's our view of the big picture. ","analyzing-the-instructure-breach",{"items":6353},[6354,6356],{"sys":6355,"name":4507},{"id":4506},{"sys":6357,"name":342},{"id":4510},{"items":6359},[6360],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":6361},{"url":5377},"7-things-we-learned-from-john-hammond","blog/7-things-we-learned-from-john-hammond",{"json":6365},{"data":6366,"content":6367,"nodeType":1463},{},[6368],{"data":6369,"content":6370,"nodeType":881},{},[6371],{"data":6372,"marks":6373,"value":6374,"nodeType":865},{},[],"Luke Jennings (Push VP of Research) and John Hammond (Senior Principal Security Researcher, Huntress) walked through the browser-based attack techniques defining the 2026 threat landscape.","Here are 7 things we learned from our conversation with John Hammond on the \"Why the browser is the new battleground\" webinar. ",{"id":6377,"publishedAt":6378},"6V12IJexyAkFFVIrbwlNPq","2026-08-12T12:00:57.289Z",{"items":6380},[6381,6383],{"sys":6382,"name":4507},{"id":4506},{"sys":6384,"name":297},{"id":6385},"3pjES4THCIfSAwhGdNwBcy",{"items":6387},[6388,6390,6392,6394,6396,6398,6400,6402,6404,6406,6408,6410,6412,6414,6416,6418,6420,6422,6424,6426,6428,6430],{"sys":6389,"name":279,"slug":280,"tier":31},{"id":276},{"sys":6391,"name":519,"slug":520,"tier":31},{"id":516},{"sys":6393,"name":413,"slug":414,"tier":31},{"id":410},{"sys":6395,"name":297,"slug":298,"tier":31},{"id":294},{"sys":6397,"name":342,"slug":343,"tier":31},{"id":339},{"sys":6399,"name":235,"slug":236,"tier":31},{"id":232},{"sys":6401,"name":261,"slug":262,"tier":45},{"id":258},{"sys":6403,"name":315,"slug":316,"tier":45},{"id":312},{"sys":6405,"name":360,"slug":361,"tier":45},{"id":357},{"sys":6407,"name":484,"slug":485,"tier":45},{"id":481},{"sys":6409,"name":475,"slug":476,"tier":45},{"id":472},{"sys":6411,"name":511,"slug":512,"tier":45},{"id":508},{"sys":6413,"name":324,"slug":325,"tier":45},{"id":321},{"sys":6415,"name":571,"slug":572,"tier":45},{"id":568},{"sys":6417,"name":466,"slug":467,"tier":45},{"id":463},{"sys":6419,"name":440,"slug":441,"tier":45},{"id":437},{"sys":6421,"name":607,"slug":608,"tier":45},{"id":604},{"sys":6423,"name":377,"slug":378,"tier":45},{"id":374},{"sys":6425,"name":431,"slug":432,"tier":45},{"id":428},{"sys":6427,"name":448,"slug":449,"tier":45},{"id":445},{"sys":6429,"name":493,"slug":494,"tier":45},{"id":490},{"sys":6431,"name":244,"slug":245,"tier":45},{"id":241},"q4U5IPhRMZseIs6ceVJ_ZzUpucxUy-2TaBbYB9CbBVE",{"id":6434,"title":6435,"authorsCollection":6436,"content":6442,"extension":228,"faqItemsCollection":7212,"faqTitle":59,"featured":6,"hashTags":59,"meta":7214,"metaTitle":7215,"ogImage":59,"postType":7216,"publishedDate":7217,"relatedBlogPostsCollection":7218,"slug":11765,"stem":11766,"subtitle":59,"summary":11767,"synopsis":11777,"sys":11784,"tagsCollection":11787,"topicsCollection":11793,"__hash__":11815},"blog/blog/consentfix-v3-analyzing-a-new-toolkit.json","ConsentFix v3: Analyzing a new criminal toolkit",{"items":6437},[6438],{"fullName":5373,"firstName":5374,"jobTitle":5375,"socialLinks":6439,"profilePicture":6441},[6440],"https://www.linkedin.com/in/daniel-g-/",{"url":5377},{"json":6443,"links":7001},{"data":6444,"content":6445,"nodeType":1463},{},[6446,6464,6471,6477,6484,6490,6509,6515,6521,6524,6532,6552,6558,6564,6570,6587,6594,6602,6609,6616,6623,6626,6634,6652,6675,6680,6685,6692,6699,6706,6709,6717,6735,6768,6775,6781,6784,6792,6799,6802,6809,6816,6824,6843,6863,6870,6876,6884,6891,6898,6901,6908,6915,6921,6938,6944,6951,6958,6965],{"data":6447,"content":6448,"nodeType":881},{},[6449,6453,6460],{"data":6450,"marks":6451,"value":6452,"nodeType":865},{},[],"In December 2025, we uncovered a state-sponsored campaign linked to Russian state-affiliated APT29 that used a new technique we called ",{"data":6454,"content":6455,"nodeType":876},{"uri":1230},[6456],{"data":6457,"marks":6458,"value":1236,"nodeType":865},{},[6459],{"type":874},{"data":6461,"marks":6462,"value":6463,"nodeType":865},{},[],". This technique merged ClickFix-style social engineering with OAuth consent phishing to hijack Microsoft accounts. Effectively, ConsentFix is a browser-native attack that results in account takeover, without the downside of needing to touch the endpoint like typical ClickFix (really, the point that it's most likely to be detected and blocked). ",{"data":6465,"content":6466,"nodeType":881},{},[6467],{"data":6468,"marks":6469,"value":6470,"nodeType":865},{},[],"The quick 101 is that victims are tricked into copy-and-pasting a legitimate Microsoft URL into the phishing page. This URL contains an OAuth authorization code that the attacker uses to sign in to a first-party Microsoft application like Azure CLI — specifically targeting apps with known Conditional Access exclusions. ",{"data":6472,"content":6476,"nodeType":890},{"target":6473},{"sys":6474},{"id":6475,"type":887,"linkType":888},"7s4kF5CUFUmdkhpzuwNalX",[],{"data":6478,"content":6479,"nodeType":881},{},[6480],{"data":6481,"marks":6482,"value":6483,"nodeType":865},{},[],"At the end of the attack chain, the attacker is effectively granted API access to the victim's Entra account, while sidestepping MFA (even passkeys), device compliance checks, and in some cases conditional access controls (depending on the application ID targeted by the attacker). ",{"data":6485,"content":6489,"nodeType":890},{"target":6486},{"sys":6487},{"id":6488,"type":887,"linkType":888},"IMtJXMWeaIbRsWxuQ1CaS",[],{"data":6491,"content":6492,"nodeType":881},{},[6493,6497,6505],{"data":6494,"marks":6495,"value":6496,"nodeType":865},{},[],"It didn’t take long for security researchers to jump on this new technique. Lots of contributors rallied round the security recommendations (which we covered in a ",{"data":6498,"content":6499,"nodeType":876},{"uri":4836},[6500],{"data":6501,"marks":6502,"value":6504,"nodeType":865},{},[6503],{"type":874},"follow-up blog post",{"data":6506,"marks":6507,"value":6508,"nodeType":865},{},[],") but the most notable contribution came from John Hammond, who took the attacker’s implementation and said “I can do better”. His v2 replaced a somewhat clunky implementation with a slick drag-and-drop function. But now, attackers have taken it one step further.",{"data":6510,"content":6514,"nodeType":890},{"target":6511},{"sys":6512},{"id":6513,"type":887,"linkType":888},"59tfJDRhGThKD48Wjg7uY2",[],{"data":6516,"content":6520,"nodeType":890},{"target":6517},{"sys":6518},{"id":6519,"type":887,"linkType":888},"6mEpyVD6f13ZttFmaBcxNm",[],{"data":6522,"content":6523,"nodeType":894},{},[],{"data":6525,"content":6526,"nodeType":904},{},[6527],{"data":6528,"marks":6529,"value":6531,"nodeType":865},{},[6530],{"type":902},"Introducing: ConsentFix v3",{"data":6533,"content":6534,"nodeType":881},{},[6535,6539,6548],{"data":6536,"marks":6537,"value":6538,"nodeType":865},{},[],"The latest development is that a member of the XSS criminal forum, a site strongly suspected to have ",{"data":6540,"content":6542,"nodeType":876},{"uri":6541},"https://flare.io/learn/resources/blog/state-of-the-dark-web-2026",[6543],{"data":6544,"marks":6545,"value":6547,"nodeType":865},{},[6546],{"type":874},"Russian state involvement",{"data":6549,"marks":6550,"value":6551,"nodeType":865},{},[],", has released a new tool “ConsentFix v3”, building on the v1 we saw in the wild, and John’s v2. ",{"data":6553,"content":6557,"nodeType":890},{"target":6554},{"sys":6555},{"id":6556,"type":887,"linkType":888},"4AW0UnBlIaXbIFZjy8ObY1",[],{"data":6559,"content":6563,"nodeType":890},{"target":6560},{"sys":6561},{"id":6562,"type":887,"linkType":888},"1b36XjqBpPx7wteBu6OA6h",[],{"data":6565,"content":6569,"nodeType":890},{"target":6566},{"sys":6567},{"id":6568,"type":887,"linkType":888},"4kbiWA3b096BAFGQuozPaK",[],{"data":6571,"content":6572,"nodeType":881},{},[6573,6577,6583],{"data":6574,"marks":6575,"value":6576,"nodeType":865},{},[],"It looks like broader cybercriminals are starting to take note of ConsentFix, and with the release of public tools like this one, it could be about to go mainstream — like ",{"data":6578,"content":6579,"nodeType":876},{"uri":938},[6580],{"data":6581,"marks":6582,"value":1307,"nodeType":865},{},[],{"data":6584,"marks":6585,"value":6586,"nodeType":865},{},[]," has this year. ",{"data":6588,"content":6589,"nodeType":881},{},[6590],{"data":6591,"marks":6592,"value":6593,"nodeType":865},{},[],"Let’s take a closer look at some of the more interesting details of the ConsentFix v3 implementation before considering the bigger picture.  ",{"data":6595,"content":6596,"nodeType":1860},{},[6597],{"data":6598,"marks":6599,"value":6601,"nodeType":865},{},[6600],{"type":902},"ConsentFix v3 under the hood",{"data":6603,"content":6604,"nodeType":881},{},[6605],{"data":6606,"marks":6607,"value":6608,"nodeType":865},{},[],"The first thing that jumps out is just how detailed this forum post is. It reads like a security vendor blog post. It walks through the key technical concepts that the reader needs to know, breaking down OAuth grants, consent phishing, refresh tokens, and FOCI (or 'Family of Client IDs' — basically, the feature that allows attackers to use a refresh token obtained for one Microsoft app to be exchanged for access tokens to other FOCI apps without re-authentication). It then walks through the history of ClickFix and ConsentFix before providing step-by-step guidance for users. ",{"data":6610,"content":6611,"nodeType":881},{},[6612],{"data":6613,"marks":6614,"value":6615,"nodeType":865},{},[],"ConsentFix v3 allows users to instrument the entire attack chain, enabling users to spin up ConsentFix infrastructure, create believable personas with which to interact with victims, craft and manage email campaigns, and automate the process of exchanging the captured OAuth token for session and refresh tokens to establish access to the compromised account. ",{"data":6617,"content":6618,"nodeType":881},{},[6619],{"data":6620,"marks":6621,"value":6622,"nodeType":865},{},[],"A combination of SaaS and open-source tools are used to perform the attack, including Cloudflare Workers for hosting, ZoomInfo for target identification, Dropbox for PDF hosting, and Pipedream as an exfiltration channel (effectively creating a webhook to automatically exchange the OAuth material in the URL for a refresh token). They also use hacker tools like SpecterPortal for post exploitation activity.",{"data":6624,"content":6625,"nodeType":894},{},[],{"data":6627,"content":6628,"nodeType":904},{},[6629],{"data":6630,"marks":6631,"value":6633,"nodeType":865},{},[6632],{"type":902},"Why attackers are turning to OAuth-based attacks",{"data":6635,"content":6636,"nodeType":881},{},[6637,6641,6648],{"data":6638,"marks":6639,"value":6640,"nodeType":865},{},[],"Attackers are increasingly turning to OAuth based techniques in 2026. Not only are “legit” OAuth connections being abused in supply chain attacks, but attacks targeting OAuth mechanisms have significantly increased with the rise of ",{"data":6642,"content":6643,"nodeType":876},{"uri":938},[6644],{"data":6645,"marks":6646,"value":1307,"nodeType":865},{},[6647],{"type":874},{"data":6649,"marks":6650,"value":6651,"nodeType":865},{},[],". This is because:",{"data":6653,"content":6654,"nodeType":1818},{},[6655,6665],{"data":6656,"content":6657,"nodeType":1734},{},[6658],{"data":6659,"content":6660,"nodeType":881},{},[6661],{"data":6662,"marks":6663,"value":6664,"nodeType":865},{},[],"OAuth attacks defeat standard access controls (including passkeys)",{"data":6666,"content":6667,"nodeType":1734},{},[6668],{"data":6669,"content":6670,"nodeType":881},{},[6671],{"data":6672,"marks":6673,"value":6674,"nodeType":865},{},[],"It’s very low friction, and less likely that users will identify it as phishing (see examples below)",{"data":6676,"content":6679,"nodeType":890},{"target":6677},{"sys":6678},{"id":6513,"type":887,"linkType":888},[],{"data":6681,"content":6684,"nodeType":890},{"target":6682},{"sys":6683},{"id":4908,"type":887,"linkType":888},[],{"data":6686,"content":6687,"nodeType":881},{},[6688],{"data":6689,"marks":6690,"value":6691,"nodeType":865},{},[],"From the user’s perspective, these aren’t situations that users are trained to treat as suspicious. In one case, the victim copies a URL (or simply drag-and-drops a box on the page). In another, they enter a short passcode that’s visible on the page. ",{"data":6693,"content":6694,"nodeType":881},{},[6695],{"data":6696,"marks":6697,"value":6698,"nodeType":865},{},[],"Both are using pop-up windows that look very convincing — and point to legitimate Microsoft pages/URLs. Even users scrutinizing the domain won’t see anything out of place. And as you can see, if the user is already signed into their Microsoft account in the browser, there’s no credential entry or MFA checks to pass through. Simply select your account from the drop down menu and … that’s it.",{"data":6700,"content":6701,"nodeType":881},{},[6702],{"data":6703,"marks":6704,"value":6705,"nodeType":865},{},[],"This unfamiliarity is the same reason that attacks like ClickFix have been so successful. In general, convincing social engineering — well crafted comms, legit-looking pages hosted on trusted sites — combined with unfamiliar payloads makes for a clever attack. And when these attacks play out entirely in the browser (circumventing endpoint controls) and sidestep identity controls, the impact is dialled up even further. ",{"data":6707,"content":6708,"nodeType":894},{},[],{"data":6710,"content":6711,"nodeType":904},{},[6712],{"data":6713,"marks":6714,"value":6716,"nodeType":865},{},[6715],{"type":902},"How ConsentFix and device code phishing overlap",{"data":6718,"content":6719,"nodeType":881},{},[6720,6724,6731],{"data":6721,"marks":6722,"value":6723,"nodeType":865},{},[],"It was only ever going to be a matter of time before ConsentFix was adopted by the mass market. But these things don’t always happen particularly fast. ",{"data":6725,"content":6726,"nodeType":876},{"uri":938},[6727],{"data":6728,"marks":6729,"value":360,"nodeType":865},{},[6730],{"type":874},{"data":6732,"marks":6733,"value":6734,"nodeType":865},{},[]," is probably the best example of this — it’s been a known technique since 2021, but it took until this year to enter mainstream adoption. A big part of that has been the availability of criminal toolkits, and also the rise in AI-assisted capabilities for tool creation (clearly at play here too). The similarity with device code phishing doesn’t end there. ",{"data":6736,"content":6737,"nodeType":881},{},[6738,6742,6751,6755,6764],{"data":6739,"marks":6740,"value":6741,"nodeType":865},{},[],"Both ConsentFix and device code phishing are OAuth attacks. They both find ways of bypassing the standard login procedure (and controls) by targeting different authorization flows, but with a similar outcome and the same advantages to an attacker. Device code phishing exploits the device authorization grant (",{"data":6743,"content":6745,"nodeType":876},{"uri":6744},"https://datatracker.ietf.org/doc/html/rfc8628",[6746],{"data":6747,"marks":6748,"value":6750,"nodeType":865},{},[6749],{"type":874},"RFC 8628",{"data":6752,"marks":6753,"value":6754,"nodeType":865},{},[],"). ConsentFix exploits the authorization code grant (",{"data":6756,"content":6758,"nodeType":876},{"uri":6757},"https://datatracker.ietf.org/doc/html/rfc6749#section-4.1",[6759],{"data":6760,"marks":6761,"value":6763,"nodeType":865},{},[6762],{"type":874},"RFC 6749",{"data":6765,"marks":6766,"value":6767,"nodeType":865},{},[],") as implemented for native/desktop apps with localhost redirects. ",{"data":6769,"content":6770,"nodeType":881},{},[6771],{"data":6772,"marks":6773,"value":6774,"nodeType":865},{},[],"The post-compromise paths are essentially identical because the tokens you get are determined by which app you target, what scopes it has, and the victim user’s permissions, not by which OAuth flow you used to obtain them. The authorization code flow and the device code flow are just different front doors into the same token issuance system.",{"data":6776,"content":6780,"nodeType":890},{"target":6777},{"sys":6778},{"id":6779,"type":887,"linkType":888},"7np3j139dWMP7sLlUQwEFC",[],{"data":6782,"content":6783,"nodeType":894},{},[],{"data":6785,"content":6786,"nodeType":904},{},[6787],{"data":6788,"marks":6789,"value":6791,"nodeType":865},{},[6790],{"type":902},"The verdict: An interesting sign of what’s coming, but maybe not the final form",{"data":6793,"content":6794,"nodeType":881},{},[6795],{"data":6796,"marks":6797,"value":6798,"nodeType":865},{},[],"It’s clear that ConsentFix v3 isn’t exactly an industrialized PhaaS-scale offering. It’s probably closer to a red team-esque proof of concept. But it is a good example of how attackers could operationalize ConsentFix campaigns using largely off-the-shelf tooling and legit SaaS tools. And an indicator of what might be coming soon. ",{"data":6800,"content":6801,"nodeType":894},{},[],{"data":6803,"content":6804,"nodeType":904},{},[6805],{"data":6806,"marks":6807,"value":4308,"nodeType":865},{},[6808],{"type":902},{"data":6810,"content":6811,"nodeType":881},{},[6812],{"data":6813,"marks":6814,"value":6815,"nodeType":865},{},[],"To be able to tackle modern attacks like ConsentFix that occur entirely within the browser context, it is vital that organizations look to monitor the browser as a detection surface, hunt for signs of malicious activity, and block attacks in real-time — in the same way that you would expect EDR to work for endpoint attacks. We’ll talk about how we do this below, but first here’s some general recommendations. ",{"data":6817,"content":6818,"nodeType":1860},{},[6819],{"data":6820,"marks":6821,"value":6823,"nodeType":865},{},[6822],{"type":902},"Microsoft ecosystem",{"data":6825,"content":6826,"nodeType":881},{},[6827,6831,6839],{"data":6828,"marks":6829,"value":6830,"nodeType":865},{},[],"Despite the similarity with device code phishing, the ",{"data":6832,"content":6833,"nodeType":876},{"uri":4332},[6834],{"data":6835,"marks":6836,"value":6838,"nodeType":865},{},[6837],{"type":874},"primary recommendation from Microsoft for device code attacks",{"data":6840,"marks":6841,"value":6842,"nodeType":865},{},[]," — disable the device code flow via conditional access — doesn’t apply to ConsentFix (because, as mentioned, it uses a different login flow).",{"data":6844,"content":6845,"nodeType":881},{},[6846,6850,6859],{"data":6847,"marks":6848,"value":6849,"nodeType":865},{},[],"For both ConsentFix and device code phishing, the ",{"data":6851,"content":6853,"nodeType":876},{"uri":6852},"https://msendpointmgr.com/2026/01/08/consentfix-quickfix/",[6854],{"data":6855,"marks":6856,"value":6858,"nodeType":865},{},[6857],{"type":874},"strongest recommendation",{"data":6860,"marks":6861,"value":6862,"nodeType":865},{},[]," is to create Service Principals for each of the vulnerable apps and restrict the users that are authorized to access them to reduce the attack surface of users that can be phished with this method.",{"data":6864,"content":6865,"nodeType":881},{},[6866],{"data":6867,"marks":6868,"value":6869,"nodeType":865},{},[],"You should also hunt in logs for relevant application IDs and resource IDs, and look for mismatches in terms of the initial access IP and subsequent activity, because while the initial login is performed by the user, subsequent actions will be performed by the attacker.  ",{"data":6871,"content":6875,"nodeType":890},{"target":6872},{"sys":6873},{"id":6874,"type":887,"linkType":888},"49Y7NXpnAeAYe9fCp1oyKn",[],{"data":6877,"content":6878,"nodeType":1860},{},[6879],{"data":6880,"marks":6881,"value":6883,"nodeType":865},{},[6882],{"type":902},"Beyond Microsoft — Google, GitHub, Salesforce, AWS",{"data":6885,"content":6886,"nodeType":881},{},[6887],{"data":6888,"marks":6889,"value":6890,"nodeType":865},{},[],"It’s worth calling out that these recommendations are Microsoft specific. While in-the-wild exploitation has focused on Microsoft, GitHub, Salesforce, AWS and others are also impacted by device code phishing, supporting device code flow either as a primary or fallback mechanism (Google less so due to inherent restrictions on scopes authorized in the context of device code logins). ",{"data":6892,"content":6893,"nodeType":881},{},[6894],{"data":6895,"marks":6896,"value":6897,"nodeType":865},{},[],"Similarly, ConsentFix principles can be applied beyond Microsoft too. The core requirement is that an OAuth code ends up in a location the victim can manually see and share, e.g. a localhost redirect where no listener is present to complete the handshake. Google Cloud CLI, GitHub CLI, and others support the auth code grant and allow localhost as a redirect URI. ",{"data":6899,"content":6900,"nodeType":894},{},[],{"data":6902,"content":6903,"nodeType":904},{},[6904],{"data":6905,"marks":6906,"value":5936,"nodeType":865},{},[6907],{"type":902},{"data":6909,"content":6910,"nodeType":881},{},[6911],{"data":6912,"marks":6913,"value":6914,"nodeType":865},{},[],"We’re already detecting and blocking both ConsentFix and device code phishing attacks as they target users in their web browser. When a page matches our detections for a device code or ConsentFix phishing kit (not limited to things like known-bad IPs and domains, but DOM-level analysis of the web page) Push detects and blocks it. Unlike an SWG or RBI type solution, Push analyzes every web page in every browser session and tab, in real time, with no latency. ",{"data":6916,"content":6920,"nodeType":890},{"target":6917},{"sys":6918},{"id":6919,"type":887,"linkType":888},"63EwHbmFZVAlhoXl17Xjfi",[],{"data":6922,"content":6923,"nodeType":881},{},[6924,6927,6934],{"data":6925,"marks":6926,"value":4414,"nodeType":865},{},[],{"data":6928,"content":6929,"nodeType":876},{"uri":4417},[6930],{"data":6931,"marks":6932,"value":4423,"nodeType":865},{},[6933],{"type":874},{"data":6935,"marks":6936,"value":6937,"nodeType":865},{},[]," whenever a user accesses a URL used for device code logins, across any app that supports them. This provides universal, last-mile protection against even ‘zero-day’ device code phishing attacks using previously unidentified toolkits.  ",{"data":6939,"content":6943,"nodeType":890},{"target":6940},{"sys":6941},{"id":6942,"type":887,"linkType":888},"3baS2yqvJd2e4aczw73PTF",[],{"data":6945,"content":6946,"nodeType":881},{},[6947],{"data":6948,"marks":6949,"value":6950,"nodeType":865},{},[],"When a user visits those URLs, Push will also emit a webhook event that the banner was shown and acknowledged. If a user opts to proceed, you can treat this as a high-fidelity alert for your security team to investigate, providing app-agnostic telemetry that may not already be provided in your logs from that particular vendor. You can also simply use Push to block users from accessing these pages if you’re confident that disruption won’t be caused. ",{"data":6952,"content":6953,"nodeType":1860},{},[6954],{"data":6955,"marks":6956,"value":4448,"nodeType":865},{},[6957],{"type":902},{"data":6959,"content":6960,"nodeType":881},{},[6961],{"data":6962,"marks":6963,"value":6964,"nodeType":865},{},[],"Push Security's browser-based security platform detects and blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, device code phishing, ClickFix, and session hijacking. You don't need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your attack surface.",{"data":6966,"content":6967,"nodeType":881},{},[6968,6971,6978,6981,6988,6991,6998],{"data":6969,"marks":6970,"value":4462,"nodeType":865},{},[],{"data":6972,"content":6973,"nodeType":876},{"uri":4465},[6974],{"data":6975,"marks":6976,"value":4471,"nodeType":865},{},[6977],{"type":874},{"data":6979,"marks":6980,"value":1877,"nodeType":865},{},[],{"data":6982,"content":6983,"nodeType":876},{"uri":4477},[6984],{"data":6985,"marks":6986,"value":4483,"nodeType":865},{},[6987],{"type":874},{"data":6989,"marks":6990,"value":4487,"nodeType":865},{},[],{"data":6992,"content":6993,"nodeType":876},{"uri":1453},[6994],{"data":6995,"marks":6996,"value":4495,"nodeType":865},{},[6997],{"type":874},{"data":6999,"marks":7000,"value":959,"nodeType":865},{},[],{"entries":7002},{"hyperlink":7003,"inline":7004,"block":7005},[],[],[7006,7013,7039,7046,7085,7092,7098,7103,7109,7172,7198,7205],{"sys":7007,"__typename":7008,"title":7009,"caption":7009,"layoutMode":59,"file":7010},{"id":6475},"Image","ConsentFix attack breakdown: The victim is tricked into copy-and-pasting a URL containing OAuth key material into a phishing page.",{"url":7011,"width":7012,"height":16},"https://images.ctfassets.net/y1cdw1ablpvd/tbetqlx85alVSg3LbHw8m/793ee588bd0347f6d1497b882b4a9f3f/image6.png",1999,{"sys":7014,"__typename":7015,"content":7016,"name":7038,"title":59},{"id":6488},"InsightTextBlockComponent",{"json":7017},{"nodeType":1463,"data":7018,"content":7019},{},[7020],{"nodeType":881,"data":7021,"content":7022},{},[7023,7027,7034],{"nodeType":865,"value":7024,"marks":7025,"data":7026},"This attack is best understood as post-authentication. If the victim is already signed in to Microsoft in their browser, they simply need to select their account name from a drop-down menu. There’s almost no friction — no credential entry or MFA checks. This is very similar to ",[],{},{"nodeType":876,"data":7028,"content":7029},{"uri":938},[7030],{"nodeType":865,"value":1307,"marks":7031,"data":7033},[7032],{"type":874},{},{"nodeType":865,"value":7035,"marks":7036,"data":7037},", another OAuth-based phishing technique, which we’ve seen increase 37x this year. More on that later. ",[],{},"ConsentFix v3 IB1",{"sys":7040,"__typename":7008,"title":7041,"caption":7041,"layoutMode":59,"file":7042},{"id":6513},"John Hammond showed off a slick new ConsentFix implementation.",{"url":7043,"width":7044,"height":7045},"https://images.ctfassets.net/y1cdw1ablpvd/1bjvJgwJQYYITray4cgquD/056744beab8fd24153b1c42b73090aeb/consentfix_v2.gif",1280,720,{"sys":7047,"__typename":7015,"content":7048,"name":7084,"title":59},{"id":6519},{"json":7049},{"nodeType":1463,"data":7050,"content":7051},{},[7052],{"nodeType":881,"data":7053,"content":7054},{},[7055,7059,7067,7071,7080],{"nodeType":865,"value":7056,"marks":7057,"data":7058},"We recently joined forces with John in a webinar where we showed off ConsentFix along with a host of other browser-based attacks. If you joined us, you’ll have already had a quick look at what we’re about to talk about below! ",[],{},{"nodeType":876,"data":7060,"content":7061},{"uri":1440},[7062],{"nodeType":865,"value":7063,"marks":7064,"data":7066},"You can watch it on-demand here.",[7065],{"type":874},{},{"nodeType":865,"value":7068,"marks":7069,"data":7070}," And you can watch John’s follow up on ",[],{},{"nodeType":876,"data":7072,"content":7074},{"uri":7073},"https://www.youtube.com/watch?v=T3oVdPCMDJw",[7075],{"nodeType":865,"value":7076,"marks":7077,"data":7079},"ConsentFix v3",[7078],{"type":874},{},{"nodeType":865,"value":7081,"marks":7082,"data":7083}," here — definitely worth a watch as always! ",[],{},"ConsentFix v3 IB2",{"sys":7086,"__typename":7008,"title":7087,"caption":7087,"layoutMode":59,"file":7088},{"id":6556},"XSS forum post on ConsentFix v3",{"url":7089,"width":7090,"height":7091},"https://images.ctfassets.net/y1cdw1ablpvd/KSVQYgv1VDhIF19jUcaOc/81fc5771fd4ce4fbe38d0d138f7970a6/image3.png",1915,1079,{"sys":7093,"__typename":7008,"title":7094,"caption":7094,"layoutMode":59,"file":7095},{"id":6562},"Description of ConsentFix v3 complete with summary video.",{"url":7096,"width":7097,"height":7091},"https://images.ctfassets.net/y1cdw1ablpvd/stbiG200DHN4huH6iaCQg/d1db13d4e04c4c528ce35320b05f4d3d/image12.png",1919,{"sys":7099,"__typename":7100,"title":7076,"arcadeDemoUrl":7101,"playText":7102},{"id":6568},"ArcadeDemo","https://demo.arcade.software/BO6Dc4lxhzlgHHvEeWi9?embed","2 mins",{"sys":7104,"__typename":7008,"title":7105,"caption":7106,"layoutMode":59,"file":7107},{"id":4908},"Device code phishing kit example","Device code phishing kit example.",{"url":7108,"width":7044,"height":7045},"https://images.ctfassets.net/y1cdw1ablpvd/2zbjCCqXRMTvaOr6Xpx2BJ/ccb3000b043b3bbc11a6d2315e66f6f1/Copy_of_Device_code_login_completion.gif",{"sys":7110,"__typename":7015,"content":7111,"name":7171,"title":59},{"id":6779},{"json":7112},{"nodeType":1463,"data":7113,"content":7114},{},[7115,7122],{"nodeType":881,"data":7116,"content":7117},{},[7118],{"nodeType":865,"value":7119,"marks":7120,"data":7121},"The different application IDs that attackers can target here vary a little per technique based on the auth flows supported. FOCI apps present the broadest utility (particularly for non-admin targets) and can be targeted via both device code phishing and ConsentFix. In practice, this means an attacker who phishes a token for one app can silently pivot to access Outlook, Teams, OneDrive, SharePoint, and so on via API.",[],{},{"nodeType":881,"data":7123,"content":7124},{},[7125,7129,7137,7141,7146,7150,7155,7159,7167],{"nodeType":865,"value":7126,"marks":7127,"data":7128},"If they want to take it even further, they can use the well-known ",[],{},{"nodeType":876,"data":7130,"content":7131},{"uri":1615},[7132],{"nodeType":865,"value":7133,"marks":7134,"data":7136},"Primary Refresh Token (PRT) escalation technique",[7135],{"type":874},{},{"nodeType":865,"value":7138,"marks":7139,"data":7140}," to get seamless SSO across ",[],{},{"nodeType":865,"value":7142,"marks":7143,"data":7145},"all",[7144],{"type":5120},{},{"nodeType":865,"value":7147,"marks":7148,"data":7149}," Entra ID-connected applications and web services (basically upgrading to normal browser-level access). This requires that you specifically target the ",[],{},{"nodeType":865,"value":7151,"marks":7152,"data":7154},"Microsoft Authentication Broker",[7153],{"type":902},{},{"nodeType":865,"value":7156,"marks":7157,"data":7158}," application, chaining it into a new device registration in the victim's environment. (This is the method that ",[],{},{"nodeType":876,"data":7160,"content":7161},{"uri":1713},[7162],{"nodeType":865,"value":7163,"marks":7164,"data":7166},"Storm-2372",[7165],{"type":874},{},{"nodeType":865,"value":7168,"marks":7169,"data":7170}," used in a major 2025 device code phishing campaign.)",[],{},"ConsentFix v3 IB3",{"sys":7173,"__typename":7015,"content":7174,"name":7197,"title":59},{"id":6874},{"json":7175},{"data":7176,"content":7177,"nodeType":1463},{},[7178],{"data":7179,"content":7180,"nodeType":881},{},[7181,7184,7193],{"data":7182,"marks":7183,"value":21,"nodeType":865},{},[],{"data":7185,"content":7187,"nodeType":876},{"uri":7186},"https://entrascopes.com/?foci=true",[7188],{"data":7189,"marks":7190,"value":7192,"nodeType":865},{},[7191],{"type":874},"This is a great resource",{"data":7194,"marks":7195,"value":7196,"nodeType":865},{},[]," from Fabian Bader and Dirk-jan Mollema enabling you to search through first-party Microsoft apps, resource IDs, FOCI apps, apps with conditional access exclusions, and those vulnerable to ConsentFix attacks. You’d need to go through the process of creating Service Principals for them and assign specific users based on required access. You’d want to do this for all of the apps that come with pre-consented permissions, conditional access exclusions, FOCI, and so on. But of course if an assigned user gets phished, the attack can still succeed. ","ConsentFix v3 IB4",{"sys":7199,"__typename":7008,"title":7200,"caption":7200,"layoutMode":59,"file":7201},{"id":6919},"When users attempt to visit malicious sites that trigger our detections, they are redirected to a safe URL and shown a customizable block screen.",{"url":7202,"width":7203,"height":7204},"https://images.ctfassets.net/y1cdw1ablpvd/2losZN7HBexdcDRlMGYMA6/0c24a2abdcc154c9faa33750db1eaed0/image4.png",1440,767,{"sys":7206,"__typename":7008,"title":7207,"caption":7207,"layoutMode":59,"file":7208},{"id":6942},"Device code phishing customizable warning banner.",{"url":7209,"width":7210,"height":7211},"https://images.ctfassets.net/y1cdw1ablpvd/21kgdVDgvY6yI4cUzZ5eth/51fbb6782e10e4a23b37b020d8b288de/image10.png",1367,859,{"items":7213},[],{},"Investigating a new criminal toolkit for ConsentFix","threat-research","2026-04-23T00:00:00.000Z",{"items":7219},[7220,8085,10802],{"__typename":1485,"sys":7221,"content":7223,"title":8071,"synopsis":8072,"hashTags":59,"publishedDate":8073,"slug":8074,"tagsCollection":8075,"authorsCollection":8081},{"id":7222},"71EaaK7lfl6bQBbkAU0qjv",{"json":7224},{"data":7225,"content":7226,"nodeType":1463},{},[7227,7235,7242,7249,7256,7268,7275,7281,7287,7290,7298,7305,7312,7318,7338,7345,7351,7358,7364,7371,7414,7420,7426,7433,7440,7443,7451,7471,7478,7484,7502,7508,7527,7534,7537,7545,7552,7596,7608,7611,7619,7636,7643,7659,7666,7673,7679,7686,7689,7697,7704,7757,7764,7767,7775,7781,7788,7795,7801,7808,7841,7848,7855,7861,7868,7874,7882,7902,7909,7942,7949,7982,7985,7993,8000,8006,8025,8032,8059,8065],{"data":7228,"content":7229,"nodeType":904},{},[7230],{"data":7231,"marks":7232,"value":7234,"nodeType":865},{},[7233],{"type":902},"Introducing “ConsentFix” — a new kind of phishing attack",{"data":7236,"content":7237,"nodeType":881},{},[7238],{"data":7239,"marks":7240,"value":7241,"nodeType":865},{},[],"The Push browser agent recently detected and blocked a new attack technique seen targeting several Push customers. ",{"data":7243,"content":7244,"nodeType":881},{},[7245],{"data":7246,"marks":7247,"value":7248,"nodeType":865},{},[],"This is a new kind of browser-based attack technique that takes over user accounts with a simple copy and paste. If you’re already logged into the app in your browser, you don’t even need to supply creds, or pass an MFA check — meaning it effectively circumvents phishing-resistant auth like passkeys too.",{"data":7250,"content":7251,"nodeType":881},{},[7252],{"data":7253,"marks":7254,"value":7255,"nodeType":865},{},[],"This is so different from the AiTM phish kits we usually come up against that we felt it deserved a new name. ",{"data":7257,"content":7258,"nodeType":881},{},[7259,7264],{"data":7260,"marks":7261,"value":7263,"nodeType":865},{},[7262],{"type":902},"Enter: ConsentFix. ",{"data":7265,"marks":7266,"value":7267,"nodeType":865},{},[],"This attack shares a lot of similarities with ClickFix/FileFix, AiTM phishing, and OAuth Consent Phishing. You can think of this as a browser-native ClickFix attack that phishes an OAuth token on a target app by getting the victim to copy and paste a URL containing OAuth key material into a phishing page. ",{"data":7269,"content":7270,"nodeType":881},{},[7271],{"data":7272,"marks":7273,"value":7274,"nodeType":865},{},[],"The campaign we detected looks to be specifically targeting Microsoft accounts by abusing the Azure CLI OAuth app. Essentially, the attacker tricks the victim into logging into Azure CLI, by generating an OAuth authorization code — visible in a localhost URL — and then pasting that URL (including the code) into an attacker-controlled page. This then creates an OAuth connection between the victim’s Microsoft account and the attacker’s Azure CLI instance. ",{"data":7276,"content":7280,"nodeType":890},{"target":7277},{"sys":7278},{"id":7279,"type":887,"linkType":888},"5GTnqWIbmraz8HZeHMybrP",[],{"data":7282,"content":7286,"nodeType":890},{"target":7283},{"sys":7284},{"id":7285,"type":887,"linkType":888},"1lcjX5q3b1bsuhyOXKvJpW",[],{"data":7288,"content":7289,"nodeType":894},{},[],{"data":7291,"content":7292,"nodeType":904},{},[7293],{"data":7294,"marks":7295,"value":7297,"nodeType":865},{},[7296],{"type":902},"How ConsentFix works",{"data":7299,"content":7300,"nodeType":881},{},[7301],{"data":7302,"marks":7303,"value":7304,"nodeType":865},{},[],"In all of the examples we saw, the victim accessed a malicious or compromised webpage via Google Search. The vast majority of the sites we’ve seen associated with the campaign are legitimate, compromised websites with high domain reputation that are easily findable via search engines.",{"data":7306,"content":7307,"nodeType":881},{},[7308],{"data":7309,"marks":7310,"value":7311,"nodeType":865},{},[],"The attacker had injected a fake Cloudflare Turnstile into the compromised websites, requiring an email address to be supplied in order to proceed. ",{"data":7313,"content":7317,"nodeType":890},{"target":7314},{"sys":7315},{"id":7316,"type":887,"linkType":888},"39jEjeLqOYIkGc4o9w3MuX",[],{"data":7319,"content":7320,"nodeType":881},{},[7321,7325,7334],{"data":7322,"marks":7323,"value":7324,"nodeType":865},{},[],"This acted as a form of ",{"data":7326,"content":7328,"nodeType":876},{"uri":7327},"https://phishing-techniques.pushsecurity.com/techniques/conditional-loading/",[7329],{"data":7330,"marks":7331,"value":7333,"nodeType":865},{},[7332],{"type":874},"conditional loading",{"data":7335,"marks":7336,"value":7337,"nodeType":865},{},[]," that would only continue if a valid email address and domain was supplied, designed to prevent the page from being analyzed by security bots, analysts, and low-value accounts that run the risk of exposing the campaign before the intended recipient(s) can be phished. ",{"data":7339,"content":7340,"nodeType":881},{},[7341],{"data":7342,"marks":7343,"value":7344,"nodeType":865},{},[],"If a domain not on the target list was provided, the victim was passed back to the original website and the attack did not progress to the next stage. Further, once the check has concluded per IP, the phishing page will no longer activate, even a different email is provided.  ",{"data":7346,"content":7350,"nodeType":890},{"target":7347},{"sys":7348},{"id":7349,"type":887,"linkType":888},"7ttmGnTzi9j87tBXfyFcOA",[],{"data":7352,"content":7353,"nodeType":881},{},[7354],{"data":7355,"marks":7356,"value":7357,"nodeType":865},{},[],"After entering an approved email address, the next stage was loaded, prompting the victim to complete a set of instructions on the page to continue.",{"data":7359,"content":7363,"nodeType":890},{"target":7360},{"sys":7361},{"id":7362,"type":887,"linkType":888},"2oHYNoMgAz6MdgLlcWjbaB",[],{"data":7365,"content":7366,"nodeType":881},{},[7367],{"data":7368,"marks":7369,"value":7370,"nodeType":865},{},[],"To complete the attack, the victim must:",{"data":7372,"content":7373,"nodeType":1818},{},[7374,7384,7394,7404],{"data":7375,"content":7376,"nodeType":1734},{},[7377],{"data":7378,"content":7379,"nodeType":881},{},[7380],{"data":7381,"marks":7382,"value":7383,"nodeType":865},{},[],"Click the “Sign In” button. This opens a new tab that loads a legitimate Microsoft URL associated with the user account/email used to access the page.",{"data":7385,"content":7386,"nodeType":1734},{},[7387],{"data":7388,"content":7389,"nodeType":881},{},[7390],{"data":7391,"marks":7392,"value":7393,"nodeType":865},{},[],"If the user is already logged into Microsoft in their browser, they simply need to select their MS account from the dropdown. Otherwise, they will be required to login via the legitimate Microsoft login URL (no phishing takes place at this stage). ",{"data":7395,"content":7396,"nodeType":1734},{},[7397],{"data":7398,"content":7399,"nodeType":881},{},[7400],{"data":7401,"marks":7402,"value":7403,"nodeType":865},{},[],"Once logged into legit Microsoft or the account is selected from the dropdown, the user is redirected to localhost, which generates a URL containing a code associated with the user’s Microsoft account. ",{"data":7405,"content":7406,"nodeType":1734},{},[7407],{"data":7408,"content":7409,"nodeType":881},{},[7410],{"data":7411,"marks":7412,"value":7413,"nodeType":865},{},[],"To complete the phish, the victim copies the URL and pastes it onto the original page. ",{"data":7415,"content":7419,"nodeType":890},{"target":7416},{"sys":7417},{"id":7418,"type":887,"linkType":888},"7zendMbmCViGwtEpUQvq6y",[],{"data":7421,"content":7425,"nodeType":890},{"target":7422},{"sys":7423},{"id":7424,"type":887,"linkType":888},"1eZOs7hXi9FzCE92QEP6xh",[],{"data":7427,"content":7428,"nodeType":881},{},[7429],{"data":7430,"marks":7431,"value":7432,"nodeType":865},{},[],"Once the steps are completed, the victim has granted the attacker access to their Microsoft account via Azure CLI. ",{"data":7434,"content":7435,"nodeType":881},{},[7436],{"data":7437,"marks":7438,"value":7439,"nodeType":865},{},[],"At this point, the attacker has effective control of the victim’s Microsoft account, but without ever needing to phish a password, or pass an MFA check. In fact, if the user was already logged in to their Microsoft account (i.e. they had an active session) no login is required at all. ",{"data":7441,"content":7442,"nodeType":894},{},[],{"data":7444,"content":7445,"nodeType":904},{},[7446],{"data":7447,"marks":7448,"value":7450,"nodeType":865},{},[7449],{"type":902},"The next evolution of ClickFix?",{"data":7452,"content":7453,"nodeType":881},{},[7454,7458,7467],{"data":7455,"marks":7456,"value":7457,"nodeType":865},{},[],"When we presented ",{"data":7459,"content":7461,"nodeType":876},{"uri":7460},"https://pushsecurity.com/webinar/clickfix",[7462],{"data":7463,"marks":7464,"value":7466,"nodeType":865},{},[7465],{"type":874},"our last webinar on ClickFix",{"data":7468,"marks":7469,"value":7470,"nodeType":865},{},[],", we predicted that the next evolution of the attack would happen entirely within the browser context. This is because any attack that touches the endpoint (a traditionally much better protected surface) is way more likely to be detected. And with many ClickFix attacks being used to deliver infostealer malware, these attacks are really trying to get back into the browser anyway — to steal credentials and sessions stored there. ",{"data":7472,"content":7473,"nodeType":881},{},[7474],{"data":7475,"marks":7476,"value":7477,"nodeType":865},{},[],"Let’s take a closer look at the page — if you follow Push research, you might be getting déjà vu. ",{"data":7479,"content":7483,"nodeType":890},{"target":7480},{"sys":7481},{"id":7482,"type":887,"linkType":888},"1vMZCJ92IxFdR1EzzCOOvb",[],{"data":7485,"content":7486,"nodeType":881},{},[7487,7491,7499],{"data":7488,"marks":7489,"value":7490,"nodeType":865},{},[],"We’ve seen this kind of embedded video player before (albeit a slicker looking one) that we blogged about as ",{"data":7492,"content":7493,"nodeType":876},{"uri":1139},[7494],{"data":7495,"marks":7496,"value":7498,"nodeType":865},{},[7497],{"type":874},"the most advanced ClickFix we’d seen",{"data":7500,"marks":7501,"value":959,"nodeType":865},{},[],{"data":7503,"content":7507,"nodeType":890},{"target":7504},{"sys":7505},{"id":7506,"type":887,"linkType":888},"ID7VKJNOZk729P5zBOBjZ",[],{"data":7509,"content":7510,"nodeType":881},{},[7511,7515,7523],{"data":7512,"marks":7513,"value":7514,"nodeType":865},{},[],"Another similarity with ClickFix campaigns we’ve investigated is the use of Google Search as a delivery vector. 4 in 5 ClickFix attacks intercepted by Push came via Google Search, with attackers using ",{"data":7516,"content":7518,"nodeType":876},{"uri":7517},"https://phishing-techniques.pushsecurity.com/techniques/malvertising/",[7519],{"data":7520,"marks":7521,"value":441,"nodeType":865},{},[7522],{"type":874},{"data":7524,"marks":7525,"value":7526,"nodeType":865},{},[]," and either compromised or custom vibe-coded websites to intercept users as they browse the internet. ",{"data":7528,"content":7529,"nodeType":881},{},[7530],{"data":7531,"marks":7532,"value":7533,"nodeType":865},{},[],"So it seems highly likely that this is a kind of browser-native evolution of ClickFix that shares many elements with typical ClickFix attacks, and is probably used by the same groups of attackers.",{"data":7535,"content":7536,"nodeType":894},{},[],{"data":7538,"content":7539,"nodeType":904},{},[7540],{"data":7541,"marks":7542,"value":7544,"nodeType":865},{},[7543],{"type":902},"OAuth shenanigans via Azure CLI",{"data":7546,"content":7547,"nodeType":881},{},[7548],{"data":7549,"marks":7550,"value":7551,"nodeType":865},{},[],"The clever use of Azure CLI and OAuth consent abuse is another clever iteration on previous techniques. ",{"data":7553,"content":7554,"nodeType":881},{},[7555,7559,7568,7571,7579,7583,7592],{"data":7556,"marks":7557,"value":7558,"nodeType":865},{},[],"We’ve previously seen ",{"data":7560,"content":7562,"nodeType":876},{"uri":7561},"https://phishing-techniques.pushsecurity.com/techniques/consent-phishing/",[7563],{"data":7564,"marks":7565,"value":7567,"nodeType":865},{},[7566],{"type":874},"consent phishing",{"data":7569,"marks":7570,"value":1651,"nodeType":865},{},[],{"data":7572,"content":7574,"nodeType":876},{"uri":7573},"https://phishing-techniques.pushsecurity.com/techniques/device-code-phishing/",[7575],{"data":7576,"marks":7577,"value":1307,"nodeType":865},{},[7578],{"type":874},{"data":7580,"marks":7581,"value":7582,"nodeType":865},{},[]," attacks where attackers have tricked victims into connecting malicious external apps into their tenant via OAuth, but this is becoming increasingly difficult in core enterprise cloud environments like Azure due to ",{"data":7584,"content":7586,"nodeType":876},{"uri":7585},"https://learn.microsoft.com/en-us/microsoft-365/admin/misc/user-consent?view=o365-worldwide",[7587],{"data":7588,"marks":7589,"value":7591,"nodeType":865},{},[7590],{"type":874},"stricter default configs",{"data":7593,"marks":7594,"value":7595,"nodeType":865},{},[],". However, since Azure CLI is a first-party Microsoft app, it is implicitly trusted in Entra ID, and is excluded from these restrictions. ",{"data":7597,"content":7598,"nodeType":881},{},[7599,7603],{"data":7600,"marks":7601,"value":7602,"nodeType":865},{},[],"First-party apps like Azure CLI are trusted by default in all tenants, allowed to request permissions without admin approval, and cannot be deleted or blocked. They can also be granted special permissions, such as tenant-wide service permissions (without needing admin approval), use of legacy or undocumented graph scopes, internal scopes for Microsoft client operations, and permissions for Office/Entra admin functions. ",{"data":7604,"marks":7605,"value":7607,"nodeType":865},{},[7606],{"type":902},"This makes Azure CLI a prime target for attackers, and significantly more exploitable than when connecting a third-party app. ",{"data":7609,"content":7610,"nodeType":894},{},[],{"data":7612,"content":7613,"nodeType":904},{},[7614],{"data":7615,"marks":7616,"value":7618,"nodeType":865},{},[7617],{"type":902},"Advanced detection evasion techniques",{"data":7620,"content":7621,"nodeType":881},{},[7622,7626,7632],{"data":7623,"marks":7624,"value":7625,"nodeType":865},{},[],"This campaign features some of the most advanced ",{"data":7627,"content":7628,"nodeType":876},{"uri":1022},[7629],{"data":7630,"marks":7631,"value":1951,"nodeType":865},{},[],{"data":7633,"marks":7634,"value":7635,"nodeType":865},{},[]," we've seen in the wild. ",{"data":7637,"content":7638,"nodeType":881},{},[7639],{"data":7640,"marks":7641,"value":7642,"nodeType":865},{},[],"As well as the use of Google Search to deliver the lure, and bot protection to prevent security tools from analyzing the page, there were multiple layers of anti-analysis techniques to navigate.",{"data":7644,"content":7645,"nodeType":881},{},[7646,7650,7655],{"data":7647,"marks":7648,"value":7649,"nodeType":865},{},[],"We already mentioned the use of selective targeting based on email addresses and domain names. But all sites involved in the campaign also have synchronized IP blocking — meaning if you visit one site and are served one of the associated phishing pages, the phish will never be served again, ",{"data":7651,"marks":7652,"value":7654,"nodeType":865},{},[7653],{"type":902},"across any of the sites linked to the campaign",{"data":7656,"marks":7657,"value":7658,"nodeType":865},{},[],". When you visit any of the sites again, the phish won't trigger, and it can be browsed as normal. ",{"data":7660,"content":7661,"nodeType":881},{},[7662],{"data":7663,"marks":7664,"value":7665,"nodeType":865},{},[],"On the backend, there are multiple checks based on your IP and identifiers unique to your session. Unless all of the conditions are met, certain JavaScript packages won't be served — preventing full inspection of the page to detect malicious elements. ",{"data":7667,"content":7668,"nodeType":881},{},[7669],{"data":7670,"marks":7671,"value":7672,"nodeType":865},{},[],"If the conditions aren't met, the page may not load the Cloudflare Turnstile check at all, or will redirect you back to the site to continue browsing as normal.",{"data":7674,"content":7678,"nodeType":890},{"target":7675},{"sys":7676},{"id":7677,"type":887,"linkType":888},"5v0zDoscA6pYLBfkXrNtIH",[],{"data":7680,"content":7681,"nodeType":881},{},[7682],{"data":7683,"marks":7684,"value":7685,"nodeType":865},{},[],"All of these make it incredibly hard to detect and block these attacks ahead of time when relying on URL-based checks and traffic analysis.",{"data":7687,"content":7688,"nodeType":894},{},[],{"data":7690,"content":7691,"nodeType":904},{},[7692],{"data":7693,"marks":7694,"value":7696,"nodeType":865},{},[7695],{"type":902},"Key takeaways",{"data":7698,"content":7699,"nodeType":881},{},[7700],{"data":7701,"marks":7702,"value":7703,"nodeType":865},{},[],"ConsentFix is a dangerous evolution of ClickFix and consent phishing that is incredibly hard for traditional security tools to detect and block, as:",{"data":7705,"content":7706,"nodeType":1818},{},[7707,7717,7727,7737,7747],{"data":7708,"content":7709,"nodeType":1734},{},[7710],{"data":7711,"content":7712,"nodeType":881},{},[7713],{"data":7714,"marks":7715,"value":7716,"nodeType":865},{},[],"The attack happens entirely inside the browser context, removing one of the key detection opportunities for ClickFix (because it doesn’t touch the endpoint).",{"data":7718,"content":7719,"nodeType":1734},{},[7720],{"data":7721,"content":7722,"nodeType":881},{},[7723],{"data":7724,"marks":7725,"value":7726,"nodeType":865},{},[],"Delivering the lure via a Google Search watering hole attack completely circumvents email-based anti-phishing controls.",{"data":7728,"content":7729,"nodeType":1734},{},[7730],{"data":7731,"content":7732,"nodeType":881},{},[7733],{"data":7734,"marks":7735,"value":7736,"nodeType":865},{},[],"Targeting a first-party app like Azure CLI means that many of the mitigating controls available for third-party app integrations do not apply — making this attack way harder to prevent.",{"data":7738,"content":7739,"nodeType":1734},{},[7740],{"data":7741,"content":7742,"nodeType":881},{},[7743],{"data":7744,"marks":7745,"value":7746,"nodeType":865},{},[],"Because there’s no login required, phishing-resistant authentication controls like passkeys have no impact on this attack. ",{"data":7748,"content":7749,"nodeType":1734},{},[7750],{"data":7751,"content":7752,"nodeType":881},{},[7753],{"data":7754,"marks":7755,"value":7756,"nodeType":865},{},[],"The use of advanced detection evasion techniques makes this attack difficult to investigate, meaning these attacks are going undetected. ",{"data":7758,"content":7759,"nodeType":881},{},[7760],{"data":7761,"marks":7762,"value":7763,"nodeType":865},{},[],"We’re sure to see more examples of ConsentFix in future. We’ll be monitoring to see how attackers adapt in terms of integrating these capabilities with common as-a-Service offerings to make them more widespread, and whether the scope extends further beyond Microsoft / Azure CLI targets in the future to target other enterprise cloud ecosystems. ",{"data":7765,"content":7766,"nodeType":894},{},[],{"data":7768,"content":7769,"nodeType":904},{},[7770],{"data":7771,"marks":7772,"value":7774,"nodeType":865},{},[7773],{"type":902},"Recommendations",{"data":7776,"content":7780,"nodeType":890},{"target":7777},{"sys":7778},{"id":7779,"type":887,"linkType":888},"3aBCwdB2aNnLRxRN5RrshC",[],{"data":7782,"content":7783,"nodeType":881},{},[7784],{"data":7785,"marks":7786,"value":7787,"nodeType":865},{},[],"On the backend, exploitation of this attack will lead to login events being observed to the Microsoft Azure CLI app. It’s likely that any legitimate use of this will most likely be limited to system administrators and possibly developers. Therefore, logins outside of these groups will be inherently more suspicious.",{"data":7789,"content":7790,"nodeType":881},{},[7791],{"data":7792,"marks":7793,"value":7794,"nodeType":865},{},[],"Additionally, it’s possible that aspects of the logins themselves will be different between legitimate Azure CLI use and exploitation of this attack. For example, see the following logs from a lab environment. The login events with an application of  “Microsoft Azure CLI” and a resource of “Azure Resource Manager” was legitimate use of the Azure CLI using the powershell CLI framework. Conversely, the login event with the Resource of “Windows Azure Active Directory” was produced by logging in using the method used by the phishing kit.",{"data":7796,"content":7800,"nodeType":890},{"target":7797},{"sys":7798},{"id":7799,"type":887,"linkType":888},"6ie0nkk6XbgwidfwmiGwL4",[],{"data":7802,"content":7803,"nodeType":881},{},[7804],{"data":7805,"marks":7806,"value":7807,"nodeType":865},{},[],"There is no guarantee this can be used to differentiate between legitimate and malicious examples, but it’s another data point to consider. If searching logs you may wish to use the respective GUIDs for these:",{"data":7809,"content":7810,"nodeType":1818},{},[7811,7826],{"data":7812,"content":7813,"nodeType":1734},{},[7814],{"data":7815,"content":7816,"nodeType":881},{},[7817,7822],{"data":7818,"marks":7819,"value":7821,"nodeType":865},{},[7820],{"type":902},"Application ID",{"data":7823,"marks":7824,"value":7825,"nodeType":865},{},[]," = 04b07795-8ddb-461a-bbee-02f9e1bf7b46",{"data":7827,"content":7828,"nodeType":1734},{},[7829],{"data":7830,"content":7831,"nodeType":881},{},[7832,7837],{"data":7833,"marks":7834,"value":7836,"nodeType":865},{},[7835],{"type":902},"Resource ID",{"data":7838,"marks":7839,"value":7840,"nodeType":865},{},[]," = 00000002-0000-0000-c000-000000000000",{"data":7842,"content":7843,"nodeType":881},{},[7844],{"data":7845,"marks":7846,"value":7847,"nodeType":865},{},[],"For interactive logins, like above, you cannot rely on looking for logins from suspicious IP addresses or locations. The login itself occurs from the victims browser directly to Microsoft, and so the IP addresses associated with these events will be the legitimate IP used by the target user, not by the threat actor. ",{"data":7849,"content":7850,"nodeType":881},{},[7851],{"data":7852,"marks":7853,"value":7854,"nodeType":865},{},[],"However, for non-interactive logins and other audit logs for actions taken, you may be able to uncover unusual IP addresses that differ from the original interactive login. For example, here are some non-interactive logins that were observed immediately after compromise that came from different IP addresses in both the US and Indonesia.",{"data":7856,"content":7860,"nodeType":890},{"target":7857},{"sys":7858},{"id":7859,"type":887,"linkType":888},"TD3YeWqgGIWIWM8FRHU4o",[],{"data":7862,"content":7863,"nodeType":881},{},[7864],{"data":7865,"marks":7866,"value":7867,"nodeType":865},{},[],"Interestingly, they differ in which resources they accessed, with one accessing the Windows Azure Active Directory resource ID like the interactive login, but two others accessing the Microsoft Intune Checkin resource ID. ",{"data":7869,"content":7873,"nodeType":890},{"target":7870},{"sys":7871},{"id":7872,"type":887,"linkType":888},"57PqDQiAiwzqkspVpROQXb",[],{"data":7875,"content":7876,"nodeType":1860},{},[7877],{"data":7878,"marks":7879,"value":7881,"nodeType":865},{},[7880],{"type":902},"IoCs",{"data":7883,"content":7884,"nodeType":881},{},[7885,7889,7898],{"data":7886,"marks":7887,"value":7888,"nodeType":865},{},[],"Short-lived IoCs are of limited value when tackling modern phishing attacks due to the rate at which attackers are able to ",{"data":7890,"content":7892,"nodeType":876},{"uri":7891},"https://phishing-techniques.pushsecurity.com/techniques/domain-rotation-redirection/",[7893],{"data":7894,"marks":7895,"value":7897,"nodeType":865},{},[7896],{"type":874},"quickly spin up and rotate the sites used",{"data":7899,"marks":7900,"value":7901,"nodeType":865},{},[]," in the attack chain, often dynamically serving different URLs to site visitors. ",{"data":7903,"content":7904,"nodeType":881},{},[7905],{"data":7906,"marks":7907,"value":7908,"nodeType":865},{},[],"That said, the domains used to deliver the final phishing payload were:",{"data":7910,"content":7911,"nodeType":1818},{},[7912,7922,7932],{"data":7913,"content":7914,"nodeType":1734},{},[7915],{"data":7916,"content":7917,"nodeType":881},{},[7918],{"data":7919,"marks":7920,"value":7921,"nodeType":865},{},[],"hxxps://trustpointassurance.com/",{"data":7923,"content":7924,"nodeType":1734},{},[7925],{"data":7926,"content":7927,"nodeType":881},{},[7928],{"data":7929,"marks":7930,"value":7931,"nodeType":865},{},[],"hxxps://fastwaycheck.com/",{"data":7933,"content":7934,"nodeType":1734},{},[7935],{"data":7936,"content":7937,"nodeType":881},{},[7938],{"data":7939,"marks":7940,"value":7941,"nodeType":865},{},[],"hxxps://previewcentral.com",{"data":7943,"content":7944,"nodeType":881},{},[7945],{"data":7946,"marks":7947,"value":7948,"nodeType":865},{},[],"In addition, we recommend hunting for connections from the following IPs in Azure logs:",{"data":7950,"content":7951,"nodeType":1818},{},[7952,7962,7972],{"data":7953,"content":7954,"nodeType":1734},{},[7955],{"data":7956,"content":7957,"nodeType":881},{},[7958],{"data":7959,"marks":7960,"value":7961,"nodeType":865},{},[],"12.75.216.90",{"data":7963,"content":7964,"nodeType":1734},{},[7965],{"data":7966,"content":7967,"nodeType":881},{},[7968],{"data":7969,"marks":7970,"value":7971,"nodeType":865},{},[],"182.3.36.223",{"data":7973,"content":7974,"nodeType":1734},{},[7975],{"data":7976,"content":7977,"nodeType":881},{},[7978],{"data":7979,"marks":7980,"value":7981,"nodeType":865},{},[],"12.75.116.137",{"data":7983,"content":7984,"nodeType":894},{},[],{"data":7986,"content":7987,"nodeType":904},{},[7988],{"data":7989,"marks":7990,"value":7992,"nodeType":865},{},[7991],{"type":902},"How Push stopped the attack",{"data":7994,"content":7995,"nodeType":881},{},[7996],{"data":7997,"marks":7998,"value":7999,"nodeType":865},{},[],"Even though this was a brand new technique, Push intercepted this attack and shut it down before customers could interact with it. ",{"data":8001,"content":8005,"nodeType":890},{"target":8002},{"sys":8003},{"id":8004,"type":887,"linkType":888},"5YzpiQH974EYA5iPPZMXkV",[],{"data":8007,"content":8008,"nodeType":881},{},[8009,8013,8021],{"data":8010,"marks":8011,"value":8012,"nodeType":865},{},[],"Push doesn’t detect the redirect tricks or rely on outdated domain TI feeds. The reason we detect these attacks (which make it through all the other layers of phishing protection) is that Push sees what your users see. It doesn’t matter what ",{"data":8014,"content":8015,"nodeType":876},{"uri":1022},[8016],{"data":8017,"marks":8018,"value":8020,"nodeType":865},{},[8019],{"type":874},"delivery channel or camouflage methods are used",{"data":8022,"marks":8023,"value":8024,"nodeType":865},{},[],", Push shuts the attack down in real time, as the user loads the malicious page in their web browser.",{"data":8026,"content":8027,"nodeType":881},{},[8028],{"data":8029,"marks":8030,"value":8031,"nodeType":865},{},[],"This isn’t all we do: Push’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":8033,"content":8034,"nodeType":881},{},[8035,8038,8045,8049,8056],{"data":8036,"marks":8037,"value":4462,"nodeType":865},{},[],{"data":8039,"content":8040,"nodeType":876},{"uri":4465},[8041],{"data":8042,"marks":8043,"value":4471,"nodeType":865},{},[8044],{"type":874},{"data":8046,"marks":8047,"value":8048,"nodeType":865},{},[]," or ",{"data":8050,"content":8051,"nodeType":876},{"uri":1453},[8052],{"data":8053,"marks":8054,"value":4495,"nodeType":865},{},[8055],{"type":874},{"data":8057,"marks":8058,"value":959,"nodeType":865},{},[],{"data":8060,"content":8064,"nodeType":890},{"target":8061},{"sys":8062},{"id":8063,"type":887,"linkType":888},"6QzB0BlVC5mstXwXHvy2c3",[],{"data":8066,"content":8067,"nodeType":881},{},[8068],{"data":8069,"marks":8070,"value":21,"nodeType":865},{},[],"ConsentFix: Analyzing a browser-native ClickFix-style attack that hijacks OAuth consent grants","Analyzing \"ConsentFix\", a new browser-native attack technique we've detected in the wild, combining OAuth consent phishing with a ClickFix-style user prompt. ","2025-12-11T00:00:00.000Z","consentfix",{"items":8076},[8077,8079],{"sys":8078,"name":4507},{"id":4506},{"sys":8080,"name":342},{"id":4510},{"items":8082},[8083],{"fullName":4514,"firstName":4515,"jobTitle":4516,"profilePicture":8084},{"url":4518},{"__typename":1485,"sys":8086,"content":8087,"title":4499,"synopsis":4500,"hashTags":59,"publishedDate":4501,"slug":361,"tagsCollection":10792,"authorsCollection":10798},{"id":1487},{"json":8088},{"data":8089,"content":8090,"nodeType":1463},{},[8091,8096,8112,8128,8134,8139,8145,8151,8154,8161,8166,8232,8248,8253,8259,8355,8360,8363,8370,8376,8381,8384,8391,8427,8432,8438,8444,8450,8456,8472,8477,8482,8487,8492,8497,8502,8507,8513,8743,8746,8753,8880,8885,8888,8895,8926,9053,9058,9061,9068,9207,9212,9215,9222,9227,9361,9366,9371,9374,9381,9520,9525,9528,9535,9675,9680,9683,9690,9781,9786,9789,9796,9887,9892,9895,9902,9907,10034,10039,10042,10049,10096,10101,10104,10111,10244,10249,10252,10259,10386,10391,10394,10401,10411,10417,10422,10427,10433,10450,10463,10468,10471,10478,10485,10502,10519,10524,10530,10536,10543,10549,10555,10561,10568,10574,10619,10624,10627,10634,10640,10646,10683,10688,10694,10697,10704,10710,10716,10732,10737,10743,10750,10756],{"data":8092,"content":8095,"nodeType":890},{"target":8093},{"sys":8094},{"id":1496,"type":887,"linkType":888},[],{"data":8097,"content":8098,"nodeType":881},{},[8099,8102,8109],{"data":8100,"marks":8101,"value":1504,"nodeType":865},{},[],{"data":8103,"content":8104,"nodeType":876},{"uri":1507},[8105],{"data":8106,"marks":8107,"value":1513,"nodeType":865},{},[8108],{"type":874},{"data":8110,"marks":8111,"value":1517,"nodeType":865},{},[],{"data":8113,"content":8114,"nodeType":881},{},[8115,8118,8125],{"data":8116,"marks":8117,"value":21,"nodeType":865},{},[],{"data":8119,"content":8120,"nodeType":876},{"uri":1526},[8121],{"data":8122,"marks":8123,"value":360,"nodeType":865},{},[8124],{"type":874},{"data":8126,"marks":8127,"value":1535,"nodeType":865},{},[],{"data":8129,"content":8130,"nodeType":881},{},[8131],{"data":8132,"marks":8133,"value":1542,"nodeType":865},{},[],{"data":8135,"content":8138,"nodeType":890},{"target":8136},{"sys":8137},{"id":1547,"type":887,"linkType":888},[],{"data":8140,"content":8141,"nodeType":881},{},[8142],{"data":8143,"marks":8144,"value":1555,"nodeType":865},{},[],{"data":8146,"content":8147,"nodeType":881},{},[8148],{"data":8149,"marks":8150,"value":1562,"nodeType":865},{},[],{"data":8152,"content":8153,"nodeType":894},{},[],{"data":8155,"content":8156,"nodeType":904},{},[8157],{"data":8158,"marks":8159,"value":1573,"nodeType":865},{},[8160],{"type":902},{"data":8162,"content":8165,"nodeType":890},{"target":8163},{"sys":8164},{"id":1578,"type":887,"linkType":888},[],{"data":8167,"content":8168,"nodeType":881},{},[8169,8172,8179,8182,8189,8192,8199,8202,8209,8212,8219,8222,8229],{"data":8170,"marks":8171,"value":1586,"nodeType":865},{},[],{"data":8173,"content":8174,"nodeType":876},{"uri":1589},[8175],{"data":8176,"marks":8177,"value":1595,"nodeType":865},{},[8178],{"type":874},{"data":8180,"marks":8181,"value":1599,"nodeType":865},{},[],{"data":8183,"content":8184,"nodeType":876},{"uri":1602},[8185],{"data":8186,"marks":8187,"value":1608,"nodeType":865},{},[8188],{"type":874},{"data":8190,"marks":8191,"value":1612,"nodeType":865},{},[],{"data":8193,"content":8194,"nodeType":876},{"uri":1615},[8195],{"data":8196,"marks":8197,"value":1621,"nodeType":865},{},[8198],{"type":874},{"data":8200,"marks":8201,"value":1625,"nodeType":865},{},[],{"data":8203,"content":8204,"nodeType":876},{"uri":1628},[8205],{"data":8206,"marks":8207,"value":1634,"nodeType":865},{},[8208],{"type":874},{"data":8210,"marks":8211,"value":1638,"nodeType":865},{},[],{"data":8213,"content":8214,"nodeType":876},{"uri":1641},[8215],{"data":8216,"marks":8217,"value":1647,"nodeType":865},{},[8218],{"type":874},{"data":8220,"marks":8221,"value":1651,"nodeType":865},{},[],{"data":8223,"content":8224,"nodeType":876},{"uri":1654},[8225],{"data":8226,"marks":8227,"value":1660,"nodeType":865},{},[8228],{"type":874},{"data":8230,"marks":8231,"value":1664,"nodeType":865},{},[],{"data":8233,"content":8234,"nodeType":881},{},[8235,8238,8245],{"data":8236,"marks":8237,"value":1671,"nodeType":865},{},[],{"data":8239,"content":8240,"nodeType":876},{"uri":1674},[8241],{"data":8242,"marks":8243,"value":1680,"nodeType":865},{},[8244],{"type":874},{"data":8246,"marks":8247,"value":1684,"nodeType":865},{},[],{"data":8249,"content":8252,"nodeType":890},{"target":8250},{"sys":8251},{"id":1689,"type":887,"linkType":888},[],{"data":8254,"content":8255,"nodeType":881},{},[8256],{"data":8257,"marks":8258,"value":1697,"nodeType":865},{},[],{"data":8260,"content":8261,"nodeType":1818},{},[8262,8289,8307],{"data":8263,"content":8264,"nodeType":1734},{},[8265],{"data":8266,"content":8267,"nodeType":881},{},[8268,8271,8277,8280,8286],{"data":8269,"marks":8270,"value":1710,"nodeType":865},{},[],{"data":8272,"content":8273,"nodeType":876},{"uri":1713},[8274],{"data":8275,"marks":8276,"value":1718,"nodeType":865},{},[],{"data":8278,"marks":8279,"value":1651,"nodeType":865},{},[],{"data":8281,"content":8282,"nodeType":876},{"uri":1724},[8283],{"data":8284,"marks":8285,"value":1729,"nodeType":865},{},[],{"data":8287,"marks":8288,"value":1733,"nodeType":865},{},[],{"data":8290,"content":8291,"nodeType":1734},{},[8292],{"data":8293,"content":8294,"nodeType":881},{},[8295,8298,8304],{"data":8296,"marks":8297,"value":1744,"nodeType":865},{},[],{"data":8299,"content":8300,"nodeType":876},{"uri":1747},[8301],{"data":8302,"marks":8303,"value":1752,"nodeType":865},{},[],{"data":8305,"marks":8306,"value":1756,"nodeType":865},{},[],{"data":8308,"content":8309,"nodeType":1734},{},[8310],{"data":8311,"content":8312,"nodeType":881},{},[8313,8316,8322,8325,8332,8335,8342,8345,8352],{"data":8314,"marks":8315,"value":1766,"nodeType":865},{},[],{"data":8317,"content":8318,"nodeType":876},{"uri":1769},[8319],{"data":8320,"marks":8321,"value":1774,"nodeType":865},{},[],{"data":8323,"marks":8324,"value":1778,"nodeType":865},{},[],{"data":8326,"content":8327,"nodeType":876},{"uri":1781},[8328],{"data":8329,"marks":8330,"value":1787,"nodeType":865},{},[8331],{"type":874},{"data":8333,"marks":8334,"value":1791,"nodeType":865},{},[],{"data":8336,"content":8337,"nodeType":876},{"uri":1794},[8338],{"data":8339,"marks":8340,"value":1800,"nodeType":865},{},[8341],{"type":874},{"data":8343,"marks":8344,"value":1804,"nodeType":865},{},[],{"data":8346,"content":8347,"nodeType":876},{"uri":1807},[8348],{"data":8349,"marks":8350,"value":1813,"nodeType":865},{},[8351],{"type":874},{"data":8353,"marks":8354,"value":1817,"nodeType":865},{},[],{"data":8356,"content":8359,"nodeType":890},{"target":8357},{"sys":8358},{"id":1823,"type":887,"linkType":888},[],{"data":8361,"content":8362,"nodeType":894},{},[],{"data":8364,"content":8365,"nodeType":904},{},[8366],{"data":8367,"marks":8368,"value":1835,"nodeType":865},{},[8369],{"type":902},{"data":8371,"content":8372,"nodeType":881},{},[8373],{"data":8374,"marks":8375,"value":1842,"nodeType":865},{},[],{"data":8377,"content":8380,"nodeType":890},{"target":8378},{"sys":8379},{"id":1847,"type":887,"linkType":888},[],{"data":8382,"content":8383,"nodeType":894},{},[],{"data":8385,"content":8386,"nodeType":1860},{},[8387],{"data":8388,"marks":8389,"value":1859,"nodeType":865},{},[8390],{"type":902},{"data":8392,"content":8393,"nodeType":881},{},[8394,8397,8404,8407,8414,8417,8424],{"data":8395,"marks":8396,"value":21,"nodeType":865},{},[],{"data":8398,"content":8399,"nodeType":876},{"uri":1807},[8400],{"data":8401,"marks":8402,"value":1813,"nodeType":865},{},[8403],{"type":874},{"data":8405,"marks":8406,"value":1877,"nodeType":865},{},[],{"data":8408,"content":8409,"nodeType":876},{"uri":1880},[8410],{"data":8411,"marks":8412,"value":1886,"nodeType":865},{},[8413],{"type":874},{"data":8415,"marks":8416,"value":1890,"nodeType":865},{},[],{"data":8418,"content":8419,"nodeType":876},{"uri":1794},[8420],{"data":8421,"marks":8422,"value":1898,"nodeType":865},{},[8423],{"type":874},{"data":8425,"marks":8426,"value":1902,"nodeType":865},{},[],{"data":8428,"content":8431,"nodeType":890},{"target":8429},{"sys":8430},{"id":1907,"type":887,"linkType":888},[],{"data":8433,"content":8434,"nodeType":881},{},[8435],{"data":8436,"marks":8437,"value":1915,"nodeType":865},{},[],{"data":8439,"content":8440,"nodeType":881},{},[8441],{"data":8442,"marks":8443,"value":1922,"nodeType":865},{},[],{"data":8445,"content":8446,"nodeType":881},{},[8447],{"data":8448,"marks":8449,"value":1929,"nodeType":865},{},[],{"data":8451,"content":8452,"nodeType":881},{},[8453],{"data":8454,"marks":8455,"value":1936,"nodeType":865},{},[],{"data":8457,"content":8458,"nodeType":881},{},[8459,8462,8469],{"data":8460,"marks":8461,"value":1943,"nodeType":865},{},[],{"data":8463,"content":8464,"nodeType":876},{"uri":1022},[8465],{"data":8466,"marks":8467,"value":1951,"nodeType":865},{},[8468],{"type":874},{"data":8470,"marks":8471,"value":1955,"nodeType":865},{},[],{"data":8473,"content":8476,"nodeType":890},{"target":8474},{"sys":8475},{"id":1960,"type":887,"linkType":888},[],{"data":8478,"content":8481,"nodeType":890},{"target":8479},{"sys":8480},{"id":1966,"type":887,"linkType":888},[],{"data":8483,"content":8486,"nodeType":890},{"target":8484},{"sys":8485},{"id":1972,"type":887,"linkType":888},[],{"data":8488,"content":8491,"nodeType":890},{"target":8489},{"sys":8490},{"id":1978,"type":887,"linkType":888},[],{"data":8493,"content":8496,"nodeType":890},{"target":8494},{"sys":8495},{"id":1984,"type":887,"linkType":888},[],{"data":8498,"content":8501,"nodeType":890},{"target":8499},{"sys":8500},{"id":1990,"type":887,"linkType":888},[],{"data":8503,"content":8506,"nodeType":890},{"target":8504},{"sys":8505},{"id":1996,"type":887,"linkType":888},[],{"data":8508,"content":8509,"nodeType":881},{},[8510],{"data":8511,"marks":8512,"value":21,"nodeType":865},{},[],{"data":8514,"content":8515,"nodeType":2270},{},[8516,8538,8609,8655,8677],{"data":8517,"content":8518,"nodeType":2032},{},[8519,8529],{"data":8520,"content":8521,"nodeType":2021},{},[8522],{"data":8523,"content":8524,"nodeType":881},{},[8525],{"data":8526,"marks":8527,"value":2020,"nodeType":865},{},[8528],{"type":902},{"data":8530,"content":8531,"nodeType":2021},{},[8532],{"data":8533,"content":8534,"nodeType":881},{},[8535],{"data":8536,"marks":8537,"value":2031,"nodeType":865},{},[],{"data":8539,"content":8540,"nodeType":2032},{},[8541,8551],{"data":8542,"content":8543,"nodeType":2021},{},[8544],{"data":8545,"content":8546,"nodeType":881},{},[8547],{"data":8548,"marks":8549,"value":2046,"nodeType":865},{},[8550],{"type":902},{"data":8552,"content":8553,"nodeType":2021},{},[8554,8578],{"data":8555,"content":8556,"nodeType":881},{},[8557,8561,8564,8568,8571,8575],{"data":8558,"marks":8559,"value":2057,"nodeType":865},{},[8560],{"type":902},{"data":8562,"marks":8563,"value":2061,"nodeType":865},{},[],{"data":8565,"marks":8566,"value":2066,"nodeType":865},{},[8567],{"type":902},{"data":8569,"marks":8570,"value":2070,"nodeType":865},{},[],{"data":8572,"marks":8573,"value":2075,"nodeType":865},{},[8574],{"type":902},{"data":8576,"marks":8577,"value":2079,"nodeType":865},{},[],{"data":8579,"content":8580,"nodeType":881},{},[8581,8585,8588,8592,8595,8599,8602,8606],{"data":8582,"marks":8583,"value":2087,"nodeType":865},{},[8584],{"type":902},{"data":8586,"marks":8587,"value":2091,"nodeType":865},{},[],{"data":8589,"marks":8590,"value":2096,"nodeType":865},{},[8591],{"type":902},{"data":8593,"marks":8594,"value":2100,"nodeType":865},{},[],{"data":8596,"marks":8597,"value":2066,"nodeType":865},{},[8598],{"type":902},{"data":8600,"marks":8601,"value":2108,"nodeType":865},{},[],{"data":8603,"marks":8604,"value":2075,"nodeType":865},{},[8605],{"type":902},{"data":8607,"marks":8608,"value":2116,"nodeType":865},{},[],{"data":8610,"content":8611,"nodeType":2032},{},[8612,8622],{"data":8613,"content":8614,"nodeType":2021},{},[8615],{"data":8616,"content":8617,"nodeType":881},{},[8618],{"data":8619,"marks":8620,"value":2130,"nodeType":865},{},[8621],{"type":902},{"data":8623,"content":8624,"nodeType":2021},{},[8625,8631,8637,8643,8649],{"data":8626,"content":8627,"nodeType":881},{},[8628],{"data":8629,"marks":8630,"value":2140,"nodeType":865},{},[],{"data":8632,"content":8633,"nodeType":881},{},[8634],{"data":8635,"marks":8636,"value":2147,"nodeType":865},{},[],{"data":8638,"content":8639,"nodeType":881},{},[8640],{"data":8641,"marks":8642,"value":2154,"nodeType":865},{},[],{"data":8644,"content":8645,"nodeType":881},{},[8646],{"data":8647,"marks":8648,"value":2161,"nodeType":865},{},[],{"data":8650,"content":8651,"nodeType":881},{},[8652],{"data":8653,"marks":8654,"value":2168,"nodeType":865},{},[],{"data":8656,"content":8657,"nodeType":2032},{},[8658,8668],{"data":8659,"content":8660,"nodeType":2021},{},[8661],{"data":8662,"content":8663,"nodeType":881},{},[8664],{"data":8665,"marks":8666,"value":2182,"nodeType":865},{},[8667],{"type":902},{"data":8669,"content":8670,"nodeType":2021},{},[8671],{"data":8672,"content":8673,"nodeType":881},{},[8674],{"data":8675,"marks":8676,"value":2192,"nodeType":865},{},[],{"data":8678,"content":8679,"nodeType":2032},{},[8680,8690],{"data":8681,"content":8682,"nodeType":2021},{},[8683],{"data":8684,"content":8685,"nodeType":881},{},[8686],{"data":8687,"marks":8688,"value":2206,"nodeType":865},{},[8689],{"type":902},{"data":8691,"content":8692,"nodeType":2021},{},[8693,8703,8713,8723,8733],{"data":8694,"content":8695,"nodeType":881},{},[8696,8700],{"data":8697,"marks":8698,"value":2217,"nodeType":865},{},[8699],{"type":902},{"data":8701,"marks":8702,"value":2221,"nodeType":865},{},[],{"data":8704,"content":8705,"nodeType":881},{},[8706,8710],{"data":8707,"marks":8708,"value":2229,"nodeType":865},{},[8709],{"type":902},{"data":8711,"marks":8712,"value":2233,"nodeType":865},{},[],{"data":8714,"content":8715,"nodeType":881},{},[8716,8720],{"data":8717,"marks":8718,"value":2241,"nodeType":865},{},[8719],{"type":902},{"data":8721,"marks":8722,"value":2245,"nodeType":865},{},[],{"data":8724,"content":8725,"nodeType":881},{},[8726,8730],{"data":8727,"marks":8728,"value":2253,"nodeType":865},{},[8729],{"type":902},{"data":8731,"marks":8732,"value":2257,"nodeType":865},{},[],{"data":8734,"content":8735,"nodeType":881},{},[8736,8740],{"data":8737,"marks":8738,"value":2265,"nodeType":865},{},[8739],{"type":902},{"data":8741,"marks":8742,"value":2269,"nodeType":865},{},[],{"data":8744,"content":8745,"nodeType":894},{},[],{"data":8747,"content":8748,"nodeType":1860},{},[8749],{"data":8750,"marks":8751,"value":2281,"nodeType":865},{},[8752],{"type":902},{"data":8754,"content":8755,"nodeType":2270},{},[8756,8778,8814,8836,8858],{"data":8757,"content":8758,"nodeType":2032},{},[8759,8769],{"data":8760,"content":8761,"nodeType":2021},{},[8762],{"data":8763,"content":8764,"nodeType":881},{},[8765],{"data":8766,"marks":8767,"value":2020,"nodeType":865},{},[8768],{"type":902},{"data":8770,"content":8771,"nodeType":2021},{},[8772],{"data":8773,"content":8774,"nodeType":881},{},[8775],{"data":8776,"marks":8777,"value":2307,"nodeType":865},{},[],{"data":8779,"content":8780,"nodeType":2032},{},[8781,8791],{"data":8782,"content":8783,"nodeType":2021},{},[8784],{"data":8785,"content":8786,"nodeType":881},{},[8787],{"data":8788,"marks":8789,"value":2046,"nodeType":865},{},[8790],{"type":902},{"data":8792,"content":8793,"nodeType":2021},{},[8794,8804],{"data":8795,"content":8796,"nodeType":881},{},[8797,8801],{"data":8798,"marks":8799,"value":2331,"nodeType":865},{},[8800],{"type":902},{"data":8802,"marks":8803,"value":2335,"nodeType":865},{},[],{"data":8805,"content":8806,"nodeType":881},{},[8807,8811],{"data":8808,"marks":8809,"value":2087,"nodeType":865},{},[8810],{"type":902},{"data":8812,"marks":8813,"value":2346,"nodeType":865},{},[],{"data":8815,"content":8816,"nodeType":2032},{},[8817,8827],{"data":8818,"content":8819,"nodeType":2021},{},[8820],{"data":8821,"content":8822,"nodeType":881},{},[8823],{"data":8824,"marks":8825,"value":2130,"nodeType":865},{},[8826],{"type":902},{"data":8828,"content":8829,"nodeType":2021},{},[8830],{"data":8831,"content":8832,"nodeType":881},{},[8833],{"data":8834,"marks":8835,"value":2369,"nodeType":865},{},[],{"data":8837,"content":8838,"nodeType":2032},{},[8839,8849],{"data":8840,"content":8841,"nodeType":2021},{},[8842],{"data":8843,"content":8844,"nodeType":881},{},[8845],{"data":8846,"marks":8847,"value":2182,"nodeType":865},{},[8848],{"type":902},{"data":8850,"content":8851,"nodeType":2021},{},[8852],{"data":8853,"content":8854,"nodeType":881},{},[8855],{"data":8856,"marks":8857,"value":2392,"nodeType":865},{},[],{"data":8859,"content":8860,"nodeType":2032},{},[8861,8871],{"data":8862,"content":8863,"nodeType":2021},{},[8864],{"data":8865,"content":8866,"nodeType":881},{},[8867],{"data":8868,"marks":8869,"value":2406,"nodeType":865},{},[8870],{"type":902},{"data":8872,"content":8873,"nodeType":2021},{},[8874],{"data":8875,"content":8876,"nodeType":881},{},[8877],{"data":8878,"marks":8879,"value":2416,"nodeType":865},{},[],{"data":8881,"content":8884,"nodeType":890},{"target":8882},{"sys":8883},{"id":2421,"type":887,"linkType":888},[],{"data":8886,"content":8887,"nodeType":894},{},[],{"data":8889,"content":8890,"nodeType":1860},{},[8891],{"data":8892,"marks":8893,"value":2433,"nodeType":865},{},[8894],{"type":902},{"data":8896,"content":8897,"nodeType":881},{},[8898,8901,8905,8908,8914,8917,8923],{"data":8899,"marks":8900,"value":2440,"nodeType":865},{},[],{"data":8902,"marks":8903,"value":2445,"nodeType":865},{},[8904],{"type":902},{"data":8906,"marks":8907,"value":2449,"nodeType":865},{},[],{"data":8909,"content":8910,"nodeType":876},{"uri":2452},[8911],{"data":8912,"marks":8913,"value":2457,"nodeType":865},{},[],{"data":8915,"marks":8916,"value":2461,"nodeType":865},{},[],{"data":8918,"content":8919,"nodeType":876},{"uri":2464},[8920],{"data":8921,"marks":8922,"value":2469,"nodeType":865},{},[],{"data":8924,"marks":8925,"value":2473,"nodeType":865},{},[],{"data":8927,"content":8928,"nodeType":2270},{},[8929,8951,8987,9009,9031],{"data":8930,"content":8931,"nodeType":2032},{},[8932,8942],{"data":8933,"content":8934,"nodeType":2021},{},[8935],{"data":8936,"content":8937,"nodeType":881},{},[8938],{"data":8939,"marks":8940,"value":2020,"nodeType":865},{},[8941],{"type":902},{"data":8943,"content":8944,"nodeType":2021},{},[8945],{"data":8946,"content":8947,"nodeType":881},{},[8948],{"data":8949,"marks":8950,"value":2499,"nodeType":865},{},[],{"data":8952,"content":8953,"nodeType":2032},{},[8954,8964],{"data":8955,"content":8956,"nodeType":2021},{},[8957],{"data":8958,"content":8959,"nodeType":881},{},[8960],{"data":8961,"marks":8962,"value":2046,"nodeType":865},{},[8963],{"type":902},{"data":8965,"content":8966,"nodeType":2021},{},[8967,8977],{"data":8968,"content":8969,"nodeType":881},{},[8970,8974],{"data":8971,"marks":8972,"value":2523,"nodeType":865},{},[8973],{"type":902},{"data":8975,"marks":8976,"value":2527,"nodeType":865},{},[],{"data":8978,"content":8979,"nodeType":881},{},[8980,8984],{"data":8981,"marks":8982,"value":2087,"nodeType":865},{},[8983],{"type":902},{"data":8985,"marks":8986,"value":2538,"nodeType":865},{},[],{"data":8988,"content":8989,"nodeType":2032},{},[8990,9000],{"data":8991,"content":8992,"nodeType":2021},{},[8993],{"data":8994,"content":8995,"nodeType":881},{},[8996],{"data":8997,"marks":8998,"value":2130,"nodeType":865},{},[8999],{"type":902},{"data":9001,"content":9002,"nodeType":2021},{},[9003],{"data":9004,"content":9005,"nodeType":881},{},[9006],{"data":9007,"marks":9008,"value":2561,"nodeType":865},{},[],{"data":9010,"content":9011,"nodeType":2032},{},[9012,9022],{"data":9013,"content":9014,"nodeType":2021},{},[9015],{"data":9016,"content":9017,"nodeType":881},{},[9018],{"data":9019,"marks":9020,"value":2182,"nodeType":865},{},[9021],{"type":902},{"data":9023,"content":9024,"nodeType":2021},{},[9025],{"data":9026,"content":9027,"nodeType":881},{},[9028],{"data":9029,"marks":9030,"value":2584,"nodeType":865},{},[],{"data":9032,"content":9033,"nodeType":2032},{},[9034,9044],{"data":9035,"content":9036,"nodeType":2021},{},[9037],{"data":9038,"content":9039,"nodeType":881},{},[9040],{"data":9041,"marks":9042,"value":2406,"nodeType":865},{},[9043],{"type":902},{"data":9045,"content":9046,"nodeType":2021},{},[9047],{"data":9048,"content":9049,"nodeType":881},{},[9050],{"data":9051,"marks":9052,"value":2607,"nodeType":865},{},[],{"data":9054,"content":9057,"nodeType":890},{"target":9055},{"sys":9056},{"id":2612,"type":887,"linkType":888},[],{"data":9059,"content":9060,"nodeType":894},{},[],{"data":9062,"content":9063,"nodeType":1860},{},[9064],{"data":9065,"marks":9066,"value":2624,"nodeType":865},{},[9067],{"type":902},{"data":9069,"content":9070,"nodeType":2270},{},[9071,9093,9135,9163,9185],{"data":9072,"content":9073,"nodeType":2032},{},[9074,9084],{"data":9075,"content":9076,"nodeType":2021},{},[9077],{"data":9078,"content":9079,"nodeType":881},{},[9080],{"data":9081,"marks":9082,"value":2020,"nodeType":865},{},[9083],{"type":902},{"data":9085,"content":9086,"nodeType":2021},{},[9087],{"data":9088,"content":9089,"nodeType":881},{},[9090],{"data":9091,"marks":9092,"value":2650,"nodeType":865},{},[],{"data":9094,"content":9095,"nodeType":2032},{},[9096,9106],{"data":9097,"content":9098,"nodeType":2021},{},[9099],{"data":9100,"content":9101,"nodeType":881},{},[9102],{"data":9103,"marks":9104,"value":2046,"nodeType":865},{},[9105],{"type":902},{"data":9107,"content":9108,"nodeType":2021},{},[9109,9119,9125],{"data":9110,"content":9111,"nodeType":881},{},[9112,9116],{"data":9113,"marks":9114,"value":2523,"nodeType":865},{},[9115],{"type":902},{"data":9117,"marks":9118,"value":2677,"nodeType":865},{},[],{"data":9120,"content":9121,"nodeType":881},{},[9122],{"data":9123,"marks":9124,"value":2684,"nodeType":865},{},[],{"data":9126,"content":9127,"nodeType":881},{},[9128,9132],{"data":9129,"marks":9130,"value":2087,"nodeType":865},{},[9131],{"type":902},{"data":9133,"marks":9134,"value":2695,"nodeType":865},{},[],{"data":9136,"content":9137,"nodeType":2032},{},[9138,9148],{"data":9139,"content":9140,"nodeType":2021},{},[9141],{"data":9142,"content":9143,"nodeType":881},{},[9144],{"data":9145,"marks":9146,"value":2130,"nodeType":865},{},[9147],{"type":902},{"data":9149,"content":9150,"nodeType":2021},{},[9151,9157],{"data":9152,"content":9153,"nodeType":881},{},[9154],{"data":9155,"marks":9156,"value":2718,"nodeType":865},{},[],{"data":9158,"content":9159,"nodeType":881},{},[9160],{"data":9161,"marks":9162,"value":2725,"nodeType":865},{},[],{"data":9164,"content":9165,"nodeType":2032},{},[9166,9176],{"data":9167,"content":9168,"nodeType":2021},{},[9169],{"data":9170,"content":9171,"nodeType":881},{},[9172],{"data":9173,"marks":9174,"value":2182,"nodeType":865},{},[9175],{"type":902},{"data":9177,"content":9178,"nodeType":2021},{},[9179],{"data":9180,"content":9181,"nodeType":881},{},[9182],{"data":9183,"marks":9184,"value":2748,"nodeType":865},{},[],{"data":9186,"content":9187,"nodeType":2032},{},[9188,9198],{"data":9189,"content":9190,"nodeType":2021},{},[9191],{"data":9192,"content":9193,"nodeType":881},{},[9194],{"data":9195,"marks":9196,"value":2406,"nodeType":865},{},[9197],{"type":902},{"data":9199,"content":9200,"nodeType":2021},{},[9201],{"data":9202,"content":9203,"nodeType":881},{},[9204],{"data":9205,"marks":9206,"value":2771,"nodeType":865},{},[],{"data":9208,"content":9211,"nodeType":890},{"target":9209},{"sys":9210},{"id":2776,"type":887,"linkType":888},[],{"data":9213,"content":9214,"nodeType":894},{},[],{"data":9216,"content":9217,"nodeType":1860},{},[9218],{"data":9219,"marks":9220,"value":2788,"nodeType":865},{},[9221],{"type":902},{"data":9223,"content":9226,"nodeType":890},{"target":9224},{"sys":9225},{"id":2793,"type":887,"linkType":888},[],{"data":9228,"content":9229,"nodeType":2270},{},[9230,9252,9295,9317,9339],{"data":9231,"content":9232,"nodeType":2032},{},[9233,9243],{"data":9234,"content":9235,"nodeType":2021},{},[9236],{"data":9237,"content":9238,"nodeType":881},{},[9239],{"data":9240,"marks":9241,"value":2020,"nodeType":865},{},[9242],{"type":902},{"data":9244,"content":9245,"nodeType":2021},{},[9246],{"data":9247,"content":9248,"nodeType":881},{},[9249],{"data":9250,"marks":9251,"value":2820,"nodeType":865},{},[],{"data":9253,"content":9254,"nodeType":2032},{},[9255,9265],{"data":9256,"content":9257,"nodeType":2021},{},[9258],{"data":9259,"content":9260,"nodeType":881},{},[9261],{"data":9262,"marks":9263,"value":2046,"nodeType":865},{},[9264],{"type":902},{"data":9266,"content":9267,"nodeType":2021},{},[9268,9278],{"data":9269,"content":9270,"nodeType":881},{},[9271,9275],{"data":9272,"marks":9273,"value":2523,"nodeType":865},{},[9274],{"type":902},{"data":9276,"marks":9277,"value":2847,"nodeType":865},{},[],{"data":9279,"content":9280,"nodeType":881},{},[9281,9285,9288,9292],{"data":9282,"marks":9283,"value":2087,"nodeType":865},{},[9284],{"type":902},{"data":9286,"marks":9287,"value":2091,"nodeType":865},{},[],{"data":9289,"marks":9290,"value":2862,"nodeType":865},{},[9291],{"type":902},{"data":9293,"marks":9294,"value":2866,"nodeType":865},{},[],{"data":9296,"content":9297,"nodeType":2032},{},[9298,9308],{"data":9299,"content":9300,"nodeType":2021},{},[9301],{"data":9302,"content":9303,"nodeType":881},{},[9304],{"data":9305,"marks":9306,"value":2130,"nodeType":865},{},[9307],{"type":902},{"data":9309,"content":9310,"nodeType":2021},{},[9311],{"data":9312,"content":9313,"nodeType":881},{},[9314],{"data":9315,"marks":9316,"value":2889,"nodeType":865},{},[],{"data":9318,"content":9319,"nodeType":2032},{},[9320,9330],{"data":9321,"content":9322,"nodeType":2021},{},[9323],{"data":9324,"content":9325,"nodeType":881},{},[9326],{"data":9327,"marks":9328,"value":2182,"nodeType":865},{},[9329],{"type":902},{"data":9331,"content":9332,"nodeType":2021},{},[9333],{"data":9334,"content":9335,"nodeType":881},{},[9336],{"data":9337,"marks":9338,"value":2912,"nodeType":865},{},[],{"data":9340,"content":9341,"nodeType":2032},{},[9342,9352],{"data":9343,"content":9344,"nodeType":2021},{},[9345],{"data":9346,"content":9347,"nodeType":881},{},[9348],{"data":9349,"marks":9350,"value":2406,"nodeType":865},{},[9351],{"type":902},{"data":9353,"content":9354,"nodeType":2021},{},[9355],{"data":9356,"content":9357,"nodeType":881},{},[9358],{"data":9359,"marks":9360,"value":2935,"nodeType":865},{},[],{"data":9362,"content":9365,"nodeType":890},{"target":9363},{"sys":9364},{"id":2940,"type":887,"linkType":888},[],{"data":9367,"content":9370,"nodeType":890},{"target":9368},{"sys":9369},{"id":2946,"type":887,"linkType":888},[],{"data":9372,"content":9373,"nodeType":894},{},[],{"data":9375,"content":9376,"nodeType":1860},{},[9377],{"data":9378,"marks":9379,"value":2958,"nodeType":865},{},[9380],{"type":902},{"data":9382,"content":9383,"nodeType":2270},{},[9384,9406,9442,9476,9498],{"data":9385,"content":9386,"nodeType":2032},{},[9387,9397],{"data":9388,"content":9389,"nodeType":2021},{},[9390],{"data":9391,"content":9392,"nodeType":881},{},[9393],{"data":9394,"marks":9395,"value":2020,"nodeType":865},{},[9396],{"type":902},{"data":9398,"content":9399,"nodeType":2021},{},[9400],{"data":9401,"content":9402,"nodeType":881},{},[9403],{"data":9404,"marks":9405,"value":2984,"nodeType":865},{},[],{"data":9407,"content":9408,"nodeType":2032},{},[9409,9419],{"data":9410,"content":9411,"nodeType":2021},{},[9412],{"data":9413,"content":9414,"nodeType":881},{},[9415],{"data":9416,"marks":9417,"value":2046,"nodeType":865},{},[9418],{"type":902},{"data":9420,"content":9421,"nodeType":2021},{},[9422,9432],{"data":9423,"content":9424,"nodeType":881},{},[9425,9429],{"data":9426,"marks":9427,"value":2523,"nodeType":865},{},[9428],{"type":902},{"data":9430,"marks":9431,"value":3011,"nodeType":865},{},[],{"data":9433,"content":9434,"nodeType":881},{},[9435,9439],{"data":9436,"marks":9437,"value":2087,"nodeType":865},{},[9438],{"type":902},{"data":9440,"marks":9441,"value":3022,"nodeType":865},{},[],{"data":9443,"content":9444,"nodeType":2032},{},[9445,9455],{"data":9446,"content":9447,"nodeType":2021},{},[9448],{"data":9449,"content":9450,"nodeType":881},{},[9451],{"data":9452,"marks":9453,"value":2130,"nodeType":865},{},[9454],{"type":902},{"data":9456,"content":9457,"nodeType":2021},{},[9458,9464,9470],{"data":9459,"content":9460,"nodeType":881},{},[9461],{"data":9462,"marks":9463,"value":3045,"nodeType":865},{},[],{"data":9465,"content":9466,"nodeType":881},{},[9467],{"data":9468,"marks":9469,"value":3052,"nodeType":865},{},[],{"data":9471,"content":9472,"nodeType":881},{},[9473],{"data":9474,"marks":9475,"value":3059,"nodeType":865},{},[],{"data":9477,"content":9478,"nodeType":2032},{},[9479,9489],{"data":9480,"content":9481,"nodeType":2021},{},[9482],{"data":9483,"content":9484,"nodeType":881},{},[9485],{"data":9486,"marks":9487,"value":2182,"nodeType":865},{},[9488],{"type":902},{"data":9490,"content":9491,"nodeType":2021},{},[9492],{"data":9493,"content":9494,"nodeType":881},{},[9495],{"data":9496,"marks":9497,"value":3082,"nodeType":865},{},[],{"data":9499,"content":9500,"nodeType":2032},{},[9501,9511],{"data":9502,"content":9503,"nodeType":2021},{},[9504],{"data":9505,"content":9506,"nodeType":881},{},[9507],{"data":9508,"marks":9509,"value":2406,"nodeType":865},{},[9510],{"type":902},{"data":9512,"content":9513,"nodeType":2021},{},[9514],{"data":9515,"content":9516,"nodeType":881},{},[9517],{"data":9518,"marks":9519,"value":3105,"nodeType":865},{},[],{"data":9521,"content":9524,"nodeType":890},{"target":9522},{"sys":9523},{"id":3110,"type":887,"linkType":888},[],{"data":9526,"content":9527,"nodeType":894},{},[],{"data":9529,"content":9530,"nodeType":1860},{},[9531],{"data":9532,"marks":9533,"value":3122,"nodeType":865},{},[9534],{"type":902},{"data":9536,"content":9537,"nodeType":2270},{},[9538,9560,9603,9631,9653],{"data":9539,"content":9540,"nodeType":2032},{},[9541,9551],{"data":9542,"content":9543,"nodeType":2021},{},[9544],{"data":9545,"content":9546,"nodeType":881},{},[9547],{"data":9548,"marks":9549,"value":2020,"nodeType":865},{},[9550],{"type":902},{"data":9552,"content":9553,"nodeType":2021},{},[9554],{"data":9555,"content":9556,"nodeType":881},{},[9557],{"data":9558,"marks":9559,"value":2820,"nodeType":865},{},[],{"data":9561,"content":9562,"nodeType":2032},{},[9563,9573],{"data":9564,"content":9565,"nodeType":2021},{},[9566],{"data":9567,"content":9568,"nodeType":881},{},[9569],{"data":9570,"marks":9571,"value":2046,"nodeType":865},{},[9572],{"type":902},{"data":9574,"content":9575,"nodeType":2021},{},[9576,9586],{"data":9577,"content":9578,"nodeType":881},{},[9579,9583],{"data":9580,"marks":9581,"value":2523,"nodeType":865},{},[9582],{"type":902},{"data":9584,"marks":9585,"value":3174,"nodeType":865},{},[],{"data":9587,"content":9588,"nodeType":881},{},[9589,9593,9596,9600],{"data":9590,"marks":9591,"value":2087,"nodeType":865},{},[9592],{"type":902},{"data":9594,"marks":9595,"value":2091,"nodeType":865},{},[],{"data":9597,"marks":9598,"value":2862,"nodeType":865},{},[9599],{"type":902},{"data":9601,"marks":9602,"value":3192,"nodeType":865},{},[],{"data":9604,"content":9605,"nodeType":2032},{},[9606,9616],{"data":9607,"content":9608,"nodeType":2021},{},[9609],{"data":9610,"content":9611,"nodeType":881},{},[9612],{"data":9613,"marks":9614,"value":2130,"nodeType":865},{},[9615],{"type":902},{"data":9617,"content":9618,"nodeType":2021},{},[9619,9625],{"data":9620,"content":9621,"nodeType":881},{},[9622],{"data":9623,"marks":9624,"value":3215,"nodeType":865},{},[],{"data":9626,"content":9627,"nodeType":881},{},[9628],{"data":9629,"marks":9630,"value":3222,"nodeType":865},{},[],{"data":9632,"content":9633,"nodeType":2032},{},[9634,9644],{"data":9635,"content":9636,"nodeType":2021},{},[9637],{"data":9638,"content":9639,"nodeType":881},{},[9640],{"data":9641,"marks":9642,"value":2182,"nodeType":865},{},[9643],{"type":902},{"data":9645,"content":9646,"nodeType":2021},{},[9647],{"data":9648,"content":9649,"nodeType":881},{},[9650],{"data":9651,"marks":9652,"value":3245,"nodeType":865},{},[],{"data":9654,"content":9655,"nodeType":2032},{},[9656,9666],{"data":9657,"content":9658,"nodeType":2021},{},[9659],{"data":9660,"content":9661,"nodeType":881},{},[9662],{"data":9663,"marks":9664,"value":2406,"nodeType":865},{},[9665],{"type":902},{"data":9667,"content":9668,"nodeType":2021},{},[9669],{"data":9670,"content":9671,"nodeType":881},{},[9672],{"data":9673,"marks":9674,"value":3268,"nodeType":865},{},[],{"data":9676,"content":9679,"nodeType":890},{"target":9677},{"sys":9678},{"id":3273,"type":887,"linkType":888},[],{"data":9681,"content":9682,"nodeType":894},{},[],{"data":9684,"content":9685,"nodeType":1860},{},[9686],{"data":9687,"marks":9688,"value":3285,"nodeType":865},{},[9689],{"type":902},{"data":9691,"content":9692,"nodeType":2270},{},[9693,9715,9737,9759],{"data":9694,"content":9695,"nodeType":2032},{},[9696,9706],{"data":9697,"content":9698,"nodeType":2021},{},[9699],{"data":9700,"content":9701,"nodeType":881},{},[9702],{"data":9703,"marks":9704,"value":2020,"nodeType":865},{},[9705],{"type":902},{"data":9707,"content":9708,"nodeType":2021},{},[9709],{"data":9710,"content":9711,"nodeType":881},{},[9712],{"data":9713,"marks":9714,"value":3311,"nodeType":865},{},[],{"data":9716,"content":9717,"nodeType":2032},{},[9718,9728],{"data":9719,"content":9720,"nodeType":2021},{},[9721],{"data":9722,"content":9723,"nodeType":881},{},[9724],{"data":9725,"marks":9726,"value":2130,"nodeType":865},{},[9727],{"type":902},{"data":9729,"content":9730,"nodeType":2021},{},[9731],{"data":9732,"content":9733,"nodeType":881},{},[9734],{"data":9735,"marks":9736,"value":3334,"nodeType":865},{},[],{"data":9738,"content":9739,"nodeType":2032},{},[9740,9750],{"data":9741,"content":9742,"nodeType":2021},{},[9743],{"data":9744,"content":9745,"nodeType":881},{},[9746],{"data":9747,"marks":9748,"value":2182,"nodeType":865},{},[9749],{"type":902},{"data":9751,"content":9752,"nodeType":2021},{},[9753],{"data":9754,"content":9755,"nodeType":881},{},[9756],{"data":9757,"marks":9758,"value":3357,"nodeType":865},{},[],{"data":9760,"content":9761,"nodeType":2032},{},[9762,9772],{"data":9763,"content":9764,"nodeType":2021},{},[9765],{"data":9766,"content":9767,"nodeType":881},{},[9768],{"data":9769,"marks":9770,"value":2406,"nodeType":865},{},[9771],{"type":902},{"data":9773,"content":9774,"nodeType":2021},{},[9775],{"data":9776,"content":9777,"nodeType":881},{},[9778],{"data":9779,"marks":9780,"value":3380,"nodeType":865},{},[],{"data":9782,"content":9785,"nodeType":890},{"target":9783},{"sys":9784},{"id":3385,"type":887,"linkType":888},[],{"data":9787,"content":9788,"nodeType":894},{},[],{"data":9790,"content":9791,"nodeType":1860},{},[9792],{"data":9793,"marks":9794,"value":3397,"nodeType":865},{},[9795],{"type":902},{"data":9797,"content":9798,"nodeType":2270},{},[9799,9821,9843,9865],{"data":9800,"content":9801,"nodeType":2032},{},[9802,9812],{"data":9803,"content":9804,"nodeType":2021},{},[9805],{"data":9806,"content":9807,"nodeType":881},{},[9808],{"data":9809,"marks":9810,"value":2020,"nodeType":865},{},[9811],{"type":902},{"data":9813,"content":9814,"nodeType":2021},{},[9815],{"data":9816,"content":9817,"nodeType":881},{},[9818],{"data":9819,"marks":9820,"value":2307,"nodeType":865},{},[],{"data":9822,"content":9823,"nodeType":2032},{},[9824,9834],{"data":9825,"content":9826,"nodeType":2021},{},[9827],{"data":9828,"content":9829,"nodeType":881},{},[9830],{"data":9831,"marks":9832,"value":2130,"nodeType":865},{},[9833],{"type":902},{"data":9835,"content":9836,"nodeType":2021},{},[9837],{"data":9838,"content":9839,"nodeType":881},{},[9840],{"data":9841,"marks":9842,"value":3445,"nodeType":865},{},[],{"data":9844,"content":9845,"nodeType":2032},{},[9846,9856],{"data":9847,"content":9848,"nodeType":2021},{},[9849],{"data":9850,"content":9851,"nodeType":881},{},[9852],{"data":9853,"marks":9854,"value":2182,"nodeType":865},{},[9855],{"type":902},{"data":9857,"content":9858,"nodeType":2021},{},[9859],{"data":9860,"content":9861,"nodeType":881},{},[9862],{"data":9863,"marks":9864,"value":3468,"nodeType":865},{},[],{"data":9866,"content":9867,"nodeType":2032},{},[9868,9878],{"data":9869,"content":9870,"nodeType":2021},{},[9871],{"data":9872,"content":9873,"nodeType":881},{},[9874],{"data":9875,"marks":9876,"value":2406,"nodeType":865},{},[9877],{"type":902},{"data":9879,"content":9880,"nodeType":2021},{},[9881],{"data":9882,"content":9883,"nodeType":881},{},[9884],{"data":9885,"marks":9886,"value":3491,"nodeType":865},{},[],{"data":9888,"content":9891,"nodeType":890},{"target":9889},{"sys":9890},{"id":3496,"type":887,"linkType":888},[],{"data":9893,"content":9894,"nodeType":894},{},[],{"data":9896,"content":9897,"nodeType":1860},{},[9898],{"data":9899,"marks":9900,"value":3508,"nodeType":865},{},[9901],{"type":902},{"data":9903,"content":9906,"nodeType":890},{"target":9904},{"sys":9905},{"id":3513,"type":887,"linkType":888},[],{"data":9908,"content":9909,"nodeType":2270},{},[9910,9932,9968,9990,10012],{"data":9911,"content":9912,"nodeType":2032},{},[9913,9923],{"data":9914,"content":9915,"nodeType":2021},{},[9916],{"data":9917,"content":9918,"nodeType":881},{},[9919],{"data":9920,"marks":9921,"value":2020,"nodeType":865},{},[9922],{"type":902},{"data":9924,"content":9925,"nodeType":2021},{},[9926],{"data":9927,"content":9928,"nodeType":881},{},[9929],{"data":9930,"marks":9931,"value":3540,"nodeType":865},{},[],{"data":9933,"content":9934,"nodeType":2032},{},[9935,9945],{"data":9936,"content":9937,"nodeType":2021},{},[9938],{"data":9939,"content":9940,"nodeType":881},{},[9941],{"data":9942,"marks":9943,"value":2046,"nodeType":865},{},[9944],{"type":902},{"data":9946,"content":9947,"nodeType":2021},{},[9948,9958],{"data":9949,"content":9950,"nodeType":881},{},[9951,9955],{"data":9952,"marks":9953,"value":2523,"nodeType":865},{},[9954],{"type":902},{"data":9956,"marks":9957,"value":3567,"nodeType":865},{},[],{"data":9959,"content":9960,"nodeType":881},{},[9961,9965],{"data":9962,"marks":9963,"value":2087,"nodeType":865},{},[9964],{"type":902},{"data":9966,"marks":9967,"value":3578,"nodeType":865},{},[],{"data":9969,"content":9970,"nodeType":2032},{},[9971,9981],{"data":9972,"content":9973,"nodeType":2021},{},[9974],{"data":9975,"content":9976,"nodeType":881},{},[9977],{"data":9978,"marks":9979,"value":2130,"nodeType":865},{},[9980],{"type":902},{"data":9982,"content":9983,"nodeType":2021},{},[9984],{"data":9985,"content":9986,"nodeType":881},{},[9987],{"data":9988,"marks":9989,"value":3601,"nodeType":865},{},[],{"data":9991,"content":9992,"nodeType":2032},{},[9993,10003],{"data":9994,"content":9995,"nodeType":2021},{},[9996],{"data":9997,"content":9998,"nodeType":881},{},[9999],{"data":10000,"marks":10001,"value":2182,"nodeType":865},{},[10002],{"type":902},{"data":10004,"content":10005,"nodeType":2021},{},[10006],{"data":10007,"content":10008,"nodeType":881},{},[10009],{"data":10010,"marks":10011,"value":3624,"nodeType":865},{},[],{"data":10013,"content":10014,"nodeType":2032},{},[10015,10025],{"data":10016,"content":10017,"nodeType":2021},{},[10018],{"data":10019,"content":10020,"nodeType":881},{},[10021],{"data":10022,"marks":10023,"value":2406,"nodeType":865},{},[10024],{"type":902},{"data":10026,"content":10027,"nodeType":2021},{},[10028],{"data":10029,"content":10030,"nodeType":881},{},[10031],{"data":10032,"marks":10033,"value":3647,"nodeType":865},{},[],{"data":10035,"content":10038,"nodeType":890},{"target":10036},{"sys":10037},{"id":3652,"type":887,"linkType":888},[],{"data":10040,"content":10041,"nodeType":894},{},[],{"data":10043,"content":10044,"nodeType":1860},{},[10045],{"data":10046,"marks":10047,"value":3664,"nodeType":865},{},[10048],{"type":902},{"data":10050,"content":10051,"nodeType":2270},{},[10052,10074],{"data":10053,"content":10054,"nodeType":2032},{},[10055,10065],{"data":10056,"content":10057,"nodeType":2021},{},[10058],{"data":10059,"content":10060,"nodeType":881},{},[10061],{"data":10062,"marks":10063,"value":2130,"nodeType":865},{},[10064],{"type":902},{"data":10066,"content":10067,"nodeType":2021},{},[10068],{"data":10069,"content":10070,"nodeType":881},{},[10071],{"data":10072,"marks":10073,"value":3690,"nodeType":865},{},[],{"data":10075,"content":10076,"nodeType":2032},{},[10077,10087],{"data":10078,"content":10079,"nodeType":2021},{},[10080],{"data":10081,"content":10082,"nodeType":881},{},[10083],{"data":10084,"marks":10085,"value":2182,"nodeType":865},{},[10086],{"type":902},{"data":10088,"content":10089,"nodeType":2021},{},[10090],{"data":10091,"content":10092,"nodeType":881},{},[10093],{"data":10094,"marks":10095,"value":3713,"nodeType":865},{},[],{"data":10097,"content":10100,"nodeType":890},{"target":10098},{"sys":10099},{"id":3718,"type":887,"linkType":888},[],{"data":10102,"content":10103,"nodeType":894},{},[],{"data":10105,"content":10106,"nodeType":1860},{},[10107],{"data":10108,"marks":10109,"value":3730,"nodeType":865},{},[10110],{"type":902},{"data":10112,"content":10113,"nodeType":2270},{},[10114,10142,10178,10200,10222],{"data":10115,"content":10116,"nodeType":2032},{},[10117,10127],{"data":10118,"content":10119,"nodeType":2021},{},[10120],{"data":10121,"content":10122,"nodeType":881},{},[10123],{"data":10124,"marks":10125,"value":2020,"nodeType":865},{},[10126],{"type":902},{"data":10128,"content":10129,"nodeType":2021},{},[10130,10136],{"data":10131,"content":10132,"nodeType":881},{},[10133],{"data":10134,"marks":10135,"value":3756,"nodeType":865},{},[],{"data":10137,"content":10138,"nodeType":881},{},[10139],{"data":10140,"marks":10141,"value":3763,"nodeType":865},{},[],{"data":10143,"content":10144,"nodeType":2032},{},[10145,10155],{"data":10146,"content":10147,"nodeType":2021},{},[10148],{"data":10149,"content":10150,"nodeType":881},{},[10151],{"data":10152,"marks":10153,"value":2046,"nodeType":865},{},[10154],{"type":902},{"data":10156,"content":10157,"nodeType":2021},{},[10158,10168],{"data":10159,"content":10160,"nodeType":881},{},[10161,10165],{"data":10162,"marks":10163,"value":2523,"nodeType":865},{},[10164],{"type":902},{"data":10166,"marks":10167,"value":3790,"nodeType":865},{},[],{"data":10169,"content":10170,"nodeType":881},{},[10171,10175],{"data":10172,"marks":10173,"value":2087,"nodeType":865},{},[10174],{"type":902},{"data":10176,"marks":10177,"value":2346,"nodeType":865},{},[],{"data":10179,"content":10180,"nodeType":2032},{},[10181,10191],{"data":10182,"content":10183,"nodeType":2021},{},[10184],{"data":10185,"content":10186,"nodeType":881},{},[10187],{"data":10188,"marks":10189,"value":2130,"nodeType":865},{},[10190],{"type":902},{"data":10192,"content":10193,"nodeType":2021},{},[10194],{"data":10195,"content":10196,"nodeType":881},{},[10197],{"data":10198,"marks":10199,"value":3823,"nodeType":865},{},[],{"data":10201,"content":10202,"nodeType":2032},{},[10203,10213],{"data":10204,"content":10205,"nodeType":2021},{},[10206],{"data":10207,"content":10208,"nodeType":881},{},[10209],{"data":10210,"marks":10211,"value":2182,"nodeType":865},{},[10212],{"type":902},{"data":10214,"content":10215,"nodeType":2021},{},[10216],{"data":10217,"content":10218,"nodeType":881},{},[10219],{"data":10220,"marks":10221,"value":3846,"nodeType":865},{},[],{"data":10223,"content":10224,"nodeType":2032},{},[10225,10235],{"data":10226,"content":10227,"nodeType":2021},{},[10228],{"data":10229,"content":10230,"nodeType":881},{},[10231],{"data":10232,"marks":10233,"value":2406,"nodeType":865},{},[10234],{"type":902},{"data":10236,"content":10237,"nodeType":2021},{},[10238],{"data":10239,"content":10240,"nodeType":881},{},[10241],{"data":10242,"marks":10243,"value":3869,"nodeType":865},{},[],{"data":10245,"content":10248,"nodeType":890},{"target":10246},{"sys":10247},{"id":3874,"type":887,"linkType":888},[],{"data":10250,"content":10251,"nodeType":894},{},[],{"data":10253,"content":10254,"nodeType":1860},{},[10255],{"data":10256,"marks":10257,"value":3886,"nodeType":865},{},[10258],{"type":902},{"data":10260,"content":10261,"nodeType":2270},{},[10262,10284,10320,10342,10364],{"data":10263,"content":10264,"nodeType":2032},{},[10265,10275],{"data":10266,"content":10267,"nodeType":2021},{},[10268],{"data":10269,"content":10270,"nodeType":881},{},[10271],{"data":10272,"marks":10273,"value":2020,"nodeType":865},{},[10274],{"type":902},{"data":10276,"content":10277,"nodeType":2021},{},[10278],{"data":10279,"content":10280,"nodeType":881},{},[10281],{"data":10282,"marks":10283,"value":3912,"nodeType":865},{},[],{"data":10285,"content":10286,"nodeType":2032},{},[10287,10297],{"data":10288,"content":10289,"nodeType":2021},{},[10290],{"data":10291,"content":10292,"nodeType":881},{},[10293],{"data":10294,"marks":10295,"value":2046,"nodeType":865},{},[10296],{"type":902},{"data":10298,"content":10299,"nodeType":2021},{},[10300,10310],{"data":10301,"content":10302,"nodeType":881},{},[10303,10307],{"data":10304,"marks":10305,"value":2523,"nodeType":865},{},[10306],{"type":902},{"data":10308,"marks":10309,"value":3939,"nodeType":865},{},[],{"data":10311,"content":10312,"nodeType":881},{},[10313,10317],{"data":10314,"marks":10315,"value":2087,"nodeType":865},{},[10316],{"type":902},{"data":10318,"marks":10319,"value":3950,"nodeType":865},{},[],{"data":10321,"content":10322,"nodeType":2032},{},[10323,10333],{"data":10324,"content":10325,"nodeType":2021},{},[10326],{"data":10327,"content":10328,"nodeType":881},{},[10329],{"data":10330,"marks":10331,"value":2130,"nodeType":865},{},[10332],{"type":902},{"data":10334,"content":10335,"nodeType":2021},{},[10336],{"data":10337,"content":10338,"nodeType":881},{},[10339],{"data":10340,"marks":10341,"value":3823,"nodeType":865},{},[],{"data":10343,"content":10344,"nodeType":2032},{},[10345,10355],{"data":10346,"content":10347,"nodeType":2021},{},[10348],{"data":10349,"content":10350,"nodeType":881},{},[10351],{"data":10352,"marks":10353,"value":2182,"nodeType":865},{},[10354],{"type":902},{"data":10356,"content":10357,"nodeType":2021},{},[10358],{"data":10359,"content":10360,"nodeType":881},{},[10361],{"data":10362,"marks":10363,"value":3995,"nodeType":865},{},[],{"data":10365,"content":10366,"nodeType":2032},{},[10367,10377],{"data":10368,"content":10369,"nodeType":2021},{},[10370],{"data":10371,"content":10372,"nodeType":881},{},[10373],{"data":10374,"marks":10375,"value":2406,"nodeType":865},{},[10376],{"type":902},{"data":10378,"content":10379,"nodeType":2021},{},[10380],{"data":10381,"content":10382,"nodeType":881},{},[10383],{"data":10384,"marks":10385,"value":4018,"nodeType":865},{},[],{"data":10387,"content":10390,"nodeType":890},{"target":10388},{"sys":10389},{"id":4023,"type":887,"linkType":888},[],{"data":10392,"content":10393,"nodeType":894},{},[],{"data":10395,"content":10396,"nodeType":904},{},[10397],{"data":10398,"marks":10399,"value":4035,"nodeType":865},{},[10400],{"type":902},{"data":10402,"content":10403,"nodeType":881},{},[10404,10407],{"data":10405,"marks":10406,"value":4042,"nodeType":865},{},[],{"data":10408,"marks":10409,"value":4047,"nodeType":865},{},[10410],{"type":902},{"data":10412,"content":10413,"nodeType":881},{},[10414],{"data":10415,"marks":10416,"value":4054,"nodeType":865},{},[],{"data":10418,"content":10421,"nodeType":890},{"target":10419},{"sys":10420},{"id":4059,"type":887,"linkType":888},[],{"data":10423,"content":10426,"nodeType":890},{"target":10424},{"sys":10425},{"id":4065,"type":887,"linkType":888},[],{"data":10428,"content":10429,"nodeType":881},{},[10430],{"data":10431,"marks":10432,"value":4073,"nodeType":865},{},[],{"data":10434,"content":10435,"nodeType":881},{},[10436,10439,10443,10446],{"data":10437,"marks":10438,"value":4080,"nodeType":865},{},[],{"data":10440,"marks":10441,"value":4085,"nodeType":865},{},[10442],{"type":902},{"data":10444,"marks":10445,"value":4089,"nodeType":865},{},[],{"data":10447,"marks":10448,"value":4094,"nodeType":865},{},[10449],{"type":902},{"data":10451,"content":10452,"nodeType":881},{},[10453,10456,10460],{"data":10454,"marks":10455,"value":4101,"nodeType":865},{},[],{"data":10457,"marks":10458,"value":4106,"nodeType":865},{},[10459],{"type":902},{"data":10461,"marks":10462,"value":4110,"nodeType":865},{},[],{"data":10464,"content":10467,"nodeType":890},{"target":10465},{"sys":10466},{"id":4115,"type":887,"linkType":888},[],{"data":10469,"content":10470,"nodeType":894},{},[],{"data":10472,"content":10473,"nodeType":904},{},[10474],{"data":10475,"marks":10476,"value":4127,"nodeType":865},{},[10477],{"type":902},{"data":10479,"content":10480,"nodeType":1860},{},[10481],{"data":10482,"marks":10483,"value":4135,"nodeType":865},{},[10484],{"type":902},{"data":10486,"content":10487,"nodeType":881},{},[10488,10491,10495,10498],{"data":10489,"marks":10490,"value":4142,"nodeType":865},{},[],{"data":10492,"marks":10493,"value":4147,"nodeType":865},{},[10494],{"type":902},{"data":10496,"marks":10497,"value":4151,"nodeType":865},{},[],{"data":10499,"marks":10500,"value":4156,"nodeType":865},{},[10501],{"type":902},{"data":10503,"content":10504,"nodeType":881},{},[10505,10509,10512,10516],{"data":10506,"marks":10507,"value":4164,"nodeType":865},{},[10508],{"type":902},{"data":10510,"marks":10511,"value":4168,"nodeType":865},{},[],{"data":10513,"marks":10514,"value":4173,"nodeType":865},{},[10515],{"type":902},{"data":10517,"marks":10518,"value":4177,"nodeType":865},{},[],{"data":10520,"content":10523,"nodeType":890},{"target":10521},{"sys":10522},{"id":3110,"type":887,"linkType":888},[],{"data":10525,"content":10526,"nodeType":881},{},[10527],{"data":10528,"marks":10529,"value":4189,"nodeType":865},{},[],{"data":10531,"content":10532,"nodeType":881},{},[10533],{"data":10534,"marks":10535,"value":4196,"nodeType":865},{},[],{"data":10537,"content":10538,"nodeType":1860},{},[10539],{"data":10540,"marks":10541,"value":4204,"nodeType":865},{},[10542],{"type":902},{"data":10544,"content":10545,"nodeType":881},{},[10546],{"data":10547,"marks":10548,"value":4211,"nodeType":865},{},[],{"data":10550,"content":10551,"nodeType":881},{},[10552],{"data":10553,"marks":10554,"value":4218,"nodeType":865},{},[],{"data":10556,"content":10557,"nodeType":881},{},[10558],{"data":10559,"marks":10560,"value":4225,"nodeType":865},{},[],{"data":10562,"content":10563,"nodeType":1860},{},[10564],{"data":10565,"marks":10566,"value":4233,"nodeType":865},{},[10567],{"type":902},{"data":10569,"content":10570,"nodeType":881},{},[10571],{"data":10572,"marks":10573,"value":4240,"nodeType":865},{},[],{"data":10575,"content":10576,"nodeType":1818},{},[10577,10590,10603],{"data":10578,"content":10579,"nodeType":1734},{},[10580],{"data":10581,"content":10582,"nodeType":881},{},[10583,10587],{"data":10584,"marks":10585,"value":4254,"nodeType":865},{},[10586],{"type":902},{"data":10588,"marks":10589,"value":4258,"nodeType":865},{},[],{"data":10591,"content":10592,"nodeType":1734},{},[10593],{"data":10594,"content":10595,"nodeType":881},{},[10596,10600],{"data":10597,"marks":10598,"value":1718,"nodeType":865},{},[10599],{"type":902},{"data":10601,"marks":10602,"value":4272,"nodeType":865},{},[],{"data":10604,"content":10605,"nodeType":1734},{},[10606],{"data":10607,"content":10608,"nodeType":881},{},[10609,10612,10616],{"data":10610,"marks":10611,"value":4282,"nodeType":865},{},[],{"data":10613,"marks":10614,"value":4287,"nodeType":865},{},[10615],{"type":902},{"data":10617,"marks":10618,"value":4291,"nodeType":865},{},[],{"data":10620,"content":10623,"nodeType":890},{"target":10621},{"sys":10622},{"id":4296,"type":887,"linkType":888},[],{"data":10625,"content":10626,"nodeType":894},{},[],{"data":10628,"content":10629,"nodeType":904},{},[10630],{"data":10631,"marks":10632,"value":4308,"nodeType":865},{},[10633],{"type":902},{"data":10635,"content":10636,"nodeType":881},{},[10637],{"data":10638,"marks":10639,"value":4315,"nodeType":865},{},[],{"data":10641,"content":10642,"nodeType":881},{},[10643],{"data":10644,"marks":10645,"value":4322,"nodeType":865},{},[],{"data":10647,"content":10648,"nodeType":881},{},[10649,10652,10659,10662,10666,10669,10673,10676,10680],{"data":10650,"marks":10651,"value":4329,"nodeType":865},{},[],{"data":10653,"content":10654,"nodeType":876},{"uri":4332},[10655],{"data":10656,"marks":10657,"value":4338,"nodeType":865},{},[10658],{"type":874},{"data":10660,"marks":10661,"value":4342,"nodeType":865},{},[],{"data":10663,"marks":10664,"value":4347,"nodeType":865},{},[10665],{"type":902},{"data":10667,"marks":10668,"value":4351,"nodeType":865},{},[],{"data":10670,"marks":10671,"value":4356,"nodeType":865},{},[10672],{"type":902},{"data":10674,"marks":10675,"value":4360,"nodeType":865},{},[],{"data":10677,"marks":10678,"value":4365,"nodeType":865},{},[10679],{"type":902},{"data":10681,"marks":10682,"value":4369,"nodeType":865},{},[],{"data":10684,"content":10687,"nodeType":890},{"target":10685},{"sys":10686},{"id":4374,"type":887,"linkType":888},[],{"data":10689,"content":10690,"nodeType":881},{},[10691],{"data":10692,"marks":10693,"value":4382,"nodeType":865},{},[],{"data":10695,"content":10696,"nodeType":894},{},[],{"data":10698,"content":10699,"nodeType":904},{},[10700],{"data":10701,"marks":10702,"value":4393,"nodeType":865},{},[10703],{"type":902},{"data":10705,"content":10706,"nodeType":881},{},[10707],{"data":10708,"marks":10709,"value":4400,"nodeType":865},{},[],{"data":10711,"content":10712,"nodeType":881},{},[10713],{"data":10714,"marks":10715,"value":4407,"nodeType":865},{},[],{"data":10717,"content":10718,"nodeType":881},{},[10719,10722,10729],{"data":10720,"marks":10721,"value":4414,"nodeType":865},{},[],{"data":10723,"content":10724,"nodeType":876},{"uri":4417},[10725],{"data":10726,"marks":10727,"value":4423,"nodeType":865},{},[10728],{"type":874},{"data":10730,"marks":10731,"value":4427,"nodeType":865},{},[],{"data":10733,"content":10736,"nodeType":890},{"target":10734},{"sys":10735},{"id":4432,"type":887,"linkType":888},[],{"data":10738,"content":10739,"nodeType":881},{},[10740],{"data":10741,"marks":10742,"value":4440,"nodeType":865},{},[],{"data":10744,"content":10745,"nodeType":1860},{},[10746],{"data":10747,"marks":10748,"value":4448,"nodeType":865},{},[10749],{"type":902},{"data":10751,"content":10752,"nodeType":881},{},[10753],{"data":10754,"marks":10755,"value":4455,"nodeType":865},{},[],{"data":10757,"content":10758,"nodeType":881},{},[10759,10762,10769,10772,10779,10782,10789],{"data":10760,"marks":10761,"value":4462,"nodeType":865},{},[],{"data":10763,"content":10764,"nodeType":876},{"uri":4465},[10765],{"data":10766,"marks":10767,"value":4471,"nodeType":865},{},[10768],{"type":874},{"data":10770,"marks":10771,"value":1877,"nodeType":865},{},[],{"data":10773,"content":10774,"nodeType":876},{"uri":4477},[10775],{"data":10776,"marks":10777,"value":4483,"nodeType":865},{},[10778],{"type":874},{"data":10780,"marks":10781,"value":4487,"nodeType":865},{},[],{"data":10783,"content":10784,"nodeType":876},{"uri":1453},[10785],{"data":10786,"marks":10787,"value":4495,"nodeType":865},{},[10788],{"type":874},{"data":10790,"marks":10791,"value":959,"nodeType":865},{},[],{"items":10793},[10794,10796],{"sys":10795,"name":4507},{"id":4506},{"sys":10797,"name":342},{"id":4510},{"items":10799},[10800],{"fullName":4514,"firstName":4515,"jobTitle":4516,"profilePicture":10801},{"url":4518},{"__typename":1485,"sys":10803,"content":10805,"title":11751,"synopsis":11752,"hashTags":59,"publishedDate":11753,"slug":11754,"tagsCollection":11755,"authorsCollection":11761},{"id":10804},"2sFCww9xnI8okIxhtOaiY1",{"json":10806},{"data":10807,"content":10808,"nodeType":1463},{},[10809,10816,10823,10830,10833,10841,10848,10855,10861,10868,10874,10893,10900,10912,10915,10923,10930,10946,10953,10965,10971,10974,10982,10990,10996,11005,11025,11034,11041,11050,11069,11078,11085,11094,11127,11136,11143,11152,11170,11176,11185,11192,11201,11242,11245,11253,11262,11282,11291,11298,11307,11340,11346,11355,11362,11368,11371,11378,11387,11394,11454,11460,11463,11470,11479,11486,11492,11495,11503,11510,11517,11586,11593,11656,11663,11666,11674,11681,11688,11694,11697,11704,11711,11718,11725],{"data":10810,"content":10811,"nodeType":881},{},[10812],{"data":10813,"marks":10814,"value":10815,"nodeType":865},{},[],"The biggest cybersecurity story this year (so far) has been the emergence of “Scattered Lapsus$ Hunters” and their record-breaking worldwide hacking spree. ",{"data":10817,"content":10818,"nodeType":881},{},[10819],{"data":10820,"marks":10821,"value":10822,"nodeType":865},{},[],"Scattered Lapsus$ Hunters is part of “The Com”, the name for the broad community of English-speaking cybercriminals with international criminal connections — including with nation-state sponsored groups. They are also known to collaborate with a range of cybercrime “as-a-Service” organizations for phishing, initial access, ransomware, and more. ",{"data":10824,"content":10825,"nodeType":881},{},[10826],{"data":10827,"marks":10828,"value":10829,"nodeType":865},{},[],"It’s difficult to pin down exactly who the individuals are that make up this criminal collective. But what is known is their MO — making money through extortion by means of account takeover, mass data theft, and ransomware deployment. ",{"data":10831,"content":10832,"nodeType":894},{},[],{"data":10834,"content":10835,"nodeType":904},{},[10836],{"data":10837,"marks":10838,"value":10840,"nodeType":865},{},[10839],{"type":902},"How did we get here? ",{"data":10842,"content":10843,"nodeType":881},{},[10844],{"data":10845,"marks":10846,"value":10847,"nodeType":865},{},[],"Earlier this year, the threat group known to most analysts as Scattered Spider (also tracked as 0ktapus, Octo Tempest, Scatter Swine, Muddled Libra, and UNC3944) re-emerged after a series of arrests in late 2024. ",{"data":10849,"content":10850,"nodeType":881},{},[10851],{"data":10852,"marks":10853,"value":10854,"nodeType":865},{},[],"This group has been active in peaks and troughs over the years, but are mainly known for high-profile ransomware attacks on Caesars and MGM Resorts in 2024. ",{"data":10856,"content":10860,"nodeType":890},{"target":10857},{"sys":10858},{"id":10859,"type":887,"linkType":888},"1Vt269d7n6IGMzOrJs1FDx",[],{"data":10862,"content":10863,"nodeType":881},{},[10864],{"data":10865,"marks":10866,"value":10867,"nodeType":865},{},[],"Scattered Spider hit the headlines again in April 2025 with attacks on UK retailers Marks & Spencer and Co-op, which resulted in significant, prolonged disruption, and a serious downstream impact on the retail supply chain. ",{"data":10869,"content":10873,"nodeType":890},{"target":10870},{"sys":10871},{"id":10872,"type":887,"linkType":888},"3kvcGV2zZZUPnM8IK04Y1O",[],{"data":10875,"content":10876,"nodeType":881},{},[10877,10881,10889],{"data":10878,"marks":10879,"value":10880,"nodeType":865},{},[],"It didn’t stop there, though. What followed was a wide-scale campaign targeting Salesforce customers, with the attackers claiming to have stolen ",{"data":10882,"content":10883,"nodeType":876},{"uri":5475},[10884],{"data":10885,"marks":10886,"value":10888,"nodeType":865},{},[10887],{"type":874},"over 1.5 billion records from 1000+ companies",{"data":10890,"marks":10891,"value":10892,"nodeType":865},{},[]," across multiple verticals, including heavyweights like Google, Cloudflare, Workday, Adidas, FedEx, Disney, LVMH, and many more.",{"data":10894,"content":10895,"nodeType":881},{},[10896],{"data":10897,"marks":10898,"value":10899,"nodeType":865},{},[],"Around this time, the attackers began to refer to themselves as part of a wider collective, assuming the moniker “Scattered Lapsus$ Hunters” (a mash-up of names given by analysts and self-adopted by attackers — Scattered Spider, ShinyHunters, and Lapsus$).",{"data":10901,"content":10902,"nodeType":881},{},[10903,10907],{"data":10904,"marks":10905,"value":10906,"nodeType":865},{},[],"The most significant breach this year to-date impacted Jaguar Land Rover. A ransomware attack resulted in months of disruption that directly impacted the UK’s GDP, with the government underwriting a $1.5B loan to alleviate the supply chain impact. ",{"data":10908,"marks":10909,"value":10911,"nodeType":865},{},[10910],{"type":902},"In fact, this was the most economically consequential cyber attack yet recorded in a G7 economy. ",{"data":10913,"content":10914,"nodeType":894},{},[],{"data":10916,"content":10917,"nodeType":904},{},[10918],{"data":10919,"marks":10920,"value":10922,"nodeType":865},{},[10921],{"type":902},"2025 wasn’t a one-off",{"data":10924,"content":10925,"nodeType":881},{},[10926],{"data":10927,"marks":10928,"value":10929,"nodeType":865},{},[],"The developments through 2025 have presented a stronger picture than ever before that cybercriminal operations are heavily interlinked. Groups overlap considerably, and individuals freely move between different cells. ",{"data":10931,"content":10932,"nodeType":881},{},[10933,10937,10942],{"data":10934,"marks":10935,"value":10936,"nodeType":865},{},[],"When we scratch beneath the surface, this is evident in the tactics, techniques and procedures (TTPs) used by these attackers — even stretching as far back as 2021 with the initial rise of Lapsus$. This is not an accident. ",{"data":10938,"marks":10939,"value":10941,"nodeType":865},{},[10940],{"type":902},"The TTPs used show a conscious move by attackers to move away from environments that are well-protected by traditional security tools. ",{"data":10943,"marks":10944,"value":10945,"nodeType":865},{},[],"This means avoiding targeting endpoints with malware, and not relying on software-based exploits. Instead, these attackers look to take over apps and services directly over the internet. ",{"data":10947,"content":10948,"nodeType":881},{},[10949],{"data":10950,"marks":10951,"value":10952,"nodeType":865},{},[],"Most of the time, this is as simple as logging in to a SaaS app, or an enterprise SSO account (e.g. Microsoft, Okta, or Google) and dumping the data. For attackers that want to take it further, they can abuse the sprawl of interconnected apps that make up modern business IT, seeking out specific data or exploitable functionality. Or, they can leverage internet-accessible management portals to chart a path back to your on-premise assets, giving them everything they need to pivot toward more conventional methods such as ransomware deployment. ",{"data":10954,"content":10955,"nodeType":881},{},[10956,10960],{"data":10957,"marks":10958,"value":10959,"nodeType":865},{},[],"When we look at historical breaches, the pattern is clear. ",{"data":10961,"marks":10962,"value":10964,"nodeType":865},{},[10963],{"type":902},"Not one of the attacks attributed to Scattered Lapsus$ Hunters, or its predecessors, started with an endpoint or network attack — they all began with account takeover. ",{"data":10966,"content":10970,"nodeType":890},{"target":10967},{"sys":10968},{"id":10969,"type":887,"linkType":888},"6poP5VM2ARrEvwKEG42HgK",[],{"data":10972,"content":10973,"nodeType":894},{},[],{"data":10975,"content":10976,"nodeType":904},{},[10977],{"data":10978,"marks":10979,"value":10981,"nodeType":865},{},[10980],{"type":902},"TTP breakdown: Analyzing the top “Scattered Lapsus$ Hunters” breaches since 2021",{"data":10983,"content":10984,"nodeType":1860},{},[10985],{"data":10986,"marks":10987,"value":10989,"nodeType":865},{},[10988],{"type":902},"Phishing and stolen credentials",{"data":10991,"content":10995,"nodeType":890},{"target":10992},{"sys":10993},{"id":10994,"type":887,"linkType":888},"4SNOanDIdGZsvRRnMYQVSo",[],{"data":10997,"content":10998,"nodeType":881},{},[10999],{"data":11000,"marks":11001,"value":11004,"nodeType":865},{},[11002,11003],{"type":902},{"type":874},"EA Games (2021)",{"data":11006,"content":11007,"nodeType":881},{},[11008,11012,11021],{"data":11009,"marks":11010,"value":11011,"nodeType":865},{},[],"Attackers used stolen session cookies to log into EA’s Slack instance, purchased on a criminal forum. Combined with ",{"data":11013,"content":11015,"nodeType":876},{"uri":11014},"https://pushsecurity.com/blog/phishing-slack-persistence/",[11016],{"data":11017,"marks":11018,"value":11020,"nodeType":865},{},[11019],{"type":874},"social engineering via Slack",{"data":11022,"marks":11023,"value":11024,"nodeType":865},{},[],", this was used to steal 750GB of data, including video game source code. ",{"data":11026,"content":11027,"nodeType":881},{},[11028],{"data":11029,"marks":11030,"value":11033,"nodeType":865},{},[11031,11032],{"type":902},{"type":874},"Nvidia (2022)",{"data":11035,"content":11036,"nodeType":881},{},[11037],{"data":11038,"marks":11039,"value":11040,"nodeType":865},{},[],"Attackers used stolen credentials to steal 1TB of data from Nvidia’s internal shares, including a significant amount of sensitive information about the designs of Nvidia graphics cards, source code, and the usernames and passwords of more than 71,000 Nvidia employees.",{"data":11042,"content":11043,"nodeType":881},{},[11044],{"data":11045,"marks":11046,"value":11049,"nodeType":865},{},[11047,11048],{"type":902},{"type":874},"Microsoft (2022)",{"data":11051,"content":11052,"nodeType":881},{},[11053,11057,11065],{"data":11054,"marks":11055,"value":11056,"nodeType":865},{},[],"Attackers used stolen credentials combined with SIM swapping and ",{"data":11058,"content":11060,"nodeType":876},{"uri":11059},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/mfa_fatigue/description.md",[11061],{"data":11062,"marks":11063,"value":11064,"nodeType":865},{},[],"MFA fatigue",{"data":11066,"marks":11067,"value":11068,"nodeType":865},{},[]," attacks to steal Azure DevOps source code — leaked a 9GB archive of Microsoft source code – including ~90% of Bing and 45% of Cortana code. ",{"data":11070,"content":11071,"nodeType":881},{},[11072],{"data":11073,"marks":11074,"value":11077,"nodeType":865},{},[11075,11076],{"type":902},{"type":874},"T-Mobile (2022)",{"data":11079,"content":11080,"nodeType":881},{},[11081],{"data":11082,"marks":11083,"value":11084,"nodeType":865},{},[],"Attackers used stolen credentials to establish initial access, coupled with social engineering T-Mobile staff into approving the attacker’s device for VPN access. This resulted in source code being stolen from over 30,000 repositories. ",{"data":11086,"content":11087,"nodeType":881},{},[11088],{"data":11089,"marks":11090,"value":11093,"nodeType":865},{},[11091,11092],{"type":902},{"type":874},"Snowflake (165 customers) (2024)",{"data":11095,"content":11096,"nodeType":881},{},[11097,11101,11110,11114,11123],{"data":11098,"marks":11099,"value":11100,"nodeType":865},{},[],"Attackers targeted ",{"data":11102,"content":11104,"nodeType":876},{"uri":11103},"https://pushsecurity.com/blog/snowflake-retro/",[11105],{"data":11106,"marks":11107,"value":11109,"nodeType":865},{},[11108],{"type":874},"165 Snowflake customers",{"data":11111,"marks":11112,"value":11113,"nodeType":865},{},[]," using stolen credentials from credential breaches dating back as far as 2020. Due to widespread MFA gaps and the presence of ",{"data":11115,"content":11117,"nodeType":876},{"uri":11116},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/ghost_logins/description.md",[11118],{"data":11119,"marks":11120,"value":11122,"nodeType":865},{},[11121],{"type":874},"ghost logins",{"data":11124,"marks":11125,"value":11126,"nodeType":865},{},[],", attackers were able to simply log in to individual customer tenants, dump the data, and use it to extort the companies. In total, 9 public victims were named following the breach, with over 1B breached customer records. ",{"data":11128,"content":11129,"nodeType":881},{},[11130],{"data":11131,"marks":11132,"value":11135,"nodeType":865},{},[11133,11134],{"type":902},{"type":874},"PowerSchool (2024)",{"data":11137,"content":11138,"nodeType":881},{},[11139],{"data":11140,"marks":11141,"value":11142,"nodeType":865},{},[],"Attackers gained access to a community-focused customer support portal, PowerSource, using compromised credentials and stole data using an \"export data manager\" customer support tool, stealing the data of 62.4 million students and 9.5 million teachers. PowerSchool paid an undisclosed ransom fee, but hackers returned later to extort schools and individuals separately anyway.",{"data":11144,"content":11145,"nodeType":881},{},[11146],{"data":11147,"marks":11148,"value":11151,"nodeType":865},{},[11149,11150],{"type":902},{"type":874},"Red Hat (2025)",{"data":11153,"content":11154,"nodeType":881},{},[11155,11159,11166],{"data":11156,"marks":11157,"value":11158,"nodeType":865},{},[],"Attackers breached Red Hat’s GitLab instance via a compromised account — the result of ",{"data":11160,"content":11161,"nodeType":876},{"uri":11116},[11162],{"data":11163,"marks":11164,"value":11122,"nodeType":865},{},[11165],{"type":874},{"data":11167,"marks":11168,"value":11169,"nodeType":865},{},[]," providing a backdoor to access an otherwise secure, SSO-connected account. Stolen data included approximately 800 Customer Engagement Reports (CERs), authentication tokens, full database URIs, and other private information in Red Hat code and CERs, which they claimed to use to gain access to downstream customer infrastructure. ",{"data":11171,"content":11175,"nodeType":890},{"target":11172},{"sys":11173},{"id":11174,"type":887,"linkType":888},"G1V7d5Dvevmr9p0YXElPX",[],{"data":11177,"content":11178,"nodeType":881},{},[11179],{"data":11180,"marks":11181,"value":11184,"nodeType":865},{},[11182,11183],{"type":902},{"type":874},"Discord (2025)",{"data":11186,"content":11187,"nodeType":881},{},[11188],{"data":11189,"marks":11190,"value":11191,"nodeType":865},{},[],"Attackers compromised a Zendesk customer support account, stealing 1.6TB of data. The hackers say this consisted of roughly 8.4 million tickets affecting 5.5 million unique users, and that about 580,000 users contained payment information.",{"data":11193,"content":11194,"nodeType":881},{},[11195],{"data":11196,"marks":11197,"value":11200,"nodeType":865},{},[11198,11199],{"type":902},{"type":874},"SoundCloud, MatchGroup, Crunchbase, Betterment... (2026)",{"data":11202,"content":11203,"nodeType":881},{},[11204,11208,11216,11219,11227,11231,11238],{"data":11205,"marks":11206,"value":11207,"nodeType":865},{},[],"Scattered Lapsus$ Hunters have already claimed several public victims in 2026, with over 60 million breached records. ",{"data":11209,"content":11211,"nodeType":876},{"uri":11210},"https://www.bleepingcomputer.com/news/security/shinyhunters-claim-to-be-behind-sso-account-data-theft-attacks/",[11212],{"data":11213,"marks":11214,"value":11215,"nodeType":865},{},[],"SoundCloud, Betterment, Crunchbase",{"data":11217,"marks":11218,"value":1651,"nodeType":865},{},[],{"data":11220,"content":11222,"nodeType":876},{"uri":11221},"https://www.bleepingcomputer.com/news/security/match-group-breach-exposes-data-from-hinge-tinder-okcupid-and-match/",[11223],{"data":11224,"marks":11225,"value":11226,"nodeType":865},{},[],"MatchGroup",{"data":11228,"marks":11229,"value":11230,"nodeType":865},{},[]," have all reported breaches this month, powered by a brand ",{"data":11232,"content":11233,"nodeType":876},{"uri":5030},[11234],{"data":11235,"marks":11236,"value":11237,"nodeType":865},{},[],"new real-time-operated AiTM phishing kit",{"data":11239,"marks":11240,"value":11241,"nodeType":865},{},[]," targeting Okta, Entra, and Google SSO accounts. This is a developing situation, with more victims expected to be announced publicly soon.",{"data":11243,"content":11244,"nodeType":894},{},[],{"data":11246,"content":11247,"nodeType":1860},{},[11248],{"data":11249,"marks":11250,"value":11252,"nodeType":865},{},[11251],{"type":902},"Vishing and help desk scams",{"data":11254,"content":11255,"nodeType":881},{},[11256],{"data":11257,"marks":11258,"value":11261,"nodeType":865},{},[11259,11260],{"type":902},{"type":874},"MGM Resorts & Caesars (2023)",{"data":11263,"content":11264,"nodeType":881},{},[11265,11269,11278],{"data":11266,"marks":11267,"value":11268,"nodeType":865},{},[],"MGM Resorts and Caesars were hit with twin breaches in 2023. Attackers socially engineered help desk personnel to take over accounts with Super Administrator privileges within MGM Resorts’ Okta tenant, which they then used to register a second, attacker-controlled IdP via ",{"data":11270,"content":11272,"nodeType":876},{"uri":11271},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/inbound_federation/description.md",[11273],{"data":11274,"marks":11275,"value":11277,"nodeType":865},{},[11276],{"type":874},"inbound federation",{"data":11279,"marks":11280,"value":11281,"nodeType":865},{},[]," — granting comprehensive access that was used to deploy ransomware. ",{"data":11283,"content":11284,"nodeType":881},{},[11285],{"data":11286,"marks":11287,"value":11290,"nodeType":865},{},[11288,11289],{"type":902},{"type":874},"Transport for London (2024)",{"data":11292,"content":11293,"nodeType":881},{},[11294],{"data":11295,"marks":11296,"value":11297,"nodeType":865},{},[],"Attackers socially engineered the Transport for London help desk to gain privileged access to the IT environment, resulting in prolonged disruption to key online services underpinning London’s public transport network, theft of 5,000 users bank details, and all 30,000 staff members having to reset their online credentials in person.",{"data":11299,"content":11300,"nodeType":881},{},[11301],{"data":11302,"marks":11303,"value":11306,"nodeType":865},{},[11304,11305],{"type":902},{"type":874},"Marks & Spencer (2025)",{"data":11308,"content":11309,"nodeType":881},{},[11310,11314,11323,11327,11336],{"data":11311,"marks":11312,"value":11313,"nodeType":865},{},[],"Attackers compromised a Microsoft Entra account belonging to a privileged user via a ",{"data":11315,"content":11317,"nodeType":876},{"uri":11316},"https://pushsecurity.com/blog/scattered-spider-defending-against-help-desk-scams/",[11318],{"data":11319,"marks":11320,"value":11322,"nodeType":865},{},[11321],{"type":874},"help desk scam",{"data":11324,"marks":11325,"value":11326,"nodeType":865},{},[],", which enabled them to steal sensitive data from cloud environments, as well as pivot to deploy ransomware via the ",{"data":11328,"content":11330,"nodeType":876},{"uri":11329},"https://cloud.google.com/blog/topics/threat-intelligence/vsphere-active-directory-integration-risks",[11331],{"data":11332,"marks":11333,"value":11335,"nodeType":865},{},[11334],{"type":874},"VMware admin console",{"data":11337,"marks":11338,"value":11339,"nodeType":865},{},[],". This enabled ransomware to be deployed at the hypervisor layer, evading host-based protections like EDR. ",{"data":11341,"content":11345,"nodeType":890},{"target":11342},{"sys":11343},{"id":11344,"type":887,"linkType":888},"7hBdHG74NaA3bQfOMpYA9o",[],{"data":11347,"content":11348,"nodeType":881},{},[11349],{"data":11350,"marks":11351,"value":11354,"nodeType":865},{},[11352,11353],{"type":902},{"type":874},"Jaguar Land Rover (2025)",{"data":11356,"content":11357,"nodeType":881},{},[11358],{"data":11359,"marks":11360,"value":11361,"nodeType":865},{},[],"Attackers compromised highly privileged admin accounts via a help desk scam, which they leveraged to access and deploy ransomware to all aspects of Jaguar’s business, from CAD and engineering software, to payments tracking, to customer car delivery, using similar techniques to the Marks & Spencer breach. ",{"data":11363,"content":11367,"nodeType":890},{"target":11364},{"sys":11365},{"id":11366,"type":887,"linkType":888},"6s1X2fo4K9EeVLBmHm4YXb",[],{"data":11369,"content":11370,"nodeType":894},{},[],{"data":11372,"content":11373,"nodeType":1860},{},[11374],{"data":11375,"marks":11376,"value":694,"nodeType":865},{},[11377],{"type":902},{"data":11379,"content":11380,"nodeType":881},{},[11381],{"data":11382,"marks":11383,"value":11386,"nodeType":865},{},[11384,11385],{"type":902},{"type":874},"Salesforce & Salesloft (1000+ customers) (2025)",{"data":11388,"content":11389,"nodeType":881},{},[11390],{"data":11391,"marks":11392,"value":11393,"nodeType":865},{},[],"A vast campaign against Salesforce customers resulted in the compromise of 1000+ Salesforce tenants (according to the attacker) with more than 1.5 billion records stolen. This campaign can consisted of three phases:",{"data":11395,"content":11396,"nodeType":1818},{},[11397,11412,11427],{"data":11398,"content":11399,"nodeType":1734},{},[11400],{"data":11401,"content":11402,"nodeType":881},{},[11403,11408],{"data":11404,"marks":11405,"value":11407,"nodeType":865},{},[11406],{"type":902},"Phase 1:",{"data":11409,"marks":11410,"value":11411,"nodeType":865},{},[]," The attacker conducted a large-scale vishing campaign against Salesforce customers, calling up users and socially engineering them into connecting a malicious version of the “Data Loader” app into their tenant. This was in fact an attacker-controlled app that enabled data to be mass-exfiltrated via API. ",{"data":11413,"content":11414,"nodeType":1734},{},[11415],{"data":11416,"content":11417,"nodeType":881},{},[11418,11423],{"data":11419,"marks":11420,"value":11422,"nodeType":865},{},[11421],{"type":902},"Phase 2: ",{"data":11424,"marks":11425,"value":11426,"nodeType":865},{},[],"The attacker conducted a supply-chain compromise against customers of Salesloft. Users of Salesloft’s “Drift” integration were impacted by attackers stealing access tokens from Salesloft’s AWS environment. This integration allowed the attacker to steal data from customers that had deployed Drift to connected environments — namely, Salesforce, and Google Workspace. ",{"data":11428,"content":11429,"nodeType":1734},{},[11430],{"data":11431,"content":11432,"nodeType":881},{},[11433,11438,11442,11450],{"data":11434,"marks":11435,"value":11437,"nodeType":865},{},[11436],{"type":902},"Phase 3:",{"data":11439,"marks":11440,"value":11441,"nodeType":865},{},[]," The attacker then conducted a separate supply-chain compromise involving Gainsight (allegedly using OAuth tokens stolen in the Salesloft attack) which enabled them to ",{"data":11443,"content":11445,"nodeType":876},{"uri":11444},"https://www.bleepingcomputer.com/news/security/salesforce-investigates-customer-data-theft-via-gainsight-breach/",[11446],{"data":11447,"marks":11448,"value":11449,"nodeType":865},{},[],"breach a further 285 Salesforce instances",{"data":11451,"marks":11452,"value":11453,"nodeType":865},{},[]," using stolen OAuth tokens from Gainsight's integrations. ",{"data":11455,"content":11459,"nodeType":890},{"target":11456},{"sys":11457},{"id":11458,"type":887,"linkType":888},"3TwjpVKQ42SwQRhvGFbZdn",[],{"data":11461,"content":11462,"nodeType":894},{},[],{"data":11464,"content":11465,"nodeType":1860},{},[11466],{"data":11467,"marks":11468,"value":699,"nodeType":865},{},[11469],{"type":902},{"data":11471,"content":11472,"nodeType":881},{},[11473],{"data":11474,"marks":11475,"value":11478,"nodeType":865},{},[11476,11477],{"type":902},{"type":874},"CyberHaven (2024)",{"data":11480,"content":11481,"nodeType":881},{},[11482],{"data":11483,"marks":11484,"value":11485,"nodeType":865},{},[],"Hackers phished a CyberHaven extension developer and uploaded a malicious version of the CyberHaven extension to the Chrome Web Store, leading to customer data breaches where installed in user browsers, impacting CyberHaven’s estimated ~400 business customers. This was part of a broader campaign that targeted 35 Chrome extensions, collectively impacting over 2.5 million users.",{"data":11487,"content":11491,"nodeType":890},{"target":11488},{"sys":11489},{"id":11490,"type":887,"linkType":888},"4ErDI0xi0Vj2Zrk8Qsb2NB",[],{"data":11493,"content":11494,"nodeType":894},{},[],{"data":11496,"content":11497,"nodeType":904},{},[11498],{"data":11499,"marks":11500,"value":11502,"nodeType":865},{},[11501],{"type":902},"The bigger picture",{"data":11504,"content":11505,"nodeType":881},{},[11506],{"data":11507,"marks":11508,"value":11509,"nodeType":865},{},[],"Scattered Lapsus$ Hunters are dominating the headlines right now, but they aren’t the only attackers using these modern techniques and consciously evading established security controls. ",{"data":11511,"content":11512,"nodeType":881},{},[11513],{"data":11514,"marks":11515,"value":11516,"nodeType":865},{},[],"Threat reports agree that attackers are steering away from traditional exploit and malware-driven breaches towards identities:",{"data":11518,"content":11519,"nodeType":1818},{},[11520,11542,11564],{"data":11521,"content":11522,"nodeType":1734},{},[11523],{"data":11524,"content":11525,"nodeType":881},{},[11526,11530,11538],{"data":11527,"marks":11528,"value":11529,"nodeType":865},{},[],"Identity-based attacks surged 32% in the last year, while 97% of identity attacks are password-based, driven by credential leaks and infostealer malware. (",{"data":11531,"content":11533,"nodeType":876},{"uri":11532},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=1",[11534],{"data":11535,"marks":11536,"value":1718,"nodeType":865},{},[11537],{"type":874},{"data":11539,"marks":11540,"value":11541,"nodeType":865},{},[],")",{"data":11543,"content":11544,"nodeType":1734},{},[11545],{"data":11546,"content":11547,"nodeType":881},{},[11548,11552,11561],{"data":11549,"marks":11550,"value":11551,"nodeType":865},{},[],"79% of detections were malware-free in the last year, up from 40% in 2019. (",{"data":11553,"content":11555,"nodeType":876},{"uri":11554},"https://www.crowdstrike.com/en-gb/global-threat-report/",[11556],{"data":11557,"marks":11558,"value":11560,"nodeType":865},{},[11559],{"type":874},"CrowdStrike",{"data":11562,"marks":11563,"value":11541,"nodeType":865},{},[],{"data":11565,"content":11566,"nodeType":1734},{},[11567],{"data":11568,"content":11569,"nodeType":881},{},[11570,11574,11583],{"data":11571,"marks":11572,"value":11573,"nodeType":865},{},[],"Credential abuse and phishing combined accounted for 38% of breaches, making identity the primary breach vector observed. (",{"data":11575,"content":11577,"nodeType":876},{"uri":11576},"https://www.verizon.com/business/resources/reports/dbir/",[11578],{"data":11579,"marks":11580,"value":11582,"nodeType":865},{},[11581],{"type":874},"Verizon",{"data":11584,"marks":11585,"value":11541,"nodeType":865},{},[],{"data":11587,"content":11588,"nodeType":881},{},[11589],{"data":11590,"marks":11591,"value":11592,"nodeType":865},{},[],"And other public breaches from this year alone demonstrate similar TTPs from outside of the Scattered Lapsus$ Hunters orbit:",{"data":11594,"content":11595,"nodeType":1818},{},[11596,11611,11626,11641],{"data":11597,"content":11598,"nodeType":1734},{},[11599],{"data":11600,"content":11601,"nodeType":881},{},[11602,11607],{"data":11603,"marks":11604,"value":11606,"nodeType":865},{},[11605],{"type":902},"Nikkei",{"data":11608,"marks":11609,"value":11610,"nodeType":865},{},[],": Japanese publishing giant Nikkei’s Slack messaging platform was compromised using stolen credentials, leaking the names, email addresses, and chat histories for 17,368 individuals registered on Slack.",{"data":11612,"content":11613,"nodeType":1734},{},[11614],{"data":11615,"content":11616,"nodeType":881},{},[11617,11622],{"data":11618,"marks":11619,"value":11621,"nodeType":865},{},[11620],{"type":902},"Evertec",{"data":11623,"marks":11624,"value":11625,"nodeType":865},{},[],": Hackers tried to steal $130 million from Evertec’s Brazilian subsidiary Sinqia S.A.after gaining unauthorized access to its environment on the central bank’s real-time payment system (Pix) using stolen credentials.",{"data":11627,"content":11628,"nodeType":1734},{},[11629],{"data":11630,"content":11631,"nodeType":881},{},[11632,11637],{"data":11633,"marks":11634,"value":11636,"nodeType":865},{},[11635],{"type":902},"Hy-Vee:",{"data":11638,"marks":11639,"value":11640,"nodeType":865},{},[]," Was hit with a data breach after hackers logged in with stolen credentials, exposing 53GB of sensitive data.",{"data":11642,"content":11643,"nodeType":1734},{},[11644],{"data":11645,"content":11646,"nodeType":881},{},[11647,11652],{"data":11648,"marks":11649,"value":11651,"nodeType":865},{},[11650],{"type":902},"Scania: ",{"data":11653,"marks":11654,"value":11655,"nodeType":865},{},[],"Automotive giant Scania confirmed it suffered a cybersecurity incident where threat actors used compromised credentials to breach its Financial Services systems and steal insurance claim documents.",{"data":11657,"content":11658,"nodeType":881},{},[11659],{"data":11660,"marks":11661,"value":11662,"nodeType":865},{},[],"Scattered Lapsus$ Hunters may be grabbing the headlines — but this a huge movement in a vast and flexible community of attackers. And criminals around the world are learning from their success. ",{"data":11664,"content":11665,"nodeType":894},{},[],{"data":11667,"content":11668,"nodeType":904},{},[11669],{"data":11670,"marks":11671,"value":11673,"nodeType":865},{},[11672],{"type":902},"Lessons learned",{"data":11675,"content":11676,"nodeType":881},{},[11677],{"data":11678,"marks":11679,"value":11680,"nodeType":865},{},[],"The common thread with all of these attacks is that they are evading established security controls by targeting applications directly, over the internet, via account takeover.",{"data":11682,"content":11683,"nodeType":881},{},[11684],{"data":11685,"marks":11686,"value":11687,"nodeType":865},{},[],"Clearly, the success of these attacks shows the limitations of multiple control layers. Endpoint and network layer controls have no visibility of this attack surface. Identity-focused controls are being undermined by ghost logins and shadow IT. And the limitations of cloud security controls in their ability to encompass all apps, and detect and stop malicious actions in real-time (that often blend in seamlessly with normal user activity). ",{"data":11689,"content":11693,"nodeType":890},{"target":11690},{"sys":11691},{"id":11692,"type":887,"linkType":888},"4Dg3fZEGf7ShyQJ8jlNDME",[],{"data":11695,"content":11696,"nodeType":894},{},[],{"data":11698,"content":11699,"nodeType":904},{},[11700],{"data":11701,"marks":11702,"value":5936,"nodeType":865},{},[11703],{"type":902},{"data":11705,"content":11706,"nodeType":881},{},[11707],{"data":11708,"marks":11709,"value":11710,"nodeType":865},{},[],"Stopping attacks that are designed to evade established controls is in our DNA — it’s the reason Push was founded. ",{"data":11712,"content":11713,"nodeType":881},{},[11714],{"data":11715,"marks":11716,"value":11717,"nodeType":865},{},[],"The browser is the gateway to to the apps and identities that attackers are now targeting, with many attacks taking place inside the user’s browser — whether that’s entering credentials onto a phishing page, approving a malicious OAuth grant, installing a risky browser extension, or insecurely accessing an app with a weak password and no MFA. ",{"data":11719,"content":11720,"nodeType":881},{},[11721],{"data":11722,"marks":11723,"value":11724,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive detection and response capabilities against attacks like AiTM phishing, credential stuffing, malicious browser extensions, malicious OAuth grants, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your attack surface.",{"data":11726,"content":11727,"nodeType":881},{},[11728,11731,11738,11741,11748],{"data":11729,"marks":11730,"value":4462,"nodeType":865},{},[],{"data":11732,"content":11733,"nodeType":876},{"uri":4465},[11734],{"data":11735,"marks":11736,"value":4471,"nodeType":865},{},[11737],{"type":874},{"data":11739,"marks":11740,"value":8048,"nodeType":865},{},[],{"data":11742,"content":11743,"nodeType":876},{"uri":1453},[11744],{"data":11745,"marks":11746,"value":4495,"nodeType":865},{},[11747],{"type":874},{"data":11749,"marks":11750,"value":959,"nodeType":865},{},[],"\"Scattered Lapsus$ Hunters\" — how modern attackers exploit the gaps in your security stack ","How Scattered Lapsus$ Hunters breaches demonstrate the evolution of attacker TTPs, shaping the future of cyber attacks.","2025-11-13T00:00:00.000Z","scattered-lapsus-hunters",{"items":11756},[11757,11759],{"sys":11758,"name":4507},{"id":4506},{"sys":11760,"name":342},{"id":4510},{"items":11762},[11763],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":11764},{"url":5377},"consentfix-v3-analyzing-a-new-toolkit","blog/consentfix-v3-analyzing-a-new-toolkit",{"json":11768},{"data":11769,"content":11770,"nodeType":1463},{},[11771,11778],{"data":11772,"content":11773,"nodeType":881},{},[11774],{"data":11775,"marks":11776,"value":11777,"nodeType":865},{},[],"Investigating a new criminal toolkit for ConsentFix being promoted on criminal forums. ",{"data":11779,"content":11780,"nodeType":881},{},[11781],{"data":11782,"marks":11783,"value":21,"nodeType":865},{},[],{"id":11785,"publishedAt":11786},"27Z1JlNtpGTPyarh393sHK","2026-08-12T12:01:05.176Z",{"items":11788},[11789,11791],{"sys":11790,"name":4507},{"id":4506},{"sys":11792,"name":342},{"id":4510},{"items":11794},[11795,11797,11799,11801,11803,11805,11807,11809,11811,11813],{"sys":11796,"name":279,"slug":280,"tier":31},{"id":276},{"sys":11798,"name":519,"slug":520,"tier":31},{"id":516},{"sys":11800,"name":315,"slug":316,"tier":45},{"id":312},{"sys":11802,"name":484,"slug":485,"tier":45},{"id":481},{"sys":11804,"name":511,"slug":512,"tier":45},{"id":508},{"sys":11806,"name":466,"slug":467,"tier":45},{"id":463},{"sys":11808,"name":360,"slug":361,"tier":45},{"id":357},{"sys":11810,"name":607,"slug":608,"tier":45},{"id":604},{"sys":11812,"name":244,"slug":245,"tier":45},{"id":241},{"sys":11814,"name":493,"slug":494,"tier":45},{"id":490},"L1TbDkMtNKV59uzU5naudHmcDycdP34hheLfWwcafVI",{"id":11817,"title":4499,"authorsCollection":11818,"content":11824,"extension":228,"faqItemsCollection":15026,"faqTitle":59,"featured":6,"hashTags":59,"meta":15028,"metaTitle":15029,"ogImage":59,"postType":7216,"publishedDate":4501,"relatedBlogPostsCollection":15030,"slug":361,"stem":17235,"subtitle":59,"summary":17236,"synopsis":4500,"sys":17247,"tagsCollection":17249,"topicsCollection":17255,"__hash__":17291},"blog/blog/device-code-phishing.json",{"items":11819},[11820],{"fullName":4514,"firstName":4515,"jobTitle":4516,"socialLinks":11821,"profilePicture":11823},[11822],"https://www.linkedin.com/in/luke-jennings-042b5619b/",{"url":4518},{"json":11825,"links":14529},{"data":11826,"content":11827,"nodeType":1463},{},[11828,11833,11849,11865,11871,11876,11882,11888,11891,11898,11903,11969,11985,11990,11996,12092,12097,12100,12107,12113,12118,12121,12128,12164,12169,12175,12181,12187,12193,12209,12214,12219,12224,12229,12234,12239,12244,12250,12480,12483,12490,12617,12622,12625,12632,12663,12790,12795,12798,12805,12944,12949,12952,12959,12964,13098,13103,13108,13111,13118,13257,13262,13265,13272,13412,13417,13420,13427,13518,13523,13526,13533,13624,13629,13632,13639,13644,13771,13776,13779,13786,13833,13838,13841,13848,13981,13986,13989,13996,14123,14128,14131,14138,14148,14154,14159,14164,14170,14187,14200,14205,14208,14215,14222,14239,14256,14261,14267,14273,14280,14286,14292,14298,14305,14311,14356,14361,14364,14371,14377,14383,14420,14425,14431,14434,14441,14447,14453,14469,14474,14480,14487,14493],{"data":11829,"content":11832,"nodeType":890},{"target":11830},{"sys":11831},{"id":1496,"type":887,"linkType":888},[],{"data":11834,"content":11835,"nodeType":881},{},[11836,11839,11846],{"data":11837,"marks":11838,"value":1504,"nodeType":865},{},[],{"data":11840,"content":11841,"nodeType":876},{"uri":1507},[11842],{"data":11843,"marks":11844,"value":1513,"nodeType":865},{},[11845],{"type":874},{"data":11847,"marks":11848,"value":1517,"nodeType":865},{},[],{"data":11850,"content":11851,"nodeType":881},{},[11852,11855,11862],{"data":11853,"marks":11854,"value":21,"nodeType":865},{},[],{"data":11856,"content":11857,"nodeType":876},{"uri":1526},[11858],{"data":11859,"marks":11860,"value":360,"nodeType":865},{},[11861],{"type":874},{"data":11863,"marks":11864,"value":1535,"nodeType":865},{},[],{"data":11866,"content":11867,"nodeType":881},{},[11868],{"data":11869,"marks":11870,"value":1542,"nodeType":865},{},[],{"data":11872,"content":11875,"nodeType":890},{"target":11873},{"sys":11874},{"id":1547,"type":887,"linkType":888},[],{"data":11877,"content":11878,"nodeType":881},{},[11879],{"data":11880,"marks":11881,"value":1555,"nodeType":865},{},[],{"data":11883,"content":11884,"nodeType":881},{},[11885],{"data":11886,"marks":11887,"value":1562,"nodeType":865},{},[],{"data":11889,"content":11890,"nodeType":894},{},[],{"data":11892,"content":11893,"nodeType":904},{},[11894],{"data":11895,"marks":11896,"value":1573,"nodeType":865},{},[11897],{"type":902},{"data":11899,"content":11902,"nodeType":890},{"target":11900},{"sys":11901},{"id":1578,"type":887,"linkType":888},[],{"data":11904,"content":11905,"nodeType":881},{},[11906,11909,11916,11919,11926,11929,11936,11939,11946,11949,11956,11959,11966],{"data":11907,"marks":11908,"value":1586,"nodeType":865},{},[],{"data":11910,"content":11911,"nodeType":876},{"uri":1589},[11912],{"data":11913,"marks":11914,"value":1595,"nodeType":865},{},[11915],{"type":874},{"data":11917,"marks":11918,"value":1599,"nodeType":865},{},[],{"data":11920,"content":11921,"nodeType":876},{"uri":1602},[11922],{"data":11923,"marks":11924,"value":1608,"nodeType":865},{},[11925],{"type":874},{"data":11927,"marks":11928,"value":1612,"nodeType":865},{},[],{"data":11930,"content":11931,"nodeType":876},{"uri":1615},[11932],{"data":11933,"marks":11934,"value":1621,"nodeType":865},{},[11935],{"type":874},{"data":11937,"marks":11938,"value":1625,"nodeType":865},{},[],{"data":11940,"content":11941,"nodeType":876},{"uri":1628},[11942],{"data":11943,"marks":11944,"value":1634,"nodeType":865},{},[11945],{"type":874},{"data":11947,"marks":11948,"value":1638,"nodeType":865},{},[],{"data":11950,"content":11951,"nodeType":876},{"uri":1641},[11952],{"data":11953,"marks":11954,"value":1647,"nodeType":865},{},[11955],{"type":874},{"data":11957,"marks":11958,"value":1651,"nodeType":865},{},[],{"data":11960,"content":11961,"nodeType":876},{"uri":1654},[11962],{"data":11963,"marks":11964,"value":1660,"nodeType":865},{},[11965],{"type":874},{"data":11967,"marks":11968,"value":1664,"nodeType":865},{},[],{"data":11970,"content":11971,"nodeType":881},{},[11972,11975,11982],{"data":11973,"marks":11974,"value":1671,"nodeType":865},{},[],{"data":11976,"content":11977,"nodeType":876},{"uri":1674},[11978],{"data":11979,"marks":11980,"value":1680,"nodeType":865},{},[11981],{"type":874},{"data":11983,"marks":11984,"value":1684,"nodeType":865},{},[],{"data":11986,"content":11989,"nodeType":890},{"target":11987},{"sys":11988},{"id":1689,"type":887,"linkType":888},[],{"data":11991,"content":11992,"nodeType":881},{},[11993],{"data":11994,"marks":11995,"value":1697,"nodeType":865},{},[],{"data":11997,"content":11998,"nodeType":1818},{},[11999,12026,12044],{"data":12000,"content":12001,"nodeType":1734},{},[12002],{"data":12003,"content":12004,"nodeType":881},{},[12005,12008,12014,12017,12023],{"data":12006,"marks":12007,"value":1710,"nodeType":865},{},[],{"data":12009,"content":12010,"nodeType":876},{"uri":1713},[12011],{"data":12012,"marks":12013,"value":1718,"nodeType":865},{},[],{"data":12015,"marks":12016,"value":1651,"nodeType":865},{},[],{"data":12018,"content":12019,"nodeType":876},{"uri":1724},[12020],{"data":12021,"marks":12022,"value":1729,"nodeType":865},{},[],{"data":12024,"marks":12025,"value":1733,"nodeType":865},{},[],{"data":12027,"content":12028,"nodeType":1734},{},[12029],{"data":12030,"content":12031,"nodeType":881},{},[12032,12035,12041],{"data":12033,"marks":12034,"value":1744,"nodeType":865},{},[],{"data":12036,"content":12037,"nodeType":876},{"uri":1747},[12038],{"data":12039,"marks":12040,"value":1752,"nodeType":865},{},[],{"data":12042,"marks":12043,"value":1756,"nodeType":865},{},[],{"data":12045,"content":12046,"nodeType":1734},{},[12047],{"data":12048,"content":12049,"nodeType":881},{},[12050,12053,12059,12062,12069,12072,12079,12082,12089],{"data":12051,"marks":12052,"value":1766,"nodeType":865},{},[],{"data":12054,"content":12055,"nodeType":876},{"uri":1769},[12056],{"data":12057,"marks":12058,"value":1774,"nodeType":865},{},[],{"data":12060,"marks":12061,"value":1778,"nodeType":865},{},[],{"data":12063,"content":12064,"nodeType":876},{"uri":1781},[12065],{"data":12066,"marks":12067,"value":1787,"nodeType":865},{},[12068],{"type":874},{"data":12070,"marks":12071,"value":1791,"nodeType":865},{},[],{"data":12073,"content":12074,"nodeType":876},{"uri":1794},[12075],{"data":12076,"marks":12077,"value":1800,"nodeType":865},{},[12078],{"type":874},{"data":12080,"marks":12081,"value":1804,"nodeType":865},{},[],{"data":12083,"content":12084,"nodeType":876},{"uri":1807},[12085],{"data":12086,"marks":12087,"value":1813,"nodeType":865},{},[12088],{"type":874},{"data":12090,"marks":12091,"value":1817,"nodeType":865},{},[],{"data":12093,"content":12096,"nodeType":890},{"target":12094},{"sys":12095},{"id":1823,"type":887,"linkType":888},[],{"data":12098,"content":12099,"nodeType":894},{},[],{"data":12101,"content":12102,"nodeType":904},{},[12103],{"data":12104,"marks":12105,"value":1835,"nodeType":865},{},[12106],{"type":902},{"data":12108,"content":12109,"nodeType":881},{},[12110],{"data":12111,"marks":12112,"value":1842,"nodeType":865},{},[],{"data":12114,"content":12117,"nodeType":890},{"target":12115},{"sys":12116},{"id":1847,"type":887,"linkType":888},[],{"data":12119,"content":12120,"nodeType":894},{},[],{"data":12122,"content":12123,"nodeType":1860},{},[12124],{"data":12125,"marks":12126,"value":1859,"nodeType":865},{},[12127],{"type":902},{"data":12129,"content":12130,"nodeType":881},{},[12131,12134,12141,12144,12151,12154,12161],{"data":12132,"marks":12133,"value":21,"nodeType":865},{},[],{"data":12135,"content":12136,"nodeType":876},{"uri":1807},[12137],{"data":12138,"marks":12139,"value":1813,"nodeType":865},{},[12140],{"type":874},{"data":12142,"marks":12143,"value":1877,"nodeType":865},{},[],{"data":12145,"content":12146,"nodeType":876},{"uri":1880},[12147],{"data":12148,"marks":12149,"value":1886,"nodeType":865},{},[12150],{"type":874},{"data":12152,"marks":12153,"value":1890,"nodeType":865},{},[],{"data":12155,"content":12156,"nodeType":876},{"uri":1794},[12157],{"data":12158,"marks":12159,"value":1898,"nodeType":865},{},[12160],{"type":874},{"data":12162,"marks":12163,"value":1902,"nodeType":865},{},[],{"data":12165,"content":12168,"nodeType":890},{"target":12166},{"sys":12167},{"id":1907,"type":887,"linkType":888},[],{"data":12170,"content":12171,"nodeType":881},{},[12172],{"data":12173,"marks":12174,"value":1915,"nodeType":865},{},[],{"data":12176,"content":12177,"nodeType":881},{},[12178],{"data":12179,"marks":12180,"value":1922,"nodeType":865},{},[],{"data":12182,"content":12183,"nodeType":881},{},[12184],{"data":12185,"marks":12186,"value":1929,"nodeType":865},{},[],{"data":12188,"content":12189,"nodeType":881},{},[12190],{"data":12191,"marks":12192,"value":1936,"nodeType":865},{},[],{"data":12194,"content":12195,"nodeType":881},{},[12196,12199,12206],{"data":12197,"marks":12198,"value":1943,"nodeType":865},{},[],{"data":12200,"content":12201,"nodeType":876},{"uri":1022},[12202],{"data":12203,"marks":12204,"value":1951,"nodeType":865},{},[12205],{"type":874},{"data":12207,"marks":12208,"value":1955,"nodeType":865},{},[],{"data":12210,"content":12213,"nodeType":890},{"target":12211},{"sys":12212},{"id":1960,"type":887,"linkType":888},[],{"data":12215,"content":12218,"nodeType":890},{"target":12216},{"sys":12217},{"id":1966,"type":887,"linkType":888},[],{"data":12220,"content":12223,"nodeType":890},{"target":12221},{"sys":12222},{"id":1972,"type":887,"linkType":888},[],{"data":12225,"content":12228,"nodeType":890},{"target":12226},{"sys":12227},{"id":1978,"type":887,"linkType":888},[],{"data":12230,"content":12233,"nodeType":890},{"target":12231},{"sys":12232},{"id":1984,"type":887,"linkType":888},[],{"data":12235,"content":12238,"nodeType":890},{"target":12236},{"sys":12237},{"id":1990,"type":887,"linkType":888},[],{"data":12240,"content":12243,"nodeType":890},{"target":12241},{"sys":12242},{"id":1996,"type":887,"linkType":888},[],{"data":12245,"content":12246,"nodeType":881},{},[12247],{"data":12248,"marks":12249,"value":21,"nodeType":865},{},[],{"data":12251,"content":12252,"nodeType":2270},{},[12253,12275,12346,12392,12414],{"data":12254,"content":12255,"nodeType":2032},{},[12256,12266],{"data":12257,"content":12258,"nodeType":2021},{},[12259],{"data":12260,"content":12261,"nodeType":881},{},[12262],{"data":12263,"marks":12264,"value":2020,"nodeType":865},{},[12265],{"type":902},{"data":12267,"content":12268,"nodeType":2021},{},[12269],{"data":12270,"content":12271,"nodeType":881},{},[12272],{"data":12273,"marks":12274,"value":2031,"nodeType":865},{},[],{"data":12276,"content":12277,"nodeType":2032},{},[12278,12288],{"data":12279,"content":12280,"nodeType":2021},{},[12281],{"data":12282,"content":12283,"nodeType":881},{},[12284],{"data":12285,"marks":12286,"value":2046,"nodeType":865},{},[12287],{"type":902},{"data":12289,"content":12290,"nodeType":2021},{},[12291,12315],{"data":12292,"content":12293,"nodeType":881},{},[12294,12298,12301,12305,12308,12312],{"data":12295,"marks":12296,"value":2057,"nodeType":865},{},[12297],{"type":902},{"data":12299,"marks":12300,"value":2061,"nodeType":865},{},[],{"data":12302,"marks":12303,"value":2066,"nodeType":865},{},[12304],{"type":902},{"data":12306,"marks":12307,"value":2070,"nodeType":865},{},[],{"data":12309,"marks":12310,"value":2075,"nodeType":865},{},[12311],{"type":902},{"data":12313,"marks":12314,"value":2079,"nodeType":865},{},[],{"data":12316,"content":12317,"nodeType":881},{},[12318,12322,12325,12329,12332,12336,12339,12343],{"data":12319,"marks":12320,"value":2087,"nodeType":865},{},[12321],{"type":902},{"data":12323,"marks":12324,"value":2091,"nodeType":865},{},[],{"data":12326,"marks":12327,"value":2096,"nodeType":865},{},[12328],{"type":902},{"data":12330,"marks":12331,"value":2100,"nodeType":865},{},[],{"data":12333,"marks":12334,"value":2066,"nodeType":865},{},[12335],{"type":902},{"data":12337,"marks":12338,"value":2108,"nodeType":865},{},[],{"data":12340,"marks":12341,"value":2075,"nodeType":865},{},[12342],{"type":902},{"data":12344,"marks":12345,"value":2116,"nodeType":865},{},[],{"data":12347,"content":12348,"nodeType":2032},{},[12349,12359],{"data":12350,"content":12351,"nodeType":2021},{},[12352],{"data":12353,"content":12354,"nodeType":881},{},[12355],{"data":12356,"marks":12357,"value":2130,"nodeType":865},{},[12358],{"type":902},{"data":12360,"content":12361,"nodeType":2021},{},[12362,12368,12374,12380,12386],{"data":12363,"content":12364,"nodeType":881},{},[12365],{"data":12366,"marks":12367,"value":2140,"nodeType":865},{},[],{"data":12369,"content":12370,"nodeType":881},{},[12371],{"data":12372,"marks":12373,"value":2147,"nodeType":865},{},[],{"data":12375,"content":12376,"nodeType":881},{},[12377],{"data":12378,"marks":12379,"value":2154,"nodeType":865},{},[],{"data":12381,"content":12382,"nodeType":881},{},[12383],{"data":12384,"marks":12385,"value":2161,"nodeType":865},{},[],{"data":12387,"content":12388,"nodeType":881},{},[12389],{"data":12390,"marks":12391,"value":2168,"nodeType":865},{},[],{"data":12393,"content":12394,"nodeType":2032},{},[12395,12405],{"data":12396,"content":12397,"nodeType":2021},{},[12398],{"data":12399,"content":12400,"nodeType":881},{},[12401],{"data":12402,"marks":12403,"value":2182,"nodeType":865},{},[12404],{"type":902},{"data":12406,"content":12407,"nodeType":2021},{},[12408],{"data":12409,"content":12410,"nodeType":881},{},[12411],{"data":12412,"marks":12413,"value":2192,"nodeType":865},{},[],{"data":12415,"content":12416,"nodeType":2032},{},[12417,12427],{"data":12418,"content":12419,"nodeType":2021},{},[12420],{"data":12421,"content":12422,"nodeType":881},{},[12423],{"data":12424,"marks":12425,"value":2206,"nodeType":865},{},[12426],{"type":902},{"data":12428,"content":12429,"nodeType":2021},{},[12430,12440,12450,12460,12470],{"data":12431,"content":12432,"nodeType":881},{},[12433,12437],{"data":12434,"marks":12435,"value":2217,"nodeType":865},{},[12436],{"type":902},{"data":12438,"marks":12439,"value":2221,"nodeType":865},{},[],{"data":12441,"content":12442,"nodeType":881},{},[12443,12447],{"data":12444,"marks":12445,"value":2229,"nodeType":865},{},[12446],{"type":902},{"data":12448,"marks":12449,"value":2233,"nodeType":865},{},[],{"data":12451,"content":12452,"nodeType":881},{},[12453,12457],{"data":12454,"marks":12455,"value":2241,"nodeType":865},{},[12456],{"type":902},{"data":12458,"marks":12459,"value":2245,"nodeType":865},{},[],{"data":12461,"content":12462,"nodeType":881},{},[12463,12467],{"data":12464,"marks":12465,"value":2253,"nodeType":865},{},[12466],{"type":902},{"data":12468,"marks":12469,"value":2257,"nodeType":865},{},[],{"data":12471,"content":12472,"nodeType":881},{},[12473,12477],{"data":12474,"marks":12475,"value":2265,"nodeType":865},{},[12476],{"type":902},{"data":12478,"marks":12479,"value":2269,"nodeType":865},{},[],{"data":12481,"content":12482,"nodeType":894},{},[],{"data":12484,"content":12485,"nodeType":1860},{},[12486],{"data":12487,"marks":12488,"value":2281,"nodeType":865},{},[12489],{"type":902},{"data":12491,"content":12492,"nodeType":2270},{},[12493,12515,12551,12573,12595],{"data":12494,"content":12495,"nodeType":2032},{},[12496,12506],{"data":12497,"content":12498,"nodeType":2021},{},[12499],{"data":12500,"content":12501,"nodeType":881},{},[12502],{"data":12503,"marks":12504,"value":2020,"nodeType":865},{},[12505],{"type":902},{"data":12507,"content":12508,"nodeType":2021},{},[12509],{"data":12510,"content":12511,"nodeType":881},{},[12512],{"data":12513,"marks":12514,"value":2307,"nodeType":865},{},[],{"data":12516,"content":12517,"nodeType":2032},{},[12518,12528],{"data":12519,"content":12520,"nodeType":2021},{},[12521],{"data":12522,"content":12523,"nodeType":881},{},[12524],{"data":12525,"marks":12526,"value":2046,"nodeType":865},{},[12527],{"type":902},{"data":12529,"content":12530,"nodeType":2021},{},[12531,12541],{"data":12532,"content":12533,"nodeType":881},{},[12534,12538],{"data":12535,"marks":12536,"value":2331,"nodeType":865},{},[12537],{"type":902},{"data":12539,"marks":12540,"value":2335,"nodeType":865},{},[],{"data":12542,"content":12543,"nodeType":881},{},[12544,12548],{"data":12545,"marks":12546,"value":2087,"nodeType":865},{},[12547],{"type":902},{"data":12549,"marks":12550,"value":2346,"nodeType":865},{},[],{"data":12552,"content":12553,"nodeType":2032},{},[12554,12564],{"data":12555,"content":12556,"nodeType":2021},{},[12557],{"data":12558,"content":12559,"nodeType":881},{},[12560],{"data":12561,"marks":12562,"value":2130,"nodeType":865},{},[12563],{"type":902},{"data":12565,"content":12566,"nodeType":2021},{},[12567],{"data":12568,"content":12569,"nodeType":881},{},[12570],{"data":12571,"marks":12572,"value":2369,"nodeType":865},{},[],{"data":12574,"content":12575,"nodeType":2032},{},[12576,12586],{"data":12577,"content":12578,"nodeType":2021},{},[12579],{"data":12580,"content":12581,"nodeType":881},{},[12582],{"data":12583,"marks":12584,"value":2182,"nodeType":865},{},[12585],{"type":902},{"data":12587,"content":12588,"nodeType":2021},{},[12589],{"data":12590,"content":12591,"nodeType":881},{},[12592],{"data":12593,"marks":12594,"value":2392,"nodeType":865},{},[],{"data":12596,"content":12597,"nodeType":2032},{},[12598,12608],{"data":12599,"content":12600,"nodeType":2021},{},[12601],{"data":12602,"content":12603,"nodeType":881},{},[12604],{"data":12605,"marks":12606,"value":2406,"nodeType":865},{},[12607],{"type":902},{"data":12609,"content":12610,"nodeType":2021},{},[12611],{"data":12612,"content":12613,"nodeType":881},{},[12614],{"data":12615,"marks":12616,"value":2416,"nodeType":865},{},[],{"data":12618,"content":12621,"nodeType":890},{"target":12619},{"sys":12620},{"id":2421,"type":887,"linkType":888},[],{"data":12623,"content":12624,"nodeType":894},{},[],{"data":12626,"content":12627,"nodeType":1860},{},[12628],{"data":12629,"marks":12630,"value":2433,"nodeType":865},{},[12631],{"type":902},{"data":12633,"content":12634,"nodeType":881},{},[12635,12638,12642,12645,12651,12654,12660],{"data":12636,"marks":12637,"value":2440,"nodeType":865},{},[],{"data":12639,"marks":12640,"value":2445,"nodeType":865},{},[12641],{"type":902},{"data":12643,"marks":12644,"value":2449,"nodeType":865},{},[],{"data":12646,"content":12647,"nodeType":876},{"uri":2452},[12648],{"data":12649,"marks":12650,"value":2457,"nodeType":865},{},[],{"data":12652,"marks":12653,"value":2461,"nodeType":865},{},[],{"data":12655,"content":12656,"nodeType":876},{"uri":2464},[12657],{"data":12658,"marks":12659,"value":2469,"nodeType":865},{},[],{"data":12661,"marks":12662,"value":2473,"nodeType":865},{},[],{"data":12664,"content":12665,"nodeType":2270},{},[12666,12688,12724,12746,12768],{"data":12667,"content":12668,"nodeType":2032},{},[12669,12679],{"data":12670,"content":12671,"nodeType":2021},{},[12672],{"data":12673,"content":12674,"nodeType":881},{},[12675],{"data":12676,"marks":12677,"value":2020,"nodeType":865},{},[12678],{"type":902},{"data":12680,"content":12681,"nodeType":2021},{},[12682],{"data":12683,"content":12684,"nodeType":881},{},[12685],{"data":12686,"marks":12687,"value":2499,"nodeType":865},{},[],{"data":12689,"content":12690,"nodeType":2032},{},[12691,12701],{"data":12692,"content":12693,"nodeType":2021},{},[12694],{"data":12695,"content":12696,"nodeType":881},{},[12697],{"data":12698,"marks":12699,"value":2046,"nodeType":865},{},[12700],{"type":902},{"data":12702,"content":12703,"nodeType":2021},{},[12704,12714],{"data":12705,"content":12706,"nodeType":881},{},[12707,12711],{"data":12708,"marks":12709,"value":2523,"nodeType":865},{},[12710],{"type":902},{"data":12712,"marks":12713,"value":2527,"nodeType":865},{},[],{"data":12715,"content":12716,"nodeType":881},{},[12717,12721],{"data":12718,"marks":12719,"value":2087,"nodeType":865},{},[12720],{"type":902},{"data":12722,"marks":12723,"value":2538,"nodeType":865},{},[],{"data":12725,"content":12726,"nodeType":2032},{},[12727,12737],{"data":12728,"content":12729,"nodeType":2021},{},[12730],{"data":12731,"content":12732,"nodeType":881},{},[12733],{"data":12734,"marks":12735,"value":2130,"nodeType":865},{},[12736],{"type":902},{"data":12738,"content":12739,"nodeType":2021},{},[12740],{"data":12741,"content":12742,"nodeType":881},{},[12743],{"data":12744,"marks":12745,"value":2561,"nodeType":865},{},[],{"data":12747,"content":12748,"nodeType":2032},{},[12749,12759],{"data":12750,"content":12751,"nodeType":2021},{},[12752],{"data":12753,"content":12754,"nodeType":881},{},[12755],{"data":12756,"marks":12757,"value":2182,"nodeType":865},{},[12758],{"type":902},{"data":12760,"content":12761,"nodeType":2021},{},[12762],{"data":12763,"content":12764,"nodeType":881},{},[12765],{"data":12766,"marks":12767,"value":2584,"nodeType":865},{},[],{"data":12769,"content":12770,"nodeType":2032},{},[12771,12781],{"data":12772,"content":12773,"nodeType":2021},{},[12774],{"data":12775,"content":12776,"nodeType":881},{},[12777],{"data":12778,"marks":12779,"value":2406,"nodeType":865},{},[12780],{"type":902},{"data":12782,"content":12783,"nodeType":2021},{},[12784],{"data":12785,"content":12786,"nodeType":881},{},[12787],{"data":12788,"marks":12789,"value":2607,"nodeType":865},{},[],{"data":12791,"content":12794,"nodeType":890},{"target":12792},{"sys":12793},{"id":2612,"type":887,"linkType":888},[],{"data":12796,"content":12797,"nodeType":894},{},[],{"data":12799,"content":12800,"nodeType":1860},{},[12801],{"data":12802,"marks":12803,"value":2624,"nodeType":865},{},[12804],{"type":902},{"data":12806,"content":12807,"nodeType":2270},{},[12808,12830,12872,12900,12922],{"data":12809,"content":12810,"nodeType":2032},{},[12811,12821],{"data":12812,"content":12813,"nodeType":2021},{},[12814],{"data":12815,"content":12816,"nodeType":881},{},[12817],{"data":12818,"marks":12819,"value":2020,"nodeType":865},{},[12820],{"type":902},{"data":12822,"content":12823,"nodeType":2021},{},[12824],{"data":12825,"content":12826,"nodeType":881},{},[12827],{"data":12828,"marks":12829,"value":2650,"nodeType":865},{},[],{"data":12831,"content":12832,"nodeType":2032},{},[12833,12843],{"data":12834,"content":12835,"nodeType":2021},{},[12836],{"data":12837,"content":12838,"nodeType":881},{},[12839],{"data":12840,"marks":12841,"value":2046,"nodeType":865},{},[12842],{"type":902},{"data":12844,"content":12845,"nodeType":2021},{},[12846,12856,12862],{"data":12847,"content":12848,"nodeType":881},{},[12849,12853],{"data":12850,"marks":12851,"value":2523,"nodeType":865},{},[12852],{"type":902},{"data":12854,"marks":12855,"value":2677,"nodeType":865},{},[],{"data":12857,"content":12858,"nodeType":881},{},[12859],{"data":12860,"marks":12861,"value":2684,"nodeType":865},{},[],{"data":12863,"content":12864,"nodeType":881},{},[12865,12869],{"data":12866,"marks":12867,"value":2087,"nodeType":865},{},[12868],{"type":902},{"data":12870,"marks":12871,"value":2695,"nodeType":865},{},[],{"data":12873,"content":12874,"nodeType":2032},{},[12875,12885],{"data":12876,"content":12877,"nodeType":2021},{},[12878],{"data":12879,"content":12880,"nodeType":881},{},[12881],{"data":12882,"marks":12883,"value":2130,"nodeType":865},{},[12884],{"type":902},{"data":12886,"content":12887,"nodeType":2021},{},[12888,12894],{"data":12889,"content":12890,"nodeType":881},{},[12891],{"data":12892,"marks":12893,"value":2718,"nodeType":865},{},[],{"data":12895,"content":12896,"nodeType":881},{},[12897],{"data":12898,"marks":12899,"value":2725,"nodeType":865},{},[],{"data":12901,"content":12902,"nodeType":2032},{},[12903,12913],{"data":12904,"content":12905,"nodeType":2021},{},[12906],{"data":12907,"content":12908,"nodeType":881},{},[12909],{"data":12910,"marks":12911,"value":2182,"nodeType":865},{},[12912],{"type":902},{"data":12914,"content":12915,"nodeType":2021},{},[12916],{"data":12917,"content":12918,"nodeType":881},{},[12919],{"data":12920,"marks":12921,"value":2748,"nodeType":865},{},[],{"data":12923,"content":12924,"nodeType":2032},{},[12925,12935],{"data":12926,"content":12927,"nodeType":2021},{},[12928],{"data":12929,"content":12930,"nodeType":881},{},[12931],{"data":12932,"marks":12933,"value":2406,"nodeType":865},{},[12934],{"type":902},{"data":12936,"content":12937,"nodeType":2021},{},[12938],{"data":12939,"content":12940,"nodeType":881},{},[12941],{"data":12942,"marks":12943,"value":2771,"nodeType":865},{},[],{"data":12945,"content":12948,"nodeType":890},{"target":12946},{"sys":12947},{"id":2776,"type":887,"linkType":888},[],{"data":12950,"content":12951,"nodeType":894},{},[],{"data":12953,"content":12954,"nodeType":1860},{},[12955],{"data":12956,"marks":12957,"value":2788,"nodeType":865},{},[12958],{"type":902},{"data":12960,"content":12963,"nodeType":890},{"target":12961},{"sys":12962},{"id":2793,"type":887,"linkType":888},[],{"data":12965,"content":12966,"nodeType":2270},{},[12967,12989,13032,13054,13076],{"data":12968,"content":12969,"nodeType":2032},{},[12970,12980],{"data":12971,"content":12972,"nodeType":2021},{},[12973],{"data":12974,"content":12975,"nodeType":881},{},[12976],{"data":12977,"marks":12978,"value":2020,"nodeType":865},{},[12979],{"type":902},{"data":12981,"content":12982,"nodeType":2021},{},[12983],{"data":12984,"content":12985,"nodeType":881},{},[12986],{"data":12987,"marks":12988,"value":2820,"nodeType":865},{},[],{"data":12990,"content":12991,"nodeType":2032},{},[12992,13002],{"data":12993,"content":12994,"nodeType":2021},{},[12995],{"data":12996,"content":12997,"nodeType":881},{},[12998],{"data":12999,"marks":13000,"value":2046,"nodeType":865},{},[13001],{"type":902},{"data":13003,"content":13004,"nodeType":2021},{},[13005,13015],{"data":13006,"content":13007,"nodeType":881},{},[13008,13012],{"data":13009,"marks":13010,"value":2523,"nodeType":865},{},[13011],{"type":902},{"data":13013,"marks":13014,"value":2847,"nodeType":865},{},[],{"data":13016,"content":13017,"nodeType":881},{},[13018,13022,13025,13029],{"data":13019,"marks":13020,"value":2087,"nodeType":865},{},[13021],{"type":902},{"data":13023,"marks":13024,"value":2091,"nodeType":865},{},[],{"data":13026,"marks":13027,"value":2862,"nodeType":865},{},[13028],{"type":902},{"data":13030,"marks":13031,"value":2866,"nodeType":865},{},[],{"data":13033,"content":13034,"nodeType":2032},{},[13035,13045],{"data":13036,"content":13037,"nodeType":2021},{},[13038],{"data":13039,"content":13040,"nodeType":881},{},[13041],{"data":13042,"marks":13043,"value":2130,"nodeType":865},{},[13044],{"type":902},{"data":13046,"content":13047,"nodeType":2021},{},[13048],{"data":13049,"content":13050,"nodeType":881},{},[13051],{"data":13052,"marks":13053,"value":2889,"nodeType":865},{},[],{"data":13055,"content":13056,"nodeType":2032},{},[13057,13067],{"data":13058,"content":13059,"nodeType":2021},{},[13060],{"data":13061,"content":13062,"nodeType":881},{},[13063],{"data":13064,"marks":13065,"value":2182,"nodeType":865},{},[13066],{"type":902},{"data":13068,"content":13069,"nodeType":2021},{},[13070],{"data":13071,"content":13072,"nodeType":881},{},[13073],{"data":13074,"marks":13075,"value":2912,"nodeType":865},{},[],{"data":13077,"content":13078,"nodeType":2032},{},[13079,13089],{"data":13080,"content":13081,"nodeType":2021},{},[13082],{"data":13083,"content":13084,"nodeType":881},{},[13085],{"data":13086,"marks":13087,"value":2406,"nodeType":865},{},[13088],{"type":902},{"data":13090,"content":13091,"nodeType":2021},{},[13092],{"data":13093,"content":13094,"nodeType":881},{},[13095],{"data":13096,"marks":13097,"value":2935,"nodeType":865},{},[],{"data":13099,"content":13102,"nodeType":890},{"target":13100},{"sys":13101},{"id":2940,"type":887,"linkType":888},[],{"data":13104,"content":13107,"nodeType":890},{"target":13105},{"sys":13106},{"id":2946,"type":887,"linkType":888},[],{"data":13109,"content":13110,"nodeType":894},{},[],{"data":13112,"content":13113,"nodeType":1860},{},[13114],{"data":13115,"marks":13116,"value":2958,"nodeType":865},{},[13117],{"type":902},{"data":13119,"content":13120,"nodeType":2270},{},[13121,13143,13179,13213,13235],{"data":13122,"content":13123,"nodeType":2032},{},[13124,13134],{"data":13125,"content":13126,"nodeType":2021},{},[13127],{"data":13128,"content":13129,"nodeType":881},{},[13130],{"data":13131,"marks":13132,"value":2020,"nodeType":865},{},[13133],{"type":902},{"data":13135,"content":13136,"nodeType":2021},{},[13137],{"data":13138,"content":13139,"nodeType":881},{},[13140],{"data":13141,"marks":13142,"value":2984,"nodeType":865},{},[],{"data":13144,"content":13145,"nodeType":2032},{},[13146,13156],{"data":13147,"content":13148,"nodeType":2021},{},[13149],{"data":13150,"content":13151,"nodeType":881},{},[13152],{"data":13153,"marks":13154,"value":2046,"nodeType":865},{},[13155],{"type":902},{"data":13157,"content":13158,"nodeType":2021},{},[13159,13169],{"data":13160,"content":13161,"nodeType":881},{},[13162,13166],{"data":13163,"marks":13164,"value":2523,"nodeType":865},{},[13165],{"type":902},{"data":13167,"marks":13168,"value":3011,"nodeType":865},{},[],{"data":13170,"content":13171,"nodeType":881},{},[13172,13176],{"data":13173,"marks":13174,"value":2087,"nodeType":865},{},[13175],{"type":902},{"data":13177,"marks":13178,"value":3022,"nodeType":865},{},[],{"data":13180,"content":13181,"nodeType":2032},{},[13182,13192],{"data":13183,"content":13184,"nodeType":2021},{},[13185],{"data":13186,"content":13187,"nodeType":881},{},[13188],{"data":13189,"marks":13190,"value":2130,"nodeType":865},{},[13191],{"type":902},{"data":13193,"content":13194,"nodeType":2021},{},[13195,13201,13207],{"data":13196,"content":13197,"nodeType":881},{},[13198],{"data":13199,"marks":13200,"value":3045,"nodeType":865},{},[],{"data":13202,"content":13203,"nodeType":881},{},[13204],{"data":13205,"marks":13206,"value":3052,"nodeType":865},{},[],{"data":13208,"content":13209,"nodeType":881},{},[13210],{"data":13211,"marks":13212,"value":3059,"nodeType":865},{},[],{"data":13214,"content":13215,"nodeType":2032},{},[13216,13226],{"data":13217,"content":13218,"nodeType":2021},{},[13219],{"data":13220,"content":13221,"nodeType":881},{},[13222],{"data":13223,"marks":13224,"value":2182,"nodeType":865},{},[13225],{"type":902},{"data":13227,"content":13228,"nodeType":2021},{},[13229],{"data":13230,"content":13231,"nodeType":881},{},[13232],{"data":13233,"marks":13234,"value":3082,"nodeType":865},{},[],{"data":13236,"content":13237,"nodeType":2032},{},[13238,13248],{"data":13239,"content":13240,"nodeType":2021},{},[13241],{"data":13242,"content":13243,"nodeType":881},{},[13244],{"data":13245,"marks":13246,"value":2406,"nodeType":865},{},[13247],{"type":902},{"data":13249,"content":13250,"nodeType":2021},{},[13251],{"data":13252,"content":13253,"nodeType":881},{},[13254],{"data":13255,"marks":13256,"value":3105,"nodeType":865},{},[],{"data":13258,"content":13261,"nodeType":890},{"target":13259},{"sys":13260},{"id":3110,"type":887,"linkType":888},[],{"data":13263,"content":13264,"nodeType":894},{},[],{"data":13266,"content":13267,"nodeType":1860},{},[13268],{"data":13269,"marks":13270,"value":3122,"nodeType":865},{},[13271],{"type":902},{"data":13273,"content":13274,"nodeType":2270},{},[13275,13297,13340,13368,13390],{"data":13276,"content":13277,"nodeType":2032},{},[13278,13288],{"data":13279,"content":13280,"nodeType":2021},{},[13281],{"data":13282,"content":13283,"nodeType":881},{},[13284],{"data":13285,"marks":13286,"value":2020,"nodeType":865},{},[13287],{"type":902},{"data":13289,"content":13290,"nodeType":2021},{},[13291],{"data":13292,"content":13293,"nodeType":881},{},[13294],{"data":13295,"marks":13296,"value":2820,"nodeType":865},{},[],{"data":13298,"content":13299,"nodeType":2032},{},[13300,13310],{"data":13301,"content":13302,"nodeType":2021},{},[13303],{"data":13304,"content":13305,"nodeType":881},{},[13306],{"data":13307,"marks":13308,"value":2046,"nodeType":865},{},[13309],{"type":902},{"data":13311,"content":13312,"nodeType":2021},{},[13313,13323],{"data":13314,"content":13315,"nodeType":881},{},[13316,13320],{"data":13317,"marks":13318,"value":2523,"nodeType":865},{},[13319],{"type":902},{"data":13321,"marks":13322,"value":3174,"nodeType":865},{},[],{"data":13324,"content":13325,"nodeType":881},{},[13326,13330,13333,13337],{"data":13327,"marks":13328,"value":2087,"nodeType":865},{},[13329],{"type":902},{"data":13331,"marks":13332,"value":2091,"nodeType":865},{},[],{"data":13334,"marks":13335,"value":2862,"nodeType":865},{},[13336],{"type":902},{"data":13338,"marks":13339,"value":3192,"nodeType":865},{},[],{"data":13341,"content":13342,"nodeType":2032},{},[13343,13353],{"data":13344,"content":13345,"nodeType":2021},{},[13346],{"data":13347,"content":13348,"nodeType":881},{},[13349],{"data":13350,"marks":13351,"value":2130,"nodeType":865},{},[13352],{"type":902},{"data":13354,"content":13355,"nodeType":2021},{},[13356,13362],{"data":13357,"content":13358,"nodeType":881},{},[13359],{"data":13360,"marks":13361,"value":3215,"nodeType":865},{},[],{"data":13363,"content":13364,"nodeType":881},{},[13365],{"data":13366,"marks":13367,"value":3222,"nodeType":865},{},[],{"data":13369,"content":13370,"nodeType":2032},{},[13371,13381],{"data":13372,"content":13373,"nodeType":2021},{},[13374],{"data":13375,"content":13376,"nodeType":881},{},[13377],{"data":13378,"marks":13379,"value":2182,"nodeType":865},{},[13380],{"type":902},{"data":13382,"content":13383,"nodeType":2021},{},[13384],{"data":13385,"content":13386,"nodeType":881},{},[13387],{"data":13388,"marks":13389,"value":3245,"nodeType":865},{},[],{"data":13391,"content":13392,"nodeType":2032},{},[13393,13403],{"data":13394,"content":13395,"nodeType":2021},{},[13396],{"data":13397,"content":13398,"nodeType":881},{},[13399],{"data":13400,"marks":13401,"value":2406,"nodeType":865},{},[13402],{"type":902},{"data":13404,"content":13405,"nodeType":2021},{},[13406],{"data":13407,"content":13408,"nodeType":881},{},[13409],{"data":13410,"marks":13411,"value":3268,"nodeType":865},{},[],{"data":13413,"content":13416,"nodeType":890},{"target":13414},{"sys":13415},{"id":3273,"type":887,"linkType":888},[],{"data":13418,"content":13419,"nodeType":894},{},[],{"data":13421,"content":13422,"nodeType":1860},{},[13423],{"data":13424,"marks":13425,"value":3285,"nodeType":865},{},[13426],{"type":902},{"data":13428,"content":13429,"nodeType":2270},{},[13430,13452,13474,13496],{"data":13431,"content":13432,"nodeType":2032},{},[13433,13443],{"data":13434,"content":13435,"nodeType":2021},{},[13436],{"data":13437,"content":13438,"nodeType":881},{},[13439],{"data":13440,"marks":13441,"value":2020,"nodeType":865},{},[13442],{"type":902},{"data":13444,"content":13445,"nodeType":2021},{},[13446],{"data":13447,"content":13448,"nodeType":881},{},[13449],{"data":13450,"marks":13451,"value":3311,"nodeType":865},{},[],{"data":13453,"content":13454,"nodeType":2032},{},[13455,13465],{"data":13456,"content":13457,"nodeType":2021},{},[13458],{"data":13459,"content":13460,"nodeType":881},{},[13461],{"data":13462,"marks":13463,"value":2130,"nodeType":865},{},[13464],{"type":902},{"data":13466,"content":13467,"nodeType":2021},{},[13468],{"data":13469,"content":13470,"nodeType":881},{},[13471],{"data":13472,"marks":13473,"value":3334,"nodeType":865},{},[],{"data":13475,"content":13476,"nodeType":2032},{},[13477,13487],{"data":13478,"content":13479,"nodeType":2021},{},[13480],{"data":13481,"content":13482,"nodeType":881},{},[13483],{"data":13484,"marks":13485,"value":2182,"nodeType":865},{},[13486],{"type":902},{"data":13488,"content":13489,"nodeType":2021},{},[13490],{"data":13491,"content":13492,"nodeType":881},{},[13493],{"data":13494,"marks":13495,"value":3357,"nodeType":865},{},[],{"data":13497,"content":13498,"nodeType":2032},{},[13499,13509],{"data":13500,"content":13501,"nodeType":2021},{},[13502],{"data":13503,"content":13504,"nodeType":881},{},[13505],{"data":13506,"marks":13507,"value":2406,"nodeType":865},{},[13508],{"type":902},{"data":13510,"content":13511,"nodeType":2021},{},[13512],{"data":13513,"content":13514,"nodeType":881},{},[13515],{"data":13516,"marks":13517,"value":3380,"nodeType":865},{},[],{"data":13519,"content":13522,"nodeType":890},{"target":13520},{"sys":13521},{"id":3385,"type":887,"linkType":888},[],{"data":13524,"content":13525,"nodeType":894},{},[],{"data":13527,"content":13528,"nodeType":1860},{},[13529],{"data":13530,"marks":13531,"value":3397,"nodeType":865},{},[13532],{"type":902},{"data":13534,"content":13535,"nodeType":2270},{},[13536,13558,13580,13602],{"data":13537,"content":13538,"nodeType":2032},{},[13539,13549],{"data":13540,"content":13541,"nodeType":2021},{},[13542],{"data":13543,"content":13544,"nodeType":881},{},[13545],{"data":13546,"marks":13547,"value":2020,"nodeType":865},{},[13548],{"type":902},{"data":13550,"content":13551,"nodeType":2021},{},[13552],{"data":13553,"content":13554,"nodeType":881},{},[13555],{"data":13556,"marks":13557,"value":2307,"nodeType":865},{},[],{"data":13559,"content":13560,"nodeType":2032},{},[13561,13571],{"data":13562,"content":13563,"nodeType":2021},{},[13564],{"data":13565,"content":13566,"nodeType":881},{},[13567],{"data":13568,"marks":13569,"value":2130,"nodeType":865},{},[13570],{"type":902},{"data":13572,"content":13573,"nodeType":2021},{},[13574],{"data":13575,"content":13576,"nodeType":881},{},[13577],{"data":13578,"marks":13579,"value":3445,"nodeType":865},{},[],{"data":13581,"content":13582,"nodeType":2032},{},[13583,13593],{"data":13584,"content":13585,"nodeType":2021},{},[13586],{"data":13587,"content":13588,"nodeType":881},{},[13589],{"data":13590,"marks":13591,"value":2182,"nodeType":865},{},[13592],{"type":902},{"data":13594,"content":13595,"nodeType":2021},{},[13596],{"data":13597,"content":13598,"nodeType":881},{},[13599],{"data":13600,"marks":13601,"value":3468,"nodeType":865},{},[],{"data":13603,"content":13604,"nodeType":2032},{},[13605,13615],{"data":13606,"content":13607,"nodeType":2021},{},[13608],{"data":13609,"content":13610,"nodeType":881},{},[13611],{"data":13612,"marks":13613,"value":2406,"nodeType":865},{},[13614],{"type":902},{"data":13616,"content":13617,"nodeType":2021},{},[13618],{"data":13619,"content":13620,"nodeType":881},{},[13621],{"data":13622,"marks":13623,"value":3491,"nodeType":865},{},[],{"data":13625,"content":13628,"nodeType":890},{"target":13626},{"sys":13627},{"id":3496,"type":887,"linkType":888},[],{"data":13630,"content":13631,"nodeType":894},{},[],{"data":13633,"content":13634,"nodeType":1860},{},[13635],{"data":13636,"marks":13637,"value":3508,"nodeType":865},{},[13638],{"type":902},{"data":13640,"content":13643,"nodeType":890},{"target":13641},{"sys":13642},{"id":3513,"type":887,"linkType":888},[],{"data":13645,"content":13646,"nodeType":2270},{},[13647,13669,13705,13727,13749],{"data":13648,"content":13649,"nodeType":2032},{},[13650,13660],{"data":13651,"content":13652,"nodeType":2021},{},[13653],{"data":13654,"content":13655,"nodeType":881},{},[13656],{"data":13657,"marks":13658,"value":2020,"nodeType":865},{},[13659],{"type":902},{"data":13661,"content":13662,"nodeType":2021},{},[13663],{"data":13664,"content":13665,"nodeType":881},{},[13666],{"data":13667,"marks":13668,"value":3540,"nodeType":865},{},[],{"data":13670,"content":13671,"nodeType":2032},{},[13672,13682],{"data":13673,"content":13674,"nodeType":2021},{},[13675],{"data":13676,"content":13677,"nodeType":881},{},[13678],{"data":13679,"marks":13680,"value":2046,"nodeType":865},{},[13681],{"type":902},{"data":13683,"content":13684,"nodeType":2021},{},[13685,13695],{"data":13686,"content":13687,"nodeType":881},{},[13688,13692],{"data":13689,"marks":13690,"value":2523,"nodeType":865},{},[13691],{"type":902},{"data":13693,"marks":13694,"value":3567,"nodeType":865},{},[],{"data":13696,"content":13697,"nodeType":881},{},[13698,13702],{"data":13699,"marks":13700,"value":2087,"nodeType":865},{},[13701],{"type":902},{"data":13703,"marks":13704,"value":3578,"nodeType":865},{},[],{"data":13706,"content":13707,"nodeType":2032},{},[13708,13718],{"data":13709,"content":13710,"nodeType":2021},{},[13711],{"data":13712,"content":13713,"nodeType":881},{},[13714],{"data":13715,"marks":13716,"value":2130,"nodeType":865},{},[13717],{"type":902},{"data":13719,"content":13720,"nodeType":2021},{},[13721],{"data":13722,"content":13723,"nodeType":881},{},[13724],{"data":13725,"marks":13726,"value":3601,"nodeType":865},{},[],{"data":13728,"content":13729,"nodeType":2032},{},[13730,13740],{"data":13731,"content":13732,"nodeType":2021},{},[13733],{"data":13734,"content":13735,"nodeType":881},{},[13736],{"data":13737,"marks":13738,"value":2182,"nodeType":865},{},[13739],{"type":902},{"data":13741,"content":13742,"nodeType":2021},{},[13743],{"data":13744,"content":13745,"nodeType":881},{},[13746],{"data":13747,"marks":13748,"value":3624,"nodeType":865},{},[],{"data":13750,"content":13751,"nodeType":2032},{},[13752,13762],{"data":13753,"content":13754,"nodeType":2021},{},[13755],{"data":13756,"content":13757,"nodeType":881},{},[13758],{"data":13759,"marks":13760,"value":2406,"nodeType":865},{},[13761],{"type":902},{"data":13763,"content":13764,"nodeType":2021},{},[13765],{"data":13766,"content":13767,"nodeType":881},{},[13768],{"data":13769,"marks":13770,"value":3647,"nodeType":865},{},[],{"data":13772,"content":13775,"nodeType":890},{"target":13773},{"sys":13774},{"id":3652,"type":887,"linkType":888},[],{"data":13777,"content":13778,"nodeType":894},{},[],{"data":13780,"content":13781,"nodeType":1860},{},[13782],{"data":13783,"marks":13784,"value":3664,"nodeType":865},{},[13785],{"type":902},{"data":13787,"content":13788,"nodeType":2270},{},[13789,13811],{"data":13790,"content":13791,"nodeType":2032},{},[13792,13802],{"data":13793,"content":13794,"nodeType":2021},{},[13795],{"data":13796,"content":13797,"nodeType":881},{},[13798],{"data":13799,"marks":13800,"value":2130,"nodeType":865},{},[13801],{"type":902},{"data":13803,"content":13804,"nodeType":2021},{},[13805],{"data":13806,"content":13807,"nodeType":881},{},[13808],{"data":13809,"marks":13810,"value":3690,"nodeType":865},{},[],{"data":13812,"content":13813,"nodeType":2032},{},[13814,13824],{"data":13815,"content":13816,"nodeType":2021},{},[13817],{"data":13818,"content":13819,"nodeType":881},{},[13820],{"data":13821,"marks":13822,"value":2182,"nodeType":865},{},[13823],{"type":902},{"data":13825,"content":13826,"nodeType":2021},{},[13827],{"data":13828,"content":13829,"nodeType":881},{},[13830],{"data":13831,"marks":13832,"value":3713,"nodeType":865},{},[],{"data":13834,"content":13837,"nodeType":890},{"target":13835},{"sys":13836},{"id":3718,"type":887,"linkType":888},[],{"data":13839,"content":13840,"nodeType":894},{},[],{"data":13842,"content":13843,"nodeType":1860},{},[13844],{"data":13845,"marks":13846,"value":3730,"nodeType":865},{},[13847],{"type":902},{"data":13849,"content":13850,"nodeType":2270},{},[13851,13879,13915,13937,13959],{"data":13852,"content":13853,"nodeType":2032},{},[13854,13864],{"data":13855,"content":13856,"nodeType":2021},{},[13857],{"data":13858,"content":13859,"nodeType":881},{},[13860],{"data":13861,"marks":13862,"value":2020,"nodeType":865},{},[13863],{"type":902},{"data":13865,"content":13866,"nodeType":2021},{},[13867,13873],{"data":13868,"content":13869,"nodeType":881},{},[13870],{"data":13871,"marks":13872,"value":3756,"nodeType":865},{},[],{"data":13874,"content":13875,"nodeType":881},{},[13876],{"data":13877,"marks":13878,"value":3763,"nodeType":865},{},[],{"data":13880,"content":13881,"nodeType":2032},{},[13882,13892],{"data":13883,"content":13884,"nodeType":2021},{},[13885],{"data":13886,"content":13887,"nodeType":881},{},[13888],{"data":13889,"marks":13890,"value":2046,"nodeType":865},{},[13891],{"type":902},{"data":13893,"content":13894,"nodeType":2021},{},[13895,13905],{"data":13896,"content":13897,"nodeType":881},{},[13898,13902],{"data":13899,"marks":13900,"value":2523,"nodeType":865},{},[13901],{"type":902},{"data":13903,"marks":13904,"value":3790,"nodeType":865},{},[],{"data":13906,"content":13907,"nodeType":881},{},[13908,13912],{"data":13909,"marks":13910,"value":2087,"nodeType":865},{},[13911],{"type":902},{"data":13913,"marks":13914,"value":2346,"nodeType":865},{},[],{"data":13916,"content":13917,"nodeType":2032},{},[13918,13928],{"data":13919,"content":13920,"nodeType":2021},{},[13921],{"data":13922,"content":13923,"nodeType":881},{},[13924],{"data":13925,"marks":13926,"value":2130,"nodeType":865},{},[13927],{"type":902},{"data":13929,"content":13930,"nodeType":2021},{},[13931],{"data":13932,"content":13933,"nodeType":881},{},[13934],{"data":13935,"marks":13936,"value":3823,"nodeType":865},{},[],{"data":13938,"content":13939,"nodeType":2032},{},[13940,13950],{"data":13941,"content":13942,"nodeType":2021},{},[13943],{"data":13944,"content":13945,"nodeType":881},{},[13946],{"data":13947,"marks":13948,"value":2182,"nodeType":865},{},[13949],{"type":902},{"data":13951,"content":13952,"nodeType":2021},{},[13953],{"data":13954,"content":13955,"nodeType":881},{},[13956],{"data":13957,"marks":13958,"value":3846,"nodeType":865},{},[],{"data":13960,"content":13961,"nodeType":2032},{},[13962,13972],{"data":13963,"content":13964,"nodeType":2021},{},[13965],{"data":13966,"content":13967,"nodeType":881},{},[13968],{"data":13969,"marks":13970,"value":2406,"nodeType":865},{},[13971],{"type":902},{"data":13973,"content":13974,"nodeType":2021},{},[13975],{"data":13976,"content":13977,"nodeType":881},{},[13978],{"data":13979,"marks":13980,"value":3869,"nodeType":865},{},[],{"data":13982,"content":13985,"nodeType":890},{"target":13983},{"sys":13984},{"id":3874,"type":887,"linkType":888},[],{"data":13987,"content":13988,"nodeType":894},{},[],{"data":13990,"content":13991,"nodeType":1860},{},[13992],{"data":13993,"marks":13994,"value":3886,"nodeType":865},{},[13995],{"type":902},{"data":13997,"content":13998,"nodeType":2270},{},[13999,14021,14057,14079,14101],{"data":14000,"content":14001,"nodeType":2032},{},[14002,14012],{"data":14003,"content":14004,"nodeType":2021},{},[14005],{"data":14006,"content":14007,"nodeType":881},{},[14008],{"data":14009,"marks":14010,"value":2020,"nodeType":865},{},[14011],{"type":902},{"data":14013,"content":14014,"nodeType":2021},{},[14015],{"data":14016,"content":14017,"nodeType":881},{},[14018],{"data":14019,"marks":14020,"value":3912,"nodeType":865},{},[],{"data":14022,"content":14023,"nodeType":2032},{},[14024,14034],{"data":14025,"content":14026,"nodeType":2021},{},[14027],{"data":14028,"content":14029,"nodeType":881},{},[14030],{"data":14031,"marks":14032,"value":2046,"nodeType":865},{},[14033],{"type":902},{"data":14035,"content":14036,"nodeType":2021},{},[14037,14047],{"data":14038,"content":14039,"nodeType":881},{},[14040,14044],{"data":14041,"marks":14042,"value":2523,"nodeType":865},{},[14043],{"type":902},{"data":14045,"marks":14046,"value":3939,"nodeType":865},{},[],{"data":14048,"content":14049,"nodeType":881},{},[14050,14054],{"data":14051,"marks":14052,"value":2087,"nodeType":865},{},[14053],{"type":902},{"data":14055,"marks":14056,"value":3950,"nodeType":865},{},[],{"data":14058,"content":14059,"nodeType":2032},{},[14060,14070],{"data":14061,"content":14062,"nodeType":2021},{},[14063],{"data":14064,"content":14065,"nodeType":881},{},[14066],{"data":14067,"marks":14068,"value":2130,"nodeType":865},{},[14069],{"type":902},{"data":14071,"content":14072,"nodeType":2021},{},[14073],{"data":14074,"content":14075,"nodeType":881},{},[14076],{"data":14077,"marks":14078,"value":3823,"nodeType":865},{},[],{"data":14080,"content":14081,"nodeType":2032},{},[14082,14092],{"data":14083,"content":14084,"nodeType":2021},{},[14085],{"data":14086,"content":14087,"nodeType":881},{},[14088],{"data":14089,"marks":14090,"value":2182,"nodeType":865},{},[14091],{"type":902},{"data":14093,"content":14094,"nodeType":2021},{},[14095],{"data":14096,"content":14097,"nodeType":881},{},[14098],{"data":14099,"marks":14100,"value":3995,"nodeType":865},{},[],{"data":14102,"content":14103,"nodeType":2032},{},[14104,14114],{"data":14105,"content":14106,"nodeType":2021},{},[14107],{"data":14108,"content":14109,"nodeType":881},{},[14110],{"data":14111,"marks":14112,"value":2406,"nodeType":865},{},[14113],{"type":902},{"data":14115,"content":14116,"nodeType":2021},{},[14117],{"data":14118,"content":14119,"nodeType":881},{},[14120],{"data":14121,"marks":14122,"value":4018,"nodeType":865},{},[],{"data":14124,"content":14127,"nodeType":890},{"target":14125},{"sys":14126},{"id":4023,"type":887,"linkType":888},[],{"data":14129,"content":14130,"nodeType":894},{},[],{"data":14132,"content":14133,"nodeType":904},{},[14134],{"data":14135,"marks":14136,"value":4035,"nodeType":865},{},[14137],{"type":902},{"data":14139,"content":14140,"nodeType":881},{},[14141,14144],{"data":14142,"marks":14143,"value":4042,"nodeType":865},{},[],{"data":14145,"marks":14146,"value":4047,"nodeType":865},{},[14147],{"type":902},{"data":14149,"content":14150,"nodeType":881},{},[14151],{"data":14152,"marks":14153,"value":4054,"nodeType":865},{},[],{"data":14155,"content":14158,"nodeType":890},{"target":14156},{"sys":14157},{"id":4059,"type":887,"linkType":888},[],{"data":14160,"content":14163,"nodeType":890},{"target":14161},{"sys":14162},{"id":4065,"type":887,"linkType":888},[],{"data":14165,"content":14166,"nodeType":881},{},[14167],{"data":14168,"marks":14169,"value":4073,"nodeType":865},{},[],{"data":14171,"content":14172,"nodeType":881},{},[14173,14176,14180,14183],{"data":14174,"marks":14175,"value":4080,"nodeType":865},{},[],{"data":14177,"marks":14178,"value":4085,"nodeType":865},{},[14179],{"type":902},{"data":14181,"marks":14182,"value":4089,"nodeType":865},{},[],{"data":14184,"marks":14185,"value":4094,"nodeType":865},{},[14186],{"type":902},{"data":14188,"content":14189,"nodeType":881},{},[14190,14193,14197],{"data":14191,"marks":14192,"value":4101,"nodeType":865},{},[],{"data":14194,"marks":14195,"value":4106,"nodeType":865},{},[14196],{"type":902},{"data":14198,"marks":14199,"value":4110,"nodeType":865},{},[],{"data":14201,"content":14204,"nodeType":890},{"target":14202},{"sys":14203},{"id":4115,"type":887,"linkType":888},[],{"data":14206,"content":14207,"nodeType":894},{},[],{"data":14209,"content":14210,"nodeType":904},{},[14211],{"data":14212,"marks":14213,"value":4127,"nodeType":865},{},[14214],{"type":902},{"data":14216,"content":14217,"nodeType":1860},{},[14218],{"data":14219,"marks":14220,"value":4135,"nodeType":865},{},[14221],{"type":902},{"data":14223,"content":14224,"nodeType":881},{},[14225,14228,14232,14235],{"data":14226,"marks":14227,"value":4142,"nodeType":865},{},[],{"data":14229,"marks":14230,"value":4147,"nodeType":865},{},[14231],{"type":902},{"data":14233,"marks":14234,"value":4151,"nodeType":865},{},[],{"data":14236,"marks":14237,"value":4156,"nodeType":865},{},[14238],{"type":902},{"data":14240,"content":14241,"nodeType":881},{},[14242,14246,14249,14253],{"data":14243,"marks":14244,"value":4164,"nodeType":865},{},[14245],{"type":902},{"data":14247,"marks":14248,"value":4168,"nodeType":865},{},[],{"data":14250,"marks":14251,"value":4173,"nodeType":865},{},[14252],{"type":902},{"data":14254,"marks":14255,"value":4177,"nodeType":865},{},[],{"data":14257,"content":14260,"nodeType":890},{"target":14258},{"sys":14259},{"id":3110,"type":887,"linkType":888},[],{"data":14262,"content":14263,"nodeType":881},{},[14264],{"data":14265,"marks":14266,"value":4189,"nodeType":865},{},[],{"data":14268,"content":14269,"nodeType":881},{},[14270],{"data":14271,"marks":14272,"value":4196,"nodeType":865},{},[],{"data":14274,"content":14275,"nodeType":1860},{},[14276],{"data":14277,"marks":14278,"value":4204,"nodeType":865},{},[14279],{"type":902},{"data":14281,"content":14282,"nodeType":881},{},[14283],{"data":14284,"marks":14285,"value":4211,"nodeType":865},{},[],{"data":14287,"content":14288,"nodeType":881},{},[14289],{"data":14290,"marks":14291,"value":4218,"nodeType":865},{},[],{"data":14293,"content":14294,"nodeType":881},{},[14295],{"data":14296,"marks":14297,"value":4225,"nodeType":865},{},[],{"data":14299,"content":14300,"nodeType":1860},{},[14301],{"data":14302,"marks":14303,"value":4233,"nodeType":865},{},[14304],{"type":902},{"data":14306,"content":14307,"nodeType":881},{},[14308],{"data":14309,"marks":14310,"value":4240,"nodeType":865},{},[],{"data":14312,"content":14313,"nodeType":1818},{},[14314,14327,14340],{"data":14315,"content":14316,"nodeType":1734},{},[14317],{"data":14318,"content":14319,"nodeType":881},{},[14320,14324],{"data":14321,"marks":14322,"value":4254,"nodeType":865},{},[14323],{"type":902},{"data":14325,"marks":14326,"value":4258,"nodeType":865},{},[],{"data":14328,"content":14329,"nodeType":1734},{},[14330],{"data":14331,"content":14332,"nodeType":881},{},[14333,14337],{"data":14334,"marks":14335,"value":1718,"nodeType":865},{},[14336],{"type":902},{"data":14338,"marks":14339,"value":4272,"nodeType":865},{},[],{"data":14341,"content":14342,"nodeType":1734},{},[14343],{"data":14344,"content":14345,"nodeType":881},{},[14346,14349,14353],{"data":14347,"marks":14348,"value":4282,"nodeType":865},{},[],{"data":14350,"marks":14351,"value":4287,"nodeType":865},{},[14352],{"type":902},{"data":14354,"marks":14355,"value":4291,"nodeType":865},{},[],{"data":14357,"content":14360,"nodeType":890},{"target":14358},{"sys":14359},{"id":4296,"type":887,"linkType":888},[],{"data":14362,"content":14363,"nodeType":894},{},[],{"data":14365,"content":14366,"nodeType":904},{},[14367],{"data":14368,"marks":14369,"value":4308,"nodeType":865},{},[14370],{"type":902},{"data":14372,"content":14373,"nodeType":881},{},[14374],{"data":14375,"marks":14376,"value":4315,"nodeType":865},{},[],{"data":14378,"content":14379,"nodeType":881},{},[14380],{"data":14381,"marks":14382,"value":4322,"nodeType":865},{},[],{"data":14384,"content":14385,"nodeType":881},{},[14386,14389,14396,14399,14403,14406,14410,14413,14417],{"data":14387,"marks":14388,"value":4329,"nodeType":865},{},[],{"data":14390,"content":14391,"nodeType":876},{"uri":4332},[14392],{"data":14393,"marks":14394,"value":4338,"nodeType":865},{},[14395],{"type":874},{"data":14397,"marks":14398,"value":4342,"nodeType":865},{},[],{"data":14400,"marks":14401,"value":4347,"nodeType":865},{},[14402],{"type":902},{"data":14404,"marks":14405,"value":4351,"nodeType":865},{},[],{"data":14407,"marks":14408,"value":4356,"nodeType":865},{},[14409],{"type":902},{"data":14411,"marks":14412,"value":4360,"nodeType":865},{},[],{"data":14414,"marks":14415,"value":4365,"nodeType":865},{},[14416],{"type":902},{"data":14418,"marks":14419,"value":4369,"nodeType":865},{},[],{"data":14421,"content":14424,"nodeType":890},{"target":14422},{"sys":14423},{"id":4374,"type":887,"linkType":888},[],{"data":14426,"content":14427,"nodeType":881},{},[14428],{"data":14429,"marks":14430,"value":4382,"nodeType":865},{},[],{"data":14432,"content":14433,"nodeType":894},{},[],{"data":14435,"content":14436,"nodeType":904},{},[14437],{"data":14438,"marks":14439,"value":4393,"nodeType":865},{},[14440],{"type":902},{"data":14442,"content":14443,"nodeType":881},{},[14444],{"data":14445,"marks":14446,"value":4400,"nodeType":865},{},[],{"data":14448,"content":14449,"nodeType":881},{},[14450],{"data":14451,"marks":14452,"value":4407,"nodeType":865},{},[],{"data":14454,"content":14455,"nodeType":881},{},[14456,14459,14466],{"data":14457,"marks":14458,"value":4414,"nodeType":865},{},[],{"data":14460,"content":14461,"nodeType":876},{"uri":4417},[14462],{"data":14463,"marks":14464,"value":4423,"nodeType":865},{},[14465],{"type":874},{"data":14467,"marks":14468,"value":4427,"nodeType":865},{},[],{"data":14470,"content":14473,"nodeType":890},{"target":14471},{"sys":14472},{"id":4432,"type":887,"linkType":888},[],{"data":14475,"content":14476,"nodeType":881},{},[14477],{"data":14478,"marks":14479,"value":4440,"nodeType":865},{},[],{"data":14481,"content":14482,"nodeType":1860},{},[14483],{"data":14484,"marks":14485,"value":4448,"nodeType":865},{},[14486],{"type":902},{"data":14488,"content":14489,"nodeType":881},{},[14490],{"data":14491,"marks":14492,"value":4455,"nodeType":865},{},[],{"data":14494,"content":14495,"nodeType":881},{},[14496,14499,14506,14509,14516,14519,14526],{"data":14497,"marks":14498,"value":4462,"nodeType":865},{},[],{"data":14500,"content":14501,"nodeType":876},{"uri":4465},[14502],{"data":14503,"marks":14504,"value":4471,"nodeType":865},{},[14505],{"type":874},{"data":14507,"marks":14508,"value":1877,"nodeType":865},{},[],{"data":14510,"content":14511,"nodeType":876},{"uri":4477},[14512],{"data":14513,"marks":14514,"value":4483,"nodeType":865},{},[14515],{"type":874},{"data":14517,"marks":14518,"value":4487,"nodeType":865},{},[],{"data":14520,"content":14521,"nodeType":876},{"uri":1453},[14522],{"data":14523,"marks":14524,"value":4495,"nodeType":865},{},[14525],{"type":874},{"data":14527,"marks":14528,"value":959,"nodeType":865},{},[],{"entries":14530},{"hyperlink":14531,"inline":14532,"block":14533},[],[],[14534,14553,14585,14592,14606,14647,14661,14689,14695,14702,14707,14714,14718,14724,14727,14733,14738,14744,14779,14785,14793,14797,14802,14808,14813,14827,14833,14841,14845,14859,14916,14922,14936,14996,15020],{"sys":14535,"__typename":7015,"content":14536,"name":14552,"title":59},{"id":1496},{"json":14537},{"data":14538,"content":14539,"nodeType":1463},{},[14540],{"data":14541,"content":14542,"nodeType":881},{},[14543,14548],{"data":14544,"marks":14545,"value":14547,"nodeType":865},{},[14546],{"type":902},"Update May 15:",{"data":14549,"marks":14550,"value":14551,"nodeType":865},{},[]," We've added details of three new kits, including proper samples of Venom, Tycoon2FA, and CYB3R, a new self-identifying kit — all from Push's customer detections. ","DCP IB 11",{"sys":14554,"__typename":7015,"content":14555,"name":14584,"title":59},{"id":1547},{"json":14556},{"nodeType":1463,"data":14557,"content":14558},{},[14559],{"nodeType":881,"data":14560,"content":14561},{},[14562,14566,14571,14575,14580],{"nodeType":865,"value":14563,"marks":14564,"data":14565},"At the start of March, we’d observed a ",[],{},{"nodeType":865,"value":14567,"marks":14568,"data":14570},"15x",[14569],{"type":902},{},{"nodeType":865,"value":14572,"marks":14573,"data":14574}," increase in device code phishing pages detected by our research team this year, with multiple kits and campaigns being tracked — with the kit now identified as EvilTokens the most prominent. ",[],{},{"nodeType":865,"value":14576,"marks":14577,"data":14579},"That figure has now risen to 37.5x",[14578],{"type":902},{},{"nodeType":865,"value":14581,"marks":14582,"data":14583},". More on that later. ",[],{},"DCP IB 1",{"sys":14586,"__typename":7008,"title":14587,"caption":14587,"layoutMode":59,"file":14588},{"id":1578},"Device code phishing evolution 2019-2026.",{"url":14589,"width":14590,"height":14591},"https://images.ctfassets.net/y1cdw1ablpvd/7dPjgH1qTrpBIdqE0D4D0g/8d0bcaea877a9fcd325b272890d8dc63/device_code_phishing_4col_timeline_1.png",1360,1160,{"sys":14593,"__typename":7015,"content":14594,"name":14605,"title":59},{"id":1689},{"json":14595},{"nodeType":1463,"data":14596,"content":14597},{},[14598],{"nodeType":881,"data":14599,"content":14600},{},[14601],{"nodeType":865,"value":14602,"marks":14603,"data":14604},"PhaaS is key to the adoption of new phishing tools and techniques, providing broad access to criminal operators at scale while driving up execution standards. It has been central to the continued evolution of AITM and ClickFix, and is a strong indicator of what comes next for device code phishing.",[],{},"DCP IB 2",{"sys":14607,"__typename":7015,"content":14608,"name":14646,"title":59},{"id":1823},{"json":14609},{"data":14610,"content":14611,"nodeType":1463},{},[14612],{"data":14613,"content":14614,"nodeType":881},{},[14615,14619,14626,14630,14634,14642],{"data":14616,"marks":14617,"value":14618,"nodeType":865},{},[],"We're seeing a clear trend of existing PhaaS kits adding device code phishing functionality. Tycoon2FA, the category leader for criminal AITM phishing capabilities, has recently",{"data":14620,"content":14621,"nodeType":876},{"uri":938},[14622],{"data":14623,"marks":14624,"value":14625,"nodeType":865},{},[]," adopted device code phishing ",{"data":14627,"marks":14628,"value":14629,"nodeType":865},{},[],"alongside its established AiTM functionality (we've provided some examples below), while t",{"data":14631,"marks":14632,"value":14633,"nodeType":865},{},[],"he ",{"data":14635,"content":14637,"nodeType":876},{"uri":14636},"https://abnormal.ai/blog/venom-phishing-campaign-mfa-credential-theft",[14638],{"data":14639,"marks":14640,"value":3664,"nodeType":865},{},[14641],{"type":874},{"data":14643,"marks":14644,"value":14645,"nodeType":865},{},[]," kit that offers device code phishing capabilities that appear visually and functionally similar to EvilTokens has an AITM component that matches our detections for Sneaky2FA, indicating a possible overlap in tooling.","DCP IB12",{"sys":14648,"__typename":7015,"content":14649,"name":14660,"title":59},{"id":1847},{"json":14650},{"nodeType":1463,"data":14651,"content":14652},{},[14653],{"nodeType":881,"data":14654,"content":14655},{},[14656],{"nodeType":865,"value":14657,"marks":14658,"data":14659},"Many of the names provided are internal codenames. The information per kit is by no means exhaustive and is likely to evolve over time. ",[],{},"DCP IP 7",{"sys":14662,"__typename":7015,"content":14663,"name":14688,"title":59},{"id":1907},{"json":14664},{"nodeType":1463,"data":14665,"content":14666},{},[14667,14674,14681],{"nodeType":881,"data":14668,"content":14669},{},[14670],{"nodeType":865,"value":14671,"marks":14672,"data":14673},"Our codename for EvilTokens internally was derived from the overly descriptive page code describing its bot protection capabilities (a clear sign of vibe coding — thanks Claude!):",[],{},{"nodeType":881,"data":14675,"content":14676},{},[14677],{"nodeType":865,"value":14678,"marks":14679,"data":14680},"\u003C!-- FIXED ANTI-BOT SYSTEM - WON'T REDIRECT REAL USERS -->",[],{},{"nodeType":881,"data":14682,"content":14683},{},[14684],{"nodeType":865,"value":14685,"marks":14686,"data":14687},"\u003C!-- ENHANCED ANTI-BOT SYSTEM WITH SERVER-SIDE VALIDATION -->",[],{},"DCP IB3",{"sys":14690,"__typename":7008,"title":14691,"caption":14691,"layoutMode":59,"file":14692},{"id":1960},"Precursor A (Left) & B (Right): Different visual lures from January 2026. ",{"url":14693,"width":7012,"height":14694},"https://images.ctfassets.net/y1cdw1ablpvd/3pfFR7ICQQqOyhGAFAj67C/6f8873d82cc7f5233a0ca9baa74f7585/image15.png",773,{"sys":14696,"__typename":7008,"title":14697,"caption":14698,"layoutMode":59,"file":14699},{"id":1966},"Early ANTIBOT: First appearance of the ANTIBOT comments, mid-Jan.","Early ANTIBOT: First appearance of the ANTIBOT comments, late-Jan.",{"url":14700,"width":7012,"height":14701},"https://images.ctfassets.net/y1cdw1ablpvd/VAdFlnCF4YftsOV02wnwu/8813ea3957b65ddfb84bb8ba5fb25a55/image6.png",564,{"sys":14703,"__typename":7100,"title":14704,"arcadeDemoUrl":14705,"playText":14706},{"id":1972},"Early ANTIBOT page load","https://demo.arcade.software/wRcvXg62Lok57ZjOKgJI?embed","20 secs",{"sys":14708,"__typename":7008,"title":14709,"caption":14709,"layoutMode":59,"file":14710},{"id":1978},"\"Courts Access\" lure with a similar security verification to Early ANTIBOT.",{"url":14711,"width":14712,"height":14713},"https://images.ctfassets.net/y1cdw1ablpvd/7LEJpoif8dnub4qJw2z6kL/3b15161c9d3f2e4f7d4f323ec04f1f33/Group_687.png",3103,1200,{"sys":14715,"__typename":7100,"title":14716,"arcadeDemoUrl":14717,"playText":7102},{"id":1984},"ANTIBOT \"Courts Access\" lure","https://demo.arcade.software/8b4YuKm1EXPmgx2q7q2D?embed",{"sys":14719,"__typename":7008,"title":14720,"caption":14720,"layoutMode":59,"file":14721},{"id":1990},"Production ANTIBOT: Current EvilTokens implementation.",{"url":14722,"width":7012,"height":14723},"https://images.ctfassets.net/y1cdw1ablpvd/1J3fOSmUPF8f3FlcwYFoGe/5eff8c1a892f870d1488d6a0f38da03c/image12.png",591,{"sys":14725,"__typename":7100,"title":1680,"arcadeDemoUrl":14726,"playText":14706},{"id":1996},"https://demo.arcade.software/zB6dqehj1lbnB2dur9lB?embed",{"sys":14728,"__typename":7008,"title":14729,"caption":14729,"layoutMode":59,"file":14730},{"id":2421},"SHAREFILE kit.",{"url":14731,"width":7012,"height":14732},"https://images.ctfassets.net/y1cdw1ablpvd/1iKelffs399PIIBedgnqmu/64a40d1ad7f69f966665f44c52e0817b/image1.png",1500,{"sys":14734,"__typename":7100,"title":14735,"arcadeDemoUrl":14736,"playText":14737},{"id":2612},"Kali365 / Clure Demo","https://demo.arcade.software/dwwFeSKGldZvTrYZDtZV?embed","30 secs",{"sys":14739,"__typename":7008,"title":14740,"caption":59,"layoutMode":59,"file":14741},{"id":2776},"LINKID landing page requires an email before serving the payload.",{"url":14742,"width":7012,"height":14743},"https://images.ctfassets.net/y1cdw1ablpvd/5XAibmWt8HDGbpOC9n1DEk/d4bcb1006d82116dff5865f5b911bc88/image9.png",1049,{"sys":14745,"__typename":7015,"content":14746,"name":14778,"title":59},{"id":2793},{"json":14747},{"nodeType":1463,"data":14748,"content":14749},{},[14750],{"nodeType":881,"data":14751,"content":14752},{},[14753,14757,14762,14766,14774],{"nodeType":865,"value":14754,"marks":14755,"data":14756},"AUTHOV was recently attributed to ",[],{},{"nodeType":865,"value":14758,"marks":14759,"data":14761},"Device Code Lab",[14760],{"type":902},{},{"nodeType":865,"value":14763,"marks":14764,"data":14765},", a professional grade, device code phishing platform, with numerous defense evasion and post-exploitation features, designed to interoperate with other phishing platforms. You can ",[],{},{"nodeType":876,"data":14767,"content":14769},{"uri":14768},"https://newtonpaul.com/blog/device-code-lab-post-exploit/",[14770],{"nodeType":865,"value":14771,"marks":14772,"data":14773},"read Paul Newton's write-up here",[],{},{"nodeType":865,"value":14775,"marks":14776,"data":14777},". ",[],{},"dcp ib14",{"sys":14780,"__typename":7008,"title":14781,"caption":14781,"layoutMode":59,"file":14782},{"id":2940},"AUTHOV kit. Notably uses a popup like prod EvilTokens.",{"url":14783,"width":7012,"height":14784},"https://images.ctfassets.net/y1cdw1ablpvd/4wKaHuSRfMXvi056r88u0b/e77feca260fe5ceb07ea7a080a09148f/image8.png",1128,{"sys":14786,"__typename":7008,"title":14787,"caption":14788,"layoutMode":59,"file":14789},{"id":2946},"Device code lab portal","Device Code Lab portal login page. Credit: Paul Newton",{"url":14790,"width":14791,"height":14792},"https://images.ctfassets.net/y1cdw1ablpvd/3qgmWJFz6hDUSEu2TcUWWU/9df13412c9ddb216020ae7a5fe476b5d/portal.png",912,787,{"sys":14794,"__typename":7100,"title":14795,"arcadeDemoUrl":14796,"playText":14706},{"id":3110},"DOCUPOLL DCP Kit","https://demo.arcade.software/Wv84a7Vziha9RwTdctvg?embed",{"sys":14798,"__typename":7008,"title":14799,"caption":14799,"layoutMode":59,"file":14800},{"id":3273},"FLOW_TOKEN kit. Notably uses a popup like prod EvilTokens.",{"url":14801,"width":7012,"height":14784},"https://images.ctfassets.net/y1cdw1ablpvd/4Bvbx5dwwBTOvAzULbnhIF/2d676145af0648b1e6f43b624af3ffbc/image7.png",{"sys":14803,"__typename":7008,"title":14804,"caption":14804,"layoutMode":59,"file":14805},{"id":3385},"PAPRIKA kit.",{"url":14806,"width":7012,"height":14807},"https://images.ctfassets.net/y1cdw1ablpvd/2XqwbTyGXRBaH6OM0t9moI/107cd701784fe8eed96eea2b9c09731a/image5.png",727,{"sys":14809,"__typename":7008,"title":14810,"caption":14810,"layoutMode":59,"file":14811},{"id":3496},"DCSTATUS kit. ",{"url":14812,"width":7012,"height":14732},"https://images.ctfassets.net/y1cdw1ablpvd/1zKQp6Wi0ckDZMLHBriU2Y/7d1c7c348407dcbde2eb94551baca7f5/image14.png",{"sys":14814,"__typename":7015,"content":14815,"name":14826,"title":59},{"id":3513},{"json":14816},{"data":14817,"content":14818,"nodeType":1463},{},[14819],{"data":14820,"content":14821,"nodeType":881},{},[14822],{"data":14823,"marks":14824,"value":14825,"nodeType":865},{},[],"Our suspicion is that this was a one-off — potentially for a red team exercise — rather than representative of a more widely used kit.","DCP IB 4",{"sys":14828,"__typename":7008,"title":14829,"caption":14829,"layoutMode":59,"file":14830},{"id":3652},"DOLCE kit.",{"url":14831,"width":7012,"height":14832},"https://images.ctfassets.net/y1cdw1ablpvd/6iUfj8vMymi2c7lZxj006n/88b8066e6bea9fa7a81bd6b546264796/image16.png",728,{"sys":14834,"__typename":7008,"title":14835,"caption":14836,"layoutMode":59,"file":14837},{"id":3718},"Venom Device Code Phishing Screenshots","Examples of the Venom platform impersonating brands like YPO, FedEx and DHL.",{"url":14838,"width":14839,"height":14840},"https://images.ctfassets.net/y1cdw1ablpvd/2NThjmQSR5XFdnKEQKXfnd/237318895da6f558cc03b2915217afea/Venom_Device_Code_Phishing__1_.png",13114,3310,{"sys":14842,"__typename":7100,"title":14843,"arcadeDemoUrl":14844,"playText":14737},{"id":3874},"Tycoon2FA Device Code Phishing","https://demo.arcade.software/SPNMxNkoyY5vTMPPlqWS?embed",{"sys":14846,"__typename":7015,"content":14847,"name":14858,"title":59},{"id":4023},{"json":14848},{"nodeType":1463,"data":14849,"content":14850},{},[14851],{"nodeType":881,"data":14852,"content":14853},{},[14854],{"nodeType":865,"value":14855,"marks":14856,"data":14857},"Clearly, device code phishing has entered mainstream adoption and we should be prepared for a lot more of it in future. So how does it work, and why is it so effective?",[],{},"DCP IB13",{"sys":14860,"__typename":7015,"content":14861,"name":14915,"title":59},{"id":4059},{"json":14862},{"nodeType":1463,"data":14863,"content":14864},{},[14865,14899],{"nodeType":881,"data":14866,"content":14867},{},[14868,14872,14879,14883,14887,14891,14895],{"nodeType":865,"value":14869,"marks":14870,"data":14871},"When targeting Microsoft environments, attackers can use the ",[],{},{"nodeType":876,"data":14873,"content":14874},{"uri":1615},[14875],{"nodeType":865,"value":14876,"marks":14877,"data":14878},"PRT escalation technique",[],{},{"nodeType":865,"value":14880,"marks":14881,"data":14882}," I mentioned in earlier research to get seamless SSO across ",[],{},{"nodeType":865,"value":7142,"marks":14884,"data":14886},[14885],{"type":5120},{},{"nodeType":865,"value":14888,"marks":14889,"data":14890}," Entra ID-connected applications and web services. This requires that you specifically target the ",[],{},{"nodeType":865,"value":7151,"marks":14892,"data":14894},[14893],{"type":902},{},{"nodeType":865,"value":14896,"marks":14897,"data":14898}," application, chained into a new device registration in the victim's environment. This is the method that Storm-2372 was leveraging in 2025. ",[],{},{"nodeType":881,"data":14900,"content":14901},{},[14902,14906,14911],{"nodeType":865,"value":14903,"marks":14904,"data":14905},"But even without this step, many Microsoft first-party apps also belong to the ",[],{},{"nodeType":865,"value":14907,"marks":14908,"data":14910},"Family of Client IDs (FOCI)",[14909],{"type":902},{},{"nodeType":865,"value":14912,"marks":14913,"data":14914},", meaning a refresh token obtained for one family member can be exchanged for access tokens to other family members without re-authentication. In practice, this means an attacker who phishes a token via e.g. the Microsoft Office client ID, can silently pivot to access Outlook, Teams, OneDrive, SharePoint, and Azure Management APIs — all from a single phished session. ",[],{},"DCP IB 8",{"sys":14917,"__typename":7008,"title":14918,"caption":14918,"layoutMode":59,"file":14919},{"id":4065},"Device code phishing attack chain.",{"url":14920,"width":7012,"height":14921},"https://images.ctfassets.net/y1cdw1ablpvd/60e9ErrL8tp3xtoer4gNUl/83899c207f61fdd9ff8aad0e1001030d/image2.png",1275,{"sys":14923,"__typename":7015,"content":14924,"name":14935,"title":59},{"id":4115},{"json":14925},{"nodeType":1463,"data":14926,"content":14927},{},[14928],{"nodeType":881,"data":14929,"content":14930},{},[14931],{"nodeType":865,"value":14932,"marks":14933,"data":14934},"One of the key limitations of early device code phishing was that the code was being sent directly over email (as in the Russia-linked campaigns in 2024-5). This meant that the code would expire unless used immediately, requiring highly engaged social engineering to pull off. To get around this, modern device code phishing pages are continuously polling for fresh codes via API. This arguably makes them more discoverable than simply providing the code and instructions in a direct message, but is way more scalable for the attacker. ",[],{},"DCP IB 5",{"sys":14937,"__typename":7015,"content":14938,"name":14995,"title":59},{"id":4296},{"json":14939},{"nodeType":1463,"data":14940,"content":14941},{},[14942,14979],{"nodeType":881,"data":14943,"content":14944},{},[14945,14950,14954,14964,14968,14975],{"nodeType":865,"value":14946,"marks":14947,"data":14949},"First-party applications",[14948],{"type":902},{},{"nodeType":865,"value":14951,"marks":14952,"data":14953}," are commonly abused in Microsoft-targeted attacks. These are ",[],{},{"nodeType":876,"data":14955,"content":14957},{"uri":14956},"https://gist.github.com/dafthack/2c0bbcac72b10c1ee205d1dd2fed3fe7",[14958],{"nodeType":865,"value":14959,"marks":14960,"data":14963},"real Microsoft applications",[14961,14962],{"type":874},{"type":902},{},{"nodeType":865,"value":14965,"marks":14966,"data":14967}," registered in every Entra ID tenant. Not only are they allowed by default (unlike third-party apps that are often subject to additional restrictions and require additional tenant-level consent before they can be accessed by a user), they come with pre-consented permissions, and can even access undocumented “legacy” scopes that aren't logged by default (exploited in the Russia-linked ",[],{},{"nodeType":876,"data":14969,"content":14970},{"uri":1230},[14971],{"nodeType":865,"value":1236,"marks":14972,"data":14974},[14973],{"type":874},{},{"nodeType":865,"value":14976,"marks":14977,"data":14978}," campaign reported by Push researchers). ",[],{},{"nodeType":881,"data":14980,"content":14981},{},[14982,14986,14991],{"nodeType":865,"value":14983,"marks":14984,"data":14985},"In other cases, such as when targeting GitHub or Salesforce, ",[],{},{"nodeType":865,"value":14987,"marks":14988,"data":14990},"third-party applications",[14989],{"type":902},{},{"nodeType":865,"value":14992,"marks":14993,"data":14994}," are often leveraged. These aren't necessarily fresh, attacker-created apps — they can be attacker-controlled instances of otherwise legitimate applications. That said, it is easier than ever for attackers to spin up their own OAuth apps, particularly using AI tools. The trade-off is that the victim has to consent to the app from the tenant level before also granting access to their account, introducing more friction to the process, and potentially running into additional security controls and restrictions depending on tenant configuration. ",[],{},"DCP IB 6",{"sys":14997,"__typename":7015,"content":14998,"name":15019,"title":59},{"id":4374},{"json":14999},{"nodeType":1463,"data":15000,"content":15001},{},[15002],{"nodeType":881,"data":15003,"content":15004},{},[15005,15009,15015],{"nodeType":865,"value":15006,"marks":15007,"data":15008},"However, it's important to recognize that blocking device code flow is not a complete solution. Related techniques like ",[],{},{"nodeType":876,"data":15010,"content":15011},{"uri":1230},[15012],{"nodeType":865,"value":1236,"marks":15013,"data":15014},[],{},{"nodeType":865,"value":15016,"marks":15017,"data":15018}," — which exploits the authorization code flow with localhost redirects rather than the device code flow — produce the same access tokens with the same capabilities but are not blocked by device code flow specific CA policies. ",[],{},"DCP IB 7",{"sys":15021,"__typename":7008,"title":15022,"caption":15023,"layoutMode":59,"file":15024},{"id":4432},"DCP warning banner","Users visiting a device code login page will be required to click through a warning banner, emitting a webhook event.",{"url":15025,"width":7210,"height":7211},"https://images.ctfassets.net/y1cdw1ablpvd/2Gtct2qofWtLLVi31Pk8NY/616e56fc4fa7dcb905a0a3a1ca28709b/image17.png",{"items":15027},[],{},"Analyzing the rise in device code phishing attacks in 2026",{"items":15031},[15032,15860,16608],{"__typename":1485,"sys":15033,"content":15034,"title":11751,"synopsis":11752,"hashTags":59,"publishedDate":11753,"slug":11754,"tagsCollection":15850,"authorsCollection":15856},{"id":10804},{"json":15035},{"data":15036,"content":15037,"nodeType":1463},{},[15038,15044,15050,15056,15059,15066,15072,15078,15083,15089,15094,15110,15116,15126,15129,15136,15142,15155,15161,15171,15176,15179,15186,15193,15198,15206,15222,15230,15236,15244,15259,15267,15273,15281,15307,15315,15321,15329,15345,15350,15358,15364,15372,15405,15408,15415,15423,15439,15447,15453,15461,15487,15492,15500,15506,15511,15514,15521,15529,15535,15586,15591,15594,15601,15609,15615,15620,15623,15630,15636,15642,15702,15708,15763,15769,15772,15779,15785,15791,15796,15799,15806,15812,15818,15824],{"data":15039,"content":15040,"nodeType":881},{},[15041],{"data":15042,"marks":15043,"value":10815,"nodeType":865},{},[],{"data":15045,"content":15046,"nodeType":881},{},[15047],{"data":15048,"marks":15049,"value":10822,"nodeType":865},{},[],{"data":15051,"content":15052,"nodeType":881},{},[15053],{"data":15054,"marks":15055,"value":10829,"nodeType":865},{},[],{"data":15057,"content":15058,"nodeType":894},{},[],{"data":15060,"content":15061,"nodeType":904},{},[15062],{"data":15063,"marks":15064,"value":10840,"nodeType":865},{},[15065],{"type":902},{"data":15067,"content":15068,"nodeType":881},{},[15069],{"data":15070,"marks":15071,"value":10847,"nodeType":865},{},[],{"data":15073,"content":15074,"nodeType":881},{},[15075],{"data":15076,"marks":15077,"value":10854,"nodeType":865},{},[],{"data":15079,"content":15082,"nodeType":890},{"target":15080},{"sys":15081},{"id":10859,"type":887,"linkType":888},[],{"data":15084,"content":15085,"nodeType":881},{},[15086],{"data":15087,"marks":15088,"value":10867,"nodeType":865},{},[],{"data":15090,"content":15093,"nodeType":890},{"target":15091},{"sys":15092},{"id":10872,"type":887,"linkType":888},[],{"data":15095,"content":15096,"nodeType":881},{},[15097,15100,15107],{"data":15098,"marks":15099,"value":10880,"nodeType":865},{},[],{"data":15101,"content":15102,"nodeType":876},{"uri":5475},[15103],{"data":15104,"marks":15105,"value":10888,"nodeType":865},{},[15106],{"type":874},{"data":15108,"marks":15109,"value":10892,"nodeType":865},{},[],{"data":15111,"content":15112,"nodeType":881},{},[15113],{"data":15114,"marks":15115,"value":10899,"nodeType":865},{},[],{"data":15117,"content":15118,"nodeType":881},{},[15119,15122],{"data":15120,"marks":15121,"value":10906,"nodeType":865},{},[],{"data":15123,"marks":15124,"value":10911,"nodeType":865},{},[15125],{"type":902},{"data":15127,"content":15128,"nodeType":894},{},[],{"data":15130,"content":15131,"nodeType":904},{},[15132],{"data":15133,"marks":15134,"value":10922,"nodeType":865},{},[15135],{"type":902},{"data":15137,"content":15138,"nodeType":881},{},[15139],{"data":15140,"marks":15141,"value":10929,"nodeType":865},{},[],{"data":15143,"content":15144,"nodeType":881},{},[15145,15148,15152],{"data":15146,"marks":15147,"value":10936,"nodeType":865},{},[],{"data":15149,"marks":15150,"value":10941,"nodeType":865},{},[15151],{"type":902},{"data":15153,"marks":15154,"value":10945,"nodeType":865},{},[],{"data":15156,"content":15157,"nodeType":881},{},[15158],{"data":15159,"marks":15160,"value":10952,"nodeType":865},{},[],{"data":15162,"content":15163,"nodeType":881},{},[15164,15167],{"data":15165,"marks":15166,"value":10959,"nodeType":865},{},[],{"data":15168,"marks":15169,"value":10964,"nodeType":865},{},[15170],{"type":902},{"data":15172,"content":15175,"nodeType":890},{"target":15173},{"sys":15174},{"id":10969,"type":887,"linkType":888},[],{"data":15177,"content":15178,"nodeType":894},{},[],{"data":15180,"content":15181,"nodeType":904},{},[15182],{"data":15183,"marks":15184,"value":10981,"nodeType":865},{},[15185],{"type":902},{"data":15187,"content":15188,"nodeType":1860},{},[15189],{"data":15190,"marks":15191,"value":10989,"nodeType":865},{},[15192],{"type":902},{"data":15194,"content":15197,"nodeType":890},{"target":15195},{"sys":15196},{"id":10994,"type":887,"linkType":888},[],{"data":15199,"content":15200,"nodeType":881},{},[15201],{"data":15202,"marks":15203,"value":11004,"nodeType":865},{},[15204,15205],{"type":902},{"type":874},{"data":15207,"content":15208,"nodeType":881},{},[15209,15212,15219],{"data":15210,"marks":15211,"value":11011,"nodeType":865},{},[],{"data":15213,"content":15214,"nodeType":876},{"uri":11014},[15215],{"data":15216,"marks":15217,"value":11020,"nodeType":865},{},[15218],{"type":874},{"data":15220,"marks":15221,"value":11024,"nodeType":865},{},[],{"data":15223,"content":15224,"nodeType":881},{},[15225],{"data":15226,"marks":15227,"value":11033,"nodeType":865},{},[15228,15229],{"type":902},{"type":874},{"data":15231,"content":15232,"nodeType":881},{},[15233],{"data":15234,"marks":15235,"value":11040,"nodeType":865},{},[],{"data":15237,"content":15238,"nodeType":881},{},[15239],{"data":15240,"marks":15241,"value":11049,"nodeType":865},{},[15242,15243],{"type":902},{"type":874},{"data":15245,"content":15246,"nodeType":881},{},[15247,15250,15256],{"data":15248,"marks":15249,"value":11056,"nodeType":865},{},[],{"data":15251,"content":15252,"nodeType":876},{"uri":11059},[15253],{"data":15254,"marks":15255,"value":11064,"nodeType":865},{},[],{"data":15257,"marks":15258,"value":11068,"nodeType":865},{},[],{"data":15260,"content":15261,"nodeType":881},{},[15262],{"data":15263,"marks":15264,"value":11077,"nodeType":865},{},[15265,15266],{"type":902},{"type":874},{"data":15268,"content":15269,"nodeType":881},{},[15270],{"data":15271,"marks":15272,"value":11084,"nodeType":865},{},[],{"data":15274,"content":15275,"nodeType":881},{},[15276],{"data":15277,"marks":15278,"value":11093,"nodeType":865},{},[15279,15280],{"type":902},{"type":874},{"data":15282,"content":15283,"nodeType":881},{},[15284,15287,15294,15297,15304],{"data":15285,"marks":15286,"value":11100,"nodeType":865},{},[],{"data":15288,"content":15289,"nodeType":876},{"uri":11103},[15290],{"data":15291,"marks":15292,"value":11109,"nodeType":865},{},[15293],{"type":874},{"data":15295,"marks":15296,"value":11113,"nodeType":865},{},[],{"data":15298,"content":15299,"nodeType":876},{"uri":11116},[15300],{"data":15301,"marks":15302,"value":11122,"nodeType":865},{},[15303],{"type":874},{"data":15305,"marks":15306,"value":11126,"nodeType":865},{},[],{"data":15308,"content":15309,"nodeType":881},{},[15310],{"data":15311,"marks":15312,"value":11135,"nodeType":865},{},[15313,15314],{"type":902},{"type":874},{"data":15316,"content":15317,"nodeType":881},{},[15318],{"data":15319,"marks":15320,"value":11142,"nodeType":865},{},[],{"data":15322,"content":15323,"nodeType":881},{},[15324],{"data":15325,"marks":15326,"value":11151,"nodeType":865},{},[15327,15328],{"type":902},{"type":874},{"data":15330,"content":15331,"nodeType":881},{},[15332,15335,15342],{"data":15333,"marks":15334,"value":11158,"nodeType":865},{},[],{"data":15336,"content":15337,"nodeType":876},{"uri":11116},[15338],{"data":15339,"marks":15340,"value":11122,"nodeType":865},{},[15341],{"type":874},{"data":15343,"marks":15344,"value":11169,"nodeType":865},{},[],{"data":15346,"content":15349,"nodeType":890},{"target":15347},{"sys":15348},{"id":11174,"type":887,"linkType":888},[],{"data":15351,"content":15352,"nodeType":881},{},[15353],{"data":15354,"marks":15355,"value":11184,"nodeType":865},{},[15356,15357],{"type":902},{"type":874},{"data":15359,"content":15360,"nodeType":881},{},[15361],{"data":15362,"marks":15363,"value":11191,"nodeType":865},{},[],{"data":15365,"content":15366,"nodeType":881},{},[15367],{"data":15368,"marks":15369,"value":11200,"nodeType":865},{},[15370,15371],{"type":902},{"type":874},{"data":15373,"content":15374,"nodeType":881},{},[15375,15378,15384,15387,15393,15396,15402],{"data":15376,"marks":15377,"value":11207,"nodeType":865},{},[],{"data":15379,"content":15380,"nodeType":876},{"uri":11210},[15381],{"data":15382,"marks":15383,"value":11215,"nodeType":865},{},[],{"data":15385,"marks":15386,"value":1651,"nodeType":865},{},[],{"data":15388,"content":15389,"nodeType":876},{"uri":11221},[15390],{"data":15391,"marks":15392,"value":11226,"nodeType":865},{},[],{"data":15394,"marks":15395,"value":11230,"nodeType":865},{},[],{"data":15397,"content":15398,"nodeType":876},{"uri":5030},[15399],{"data":15400,"marks":15401,"value":11237,"nodeType":865},{},[],{"data":15403,"marks":15404,"value":11241,"nodeType":865},{},[],{"data":15406,"content":15407,"nodeType":894},{},[],{"data":15409,"content":15410,"nodeType":1860},{},[15411],{"data":15412,"marks":15413,"value":11252,"nodeType":865},{},[15414],{"type":902},{"data":15416,"content":15417,"nodeType":881},{},[15418],{"data":15419,"marks":15420,"value":11261,"nodeType":865},{},[15421,15422],{"type":902},{"type":874},{"data":15424,"content":15425,"nodeType":881},{},[15426,15429,15436],{"data":15427,"marks":15428,"value":11268,"nodeType":865},{},[],{"data":15430,"content":15431,"nodeType":876},{"uri":11271},[15432],{"data":15433,"marks":15434,"value":11277,"nodeType":865},{},[15435],{"type":874},{"data":15437,"marks":15438,"value":11281,"nodeType":865},{},[],{"data":15440,"content":15441,"nodeType":881},{},[15442],{"data":15443,"marks":15444,"value":11290,"nodeType":865},{},[15445,15446],{"type":902},{"type":874},{"data":15448,"content":15449,"nodeType":881},{},[15450],{"data":15451,"marks":15452,"value":11297,"nodeType":865},{},[],{"data":15454,"content":15455,"nodeType":881},{},[15456],{"data":15457,"marks":15458,"value":11306,"nodeType":865},{},[15459,15460],{"type":902},{"type":874},{"data":15462,"content":15463,"nodeType":881},{},[15464,15467,15474,15477,15484],{"data":15465,"marks":15466,"value":11313,"nodeType":865},{},[],{"data":15468,"content":15469,"nodeType":876},{"uri":11316},[15470],{"data":15471,"marks":15472,"value":11322,"nodeType":865},{},[15473],{"type":874},{"data":15475,"marks":15476,"value":11326,"nodeType":865},{},[],{"data":15478,"content":15479,"nodeType":876},{"uri":11329},[15480],{"data":15481,"marks":15482,"value":11335,"nodeType":865},{},[15483],{"type":874},{"data":15485,"marks":15486,"value":11339,"nodeType":865},{},[],{"data":15488,"content":15491,"nodeType":890},{"target":15489},{"sys":15490},{"id":11344,"type":887,"linkType":888},[],{"data":15493,"content":15494,"nodeType":881},{},[15495],{"data":15496,"marks":15497,"value":11354,"nodeType":865},{},[15498,15499],{"type":902},{"type":874},{"data":15501,"content":15502,"nodeType":881},{},[15503],{"data":15504,"marks":15505,"value":11361,"nodeType":865},{},[],{"data":15507,"content":15510,"nodeType":890},{"target":15508},{"sys":15509},{"id":11366,"type":887,"linkType":888},[],{"data":15512,"content":15513,"nodeType":894},{},[],{"data":15515,"content":15516,"nodeType":1860},{},[15517],{"data":15518,"marks":15519,"value":694,"nodeType":865},{},[15520],{"type":902},{"data":15522,"content":15523,"nodeType":881},{},[15524],{"data":15525,"marks":15526,"value":11386,"nodeType":865},{},[15527,15528],{"type":902},{"type":874},{"data":15530,"content":15531,"nodeType":881},{},[15532],{"data":15533,"marks":15534,"value":11393,"nodeType":865},{},[],{"data":15536,"content":15537,"nodeType":1818},{},[15538,15551,15564],{"data":15539,"content":15540,"nodeType":1734},{},[15541],{"data":15542,"content":15543,"nodeType":881},{},[15544,15548],{"data":15545,"marks":15546,"value":11407,"nodeType":865},{},[15547],{"type":902},{"data":15549,"marks":15550,"value":11411,"nodeType":865},{},[],{"data":15552,"content":15553,"nodeType":1734},{},[15554],{"data":15555,"content":15556,"nodeType":881},{},[15557,15561],{"data":15558,"marks":15559,"value":11422,"nodeType":865},{},[15560],{"type":902},{"data":15562,"marks":15563,"value":11426,"nodeType":865},{},[],{"data":15565,"content":15566,"nodeType":1734},{},[15567],{"data":15568,"content":15569,"nodeType":881},{},[15570,15574,15577,15583],{"data":15571,"marks":15572,"value":11437,"nodeType":865},{},[15573],{"type":902},{"data":15575,"marks":15576,"value":11441,"nodeType":865},{},[],{"data":15578,"content":15579,"nodeType":876},{"uri":11444},[15580],{"data":15581,"marks":15582,"value":11449,"nodeType":865},{},[],{"data":15584,"marks":15585,"value":11453,"nodeType":865},{},[],{"data":15587,"content":15590,"nodeType":890},{"target":15588},{"sys":15589},{"id":11458,"type":887,"linkType":888},[],{"data":15592,"content":15593,"nodeType":894},{},[],{"data":15595,"content":15596,"nodeType":1860},{},[15597],{"data":15598,"marks":15599,"value":699,"nodeType":865},{},[15600],{"type":902},{"data":15602,"content":15603,"nodeType":881},{},[15604],{"data":15605,"marks":15606,"value":11478,"nodeType":865},{},[15607,15608],{"type":902},{"type":874},{"data":15610,"content":15611,"nodeType":881},{},[15612],{"data":15613,"marks":15614,"value":11485,"nodeType":865},{},[],{"data":15616,"content":15619,"nodeType":890},{"target":15617},{"sys":15618},{"id":11490,"type":887,"linkType":888},[],{"data":15621,"content":15622,"nodeType":894},{},[],{"data":15624,"content":15625,"nodeType":904},{},[15626],{"data":15627,"marks":15628,"value":11502,"nodeType":865},{},[15629],{"type":902},{"data":15631,"content":15632,"nodeType":881},{},[15633],{"data":15634,"marks":15635,"value":11509,"nodeType":865},{},[],{"data":15637,"content":15638,"nodeType":881},{},[15639],{"data":15640,"marks":15641,"value":11516,"nodeType":865},{},[],{"data":15643,"content":15644,"nodeType":1818},{},[15645,15664,15683],{"data":15646,"content":15647,"nodeType":1734},{},[15648],{"data":15649,"content":15650,"nodeType":881},{},[15651,15654,15661],{"data":15652,"marks":15653,"value":11529,"nodeType":865},{},[],{"data":15655,"content":15656,"nodeType":876},{"uri":11532},[15657],{"data":15658,"marks":15659,"value":1718,"nodeType":865},{},[15660],{"type":874},{"data":15662,"marks":15663,"value":11541,"nodeType":865},{},[],{"data":15665,"content":15666,"nodeType":1734},{},[15667],{"data":15668,"content":15669,"nodeType":881},{},[15670,15673,15680],{"data":15671,"marks":15672,"value":11551,"nodeType":865},{},[],{"data":15674,"content":15675,"nodeType":876},{"uri":11554},[15676],{"data":15677,"marks":15678,"value":11560,"nodeType":865},{},[15679],{"type":874},{"data":15681,"marks":15682,"value":11541,"nodeType":865},{},[],{"data":15684,"content":15685,"nodeType":1734},{},[15686],{"data":15687,"content":15688,"nodeType":881},{},[15689,15692,15699],{"data":15690,"marks":15691,"value":11573,"nodeType":865},{},[],{"data":15693,"content":15694,"nodeType":876},{"uri":11576},[15695],{"data":15696,"marks":15697,"value":11582,"nodeType":865},{},[15698],{"type":874},{"data":15700,"marks":15701,"value":11541,"nodeType":865},{},[],{"data":15703,"content":15704,"nodeType":881},{},[15705],{"data":15706,"marks":15707,"value":11592,"nodeType":865},{},[],{"data":15709,"content":15710,"nodeType":1818},{},[15711,15724,15737,15750],{"data":15712,"content":15713,"nodeType":1734},{},[15714],{"data":15715,"content":15716,"nodeType":881},{},[15717,15721],{"data":15718,"marks":15719,"value":11606,"nodeType":865},{},[15720],{"type":902},{"data":15722,"marks":15723,"value":11610,"nodeType":865},{},[],{"data":15725,"content":15726,"nodeType":1734},{},[15727],{"data":15728,"content":15729,"nodeType":881},{},[15730,15734],{"data":15731,"marks":15732,"value":11621,"nodeType":865},{},[15733],{"type":902},{"data":15735,"marks":15736,"value":11625,"nodeType":865},{},[],{"data":15738,"content":15739,"nodeType":1734},{},[15740],{"data":15741,"content":15742,"nodeType":881},{},[15743,15747],{"data":15744,"marks":15745,"value":11636,"nodeType":865},{},[15746],{"type":902},{"data":15748,"marks":15749,"value":11640,"nodeType":865},{},[],{"data":15751,"content":15752,"nodeType":1734},{},[15753],{"data":15754,"content":15755,"nodeType":881},{},[15756,15760],{"data":15757,"marks":15758,"value":11651,"nodeType":865},{},[15759],{"type":902},{"data":15761,"marks":15762,"value":11655,"nodeType":865},{},[],{"data":15764,"content":15765,"nodeType":881},{},[15766],{"data":15767,"marks":15768,"value":11662,"nodeType":865},{},[],{"data":15770,"content":15771,"nodeType":894},{},[],{"data":15773,"content":15774,"nodeType":904},{},[15775],{"data":15776,"marks":15777,"value":11673,"nodeType":865},{},[15778],{"type":902},{"data":15780,"content":15781,"nodeType":881},{},[15782],{"data":15783,"marks":15784,"value":11680,"nodeType":865},{},[],{"data":15786,"content":15787,"nodeType":881},{},[15788],{"data":15789,"marks":15790,"value":11687,"nodeType":865},{},[],{"data":15792,"content":15795,"nodeType":890},{"target":15793},{"sys":15794},{"id":11692,"type":887,"linkType":888},[],{"data":15797,"content":15798,"nodeType":894},{},[],{"data":15800,"content":15801,"nodeType":904},{},[15802],{"data":15803,"marks":15804,"value":5936,"nodeType":865},{},[15805],{"type":902},{"data":15807,"content":15808,"nodeType":881},{},[15809],{"data":15810,"marks":15811,"value":11710,"nodeType":865},{},[],{"data":15813,"content":15814,"nodeType":881},{},[15815],{"data":15816,"marks":15817,"value":11717,"nodeType":865},{},[],{"data":15819,"content":15820,"nodeType":881},{},[15821],{"data":15822,"marks":15823,"value":11724,"nodeType":865},{},[],{"data":15825,"content":15826,"nodeType":881},{},[15827,15830,15837,15840,15847],{"data":15828,"marks":15829,"value":4462,"nodeType":865},{},[],{"data":15831,"content":15832,"nodeType":876},{"uri":4465},[15833],{"data":15834,"marks":15835,"value":4471,"nodeType":865},{},[15836],{"type":874},{"data":15838,"marks":15839,"value":8048,"nodeType":865},{},[],{"data":15841,"content":15842,"nodeType":876},{"uri":1453},[15843],{"data":15844,"marks":15845,"value":4495,"nodeType":865},{},[15846],{"type":874},{"data":15848,"marks":15849,"value":959,"nodeType":865},{},[],{"items":15851},[15852,15854],{"sys":15853,"name":4507},{"id":4506},{"sys":15855,"name":342},{"id":4510},{"items":15857},[15858],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":15859},{"url":5377},{"__typename":1485,"sys":15861,"content":15862,"title":8071,"synopsis":8072,"hashTags":59,"publishedDate":8073,"slug":8074,"tagsCollection":16598,"authorsCollection":16604},{"id":7222},{"json":15863},{"data":15864,"content":15865,"nodeType":1463},{},[15866,15873,15879,15885,15891,15901,15907,15912,15917,15920,15927,15933,15939,15944,15960,15966,15971,15977,15982,15988,16027,16032,16037,16043,16049,16052,16059,16075,16081,16086,16102,16107,16123,16129,16132,16139,16145,16181,16191,16194,16201,16216,16222,16235,16241,16247,16252,16258,16261,16268,16274,16322,16328,16331,16338,16343,16349,16355,16360,16366,16395,16401,16407,16412,16418,16423,16430,16446,16452,16482,16488,16518,16521,16528,16534,16539,16555,16561,16587,16592],{"data":15867,"content":15868,"nodeType":904},{},[15869],{"data":15870,"marks":15871,"value":7234,"nodeType":865},{},[15872],{"type":902},{"data":15874,"content":15875,"nodeType":881},{},[15876],{"data":15877,"marks":15878,"value":7241,"nodeType":865},{},[],{"data":15880,"content":15881,"nodeType":881},{},[15882],{"data":15883,"marks":15884,"value":7248,"nodeType":865},{},[],{"data":15886,"content":15887,"nodeType":881},{},[15888],{"data":15889,"marks":15890,"value":7255,"nodeType":865},{},[],{"data":15892,"content":15893,"nodeType":881},{},[15894,15898],{"data":15895,"marks":15896,"value":7263,"nodeType":865},{},[15897],{"type":902},{"data":15899,"marks":15900,"value":7267,"nodeType":865},{},[],{"data":15902,"content":15903,"nodeType":881},{},[15904],{"data":15905,"marks":15906,"value":7274,"nodeType":865},{},[],{"data":15908,"content":15911,"nodeType":890},{"target":15909},{"sys":15910},{"id":7279,"type":887,"linkType":888},[],{"data":15913,"content":15916,"nodeType":890},{"target":15914},{"sys":15915},{"id":7285,"type":887,"linkType":888},[],{"data":15918,"content":15919,"nodeType":894},{},[],{"data":15921,"content":15922,"nodeType":904},{},[15923],{"data":15924,"marks":15925,"value":7297,"nodeType":865},{},[15926],{"type":902},{"data":15928,"content":15929,"nodeType":881},{},[15930],{"data":15931,"marks":15932,"value":7304,"nodeType":865},{},[],{"data":15934,"content":15935,"nodeType":881},{},[15936],{"data":15937,"marks":15938,"value":7311,"nodeType":865},{},[],{"data":15940,"content":15943,"nodeType":890},{"target":15941},{"sys":15942},{"id":7316,"type":887,"linkType":888},[],{"data":15945,"content":15946,"nodeType":881},{},[15947,15950,15957],{"data":15948,"marks":15949,"value":7324,"nodeType":865},{},[],{"data":15951,"content":15952,"nodeType":876},{"uri":7327},[15953],{"data":15954,"marks":15955,"value":7333,"nodeType":865},{},[15956],{"type":874},{"data":15958,"marks":15959,"value":7337,"nodeType":865},{},[],{"data":15961,"content":15962,"nodeType":881},{},[15963],{"data":15964,"marks":15965,"value":7344,"nodeType":865},{},[],{"data":15967,"content":15970,"nodeType":890},{"target":15968},{"sys":15969},{"id":7349,"type":887,"linkType":888},[],{"data":15972,"content":15973,"nodeType":881},{},[15974],{"data":15975,"marks":15976,"value":7357,"nodeType":865},{},[],{"data":15978,"content":15981,"nodeType":890},{"target":15979},{"sys":15980},{"id":7362,"type":887,"linkType":888},[],{"data":15983,"content":15984,"nodeType":881},{},[15985],{"data":15986,"marks":15987,"value":7370,"nodeType":865},{},[],{"data":15989,"content":15990,"nodeType":1818},{},[15991,16000,16009,16018],{"data":15992,"content":15993,"nodeType":1734},{},[15994],{"data":15995,"content":15996,"nodeType":881},{},[15997],{"data":15998,"marks":15999,"value":7383,"nodeType":865},{},[],{"data":16001,"content":16002,"nodeType":1734},{},[16003],{"data":16004,"content":16005,"nodeType":881},{},[16006],{"data":16007,"marks":16008,"value":7393,"nodeType":865},{},[],{"data":16010,"content":16011,"nodeType":1734},{},[16012],{"data":16013,"content":16014,"nodeType":881},{},[16015],{"data":16016,"marks":16017,"value":7403,"nodeType":865},{},[],{"data":16019,"content":16020,"nodeType":1734},{},[16021],{"data":16022,"content":16023,"nodeType":881},{},[16024],{"data":16025,"marks":16026,"value":7413,"nodeType":865},{},[],{"data":16028,"content":16031,"nodeType":890},{"target":16029},{"sys":16030},{"id":7418,"type":887,"linkType":888},[],{"data":16033,"content":16036,"nodeType":890},{"target":16034},{"sys":16035},{"id":7424,"type":887,"linkType":888},[],{"data":16038,"content":16039,"nodeType":881},{},[16040],{"data":16041,"marks":16042,"value":7432,"nodeType":865},{},[],{"data":16044,"content":16045,"nodeType":881},{},[16046],{"data":16047,"marks":16048,"value":7439,"nodeType":865},{},[],{"data":16050,"content":16051,"nodeType":894},{},[],{"data":16053,"content":16054,"nodeType":904},{},[16055],{"data":16056,"marks":16057,"value":7450,"nodeType":865},{},[16058],{"type":902},{"data":16060,"content":16061,"nodeType":881},{},[16062,16065,16072],{"data":16063,"marks":16064,"value":7457,"nodeType":865},{},[],{"data":16066,"content":16067,"nodeType":876},{"uri":7460},[16068],{"data":16069,"marks":16070,"value":7466,"nodeType":865},{},[16071],{"type":874},{"data":16073,"marks":16074,"value":7470,"nodeType":865},{},[],{"data":16076,"content":16077,"nodeType":881},{},[16078],{"data":16079,"marks":16080,"value":7477,"nodeType":865},{},[],{"data":16082,"content":16085,"nodeType":890},{"target":16083},{"sys":16084},{"id":7482,"type":887,"linkType":888},[],{"data":16087,"content":16088,"nodeType":881},{},[16089,16092,16099],{"data":16090,"marks":16091,"value":7490,"nodeType":865},{},[],{"data":16093,"content":16094,"nodeType":876},{"uri":1139},[16095],{"data":16096,"marks":16097,"value":7498,"nodeType":865},{},[16098],{"type":874},{"data":16100,"marks":16101,"value":959,"nodeType":865},{},[],{"data":16103,"content":16106,"nodeType":890},{"target":16104},{"sys":16105},{"id":7506,"type":887,"linkType":888},[],{"data":16108,"content":16109,"nodeType":881},{},[16110,16113,16120],{"data":16111,"marks":16112,"value":7514,"nodeType":865},{},[],{"data":16114,"content":16115,"nodeType":876},{"uri":7517},[16116],{"data":16117,"marks":16118,"value":441,"nodeType":865},{},[16119],{"type":874},{"data":16121,"marks":16122,"value":7526,"nodeType":865},{},[],{"data":16124,"content":16125,"nodeType":881},{},[16126],{"data":16127,"marks":16128,"value":7533,"nodeType":865},{},[],{"data":16130,"content":16131,"nodeType":894},{},[],{"data":16133,"content":16134,"nodeType":904},{},[16135],{"data":16136,"marks":16137,"value":7544,"nodeType":865},{},[16138],{"type":902},{"data":16140,"content":16141,"nodeType":881},{},[16142],{"data":16143,"marks":16144,"value":7551,"nodeType":865},{},[],{"data":16146,"content":16147,"nodeType":881},{},[16148,16151,16158,16161,16168,16171,16178],{"data":16149,"marks":16150,"value":7558,"nodeType":865},{},[],{"data":16152,"content":16153,"nodeType":876},{"uri":7561},[16154],{"data":16155,"marks":16156,"value":7567,"nodeType":865},{},[16157],{"type":874},{"data":16159,"marks":16160,"value":1651,"nodeType":865},{},[],{"data":16162,"content":16163,"nodeType":876},{"uri":7573},[16164],{"data":16165,"marks":16166,"value":1307,"nodeType":865},{},[16167],{"type":874},{"data":16169,"marks":16170,"value":7582,"nodeType":865},{},[],{"data":16172,"content":16173,"nodeType":876},{"uri":7585},[16174],{"data":16175,"marks":16176,"value":7591,"nodeType":865},{},[16177],{"type":874},{"data":16179,"marks":16180,"value":7595,"nodeType":865},{},[],{"data":16182,"content":16183,"nodeType":881},{},[16184,16187],{"data":16185,"marks":16186,"value":7602,"nodeType":865},{},[],{"data":16188,"marks":16189,"value":7607,"nodeType":865},{},[16190],{"type":902},{"data":16192,"content":16193,"nodeType":894},{},[],{"data":16195,"content":16196,"nodeType":904},{},[16197],{"data":16198,"marks":16199,"value":7618,"nodeType":865},{},[16200],{"type":902},{"data":16202,"content":16203,"nodeType":881},{},[16204,16207,16213],{"data":16205,"marks":16206,"value":7625,"nodeType":865},{},[],{"data":16208,"content":16209,"nodeType":876},{"uri":1022},[16210],{"data":16211,"marks":16212,"value":1951,"nodeType":865},{},[],{"data":16214,"marks":16215,"value":7635,"nodeType":865},{},[],{"data":16217,"content":16218,"nodeType":881},{},[16219],{"data":16220,"marks":16221,"value":7642,"nodeType":865},{},[],{"data":16223,"content":16224,"nodeType":881},{},[16225,16228,16232],{"data":16226,"marks":16227,"value":7649,"nodeType":865},{},[],{"data":16229,"marks":16230,"value":7654,"nodeType":865},{},[16231],{"type":902},{"data":16233,"marks":16234,"value":7658,"nodeType":865},{},[],{"data":16236,"content":16237,"nodeType":881},{},[16238],{"data":16239,"marks":16240,"value":7665,"nodeType":865},{},[],{"data":16242,"content":16243,"nodeType":881},{},[16244],{"data":16245,"marks":16246,"value":7672,"nodeType":865},{},[],{"data":16248,"content":16251,"nodeType":890},{"target":16249},{"sys":16250},{"id":7677,"type":887,"linkType":888},[],{"data":16253,"content":16254,"nodeType":881},{},[16255],{"data":16256,"marks":16257,"value":7685,"nodeType":865},{},[],{"data":16259,"content":16260,"nodeType":894},{},[],{"data":16262,"content":16263,"nodeType":904},{},[16264],{"data":16265,"marks":16266,"value":7696,"nodeType":865},{},[16267],{"type":902},{"data":16269,"content":16270,"nodeType":881},{},[16271],{"data":16272,"marks":16273,"value":7703,"nodeType":865},{},[],{"data":16275,"content":16276,"nodeType":1818},{},[16277,16286,16295,16304,16313],{"data":16278,"content":16279,"nodeType":1734},{},[16280],{"data":16281,"content":16282,"nodeType":881},{},[16283],{"data":16284,"marks":16285,"value":7716,"nodeType":865},{},[],{"data":16287,"content":16288,"nodeType":1734},{},[16289],{"data":16290,"content":16291,"nodeType":881},{},[16292],{"data":16293,"marks":16294,"value":7726,"nodeType":865},{},[],{"data":16296,"content":16297,"nodeType":1734},{},[16298],{"data":16299,"content":16300,"nodeType":881},{},[16301],{"data":16302,"marks":16303,"value":7736,"nodeType":865},{},[],{"data":16305,"content":16306,"nodeType":1734},{},[16307],{"data":16308,"content":16309,"nodeType":881},{},[16310],{"data":16311,"marks":16312,"value":7746,"nodeType":865},{},[],{"data":16314,"content":16315,"nodeType":1734},{},[16316],{"data":16317,"content":16318,"nodeType":881},{},[16319],{"data":16320,"marks":16321,"value":7756,"nodeType":865},{},[],{"data":16323,"content":16324,"nodeType":881},{},[16325],{"data":16326,"marks":16327,"value":7763,"nodeType":865},{},[],{"data":16329,"content":16330,"nodeType":894},{},[],{"data":16332,"content":16333,"nodeType":904},{},[16334],{"data":16335,"marks":16336,"value":7774,"nodeType":865},{},[16337],{"type":902},{"data":16339,"content":16342,"nodeType":890},{"target":16340},{"sys":16341},{"id":7779,"type":887,"linkType":888},[],{"data":16344,"content":16345,"nodeType":881},{},[16346],{"data":16347,"marks":16348,"value":7787,"nodeType":865},{},[],{"data":16350,"content":16351,"nodeType":881},{},[16352],{"data":16353,"marks":16354,"value":7794,"nodeType":865},{},[],{"data":16356,"content":16359,"nodeType":890},{"target":16357},{"sys":16358},{"id":7799,"type":887,"linkType":888},[],{"data":16361,"content":16362,"nodeType":881},{},[16363],{"data":16364,"marks":16365,"value":7807,"nodeType":865},{},[],{"data":16367,"content":16368,"nodeType":1818},{},[16369,16382],{"data":16370,"content":16371,"nodeType":1734},{},[16372],{"data":16373,"content":16374,"nodeType":881},{},[16375,16379],{"data":16376,"marks":16377,"value":7821,"nodeType":865},{},[16378],{"type":902},{"data":16380,"marks":16381,"value":7825,"nodeType":865},{},[],{"data":16383,"content":16384,"nodeType":1734},{},[16385],{"data":16386,"content":16387,"nodeType":881},{},[16388,16392],{"data":16389,"marks":16390,"value":7836,"nodeType":865},{},[16391],{"type":902},{"data":16393,"marks":16394,"value":7840,"nodeType":865},{},[],{"data":16396,"content":16397,"nodeType":881},{},[16398],{"data":16399,"marks":16400,"value":7847,"nodeType":865},{},[],{"data":16402,"content":16403,"nodeType":881},{},[16404],{"data":16405,"marks":16406,"value":7854,"nodeType":865},{},[],{"data":16408,"content":16411,"nodeType":890},{"target":16409},{"sys":16410},{"id":7859,"type":887,"linkType":888},[],{"data":16413,"content":16414,"nodeType":881},{},[16415],{"data":16416,"marks":16417,"value":7867,"nodeType":865},{},[],{"data":16419,"content":16422,"nodeType":890},{"target":16420},{"sys":16421},{"id":7872,"type":887,"linkType":888},[],{"data":16424,"content":16425,"nodeType":1860},{},[16426],{"data":16427,"marks":16428,"value":7881,"nodeType":865},{},[16429],{"type":902},{"data":16431,"content":16432,"nodeType":881},{},[16433,16436,16443],{"data":16434,"marks":16435,"value":7888,"nodeType":865},{},[],{"data":16437,"content":16438,"nodeType":876},{"uri":7891},[16439],{"data":16440,"marks":16441,"value":7897,"nodeType":865},{},[16442],{"type":874},{"data":16444,"marks":16445,"value":7901,"nodeType":865},{},[],{"data":16447,"content":16448,"nodeType":881},{},[16449],{"data":16450,"marks":16451,"value":7908,"nodeType":865},{},[],{"data":16453,"content":16454,"nodeType":1818},{},[16455,16464,16473],{"data":16456,"content":16457,"nodeType":1734},{},[16458],{"data":16459,"content":16460,"nodeType":881},{},[16461],{"data":16462,"marks":16463,"value":7921,"nodeType":865},{},[],{"data":16465,"content":16466,"nodeType":1734},{},[16467],{"data":16468,"content":16469,"nodeType":881},{},[16470],{"data":16471,"marks":16472,"value":7931,"nodeType":865},{},[],{"data":16474,"content":16475,"nodeType":1734},{},[16476],{"data":16477,"content":16478,"nodeType":881},{},[16479],{"data":16480,"marks":16481,"value":7941,"nodeType":865},{},[],{"data":16483,"content":16484,"nodeType":881},{},[16485],{"data":16486,"marks":16487,"value":7948,"nodeType":865},{},[],{"data":16489,"content":16490,"nodeType":1818},{},[16491,16500,16509],{"data":16492,"content":16493,"nodeType":1734},{},[16494],{"data":16495,"content":16496,"nodeType":881},{},[16497],{"data":16498,"marks":16499,"value":7961,"nodeType":865},{},[],{"data":16501,"content":16502,"nodeType":1734},{},[16503],{"data":16504,"content":16505,"nodeType":881},{},[16506],{"data":16507,"marks":16508,"value":7971,"nodeType":865},{},[],{"data":16510,"content":16511,"nodeType":1734},{},[16512],{"data":16513,"content":16514,"nodeType":881},{},[16515],{"data":16516,"marks":16517,"value":7981,"nodeType":865},{},[],{"data":16519,"content":16520,"nodeType":894},{},[],{"data":16522,"content":16523,"nodeType":904},{},[16524],{"data":16525,"marks":16526,"value":7992,"nodeType":865},{},[16527],{"type":902},{"data":16529,"content":16530,"nodeType":881},{},[16531],{"data":16532,"marks":16533,"value":7999,"nodeType":865},{},[],{"data":16535,"content":16538,"nodeType":890},{"target":16536},{"sys":16537},{"id":8004,"type":887,"linkType":888},[],{"data":16540,"content":16541,"nodeType":881},{},[16542,16545,16552],{"data":16543,"marks":16544,"value":8012,"nodeType":865},{},[],{"data":16546,"content":16547,"nodeType":876},{"uri":1022},[16548],{"data":16549,"marks":16550,"value":8020,"nodeType":865},{},[16551],{"type":874},{"data":16553,"marks":16554,"value":8024,"nodeType":865},{},[],{"data":16556,"content":16557,"nodeType":881},{},[16558],{"data":16559,"marks":16560,"value":8031,"nodeType":865},{},[],{"data":16562,"content":16563,"nodeType":881},{},[16564,16567,16574,16577,16584],{"data":16565,"marks":16566,"value":4462,"nodeType":865},{},[],{"data":16568,"content":16569,"nodeType":876},{"uri":4465},[16570],{"data":16571,"marks":16572,"value":4471,"nodeType":865},{},[16573],{"type":874},{"data":16575,"marks":16576,"value":8048,"nodeType":865},{},[],{"data":16578,"content":16579,"nodeType":876},{"uri":1453},[16580],{"data":16581,"marks":16582,"value":4495,"nodeType":865},{},[16583],{"type":874},{"data":16585,"marks":16586,"value":959,"nodeType":865},{},[],{"data":16588,"content":16591,"nodeType":890},{"target":16589},{"sys":16590},{"id":8063,"type":887,"linkType":888},[],{"data":16593,"content":16594,"nodeType":881},{},[16595],{"data":16596,"marks":16597,"value":21,"nodeType":865},{},[],{"items":16599},[16600,16602],{"sys":16601,"name":4507},{"id":4506},{"sys":16603,"name":342},{"id":4510},{"items":16605},[16606],{"fullName":4514,"firstName":4515,"jobTitle":4516,"profilePicture":16607},{"url":4518},{"__typename":1485,"sys":16609,"content":16611,"title":17221,"synopsis":17222,"hashTags":59,"publishedDate":17223,"slug":17224,"tagsCollection":17225,"authorsCollection":17231},{"id":16610},"44DXq5ZkL9XQV5Fngto0XZ",{"json":16612},{"data":16613,"content":16614,"nodeType":1463},{},[16615,16632,16639,16646,16649,16657,16677,16696,16730,16736,16739,16747,16755,16762,16780,16787,16792,16798,16805,16812,16820,16827,16834,16840,16847,16867,16875,16882,16889,16909,16915,16935,16941,16948,16954,16957,16965,16972,16991,16998,17025,17032,17040,17043,17051,17058,17065,17071,17078,17123,17129,17136,17168,17174,17215],{"data":16616,"content":16617,"nodeType":881},{},[16618,16621,16628],{"data":16619,"marks":16620,"value":21,"nodeType":865},{},[],{"data":16622,"content":16623,"nodeType":876},{"uri":1747},[16624],{"data":16625,"marks":16626,"value":1752,"nodeType":865},{},[16627],{"type":874},{"data":16629,"marks":16630,"value":16631,"nodeType":865},{},[]," are running a large-scale hybrid vishing plus AiTM phishing campaign across several industry verticals, targeting Okta, Entra, and Google SSO platforms. ",{"data":16633,"content":16634,"nodeType":881},{},[16635],{"data":16636,"marks":16637,"value":16638,"nodeType":865},{},[],"The attacks begin with the attacker calling their victim, impersonating IT staff from their company. They offer to help the employee set up passkeys for logging into the enterprise SSO service, tricking the victim into visiting a specially crafted adversary-in-the-middle phishing site that captures their SSO credentials, MFA codes, and ultimately live session access. ",{"data":16640,"content":16641,"nodeType":881},{},[16642],{"data":16643,"marks":16644,"value":16645,"nodeType":865},{},[],"Once an account is stolen, the attacker logs in to the SSO dashboard to see which platforms they have access to and then proceeds to steal data from them — with the ultimate goal of extorting victims. ",{"data":16647,"content":16648,"nodeType":894},{},[],{"data":16650,"content":16651,"nodeType":904},{},[16652],{"data":16653,"marks":16654,"value":16656,"nodeType":865},{},[16655],{"type":902},"What we know",{"data":16658,"content":16659,"nodeType":881},{},[16660,16664,16673],{"data":16661,"marks":16662,"value":16663,"nodeType":865},{},[],"To date, ",{"data":16665,"content":16667,"nodeType":876},{"uri":16666},"https://www.silentpush.com/blog/slsh-alert/",[16668],{"data":16669,"marks":16670,"value":16672,"nodeType":865},{},[16671],{"type":874},"100+ companies have been targeted",{"data":16674,"marks":16675,"value":16676,"nodeType":865},{},[],", with infrastructure and domains impersonating their brand to be used in legit-looking campaigns against them. The reality is that the list of targets could be more extensive, and will continue to increase over time. ",{"data":16678,"content":16679,"nodeType":881},{},[16680,16684,16692],{"data":16681,"marks":16682,"value":16683,"nodeType":865},{},[],"SLH ",{"data":16685,"content":16686,"nodeType":876},{"uri":11210},[16687],{"data":16688,"marks":16689,"value":16691,"nodeType":865},{},[16690],{"type":874},"claims to be using data stolen in previous breaches",{"data":16693,"marks":16694,"value":16695,"nodeType":865},{},[],", such as the widespread Salesforce data theft attacks reported in 2025, to identify and contact employees. This data includes phone numbers, job titles, names, and other details used to make the social engineering calls more convincing.",{"data":16697,"content":16698,"nodeType":881},{},[16699,16703,16708,16712,16717,16721,16726],{"data":16700,"marks":16701,"value":16702,"nodeType":865},{},[],"The group recently relaunched its Tor data leak site, which currently lists breaches at ",{"data":16704,"marks":16705,"value":16707,"nodeType":865},{},[16706],{"type":902},"Betterment",{"data":16709,"marks":16710,"value":16711,"nodeType":865},{},[]," (20 million records containing PII), ",{"data":16713,"marks":16714,"value":16716,"nodeType":865},{},[16715],{"type":902},"Crunchbase",{"data":16718,"marks":16719,"value":16720,"nodeType":865},{},[]," (2 million records containing PII), and ",{"data":16722,"marks":16723,"value":16725,"nodeType":865},{},[16724],{"type":902},"SoundCloud",{"data":16727,"marks":16728,"value":16729,"nodeType":865},{},[]," (30 million records containing PII). ",{"data":16731,"content":16735,"nodeType":890},{"target":16732},{"sys":16733},{"id":16734,"type":887,"linkType":888},"5scKHYJJleNklGAXNKVc7b",[],{"data":16737,"content":16738,"nodeType":894},{},[],{"data":16740,"content":16741,"nodeType":904},{},[16742],{"data":16743,"marks":16744,"value":16746,"nodeType":865},{},[16745],{"type":902},"What’s new?",{"data":16748,"content":16749,"nodeType":1860},{},[16750],{"data":16751,"marks":16752,"value":16754,"nodeType":865},{},[16753],{"type":902},"The best of both worlds? Vishing + AiTM phishing",{"data":16756,"content":16757,"nodeType":881},{},[16758],{"data":16759,"marks":16760,"value":16761,"nodeType":865},{},[],"SLH and threat actors affiliated with “The Com” are no stranger to voice phishing (vishing) or the use of MFA-bypassing Attacker-in-the-Middle (AitM) phishing kits. ",{"data":16763,"content":16764,"nodeType":881},{},[16765,16768,16776],{"data":16766,"marks":16767,"value":21,"nodeType":865},{},[],{"data":16769,"content":16770,"nodeType":876},{"uri":1747},[16771],{"data":16772,"marks":16773,"value":16775,"nodeType":865},{},[16774],{"type":874},"SLH and it’s precursor groups",{"data":16777,"marks":16778,"value":16779,"nodeType":865},{},[]," leveraged vishing to great success in the form of help desk impersonation and password/MFA reset attacks as seen in the high profile Marks & Spencer, Co-Op, and Jaguar Land Rover attacks in 2025, as well as the Caesars and MGM attacks in 2023. MFA-bypassing phishing techniques have also long been a part of their arsenal, from the 2022 0ktapus phishing campaign to more recent use of modern AiTM phishing kits. ",{"data":16781,"content":16782,"nodeType":881},{},[16783],{"data":16784,"marks":16785,"value":16786,"nodeType":865},{},[],"But until now, we haven’t seen them used together. ",{"data":16788,"content":16791,"nodeType":890},{"target":16789},{"sys":16790},{"id":10969,"type":887,"linkType":888},[],{"data":16793,"content":16797,"nodeType":890},{"target":16794},{"sys":16795},{"id":16796,"type":887,"linkType":888},"1IDsaYD3H5MjvPS4ekcUhU",[],{"data":16799,"content":16800,"nodeType":881},{},[16801],{"data":16802,"marks":16803,"value":16804,"nodeType":865},{},[],"It makes sense to combine these methods. AiTM phishing kits are flexible, highly customizable, and can be used to target a broad range of apps — including all of the major IdP platforms used for SSO. Vishing on the other hand is proven to increase the effectiveness of social engineering attacks when performed by an effective operator — which SLH are proven to be (helped by predominantly native English speakers making up their membership, along with the use of effective voice phishing tools). ",{"data":16806,"content":16807,"nodeType":881},{},[16808],{"data":16809,"marks":16810,"value":16811,"nodeType":865},{},[],"Both vishing and AiTM phishing are identity-first methods that consciously evade traditional security tools and detection controls at the endpoint and network layer. This makes them highly effective in today’s IT environment. ",{"data":16813,"content":16814,"nodeType":1860},{},[16815],{"data":16816,"marks":16817,"value":16819,"nodeType":865},{},[16818],{"type":902},"A new kind of operator-driven AiTM kit",{"data":16821,"content":16822,"nodeType":881},{},[16823],{"data":16824,"marks":16825,"value":16826,"nodeType":865},{},[],"Another unique part about this campaign is that it uses a “live phishing panel” — i.e. a customizable phishing page controlled by the attacker in real time. This enables attackers to dynamically change what a victim sees on a phishing site while speaking to them on the phone. This allows them to guide victims through each step of the login and MFA authentication process.",{"data":16828,"content":16829,"nodeType":881},{},[16830],{"data":16831,"marks":16832,"value":16833,"nodeType":865},{},[],"This is principally to increase the victim’s likelihood of engaging with the phishing page. As you can see in the image below, there are several options that can be presented to the victim — including not just the normal phishing stages of entering credentials and passing MFA checks, but also post-compromise actions (e.g. creating a passkey that would then be controlled by the attacker for persistent access even if an account password is reset). ",{"data":16835,"content":16839,"nodeType":890},{"target":16836},{"sys":16837},{"id":16838,"type":887,"linkType":888},"73Y2n3tRkGFtfhrA2AVJyv",[],{"data":16841,"content":16842,"nodeType":881},{},[16843],{"data":16844,"marks":16845,"value":16846,"nodeType":865},{},[],"At the end of the authentication flow, the threat actor can choose to redirect their target to a “support ticket\" closure screen. This allows the threat actor to manually terminate the session once the compromise is complete while providing the targeted user with context that matches the \"IT support\" ruse. This further reduces the likelihood of post-hoc reporting by a suspicious victim.",{"data":16848,"content":16849,"nodeType":881},{},[16850,16854,16863],{"data":16851,"marks":16852,"value":16853,"nodeType":865},{},[],"Given that this modular, operator-controlled phishing kit is reportedly available “",{"data":16855,"content":16857,"nodeType":876},{"uri":16856},"https://www.okta.com/blog/threat-intelligence/phishing-kits-adapt-to-the-script-of-callers/",[16858],{"data":16859,"marks":16860,"value":16862,"nodeType":865},{},[16861],{"type":874},"as a service",{"data":16864,"marks":16865,"value":16866,"nodeType":865},{},[],"” for criminals, we should expect to see much more of this in future. ",{"data":16868,"content":16869,"nodeType":1860},{},[16870],{"data":16871,"marks":16872,"value":16874,"nodeType":865},{},[16873],{"type":902},"0ktapus 2.0?",{"data":16876,"content":16877,"nodeType":881},{},[16878],{"data":16879,"marks":16880,"value":16881,"nodeType":865},{},[],"As we mentioned earlier, Scattered Spider made their reputation launching phishing attacks against Okta accounts in the 2022 0ktapus campaign. ",{"data":16883,"content":16884,"nodeType":881},{},[16885],{"data":16886,"marks":16887,"value":16888,"nodeType":865},{},[],"The vast majority of phishing attacks target IdP accounts because of the widespread access to downstream apps they grant via SSO. ",{"data":16890,"content":16891,"nodeType":881},{},[16892,16896,16905],{"data":16893,"marks":16894,"value":16895,"nodeType":865},{},[],"This comes at the same time as ",{"data":16897,"content":16899,"nodeType":876},{"uri":16898},"https://www.bleepingcomputer.com/news/security/fake-lastpass-emails-pose-as-password-vault-backup-alerts/",[16900],{"data":16901,"marks":16902,"value":16904,"nodeType":865},{},[16903],{"type":874},"attackers running campaigns to target LastPass master passwords",{"data":16906,"marks":16907,"value":16908,"nodeType":865},{},[],". This provides a similar level of access to apps in the form of credentials (and sometimes saved passkeys). ",{"data":16910,"content":16914,"nodeType":890},{"target":16911},{"sys":16912},{"id":16913,"type":887,"linkType":888},"1vyu5WvdktTnC24TkVFqfs",[],{"data":16916,"content":16917,"nodeType":881},{},[16918,16922,16931],{"data":16919,"marks":16920,"value":16921,"nodeType":865},{},[],"Not only is this a goldmine for attackers looking to steal data or pivot to other systems to be able to launch further attacks (e.g. pivoting to cloud and on-prem services for ransomware deployment) but it’s a nightmare for incident responders. If an attacker can access an app and create a backdoor login method (AKA. a ",{"data":16923,"content":16925,"nodeType":876},{"uri":16924},"https://pushsecurity.com/blog/ghost-logins-when-forgotten-identities-come-back-to-haunt-you/",[16926],{"data":16927,"marks":16928,"value":16930,"nodeType":865},{},[16929],{"type":874},"ghost login",{"data":16932,"marks":16933,"value":16934,"nodeType":865},{},[],") it can be very difficult for a security team to identify and clean them up. ",{"data":16936,"content":16940,"nodeType":890},{"target":16937},{"sys":16938},{"id":16939,"type":887,"linkType":888},"7tILkroPw9w0WLIo1bVV24",[],{"data":16942,"content":16943,"nodeType":881},{},[16944],{"data":16945,"marks":16946,"value":16947,"nodeType":865},{},[],"Check out the excerpt from one of our recent webinars below for more information. ",{"data":16949,"content":16953,"nodeType":890},{"target":16950},{"sys":16951},{"id":16952,"type":887,"linkType":888},"5IVkapjwLp1Ys14vXagQRD",[],{"data":16955,"content":16956,"nodeType":894},{},[],{"data":16958,"content":16959,"nodeType":904},{},[16960],{"data":16961,"marks":16962,"value":16964,"nodeType":865},{},[16963],{"type":902},"Impact analysis",{"data":16966,"content":16967,"nodeType":881},{},[16968],{"data":16969,"marks":16970,"value":16971,"nodeType":865},{},[],"This combination of methods is likely to increase the success of these malicious campaigns as well as reducing the likelihood of detection. ",{"data":16973,"content":16974,"nodeType":881},{},[16975,16979,16987],{"data":16976,"marks":16977,"value":16978,"nodeType":865},{},[],"It’s well documented that modern phishing attacks use a wide and ever-expanding range of ",{"data":16980,"content":16982,"nodeType":876},{"uri":16981},"https://pushsecurity.com/blog/phishing-detection-evasion-launch/",[16983],{"data":16984,"marks":16985,"value":1951,"nodeType":865},{},[16986],{"type":874},{"data":16988,"marks":16989,"value":16990,"nodeType":865},{},[]," — from implementing legitimate bot protection technologies to prevent analysis, to only loading pages if the correct parameters are met — such as coming through a specific URL redirect path, and adhering to “normal” browser configs (excluding unusual browser window sizes and the presence of security analysis tools).",{"data":16992,"content":16993,"nodeType":881},{},[16994],{"data":16995,"marks":16996,"value":16997,"nodeType":865},{},[],"In this case, the malicious payload will only trigger in the event that the delivery is approved by an operator in real time. This means that anyone attempting to find and proactively block a phishing page based on indicators of known-bad is going to have a tough time finding and flagging them. If you haven’t got a community of security analysts sharing and tagging samples of malicious pages, it makes it really hard to find and block them at scale before they hit a victim. And if these convincing attacks aren’t being reported, they’re even less likely to be investigated. This is what we mean when we say that most phishing attacks today are effectively zero-day. ",{"data":16999,"content":17000,"nodeType":881},{},[17001,17005,17010,17013,17021],{"data":17002,"marks":17003,"value":17004,"nodeType":865},{},[],"In this case, it’s worth pointing out that the phone call is essentially the delivery vector for the phishing page. This means there’s no email to intercept and analyse. This isn’t new — ",{"data":17006,"marks":17007,"value":17009,"nodeType":865},{},[17008],{"type":902},"non-email vectors now account for more than 1 in 3 phishing attacks intercepted by Push",{"data":17011,"marks":17012,"value":1877,"nodeType":865},{},[],{"data":17014,"content":17015,"nodeType":876},{"uri":914},[17016],{"data":17017,"marks":17018,"value":17020,"nodeType":865},{},[17019],{"type":874},"LinkedIn and Google Search being the top culprits",{"data":17022,"marks":17023,"value":17024,"nodeType":865},{},[],". This effectively cuts out the primary phishing detection surface for most organizations.",{"data":17026,"content":17027,"nodeType":881},{},[17028],{"data":17029,"marks":17030,"value":17031,"nodeType":865},{},[],"All this means that unless you’re able to detect and block these attacks in real time, organizations will find themselves unable to counter this evolving threat. ",{"data":17033,"content":17034,"nodeType":881},{},[17035],{"data":17036,"marks":17037,"value":17039,"nodeType":865},{},[17038],{"type":902},"The best/only way to do that is to be in the browser. ",{"data":17041,"content":17042,"nodeType":894},{},[],{"data":17044,"content":17045,"nodeType":904},{},[17046],{"data":17047,"marks":17048,"value":17050,"nodeType":865},{},[17049],{"type":902},"How Push stops the attack",{"data":17052,"content":17053,"nodeType":881},{},[17054],{"data":17055,"marks":17056,"value":17057,"nodeType":865},{},[],"As a browser-based detection and response tool, Push is perfectly positioned to detect and block attacks like this in real-time. ",{"data":17059,"content":17060,"nodeType":881},{},[17061],{"data":17062,"marks":17063,"value":17064,"nodeType":865},{},[],"Push harnesses deep browser telemetry to detect and block phishing based on behaviors, not static indicators. By analyzing how phishing pages behave and how users interact with them, Push uncovers fake pages, attempted credential theft, and phishing kits the moment they load in the browser — regardless of the delivery mechanism, and even when the attack has never been seen before. ",{"data":17066,"content":17070,"nodeType":890},{"target":17067},{"sys":17068},{"id":17069,"type":887,"linkType":888},"2TAKFM1rpETq4KtTY3FPIs",[],{"data":17072,"content":17073,"nodeType":881},{},[17074],{"data":17075,"marks":17076,"value":17077,"nodeType":865},{},[],"Push's browser-based controls include:",{"data":17079,"content":17080,"nodeType":1818},{},[17081,17102],{"data":17082,"content":17083,"nodeType":1734},{},[17084],{"data":17085,"content":17086,"nodeType":881},{},[17087,17090,17098],{"data":17088,"marks":17089,"value":21,"nodeType":865},{},[],{"data":17091,"content":17093,"nodeType":876},{"uri":17092},"https://pushsecurity.com/blog/introducing-sso-password-protection/",[17094],{"data":17095,"marks":17096,"value":17097,"nodeType":865},{},[],"Fingerprinting high-risk app passwords",{"data":17099,"marks":17100,"value":17101,"nodeType":865},{},[]," so they can only be used on a specific domain. Any attempt to reuse this password elsewhere (such as on a phishing site) results in the attempt being blocked. ",{"data":17103,"content":17104,"nodeType":1734},{},[17105],{"data":17106,"content":17107,"nodeType":881},{},[17108,17111,17119],{"data":17109,"marks":17110,"value":21,"nodeType":865},{},[],{"data":17112,"content":17114,"nodeType":876},{"uri":17113},"https://pushsecurity.com/blog/detecting-and-blocking-phishing-attacks-in-the-browser/",[17115],{"data":17116,"marks":17117,"value":17118,"nodeType":865},{},[],"Multiple browser-based checks",{"data":17120,"marks":17121,"value":17122,"nodeType":865},{},[]," looking for indicators of bad, such as cloned elements from legitimate websites, and an ever-growing number of detections relating to phishing kit behaviors and attributes as they are rendered on a page. ",{"data":17124,"content":17128,"nodeType":890},{"target":17125},{"sys":17126},{"id":17127,"type":887,"linkType":888},"4ESxxjTjNwNXGEW4DBcMVV",[],{"data":17130,"content":17131,"nodeType":881},{},[17132],{"data":17133,"marks":17134,"value":17135,"nodeType":865},{},[],"Because Push observes every login made in the browser, you can also use Push to find identities susceptible to phishing attacks, such as those not using phishing-resistant authentication methods (e.g. passkeys), to proactively improve your account hygiene and reduce your attack surface. ",{"data":17137,"content":17138,"nodeType":881},{},[17139,17143,17152,17156,17164],{"data":17140,"marks":17141,"value":17142,"nodeType":865},{},[],"Finally, you can also use our ",{"data":17144,"content":17146,"nodeType":876},{"uri":17145},"https://pushsecurity.com/blog/employee-identity-verification-codes-release/",[17147],{"data":17148,"marks":17149,"value":17151,"nodeType":865},{},[17150],{"type":874},"employee verification codes",{"data":17153,"marks":17154,"value":17155,"nodeType":865},{},[]," feature as part of a layered defense — a simple, browser-based identity check that gives your employees a reliable way to confirm they’re talking to another employee from your organization. It enables employees to quickly verify that a caller is who they say they are by relaying a rotating 6-digit verification code displayed in every employee's browser via the Push extension. This is an effective way of combating ",{"data":17157,"content":17158,"nodeType":876},{"uri":11316},[17159],{"data":17160,"marks":17161,"value":17163,"nodeType":865},{},[17162],{"type":874},"help desk scams",{"data":17165,"marks":17166,"value":17167,"nodeType":865},{},[]," too — another favorite of SLH. ",{"data":17169,"content":17173,"nodeType":890},{"target":17170},{"sys":17171},{"id":17172,"type":887,"linkType":888},"1TEpCjh8UGwmejgYSGC1by",[],{"data":17175,"content":17176,"nodeType":970},{},[17177],{"data":17178,"content":17179,"nodeType":881},{},[17180,17184,17192,17195,17202,17205,17212],{"data":17181,"marks":17182,"value":17183,"nodeType":865},{},[],"Want to learn more about Push? ",{"data":17185,"content":17186,"nodeType":876},{"uri":4465},[17187],{"data":17188,"marks":17189,"value":17191,"nodeType":865},{},[17190],{"type":874},"Check out our latest product overview",{"data":17193,"marks":17194,"value":1877,"nodeType":865},{},[],{"data":17196,"content":17197,"nodeType":876},{"uri":4477},[17198],{"data":17199,"marks":17200,"value":17201,"nodeType":865},{},[],"visit our demo library",{"data":17203,"marks":17204,"value":4487,"nodeType":865},{},[],{"data":17206,"content":17207,"nodeType":876},{"uri":1453},[17208],{"data":17209,"marks":17210,"value":4495,"nodeType":865},{},[17211],{"type":874},{"data":17213,"marks":17214,"value":959,"nodeType":865},{},[],{"data":17216,"content":17217,"nodeType":881},{},[17218],{"data":17219,"marks":17220,"value":21,"nodeType":865},{},[],"Unpacking the latest SLH campaign — combining vishing with AiTM phishing to hijack SSO accounts","Analyzing the latest Scattered Lapsus$ Hunters (SLH) phishing campaign targeting hundreds of organizations.\n","2026-01-28T00:00:00.000Z","unpacking-the-latest-slh-campaign",{"items":17226},[17227,17229],{"sys":17228,"name":4507},{"id":4506},{"sys":17230,"name":342},{"id":4510},{"items":17232},[17233],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":17234},{"url":5377},"blog/device-code-phishing",{"json":17237},{"data":17238,"content":17239,"nodeType":1463},{},[17240],{"data":17241,"content":17242,"nodeType":881},{},[17243],{"data":17244,"marks":17245,"value":17246,"nodeType":865},{},[],"Device code phishing is an account takeover technique that abuses the OAuth 2.0 Device Authorization Grant to steal access tokens while bypassing standard access controls (like passwords, MFA, and even passkeys).",{"id":1487,"publishedAt":17248},"2026-08-12T11:53:02.556Z",{"items":17250},[17251,17253],{"sys":17252,"name":4507},{"id":4506},{"sys":17254,"name":342},{"id":4510},{"items":17256},[17257,17259,17261,17263,17265,17267,17269,17271,17273,17275,17277,17279,17281,17283,17285,17287,17289],{"sys":17258,"name":279,"slug":280,"tier":31},{"id":276},{"sys":17260,"name":519,"slug":520,"tier":31},{"id":516},{"sys":17262,"name":413,"slug":414,"tier":31},{"id":410},{"sys":17264,"name":642,"slug":643,"tier":31},{"id":639},{"sys":17266,"name":342,"slug":343,"tier":31},{"id":339},{"sys":17268,"name":360,"slug":361,"tier":45},{"id":357},{"sys":17270,"name":466,"slug":467,"tier":45},{"id":463},{"sys":17272,"name":484,"slug":485,"tier":45},{"id":481},{"sys":17274,"name":571,"slug":572,"tier":45},{"id":568},{"sys":17276,"name":511,"slug":512,"tier":45},{"id":508},{"sys":17278,"name":607,"slug":608,"tier":45},{"id":604},{"sys":17280,"name":650,"slug":651,"tier":45},{"id":647},{"sys":17282,"name":261,"slug":262,"tier":45},{"id":258},{"sys":17284,"name":493,"slug":494,"tier":45},{"id":490},{"sys":17286,"name":475,"slug":476,"tier":45},{"id":472},{"sys":17288,"name":404,"slug":405,"tier":45},{"id":401},{"sys":17290,"name":315,"slug":316,"tier":45},{"id":312},"8tjCe4rlgxCHc3XVdlvd0ZnFwPabXi2E9C7FD0L6OHs",{"id":17293,"title":17221,"authorsCollection":17294,"content":17299,"extension":228,"faqItemsCollection":17948,"faqTitle":59,"featured":6,"hashTags":59,"meta":17950,"metaTitle":17951,"ogImage":59,"postType":7216,"publishedDate":17223,"relatedBlogPostsCollection":17952,"slug":17224,"stem":20913,"subtitle":59,"summary":20914,"synopsis":17222,"sys":20925,"tagsCollection":20927,"topicsCollection":20933,"__hash__":20969},"blog/blog/unpacking-the-latest-slh-campaign.json",{"items":17295},[17296],{"fullName":5373,"firstName":5374,"jobTitle":5375,"socialLinks":17297,"profilePicture":17298},[6440],{"url":5377},{"json":17300,"links":17822},{"data":17301,"content":17302,"nodeType":1463},{},[17303,17319,17325,17331,17334,17341,17357,17373,17400,17405,17408,17415,17422,17428,17444,17450,17455,17460,17466,17472,17479,17485,17491,17496,17502,17518,17525,17531,17537,17553,17558,17574,17579,17585,17590,17593,17600,17606,17622,17628,17651,17657,17664,17667,17674,17680,17686,17691,17697,17736,17741,17747,17773,17778,17816],{"data":17304,"content":17305,"nodeType":881},{},[17306,17309,17316],{"data":17307,"marks":17308,"value":21,"nodeType":865},{},[],{"data":17310,"content":17311,"nodeType":876},{"uri":1747},[17312],{"data":17313,"marks":17314,"value":1752,"nodeType":865},{},[17315],{"type":874},{"data":17317,"marks":17318,"value":16631,"nodeType":865},{},[],{"data":17320,"content":17321,"nodeType":881},{},[17322],{"data":17323,"marks":17324,"value":16638,"nodeType":865},{},[],{"data":17326,"content":17327,"nodeType":881},{},[17328],{"data":17329,"marks":17330,"value":16645,"nodeType":865},{},[],{"data":17332,"content":17333,"nodeType":894},{},[],{"data":17335,"content":17336,"nodeType":904},{},[17337],{"data":17338,"marks":17339,"value":16656,"nodeType":865},{},[17340],{"type":902},{"data":17342,"content":17343,"nodeType":881},{},[17344,17347,17354],{"data":17345,"marks":17346,"value":16663,"nodeType":865},{},[],{"data":17348,"content":17349,"nodeType":876},{"uri":16666},[17350],{"data":17351,"marks":17352,"value":16672,"nodeType":865},{},[17353],{"type":874},{"data":17355,"marks":17356,"value":16676,"nodeType":865},{},[],{"data":17358,"content":17359,"nodeType":881},{},[17360,17363,17370],{"data":17361,"marks":17362,"value":16683,"nodeType":865},{},[],{"data":17364,"content":17365,"nodeType":876},{"uri":11210},[17366],{"data":17367,"marks":17368,"value":16691,"nodeType":865},{},[17369],{"type":874},{"data":17371,"marks":17372,"value":16695,"nodeType":865},{},[],{"data":17374,"content":17375,"nodeType":881},{},[17376,17379,17383,17386,17390,17393,17397],{"data":17377,"marks":17378,"value":16702,"nodeType":865},{},[],{"data":17380,"marks":17381,"value":16707,"nodeType":865},{},[17382],{"type":902},{"data":17384,"marks":17385,"value":16711,"nodeType":865},{},[],{"data":17387,"marks":17388,"value":16716,"nodeType":865},{},[17389],{"type":902},{"data":17391,"marks":17392,"value":16720,"nodeType":865},{},[],{"data":17394,"marks":17395,"value":16725,"nodeType":865},{},[17396],{"type":902},{"data":17398,"marks":17399,"value":16729,"nodeType":865},{},[],{"data":17401,"content":17404,"nodeType":890},{"target":17402},{"sys":17403},{"id":16734,"type":887,"linkType":888},[],{"data":17406,"content":17407,"nodeType":894},{},[],{"data":17409,"content":17410,"nodeType":904},{},[17411],{"data":17412,"marks":17413,"value":16746,"nodeType":865},{},[17414],{"type":902},{"data":17416,"content":17417,"nodeType":1860},{},[17418],{"data":17419,"marks":17420,"value":16754,"nodeType":865},{},[17421],{"type":902},{"data":17423,"content":17424,"nodeType":881},{},[17425],{"data":17426,"marks":17427,"value":16761,"nodeType":865},{},[],{"data":17429,"content":17430,"nodeType":881},{},[17431,17434,17441],{"data":17432,"marks":17433,"value":21,"nodeType":865},{},[],{"data":17435,"content":17436,"nodeType":876},{"uri":1747},[17437],{"data":17438,"marks":17439,"value":16775,"nodeType":865},{},[17440],{"type":874},{"data":17442,"marks":17443,"value":16779,"nodeType":865},{},[],{"data":17445,"content":17446,"nodeType":881},{},[17447],{"data":17448,"marks":17449,"value":16786,"nodeType":865},{},[],{"data":17451,"content":17454,"nodeType":890},{"target":17452},{"sys":17453},{"id":10969,"type":887,"linkType":888},[],{"data":17456,"content":17459,"nodeType":890},{"target":17457},{"sys":17458},{"id":16796,"type":887,"linkType":888},[],{"data":17461,"content":17462,"nodeType":881},{},[17463],{"data":17464,"marks":17465,"value":16804,"nodeType":865},{},[],{"data":17467,"content":17468,"nodeType":881},{},[17469],{"data":17470,"marks":17471,"value":16811,"nodeType":865},{},[],{"data":17473,"content":17474,"nodeType":1860},{},[17475],{"data":17476,"marks":17477,"value":16819,"nodeType":865},{},[17478],{"type":902},{"data":17480,"content":17481,"nodeType":881},{},[17482],{"data":17483,"marks":17484,"value":16826,"nodeType":865},{},[],{"data":17486,"content":17487,"nodeType":881},{},[17488],{"data":17489,"marks":17490,"value":16833,"nodeType":865},{},[],{"data":17492,"content":17495,"nodeType":890},{"target":17493},{"sys":17494},{"id":16838,"type":887,"linkType":888},[],{"data":17497,"content":17498,"nodeType":881},{},[17499],{"data":17500,"marks":17501,"value":16846,"nodeType":865},{},[],{"data":17503,"content":17504,"nodeType":881},{},[17505,17508,17515],{"data":17506,"marks":17507,"value":16853,"nodeType":865},{},[],{"data":17509,"content":17510,"nodeType":876},{"uri":16856},[17511],{"data":17512,"marks":17513,"value":16862,"nodeType":865},{},[17514],{"type":874},{"data":17516,"marks":17517,"value":16866,"nodeType":865},{},[],{"data":17519,"content":17520,"nodeType":1860},{},[17521],{"data":17522,"marks":17523,"value":16874,"nodeType":865},{},[17524],{"type":902},{"data":17526,"content":17527,"nodeType":881},{},[17528],{"data":17529,"marks":17530,"value":16881,"nodeType":865},{},[],{"data":17532,"content":17533,"nodeType":881},{},[17534],{"data":17535,"marks":17536,"value":16888,"nodeType":865},{},[],{"data":17538,"content":17539,"nodeType":881},{},[17540,17543,17550],{"data":17541,"marks":17542,"value":16895,"nodeType":865},{},[],{"data":17544,"content":17545,"nodeType":876},{"uri":16898},[17546],{"data":17547,"marks":17548,"value":16904,"nodeType":865},{},[17549],{"type":874},{"data":17551,"marks":17552,"value":16908,"nodeType":865},{},[],{"data":17554,"content":17557,"nodeType":890},{"target":17555},{"sys":17556},{"id":16913,"type":887,"linkType":888},[],{"data":17559,"content":17560,"nodeType":881},{},[17561,17564,17571],{"data":17562,"marks":17563,"value":16921,"nodeType":865},{},[],{"data":17565,"content":17566,"nodeType":876},{"uri":16924},[17567],{"data":17568,"marks":17569,"value":16930,"nodeType":865},{},[17570],{"type":874},{"data":17572,"marks":17573,"value":16934,"nodeType":865},{},[],{"data":17575,"content":17578,"nodeType":890},{"target":17576},{"sys":17577},{"id":16939,"type":887,"linkType":888},[],{"data":17580,"content":17581,"nodeType":881},{},[17582],{"data":17583,"marks":17584,"value":16947,"nodeType":865},{},[],{"data":17586,"content":17589,"nodeType":890},{"target":17587},{"sys":17588},{"id":16952,"type":887,"linkType":888},[],{"data":17591,"content":17592,"nodeType":894},{},[],{"data":17594,"content":17595,"nodeType":904},{},[17596],{"data":17597,"marks":17598,"value":16964,"nodeType":865},{},[17599],{"type":902},{"data":17601,"content":17602,"nodeType":881},{},[17603],{"data":17604,"marks":17605,"value":16971,"nodeType":865},{},[],{"data":17607,"content":17608,"nodeType":881},{},[17609,17612,17619],{"data":17610,"marks":17611,"value":16978,"nodeType":865},{},[],{"data":17613,"content":17614,"nodeType":876},{"uri":16981},[17615],{"data":17616,"marks":17617,"value":1951,"nodeType":865},{},[17618],{"type":874},{"data":17620,"marks":17621,"value":16990,"nodeType":865},{},[],{"data":17623,"content":17624,"nodeType":881},{},[17625],{"data":17626,"marks":17627,"value":16997,"nodeType":865},{},[],{"data":17629,"content":17630,"nodeType":881},{},[17631,17634,17638,17641,17648],{"data":17632,"marks":17633,"value":17004,"nodeType":865},{},[],{"data":17635,"marks":17636,"value":17009,"nodeType":865},{},[17637],{"type":902},{"data":17639,"marks":17640,"value":1877,"nodeType":865},{},[],{"data":17642,"content":17643,"nodeType":876},{"uri":914},[17644],{"data":17645,"marks":17646,"value":17020,"nodeType":865},{},[17647],{"type":874},{"data":17649,"marks":17650,"value":17024,"nodeType":865},{},[],{"data":17652,"content":17653,"nodeType":881},{},[17654],{"data":17655,"marks":17656,"value":17031,"nodeType":865},{},[],{"data":17658,"content":17659,"nodeType":881},{},[17660],{"data":17661,"marks":17662,"value":17039,"nodeType":865},{},[17663],{"type":902},{"data":17665,"content":17666,"nodeType":894},{},[],{"data":17668,"content":17669,"nodeType":904},{},[17670],{"data":17671,"marks":17672,"value":17050,"nodeType":865},{},[17673],{"type":902},{"data":17675,"content":17676,"nodeType":881},{},[17677],{"data":17678,"marks":17679,"value":17057,"nodeType":865},{},[],{"data":17681,"content":17682,"nodeType":881},{},[17683],{"data":17684,"marks":17685,"value":17064,"nodeType":865},{},[],{"data":17687,"content":17690,"nodeType":890},{"target":17688},{"sys":17689},{"id":17069,"type":887,"linkType":888},[],{"data":17692,"content":17693,"nodeType":881},{},[17694],{"data":17695,"marks":17696,"value":17077,"nodeType":865},{},[],{"data":17698,"content":17699,"nodeType":1818},{},[17700,17718],{"data":17701,"content":17702,"nodeType":1734},{},[17703],{"data":17704,"content":17705,"nodeType":881},{},[17706,17709,17715],{"data":17707,"marks":17708,"value":21,"nodeType":865},{},[],{"data":17710,"content":17711,"nodeType":876},{"uri":17092},[17712],{"data":17713,"marks":17714,"value":17097,"nodeType":865},{},[],{"data":17716,"marks":17717,"value":17101,"nodeType":865},{},[],{"data":17719,"content":17720,"nodeType":1734},{},[17721],{"data":17722,"content":17723,"nodeType":881},{},[17724,17727,17733],{"data":17725,"marks":17726,"value":21,"nodeType":865},{},[],{"data":17728,"content":17729,"nodeType":876},{"uri":17113},[17730],{"data":17731,"marks":17732,"value":17118,"nodeType":865},{},[],{"data":17734,"marks":17735,"value":17122,"nodeType":865},{},[],{"data":17737,"content":17740,"nodeType":890},{"target":17738},{"sys":17739},{"id":17127,"type":887,"linkType":888},[],{"data":17742,"content":17743,"nodeType":881},{},[17744],{"data":17745,"marks":17746,"value":17135,"nodeType":865},{},[],{"data":17748,"content":17749,"nodeType":881},{},[17750,17753,17760,17763,17770],{"data":17751,"marks":17752,"value":17142,"nodeType":865},{},[],{"data":17754,"content":17755,"nodeType":876},{"uri":17145},[17756],{"data":17757,"marks":17758,"value":17151,"nodeType":865},{},[17759],{"type":874},{"data":17761,"marks":17762,"value":17155,"nodeType":865},{},[],{"data":17764,"content":17765,"nodeType":876},{"uri":11316},[17766],{"data":17767,"marks":17768,"value":17163,"nodeType":865},{},[17769],{"type":874},{"data":17771,"marks":17772,"value":17167,"nodeType":865},{},[],{"data":17774,"content":17777,"nodeType":890},{"target":17775},{"sys":17776},{"id":17172,"type":887,"linkType":888},[],{"data":17779,"content":17780,"nodeType":970},{},[17781],{"data":17782,"content":17783,"nodeType":881},{},[17784,17787,17794,17797,17803,17806,17813],{"data":17785,"marks":17786,"value":17183,"nodeType":865},{},[],{"data":17788,"content":17789,"nodeType":876},{"uri":4465},[17790],{"data":17791,"marks":17792,"value":17191,"nodeType":865},{},[17793],{"type":874},{"data":17795,"marks":17796,"value":1877,"nodeType":865},{},[],{"data":17798,"content":17799,"nodeType":876},{"uri":4477},[17800],{"data":17801,"marks":17802,"value":17201,"nodeType":865},{},[],{"data":17804,"marks":17805,"value":4487,"nodeType":865},{},[],{"data":17807,"content":17808,"nodeType":876},{"uri":1453},[17809],{"data":17810,"marks":17811,"value":4495,"nodeType":865},{},[17812],{"type":874},{"data":17814,"marks":17815,"value":959,"nodeType":865},{},[],{"data":17817,"content":17818,"nodeType":881},{},[17819],{"data":17820,"marks":17821,"value":21,"nodeType":865},{},[],{"entries":17823},{"hyperlink":17824,"inline":17825,"block":17826},[],[],[17827,17835,17842,17867,17875,17881,17905,17909,17934,17940],{"sys":17828,"__typename":7008,"title":17829,"caption":17830,"layoutMode":59,"file":17831},{"id":16734},"SLH TOR leak site with claimed victims.","SLH Tor leak site with claimed victims.",{"url":17832,"width":17833,"height":17834},"https://images.ctfassets.net/y1cdw1ablpvd/PoWJBZ3uyl94usKVv3zgr/ed5aefc88cf39fe354755c7b145564bf/image4.png",1284,588,{"sys":17836,"__typename":7008,"title":17837,"caption":17837,"layoutMode":59,"file":17838},{"id":10969},"Big picture view of Scattered Lapsus$ Hunters breaches since 2021.",{"url":17839,"width":17840,"height":17841},"https://images.ctfassets.net/y1cdw1ablpvd/415gvGUy6Ywr2zofY8Phpk/dc9a8461ef07c041fef4a7fb39d0a25b/Screenshot_2026-02-25_at_09.50.56.png",3414,1852,{"sys":17843,"__typename":7015,"content":17844,"name":17866,"title":59},{"id":16796},{"json":17845},{"data":17846,"content":17847,"nodeType":1463},{},[17848],{"data":17849,"content":17850,"nodeType":881},{},[17851,17855,17863],{"data":17852,"marks":17853,"value":17854,"nodeType":865},{},[],"Get the background on Scattered Lapsus$ Hunters, and how they relate to Scattered Spider, Lapsus$, ShinyHunters, and other Com-affiliated groups in our recent deep dive, unpacking related breaches dating back to 2021 ",{"data":17856,"content":17857,"nodeType":876},{"uri":1747},[17858],{"data":17859,"marks":17860,"value":17862,"nodeType":865},{},[17861],{"type":874},"in our recent blog post",{"data":17864,"marks":17865,"value":959,"nodeType":865},{},[],"SLH campaign insight box 1",{"sys":17868,"__typename":7008,"title":17869,"caption":17870,"layoutMode":59,"file":17871},{"id":16838},"What the operator sees in their phishing dashboard.","Phishing dashboard view provided by Okta Threat Intelligence.",{"url":17872,"width":17873,"height":17874},"https://images.ctfassets.net/y1cdw1ablpvd/3IvcYr8sCMsCbhnzG9OzJA/35e3bdcf6dcddb3c431600afe490fe7e/image5.png",1600,558,{"sys":17876,"__typename":7008,"title":17877,"caption":17877,"layoutMode":59,"file":17878},{"id":16913},"SSO panel examples in Entra and Okta.",{"url":17879,"width":7012,"height":17880},"https://images.ctfassets.net/y1cdw1ablpvd/31RIcvGgLz2fmHBYsZyEV5/4326e200aa8ba9879257c2f9b643cf08/image1.png",680,{"sys":17882,"__typename":7015,"content":17883,"name":17904,"title":59},{"id":16939},{"json":17884},{"data":17885,"content":17886,"nodeType":1463},{},[17887],{"data":17888,"content":17889,"nodeType":881},{},[17890,17893,17900],{"data":17891,"marks":17892,"value":21,"nodeType":865},{},[],{"data":17894,"content":17895,"nodeType":876},{"uri":5566},[17896],{"data":17897,"marks":17898,"value":17899,"nodeType":865},{},[],"Mandiant has reported",{"data":17901,"marks":17902,"value":17903,"nodeType":865},{},[]," how the attacker opportunistically pivots across accessible SaaS platforms (SharePoint, Salesforce, DocuSign, Slack), hunting for specific strings like “poc,” “confidential,” “salesforce,” and “vpn.” Notable tradecraft includes using ToogleBox Recall to delete MFA enrollment notifications from victims’ inboxes and leveraging PowerShell to bulk-download SharePoint content routed through commercial VPN services like Mullvad, Oxylabs, and NetNut. Check out their blog post for some example SaaS activity logs that can be used to investigate a potential compromise. ","SLH V2 insight box 1",{"sys":17906,"__typename":7100,"title":17907,"arcadeDemoUrl":17908,"playText":7102},{"id":16952},"SSO Exploitation Demo","https://demo.arcade.software/pwGUZuoRdTLzfbWGZUDJ?embed",{"sys":17910,"__typename":7015,"content":17911,"name":17933,"title":59},{"id":17069},{"json":17912},{"data":17913,"content":17914,"nodeType":1463},{},[17915],{"data":17916,"content":17917,"nodeType":881},{},[17918,17922,17929],{"data":17919,"marks":17920,"value":17921,"nodeType":865},{},[],"This even includes brand new techniques that have never been seen in the wild — such as ",{"data":17923,"content":17924,"nodeType":876},{"uri":4836},[17925],{"data":17926,"marks":17927,"value":1236,"nodeType":865},{},[17928],{"type":874},{"data":17930,"marks":17931,"value":17932,"nodeType":865},{},[],", which we blocked the first time it was seen targeting our customers, before even realizing it was a new kind of attack.","SLH campaign insight box 2",{"sys":17935,"__typename":7008,"title":17936,"caption":17936,"layoutMode":59,"file":17937},{"id":17127},"Push blocks phishing pages using real-time, in-browser analysis — shutting the attack down before a compromise happens. ",{"url":17938,"width":7012,"height":17939},"https://images.ctfassets.net/y1cdw1ablpvd/6InFhVkJJOPhsojQoub04K/b43e32cfa0bdc423dc993e930ebe1ae2/image1.png",1125,{"sys":17941,"__typename":7008,"title":17942,"caption":17943,"layoutMode":59,"file":17944},{"id":17172},"Employee Verification Codes","Push provides a lightweight verification feature in every user’s browser — no additional apps or devices required.",{"url":17945,"width":17946,"height":17947},"https://images.ctfassets.net/y1cdw1ablpvd/41X6fkPJgqf14vO3O14TF3/e0cecdbdfaee1353f15ff77ecb6a55a8/Employee_verification_codes.png",2088,1240,{"items":17949},[],{},"Unpacking the latest SLH phishing campaign",{"items":17953},[17954,18770,20085],{"__typename":1485,"sys":17955,"content":17957,"title":18756,"synopsis":18757,"hashTags":59,"publishedDate":18758,"slug":18759,"tagsCollection":18760,"authorsCollection":18766},{"id":17956},"4jcVFrvGBtVXpKU3gDMaa2",{"json":17958},{"data":17959,"content":17960,"nodeType":1463},{},[17961,17979,17986,17992,18047,18054,18061,18064,18072,18079,18086,18137,18145,18152,18175,18182,18185,18193,18200,18207,18214,18221,18228,18235,18240,18248,18255,18274,18294,18297,18305,18312,18319,18326,18334,18353,18360,18365,18373,18393,18413,18526,18529,18537,18544,18551,18554,18562,18569,18576,18583,18650,18680,18683,18691,18697,18704,18711,18718,18744,18750],{"data":17962,"content":17963,"nodeType":881},{},[17964,17968,17975],{"data":17965,"marks":17966,"value":17967,"nodeType":865},{},[],"In December, the Push Security research team discovered and blocked a brand new attack technique that we coined ",{"data":17969,"content":17970,"nodeType":876},{"uri":1230},[17971],{"data":17972,"marks":17973,"value":1236,"nodeType":865},{},[17974],{"type":874},{"data":17976,"marks":17977,"value":17978,"nodeType":865},{},[],". This technique merged ClickFix-style social engineering with OAuth consent phishing to hijack Microsoft accounts. ",{"data":17980,"content":17981,"nodeType":881},{},[17982],{"data":17983,"marks":17984,"value":17985,"nodeType":865},{},[],"We saw this attack running across a large network of compromised websites that attackers were injecting the malicious payload into, forming a large-scale campaign that was detected across multiple customer estates. ",{"data":17987,"content":17991,"nodeType":890},{"target":17988},{"sys":17989},{"id":17990,"type":887,"linkType":888},"603MWDqc9NsqkklIkfGNZN",[],{"data":17993,"content":17994,"nodeType":881},{},[17995,17999,18008,18012,18020,18023,18032,18035,18043],{"data":17996,"marks":17997,"value":17998,"nodeType":865},{},[],"ConsentFix got a pretty awesome response from the community in a very short space of time. Within days, ",{"data":18000,"content":18002,"nodeType":876},{"uri":18001},"https://www.youtube.com/watch?v=AAiiIY-Soak",[18003],{"data":18004,"marks":18005,"value":18007,"nodeType":865},{},[18006],{"type":874},"John Hammond shared a new and improved version of the technique",{"data":18009,"marks":18010,"value":18011,"nodeType":865},{},[]," that he’d spun up in his own lab, while security researchers from ",{"data":18013,"content":18015,"nodeType":876},{"uri":18014},"https://medium.com/@nitashathakur/consentfix-poc-how-the-attack-works-end-to-end-4f8b656f977d",[18016],{"data":18017,"marks":18018,"value":1718,"nodeType":865},{},[18019],{"type":874},{"data":18021,"marks":18022,"value":1877,"nodeType":865},{},[],{"data":18024,"content":18026,"nodeType":876},{"uri":18025},"https://www.glueckkanja.com/en/posts/2025-12-31-vulnerability-consentfix",[18027],{"data":18028,"marks":18029,"value":18031,"nodeType":865},{},[18030],{"type":874},"Glueck Kanja",{"data":18033,"marks":18034,"value":1791,"nodeType":865},{},[],{"data":18036,"content":18037,"nodeType":876},{"uri":6852},[18038],{"data":18039,"marks":18040,"value":18042,"nodeType":865},{},[18041],{"type":874},"other individual contributors",{"data":18044,"marks":18045,"value":18046,"nodeType":865},{},[]," all shared analysis and recommendations. ",{"data":18048,"content":18049,"nodeType":881},{},[18050],{"data":18051,"marks":18052,"value":18053,"nodeType":865},{},[],"In this blog, we’re sharing some new insights on the campaign, pulling together some of the top recommendations and resources shared across the community, and predicting what the future holds for this novel technique as it quickly enters the mainstream. ",{"data":18055,"content":18056,"nodeType":881},{},[18057],{"data":18058,"marks":18059,"value":18060,"nodeType":865},{},[],"First though, let’s quickly recap what ConsentFix is and how it works. ",{"data":18062,"content":18063,"nodeType":894},{},[],{"data":18065,"content":18066,"nodeType":904},{},[18067],{"data":18068,"marks":18069,"value":18071,"nodeType":865},{},[18070],{"type":902},"ConsentFix 101",{"data":18073,"content":18074,"nodeType":881},{},[18075],{"data":18076,"marks":18077,"value":18078,"nodeType":865},{},[],"ConsentFix is an attack technique that prompts the victim to share an OAuth authorization code with an attacker via a phishing page. The attacker then enters this code into a target application on their own device in order to complete the authorization handshake and take over the account. ",{"data":18080,"content":18081,"nodeType":881},{},[18082],{"data":18083,"marks":18084,"value":18085,"nodeType":865},{},[],"By hijacking OAuth, attackers can effectively bypass identity-layer controls like passwords and MFA — even phishing resistant authentication methods like passkeys have no impact on this attack, because it sidesteps the authentication process altogether. ",{"data":18087,"content":18088,"nodeType":881},{},[18089,18093,18101,18104,18111,18115,18122,18126,18134],{"data":18090,"marks":18091,"value":18092,"nodeType":865},{},[],"OAuth abuse attacks are not new. Techniques like ",{"data":18094,"content":18096,"nodeType":876},{"uri":18095},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/consent_phishing/description.md",[18097],{"data":18098,"marks":18099,"value":7567,"nodeType":865},{},[18100],{"type":874},{"data":18102,"marks":18103,"value":1651,"nodeType":865},{},[],{"data":18105,"content":18106,"nodeType":876},{"uri":1526},[18107],{"data":18108,"marks":18109,"value":1307,"nodeType":865},{},[18110],{"type":874},{"data":18112,"marks":18113,"value":18114,"nodeType":865},{},[]," have been around for some time. However, these mainly focus on connecting your primary workspace account (e.g. Microsoft, Google, etc.) to a fraudulent, attacker-controlled application. But this is becoming increasingly difficult in core enterprise cloud environments like Azure due to ",{"data":18116,"content":18117,"nodeType":876},{"uri":7585},[18118],{"data":18119,"marks":18120,"value":7591,"nodeType":865},{},[18121],{"type":874},{"data":18123,"marks":18124,"value":18125,"nodeType":865},{},[],". That said, device code phishing still featured prominently in the recent ",{"data":18127,"content":18128,"nodeType":876},{"uri":1747},[18129],{"data":18130,"marks":18131,"value":18133,"nodeType":865},{},[18132],{"type":874},"high-profile Salesforce attacks in 2025",{"data":18135,"marks":18136,"value":959,"nodeType":865},{},[],{"data":18138,"content":18139,"nodeType":1860},{},[18140],{"data":18141,"marks":18142,"value":18144,"nodeType":865},{},[18143],{"type":902},"What makes ConsentFix so dangerous?",{"data":18146,"content":18147,"nodeType":881},{},[18148],{"data":18149,"marks":18150,"value":18151,"nodeType":865},{},[],"Unlike typical OAuth attacks, the novel ConsentFix approach enabled the attacker to target different types of application to what they usually go after — with big implications for detection and response. In this case, the attacker:",{"data":18153,"content":18154,"nodeType":1818},{},[18155,18165],{"data":18156,"content":18157,"nodeType":1734},{},[18158],{"data":18159,"content":18160,"nodeType":881},{},[18161],{"data":18162,"marks":18163,"value":18164,"nodeType":865},{},[],"Specifically targeted first-party Microsoft apps that cannot be restricted in the same way as third-party applications, and are pre-consented in every tenant (meaning users can authenticate to them without admin approval). ",{"data":18166,"content":18167,"nodeType":1734},{},[18168],{"data":18169,"content":18170,"nodeType":881},{},[18171],{"data":18172,"marks":18173,"value":18174,"nodeType":865},{},[],"Leveraged legacy scopes that are outside the scope of default logging to evade detection, and targeted scopes with known Conditional Access policy exclusions.",{"data":18176,"content":18177,"nodeType":881},{},[18178],{"data":18179,"marks":18180,"value":18181,"nodeType":865},{},[],"This means that default controls you’d expect to block malicious OAuth grants don’t apply, you may not have logging enabled to detect it if it did happen to you, and to top it off, conditional access policy exclusions mean that many organizations’ expected controls don’t work as intended in this case. ",{"data":18183,"content":18184,"nodeType":894},{},[],{"data":18186,"content":18187,"nodeType":904},{},[18188],{"data":18189,"marks":18190,"value":18192,"nodeType":865},{},[18191],{"type":902},"ConsentFix campaign recap",{"data":18194,"content":18195,"nodeType":881},{},[18196],{"data":18197,"marks":18198,"value":18199,"nodeType":865},{},[],"Let’s quickly recap how the ConsentFix campaign was implemented. ",{"data":18201,"content":18202,"nodeType":881},{},[18203],{"data":18204,"marks":18205,"value":18206,"nodeType":865},{},[],"The victim is served a page which requires that they verify that they are human by pasting a URL into the phishing page.",{"data":18208,"content":18209,"nodeType":881},{},[18210],{"data":18211,"marks":18212,"value":18213,"nodeType":865},{},[],"Clicking the “Sign In” button opens a legitimate Microsoft login page. If the user is already logged in (which they likely are if working in their normal browser) their account information is already pre-populated and they won’t need to authenticate again. ",{"data":18215,"content":18216,"nodeType":881},{},[18217],{"data":18218,"marks":18219,"value":18220,"nodeType":865},{},[],"Selecting their account redirects them to a localhost URL containing an OAuth authorization code — this is what they then post into the original phishing page to complete the attack. ",{"data":18222,"content":18223,"nodeType":881},{},[18224],{"data":18225,"marks":18226,"value":18227,"nodeType":865},{},[],"Once the attacker gets the URL, they can exchange it for an access token or refresh token for the particular application being targeted — in this case, Azure CLI.",{"data":18229,"content":18230,"nodeType":881},{},[18231],{"data":18232,"marks":18233,"value":18234,"nodeType":865},{},[],"The TL;DR is that the attacker is manually completing an authorization flow that happens when a user logs into Azure CLI — a a command line client that provides you with the ability to easily manage your Azure AD / Entra ID environment. Except in this case, they’re taking the victim’s information to log in on the attacker’s device instead. ",{"data":18236,"content":18239,"nodeType":890},{"target":18237},{"sys":18238},{"id":7424,"type":887,"linkType":888},[],{"data":18241,"content":18242,"nodeType":1860},{},[18243],{"data":18244,"marks":18245,"value":18247,"nodeType":865},{},[18246],{"type":902},"Latest campaign details",{"data":18249,"content":18250,"nodeType":881},{},[18251],{"data":18252,"marks":18253,"value":18254,"nodeType":865},{},[],"Since we shared our blog post, we’ve had a number of additional details come to light about the campaign, which we’ve continued to track. ",{"data":18256,"content":18257,"nodeType":881},{},[18258,18262,18270],{"data":18259,"marks":18260,"value":18261,"nodeType":865},{},[],"It appears to be linked to Russian state-affiliated APT29, as corroborated by threat researchers we’ve been collaborating with. This is consistent with the ",{"data":18263,"content":18264,"nodeType":876},{"uri":1230},[18265],{"data":18266,"marks":18267,"value":18269,"nodeType":865},{},[18268],{"type":874},"stealthy tactics we observed",{"data":18271,"marks":18272,"value":18273,"nodeType":865},{},[],", which go far beyond the run-of-the-mill detection evasion techniques we see used in criminal phishing campaigns. ",{"data":18275,"content":18276,"nodeType":881},{},[18277,18281,18290],{"data":18278,"marks":18279,"value":18280,"nodeType":865},{},[],"It shares many similarities with, and appears to be an evolution of, ",{"data":18282,"content":18284,"nodeType":876},{"uri":18283},"https://www.volexity.com/blog/2025/12/04/dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phishing-attacks/",[18285],{"data":18286,"marks":18287,"value":18289,"nodeType":865},{},[18288],{"type":874},"this Russia-affiliated campaign identified by Volexity",{"data":18291,"marks":18292,"value":18293,"nodeType":865},{},[]," that featured a manual version of the attack — where they victim was social engineered via email into opening the Microsoft URL, copying the localhost response, and sending it back to the attacker via email. ",{"data":18295,"content":18296,"nodeType":894},{},[],{"data":18298,"content":18299,"nodeType":904},{},[18300],{"data":18301,"marks":18302,"value":18304,"nodeType":865},{},[18303],{"type":902},"Top contributions from the community",{"data":18306,"content":18307,"nodeType":881},{},[18308],{"data":18309,"marks":18310,"value":18311,"nodeType":865},{},[],"As we mentioned earlier, the community response to ConsentFix has been incredible. ",{"data":18313,"content":18314,"nodeType":881},{},[18315],{"data":18316,"marks":18317,"value":18318,"nodeType":865},{},[],"As ever, you get a lot of vendors covering the attack technique with “install our product” as the recommendation. This is to be expected, but it’s misleading when some of these vendors are pushing EDR products that would have absolutely no way of detecting or blocking the attack. ",{"data":18320,"content":18321,"nodeType":881},{},[18322],{"data":18323,"marks":18324,"value":18325,"nodeType":865},{},[],"But cutting through the marketing, a lot of really great resources and recommendations were shared. ",{"data":18327,"content":18328,"nodeType":1860},{},[18329],{"data":18330,"marks":18331,"value":18333,"nodeType":865},{},[18332],{"type":902},"V2.0 released by John Hammond",{"data":18335,"content":18336,"nodeType":881},{},[18337,18341,18349],{"data":18338,"marks":18339,"value":18340,"nodeType":865},{},[],"Within days, John Hammond ",{"data":18342,"content":18343,"nodeType":876},{"uri":18001},[18344],{"data":18345,"marks":18346,"value":18348,"nodeType":865},{},[18347],{"type":874},"posted about ConsentFix on his Youtube channel",{"data":18350,"marks":18351,"value":18352,"nodeType":865},{},[],", where he showed off a slick improvement on the ConsentFix implementation used by attackers. In his version, the URL containing the Microsoft authorization code was generated in a pop-up browser window that could simply be drag-and-dropped into the phishing page. ",{"data":18354,"content":18355,"nodeType":881},{},[18356],{"data":18357,"marks":18358,"value":18359,"nodeType":865},{},[],"This implementation is way smoother, making it much more likely that a victim would fall for it. And this took a matter of days… ",{"data":18361,"content":18364,"nodeType":890},{"target":18362},{"sys":18363},{"id":6513,"type":887,"linkType":888},[],{"data":18366,"content":18367,"nodeType":1860},{},[18368],{"data":18369,"marks":18370,"value":18372,"nodeType":865},{},[18371],{"type":902},"Additional vulnerable first-party apps identified",{"data":18374,"content":18375,"nodeType":881},{},[18376,18380,18389],{"data":18377,"marks":18378,"value":18379,"nodeType":865},{},[],"Fabian Bader and Dirk-jan Mollema from Glueck Kanja have ",{"data":18381,"content":18383,"nodeType":876},{"uri":18382},"https://entrascopes.com/?bypass=true&authcodeFix=true",[18384],{"data":18385,"marks":18386,"value":18388,"nodeType":865},{},[18387],{"type":874},"shared a great resource",{"data":18390,"marks":18391,"value":18392,"nodeType":865},{},[]," on wider first-party apps that are vulnerable to ConsentFix. ",{"data":18394,"content":18395,"nodeType":881},{},[18396,18400,18409],{"data":18397,"marks":18398,"value":18399,"nodeType":865},{},[],"In total, there are 11 apps vulnerable to ConsentFix that also have known ",{"data":18401,"content":18403,"nodeType":876},{"uri":18402},"https://cloudbrothers.info/conditional-access-bypasses/#documented-bypasses",[18404],{"data":18405,"marks":18406,"value":18408,"nodeType":865},{},[18407],{"type":874},"Conditional Access exclusions",{"data":18410,"marks":18411,"value":18412,"nodeType":865},{},[]," (either for the app generally, or when specific scopes are requested for the app):",{"data":18414,"content":18415,"nodeType":1818},{},[18416,18426,18436,18446,18456,18466,18476,18486,18496,18506,18516],{"data":18417,"content":18418,"nodeType":1734},{},[18419],{"data":18420,"content":18421,"nodeType":881},{},[18422],{"data":18423,"marks":18424,"value":18425,"nodeType":865},{},[],"Microsoft Azure CLI: 04b07795-8ddb-461a-bbee-02f9e1bf7b46",{"data":18427,"content":18428,"nodeType":1734},{},[18429],{"data":18430,"content":18431,"nodeType":881},{},[18432],{"data":18433,"marks":18434,"value":18435,"nodeType":865},{},[],"Microsoft Azure PowerShell: 1950a258-227b-4e31-a9cf-717495945fc2",{"data":18437,"content":18438,"nodeType":1734},{},[18439],{"data":18440,"content":18441,"nodeType":881},{},[18442],{"data":18443,"marks":18444,"value":18445,"nodeType":865},{},[],"Microsoft Teams: 1fec8e78-bce4-4aaf-ab1b-5451cc387264",{"data":18447,"content":18448,"nodeType":1734},{},[18449],{"data":18450,"content":18451,"nodeType":881},{},[18452],{"data":18453,"marks":18454,"value":18455,"nodeType":865},{},[],"Microsoft Whiteboard Client: 57336123-6e14-4acc-8dcf-287b6088aa28",{"data":18457,"content":18458,"nodeType":1734},{},[18459],{"data":18460,"content":18461,"nodeType":881},{},[18462],{"data":18463,"marks":18464,"value":18465,"nodeType":865},{},[],"Microsoft Flow Mobile PROD-GCCH-CN: 57fcbcfa-7cee-4eb1-8b25-12d2030b4ee0",{"data":18467,"content":18468,"nodeType":1734},{},[18469],{"data":18470,"content":18471,"nodeType":881},{},[18472],{"data":18473,"marks":18474,"value":18475,"nodeType":865},{},[],"Enterprise Roaming and Backup: 60c8bde5-3167-4f92-8fdb-059f6176dc0",{"data":18477,"content":18478,"nodeType":1734},{},[18479],{"data":18480,"content":18481,"nodeType":881},{},[18482],{"data":18483,"marks":18484,"value":18485,"nodeType":865},{},[],"Visual Studio: 872cd9fa-d31f-45e0-9eab-6e460a02d1f1",{"data":18487,"content":18488,"nodeType":1734},{},[18489],{"data":18490,"content":18491,"nodeType":881},{},[18492],{"data":18493,"marks":18494,"value":18495,"nodeType":865},{},[],"Aadrm Admin Powershell: 90f610bf-206d-4950-b61d-37fa6fd1b224",{"data":18497,"content":18498,"nodeType":1734},{},[18499],{"data":18500,"content":18501,"nodeType":881},{},[18502],{"data":18503,"marks":18504,"value":18505,"nodeType":865},{},[],"Microsoft SharePoint Online Management Shell: 9bc3ab49-b65d-410a-85ad-de819febfddc",{"data":18507,"content":18508,"nodeType":1734},{},[18509],{"data":18510,"content":18511,"nodeType":881},{},[18512],{"data":18513,"marks":18514,"value":18515,"nodeType":865},{},[],"Microsoft Power Query for Excel: a672d62c-fc7b-4e81-a576-e60dc46e951d",{"data":18517,"content":18518,"nodeType":1734},{},[18519],{"data":18520,"content":18521,"nodeType":881},{},[18522],{"data":18523,"marks":18524,"value":18525,"nodeType":865},{},[],"Visual Studio Code: aebc6443-996d-45c2-90f0-388ff96faa56",{"data":18527,"content":18528,"nodeType":894},{},[],{"data":18530,"content":18531,"nodeType":904},{},[18532],{"data":18533,"marks":18534,"value":18536,"nodeType":865},{},[18535],{"type":902},"Predictions for ConsentFix",{"data":18538,"content":18539,"nodeType":881},{},[18540],{"data":18541,"marks":18542,"value":18543,"nodeType":865},{},[],"Based on the speed at which new iterations on the ConsentFix technique were shared by security researchers, and the breadth of apps and possible scopes that can be leveraged, both red teams and criminals will inevitably adopt ConsentFix into their arsenal of TTPs in the near future. It is likely that new ConsentFix variants will emerge imminently (if not already in circulation). ",{"data":18545,"content":18546,"nodeType":881},{},[18547],{"data":18548,"marks":18549,"value":18550,"nodeType":865},{},[],"All security teams responsible for protecting Microsoft environments should ensure that monitoring controls and mitigations are put in place as a matter of high priority. ",{"data":18552,"content":18553,"nodeType":894},{},[],{"data":18555,"content":18556,"nodeType":904},{},[18557],{"data":18558,"marks":18559,"value":18561,"nodeType":865},{},[18560],{"type":902},"Updated recommendations for security teams",{"data":18563,"content":18564,"nodeType":881},{},[18565],{"data":18566,"marks":18567,"value":18568,"nodeType":865},{},[],"As an entirely browser-native attack technique, many traditional security tools and data sources are of limited use when it comes to detecting or pre-emptively blocking this attack. At the same time, the attack exploits default Microsoft security configs to evade both prevention and detection controls.",{"data":18570,"content":18571,"nodeType":881},{},[18572],{"data":18573,"marks":18574,"value":18575,"nodeType":865},{},[],"To be able to tackle modern attacks like ConsentFix that occur entirely within the browser context, it is vital that organizations look to monitor the browser as a detection surface, hunt for signs of malicious activity, and block attacks in real-time — in the same way that you would expect EDR to work for endpoint attacks. ",{"data":18577,"content":18578,"nodeType":881},{},[18579],{"data":18580,"marks":18581,"value":18582,"nodeType":865},{},[],"For organizations relying on Microsoft logging as the sole line of defense against this attack, there are some new recommendations to add to the list thanks to the community response: ",{"data":18584,"content":18585,"nodeType":1818},{},[18586,18609,18619,18640],{"data":18587,"content":18588,"nodeType":1734},{},[18589],{"data":18590,"content":18591,"nodeType":881},{},[18592,18596,18605],{"data":18593,"marks":18594,"value":18595,"nodeType":865},{},[],"Ensure that logging for the deprecated ",{"data":18597,"content":18599,"nodeType":876},{"uri":18598},"https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/aadgraphactivitylogs",[18600],{"data":18601,"marks":18602,"value":18604,"nodeType":865},{},[18603],{"type":874},"AADGraphActivityLogs",{"data":18606,"marks":18607,"value":18608,"nodeType":865},{},[]," is enabled.",{"data":18610,"content":18611,"nodeType":1734},{},[18612],{"data":18613,"content":18614,"nodeType":881},{},[18615],{"data":18616,"marks":18617,"value":18618,"nodeType":865},{},[],"Hunt in logs for the Application IDs highlighted above, along with the Resource IDs for Windows Azure Active Directory (00000002-0000-0000-c000-000000000000) and Microsoft Intune Checkin (26a4ae64-5862-427f-a9b0-044e62572a4f)",{"data":18620,"content":18621,"nodeType":1734},{},[18622],{"data":18623,"content":18624,"nodeType":881},{},[18625,18628,18636],{"data":18626,"marks":18627,"value":21,"nodeType":865},{},[],{"data":18629,"content":18630,"nodeType":876},{"uri":6852},[18631],{"data":18632,"marks":18633,"value":18635,"nodeType":865},{},[18634],{"type":874},"Create Service Principals for each of the vulnerable apps and restrict the users that are authorized to access them",{"data":18637,"marks":18638,"value":18639,"nodeType":865},{},[]," to reduce the attack surface of users that can be phished with this method.",{"data":18641,"content":18642,"nodeType":1734},{},[18643],{"data":18644,"content":18645,"nodeType":881},{},[18646],{"data":18647,"marks":18648,"value":18649,"nodeType":865},{},[],"Block access to CLI tools via Conditional Access policy and issue exclusions for authorized users/groups. ",{"data":18651,"content":18652,"nodeType":881},{},[18653,18657,18666,18670,18677],{"data":18654,"marks":18655,"value":18656,"nodeType":865},{},[],"Additional resources that may be of use include community-created ",{"data":18658,"content":18660,"nodeType":876},{"uri":18659},"https://github.com/elastic/detection-rules/pull/5485",[18661],{"data":18662,"marks":18663,"value":18665,"nodeType":865},{},[18664],{"type":874},"Elastic detection rules",{"data":18667,"marks":18668,"value":18669,"nodeType":865},{},[]," for ConsentFix and further mitigation and hunting guidance from ",{"data":18671,"content":18672,"nodeType":876},{"uri":18025},[18673],{"data":18674,"marks":18675,"value":18031,"nodeType":865},{},[18676],{"type":874},{"data":18678,"marks":18679,"value":1032,"nodeType":865},{},[],{"data":18681,"content":18682,"nodeType":894},{},[],{"data":18684,"content":18685,"nodeType":904},{},[18686],{"data":18687,"marks":18688,"value":18690,"nodeType":865},{},[18689],{"type":902},"Learn more about Push Security",{"data":18692,"content":18693,"nodeType":881},{},[18694],{"data":18695,"marks":18696,"value":7999,"nodeType":865},{},[],{"data":18698,"content":18699,"nodeType":881},{},[18700],{"data":18701,"marks":18702,"value":18703,"nodeType":865},{},[],"Push tackles browser-based attacks using behavioral threat detection controls, powered by deep browser telemetry, to provide broad detection and blocking capabilities against attacks happening in the browser. This means analyzing the end-to-end process of a webpage loading/running in the browser, and how the user interacts with the page, to spot universal indicators of bad activity. ",{"data":18705,"content":18706,"nodeType":881},{},[18707],{"data":18708,"marks":18709,"value":18710,"nodeType":865},{},[],"This is the only reliable way to detect malicious websites in a world where IoC-based detections are trivial for attackers to get around. Rather than playing known-bad whac-a-mole, Push detects and blocks even zero-day browser threats in real time.",{"data":18712,"content":18713,"nodeType":881},{},[18714],{"data":18715,"marks":18716,"value":18717,"nodeType":865},{},[],"Push stops browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, ConsentFix, and session hijacking. You don’t need to wait until it all goes wrong either — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":18719,"content":18720,"nodeType":881},{},[18721,18724,18731,18734,18741],{"data":18722,"marks":18723,"value":4462,"nodeType":865},{},[],{"data":18725,"content":18726,"nodeType":876},{"uri":4465},[18727],{"data":18728,"marks":18729,"value":4471,"nodeType":865},{},[18730],{"type":874},{"data":18732,"marks":18733,"value":8048,"nodeType":865},{},[],{"data":18735,"content":18736,"nodeType":876},{"uri":1453},[18737],{"data":18738,"marks":18739,"value":4495,"nodeType":865},{},[18740],{"type":874},{"data":18742,"marks":18743,"value":959,"nodeType":865},{},[],{"data":18745,"content":18749,"nodeType":890},{"target":18746},{"sys":18747},{"id":18748,"type":887,"linkType":888},"4D7zpYAc1tTEAmn2hpkWPe",[],{"data":18751,"content":18752,"nodeType":881},{},[18753],{"data":18754,"marks":18755,"value":21,"nodeType":865},{},[],"ConsentFix debrief: latest community insights, recommendations, and predictions","New insights on the ConsentFix campaign stopped by Push.","2026-01-14T00:00:00.000Z","consentfix-debrief",{"items":18761},[18762,18764],{"sys":18763,"name":342},{"id":4510},{"sys":18765,"name":4507},{"id":4506},{"items":18767},[18768],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":18769},{"url":5377},{"__typename":1485,"sys":18771,"content":18773,"title":20067,"synopsis":20068,"hashTags":59,"publishedDate":20069,"slug":20070,"tagsCollection":20071,"authorsCollection":20077},{"id":18772},"37KWV8V5L3aNZBSx6JMd0Z",{"json":18774},{"data":18775,"content":18776,"nodeType":1463},{},[18777,18784,18791,18852,18859,18928,18934,18941,18948,18951,18958,18965,18972,19075,19094,19101,19143,19150,19157,19164,19197,19203,19235,19241,19248,19255,19288,19308,19311,19318,19324,19355,19362,19369,19376,19382,19389,19395,19410,19453,19459,19479,19482,19489,19495,19515,19522,19551,19571,19577,19598,19605,19612,19672,19679,19685,19700,19714,19735,19741,19762,19769,19772,19779,19785,19792,19799,19820,19826,19847,19853,19860,19893,19911,19914,19921,19927,19934,19955,19961,19976,19982,19989,19996,20015,20018,20024,20031,20038],{"data":18778,"content":18779,"nodeType":881},{},[18780],{"data":18781,"marks":18782,"value":18783,"nodeType":865},{},[],"Looking back over the year’s headlines and trending TTPs, it’s clear that 2025 was the year that browser-based account takeover techniques made the leap into the mainstream.",{"data":18785,"content":18786,"nodeType":881},{},[18787],{"data":18788,"marks":18789,"value":18790,"nodeType":865},{},[],"A few stats tell the story …",{"data":18792,"content":18793,"nodeType":1818},{},[18794,18813,18832],{"data":18795,"content":18796,"nodeType":1734},{},[18797],{"data":18798,"content":18799,"nodeType":881},{},[18800,18804,18810],{"data":18801,"marks":18802,"value":18803,"nodeType":865},{},[],"Identity-based attacks surged by 32% over the last year, and 97% of identity attacks were password-based, driven by a combination of credential leaks and infostealer malware. (",{"data":18805,"content":18806,"nodeType":876},{"uri":11532},[18807],{"data":18808,"marks":18809,"value":1718,"nodeType":865},{},[],{"data":18811,"marks":18812,"value":11541,"nodeType":865},{},[],{"data":18814,"content":18815,"nodeType":1734},{},[18816],{"data":18817,"content":18818,"nodeType":881},{},[18819,18823,18829],{"data":18820,"marks":18821,"value":18822,"nodeType":865},{},[],"ClickFix was the most common initial point of access for adversaries in the past year, accounting for a whopping 47% of observed attacks. (",{"data":18824,"content":18825,"nodeType":876},{"uri":11532},[18826],{"data":18827,"marks":18828,"value":1718,"nodeType":865},{},[],{"data":18830,"marks":18831,"value":11541,"nodeType":865},{},[],{"data":18833,"content":18834,"nodeType":1734},{},[18835],{"data":18836,"content":18837,"nodeType":881},{},[18838,18842,18849],{"data":18839,"marks":18840,"value":18841,"nodeType":865},{},[],"Pure malware-based attacks declined, as adversaries continued to shift from targeting endpoints to corporate identities. In the last year-plus, 79% of detections were malware-free, up from 40% in 2019. And abuse of valid accounts was responsible for more than one-third of all cloud-related incidents. (",{"data":18843,"content":18844,"nodeType":876},{"uri":11554},[18845],{"data":18846,"marks":18847,"value":18848,"nodeType":865},{},[],"Crowdstrike",{"data":18850,"marks":18851,"value":11541,"nodeType":865},{},[],{"data":18853,"content":18854,"nodeType":881},{},[18855],{"data":18856,"marks":18857,"value":18858,"nodeType":865},{},[],"… and so do the headlines from 2025:",{"data":18860,"content":18861,"nodeType":1818},{},[18862,18881,18909],{"data":18863,"content":18864,"nodeType":1734},{},[18865],{"data":18866,"content":18867,"nodeType":881},{},[18868,18872,18877],{"data":18869,"marks":18870,"value":18871,"nodeType":865},{},[],"Attackers stole over ",{"data":18873,"marks":18874,"value":18876,"nodeType":865},{},[18875],{"type":902},"1.5 billion records",{"data":18878,"marks":18879,"value":18880,"nodeType":865},{},[]," from an estimated 1,000+ Salesforce tenants by exploiting integrations (Salesloft, Gainsight), phishing credentials, and by tricking users into installing a malicious OAuth app.",{"data":18882,"content":18883,"nodeType":1734},{},[18884],{"data":18885,"content":18886,"nodeType":881},{},[18887,18891,18896,18900,18905],{"data":18888,"marks":18889,"value":18890,"nodeType":865},{},[],"Marks & Spencer was hit with a help desk scam that led to a compromised Microsoft Entra account, followed by a ransomware deployment resulting in months of disruption, ",{"data":18892,"marks":18893,"value":18895,"nodeType":865},{},[18894],{"type":902},"$400M",{"data":18897,"marks":18898,"value":18899,"nodeType":865},{},[]," in lost profits, and around ",{"data":18901,"marks":18902,"value":18904,"nodeType":865},{},[18903],{"type":902},"$1.3B",{"data":18906,"marks":18907,"value":18908,"nodeType":865},{},[]," wiped off their stock market valuation at one stage.",{"data":18910,"content":18911,"nodeType":1734},{},[18912],{"data":18913,"content":18914,"nodeType":881},{},[18915,18919,18924],{"data":18916,"marks":18917,"value":18918,"nodeType":865},{},[],"Jaguar Land Rover was compromised via highly privileged admin accounts — another help desk scam targeting workforce credentials for initial access — resulting in months of disruption that led the UK government to underwrite a ",{"data":18920,"marks":18921,"value":18923,"nodeType":865},{},[18922],{"type":902},"$1.5B",{"data":18925,"marks":18926,"value":18927,"nodeType":865},{},[]," loan to alleviate the supply chain impact. This was the most economically consequential cyber attack yet recorded in a G7 economy.",{"data":18929,"content":18933,"nodeType":890},{"target":18930},{"sys":18931},{"id":18932,"type":887,"linkType":888},"v5YYnjP2NViOh6Ucxp2Fe",[],{"data":18935,"content":18936,"nodeType":881},{},[18937],{"data":18938,"marks":18939,"value":18940,"nodeType":865},{},[],"At Push, we’ve been closely tracking the evolution of browser-based attacks. Looking back at 2025, we’ve seen a notable increase in the sophistication and frequency of modern attack techniques methods like ClickFix, commodified phish kits that bypass MFA, malicious browser extensions, and many more. (Writing phish kit teardowns for the Push blog is practically a full-time job now.)",{"data":18942,"content":18943,"nodeType":881},{},[18944],{"data":18945,"marks":18946,"value":18947,"nodeType":865},{},[],"In this article, we’ll take a look at how real-world attacks and our own research drove the features we delivered for Push customers this year to take the fight to adversaries.",{"data":18949,"content":18950,"nodeType":894},{},[],{"data":18952,"content":18953,"nodeType":904},{},[18954],{"data":18955,"marks":18956,"value":18957,"nodeType":865},{},[],"Detecting and blocking increasingly sophisticated phishing-as-a-service tools",{"data":18959,"content":18960,"nodeType":1860},{},[18961],{"data":18962,"marks":18963,"value":18964,"nodeType":865},{},[],"What happened",{"data":18966,"content":18967,"nodeType":881},{},[18968],{"data":18969,"marks":18970,"value":18971,"nodeType":865},{},[],"The current state of the art for phishing centers on three core developments:",{"data":18973,"content":18974,"nodeType":1818},{},[18975,19005,19046],{"data":18976,"content":18977,"nodeType":1734},{},[18978],{"data":18979,"content":18980,"nodeType":881},{},[18981,18986,18990,19001],{"data":18982,"marks":18983,"value":18985,"nodeType":865},{},[18984],{"type":902},"Detection evasion: ",{"data":18987,"marks":18988,"value":18989,"nodeType":865},{},[],"Adversaries demonstrated a ",{"data":18991,"content":18995,"nodeType":19000},{"target":18992},{"sys":18993},{"id":18994,"type":887,"linkType":888},"4XZ6qCr8pjJvcD7hi09x2Y",[18996],{"data":18997,"marks":18998,"value":18999,"nodeType":865},{},[],"creative array of approaches","entry-hyperlink",{"data":19002,"marks":19003,"value":19004,"nodeType":865},{},[]," this year to hide their intentions from end-users and defenders, using methods such as sending phishing emails from legitimate services; serving phishing pages via malvertising and SEO poisoning; and obfuscating URLs. More sophisticated techniques used page-level obfuscation, cross-domain iframes, single-use links, and legitimate OIDC logins to evade detection and analysis from traditional tools.",{"data":19006,"content":19007,"nodeType":1734},{},[19008],{"data":19009,"content":19010,"nodeType":881},{},[19011,19016,19020,19029,19033,19043],{"data":19012,"marks":19013,"value":19015,"nodeType":865},{},[19014],{"type":902},"Multi-channel delivery of lures:",{"data":19017,"marks":19018,"value":19019,"nodeType":865},{},[]," Adversaries proved the truism of “phishing doesn’t just happen in the mailbox” this year by increasing their observed use of ",{"data":19021,"content":19025,"nodeType":19000},{"target":19022},{"sys":19023},{"id":19024,"type":887,"linkType":888},"72lLmy0CXnOp3LWOdcUguX",[19026],{"data":19027,"marks":19028,"value":441,"nodeType":865},{},[],{"data":19030,"marks":19031,"value":19032,"nodeType":865},{},[]," and SEO poisoning — techniques that place malicious pages within trusted contexts like the Google search engine results page — as well as the use of social media services like LinkedIn to ",{"data":19034,"content":19038,"nodeType":19000},{"target":19035},{"sys":19036},{"id":19037,"type":887,"linkType":888},"2yEhB2gFC2TJDLquVP3cg2",[19039],{"data":19040,"marks":19041,"value":19042,"nodeType":865},{},[],"deliver phishing lures",{"data":19044,"marks":19045,"value":14775,"nodeType":865},{},[],{"data":19047,"content":19048,"nodeType":1734},{},[19049],{"data":19050,"content":19051,"nodeType":881},{},[19052,19057,19061,19071],{"data":19053,"marks":19054,"value":19056,"nodeType":865},{},[19055],{"type":902},"Commodification of phishing toolkits:",{"data":19058,"marks":19059,"value":19060,"nodeType":865},{},[]," Phishing-as-a-service (PhaaS) kits have become another SaaS with their own supply chain, including developers of malicious tooling, operators who run the campaigns, and brokers who sell stolen credentials and tokens. The incentives for attackers are clear: quick ROI from targeting workforce identities, and out-of-the-box tools that make it easier to efficiently spin up new campaigns or try new techniques. As with any SaaS offering, the customer (attackers, in this case) benefits from rapid innovations they didn’t have to build. We saw this recently with the ",{"data":19062,"content":19066,"nodeType":19000},{"target":19063},{"sys":19064},{"id":19065,"type":887,"linkType":888},"6QLonRmBzbj9h88Y7jD0LU",[19067],{"data":19068,"marks":19069,"value":19070,"nodeType":865},{},[],"addition of a browser-in-the-browser (BitB) technique",{"data":19072,"marks":19073,"value":19074,"nodeType":865},{},[]," to the phish kit Sneaky2FA — a change that makes it even more effective.",{"data":19076,"content":19077,"nodeType":881},{},[19078,19082,19090],{"data":19079,"marks":19080,"value":19081,"nodeType":865},{},[],"In 2025, Push researchers tracked how each of these developments expanded in scope and sophistication. Check out our ",{"data":19083,"content":19085,"nodeType":876},{"uri":19084},"https://pushsecurity.github.io/phishing-techniques/",[19086],{"data":19087,"marks":19088,"value":19089,"nodeType":865},{},[],"phishing detection evasion techniques matrix",{"data":19091,"marks":19092,"value":19093,"nodeType":865},{},[]," on Github for more detail. ",{"data":19095,"content":19096,"nodeType":881},{},[19097],{"data":19098,"marks":19099,"value":19100,"nodeType":865},{},[],"The takeaways for security teams?",{"data":19102,"content":19103,"nodeType":1818},{},[19104,19114,19133],{"data":19105,"content":19106,"nodeType":1734},{},[19107],{"data":19108,"content":19109,"nodeType":881},{},[19110],{"data":19111,"marks":19112,"value":19113,"nodeType":865},{},[],"You can’t block your way to safety when adversaries are using the same legitimate apps that your employees use.",{"data":19115,"content":19116,"nodeType":1734},{},[19117],{"data":19118,"content":19119,"nodeType":881},{},[19120,19124,19129],{"data":19121,"marks":19122,"value":19123,"nodeType":865},{},[],"Similarly, while end-user training is important, it’s not reasonable to expect employees to know when a SharePoint document link is malicious when it looks identical to the ones they trust every day — because adversaries ",{"data":19125,"marks":19126,"value":19128,"nodeType":865},{},[19127],{"type":5120},"are using the legitimate service",{"data":19130,"marks":19131,"value":19132,"nodeType":865},{},[],". Push researchers have observed the abuse of hundreds of legitimate services in phishing attacks this year.",{"data":19134,"content":19135,"nodeType":1734},{},[19136],{"data":19137,"content":19138,"nodeType":881},{},[19139],{"data":19140,"marks":19141,"value":19142,"nodeType":865},{},[],"Security solutions need to be able to analyze real-time context and behavior, not rely solely on inferences from secondary characteristics like domain reputation.",{"data":19144,"content":19145,"nodeType":881},{},[19146],{"data":19147,"marks":19148,"value":19149,"nodeType":865},{},[],"Here's what we built to help defend organizations.",{"data":19151,"content":19152,"nodeType":1860},{},[19153],{"data":19154,"marks":19155,"value":19156,"nodeType":865},{},[],"What we built",{"data":19158,"content":19159,"nodeType":881},{},[19160],{"data":19161,"marks":19162,"value":19163,"nodeType":865},{},[],"The feature we built in 2025 that gave us unique insight into these TTPs is Push’s Detections capability. With Detections, you can:",{"data":19165,"content":19166,"nodeType":1818},{},[19167,19177,19187],{"data":19168,"content":19169,"nodeType":1734},{},[19170],{"data":19171,"content":19172,"nodeType":881},{},[19173],{"data":19174,"marks":19175,"value":19176,"nodeType":865},{},[],"Get alerted when Push detects a browser-based attack, and see how the Push agent responded to block the attack. The platform provides a front-end view for quick triage, and you can also pipe the detection events to your SIEM or other platform of choice.",{"data":19178,"content":19179,"nodeType":1734},{},[19180],{"data":19181,"content":19182,"nodeType":881},{},[19183],{"data":19184,"marks":19185,"value":19186,"nodeType":865},{},[],"Review a timeline of the incident: Where a phishing link originated; whether a user entered their credentials; what kind of phishkit was detected; and how Push responded (configurable based on your environment).",{"data":19188,"content":19189,"nodeType":1734},{},[19190],{"data":19191,"content":19192,"nodeType":881},{},[19193],{"data":19194,"marks":19195,"value":19196,"nodeType":865},{},[],"Get actionable telemetry and metadata about an incident, including a screenshot of the malicious page to see exactly what the user saw; intel about the involved domains, including when they were registered and if they’ve been scanned by urlscan before; and the blast radius of an attack, including other apps that shared a password with the potentially compromised account",{"data":19198,"content":19202,"nodeType":890},{"target":19199},{"sys":19200},{"id":19201,"type":887,"linkType":888},"5dygPaG3Gfw4Yeicffv6tV",[],{"data":19204,"content":19205,"nodeType":881},{},[19206,19210,19215,19218,19223,19226,19231],{"data":19207,"marks":19208,"value":19209,"nodeType":865},{},[],"This telemetry — combined with Push’s out-of-the-box controls like ",{"data":19211,"marks":19212,"value":19214,"nodeType":865},{},[19213],{"type":902},"Phishing tool detection",{"data":19216,"marks":19217,"value":1877,"nodeType":865},{},[],{"data":19219,"marks":19220,"value":19222,"nodeType":865},{},[19221],{"type":902},"Cloned login page detection",{"data":19224,"marks":19225,"value":1791,"nodeType":865},{},[],{"data":19227,"marks":19228,"value":19230,"nodeType":865},{},[19229],{"type":902},"Malicious copy and paste detection",{"data":19232,"marks":19233,"value":19234,"nodeType":865},{},[]," (aka ClickFix detection) — give you a seat on the user’s side of the equation, capturing real-time information about what users did and the TTPs of an attack so you can investigate and respond efficiently and confidently.",{"data":19236,"content":19240,"nodeType":890},{"target":19237},{"sys":19238},{"id":19239,"type":887,"linkType":888},"563fJFSgoLDOwSXSQ9Y0MM",[],{"data":19242,"content":19243,"nodeType":881},{},[19244],{"data":19245,"marks":19246,"value":19247,"nodeType":865},{},[],"With the visibility provided by this telemetry across Push’s install base, our R&D and Product teams have rapidly iterated all year on our detections to increase coverage and respond quickly to newly identified attack types.",{"data":19249,"content":19250,"nodeType":881},{},[19251],{"data":19252,"marks":19253,"value":19254,"nodeType":865},{},[],"This year, we also released:",{"data":19256,"content":19257,"nodeType":1818},{},[19258,19268,19278],{"data":19259,"content":19260,"nodeType":1734},{},[19261],{"data":19262,"content":19263,"nodeType":881},{},[19264],{"data":19265,"marks":19266,"value":19267,"nodeType":865},{},[],"Detections for new variants of cloned login pages and AiTM phish kits.",{"data":19269,"content":19270,"nodeType":1734},{},[19271],{"data":19272,"content":19273,"nodeType":881},{},[19274],{"data":19275,"marks":19276,"value":19277,"nodeType":865},{},[],"12+ pre-release detections focused on flagging emerging attacker techniques.",{"data":19279,"content":19280,"nodeType":1734},{},[19281],{"data":19282,"content":19283,"nodeType":881},{},[19284],{"data":19285,"marks":19286,"value":19287,"nodeType":865},{},[],"7+ first-class SIEM and SOAR integrations, to make it simpler to ingest Push telemetry and operationalize it.",{"data":19289,"content":19290,"nodeType":881},{},[19291,19295,19305],{"data":19292,"marks":19293,"value":19294,"nodeType":865},{},[],"Learn more about Push’s detections features in our ",{"data":19296,"content":19300,"nodeType":19000},{"target":19297},{"sys":19298},{"id":19299,"type":887,"linkType":888},"6OFdfAsoPUECeRAetWvedp",[19301],{"data":19302,"marks":19303,"value":19304,"nodeType":865},{},[],"blog article",{"data":19306,"marks":19307,"value":959,"nodeType":865},{},[],{"data":19309,"content":19310,"nodeType":894},{},[],{"data":19312,"content":19313,"nodeType":904},{},[19314],{"data":19315,"marks":19316,"value":19317,"nodeType":865},{},[],"Detecting and blocking ClickFix-style malicious copy and paste attacks",{"data":19319,"content":19320,"nodeType":1860},{},[19321],{"data":19322,"marks":19323,"value":18964,"nodeType":865},{},[],{"data":19325,"content":19326,"nodeType":881},{},[19327,19331,19339,19343,19351],{"data":19328,"marks":19329,"value":19330,"nodeType":865},{},[],"ClickFix-style attacks left their mark in 2025, quickly becoming one of the most prevalent attack techniques — with ",{"data":19332,"content":19334,"nodeType":876},{"uri":19333},"https://www.scworld.com/news/clickfix-phishing-links-increased-nearly-400-in-12-months-report-says",[19335],{"data":19336,"marks":19337,"value":19338,"nodeType":865},{},[],"estimates",{"data":19340,"marks":19341,"value":19342,"nodeType":865},{},[]," of a 400 percent year-over-year increase, and another ",{"data":19344,"content":19346,"nodeType":876},{"uri":19345},"https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h12025.pdf",[19347],{"data":19348,"marks":19349,"value":19350,"nodeType":865},{},[],"report",{"data":19352,"marks":19353,"value":19354,"nodeType":865},{},[]," documenting a 517 percent growth in just the last 6 months of the year.",{"data":19356,"content":19357,"nodeType":881},{},[19358],{"data":19359,"marks":19360,"value":19361,"nodeType":865},{},[],"What is ClickFix? This attack technique prompts the user to solve some kind of problem or troubleshooting step in the browser — often presented as a CAPTCHA challenge. The key aspect of the attack is that it tricks users into running malicious commands on their device by copying malicious code from the page clipboard and running it locally. (The copy typically occurs  automatically via the page itself, but can also be performed manually by the user.)",{"data":19363,"content":19364,"nodeType":881},{},[19365],{"data":19366,"marks":19367,"value":19368,"nodeType":865},{},[],"These malicious copy and paste attacks are often used to deliver infostealer malware or remote access software, with the attacker’s end goal being stealing session cookies and credentials to facilitate attacks on business apps.",{"data":19370,"content":19371,"nodeType":881},{},[19372],{"data":19373,"marks":19374,"value":19375,"nodeType":865},{},[],"What’s especially challenging about this attack type is that it usually can only be detected after the fact — when a machine is already compromised, or malicious code attempts to execute (if EDR catches it). Even if it is detected, security teams are left flying blind when they try to determine the initial vector for the attack, and which other users might have been targeted.",{"data":19377,"content":19378,"nodeType":1860},{},[19379],{"data":19380,"marks":19381,"value":19156,"nodeType":865},{},[],{"data":19383,"content":19384,"nodeType":881},{},[19385],{"data":19386,"marks":19387,"value":19388,"nodeType":865},{},[],"Because of our position in the browser, Push is uniquely positioned to detect and block browser-native attacks like ClickFix and other forms of malicious copy and paste techniques. So that’s what we built.",{"data":19390,"content":19394,"nodeType":890},{"target":19391},{"sys":19392},{"id":19393,"type":887,"linkType":888},"56jVT7dbNqUGiSRTfTCQw2",[],{"data":19396,"content":19397,"nodeType":881},{},[19398,19402,19406],{"data":19399,"marks":19400,"value":19401,"nodeType":865},{},[],"With our ",{"data":19403,"marks":19404,"value":19230,"nodeType":865},{},[19405],{"type":902},{"data":19407,"marks":19408,"value":19409,"nodeType":865},{},[],", you can:",{"data":19411,"content":19412,"nodeType":1818},{},[19413,19423,19433,19443],{"data":19414,"content":19415,"nodeType":1734},{},[19416],{"data":19417,"content":19418,"nodeType":881},{},[19419],{"data":19420,"marks":19421,"value":19422,"nodeType":865},{},[],"Detect ClickFix-style attacks as soon as they target end-users, regardless of the delivery channel for the lure, or the specifics of the malware type and execution.",{"data":19424,"content":19425,"nodeType":1734},{},[19426],{"data":19427,"content":19428,"nodeType":881},{},[19429],{"data":19430,"marks":19431,"value":19432,"nodeType":865},{},[],"Block these attacks before the malicious code is copied to the clipboard.",{"data":19434,"content":19435,"nodeType":1734},{},[19436],{"data":19437,"content":19438,"nodeType":881},{},[19439],{"data":19440,"marks":19441,"value":19442,"nodeType":865},{},[],"Safely collect the payload for further investigation by your security team, and replace the clipboard contents with safe text as part of the blocking action.",{"data":19444,"content":19445,"nodeType":1734},{},[19446],{"data":19447,"content":19448,"nodeType":881},{},[19449],{"data":19450,"marks":19451,"value":19452,"nodeType":865},{},[],"Capture a detailed timeline of events to see how users were targeted and how the attack unfolded.",{"data":19454,"content":19458,"nodeType":890},{"target":19455},{"sys":19456},{"id":19457,"type":887,"linkType":888},"sALkMt8UbTZ2f34hKvGLj",[],{"data":19460,"content":19461,"nodeType":881},{},[19462,19466,19476],{"data":19463,"marks":19464,"value":19465,"nodeType":865},{},[],"Learn more about ClickFix detection in our ",{"data":19467,"content":19471,"nodeType":19000},{"target":19468},{"sys":19469},{"id":19470,"type":887,"linkType":888},"7jygmadjoz0asAHv7e5PuK",[19472],{"data":19473,"marks":19474,"value":19475,"nodeType":865},{},[],"documentation",{"data":19477,"marks":19478,"value":959,"nodeType":865},{},[],{"data":19480,"content":19481,"nodeType":894},{},[],{"data":19483,"content":19484,"nodeType":904},{},[19485],{"data":19486,"marks":19487,"value":19488,"nodeType":865},{},[],"Getting ahead of breaches tied to stolen credentials and ghost logins",{"data":19490,"content":19491,"nodeType":1860},{},[19492],{"data":19493,"marks":19494,"value":18964,"nodeType":865},{},[],{"data":19496,"content":19497,"nodeType":881},{},[19498,19502,19512],{"data":19499,"marks":19500,"value":19501,"nodeType":865},{},[],"Starting in November 2024 and continuing through July 2025, adversaries linked to the HELLCAT threat group compromised Jira tenants belonging to 10 organizations using ",{"data":19503,"content":19507,"nodeType":19000},{"target":19504},{"sys":19505},{"id":19506,"type":887,"linkType":888},"gANCbeL9AnxmbGAE5HhyG",[19508],{"data":19509,"marks":19510,"value":19511,"nodeType":865},{},[],"stolen credentials",{"data":19513,"marks":19514,"value":14775,"nodeType":865},{},[],{"data":19516,"content":19517,"nodeType":881},{},[19518],{"data":19519,"marks":19520,"value":19521,"nodeType":865},{},[],"Business-critical applications like Jira are prime targets for attackers, who in this case dumped valuable data and then held it for ransom (or sold it on criminal marketplaces). Of course, this isn’t just a problem for Jira — data from Push’s initial deployment into customer environments shows that lots of critical apps lack basic controls like strong passwords and MFA.",{"data":19523,"content":19524,"nodeType":881},{},[19525,19529,19537,19541,19547],{"data":19526,"marks":19527,"value":19528,"nodeType":865},{},[],"The evolving threat group known as ",{"data":19530,"content":19533,"nodeType":19000},{"target":19531},{"sys":19532},{"id":10804,"type":887,"linkType":888},[19534],{"data":19535,"marks":19536,"value":1752,"nodeType":865},{},[],{"data":19538,"marks":19539,"value":19540,"nodeType":865},{},[]," has also embraced the use of stolen creds, session cookies, and unprotected local account logins — aka ",{"data":19542,"content":19543,"nodeType":876},{"uri":11116},[19544],{"data":19545,"marks":19546,"value":11122,"nodeType":865},{},[],{"data":19548,"marks":19549,"value":19550,"nodeType":865},{},[]," — to compromise large organizations.",{"data":19552,"content":19553,"nodeType":881},{},[19554,19558,19567],{"data":19555,"marks":19556,"value":19557,"nodeType":865},{},[],"In 2025, Red Hat’s GitLab instance was compromised due to a local account that essentially provided a backdoor to an otherwise secure and SSO-connected account — an attack reminiscent of the ",{"data":19559,"content":19563,"nodeType":19000},{"target":19560},{"sys":19561},{"id":19562,"type":887,"linkType":888},"PAPJPr3CIB6J20udYyy1r",[19564],{"data":19565,"marks":19566,"value":5480,"nodeType":865},{},[],{"data":19568,"marks":19569,"value":19570,"nodeType":865},{},[],", which targeted local logins that lacked MFA.",{"data":19572,"content":19573,"nodeType":1860},{},[19574],{"data":19575,"marks":19576,"value":19156,"nodeType":865},{},[],{"data":19578,"content":19579,"nodeType":881},{},[19580,19584,19594],{"data":19581,"marks":19582,"value":19583,"nodeType":865},{},[],"Push already provided the ability to detect stolen credentials being actively used by employees in your organization with our ",{"data":19585,"content":19589,"nodeType":19000},{"target":19586},{"sys":19587},{"id":19588,"type":887,"linkType":888},"6vCr4d3R1XA1E8dU883l7N",[19590],{"data":19591,"marks":19592,"value":19593,"nodeType":865},{},[],"Stolen credential detection control",{"data":19595,"marks":19596,"value":19597,"nodeType":865},{},[],". This provides an early-warning signal when Push finds a match between credentials for sale on criminal forums with those still being used by your employees, reducing some 99.5% of false positives we usually see with TI feed data.",{"data":19599,"content":19600,"nodeType":881},{},[19601],{"data":19602,"marks":19603,"value":19604,"nodeType":865},{},[],"With Push, you can also identify where employees are logging in with passwords on apps that otherwise should be using SAML, OIDC, or some other federated mechanism — aka the ghost login vulnerability.",{"data":19606,"content":19607,"nodeType":881},{},[19608],{"data":19609,"marks":19610,"value":19611,"nodeType":865},{},[],"This year, we made it easier for security teams to enforce two security fundamentals that help harden accounts and reduce the risk of ATO, even on unmanaged apps:",{"data":19613,"content":19614,"nodeType":1818},{},[19615,19644],{"data":19616,"content":19617,"nodeType":1734},{},[19618],{"data":19619,"content":19620,"nodeType":881},{},[19621,19626,19630,19640],{"data":19622,"marks":19623,"value":19625,"nodeType":865},{},[19624],{"type":902},"Strong password enforcement:",{"data":19627,"marks":19628,"value":19629,"nodeType":865},{},[]," With this control, you can prompt end-users to ",{"data":19631,"content":19635,"nodeType":19000},{"target":19632},{"sys":19633},{"id":19634,"type":887,"linkType":888},"5aB5x5VXrMv7PDmH0iiK0c",[19636],{"data":19637,"marks":19638,"value":19639,"nodeType":865},{},[],"fix an insecure password",{"data":19641,"marks":19642,"value":19643,"nodeType":865},{},[]," on all your workforce apps, even the ones you don’t centrally manage. ",{"data":19645,"content":19646,"nodeType":1734},{},[19647],{"data":19648,"content":19649,"nodeType":881},{},[19650,19655,19658,19668],{"data":19651,"marks":19652,"value":19654,"nodeType":865},{},[19653],{"type":902},"MFA enforcement:",{"data":19656,"marks":19657,"value":19629,"nodeType":865},{},[],{"data":19659,"content":19663,"nodeType":19000},{"target":19660},{"sys":19661},{"id":19662,"type":887,"linkType":888},"wikyVxlHwKUOKM9xo19eP",[19664],{"data":19665,"marks":19666,"value":19667,"nodeType":865},{},[],"register for MFA",{"data":19669,"marks":19670,"value":19671,"nodeType":865},{},[]," where Push detects it’s missing — again, even on unmanaged apps.",{"data":19673,"content":19674,"nodeType":881},{},[19675],{"data":19676,"marks":19677,"value":19678,"nodeType":865},{},[],"Both of these controls use in-browser banners to provide point-in-time guidance to users when they’re most likely to see it and act on it.",{"data":19680,"content":19684,"nodeType":890},{"target":19681},{"sys":19682},{"id":19683,"type":887,"linkType":888},"3XH0hnnhcZNI47PhdiD4q0",[],{"data":19686,"content":19687,"nodeType":881},{},[19688,19692,19697],{"data":19689,"marks":19690,"value":19691,"nodeType":865},{},[],"To address the pattern of adversaries moving from targeting hardened core apps such as identity providers to the likes of GitLab, Postman, Jira, and others containing valuable corporate data, we also expanded one of the Push platform’s core security controls called ",{"data":19693,"marks":19694,"value":19696,"nodeType":865},{},[19695],{"type":902},"Password protection",{"data":19698,"marks":19699,"value":959,"nodeType":865},{},[],{"data":19701,"content":19702,"nodeType":881},{},[19703,19706,19710],{"data":19704,"marks":19705,"value":5069,"nodeType":865},{},[],{"data":19707,"marks":19708,"value":19696,"nodeType":865},{},[19709],{"type":902},{"data":19711,"marks":19712,"value":19713,"nodeType":865},{},[]," control previously could be applied only to IdP passwords, allowing you to essentially “pin” the credential for those systems so that it could never be entered on a phishing page or reused on any other app. ",{"data":19715,"content":19716,"nodeType":881},{},[19717,19721,19731],{"data":19718,"marks":19719,"value":19720,"nodeType":865},{},[],"We expanded that control to allow you to ",{"data":19722,"content":19726,"nodeType":19000},{"target":19723},{"sys":19724},{"id":19725,"type":887,"linkType":888},"6FYHbkcRUrtznPo7RarRsz",[19727],{"data":19728,"marks":19729,"value":19730,"nodeType":865},{},[],"protect passwords on any valuable app",{"data":19732,"marks":19733,"value":19734,"nodeType":865},{},[],", preventing account takeover through phished creds and reducing the blast radius of attacks when a compromised account has been reusing passwords on multiple applications.",{"data":19736,"content":19740,"nodeType":890},{"target":19737},{"sys":19738},{"id":19739,"type":887,"linkType":888},"74l82HIeaumFX4u9AMjj79",[],{"data":19742,"content":19743,"nodeType":881},{},[19744,19748,19758],{"data":19745,"marks":19746,"value":19747,"nodeType":865},{},[],"Push also now gives you visibility into where employees are ",{"data":19749,"content":19753,"nodeType":19000},{"target":19750},{"sys":19751},{"id":19752,"type":887,"linkType":888},"7uLeQ9twNl5RyNaWkkJNjd",[19754],{"data":19755,"marks":19756,"value":19757,"nodeType":865},{},[],"syncing their corporate browser profile",{"data":19759,"marks":19760,"value":19761,"nodeType":865},{},[]," to a personal profile, raising the risk of syncing corporate passwords to unmanaged devices — another vector for credential harvesting if those endpoints become compromised.",{"data":19763,"content":19764,"nodeType":881},{},[19765],{"data":19766,"marks":19767,"value":19768,"nodeType":865},{},[],"And of course, underlying all these features is the foundational visibility of all your apps, accounts, account vulnerabilities, and login methods that Push provides.",{"data":19770,"content":19771,"nodeType":894},{},[],{"data":19773,"content":19774,"nodeType":904},{},[19775],{"data":19776,"marks":19777,"value":19778,"nodeType":865},{},[],"Blocking malicious browser extensions",{"data":19780,"content":19781,"nodeType":1860},{},[19782],{"data":19783,"marks":19784,"value":18964,"nodeType":865},{},[],{"data":19786,"content":19787,"nodeType":881},{},[19788],{"data":19789,"marks":19790,"value":19791,"nodeType":865},{},[],"Getting visibility and control over all the browser extensions used across your workforce has long been a thorny problem for security teams. ",{"data":19793,"content":19794,"nodeType":881},{},[19795],{"data":19796,"marks":19797,"value":19798,"nodeType":865},{},[],"The possible solutions haven’t been great, either. Teams could either apply a blunt-force block for most or all extensions, or spend painstaking time trying to understand what was installed, why, and by whom, across all the browsers in the environment.",{"data":19800,"content":19801,"nodeType":881},{},[19802,19806,19816],{"data":19803,"marks":19804,"value":19805,"nodeType":865},{},[],"The urgency of solving this problem increased for many organizations this year after the December 2024 compromise of at least 35 Google Chrome extensions in a ",{"data":19807,"content":19811,"nodeType":19000},{"target":19808},{"sys":19809},{"id":19810,"type":887,"linkType":888},"6sprbTRpfnTJsP3mGR2gKa",[19812],{"data":19813,"marks":19814,"value":19815,"nodeType":865},{},[],"campaign targeting browser extension developers",{"data":19817,"marks":19818,"value":19819,"nodeType":865},{},[],". Cyberhaven’s extension was one of these, and the campaign inherited their name.",{"data":19821,"content":19822,"nodeType":1860},{},[19823],{"data":19824,"marks":19825,"value":19156,"nodeType":865},{},[],{"data":19827,"content":19828,"nodeType":881},{},[19829,19833,19843],{"data":19830,"marks":19831,"value":19832,"nodeType":865},{},[],"With Push, you can now get visibility across ",{"data":19834,"content":19838,"nodeType":19000},{"target":19835},{"sys":19836},{"id":19837,"type":887,"linkType":888},"3ibVBa6u0XfcXXDVtON5th",[19839],{"data":19840,"marks":19841,"value":19842,"nodeType":865},{},[],"all the browser extensions",{"data":19844,"marks":19845,"value":19846,"nodeType":865},{},[]," installed on employee browsers in your environment, and block the ones you don’t want.",{"data":19848,"content":19852,"nodeType":890},{"target":19849},{"sys":19850},{"id":19851,"type":887,"linkType":888},"5J5jdmwugy7yU8GGwxe7iH",[],{"data":19854,"content":19855,"nodeType":881},{},[19856],{"data":19857,"marks":19858,"value":19859,"nodeType":865},{},[],"You can also:",{"data":19861,"content":19862,"nodeType":1818},{},[19863,19873,19883],{"data":19864,"content":19865,"nodeType":1734},{},[19866],{"data":19867,"content":19868,"nodeType":881},{},[19869],{"data":19870,"marks":19871,"value":19872,"nodeType":865},{},[],"Review extensions with risky permissions.",{"data":19874,"content":19875,"nodeType":1734},{},[19876],{"data":19877,"content":19878,"nodeType":881},{},[19879],{"data":19880,"marks":19881,"value":19882,"nodeType":865},{},[],"Identify extensions with potentially suspicious installation methods, such as sideloaded or manually installed.",{"data":19884,"content":19885,"nodeType":1734},{},[19886],{"data":19887,"content":19888,"nodeType":881},{},[19889],{"data":19890,"marks":19891,"value":19892,"nodeType":865},{},[],"Block extensions based on user groups and browser profiles (e.g. profiles logged in with a company domain).",{"data":19894,"content":19895,"nodeType":881},{},[19896,19900,19908],{"data":19897,"marks":19898,"value":19899,"nodeType":865},{},[],"Learn more about extension visibility and management in our ",{"data":19901,"content":19904,"nodeType":19000},{"target":19902},{"sys":19903},{"id":19837,"type":887,"linkType":888},[19905],{"data":19906,"marks":19907,"value":19475,"nodeType":865},{},[],{"data":19909,"marks":19910,"value":959,"nodeType":865},{},[],{"data":19912,"content":19913,"nodeType":894},{},[],{"data":19915,"content":19916,"nodeType":904},{},[19917],{"data":19918,"marks":19919,"value":19920,"nodeType":865},{},[],"Adding a layer of protection against help desk scams",{"data":19922,"content":19923,"nodeType":1860},{},[19924],{"data":19925,"marks":19926,"value":18964,"nodeType":865},{},[],{"data":19928,"content":19929,"nodeType":881},{},[19930],{"data":19931,"marks":19932,"value":19933,"nodeType":865},{},[],"Finally, another big theme in this year’s TTPs was the use of help desk social engineering to compromise organizations. ",{"data":19935,"content":19936,"nodeType":881},{},[19937,19941,19951],{"data":19938,"marks":19939,"value":19940,"nodeType":865},{},[],"Attackers like ",{"data":19942,"content":19946,"nodeType":19000},{"target":19943},{"sys":19944},{"id":19945,"type":887,"linkType":888},"wgpdyHDn9NcpIJNr7jnFp",[19947],{"data":19948,"marks":19949,"value":19950,"nodeType":865},{},[],"Scattered Spider",{"data":19952,"marks":19953,"value":19954,"nodeType":865},{},[]," — now known as part of the evolving cybercriminal group Scattered Lapsus$ Hunters — have targeted organizations including MGM Resorts and Marks & Spencer by convincing help desk staff to help them bypass MFA or reset credentials for accounts they then use to access corporate systems. ",{"data":19956,"content":19957,"nodeType":1860},{},[19958],{"data":19959,"marks":19960,"value":19156,"nodeType":865},{},[],{"data":19962,"content":19963,"nodeType":881},{},[19964,19968,19973],{"data":19965,"marks":19966,"value":19967,"nodeType":865},{},[],"To provide an additional layer of security when verifying employee identities during help desk interactions, Push introduced ",{"data":19969,"marks":19970,"value":19972,"nodeType":865},{},[19971],{"type":902},"Employee verification codes",{"data":19974,"marks":19975,"value":959,"nodeType":865},{},[],{"data":19977,"content":19981,"nodeType":890},{"target":19978},{"sys":19979},{"id":19980,"type":887,"linkType":888},"19Baqh5QwbonzsR0EcaDS8",[],{"data":19983,"content":19984,"nodeType":881},{},[19985],{"data":19986,"marks":19987,"value":19988,"nodeType":865},{},[],"These are a rotating 6-digit verification code accessible via the Push Security extension dropdown. When an employee contacts your help desk, staff can use this code to help verify their identity before performing any sensitive account changes.",{"data":19990,"content":19991,"nodeType":881},{},[19992],{"data":19993,"marks":19994,"value":19995,"nodeType":865},{},[],"Employee verification codes are lightweight, rotate every 24 hours, and don’t require any additional apps or devices.",{"data":19997,"content":19998,"nodeType":881},{},[19999,20003,20012],{"data":20000,"marks":20001,"value":20002,"nodeType":865},{},[],"Learn more about verification codes in our ",{"data":20004,"content":20008,"nodeType":19000},{"target":20005},{"sys":20006},{"id":20007,"type":887,"linkType":888},"4rLP8wr6HnvBG2OzqYYKpF",[20009],{"data":20010,"marks":20011,"value":19304,"nodeType":865},{},[],{"data":20013,"marks":20014,"value":959,"nodeType":865},{},[],{"data":20016,"content":20017,"nodeType":894},{},[],{"data":20019,"content":20020,"nodeType":904},{},[20021],{"data":20022,"marks":20023,"value":4448,"nodeType":865},{},[],{"data":20025,"content":20026,"nodeType":881},{},[20027],{"data":20028,"marks":20029,"value":20030,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking. ",{"data":20032,"content":20033,"nodeType":881},{},[20034],{"data":20035,"marks":20036,"value":20037,"nodeType":865},{},[],"You don’t need to wait until it all goes wrong — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":20039,"content":20040,"nodeType":881},{},[20041,20045,20053,20057,20064],{"data":20042,"marks":20043,"value":20044,"nodeType":865},{},[],"To learn more about Push, check out our latest ",{"data":20046,"content":20048,"nodeType":876},{"uri":20047},"/resources/product-brochure",[20049],{"data":20050,"marks":20051,"value":20052,"nodeType":865},{},[],"product overview",{"data":20054,"marks":20055,"value":20056,"nodeType":865},{},[]," or book some time with one of our team for a ",{"data":20058,"content":20060,"nodeType":876},{"uri":20059},"/demo",[20061],{"data":20062,"marks":20063,"value":5355,"nodeType":865},{},[],{"data":20065,"marks":20066,"value":959,"nodeType":865},{},[],"Taking the fight to attackers: Push’s top features of 2025","Here’s how real-world attacks and our own R&D informed what we built for Push customers over the last year.","2025-12-17T00:00:00.000Z","taking-the-fight-to-attackers-top-features-of-2025",{"items":20072},[20073,20075],{"sys":20074,"name":342},{"id":4510},{"sys":20076,"name":4507},{"id":4506},{"items":20078},[20079],{"fullName":20080,"firstName":20081,"jobTitle":20082,"profilePicture":20083},"Kelly Davenport","Kelly","Product Team",{"url":20084},"https://images.ctfassets.net/y1cdw1ablpvd/1hi8bEuVfn5sF57LivAq6d/9a3b82426c697d765e2e450e33a18424/kelly_profile_pic.jpeg",{"__typename":1485,"sys":20086,"content":20087,"title":11751,"synopsis":11752,"hashTags":59,"publishedDate":11753,"slug":11754,"tagsCollection":20903,"authorsCollection":20909},{"id":10804},{"json":20088},{"data":20089,"content":20090,"nodeType":1463},{},[20091,20097,20103,20109,20112,20119,20125,20131,20136,20142,20147,20163,20169,20179,20182,20189,20195,20208,20214,20224,20229,20232,20239,20246,20251,20259,20275,20283,20289,20297,20312,20320,20326,20334,20360,20368,20374,20382,20398,20403,20411,20417,20425,20458,20461,20468,20476,20492,20500,20506,20514,20540,20545,20553,20559,20564,20567,20574,20582,20588,20639,20644,20647,20654,20662,20668,20673,20676,20683,20689,20695,20755,20761,20816,20822,20825,20832,20838,20844,20849,20852,20859,20865,20871,20877],{"data":20092,"content":20093,"nodeType":881},{},[20094],{"data":20095,"marks":20096,"value":10815,"nodeType":865},{},[],{"data":20098,"content":20099,"nodeType":881},{},[20100],{"data":20101,"marks":20102,"value":10822,"nodeType":865},{},[],{"data":20104,"content":20105,"nodeType":881},{},[20106],{"data":20107,"marks":20108,"value":10829,"nodeType":865},{},[],{"data":20110,"content":20111,"nodeType":894},{},[],{"data":20113,"content":20114,"nodeType":904},{},[20115],{"data":20116,"marks":20117,"value":10840,"nodeType":865},{},[20118],{"type":902},{"data":20120,"content":20121,"nodeType":881},{},[20122],{"data":20123,"marks":20124,"value":10847,"nodeType":865},{},[],{"data":20126,"content":20127,"nodeType":881},{},[20128],{"data":20129,"marks":20130,"value":10854,"nodeType":865},{},[],{"data":20132,"content":20135,"nodeType":890},{"target":20133},{"sys":20134},{"id":10859,"type":887,"linkType":888},[],{"data":20137,"content":20138,"nodeType":881},{},[20139],{"data":20140,"marks":20141,"value":10867,"nodeType":865},{},[],{"data":20143,"content":20146,"nodeType":890},{"target":20144},{"sys":20145},{"id":10872,"type":887,"linkType":888},[],{"data":20148,"content":20149,"nodeType":881},{},[20150,20153,20160],{"data":20151,"marks":20152,"value":10880,"nodeType":865},{},[],{"data":20154,"content":20155,"nodeType":876},{"uri":5475},[20156],{"data":20157,"marks":20158,"value":10888,"nodeType":865},{},[20159],{"type":874},{"data":20161,"marks":20162,"value":10892,"nodeType":865},{},[],{"data":20164,"content":20165,"nodeType":881},{},[20166],{"data":20167,"marks":20168,"value":10899,"nodeType":865},{},[],{"data":20170,"content":20171,"nodeType":881},{},[20172,20175],{"data":20173,"marks":20174,"value":10906,"nodeType":865},{},[],{"data":20176,"marks":20177,"value":10911,"nodeType":865},{},[20178],{"type":902},{"data":20180,"content":20181,"nodeType":894},{},[],{"data":20183,"content":20184,"nodeType":904},{},[20185],{"data":20186,"marks":20187,"value":10922,"nodeType":865},{},[20188],{"type":902},{"data":20190,"content":20191,"nodeType":881},{},[20192],{"data":20193,"marks":20194,"value":10929,"nodeType":865},{},[],{"data":20196,"content":20197,"nodeType":881},{},[20198,20201,20205],{"data":20199,"marks":20200,"value":10936,"nodeType":865},{},[],{"data":20202,"marks":20203,"value":10941,"nodeType":865},{},[20204],{"type":902},{"data":20206,"marks":20207,"value":10945,"nodeType":865},{},[],{"data":20209,"content":20210,"nodeType":881},{},[20211],{"data":20212,"marks":20213,"value":10952,"nodeType":865},{},[],{"data":20215,"content":20216,"nodeType":881},{},[20217,20220],{"data":20218,"marks":20219,"value":10959,"nodeType":865},{},[],{"data":20221,"marks":20222,"value":10964,"nodeType":865},{},[20223],{"type":902},{"data":20225,"content":20228,"nodeType":890},{"target":20226},{"sys":20227},{"id":10969,"type":887,"linkType":888},[],{"data":20230,"content":20231,"nodeType":894},{},[],{"data":20233,"content":20234,"nodeType":904},{},[20235],{"data":20236,"marks":20237,"value":10981,"nodeType":865},{},[20238],{"type":902},{"data":20240,"content":20241,"nodeType":1860},{},[20242],{"data":20243,"marks":20244,"value":10989,"nodeType":865},{},[20245],{"type":902},{"data":20247,"content":20250,"nodeType":890},{"target":20248},{"sys":20249},{"id":10994,"type":887,"linkType":888},[],{"data":20252,"content":20253,"nodeType":881},{},[20254],{"data":20255,"marks":20256,"value":11004,"nodeType":865},{},[20257,20258],{"type":902},{"type":874},{"data":20260,"content":20261,"nodeType":881},{},[20262,20265,20272],{"data":20263,"marks":20264,"value":11011,"nodeType":865},{},[],{"data":20266,"content":20267,"nodeType":876},{"uri":11014},[20268],{"data":20269,"marks":20270,"value":11020,"nodeType":865},{},[20271],{"type":874},{"data":20273,"marks":20274,"value":11024,"nodeType":865},{},[],{"data":20276,"content":20277,"nodeType":881},{},[20278],{"data":20279,"marks":20280,"value":11033,"nodeType":865},{},[20281,20282],{"type":902},{"type":874},{"data":20284,"content":20285,"nodeType":881},{},[20286],{"data":20287,"marks":20288,"value":11040,"nodeType":865},{},[],{"data":20290,"content":20291,"nodeType":881},{},[20292],{"data":20293,"marks":20294,"value":11049,"nodeType":865},{},[20295,20296],{"type":902},{"type":874},{"data":20298,"content":20299,"nodeType":881},{},[20300,20303,20309],{"data":20301,"marks":20302,"value":11056,"nodeType":865},{},[],{"data":20304,"content":20305,"nodeType":876},{"uri":11059},[20306],{"data":20307,"marks":20308,"value":11064,"nodeType":865},{},[],{"data":20310,"marks":20311,"value":11068,"nodeType":865},{},[],{"data":20313,"content":20314,"nodeType":881},{},[20315],{"data":20316,"marks":20317,"value":11077,"nodeType":865},{},[20318,20319],{"type":902},{"type":874},{"data":20321,"content":20322,"nodeType":881},{},[20323],{"data":20324,"marks":20325,"value":11084,"nodeType":865},{},[],{"data":20327,"content":20328,"nodeType":881},{},[20329],{"data":20330,"marks":20331,"value":11093,"nodeType":865},{},[20332,20333],{"type":902},{"type":874},{"data":20335,"content":20336,"nodeType":881},{},[20337,20340,20347,20350,20357],{"data":20338,"marks":20339,"value":11100,"nodeType":865},{},[],{"data":20341,"content":20342,"nodeType":876},{"uri":11103},[20343],{"data":20344,"marks":20345,"value":11109,"nodeType":865},{},[20346],{"type":874},{"data":20348,"marks":20349,"value":11113,"nodeType":865},{},[],{"data":20351,"content":20352,"nodeType":876},{"uri":11116},[20353],{"data":20354,"marks":20355,"value":11122,"nodeType":865},{},[20356],{"type":874},{"data":20358,"marks":20359,"value":11126,"nodeType":865},{},[],{"data":20361,"content":20362,"nodeType":881},{},[20363],{"data":20364,"marks":20365,"value":11135,"nodeType":865},{},[20366,20367],{"type":902},{"type":874},{"data":20369,"content":20370,"nodeType":881},{},[20371],{"data":20372,"marks":20373,"value":11142,"nodeType":865},{},[],{"data":20375,"content":20376,"nodeType":881},{},[20377],{"data":20378,"marks":20379,"value":11151,"nodeType":865},{},[20380,20381],{"type":902},{"type":874},{"data":20383,"content":20384,"nodeType":881},{},[20385,20388,20395],{"data":20386,"marks":20387,"value":11158,"nodeType":865},{},[],{"data":20389,"content":20390,"nodeType":876},{"uri":11116},[20391],{"data":20392,"marks":20393,"value":11122,"nodeType":865},{},[20394],{"type":874},{"data":20396,"marks":20397,"value":11169,"nodeType":865},{},[],{"data":20399,"content":20402,"nodeType":890},{"target":20400},{"sys":20401},{"id":11174,"type":887,"linkType":888},[],{"data":20404,"content":20405,"nodeType":881},{},[20406],{"data":20407,"marks":20408,"value":11184,"nodeType":865},{},[20409,20410],{"type":902},{"type":874},{"data":20412,"content":20413,"nodeType":881},{},[20414],{"data":20415,"marks":20416,"value":11191,"nodeType":865},{},[],{"data":20418,"content":20419,"nodeType":881},{},[20420],{"data":20421,"marks":20422,"value":11200,"nodeType":865},{},[20423,20424],{"type":902},{"type":874},{"data":20426,"content":20427,"nodeType":881},{},[20428,20431,20437,20440,20446,20449,20455],{"data":20429,"marks":20430,"value":11207,"nodeType":865},{},[],{"data":20432,"content":20433,"nodeType":876},{"uri":11210},[20434],{"data":20435,"marks":20436,"value":11215,"nodeType":865},{},[],{"data":20438,"marks":20439,"value":1651,"nodeType":865},{},[],{"data":20441,"content":20442,"nodeType":876},{"uri":11221},[20443],{"data":20444,"marks":20445,"value":11226,"nodeType":865},{},[],{"data":20447,"marks":20448,"value":11230,"nodeType":865},{},[],{"data":20450,"content":20451,"nodeType":876},{"uri":5030},[20452],{"data":20453,"marks":20454,"value":11237,"nodeType":865},{},[],{"data":20456,"marks":20457,"value":11241,"nodeType":865},{},[],{"data":20459,"content":20460,"nodeType":894},{},[],{"data":20462,"content":20463,"nodeType":1860},{},[20464],{"data":20465,"marks":20466,"value":11252,"nodeType":865},{},[20467],{"type":902},{"data":20469,"content":20470,"nodeType":881},{},[20471],{"data":20472,"marks":20473,"value":11261,"nodeType":865},{},[20474,20475],{"type":902},{"type":874},{"data":20477,"content":20478,"nodeType":881},{},[20479,20482,20489],{"data":20480,"marks":20481,"value":11268,"nodeType":865},{},[],{"data":20483,"content":20484,"nodeType":876},{"uri":11271},[20485],{"data":20486,"marks":20487,"value":11277,"nodeType":865},{},[20488],{"type":874},{"data":20490,"marks":20491,"value":11281,"nodeType":865},{},[],{"data":20493,"content":20494,"nodeType":881},{},[20495],{"data":20496,"marks":20497,"value":11290,"nodeType":865},{},[20498,20499],{"type":902},{"type":874},{"data":20501,"content":20502,"nodeType":881},{},[20503],{"data":20504,"marks":20505,"value":11297,"nodeType":865},{},[],{"data":20507,"content":20508,"nodeType":881},{},[20509],{"data":20510,"marks":20511,"value":11306,"nodeType":865},{},[20512,20513],{"type":902},{"type":874},{"data":20515,"content":20516,"nodeType":881},{},[20517,20520,20527,20530,20537],{"data":20518,"marks":20519,"value":11313,"nodeType":865},{},[],{"data":20521,"content":20522,"nodeType":876},{"uri":11316},[20523],{"data":20524,"marks":20525,"value":11322,"nodeType":865},{},[20526],{"type":874},{"data":20528,"marks":20529,"value":11326,"nodeType":865},{},[],{"data":20531,"content":20532,"nodeType":876},{"uri":11329},[20533],{"data":20534,"marks":20535,"value":11335,"nodeType":865},{},[20536],{"type":874},{"data":20538,"marks":20539,"value":11339,"nodeType":865},{},[],{"data":20541,"content":20544,"nodeType":890},{"target":20542},{"sys":20543},{"id":11344,"type":887,"linkType":888},[],{"data":20546,"content":20547,"nodeType":881},{},[20548],{"data":20549,"marks":20550,"value":11354,"nodeType":865},{},[20551,20552],{"type":902},{"type":874},{"data":20554,"content":20555,"nodeType":881},{},[20556],{"data":20557,"marks":20558,"value":11361,"nodeType":865},{},[],{"data":20560,"content":20563,"nodeType":890},{"target":20561},{"sys":20562},{"id":11366,"type":887,"linkType":888},[],{"data":20565,"content":20566,"nodeType":894},{},[],{"data":20568,"content":20569,"nodeType":1860},{},[20570],{"data":20571,"marks":20572,"value":694,"nodeType":865},{},[20573],{"type":902},{"data":20575,"content":20576,"nodeType":881},{},[20577],{"data":20578,"marks":20579,"value":11386,"nodeType":865},{},[20580,20581],{"type":902},{"type":874},{"data":20583,"content":20584,"nodeType":881},{},[20585],{"data":20586,"marks":20587,"value":11393,"nodeType":865},{},[],{"data":20589,"content":20590,"nodeType":1818},{},[20591,20604,20617],{"data":20592,"content":20593,"nodeType":1734},{},[20594],{"data":20595,"content":20596,"nodeType":881},{},[20597,20601],{"data":20598,"marks":20599,"value":11407,"nodeType":865},{},[20600],{"type":902},{"data":20602,"marks":20603,"value":11411,"nodeType":865},{},[],{"data":20605,"content":20606,"nodeType":1734},{},[20607],{"data":20608,"content":20609,"nodeType":881},{},[20610,20614],{"data":20611,"marks":20612,"value":11422,"nodeType":865},{},[20613],{"type":902},{"data":20615,"marks":20616,"value":11426,"nodeType":865},{},[],{"data":20618,"content":20619,"nodeType":1734},{},[20620],{"data":20621,"content":20622,"nodeType":881},{},[20623,20627,20630,20636],{"data":20624,"marks":20625,"value":11437,"nodeType":865},{},[20626],{"type":902},{"data":20628,"marks":20629,"value":11441,"nodeType":865},{},[],{"data":20631,"content":20632,"nodeType":876},{"uri":11444},[20633],{"data":20634,"marks":20635,"value":11449,"nodeType":865},{},[],{"data":20637,"marks":20638,"value":11453,"nodeType":865},{},[],{"data":20640,"content":20643,"nodeType":890},{"target":20641},{"sys":20642},{"id":11458,"type":887,"linkType":888},[],{"data":20645,"content":20646,"nodeType":894},{},[],{"data":20648,"content":20649,"nodeType":1860},{},[20650],{"data":20651,"marks":20652,"value":699,"nodeType":865},{},[20653],{"type":902},{"data":20655,"content":20656,"nodeType":881},{},[20657],{"data":20658,"marks":20659,"value":11478,"nodeType":865},{},[20660,20661],{"type":902},{"type":874},{"data":20663,"content":20664,"nodeType":881},{},[20665],{"data":20666,"marks":20667,"value":11485,"nodeType":865},{},[],{"data":20669,"content":20672,"nodeType":890},{"target":20670},{"sys":20671},{"id":11490,"type":887,"linkType":888},[],{"data":20674,"content":20675,"nodeType":894},{},[],{"data":20677,"content":20678,"nodeType":904},{},[20679],{"data":20680,"marks":20681,"value":11502,"nodeType":865},{},[20682],{"type":902},{"data":20684,"content":20685,"nodeType":881},{},[20686],{"data":20687,"marks":20688,"value":11509,"nodeType":865},{},[],{"data":20690,"content":20691,"nodeType":881},{},[20692],{"data":20693,"marks":20694,"value":11516,"nodeType":865},{},[],{"data":20696,"content":20697,"nodeType":1818},{},[20698,20717,20736],{"data":20699,"content":20700,"nodeType":1734},{},[20701],{"data":20702,"content":20703,"nodeType":881},{},[20704,20707,20714],{"data":20705,"marks":20706,"value":11529,"nodeType":865},{},[],{"data":20708,"content":20709,"nodeType":876},{"uri":11532},[20710],{"data":20711,"marks":20712,"value":1718,"nodeType":865},{},[20713],{"type":874},{"data":20715,"marks":20716,"value":11541,"nodeType":865},{},[],{"data":20718,"content":20719,"nodeType":1734},{},[20720],{"data":20721,"content":20722,"nodeType":881},{},[20723,20726,20733],{"data":20724,"marks":20725,"value":11551,"nodeType":865},{},[],{"data":20727,"content":20728,"nodeType":876},{"uri":11554},[20729],{"data":20730,"marks":20731,"value":11560,"nodeType":865},{},[20732],{"type":874},{"data":20734,"marks":20735,"value":11541,"nodeType":865},{},[],{"data":20737,"content":20738,"nodeType":1734},{},[20739],{"data":20740,"content":20741,"nodeType":881},{},[20742,20745,20752],{"data":20743,"marks":20744,"value":11573,"nodeType":865},{},[],{"data":20746,"content":20747,"nodeType":876},{"uri":11576},[20748],{"data":20749,"marks":20750,"value":11582,"nodeType":865},{},[20751],{"type":874},{"data":20753,"marks":20754,"value":11541,"nodeType":865},{},[],{"data":20756,"content":20757,"nodeType":881},{},[20758],{"data":20759,"marks":20760,"value":11592,"nodeType":865},{},[],{"data":20762,"content":20763,"nodeType":1818},{},[20764,20777,20790,20803],{"data":20765,"content":20766,"nodeType":1734},{},[20767],{"data":20768,"content":20769,"nodeType":881},{},[20770,20774],{"data":20771,"marks":20772,"value":11606,"nodeType":865},{},[20773],{"type":902},{"data":20775,"marks":20776,"value":11610,"nodeType":865},{},[],{"data":20778,"content":20779,"nodeType":1734},{},[20780],{"data":20781,"content":20782,"nodeType":881},{},[20783,20787],{"data":20784,"marks":20785,"value":11621,"nodeType":865},{},[20786],{"type":902},{"data":20788,"marks":20789,"value":11625,"nodeType":865},{},[],{"data":20791,"content":20792,"nodeType":1734},{},[20793],{"data":20794,"content":20795,"nodeType":881},{},[20796,20800],{"data":20797,"marks":20798,"value":11636,"nodeType":865},{},[20799],{"type":902},{"data":20801,"marks":20802,"value":11640,"nodeType":865},{},[],{"data":20804,"content":20805,"nodeType":1734},{},[20806],{"data":20807,"content":20808,"nodeType":881},{},[20809,20813],{"data":20810,"marks":20811,"value":11651,"nodeType":865},{},[20812],{"type":902},{"data":20814,"marks":20815,"value":11655,"nodeType":865},{},[],{"data":20817,"content":20818,"nodeType":881},{},[20819],{"data":20820,"marks":20821,"value":11662,"nodeType":865},{},[],{"data":20823,"content":20824,"nodeType":894},{},[],{"data":20826,"content":20827,"nodeType":904},{},[20828],{"data":20829,"marks":20830,"value":11673,"nodeType":865},{},[20831],{"type":902},{"data":20833,"content":20834,"nodeType":881},{},[20835],{"data":20836,"marks":20837,"value":11680,"nodeType":865},{},[],{"data":20839,"content":20840,"nodeType":881},{},[20841],{"data":20842,"marks":20843,"value":11687,"nodeType":865},{},[],{"data":20845,"content":20848,"nodeType":890},{"target":20846},{"sys":20847},{"id":11692,"type":887,"linkType":888},[],{"data":20850,"content":20851,"nodeType":894},{},[],{"data":20853,"content":20854,"nodeType":904},{},[20855],{"data":20856,"marks":20857,"value":5936,"nodeType":865},{},[20858],{"type":902},{"data":20860,"content":20861,"nodeType":881},{},[20862],{"data":20863,"marks":20864,"value":11710,"nodeType":865},{},[],{"data":20866,"content":20867,"nodeType":881},{},[20868],{"data":20869,"marks":20870,"value":11717,"nodeType":865},{},[],{"data":20872,"content":20873,"nodeType":881},{},[20874],{"data":20875,"marks":20876,"value":11724,"nodeType":865},{},[],{"data":20878,"content":20879,"nodeType":881},{},[20880,20883,20890,20893,20900],{"data":20881,"marks":20882,"value":4462,"nodeType":865},{},[],{"data":20884,"content":20885,"nodeType":876},{"uri":4465},[20886],{"data":20887,"marks":20888,"value":4471,"nodeType":865},{},[20889],{"type":874},{"data":20891,"marks":20892,"value":8048,"nodeType":865},{},[],{"data":20894,"content":20895,"nodeType":876},{"uri":1453},[20896],{"data":20897,"marks":20898,"value":4495,"nodeType":865},{},[20899],{"type":874},{"data":20901,"marks":20902,"value":959,"nodeType":865},{},[],{"items":20904},[20905,20907],{"sys":20906,"name":4507},{"id":4506},{"sys":20908,"name":342},{"id":4510},{"items":20910},[20911],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":20912},{"url":5377},"blog/unpacking-the-latest-slh-campaign",{"json":20915},{"data":20916,"content":20917,"nodeType":1463},{},[20918],{"data":20919,"content":20920,"nodeType":881},{},[20921],{"data":20922,"marks":20923,"value":20924,"nodeType":865},{},[],"Analyzing the latest Scattered Lapsus$ Hunters (SLH) phishing campaign targeting hundreds of organizations. ",{"id":16610,"publishedAt":20926},"2026-08-12T11:53:16.417Z",{"items":20928},[20929,20931],{"sys":20930,"name":4507},{"id":4506},{"sys":20932,"name":342},{"id":4510},{"items":20934},[20935,20937,20939,20941,20943,20945,20947,20949,20951,20953,20955,20957,20959,20961,20963,20965,20967],{"sys":20936,"name":279,"slug":280,"tier":31},{"id":276},{"sys":20938,"name":413,"slug":414,"tier":31},{"id":410},{"sys":20940,"name":519,"slug":520,"tier":31},{"id":516},{"sys":20942,"name":342,"slug":343,"tier":31},{"id":339},{"sys":20944,"name":642,"slug":643,"tier":31},{"id":639},{"sys":20946,"name":650,"slug":651,"tier":45},{"id":647},{"sys":20948,"name":261,"slug":262,"tier":45},{"id":258},{"sys":20950,"name":571,"slug":572,"tier":45},{"id":568},{"sys":20952,"name":466,"slug":467,"tier":45},{"id":463},{"sys":20954,"name":607,"slug":608,"tier":45},{"id":604},{"sys":20956,"name":511,"slug":512,"tier":45},{"id":508},{"sys":20958,"name":324,"slug":325,"tier":45},{"id":321},{"sys":20960,"name":475,"slug":476,"tier":45},{"id":472},{"sys":20962,"name":395,"slug":396,"tier":45},{"id":392},{"sys":20964,"name":493,"slug":494,"tier":45},{"id":490},{"sys":20966,"name":537,"slug":538,"tier":45},{"id":534},{"sys":20968,"name":404,"slug":405,"tier":45},{"id":401},"nlrbqqJFVIlz8E8KpfsQufXY-yj--6GLH62nM04r1CY",{"id":20971,"title":18756,"authorsCollection":20972,"content":20977,"extension":228,"faqItemsCollection":21703,"faqTitle":59,"featured":6,"hashTags":59,"meta":21705,"metaTitle":21706,"ogImage":59,"postType":7216,"publishedDate":18758,"relatedBlogPostsCollection":21707,"slug":18759,"stem":24206,"subtitle":59,"summary":24207,"synopsis":18757,"sys":24218,"tagsCollection":24220,"topicsCollection":24226,"__hash__":24248},"blog/blog/consentfix-debrief.json",{"items":20973},[20974],{"fullName":5373,"firstName":5374,"jobTitle":5375,"socialLinks":20975,"profilePicture":20976},[6440],{"url":5377},{"json":20978,"links":21679},{"data":20979,"content":20980,"nodeType":1463},{},[20981,20997,21003,21008,21054,21060,21066,21069,21076,21082,21088,21134,21141,21147,21168,21174,21177,21184,21190,21196,21202,21208,21214,21220,21225,21232,21238,21254,21270,21273,21280,21286,21292,21298,21305,21321,21327,21332,21339,21355,21371,21473,21476,21483,21489,21495,21498,21505,21511,21517,21523,21582,21608,21611,21618,21624,21630,21636,21642,21668,21673],{"data":20982,"content":20983,"nodeType":881},{},[20984,20987,20994],{"data":20985,"marks":20986,"value":17967,"nodeType":865},{},[],{"data":20988,"content":20989,"nodeType":876},{"uri":1230},[20990],{"data":20991,"marks":20992,"value":1236,"nodeType":865},{},[20993],{"type":874},{"data":20995,"marks":20996,"value":17978,"nodeType":865},{},[],{"data":20998,"content":20999,"nodeType":881},{},[21000],{"data":21001,"marks":21002,"value":17985,"nodeType":865},{},[],{"data":21004,"content":21007,"nodeType":890},{"target":21005},{"sys":21006},{"id":17990,"type":887,"linkType":888},[],{"data":21009,"content":21010,"nodeType":881},{},[21011,21014,21021,21024,21031,21034,21041,21044,21051],{"data":21012,"marks":21013,"value":17998,"nodeType":865},{},[],{"data":21015,"content":21016,"nodeType":876},{"uri":18001},[21017],{"data":21018,"marks":21019,"value":18007,"nodeType":865},{},[21020],{"type":874},{"data":21022,"marks":21023,"value":18011,"nodeType":865},{},[],{"data":21025,"content":21026,"nodeType":876},{"uri":18014},[21027],{"data":21028,"marks":21029,"value":1718,"nodeType":865},{},[21030],{"type":874},{"data":21032,"marks":21033,"value":1877,"nodeType":865},{},[],{"data":21035,"content":21036,"nodeType":876},{"uri":18025},[21037],{"data":21038,"marks":21039,"value":18031,"nodeType":865},{},[21040],{"type":874},{"data":21042,"marks":21043,"value":1791,"nodeType":865},{},[],{"data":21045,"content":21046,"nodeType":876},{"uri":6852},[21047],{"data":21048,"marks":21049,"value":18042,"nodeType":865},{},[21050],{"type":874},{"data":21052,"marks":21053,"value":18046,"nodeType":865},{},[],{"data":21055,"content":21056,"nodeType":881},{},[21057],{"data":21058,"marks":21059,"value":18053,"nodeType":865},{},[],{"data":21061,"content":21062,"nodeType":881},{},[21063],{"data":21064,"marks":21065,"value":18060,"nodeType":865},{},[],{"data":21067,"content":21068,"nodeType":894},{},[],{"data":21070,"content":21071,"nodeType":904},{},[21072],{"data":21073,"marks":21074,"value":18071,"nodeType":865},{},[21075],{"type":902},{"data":21077,"content":21078,"nodeType":881},{},[21079],{"data":21080,"marks":21081,"value":18078,"nodeType":865},{},[],{"data":21083,"content":21084,"nodeType":881},{},[21085],{"data":21086,"marks":21087,"value":18085,"nodeType":865},{},[],{"data":21089,"content":21090,"nodeType":881},{},[21091,21094,21101,21104,21111,21114,21121,21124,21131],{"data":21092,"marks":21093,"value":18092,"nodeType":865},{},[],{"data":21095,"content":21096,"nodeType":876},{"uri":18095},[21097],{"data":21098,"marks":21099,"value":7567,"nodeType":865},{},[21100],{"type":874},{"data":21102,"marks":21103,"value":1651,"nodeType":865},{},[],{"data":21105,"content":21106,"nodeType":876},{"uri":1526},[21107],{"data":21108,"marks":21109,"value":1307,"nodeType":865},{},[21110],{"type":874},{"data":21112,"marks":21113,"value":18114,"nodeType":865},{},[],{"data":21115,"content":21116,"nodeType":876},{"uri":7585},[21117],{"data":21118,"marks":21119,"value":7591,"nodeType":865},{},[21120],{"type":874},{"data":21122,"marks":21123,"value":18125,"nodeType":865},{},[],{"data":21125,"content":21126,"nodeType":876},{"uri":1747},[21127],{"data":21128,"marks":21129,"value":18133,"nodeType":865},{},[21130],{"type":874},{"data":21132,"marks":21133,"value":959,"nodeType":865},{},[],{"data":21135,"content":21136,"nodeType":1860},{},[21137],{"data":21138,"marks":21139,"value":18144,"nodeType":865},{},[21140],{"type":902},{"data":21142,"content":21143,"nodeType":881},{},[21144],{"data":21145,"marks":21146,"value":18151,"nodeType":865},{},[],{"data":21148,"content":21149,"nodeType":1818},{},[21150,21159],{"data":21151,"content":21152,"nodeType":1734},{},[21153],{"data":21154,"content":21155,"nodeType":881},{},[21156],{"data":21157,"marks":21158,"value":18164,"nodeType":865},{},[],{"data":21160,"content":21161,"nodeType":1734},{},[21162],{"data":21163,"content":21164,"nodeType":881},{},[21165],{"data":21166,"marks":21167,"value":18174,"nodeType":865},{},[],{"data":21169,"content":21170,"nodeType":881},{},[21171],{"data":21172,"marks":21173,"value":18181,"nodeType":865},{},[],{"data":21175,"content":21176,"nodeType":894},{},[],{"data":21178,"content":21179,"nodeType":904},{},[21180],{"data":21181,"marks":21182,"value":18192,"nodeType":865},{},[21183],{"type":902},{"data":21185,"content":21186,"nodeType":881},{},[21187],{"data":21188,"marks":21189,"value":18199,"nodeType":865},{},[],{"data":21191,"content":21192,"nodeType":881},{},[21193],{"data":21194,"marks":21195,"value":18206,"nodeType":865},{},[],{"data":21197,"content":21198,"nodeType":881},{},[21199],{"data":21200,"marks":21201,"value":18213,"nodeType":865},{},[],{"data":21203,"content":21204,"nodeType":881},{},[21205],{"data":21206,"marks":21207,"value":18220,"nodeType":865},{},[],{"data":21209,"content":21210,"nodeType":881},{},[21211],{"data":21212,"marks":21213,"value":18227,"nodeType":865},{},[],{"data":21215,"content":21216,"nodeType":881},{},[21217],{"data":21218,"marks":21219,"value":18234,"nodeType":865},{},[],{"data":21221,"content":21224,"nodeType":890},{"target":21222},{"sys":21223},{"id":7424,"type":887,"linkType":888},[],{"data":21226,"content":21227,"nodeType":1860},{},[21228],{"data":21229,"marks":21230,"value":18247,"nodeType":865},{},[21231],{"type":902},{"data":21233,"content":21234,"nodeType":881},{},[21235],{"data":21236,"marks":21237,"value":18254,"nodeType":865},{},[],{"data":21239,"content":21240,"nodeType":881},{},[21241,21244,21251],{"data":21242,"marks":21243,"value":18261,"nodeType":865},{},[],{"data":21245,"content":21246,"nodeType":876},{"uri":1230},[21247],{"data":21248,"marks":21249,"value":18269,"nodeType":865},{},[21250],{"type":874},{"data":21252,"marks":21253,"value":18273,"nodeType":865},{},[],{"data":21255,"content":21256,"nodeType":881},{},[21257,21260,21267],{"data":21258,"marks":21259,"value":18280,"nodeType":865},{},[],{"data":21261,"content":21262,"nodeType":876},{"uri":18283},[21263],{"data":21264,"marks":21265,"value":18289,"nodeType":865},{},[21266],{"type":874},{"data":21268,"marks":21269,"value":18293,"nodeType":865},{},[],{"data":21271,"content":21272,"nodeType":894},{},[],{"data":21274,"content":21275,"nodeType":904},{},[21276],{"data":21277,"marks":21278,"value":18304,"nodeType":865},{},[21279],{"type":902},{"data":21281,"content":21282,"nodeType":881},{},[21283],{"data":21284,"marks":21285,"value":18311,"nodeType":865},{},[],{"data":21287,"content":21288,"nodeType":881},{},[21289],{"data":21290,"marks":21291,"value":18318,"nodeType":865},{},[],{"data":21293,"content":21294,"nodeType":881},{},[21295],{"data":21296,"marks":21297,"value":18325,"nodeType":865},{},[],{"data":21299,"content":21300,"nodeType":1860},{},[21301],{"data":21302,"marks":21303,"value":18333,"nodeType":865},{},[21304],{"type":902},{"data":21306,"content":21307,"nodeType":881},{},[21308,21311,21318],{"data":21309,"marks":21310,"value":18340,"nodeType":865},{},[],{"data":21312,"content":21313,"nodeType":876},{"uri":18001},[21314],{"data":21315,"marks":21316,"value":18348,"nodeType":865},{},[21317],{"type":874},{"data":21319,"marks":21320,"value":18352,"nodeType":865},{},[],{"data":21322,"content":21323,"nodeType":881},{},[21324],{"data":21325,"marks":21326,"value":18359,"nodeType":865},{},[],{"data":21328,"content":21331,"nodeType":890},{"target":21329},{"sys":21330},{"id":6513,"type":887,"linkType":888},[],{"data":21333,"content":21334,"nodeType":1860},{},[21335],{"data":21336,"marks":21337,"value":18372,"nodeType":865},{},[21338],{"type":902},{"data":21340,"content":21341,"nodeType":881},{},[21342,21345,21352],{"data":21343,"marks":21344,"value":18379,"nodeType":865},{},[],{"data":21346,"content":21347,"nodeType":876},{"uri":18382},[21348],{"data":21349,"marks":21350,"value":18388,"nodeType":865},{},[21351],{"type":874},{"data":21353,"marks":21354,"value":18392,"nodeType":865},{},[],{"data":21356,"content":21357,"nodeType":881},{},[21358,21361,21368],{"data":21359,"marks":21360,"value":18399,"nodeType":865},{},[],{"data":21362,"content":21363,"nodeType":876},{"uri":18402},[21364],{"data":21365,"marks":21366,"value":18408,"nodeType":865},{},[21367],{"type":874},{"data":21369,"marks":21370,"value":18412,"nodeType":865},{},[],{"data":21372,"content":21373,"nodeType":1818},{},[21374,21383,21392,21401,21410,21419,21428,21437,21446,21455,21464],{"data":21375,"content":21376,"nodeType":1734},{},[21377],{"data":21378,"content":21379,"nodeType":881},{},[21380],{"data":21381,"marks":21382,"value":18425,"nodeType":865},{},[],{"data":21384,"content":21385,"nodeType":1734},{},[21386],{"data":21387,"content":21388,"nodeType":881},{},[21389],{"data":21390,"marks":21391,"value":18435,"nodeType":865},{},[],{"data":21393,"content":21394,"nodeType":1734},{},[21395],{"data":21396,"content":21397,"nodeType":881},{},[21398],{"data":21399,"marks":21400,"value":18445,"nodeType":865},{},[],{"data":21402,"content":21403,"nodeType":1734},{},[21404],{"data":21405,"content":21406,"nodeType":881},{},[21407],{"data":21408,"marks":21409,"value":18455,"nodeType":865},{},[],{"data":21411,"content":21412,"nodeType":1734},{},[21413],{"data":21414,"content":21415,"nodeType":881},{},[21416],{"data":21417,"marks":21418,"value":18465,"nodeType":865},{},[],{"data":21420,"content":21421,"nodeType":1734},{},[21422],{"data":21423,"content":21424,"nodeType":881},{},[21425],{"data":21426,"marks":21427,"value":18475,"nodeType":865},{},[],{"data":21429,"content":21430,"nodeType":1734},{},[21431],{"data":21432,"content":21433,"nodeType":881},{},[21434],{"data":21435,"marks":21436,"value":18485,"nodeType":865},{},[],{"data":21438,"content":21439,"nodeType":1734},{},[21440],{"data":21441,"content":21442,"nodeType":881},{},[21443],{"data":21444,"marks":21445,"value":18495,"nodeType":865},{},[],{"data":21447,"content":21448,"nodeType":1734},{},[21449],{"data":21450,"content":21451,"nodeType":881},{},[21452],{"data":21453,"marks":21454,"value":18505,"nodeType":865},{},[],{"data":21456,"content":21457,"nodeType":1734},{},[21458],{"data":21459,"content":21460,"nodeType":881},{},[21461],{"data":21462,"marks":21463,"value":18515,"nodeType":865},{},[],{"data":21465,"content":21466,"nodeType":1734},{},[21467],{"data":21468,"content":21469,"nodeType":881},{},[21470],{"data":21471,"marks":21472,"value":18525,"nodeType":865},{},[],{"data":21474,"content":21475,"nodeType":894},{},[],{"data":21477,"content":21478,"nodeType":904},{},[21479],{"data":21480,"marks":21481,"value":18536,"nodeType":865},{},[21482],{"type":902},{"data":21484,"content":21485,"nodeType":881},{},[21486],{"data":21487,"marks":21488,"value":18543,"nodeType":865},{},[],{"data":21490,"content":21491,"nodeType":881},{},[21492],{"data":21493,"marks":21494,"value":18550,"nodeType":865},{},[],{"data":21496,"content":21497,"nodeType":894},{},[],{"data":21499,"content":21500,"nodeType":904},{},[21501],{"data":21502,"marks":21503,"value":18561,"nodeType":865},{},[21504],{"type":902},{"data":21506,"content":21507,"nodeType":881},{},[21508],{"data":21509,"marks":21510,"value":18568,"nodeType":865},{},[],{"data":21512,"content":21513,"nodeType":881},{},[21514],{"data":21515,"marks":21516,"value":18575,"nodeType":865},{},[],{"data":21518,"content":21519,"nodeType":881},{},[21520],{"data":21521,"marks":21522,"value":18582,"nodeType":865},{},[],{"data":21524,"content":21525,"nodeType":1818},{},[21526,21545,21554,21573],{"data":21527,"content":21528,"nodeType":1734},{},[21529],{"data":21530,"content":21531,"nodeType":881},{},[21532,21535,21542],{"data":21533,"marks":21534,"value":18595,"nodeType":865},{},[],{"data":21536,"content":21537,"nodeType":876},{"uri":18598},[21538],{"data":21539,"marks":21540,"value":18604,"nodeType":865},{},[21541],{"type":874},{"data":21543,"marks":21544,"value":18608,"nodeType":865},{},[],{"data":21546,"content":21547,"nodeType":1734},{},[21548],{"data":21549,"content":21550,"nodeType":881},{},[21551],{"data":21552,"marks":21553,"value":18618,"nodeType":865},{},[],{"data":21555,"content":21556,"nodeType":1734},{},[21557],{"data":21558,"content":21559,"nodeType":881},{},[21560,21563,21570],{"data":21561,"marks":21562,"value":21,"nodeType":865},{},[],{"data":21564,"content":21565,"nodeType":876},{"uri":6852},[21566],{"data":21567,"marks":21568,"value":18635,"nodeType":865},{},[21569],{"type":874},{"data":21571,"marks":21572,"value":18639,"nodeType":865},{},[],{"data":21574,"content":21575,"nodeType":1734},{},[21576],{"data":21577,"content":21578,"nodeType":881},{},[21579],{"data":21580,"marks":21581,"value":18649,"nodeType":865},{},[],{"data":21583,"content":21584,"nodeType":881},{},[21585,21588,21595,21598,21605],{"data":21586,"marks":21587,"value":18656,"nodeType":865},{},[],{"data":21589,"content":21590,"nodeType":876},{"uri":18659},[21591],{"data":21592,"marks":21593,"value":18665,"nodeType":865},{},[21594],{"type":874},{"data":21596,"marks":21597,"value":18669,"nodeType":865},{},[],{"data":21599,"content":21600,"nodeType":876},{"uri":18025},[21601],{"data":21602,"marks":21603,"value":18031,"nodeType":865},{},[21604],{"type":874},{"data":21606,"marks":21607,"value":1032,"nodeType":865},{},[],{"data":21609,"content":21610,"nodeType":894},{},[],{"data":21612,"content":21613,"nodeType":904},{},[21614],{"data":21615,"marks":21616,"value":18690,"nodeType":865},{},[21617],{"type":902},{"data":21619,"content":21620,"nodeType":881},{},[21621],{"data":21622,"marks":21623,"value":7999,"nodeType":865},{},[],{"data":21625,"content":21626,"nodeType":881},{},[21627],{"data":21628,"marks":21629,"value":18703,"nodeType":865},{},[],{"data":21631,"content":21632,"nodeType":881},{},[21633],{"data":21634,"marks":21635,"value":18710,"nodeType":865},{},[],{"data":21637,"content":21638,"nodeType":881},{},[21639],{"data":21640,"marks":21641,"value":18717,"nodeType":865},{},[],{"data":21643,"content":21644,"nodeType":881},{},[21645,21648,21655,21658,21665],{"data":21646,"marks":21647,"value":4462,"nodeType":865},{},[],{"data":21649,"content":21650,"nodeType":876},{"uri":4465},[21651],{"data":21652,"marks":21653,"value":4471,"nodeType":865},{},[21654],{"type":874},{"data":21656,"marks":21657,"value":8048,"nodeType":865},{},[],{"data":21659,"content":21660,"nodeType":876},{"uri":1453},[21661],{"data":21662,"marks":21663,"value":4495,"nodeType":865},{},[21664],{"type":874},{"data":21666,"marks":21667,"value":959,"nodeType":865},{},[],{"data":21669,"content":21672,"nodeType":890},{"target":21670},{"sys":21671},{"id":18748,"type":887,"linkType":888},[],{"data":21674,"content":21675,"nodeType":881},{},[21676],{"data":21677,"marks":21678,"value":21,"nodeType":865},{},[],{"entries":21680},{"hyperlink":21681,"inline":21682,"block":21683},[],[],[21684,21690,21695,21698],{"sys":21685,"__typename":7008,"title":21686,"caption":21686,"layoutMode":59,"file":21687},{"id":17990},"“ConsentFix” phishing site detected and blocked by Push. ",{"url":21688,"width":7012,"height":21689},"https://images.ctfassets.net/y1cdw1ablpvd/3FyJ6MHYvAi7z9O7LahUer/ac4384da808287779f1e1f622186dcbc/1.png",1185,{"sys":21691,"__typename":7008,"title":21692,"caption":7009,"layoutMode":59,"file":21693},{"id":7424},"ConsentFix attack breakdown.",{"url":21694,"width":7012,"height":16},"https://images.ctfassets.net/y1cdw1ablpvd/7x6SiBWarYH3w4nPfjtf7r/4c1dd037b9ad47ccbba0a87256ecd909/2.png",{"sys":21696,"__typename":7008,"title":7041,"caption":7041,"layoutMode":59,"file":21697},{"id":6513},{"url":7043,"width":7044,"height":7045},{"sys":21699,"__typename":1471,"type":1472,"ctaText":21700,"buttonLabel":21701,"buttonColour":1475,"buttonUrl":21702},{"id":18748},"Want to see how security controls match up with modern browser-based attacks? Register for our upcoming webinar for an interactive walkthrough.","Register Now","https://pushsecurity.com/webinar/investigating-browser-threats",{"items":21704},[],{},"ConsentFix debrief: insights, recommendations & predictions",{"items":21708},[21709,22457,23073],{"__typename":1485,"sys":21710,"content":21711,"title":8071,"synopsis":8072,"hashTags":59,"publishedDate":8073,"slug":8074,"tagsCollection":22447,"authorsCollection":22453},{"id":7222},{"json":21712},{"data":21713,"content":21714,"nodeType":1463},{},[21715,21722,21728,21734,21740,21750,21756,21761,21766,21769,21776,21782,21788,21793,21809,21815,21820,21826,21831,21837,21876,21881,21886,21892,21898,21901,21908,21924,21930,21935,21951,21956,21972,21978,21981,21988,21994,22030,22040,22043,22050,22065,22071,22084,22090,22096,22101,22107,22110,22117,22123,22171,22177,22180,22187,22192,22198,22204,22209,22215,22244,22250,22256,22261,22267,22272,22279,22295,22301,22331,22337,22367,22370,22377,22383,22388,22404,22410,22436,22441],{"data":21716,"content":21717,"nodeType":904},{},[21718],{"data":21719,"marks":21720,"value":7234,"nodeType":865},{},[21721],{"type":902},{"data":21723,"content":21724,"nodeType":881},{},[21725],{"data":21726,"marks":21727,"value":7241,"nodeType":865},{},[],{"data":21729,"content":21730,"nodeType":881},{},[21731],{"data":21732,"marks":21733,"value":7248,"nodeType":865},{},[],{"data":21735,"content":21736,"nodeType":881},{},[21737],{"data":21738,"marks":21739,"value":7255,"nodeType":865},{},[],{"data":21741,"content":21742,"nodeType":881},{},[21743,21747],{"data":21744,"marks":21745,"value":7263,"nodeType":865},{},[21746],{"type":902},{"data":21748,"marks":21749,"value":7267,"nodeType":865},{},[],{"data":21751,"content":21752,"nodeType":881},{},[21753],{"data":21754,"marks":21755,"value":7274,"nodeType":865},{},[],{"data":21757,"content":21760,"nodeType":890},{"target":21758},{"sys":21759},{"id":7279,"type":887,"linkType":888},[],{"data":21762,"content":21765,"nodeType":890},{"target":21763},{"sys":21764},{"id":7285,"type":887,"linkType":888},[],{"data":21767,"content":21768,"nodeType":894},{},[],{"data":21770,"content":21771,"nodeType":904},{},[21772],{"data":21773,"marks":21774,"value":7297,"nodeType":865},{},[21775],{"type":902},{"data":21777,"content":21778,"nodeType":881},{},[21779],{"data":21780,"marks":21781,"value":7304,"nodeType":865},{},[],{"data":21783,"content":21784,"nodeType":881},{},[21785],{"data":21786,"marks":21787,"value":7311,"nodeType":865},{},[],{"data":21789,"content":21792,"nodeType":890},{"target":21790},{"sys":21791},{"id":7316,"type":887,"linkType":888},[],{"data":21794,"content":21795,"nodeType":881},{},[21796,21799,21806],{"data":21797,"marks":21798,"value":7324,"nodeType":865},{},[],{"data":21800,"content":21801,"nodeType":876},{"uri":7327},[21802],{"data":21803,"marks":21804,"value":7333,"nodeType":865},{},[21805],{"type":874},{"data":21807,"marks":21808,"value":7337,"nodeType":865},{},[],{"data":21810,"content":21811,"nodeType":881},{},[21812],{"data":21813,"marks":21814,"value":7344,"nodeType":865},{},[],{"data":21816,"content":21819,"nodeType":890},{"target":21817},{"sys":21818},{"id":7349,"type":887,"linkType":888},[],{"data":21821,"content":21822,"nodeType":881},{},[21823],{"data":21824,"marks":21825,"value":7357,"nodeType":865},{},[],{"data":21827,"content":21830,"nodeType":890},{"target":21828},{"sys":21829},{"id":7362,"type":887,"linkType":888},[],{"data":21832,"content":21833,"nodeType":881},{},[21834],{"data":21835,"marks":21836,"value":7370,"nodeType":865},{},[],{"data":21838,"content":21839,"nodeType":1818},{},[21840,21849,21858,21867],{"data":21841,"content":21842,"nodeType":1734},{},[21843],{"data":21844,"content":21845,"nodeType":881},{},[21846],{"data":21847,"marks":21848,"value":7383,"nodeType":865},{},[],{"data":21850,"content":21851,"nodeType":1734},{},[21852],{"data":21853,"content":21854,"nodeType":881},{},[21855],{"data":21856,"marks":21857,"value":7393,"nodeType":865},{},[],{"data":21859,"content":21860,"nodeType":1734},{},[21861],{"data":21862,"content":21863,"nodeType":881},{},[21864],{"data":21865,"marks":21866,"value":7403,"nodeType":865},{},[],{"data":21868,"content":21869,"nodeType":1734},{},[21870],{"data":21871,"content":21872,"nodeType":881},{},[21873],{"data":21874,"marks":21875,"value":7413,"nodeType":865},{},[],{"data":21877,"content":21880,"nodeType":890},{"target":21878},{"sys":21879},{"id":7418,"type":887,"linkType":888},[],{"data":21882,"content":21885,"nodeType":890},{"target":21883},{"sys":21884},{"id":7424,"type":887,"linkType":888},[],{"data":21887,"content":21888,"nodeType":881},{},[21889],{"data":21890,"marks":21891,"value":7432,"nodeType":865},{},[],{"data":21893,"content":21894,"nodeType":881},{},[21895],{"data":21896,"marks":21897,"value":7439,"nodeType":865},{},[],{"data":21899,"content":21900,"nodeType":894},{},[],{"data":21902,"content":21903,"nodeType":904},{},[21904],{"data":21905,"marks":21906,"value":7450,"nodeType":865},{},[21907],{"type":902},{"data":21909,"content":21910,"nodeType":881},{},[21911,21914,21921],{"data":21912,"marks":21913,"value":7457,"nodeType":865},{},[],{"data":21915,"content":21916,"nodeType":876},{"uri":7460},[21917],{"data":21918,"marks":21919,"value":7466,"nodeType":865},{},[21920],{"type":874},{"data":21922,"marks":21923,"value":7470,"nodeType":865},{},[],{"data":21925,"content":21926,"nodeType":881},{},[21927],{"data":21928,"marks":21929,"value":7477,"nodeType":865},{},[],{"data":21931,"content":21934,"nodeType":890},{"target":21932},{"sys":21933},{"id":7482,"type":887,"linkType":888},[],{"data":21936,"content":21937,"nodeType":881},{},[21938,21941,21948],{"data":21939,"marks":21940,"value":7490,"nodeType":865},{},[],{"data":21942,"content":21943,"nodeType":876},{"uri":1139},[21944],{"data":21945,"marks":21946,"value":7498,"nodeType":865},{},[21947],{"type":874},{"data":21949,"marks":21950,"value":959,"nodeType":865},{},[],{"data":21952,"content":21955,"nodeType":890},{"target":21953},{"sys":21954},{"id":7506,"type":887,"linkType":888},[],{"data":21957,"content":21958,"nodeType":881},{},[21959,21962,21969],{"data":21960,"marks":21961,"value":7514,"nodeType":865},{},[],{"data":21963,"content":21964,"nodeType":876},{"uri":7517},[21965],{"data":21966,"marks":21967,"value":441,"nodeType":865},{},[21968],{"type":874},{"data":21970,"marks":21971,"value":7526,"nodeType":865},{},[],{"data":21973,"content":21974,"nodeType":881},{},[21975],{"data":21976,"marks":21977,"value":7533,"nodeType":865},{},[],{"data":21979,"content":21980,"nodeType":894},{},[],{"data":21982,"content":21983,"nodeType":904},{},[21984],{"data":21985,"marks":21986,"value":7544,"nodeType":865},{},[21987],{"type":902},{"data":21989,"content":21990,"nodeType":881},{},[21991],{"data":21992,"marks":21993,"value":7551,"nodeType":865},{},[],{"data":21995,"content":21996,"nodeType":881},{},[21997,22000,22007,22010,22017,22020,22027],{"data":21998,"marks":21999,"value":7558,"nodeType":865},{},[],{"data":22001,"content":22002,"nodeType":876},{"uri":7561},[22003],{"data":22004,"marks":22005,"value":7567,"nodeType":865},{},[22006],{"type":874},{"data":22008,"marks":22009,"value":1651,"nodeType":865},{},[],{"data":22011,"content":22012,"nodeType":876},{"uri":7573},[22013],{"data":22014,"marks":22015,"value":1307,"nodeType":865},{},[22016],{"type":874},{"data":22018,"marks":22019,"value":7582,"nodeType":865},{},[],{"data":22021,"content":22022,"nodeType":876},{"uri":7585},[22023],{"data":22024,"marks":22025,"value":7591,"nodeType":865},{},[22026],{"type":874},{"data":22028,"marks":22029,"value":7595,"nodeType":865},{},[],{"data":22031,"content":22032,"nodeType":881},{},[22033,22036],{"data":22034,"marks":22035,"value":7602,"nodeType":865},{},[],{"data":22037,"marks":22038,"value":7607,"nodeType":865},{},[22039],{"type":902},{"data":22041,"content":22042,"nodeType":894},{},[],{"data":22044,"content":22045,"nodeType":904},{},[22046],{"data":22047,"marks":22048,"value":7618,"nodeType":865},{},[22049],{"type":902},{"data":22051,"content":22052,"nodeType":881},{},[22053,22056,22062],{"data":22054,"marks":22055,"value":7625,"nodeType":865},{},[],{"data":22057,"content":22058,"nodeType":876},{"uri":1022},[22059],{"data":22060,"marks":22061,"value":1951,"nodeType":865},{},[],{"data":22063,"marks":22064,"value":7635,"nodeType":865},{},[],{"data":22066,"content":22067,"nodeType":881},{},[22068],{"data":22069,"marks":22070,"value":7642,"nodeType":865},{},[],{"data":22072,"content":22073,"nodeType":881},{},[22074,22077,22081],{"data":22075,"marks":22076,"value":7649,"nodeType":865},{},[],{"data":22078,"marks":22079,"value":7654,"nodeType":865},{},[22080],{"type":902},{"data":22082,"marks":22083,"value":7658,"nodeType":865},{},[],{"data":22085,"content":22086,"nodeType":881},{},[22087],{"data":22088,"marks":22089,"value":7665,"nodeType":865},{},[],{"data":22091,"content":22092,"nodeType":881},{},[22093],{"data":22094,"marks":22095,"value":7672,"nodeType":865},{},[],{"data":22097,"content":22100,"nodeType":890},{"target":22098},{"sys":22099},{"id":7677,"type":887,"linkType":888},[],{"data":22102,"content":22103,"nodeType":881},{},[22104],{"data":22105,"marks":22106,"value":7685,"nodeType":865},{},[],{"data":22108,"content":22109,"nodeType":894},{},[],{"data":22111,"content":22112,"nodeType":904},{},[22113],{"data":22114,"marks":22115,"value":7696,"nodeType":865},{},[22116],{"type":902},{"data":22118,"content":22119,"nodeType":881},{},[22120],{"data":22121,"marks":22122,"value":7703,"nodeType":865},{},[],{"data":22124,"content":22125,"nodeType":1818},{},[22126,22135,22144,22153,22162],{"data":22127,"content":22128,"nodeType":1734},{},[22129],{"data":22130,"content":22131,"nodeType":881},{},[22132],{"data":22133,"marks":22134,"value":7716,"nodeType":865},{},[],{"data":22136,"content":22137,"nodeType":1734},{},[22138],{"data":22139,"content":22140,"nodeType":881},{},[22141],{"data":22142,"marks":22143,"value":7726,"nodeType":865},{},[],{"data":22145,"content":22146,"nodeType":1734},{},[22147],{"data":22148,"content":22149,"nodeType":881},{},[22150],{"data":22151,"marks":22152,"value":7736,"nodeType":865},{},[],{"data":22154,"content":22155,"nodeType":1734},{},[22156],{"data":22157,"content":22158,"nodeType":881},{},[22159],{"data":22160,"marks":22161,"value":7746,"nodeType":865},{},[],{"data":22163,"content":22164,"nodeType":1734},{},[22165],{"data":22166,"content":22167,"nodeType":881},{},[22168],{"data":22169,"marks":22170,"value":7756,"nodeType":865},{},[],{"data":22172,"content":22173,"nodeType":881},{},[22174],{"data":22175,"marks":22176,"value":7763,"nodeType":865},{},[],{"data":22178,"content":22179,"nodeType":894},{},[],{"data":22181,"content":22182,"nodeType":904},{},[22183],{"data":22184,"marks":22185,"value":7774,"nodeType":865},{},[22186],{"type":902},{"data":22188,"content":22191,"nodeType":890},{"target":22189},{"sys":22190},{"id":7779,"type":887,"linkType":888},[],{"data":22193,"content":22194,"nodeType":881},{},[22195],{"data":22196,"marks":22197,"value":7787,"nodeType":865},{},[],{"data":22199,"content":22200,"nodeType":881},{},[22201],{"data":22202,"marks":22203,"value":7794,"nodeType":865},{},[],{"data":22205,"content":22208,"nodeType":890},{"target":22206},{"sys":22207},{"id":7799,"type":887,"linkType":888},[],{"data":22210,"content":22211,"nodeType":881},{},[22212],{"data":22213,"marks":22214,"value":7807,"nodeType":865},{},[],{"data":22216,"content":22217,"nodeType":1818},{},[22218,22231],{"data":22219,"content":22220,"nodeType":1734},{},[22221],{"data":22222,"content":22223,"nodeType":881},{},[22224,22228],{"data":22225,"marks":22226,"value":7821,"nodeType":865},{},[22227],{"type":902},{"data":22229,"marks":22230,"value":7825,"nodeType":865},{},[],{"data":22232,"content":22233,"nodeType":1734},{},[22234],{"data":22235,"content":22236,"nodeType":881},{},[22237,22241],{"data":22238,"marks":22239,"value":7836,"nodeType":865},{},[22240],{"type":902},{"data":22242,"marks":22243,"value":7840,"nodeType":865},{},[],{"data":22245,"content":22246,"nodeType":881},{},[22247],{"data":22248,"marks":22249,"value":7847,"nodeType":865},{},[],{"data":22251,"content":22252,"nodeType":881},{},[22253],{"data":22254,"marks":22255,"value":7854,"nodeType":865},{},[],{"data":22257,"content":22260,"nodeType":890},{"target":22258},{"sys":22259},{"id":7859,"type":887,"linkType":888},[],{"data":22262,"content":22263,"nodeType":881},{},[22264],{"data":22265,"marks":22266,"value":7867,"nodeType":865},{},[],{"data":22268,"content":22271,"nodeType":890},{"target":22269},{"sys":22270},{"id":7872,"type":887,"linkType":888},[],{"data":22273,"content":22274,"nodeType":1860},{},[22275],{"data":22276,"marks":22277,"value":7881,"nodeType":865},{},[22278],{"type":902},{"data":22280,"content":22281,"nodeType":881},{},[22282,22285,22292],{"data":22283,"marks":22284,"value":7888,"nodeType":865},{},[],{"data":22286,"content":22287,"nodeType":876},{"uri":7891},[22288],{"data":22289,"marks":22290,"value":7897,"nodeType":865},{},[22291],{"type":874},{"data":22293,"marks":22294,"value":7901,"nodeType":865},{},[],{"data":22296,"content":22297,"nodeType":881},{},[22298],{"data":22299,"marks":22300,"value":7908,"nodeType":865},{},[],{"data":22302,"content":22303,"nodeType":1818},{},[22304,22313,22322],{"data":22305,"content":22306,"nodeType":1734},{},[22307],{"data":22308,"content":22309,"nodeType":881},{},[22310],{"data":22311,"marks":22312,"value":7921,"nodeType":865},{},[],{"data":22314,"content":22315,"nodeType":1734},{},[22316],{"data":22317,"content":22318,"nodeType":881},{},[22319],{"data":22320,"marks":22321,"value":7931,"nodeType":865},{},[],{"data":22323,"content":22324,"nodeType":1734},{},[22325],{"data":22326,"content":22327,"nodeType":881},{},[22328],{"data":22329,"marks":22330,"value":7941,"nodeType":865},{},[],{"data":22332,"content":22333,"nodeType":881},{},[22334],{"data":22335,"marks":22336,"value":7948,"nodeType":865},{},[],{"data":22338,"content":22339,"nodeType":1818},{},[22340,22349,22358],{"data":22341,"content":22342,"nodeType":1734},{},[22343],{"data":22344,"content":22345,"nodeType":881},{},[22346],{"data":22347,"marks":22348,"value":7961,"nodeType":865},{},[],{"data":22350,"content":22351,"nodeType":1734},{},[22352],{"data":22353,"content":22354,"nodeType":881},{},[22355],{"data":22356,"marks":22357,"value":7971,"nodeType":865},{},[],{"data":22359,"content":22360,"nodeType":1734},{},[22361],{"data":22362,"content":22363,"nodeType":881},{},[22364],{"data":22365,"marks":22366,"value":7981,"nodeType":865},{},[],{"data":22368,"content":22369,"nodeType":894},{},[],{"data":22371,"content":22372,"nodeType":904},{},[22373],{"data":22374,"marks":22375,"value":7992,"nodeType":865},{},[22376],{"type":902},{"data":22378,"content":22379,"nodeType":881},{},[22380],{"data":22381,"marks":22382,"value":7999,"nodeType":865},{},[],{"data":22384,"content":22387,"nodeType":890},{"target":22385},{"sys":22386},{"id":8004,"type":887,"linkType":888},[],{"data":22389,"content":22390,"nodeType":881},{},[22391,22394,22401],{"data":22392,"marks":22393,"value":8012,"nodeType":865},{},[],{"data":22395,"content":22396,"nodeType":876},{"uri":1022},[22397],{"data":22398,"marks":22399,"value":8020,"nodeType":865},{},[22400],{"type":874},{"data":22402,"marks":22403,"value":8024,"nodeType":865},{},[],{"data":22405,"content":22406,"nodeType":881},{},[22407],{"data":22408,"marks":22409,"value":8031,"nodeType":865},{},[],{"data":22411,"content":22412,"nodeType":881},{},[22413,22416,22423,22426,22433],{"data":22414,"marks":22415,"value":4462,"nodeType":865},{},[],{"data":22417,"content":22418,"nodeType":876},{"uri":4465},[22419],{"data":22420,"marks":22421,"value":4471,"nodeType":865},{},[22422],{"type":874},{"data":22424,"marks":22425,"value":8048,"nodeType":865},{},[],{"data":22427,"content":22428,"nodeType":876},{"uri":1453},[22429],{"data":22430,"marks":22431,"value":4495,"nodeType":865},{},[22432],{"type":874},{"data":22434,"marks":22435,"value":959,"nodeType":865},{},[],{"data":22437,"content":22440,"nodeType":890},{"target":22438},{"sys":22439},{"id":8063,"type":887,"linkType":888},[],{"data":22442,"content":22443,"nodeType":881},{},[22444],{"data":22445,"marks":22446,"value":21,"nodeType":865},{},[],{"items":22448},[22449,22451],{"sys":22450,"name":4507},{"id":4506},{"sys":22452,"name":342},{"id":4510},{"items":22454},[22455],{"fullName":4514,"firstName":4515,"jobTitle":4516,"profilePicture":22456},{"url":4518},{"__typename":1485,"sys":22458,"content":22460,"title":23059,"synopsis":23060,"hashTags":59,"publishedDate":23061,"slug":23062,"tagsCollection":23063,"authorsCollection":23069},{"id":22459},"2YmiesBvJHGw4wiKEKzLUq",{"json":22461},{"data":22462,"content":22463,"nodeType":1463},{},[22464,22471,22478,22527,22533,22540,22547,22553,22559,22565,22568,22576,22583,22589,22596,22602,22608,22615,22621,22638,22641,22649,22656,22663,22670,22677,22683,22701,22704,22712,22719,22774,22781,22788,22791,22798,22805,22812,22819,22845,22848,22855,22871,22878,22921,22928,22971,22978,23051],{"data":22465,"content":22466,"nodeType":881},{},[22467],{"data":22468,"marks":22469,"value":22470,"nodeType":865},{},[],"In recent months, we’ve seen a significant increase in the number of attacks targeting ad manager accounts. These attacks ultimately serve up an Attacker-in-the-Middle (AITM) phishing page designed to steal the victim’s Google account. ",{"data":22472,"content":22473,"nodeType":881},{},[22474],{"data":22475,"marks":22476,"value":22477,"nodeType":865},{},[],"Most recently, we reported on:",{"data":22479,"content":22480,"nodeType":1818},{},[22481,22504],{"data":22482,"content":22483,"nodeType":1734},{},[22484],{"data":22485,"content":22486,"nodeType":881},{},[22487,22491,22500],{"data":22488,"marks":22489,"value":22490,"nodeType":865},{},[],"A campaign running ",{"data":22492,"content":22494,"nodeType":876},{"uri":22493},"https://pushsecurity.com/blog/analysing-a-malvertising-attack-targeting-business-google-accounts/",[22495],{"data":22496,"marks":22497,"value":22499,"nodeType":865},{},[22498],{"type":874},"fake malvertising ads for “Google Ads”",{"data":22501,"marks":22502,"value":22503,"nodeType":865},{},[]," in Google Search. ",{"data":22505,"content":22506,"nodeType":1734},{},[22507],{"data":22508,"content":22509,"nodeType":881},{},[22510,22514,22523],{"data":22511,"marks":22512,"value":22513,"nodeType":865},{},[],"A campaign using sophisticated ",{"data":22515,"content":22517,"nodeType":876},{"uri":22516},"https://pushsecurity.com/blog/uncovering-a-calendly-themed-phishing-campaign/",[22518],{"data":22519,"marks":22520,"value":22522,"nodeType":865},{},[22521],{"type":874},"Calendly-themed phishing lures",{"data":22524,"marks":22525,"value":22526,"nodeType":865},{},[]," targeting marketing professionals.",{"data":22528,"content":22532,"nodeType":890},{"target":22529},{"sys":22530},{"id":22531,"type":887,"linkType":888},"1ThnhFZQIhzV179qclvzFH",[],{"data":22534,"content":22535,"nodeType":881},{},[22536],{"data":22537,"marks":22538,"value":22539,"nodeType":865},{},[],"Now, we’ve seen the Google Ads malvertising campaign expand to run additional ads impersonating Ahrefs, an AI marketing platform. Crucially, employees with access to Ahrefs are highly likely to also have access to Google Ads, meaning that attackers can reliably target Google accounts via Ahrefs. ",{"data":22541,"content":22542,"nodeType":881},{},[22543],{"data":22544,"marks":22545,"value":22546,"nodeType":865},{},[],"You can see a demo of the phishing chain below. ",{"data":22548,"content":22552,"nodeType":890},{"target":22549},{"sys":22550},{"id":22551,"type":887,"linkType":888},"2XjyySGldgl9uPA7CZRms8",[],{"data":22554,"content":22558,"nodeType":890},{"target":22555},{"sys":22556},{"id":22557,"type":887,"linkType":888},"yB12nGF91iq15GoHWItaX",[],{"data":22560,"content":22564,"nodeType":890},{"target":22561},{"sys":22562},{"id":22563,"type":887,"linkType":888},"2NK29DaTd93kOctyWxV0RT",[],{"data":22566,"content":22567,"nodeType":894},{},[],{"data":22569,"content":22570,"nodeType":904},{},[22571],{"data":22572,"marks":22573,"value":22575,"nodeType":865},{},[22574],{"type":902},"Attack breakdown",{"data":22577,"content":22578,"nodeType":881},{},[22579],{"data":22580,"marks":22581,"value":22582,"nodeType":865},{},[],"Users searching for “ahrefs” on Google Search were served with a fake ad impersonating Ahrefs, hosted on Squarespace, a legitimate website building and hosting platform. Previously, we’d seen this campaign use hosting sites Odoo and Kartra to similar effect. ",{"data":22584,"content":22588,"nodeType":890},{"target":22585},{"sys":22586},{"id":22587,"type":887,"linkType":888},"59dhFey5rahm5sA20NudTl",[],{"data":22590,"content":22591,"nodeType":881},{},[22592],{"data":22593,"marks":22594,"value":22595,"nodeType":865},{},[],"Upon clicking the link, the victim was taken to a clone of the real Ahrefs site. Crucially, you can see that the domain is not the official Ahrefs domain. ",{"data":22597,"content":22601,"nodeType":890},{"target":22598},{"sys":22599},{"id":22600,"type":887,"linkType":888},"48fQUiJXC1qACKUUPDliS5",[],{"data":22603,"content":22607,"nodeType":890},{"target":22604},{"sys":22605},{"id":22606,"type":887,"linkType":888},"77iqOW1jDVt5Oxw8qTwnKG",[],{"data":22609,"content":22610,"nodeType":881},{},[22611],{"data":22612,"marks":22613,"value":22614,"nodeType":865},{},[],"However, the site is not fully interactable beyond the front page. Clicking on any link takes the user to a Google sign-in page. ",{"data":22616,"content":22620,"nodeType":890},{"target":22617},{"sys":22618},{"id":22619,"type":887,"linkType":888},"7t9BoUyIFN8dlBDksjsYlD",[],{"data":22622,"content":22623,"nodeType":881},{},[22624,22628,22635],{"data":22625,"marks":22626,"value":22627,"nodeType":865},{},[],"This is in fact an AITM phishing page that is designed to hijack the victim’s Google account. Entering credentials and completing the MFA check will result in the attacker stealing the app session and effectively taking over the account. The phishing kit used matches ",{"data":22629,"content":22630,"nodeType":876},{"uri":22493},[22631],{"data":22632,"marks":22633,"value":22634,"nodeType":865},{},[],"the previous malvertising detected impersonating Google Ads",{"data":22636,"marks":22637,"value":1032,"nodeType":865},{},[],{"data":22639,"content":22640,"nodeType":894},{},[],{"data":22642,"content":22643,"nodeType":904},{},[22644],{"data":22645,"marks":22646,"value":22648,"nodeType":865},{},[22647],{"type":902},"Why are attackers targeting ad manager accounts?",{"data":22650,"content":22651,"nodeType":881},{},[22652],{"data":22653,"marks":22654,"value":22655,"nodeType":865},{},[],"Ad Manager accounts on platforms like Google, Facebook, and LinkedIn have become lucrative targets for cybercriminals. By compromising these accounts, attackers can exploit the digital advertising ecosystem in various ways for financial gain. ",{"data":22657,"content":22658,"nodeType":881},{},[22659],{"data":22660,"marks":22661,"value":22662,"nodeType":865},{},[],"The ad industry’s scale makes it attractive to fraud. Estimates suggest digital ad fraud cost advertisers tens of billions, potentially nearing $100 billion or more, with projections reaching $172 billion by 2028.",{"data":22664,"content":22665,"nodeType":881},{},[22666],{"data":22667,"marks":22668,"value":22669,"nodeType":865},{},[],"A hijacked Google Ad Manager account gives attackers access to significant ad spend and account data which can be monetized illicitly. The tactics range from stealthy ad fraud to overt abuse like malicious ads or extortion schemes.",{"data":22671,"content":22672,"nodeType":881},{},[22673],{"data":22674,"marks":22675,"value":22676,"nodeType":865},{},[],"Pretty much every enterprise today advertises their services via Google ads — this makes attacks on these accounts pretty much a unanimous problem. Agencies managing numerous client accounts are put further at risk. For example, if an attacker can compromise an MCC account (used to manage several ad accounts) they get full access to the customer portfolio. ",{"data":22678,"content":22682,"nodeType":890},{"target":22679},{"sys":22680},{"id":22681,"type":887,"linkType":888},"1WPbstxHtdjnAKpF1rhCpW",[],{"data":22684,"content":22685,"nodeType":881},{},[22686,22690,22698],{"data":22687,"marks":22688,"value":22689,"nodeType":865},{},[],"Learn more about why attackers are targeting ad manager accounts ",{"data":22691,"content":22693,"nodeType":876},{"uri":22692},"https://pushsecurity.com/blog/cyber-criminal-ecosystem-analysis",[22694],{"data":22695,"marks":22696,"value":22697,"nodeType":865},{},[],"in our blog post",{"data":22699,"marks":22700,"value":1032,"nodeType":865},{},[],{"data":22702,"content":22703,"nodeType":894},{},[],{"data":22705,"content":22706,"nodeType":904},{},[22707],{"data":22708,"marks":22709,"value":22711,"nodeType":865},{},[22710],{"type":902},"Why malvertising? ",{"data":22713,"content":22714,"nodeType":881},{},[22715],{"data":22716,"marks":22717,"value":22718,"nodeType":865},{},[],"Malvertising scams happen across lots of different sites, but the most common platform we see targeted is Google Search. This takes advantage of users browsing to find a website and clicking the first link that appears — in this case a fake sponsored link taking you to the attacker’s page. ",{"data":22720,"content":22721,"nodeType":881},{},[22722,22726,22733,22737,22746,22749,22758,22761,22770],{"data":22723,"marks":22724,"value":22725,"nodeType":865},{},[],"Malvertising attacks delivered over channels like Google Search are a great way to catch victims unawares while also evading typically email-based anti-phishing controls. Malvertising is an increasingly popular attack vector for the delivery of AITM phishing, malware downloads, and ",{"data":22727,"content":22728,"nodeType":876},{"uri":1139},[22729],{"data":22730,"marks":22731,"value":315,"nodeType":865},{},[22732],{"type":874},{"data":22734,"marks":22735,"value":22736,"nodeType":865},{},[]," (4 in 5 ClickFix attacks intercepted by Push were delivered via Google Search). This isn’t just targeting ad manager accounts — last year, we reported on campaigns impersonating ",{"data":22738,"content":22740,"nodeType":876},{"uri":22739},"https://pushsecurity.com/blog/analysing-a-sophisticated-google-malvertising-attack/",[22741],{"data":22742,"marks":22743,"value":22745,"nodeType":865},{},[22744],{"type":874},"TradingView",{"data":22747,"marks":22748,"value":1877,"nodeType":865},{},[],{"data":22750,"content":22752,"nodeType":876},{"uri":22751},"https://pushsecurity.com/blog/phishing-with-active-directory-federation-services/",[22753],{"data":22754,"marks":22755,"value":22757,"nodeType":865},{},[22756],{"type":874},"Microsoft Office 365",{"data":22759,"marks":22760,"value":1791,"nodeType":865},{},[],{"data":22762,"content":22764,"nodeType":876},{"uri":22763},"https://pushsecurity.com/blog/investigating-a-recent-malvertising-campaign-targeting-onfido-customers/",[22765],{"data":22766,"marks":22767,"value":22769,"nodeType":865},{},[22768],{"type":874},"Onfido",{"data":22771,"marks":22772,"value":22773,"nodeType":865},{},[],", to name a few. ",{"data":22775,"content":22776,"nodeType":881},{},[22777],{"data":22778,"marks":22779,"value":22780,"nodeType":865},{},[],"There’s a tendency to see malvertising as a more random attack, but Google Ads can be tuned to searches coming from specific geographic locations, tailored to specific email domain matches, or specific device types (e.g. desktop, mobile, etc.). If you know where your target organization is located, you can tailor the ad to that location. Even more precise ad targeting can be achieved on social media platforms. ",{"data":22782,"content":22783,"nodeType":881},{},[22784],{"data":22785,"marks":22786,"value":22787,"nodeType":865},{},[],"Because these attacks completely circumvent the traditional phishing detection surface (email) and often happen entirely over the internet (meaning no endpoint security controls can come into play) the only way to reliably detect and stop these attacks is to intercept them where they happen — in the user’s web browser. ",{"data":22789,"content":22790,"nodeType":894},{},[],{"data":22792,"content":22793,"nodeType":904},{},[22794],{"data":22795,"marks":22796,"value":7992,"nodeType":865},{},[22797],{"type":902},{"data":22799,"content":22800,"nodeType":881},{},[22801],{"data":22802,"marks":22803,"value":22804,"nodeType":865},{},[],"Regardless of the delivery channel, all roads lead to a web page accessed in the victim’s browser, where Push is waiting to detect and block the attack. Even if the page has never been previously flagged as suspicious or malicious, Push analyses the page in real time and blocks it — protecting against the latest zero-day threats.  ",{"data":22806,"content":22807,"nodeType":881},{},[22808],{"data":22809,"marks":22810,"value":22811,"nodeType":865},{},[],"By seeing what your users see, and getting an unfiltered, real-time view of the page as it loads, Push is able to pinpoint malicious content, code, and behaviors and shut the attack down before it happens. Whether it's entering credentials onto a phishing page, approving a malicious OAuth grant, installing a risky browser extension, or insecurely accessing an app with a weak password and no MFA, Push detects the action and shuts it down.",{"data":22813,"content":22814,"nodeType":881},{},[22815],{"data":22816,"marks":22817,"value":22818,"nodeType":865},{},[],"Push blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, malicious OAuth grants, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":22820,"content":22821,"nodeType":881},{},[22822,22825,22832,22835,22842],{"data":22823,"marks":22824,"value":4462,"nodeType":865},{},[],{"data":22826,"content":22827,"nodeType":876},{"uri":4465},[22828],{"data":22829,"marks":22830,"value":4471,"nodeType":865},{},[22831],{"type":874},{"data":22833,"marks":22834,"value":8048,"nodeType":865},{},[],{"data":22836,"content":22837,"nodeType":876},{"uri":1453},[22838],{"data":22839,"marks":22840,"value":4495,"nodeType":865},{},[22841],{"type":874},{"data":22843,"marks":22844,"value":959,"nodeType":865},{},[],{"data":22846,"content":22847,"nodeType":894},{},[],{"data":22849,"content":22850,"nodeType":904},{},[22851],{"data":22852,"marks":22853,"value":7881,"nodeType":865},{},[22854],{"type":902},{"data":22856,"content":22857,"nodeType":881},{},[22858,22861,22868],{"data":22859,"marks":22860,"value":7888,"nodeType":865},{},[],{"data":22862,"content":22863,"nodeType":876},{"uri":7891},[22864],{"data":22865,"marks":22866,"value":7897,"nodeType":865},{},[22867],{"type":874},{"data":22869,"marks":22870,"value":7901,"nodeType":865},{},[],{"data":22872,"content":22873,"nodeType":881},{},[22874],{"data":22875,"marks":22876,"value":22877,"nodeType":865},{},[],"That said, the domains observed in this chain were:",{"data":22879,"content":22880,"nodeType":1818},{},[22881,22891,22901,22911],{"data":22882,"content":22883,"nodeType":1734},{},[22884],{"data":22885,"content":22886,"nodeType":881},{},[22887],{"data":22888,"marks":22889,"value":22890,"nodeType":865},{},[],"comandd-ok[.]com",{"data":22892,"content":22893,"nodeType":1734},{},[22894],{"data":22895,"content":22896,"nodeType":881},{},[22897],{"data":22898,"marks":22899,"value":22900,"nodeType":865},{},[],"ahrefs-ac.squarespace[.]com",{"data":22902,"content":22903,"nodeType":1734},{},[22904],{"data":22905,"content":22906,"nodeType":881},{},[22907],{"data":22908,"marks":22909,"value":22910,"nodeType":865},{},[],"ahrefs-seo-app.squarespace[.]com",{"data":22912,"content":22913,"nodeType":1734},{},[22914],{"data":22915,"content":22916,"nodeType":881},{},[22917],{"data":22918,"marks":22919,"value":22920,"nodeType":865},{},[],"slgn-ahrefs-app-com.squarespace[.]com",{"data":22922,"content":22923,"nodeType":881},{},[22924],{"data":22925,"marks":22926,"value":22927,"nodeType":865},{},[],"[Update 24th February] We also observed the following new domains:",{"data":22929,"content":22930,"nodeType":1818},{},[22931,22941,22951,22961],{"data":22932,"content":22933,"nodeType":1734},{},[22934],{"data":22935,"content":22936,"nodeType":881},{},[22937],{"data":22938,"marks":22939,"value":22940,"nodeType":865},{},[],"www-ahrefs-seo-ads[.]surge.sh",{"data":22942,"content":22943,"nodeType":1734},{},[22944],{"data":22945,"content":22946,"nodeType":881},{},[22947],{"data":22948,"marks":22949,"value":22950,"nodeType":865},{},[],"web-semrush-seo-wold[.]surge[.]sh",{"data":22952,"content":22953,"nodeType":1734},{},[22954],{"data":22955,"content":22956,"nodeType":881},{},[22957],{"data":22958,"marks":22959,"value":22960,"nodeType":865},{},[],"contabelforeehc[.]com",{"data":22962,"content":22963,"nodeType":1734},{},[22964],{"data":22965,"content":22966,"nodeType":881},{},[22967],{"data":22968,"marks":22969,"value":22970,"nodeType":865},{},[],"contabelfore[.]com",{"data":22972,"content":22973,"nodeType":881},{},[22974],{"data":22975,"marks":22976,"value":22977,"nodeType":865},{},[],"In addition, the following domains were previously associated with the attacks we detected in December:",{"data":22979,"content":22980,"nodeType":1818},{},[22981,22991,23001,23011,23021,23031,23041],{"data":22982,"content":22983,"nodeType":1734},{},[22984],{"data":22985,"content":22986,"nodeType":881},{},[22987],{"data":22988,"marks":22989,"value":22990,"nodeType":865},{},[],"ads-adsword1.odoo[.]com",{"data":22992,"content":22993,"nodeType":1734},{},[22994],{"data":22995,"content":22996,"nodeType":881},{},[22997],{"data":22998,"marks":22999,"value":23000,"nodeType":865},{},[],"sing-operador2[.]click/accounts/v3/login",{"data":23002,"content":23003,"nodeType":1734},{},[23004],{"data":23005,"content":23006,"nodeType":881},{},[23007],{"data":23008,"marks":23009,"value":23010,"nodeType":865},{},[],"adsgooglie.odoo[.]com/",{"data":23012,"content":23013,"nodeType":1734},{},[23014],{"data":23015,"content":23016,"nodeType":881},{},[23017],{"data":23018,"marks":23019,"value":23020,"nodeType":865},{},[],"word4only[.]online/",{"data":23022,"content":23023,"nodeType":1734},{},[23024],{"data":23025,"content":23026,"nodeType":881},{},[23027],{"data":23028,"marks":23029,"value":23030,"nodeType":865},{},[],"adsloginacess.kartra[.]com/page/oeN7",{"data":23032,"content":23033,"nodeType":1734},{},[23034],{"data":23035,"content":23036,"nodeType":881},{},[23037],{"data":23038,"marks":23039,"value":23040,"nodeType":865},{},[],"ads-o.odoo[.]com",{"data":23042,"content":23043,"nodeType":1734},{},[23044],{"data":23045,"content":23046,"nodeType":881},{},[23047],{"data":23048,"marks":23049,"value":23050,"nodeType":865},{},[],"operador8-ads[.]lat/accounts/v3/login/",{"data":23052,"content":23053,"nodeType":881},{},[23054],{"data":23055,"marks":23056,"value":23058,"nodeType":865},{},[23057],{"type":902},"Push customers do not need to take any further action.","Google Search malvertising campaign continues, now impersonating Ahrefs","New samples linked to a Push-tracked malvertising campaign detected, targeting Google accounts via an Ahrefs lure. ","2026-01-12T00:00:00.000Z","google-search-malvertising-campaign-continues-now-impersonating-ahrefs",{"items":23064},[23065,23067],{"sys":23066,"name":342},{"id":4510},{"sys":23068,"name":4507},{"id":4506},{"items":23070},[23071],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":23072},{"url":5377},{"__typename":1485,"sys":23074,"content":23075,"title":20067,"synopsis":20068,"hashTags":59,"publishedDate":20069,"slug":20070,"tagsCollection":24196,"authorsCollection":24202},{"id":18772},{"json":23076},{"data":23077,"content":23078,"nodeType":1463},{},[23079,23085,23091,23148,23154,23212,23217,23223,23229,23232,23238,23244,23250,23336,23351,23357,23394,23400,23406,23412,23442,23447,23474,23479,23485,23491,23521,23538,23541,23547,23553,23577,23583,23589,23595,23601,23607,23612,23625,23664,23669,23686,23689,23695,23701,23718,23724,23750,23767,23773,23790,23796,23802,23853,23859,23864,23877,23890,23907,23912,23929,23935,23938,23944,23950,23956,23962,23979,23985,24002,24007,24013,24043,24060,24063,24069,24075,24081,24098,24104,24117,24122,24128,24134,24151,24154,24160,24166,24172],{"data":23080,"content":23081,"nodeType":881},{},[23082],{"data":23083,"marks":23084,"value":18783,"nodeType":865},{},[],{"data":23086,"content":23087,"nodeType":881},{},[23088],{"data":23089,"marks":23090,"value":18790,"nodeType":865},{},[],{"data":23092,"content":23093,"nodeType":1818},{},[23094,23112,23130],{"data":23095,"content":23096,"nodeType":1734},{},[23097],{"data":23098,"content":23099,"nodeType":881},{},[23100,23103,23109],{"data":23101,"marks":23102,"value":18803,"nodeType":865},{},[],{"data":23104,"content":23105,"nodeType":876},{"uri":11532},[23106],{"data":23107,"marks":23108,"value":1718,"nodeType":865},{},[],{"data":23110,"marks":23111,"value":11541,"nodeType":865},{},[],{"data":23113,"content":23114,"nodeType":1734},{},[23115],{"data":23116,"content":23117,"nodeType":881},{},[23118,23121,23127],{"data":23119,"marks":23120,"value":18822,"nodeType":865},{},[],{"data":23122,"content":23123,"nodeType":876},{"uri":11532},[23124],{"data":23125,"marks":23126,"value":1718,"nodeType":865},{},[],{"data":23128,"marks":23129,"value":11541,"nodeType":865},{},[],{"data":23131,"content":23132,"nodeType":1734},{},[23133],{"data":23134,"content":23135,"nodeType":881},{},[23136,23139,23145],{"data":23137,"marks":23138,"value":18841,"nodeType":865},{},[],{"data":23140,"content":23141,"nodeType":876},{"uri":11554},[23142],{"data":23143,"marks":23144,"value":18848,"nodeType":865},{},[],{"data":23146,"marks":23147,"value":11541,"nodeType":865},{},[],{"data":23149,"content":23150,"nodeType":881},{},[23151],{"data":23152,"marks":23153,"value":18858,"nodeType":865},{},[],{"data":23155,"content":23156,"nodeType":1818},{},[23157,23173,23196],{"data":23158,"content":23159,"nodeType":1734},{},[23160],{"data":23161,"content":23162,"nodeType":881},{},[23163,23166,23170],{"data":23164,"marks":23165,"value":18871,"nodeType":865},{},[],{"data":23167,"marks":23168,"value":18876,"nodeType":865},{},[23169],{"type":902},{"data":23171,"marks":23172,"value":18880,"nodeType":865},{},[],{"data":23174,"content":23175,"nodeType":1734},{},[23176],{"data":23177,"content":23178,"nodeType":881},{},[23179,23182,23186,23189,23193],{"data":23180,"marks":23181,"value":18890,"nodeType":865},{},[],{"data":23183,"marks":23184,"value":18895,"nodeType":865},{},[23185],{"type":902},{"data":23187,"marks":23188,"value":18899,"nodeType":865},{},[],{"data":23190,"marks":23191,"value":18904,"nodeType":865},{},[23192],{"type":902},{"data":23194,"marks":23195,"value":18908,"nodeType":865},{},[],{"data":23197,"content":23198,"nodeType":1734},{},[23199],{"data":23200,"content":23201,"nodeType":881},{},[23202,23205,23209],{"data":23203,"marks":23204,"value":18918,"nodeType":865},{},[],{"data":23206,"marks":23207,"value":18923,"nodeType":865},{},[23208],{"type":902},{"data":23210,"marks":23211,"value":18927,"nodeType":865},{},[],{"data":23213,"content":23216,"nodeType":890},{"target":23214},{"sys":23215},{"id":18932,"type":887,"linkType":888},[],{"data":23218,"content":23219,"nodeType":881},{},[23220],{"data":23221,"marks":23222,"value":18940,"nodeType":865},{},[],{"data":23224,"content":23225,"nodeType":881},{},[23226],{"data":23227,"marks":23228,"value":18947,"nodeType":865},{},[],{"data":23230,"content":23231,"nodeType":894},{},[],{"data":23233,"content":23234,"nodeType":904},{},[23235],{"data":23236,"marks":23237,"value":18957,"nodeType":865},{},[],{"data":23239,"content":23240,"nodeType":1860},{},[23241],{"data":23242,"marks":23243,"value":18964,"nodeType":865},{},[],{"data":23245,"content":23246,"nodeType":881},{},[23247],{"data":23248,"marks":23249,"value":18971,"nodeType":865},{},[],{"data":23251,"content":23252,"nodeType":1818},{},[23253,23277,23312],{"data":23254,"content":23255,"nodeType":1734},{},[23256],{"data":23257,"content":23258,"nodeType":881},{},[23259,23263,23266,23274],{"data":23260,"marks":23261,"value":18985,"nodeType":865},{},[23262],{"type":902},{"data":23264,"marks":23265,"value":18989,"nodeType":865},{},[],{"data":23267,"content":23270,"nodeType":19000},{"target":23268},{"sys":23269},{"id":18994,"type":887,"linkType":888},[23271],{"data":23272,"marks":23273,"value":18999,"nodeType":865},{},[],{"data":23275,"marks":23276,"value":19004,"nodeType":865},{},[],{"data":23278,"content":23279,"nodeType":1734},{},[23280],{"data":23281,"content":23282,"nodeType":881},{},[23283,23287,23290,23298,23301,23309],{"data":23284,"marks":23285,"value":19015,"nodeType":865},{},[23286],{"type":902},{"data":23288,"marks":23289,"value":19019,"nodeType":865},{},[],{"data":23291,"content":23294,"nodeType":19000},{"target":23292},{"sys":23293},{"id":19024,"type":887,"linkType":888},[23295],{"data":23296,"marks":23297,"value":441,"nodeType":865},{},[],{"data":23299,"marks":23300,"value":19032,"nodeType":865},{},[],{"data":23302,"content":23305,"nodeType":19000},{"target":23303},{"sys":23304},{"id":19037,"type":887,"linkType":888},[23306],{"data":23307,"marks":23308,"value":19042,"nodeType":865},{},[],{"data":23310,"marks":23311,"value":14775,"nodeType":865},{},[],{"data":23313,"content":23314,"nodeType":1734},{},[23315],{"data":23316,"content":23317,"nodeType":881},{},[23318,23322,23325,23333],{"data":23319,"marks":23320,"value":19056,"nodeType":865},{},[23321],{"type":902},{"data":23323,"marks":23324,"value":19060,"nodeType":865},{},[],{"data":23326,"content":23329,"nodeType":19000},{"target":23327},{"sys":23328},{"id":19065,"type":887,"linkType":888},[23330],{"data":23331,"marks":23332,"value":19070,"nodeType":865},{},[],{"data":23334,"marks":23335,"value":19074,"nodeType":865},{},[],{"data":23337,"content":23338,"nodeType":881},{},[23339,23342,23348],{"data":23340,"marks":23341,"value":19081,"nodeType":865},{},[],{"data":23343,"content":23344,"nodeType":876},{"uri":19084},[23345],{"data":23346,"marks":23347,"value":19089,"nodeType":865},{},[],{"data":23349,"marks":23350,"value":19093,"nodeType":865},{},[],{"data":23352,"content":23353,"nodeType":881},{},[23354],{"data":23355,"marks":23356,"value":19100,"nodeType":865},{},[],{"data":23358,"content":23359,"nodeType":1818},{},[23360,23369,23385],{"data":23361,"content":23362,"nodeType":1734},{},[23363],{"data":23364,"content":23365,"nodeType":881},{},[23366],{"data":23367,"marks":23368,"value":19113,"nodeType":865},{},[],{"data":23370,"content":23371,"nodeType":1734},{},[23372],{"data":23373,"content":23374,"nodeType":881},{},[23375,23378,23382],{"data":23376,"marks":23377,"value":19123,"nodeType":865},{},[],{"data":23379,"marks":23380,"value":19128,"nodeType":865},{},[23381],{"type":5120},{"data":23383,"marks":23384,"value":19132,"nodeType":865},{},[],{"data":23386,"content":23387,"nodeType":1734},{},[23388],{"data":23389,"content":23390,"nodeType":881},{},[23391],{"data":23392,"marks":23393,"value":19142,"nodeType":865},{},[],{"data":23395,"content":23396,"nodeType":881},{},[23397],{"data":23398,"marks":23399,"value":19149,"nodeType":865},{},[],{"data":23401,"content":23402,"nodeType":1860},{},[23403],{"data":23404,"marks":23405,"value":19156,"nodeType":865},{},[],{"data":23407,"content":23408,"nodeType":881},{},[23409],{"data":23410,"marks":23411,"value":19163,"nodeType":865},{},[],{"data":23413,"content":23414,"nodeType":1818},{},[23415,23424,23433],{"data":23416,"content":23417,"nodeType":1734},{},[23418],{"data":23419,"content":23420,"nodeType":881},{},[23421],{"data":23422,"marks":23423,"value":19176,"nodeType":865},{},[],{"data":23425,"content":23426,"nodeType":1734},{},[23427],{"data":23428,"content":23429,"nodeType":881},{},[23430],{"data":23431,"marks":23432,"value":19186,"nodeType":865},{},[],{"data":23434,"content":23435,"nodeType":1734},{},[23436],{"data":23437,"content":23438,"nodeType":881},{},[23439],{"data":23440,"marks":23441,"value":19196,"nodeType":865},{},[],{"data":23443,"content":23446,"nodeType":890},{"target":23444},{"sys":23445},{"id":19201,"type":887,"linkType":888},[],{"data":23448,"content":23449,"nodeType":881},{},[23450,23453,23457,23460,23464,23467,23471],{"data":23451,"marks":23452,"value":19209,"nodeType":865},{},[],{"data":23454,"marks":23455,"value":19214,"nodeType":865},{},[23456],{"type":902},{"data":23458,"marks":23459,"value":1877,"nodeType":865},{},[],{"data":23461,"marks":23462,"value":19222,"nodeType":865},{},[23463],{"type":902},{"data":23465,"marks":23466,"value":1791,"nodeType":865},{},[],{"data":23468,"marks":23469,"value":19230,"nodeType":865},{},[23470],{"type":902},{"data":23472,"marks":23473,"value":19234,"nodeType":865},{},[],{"data":23475,"content":23478,"nodeType":890},{"target":23476},{"sys":23477},{"id":19239,"type":887,"linkType":888},[],{"data":23480,"content":23481,"nodeType":881},{},[23482],{"data":23483,"marks":23484,"value":19247,"nodeType":865},{},[],{"data":23486,"content":23487,"nodeType":881},{},[23488],{"data":23489,"marks":23490,"value":19254,"nodeType":865},{},[],{"data":23492,"content":23493,"nodeType":1818},{},[23494,23503,23512],{"data":23495,"content":23496,"nodeType":1734},{},[23497],{"data":23498,"content":23499,"nodeType":881},{},[23500],{"data":23501,"marks":23502,"value":19267,"nodeType":865},{},[],{"data":23504,"content":23505,"nodeType":1734},{},[23506],{"data":23507,"content":23508,"nodeType":881},{},[23509],{"data":23510,"marks":23511,"value":19277,"nodeType":865},{},[],{"data":23513,"content":23514,"nodeType":1734},{},[23515],{"data":23516,"content":23517,"nodeType":881},{},[23518],{"data":23519,"marks":23520,"value":19287,"nodeType":865},{},[],{"data":23522,"content":23523,"nodeType":881},{},[23524,23527,23535],{"data":23525,"marks":23526,"value":19294,"nodeType":865},{},[],{"data":23528,"content":23531,"nodeType":19000},{"target":23529},{"sys":23530},{"id":19299,"type":887,"linkType":888},[23532],{"data":23533,"marks":23534,"value":19304,"nodeType":865},{},[],{"data":23536,"marks":23537,"value":959,"nodeType":865},{},[],{"data":23539,"content":23540,"nodeType":894},{},[],{"data":23542,"content":23543,"nodeType":904},{},[23544],{"data":23545,"marks":23546,"value":19317,"nodeType":865},{},[],{"data":23548,"content":23549,"nodeType":1860},{},[23550],{"data":23551,"marks":23552,"value":18964,"nodeType":865},{},[],{"data":23554,"content":23555,"nodeType":881},{},[23556,23559,23565,23568,23574],{"data":23557,"marks":23558,"value":19330,"nodeType":865},{},[],{"data":23560,"content":23561,"nodeType":876},{"uri":19333},[23562],{"data":23563,"marks":23564,"value":19338,"nodeType":865},{},[],{"data":23566,"marks":23567,"value":19342,"nodeType":865},{},[],{"data":23569,"content":23570,"nodeType":876},{"uri":19345},[23571],{"data":23572,"marks":23573,"value":19350,"nodeType":865},{},[],{"data":23575,"marks":23576,"value":19354,"nodeType":865},{},[],{"data":23578,"content":23579,"nodeType":881},{},[23580],{"data":23581,"marks":23582,"value":19361,"nodeType":865},{},[],{"data":23584,"content":23585,"nodeType":881},{},[23586],{"data":23587,"marks":23588,"value":19368,"nodeType":865},{},[],{"data":23590,"content":23591,"nodeType":881},{},[23592],{"data":23593,"marks":23594,"value":19375,"nodeType":865},{},[],{"data":23596,"content":23597,"nodeType":1860},{},[23598],{"data":23599,"marks":23600,"value":19156,"nodeType":865},{},[],{"data":23602,"content":23603,"nodeType":881},{},[23604],{"data":23605,"marks":23606,"value":19388,"nodeType":865},{},[],{"data":23608,"content":23611,"nodeType":890},{"target":23609},{"sys":23610},{"id":19393,"type":887,"linkType":888},[],{"data":23613,"content":23614,"nodeType":881},{},[23615,23618,23622],{"data":23616,"marks":23617,"value":19401,"nodeType":865},{},[],{"data":23619,"marks":23620,"value":19230,"nodeType":865},{},[23621],{"type":902},{"data":23623,"marks":23624,"value":19409,"nodeType":865},{},[],{"data":23626,"content":23627,"nodeType":1818},{},[23628,23637,23646,23655],{"data":23629,"content":23630,"nodeType":1734},{},[23631],{"data":23632,"content":23633,"nodeType":881},{},[23634],{"data":23635,"marks":23636,"value":19422,"nodeType":865},{},[],{"data":23638,"content":23639,"nodeType":1734},{},[23640],{"data":23641,"content":23642,"nodeType":881},{},[23643],{"data":23644,"marks":23645,"value":19432,"nodeType":865},{},[],{"data":23647,"content":23648,"nodeType":1734},{},[23649],{"data":23650,"content":23651,"nodeType":881},{},[23652],{"data":23653,"marks":23654,"value":19442,"nodeType":865},{},[],{"data":23656,"content":23657,"nodeType":1734},{},[23658],{"data":23659,"content":23660,"nodeType":881},{},[23661],{"data":23662,"marks":23663,"value":19452,"nodeType":865},{},[],{"data":23665,"content":23668,"nodeType":890},{"target":23666},{"sys":23667},{"id":19457,"type":887,"linkType":888},[],{"data":23670,"content":23671,"nodeType":881},{},[23672,23675,23683],{"data":23673,"marks":23674,"value":19465,"nodeType":865},{},[],{"data":23676,"content":23679,"nodeType":19000},{"target":23677},{"sys":23678},{"id":19470,"type":887,"linkType":888},[23680],{"data":23681,"marks":23682,"value":19475,"nodeType":865},{},[],{"data":23684,"marks":23685,"value":959,"nodeType":865},{},[],{"data":23687,"content":23688,"nodeType":894},{},[],{"data":23690,"content":23691,"nodeType":904},{},[23692],{"data":23693,"marks":23694,"value":19488,"nodeType":865},{},[],{"data":23696,"content":23697,"nodeType":1860},{},[23698],{"data":23699,"marks":23700,"value":18964,"nodeType":865},{},[],{"data":23702,"content":23703,"nodeType":881},{},[23704,23707,23715],{"data":23705,"marks":23706,"value":19501,"nodeType":865},{},[],{"data":23708,"content":23711,"nodeType":19000},{"target":23709},{"sys":23710},{"id":19506,"type":887,"linkType":888},[23712],{"data":23713,"marks":23714,"value":19511,"nodeType":865},{},[],{"data":23716,"marks":23717,"value":14775,"nodeType":865},{},[],{"data":23719,"content":23720,"nodeType":881},{},[23721],{"data":23722,"marks":23723,"value":19521,"nodeType":865},{},[],{"data":23725,"content":23726,"nodeType":881},{},[23727,23730,23738,23741,23747],{"data":23728,"marks":23729,"value":19528,"nodeType":865},{},[],{"data":23731,"content":23734,"nodeType":19000},{"target":23732},{"sys":23733},{"id":10804,"type":887,"linkType":888},[23735],{"data":23736,"marks":23737,"value":1752,"nodeType":865},{},[],{"data":23739,"marks":23740,"value":19540,"nodeType":865},{},[],{"data":23742,"content":23743,"nodeType":876},{"uri":11116},[23744],{"data":23745,"marks":23746,"value":11122,"nodeType":865},{},[],{"data":23748,"marks":23749,"value":19550,"nodeType":865},{},[],{"data":23751,"content":23752,"nodeType":881},{},[23753,23756,23764],{"data":23754,"marks":23755,"value":19557,"nodeType":865},{},[],{"data":23757,"content":23760,"nodeType":19000},{"target":23758},{"sys":23759},{"id":19562,"type":887,"linkType":888},[23761],{"data":23762,"marks":23763,"value":5480,"nodeType":865},{},[],{"data":23765,"marks":23766,"value":19570,"nodeType":865},{},[],{"data":23768,"content":23769,"nodeType":1860},{},[23770],{"data":23771,"marks":23772,"value":19156,"nodeType":865},{},[],{"data":23774,"content":23775,"nodeType":881},{},[23776,23779,23787],{"data":23777,"marks":23778,"value":19583,"nodeType":865},{},[],{"data":23780,"content":23783,"nodeType":19000},{"target":23781},{"sys":23782},{"id":19588,"type":887,"linkType":888},[23784],{"data":23785,"marks":23786,"value":19593,"nodeType":865},{},[],{"data":23788,"marks":23789,"value":19597,"nodeType":865},{},[],{"data":23791,"content":23792,"nodeType":881},{},[23793],{"data":23794,"marks":23795,"value":19604,"nodeType":865},{},[],{"data":23797,"content":23798,"nodeType":881},{},[23799],{"data":23800,"marks":23801,"value":19611,"nodeType":865},{},[],{"data":23803,"content":23804,"nodeType":1818},{},[23805,23829],{"data":23806,"content":23807,"nodeType":1734},{},[23808],{"data":23809,"content":23810,"nodeType":881},{},[23811,23815,23818,23826],{"data":23812,"marks":23813,"value":19625,"nodeType":865},{},[23814],{"type":902},{"data":23816,"marks":23817,"value":19629,"nodeType":865},{},[],{"data":23819,"content":23822,"nodeType":19000},{"target":23820},{"sys":23821},{"id":19634,"type":887,"linkType":888},[23823],{"data":23824,"marks":23825,"value":19639,"nodeType":865},{},[],{"data":23827,"marks":23828,"value":19643,"nodeType":865},{},[],{"data":23830,"content":23831,"nodeType":1734},{},[23832],{"data":23833,"content":23834,"nodeType":881},{},[23835,23839,23842,23850],{"data":23836,"marks":23837,"value":19654,"nodeType":865},{},[23838],{"type":902},{"data":23840,"marks":23841,"value":19629,"nodeType":865},{},[],{"data":23843,"content":23846,"nodeType":19000},{"target":23844},{"sys":23845},{"id":19662,"type":887,"linkType":888},[23847],{"data":23848,"marks":23849,"value":19667,"nodeType":865},{},[],{"data":23851,"marks":23852,"value":19671,"nodeType":865},{},[],{"data":23854,"content":23855,"nodeType":881},{},[23856],{"data":23857,"marks":23858,"value":19678,"nodeType":865},{},[],{"data":23860,"content":23863,"nodeType":890},{"target":23861},{"sys":23862},{"id":19683,"type":887,"linkType":888},[],{"data":23865,"content":23866,"nodeType":881},{},[23867,23870,23874],{"data":23868,"marks":23869,"value":19691,"nodeType":865},{},[],{"data":23871,"marks":23872,"value":19696,"nodeType":865},{},[23873],{"type":902},{"data":23875,"marks":23876,"value":959,"nodeType":865},{},[],{"data":23878,"content":23879,"nodeType":881},{},[23880,23883,23887],{"data":23881,"marks":23882,"value":5069,"nodeType":865},{},[],{"data":23884,"marks":23885,"value":19696,"nodeType":865},{},[23886],{"type":902},{"data":23888,"marks":23889,"value":19713,"nodeType":865},{},[],{"data":23891,"content":23892,"nodeType":881},{},[23893,23896,23904],{"data":23894,"marks":23895,"value":19720,"nodeType":865},{},[],{"data":23897,"content":23900,"nodeType":19000},{"target":23898},{"sys":23899},{"id":19725,"type":887,"linkType":888},[23901],{"data":23902,"marks":23903,"value":19730,"nodeType":865},{},[],{"data":23905,"marks":23906,"value":19734,"nodeType":865},{},[],{"data":23908,"content":23911,"nodeType":890},{"target":23909},{"sys":23910},{"id":19739,"type":887,"linkType":888},[],{"data":23913,"content":23914,"nodeType":881},{},[23915,23918,23926],{"data":23916,"marks":23917,"value":19747,"nodeType":865},{},[],{"data":23919,"content":23922,"nodeType":19000},{"target":23920},{"sys":23921},{"id":19752,"type":887,"linkType":888},[23923],{"data":23924,"marks":23925,"value":19757,"nodeType":865},{},[],{"data":23927,"marks":23928,"value":19761,"nodeType":865},{},[],{"data":23930,"content":23931,"nodeType":881},{},[23932],{"data":23933,"marks":23934,"value":19768,"nodeType":865},{},[],{"data":23936,"content":23937,"nodeType":894},{},[],{"data":23939,"content":23940,"nodeType":904},{},[23941],{"data":23942,"marks":23943,"value":19778,"nodeType":865},{},[],{"data":23945,"content":23946,"nodeType":1860},{},[23947],{"data":23948,"marks":23949,"value":18964,"nodeType":865},{},[],{"data":23951,"content":23952,"nodeType":881},{},[23953],{"data":23954,"marks":23955,"value":19791,"nodeType":865},{},[],{"data":23957,"content":23958,"nodeType":881},{},[23959],{"data":23960,"marks":23961,"value":19798,"nodeType":865},{},[],{"data":23963,"content":23964,"nodeType":881},{},[23965,23968,23976],{"data":23966,"marks":23967,"value":19805,"nodeType":865},{},[],{"data":23969,"content":23972,"nodeType":19000},{"target":23970},{"sys":23971},{"id":19810,"type":887,"linkType":888},[23973],{"data":23974,"marks":23975,"value":19815,"nodeType":865},{},[],{"data":23977,"marks":23978,"value":19819,"nodeType":865},{},[],{"data":23980,"content":23981,"nodeType":1860},{},[23982],{"data":23983,"marks":23984,"value":19156,"nodeType":865},{},[],{"data":23986,"content":23987,"nodeType":881},{},[23988,23991,23999],{"data":23989,"marks":23990,"value":19832,"nodeType":865},{},[],{"data":23992,"content":23995,"nodeType":19000},{"target":23993},{"sys":23994},{"id":19837,"type":887,"linkType":888},[23996],{"data":23997,"marks":23998,"value":19842,"nodeType":865},{},[],{"data":24000,"marks":24001,"value":19846,"nodeType":865},{},[],{"data":24003,"content":24006,"nodeType":890},{"target":24004},{"sys":24005},{"id":19851,"type":887,"linkType":888},[],{"data":24008,"content":24009,"nodeType":881},{},[24010],{"data":24011,"marks":24012,"value":19859,"nodeType":865},{},[],{"data":24014,"content":24015,"nodeType":1818},{},[24016,24025,24034],{"data":24017,"content":24018,"nodeType":1734},{},[24019],{"data":24020,"content":24021,"nodeType":881},{},[24022],{"data":24023,"marks":24024,"value":19872,"nodeType":865},{},[],{"data":24026,"content":24027,"nodeType":1734},{},[24028],{"data":24029,"content":24030,"nodeType":881},{},[24031],{"data":24032,"marks":24033,"value":19882,"nodeType":865},{},[],{"data":24035,"content":24036,"nodeType":1734},{},[24037],{"data":24038,"content":24039,"nodeType":881},{},[24040],{"data":24041,"marks":24042,"value":19892,"nodeType":865},{},[],{"data":24044,"content":24045,"nodeType":881},{},[24046,24049,24057],{"data":24047,"marks":24048,"value":19899,"nodeType":865},{},[],{"data":24050,"content":24053,"nodeType":19000},{"target":24051},{"sys":24052},{"id":19837,"type":887,"linkType":888},[24054],{"data":24055,"marks":24056,"value":19475,"nodeType":865},{},[],{"data":24058,"marks":24059,"value":959,"nodeType":865},{},[],{"data":24061,"content":24062,"nodeType":894},{},[],{"data":24064,"content":24065,"nodeType":904},{},[24066],{"data":24067,"marks":24068,"value":19920,"nodeType":865},{},[],{"data":24070,"content":24071,"nodeType":1860},{},[24072],{"data":24073,"marks":24074,"value":18964,"nodeType":865},{},[],{"data":24076,"content":24077,"nodeType":881},{},[24078],{"data":24079,"marks":24080,"value":19933,"nodeType":865},{},[],{"data":24082,"content":24083,"nodeType":881},{},[24084,24087,24095],{"data":24085,"marks":24086,"value":19940,"nodeType":865},{},[],{"data":24088,"content":24091,"nodeType":19000},{"target":24089},{"sys":24090},{"id":19945,"type":887,"linkType":888},[24092],{"data":24093,"marks":24094,"value":19950,"nodeType":865},{},[],{"data":24096,"marks":24097,"value":19954,"nodeType":865},{},[],{"data":24099,"content":24100,"nodeType":1860},{},[24101],{"data":24102,"marks":24103,"value":19156,"nodeType":865},{},[],{"data":24105,"content":24106,"nodeType":881},{},[24107,24110,24114],{"data":24108,"marks":24109,"value":19967,"nodeType":865},{},[],{"data":24111,"marks":24112,"value":19972,"nodeType":865},{},[24113],{"type":902},{"data":24115,"marks":24116,"value":959,"nodeType":865},{},[],{"data":24118,"content":24121,"nodeType":890},{"target":24119},{"sys":24120},{"id":19980,"type":887,"linkType":888},[],{"data":24123,"content":24124,"nodeType":881},{},[24125],{"data":24126,"marks":24127,"value":19988,"nodeType":865},{},[],{"data":24129,"content":24130,"nodeType":881},{},[24131],{"data":24132,"marks":24133,"value":19995,"nodeType":865},{},[],{"data":24135,"content":24136,"nodeType":881},{},[24137,24140,24148],{"data":24138,"marks":24139,"value":20002,"nodeType":865},{},[],{"data":24141,"content":24144,"nodeType":19000},{"target":24142},{"sys":24143},{"id":20007,"type":887,"linkType":888},[24145],{"data":24146,"marks":24147,"value":19304,"nodeType":865},{},[],{"data":24149,"marks":24150,"value":959,"nodeType":865},{},[],{"data":24152,"content":24153,"nodeType":894},{},[],{"data":24155,"content":24156,"nodeType":904},{},[24157],{"data":24158,"marks":24159,"value":4448,"nodeType":865},{},[],{"data":24161,"content":24162,"nodeType":881},{},[24163],{"data":24164,"marks":24165,"value":20030,"nodeType":865},{},[],{"data":24167,"content":24168,"nodeType":881},{},[24169],{"data":24170,"marks":24171,"value":20037,"nodeType":865},{},[],{"data":24173,"content":24174,"nodeType":881},{},[24175,24178,24184,24187,24193],{"data":24176,"marks":24177,"value":20044,"nodeType":865},{},[],{"data":24179,"content":24180,"nodeType":876},{"uri":20047},[24181],{"data":24182,"marks":24183,"value":20052,"nodeType":865},{},[],{"data":24185,"marks":24186,"value":20056,"nodeType":865},{},[],{"data":24188,"content":24189,"nodeType":876},{"uri":20059},[24190],{"data":24191,"marks":24192,"value":5355,"nodeType":865},{},[],{"data":24194,"marks":24195,"value":959,"nodeType":865},{},[],{"items":24197},[24198,24200],{"sys":24199,"name":342},{"id":4510},{"sys":24201,"name":4507},{"id":4506},{"items":24203},[24204],{"fullName":20080,"firstName":20081,"jobTitle":20082,"profilePicture":24205},{"url":20084},"blog/consentfix-debrief",{"json":24208},{"data":24209,"content":24210,"nodeType":1463},{},[24211],{"data":24212,"content":24213,"nodeType":881},{},[24214],{"data":24215,"marks":24216,"value":24217,"nodeType":865},{},[],"In December, the Push Security research team discovered and blocked a brand new attack technique that we coined ConsentFix. We’re sharing some new insights on the campaign and pulling together some of the top recommendations and resources from across the community.",{"id":17956,"publishedAt":24219},"2026-08-12T11:53:17.990Z",{"items":24221},[24222,24224],{"sys":24223,"name":342},{"id":4510},{"sys":24225,"name":4507},{"id":4506},{"items":24227},[24228,24230,24232,24234,24236,24238,24240,24242,24244,24246],{"sys":24229,"name":279,"slug":280,"tier":31},{"id":276},{"sys":24231,"name":413,"slug":414,"tier":31},{"id":410},{"sys":24233,"name":342,"slug":343,"tier":31},{"id":339},{"sys":24235,"name":642,"slug":643,"tier":31},{"id":639},{"sys":24237,"name":315,"slug":316,"tier":45},{"id":312},{"sys":24239,"name":484,"slug":485,"tier":45},{"id":481},{"sys":24241,"name":466,"slug":467,"tier":45},{"id":463},{"sys":24243,"name":607,"slug":608,"tier":45},{"id":604},{"sys":24245,"name":493,"slug":494,"tier":45},{"id":490},{"sys":24247,"name":351,"slug":352,"tier":45},{"id":348},"TUFybvHb1NoaG6z8j3cuNnEKnFo_nsXmfjWUc_b4rt0",{"id":24250,"title":24251,"authorsCollection":24252,"content":24257,"extension":228,"faqItemsCollection":25010,"faqTitle":59,"featured":6,"hashTags":59,"meta":25012,"metaTitle":25013,"ogImage":59,"postType":1480,"publishedDate":25014,"relatedBlogPostsCollection":25015,"slug":27191,"stem":27192,"subtitle":59,"summary":27193,"synopsis":27204,"sys":27205,"tagsCollection":27208,"topicsCollection":27214,"__hash__":27260},"blog/blog/2025-top-phishing-trends.json","2025’s top phishing trends — and what they mean for your 2026 security strategy",{"items":24253},[24254],{"fullName":5373,"firstName":5374,"jobTitle":5375,"socialLinks":24255,"profilePicture":24256},[6440],{"url":5377},{"json":24258,"links":24923},{"data":24259,"content":24260,"nodeType":1463},{},[24261,24267,24274,24281,24284,24292,24299,24306,24313,24407,24413,24419,24425,24432,24439,24458,24461,24469,24476,24483,24490,24533,24540,24585,24591,24598,24605,24608,24616,24623,24630,24637,24708,24714,24720,24752,24758,24777,24783,24790,24797,24803,24806,24814,24821,24854,24861,24864,24872,24879,24886,24912,24917],{"data":24262,"content":24266,"nodeType":890},{"target":24263},{"sys":24264},{"id":24265,"type":887,"linkType":888},"1axcGwWxeKxDMk8jOWhYT6",[],{"data":24268,"content":24269,"nodeType":881},{},[24270],{"data":24271,"marks":24272,"value":24273,"nodeType":865},{},[],"2025 saw a huge amount of attacker innovation when it comes to phishing attacks, as attackers continue to double down on identity-based techniques. The continual evolution of phishing means it remains one of the most effective methods available to attackers today — in fact, it’s arguably more effective than ever. ",{"data":24275,"content":24276,"nodeType":881},{},[24277],{"data":24278,"marks":24279,"value":24280,"nodeType":865},{},[],"Let’s take a closer look at the key trends that defined phishing attacks in 2025, and what these changes mean for security teams heading into 2026. ",{"data":24282,"content":24283,"nodeType":894},{},[],{"data":24285,"content":24286,"nodeType":904},{},[24287],{"data":24288,"marks":24289,"value":24291,"nodeType":865},{},[24290],{"type":902},"#1: Phishing goes omni-channel",{"data":24293,"content":24294,"nodeType":881},{},[24295],{"data":24296,"marks":24297,"value":24298,"nodeType":865},{},[],"We’ve been talking about the rise of non-email phishing for some time now, but 2025 was the year phishing truly went omni-channel. ",{"data":24300,"content":24301,"nodeType":881},{},[24302],{"data":24303,"marks":24304,"value":24305,"nodeType":865},{},[],"Although most of the industry’s data on phishing still comes from email security vendors and tools, the picture is starting to change. Roughly 1 in 3 phishing attacks detected by Push Security were delivered outside of email. ",{"data":24307,"content":24308,"nodeType":881},{},[24309],{"data":24310,"marks":24311,"value":24312,"nodeType":865},{},[],"There are many examples of phishing campaigns operated outside of email, with LinkedIn DMs and Google Search being the top channels we identified. Notable campaigns include:",{"data":24314,"content":24315,"nodeType":1818},{},[24316,24338,24360],{"data":24317,"content":24318,"nodeType":1734},{},[24319],{"data":24320,"content":24321,"nodeType":881},{},[24322,24325,24334],{"data":24323,"marks":24324,"value":21,"nodeType":865},{},[],{"data":24326,"content":24328,"nodeType":876},{"uri":24327},"https://pushsecurity.com/blog/how-push-stopped-a-high-risk-linkedin-spear-phishing-attack",[24329],{"data":24330,"marks":24331,"value":24333,"nodeType":865},{},[24332],{"type":874},"A targeted campaign against tech company Exec’s",{"data":24335,"marks":24336,"value":24337,"nodeType":865},{},[]," delivered via compromised accounts on LinkedIn from other employees of the same organization, framed as an investment opportunity.",{"data":24339,"content":24340,"nodeType":1734},{},[24341],{"data":24342,"content":24343,"nodeType":881},{},[24344,24347,24356],{"data":24345,"marks":24346,"value":21,"nodeType":865},{},[],{"data":24348,"content":24350,"nodeType":876},{"uri":24349},"https://pushsecurity.com/blog/new-phishing-campaign-identified-targeting-linkedin-users",[24351],{"data":24352,"marks":24353,"value":24355,"nodeType":865},{},[24354],{"type":874},"A campaign posing as a South American investment fund",{"data":24357,"marks":24358,"value":24359,"nodeType":865},{},[]," offering the opportunity to join the fund. ",{"data":24361,"content":24362,"nodeType":1734},{},[24363],{"data":24364,"content":24365,"nodeType":881},{},[24366,24370,24379,24383,24391,24395,24403],{"data":24367,"marks":24368,"value":24369,"nodeType":865},{},[],"Several malvertising campaigns capturing users searching for key search terms such as “",{"data":24371,"content":24373,"nodeType":876},{"uri":24372},"https://pushsecurity.com/blog/analysing-a-malvertising-attack-targeting-business-google-accounts",[24374],{"data":24375,"marks":24376,"value":24378,"nodeType":865},{},[24377],{"type":874},"Google Ads",{"data":24380,"marks":24381,"value":24382,"nodeType":865},{},[],"”, “",{"data":24384,"content":24386,"nodeType":876},{"uri":24385},"https://pushsecurity.com/blog/analysing-a-sophisticated-google-malvertising-attack",[24387],{"data":24388,"marks":24389,"value":22745,"nodeType":865},{},[24390],{"type":874},{"data":24392,"marks":24393,"value":24394,"nodeType":865},{},[],"” and “",{"data":24396,"content":24398,"nodeType":876},{"uri":24397},"https://pushsecurity.com/blog/investigating-a-recent-malvertising-campaign-targeting-onfido-customers",[24399],{"data":24400,"marks":24401,"value":22769,"nodeType":865},{},[24402],{"type":874},{"data":24404,"marks":24405,"value":24406,"nodeType":865},{},[],"”. ",{"data":24408,"content":24412,"nodeType":890},{"target":24409},{"sys":24410},{"id":24411,"type":887,"linkType":888},"3LjyZooaJQ83eJt8DRX9bP",[],{"data":24414,"content":24418,"nodeType":890},{"target":24415},{"sys":24416},{"id":24417,"type":887,"linkType":888},"644LdQYjRHerpKU5pCGv1n",[],{"data":24420,"content":24424,"nodeType":890},{"target":24421},{"sys":24422},{"id":24423,"type":887,"linkType":888},"3anCGk5A4AOVH1t9dr1xKp",[],{"data":24426,"content":24427,"nodeType":881},{},[24428],{"data":24429,"marks":24430,"value":24431,"nodeType":865},{},[],"Phishing via non-email channels has a number of advantages. With email being the best protected phishing vector, it sidesteps these controls entirely. There’s no need to build up your sender reputation, find ways to trick content analysis engines, or hope your message doesn’t end up in the spam folder.",{"data":24433,"content":24434,"nodeType":881},{},[24435],{"data":24436,"marks":24437,"value":24438,"nodeType":865},{},[],"In comparison, non-email vectors have practically no screening, your security team has no visibility, and users are less likely to anticipate possible phishing. It’s arguable that a company Exec is more likely to engage with a LinkedIn DM from a reputable account than a cold email. And social media apps do nothing to analyse messages for phishing links. (And because of the limitations of URL-based checks when it comes to today’s multi-stage phishing attacks, this would be extremely difficult even if they tried). ",{"data":24440,"content":24441,"nodeType":881},{},[24442,24446,24454],{"data":24443,"marks":24444,"value":24445,"nodeType":865},{},[],"Search engines also present a huge opportunity for attackers, whether they’re compromising existing, high reputation sites, spinning up malicious ads, or simply vibe coding their own SEO-optimized websites. This is an effective way to launch “watering hole” style attacks, casting a wide net to harvest credentials and account access that can be re-sold to other criminals for a fee, or leveraged by partners in the cybercriminal ecosystem as part of major cyber breaches (such as the recent attacks by the “",{"data":24447,"content":24449,"nodeType":876},{"uri":24448},"https://pushsecurity.com/blog/scattered-lapsus-hunters",[24450],{"data":24451,"marks":24452,"value":1752,"nodeType":865},{},[24453],{"type":874},{"data":24455,"marks":24456,"value":24457,"nodeType":865},{},[],"” criminal collective, all of which began with identity-based initial access). ",{"data":24459,"content":24460,"nodeType":894},{},[],{"data":24462,"content":24463,"nodeType":904},{},[24464],{"data":24465,"marks":24466,"value":24468,"nodeType":865},{},[24467],{"type":902},"#2: Criminal PhaaS kits dominate",{"data":24470,"content":24471,"nodeType":881},{},[24472],{"data":24473,"marks":24474,"value":24475,"nodeType":865},{},[],"The vast majority of phishing attacks today use a reverse proxy. This means they are capable of bypassing most forms of MFA because a session is created and stolen in real time as part of the attack. There is no downside to this approach compared to the basic credential phishing that was the norm more than a decade ago.",{"data":24477,"content":24478,"nodeType":881},{},[24479],{"data":24480,"marks":24481,"value":24482,"nodeType":865},{},[],"These Attacker-in-the-Middle attacks are powered by criminal Phishing-as-a-Service (PhaaS) kits such as Tycoon, NakedPages, Sneaky2FA, Flowerstorm, Salty2FA, along with various Evilginx variations (nominally a tool for red teamers, but widely used by attackers). ",{"data":24484,"content":24485,"nodeType":881},{},[24486],{"data":24487,"marks":24488,"value":24489,"nodeType":865},{},[],"PhaaS kits are incredibly important to cybercrime because they make sophisticated and continuously evolving capabilities available to the criminal marketplace, lowering the barrier to entry for criminals running advanced phishing campaigns. This is not unique to phishing: Ransomware-as-a-Service, Credential Stuffing-as-a-Service, and many more for-hire tools and services exist for criminals to use for a fee. ",{"data":24491,"content":24492,"nodeType":881},{},[24493,24497,24506,24509,24516,24520,24529],{"data":24494,"marks":24495,"value":24496,"nodeType":865},{},[],"This competitive environment has fueled attacker innovation, resulting in an environment in which MFA-bypass is table stakes, phishing-resistant authentication is being circumvented through ",{"data":24498,"content":24500,"nodeType":876},{"uri":24499},"https://pushsecurity.com/blog/mfa-downgrade-attacks",[24501],{"data":24502,"marks":24503,"value":24505,"nodeType":865},{},[24504],{"type":874},"downgrade attacks",{"data":24507,"marks":24508,"value":1791,"nodeType":865},{},[],{"data":24510,"content":24511,"nodeType":876},{"uri":1022},[24512],{"data":24513,"marks":24514,"value":1951,"nodeType":865},{},[24515],{"type":874},{"data":24517,"marks":24518,"value":24519,"nodeType":865},{},[]," are being used to circumvent security tools — from email scanners, to web-crawling security tools, to web proxies analyzing network traffic. It also means that when new capabilities emerge — such as ",{"data":24521,"content":24523,"nodeType":876},{"uri":24522},"https://pushsecurity.com/blog/analyzing-the-latest-sneaky2fa-phishing-page",[24524],{"data":24525,"marks":24526,"value":24528,"nodeType":865},{},[24527],{"type":874},"Browser-in-the-Browser",{"data":24530,"marks":24531,"value":24532,"nodeType":865},{},[]," — these are quickly integrated into a range of phishing kits. ",{"data":24534,"content":24535,"nodeType":881},{},[24536],{"data":24537,"marks":24538,"value":24539,"nodeType":865},{},[],"Some of the most prevalent detection evasion methods we’ve seen this year are:",{"data":24541,"content":24542,"nodeType":1818},{},[24543,24553,24563],{"data":24544,"content":24545,"nodeType":1734},{},[24546],{"data":24547,"content":24548,"nodeType":881},{},[24549],{"data":24550,"marks":24551,"value":24552,"nodeType":865},{},[],"Widespread use of bot protection. Every phishing page today comes with either a custom CAPTCHA or Cloudflare Turnstile (legitimate and fake versions) designed to block web-crawling security bots from being able to analyse phishing pages. ",{"data":24554,"content":24555,"nodeType":1734},{},[24556],{"data":24557,"content":24558,"nodeType":881},{},[24559],{"data":24560,"marks":24561,"value":24562,"nodeType":865},{},[],"Extensive redirect chains between the initial link seeded out to the victim, and the actual malicious page hosting phishing content, designed to bury phishing sites among several legitimate pages. ",{"data":24564,"content":24565,"nodeType":1734},{},[24566],{"data":24567,"content":24568,"nodeType":881},{},[24569,24573,24581],{"data":24570,"marks":24571,"value":24572,"nodeType":865},{},[],"Multi-stage page loading performed client-side via JavaScript. This means that pages are ",{"data":24574,"content":24575,"nodeType":876},{"uri":7327},[24576],{"data":24577,"marks":24578,"value":24580,"nodeType":865},{},[24579],{"type":874},"conditionally loaded",{"data":24582,"marks":24583,"value":24584,"nodeType":865},{},[],", and if conditions aren’t met, malicious content isn’t served — so the page looks clean. This also means that most of the malicious activity is happening locally, without creating web requests that can be analysed by network traffic analysis tools (e.g. web proxies). ",{"data":24586,"content":24590,"nodeType":890},{"target":24587},{"sys":24588},{"id":24589,"type":887,"linkType":888},"5LLgjhCexTYd5OlHuptv3n",[],{"data":24592,"content":24593,"nodeType":881},{},[24594],{"data":24595,"marks":24596,"value":24597,"nodeType":865},{},[],"This contributes to an environment where phishing is going undetected for extended periods of time. Even when a page is flagged, it’s trivial for attackers to dynamically serve up different phishing pages from the same benign chain of URLs used in the attack. ",{"data":24599,"content":24600,"nodeType":881},{},[24601],{"data":24602,"marks":24603,"value":24604,"nodeType":865},{},[],"This is all to say that the old-school approach to URL blocking bad sites is becoming much harder and leaves you two steps behind attackers at all times.",{"data":24606,"content":24607,"nodeType":894},{},[],{"data":24609,"content":24610,"nodeType":904},{},[24611],{"data":24612,"marks":24613,"value":24615,"nodeType":865},{},[24614],{"type":902},"#3: Attackers find ways around phishing-resistant authentication (and other security controls)",{"data":24617,"content":24618,"nodeType":881},{},[24619],{"data":24620,"marks":24621,"value":24622,"nodeType":865},{},[],"We already mentioned that MFA downgrade has been an area of focus for security researchers and attackers. But phishing-resistant authentication methods (i.e. passkeys) remain effective so long as the phishing-resistant factor is the only possible login factor, and there are no backup methods enabled for the account. (Though because of the logistical issues of having just one factor, this is fairly uncommon.) ",{"data":24624,"content":24625,"nodeType":881},{},[24626],{"data":24627,"marks":24628,"value":24629,"nodeType":865},{},[],"Equally, access control policies can be applied on larger enterprise apps and cloud platforms to reduce the risk of unauthorized access (although these can be tricky to implement and maintain without error).",{"data":24631,"content":24632,"nodeType":881},{},[24633],{"data":24634,"marks":24635,"value":24636,"nodeType":865},{},[],"In any case, attackers are considering all eventualities and looking for alternative ways into accounts that are less well protected. This mainly involves attackers circumventing the standard authentication process, through techniques such as:",{"data":24638,"content":24639,"nodeType":1818},{},[24640,24667,24693],{"data":24641,"content":24642,"nodeType":1734},{},[24643],{"data":24644,"content":24645,"nodeType":881},{},[24646,24649,24658,24663],{"data":24647,"marks":24648,"value":21,"nodeType":865},{},[],{"data":24650,"content":24651,"nodeType":876},{"uri":18095},[24652],{"data":24653,"marks":24654,"value":24657,"nodeType":865},{},[24655,24656],{"type":874},{"type":902},"Consent phishing",{"data":24659,"marks":24660,"value":24662,"nodeType":865},{},[24661],{"type":902},":",{"data":24664,"marks":24665,"value":24666,"nodeType":865},{},[]," Tricking victims into connecting malicious OAuth apps into their app tenant.",{"data":24668,"content":24669,"nodeType":1734},{},[24670],{"data":24671,"content":24672,"nodeType":881},{},[24673,24676,24684,24689],{"data":24674,"marks":24675,"value":21,"nodeType":865},{},[],{"data":24677,"content":24678,"nodeType":876},{"uri":1526},[24679],{"data":24680,"marks":24681,"value":360,"nodeType":865},{},[24682,24683],{"type":874},{"type":902},{"data":24685,"marks":24686,"value":24688,"nodeType":865},{},[24687],{"type":902},": ",{"data":24690,"marks":24691,"value":24692,"nodeType":865},{},[],"The same as consent phishing, but authorizing through the device code flow designed for device logins that cannot support OAuth, by providing a substitute passcode. ",{"data":24694,"content":24695,"nodeType":1734},{},[24696],{"data":24697,"content":24698,"nodeType":881},{},[24699,24704],{"data":24700,"marks":24701,"value":24703,"nodeType":865},{},[24702],{"type":902},"Malicious browser extensions: ",{"data":24705,"marks":24706,"value":24707,"nodeType":865},{},[],"Tricking victims into installing a malicious extension (or hijacking an existing one) to steal credentials and cookies from the browser. ",{"data":24709,"content":24713,"nodeType":890},{"target":24710},{"sys":24711},{"id":24712,"type":887,"linkType":888},"75lMjdJtq9APebTaF2hQ1b",[],{"data":24715,"content":24719,"nodeType":890},{"target":24716},{"sys":24717},{"id":24718,"type":887,"linkType":888},"4KWwlg8PsuyAud8i5tpWfH",[],{"data":24721,"content":24722,"nodeType":881},{},[24723,24727,24735,24739,24748],{"data":24724,"marks":24725,"value":24726,"nodeType":865},{},[],"Another technique that attackers are using to steal credentials and sessions is ",{"data":24728,"content":24730,"nodeType":876},{"uri":24729},"https://pushsecurity.com/blog/the-most-advanced-clickfix-yet",[24731],{"data":24732,"marks":24733,"value":315,"nodeType":865},{},[24734],{"type":874},{"data":24736,"marks":24737,"value":24738,"nodeType":865},{},[],". ClickFix was the ",{"data":24740,"content":24742,"nodeType":876},{"uri":24741},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=36",[24743],{"data":24744,"marks":24745,"value":24747,"nodeType":865},{},[24746],{"type":874},"top initial access vector detected by Microsoft last year",{"data":24749,"marks":24750,"value":24751,"nodeType":865},{},[],", involved in 47% of attacks. While not a traditional phishing attack, this sees attackers socially engineer users into running malicious code on their machine, typically deploying remote access tools and infostealer malware. Infostealers are then used to harvest credentials and cookies for initial access to various apps and services. ",{"data":24753,"content":24757,"nodeType":890},{"target":24754},{"sys":24755},{"id":24756,"type":887,"linkType":888},"4cC9GbPoKFmYUJgbkbeOLs",[],{"data":24759,"content":24760,"nodeType":881},{},[24761,24765,24773],{"data":24762,"marks":24763,"value":24764,"nodeType":865},{},[],"Push Security researchers have also discovered a brand new technique dubbed ",{"data":24766,"content":24768,"nodeType":876},{"uri":24767},"https://pushsecurity.com/blog/consentfix",[24769],{"data":24770,"marks":24771,"value":1236,"nodeType":865},{},[24772],{"type":874},{"data":24774,"marks":24775,"value":24776,"nodeType":865},{},[]," — a browser-native version of ClickFix that results in an OAuth connection being established to the target app, simply by copying and pasting a legitimate URL containing OAuth key material. ",{"data":24778,"content":24782,"nodeType":890},{"target":24779},{"sys":24780},{"id":24781,"type":887,"linkType":888},"4bdqleePd53oK5v5uEUFbr",[],{"data":24784,"content":24785,"nodeType":881},{},[24786],{"data":24787,"marks":24788,"value":24789,"nodeType":865},{},[],"This is even more dangerous than ClickFix as it is entirely browser-native — removing the endpoint detection surface (and strong security controls like EDR) from the equation entirely. And in the particular case spotted by Push, the attackers targeted Azure CLI — a first-party Microsoft app that has special permissions and can’t be restricted like third-party apps. ",{"data":24791,"content":24792,"nodeType":881},{},[24793],{"data":24794,"marks":24795,"value":24796,"nodeType":865},{},[],"Really, there are lots of different techniques attackers can use to take over accounts on key business applications — it’s outdated to think of phishing as being locked in to passwords, MFA, and the standard authentication flow. ",{"data":24798,"content":24802,"nodeType":890},{"target":24799},{"sys":24800},{"id":24801,"type":887,"linkType":888},"74S97KkuFzI48UwXw3msTq",[],{"data":24804,"content":24805,"nodeType":894},{},[],{"data":24807,"content":24808,"nodeType":904},{},[24809],{"data":24810,"marks":24811,"value":24813,"nodeType":865},{},[24812],{"type":902},"Guidance for security teams in 2026",{"data":24815,"content":24816,"nodeType":881},{},[24817],{"data":24818,"marks":24819,"value":24820,"nodeType":865},{},[],"To tackle phishing in 2026, security teams need to change their threat model for phishing, and acknowledge that:",{"data":24822,"content":24823,"nodeType":1818},{},[24824,24834,24844],{"data":24825,"content":24826,"nodeType":1734},{},[24827],{"data":24828,"content":24829,"nodeType":881},{},[24830],{"data":24831,"marks":24832,"value":24833,"nodeType":865},{},[],"It’s not enough to protect email as your main anti-phishing surface",{"data":24835,"content":24836,"nodeType":1734},{},[24837],{"data":24838,"content":24839,"nodeType":881},{},[24840],{"data":24841,"marks":24842,"value":24843,"nodeType":865},{},[],"Network and traffic monitoring tools aren’t keeping up with modern phishing pages",{"data":24845,"content":24846,"nodeType":1734},{},[24847],{"data":24848,"content":24849,"nodeType":881},{},[24850],{"data":24851,"marks":24852,"value":24853,"nodeType":865},{},[],"Phishing-resistant authentication, even if perfectly implemented, doesn’t make you immune",{"data":24855,"content":24856,"nodeType":881},{},[24857],{"data":24858,"marks":24859,"value":24860,"nodeType":865},{},[],"Detection and response is key. But most organizations have significant visibility gaps.",{"data":24862,"content":24863,"nodeType":894},{},[],{"data":24865,"content":24866,"nodeType":904},{},[24867],{"data":24868,"marks":24869,"value":24871,"nodeType":865},{},[24870],{"type":902},"Solving the detection gap in the browser",{"data":24873,"content":24874,"nodeType":881},{},[24875],{"data":24876,"marks":24877,"value":24878,"nodeType":865},{},[],"One thing that these attacks have in common is that they all take place in the web browser, targeting users as they go about their work on the internet. That makes it the perfect place to detect and respond to these attacks. But right now, the browser is a blind-spot for most security teams.",{"data":24880,"content":24881,"nodeType":881},{},[24882],{"data":24883,"marks":24884,"value":24885,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":24887,"content":24888,"nodeType":881},{},[24889,24892,24899,24902,24909],{"data":24890,"marks":24891,"value":4462,"nodeType":865},{},[],{"data":24893,"content":24894,"nodeType":876},{"uri":4465},[24895],{"data":24896,"marks":24897,"value":4471,"nodeType":865},{},[24898],{"type":874},{"data":24900,"marks":24901,"value":8048,"nodeType":865},{},[],{"data":24903,"content":24904,"nodeType":876},{"uri":1453},[24905],{"data":24906,"marks":24907,"value":4495,"nodeType":865},{},[24908],{"type":874},{"data":24910,"marks":24911,"value":959,"nodeType":865},{},[],{"data":24913,"content":24916,"nodeType":890},{"target":24914},{"sys":24915},{"id":8063,"type":887,"linkType":888},[],{"data":24918,"content":24919,"nodeType":881},{},[24920],{"data":24921,"marks":24922,"value":21,"nodeType":865},{},[],{"entries":24924},{"hyperlink":24925,"inline":24926,"block":24927},[],[],[24928,24953,24958,24964,24970,24976,24981,24988,24994,25001,25007],{"sys":24929,"__typename":7015,"content":24930,"name":24952,"title":59},{"id":24265},{"json":24931},{"nodeType":1463,"data":24932,"content":24933},{},[24934],{"nodeType":881,"data":24935,"content":24936},{},[24937,24941,24949],{"nodeType":865,"value":24938,"marks":24939,"data":24940},"We recently ran a webinar packed full of attack demo's, showcasing some of the most interesting attacks intercepted by Push in 2025. ",[],{},{"nodeType":876,"data":24942,"content":24944},{"uri":24943},"https://pushsecurity.com/webinar/phishing-2025-review",[24945],{"nodeType":865,"value":24946,"marks":24947,"data":24948},"You can now watch it on demand here!",[],{},{"nodeType":865,"value":21,"marks":24950,"data":24951},[],{},"Top phishing trends insight box 1",{"sys":24954,"__typename":7008,"title":24955,"caption":24955,"layoutMode":59,"file":24956},{"id":24411},"Fake private equity fund page hosted on Google Sites. ",{"url":24957,"width":7012,"height":14713},"https://images.ctfassets.net/y1cdw1ablpvd/2DbF1Lj4h5HVGrqDhlVlTF/9efa11f318206eb913d83c254746efb1/1.png",{"sys":24959,"__typename":7008,"title":24960,"caption":24960,"layoutMode":59,"file":24961},{"id":24417},"Custom investment fund landing page hosted on Firebase.",{"url":24962,"width":7012,"height":24963},"https://images.ctfassets.net/y1cdw1ablpvd/2NH9muR2eBEPEybqQ8o0yu/ef66b40c7428790c9017181e17b33558/2.png",1080,{"sys":24965,"__typename":7008,"title":24966,"caption":24966,"layoutMode":59,"file":24967},{"id":24423},"Malvertising link for “Google Ads” taking the top Sponsored Results spot.",{"url":24968,"width":7012,"height":24969},"https://images.ctfassets.net/y1cdw1ablpvd/2gQcwHSyUKIoqlW1upRSzK/5ead4c9e6c1e6659be7d781ad85ed9ea/3.png",1205,{"sys":24971,"__typename":7008,"title":24972,"caption":24972,"layoutMode":59,"file":24973},{"id":24589},"Example of a typical phishing link chain incorporating legitimate websites before serving up a phishing page, as shown in the Push Security “Timelines” detection feature.",{"url":24974,"width":24975,"height":7012},"https://images.ctfassets.net/y1cdw1ablpvd/3WZkEAVsAH7PWtcoQJfDG1/03826279b5dd2bc11fbbf34f82c59136/4.png",1743,{"sys":24977,"__typename":7008,"title":24978,"caption":24978,"layoutMode":59,"file":24979},{"id":24712},"Consent phishing examples where an attacker tricks the victim into authorizing an attacker-controlled app with risky permissions.",{"url":24980,"width":7012,"height":7210},"https://images.ctfassets.net/y1cdw1ablpvd/2ZgY3mMKcE6IGpH55kOuL4/2a7e78e97654faa61cf8e8b002789b96/5.png",{"sys":24982,"__typename":7008,"title":24983,"caption":24983,"layoutMode":59,"file":24984},{"id":24718},"Device code phishing targeting Salesforce, as seen in the Scattered Lapsus$ Hunters campaign. ",{"url":24985,"width":24986,"height":24987},"https://images.ctfassets.net/y1cdw1ablpvd/7uvYjRiqG4E7qj3PTmTZzW/3d3ed52d3157bf12a630e35eb2ae08d1/6.png",1488,950,{"sys":24989,"__typename":7008,"title":24990,"caption":24990,"layoutMode":59,"file":24991},{"id":24756},"ClickFix attacks prompt the victim to “fix” an issue on the webpage by running code locally on their machine.",{"url":24992,"width":7012,"height":24993},"https://images.ctfassets.net/y1cdw1ablpvd/1LXv96rhy5Sv6SBlJP0bJS/6fb6b49dcd2bdc003c2aa60ed271708f/7.png",1117,{"sys":24995,"__typename":7008,"title":24996,"caption":24996,"layoutMode":59,"file":24997},{"id":24781},"ConsentFix prompts victims to paste a URL containing an OAuth code, authorising a connection to the attacker’s OAuth app tenant. ",{"url":24998,"width":24999,"height":25000},"https://images.ctfassets.net/y1cdw1ablpvd/7IfG43sz0jRnrNiKsMwN8j/1373b7cd86fe969acad27ad956612ca0/8.png",1225,1135,{"sys":25002,"__typename":7008,"title":25003,"caption":25003,"layoutMode":59,"file":25004},{"id":24801},"There are lots of ways that attackers can achieve account takeover today via phishing / social engineering.",{"url":25005,"width":7012,"height":25006},"https://images.ctfassets.net/y1cdw1ablpvd/4Wz7gAJLWDyaGjj030ypH2/7a07f1e5c46cdebd2e395d0ceb412387/9.png",969,{"sys":25008,"__typename":1471,"type":1472,"ctaText":25009,"buttonLabel":21701,"buttonColour":1475,"buttonUrl":24943},{"id":8063},"Learn how phishing evolved in 2025, showcasing the most sophisticated attacks and key trends uncovered by Push researchers",{"items":25011},[],{},"Analyzing 2025's top phishing trends","2025-12-15T00:00:00.000Z",{"items":25016},[25017,25765,26363],{"__typename":1485,"sys":25018,"content":25019,"title":8071,"synopsis":8072,"hashTags":59,"publishedDate":8073,"slug":8074,"tagsCollection":25755,"authorsCollection":25761},{"id":7222},{"json":25020},{"data":25021,"content":25022,"nodeType":1463},{},[25023,25030,25036,25042,25048,25058,25064,25069,25074,25077,25084,25090,25096,25101,25117,25123,25128,25134,25139,25145,25184,25189,25194,25200,25206,25209,25216,25232,25238,25243,25259,25264,25280,25286,25289,25296,25302,25338,25348,25351,25358,25373,25379,25392,25398,25404,25409,25415,25418,25425,25431,25479,25485,25488,25495,25500,25506,25512,25517,25523,25552,25558,25564,25569,25575,25580,25587,25603,25609,25639,25645,25675,25678,25685,25691,25696,25712,25718,25744,25749],{"data":25024,"content":25025,"nodeType":904},{},[25026],{"data":25027,"marks":25028,"value":7234,"nodeType":865},{},[25029],{"type":902},{"data":25031,"content":25032,"nodeType":881},{},[25033],{"data":25034,"marks":25035,"value":7241,"nodeType":865},{},[],{"data":25037,"content":25038,"nodeType":881},{},[25039],{"data":25040,"marks":25041,"value":7248,"nodeType":865},{},[],{"data":25043,"content":25044,"nodeType":881},{},[25045],{"data":25046,"marks":25047,"value":7255,"nodeType":865},{},[],{"data":25049,"content":25050,"nodeType":881},{},[25051,25055],{"data":25052,"marks":25053,"value":7263,"nodeType":865},{},[25054],{"type":902},{"data":25056,"marks":25057,"value":7267,"nodeType":865},{},[],{"data":25059,"content":25060,"nodeType":881},{},[25061],{"data":25062,"marks":25063,"value":7274,"nodeType":865},{},[],{"data":25065,"content":25068,"nodeType":890},{"target":25066},{"sys":25067},{"id":7279,"type":887,"linkType":888},[],{"data":25070,"content":25073,"nodeType":890},{"target":25071},{"sys":25072},{"id":7285,"type":887,"linkType":888},[],{"data":25075,"content":25076,"nodeType":894},{},[],{"data":25078,"content":25079,"nodeType":904},{},[25080],{"data":25081,"marks":25082,"value":7297,"nodeType":865},{},[25083],{"type":902},{"data":25085,"content":25086,"nodeType":881},{},[25087],{"data":25088,"marks":25089,"value":7304,"nodeType":865},{},[],{"data":25091,"content":25092,"nodeType":881},{},[25093],{"data":25094,"marks":25095,"value":7311,"nodeType":865},{},[],{"data":25097,"content":25100,"nodeType":890},{"target":25098},{"sys":25099},{"id":7316,"type":887,"linkType":888},[],{"data":25102,"content":25103,"nodeType":881},{},[25104,25107,25114],{"data":25105,"marks":25106,"value":7324,"nodeType":865},{},[],{"data":25108,"content":25109,"nodeType":876},{"uri":7327},[25110],{"data":25111,"marks":25112,"value":7333,"nodeType":865},{},[25113],{"type":874},{"data":25115,"marks":25116,"value":7337,"nodeType":865},{},[],{"data":25118,"content":25119,"nodeType":881},{},[25120],{"data":25121,"marks":25122,"value":7344,"nodeType":865},{},[],{"data":25124,"content":25127,"nodeType":890},{"target":25125},{"sys":25126},{"id":7349,"type":887,"linkType":888},[],{"data":25129,"content":25130,"nodeType":881},{},[25131],{"data":25132,"marks":25133,"value":7357,"nodeType":865},{},[],{"data":25135,"content":25138,"nodeType":890},{"target":25136},{"sys":25137},{"id":7362,"type":887,"linkType":888},[],{"data":25140,"content":25141,"nodeType":881},{},[25142],{"data":25143,"marks":25144,"value":7370,"nodeType":865},{},[],{"data":25146,"content":25147,"nodeType":1818},{},[25148,25157,25166,25175],{"data":25149,"content":25150,"nodeType":1734},{},[25151],{"data":25152,"content":25153,"nodeType":881},{},[25154],{"data":25155,"marks":25156,"value":7383,"nodeType":865},{},[],{"data":25158,"content":25159,"nodeType":1734},{},[25160],{"data":25161,"content":25162,"nodeType":881},{},[25163],{"data":25164,"marks":25165,"value":7393,"nodeType":865},{},[],{"data":25167,"content":25168,"nodeType":1734},{},[25169],{"data":25170,"content":25171,"nodeType":881},{},[25172],{"data":25173,"marks":25174,"value":7403,"nodeType":865},{},[],{"data":25176,"content":25177,"nodeType":1734},{},[25178],{"data":25179,"content":25180,"nodeType":881},{},[25181],{"data":25182,"marks":25183,"value":7413,"nodeType":865},{},[],{"data":25185,"content":25188,"nodeType":890},{"target":25186},{"sys":25187},{"id":7418,"type":887,"linkType":888},[],{"data":25190,"content":25193,"nodeType":890},{"target":25191},{"sys":25192},{"id":7424,"type":887,"linkType":888},[],{"data":25195,"content":25196,"nodeType":881},{},[25197],{"data":25198,"marks":25199,"value":7432,"nodeType":865},{},[],{"data":25201,"content":25202,"nodeType":881},{},[25203],{"data":25204,"marks":25205,"value":7439,"nodeType":865},{},[],{"data":25207,"content":25208,"nodeType":894},{},[],{"data":25210,"content":25211,"nodeType":904},{},[25212],{"data":25213,"marks":25214,"value":7450,"nodeType":865},{},[25215],{"type":902},{"data":25217,"content":25218,"nodeType":881},{},[25219,25222,25229],{"data":25220,"marks":25221,"value":7457,"nodeType":865},{},[],{"data":25223,"content":25224,"nodeType":876},{"uri":7460},[25225],{"data":25226,"marks":25227,"value":7466,"nodeType":865},{},[25228],{"type":874},{"data":25230,"marks":25231,"value":7470,"nodeType":865},{},[],{"data":25233,"content":25234,"nodeType":881},{},[25235],{"data":25236,"marks":25237,"value":7477,"nodeType":865},{},[],{"data":25239,"content":25242,"nodeType":890},{"target":25240},{"sys":25241},{"id":7482,"type":887,"linkType":888},[],{"data":25244,"content":25245,"nodeType":881},{},[25246,25249,25256],{"data":25247,"marks":25248,"value":7490,"nodeType":865},{},[],{"data":25250,"content":25251,"nodeType":876},{"uri":1139},[25252],{"data":25253,"marks":25254,"value":7498,"nodeType":865},{},[25255],{"type":874},{"data":25257,"marks":25258,"value":959,"nodeType":865},{},[],{"data":25260,"content":25263,"nodeType":890},{"target":25261},{"sys":25262},{"id":7506,"type":887,"linkType":888},[],{"data":25265,"content":25266,"nodeType":881},{},[25267,25270,25277],{"data":25268,"marks":25269,"value":7514,"nodeType":865},{},[],{"data":25271,"content":25272,"nodeType":876},{"uri":7517},[25273],{"data":25274,"marks":25275,"value":441,"nodeType":865},{},[25276],{"type":874},{"data":25278,"marks":25279,"value":7526,"nodeType":865},{},[],{"data":25281,"content":25282,"nodeType":881},{},[25283],{"data":25284,"marks":25285,"value":7533,"nodeType":865},{},[],{"data":25287,"content":25288,"nodeType":894},{},[],{"data":25290,"content":25291,"nodeType":904},{},[25292],{"data":25293,"marks":25294,"value":7544,"nodeType":865},{},[25295],{"type":902},{"data":25297,"content":25298,"nodeType":881},{},[25299],{"data":25300,"marks":25301,"value":7551,"nodeType":865},{},[],{"data":25303,"content":25304,"nodeType":881},{},[25305,25308,25315,25318,25325,25328,25335],{"data":25306,"marks":25307,"value":7558,"nodeType":865},{},[],{"data":25309,"content":25310,"nodeType":876},{"uri":7561},[25311],{"data":25312,"marks":25313,"value":7567,"nodeType":865},{},[25314],{"type":874},{"data":25316,"marks":25317,"value":1651,"nodeType":865},{},[],{"data":25319,"content":25320,"nodeType":876},{"uri":7573},[25321],{"data":25322,"marks":25323,"value":1307,"nodeType":865},{},[25324],{"type":874},{"data":25326,"marks":25327,"value":7582,"nodeType":865},{},[],{"data":25329,"content":25330,"nodeType":876},{"uri":7585},[25331],{"data":25332,"marks":25333,"value":7591,"nodeType":865},{},[25334],{"type":874},{"data":25336,"marks":25337,"value":7595,"nodeType":865},{},[],{"data":25339,"content":25340,"nodeType":881},{},[25341,25344],{"data":25342,"marks":25343,"value":7602,"nodeType":865},{},[],{"data":25345,"marks":25346,"value":7607,"nodeType":865},{},[25347],{"type":902},{"data":25349,"content":25350,"nodeType":894},{},[],{"data":25352,"content":25353,"nodeType":904},{},[25354],{"data":25355,"marks":25356,"value":7618,"nodeType":865},{},[25357],{"type":902},{"data":25359,"content":25360,"nodeType":881},{},[25361,25364,25370],{"data":25362,"marks":25363,"value":7625,"nodeType":865},{},[],{"data":25365,"content":25366,"nodeType":876},{"uri":1022},[25367],{"data":25368,"marks":25369,"value":1951,"nodeType":865},{},[],{"data":25371,"marks":25372,"value":7635,"nodeType":865},{},[],{"data":25374,"content":25375,"nodeType":881},{},[25376],{"data":25377,"marks":25378,"value":7642,"nodeType":865},{},[],{"data":25380,"content":25381,"nodeType":881},{},[25382,25385,25389],{"data":25383,"marks":25384,"value":7649,"nodeType":865},{},[],{"data":25386,"marks":25387,"value":7654,"nodeType":865},{},[25388],{"type":902},{"data":25390,"marks":25391,"value":7658,"nodeType":865},{},[],{"data":25393,"content":25394,"nodeType":881},{},[25395],{"data":25396,"marks":25397,"value":7665,"nodeType":865},{},[],{"data":25399,"content":25400,"nodeType":881},{},[25401],{"data":25402,"marks":25403,"value":7672,"nodeType":865},{},[],{"data":25405,"content":25408,"nodeType":890},{"target":25406},{"sys":25407},{"id":7677,"type":887,"linkType":888},[],{"data":25410,"content":25411,"nodeType":881},{},[25412],{"data":25413,"marks":25414,"value":7685,"nodeType":865},{},[],{"data":25416,"content":25417,"nodeType":894},{},[],{"data":25419,"content":25420,"nodeType":904},{},[25421],{"data":25422,"marks":25423,"value":7696,"nodeType":865},{},[25424],{"type":902},{"data":25426,"content":25427,"nodeType":881},{},[25428],{"data":25429,"marks":25430,"value":7703,"nodeType":865},{},[],{"data":25432,"content":25433,"nodeType":1818},{},[25434,25443,25452,25461,25470],{"data":25435,"content":25436,"nodeType":1734},{},[25437],{"data":25438,"content":25439,"nodeType":881},{},[25440],{"data":25441,"marks":25442,"value":7716,"nodeType":865},{},[],{"data":25444,"content":25445,"nodeType":1734},{},[25446],{"data":25447,"content":25448,"nodeType":881},{},[25449],{"data":25450,"marks":25451,"value":7726,"nodeType":865},{},[],{"data":25453,"content":25454,"nodeType":1734},{},[25455],{"data":25456,"content":25457,"nodeType":881},{},[25458],{"data":25459,"marks":25460,"value":7736,"nodeType":865},{},[],{"data":25462,"content":25463,"nodeType":1734},{},[25464],{"data":25465,"content":25466,"nodeType":881},{},[25467],{"data":25468,"marks":25469,"value":7746,"nodeType":865},{},[],{"data":25471,"content":25472,"nodeType":1734},{},[25473],{"data":25474,"content":25475,"nodeType":881},{},[25476],{"data":25477,"marks":25478,"value":7756,"nodeType":865},{},[],{"data":25480,"content":25481,"nodeType":881},{},[25482],{"data":25483,"marks":25484,"value":7763,"nodeType":865},{},[],{"data":25486,"content":25487,"nodeType":894},{},[],{"data":25489,"content":25490,"nodeType":904},{},[25491],{"data":25492,"marks":25493,"value":7774,"nodeType":865},{},[25494],{"type":902},{"data":25496,"content":25499,"nodeType":890},{"target":25497},{"sys":25498},{"id":7779,"type":887,"linkType":888},[],{"data":25501,"content":25502,"nodeType":881},{},[25503],{"data":25504,"marks":25505,"value":7787,"nodeType":865},{},[],{"data":25507,"content":25508,"nodeType":881},{},[25509],{"data":25510,"marks":25511,"value":7794,"nodeType":865},{},[],{"data":25513,"content":25516,"nodeType":890},{"target":25514},{"sys":25515},{"id":7799,"type":887,"linkType":888},[],{"data":25518,"content":25519,"nodeType":881},{},[25520],{"data":25521,"marks":25522,"value":7807,"nodeType":865},{},[],{"data":25524,"content":25525,"nodeType":1818},{},[25526,25539],{"data":25527,"content":25528,"nodeType":1734},{},[25529],{"data":25530,"content":25531,"nodeType":881},{},[25532,25536],{"data":25533,"marks":25534,"value":7821,"nodeType":865},{},[25535],{"type":902},{"data":25537,"marks":25538,"value":7825,"nodeType":865},{},[],{"data":25540,"content":25541,"nodeType":1734},{},[25542],{"data":25543,"content":25544,"nodeType":881},{},[25545,25549],{"data":25546,"marks":25547,"value":7836,"nodeType":865},{},[25548],{"type":902},{"data":25550,"marks":25551,"value":7840,"nodeType":865},{},[],{"data":25553,"content":25554,"nodeType":881},{},[25555],{"data":25556,"marks":25557,"value":7847,"nodeType":865},{},[],{"data":25559,"content":25560,"nodeType":881},{},[25561],{"data":25562,"marks":25563,"value":7854,"nodeType":865},{},[],{"data":25565,"content":25568,"nodeType":890},{"target":25566},{"sys":25567},{"id":7859,"type":887,"linkType":888},[],{"data":25570,"content":25571,"nodeType":881},{},[25572],{"data":25573,"marks":25574,"value":7867,"nodeType":865},{},[],{"data":25576,"content":25579,"nodeType":890},{"target":25577},{"sys":25578},{"id":7872,"type":887,"linkType":888},[],{"data":25581,"content":25582,"nodeType":1860},{},[25583],{"data":25584,"marks":25585,"value":7881,"nodeType":865},{},[25586],{"type":902},{"data":25588,"content":25589,"nodeType":881},{},[25590,25593,25600],{"data":25591,"marks":25592,"value":7888,"nodeType":865},{},[],{"data":25594,"content":25595,"nodeType":876},{"uri":7891},[25596],{"data":25597,"marks":25598,"value":7897,"nodeType":865},{},[25599],{"type":874},{"data":25601,"marks":25602,"value":7901,"nodeType":865},{},[],{"data":25604,"content":25605,"nodeType":881},{},[25606],{"data":25607,"marks":25608,"value":7908,"nodeType":865},{},[],{"data":25610,"content":25611,"nodeType":1818},{},[25612,25621,25630],{"data":25613,"content":25614,"nodeType":1734},{},[25615],{"data":25616,"content":25617,"nodeType":881},{},[25618],{"data":25619,"marks":25620,"value":7921,"nodeType":865},{},[],{"data":25622,"content":25623,"nodeType":1734},{},[25624],{"data":25625,"content":25626,"nodeType":881},{},[25627],{"data":25628,"marks":25629,"value":7931,"nodeType":865},{},[],{"data":25631,"content":25632,"nodeType":1734},{},[25633],{"data":25634,"content":25635,"nodeType":881},{},[25636],{"data":25637,"marks":25638,"value":7941,"nodeType":865},{},[],{"data":25640,"content":25641,"nodeType":881},{},[25642],{"data":25643,"marks":25644,"value":7948,"nodeType":865},{},[],{"data":25646,"content":25647,"nodeType":1818},{},[25648,25657,25666],{"data":25649,"content":25650,"nodeType":1734},{},[25651],{"data":25652,"content":25653,"nodeType":881},{},[25654],{"data":25655,"marks":25656,"value":7961,"nodeType":865},{},[],{"data":25658,"content":25659,"nodeType":1734},{},[25660],{"data":25661,"content":25662,"nodeType":881},{},[25663],{"data":25664,"marks":25665,"value":7971,"nodeType":865},{},[],{"data":25667,"content":25668,"nodeType":1734},{},[25669],{"data":25670,"content":25671,"nodeType":881},{},[25672],{"data":25673,"marks":25674,"value":7981,"nodeType":865},{},[],{"data":25676,"content":25677,"nodeType":894},{},[],{"data":25679,"content":25680,"nodeType":904},{},[25681],{"data":25682,"marks":25683,"value":7992,"nodeType":865},{},[25684],{"type":902},{"data":25686,"content":25687,"nodeType":881},{},[25688],{"data":25689,"marks":25690,"value":7999,"nodeType":865},{},[],{"data":25692,"content":25695,"nodeType":890},{"target":25693},{"sys":25694},{"id":8004,"type":887,"linkType":888},[],{"data":25697,"content":25698,"nodeType":881},{},[25699,25702,25709],{"data":25700,"marks":25701,"value":8012,"nodeType":865},{},[],{"data":25703,"content":25704,"nodeType":876},{"uri":1022},[25705],{"data":25706,"marks":25707,"value":8020,"nodeType":865},{},[25708],{"type":874},{"data":25710,"marks":25711,"value":8024,"nodeType":865},{},[],{"data":25713,"content":25714,"nodeType":881},{},[25715],{"data":25716,"marks":25717,"value":8031,"nodeType":865},{},[],{"data":25719,"content":25720,"nodeType":881},{},[25721,25724,25731,25734,25741],{"data":25722,"marks":25723,"value":4462,"nodeType":865},{},[],{"data":25725,"content":25726,"nodeType":876},{"uri":4465},[25727],{"data":25728,"marks":25729,"value":4471,"nodeType":865},{},[25730],{"type":874},{"data":25732,"marks":25733,"value":8048,"nodeType":865},{},[],{"data":25735,"content":25736,"nodeType":876},{"uri":1453},[25737],{"data":25738,"marks":25739,"value":4495,"nodeType":865},{},[25740],{"type":874},{"data":25742,"marks":25743,"value":959,"nodeType":865},{},[],{"data":25745,"content":25748,"nodeType":890},{"target":25746},{"sys":25747},{"id":8063,"type":887,"linkType":888},[],{"data":25750,"content":25751,"nodeType":881},{},[25752],{"data":25753,"marks":25754,"value":21,"nodeType":865},{},[],{"items":25756},[25757,25759],{"sys":25758,"name":4507},{"id":4506},{"sys":25760,"name":342},{"id":4510},{"items":25762},[25763],{"fullName":4514,"firstName":4515,"jobTitle":4516,"profilePicture":25764},{"url":4518},{"__typename":1485,"sys":25766,"content":25768,"title":26349,"synopsis":26350,"hashTags":59,"publishedDate":26351,"slug":26352,"tagsCollection":26353,"authorsCollection":26359},{"id":25767},"6Zosy4SU0LpjlaSWX75peb",{"json":25769},{"data":25770,"content":25771,"nodeType":1463},{},[25772,25779,25786,25793,25799,25806,25809,25817,25824,25831,25838,25844,25851,25857,25864,25870,25877,25883,25914,25921,25927,25934,25940,25947,25953,25960,26003,26006,26014,26021,26028,26035,26041,26044,26052,26059,26079,26085,26091,26097,26104,26110,26116,26136,26139,26147,26166,26172,26179,26197,26205,26212,26219,26226,26244,26252,26259,26265,26268,26275,26282,26289,26292,26299,26306,26312,26338,26343],{"data":25773,"content":25774,"nodeType":881},{},[25775],{"data":25776,"marks":25777,"value":25778,"nodeType":865},{},[],"We recently investigated a sophisticated phishing campaign targeting Google Workspace and Facebook Business accounts with Calendly-themed phishing lures, based around a fake job opportunity. ",{"data":25780,"content":25781,"nodeType":881},{},[25782],{"data":25783,"marks":25784,"value":25785,"nodeType":865},{},[],"We were first alerted to the campaign when a Push customer was hit with a highly targeted email-based attack, where the attacker used an Attacker-in-the-Middle (AiTM) phishing toolkit to target the customer’s Google Workspace account. ",{"data":25787,"content":25788,"nodeType":881},{},[25789],{"data":25790,"marks":25791,"value":25792,"nodeType":865},{},[],"In this case, Google was the customer’s primary enterprise IdP account, used to access native Google suite apps as well as SSO to downstream apps — effectively, the front door to their business IT stack. Despite this, the attacker’s MO was specifically the takeover of accounts used for the management of digital ads. ",{"data":25794,"content":25798,"nodeType":890},{"target":25795},{"sys":25796},{"id":25797,"type":887,"linkType":888},"5oivBCf1Fqvnq0GNCSko8f",[],{"data":25800,"content":25801,"nodeType":881},{},[25802],{"data":25803,"marks":25804,"value":25805,"nodeType":865},{},[],"In this blog post, we break down the various TTPs used by the attacker across the campaign, and consider why ad management platforms are being specifically targeted.  ",{"data":25807,"content":25808,"nodeType":894},{},[],{"data":25810,"content":25811,"nodeType":904},{},[25812],{"data":25813,"marks":25814,"value":25816,"nodeType":865},{},[25815],{"type":902},"Variant 1: Targeting Google Workspace with a sophisticated email phish ",{"data":25818,"content":25819,"nodeType":881},{},[25820],{"data":25821,"marks":25822,"value":25823,"nodeType":865},{},[],"The first phishing variant we analyzed began with a multi-stage phishing email lure, framed as a job opportunity for LVMH (Louis Vuitton Moët Hennessy), which oversees more than 75 brands across sectors like fashion, cosmetics, watches, and spirits. The specific delivery address is impersonating “Inside LVMH”, the talent acquisition and training arm of LVMH.  ",{"data":25825,"content":25826,"nodeType":881},{},[25827],{"data":25828,"marks":25829,"value":25830,"nodeType":865},{},[],"This lure is notable for multiple reasons. It is highly targeted, well-written, populated with information from the victim, and coming from what appears to be a legitimate employee of LVMH. Even if the victim was initially suspicious, searching for the recruiter’s name would appear to confirm their identity.  ",{"data":25832,"content":25833,"nodeType":881},{},[25834],{"data":25835,"marks":25836,"value":25837,"nodeType":865},{},[],"It is possible, even likely, that this interaction was operated using AI, using information scraped from the internet — but in any case, the outcome achieved is highly convincing. ",{"data":25839,"content":25843,"nodeType":890},{"target":25840},{"sys":25841},{"id":25842,"type":887,"linkType":888},"46BYpquURERbkhWc6C2Lpc",[],{"data":25845,"content":25846,"nodeType":881},{},[25847],{"data":25848,"marks":25849,"value":25850,"nodeType":865},{},[],"Only after the victim has responded to an initial email was the phishing link delivered under the guise of a Calendly link to book time for a call. ",{"data":25852,"content":25856,"nodeType":890},{"target":25853},{"sys":25854},{"id":25855,"type":887,"linkType":888},"37GBkfXGEdWvdQbMq65sad",[],{"data":25858,"content":25859,"nodeType":881},{},[25860],{"data":25861,"marks":25862,"value":25863,"nodeType":865},{},[],"Clicking the link takes the victim to an authentic-looking page impersonating a Calendly landing page.",{"data":25865,"content":25869,"nodeType":890},{"target":25866},{"sys":25867},{"id":25868,"type":887,"linkType":888},"1DwOPzK7mxsoJlEBp8cMpr",[],{"data":25871,"content":25872,"nodeType":881},{},[25873],{"data":25874,"marks":25875,"value":25876,"nodeType":865},{},[],"After completing the CAPTCHA check and selecting \"Continue with Google” the victim is redirected to an AiTM phishing page designed to capture Google Workspace credentials, with specific branding impersonating Calendly — making this visually distinct from most common Google-themed phishing pages. ",{"data":25878,"content":25882,"nodeType":890},{"target":25879},{"sys":25880},{"id":25881,"type":887,"linkType":888},"u1SY1uUX23sxfBYLpyaKb",[],{"data":25884,"content":25885,"nodeType":881},{},[25886,25890,25898,25902,25910],{"data":25887,"marks":25888,"value":25889,"nodeType":865},{},[],"This page uses ",{"data":25891,"content":25892,"nodeType":876},{"uri":7327},[25893],{"data":25894,"marks":25895,"value":25897,"nodeType":865},{},[25896],{"type":874},"specific targeting parameters",{"data":25899,"marks":25900,"value":25901,"nodeType":865},{},[]," to ensure that only the intended recipient is able to access the page’s malicious functionality — a well-known ",{"data":25903,"content":25904,"nodeType":876},{"uri":1022},[25905],{"data":25906,"marks":25907,"value":25909,"nodeType":865},{},[25908],{"type":874},"detection evasion technique",{"data":25911,"marks":25912,"value":25913,"nodeType":865},{},[]," to prevent security analysts from being able to fully analyse the page (as malicious elements are not rendered until this check is completed). ",{"data":25915,"content":25916,"nodeType":881},{},[25917],{"data":25918,"marks":25919,"value":25920,"nodeType":865},{},[],"As you can see in the example below, attempts to use any email other than the intended victim’s email domain are blocked.   ",{"data":25922,"content":25926,"nodeType":890},{"target":25923},{"sys":25924},{"id":25925,"type":887,"linkType":888},"5m8LvVYjXz0zrITgTWqxio",[],{"data":25928,"content":25929,"nodeType":881},{},[25930],{"data":25931,"marks":25932,"value":25933,"nodeType":865},{},[],"Only entering an allowed email domain loads the password entry field. ",{"data":25935,"content":25939,"nodeType":890},{"target":25936},{"sys":25937},{"id":25938,"type":887,"linkType":888},"6KFRJSsgk2pB6x67kWdpws",[],{"data":25941,"content":25942,"nodeType":881},{},[25943],{"data":25944,"marks":25945,"value":25946,"nodeType":865},{},[],"We identified a number of pages that appear to be part of the same campaign. All these pages have the same visual style, Calendly-themed lure targeting Google Workspace accounts, and appear to match real employees of the respective companies being impersonated. ",{"data":25948,"content":25952,"nodeType":890},{"target":25949},{"sys":25950},{"id":25951,"type":887,"linkType":888},"zMkN1U5QlvIEcfOGmhBBf",[],{"data":25954,"content":25955,"nodeType":881},{},[25956],{"data":25957,"marks":25958,"value":25959,"nodeType":865},{},[],"The different pages include:",{"data":25961,"content":25962,"nodeType":1818},{},[25963,25973,25983,25993],{"data":25964,"content":25965,"nodeType":1734},{},[25966],{"data":25967,"content":25968,"nodeType":881},{},[25969],{"data":25970,"marks":25971,"value":25972,"nodeType":865},{},[],"A different visual match for the LVMH page.",{"data":25974,"content":25975,"nodeType":1734},{},[25976],{"data":25977,"content":25978,"nodeType":881},{},[25979],{"data":25980,"marks":25981,"value":25982,"nodeType":865},{},[],"A Lego recruitment themed page.",{"data":25984,"content":25985,"nodeType":1734},{},[25986],{"data":25987,"content":25988,"nodeType":881},{},[25989],{"data":25990,"marks":25991,"value":25992,"nodeType":865},{},[],"A Mastercard HR themed page.",{"data":25994,"content":25995,"nodeType":1734},{},[25996],{"data":25997,"content":25998,"nodeType":881},{},[25999],{"data":26000,"marks":26001,"value":26002,"nodeType":865},{},[],"An Uber recruitment themed page.",{"data":26004,"content":26005,"nodeType":894},{},[],{"data":26007,"content":26008,"nodeType":904},{},[26009],{"data":26010,"marks":26011,"value":26013,"nodeType":865},{},[26012],{"type":902},"Variant 2: Targeting Facebook Business accounts",{"data":26015,"content":26016,"nodeType":881},{},[26017],{"data":26018,"marks":26019,"value":26020,"nodeType":865},{},[],"Upon further investigation, we found links to a second phishing page style that appears to be part of a longer campaign targeting Facebook accounts, dating back more than two years. ",{"data":26022,"content":26023,"nodeType":881},{},[26024],{"data":26025,"marks":26026,"value":26027,"nodeType":865},{},[],"In total, we identified 31 unique URLs associated with the same campaign, many of which were recycled over time to impersonate different brands. ",{"data":26029,"content":26030,"nodeType":881},{},[26031],{"data":26032,"marks":26033,"value":26034,"nodeType":865},{},[],"Since most of these pages appeared to be older (and no longer live) they could not be analysed further, beyond giving an indication of how the phishing campaign has evolved over time. ",{"data":26036,"content":26040,"nodeType":890},{"target":26037},{"sys":26038},{"id":26039,"type":887,"linkType":888},"5PFRI9XtNVdkpYiRoIYpF",[],{"data":26042,"content":26043,"nodeType":894},{},[],{"data":26045,"content":26046,"nodeType":904},{},[26047],{"data":26048,"marks":26049,"value":26051,"nodeType":865},{},[26050],{"type":902},"Variant 3: Targeting both Google and Facebook accounts",{"data":26053,"content":26054,"nodeType":881},{},[26055],{"data":26056,"marks":26057,"value":26058,"nodeType":865},{},[],"We also discovered a third, more recent variant targeting both Google and Facebook accounts with Calendly-styled pages.",{"data":26060,"content":26061,"nodeType":881},{},[26062,26066,26075],{"data":26063,"marks":26064,"value":26065,"nodeType":865},{},[],"This variant looks to leverage a Browser-in-the-Browser style pop-up window similar to the ",{"data":26067,"content":26069,"nodeType":876},{"uri":26068},"https://pushsecurity.com/blog/analyzing-the-latest-sneaky2fa-phishing-page/",[26070],{"data":26071,"marks":26072,"value":26074,"nodeType":865},{},[26073],{"type":874},"Sneaky2FA attacks we reported on recently",{"data":26076,"marks":26077,"value":26078,"nodeType":865},{},[],". BITB allows the attacker to mask the phishing page URL by presenting a fake URL set by the attacker, inside a pop-up login window. ",{"data":26080,"content":26084,"nodeType":890},{"target":26081},{"sys":26082},{"id":26083,"type":887,"linkType":888},"7w4cmyqPvhxAFrokaK9CE1",[],{"data":26086,"content":26090,"nodeType":890},{"target":26087},{"sys":26088},{"id":26089,"type":887,"linkType":888},"6FUSNecz0BXLxJxoJTsALD",[],{"data":26092,"content":26096,"nodeType":890},{"target":26093},{"sys":26094},{"id":26095,"type":887,"linkType":888},"2zwFDrgsLuxi4Xv2q0nPFK",[],{"data":26098,"content":26099,"nodeType":881},{},[26100],{"data":26101,"marks":26102,"value":26103,"nodeType":865},{},[],"The attacker also implemented additional anti-analysis functionality, beyond the specific domain targeting we observed in the first page variant — the result of which meant the page IP blocked us from interacting with it further. ",{"data":26105,"content":26109,"nodeType":890},{"target":26106},{"sys":26107},{"id":26108,"type":887,"linkType":888},"3ZPdxi5cGZcn5hF1ISIUa7",[],{"data":26111,"content":26115,"nodeType":890},{"target":26112},{"sys":26113},{"id":26114,"type":887,"linkType":888},"3J5pmgNL9LevE1FdX4oksf",[],{"data":26117,"content":26118,"nodeType":881},{},[26119,26123,26132],{"data":26120,"marks":26121,"value":26122,"nodeType":865},{},[],"Often ",{"data":26124,"content":26126,"nodeType":876},{"uri":26125},"https://phishing-techniques.pushsecurity.com/techniques/anti-sandbox/",[26127],{"data":26128,"marks":26129,"value":26131,"nodeType":865},{},[26130],{"type":874},"accessing dev tools",{"data":26133,"marks":26134,"value":26135,"nodeType":865},{},[]," on a page is enough to trigger this, specifically targeting security analysts and web-crawling security bots/tools. ",{"data":26137,"content":26138,"nodeType":894},{},[],{"data":26140,"content":26141,"nodeType":904},{},[26142],{"data":26143,"marks":26144,"value":26146,"nodeType":865},{},[26145],{"type":902},"Why are attackers targeting business ad management accounts?",{"data":26148,"content":26149,"nodeType":881},{},[26150,26154,26162],{"data":26151,"marks":26152,"value":26153,"nodeType":865},{},[],"The campaign shows signs of being a long-running, targeted initiative focused on compromising accounts responsible for managing digital ads on behalf of businesses. The attackers have demonstrated that they are continuing to iterate on their TTPs, introducing new page styles with increased sophistication, and new ",{"data":26155,"content":26157,"nodeType":876},{"uri":26156},"https://phishing-techniques.pushsecurity.com/#techniques-table",[26158],{"data":26159,"marks":26160,"value":1951,"nodeType":865},{},[26161],{"type":874},{"data":26163,"marks":26164,"value":26165,"nodeType":865},{},[]," to defeat security analysis tools.  ",{"data":26167,"content":26171,"nodeType":890},{"target":26168},{"sys":26169},{"id":26170,"type":887,"linkType":888},"m5GsTsDb55T70MU2m72B1",[],{"data":26173,"content":26174,"nodeType":881},{},[26175],{"data":26176,"marks":26177,"value":26178,"nodeType":865},{},[],"We also discovered that Google recently issued a security warning specifically for agency organizations managing ads for a number of businesses, urging them to create security alerts whenever a new account is added to a Manager Account (MCC) used to view and manage multiple Google Ads accounts from a single view. ",{"data":26180,"content":26181,"nodeType":881},{},[26182,26186,26193],{"data":26183,"marks":26184,"value":26185,"nodeType":865},{},[],"With malvertising on the rise as an increasingly popular attack vector for the delivery of AITM phishing, malware downloads, and ",{"data":26187,"content":26188,"nodeType":876},{"uri":1139},[26189],{"data":26190,"marks":26191,"value":315,"nodeType":865},{},[26192],{"type":874},{"data":26194,"marks":26195,"value":26196,"nodeType":865},{},[]," (4 in 5 ClickFix attacks intercepted by Push were delivered via Google Search), it makes sense that attackers are looking to increase their web of accounts from which to launch malicious ads. ",{"data":26198,"content":26199,"nodeType":1860},{},[26200],{"data":26201,"marks":26202,"value":26204,"nodeType":865},{},[26203],{"type":902},"Why are attackers turning to malvertising?",{"data":26206,"content":26207,"nodeType":881},{},[26208],{"data":26209,"marks":26210,"value":26211,"nodeType":865},{},[],"Malvertising attacks delivered over search engines (e.g. Google Search) and social media apps (Facebook, LinkedIn, etc.) are a great way to catch victims unawares while also evading typically email-based anti-phishing controls. ",{"data":26213,"content":26214,"nodeType":881},{},[26215],{"data":26216,"marks":26217,"value":26218,"nodeType":865},{},[],"The flipside of this is that malvertising attacks are less likely to be targeted than phishing delivered directly to the victim via a direct message (i.e. email, social media DM, instant messenger app, SMS, etc.). ",{"data":26220,"content":26221,"nodeType":881},{},[26222],{"data":26223,"marks":26224,"value":26225,"nodeType":865},{},[],"However, that isn’t to say that malvertising attacks can’t be targeted. For example, Google Ads can be targeted to searches coming from specific geographic locations, tailored to specific email domain matches, or specific device types (e.g. desktop, mobile, etc.). If you know where your target organization is located, you can tailor the ad to that location. Even more precise ad targeting can be achieved on social media platforms. ",{"data":26227,"content":26228,"nodeType":881},{},[26229,26233,26240],{"data":26230,"marks":26231,"value":26232,"nodeType":865},{},[],"Malvertising is an effective way to launch “watering hole” style attacks, casting a wide net to harvest credentials and account access that can be re-sold to other criminals for a fee, or leveraged by partners in the cybercriminal ecosystem as part of major cyber breaches (such as the recent attacks by the “",{"data":26234,"content":26235,"nodeType":876},{"uri":1747},[26236],{"data":26237,"marks":26238,"value":1752,"nodeType":865},{},[26239],{"type":874},{"data":26241,"marks":26242,"value":26243,"nodeType":865},{},[],"” criminal collective, all of which began with identity-based initial access). For this reason, credentials and access are an increasingly profitable commodity for cyber criminals. ",{"data":26245,"content":26246,"nodeType":1860},{},[26247],{"data":26248,"marks":26249,"value":26251,"nodeType":865},{},[26250],{"type":902},"Additional considerations",{"data":26253,"content":26254,"nodeType":881},{},[26255],{"data":26256,"marks":26257,"value":26258,"nodeType":865},{},[],"As previously mentioned, compromising a Google Workspace account (particularly where it is the primary enterprise cloud platform used by the organization) provides comprehensive access to business apps, data, and functionality that can be exploited by attackers — effectively, it’s the access point to modern business IT. There’s a good chance that attackers establishing a foothold in this way would look to leverage this access further, or at least sell on that access to a criminal group looking to take the attack further. ",{"data":26260,"content":26264,"nodeType":890},{"target":26261},{"sys":26262},{"id":26263,"type":887,"linkType":888},"7jnQqRk0JuqEtrQ3HXy3f8",[],{"data":26266,"content":26267,"nodeType":894},{},[],{"data":26269,"content":26270,"nodeType":904},{},[26271],{"data":26272,"marks":26273,"value":7881,"nodeType":865},{},[26274],{"type":902},{"data":26276,"content":26277,"nodeType":881},{},[26278],{"data":26279,"marks":26280,"value":26281,"nodeType":865},{},[],"We have opted not to provide the domains associated with that campaign to preserve the privacy of the individuals being impersonated by the attacker. In many cases, their full name was included in the URL for the phishing page, while their name and profile picture (most likely scraped from LinkedIn) are also visible on the landing page. ",{"data":26283,"content":26284,"nodeType":881},{},[26285],{"data":26286,"marks":26287,"value":26288,"nodeType":865},{},[],"However, with the rate at which these domains were spun up and subsequently taken down (by the attacker or the site hosting the links) IoC-based detections for campaigns such as this are of limited value. ",{"data":26290,"content":26291,"nodeType":894},{},[],{"data":26293,"content":26294,"nodeType":904},{},[26295],{"data":26296,"marks":26297,"value":4448,"nodeType":865},{},[26298],{"type":902},{"data":26300,"content":26301,"nodeType":881},{},[26302],{"data":26303,"marks":26304,"value":26305,"nodeType":865},{},[],"Push researchers are continuously analysing and developing new detections based on the latest phishing kits and TTPs which enables us to stay two steps ahead of attackers.",{"data":26307,"content":26308,"nodeType":881},{},[26309],{"data":26310,"marks":26311,"value":11724,"nodeType":865},{},[],{"data":26313,"content":26314,"nodeType":881},{},[26315,26318,26325,26328,26335],{"data":26316,"marks":26317,"value":4462,"nodeType":865},{},[],{"data":26319,"content":26320,"nodeType":876},{"uri":4465},[26321],{"data":26322,"marks":26323,"value":4471,"nodeType":865},{},[26324],{"type":874},{"data":26326,"marks":26327,"value":8048,"nodeType":865},{},[],{"data":26329,"content":26330,"nodeType":876},{"uri":1453},[26331],{"data":26332,"marks":26333,"value":4495,"nodeType":865},{},[26334],{"type":874},{"data":26336,"marks":26337,"value":959,"nodeType":865},{},[],{"data":26339,"content":26342,"nodeType":890},{"target":26340},{"sys":26341},{"id":8063,"type":887,"linkType":888},[],{"data":26344,"content":26345,"nodeType":881},{},[26346],{"data":26347,"marks":26348,"value":21,"nodeType":865},{},[],"Uncovering a Calendly-themed phishing campaign targeting business ad manager accounts","Investigating a phishing campaign targeting Google Ads Manager MCC accounts to propagate malvertising lures. ","2025-12-02T00:00:00.000Z","uncovering-a-calendly-themed-phishing-campaign",{"items":26354},[26355,26357],{"sys":26356,"name":4507},{"id":4506},{"sys":26358,"name":342},{"id":4510},{"items":26360},[26361],{"fullName":4514,"firstName":4515,"jobTitle":4516,"profilePicture":26362},{"url":4518},{"__typename":1485,"sys":26364,"content":26365,"title":11751,"synopsis":11752,"hashTags":59,"publishedDate":11753,"slug":11754,"tagsCollection":27181,"authorsCollection":27187},{"id":10804},{"json":26366},{"data":26367,"content":26368,"nodeType":1463},{},[26369,26375,26381,26387,26390,26397,26403,26409,26414,26420,26425,26441,26447,26457,26460,26467,26473,26486,26492,26502,26507,26510,26517,26524,26529,26537,26553,26561,26567,26575,26590,26598,26604,26612,26638,26646,26652,26660,26676,26681,26689,26695,26703,26736,26739,26746,26754,26770,26778,26784,26792,26818,26823,26831,26837,26842,26845,26852,26860,26866,26917,26922,26925,26932,26940,26946,26951,26954,26961,26967,26973,27033,27039,27094,27100,27103,27110,27116,27122,27127,27130,27137,27143,27149,27155],{"data":26370,"content":26371,"nodeType":881},{},[26372],{"data":26373,"marks":26374,"value":10815,"nodeType":865},{},[],{"data":26376,"content":26377,"nodeType":881},{},[26378],{"data":26379,"marks":26380,"value":10822,"nodeType":865},{},[],{"data":26382,"content":26383,"nodeType":881},{},[26384],{"data":26385,"marks":26386,"value":10829,"nodeType":865},{},[],{"data":26388,"content":26389,"nodeType":894},{},[],{"data":26391,"content":26392,"nodeType":904},{},[26393],{"data":26394,"marks":26395,"value":10840,"nodeType":865},{},[26396],{"type":902},{"data":26398,"content":26399,"nodeType":881},{},[26400],{"data":26401,"marks":26402,"value":10847,"nodeType":865},{},[],{"data":26404,"content":26405,"nodeType":881},{},[26406],{"data":26407,"marks":26408,"value":10854,"nodeType":865},{},[],{"data":26410,"content":26413,"nodeType":890},{"target":26411},{"sys":26412},{"id":10859,"type":887,"linkType":888},[],{"data":26415,"content":26416,"nodeType":881},{},[26417],{"data":26418,"marks":26419,"value":10867,"nodeType":865},{},[],{"data":26421,"content":26424,"nodeType":890},{"target":26422},{"sys":26423},{"id":10872,"type":887,"linkType":888},[],{"data":26426,"content":26427,"nodeType":881},{},[26428,26431,26438],{"data":26429,"marks":26430,"value":10880,"nodeType":865},{},[],{"data":26432,"content":26433,"nodeType":876},{"uri":5475},[26434],{"data":26435,"marks":26436,"value":10888,"nodeType":865},{},[26437],{"type":874},{"data":26439,"marks":26440,"value":10892,"nodeType":865},{},[],{"data":26442,"content":26443,"nodeType":881},{},[26444],{"data":26445,"marks":26446,"value":10899,"nodeType":865},{},[],{"data":26448,"content":26449,"nodeType":881},{},[26450,26453],{"data":26451,"marks":26452,"value":10906,"nodeType":865},{},[],{"data":26454,"marks":26455,"value":10911,"nodeType":865},{},[26456],{"type":902},{"data":26458,"content":26459,"nodeType":894},{},[],{"data":26461,"content":26462,"nodeType":904},{},[26463],{"data":26464,"marks":26465,"value":10922,"nodeType":865},{},[26466],{"type":902},{"data":26468,"content":26469,"nodeType":881},{},[26470],{"data":26471,"marks":26472,"value":10929,"nodeType":865},{},[],{"data":26474,"content":26475,"nodeType":881},{},[26476,26479,26483],{"data":26477,"marks":26478,"value":10936,"nodeType":865},{},[],{"data":26480,"marks":26481,"value":10941,"nodeType":865},{},[26482],{"type":902},{"data":26484,"marks":26485,"value":10945,"nodeType":865},{},[],{"data":26487,"content":26488,"nodeType":881},{},[26489],{"data":26490,"marks":26491,"value":10952,"nodeType":865},{},[],{"data":26493,"content":26494,"nodeType":881},{},[26495,26498],{"data":26496,"marks":26497,"value":10959,"nodeType":865},{},[],{"data":26499,"marks":26500,"value":10964,"nodeType":865},{},[26501],{"type":902},{"data":26503,"content":26506,"nodeType":890},{"target":26504},{"sys":26505},{"id":10969,"type":887,"linkType":888},[],{"data":26508,"content":26509,"nodeType":894},{},[],{"data":26511,"content":26512,"nodeType":904},{},[26513],{"data":26514,"marks":26515,"value":10981,"nodeType":865},{},[26516],{"type":902},{"data":26518,"content":26519,"nodeType":1860},{},[26520],{"data":26521,"marks":26522,"value":10989,"nodeType":865},{},[26523],{"type":902},{"data":26525,"content":26528,"nodeType":890},{"target":26526},{"sys":26527},{"id":10994,"type":887,"linkType":888},[],{"data":26530,"content":26531,"nodeType":881},{},[26532],{"data":26533,"marks":26534,"value":11004,"nodeType":865},{},[26535,26536],{"type":902},{"type":874},{"data":26538,"content":26539,"nodeType":881},{},[26540,26543,26550],{"data":26541,"marks":26542,"value":11011,"nodeType":865},{},[],{"data":26544,"content":26545,"nodeType":876},{"uri":11014},[26546],{"data":26547,"marks":26548,"value":11020,"nodeType":865},{},[26549],{"type":874},{"data":26551,"marks":26552,"value":11024,"nodeType":865},{},[],{"data":26554,"content":26555,"nodeType":881},{},[26556],{"data":26557,"marks":26558,"value":11033,"nodeType":865},{},[26559,26560],{"type":902},{"type":874},{"data":26562,"content":26563,"nodeType":881},{},[26564],{"data":26565,"marks":26566,"value":11040,"nodeType":865},{},[],{"data":26568,"content":26569,"nodeType":881},{},[26570],{"data":26571,"marks":26572,"value":11049,"nodeType":865},{},[26573,26574],{"type":902},{"type":874},{"data":26576,"content":26577,"nodeType":881},{},[26578,26581,26587],{"data":26579,"marks":26580,"value":11056,"nodeType":865},{},[],{"data":26582,"content":26583,"nodeType":876},{"uri":11059},[26584],{"data":26585,"marks":26586,"value":11064,"nodeType":865},{},[],{"data":26588,"marks":26589,"value":11068,"nodeType":865},{},[],{"data":26591,"content":26592,"nodeType":881},{},[26593],{"data":26594,"marks":26595,"value":11077,"nodeType":865},{},[26596,26597],{"type":902},{"type":874},{"data":26599,"content":26600,"nodeType":881},{},[26601],{"data":26602,"marks":26603,"value":11084,"nodeType":865},{},[],{"data":26605,"content":26606,"nodeType":881},{},[26607],{"data":26608,"marks":26609,"value":11093,"nodeType":865},{},[26610,26611],{"type":902},{"type":874},{"data":26613,"content":26614,"nodeType":881},{},[26615,26618,26625,26628,26635],{"data":26616,"marks":26617,"value":11100,"nodeType":865},{},[],{"data":26619,"content":26620,"nodeType":876},{"uri":11103},[26621],{"data":26622,"marks":26623,"value":11109,"nodeType":865},{},[26624],{"type":874},{"data":26626,"marks":26627,"value":11113,"nodeType":865},{},[],{"data":26629,"content":26630,"nodeType":876},{"uri":11116},[26631],{"data":26632,"marks":26633,"value":11122,"nodeType":865},{},[26634],{"type":874},{"data":26636,"marks":26637,"value":11126,"nodeType":865},{},[],{"data":26639,"content":26640,"nodeType":881},{},[26641],{"data":26642,"marks":26643,"value":11135,"nodeType":865},{},[26644,26645],{"type":902},{"type":874},{"data":26647,"content":26648,"nodeType":881},{},[26649],{"data":26650,"marks":26651,"value":11142,"nodeType":865},{},[],{"data":26653,"content":26654,"nodeType":881},{},[26655],{"data":26656,"marks":26657,"value":11151,"nodeType":865},{},[26658,26659],{"type":902},{"type":874},{"data":26661,"content":26662,"nodeType":881},{},[26663,26666,26673],{"data":26664,"marks":26665,"value":11158,"nodeType":865},{},[],{"data":26667,"content":26668,"nodeType":876},{"uri":11116},[26669],{"data":26670,"marks":26671,"value":11122,"nodeType":865},{},[26672],{"type":874},{"data":26674,"marks":26675,"value":11169,"nodeType":865},{},[],{"data":26677,"content":26680,"nodeType":890},{"target":26678},{"sys":26679},{"id":11174,"type":887,"linkType":888},[],{"data":26682,"content":26683,"nodeType":881},{},[26684],{"data":26685,"marks":26686,"value":11184,"nodeType":865},{},[26687,26688],{"type":902},{"type":874},{"data":26690,"content":26691,"nodeType":881},{},[26692],{"data":26693,"marks":26694,"value":11191,"nodeType":865},{},[],{"data":26696,"content":26697,"nodeType":881},{},[26698],{"data":26699,"marks":26700,"value":11200,"nodeType":865},{},[26701,26702],{"type":902},{"type":874},{"data":26704,"content":26705,"nodeType":881},{},[26706,26709,26715,26718,26724,26727,26733],{"data":26707,"marks":26708,"value":11207,"nodeType":865},{},[],{"data":26710,"content":26711,"nodeType":876},{"uri":11210},[26712],{"data":26713,"marks":26714,"value":11215,"nodeType":865},{},[],{"data":26716,"marks":26717,"value":1651,"nodeType":865},{},[],{"data":26719,"content":26720,"nodeType":876},{"uri":11221},[26721],{"data":26722,"marks":26723,"value":11226,"nodeType":865},{},[],{"data":26725,"marks":26726,"value":11230,"nodeType":865},{},[],{"data":26728,"content":26729,"nodeType":876},{"uri":5030},[26730],{"data":26731,"marks":26732,"value":11237,"nodeType":865},{},[],{"data":26734,"marks":26735,"value":11241,"nodeType":865},{},[],{"data":26737,"content":26738,"nodeType":894},{},[],{"data":26740,"content":26741,"nodeType":1860},{},[26742],{"data":26743,"marks":26744,"value":11252,"nodeType":865},{},[26745],{"type":902},{"data":26747,"content":26748,"nodeType":881},{},[26749],{"data":26750,"marks":26751,"value":11261,"nodeType":865},{},[26752,26753],{"type":902},{"type":874},{"data":26755,"content":26756,"nodeType":881},{},[26757,26760,26767],{"data":26758,"marks":26759,"value":11268,"nodeType":865},{},[],{"data":26761,"content":26762,"nodeType":876},{"uri":11271},[26763],{"data":26764,"marks":26765,"value":11277,"nodeType":865},{},[26766],{"type":874},{"data":26768,"marks":26769,"value":11281,"nodeType":865},{},[],{"data":26771,"content":26772,"nodeType":881},{},[26773],{"data":26774,"marks":26775,"value":11290,"nodeType":865},{},[26776,26777],{"type":902},{"type":874},{"data":26779,"content":26780,"nodeType":881},{},[26781],{"data":26782,"marks":26783,"value":11297,"nodeType":865},{},[],{"data":26785,"content":26786,"nodeType":881},{},[26787],{"data":26788,"marks":26789,"value":11306,"nodeType":865},{},[26790,26791],{"type":902},{"type":874},{"data":26793,"content":26794,"nodeType":881},{},[26795,26798,26805,26808,26815],{"data":26796,"marks":26797,"value":11313,"nodeType":865},{},[],{"data":26799,"content":26800,"nodeType":876},{"uri":11316},[26801],{"data":26802,"marks":26803,"value":11322,"nodeType":865},{},[26804],{"type":874},{"data":26806,"marks":26807,"value":11326,"nodeType":865},{},[],{"data":26809,"content":26810,"nodeType":876},{"uri":11329},[26811],{"data":26812,"marks":26813,"value":11335,"nodeType":865},{},[26814],{"type":874},{"data":26816,"marks":26817,"value":11339,"nodeType":865},{},[],{"data":26819,"content":26822,"nodeType":890},{"target":26820},{"sys":26821},{"id":11344,"type":887,"linkType":888},[],{"data":26824,"content":26825,"nodeType":881},{},[26826],{"data":26827,"marks":26828,"value":11354,"nodeType":865},{},[26829,26830],{"type":902},{"type":874},{"data":26832,"content":26833,"nodeType":881},{},[26834],{"data":26835,"marks":26836,"value":11361,"nodeType":865},{},[],{"data":26838,"content":26841,"nodeType":890},{"target":26839},{"sys":26840},{"id":11366,"type":887,"linkType":888},[],{"data":26843,"content":26844,"nodeType":894},{},[],{"data":26846,"content":26847,"nodeType":1860},{},[26848],{"data":26849,"marks":26850,"value":694,"nodeType":865},{},[26851],{"type":902},{"data":26853,"content":26854,"nodeType":881},{},[26855],{"data":26856,"marks":26857,"value":11386,"nodeType":865},{},[26858,26859],{"type":902},{"type":874},{"data":26861,"content":26862,"nodeType":881},{},[26863],{"data":26864,"marks":26865,"value":11393,"nodeType":865},{},[],{"data":26867,"content":26868,"nodeType":1818},{},[26869,26882,26895],{"data":26870,"content":26871,"nodeType":1734},{},[26872],{"data":26873,"content":26874,"nodeType":881},{},[26875,26879],{"data":26876,"marks":26877,"value":11407,"nodeType":865},{},[26878],{"type":902},{"data":26880,"marks":26881,"value":11411,"nodeType":865},{},[],{"data":26883,"content":26884,"nodeType":1734},{},[26885],{"data":26886,"content":26887,"nodeType":881},{},[26888,26892],{"data":26889,"marks":26890,"value":11422,"nodeType":865},{},[26891],{"type":902},{"data":26893,"marks":26894,"value":11426,"nodeType":865},{},[],{"data":26896,"content":26897,"nodeType":1734},{},[26898],{"data":26899,"content":26900,"nodeType":881},{},[26901,26905,26908,26914],{"data":26902,"marks":26903,"value":11437,"nodeType":865},{},[26904],{"type":902},{"data":26906,"marks":26907,"value":11441,"nodeType":865},{},[],{"data":26909,"content":26910,"nodeType":876},{"uri":11444},[26911],{"data":26912,"marks":26913,"value":11449,"nodeType":865},{},[],{"data":26915,"marks":26916,"value":11453,"nodeType":865},{},[],{"data":26918,"content":26921,"nodeType":890},{"target":26919},{"sys":26920},{"id":11458,"type":887,"linkType":888},[],{"data":26923,"content":26924,"nodeType":894},{},[],{"data":26926,"content":26927,"nodeType":1860},{},[26928],{"data":26929,"marks":26930,"value":699,"nodeType":865},{},[26931],{"type":902},{"data":26933,"content":26934,"nodeType":881},{},[26935],{"data":26936,"marks":26937,"value":11478,"nodeType":865},{},[26938,26939],{"type":902},{"type":874},{"data":26941,"content":26942,"nodeType":881},{},[26943],{"data":26944,"marks":26945,"value":11485,"nodeType":865},{},[],{"data":26947,"content":26950,"nodeType":890},{"target":26948},{"sys":26949},{"id":11490,"type":887,"linkType":888},[],{"data":26952,"content":26953,"nodeType":894},{},[],{"data":26955,"content":26956,"nodeType":904},{},[26957],{"data":26958,"marks":26959,"value":11502,"nodeType":865},{},[26960],{"type":902},{"data":26962,"content":26963,"nodeType":881},{},[26964],{"data":26965,"marks":26966,"value":11509,"nodeType":865},{},[],{"data":26968,"content":26969,"nodeType":881},{},[26970],{"data":26971,"marks":26972,"value":11516,"nodeType":865},{},[],{"data":26974,"content":26975,"nodeType":1818},{},[26976,26995,27014],{"data":26977,"content":26978,"nodeType":1734},{},[26979],{"data":26980,"content":26981,"nodeType":881},{},[26982,26985,26992],{"data":26983,"marks":26984,"value":11529,"nodeType":865},{},[],{"data":26986,"content":26987,"nodeType":876},{"uri":11532},[26988],{"data":26989,"marks":26990,"value":1718,"nodeType":865},{},[26991],{"type":874},{"data":26993,"marks":26994,"value":11541,"nodeType":865},{},[],{"data":26996,"content":26997,"nodeType":1734},{},[26998],{"data":26999,"content":27000,"nodeType":881},{},[27001,27004,27011],{"data":27002,"marks":27003,"value":11551,"nodeType":865},{},[],{"data":27005,"content":27006,"nodeType":876},{"uri":11554},[27007],{"data":27008,"marks":27009,"value":11560,"nodeType":865},{},[27010],{"type":874},{"data":27012,"marks":27013,"value":11541,"nodeType":865},{},[],{"data":27015,"content":27016,"nodeType":1734},{},[27017],{"data":27018,"content":27019,"nodeType":881},{},[27020,27023,27030],{"data":27021,"marks":27022,"value":11573,"nodeType":865},{},[],{"data":27024,"content":27025,"nodeType":876},{"uri":11576},[27026],{"data":27027,"marks":27028,"value":11582,"nodeType":865},{},[27029],{"type":874},{"data":27031,"marks":27032,"value":11541,"nodeType":865},{},[],{"data":27034,"content":27035,"nodeType":881},{},[27036],{"data":27037,"marks":27038,"value":11592,"nodeType":865},{},[],{"data":27040,"content":27041,"nodeType":1818},{},[27042,27055,27068,27081],{"data":27043,"content":27044,"nodeType":1734},{},[27045],{"data":27046,"content":27047,"nodeType":881},{},[27048,27052],{"data":27049,"marks":27050,"value":11606,"nodeType":865},{},[27051],{"type":902},{"data":27053,"marks":27054,"value":11610,"nodeType":865},{},[],{"data":27056,"content":27057,"nodeType":1734},{},[27058],{"data":27059,"content":27060,"nodeType":881},{},[27061,27065],{"data":27062,"marks":27063,"value":11621,"nodeType":865},{},[27064],{"type":902},{"data":27066,"marks":27067,"value":11625,"nodeType":865},{},[],{"data":27069,"content":27070,"nodeType":1734},{},[27071],{"data":27072,"content":27073,"nodeType":881},{},[27074,27078],{"data":27075,"marks":27076,"value":11636,"nodeType":865},{},[27077],{"type":902},{"data":27079,"marks":27080,"value":11640,"nodeType":865},{},[],{"data":27082,"content":27083,"nodeType":1734},{},[27084],{"data":27085,"content":27086,"nodeType":881},{},[27087,27091],{"data":27088,"marks":27089,"value":11651,"nodeType":865},{},[27090],{"type":902},{"data":27092,"marks":27093,"value":11655,"nodeType":865},{},[],{"data":27095,"content":27096,"nodeType":881},{},[27097],{"data":27098,"marks":27099,"value":11662,"nodeType":865},{},[],{"data":27101,"content":27102,"nodeType":894},{},[],{"data":27104,"content":27105,"nodeType":904},{},[27106],{"data":27107,"marks":27108,"value":11673,"nodeType":865},{},[27109],{"type":902},{"data":27111,"content":27112,"nodeType":881},{},[27113],{"data":27114,"marks":27115,"value":11680,"nodeType":865},{},[],{"data":27117,"content":27118,"nodeType":881},{},[27119],{"data":27120,"marks":27121,"value":11687,"nodeType":865},{},[],{"data":27123,"content":27126,"nodeType":890},{"target":27124},{"sys":27125},{"id":11692,"type":887,"linkType":888},[],{"data":27128,"content":27129,"nodeType":894},{},[],{"data":27131,"content":27132,"nodeType":904},{},[27133],{"data":27134,"marks":27135,"value":5936,"nodeType":865},{},[27136],{"type":902},{"data":27138,"content":27139,"nodeType":881},{},[27140],{"data":27141,"marks":27142,"value":11710,"nodeType":865},{},[],{"data":27144,"content":27145,"nodeType":881},{},[27146],{"data":27147,"marks":27148,"value":11717,"nodeType":865},{},[],{"data":27150,"content":27151,"nodeType":881},{},[27152],{"data":27153,"marks":27154,"value":11724,"nodeType":865},{},[],{"data":27156,"content":27157,"nodeType":881},{},[27158,27161,27168,27171,27178],{"data":27159,"marks":27160,"value":4462,"nodeType":865},{},[],{"data":27162,"content":27163,"nodeType":876},{"uri":4465},[27164],{"data":27165,"marks":27166,"value":4471,"nodeType":865},{},[27167],{"type":874},{"data":27169,"marks":27170,"value":8048,"nodeType":865},{},[],{"data":27172,"content":27173,"nodeType":876},{"uri":1453},[27174],{"data":27175,"marks":27176,"value":4495,"nodeType":865},{},[27177],{"type":874},{"data":27179,"marks":27180,"value":959,"nodeType":865},{},[],{"items":27182},[27183,27185],{"sys":27184,"name":4507},{"id":4506},{"sys":27186,"name":342},{"id":4510},{"items":27188},[27189],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":27190},{"url":5377},"2025-top-phishing-trends","blog/2025-top-phishing-trends",{"json":27194},{"data":27195,"content":27196,"nodeType":1463},{},[27197],{"data":27198,"content":27199,"nodeType":881},{},[27200],{"data":27201,"marks":27202,"value":27203,"nodeType":865},{},[],"Phishing attacks changed a lot through 2025. Here's the top trends from this year and what they mean for security teams heading into 2026. \n","Analyzing the key trends that defined phishing attacks in 2025, and what these changes mean for security teams heading into 2026. ",{"id":27206,"publishedAt":27207},"5CqV6e5wfHsfEVczkWSerZ","2026-08-12T11:53:25.080Z",{"items":27209},[27210,27212],{"sys":27211,"name":342},{"id":4510},{"sys":27213,"name":4507},{"id":4506},{"items":27215},[27216,27218,27220,27222,27224,27226,27228,27230,27232,27234,27236,27238,27240,27242,27244,27246,27248,27250,27252,27254,27256,27258],{"sys":27217,"name":279,"slug":280,"tier":31},{"id":276},{"sys":27219,"name":413,"slug":414,"tier":31},{"id":410},{"sys":27221,"name":519,"slug":520,"tier":31},{"id":516},{"sys":27223,"name":642,"slug":643,"tier":31},{"id":639},{"sys":27225,"name":342,"slug":343,"tier":31},{"id":339},{"sys":27227,"name":261,"slug":262,"tier":45},{"id":258},{"sys":27229,"name":315,"slug":316,"tier":45},{"id":312},{"sys":27231,"name":324,"slug":325,"tier":45},{"id":321},{"sys":27233,"name":466,"slug":467,"tier":45},{"id":463},{"sys":27235,"name":511,"slug":512,"tier":45},{"id":508},{"sys":27237,"name":440,"slug":441,"tier":45},{"id":437},{"sys":27239,"name":563,"slug":564,"tier":45},{"id":560},{"sys":27241,"name":475,"slug":476,"tier":45},{"id":472},{"sys":27243,"name":607,"slug":608,"tier":45},{"id":604},{"sys":27245,"name":484,"slug":485,"tier":45},{"id":481},{"sys":27247,"name":360,"slug":361,"tier":45},{"id":357},{"sys":27249,"name":288,"slug":289,"tier":45},{"id":285},{"sys":27251,"name":422,"slug":423,"tier":45},{"id":419},{"sys":27253,"name":571,"slug":572,"tier":45},{"id":568},{"sys":27255,"name":431,"slug":432,"tier":45},{"id":428},{"sys":27257,"name":493,"slug":494,"tier":45},{"id":490},{"sys":27259,"name":404,"slug":405,"tier":45},{"id":401},"7YvVxDfBfBbYwky5xPf7erTDCzlAGNd3QktYmRe96W8",{"id":27262,"title":8071,"authorsCollection":27263,"content":27268,"extension":228,"faqItemsCollection":28161,"faqTitle":59,"featured":6,"hashTags":59,"meta":28163,"metaTitle":28164,"ogImage":59,"postType":7216,"publishedDate":8073,"relatedBlogPostsCollection":28165,"slug":8074,"stem":29837,"subtitle":59,"summary":29838,"synopsis":8072,"sys":29849,"tagsCollection":29851,"topicsCollection":29857,"__hash__":29871},"blog/blog/consentfix.json",{"items":27264},[27265],{"fullName":4514,"firstName":4515,"jobTitle":4516,"socialLinks":27266,"profilePicture":27267},[11822],{"url":4518},{"json":27269,"links":28004},{"data":27270,"content":27271,"nodeType":1463},{},[27272,27279,27285,27291,27297,27307,27313,27318,27323,27326,27333,27339,27345,27350,27366,27372,27377,27383,27388,27394,27433,27438,27443,27449,27455,27458,27465,27481,27487,27492,27508,27513,27529,27535,27538,27545,27551,27587,27597,27600,27607,27622,27628,27641,27647,27653,27658,27664,27667,27674,27680,27728,27734,27737,27744,27749,27755,27761,27766,27772,27801,27807,27813,27818,27824,27829,27836,27852,27858,27888,27894,27924,27927,27934,27940,27945,27961,27967,27993,27998],{"data":27273,"content":27274,"nodeType":904},{},[27275],{"data":27276,"marks":27277,"value":7234,"nodeType":865},{},[27278],{"type":902},{"data":27280,"content":27281,"nodeType":881},{},[27282],{"data":27283,"marks":27284,"value":7241,"nodeType":865},{},[],{"data":27286,"content":27287,"nodeType":881},{},[27288],{"data":27289,"marks":27290,"value":7248,"nodeType":865},{},[],{"data":27292,"content":27293,"nodeType":881},{},[27294],{"data":27295,"marks":27296,"value":7255,"nodeType":865},{},[],{"data":27298,"content":27299,"nodeType":881},{},[27300,27304],{"data":27301,"marks":27302,"value":7263,"nodeType":865},{},[27303],{"type":902},{"data":27305,"marks":27306,"value":7267,"nodeType":865},{},[],{"data":27308,"content":27309,"nodeType":881},{},[27310],{"data":27311,"marks":27312,"value":7274,"nodeType":865},{},[],{"data":27314,"content":27317,"nodeType":890},{"target":27315},{"sys":27316},{"id":7279,"type":887,"linkType":888},[],{"data":27319,"content":27322,"nodeType":890},{"target":27320},{"sys":27321},{"id":7285,"type":887,"linkType":888},[],{"data":27324,"content":27325,"nodeType":894},{},[],{"data":27327,"content":27328,"nodeType":904},{},[27329],{"data":27330,"marks":27331,"value":7297,"nodeType":865},{},[27332],{"type":902},{"data":27334,"content":27335,"nodeType":881},{},[27336],{"data":27337,"marks":27338,"value":7304,"nodeType":865},{},[],{"data":27340,"content":27341,"nodeType":881},{},[27342],{"data":27343,"marks":27344,"value":7311,"nodeType":865},{},[],{"data":27346,"content":27349,"nodeType":890},{"target":27347},{"sys":27348},{"id":7316,"type":887,"linkType":888},[],{"data":27351,"content":27352,"nodeType":881},{},[27353,27356,27363],{"data":27354,"marks":27355,"value":7324,"nodeType":865},{},[],{"data":27357,"content":27358,"nodeType":876},{"uri":7327},[27359],{"data":27360,"marks":27361,"value":7333,"nodeType":865},{},[27362],{"type":874},{"data":27364,"marks":27365,"value":7337,"nodeType":865},{},[],{"data":27367,"content":27368,"nodeType":881},{},[27369],{"data":27370,"marks":27371,"value":7344,"nodeType":865},{},[],{"data":27373,"content":27376,"nodeType":890},{"target":27374},{"sys":27375},{"id":7349,"type":887,"linkType":888},[],{"data":27378,"content":27379,"nodeType":881},{},[27380],{"data":27381,"marks":27382,"value":7357,"nodeType":865},{},[],{"data":27384,"content":27387,"nodeType":890},{"target":27385},{"sys":27386},{"id":7362,"type":887,"linkType":888},[],{"data":27389,"content":27390,"nodeType":881},{},[27391],{"data":27392,"marks":27393,"value":7370,"nodeType":865},{},[],{"data":27395,"content":27396,"nodeType":1818},{},[27397,27406,27415,27424],{"data":27398,"content":27399,"nodeType":1734},{},[27400],{"data":27401,"content":27402,"nodeType":881},{},[27403],{"data":27404,"marks":27405,"value":7383,"nodeType":865},{},[],{"data":27407,"content":27408,"nodeType":1734},{},[27409],{"data":27410,"content":27411,"nodeType":881},{},[27412],{"data":27413,"marks":27414,"value":7393,"nodeType":865},{},[],{"data":27416,"content":27417,"nodeType":1734},{},[27418],{"data":27419,"content":27420,"nodeType":881},{},[27421],{"data":27422,"marks":27423,"value":7403,"nodeType":865},{},[],{"data":27425,"content":27426,"nodeType":1734},{},[27427],{"data":27428,"content":27429,"nodeType":881},{},[27430],{"data":27431,"marks":27432,"value":7413,"nodeType":865},{},[],{"data":27434,"content":27437,"nodeType":890},{"target":27435},{"sys":27436},{"id":7418,"type":887,"linkType":888},[],{"data":27439,"content":27442,"nodeType":890},{"target":27440},{"sys":27441},{"id":7424,"type":887,"linkType":888},[],{"data":27444,"content":27445,"nodeType":881},{},[27446],{"data":27447,"marks":27448,"value":7432,"nodeType":865},{},[],{"data":27450,"content":27451,"nodeType":881},{},[27452],{"data":27453,"marks":27454,"value":7439,"nodeType":865},{},[],{"data":27456,"content":27457,"nodeType":894},{},[],{"data":27459,"content":27460,"nodeType":904},{},[27461],{"data":27462,"marks":27463,"value":7450,"nodeType":865},{},[27464],{"type":902},{"data":27466,"content":27467,"nodeType":881},{},[27468,27471,27478],{"data":27469,"marks":27470,"value":7457,"nodeType":865},{},[],{"data":27472,"content":27473,"nodeType":876},{"uri":7460},[27474],{"data":27475,"marks":27476,"value":7466,"nodeType":865},{},[27477],{"type":874},{"data":27479,"marks":27480,"value":7470,"nodeType":865},{},[],{"data":27482,"content":27483,"nodeType":881},{},[27484],{"data":27485,"marks":27486,"value":7477,"nodeType":865},{},[],{"data":27488,"content":27491,"nodeType":890},{"target":27489},{"sys":27490},{"id":7482,"type":887,"linkType":888},[],{"data":27493,"content":27494,"nodeType":881},{},[27495,27498,27505],{"data":27496,"marks":27497,"value":7490,"nodeType":865},{},[],{"data":27499,"content":27500,"nodeType":876},{"uri":1139},[27501],{"data":27502,"marks":27503,"value":7498,"nodeType":865},{},[27504],{"type":874},{"data":27506,"marks":27507,"value":959,"nodeType":865},{},[],{"data":27509,"content":27512,"nodeType":890},{"target":27510},{"sys":27511},{"id":7506,"type":887,"linkType":888},[],{"data":27514,"content":27515,"nodeType":881},{},[27516,27519,27526],{"data":27517,"marks":27518,"value":7514,"nodeType":865},{},[],{"data":27520,"content":27521,"nodeType":876},{"uri":7517},[27522],{"data":27523,"marks":27524,"value":441,"nodeType":865},{},[27525],{"type":874},{"data":27527,"marks":27528,"value":7526,"nodeType":865},{},[],{"data":27530,"content":27531,"nodeType":881},{},[27532],{"data":27533,"marks":27534,"value":7533,"nodeType":865},{},[],{"data":27536,"content":27537,"nodeType":894},{},[],{"data":27539,"content":27540,"nodeType":904},{},[27541],{"data":27542,"marks":27543,"value":7544,"nodeType":865},{},[27544],{"type":902},{"data":27546,"content":27547,"nodeType":881},{},[27548],{"data":27549,"marks":27550,"value":7551,"nodeType":865},{},[],{"data":27552,"content":27553,"nodeType":881},{},[27554,27557,27564,27567,27574,27577,27584],{"data":27555,"marks":27556,"value":7558,"nodeType":865},{},[],{"data":27558,"content":27559,"nodeType":876},{"uri":7561},[27560],{"data":27561,"marks":27562,"value":7567,"nodeType":865},{},[27563],{"type":874},{"data":27565,"marks":27566,"value":1651,"nodeType":865},{},[],{"data":27568,"content":27569,"nodeType":876},{"uri":7573},[27570],{"data":27571,"marks":27572,"value":1307,"nodeType":865},{},[27573],{"type":874},{"data":27575,"marks":27576,"value":7582,"nodeType":865},{},[],{"data":27578,"content":27579,"nodeType":876},{"uri":7585},[27580],{"data":27581,"marks":27582,"value":7591,"nodeType":865},{},[27583],{"type":874},{"data":27585,"marks":27586,"value":7595,"nodeType":865},{},[],{"data":27588,"content":27589,"nodeType":881},{},[27590,27593],{"data":27591,"marks":27592,"value":7602,"nodeType":865},{},[],{"data":27594,"marks":27595,"value":7607,"nodeType":865},{},[27596],{"type":902},{"data":27598,"content":27599,"nodeType":894},{},[],{"data":27601,"content":27602,"nodeType":904},{},[27603],{"data":27604,"marks":27605,"value":7618,"nodeType":865},{},[27606],{"type":902},{"data":27608,"content":27609,"nodeType":881},{},[27610,27613,27619],{"data":27611,"marks":27612,"value":7625,"nodeType":865},{},[],{"data":27614,"content":27615,"nodeType":876},{"uri":1022},[27616],{"data":27617,"marks":27618,"value":1951,"nodeType":865},{},[],{"data":27620,"marks":27621,"value":7635,"nodeType":865},{},[],{"data":27623,"content":27624,"nodeType":881},{},[27625],{"data":27626,"marks":27627,"value":7642,"nodeType":865},{},[],{"data":27629,"content":27630,"nodeType":881},{},[27631,27634,27638],{"data":27632,"marks":27633,"value":7649,"nodeType":865},{},[],{"data":27635,"marks":27636,"value":7654,"nodeType":865},{},[27637],{"type":902},{"data":27639,"marks":27640,"value":7658,"nodeType":865},{},[],{"data":27642,"content":27643,"nodeType":881},{},[27644],{"data":27645,"marks":27646,"value":7665,"nodeType":865},{},[],{"data":27648,"content":27649,"nodeType":881},{},[27650],{"data":27651,"marks":27652,"value":7672,"nodeType":865},{},[],{"data":27654,"content":27657,"nodeType":890},{"target":27655},{"sys":27656},{"id":7677,"type":887,"linkType":888},[],{"data":27659,"content":27660,"nodeType":881},{},[27661],{"data":27662,"marks":27663,"value":7685,"nodeType":865},{},[],{"data":27665,"content":27666,"nodeType":894},{},[],{"data":27668,"content":27669,"nodeType":904},{},[27670],{"data":27671,"marks":27672,"value":7696,"nodeType":865},{},[27673],{"type":902},{"data":27675,"content":27676,"nodeType":881},{},[27677],{"data":27678,"marks":27679,"value":7703,"nodeType":865},{},[],{"data":27681,"content":27682,"nodeType":1818},{},[27683,27692,27701,27710,27719],{"data":27684,"content":27685,"nodeType":1734},{},[27686],{"data":27687,"content":27688,"nodeType":881},{},[27689],{"data":27690,"marks":27691,"value":7716,"nodeType":865},{},[],{"data":27693,"content":27694,"nodeType":1734},{},[27695],{"data":27696,"content":27697,"nodeType":881},{},[27698],{"data":27699,"marks":27700,"value":7726,"nodeType":865},{},[],{"data":27702,"content":27703,"nodeType":1734},{},[27704],{"data":27705,"content":27706,"nodeType":881},{},[27707],{"data":27708,"marks":27709,"value":7736,"nodeType":865},{},[],{"data":27711,"content":27712,"nodeType":1734},{},[27713],{"data":27714,"content":27715,"nodeType":881},{},[27716],{"data":27717,"marks":27718,"value":7746,"nodeType":865},{},[],{"data":27720,"content":27721,"nodeType":1734},{},[27722],{"data":27723,"content":27724,"nodeType":881},{},[27725],{"data":27726,"marks":27727,"value":7756,"nodeType":865},{},[],{"data":27729,"content":27730,"nodeType":881},{},[27731],{"data":27732,"marks":27733,"value":7763,"nodeType":865},{},[],{"data":27735,"content":27736,"nodeType":894},{},[],{"data":27738,"content":27739,"nodeType":904},{},[27740],{"data":27741,"marks":27742,"value":7774,"nodeType":865},{},[27743],{"type":902},{"data":27745,"content":27748,"nodeType":890},{"target":27746},{"sys":27747},{"id":7779,"type":887,"linkType":888},[],{"data":27750,"content":27751,"nodeType":881},{},[27752],{"data":27753,"marks":27754,"value":7787,"nodeType":865},{},[],{"data":27756,"content":27757,"nodeType":881},{},[27758],{"data":27759,"marks":27760,"value":7794,"nodeType":865},{},[],{"data":27762,"content":27765,"nodeType":890},{"target":27763},{"sys":27764},{"id":7799,"type":887,"linkType":888},[],{"data":27767,"content":27768,"nodeType":881},{},[27769],{"data":27770,"marks":27771,"value":7807,"nodeType":865},{},[],{"data":27773,"content":27774,"nodeType":1818},{},[27775,27788],{"data":27776,"content":27777,"nodeType":1734},{},[27778],{"data":27779,"content":27780,"nodeType":881},{},[27781,27785],{"data":27782,"marks":27783,"value":7821,"nodeType":865},{},[27784],{"type":902},{"data":27786,"marks":27787,"value":7825,"nodeType":865},{},[],{"data":27789,"content":27790,"nodeType":1734},{},[27791],{"data":27792,"content":27793,"nodeType":881},{},[27794,27798],{"data":27795,"marks":27796,"value":7836,"nodeType":865},{},[27797],{"type":902},{"data":27799,"marks":27800,"value":7840,"nodeType":865},{},[],{"data":27802,"content":27803,"nodeType":881},{},[27804],{"data":27805,"marks":27806,"value":7847,"nodeType":865},{},[],{"data":27808,"content":27809,"nodeType":881},{},[27810],{"data":27811,"marks":27812,"value":7854,"nodeType":865},{},[],{"data":27814,"content":27817,"nodeType":890},{"target":27815},{"sys":27816},{"id":7859,"type":887,"linkType":888},[],{"data":27819,"content":27820,"nodeType":881},{},[27821],{"data":27822,"marks":27823,"value":7867,"nodeType":865},{},[],{"data":27825,"content":27828,"nodeType":890},{"target":27826},{"sys":27827},{"id":7872,"type":887,"linkType":888},[],{"data":27830,"content":27831,"nodeType":1860},{},[27832],{"data":27833,"marks":27834,"value":7881,"nodeType":865},{},[27835],{"type":902},{"data":27837,"content":27838,"nodeType":881},{},[27839,27842,27849],{"data":27840,"marks":27841,"value":7888,"nodeType":865},{},[],{"data":27843,"content":27844,"nodeType":876},{"uri":7891},[27845],{"data":27846,"marks":27847,"value":7897,"nodeType":865},{},[27848],{"type":874},{"data":27850,"marks":27851,"value":7901,"nodeType":865},{},[],{"data":27853,"content":27854,"nodeType":881},{},[27855],{"data":27856,"marks":27857,"value":7908,"nodeType":865},{},[],{"data":27859,"content":27860,"nodeType":1818},{},[27861,27870,27879],{"data":27862,"content":27863,"nodeType":1734},{},[27864],{"data":27865,"content":27866,"nodeType":881},{},[27867],{"data":27868,"marks":27869,"value":7921,"nodeType":865},{},[],{"data":27871,"content":27872,"nodeType":1734},{},[27873],{"data":27874,"content":27875,"nodeType":881},{},[27876],{"data":27877,"marks":27878,"value":7931,"nodeType":865},{},[],{"data":27880,"content":27881,"nodeType":1734},{},[27882],{"data":27883,"content":27884,"nodeType":881},{},[27885],{"data":27886,"marks":27887,"value":7941,"nodeType":865},{},[],{"data":27889,"content":27890,"nodeType":881},{},[27891],{"data":27892,"marks":27893,"value":7948,"nodeType":865},{},[],{"data":27895,"content":27896,"nodeType":1818},{},[27897,27906,27915],{"data":27898,"content":27899,"nodeType":1734},{},[27900],{"data":27901,"content":27902,"nodeType":881},{},[27903],{"data":27904,"marks":27905,"value":7961,"nodeType":865},{},[],{"data":27907,"content":27908,"nodeType":1734},{},[27909],{"data":27910,"content":27911,"nodeType":881},{},[27912],{"data":27913,"marks":27914,"value":7971,"nodeType":865},{},[],{"data":27916,"content":27917,"nodeType":1734},{},[27918],{"data":27919,"content":27920,"nodeType":881},{},[27921],{"data":27922,"marks":27923,"value":7981,"nodeType":865},{},[],{"data":27925,"content":27926,"nodeType":894},{},[],{"data":27928,"content":27929,"nodeType":904},{},[27930],{"data":27931,"marks":27932,"value":7992,"nodeType":865},{},[27933],{"type":902},{"data":27935,"content":27936,"nodeType":881},{},[27937],{"data":27938,"marks":27939,"value":7999,"nodeType":865},{},[],{"data":27941,"content":27944,"nodeType":890},{"target":27942},{"sys":27943},{"id":8004,"type":887,"linkType":888},[],{"data":27946,"content":27947,"nodeType":881},{},[27948,27951,27958],{"data":27949,"marks":27950,"value":8012,"nodeType":865},{},[],{"data":27952,"content":27953,"nodeType":876},{"uri":1022},[27954],{"data":27955,"marks":27956,"value":8020,"nodeType":865},{},[27957],{"type":874},{"data":27959,"marks":27960,"value":8024,"nodeType":865},{},[],{"data":27962,"content":27963,"nodeType":881},{},[27964],{"data":27965,"marks":27966,"value":8031,"nodeType":865},{},[],{"data":27968,"content":27969,"nodeType":881},{},[27970,27973,27980,27983,27990],{"data":27971,"marks":27972,"value":4462,"nodeType":865},{},[],{"data":27974,"content":27975,"nodeType":876},{"uri":4465},[27976],{"data":27977,"marks":27978,"value":4471,"nodeType":865},{},[27979],{"type":874},{"data":27981,"marks":27982,"value":8048,"nodeType":865},{},[],{"data":27984,"content":27985,"nodeType":876},{"uri":1453},[27986],{"data":27987,"marks":27988,"value":4495,"nodeType":865},{},[27989],{"type":874},{"data":27991,"marks":27992,"value":959,"nodeType":865},{},[],{"data":27994,"content":27997,"nodeType":890},{"target":27995},{"sys":27996},{"id":8063,"type":887,"linkType":888},[],{"data":27999,"content":28000,"nodeType":881},{},[28001],{"data":28002,"marks":28003,"value":21,"nodeType":865},{},[],{"entries":28005},{"hyperlink":28006,"inline":28007,"block":28008},[],[],[28009,28035,28043,28050,28056,28061,28067,28070,28074,28079,28084,28108,28115,28122,28152,28159],{"sys":28010,"__typename":7015,"content":28011,"name":28034,"title":59},{"id":7279},{"json":28012},{"nodeType":1463,"data":28013,"content":28014},{},[28015],{"nodeType":881,"data":28016,"content":28017},{},[28018,28021,28030],{"nodeType":865,"value":21,"marks":28019,"data":28020},[],{},{"nodeType":876,"data":28022,"content":28024},{"uri":28023},"https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow",[28025],{"nodeType":865,"value":28026,"marks":28027,"data":28029},"Authorization code flow",[28028],{"type":874},{},{"nodeType":865,"value":28031,"marks":28032,"data":28033}," is an OAuth 2.0 protocol for web applications to get a user's permission to access protected resources. When using the authorization code flow to connect an app, it combines the code with an OAuth secret held by the app in exchange for a token (the valuable part). However, some apps can’t protect a secret — for example, apps that run on your mobile device or desktop. In this case, the code alone is enough to generate an OAuth token, without the secret — which is what is being exploited here.",[],{},"ConsentFix Insight Box 1",{"sys":28036,"__typename":7008,"title":28037,"caption":28038,"layoutMode":59,"file":28039},{"id":7285},"Authorization code flow in Microsoft apps.","Authorization code flow for Microsoft apps.",{"url":28040,"width":28041,"height":28042},"https://images.ctfassets.net/y1cdw1ablpvd/39SjQQIFV5aDh4Xq90X1BX/59ff8127bd758e34620738e2cecc0341/image2.png",1656,1064,{"sys":28044,"__typename":7008,"title":28045,"caption":28045,"layoutMode":59,"file":28046},{"id":7316},"Fake Cloudflare Turnstile page requesting a valid email address.",{"url":28047,"width":28048,"height":28049},"https://images.ctfassets.net/y1cdw1ablpvd/7bkcFEo59SUYRyBOAHfj6G/f8a49793c6190bea9007753ad1a93159/image_683.png",1446,546,{"sys":28051,"__typename":7008,"title":28052,"caption":28052,"layoutMode":59,"file":28053},{"id":7349},"If a personal email address is used, a business address is prompted.",{"url":28054,"width":7012,"height":28055},"https://images.ctfassets.net/y1cdw1ablpvd/7CNNGeywhNK5XJaGs1wC08/3a948187b0cadb8f1989db04d233ce49/image5.png",958,{"sys":28057,"__typename":7008,"title":28058,"caption":28058,"layoutMode":59,"file":28059},{"id":7362},"The victim is prompted to complete a further verification check.",{"url":28060,"width":24999,"height":25000},"https://images.ctfassets.net/y1cdw1ablpvd/m8UjkvISMPYalhzlpFrHq/b31f330ce1d49e242f0b4185b154d3e2/image_694__1_.png",{"sys":28062,"__typename":7008,"title":28063,"caption":28063,"layoutMode":59,"file":28064},{"id":7418},"Response on the malicious page, showing the response URL and redirect. The client_id is specific to the Azure CLI app.",{"url":28065,"width":7012,"height":28066},"https://images.ctfassets.net/y1cdw1ablpvd/24oliBnRyryM1MGM06rqUh/4e6dd173756c8f472601b9665155d27b/image1.png",1051,{"sys":28068,"__typename":7008,"title":21692,"caption":7009,"layoutMode":59,"file":28069},{"id":7424},{"url":21694,"width":7012,"height":16},{"sys":28071,"__typename":7100,"title":28072,"arcadeDemoUrl":28073,"playText":7102},{"id":7482},"ConsentFix Demo","https://demo.arcade.software/jVg07nEAWrkdzyRc4S83?embed",{"sys":28075,"__typename":7100,"title":28076,"arcadeDemoUrl":28077,"playText":28078},{"id":7506},"The most advanced ClickFix yet?","https://demo.arcade.software/yQIHbuD990Dk5CjI1cvS?embed","1 mins",{"sys":28080,"__typename":7100,"title":28081,"arcadeDemoUrl":28082,"playText":28083},{"id":7677},"ConsentFix Denied Access","https://demo.arcade.software/3zw2WIpCdCI2FhnEbLH7?embed","1 min",{"sys":28085,"__typename":7015,"content":28086,"name":28107,"title":59},{"id":7779},{"json":28087},{"nodeType":1463,"data":28088,"content":28089},{},[28090],{"nodeType":881,"data":28091,"content":28092},{},[28093,28097,28104],{"nodeType":865,"value":28094,"marks":28095,"data":28096},"Since releasing this research, the security community has jumped on ConsentFix, discovering several additional vulnerable Microsoft apps, and sharing a variety of Microsoft-specific mitigation and detection guidance. You can find this information aggregated ",[],{},{"nodeType":876,"data":28098,"content":28099},{"uri":4836},[28100],{"nodeType":865,"value":28101,"marks":28102,"data":28103},"in our follow-up blog post here",[],{},{"nodeType":865,"value":14775,"marks":28105,"data":28106},[],{},"ConsentFix Insight Box 4",{"sys":28109,"__typename":7008,"title":28110,"caption":28110,"layoutMode":59,"file":28111},{"id":7799},"Microsoft log examples.",{"url":28112,"width":28113,"height":28114},"https://images.ctfassets.net/y1cdw1ablpvd/66hEuuZyciE7RPKR7tpZz4/c75ef643729ddd93cf5850dbe7a81617/image8.png",1794,240,{"sys":28116,"__typename":7008,"title":28117,"caption":28117,"layoutMode":59,"file":28118},{"id":7859},"Non-interactive logins observed from IP addresses in the US and Indonesia. ",{"url":28119,"width":28120,"height":28121},"https://images.ctfassets.net/y1cdw1ablpvd/76x7GAQzcmzaM30BvyBDNS/33b84a9d8c7a4ac088f080df705841dd/image9.png",1838,316,{"sys":28123,"__typename":7015,"content":28124,"name":28151,"title":59},{"id":7872},{"json":28125},{"nodeType":1463,"data":28126,"content":28127},{},[28128],{"nodeType":881,"data":28129,"content":28130},{},[28131,28136,28140,28147],{"nodeType":865,"value":28132,"marks":28133,"data":28135},"Note: ",[28134],{"type":902},{},{"nodeType":865,"value":28137,"marks":28138,"data":28139},"The attacker is intentionally leveraging legacy scopes to evade detection. You should ensure that ",[],{},{"nodeType":876,"data":28141,"content":28142},{"uri":18598},[28143],{"nodeType":865,"value":18604,"marks":28144,"data":28146},[28145],{"type":874},{},{"nodeType":865,"value":28148,"marks":28149,"data":28150}," is enabled and monitored to be able to search for unusual activity such as AD enumeration.",[],{},"ConsentFix Insight Box 3",{"sys":28153,"__typename":7008,"title":28154,"caption":28154,"layoutMode":59,"file":28155},{"id":8004},"Detection timeline showing the page being detected and blocked by Push.",{"url":28156,"width":28157,"height":28158},"https://images.ctfassets.net/y1cdw1ablpvd/4H7j3s8F1FuyrGBvgSFs5a/882bf3ec5e477031fda0fde3223832f9/Group_594__1_.png",2328,1116,{"sys":28160,"__typename":1471,"type":1472,"ctaText":25009,"buttonLabel":21701,"buttonColour":1475,"buttonUrl":24943},{"id":8063},{"items":28162},[],{},"ConsentFix: Browser-native ClickFix hijacks OAuth grants",{"items":28166},[28167,28687,29248],{"__typename":1485,"sys":28168,"content":28169,"title":26349,"synopsis":26350,"hashTags":59,"publishedDate":26351,"slug":26352,"tagsCollection":28677,"authorsCollection":28683},{"id":25767},{"json":28170},{"data":28171,"content":28172,"nodeType":1463},{},[28173,28179,28185,28191,28196,28202,28205,28212,28218,28224,28230,28235,28241,28246,28252,28257,28263,28268,28294,28300,28305,28311,28316,28322,28327,28333,28372,28375,28382,28388,28394,28400,28405,28408,28415,28421,28437,28442,28447,28452,28458,28463,28468,28484,28487,28494,28510,28515,28521,28537,28544,28550,28556,28562,28578,28585,28591,28596,28599,28606,28612,28618,28621,28628,28634,28640,28666,28671],{"data":28174,"content":28175,"nodeType":881},{},[28176],{"data":28177,"marks":28178,"value":25778,"nodeType":865},{},[],{"data":28180,"content":28181,"nodeType":881},{},[28182],{"data":28183,"marks":28184,"value":25785,"nodeType":865},{},[],{"data":28186,"content":28187,"nodeType":881},{},[28188],{"data":28189,"marks":28190,"value":25792,"nodeType":865},{},[],{"data":28192,"content":28195,"nodeType":890},{"target":28193},{"sys":28194},{"id":25797,"type":887,"linkType":888},[],{"data":28197,"content":28198,"nodeType":881},{},[28199],{"data":28200,"marks":28201,"value":25805,"nodeType":865},{},[],{"data":28203,"content":28204,"nodeType":894},{},[],{"data":28206,"content":28207,"nodeType":904},{},[28208],{"data":28209,"marks":28210,"value":25816,"nodeType":865},{},[28211],{"type":902},{"data":28213,"content":28214,"nodeType":881},{},[28215],{"data":28216,"marks":28217,"value":25823,"nodeType":865},{},[],{"data":28219,"content":28220,"nodeType":881},{},[28221],{"data":28222,"marks":28223,"value":25830,"nodeType":865},{},[],{"data":28225,"content":28226,"nodeType":881},{},[28227],{"data":28228,"marks":28229,"value":25837,"nodeType":865},{},[],{"data":28231,"content":28234,"nodeType":890},{"target":28232},{"sys":28233},{"id":25842,"type":887,"linkType":888},[],{"data":28236,"content":28237,"nodeType":881},{},[28238],{"data":28239,"marks":28240,"value":25850,"nodeType":865},{},[],{"data":28242,"content":28245,"nodeType":890},{"target":28243},{"sys":28244},{"id":25855,"type":887,"linkType":888},[],{"data":28247,"content":28248,"nodeType":881},{},[28249],{"data":28250,"marks":28251,"value":25863,"nodeType":865},{},[],{"data":28253,"content":28256,"nodeType":890},{"target":28254},{"sys":28255},{"id":25868,"type":887,"linkType":888},[],{"data":28258,"content":28259,"nodeType":881},{},[28260],{"data":28261,"marks":28262,"value":25876,"nodeType":865},{},[],{"data":28264,"content":28267,"nodeType":890},{"target":28265},{"sys":28266},{"id":25881,"type":887,"linkType":888},[],{"data":28269,"content":28270,"nodeType":881},{},[28271,28274,28281,28284,28291],{"data":28272,"marks":28273,"value":25889,"nodeType":865},{},[],{"data":28275,"content":28276,"nodeType":876},{"uri":7327},[28277],{"data":28278,"marks":28279,"value":25897,"nodeType":865},{},[28280],{"type":874},{"data":28282,"marks":28283,"value":25901,"nodeType":865},{},[],{"data":28285,"content":28286,"nodeType":876},{"uri":1022},[28287],{"data":28288,"marks":28289,"value":25909,"nodeType":865},{},[28290],{"type":874},{"data":28292,"marks":28293,"value":25913,"nodeType":865},{},[],{"data":28295,"content":28296,"nodeType":881},{},[28297],{"data":28298,"marks":28299,"value":25920,"nodeType":865},{},[],{"data":28301,"content":28304,"nodeType":890},{"target":28302},{"sys":28303},{"id":25925,"type":887,"linkType":888},[],{"data":28306,"content":28307,"nodeType":881},{},[28308],{"data":28309,"marks":28310,"value":25933,"nodeType":865},{},[],{"data":28312,"content":28315,"nodeType":890},{"target":28313},{"sys":28314},{"id":25938,"type":887,"linkType":888},[],{"data":28317,"content":28318,"nodeType":881},{},[28319],{"data":28320,"marks":28321,"value":25946,"nodeType":865},{},[],{"data":28323,"content":28326,"nodeType":890},{"target":28324},{"sys":28325},{"id":25951,"type":887,"linkType":888},[],{"data":28328,"content":28329,"nodeType":881},{},[28330],{"data":28331,"marks":28332,"value":25959,"nodeType":865},{},[],{"data":28334,"content":28335,"nodeType":1818},{},[28336,28345,28354,28363],{"data":28337,"content":28338,"nodeType":1734},{},[28339],{"data":28340,"content":28341,"nodeType":881},{},[28342],{"data":28343,"marks":28344,"value":25972,"nodeType":865},{},[],{"data":28346,"content":28347,"nodeType":1734},{},[28348],{"data":28349,"content":28350,"nodeType":881},{},[28351],{"data":28352,"marks":28353,"value":25982,"nodeType":865},{},[],{"data":28355,"content":28356,"nodeType":1734},{},[28357],{"data":28358,"content":28359,"nodeType":881},{},[28360],{"data":28361,"marks":28362,"value":25992,"nodeType":865},{},[],{"data":28364,"content":28365,"nodeType":1734},{},[28366],{"data":28367,"content":28368,"nodeType":881},{},[28369],{"data":28370,"marks":28371,"value":26002,"nodeType":865},{},[],{"data":28373,"content":28374,"nodeType":894},{},[],{"data":28376,"content":28377,"nodeType":904},{},[28378],{"data":28379,"marks":28380,"value":26013,"nodeType":865},{},[28381],{"type":902},{"data":28383,"content":28384,"nodeType":881},{},[28385],{"data":28386,"marks":28387,"value":26020,"nodeType":865},{},[],{"data":28389,"content":28390,"nodeType":881},{},[28391],{"data":28392,"marks":28393,"value":26027,"nodeType":865},{},[],{"data":28395,"content":28396,"nodeType":881},{},[28397],{"data":28398,"marks":28399,"value":26034,"nodeType":865},{},[],{"data":28401,"content":28404,"nodeType":890},{"target":28402},{"sys":28403},{"id":26039,"type":887,"linkType":888},[],{"data":28406,"content":28407,"nodeType":894},{},[],{"data":28409,"content":28410,"nodeType":904},{},[28411],{"data":28412,"marks":28413,"value":26051,"nodeType":865},{},[28414],{"type":902},{"data":28416,"content":28417,"nodeType":881},{},[28418],{"data":28419,"marks":28420,"value":26058,"nodeType":865},{},[],{"data":28422,"content":28423,"nodeType":881},{},[28424,28427,28434],{"data":28425,"marks":28426,"value":26065,"nodeType":865},{},[],{"data":28428,"content":28429,"nodeType":876},{"uri":26068},[28430],{"data":28431,"marks":28432,"value":26074,"nodeType":865},{},[28433],{"type":874},{"data":28435,"marks":28436,"value":26078,"nodeType":865},{},[],{"data":28438,"content":28441,"nodeType":890},{"target":28439},{"sys":28440},{"id":26083,"type":887,"linkType":888},[],{"data":28443,"content":28446,"nodeType":890},{"target":28444},{"sys":28445},{"id":26089,"type":887,"linkType":888},[],{"data":28448,"content":28451,"nodeType":890},{"target":28449},{"sys":28450},{"id":26095,"type":887,"linkType":888},[],{"data":28453,"content":28454,"nodeType":881},{},[28455],{"data":28456,"marks":28457,"value":26103,"nodeType":865},{},[],{"data":28459,"content":28462,"nodeType":890},{"target":28460},{"sys":28461},{"id":26108,"type":887,"linkType":888},[],{"data":28464,"content":28467,"nodeType":890},{"target":28465},{"sys":28466},{"id":26114,"type":887,"linkType":888},[],{"data":28469,"content":28470,"nodeType":881},{},[28471,28474,28481],{"data":28472,"marks":28473,"value":26122,"nodeType":865},{},[],{"data":28475,"content":28476,"nodeType":876},{"uri":26125},[28477],{"data":28478,"marks":28479,"value":26131,"nodeType":865},{},[28480],{"type":874},{"data":28482,"marks":28483,"value":26135,"nodeType":865},{},[],{"data":28485,"content":28486,"nodeType":894},{},[],{"data":28488,"content":28489,"nodeType":904},{},[28490],{"data":28491,"marks":28492,"value":26146,"nodeType":865},{},[28493],{"type":902},{"data":28495,"content":28496,"nodeType":881},{},[28497,28500,28507],{"data":28498,"marks":28499,"value":26153,"nodeType":865},{},[],{"data":28501,"content":28502,"nodeType":876},{"uri":26156},[28503],{"data":28504,"marks":28505,"value":1951,"nodeType":865},{},[28506],{"type":874},{"data":28508,"marks":28509,"value":26165,"nodeType":865},{},[],{"data":28511,"content":28514,"nodeType":890},{"target":28512},{"sys":28513},{"id":26170,"type":887,"linkType":888},[],{"data":28516,"content":28517,"nodeType":881},{},[28518],{"data":28519,"marks":28520,"value":26178,"nodeType":865},{},[],{"data":28522,"content":28523,"nodeType":881},{},[28524,28527,28534],{"data":28525,"marks":28526,"value":26185,"nodeType":865},{},[],{"data":28528,"content":28529,"nodeType":876},{"uri":1139},[28530],{"data":28531,"marks":28532,"value":315,"nodeType":865},{},[28533],{"type":874},{"data":28535,"marks":28536,"value":26196,"nodeType":865},{},[],{"data":28538,"content":28539,"nodeType":1860},{},[28540],{"data":28541,"marks":28542,"value":26204,"nodeType":865},{},[28543],{"type":902},{"data":28545,"content":28546,"nodeType":881},{},[28547],{"data":28548,"marks":28549,"value":26211,"nodeType":865},{},[],{"data":28551,"content":28552,"nodeType":881},{},[28553],{"data":28554,"marks":28555,"value":26218,"nodeType":865},{},[],{"data":28557,"content":28558,"nodeType":881},{},[28559],{"data":28560,"marks":28561,"value":26225,"nodeType":865},{},[],{"data":28563,"content":28564,"nodeType":881},{},[28565,28568,28575],{"data":28566,"marks":28567,"value":26232,"nodeType":865},{},[],{"data":28569,"content":28570,"nodeType":876},{"uri":1747},[28571],{"data":28572,"marks":28573,"value":1752,"nodeType":865},{},[28574],{"type":874},{"data":28576,"marks":28577,"value":26243,"nodeType":865},{},[],{"data":28579,"content":28580,"nodeType":1860},{},[28581],{"data":28582,"marks":28583,"value":26251,"nodeType":865},{},[28584],{"type":902},{"data":28586,"content":28587,"nodeType":881},{},[28588],{"data":28589,"marks":28590,"value":26258,"nodeType":865},{},[],{"data":28592,"content":28595,"nodeType":890},{"target":28593},{"sys":28594},{"id":26263,"type":887,"linkType":888},[],{"data":28597,"content":28598,"nodeType":894},{},[],{"data":28600,"content":28601,"nodeType":904},{},[28602],{"data":28603,"marks":28604,"value":7881,"nodeType":865},{},[28605],{"type":902},{"data":28607,"content":28608,"nodeType":881},{},[28609],{"data":28610,"marks":28611,"value":26281,"nodeType":865},{},[],{"data":28613,"content":28614,"nodeType":881},{},[28615],{"data":28616,"marks":28617,"value":26288,"nodeType":865},{},[],{"data":28619,"content":28620,"nodeType":894},{},[],{"data":28622,"content":28623,"nodeType":904},{},[28624],{"data":28625,"marks":28626,"value":4448,"nodeType":865},{},[28627],{"type":902},{"data":28629,"content":28630,"nodeType":881},{},[28631],{"data":28632,"marks":28633,"value":26305,"nodeType":865},{},[],{"data":28635,"content":28636,"nodeType":881},{},[28637],{"data":28638,"marks":28639,"value":11724,"nodeType":865},{},[],{"data":28641,"content":28642,"nodeType":881},{},[28643,28646,28653,28656,28663],{"data":28644,"marks":28645,"value":4462,"nodeType":865},{},[],{"data":28647,"content":28648,"nodeType":876},{"uri":4465},[28649],{"data":28650,"marks":28651,"value":4471,"nodeType":865},{},[28652],{"type":874},{"data":28654,"marks":28655,"value":8048,"nodeType":865},{},[],{"data":28657,"content":28658,"nodeType":876},{"uri":1453},[28659],{"data":28660,"marks":28661,"value":4495,"nodeType":865},{},[28662],{"type":874},{"data":28664,"marks":28665,"value":959,"nodeType":865},{},[],{"data":28667,"content":28670,"nodeType":890},{"target":28668},{"sys":28669},{"id":8063,"type":887,"linkType":888},[],{"data":28672,"content":28673,"nodeType":881},{},[28674],{"data":28675,"marks":28676,"value":21,"nodeType":865},{},[],{"items":28678},[28679,28681],{"sys":28680,"name":4507},{"id":4506},{"sys":28682,"name":342},{"id":4510},{"items":28684},[28685],{"fullName":4514,"firstName":4515,"jobTitle":4516,"profilePicture":28686},{"url":4518},{"__typename":1485,"sys":28688,"content":28689,"title":29234,"synopsis":29235,"hashTags":59,"publishedDate":29236,"slug":29237,"tagsCollection":29238,"authorsCollection":29244},{"id":19065},{"json":28690},{"data":28691,"content":28692,"nodeType":1463},{},[28693,28700,28706,28735,28742,28749,28756,28759,28767,28787,28794,28800,28807,28813,28820,28826,28833,28839,28846,28852,28859,28866,28872,28875,28883,28903,28910,28917,28923,28941,28949,28969,28977,28995,29002,29008,29040,29048,29081,29089,29109,29114,29117,29125,29145,29151,29154,29162,29169,29176,29179,29186,29192,29199,29223,29228],{"data":28694,"content":28695,"nodeType":881},{},[28696],{"data":28697,"marks":28698,"value":28699,"nodeType":865},{},[],"PhaaS kits make up the vast majority of phishing sites intercepted by Push and dominate the phishing landscape, with kits like Tycoon, NakedPages, Flowerstorm, Salty2FA, and various Evilginx variations proving very popular among attackers targeting Push customers.",{"data":28701,"content":28702,"nodeType":881},{},[28703],{"data":28704,"marks":28705,"value":24489,"nodeType":865},{},[],{"data":28707,"content":28708,"nodeType":881},{},[28709,28713,28721,28724,28731],{"data":28710,"marks":28711,"value":28712,"nodeType":865},{},[],"This competitive environment has fuelled attacker innovation, resulting in an environment in which MFA-bypass is table stakes, phishing-resistant authentication is being circumvented through ",{"data":28714,"content":28716,"nodeType":876},{"uri":28715},"https://pushsecurity.com/blog/mfa-downgrade-attacks/",[28717],{"data":28718,"marks":28719,"value":24505,"nodeType":865},{},[28720],{"type":874},{"data":28722,"marks":28723,"value":1791,"nodeType":865},{},[],{"data":28725,"content":28726,"nodeType":876},{"uri":1022},[28727],{"data":28728,"marks":28729,"value":1951,"nodeType":865},{},[28730],{"type":874},{"data":28732,"marks":28733,"value":28734,"nodeType":865},{},[]," are being used to circumvent security tools — from email scanners, to web-crawling security tools, to web proxies analyzing network traffic.",{"data":28736,"content":28737,"nodeType":881},{},[28738],{"data":28739,"marks":28740,"value":28741,"nodeType":865},{},[],"Recently, we’ve noticed an increase in detections relating to Sneaky2FA, which operates through a fully-featured bot on Telegram. Customers reportedly receive access to a licensed, obfuscated version of the source code and deploy it independently.",{"data":28743,"content":28744,"nodeType":881},{},[28745],{"data":28746,"marks":28747,"value":28748,"nodeType":865},{},[],"This makes Sneaky2FA something that can be reliably profiled and tracked due to these codebase similarities — which is what we’re actively doing at Push. ",{"data":28750,"content":28751,"nodeType":881},{},[28752],{"data":28753,"marks":28754,"value":28755,"nodeType":865},{},[],"Why is this relevant? Well, the latest Sneaky2FA phish we identified was pretty interesting. ",{"data":28757,"content":28758,"nodeType":894},{},[],{"data":28760,"content":28761,"nodeType":904},{},[28762],{"data":28763,"marks":28764,"value":28766,"nodeType":865},{},[28765],{"type":902},"Sneaky2FA adds BITB to its phishing toolkit",{"data":28768,"content":28769,"nodeType":881},{},[28770,28774,28783],{"data":28771,"marks":28772,"value":28773,"nodeType":865},{},[],"We recently detected a Sneaky2FA server that is a bit different from the typical reverse-proxy ",{"data":28775,"content":28777,"nodeType":876},{"uri":28776},"https://pushsecurity.com/blog/phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm/",[28778],{"data":28779,"marks":28780,"value":28782,"nodeType":865},{},[28781],{"type":874},"Attacker-in-the-Middle",{"data":28784,"marks":28785,"value":28786,"nodeType":865},{},[]," site, featuring an embedded browser window that contained the actual phishing page. ",{"data":28788,"content":28789,"nodeType":881},{},[28790],{"data":28791,"marks":28792,"value":28793,"nodeType":865},{},[],"You can see how the page loaded below in the video below.",{"data":28795,"content":28799,"nodeType":890},{"target":28796},{"sys":28797},{"id":28798,"type":887,"linkType":888},"6L6Ban2xptI1uNA8OPJQzq",[],{"data":28801,"content":28802,"nodeType":881},{},[28803],{"data":28804,"marks":28805,"value":28806,"nodeType":865},{},[],"When the URL previewdoc[.]us is first accessed, a Cloudflare Turnstile check must be completed before the page loads. ",{"data":28808,"content":28812,"nodeType":890},{"target":28809},{"sys":28810},{"id":28811,"type":887,"linkType":888},"QscI1SZ6dOpgMkrJPtqLD",[],{"data":28814,"content":28815,"nodeType":881},{},[28816],{"data":28817,"marks":28818,"value":28819,"nodeType":865},{},[],"The page then redirects to a subdomain of previewdoc[.]us, which prompts the user to “Sign in with Microsoft” in order to view a document, styled to look like Adobe Acrobat Reader. ",{"data":28821,"content":28825,"nodeType":890},{"target":28822},{"sys":28823},{"id":28824,"type":887,"linkType":888},"7pkfAQquHrA6aUnCtj74iu",[],{"data":28827,"content":28828,"nodeType":881},{},[28829],{"data":28830,"marks":28831,"value":28832,"nodeType":865},{},[],"Upon clicking ‘Sign in with Microsoft” a reverse-proxy phishing page resembling a Microsoft login form is loaded in an embedded browser, with a custom background image designed to resemble a document library. ",{"data":28834,"content":28838,"nodeType":890},{"target":28835},{"sys":28836},{"id":28837,"type":887,"linkType":888},"782tw14AqgJ9mqneVaOdHc",[],{"data":28840,"content":28841,"nodeType":881},{},[28842],{"data":28843,"marks":28844,"value":28845,"nodeType":865},{},[],"Interestingly, the pop-up window adjusts to the visitor’s OS and browser — you can see some different examples below.",{"data":28847,"content":28851,"nodeType":890},{"target":28848},{"sys":28849},{"id":28850,"type":887,"linkType":888},"6lN9agEyeQ63LDHM1kaSqX",[],{"data":28853,"content":28854,"nodeType":881},{},[28855],{"data":28856,"marks":28857,"value":28858,"nodeType":865},{},[],"Completing authentication will result in the user’s Microsoft credentials and active session being stolen by the attacker, facilitating account takeover. ",{"data":28860,"content":28861,"nodeType":881},{},[28862],{"data":28863,"marks":28864,"value":28865,"nodeType":865},{},[],"You can see the sequence of pages loaded and Push detection events in the timeline below.",{"data":28867,"content":28871,"nodeType":890},{"target":28868},{"sys":28869},{"id":28870,"type":887,"linkType":888},"1oPpha39PMiJGUaZSptx1f",[],{"data":28873,"content":28874,"nodeType":894},{},[],{"data":28876,"content":28877,"nodeType":904},{},[28878],{"data":28879,"marks":28880,"value":28882,"nodeType":865},{},[28881],{"type":902},"Why Browser-in-the-Browser?",{"data":28884,"content":28885,"nodeType":881},{},[28886,28890,28899],{"data":28887,"marks":28888,"value":28889,"nodeType":865},{},[],"BITB was first coined as a technique in 2022 by ",{"data":28891,"content":28893,"nodeType":876},{"uri":28892},"https://mrd0x.com/browser-in-the-browser-phishing-attack/",[28894],{"data":28895,"marks":28896,"value":28898,"nodeType":865},{},[28897],{"type":874},"mr.d0x",{"data":28900,"marks":28901,"value":28902,"nodeType":865},{},[],", but standard AITM phishing pages are far more frequently encountered in the wild, particularly when it comes to enterprise business targets.",{"data":28904,"content":28905,"nodeType":881},{},[28906],{"data":28907,"marks":28908,"value":28909,"nodeType":865},{},[],"BITB is principally designed to mask suspicious phishing URLs by simulating a pretty normal function of in-browser authentication — a pop-up login form. BITB phishing pages replicate the design of a pop-up window with an iframe pointing to a malicious server. ",{"data":28911,"content":28912,"nodeType":881},{},[28913],{"data":28914,"marks":28915,"value":28916,"nodeType":865},{},[],"The pop-up browser window shows a legitimate Microsoft login URL — this is in fact a fake URL that is designed to fool the user. ",{"data":28918,"content":28922,"nodeType":890},{"target":28919},{"sys":28920},{"id":28921,"type":887,"linkType":888},"7kI5PHTr9XYQJ0xVJUnUDu",[],{"data":28924,"content":28925,"nodeType":881},{},[28926,28930,28937],{"data":28927,"marks":28928,"value":28929,"nodeType":865},{},[],"This BITB example shares many of the advantages of typical reverse-proxy based phishing pages, as well as the ",{"data":28931,"content":28932,"nodeType":876},{"uri":1022},[28933],{"data":28934,"marks":28935,"value":1951,"nodeType":865},{},[28936],{"type":874},{"data":28938,"marks":28939,"value":28940,"nodeType":865},{},[]," that are commonly used by attackers (and baked into PhaaS kits off-the-shelf). This includes:",{"data":28942,"content":28943,"nodeType":1860},{},[28944],{"data":28945,"marks":28946,"value":28948,"nodeType":865},{},[28947],{"type":902},"Bot protection to defeat web scraping tools",{"data":28950,"content":28951,"nodeType":881},{},[28952,28956,28965],{"data":28953,"marks":28954,"value":28955,"nodeType":865},{},[],"Attackers are using common ",{"data":28957,"content":28959,"nodeType":876},{"uri":28958},"https://phishing-techniques.pushsecurity.com/techniques/bot-protection/",[28960],{"data":28961,"marks":28962,"value":28964,"nodeType":865},{},[28963],{"type":874},"bot protection",{"data":28966,"marks":28967,"value":28968,"nodeType":865},{},[]," technologies like CAPTCHA and Cloudflare Turnstile to prevent security bots from accessing their web pages to be able to analyse them (and therefore block pages from being automatically flagged). This requires anyone visiting the page to pass a bot check/challenge before the page can be loaded, meaning the full page cannot be analysed by automated tools. ",{"data":28970,"content":28971,"nodeType":1860},{},[28972],{"data":28973,"marks":28974,"value":28976,"nodeType":865},{},[28975],{"type":902},"Stop unwanted visitors with conditional loading",{"data":28978,"content":28979,"nodeType":881},{},[28980,28983,28991],{"data":28981,"marks":28982,"value":21,"nodeType":865},{},[],{"data":28984,"content":28985,"nodeType":876},{"uri":7327},[28986],{"data":28987,"marks":28988,"value":28990,"nodeType":865},{},[28989],{"type":874},"Conditional loading",{"data":28992,"marks":28993,"value":28994,"nodeType":865},{},[]," techniques are used to prevent unwanted visitors from accessing the phishing page — reducing the chance that it is detected and flagged and extending the longevity of the phish. This often includes known security vendor IPs, VPN/proxy services, but is often used to target specific organizations (or even specific users within an organization). ",{"data":28996,"content":28997,"nodeType":881},{},[28998],{"data":28999,"marks":29000,"value":29001,"nodeType":865},{},[],"In this case, where the correct parameters are not supplied or the phishing site detects an unwanted variable, it will redirect to a benign wikibooks page. ",{"data":29003,"content":29007,"nodeType":890},{"target":29004},{"sys":29005},{"id":29006,"type":887,"linkType":888},"fN2XugiDIef8haTDapViT",[],{"data":29009,"content":29010,"nodeType":881},{},[29011,29015,29023,29027,29036],{"data":29012,"marks":29013,"value":29014,"nodeType":865},{},[],"Sneaky2FA has also been commonly observed using ",{"data":29016,"content":29017,"nodeType":876},{"uri":26125},[29018],{"data":29019,"marks":29020,"value":29022,"nodeType":865},{},[29021],{"type":874},"anti-analysis",{"data":29024,"marks":29025,"value":29026,"nodeType":865},{},[]," techniques to detect or ",{"data":29028,"content":29030,"nodeType":876},{"uri":29029},"https://blog.sekoia.io/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/#:~:text=Sneaky%202FA%20pages%20use%20anti,we%20identified%20as%20Sneaky%202FA",[29031],{"data":29032,"marks":29033,"value":29035,"nodeType":865},{},[29034],{"type":874},"disable browser developer tools",{"data":29037,"marks":29038,"value":29039,"nodeType":865},{},[]," to block attempts to analyse the page for malicious content. ",{"data":29041,"content":29042,"nodeType":1860},{},[29043],{"data":29044,"marks":29045,"value":29047,"nodeType":865},{},[29046],{"type":902},"Page and code obfuscation",{"data":29049,"content":29050,"nodeType":881},{},[29051,29055,29064,29068,29077],{"data":29052,"marks":29053,"value":29054,"nodeType":865},{},[],"The HTML and JavaScript of Sneaky2FA pages are ",{"data":29056,"content":29058,"nodeType":876},{"uri":29057},"https://phishing-techniques.pushsecurity.com/techniques/page-obfuscation/",[29059],{"data":29060,"marks":29061,"value":29063,"nodeType":865},{},[29062],{"type":874},"heavily obfuscated",{"data":29065,"marks":29066,"value":29067,"nodeType":865},{},[]," to evade static detection and pattern-matching, ",{"data":29069,"content":29071,"nodeType":876},{"uri":29070},"https://blog.sekoia.io/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/#:~:text=,%E2%80%9CNo%20account%3F%E2%80%9D%20and%20%E2%80%9CSign%20in%E2%80%9D",[29072],{"data":29073,"marks":29074,"value":29076,"nodeType":865},{},[29075],{"type":874},"such as",{"data":29078,"marks":29079,"value":29080,"nodeType":865},{},[]," breaking up UI text with invisible tags, embedding background and interface elements as encoded images instead of text, and other changes that are invisible to the user, but make it hard for scanning tools to fingerprint the page. ",{"data":29082,"content":29083,"nodeType":1860},{},[29084],{"data":29085,"marks":29086,"value":29088,"nodeType":865},{},[29087],{"type":902},"Domain rotation and URL masking",{"data":29090,"content":29091,"nodeType":881},{},[29092,29096,29105],{"data":29093,"marks":29094,"value":29095,"nodeType":865},{},[],"In addition to masking the phishing site URL presented to the user via the BITB window, Sneaky2FA has been seen using ",{"data":29097,"content":29099,"nodeType":876},{"uri":29098},"https://www.centripetal.ai/threat-research/typhoon-versus-sneaky",[29100],{"data":29101,"marks":29102,"value":29104,"nodeType":865},{},[29103],{"type":874},"stealthy hosting and domain tactics",{"data":29106,"marks":29107,"value":29108,"nodeType":865},{},[],". Each campaign uses a fresh, long, randomized URL (typically a 150-character path) on a benign-looking domain (often an old or compromised site). These domains are usually short-lived: many are taken down after just a few days or weeks. Analysts have observed that Sneaky2FA domains often lie dormant or serve harmless content until right before an attack, then quickly vanish after use. This “burn-and-replace” approach makes traditional defenses (which rely on domain reputation or pattern-matching) much weaker.",{"data":29110,"content":29113,"nodeType":890},{"target":29111},{"sys":29112},{"id":8063,"type":887,"linkType":888},[],{"data":29115,"content":29116,"nodeType":894},{},[],{"data":29118,"content":29119,"nodeType":904},{},[29120],{"data":29121,"marks":29122,"value":29124,"nodeType":865},{},[29123],{"type":902},"Are attackers moving to BITB? ",{"data":29126,"content":29127,"nodeType":881},{},[29128,29132,29141],{"data":29129,"marks":29130,"value":29131,"nodeType":865},{},[],"There is evidence that Sneaky2FAs shift to BITB might not be an isolated change. Raccoon0365 is another PhaaS service that has been seen utilizing BITB functionality after ",{"data":29133,"content":29135,"nodeType":876},{"uri":29134},"https://www.cloudflare.com/en-gb/threat-intelligence/research/report/cloudflare-participates-in-global-operation-to-disrupt-raccoono365/",[29136],{"data":29137,"marks":29138,"value":29140,"nodeType":865},{},[29139],{"type":874},"announcing a “BITB mini-panel”",{"data":29142,"marks":29143,"value":29144,"nodeType":865},{},[]," would be added as part of a service revamp. ",{"data":29146,"content":29150,"nodeType":890},{"target":29147},{"sys":29148},{"id":29149,"type":887,"linkType":888},"2sJUR9TVbZMU1v10Tq94Pz",[],{"data":29152,"content":29153,"nodeType":894},{},[],{"data":29155,"content":29156,"nodeType":904},{},[29157],{"data":29158,"marks":29159,"value":29161,"nodeType":865},{},[29160],{"type":902},"Conclusion",{"data":29163,"content":29164,"nodeType":881},{},[29165],{"data":29166,"marks":29167,"value":29168,"nodeType":865},{},[],"Attackers are continuously innovating their phishing techniques, particularly in the context of an increasingly professionalized PhaaS ecosystem. With identity-based attacks continuing to be the leading cause of breaches, attackers are incentivized to refine and enhance their phishing infrastructure. ",{"data":29170,"content":29171,"nodeType":881},{},[29172],{"data":29173,"marks":29174,"value":29175,"nodeType":865},{},[],"The addition of BITB, with the frequent iteration and improvement of detection evasion techniques, means that traditional security controls such as email gateways, web filters, and signature-based defenses will continue to be reliably bypassed. ",{"data":29177,"content":29178,"nodeType":894},{},[],{"data":29180,"content":29181,"nodeType":904},{},[29182],{"data":29183,"marks":29184,"value":5936,"nodeType":865},{},[29185],{"type":902},{"data":29187,"content":29188,"nodeType":881},{},[29189],{"data":29190,"marks":29191,"value":26305,"nodeType":865},{},[],{"data":29193,"content":29194,"nodeType":881},{},[29195],{"data":29196,"marks":29197,"value":29198,"nodeType":865},{},[],"Despite the various detection evasion techniques, and the use of BITB methods, Push still detected this toolkit running on the page, enabling any attack to be detected and blocked before the user could be phished. Because we can inspect the live page, we detect malicious content loaded in the browser in real time. ",{"data":29200,"content":29201,"nodeType":881},{},[29202,29205,29211,29214,29220],{"data":29203,"marks":29204,"value":4462,"nodeType":865},{},[],{"data":29206,"content":29207,"nodeType":876},{"uri":4465},[29208],{"data":29209,"marks":29210,"value":4471,"nodeType":865},{},[],{"data":29212,"marks":29213,"value":8048,"nodeType":865},{},[],{"data":29215,"content":29216,"nodeType":876},{"uri":1453},[29217],{"data":29218,"marks":29219,"value":4495,"nodeType":865},{},[],{"data":29221,"marks":29222,"value":959,"nodeType":865},{},[],{"data":29224,"content":29227,"nodeType":890},{"target":29225},{"sys":29226},{"id":8063,"type":887,"linkType":888},[],{"data":29229,"content":29230,"nodeType":881},{},[29231],{"data":29232,"marks":29233,"value":21,"nodeType":865},{},[],"Analyzing the latest Sneaky2FA Browser-in-the-Browser phishing page","Analyzing a BITB phishing page linked to the Sneaky2FA Phishing-as-a-Service operation. ","2025-11-18T00:00:00.000Z","analyzing-the-latest-sneaky2fa-phishing-page",{"items":29239},[29240,29242],{"sys":29241,"name":4507},{"id":4506},{"sys":29243,"name":342},{"id":4510},{"items":29245},[29246],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":29247},{"url":5377},{"__typename":1485,"sys":29249,"content":29251,"title":28076,"synopsis":29824,"hashTags":59,"publishedDate":29825,"slug":29826,"tagsCollection":29827,"authorsCollection":29833},{"id":29250},"7rVNBW6rYXnXMpI0JEwzgR",{"json":29252},{"data":29253,"content":29254,"nodeType":1463},{},[29255,29262,29269,29281,29286,29293,29296,29304,29311,29317,29333,29340,29363,29370,29376,29379,29387,29419,29425,29444,29450,29469,29476,29482,29485,29493,29500,29520,29527,29547,29554,29560,29563,29571,29578,29611,29618,29625,29671,29689,29699,29706,29709,29717,29737,29744,29751,29756,29759,29767,29787,29813,29818],{"data":29256,"content":29257,"nodeType":881},{},[29258],{"data":29259,"marks":29260,"value":29261,"nodeType":865},{},[],"ClickFix attacks have skyrocketed in the last year. This social engineering attack has established itself as a key part of the modern attacker’s toolkit, tricking victims into running malicious code on their device.",{"data":29263,"content":29264,"nodeType":881},{},[29265],{"data":29266,"marks":29267,"value":29268,"nodeType":865},{},[],"As we showcased in our last webinar and at our threat briefing in London earlier this month, ClickFix is evolving fast, in terms of the web pages themselves, the delivery mechanisms by which they are sent to victims, and the nature of the payload and its execution.",{"data":29270,"content":29271,"nodeType":881},{},[29272,29276],{"data":29273,"marks":29274,"value":29275,"nodeType":865},{},[],"One particular example stood out to us in our research. ",{"data":29277,"marks":29278,"value":29280,"nodeType":865},{},[29279],{"type":902},"So, is this the most advanced ClickFix you’ve seen?",{"data":29282,"content":29285,"nodeType":890},{"target":29283},{"sys":29284},{"id":7506,"type":887,"linkType":888},[],{"data":29287,"content":29288,"nodeType":881},{},[29289],{"data":29290,"marks":29291,"value":29292,"nodeType":865},{},[],"Let’s break it down further.",{"data":29294,"content":29295,"nodeType":894},{},[],{"data":29297,"content":29298,"nodeType":904},{},[29299],{"data":29300,"marks":29301,"value":29303,"nodeType":865},{},[29302],{"type":902},"How ClickFix pages are evolving",{"data":29305,"content":29306,"nodeType":881},{},[29307],{"data":29308,"marks":29309,"value":29310,"nodeType":865},{},[],"The CloudFlare-based lure is a great example of how ClickFix pages themselves are evolving — and becoming increasingly convincing to users. ",{"data":29312,"content":29316,"nodeType":890},{"target":29313},{"sys":29314},{"id":29315,"type":887,"linkType":888},"4wJOgtofImjbsekyXMc5Ec",[],{"data":29318,"content":29319,"nodeType":881},{},[29320,29324,29329],{"data":29321,"marks":29322,"value":29323,"nodeType":865},{},[],"This is an incredibly slick example — ",{"data":29325,"marks":29326,"value":29328,"nodeType":865},{},[29327],{"type":902},"it almost looks like Cloudflare shipped a new kind of bot check service. ",{"data":29330,"marks":29331,"value":29332,"nodeType":865},{},[],"The embedded video, countdown timer, and counter for “users verified in the last hour” all serve to increase the sense of authenticity, and put extra pressure on the victim to complete the check. ",{"data":29334,"content":29335,"nodeType":881},{},[29336],{"data":29337,"marks":29338,"value":29339,"nodeType":865},{},[],"There are a couple of extra things happening under the hood here, too:",{"data":29341,"content":29342,"nodeType":1818},{},[29343,29353],{"data":29344,"content":29345,"nodeType":1734},{},[29346],{"data":29347,"content":29348,"nodeType":881},{},[29349],{"data":29350,"marks":29351,"value":29352,"nodeType":865},{},[],"The page is adapting to the device that you’re visiting from, serving up instructions specific to the user’s Mac (increasingly common as ClickFix expands to support different Operating Systems).",{"data":29354,"content":29355,"nodeType":1734},{},[29356],{"data":29357,"content":29358,"nodeType":881},{},[29359],{"data":29360,"marks":29361,"value":29362,"nodeType":865},{},[],"The page is automatically copying the malicious code to the user’s clipboard via JavaScript (which we see in 9/10 cases).",{"data":29364,"content":29365,"nodeType":881},{},[29366],{"data":29367,"marks":29368,"value":29369,"nodeType":865},{},[],"For the past decade or more, user awareness has focused on stopping users from clicking links in suspicious emails, downloading risky files, and entering their username and password into random websites. It hasn’t focused on opening up a program and running a command — so it’s no surprise that this kind of highly convincing page is so effective at duping victims into following the instructions. ",{"data":29371,"content":29375,"nodeType":890},{"target":29372},{"sys":29373},{"id":29374,"type":887,"linkType":888},"LiVIyGxdAaUXUfvKjD6ON",[],{"data":29377,"content":29378,"nodeType":894},{},[],{"data":29380,"content":29381,"nodeType":904},{},[29382],{"data":29383,"marks":29384,"value":29386,"nodeType":865},{},[29385],{"type":902},"How ClickFix delivery methods are evolving",{"data":29388,"content":29389,"nodeType":881},{},[29390,29394,29402,29406,29415],{"data":29391,"marks":29392,"value":29393,"nodeType":865},{},[],"There’s also the fact that this page wasn’t accessed via email. The top delivery vector for ClickFix attacks that we’ve observed is, in fact, Google Search — in the form of ",{"data":29395,"content":29396,"nodeType":876},{"uri":7517},[29397],{"data":29398,"marks":29399,"value":29401,"nodeType":865},{},[29400],{"type":874},"poisoned search results and malicious advertising (malvertising)",{"data":29403,"marks":29404,"value":29405,"nodeType":865},{},[],". Attackers are either taking over legitimate sites (there’s a ",{"data":29407,"content":29409,"nodeType":876},{"uri":29408},"https://www.bleepingcomputer.com/news/security/hackers-launch-mass-attacks-exploiting-outdated-wordpress-plugins/",[29410],{"data":29411,"marks":29412,"value":29414,"nodeType":865},{},[29413],{"type":874},"steady supply of website hosting and CMS vulnerabilities",{"data":29416,"marks":29417,"value":29418,"nodeType":865},{},[]," to take advantage of) or simply vibe-coding their own sites and optimizing them for various search terms. ",{"data":29420,"content":29424,"nodeType":890},{"target":29421},{"sys":29422},{"id":29423,"type":887,"linkType":888},"6N9EmH6AaN6Hr4xk6ozATR",[],{"data":29426,"content":29427,"nodeType":881},{},[29428,29432,29441],{"data":29429,"marks":29430,"value":29431,"nodeType":865},{},[],"And because most anti-phishing controls are implemented via email, by using ",{"data":29433,"content":29435,"nodeType":876},{"uri":29434},"https://pushsecurity.com/blog/why-attackers-are-moving-beyond-email-based-phishing?utm_source=thehackernews&utm_medium=sponsored-content&utm_term=article",[29436],{"data":29437,"marks":29438,"value":29440,"nodeType":865},{},[29439],{"type":874},"non-email delivery vectors, an entire layer of detection opportunity is cut out",{"data":29442,"marks":29443,"value":1032,"nodeType":865},{},[],{"data":29445,"content":29449,"nodeType":890},{"target":29446},{"sys":29447},{"id":29448,"type":887,"linkType":888},"1CWsZlLFX9TS53J1uamOG8",[],{"data":29451,"content":29452,"nodeType":881},{},[29453,29457,29465],{"data":29454,"marks":29455,"value":29456,"nodeType":865},{},[],"But even when they are sent via email, ClickFix pages, like other modern phishing sites, are using a range of ",{"data":29458,"content":29460,"nodeType":876},{"uri":29459},"https://pushsecurity.com/blog/phishing-detection-evasion-launch?utm_source=thehackernews&utm_medium=sponsored-content&utm_term=article",[29461],{"data":29462,"marks":29463,"value":1951,"nodeType":865},{},[29464],{"type":874},{"data":29466,"marks":29467,"value":29468,"nodeType":865},{},[]," that prevent them being flagged by security tools — from email scanners, to web-crawling security tools, to web proxies analyzing network traffic. Detection evasion mainly involves camouflaging and rotating domains to stay ahead of known-bad detections (i.e. blocklists), using bot protection to prevent analysis, and heavily obfuscating page content to stop detection signatures firing. ",{"data":29470,"content":29471,"nodeType":881},{},[29472],{"data":29473,"marks":29474,"value":29475,"nodeType":865},{},[],"Finally, because the code is copied inside the browser sandbox, typical security tools are unable to observe and flag this action as potentially malicious. This means that the last — and only — opportunity for organizations to stop ClickFix is on the endpoint, after the user has attempted to run the malicious code.",{"data":29477,"content":29481,"nodeType":890},{"target":29478},{"sys":29479},{"id":29480,"type":887,"linkType":888},"3HiqpIBWWMr5FMi3IBzXcc",[],{"data":29483,"content":29484,"nodeType":894},{},[],{"data":29486,"content":29487,"nodeType":904},{},[29488],{"data":29489,"marks":29490,"value":29492,"nodeType":865},{},[29491],{"type":902},"How ClickFix payloads are evolving",{"data":29494,"content":29495,"nodeType":881},{},[29496],{"data":29497,"marks":29498,"value":29499,"nodeType":865},{},[],"It’s not just the ClickFix page and delivery mechanisms that are evolving — the services where code is being run, and the type of payload, are also increasingly varied. ",{"data":29501,"content":29502,"nodeType":881},{},[29503,29507,29516],{"data":29504,"marks":29505,"value":29506,"nodeType":865},{},[],"While the main payloads observed by Push are mshta and PowerShell, ",{"data":29508,"content":29510,"nodeType":876},{"uri":29509},"https://mhaggis.github.io/ClickGrab/techniques.html",[29511],{"data":29512,"marks":29513,"value":29515,"nodeType":865},{},[29514],{"type":874},"attackers are abusing a wide range of LOLBINS",{"data":29517,"marks":29518,"value":29519,"nodeType":865},{},[]," targeting different services across Operating Systems.",{"data":29521,"content":29522,"nodeType":881},{},[29523],{"data":29524,"marks":29525,"value":29526,"nodeType":865},{},[],"While it is possible to disable the Win+R dialog box and limit the applications that can be run from the File Explorer address bar, it is not possible to similarly restrict users from interacting with other legitimate services to run malicious commands. ",{"data":29528,"content":29529,"nodeType":881},{},[29530,29534,29543],{"data":29531,"marks":29532,"value":29533,"nodeType":865},{},[],"Another recent example termed ",{"data":29535,"content":29537,"nodeType":876},{"uri":29536},"https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/",[29538],{"data":29539,"marks":29540,"value":29542,"nodeType":865},{},[29541],{"type":874},"cache smuggling",{"data":29544,"marks":29545,"value":29546,"nodeType":865},{},[]," was also identified by security researchers. This technique combines a ClickFix approach with JavaScript that caches a malicious file posing as a JPG. This means that the ClickFix command executes locally — effectively getting an entire zip file onto the local system without the PowerShell command needing to make any web requests.",{"data":29548,"content":29549,"nodeType":881},{},[29550],{"data":29551,"marks":29552,"value":29553,"nodeType":865},{},[],"Finally, it’s worth considering the future of ClickFix. The current attack path straddles browser and endpoint — what if it could take place entirely in the browser and evade EDR altogether? ",{"data":29555,"content":29559,"nodeType":890},{"target":29556},{"sys":29557},{"id":29558,"type":887,"linkType":888},"2rUDKawJnrmZVtxfNcSNha",[],{"data":29561,"content":29562,"nodeType":894},{},[],{"data":29564,"content":29565,"nodeType":904},{},[29566],{"data":29567,"marks":29568,"value":29570,"nodeType":865},{},[29569],{"type":902},"What’s the impact of ClickFix evolution?",{"data":29572,"content":29573,"nodeType":881},{},[29574],{"data":29575,"marks":29576,"value":29577,"nodeType":865},{},[],"To summarize:",{"data":29579,"content":29580,"nodeType":1818},{},[29581,29591,29601],{"data":29582,"content":29583,"nodeType":1734},{},[29584],{"data":29585,"content":29586,"nodeType":881},{},[29587],{"data":29588,"marks":29589,"value":29590,"nodeType":865},{},[],"ClickFix pages are becoming increasingly sophisticated, making it more likely that victims will fall for the social engineering.",{"data":29592,"content":29593,"nodeType":1734},{},[29594],{"data":29595,"content":29596,"nodeType":881},{},[29597],{"data":29598,"marks":29599,"value":29600,"nodeType":865},{},[],"ClickFix delivery is evading traditional monitoring controls at the email layer to reach victims. ",{"data":29602,"content":29603,"nodeType":1734},{},[29604],{"data":29605,"content":29606,"nodeType":881},{},[29607],{"data":29608,"marks":29609,"value":29610,"nodeType":865},{},[],"ClickFix payloads are becoming more varied and are finding new ways to evade security controls. ",{"data":29612,"content":29613,"nodeType":881},{},[29614],{"data":29615,"marks":29616,"value":29617,"nodeType":865},{},[],"This means that EDR-based interception of malware execution is the last — and only — real line of defense for most organizations, kicking in after the initial script has been run (typically acting as a stager for the real malware). ",{"data":29619,"content":29620,"nodeType":881},{},[29621],{"data":29622,"marks":29623,"value":29624,"nodeType":865},{},[],"Malware execution can and should be intercepted by EDR, but it’s not foolproof. ",{"data":29626,"content":29627,"nodeType":1818},{},[29628,29651,29661],{"data":29629,"content":29630,"nodeType":1734},{},[29631],{"data":29632,"content":29633,"nodeType":881},{},[29634,29638,29647],{"data":29635,"marks":29636,"value":29637,"nodeType":865},{},[],"Attackers are constantly ",{"data":29639,"content":29641,"nodeType":876},{"uri":29640},"https://www.infostealers.com/article/logins-zip-leverages-chromium-zero-day-stealthy-infostealer-builder-promises-99-credential-theft-in-under-12-seconds/",[29642],{"data":29643,"marks":29644,"value":29646,"nodeType":865},{},[29645],{"type":874},"developing new tools and capabilities",{"data":29648,"marks":29649,"value":29650,"nodeType":865},{},[]," to bypass EDR in the cat-and-mouse game between attackers and defenders.",{"data":29652,"content":29653,"nodeType":1734},{},[29654],{"data":29655,"content":29656,"nodeType":881},{},[29657],{"data":29658,"marks":29659,"value":29660,"nodeType":865},{},[],"Because ClickFix attacks are user initiated, context might be missing that lead to the alert being misclassified. This can mean the difference between the level of priority alert that is raised, and whether or not it is automatically blocked.",{"data":29662,"content":29663,"nodeType":1734},{},[29664],{"data":29665,"content":29666,"nodeType":881},{},[29667],{"data":29668,"marks":29669,"value":29670,"nodeType":865},{},[],"If you’re an organization that allows employees and contractors to use unmanaged BYOD devices, there’s a strong chance that there are gaps in your EDR coverage.",{"data":29672,"content":29673,"nodeType":881},{},[29674,29678,29685],{"data":29675,"marks":29676,"value":29677,"nodeType":865},{},[],"This is why attackers are doubling down. According to the ",{"data":29679,"content":29680,"nodeType":876},{"uri":11532},[29681],{"data":29682,"marks":29683,"value":29684,"nodeType":865},{},[],"2025 Microsoft Digital Defense report",{"data":29686,"marks":29687,"value":29688,"nodeType":865},{},[],", ClickFix was the most common initial access method in the last year, accounting for 47% of attacks. That's a pretty significant stat.",{"data":29690,"content":29691,"nodeType":970},{},[29692],{"data":29693,"content":29694,"nodeType":881},{},[29695],{"data":29696,"marks":29697,"value":29698,"nodeType":865},{},[],"47% of attacks started with ClickFix in the last year, according to Microsoft.",{"data":29700,"content":29701,"nodeType":881},{},[29702],{"data":29703,"marks":29704,"value":29705,"nodeType":865},{},[],"Ultimately, organizations are leaving themselves relying on a single line of defense — if the attack isn’t detected and blocked by EDR, it isn’t spotted at all. ",{"data":29707,"content":29708,"nodeType":894},{},[],{"data":29710,"content":29711,"nodeType":904},{},[29712],{"data":29713,"marks":29714,"value":29716,"nodeType":865},{},[29715],{"type":902},"Don’t gamble on a single point of failure ",{"data":29718,"content":29719,"nodeType":881},{},[29720,29724,29733],{"data":29721,"marks":29722,"value":29723,"nodeType":865},{},[],"Push Security’s latest feature, ",{"data":29725,"content":29727,"nodeType":876},{"uri":29726},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection?utm_source=thehackernews&utm_medium=sponsored-content&utm_term=article",[29728],{"data":29729,"marks":29730,"value":29732,"nodeType":865},{},[29731],{"type":874},"malicious copy and paste detection",{"data":29734,"marks":29735,"value":29736,"nodeType":865},{},[],", tackles ClickFix-style attacks at the earliest opportunity through browser-based detection and blocking. This is a universally effective control that works regardless of the lure delivery channel, page style and structure, or the specifics of the malware type and execution.",{"data":29738,"content":29739,"nodeType":881},{},[29740],{"data":29741,"marks":29742,"value":29743,"nodeType":865},{},[],"Unlike heavy-handed DLP solutions that block copy-paste altogether, Push protects your employees without disrupting their user experience or hampering productivity.",{"data":29745,"content":29746,"nodeType":881},{},[29747],{"data":29748,"marks":29749,"value":29750,"nodeType":865},{},[],"By adding a new layer of protection in the browser, security teams can reduce the strain on their EDR and reduce the risk of host-based controls being bypassed through misconfiguration or attacker innovation. ",{"data":29752,"content":29755,"nodeType":890},{"target":29753},{"sys":29754},{"id":19457,"type":887,"linkType":888},[],{"data":29757,"content":29758,"nodeType":894},{},[],{"data":29760,"content":29761,"nodeType":904},{},[29762],{"data":29763,"marks":29764,"value":29766,"nodeType":865},{},[29765],{"type":902},"Learn more",{"data":29768,"content":29769,"nodeType":881},{},[29770,29774,29783],{"data":29771,"marks":29772,"value":29773,"nodeType":865},{},[],"If you want to learn more about ClickFix attacks and how they’re evolving, ",{"data":29775,"content":29777,"nodeType":876},{"uri":29776},"https://pushsecurity.com/resources/clickfix",[29778],{"data":29779,"marks":29780,"value":29782,"nodeType":865},{},[29781],{"type":874},"check out our latest webinar (now available on-demand!)",{"data":29784,"marks":29785,"value":29786,"nodeType":865},{},[]," where we dive into real-world ClickFix examples and demonstrate how ClickFix sites work under the hood. ",{"data":29788,"content":29789,"nodeType":881},{},[29790,29793,29800,29803,29810],{"data":29791,"marks":29792,"value":4462,"nodeType":865},{},[],{"data":29794,"content":29795,"nodeType":876},{"uri":4465},[29796],{"data":29797,"marks":29798,"value":4471,"nodeType":865},{},[29799],{"type":874},{"data":29801,"marks":29802,"value":8048,"nodeType":865},{},[],{"data":29804,"content":29805,"nodeType":876},{"uri":1453},[29806],{"data":29807,"marks":29808,"value":4495,"nodeType":865},{},[29809],{"type":874},{"data":29811,"marks":29812,"value":959,"nodeType":865},{},[],{"data":29814,"content":29817,"nodeType":890},{"target":29815},{"sys":29816},{"id":29374,"type":887,"linkType":888},[],{"data":29819,"content":29820,"nodeType":881},{},[29821],{"data":29822,"marks":29823,"value":21,"nodeType":865},{},[],"Breaking down the most sophisticated ClickFix page we’ve seen in the wild — and what it tells us about the future of malicious copy-and-paste attacks. ","2025-11-06T00:00:00.000Z","the-most-advanced-clickfix-yet",{"items":29828},[29829,29831],{"sys":29830,"name":342},{"id":4510},{"sys":29832,"name":4507},{"id":4506},{"items":29834},[29835],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":29836},{"url":5377},"blog/consentfix",{"json":29839},{"data":29840,"content":29841,"nodeType":1463},{},[29842],{"data":29843,"content":29844,"nodeType":881},{},[29845],{"data":29846,"marks":29847,"value":29848,"nodeType":865},{},[],"We recently intercepted a phishing campaign using a new kind of attack technique that we’re calling “ConsentFix” — combining OAuth consent phishing with a ClickFix-style user prompt that leads to account compromise. Here's what you need to know.",{"id":7222,"publishedAt":29850},"2026-08-12T11:53:26.585Z",{"items":29852},[29853,29855],{"sys":29854,"name":4507},{"id":4506},{"sys":29856,"name":342},{"id":4510},{"items":29858},[29859,29861,29863,29865,29867,29869],{"sys":29860,"name":279,"slug":280,"tier":31},{"id":276},{"sys":29862,"name":519,"slug":520,"tier":31},{"id":516},{"sys":29864,"name":315,"slug":316,"tier":45},{"id":312},{"sys":29866,"name":484,"slug":485,"tier":45},{"id":481},{"sys":29868,"name":466,"slug":467,"tier":45},{"id":463},{"sys":29870,"name":493,"slug":494,"tier":45},{"id":490},"Xu_kH8ft7E7dewNA1M7IE5Dg3Fqi7IerHhbCAoWPUYA",{"id":29873,"title":29874,"authorsCollection":29875,"content":29880,"extension":228,"faqItemsCollection":30718,"faqTitle":59,"featured":6,"hashTags":59,"meta":30720,"metaTitle":30721,"ogImage":59,"postType":1480,"publishedDate":30722,"relatedBlogPostsCollection":30723,"slug":32656,"stem":32657,"subtitle":59,"summary":32658,"synopsis":32668,"sys":32669,"tagsCollection":32672,"topicsCollection":32678,"__hash__":32730},"blog/blog/how-the-browser-became-the-main-cyber-battleground.json","How the browser became the main cyber battleground",{"items":29876},[29877],{"fullName":5373,"firstName":5374,"jobTitle":5375,"socialLinks":29878,"profilePicture":29879},[6440],{"url":5377},{"json":29881,"links":30661},{"data":29882,"content":29883,"nodeType":1463},{},[29884,29891,29924,29931,29937,29944,29976,29983,29989,29992,30000,30007,30014,30071,30090,30102,30109,30115,30118,30126,30142,30148,30155,30161,30168,30205,30211,30214,30222,30229,30236,30361,30367,30398,30405,30408,30416,30423,30430,30472,30500,30507,30583,30589,30592,30599,30606,30626,30629,30637,30644],{"data":29885,"content":29886,"nodeType":881},{},[29887],{"data":29888,"marks":29889,"value":29890,"nodeType":865},{},[],"Until recently, the cyber attacker methodology behind the biggest breaches of the last decade or so has been pretty consistent:",{"data":29892,"content":29893,"nodeType":1818},{},[29894,29904,29914],{"data":29895,"content":29896,"nodeType":1734},{},[29897],{"data":29898,"content":29899,"nodeType":881},{},[29900],{"data":29901,"marks":29902,"value":29903,"nodeType":865},{},[],"Compromise an endpoint via software exploit, or social engineering a user to run malware on their device; ",{"data":29905,"content":29906,"nodeType":1734},{},[29907],{"data":29908,"content":29909,"nodeType":881},{},[29910],{"data":29911,"marks":29912,"value":29913,"nodeType":865},{},[],"Find ways to move laterally inside the network and compromise privileged identities;",{"data":29915,"content":29916,"nodeType":1734},{},[29917],{"data":29918,"content":29919,"nodeType":881},{},[29920],{"data":29921,"marks":29922,"value":29923,"nodeType":865},{},[],"Repeat as needed until you can execute your desired attack — usually stealing data from file shares, deploying ransomware, or both. ",{"data":29925,"content":29926,"nodeType":881},{},[29927],{"data":29928,"marks":29929,"value":29930,"nodeType":865},{},[],"But attacks have fundamentally changed as networks have evolved. With the SaaS-ification of enterprise IT, core business systems aren’t locally deployed and centrally managed in the way they used to be. Instead, they’re logged into over the internet, via a web browser.",{"data":29932,"content":29936,"nodeType":890},{"target":29933},{"sys":29934},{"id":29935,"type":887,"linkType":888},"4h4hUYAghbZavOwjRTnBe2",[],{"data":29938,"content":29939,"nodeType":881},{},[29940],{"data":29941,"marks":29942,"value":29943,"nodeType":865},{},[],"Under the shared responsibility model, the part that’s left to the business consuming a SaaS service is mostly constrained to how they manage identities — the vehicle by which the app is accessed and used by the workforce. It’s no surprise that this has become the soft underbelly in the crosshairs of attackers. ",{"data":29945,"content":29946,"nodeType":881},{},[29947,29951,29959,29963,29972],{"data":29948,"marks":29949,"value":29950,"nodeType":865},{},[],"We’ve seen this time and again in the biggest breaches of recent years, with the highlights including the massive ",{"data":29952,"content":29953,"nodeType":876},{"uri":11103},[29954],{"data":29955,"marks":29956,"value":29958,"nodeType":865},{},[29957],{"type":874},"Snowflake campaign in 2024",{"data":29960,"marks":29961,"value":29962,"nodeType":865},{},[]," and the ",{"data":29964,"content":29966,"nodeType":876},{"uri":29965},"https://pushsecurity.com/blog/key-takeaways-from-the-scattered-spider-attacks-on-insurance-firms/",[29967],{"data":29968,"marks":29969,"value":29971,"nodeType":865},{},[29970],{"type":874},"2025 crime wave attributed to Scattered Spider",{"data":29973,"marks":29974,"value":29975,"nodeType":865},{},[],".   ",{"data":29977,"content":29978,"nodeType":881},{},[29979],{"data":29980,"marks":29981,"value":29982,"nodeType":865},{},[],"These attacks are so successful because while attackers have moved with the changes to enterprise IT, security hasn’t really kept up. ",{"data":29984,"content":29988,"nodeType":890},{"target":29985},{"sys":29986},{"id":29987,"type":887,"linkType":888},"xH0ZqgKQXCRRZGYVs6xt6",[],{"data":29990,"content":29991,"nodeType":894},{},[],{"data":29993,"content":29994,"nodeType":904},{},[29995],{"data":29996,"marks":29997,"value":29999,"nodeType":865},{},[29998],{"type":902},"The browser is the new battleground — and a security blind spot",{"data":30001,"content":30002,"nodeType":881},{},[30003],{"data":30004,"marks":30005,"value":30006,"nodeType":865},{},[],"Taking over workforce identities is the first objective for attackers looking to target an organization, and the browser is the place where the attacks against users happen. This is because it’s where these digital identities are created and used — and their credentials and sessions live. This is what the attacker wants to get their hands on. ",{"data":30008,"content":30009,"nodeType":881},{},[30010],{"data":30011,"marks":30012,"value":30013,"nodeType":865},{},[],"Stolen credentials can be used as part of targeted attacks or in broader credential stuffing (cycling known username and credential pairs against various apps and platforms), while stolen session tokens can be used to log in directly to an active session, bypassing the authentication process. ",{"data":30015,"content":30016,"nodeType":881},{},[30017,30021,30026,30029,30034,30037,30042,30045,30050,30053,30058,30062,30067],{"data":30018,"marks":30019,"value":30020,"nodeType":865},{},[],"There are a few different techniques that attackers can use to get access to these identities. Attackers harvest stolen credentials from various places — ",{"data":30022,"marks":30023,"value":30025,"nodeType":865},{},[30024],{"type":902},"data breach dumps",{"data":30027,"marks":30028,"value":1877,"nodeType":865},{},[],{"data":30030,"marks":30031,"value":30033,"nodeType":865},{},[30032],{"type":902},"mass",{"data":30035,"marks":30036,"value":2091,"nodeType":865},{},[],{"data":30038,"marks":30039,"value":30041,"nodeType":865},{},[30040],{"type":902},"credential",{"data":30043,"marks":30044,"value":2091,"nodeType":865},{},[],{"data":30046,"marks":30047,"value":30049,"nodeType":865},{},[30048],{"type":902},"phishing campaigns,",{"data":30051,"marks":30052,"value":2091,"nodeType":865},{},[],{"data":30054,"marks":30055,"value":30057,"nodeType":865},{},[30056],{"type":902},"infostealer logs",{"data":30059,"marks":30060,"value":30061,"nodeType":865},{},[],", even ",{"data":30063,"marks":30064,"value":30066,"nodeType":865},{},[30065],{"type":902},"malicious browser extensions",{"data":30068,"marks":30069,"value":30070,"nodeType":865},{},[]," that they’ve tricked an employee into installing. In fact, the cyber crime ecosystem itself has shifted on its axis to cater to this, with hackers specifically taking on the role of harvesting credentials and establishing account access for others to exploit. ",{"data":30072,"content":30073,"nodeType":881},{},[30074,30078,30086],{"data":30075,"marks":30076,"value":30077,"nodeType":865},{},[],"The high-profile ",{"data":30079,"content":30080,"nodeType":876},{"uri":11103},[30081],{"data":30082,"marks":30083,"value":30085,"nodeType":865},{},[30084],{"type":874},"Snowflake",{"data":30087,"marks":30088,"value":30089,"nodeType":865},{},[]," breaches in 2024 signalled a watershed moment in the shift to identity-driven breaches, where attackers logged into accounts across hundreds of customer tenants using stolen credentials. One of the primary sources of the stolen credentials used in the attacks were infostealer logs dating back to 2020 — breached passwords that hadn’t been rotated or mitigated with MFA. ",{"data":30091,"content":30092,"nodeType":881},{},[30093,30097],{"data":30094,"marks":30095,"value":30096,"nodeType":865},{},[],"Infostealers are notable because they’re an endpoint malware attack designed to harvest credentials and session tokens (often from the browser) to enable the attacker to then log into those services… through their own web browser. ",{"data":30098,"marks":30099,"value":30101,"nodeType":865},{},[30100],{"type":902},"So, even today’s endpoint attacks are seeing the attacker pivot back into the browser in order to get to identities — the key to the online apps and services where exploitable data and functionality now resides. ",{"data":30103,"content":30104,"nodeType":881},{},[30105],{"data":30106,"marks":30107,"value":30108,"nodeType":865},{},[],"The problem here is that this is a blind spot for the security tools we’re currently reliant upon — which don’t have the fine-grained visibility required. This is very similar to the challenge that the industry faced prior to the introduction of EDR in the 2010s — the main sources of data are looking from the outside-in, lacking the process-level visibility and context to be able to detect and stop attacks as they happen.",{"data":30110,"content":30114,"nodeType":890},{"target":30111},{"sys":30112},{"id":30113,"type":887,"linkType":888},"2qoMH6qCNJc7it7sTuKl4F",[],{"data":30116,"content":30117,"nodeType":894},{},[],{"data":30119,"content":30120,"nodeType":904},{},[30121],{"data":30122,"marks":30123,"value":30125,"nodeType":865},{},[30124],{"type":902},"Identity is the prize, browser is the platform — and phishing is the weapon of choice",{"data":30127,"content":30128,"nodeType":881},{},[30129,30133,30138],{"data":30130,"marks":30131,"value":30132,"nodeType":865},{},[],"But the technique that’s STILL driving the most impactful identity-driven breaches? ",{"data":30134,"marks":30135,"value":30137,"nodeType":865},{},[30136],{"type":902},"It’s phishing",{"data":30139,"marks":30140,"value":30141,"nodeType":865},{},[],". Phishing for credentials, sessions, OAuth consent, authorization codes. Phishing via email, instant messenger, social media, malicious Google ads… it all happens in, or leads to, the browser. ",{"data":30143,"content":30147,"nodeType":890},{"target":30144},{"sys":30145},{"id":30146,"type":887,"linkType":888},"6Gsd3G0sOibNxgVLimb2wV",[],{"data":30149,"content":30150,"nodeType":881},{},[30151],{"data":30152,"marks":30153,"value":30154,"nodeType":865},{},[],"And modern phishing attacks are more effective than ever. Today, phishing operates on an industrial scale, using an array of obfuscation and detection evasion techniques to block email and network security tools from intercepting them. Probably the most common example today is the use of bot protection (think CAPTCHA or Cloudflare Turnstile), using legitimate anti-spam features to block security tools. ",{"data":30156,"content":30160,"nodeType":890},{"target":30157},{"sys":30158},{"id":30159,"type":887,"linkType":888},"6M1My4lSKItu6Qdv4hO1RA",[],{"data":30162,"content":30163,"nodeType":881},{},[30164],{"data":30165,"marks":30166,"value":30167,"nodeType":865},{},[],"The latest generation of fully customized AitM phishing kits are dynamically obfuscating the code that loads the web page, implementing custom CAPTCHA, and using runtime anti-analysis features, making them increasingly difficult to detect. The ways in which links are delivered has also increased in sophistication, with more delivery channels (as we showed above) and the use of legitimate SaaS services for camouflage. ",{"data":30169,"content":30170,"nodeType":881},{},[30171,30175,30180,30184,30189,30193,30201],{"data":30172,"marks":30173,"value":30174,"nodeType":865},{},[],"And the latest trends indicate that attackers are responding to increasingly hardened IdP/SSO configuration by exploiting alternative phishing techniques that ",{"data":30176,"marks":30177,"value":30179,"nodeType":865},{},[30178],{"type":902},"circumvent MFA and passkeys",{"data":30181,"marks":30182,"value":30183,"nodeType":865},{},[],", most commonly by ",{"data":30185,"marks":30186,"value":30188,"nodeType":865},{},[30187],{"type":902},"downgrading to a phishable backup authentication method",{"data":30190,"marks":30191,"value":30192,"nodeType":865},{},[]," — which you can see in action below, and ",{"data":30194,"content":30195,"nodeType":876},{"uri":28715},[30196],{"data":30197,"marks":30198,"value":30200,"nodeType":865},{},[30199],{"type":874},"read more about here",{"data":30202,"marks":30203,"value":30204,"nodeType":865},{},[],".  ",{"data":30206,"content":30210,"nodeType":890},{"target":30207},{"sys":30208},{"id":30209,"type":887,"linkType":888},"54I3YQ2gK26a8FIocQ3WYT",[],{"data":30212,"content":30213,"nodeType":894},{},[],{"data":30215,"content":30216,"nodeType":904},{},[30217],{"data":30218,"marks":30219,"value":30221,"nodeType":865},{},[30220],{"type":902},"Identities are the lowest-hanging fruit for attackers to aim for",{"data":30223,"content":30224,"nodeType":881},{},[30225],{"data":30226,"marks":30227,"value":30228,"nodeType":865},{},[],"The goal of the modern attacker, and the easiest way into your business’s digital environment, is to compromise identities. Whether you’re dealing with phishing attacks, malicious browser extensions, or infostealer malware, the objective remains the same — account takeover. ",{"data":30230,"content":30231,"nodeType":881},{},[30232],{"data":30233,"marks":30234,"value":30235,"nodeType":865},{},[],"Organizations are dealing with a vast and vulnerable attack surface consisting of:",{"data":30237,"content":30238,"nodeType":1818},{},[30239,30261,30282,30303],{"data":30240,"content":30241,"nodeType":1734},{},[30242],{"data":30243,"content":30244,"nodeType":881},{},[30245,30248,30257],{"data":30246,"marks":30247,"value":21,"nodeType":865},{},[],{"data":30249,"content":30251,"nodeType":876},{"uri":30250},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/",[30252],{"data":30253,"marks":30254,"value":30256,"nodeType":865},{},[30255],{"type":874},"Hundreds of applications, with thousands of accounts",{"data":30258,"marks":30259,"value":30260,"nodeType":865},{},[]," spread across the app estate.",{"data":30262,"content":30263,"nodeType":1734},{},[30264],{"data":30265,"content":30266,"nodeType":881},{},[30267,30271,30279],{"data":30268,"marks":30269,"value":30270,"nodeType":865},{},[],"Accounts vulnerable to MFA-bypass phishing kits, because they are using a login method that is not phishing-resistant, or because ",{"data":30272,"content":30273,"nodeType":876},{"uri":28715},[30274],{"data":30275,"marks":30276,"value":30278,"nodeType":865},{},[30277],{"type":874},"the login method can be downgraded",{"data":30280,"marks":30281,"value":959,"nodeType":865},{},[],{"data":30283,"content":30284,"nodeType":1734},{},[30285],{"data":30286,"content":30287,"nodeType":881},{},[30288,30292,30299],{"data":30289,"marks":30290,"value":30291,"nodeType":865},{},[],"Accounts with a weak, reused, or breached password and no MFA altogether (usually the result of a forgotten-about ",{"data":30293,"content":30294,"nodeType":876},{"uri":11116},[30295],{"data":30296,"marks":30297,"value":16930,"nodeType":865},{},[30298],{"type":874},{"data":30300,"marks":30301,"value":30302,"nodeType":865},{},[],").",{"data":30304,"content":30305,"nodeType":1734},{},[30306],{"data":30307,"content":30308,"nodeType":881},{},[30309,30313,30322,30325,30334,30338,30345,30348,30357],{"data":30310,"marks":30311,"value":30312,"nodeType":865},{},[],"Bypassing the authentication process entirely to evade otherwise phishing-resistant authentication methods, by abusing features like ",{"data":30314,"content":30316,"nodeType":876},{"uri":30315},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/api_keys/description.md",[30317],{"data":30318,"marks":30319,"value":30321,"nodeType":865},{},[30320],{"type":874},"API key creation",{"data":30323,"marks":30324,"value":1877,"nodeType":865},{},[],{"data":30326,"content":30328,"nodeType":876},{"uri":30327},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/app_specific_password_phishing/description.md",[30329],{"data":30330,"marks":30331,"value":30333,"nodeType":865},{},[30332],{"type":874},"app-specific passwords",{"data":30335,"marks":30336,"value":30337,"nodeType":865},{},[],", OAuth ",{"data":30339,"content":30340,"nodeType":876},{"uri":18095},[30341],{"data":30342,"marks":30343,"value":7567,"nodeType":865},{},[30344],{"type":874},{"data":30346,"marks":30347,"value":1877,"nodeType":865},{},[],{"data":30349,"content":30351,"nodeType":876},{"uri":30350},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/cross-idp_impersonation/description.md",[30352],{"data":30353,"marks":30354,"value":30356,"nodeType":865},{},[30355],{"type":874},"cross-IdP impersonation",{"data":30358,"marks":30359,"value":30360,"nodeType":865},{},[],", and more.  ",{"data":30362,"content":30366,"nodeType":890},{"target":30363},{"sys":30364},{"id":30365,"type":887,"linkType":888},"3WFzina1t5j6bDlTlGQA0l",[],{"data":30368,"content":30369,"nodeType":881},{},[30370,30374,30383,30387,30394],{"data":30371,"marks":30372,"value":30373,"nodeType":865},{},[],"A key driver of identity vulnerability is the ",{"data":30375,"content":30377,"nodeType":876},{"uri":30376},"https://pushsecurity.com/blog/minimum-viable-identity-security/",[30378],{"data":30379,"marks":30380,"value":30382,"nodeType":865},{},[30381],{"type":874},"huge variance in the configurability of accounts per application",{"data":30384,"marks":30385,"value":30386,"nodeType":865},{},[],", with different levels of centralized visibility and security control of identities provided — for example, while one app can be locked down to only accept SSO logins via SAML and automatically remove any unused passwords, another provides no control or visibility of login method or MFA status (another big driver of the ",{"data":30388,"content":30389,"nodeType":876},{"uri":11103},[30390],{"data":30391,"marks":30392,"value":30085,"nodeType":865},{},[30393],{"type":874},{"data":30395,"marks":30396,"value":30397,"nodeType":865},{},[]," breaches last year). Unfortunately, as a by-product of product-led growth and something that is compounded by every new SaaS startup that hits the market, this situation doesn’t look like it’s going to change anytime soon. ",{"data":30399,"content":30400,"nodeType":881},{},[30401],{"data":30402,"marks":30403,"value":30404,"nodeType":865},{},[],"The end result is that identities are misconfigured, invisible to the security team, and routinely exploited by commodity attacker tooling. It’s no surprise that they’re the primary target for attackers today. ",{"data":30406,"content":30407,"nodeType":894},{},[],{"data":30409,"content":30410,"nodeType":904},{},[30411],{"data":30412,"marks":30413,"value":30415,"nodeType":865},{},[30414],{"type":902},"The solution: The browser as a telemetry source and control point",{"data":30417,"content":30418,"nodeType":881},{},[30419],{"data":30420,"marks":30421,"value":30422,"nodeType":865},{},[],"Because identity attacks play out in the browser, it’s the perfect place for security teams to observe, intercept, and shut down these attacks. ",{"data":30424,"content":30425,"nodeType":881},{},[30426],{"data":30427,"marks":30428,"value":30429,"nodeType":865},{},[],"The browser has a number of advantages over the different places where identity can be observed and protected, because:",{"data":30431,"content":30432,"nodeType":1818},{},[30433,30443,30453],{"data":30434,"content":30435,"nodeType":1734},{},[30436],{"data":30437,"content":30438,"nodeType":881},{},[30439],{"data":30440,"marks":30441,"value":30442,"nodeType":865},{},[],"You aren’t limited to the apps and identities directly connected to your IdP (a fraction of your workforce identity sprawl). ",{"data":30444,"content":30445,"nodeType":1734},{},[30446],{"data":30447,"content":30448,"nodeType":881},{},[30449],{"data":30450,"marks":30451,"value":30452,"nodeType":865},{},[],"You aren’t limited to the apps that you know about and manage centrally — you can observe every login that passes through the browser.",{"data":30454,"content":30455,"nodeType":1734},{},[30456],{"data":30457,"content":30458,"nodeType":881},{},[30459,30463,30468],{"data":30460,"marks":30461,"value":30462,"nodeType":865},{},[],"You can observe all the properties of a login, including the login method, MFA method, etc. You’d otherwise need API access to ",{"data":30464,"marks":30465,"value":30467,"nodeType":865},{},[30466],{"type":5120},"maybe",{"data":30469,"marks":30470,"value":30471,"nodeType":865},{},[]," get this information (depending on whether an API is provided and whether this specific data can be interrogated, also not standard for many apps). ",{"data":30473,"content":30474,"nodeType":881},{},[30475,30479,30484,30488,30496],{"data":30476,"marks":30477,"value":30478,"nodeType":865},{},[],"It’s obvious with all that we’ve covered so far that fixing every identity vulnerability is an ominous task — the SaaS ecosystem itself is working against you. ",{"data":30480,"marks":30481,"value":30483,"nodeType":865},{},[30482],{"type":902},"This is why detecting and responding to identity attacks is essential. ",{"data":30485,"marks":30486,"value":30487,"nodeType":865},{},[],"Because identity compromise almost always involves phishing or social engineering a user to perform an action in their browser (with some exceptions — like the ",{"data":30489,"content":30490,"nodeType":876},{"uri":11316},[30491],{"data":30492,"marks":30493,"value":30495,"nodeType":865},{},[30494],{"type":874},"Scattered Spider-related help desk attacks",{"data":30497,"marks":30498,"value":30499,"nodeType":865},{},[]," seen recently), it’s also the perfect place to monitor for and intercept attacks. ",{"data":30501,"content":30502,"nodeType":881},{},[30503],{"data":30504,"marks":30505,"value":30506,"nodeType":865},{},[],"In the browser, you gather deep, contextualized information about page behavior and user inputs that can be used to detect and shut down risky scenarios in real time. Take the example of phishing pages. Because Push operates in the browser, it sees everything:",{"data":30508,"content":30509,"nodeType":1818},{},[30510,30520,30530,30540,30563,30573],{"data":30511,"content":30512,"nodeType":1734},{},[30513],{"data":30514,"content":30515,"nodeType":881},{},[30516],{"data":30517,"marks":30518,"value":30519,"nodeType":865},{},[],"The page layout.",{"data":30521,"content":30522,"nodeType":1734},{},[30523],{"data":30524,"content":30525,"nodeType":881},{},[30526],{"data":30527,"marks":30528,"value":30529,"nodeType":865},{},[],"Where the user came from (through the whole redirect chain).",{"data":30531,"content":30532,"nodeType":1734},{},[30533],{"data":30534,"content":30535,"nodeType":881},{},[30536],{"data":30537,"marks":30538,"value":30539,"nodeType":865},{},[],"Page interaction events — e.g. tabs opened and closed, popup windows, forms submitted, etc.",{"data":30541,"content":30542,"nodeType":1734},{},[30543],{"data":30544,"content":30545,"nodeType":881},{},[30546,30550,30559],{"data":30547,"marks":30548,"value":30549,"nodeType":865},{},[],"The password they enter ",{"data":30551,"content":30553,"nodeType":876},{"uri":30552},"https://pushsecurity.com/help/10043/#how-push-securely-analyzes-passwords",[30554],{"data":30555,"marks":30556,"value":30558,"nodeType":865},{},[30557],{"type":874},"(as a salted, abbreviated hash)",{"data":30560,"marks":30561,"value":30562,"nodeType":865},{},[],", and whether a password was typed or copied, and where from.",{"data":30564,"content":30565,"nodeType":1734},{},[30566],{"data":30567,"content":30568,"nodeType":881},{},[30569],{"data":30570,"marks":30571,"value":30572,"nodeType":865},{},[],"What scripts are running on the page and whether they are potentially malicious.",{"data":30574,"content":30575,"nodeType":1734},{},[30576],{"data":30577,"content":30578,"nodeType":881},{},[30579],{"data":30580,"marks":30581,"value":30582,"nodeType":865},{},[],"Where credentials are being sent.",{"data":30584,"content":30588,"nodeType":890},{"target":30585},{"sys":30586},{"id":30587,"type":887,"linkType":888},"6kQejVS63FQ6Oy8nIm6UlV",[],{"data":30590,"content":30591,"nodeType":894},{},[],{"data":30593,"content":30594,"nodeType":904},{},[30595],{"data":30596,"marks":30597,"value":29161,"nodeType":865},{},[30598],{"type":902},{"data":30600,"content":30601,"nodeType":881},{},[30602],{"data":30603,"marks":30604,"value":30605,"nodeType":865},{},[],"Identity attacks are the biggest unsolved problem facing security teams today and the leading cause of security breaches. At the same time, the browser presents security teams with all the tools they need to prevent, detect, and respond to identity-based attacks — proactively by finding and fixing identity vulnerabilities, and reactively by detecting and blocking attacks against users in real time. ",{"data":30607,"content":30608,"nodeType":881},{},[30609,30613,30622],{"data":30610,"marks":30611,"value":30612,"nodeType":865},{},[],"Organizations need to move past the old ways of doing identity security — relying on MFA attestations, identity management dashboards, and ",{"data":30614,"content":30616,"nodeType":876},{"uri":30615},"https://pushsecurity.com/blog/three-reasons-why-browser-is-best-for-stopping-phishing-attacks/",[30617],{"data":30618,"marks":30619,"value":30621,"nodeType":865},{},[30620],{"type":874},"legacy email and network anti-phishing tools",{"data":30623,"marks":30624,"value":30625,"nodeType":865},{},[],". And there’s no better place to stop these attacks than in the browser. ",{"data":30627,"content":30628,"nodeType":894},{},[],{"data":30630,"content":30631,"nodeType":904},{},[30632],{"data":30633,"marks":30634,"value":30636,"nodeType":865},{},[30635],{"type":902},"Find out more",{"data":30638,"content":30639,"nodeType":881},{},[30640],{"data":30641,"marks":30642,"value":30643,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks identity attacks like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more.",{"data":30645,"content":30646,"nodeType":881},{},[30647,30651,30658],{"data":30648,"marks":30649,"value":30650,"nodeType":865},{},[],"If you want to learn more about how Push helps you to detect and stop attacks in the browser, ",{"data":30652,"content":30653,"nodeType":876},{"uri":1453},[30654],{"data":30655,"marks":30656,"value":4495,"nodeType":865},{},[30657],{"type":874},{"data":30659,"marks":30660,"value":959,"nodeType":865},{},[],{"entries":30662},{"hyperlink":30663,"inline":30664,"block":30665},[],[],[30666,30673,30679,30685,30691,30699,30703,30711],{"sys":30667,"__typename":7008,"title":30668,"caption":30668,"layoutMode":59,"file":30669},{"id":29935},"Attacks have shifted from targeting local networks to SaaS services, accessed through employee web browsers.",{"url":30670,"width":30671,"height":30672},"https://images.ctfassets.net/y1cdw1ablpvd/SadRsmdnNZofhrKddH01D/1ba16316bdfa666b2bc387d5b694e515/image2.png",1506,574,{"sys":30674,"__typename":1471,"type":1472,"ctaText":30675,"buttonLabel":30676,"buttonColour":30677,"buttonUrl":30678},{"id":29987},"Read how the transformation of business IT has shaped the evolution of phishing attacks in our latest whitepaper.","Download Now","sea blue","https://pushsecurity.com/resources/phishing-evolution",{"sys":30680,"__typename":7008,"title":30681,"caption":30681,"layoutMode":59,"file":30682},{"id":30113},"EDR solved endpoint attacks by getting deep visibility into OS-level processes and activity — we now face a similar visibility problem in the browser. ",{"url":30683,"width":7012,"height":30684},"https://images.ctfassets.net/y1cdw1ablpvd/2KuUuYKf2Q9TlIJ9fkOI82/9a52cae72564e69d3cfe8b3b613eb950/image5.png",632,{"sys":30686,"__typename":7008,"title":30687,"caption":30687,"layoutMode":59,"file":30688},{"id":30146},"Phishing is now multi- and cross-channel, targeting a vast range of cloud and SaaS apps using flexible AitM toolkits — but all roads inevitably lead to the browser.",{"url":30689,"width":7012,"height":30690},"https://images.ctfassets.net/y1cdw1ablpvd/4p8sf1x8PfWF06ndwTsdf9/136ed45c7912459a70dbb53b62cf5a90/image6.png",1003,{"sys":30692,"__typename":7008,"title":30693,"caption":30694,"layoutMode":59,"file":30695},{"id":30159},"Cloudflare Turnstile is a simple way for attackers to block automated analysis of their phishing kits — it should probably come with a trigger warning for incident responders.","Cloudflare Turnstile is a simple way for security teams to prevent automated analysis — it should probably come with a trigger warning for incident responders.",{"url":30696,"width":30697,"height":30698},"https://images.ctfassets.net/y1cdw1ablpvd/6gGDHL1jECCm4j02gZZlYe/92e4362eea9fb712aeb64bdd7fb19d59/image3.png",1262,464,{"sys":30700,"__typename":7100,"title":30701,"arcadeDemoUrl":30702,"playText":7102},{"id":30209},"MFA Downgrade Demo","https://demo.arcade.software/1MzRfFaRCD2pYPhIXkvi?embed",{"sys":30704,"__typename":7008,"title":30705,"caption":30706,"layoutMode":59,"file":30707},{"id":30365},"Infographic showing the identity vulnerability spread for a 1,000 seat organization","A 1,000 user organization has over 15,000 accounts with various configurations and associated vulnerabilities.",{"url":30708,"width":30709,"height":30710},"https://images.ctfassets.net/y1cdw1ablpvd/266iLQBVsJIQEx6dnUEVrZ/eb5b1be79b7b29365baf299053fddf42/Infographic.png",5480,3012,{"sys":30712,"__typename":7008,"title":30713,"caption":30713,"layoutMode":59,"file":30714},{"id":30587},"Being in the browser gives you unrivalled visibility of phishing page activity and user behavior.",{"url":30715,"width":30716,"height":30717},"https://images.ctfassets.net/y1cdw1ablpvd/42mmDkjfXn0uOkTyvFLNqG/0385dadcb0731bea1de1ca5ae6ee7c18/image1.png",1560,766,{"items":30719},[],{},"Why the browser is now the main cyber attack surface","2025-08-15T00:00:00.000Z",{"items":30724},[30725,31727,32089],{"__typename":1485,"sys":30726,"content":30727,"title":31713,"synopsis":31714,"hashTags":59,"publishedDate":31715,"slug":31716,"tagsCollection":31717,"authorsCollection":31723},{"id":19299},{"json":30728},{"data":30729,"content":30730,"nodeType":1463},{},[30731,30738,30750,30762,30774,30786,30792,30812,30819,30835,30842,30848,30851,30859,30866,30873,30880,30886,30889,30897,30904,30924,30931,30938,30945,30952,30958,30965,30972,30979,31008,31015,31033,31040,31047,31067,31087,31107,31113,31120,31136,31143,31150,31157,31176,31184,31191,31198,31201,31209,31216,31223,31230,31273,31279,31286,31301,31390,31396,31403,31410,31473,31480,31487,31494,31500,31507,31514,31521,31527,31534,31541,31548,31554,31573,31580,31587,31630,31636,31639,31647,31671,31674,31681,31688,31695],{"data":30732,"content":30733,"nodeType":881},{},[30734],{"data":30735,"marks":30736,"value":30737,"nodeType":865},{},[],"Oh, look! A time capsule from 2010. Wonder what’s inside … ",{"data":30739,"content":30740,"nodeType":881},{},[30741,30746],{"data":30742,"marks":30743,"value":30745,"nodeType":865},{},[30744],{"type":902},"Listening to:",{"data":30747,"marks":30748,"value":30749,"nodeType":865},{},[]," “Like a G6” by Far East Movement (on a Nokia C7 — hey, it even had a touchscreen).",{"data":30751,"content":30752,"nodeType":881},{},[30753,30758],{"data":30754,"marks":30755,"value":30757,"nodeType":865},{},[30756],{"type":902},"Major news event:",{"data":30759,"marks":30760,"value":30761,"nodeType":865},{},[]," Eyjafjallajökull volcano erupts in Iceland, disrupting air travel.",{"data":30763,"content":30764,"nodeType":881},{},[30765,30770],{"data":30766,"marks":30767,"value":30769,"nodeType":865},{},[30768],{"type":902},"Worried about:",{"data":30771,"marks":30772,"value":30773,"nodeType":865},{},[]," Exploitable Flash browser plugins and static HTML phishing sites.",{"data":30775,"content":30776,"nodeType":881},{},[30777,30782],{"data":30778,"marks":30779,"value":30781,"nodeType":865},{},[30780],{"type":902},"How to be a hero?",{"data":30783,"marks":30784,"value":30785,"nodeType":865},{},[]," Roll out the latest AV, implement a web proxy, and add a “report phishing” button to your email solution.",{"data":30787,"content":30791,"nodeType":890},{"target":30788},{"sys":30789},{"id":30790,"type":887,"linkType":888},"54xYbMs0ii96xb2jgQVX9m",[],{"data":30793,"content":30794,"nodeType":881},{},[30795,30799,30808],{"data":30796,"marks":30797,"value":30798,"nodeType":865},{},[],"We’re halfway through 2025, and the time capsule for this year may need to be an XL when it comes to ",{"data":30800,"content":30802,"nodeType":876},{"uri":30801},"https://pushsecurity.com/blog/scattered-spider-ttp-evolution-in-2025/",[30803],{"data":30804,"marks":30805,"value":30807,"nodeType":865},{},[30806],{"type":874},"how much has happened",{"data":30809,"marks":30810,"value":30811,"nodeType":865},{},[]," in the world of browser-based attacks. (Yet fittingly, Drake’s “Nokia” is a pop hit.)",{"data":30813,"content":30814,"nodeType":881},{},[30815],{"data":30816,"marks":30817,"value":30818,"nodeType":865},{},[],"While at least we don’t have to worry about Flash anymore, the browser is now the new battleground, and workforce identities are the most common target. Security teams are struggling with approaches and tools that attackers have outpaced.",{"data":30820,"content":30821,"nodeType":881},{},[30822,30826,30831],{"data":30823,"marks":30824,"value":30825,"nodeType":865},{},[],"In this article, we’ll cover how browser-based attacks have evolved, and how Push is taking a new approach with the release of our ",{"data":30827,"marks":30828,"value":30830,"nodeType":865},{},[30829],{"type":902},"Detections",{"data":30832,"marks":30833,"value":30834,"nodeType":865},{},[]," capabilities, now generally available to all customers.",{"data":30836,"content":30837,"nodeType":881},{},[30838],{"data":30839,"marks":30840,"value":30841,"nodeType":865},{},[],"Push Detections use real-time telemetry to help you understand context, user behavior, and attacker techniques, and then respond — a modern tool for modern browser-based attacks.",{"data":30843,"content":30847,"nodeType":890},{"target":30844},{"sys":30845},{"id":30846,"type":887,"linkType":888},"2ULDSj85bXtT2OgpXKBHtB",[],{"data":30849,"content":30850,"nodeType":894},{},[],{"data":30852,"content":30853,"nodeType":904},{},[30854],{"data":30855,"marks":30856,"value":30858,"nodeType":865},{},[30857],{"type":902},"The old world vs. the new world",{"data":30860,"content":30861,"nodeType":881},{},[30862],{"data":30863,"marks":30864,"value":30865,"nodeType":865},{},[],"In the early 2010s, the typical attack path involved sending a user an email with a link to a static HTML webpage (most commonly a generic Exchange Web Access clone) that tricked them into giving you Active Directory creds. These could be used to log in to an exposed remote desktop service or the victim’s mailbox, giving the attacker a foothold to install malware. Anyone who’s done “red teaming 101” will recognize this scenario. ",{"data":30867,"content":30868,"nodeType":881},{},[30869],{"data":30870,"marks":30871,"value":30872,"nodeType":865},{},[],"A compromised identity was once just part of a system compromise. That meant the scope of detection and response was focused on the organization’s Active Directory domain, correlated with endpoint and network logs. ",{"data":30874,"content":30875,"nodeType":881},{},[30876],{"data":30877,"marks":30878,"value":30879,"nodeType":865},{},[],"But now, identity attacks happen beyond traditional on-premises networks, impacting cloud identities that are created, used, and attacked in the browser. What was once the familiar backbone of business IT — internal apps and thick clients — has been replaced with a sprawling cloud and SaaS ecosystem that can be targeted directly via identity, without touching the endpoint. ",{"data":30881,"content":30885,"nodeType":890},{"target":30882},{"sys":30883},{"id":30884,"type":887,"linkType":888},"2F2p4eTMCHo3LfNQJZeGWB",[],{"data":30887,"content":30888,"nodeType":894},{},[],{"data":30890,"content":30891,"nodeType":904},{},[30892],{"data":30893,"marks":30894,"value":30896,"nodeType":865},{},[30895],{"type":902},"Why detection and response hasn’t kept up with threat evolution",{"data":30898,"content":30899,"nodeType":881},{},[30900],{"data":30901,"marks":30902,"value":30903,"nodeType":865},{},[],"This shift in attacker TTPs is forcing a change in how we handle detection and response. ",{"data":30905,"content":30906,"nodeType":881},{},[30907,30911,30920],{"data":30908,"marks":30909,"value":30910,"nodeType":865},{},[],"But a lot of organizations are still applying the same old playbooks to this new world where identity attacks are the ",{"data":30912,"content":30914,"nodeType":876},{"uri":30913},"https://pushsecurity.com/resources/2024-identity-attacks",[30915],{"data":30916,"marks":30917,"value":30919,"nodeType":865},{},[30918],{"type":874},"leading cause of breaches",{"data":30921,"marks":30922,"value":30923,"nodeType":865},{},[],", with uneven outcomes. ",{"data":30925,"content":30926,"nodeType":881},{},[30927],{"data":30928,"marks":30929,"value":30930,"nodeType":865},{},[],"This isn’t because of a lack of effort or skill on the part of security teams. It’s a reflection of the tools that have been available. ",{"data":30932,"content":30933,"nodeType":881},{},[30934],{"data":30935,"marks":30936,"value":30937,"nodeType":865},{},[],"Let’s look at some of the ways detection and response hasn’t kept up with the evolution of browser-borne threats in this new landscape.",{"data":30939,"content":30940,"nodeType":1860},{},[30941],{"data":30942,"marks":30943,"value":30944,"nodeType":865},{},[],"Incomplete identity visibility ",{"data":30946,"content":30947,"nodeType":881},{},[30948],{"data":30949,"marks":30950,"value":30951,"nodeType":865},{},[],"Today’s cloud identity providers see a fraction of the overall logins your users make to online apps, compared to the comprehensive visibility of Active Directory in the old world. You don’t know where users are logging in, how they’re logging in, or whether these logins are securely using phishing-resistant methods.",{"data":30953,"content":30957,"nodeType":890},{"target":30954},{"sys":30955},{"id":30956,"type":887,"linkType":888},"1SUYueQct7dtWwLh3AaAtA",[],{"data":30959,"content":30960,"nodeType":881},{},[30961],{"data":30962,"marks":30963,"value":30964,"nodeType":865},{},[],"This means that identity attacks are routinely bypassing preventative, account hygiene-based controls, putting the strain on detection and response. ",{"data":30966,"content":30967,"nodeType":1860},{},[30968],{"data":30969,"marks":30970,"value":30971,"nodeType":865},{},[],"Limited detection coverage ",{"data":30973,"content":30974,"nodeType":881},{},[30975],{"data":30976,"marks":30977,"value":30978,"nodeType":865},{},[],"Email and network security tools got pretty good at intercepting old-school phishing attacks like the ones from our proverbial time capsule: static HTML pages delivered over email that could be intercepted and analyzed when entering the mailbox or being loaded by the user. ",{"data":30980,"content":30981,"nodeType":881},{},[30982,30986,30996,31000,31004],{"data":30983,"marks":30984,"value":30985,"nodeType":865},{},[],"But with modern phishing attacks dynamically obfuscating the code that loads the web page, implementing custom bot protection, and using runtime anti-analysis features, they’re ",{"data":30987,"content":30989,"nodeType":876},{"uri":30988},"https://pushsecurity.com/blog/why-most-phishing-attacks-feel-like-a-zero-day/",[30990],{"data":30991,"marks":30992,"value":30995,"nodeType":865},{},[30993,30994],{"type":874},{"type":902},"increasingly difficult to detect",{"data":30997,"marks":30998,"value":2091,"nodeType":865},{},[30999],{"type":902},{"data":31001,"marks":31002,"value":31003,"nodeType":865},{},[],"using conventional tools",{"data":31005,"marks":31006,"value":29975,"nodeType":865},{},[31007],{"type":902},{"data":31009,"content":31010,"nodeType":881},{},[31011],{"data":31012,"marks":31013,"value":31014,"nodeType":865},{},[],"Of course, email-based detections aren’t much use if attackers are using legitimate services to camouflage their links, or bypassing email altogether by switching to alternative delivery channels like messaging apps (such as Slack and Teams), as well as public services like LinkedIn and Reddit. ",{"data":31016,"content":31017,"nodeType":881},{},[31018,31022,31029],{"data":31019,"marks":31020,"value":31021,"nodeType":865},{},[],"More recently, groups like ",{"data":31023,"content":31024,"nodeType":876},{"uri":30801},[31025],{"data":31026,"marks":31027,"value":19950,"nodeType":865},{},[31028],{"type":874},{"data":31030,"marks":31031,"value":31032,"nodeType":865},{},[]," have even been seen using malvertising techniques, delivering phishing links masquerading as paid Google ads.",{"data":31034,"content":31035,"nodeType":1860},{},[31036],{"data":31037,"marks":31038,"value":31039,"nodeType":865},{},[],"Inadequate security logs",{"data":31041,"content":31042,"nodeType":881},{},[31043],{"data":31044,"marks":31045,"value":31046,"nodeType":865},{},[],"If you fail to spot the attack pre-account takeover, you’re reliant on being able to detect and investigate suspicious or malicious activity resulting from the compromise. ",{"data":31048,"content":31049,"nodeType":881},{},[31050,31054,31063],{"data":31051,"marks":31052,"value":31053,"nodeType":865},{},[],"This was more straightforward (if not easy) when you had the luxury of a ",{"data":31055,"content":31057,"nodeType":876},{"uri":31056},"https://pushsecurity.com/blog/shifting-detection-left-for-more-effective-itdr/",[31058],{"data":31059,"marks":31060,"value":31062,"nodeType":865},{},[31061],{"type":874},"typical on-prem network to fall back",{"data":31064,"marks":31065,"value":31066,"nodeType":865},{},[]," on. But with cloud exploitation taking place in a matter of minutes, you don’t get much warning — and your endpoint and network-based alarms can’t help you. ",{"data":31068,"content":31069,"nodeType":881},{},[31070,31074,31083],{"data":31071,"marks":31072,"value":31073,"nodeType":865},{},[],"The situation is further complicated by the fact that you simply don’t have the logs you need because of the huge variability in how cloud and SaaS services provide logs (with many ",{"data":31075,"content":31077,"nodeType":876},{"uri":31076},"https://pushsecurity.com/blog/minimum-viable-identity-security/#id-enable-security-teams-to-detect-and-respond-to-identity-attacks",[31078],{"data":31079,"marks":31080,"value":31082,"nodeType":865},{},[31081],{"type":874},"failing to provide security logs",{"data":31084,"marks":31085,"value":31086,"nodeType":865},{},[]," with relevant data points at all). So chances are you’re flying blind when it comes to large chunks of your business app suite. ",{"data":31088,"content":31089,"nodeType":881},{},[31090,31094,31103],{"data":31091,"marks":31092,"value":31093,"nodeType":865},{},[],"Ultimately, you’re stuck with what you can observe — typically network traffic. But ",{"data":31095,"content":31097,"nodeType":876},{"uri":31096},"https://pushsecurity.com/blog/the-web-proxy-is-dead-long-live-the-browser-extension/",[31098],{"data":31099,"marks":31100,"value":31102,"nodeType":865},{},[31101],{"type":874},"even with a TLS-terminating proxy",{"data":31104,"marks":31105,"value":31106,"nodeType":865},{},[],", extracting fine-grained identity data points isn’t really achievable. You’re looking from the outside-in at malicious activity that’s happening in the user’s browser and trying to infer what happened.  ",{"data":31108,"content":31112,"nodeType":890},{"target":31109},{"sys":31110},{"id":31111,"type":887,"linkType":888},"7FMdHtbE63GMCavObETf3O",[],{"data":31114,"content":31115,"nodeType":1860},{},[31116],{"data":31117,"marks":31118,"value":31119,"nodeType":865},{},[],"Spotty control enforcement",{"data":31121,"content":31122,"nodeType":881},{},[31123,31127,31132],{"data":31124,"marks":31125,"value":31126,"nodeType":865},{},[],"And in the case that you do identify that a user clicked a malicious link and ",{"data":31128,"marks":31129,"value":31131,"nodeType":865},{},[31130],{"type":5120},"maybe ",{"data":31133,"marks":31134,"value":31135,"nodeType":865},{},[],"entered their credentials into the page — now what? ",{"data":31137,"content":31138,"nodeType":881},{},[31139],{"data":31140,"marks":31141,"value":31142,"nodeType":865},{},[],"You can reset the account in the affected app, ideally terminating active sessions — which may or may not be possible, depending on the app. This might take a while if you don’t centrally manage the app, and involve some painful emergency phone calls to employees. ",{"data":31144,"content":31145,"nodeType":881},{},[31146],{"data":31147,"marks":31148,"value":31149,"nodeType":865},{},[],"What about apps where the same password is reused? ",{"data":31151,"content":31152,"nodeType":881},{},[31153],{"data":31154,"marks":31155,"value":31156,"nodeType":865},{},[],"Or if it’s an IdP account used for SSO, what about the other apps that might be accessible now? ",{"data":31158,"content":31159,"nodeType":881},{},[31160,31164,31172],{"data":31161,"marks":31162,"value":31163,"nodeType":865},{},[],"If the attacker has created stealthy backdoors that persist through credential changes (like ",{"data":31165,"content":31166,"nodeType":876},{"uri":11116},[31167],{"data":31168,"marks":31169,"value":31171,"nodeType":865},{},[31170],{"type":874},"creating an API key or a malicious OAuth integration",{"data":31173,"marks":31174,"value":31175,"nodeType":865},{},[],") they could still be lurking in your environment.",{"data":31177,"content":31178,"nodeType":881},{},[31179],{"data":31180,"marks":31181,"value":31183,"nodeType":865},{},[31182],{"type":902},"Suddenly, you’re not dealing with one possible control point, you’re dealing with several. ",{"data":31185,"content":31186,"nodeType":881},{},[31187],{"data":31188,"marks":31189,"value":31190,"nodeType":865},{},[],"And if you can’t trace the attack back to a source — because your email solution missed it, or it didn’t come via email, how can you triage the impact to other users? ",{"data":31192,"content":31193,"nodeType":881},{},[31194],{"data":31195,"marks":31196,"value":31197,"nodeType":865},{},[],"It’s no wonder that security teams are struggling to adapt. ",{"data":31199,"content":31200,"nodeType":894},{},[],{"data":31202,"content":31203,"nodeType":904},{},[31204],{"data":31205,"marks":31206,"value":31208,"nodeType":865},{},[31207],{"type":902},"How Push is solving modern identity investigations in the browser",{"data":31210,"content":31211,"nodeType":881},{},[31212],{"data":31213,"marks":31214,"value":31215,"nodeType":865},{},[],"The good news? We’ve seen this phenomenon play out before: In the early 2010s, in fact, when AV evolved into EDR. What was the big innovation then? Getting inside the data stream, in real time, and detecting and responding from a much higher-fidelity source of telemetry.",{"data":31217,"content":31218,"nodeType":881},{},[31219],{"data":31220,"marks":31221,"value":31222,"nodeType":865},{},[],"This time around, security teams need tools that take them inside the browser layer.",{"data":31224,"content":31225,"nodeType":881},{},[31226],{"data":31227,"marks":31228,"value":31229,"nodeType":865},{},[],"This approach gives you the right vantage point to defend against and investigate browser-based identity attacks, providing access to:",{"data":31231,"content":31232,"nodeType":1818},{},[31233,31243,31253,31263],{"data":31234,"content":31235,"nodeType":1734},{},[31236],{"data":31237,"content":31238,"nodeType":881},{},[31239],{"data":31240,"marks":31241,"value":31242,"nodeType":865},{},[],"Full decrypted HTTP traffic — not just DNS and TCP/IP metadata",{"data":31244,"content":31245,"nodeType":1734},{},[31246],{"data":31247,"content":31248,"nodeType":881},{},[31249],{"data":31250,"marks":31251,"value":31252,"nodeType":865},{},[],"Full user interaction tracing — every click, keystroke, or DOM change",{"data":31254,"content":31255,"nodeType":1734},{},[31256],{"data":31257,"content":31258,"nodeType":881},{},[31259],{"data":31260,"marks":31261,"value":31262,"nodeType":865},{},[],"Full inspection at every layer of execution, not just the initial HTML served",{"data":31264,"content":31265,"nodeType":1734},{},[31266],{"data":31267,"content":31268,"nodeType":881},{},[31269],{"data":31270,"marks":31271,"value":31272,"nodeType":865},{},[],"Full access to browser APIs, to correlate with browser history, local storage, cookies, etc.",{"data":31274,"content":31278,"nodeType":890},{"target":31275},{"sys":31276},{"id":31277,"type":887,"linkType":888},"5qt0s8e1TIEUxhU1GzFO63",[],{"data":31280,"content":31281,"nodeType":881},{},[31282],{"data":31283,"marks":31284,"value":31285,"nodeType":865},{},[],"With this data, teams have the information they need to respond to and investigate browser-based attacks. But to become valuable, this data needs a translation layer that turns it from raw logs into actionable information.",{"data":31287,"content":31288,"nodeType":881},{},[31289,31293,31297],{"data":31290,"marks":31291,"value":31292,"nodeType":865},{},[],"That’s where Push’s ",{"data":31294,"marks":31295,"value":30830,"nodeType":865},{},[31296],{"type":902},{"data":31298,"marks":31299,"value":31300,"nodeType":865},{},[]," capability comes in. With it, you can:",{"data":31302,"content":31303,"nodeType":1818},{},[31304,31340,31350,31360,31370,31380],{"data":31305,"content":31306,"nodeType":1734},{},[31307],{"data":31308,"content":31309,"nodeType":881},{},[31310,31314,31323,31327,31336],{"data":31311,"marks":31312,"value":31313,"nodeType":865},{},[],"Get alerted in your platform of choice (via the Push admin console, ",{"data":31315,"content":31317,"nodeType":876},{"uri":31316},"https://pushsecurity.com/help/audience/administrators/docs/connect-to-siem-or-soar/send-webhook-events-to-slack/",[31318],{"data":31319,"marks":31320,"value":31322,"nodeType":865},{},[31321],{"type":874},"Slack integration",{"data":31324,"marks":31325,"value":31326,"nodeType":865},{},[],", or your ",{"data":31328,"content":31330,"nodeType":876},{"uri":31329},"https://pushsecurity.com/help/audience/administrators/docs/connect-to-siem-or-soar/",[31331],{"data":31332,"marks":31333,"value":31335,"nodeType":865},{},[31334],{"type":874},"SIEM/SOAR",{"data":31337,"marks":31338,"value":31339,"nodeType":865},{},[]," of choice) whenever Push detects a browser-based attack, such as AiTM phishing or a cloned login page.",{"data":31341,"content":31342,"nodeType":1734},{},[31343],{"data":31344,"content":31345,"nodeType":881},{},[31346],{"data":31347,"marks":31348,"value":31349,"nodeType":865},{},[],"Review a curated timeline of the incident: Where a phishing link originated; whether a user entered their credentials on the page; what kind of phishkit was used; and whether the attack was blocked by Push.",{"data":31351,"content":31352,"nodeType":1734},{},[31353],{"data":31354,"content":31355,"nodeType":881},{},[31356],{"data":31357,"marks":31358,"value":31359,"nodeType":865},{},[],"See all the other impacted accounts and apps that shared a password with the phished account so you can remediate them.",{"data":31361,"content":31362,"nodeType":1734},{},[31363],{"data":31364,"content":31365,"nodeType":881},{},[31366],{"data":31367,"marks":31368,"value":31369,"nodeType":865},{},[],"See a screenshot captured by the Push browser extension of the phishing page, so you can see exactly what the user saw before the page disappears.",{"data":31371,"content":31372,"nodeType":1734},{},[31373],{"data":31374,"content":31375,"nodeType":881},{},[31376],{"data":31377,"marks":31378,"value":31379,"nodeType":865},{},[],"Get additional context from urlscan.io about the domains connected to the incident, helping you understand whether a domain has been reported as malicious by other users, when it was registered, and how many times it’s been scanned.",{"data":31381,"content":31382,"nodeType":1734},{},[31383],{"data":31384,"content":31385,"nodeType":881},{},[31386],{"data":31387,"marks":31388,"value":31389,"nodeType":865},{},[],"Interrogate and send this telemetry to your SIEM for you to operationalize it as part of SecOps workflows and hunt across events for similar incident characteristics.",{"data":31391,"content":31395,"nodeType":890},{"target":31392},{"sys":31393},{"id":31394,"type":887,"linkType":888},"5iPYWpPx4IZ2M1DykQiWsN",[],{"data":31397,"content":31398,"nodeType":1860},{},[31399],{"data":31400,"marks":31401,"value":31402,"nodeType":865},{},[],"Browser context",{"data":31404,"content":31405,"nodeType":881},{},[31406],{"data":31407,"marks":31408,"value":31409,"nodeType":865},{},[],"With Push, there’s no more: ",{"data":31411,"content":31412,"nodeType":1818},{},[31413,31423,31433,31443,31453,31463],{"data":31414,"content":31415,"nodeType":1734},{},[31416],{"data":31417,"content":31418,"nodeType":881},{},[31419],{"data":31420,"marks":31421,"value":31422,"nodeType":865},{},[],"Waiting (and hoping) that a browser-based attack gets recognized and reported by a user.",{"data":31424,"content":31425,"nodeType":1734},{},[31426],{"data":31427,"content":31428,"nodeType":881},{},[31429],{"data":31430,"marks":31431,"value":31432,"nodeType":865},{},[],"Guesswork as to exactly what happened on the phishing page. ",{"data":31434,"content":31435,"nodeType":1734},{},[31436],{"data":31437,"content":31438,"nodeType":881},{},[31439],{"data":31440,"marks":31441,"value":31442,"nodeType":865},{},[],"Struggling to get your hands on a live version of the page to see if it was actually malicious and getting thwarted because the attacker used a one-time phishing link. ",{"data":31444,"content":31445,"nodeType":1734},{},[31446],{"data":31447,"content":31448,"nodeType":881},{},[31449],{"data":31450,"marks":31451,"value":31452,"nodeType":865},{},[],"Manually tracing the attack to see if it arrived by email so you can quarantine the messages. ",{"data":31454,"content":31455,"nodeType":1734},{},[31456],{"data":31457,"content":31458,"nodeType":881},{},[31459],{"data":31460,"marks":31461,"value":31462,"nodeType":865},{},[],"Trawling through voluminous proxy logs for scraps of information (who else visited the link; where did it originate; etc.).",{"data":31464,"content":31465,"nodeType":1734},{},[31466],{"data":31467,"content":31468,"nodeType":881},{},[31469],{"data":31470,"marks":31471,"value":31472,"nodeType":865},{},[],"Spending precious time on urlscan or VirusTotal to get basic context on a domain or IP address. ",{"data":31474,"content":31475,"nodeType":881},{},[31476],{"data":31477,"marks":31478,"value":31479,"nodeType":865},{},[],"Instead, Push gives you all the information you need in one place to investigate and respond. ",{"data":31481,"content":31482,"nodeType":881},{},[31483],{"data":31484,"marks":31485,"value":31486,"nodeType":865},{},[],"The foundation for these detections is the Push browser agent, which can be silently installed in all major browsers in your environment to begin streaming information about a user’s entire identity footprint. ",{"data":31488,"content":31489,"nodeType":881},{},[31490],{"data":31491,"marks":31492,"value":31493,"nodeType":865},{},[],"This valuable telemetry, combined with Push’s out-of-the-box controls and detections, gives you a seat on the user’s side of the equation, capturing reliable information about network requests, scripts loaded by a malicious website, and what a user clicked and navigated to: the ingredients for showing you how a browser-based attack unfolded, start to finish.",{"data":31495,"content":31499,"nodeType":890},{"target":31496},{"sys":31497},{"id":31498,"type":887,"linkType":888},"7ylgcaNDrxYhw7bULixM1C",[],{"data":31501,"content":31502,"nodeType":881},{},[31503],{"data":31504,"marks":31505,"value":31506,"nodeType":865},{},[],"Push raises a detection when it observes a phishing attack or when a user attempts to visit a blocked URL. You can view detections in the Push admin console, or send them to your SIEM or SOAR for correlation and analysis.",{"data":31508,"content":31509,"nodeType":1860},{},[31510],{"data":31511,"marks":31512,"value":31513,"nodeType":865},{},[],"Screenshot capture",{"data":31515,"content":31516,"nodeType":881},{},[31517],{"data":31518,"marks":31519,"value":31520,"nodeType":865},{},[],"The Push extension can also capture a screenshot at the time of a detection firing. This means security teams can see the visual characteristics of the page even if it’s since been taken down (and no more looking at bot protection screens like Cloudflare Turnstile on urlscan). ",{"data":31522,"content":31526,"nodeType":890},{"target":31523},{"sys":31524},{"id":31525,"type":887,"linkType":888},"58HPrc7wImm3mLxPK0yJOG",[],{"data":31528,"content":31529,"nodeType":1860},{},[31530],{"data":31531,"marks":31532,"value":31533,"nodeType":865},{},[],"Blast radius analysis for all impacted accounts & apps",{"data":31535,"content":31536,"nodeType":881},{},[31537],{"data":31538,"marks":31539,"value":31540,"nodeType":865},{},[],"With Push’s knowledge of your workforce identities — based on observing logins in the browser that use corporate credentials — the platform can also provide an analysis of the blast radius of an attack by showing you where other accounts and apps are impacted or at risk.",{"data":31542,"content":31543,"nodeType":881},{},[31544],{"data":31545,"marks":31546,"value":31547,"nodeType":865},{},[],"This information helps you understand the true impact of an incident so you can remediate all affected accounts.",{"data":31549,"content":31553,"nodeType":890},{"target":31550},{"sys":31551},{"id":31552,"type":887,"linkType":888},"77e8XMl2Rb0p7ZrG2wmURO",[],{"data":31555,"content":31556,"nodeType":881},{},[31557,31561,31569],{"data":31558,"marks":31559,"value":31560,"nodeType":865},{},[],"Push is able to provide this blast radius analysis by ",{"data":31562,"content":31563,"nodeType":876},{"uri":30552},[31564],{"data":31565,"marks":31566,"value":31568,"nodeType":865},{},[31567],{"type":874},"securely fingerprinting users’ passwords",{"data":31570,"marks":31571,"value":31572,"nodeType":865},{},[]," when a login is observed; analyzing them for security posture issues such as missing MFA, or stolen, weak, or reused passwords; and then raising that relevant context for a given detection.",{"data":31574,"content":31575,"nodeType":1860},{},[31576],{"data":31577,"marks":31578,"value":31579,"nodeType":865},{},[],"Correlated context from urlscan.io",{"data":31581,"content":31582,"nodeType":881},{},[31583],{"data":31584,"marks":31585,"value":31586,"nodeType":865},{},[],"Finally, through an integration with urlscan.io, Push is able to provide additional context about the domains involved in a detection event, including:",{"data":31588,"content":31589,"nodeType":1818},{},[31590,31600,31610,31620],{"data":31591,"content":31592,"nodeType":1734},{},[31593],{"data":31594,"content":31595,"nodeType":881},{},[31596],{"data":31597,"marks":31598,"value":31599,"nodeType":865},{},[],"When they were created",{"data":31601,"content":31602,"nodeType":1734},{},[31603],{"data":31604,"content":31605,"nodeType":881},{},[31606],{"data":31607,"marks":31608,"value":31609,"nodeType":865},{},[],"How many times they have previously been scanned",{"data":31611,"content":31612,"nodeType":1734},{},[31613],{"data":31614,"content":31615,"nodeType":881},{},[31616],{"data":31617,"marks":31618,"value":31619,"nodeType":865},{},[],"When they were last scanned",{"data":31621,"content":31622,"nodeType":1734},{},[31623],{"data":31624,"content":31625,"nodeType":881},{},[31626],{"data":31627,"marks":31628,"value":31629,"nodeType":865},{},[],"If urlscan has marked them as suspicious",{"data":31631,"content":31635,"nodeType":890},{"target":31632},{"sys":31633},{"id":31634,"type":887,"linkType":888},"2AKpAk65XdmaGBfe2V4qZ5",[],{"data":31637,"content":31638,"nodeType":894},{},[],{"data":31640,"content":31641,"nodeType":904},{},[31642],{"data":31643,"marks":31644,"value":31646,"nodeType":865},{},[31645],{"type":902},"Check out our latest webinar for practical guidance in real-world scenarios",{"data":31648,"content":31649,"nodeType":881},{},[31650,31654,31663,31666],{"data":31651,"marks":31652,"value":31653,"nodeType":865},{},[],"For practical advice and applied examples of how to use Push data in incident response — as well as some bonus examples of automated response and remediation use cases — ",{"data":31655,"content":31657,"nodeType":876},{"uri":31656},"https://pushsecurity.com/webinar/identity-detection-response",[31658],{"data":31659,"marks":31660,"value":31662,"nodeType":865},{},[31661],{"type":874},"join us live on August 13 for our webinar",{"data":31664,"marks":31665,"value":1877,"nodeType":865},{},[],{"data":31667,"marks":31668,"value":31670,"nodeType":865},{},[31669],{"type":902},"“Identity attacks have changed — have your IR playbooks?”",{"data":31672,"content":31673,"nodeType":894},{},[],{"data":31675,"content":31676,"nodeType":904},{},[31677],{"data":31678,"marks":31679,"value":4448,"nodeType":865},{},[31680],{"type":902},{"data":31682,"content":31683,"nodeType":881},{},[31684],{"data":31685,"marks":31686,"value":31687,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, password spraying, and session hijacking using stolen session tokens. ",{"data":31689,"content":31690,"nodeType":881},{},[31691],{"data":31692,"marks":31693,"value":31694,"nodeType":865},{},[],"You can also use Push to find and fix identity vulnerabilities across every app that your employees use, including ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more.",{"data":31696,"content":31697,"nodeType":881},{},[31698,31702,31710],{"data":31699,"marks":31700,"value":31701,"nodeType":865},{},[],"If you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":31703,"content":31704,"nodeType":876},{"uri":6048},[31705],{"data":31706,"marks":31707,"value":31709,"nodeType":865},{},[31708],{"type":874},"request a demo.",{"data":31711,"marks":31712,"value":21,"nodeType":865},{},[],"Introducing Push Detections: Equipping SecOps and IR teams to stop browser-based attacks","We’re launching a new Detections capability, enabling security teams to more effectively investigate and triage alerts, and build more effective workflows. ","2025-07-29T00:00:00.000Z","introducing-push-detections",{"items":31718},[31719,31721],{"sys":31720,"name":342},{"id":4510},{"sys":31722,"name":4507},{"id":4506},{"items":31724},[31725],{"fullName":20080,"firstName":20081,"jobTitle":20082,"profilePicture":31726},{"url":20084},{"__typename":1485,"sys":31728,"content":31729,"title":32074,"synopsis":32075,"hashTags":59,"publishedDate":32076,"slug":32077,"tagsCollection":32078,"authorsCollection":32082},{"id":20007},{"json":31730},{"data":31731,"content":31732,"nodeType":1463},{},[31733,31740,31747,31754,31760,31767,31800,31807,31814,31821,31827,31834,31841,31859,31865,31872,31892,31910,31917,31924,31931,31938,31945,31952,31959,31979,31986,31993,31999,32006,32013,32038,32044,32062,32068],{"data":31734,"content":31735,"nodeType":881},{},[31736],{"data":31737,"marks":31738,"value":31739,"nodeType":865},{},[],"Scattered Spider has shown the world the devastating effects attackers can achieve by socially engineering IT help desks into performing MFA resets so they can take over accounts on sensitive corporate apps. ",{"data":31741,"content":31742,"nodeType":881},{},[31743],{"data":31744,"marks":31745,"value":31746,"nodeType":865},{},[],"That’s why we’re introducing Employee Identity Verification Codes — a simple, browser-based identity check that gives your help desk a reliable way to confirm they’re talking to someone from your organization.",{"data":31748,"content":31749,"nodeType":881},{},[31750],{"data":31751,"marks":31752,"value":31753,"nodeType":865},{},[],"Push now provides your employees with a rotating 6-digit verification code in their browser via the Push Security extension. When an employee contacts your IT help desk to request an MFA reset or access recovery, the help desk can ask for this code to verify their identity — ensuring it’s really them, and not an attacker.",{"data":31755,"content":31759,"nodeType":890},{"target":31756},{"sys":31757},{"id":31758,"type":887,"linkType":888},"3PkiGgzwSt9Nb5rsGRiQVZ",[],{"data":31761,"content":31762,"nodeType":881},{},[31763],{"data":31764,"marks":31765,"value":31766,"nodeType":865},{},[],"The employee identity verification codes are:",{"data":31768,"content":31769,"nodeType":1818},{},[31770,31780,31790],{"data":31771,"content":31772,"nodeType":1734},{},[31773],{"data":31774,"content":31775,"nodeType":881},{},[31776],{"data":31777,"marks":31778,"value":31779,"nodeType":865},{},[],"Session-aware - generated in users’ browsers and only visible to them when they click on the Push Security extension icon in their browser toolbar.",{"data":31781,"content":31782,"nodeType":1734},{},[31783],{"data":31784,"content":31785,"nodeType":881},{},[31786],{"data":31787,"marks":31788,"value":31789,"nodeType":865},{},[],"Rotating: they change every 24 hours",{"data":31791,"content":31792,"nodeType":1734},{},[31793],{"data":31794,"content":31795,"nodeType":881},{},[31796],{"data":31797,"marks":31798,"value":31799,"nodeType":865},{},[],"Lightweight: no additional apps or devices required",{"data":31801,"content":31802,"nodeType":881},{},[31803],{"data":31804,"marks":31805,"value":31806,"nodeType":865},{},[],"It’s a fast, simple verification method — directly in the employee’s browser — that addresses a real-world threat.",{"data":31808,"content":31809,"nodeType":904},{},[31810],{"data":31811,"marks":31812,"value":31813,"nodeType":865},{},[],"We think it’s swell, but don’t just take our word for it …",{"data":31815,"content":31816,"nodeType":881},{},[31817],{"data":31818,"marks":31819,"value":31820,"nodeType":865},{},[],"Eric Rubin — a Senior Manager in GitLab’s Corporate Security team — has already rolled out Employee Identity Verification Codes across his workforce. Here’s what he had to say about it:",{"data":31822,"content":31826,"nodeType":890},{"target":31823},{"sys":31824},{"id":31825,"type":887,"linkType":888},"5ZLaA869NXpMjVwkswEyOB",[],{"data":31828,"content":31829,"nodeType":881},{},[31830],{"data":31831,"marks":31832,"value":31833,"nodeType":865},{},[],"Thank you, Eric!",{"data":31835,"content":31836,"nodeType":904},{},[31837],{"data":31838,"marks":31839,"value":31840,"nodeType":865},{},[],"Why are help desk identity verification methods so hot right now?",{"data":31842,"content":31843,"nodeType":881},{},[31844,31848,31855],{"data":31845,"marks":31846,"value":31847,"nodeType":865},{},[],"A number of the high-profile incidents attributed to the ",{"data":31849,"content":31850,"nodeType":876},{"uri":30801},[31851],{"data":31852,"marks":31853,"value":31854,"nodeType":865},{},[],"Scattered Spider cybercriminal group",{"data":31856,"marks":31857,"value":31858,"nodeType":865},{},[]," saw them socially engineer IT help desks into resetting MFA on employee accounts that they had already acquired valid credentials for. These compromised accounts were typically on IdP systems like Okta providing SSO access to large numbers of downstream applications.",{"data":31860,"content":31864,"nodeType":890},{"target":31861},{"sys":31862},{"id":31863,"type":887,"linkType":888},"2F2dpOkyXWnrKgFC3dSl67",[],{"data":31866,"content":31867,"nodeType":1860},{},[31868],{"data":31869,"marks":31870,"value":31871,"nodeType":865},{},[],"Case study: The MGM Resorts breach",{"data":31873,"content":31874,"nodeType":881},{},[31875,31879,31888],{"data":31876,"marks":31877,"value":31878,"nodeType":865},{},[],"One of Scattered Spider’s most notorious and well-documented attacks was against ",{"data":31880,"content":31882,"nodeType":876},{"uri":31881},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-mgm-resorts-september-2023",[31883],{"data":31884,"marks":31885,"value":31887,"nodeType":865},{},[31886],{"type":874},"MGM Resorts",{"data":31889,"marks":31890,"value":31891,"nodeType":865},{},[],". Scattered Spider socially engineered MGM Resorts’ help desk personnel to bypass MFA and log in to accounts for which they had acquired valid login credentials via credential phishing and historical infostealer compromises. ",{"data":31893,"content":31894,"nodeType":881},{},[31895,31899,31906],{"data":31896,"marks":31897,"value":31898,"nodeType":865},{},[],"They specifically targeted accounts with Super Administrator privileges within MGM Resorts’ Okta tenant, which they then used to register a second, attacker-controlled IdP via ",{"data":31900,"content":31901,"nodeType":876},{"uri":11271},[31902],{"data":31903,"marks":31904,"value":11277,"nodeType":865},{},[31905],{"type":874},{"data":31907,"marks":31908,"value":31909,"nodeType":865},{},[],". This then enabled them to impersonate any user within the Okta tenant. ",{"data":31911,"content":31912,"nodeType":881},{},[31913],{"data":31914,"marks":31915,"value":31916,"nodeType":865},{},[],"The attackers were then able to abuse SSO access to downstream apps and platforms from various accounts, culminating in deployment of ransomware to around 100 ESXi servers and data exfiltration. ",{"data":31918,"content":31919,"nodeType":881},{},[31920],{"data":31921,"marks":31922,"value":31923,"nodeType":865},{},[],"The breach resulted in a 36-hour outage, a $100M hit to its Q3 results, one-time cyber consulting fees in the region of $10M, and a class-action lawsuit later settled for $45M. ",{"data":31925,"content":31926,"nodeType":1860},{},[31927],{"data":31928,"marks":31929,"value":31930,"nodeType":865},{},[],"Reassessing help desk verification processes",{"data":31932,"content":31933,"nodeType":881},{},[31934],{"data":31935,"marks":31936,"value":31937,"nodeType":865},{},[],"Scattered Spider’s high-profile attacks — including its most recent against UK retailers Marks & Spencer’s and the Co-op — has prompted many security teams to reassess the verification processes used by their IT help desks when an employee requests an MFA reset or access to sensitive applications. ",{"data":31939,"content":31940,"nodeType":881},{},[31941],{"data":31942,"marks":31943,"value":31944,"nodeType":865},{},[],"Initial guidance from across the industry included the use of call-back verification for any MFA or credential changes requested by an employee. However, Scattered Spider are also known to use SIM-swapping to trick mobile carriers into transferring a victim’s phone number to a SIM card controlled by the attacker - thereby allowing them to intercept verification calls. ",{"data":31946,"content":31947,"nodeType":904},{},[31948],{"data":31949,"marks":31950,"value":31951,"nodeType":865},{},[],"Simple verification using your employees’ browsers",{"data":31953,"content":31954,"nodeType":881},{},[31955],{"data":31956,"marks":31957,"value":31958,"nodeType":865},{},[],"Push already provides several controls that directly align to the other TTPs used by Scattered Spider. They include detecting stolen credentials, cloned login pages, AitM toolkits and compromised IdP sessions. ",{"data":31960,"content":31961,"nodeType":881},{},[31962,31966,31975],{"data":31963,"marks":31964,"value":31965,"nodeType":865},{},[],"(BTW, if this piques your interest, you can ",{"data":31967,"content":31969,"nodeType":876},{"uri":31968},"https://pushsecurity.com/resources?type=webinar#content",[31970],{"data":31971,"marks":31972,"value":31974,"nodeType":865},{},[31973],{"type":874},"stream our latest webinar",{"data":31976,"marks":31977,"value":31978,"nodeType":865},{},[]," where we deep-dive into Scattered Spider, how their TTPs are evolving in 2025, and what Push is doing to protect organizations against them.) ",{"data":31980,"content":31981,"nodeType":881},{},[31982],{"data":31983,"marks":31984,"value":31985,"nodeType":865},{},[],"But to provide our customers with an additional layer of defense against the Scattered Spider attack chain, we wanted to see how we could make it harder for attackers to socially engineer IT help desks into gaining access to IdP systems and sensitive apps.",{"data":31987,"content":31988,"nodeType":881},{},[31989],{"data":31990,"marks":31991,"value":31992,"nodeType":865},{},[],"As so often is the case, the answer was staring us right in the face - we can use our browser extension. By placing a verification code in the details tray of every employees’ Push extension, they can use that to verify their identity with their help desk team.",{"data":31994,"content":31998,"nodeType":890},{"target":31995},{"sys":31996},{"id":31997,"type":887,"linkType":888},"4hRJVGqKGyOHJ8NSsQYWGP",[],{"data":32000,"content":32001,"nodeType":904},{},[32002],{"data":32003,"marks":32004,"value":32005,"nodeType":865},{},[],"Get started today!",{"data":32007,"content":32008,"nodeType":881},{},[32009],{"data":32010,"marks":32011,"value":32012,"nodeType":865},{},[],"Employee verification codes is a Labs feature, which means it’s available on an early-access basis. We're particularly interested in hearing your feedback on how to develop this feature further.",{"data":32014,"content":32015,"nodeType":881},{},[32016,32020,32025,32029,32034],{"data":32017,"marks":32018,"value":32019,"nodeType":865},{},[],"You can enable Labs features by going to the ",{"data":32021,"marks":32022,"value":32024,"nodeType":865},{},[32023],{"type":902},"Settings",{"data":32026,"marks":32027,"value":32028,"nodeType":865},{},[]," page of the Push admin console and choosing the ",{"data":32030,"marks":32031,"value":32033,"nodeType":865},{},[32032],{"type":902},"Labs",{"data":32035,"marks":32036,"value":32037,"nodeType":865},{},[]," tab.",{"data":32039,"content":32043,"nodeType":890},{"target":32040},{"sys":32041},{"id":32042,"type":887,"linkType":888},"6TyqP2eOmalIF6RRoe476Y",[],{"data":32045,"content":32046,"nodeType":881},{},[32047,32051,32058],{"data":32048,"marks":32049,"value":32050,"nodeType":865},{},[],"If you’d like to find out more about this feature, and the other ways Push is stopping identity attacks in the browser, ",{"data":32052,"content":32053,"nodeType":876},{"uri":6048},[32054],{"data":32055,"marks":32056,"value":1458,"nodeType":865},{},[32057],{"type":874},{"data":32059,"marks":32060,"value":32061,"nodeType":865},{},[]," with one of our team. ",{"data":32063,"content":32067,"nodeType":890},{"target":32064},{"sys":32065},{"id":32066,"type":887,"linkType":888},"7xBE9MrnMy3hfwIkhLhNhQ",[],{"data":32069,"content":32070,"nodeType":881},{},[32071],{"data":32072,"marks":32073,"value":21,"nodeType":865},{},[],"A simple, browser-based way to protect your help desk against social engineering","Push's new Employee Identity Verification Codes feature is a simple way for your help desk to confirm they’re talking to someone from your organization.\n","2025-06-19T00:00:00.000Z","employee-identity-verification-codes-release",{"items":32079},[32080],{"sys":32081,"name":297},{"id":6385},{"items":32083},[32084],{"fullName":32085,"firstName":32086,"jobTitle":20082,"profilePicture":32087},"Alex Henshall","Alex",{"url":32088},"https://images.ctfassets.net/y1cdw1ablpvd/2rz3Pre3b1MexPIQ4hzPUe/0ef8a092b7e7df00fbce3f7d1ccb96d1/Alex_Henshall.jpeg",{"__typename":1485,"sys":32090,"content":32091,"title":32638,"synopsis":32639,"hashTags":59,"publishedDate":32640,"slug":32641,"tagsCollection":32642,"authorsCollection":32648},{"id":18994},{"json":32092},{"data":32093,"content":32094,"nodeType":1463},{},[32095,32114,32121,32144,32151,32158,32165,32184,32190,32193,32201,32208,32228,32272,32316,32346,32366,32372,32375,32383,32390,32397,32404,32411,32534,32541,32544,32551,32568,32585,32588,32596,32613,32620],{"data":32096,"content":32097,"nodeType":881},{},[32098,32102,32110],{"data":32099,"marks":32100,"value":32101,"nodeType":865},{},[],"Almost two years ago, we released our ",{"data":32103,"content":32104,"nodeType":876},{"uri":5192},[32105],{"data":32106,"marks":32107,"value":32109,"nodeType":865},{},[32108],{"type":874},"SaaS attacks matrix",{"data":32111,"marks":32112,"value":32113,"nodeType":865},{},[]," on GitHub. At the time, our research into modern attack patterns showed us that attackers were increasingly relying on cloud-native techniques, taking advantage of the shift in business IT from traditional on-premise networks to a web of third-party services accessed over the internet. ",{"data":32115,"content":32116,"nodeType":881},{},[32117],{"data":32118,"marks":32119,"value":32120,"nodeType":865},{},[],"As part of our work in maintaining and updating the SaaS attacks matrix in line with our own research and attacks in the wild, we identified that:",{"data":32122,"content":32123,"nodeType":1818},{},[32124,32134],{"data":32125,"content":32126,"nodeType":1734},{},[32127],{"data":32128,"content":32129,"nodeType":881},{},[32130],{"data":32131,"marks":32132,"value":32133,"nodeType":865},{},[],"The fastest growing category since day 1 has been initial access, which is entirely driven by identity-based techniques (i.e. logging into apps).",{"data":32135,"content":32136,"nodeType":1734},{},[32137],{"data":32138,"content":32139,"nodeType":881},{},[32140],{"data":32141,"marks":32142,"value":32143,"nodeType":865},{},[],"Phishing in various forms is the most widely used, and generally effective, of all the initial access techniques we encounter. ",{"data":32145,"content":32146,"nodeType":881},{},[32147],{"data":32148,"marks":32149,"value":32150,"nodeType":865},{},[],"It’s increasingly difficult to reflect a lot of the research we’re doing within the parameters of the SaaS attacks matrix when attackers are doing so much (and to varying levels) in how they architect their phishing sites, distribute links and lures, and find novel ways around authentication and access controls. ",{"data":32152,"content":32153,"nodeType":881},{},[32154],{"data":32155,"marks":32156,"value":32157,"nodeType":865},{},[],"Equally, while there’s a huge amount of valuable research and deep-dive analysis of how individual phishing kits are behaving produced by security firms, there’s a gap in how we’re bringing together this knowledge and understanding the broad strokes of why and how phishing attacks are still so successful.  ",{"data":32159,"content":32160,"nodeType":881},{},[32161],{"data":32162,"marks":32163,"value":32164,"nodeType":865},{},[],"We come across so many phishing attacks on a daily basis that it’s impossible to write a deep-dive teardown on every one — and to some extent it wouldn’t be useful to do so. What’s arguably more valuable is understanding the patterns and commonalities across phishing campaigns that can help us to understand, generally, how malicious tooling and tradecraft is evolving. ",{"data":32166,"content":32167,"nodeType":881},{},[32168,32172,32180],{"data":32169,"marks":32170,"value":32171,"nodeType":865},{},[],"So, we decided to ",{"data":32173,"content":32174,"nodeType":876},{"uri":19084},[32175],{"data":32176,"marks":32177,"value":32179,"nodeType":865},{},[32178],{"type":874},"create a new resource",{"data":32181,"marks":32182,"value":32183,"nodeType":865},{},[]," giving phishing the space to breathe that it deserves. ",{"data":32185,"content":32189,"nodeType":890},{"target":32186},{"sys":32187},{"id":32188,"type":887,"linkType":888},"7rK8RR8KKQ9DbBouZKnjs6",[],{"data":32191,"content":32192,"nodeType":894},{},[],{"data":32194,"content":32195,"nodeType":904},{},[32196],{"data":32197,"marks":32198,"value":32200,"nodeType":865},{},[32199],{"type":902},"How phishing has evolved",{"data":32202,"content":32203,"nodeType":881},{},[32204],{"data":32205,"marks":32206,"value":32207,"nodeType":865},{},[],"It’s easy to write off phishing as unsophisticated and simplistic, particularly when we think back to the first generation of phishing attacks — static HTML pages purely designed to steal your username and password, linked directly from an email. ",{"data":32209,"content":32210,"nodeType":881},{},[32211,32215,32224],{"data":32212,"marks":32213,"value":32214,"nodeType":865},{},[],"Modern phishing has changed a lot in the past decade or so. ",{"data":32216,"content":32218,"nodeType":876},{"uri":32217},"https://phishing-techniques.pushsecurity.com/techniques/aitm-phishing/",[32219],{"data":32220,"marks":32221,"value":32223,"nodeType":865},{},[32222],{"type":874},"MFA-bypassing  Attacker-in-the-Middle (AitM) kits",{"data":32225,"marks":32226,"value":32227,"nodeType":865},{},[]," are table stakes — anyone can pick up a copy of Evilginx and immediately blow past most email and network security solutions on the market.  ",{"data":32229,"content":32230,"nodeType":881},{},[32231,32235,32244,32248,32256,32260,32268],{"data":32232,"marks":32233,"value":32234,"nodeType":865},{},[],"But the most sophisticated attacks — the ones that usually hit the headlines in the form of major breaches — are doing much more than this. The latest generation of fully customized AitM phishing kits are ",{"data":32236,"content":32238,"nodeType":876},{"uri":32237},"https://phishing-techniques.pushsecurity.com/techniques/code-obfuscation/",[32239],{"data":32240,"marks":32241,"value":32243,"nodeType":865},{},[32242],{"type":874},"dynamically obfuscating the code that loads the web page",{"data":32245,"marks":32246,"value":32247,"nodeType":865},{},[],", implementing ",{"data":32249,"content":32250,"nodeType":876},{"uri":28958},[32251],{"data":32252,"marks":32253,"value":32255,"nodeType":865},{},[32254],{"type":874},"bot protection through custom CAPTCHA",{"data":32257,"marks":32258,"value":32259,"nodeType":865},{},[],", and using ",{"data":32261,"content":32262,"nodeType":876},{"uri":26125},[32263],{"data":32264,"marks":32265,"value":32267,"nodeType":865},{},[32266],{"type":874},"runtime anti-analysis features",{"data":32269,"marks":32270,"value":32271,"nodeType":865},{},[],", making them increasingly difficult to detect by the tools most enterprises are using to combat the problem. ",{"data":32273,"content":32274,"nodeType":881},{},[32275,32279,32286,32290,32299,32303,32312],{"data":32276,"marks":32277,"value":32278,"nodeType":865},{},[],"The techniques used by attackers to deliver phishing lures are also more sophisticated. Groups like Scattered Spider have been seen using ",{"data":32280,"content":32281,"nodeType":876},{"uri":7517},[32282],{"data":32283,"marks":32284,"value":441,"nodeType":865},{},[32285],{"type":874},{"data":32287,"marks":32288,"value":32289,"nodeType":865},{},[]," techniques, delivering phishing links via paid Google ads, while phishing campaigns are frequently encountered in ",{"data":32291,"content":32293,"nodeType":876},{"uri":32292},"https://phishing-techniques.pushsecurity.com/techniques/instant-messenger/",[32294],{"data":32295,"marks":32296,"value":32298,"nodeType":865},{},[32297],{"type":874},"IM apps",{"data":32300,"marks":32301,"value":32302,"nodeType":865},{},[]," (such as Slack and Teams), as well as ",{"data":32304,"content":32306,"nodeType":876},{"uri":32305},"https://phishing-techniques.pushsecurity.com/techniques/social-media/",[32307],{"data":32308,"marks":32309,"value":32311,"nodeType":865},{},[32310],{"type":874},"public messaging services",{"data":32313,"marks":32314,"value":32315,"nodeType":865},{},[]," like LinkedIn messenger and Reddit — bypassing email altogether. ",{"data":32317,"content":32318,"nodeType":881},{},[32319,32323,32332,32336,32343],{"data":32320,"marks":32321,"value":32322,"nodeType":865},{},[],"The latest trends indicate that attackers are responding to increasingly hardened IdP/SSO configuration by using alternative phishing techniques that circumvent MFA and passkeys, either by ",{"data":32324,"content":32326,"nodeType":876},{"uri":32325},"https://phishing-techniques.pushsecurity.com/techniques/mfa-downgrade/",[32327],{"data":32328,"marks":32329,"value":32331,"nodeType":865},{},[32330],{"type":874},"downgrading to a backup (less secure) authentication method",{"data":32333,"marks":32334,"value":32335,"nodeType":865},{},[],", or sidestepping the legitimate auth process entirely through methods like ",{"data":32337,"content":32338,"nodeType":876},{"uri":7561},[32339],{"data":32340,"marks":32341,"value":7567,"nodeType":865},{},[32342],{"type":874},{"data":32344,"marks":32345,"value":1032,"nodeType":865},{},[],{"data":32347,"content":32348,"nodeType":881},{},[32349,32353,32362],{"data":32350,"marks":32351,"value":32352,"nodeType":865},{},[],"Attackers have also realized how much valuable data exists in Shadow SaaS highlighted by major SaaS breaches impacting apps like Snowflake. This is driving ",{"data":32354,"content":32356,"nodeType":876},{"uri":32355},"https://phishing-techniques.pushsecurity.com/techniques/saas-admins/",[32357],{"data":32358,"marks":32359,"value":32361,"nodeType":865},{},[32360],{"type":874},"broader targeting against apps like Slack, Mailchimp, Postman, GitHub, and other commonly-used business apps directly",{"data":32363,"marks":32364,"value":32365,"nodeType":865},{},[]," — bypassing IdPs (MS, Google, Okta, etc.) that typically have more robust authentication controls in place.",{"data":32367,"content":32371,"nodeType":890},{"target":32368},{"sys":32369},{"id":32370,"type":887,"linkType":888},"1II2kHyOZcShLsexx1TAgy",[],{"data":32373,"content":32374,"nodeType":894},{},[],{"data":32376,"content":32377,"nodeType":904},{},[32378],{"data":32379,"marks":32380,"value":32382,"nodeType":865},{},[32381],{"type":902},"Using the phishing detection evasion techniques matrix",{"data":32384,"content":32385,"nodeType":881},{},[32386],{"data":32387,"marks":32388,"value":32389,"nodeType":865},{},[],"With so much attacker innovation happening in the phishing space, it’s tricky for security teams and solution vendors to have a big picture view of the subtle changes attackers are making to their phishing attacks, and precisely why they’re doing it — or more specifically, which detection techniques they’re evading. ",{"data":32391,"content":32392,"nodeType":881},{},[32393],{"data":32394,"marks":32395,"value":32396,"nodeType":865},{},[],"If you look at one of the many phishing kit teardowns found in security blogs online (including our own) it can be hard to see the wood for the trees when it comes to understanding why a phishing page behaves in the way it does — why is it behaving in this way? What control exactly is this trying to get around? ",{"data":32398,"content":32399,"nodeType":881},{},[32400],{"data":32401,"marks":32402,"value":32403,"nodeType":865},{},[],"By creating a simple framework breaking down the categories of a phishing attack into phases, each with its own specific attacker objective, we can better understand phishing kit behavior and track meaningful changes over time. This ensures that we understand how we need to adapt to as an industry in order to detect and block these attacks. ",{"data":32405,"content":32406,"nodeType":881},{},[32407],{"data":32408,"marks":32409,"value":32410,"nodeType":865},{},[],"The matrix covers the following categories:",{"data":32412,"content":32413,"nodeType":1818},{},[32414,32429,32444,32459,32474,32489,32504,32519],{"data":32415,"content":32416,"nodeType":1734},{},[32417],{"data":32418,"content":32419,"nodeType":881},{},[32420,32425],{"data":32421,"marks":32422,"value":32424,"nodeType":865},{},[32423],{"type":902},"Phase 1: Targeting",{"data":32426,"marks":32427,"value":32428,"nodeType":865},{},[]," — Identifying apps and users to evade security controls and achieve the shortest time-to-impact of a phishing attack. ",{"data":32430,"content":32431,"nodeType":1734},{},[32432],{"data":32433,"content":32434,"nodeType":881},{},[32435,32440],{"data":32436,"marks":32437,"value":32439,"nodeType":865},{},[32438],{"type":902},"Phase 2: Link delivery",{"data":32441,"marks":32442,"value":32443,"nodeType":865},{},[]," — Deliver links using phishing vectors that evade traditional security controls. ",{"data":32445,"content":32446,"nodeType":1734},{},[32447],{"data":32448,"content":32449,"nodeType":881},{},[32450,32455],{"data":32451,"marks":32452,"value":32454,"nodeType":865},{},[32453],{"type":902},"Phase 3: Link camouflage",{"data":32456,"marks":32457,"value":32458,"nodeType":865},{},[]," — Masking malicious links to prevent detection at the email, network proxy, or safe browsing layer. ",{"data":32460,"content":32461,"nodeType":1734},{},[32462],{"data":32463,"content":32464,"nodeType":881},{},[32465,32470],{"data":32466,"marks":32467,"value":32469,"nodeType":865},{},[32468],{"type":902},"Phase 4: TI evasion ",{"data":32471,"marks":32472,"value":32473,"nodeType":865},{},[],"— Preventing TI feeds from flagging and blocking known-bad domains by masking or changing elements likely to be flagged.",{"data":32475,"content":32476,"nodeType":1734},{},[32477],{"data":32478,"content":32479,"nodeType":881},{},[32480,32485],{"data":32481,"marks":32482,"value":32484,"nodeType":865},{},[32483],{"type":902},"Phase 5: Anti-analysis",{"data":32486,"marks":32487,"value":32488,"nodeType":865},{},[]," — Techniques to defeat automated “sandbox” analysis tools by preventing security teams and bots from accessing the page.",{"data":32490,"content":32491,"nodeType":1734},{},[32492],{"data":32493,"content":32494,"nodeType":881},{},[32495,32500],{"data":32496,"marks":32497,"value":32499,"nodeType":865},{},[32498],{"type":902},"Phase 6: Page obfuscation",{"data":32501,"marks":32502,"value":32503,"nodeType":865},{},[]," — Obfuscating page elements to break detection signatures analysing page content and code. ",{"data":32505,"content":32506,"nodeType":1734},{},[32507],{"data":32508,"content":32509,"nodeType":881},{},[32510,32515],{"data":32511,"marks":32512,"value":32514,"nodeType":865},{},[32513],{"type":902},"Phase 7: Defeat MFA & CA",{"data":32516,"marks":32517,"value":32518,"nodeType":865},{},[]," — Defeat authentication and access controls in order to successfully execute the phishing attack.",{"data":32520,"content":32521,"nodeType":1734},{},[32522],{"data":32523,"content":32524,"nodeType":881},{},[32525,32530],{"data":32526,"marks":32527,"value":32529,"nodeType":865},{},[32528],{"type":902},"Phase 8: Account takeover",{"data":32531,"marks":32532,"value":32533,"nodeType":865},{},[]," — Achieve a form of account takeover and conclude the identity attack, enabling further exploitation to take place.",{"data":32535,"content":32536,"nodeType":881},{},[32537],{"data":32538,"marks":32539,"value":32540,"nodeType":865},{},[],"Combining techniques and approaches from these categories is what enables attackers to bypass the majority of phishing detection controls they encounter today. You typically find that the more advanced the phishing kit / attacker, the more techniques they’ll leverage. And as phishing infrastructure becomes increasingly templated and commodified with as-a-Service or for-hire models, the average phishing attack will employ more of these measures to counter security controls. ",{"data":32542,"content":32543,"nodeType":894},{},[],{"data":32545,"content":32546,"nodeType":904},{},[32547],{"data":32548,"marks":32549,"value":29766,"nodeType":865},{},[32550],{"type":902},{"data":32552,"content":32553,"nodeType":881},{},[32554,32557,32565],{"data":32555,"marks":32556,"value":21,"nodeType":865},{},[],{"data":32558,"content":32559,"nodeType":876},{"uri":19084},[32560],{"data":32561,"marks":32562,"value":32564,"nodeType":865},{},[32563],{"type":874},"You can find the matrix here.",{"data":32566,"marks":32567,"value":21,"nodeType":865},{},[],{"data":32569,"content":32570,"nodeType":881},{},[32571,32575,32582],{"data":32572,"marks":32573,"value":32574,"nodeType":865},{},[],"If you want to learn more about the research that led us to this point, and our take on how and why phishing attacks have evolved, ",{"data":32576,"content":32577,"nodeType":876},{"uri":30678},[32578],{"data":32579,"marks":32580,"value":32581,"nodeType":865},{},[],"you can also check out our latest whitepaper. ",{"data":32583,"marks":32584,"value":21,"nodeType":865},{},[],{"data":32586,"content":32587,"nodeType":894},{},[],{"data":32589,"content":32590,"nodeType":904},{},[32591],{"data":32592,"marks":32593,"value":32595,"nodeType":865},{},[32594],{"type":902},"Get involved!",{"data":32597,"content":32598,"nodeType":881},{},[32599,32603,32609],{"data":32600,"marks":32601,"value":32602,"nodeType":865},{},[],"Like the ",{"data":32604,"content":32605,"nodeType":876},{"uri":5192},[32606],{"data":32607,"marks":32608,"value":4540,"nodeType":865},{},[],{"data":32610,"marks":32611,"value":32612,"nodeType":865},{},[],", we’d love to see the security community using and helping us to maintain this resource to ensure it stays up to date with techniques as they evolve. ",{"data":32614,"content":32615,"nodeType":881},{},[32616],{"data":32617,"marks":32618,"value":32619,"nodeType":865},{},[],"Unlike the SaaS matrix, which we’ve seen mostly leveraged by offensive security practitioners, phishing detection evasion techniques are most useful to blue teamers looking to assess current detection capabilities and understand why certain attacks got through existing defenses. ",{"data":32621,"content":32622,"nodeType":881},{},[32623,32627,32635],{"data":32624,"marks":32625,"value":32626,"nodeType":865},{},[],"If you’d like to add techniques you’ve observed or examples that you think demonstrate them, ",{"data":32628,"content":32630,"nodeType":876},{"uri":32629},"https://github.com/pushsecurity/phishing-techniques",[32631],{"data":32632,"marks":32633,"value":32634,"nodeType":865},{},[],"get involved on GitHub!",{"data":32636,"marks":32637,"value":21,"nodeType":865},{},[],"Introducing our guide to phishing detection evasion techniques","Introducing our latest resource for security teams breaking down the techniques that modern phishing attacks are using to evade detection. ","2025-08-06T00:00:00.000Z","phishing-detection-evasion-launch",{"items":32643},[32644,32646],{"sys":32645,"name":342},{"id":4510},{"sys":32647,"name":4507},{"id":4506},{"items":32649},[32650],{"fullName":32651,"firstName":32652,"jobTitle":32653,"profilePicture":32654},"Jacques Louw","Jacques","Co-founder / CRO",{"url":32655},"https://images.ctfassets.net/y1cdw1ablpvd/39m8bektV23lnCRcEq0G8h/2a08f6276a50744f1a4b499b273f6bb2/Push_Founders_at_Cahoots_October_28_2022_by_Doug_Coombe-21.jpg","how-the-browser-became-the-main-cyber-battleground","blog/how-the-browser-became-the-main-cyber-battleground",{"json":32659},{"data":32660,"content":32661,"nodeType":1463},{},[32662],{"data":32663,"content":32664,"nodeType":881},{},[32665],{"data":32666,"marks":32667,"value":32668,"nodeType":865},{},[],"How attacks have moved away from endpoints and internal networks to the browser — a blind spot for traditional security tools.",{"id":32670,"publishedAt":32671},"31m73YMGdCyqVmjHulBwER","2026-08-12T11:53:53.682Z",{"items":32673},[32674,32676],{"sys":32675,"name":342},{"id":4510},{"sys":32677,"name":4507},{"id":4506},{"items":32679},[32680,32682,32684,32686,32688,32690,32692,32694,32696,32698,32700,32702,32704,32706,32708,32710,32712,32714,32716,32718,32720,32722,32724,32726,32728],{"sys":32681,"name":279,"slug":280,"tier":31},{"id":276},{"sys":32683,"name":297,"slug":298,"tier":31},{"id":294},{"sys":32685,"name":413,"slug":414,"tier":31},{"id":410},{"sys":32687,"name":519,"slug":520,"tier":31},{"id":516},{"sys":32689,"name":545,"slug":546,"tier":31},{"id":542},{"sys":32691,"name":342,"slug":343,"tier":31},{"id":339},{"sys":32693,"name":642,"slug":643,"tier":31},{"id":639},{"sys":32695,"name":377,"slug":378,"tier":45},{"id":374},{"sys":32697,"name":404,"slug":405,"tier":45},{"id":401},{"sys":32699,"name":324,"slug":325,"tier":45},{"id":321},{"sys":32701,"name":333,"slug":334,"tier":45},{"id":330},{"sys":32703,"name":571,"slug":572,"tier":45},{"id":568},{"sys":32705,"name":422,"slug":423,"tier":45},{"id":419},{"sys":32707,"name":261,"slug":262,"tier":45},{"id":258},{"sys":32709,"name":466,"slug":467,"tier":45},{"id":463},{"sys":32711,"name":457,"slug":458,"tier":45},{"id":454},{"sys":32713,"name":395,"slug":396,"tier":45},{"id":392},{"sys":32715,"name":288,"slug":289,"tier":45},{"id":285},{"sys":32717,"name":484,"slug":485,"tier":45},{"id":481},{"sys":32719,"name":589,"slug":590,"tier":45},{"id":586},{"sys":32721,"name":607,"slug":608,"tier":45},{"id":604},{"sys":32723,"name":475,"slug":476,"tier":45},{"id":472},{"sys":32725,"name":511,"slug":512,"tier":45},{"id":508},{"sys":32727,"name":493,"slug":494,"tier":45},{"id":490},{"sys":32729,"name":440,"slug":441,"tier":45},{"id":437},"PonpZ2he3fGXpKQWTeIZC0k0nbZ5ZfYtQyn8NDwmYDI",{"id":32732,"title":32638,"authorsCollection":32733,"content":32739,"extension":228,"faqItemsCollection":33226,"faqTitle":59,"featured":6,"hashTags":59,"meta":33228,"metaTitle":33229,"ogImage":59,"postType":33230,"publishedDate":32640,"relatedBlogPostsCollection":33231,"slug":32641,"stem":35395,"subtitle":59,"summary":35396,"synopsis":32639,"sys":35407,"tagsCollection":35409,"topicsCollection":35415,"__hash__":35453},"blog/blog/phishing-detection-evasion-launch.json",{"items":32734},[32735],{"fullName":32651,"firstName":32652,"jobTitle":32653,"socialLinks":32736,"profilePicture":32738},[32737],"https://www.linkedin.com/in/jacques-louw-o-62608594/",{"url":32655},{"json":32740,"links":33210},{"data":32741,"content":32742,"nodeType":1463},{},[32743,32759,32765,32786,32792,32798,32804,32820,32825,32828,32835,32841,32857,32893,32929,32955,32971,32976,32979,32986,32992,32998,33004,33010,33117,33123,33126,33133,33149,33164,33167,33174,33189,33195],{"data":32744,"content":32745,"nodeType":881},{},[32746,32749,32756],{"data":32747,"marks":32748,"value":32101,"nodeType":865},{},[],{"data":32750,"content":32751,"nodeType":876},{"uri":5192},[32752],{"data":32753,"marks":32754,"value":32109,"nodeType":865},{},[32755],{"type":874},{"data":32757,"marks":32758,"value":32113,"nodeType":865},{},[],{"data":32760,"content":32761,"nodeType":881},{},[32762],{"data":32763,"marks":32764,"value":32120,"nodeType":865},{},[],{"data":32766,"content":32767,"nodeType":1818},{},[32768,32777],{"data":32769,"content":32770,"nodeType":1734},{},[32771],{"data":32772,"content":32773,"nodeType":881},{},[32774],{"data":32775,"marks":32776,"value":32133,"nodeType":865},{},[],{"data":32778,"content":32779,"nodeType":1734},{},[32780],{"data":32781,"content":32782,"nodeType":881},{},[32783],{"data":32784,"marks":32785,"value":32143,"nodeType":865},{},[],{"data":32787,"content":32788,"nodeType":881},{},[32789],{"data":32790,"marks":32791,"value":32150,"nodeType":865},{},[],{"data":32793,"content":32794,"nodeType":881},{},[32795],{"data":32796,"marks":32797,"value":32157,"nodeType":865},{},[],{"data":32799,"content":32800,"nodeType":881},{},[32801],{"data":32802,"marks":32803,"value":32164,"nodeType":865},{},[],{"data":32805,"content":32806,"nodeType":881},{},[32807,32810,32817],{"data":32808,"marks":32809,"value":32171,"nodeType":865},{},[],{"data":32811,"content":32812,"nodeType":876},{"uri":19084},[32813],{"data":32814,"marks":32815,"value":32179,"nodeType":865},{},[32816],{"type":874},{"data":32818,"marks":32819,"value":32183,"nodeType":865},{},[],{"data":32821,"content":32824,"nodeType":890},{"target":32822},{"sys":32823},{"id":32188,"type":887,"linkType":888},[],{"data":32826,"content":32827,"nodeType":894},{},[],{"data":32829,"content":32830,"nodeType":904},{},[32831],{"data":32832,"marks":32833,"value":32200,"nodeType":865},{},[32834],{"type":902},{"data":32836,"content":32837,"nodeType":881},{},[32838],{"data":32839,"marks":32840,"value":32207,"nodeType":865},{},[],{"data":32842,"content":32843,"nodeType":881},{},[32844,32847,32854],{"data":32845,"marks":32846,"value":32214,"nodeType":865},{},[],{"data":32848,"content":32849,"nodeType":876},{"uri":32217},[32850],{"data":32851,"marks":32852,"value":32223,"nodeType":865},{},[32853],{"type":874},{"data":32855,"marks":32856,"value":32227,"nodeType":865},{},[],{"data":32858,"content":32859,"nodeType":881},{},[32860,32863,32870,32873,32880,32883,32890],{"data":32861,"marks":32862,"value":32234,"nodeType":865},{},[],{"data":32864,"content":32865,"nodeType":876},{"uri":32237},[32866],{"data":32867,"marks":32868,"value":32243,"nodeType":865},{},[32869],{"type":874},{"data":32871,"marks":32872,"value":32247,"nodeType":865},{},[],{"data":32874,"content":32875,"nodeType":876},{"uri":28958},[32876],{"data":32877,"marks":32878,"value":32255,"nodeType":865},{},[32879],{"type":874},{"data":32881,"marks":32882,"value":32259,"nodeType":865},{},[],{"data":32884,"content":32885,"nodeType":876},{"uri":26125},[32886],{"data":32887,"marks":32888,"value":32267,"nodeType":865},{},[32889],{"type":874},{"data":32891,"marks":32892,"value":32271,"nodeType":865},{},[],{"data":32894,"content":32895,"nodeType":881},{},[32896,32899,32906,32909,32916,32919,32926],{"data":32897,"marks":32898,"value":32278,"nodeType":865},{},[],{"data":32900,"content":32901,"nodeType":876},{"uri":7517},[32902],{"data":32903,"marks":32904,"value":441,"nodeType":865},{},[32905],{"type":874},{"data":32907,"marks":32908,"value":32289,"nodeType":865},{},[],{"data":32910,"content":32911,"nodeType":876},{"uri":32292},[32912],{"data":32913,"marks":32914,"value":32298,"nodeType":865},{},[32915],{"type":874},{"data":32917,"marks":32918,"value":32302,"nodeType":865},{},[],{"data":32920,"content":32921,"nodeType":876},{"uri":32305},[32922],{"data":32923,"marks":32924,"value":32311,"nodeType":865},{},[32925],{"type":874},{"data":32927,"marks":32928,"value":32315,"nodeType":865},{},[],{"data":32930,"content":32931,"nodeType":881},{},[32932,32935,32942,32945,32952],{"data":32933,"marks":32934,"value":32322,"nodeType":865},{},[],{"data":32936,"content":32937,"nodeType":876},{"uri":32325},[32938],{"data":32939,"marks":32940,"value":32331,"nodeType":865},{},[32941],{"type":874},{"data":32943,"marks":32944,"value":32335,"nodeType":865},{},[],{"data":32946,"content":32947,"nodeType":876},{"uri":7561},[32948],{"data":32949,"marks":32950,"value":7567,"nodeType":865},{},[32951],{"type":874},{"data":32953,"marks":32954,"value":1032,"nodeType":865},{},[],{"data":32956,"content":32957,"nodeType":881},{},[32958,32961,32968],{"data":32959,"marks":32960,"value":32352,"nodeType":865},{},[],{"data":32962,"content":32963,"nodeType":876},{"uri":32355},[32964],{"data":32965,"marks":32966,"value":32361,"nodeType":865},{},[32967],{"type":874},{"data":32969,"marks":32970,"value":32365,"nodeType":865},{},[],{"data":32972,"content":32975,"nodeType":890},{"target":32973},{"sys":32974},{"id":32370,"type":887,"linkType":888},[],{"data":32977,"content":32978,"nodeType":894},{},[],{"data":32980,"content":32981,"nodeType":904},{},[32982],{"data":32983,"marks":32984,"value":32382,"nodeType":865},{},[32985],{"type":902},{"data":32987,"content":32988,"nodeType":881},{},[32989],{"data":32990,"marks":32991,"value":32389,"nodeType":865},{},[],{"data":32993,"content":32994,"nodeType":881},{},[32995],{"data":32996,"marks":32997,"value":32396,"nodeType":865},{},[],{"data":32999,"content":33000,"nodeType":881},{},[33001],{"data":33002,"marks":33003,"value":32403,"nodeType":865},{},[],{"data":33005,"content":33006,"nodeType":881},{},[33007],{"data":33008,"marks":33009,"value":32410,"nodeType":865},{},[],{"data":33011,"content":33012,"nodeType":1818},{},[33013,33026,33039,33052,33065,33078,33091,33104],{"data":33014,"content":33015,"nodeType":1734},{},[33016],{"data":33017,"content":33018,"nodeType":881},{},[33019,33023],{"data":33020,"marks":33021,"value":32424,"nodeType":865},{},[33022],{"type":902},{"data":33024,"marks":33025,"value":32428,"nodeType":865},{},[],{"data":33027,"content":33028,"nodeType":1734},{},[33029],{"data":33030,"content":33031,"nodeType":881},{},[33032,33036],{"data":33033,"marks":33034,"value":32439,"nodeType":865},{},[33035],{"type":902},{"data":33037,"marks":33038,"value":32443,"nodeType":865},{},[],{"data":33040,"content":33041,"nodeType":1734},{},[33042],{"data":33043,"content":33044,"nodeType":881},{},[33045,33049],{"data":33046,"marks":33047,"value":32454,"nodeType":865},{},[33048],{"type":902},{"data":33050,"marks":33051,"value":32458,"nodeType":865},{},[],{"data":33053,"content":33054,"nodeType":1734},{},[33055],{"data":33056,"content":33057,"nodeType":881},{},[33058,33062],{"data":33059,"marks":33060,"value":32469,"nodeType":865},{},[33061],{"type":902},{"data":33063,"marks":33064,"value":32473,"nodeType":865},{},[],{"data":33066,"content":33067,"nodeType":1734},{},[33068],{"data":33069,"content":33070,"nodeType":881},{},[33071,33075],{"data":33072,"marks":33073,"value":32484,"nodeType":865},{},[33074],{"type":902},{"data":33076,"marks":33077,"value":32488,"nodeType":865},{},[],{"data":33079,"content":33080,"nodeType":1734},{},[33081],{"data":33082,"content":33083,"nodeType":881},{},[33084,33088],{"data":33085,"marks":33086,"value":32499,"nodeType":865},{},[33087],{"type":902},{"data":33089,"marks":33090,"value":32503,"nodeType":865},{},[],{"data":33092,"content":33093,"nodeType":1734},{},[33094],{"data":33095,"content":33096,"nodeType":881},{},[33097,33101],{"data":33098,"marks":33099,"value":32514,"nodeType":865},{},[33100],{"type":902},{"data":33102,"marks":33103,"value":32518,"nodeType":865},{},[],{"data":33105,"content":33106,"nodeType":1734},{},[33107],{"data":33108,"content":33109,"nodeType":881},{},[33110,33114],{"data":33111,"marks":33112,"value":32529,"nodeType":865},{},[33113],{"type":902},{"data":33115,"marks":33116,"value":32533,"nodeType":865},{},[],{"data":33118,"content":33119,"nodeType":881},{},[33120],{"data":33121,"marks":33122,"value":32540,"nodeType":865},{},[],{"data":33124,"content":33125,"nodeType":894},{},[],{"data":33127,"content":33128,"nodeType":904},{},[33129],{"data":33130,"marks":33131,"value":29766,"nodeType":865},{},[33132],{"type":902},{"data":33134,"content":33135,"nodeType":881},{},[33136,33139,33146],{"data":33137,"marks":33138,"value":21,"nodeType":865},{},[],{"data":33140,"content":33141,"nodeType":876},{"uri":19084},[33142],{"data":33143,"marks":33144,"value":32564,"nodeType":865},{},[33145],{"type":874},{"data":33147,"marks":33148,"value":21,"nodeType":865},{},[],{"data":33150,"content":33151,"nodeType":881},{},[33152,33155,33161],{"data":33153,"marks":33154,"value":32574,"nodeType":865},{},[],{"data":33156,"content":33157,"nodeType":876},{"uri":30678},[33158],{"data":33159,"marks":33160,"value":32581,"nodeType":865},{},[],{"data":33162,"marks":33163,"value":21,"nodeType":865},{},[],{"data":33165,"content":33166,"nodeType":894},{},[],{"data":33168,"content":33169,"nodeType":904},{},[33170],{"data":33171,"marks":33172,"value":32595,"nodeType":865},{},[33173],{"type":902},{"data":33175,"content":33176,"nodeType":881},{},[33177,33180,33186],{"data":33178,"marks":33179,"value":32602,"nodeType":865},{},[],{"data":33181,"content":33182,"nodeType":876},{"uri":5192},[33183],{"data":33184,"marks":33185,"value":4540,"nodeType":865},{},[],{"data":33187,"marks":33188,"value":32612,"nodeType":865},{},[],{"data":33190,"content":33191,"nodeType":881},{},[33192],{"data":33193,"marks":33194,"value":32619,"nodeType":865},{},[],{"data":33196,"content":33197,"nodeType":881},{},[33198,33201,33207],{"data":33199,"marks":33200,"value":32626,"nodeType":865},{},[],{"data":33202,"content":33203,"nodeType":876},{"uri":32629},[33204],{"data":33205,"marks":33206,"value":32634,"nodeType":865},{},[],{"data":33208,"marks":33209,"value":21,"nodeType":865},{},[],{"entries":33211},{"hyperlink":33212,"inline":33213,"block":33214},[],[],[33215,33222],{"sys":33216,"__typename":7008,"title":33217,"caption":59,"layoutMode":59,"file":33218},{"id":32188},"Phishing evasion techniques matrix",{"url":33219,"width":33220,"height":33221},"https://images.ctfassets.net/y1cdw1ablpvd/2cWkqvkdur2bE8wcXDBp5k/a0dce8da8d4210b845da30e4653119d3/Group_543__1_.png",2224,1401,{"sys":33223,"__typename":1471,"type":1472,"ctaText":33224,"buttonLabel":33225,"buttonColour":1475,"buttonUrl":30678},{"id":32370},"Learn more about how phishing attacks have evolved and why they're so effective at evading detection controls.","Get the Whitepaper",{"items":33227},[],{},"How modern phishing attacks evade detection controls","guide",{"items":33232},[33233,34093,34762],{"__typename":1485,"sys":33234,"content":33235,"title":31713,"synopsis":31714,"hashTags":59,"publishedDate":31715,"slug":31716,"tagsCollection":34083,"authorsCollection":34089},{"id":19299},{"json":33236},{"data":33237,"content":33238,"nodeType":1463},{},[33239,33245,33255,33265,33275,33285,33290,33306,33312,33325,33331,33336,33339,33346,33352,33358,33364,33369,33372,33379,33385,33401,33407,33413,33419,33425,33430,33436,33442,33448,33473,33479,33495,33501,33507,33523,33539,33555,33560,33566,33579,33585,33591,33597,33613,33620,33626,33632,33635,33642,33648,33654,33660,33699,33704,33710,33723,33800,33805,33811,33817,33874,33880,33886,33892,33897,33903,33909,33915,33920,33926,33932,33938,33943,33959,33965,33971,34010,34015,34018,34025,34045,34048,34055,34061,34067],{"data":33240,"content":33241,"nodeType":881},{},[33242],{"data":33243,"marks":33244,"value":30737,"nodeType":865},{},[],{"data":33246,"content":33247,"nodeType":881},{},[33248,33252],{"data":33249,"marks":33250,"value":30745,"nodeType":865},{},[33251],{"type":902},{"data":33253,"marks":33254,"value":30749,"nodeType":865},{},[],{"data":33256,"content":33257,"nodeType":881},{},[33258,33262],{"data":33259,"marks":33260,"value":30757,"nodeType":865},{},[33261],{"type":902},{"data":33263,"marks":33264,"value":30761,"nodeType":865},{},[],{"data":33266,"content":33267,"nodeType":881},{},[33268,33272],{"data":33269,"marks":33270,"value":30769,"nodeType":865},{},[33271],{"type":902},{"data":33273,"marks":33274,"value":30773,"nodeType":865},{},[],{"data":33276,"content":33277,"nodeType":881},{},[33278,33282],{"data":33279,"marks":33280,"value":30781,"nodeType":865},{},[33281],{"type":902},{"data":33283,"marks":33284,"value":30785,"nodeType":865},{},[],{"data":33286,"content":33289,"nodeType":890},{"target":33287},{"sys":33288},{"id":30790,"type":887,"linkType":888},[],{"data":33291,"content":33292,"nodeType":881},{},[33293,33296,33303],{"data":33294,"marks":33295,"value":30798,"nodeType":865},{},[],{"data":33297,"content":33298,"nodeType":876},{"uri":30801},[33299],{"data":33300,"marks":33301,"value":30807,"nodeType":865},{},[33302],{"type":874},{"data":33304,"marks":33305,"value":30811,"nodeType":865},{},[],{"data":33307,"content":33308,"nodeType":881},{},[33309],{"data":33310,"marks":33311,"value":30818,"nodeType":865},{},[],{"data":33313,"content":33314,"nodeType":881},{},[33315,33318,33322],{"data":33316,"marks":33317,"value":30825,"nodeType":865},{},[],{"data":33319,"marks":33320,"value":30830,"nodeType":865},{},[33321],{"type":902},{"data":33323,"marks":33324,"value":30834,"nodeType":865},{},[],{"data":33326,"content":33327,"nodeType":881},{},[33328],{"data":33329,"marks":33330,"value":30841,"nodeType":865},{},[],{"data":33332,"content":33335,"nodeType":890},{"target":33333},{"sys":33334},{"id":30846,"type":887,"linkType":888},[],{"data":33337,"content":33338,"nodeType":894},{},[],{"data":33340,"content":33341,"nodeType":904},{},[33342],{"data":33343,"marks":33344,"value":30858,"nodeType":865},{},[33345],{"type":902},{"data":33347,"content":33348,"nodeType":881},{},[33349],{"data":33350,"marks":33351,"value":30865,"nodeType":865},{},[],{"data":33353,"content":33354,"nodeType":881},{},[33355],{"data":33356,"marks":33357,"value":30872,"nodeType":865},{},[],{"data":33359,"content":33360,"nodeType":881},{},[33361],{"data":33362,"marks":33363,"value":30879,"nodeType":865},{},[],{"data":33365,"content":33368,"nodeType":890},{"target":33366},{"sys":33367},{"id":30884,"type":887,"linkType":888},[],{"data":33370,"content":33371,"nodeType":894},{},[],{"data":33373,"content":33374,"nodeType":904},{},[33375],{"data":33376,"marks":33377,"value":30896,"nodeType":865},{},[33378],{"type":902},{"data":33380,"content":33381,"nodeType":881},{},[33382],{"data":33383,"marks":33384,"value":30903,"nodeType":865},{},[],{"data":33386,"content":33387,"nodeType":881},{},[33388,33391,33398],{"data":33389,"marks":33390,"value":30910,"nodeType":865},{},[],{"data":33392,"content":33393,"nodeType":876},{"uri":30913},[33394],{"data":33395,"marks":33396,"value":30919,"nodeType":865},{},[33397],{"type":874},{"data":33399,"marks":33400,"value":30923,"nodeType":865},{},[],{"data":33402,"content":33403,"nodeType":881},{},[33404],{"data":33405,"marks":33406,"value":30930,"nodeType":865},{},[],{"data":33408,"content":33409,"nodeType":881},{},[33410],{"data":33411,"marks":33412,"value":30937,"nodeType":865},{},[],{"data":33414,"content":33415,"nodeType":1860},{},[33416],{"data":33417,"marks":33418,"value":30944,"nodeType":865},{},[],{"data":33420,"content":33421,"nodeType":881},{},[33422],{"data":33423,"marks":33424,"value":30951,"nodeType":865},{},[],{"data":33426,"content":33429,"nodeType":890},{"target":33427},{"sys":33428},{"id":30956,"type":887,"linkType":888},[],{"data":33431,"content":33432,"nodeType":881},{},[33433],{"data":33434,"marks":33435,"value":30964,"nodeType":865},{},[],{"data":33437,"content":33438,"nodeType":1860},{},[33439],{"data":33440,"marks":33441,"value":30971,"nodeType":865},{},[],{"data":33443,"content":33444,"nodeType":881},{},[33445],{"data":33446,"marks":33447,"value":30978,"nodeType":865},{},[],{"data":33449,"content":33450,"nodeType":881},{},[33451,33454,33462,33466,33469],{"data":33452,"marks":33453,"value":30985,"nodeType":865},{},[],{"data":33455,"content":33456,"nodeType":876},{"uri":30988},[33457],{"data":33458,"marks":33459,"value":30995,"nodeType":865},{},[33460,33461],{"type":874},{"type":902},{"data":33463,"marks":33464,"value":2091,"nodeType":865},{},[33465],{"type":902},{"data":33467,"marks":33468,"value":31003,"nodeType":865},{},[],{"data":33470,"marks":33471,"value":29975,"nodeType":865},{},[33472],{"type":902},{"data":33474,"content":33475,"nodeType":881},{},[33476],{"data":33477,"marks":33478,"value":31014,"nodeType":865},{},[],{"data":33480,"content":33481,"nodeType":881},{},[33482,33485,33492],{"data":33483,"marks":33484,"value":31021,"nodeType":865},{},[],{"data":33486,"content":33487,"nodeType":876},{"uri":30801},[33488],{"data":33489,"marks":33490,"value":19950,"nodeType":865},{},[33491],{"type":874},{"data":33493,"marks":33494,"value":31032,"nodeType":865},{},[],{"data":33496,"content":33497,"nodeType":1860},{},[33498],{"data":33499,"marks":33500,"value":31039,"nodeType":865},{},[],{"data":33502,"content":33503,"nodeType":881},{},[33504],{"data":33505,"marks":33506,"value":31046,"nodeType":865},{},[],{"data":33508,"content":33509,"nodeType":881},{},[33510,33513,33520],{"data":33511,"marks":33512,"value":31053,"nodeType":865},{},[],{"data":33514,"content":33515,"nodeType":876},{"uri":31056},[33516],{"data":33517,"marks":33518,"value":31062,"nodeType":865},{},[33519],{"type":874},{"data":33521,"marks":33522,"value":31066,"nodeType":865},{},[],{"data":33524,"content":33525,"nodeType":881},{},[33526,33529,33536],{"data":33527,"marks":33528,"value":31073,"nodeType":865},{},[],{"data":33530,"content":33531,"nodeType":876},{"uri":31076},[33532],{"data":33533,"marks":33534,"value":31082,"nodeType":865},{},[33535],{"type":874},{"data":33537,"marks":33538,"value":31086,"nodeType":865},{},[],{"data":33540,"content":33541,"nodeType":881},{},[33542,33545,33552],{"data":33543,"marks":33544,"value":31093,"nodeType":865},{},[],{"data":33546,"content":33547,"nodeType":876},{"uri":31096},[33548],{"data":33549,"marks":33550,"value":31102,"nodeType":865},{},[33551],{"type":874},{"data":33553,"marks":33554,"value":31106,"nodeType":865},{},[],{"data":33556,"content":33559,"nodeType":890},{"target":33557},{"sys":33558},{"id":31111,"type":887,"linkType":888},[],{"data":33561,"content":33562,"nodeType":1860},{},[33563],{"data":33564,"marks":33565,"value":31119,"nodeType":865},{},[],{"data":33567,"content":33568,"nodeType":881},{},[33569,33572,33576],{"data":33570,"marks":33571,"value":31126,"nodeType":865},{},[],{"data":33573,"marks":33574,"value":31131,"nodeType":865},{},[33575],{"type":5120},{"data":33577,"marks":33578,"value":31135,"nodeType":865},{},[],{"data":33580,"content":33581,"nodeType":881},{},[33582],{"data":33583,"marks":33584,"value":31142,"nodeType":865},{},[],{"data":33586,"content":33587,"nodeType":881},{},[33588],{"data":33589,"marks":33590,"value":31149,"nodeType":865},{},[],{"data":33592,"content":33593,"nodeType":881},{},[33594],{"data":33595,"marks":33596,"value":31156,"nodeType":865},{},[],{"data":33598,"content":33599,"nodeType":881},{},[33600,33603,33610],{"data":33601,"marks":33602,"value":31163,"nodeType":865},{},[],{"data":33604,"content":33605,"nodeType":876},{"uri":11116},[33606],{"data":33607,"marks":33608,"value":31171,"nodeType":865},{},[33609],{"type":874},{"data":33611,"marks":33612,"value":31175,"nodeType":865},{},[],{"data":33614,"content":33615,"nodeType":881},{},[33616],{"data":33617,"marks":33618,"value":31183,"nodeType":865},{},[33619],{"type":902},{"data":33621,"content":33622,"nodeType":881},{},[33623],{"data":33624,"marks":33625,"value":31190,"nodeType":865},{},[],{"data":33627,"content":33628,"nodeType":881},{},[33629],{"data":33630,"marks":33631,"value":31197,"nodeType":865},{},[],{"data":33633,"content":33634,"nodeType":894},{},[],{"data":33636,"content":33637,"nodeType":904},{},[33638],{"data":33639,"marks":33640,"value":31208,"nodeType":865},{},[33641],{"type":902},{"data":33643,"content":33644,"nodeType":881},{},[33645],{"data":33646,"marks":33647,"value":31215,"nodeType":865},{},[],{"data":33649,"content":33650,"nodeType":881},{},[33651],{"data":33652,"marks":33653,"value":31222,"nodeType":865},{},[],{"data":33655,"content":33656,"nodeType":881},{},[33657],{"data":33658,"marks":33659,"value":31229,"nodeType":865},{},[],{"data":33661,"content":33662,"nodeType":1818},{},[33663,33672,33681,33690],{"data":33664,"content":33665,"nodeType":1734},{},[33666],{"data":33667,"content":33668,"nodeType":881},{},[33669],{"data":33670,"marks":33671,"value":31242,"nodeType":865},{},[],{"data":33673,"content":33674,"nodeType":1734},{},[33675],{"data":33676,"content":33677,"nodeType":881},{},[33678],{"data":33679,"marks":33680,"value":31252,"nodeType":865},{},[],{"data":33682,"content":33683,"nodeType":1734},{},[33684],{"data":33685,"content":33686,"nodeType":881},{},[33687],{"data":33688,"marks":33689,"value":31262,"nodeType":865},{},[],{"data":33691,"content":33692,"nodeType":1734},{},[33693],{"data":33694,"content":33695,"nodeType":881},{},[33696],{"data":33697,"marks":33698,"value":31272,"nodeType":865},{},[],{"data":33700,"content":33703,"nodeType":890},{"target":33701},{"sys":33702},{"id":31277,"type":887,"linkType":888},[],{"data":33705,"content":33706,"nodeType":881},{},[33707],{"data":33708,"marks":33709,"value":31285,"nodeType":865},{},[],{"data":33711,"content":33712,"nodeType":881},{},[33713,33716,33720],{"data":33714,"marks":33715,"value":31292,"nodeType":865},{},[],{"data":33717,"marks":33718,"value":30830,"nodeType":865},{},[33719],{"type":902},{"data":33721,"marks":33722,"value":31300,"nodeType":865},{},[],{"data":33724,"content":33725,"nodeType":1818},{},[33726,33755,33764,33773,33782,33791],{"data":33727,"content":33728,"nodeType":1734},{},[33729],{"data":33730,"content":33731,"nodeType":881},{},[33732,33735,33742,33745,33752],{"data":33733,"marks":33734,"value":31313,"nodeType":865},{},[],{"data":33736,"content":33737,"nodeType":876},{"uri":31316},[33738],{"data":33739,"marks":33740,"value":31322,"nodeType":865},{},[33741],{"type":874},{"data":33743,"marks":33744,"value":31326,"nodeType":865},{},[],{"data":33746,"content":33747,"nodeType":876},{"uri":31329},[33748],{"data":33749,"marks":33750,"value":31335,"nodeType":865},{},[33751],{"type":874},{"data":33753,"marks":33754,"value":31339,"nodeType":865},{},[],{"data":33756,"content":33757,"nodeType":1734},{},[33758],{"data":33759,"content":33760,"nodeType":881},{},[33761],{"data":33762,"marks":33763,"value":31349,"nodeType":865},{},[],{"data":33765,"content":33766,"nodeType":1734},{},[33767],{"data":33768,"content":33769,"nodeType":881},{},[33770],{"data":33771,"marks":33772,"value":31359,"nodeType":865},{},[],{"data":33774,"content":33775,"nodeType":1734},{},[33776],{"data":33777,"content":33778,"nodeType":881},{},[33779],{"data":33780,"marks":33781,"value":31369,"nodeType":865},{},[],{"data":33783,"content":33784,"nodeType":1734},{},[33785],{"data":33786,"content":33787,"nodeType":881},{},[33788],{"data":33789,"marks":33790,"value":31379,"nodeType":865},{},[],{"data":33792,"content":33793,"nodeType":1734},{},[33794],{"data":33795,"content":33796,"nodeType":881},{},[33797],{"data":33798,"marks":33799,"value":31389,"nodeType":865},{},[],{"data":33801,"content":33804,"nodeType":890},{"target":33802},{"sys":33803},{"id":31394,"type":887,"linkType":888},[],{"data":33806,"content":33807,"nodeType":1860},{},[33808],{"data":33809,"marks":33810,"value":31402,"nodeType":865},{},[],{"data":33812,"content":33813,"nodeType":881},{},[33814],{"data":33815,"marks":33816,"value":31409,"nodeType":865},{},[],{"data":33818,"content":33819,"nodeType":1818},{},[33820,33829,33838,33847,33856,33865],{"data":33821,"content":33822,"nodeType":1734},{},[33823],{"data":33824,"content":33825,"nodeType":881},{},[33826],{"data":33827,"marks":33828,"value":31422,"nodeType":865},{},[],{"data":33830,"content":33831,"nodeType":1734},{},[33832],{"data":33833,"content":33834,"nodeType":881},{},[33835],{"data":33836,"marks":33837,"value":31432,"nodeType":865},{},[],{"data":33839,"content":33840,"nodeType":1734},{},[33841],{"data":33842,"content":33843,"nodeType":881},{},[33844],{"data":33845,"marks":33846,"value":31442,"nodeType":865},{},[],{"data":33848,"content":33849,"nodeType":1734},{},[33850],{"data":33851,"content":33852,"nodeType":881},{},[33853],{"data":33854,"marks":33855,"value":31452,"nodeType":865},{},[],{"data":33857,"content":33858,"nodeType":1734},{},[33859],{"data":33860,"content":33861,"nodeType":881},{},[33862],{"data":33863,"marks":33864,"value":31462,"nodeType":865},{},[],{"data":33866,"content":33867,"nodeType":1734},{},[33868],{"data":33869,"content":33870,"nodeType":881},{},[33871],{"data":33872,"marks":33873,"value":31472,"nodeType":865},{},[],{"data":33875,"content":33876,"nodeType":881},{},[33877],{"data":33878,"marks":33879,"value":31479,"nodeType":865},{},[],{"data":33881,"content":33882,"nodeType":881},{},[33883],{"data":33884,"marks":33885,"value":31486,"nodeType":865},{},[],{"data":33887,"content":33888,"nodeType":881},{},[33889],{"data":33890,"marks":33891,"value":31493,"nodeType":865},{},[],{"data":33893,"content":33896,"nodeType":890},{"target":33894},{"sys":33895},{"id":31498,"type":887,"linkType":888},[],{"data":33898,"content":33899,"nodeType":881},{},[33900],{"data":33901,"marks":33902,"value":31506,"nodeType":865},{},[],{"data":33904,"content":33905,"nodeType":1860},{},[33906],{"data":33907,"marks":33908,"value":31513,"nodeType":865},{},[],{"data":33910,"content":33911,"nodeType":881},{},[33912],{"data":33913,"marks":33914,"value":31520,"nodeType":865},{},[],{"data":33916,"content":33919,"nodeType":890},{"target":33917},{"sys":33918},{"id":31525,"type":887,"linkType":888},[],{"data":33921,"content":33922,"nodeType":1860},{},[33923],{"data":33924,"marks":33925,"value":31533,"nodeType":865},{},[],{"data":33927,"content":33928,"nodeType":881},{},[33929],{"data":33930,"marks":33931,"value":31540,"nodeType":865},{},[],{"data":33933,"content":33934,"nodeType":881},{},[33935],{"data":33936,"marks":33937,"value":31547,"nodeType":865},{},[],{"data":33939,"content":33942,"nodeType":890},{"target":33940},{"sys":33941},{"id":31552,"type":887,"linkType":888},[],{"data":33944,"content":33945,"nodeType":881},{},[33946,33949,33956],{"data":33947,"marks":33948,"value":31560,"nodeType":865},{},[],{"data":33950,"content":33951,"nodeType":876},{"uri":30552},[33952],{"data":33953,"marks":33954,"value":31568,"nodeType":865},{},[33955],{"type":874},{"data":33957,"marks":33958,"value":31572,"nodeType":865},{},[],{"data":33960,"content":33961,"nodeType":1860},{},[33962],{"data":33963,"marks":33964,"value":31579,"nodeType":865},{},[],{"data":33966,"content":33967,"nodeType":881},{},[33968],{"data":33969,"marks":33970,"value":31586,"nodeType":865},{},[],{"data":33972,"content":33973,"nodeType":1818},{},[33974,33983,33992,34001],{"data":33975,"content":33976,"nodeType":1734},{},[33977],{"data":33978,"content":33979,"nodeType":881},{},[33980],{"data":33981,"marks":33982,"value":31599,"nodeType":865},{},[],{"data":33984,"content":33985,"nodeType":1734},{},[33986],{"data":33987,"content":33988,"nodeType":881},{},[33989],{"data":33990,"marks":33991,"value":31609,"nodeType":865},{},[],{"data":33993,"content":33994,"nodeType":1734},{},[33995],{"data":33996,"content":33997,"nodeType":881},{},[33998],{"data":33999,"marks":34000,"value":31619,"nodeType":865},{},[],{"data":34002,"content":34003,"nodeType":1734},{},[34004],{"data":34005,"content":34006,"nodeType":881},{},[34007],{"data":34008,"marks":34009,"value":31629,"nodeType":865},{},[],{"data":34011,"content":34014,"nodeType":890},{"target":34012},{"sys":34013},{"id":31634,"type":887,"linkType":888},[],{"data":34016,"content":34017,"nodeType":894},{},[],{"data":34019,"content":34020,"nodeType":904},{},[34021],{"data":34022,"marks":34023,"value":31646,"nodeType":865},{},[34024],{"type":902},{"data":34026,"content":34027,"nodeType":881},{},[34028,34031,34038,34041],{"data":34029,"marks":34030,"value":31653,"nodeType":865},{},[],{"data":34032,"content":34033,"nodeType":876},{"uri":31656},[34034],{"data":34035,"marks":34036,"value":31662,"nodeType":865},{},[34037],{"type":874},{"data":34039,"marks":34040,"value":1877,"nodeType":865},{},[],{"data":34042,"marks":34043,"value":31670,"nodeType":865},{},[34044],{"type":902},{"data":34046,"content":34047,"nodeType":894},{},[],{"data":34049,"content":34050,"nodeType":904},{},[34051],{"data":34052,"marks":34053,"value":4448,"nodeType":865},{},[34054],{"type":902},{"data":34056,"content":34057,"nodeType":881},{},[34058],{"data":34059,"marks":34060,"value":31687,"nodeType":865},{},[],{"data":34062,"content":34063,"nodeType":881},{},[34064],{"data":34065,"marks":34066,"value":31694,"nodeType":865},{},[],{"data":34068,"content":34069,"nodeType":881},{},[34070,34073,34080],{"data":34071,"marks":34072,"value":31701,"nodeType":865},{},[],{"data":34074,"content":34075,"nodeType":876},{"uri":6048},[34076],{"data":34077,"marks":34078,"value":31709,"nodeType":865},{},[34079],{"type":874},{"data":34081,"marks":34082,"value":21,"nodeType":865},{},[],{"items":34084},[34085,34087],{"sys":34086,"name":342},{"id":4510},{"sys":34088,"name":4507},{"id":4506},{"items":34090},[34091],{"fullName":20080,"firstName":20081,"jobTitle":20082,"profilePicture":34092},{"url":20084},{"__typename":1485,"sys":34094,"content":34096,"title":34748,"synopsis":34749,"hashTags":59,"publishedDate":34750,"slug":34751,"tagsCollection":34752,"authorsCollection":34758},{"id":34095},"7dqGkFzSMA00bIJ94rW4na",{"json":34097},{"data":34098,"content":34099,"nodeType":1463},{},[34100,34107,34114,34120,34145,34165,34168,34176,34183,34190,34198,34218,34221,34229,34236,34241,34248,34254,34257,34265,34272,34279,34302,34309,34342,34349,34357,34376,34383,34389,34416,34446,34454,34461,34468,34501,34504,34512,34531,34538,34561,34568,34574,34577,34585,34592,34715,34718,34725,34732],{"data":34101,"content":34102,"nodeType":881},{},[34103],{"data":34104,"marks":34105,"value":34106,"nodeType":865},{},[],"As awareness grows around many MFA methods being “phishable” (i.e. not phishing resistant), passwordless authentication methods are being increasingly advocated. ",{"data":34108,"content":34109,"nodeType":881},{},[34110],{"data":34111,"marks":34112,"value":34113,"nodeType":865},{},[],"This is a good thing. The most commonly used MFA factors (like SMS codes, push notifications, and app-based OTP) are routinely bypassed, with modern reverse-proxy phishing kits the most common method. ",{"data":34115,"content":34119,"nodeType":890},{"target":34116},{"sys":34117},{"id":34118,"type":887,"linkType":888},"ImwzE2R9qaHaqlWn0GqIa",[],{"data":34121,"content":34122,"nodeType":881},{},[34123,34127,34132,34136,34141],{"data":34124,"marks":34125,"value":34126,"nodeType":865},{},[],"Often referred to as a “passkey”, passwordless authentication typically consists of a hardware security device that is built-into your laptop (e.g. the fingerprint sensor on a laptop) or something you plug into your device (e.g. a Yubikey). Because passkey-based logins are domain-bound, trying to use a passkey for ",{"data":34128,"marks":34129,"value":34131,"nodeType":865},{},[34130],{"type":874},"microsoft.com",{"data":34133,"marks":34134,"value":34135,"nodeType":865},{},[]," on ",{"data":34137,"marks":34138,"value":34140,"nodeType":865},{},[34139],{"type":874},"phishing.com",{"data":34142,"marks":34143,"value":34144,"nodeType":865},{},[]," simply won’t generate the correct value to pass the authentication check, even when proxied using an AitM kit. ",{"data":34146,"content":34147,"nodeType":881},{},[34148,34152,34162],{"data":34149,"marks":34150,"value":34151,"nodeType":865},{},[],"However, attackers have realized that even as these new phishing-resistant methods are starting to become used, most users still have alternative MFA methods active. The attacker can then do what’s called a ",{"data":34153,"content":34155,"nodeType":876},{"uri":34154},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/mfa_downgrade/description.md",[34156],{"data":34157,"marks":34158,"value":34161,"nodeType":865},{},[34159,34160],{"type":874},{"type":902},"downgrade attack",{"data":34163,"marks":34164,"value":959,"nodeType":865},{},[],{"data":34166,"content":34167,"nodeType":894},{},[],{"data":34169,"content":34170,"nodeType":904},{},[34171],{"data":34172,"marks":34173,"value":34175,"nodeType":865},{},[34174],{"type":902},"Downgrade attacks 101",{"data":34177,"content":34178,"nodeType":881},{},[34179],{"data":34180,"marks":34181,"value":34182,"nodeType":865},{},[],"When conducting an Attacker-in-the-Middle phishing attack, the attacker doesn’t need to relay 100% of the messages accurately. Instead, they can alter some of them. The app might ask the user “You need to MFA — do you want to use your passkey, or your backup authenticator code?”, but the phishing website might modify this page to say “You need to MFA — use your backup authenticator code” not giving you the option to use your secure passkey. This is called a downgrade attack.",{"data":34184,"content":34185,"nodeType":881},{},[34186],{"data":34187,"marks":34188,"value":34189,"nodeType":865},{},[],"This can also be applied to accounts that use SSO as the default login method. In this scenario, the phish kit can select a backup username and password option to allow the phishing attack to proceed.  ",{"data":34191,"content":34192,"nodeType":881},{},[34193],{"data":34194,"marks":34195,"value":34197,"nodeType":865},{},[34196],{"type":902},"So, you have a situation where even if a phishing-resistant login method exists, the presence of a less secure backup method means the account is still vulnerable to phishing attacks. ",{"data":34199,"content":34200,"nodeType":881},{},[34201,34205,34214],{"data":34202,"marks":34203,"value":34204,"nodeType":865},{},[],"These attacks are effective across a number of sites and login methods that support passkey-based logins, for example, Windows Hello, Okta FastPass, and Google Workspace. As an example, here’s a link to a ",{"data":34206,"content":34208,"nodeType":876},{"uri":34207},"https://github.com/yudasm/WHfB-o365-Phishlet",[34209],{"data":34210,"marks":34211,"value":34213,"nodeType":865},{},[34212],{"type":874},"custom phishlet for Evilginx",{"data":34215,"marks":34216,"value":34217,"nodeType":865},{},[]," targeting Windows Hello for Business. A small caveat is that changes made by Microsoft have since broken this plugin, but we were able to write our own custom phishlet to achieve the same outcome. ",{"data":34219,"content":34220,"nodeType":894},{},[],{"data":34222,"content":34223,"nodeType":904},{},[34224],{"data":34225,"marks":34226,"value":34228,"nodeType":865},{},[34227],{"type":902},"MFA downgrade in action",{"data":34230,"content":34231,"nodeType":881},{},[34232],{"data":34233,"marks":34234,"value":34235,"nodeType":865},{},[],"Check out the video below to see an example of using Evilginx with a custom phishlet to downgrade authentication for a Microsoft account using Windows Hello. ",{"data":34237,"content":34240,"nodeType":890},{"target":34238},{"sys":34239},{"id":30209,"type":887,"linkType":888},[],{"data":34242,"content":34243,"nodeType":881},{},[34244],{"data":34245,"marks":34246,"value":34247,"nodeType":865},{},[],"We’ve encountered similar functionality in criminal phishing platforms we’ve investigated such as Tycoon — in this case, targeting Google accounts. This snippet is notable in that it includes JavaScript to abuse UI features to bypass passkeys.",{"data":34249,"content":34253,"nodeType":890},{"target":34250},{"sys":34251},{"id":34252,"type":887,"linkType":888},"5Vya1VApSisr0000HuTLY2",[],{"data":34255,"content":34256,"nodeType":894},{},[],{"data":34258,"content":34259,"nodeType":904},{},[34260],{"data":34261,"marks":34262,"value":34264,"nodeType":865},{},[34263],{"type":902},"Mitigations (and challenges)",{"data":34266,"content":34267,"nodeType":881},{},[34268],{"data":34269,"marks":34270,"value":34271,"nodeType":865},{},[],"MFA downgrade is made possible by the existence of backup authentication methods. So the obvious solution is to remove backup/unused login and MFA methods from your accounts, ensuring you’re accessing apps using SSO from a hardened Identity Provider (IdP) account (e.g. Okta, Entra, Google Workspace). ",{"data":34273,"content":34274,"nodeType":881},{},[34275],{"data":34276,"marks":34277,"value":34278,"nodeType":865},{},[],"In the ideal world, you’d be:",{"data":34280,"content":34281,"nodeType":1818},{},[34282,34292],{"data":34283,"content":34284,"nodeType":1734},{},[34285],{"data":34286,"content":34287,"nodeType":881},{},[34288],{"data":34289,"marks":34290,"value":34291,"nodeType":865},{},[],"Using only one IdP account, which you access via passkey, with no backup methods.",{"data":34293,"content":34294,"nodeType":1734},{},[34295],{"data":34296,"content":34297,"nodeType":881},{},[34298],{"data":34299,"marks":34300,"value":34301,"nodeType":865},{},[],"Accessing all business apps using SSO from your locked-down IdP account. ",{"data":34303,"content":34304,"nodeType":881},{},[34305],{"data":34306,"marks":34307,"value":34308,"nodeType":865},{},[],"The reality is way different, though. Because going totally passwordless is hard. It requires a large investment of time, money, and training for end-users. You’ll find many cautionary tales of companies starting on their passkey adoption journey and ultimately failing to make it a reality. This is largely because:",{"data":34310,"content":34311,"nodeType":1818},{},[34312,34322,34332],{"data":34313,"content":34314,"nodeType":1734},{},[34315],{"data":34316,"content":34317,"nodeType":881},{},[34318],{"data":34319,"marks":34320,"value":34321,"nodeType":865},{},[],"In environments with a mix of older and newer infrastructure, it can be challenging to get complete coverage. ",{"data":34323,"content":34324,"nodeType":1734},{},[34325],{"data":34326,"content":34327,"nodeType":881},{},[34328],{"data":34329,"marks":34330,"value":34331,"nodeType":865},{},[],"Not every device comes with an in-built biometric identification method, so you need to use a second device — which employees may struggle with (especially when they lose it and aren’t familiar with how to regain account access).",{"data":34333,"content":34334,"nodeType":1734},{},[34335],{"data":34336,"content":34337,"nodeType":881},{},[34338],{"data":34339,"marks":34340,"value":34341,"nodeType":865},{},[],"Most apps don’t allow you to log in directly with a passkey, meaning you need to SSO from your IdP account. But many apps don’t support every preferred SSO provider, and fail to provide SAML support, so there can be gaps.  ",{"data":34343,"content":34344,"nodeType":881},{},[34345],{"data":34346,"marks":34347,"value":34348,"nodeType":865},{},[],"And ultimately, because of the self-service, product-led growth fuelled nature of most online services today, it’s easy for users to slip back into using passwords — and hard for security teams to find and remove them (particularly if an app isn’t centrally managed). And the level of support that different apps provide users and administrators to secure how they access their services varies significantly. ",{"data":34350,"content":34351,"nodeType":1860},{},[34352],{"data":34353,"marks":34354,"value":34356,"nodeType":865},{},[34355],{"type":902},"Most apps make removing phishable authentication hard",{"data":34358,"content":34359,"nodeType":881},{},[34360,34364,34372],{"data":34361,"marks":34362,"value":34363,"nodeType":865},{},[],"While some providers are taking steps to go passwordless by default, which makes it easier to remove passwords (e.g. ",{"data":34365,"content":34367,"nodeType":876},{"uri":34366},"https://techcommunity.microsoft.com/blog/microsoft-entra-blog/introducing-password-removal-for-microsoft-accounts/2747280",[34368],{"data":34369,"marks":34370,"value":1718,"nodeType":865},{},[34371],{"type":874},{"data":34373,"marks":34374,"value":34375,"nodeType":865},{},[]," recently made a big deal of its desire to get rid of passwords), the quality of identity security management functionality varies significantly from app to app. ",{"data":34377,"content":34378,"nodeType":881},{},[34379],{"data":34380,"marks":34381,"value":34382,"nodeType":865},{},[],"Many apps default to the most recently used or strongest login method, but very few automatically lock you in to using the strongest method available. Most of the time, these kinds of controls also need to be configured in the app — which can be challenging if your security team doesn’t manage it (or simply isn’t aware of it). ",{"data":34384,"content":34388,"nodeType":890},{"target":34385},{"sys":34386},{"id":34387,"type":887,"linkType":888},"4X9MR0CbSMltOmw767XNOm",[],{"data":34390,"content":34391,"nodeType":881},{},[34392,34396,34401,34405,34412],{"data":34393,"marks":34394,"value":34395,"nodeType":865},{},[],"Finally, configuring MFA is often an additive process — you start by adding a phone number, then you add an authenticator app or a passkey. Just like we find that most accounts with SSO ",{"data":34397,"marks":34398,"value":34400,"nodeType":865},{},[34399],{"type":902},"also",{"data":34402,"marks":34403,"value":34404,"nodeType":865},{},[]," have a password login configured (also known as ",{"data":34406,"content":34407,"nodeType":876},{"uri":11116},[34408],{"data":34409,"marks":34410,"value":11122,"nodeType":865},{},[34411],{"type":874},{"data":34413,"marks":34414,"value":34415,"nodeType":865},{},[],"), most accounts with MFA typically have multiple methods attached to their account. ",{"data":34417,"content":34418,"nodeType":881},{},[34419,34423,34430,34433,34442],{"data":34420,"marks":34421,"value":34422,"nodeType":865},{},[],"The result is that even if you can successfully lock down a handful of apps, many more will continue to be susceptible to phishing attacks using commonly available downgrade functionality. And as attackers diversify the apps they target (such as these recent examples targeting ",{"data":34424,"content":34425,"nodeType":876},{"uri":22763},[34426],{"data":34427,"marks":34428,"value":22769,"nodeType":865},{},[34429],{"type":874},{"data":34431,"marks":34432,"value":1651,"nodeType":865},{},[],{"data":34434,"content":34436,"nodeType":876},{"uri":34435},"https://pushsecurity.com/blog/dissecting-a-recent-mailchimp-phishing-attack/",[34437],{"data":34438,"marks":34439,"value":34441,"nodeType":865},{},[34440],{"type":874},"MailChimp",{"data":34443,"marks":34444,"value":34445,"nodeType":865},{},[],"), this becomes increasingly likely. ",{"data":34447,"content":34448,"nodeType":1860},{},[34449],{"data":34450,"marks":34451,"value":34453,"nodeType":865},{},[34452],{"type":902},"Conditional access is a useful mitigation if configured properly, but only on apps which support it",{"data":34455,"content":34456,"nodeType":881},{},[34457],{"data":34458,"marks":34459,"value":34460,"nodeType":865},{},[],"Conditional access policies are a useful last line of defense against account takeover attacks by denying logins that don't meet certain criteria, even if they user is able to authenticate. In larger IdP platforms that typically support more granular conditional access policies, this is a useful addition when configured correctly. However, many apps simply don't support conditional access, so will be vulnerable to attackers targeting them directly (as opposed to first logging into e.g. Microsoft or Google, and then accessing downstream apps via SSO). ",{"data":34462,"content":34463,"nodeType":881},{},[34464],{"data":34465,"marks":34466,"value":34467,"nodeType":865},{},[],"That said, locking down your core IdP platforms with robust conditional access should be a top priority for security teams. Useful policies that should be configured include:",{"data":34469,"content":34470,"nodeType":1818},{},[34471,34481,34491],{"data":34472,"content":34473,"nodeType":1734},{},[34474],{"data":34475,"content":34476,"nodeType":881},{},[34477],{"data":34478,"marks":34479,"value":34480,"nodeType":865},{},[],"Limiting logins to domain-joined devices.",{"data":34482,"content":34483,"nodeType":1734},{},[34484],{"data":34485,"content":34486,"nodeType":881},{},[34487],{"data":34488,"marks":34489,"value":34490,"nodeType":865},{},[],"Set phishing-resistant MFA as required. ",{"data":34492,"content":34493,"nodeType":1734},{},[34494],{"data":34495,"content":34496,"nodeType":881},{},[34497],{"data":34498,"marks":34499,"value":34500,"nodeType":865},{},[],"(Where possible) limit logins to trusted IP ranges. ",{"data":34502,"content":34503,"nodeType":894},{},[],{"data":34505,"content":34506,"nodeType":904},{},[34507],{"data":34508,"marks":34509,"value":34511,"nodeType":865},{},[34510],{"type":902},"Tackling MFA downgrade with Push Security",{"data":34513,"content":34514,"nodeType":881},{},[34515,34519,34527],{"data":34516,"marks":34517,"value":34518,"nodeType":865},{},[],"Phishing-resistant authentication methods like passkeys are key to the future of enterprise identity security, but organizations need to recognize that adopting passkeys isn’t a silver bullet. Ensuring that passkeys are the only authentication method supported by your business apps is no mean feat, considering ",{"data":34520,"content":34521,"nodeType":876},{"uri":30250},[34522],{"data":34523,"marks":34524,"value":34526,"nodeType":865},{},[34525],{"type":874},"most organizations are using hundreds of them",{"data":34528,"marks":34529,"value":34530,"nodeType":865},{},[]," — all with their own specific ways of handling and administering identities. ",{"data":34532,"content":34533,"nodeType":881},{},[34534],{"data":34535,"marks":34536,"value":34537,"nodeType":865},{},[],"That’s why we support a layered defense, providing last-mile protection by:",{"data":34539,"content":34540,"nodeType":1818},{},[34541,34551],{"data":34542,"content":34543,"nodeType":1734},{},[34544],{"data":34545,"content":34546,"nodeType":881},{},[34547],{"data":34548,"marks":34549,"value":34550,"nodeType":865},{},[],"Intercepting and blocking phishing attacks in the browser to prevent AiTM attacks using downgrade techniques.",{"data":34552,"content":34553,"nodeType":1734},{},[34554],{"data":34555,"content":34556,"nodeType":881},{},[34557],{"data":34558,"marks":34559,"value":34560,"nodeType":865},{},[],"Identifying backup MFA and login methods across the business apps your employees use, so they can be removed (individually or through app-level configuration changes).",{"data":34562,"content":34563,"nodeType":881},{},[34564],{"data":34565,"marks":34566,"value":34567,"nodeType":865},{},[],"Here’s how it works.",{"data":34569,"content":34573,"nodeType":890},{"target":34570},{"sys":34571},{"id":34572,"type":887,"linkType":888},"2uvItnfaOQZHa4a9BIIhRn",[],{"data":34575,"content":34576,"nodeType":894},{},[],{"data":34578,"content":34579,"nodeType":904},{},[34580],{"data":34581,"marks":34582,"value":34584,"nodeType":865},{},[34583],{"type":902},"Further reading",{"data":34586,"content":34587,"nodeType":881},{},[34588],{"data":34589,"marks":34590,"value":34591,"nodeType":865},{},[],"MFA downgrade is just one method of getting into an otherwise locked-down account. Attackers are also finding ways to bypass the standard authentication process entirely, through: ",{"data":34593,"content":34594,"nodeType":1818},{},[34595,34628,34661,34681],{"data":34596,"content":34597,"nodeType":1734},{},[34598],{"data":34599,"content":34600,"nodeType":881},{},[34601,34604,34612,34616,34625],{"data":34602,"marks":34603,"value":21,"nodeType":865},{},[],{"data":34605,"content":34606,"nodeType":876},{"uri":30327},[34607],{"data":34608,"marks":34609,"value":34611,"nodeType":865},{},[34610],{"type":874},"App-specific password phishing",{"data":34613,"marks":34614,"value":34615,"nodeType":865},{},[],", where attackers can abuse functionality designed to enable users to log into apps that don’t support modern authentication. (",{"data":34617,"content":34619,"nodeType":876},{"uri":34618},"https://pushsecurity.com/blog/app-specific-password-phishing/",[34620],{"data":34621,"marks":34622,"value":34624,"nodeType":865},{},[34623],{"type":874},"Read the article for more information here",{"data":34626,"marks":34627,"value":30302,"nodeType":865},{},[],{"data":34629,"content":34630,"nodeType":1734},{},[34631],{"data":34632,"content":34633,"nodeType":881},{},[34634,34637,34644,34648,34657],{"data":34635,"marks":34636,"value":21,"nodeType":865},{},[],{"data":34638,"content":34639,"nodeType":876},{"uri":18095},[34640],{"data":34641,"marks":34642,"value":24657,"nodeType":865},{},[34643],{"type":874},{"data":34645,"marks":34646,"value":34647,"nodeType":865},{},[],", which sees the victim accept OAuth scopes for an attacker-controlled app integration granting access to the account without needing to directly compromise it. (",{"data":34649,"content":34651,"nodeType":876},{"uri":34650},"https://pushsecurity.com/blog/how-consent-phishing-is-evolving/",[34652],{"data":34653,"marks":34654,"value":34656,"nodeType":865},{},[34655],{"type":874},"You can read more about recent examples here",{"data":34658,"marks":34659,"value":34660,"nodeType":865},{},[],".) ",{"data":34662,"content":34663,"nodeType":1734},{},[34664],{"data":34665,"content":34666,"nodeType":881},{},[34667,34670,34677],{"data":34668,"marks":34669,"value":21,"nodeType":865},{},[],{"data":34671,"content":34672,"nodeType":876},{"uri":1526},[34673],{"data":34674,"marks":34675,"value":360,"nodeType":865},{},[34676],{"type":874},{"data":34678,"marks":34679,"value":34680,"nodeType":865},{},[],", functionally very similar to consent phishing but involving the victim entering a code for authorization. ",{"data":34682,"content":34683,"nodeType":1734},{},[34684],{"data":34685,"content":34686,"nodeType":881},{},[34687,34690,34698,34702,34711],{"data":34688,"marks":34689,"value":21,"nodeType":865},{},[],{"data":34691,"content":34692,"nodeType":876},{"uri":30350},[34693],{"data":34694,"marks":34695,"value":34697,"nodeType":865},{},[34696],{"type":874},"Cross-IdP impersonation",{"data":34699,"marks":34700,"value":34701,"nodeType":865},{},[],", which sees the attacker register a new IdP connected to the victim’s email account that can be used to access connected apps via SSO without directly compromising the primary IdP. (",{"data":34703,"content":34705,"nodeType":876},{"uri":34704},"https://pushsecurity.com/blog/a-new-class-of-phishing-verification-phishing-and-cross-idp-impersonation/",[34706],{"data":34707,"marks":34708,"value":34710,"nodeType":865},{},[34709],{"type":874},"You can read more about this here",{"data":34712,"marks":34713,"value":34714,"nodeType":865},{},[],".)",{"data":34716,"content":34717,"nodeType":894},{},[],{"data":34719,"content":34720,"nodeType":904},{},[34721],{"data":34722,"marks":34723,"value":29766,"nodeType":865},{},[34724],{"type":902},{"data":34726,"content":34727,"nodeType":881},{},[34728],{"data":34729,"marks":34730,"value":34731,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use, like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more.",{"data":34733,"content":34734,"nodeType":881},{},[34735,34738,34745],{"data":34736,"marks":34737,"value":31701,"nodeType":865},{},[],{"data":34739,"content":34740,"nodeType":876},{"uri":6048},[34741],{"data":34742,"marks":34743,"value":4495,"nodeType":865},{},[34744],{"type":874},{"data":34746,"marks":34747,"value":959,"nodeType":865},{},[],"MFA downgrade: How attackers are getting around phishing-resistant authentication","MFA downgrade attacks are an increasingly common technique used by attackers to bypass phishing-resistant authentication methods registered to an account.","2025-07-21T00:00:00.000Z","mfa-downgrade-attacks",{"items":34753},[34754,34756],{"sys":34755,"name":342},{"id":4510},{"sys":34757,"name":4507},{"id":4506},{"items":34759},[34760],{"fullName":4514,"firstName":4515,"jobTitle":4516,"profilePicture":34761},{"url":4518},{"__typename":1485,"sys":34763,"content":34765,"title":35378,"synopsis":35379,"hashTags":59,"publishedDate":35380,"slug":35381,"tagsCollection":35382,"authorsCollection":35388},{"id":34764},"XQHcBu5kiSBd6MMwICYI4",{"json":34766},{"data":34767,"content":34768,"nodeType":1463},{},[34769,34776,34783,34791,34820,34827,34833,34836,34844,34851,34858,34901,34908,34915,34918,34926,34933,34940,34947,34966,34973,34979,34987,34994,35001,35008,35014,35017,35025,35033,35040,35048,35055,35117,35124,35132,35139,35172,35180,35187,35195,35202,35210,35217,35270,35277,35280,35288,35295,35312,35345,35366,35372],{"data":34770,"content":34771,"nodeType":881},{},[34772],{"data":34773,"marks":34774,"value":34775,"nodeType":865},{},[],"Phishing has undergone a radical transformation. The laughably bad emails and fake PayPal logins of the past have given way to sophisticated campaigns engineered to slip through even the most hardened security stacks. ",{"data":34777,"content":34778,"nodeType":881},{},[34779],{"data":34780,"marks":34781,"value":34782,"nodeType":865},{},[],"Today’s phishing attacks are faster, more adaptable, and harder to catch with traditional tools. Email filters and threat intel still play an important role, but they’re often reacting to threats that are already in motion, and by the time a phishing link is flagged and blocklisted, someone has probably already clicked — and the attacker has moved onto their next set of links.",{"data":34784,"content":34785,"nodeType":881},{},[34786],{"data":34787,"marks":34788,"value":34790,"nodeType":865},{},[34789],{"type":902},"The problem isn’t that phishing has evolved. It’s that our defenses haven’t.",{"data":34792,"content":34793,"nodeType":881},{},[34794,34798,34807,34811,34816],{"data":34795,"marks":34796,"value":34797,"nodeType":865},{},[],"That’s where ",{"data":34799,"content":34801,"nodeType":876},{"uri":34800},"https://pushsecurity.com/uc/zero-day-phishing-protection",[34802],{"data":34803,"marks":34804,"value":34806,"nodeType":865},{},[34805],{"type":874},"Push Security",{"data":34808,"marks":34809,"value":34810,"nodeType":865},{},[]," comes in. By embedding real-time detection directly into the browser, the very place where phishing attacks unfold, Push offers a fundamentally new way to stop phishing: ",{"data":34812,"marks":34813,"value":34815,"nodeType":865},{},[34814],{"type":5120},"as it happens",{"data":34817,"marks":34818,"value":34819,"nodeType":865},{},[],", regardless of whether or not the exact attack has ever been seen before. ",{"data":34821,"content":34822,"nodeType":881},{},[34823],{"data":34824,"marks":34825,"value":34826,"nodeType":865},{},[],"Check out the video to see how it works. ",{"data":34828,"content":34832,"nodeType":890},{"target":34829},{"sys":34830},{"id":34831,"type":887,"linkType":888},"4LaKobadjp19jjocLXcW4E",[],{"data":34834,"content":34835,"nodeType":894},{},[],{"data":34837,"content":34838,"nodeType":904},{},[34839],{"data":34840,"marks":34841,"value":34843,"nodeType":865},{},[34842],{"type":902},"The modern phishing playground",{"data":34845,"content":34846,"nodeType":881},{},[34847],{"data":34848,"marks":34849,"value":34850,"nodeType":865},{},[],"Phishing attacks today look nothing like the blunt instruments of a few years ago. These are fast, customized, and often completely ephemeral. A phishing domain might go live at 9 a.m., compromise scores of credentials, and be gone before lunch, long before it ever hits a threat intel feed.",{"data":34852,"content":34853,"nodeType":881},{},[34854],{"data":34855,"marks":34856,"value":34857,"nodeType":865},{},[],"Modern attackers use:",{"data":34859,"content":34860,"nodeType":1818},{},[34861,34871,34881,34891],{"data":34862,"content":34863,"nodeType":1734},{},[34864],{"data":34865,"content":34866,"nodeType":881},{},[34867],{"data":34868,"marks":34869,"value":34870,"nodeType":865},{},[],"Dynamic content and user-adaptive emails that can be easily changed based on the target’s identity and environment.",{"data":34872,"content":34873,"nodeType":1734},{},[34874],{"data":34875,"content":34876,"nodeType":881},{},[34877],{"data":34878,"marks":34879,"value":34880,"nodeType":865},{},[],"Obfuscated URLs hidden behind trusted services (like Google Sites), making reputation analysis less than reliable.",{"data":34882,"content":34883,"nodeType":1734},{},[34884],{"data":34885,"content":34886,"nodeType":881},{},[34887],{"data":34888,"marks":34889,"value":34890,"nodeType":865},{},[],"Real-time proxying tools to clone login flows and harvest credentials.",{"data":34892,"content":34893,"nodeType":1734},{},[34894],{"data":34895,"content":34896,"nodeType":881},{},[34897],{"data":34898,"marks":34899,"value":34900,"nodeType":865},{},[],"Rapid-fire infrastructure rotation, making the attack’s infrastructure almost impossible to track in time.",{"data":34902,"content":34903,"nodeType":881},{},[34904],{"data":34905,"marks":34906,"value":34907,"nodeType":865},{},[],"These attacks often bypass traditional defenses entirely, not because the tools are broken, but because they were designed for a different era, one where phishing pages lived for days or weeks, not minutes.",{"data":34909,"content":34910,"nodeType":881},{},[34911],{"data":34912,"marks":34913,"value":34914,"nodeType":865},{},[],"It’s not enough to know what was bad yesterday. You need to know what’s happening now.",{"data":34916,"content":34917,"nodeType":894},{},[],{"data":34919,"content":34920,"nodeType":904},{},[34921],{"data":34922,"marks":34923,"value":34925,"nodeType":865},{},[34924],{"type":902},"Why blocklists and perimeter defenses are falling behind",{"data":34927,"content":34928,"nodeType":881},{},[34929],{"data":34930,"marks":34931,"value":34932,"nodeType":865},{},[],"The security ecosystem has long depended on reputation-based systems: block the known bad, allow the rest. That worked when attackers reused infrastructure and relied on mass campaigns. Today’s adversaries have adapted.",{"data":34934,"content":34935,"nodeType":881},{},[34936],{"data":34937,"marks":34938,"value":34939,"nodeType":865},{},[],"Consider a scenario similar to the one from our video:",{"data":34941,"content":34942,"nodeType":881},{},[34943],{"data":34944,"marks":34945,"value":34946,"nodeType":865},{},[],"A staff member receives an email appearing to be from Microsoft Teams. It includes dynamic content that mirrors their actual environment, including their username, company logo, and real collaboration data. The embedded link takes them to a cloned Microsoft login page hosted on a benign-looking subdomain. The site is brand new. It’s not on any blocklist. Your email filter passes it. The employee logs in. Credentials and session tokens? Gone.",{"data":34948,"content":34949,"nodeType":881},{},[34950,34954,34962],{"data":34951,"marks":34952,"value":34953,"nodeType":865},{},[],"And that’s just step one. The attacker now pivots to connected apps like ",{"data":34955,"content":34956,"nodeType":876},{"uri":5836},[34957],{"data":34958,"marks":34959,"value":34961,"nodeType":865},{},[34960],{"type":874},"Jira",{"data":34963,"marks":34964,"value":34965,"nodeType":865},{},[],", Confluence, or AWS, moving laterally through your cloud environment using the compromised credentials.",{"data":34967,"content":34968,"nodeType":881},{},[34969],{"data":34970,"marks":34971,"value":34972,"nodeType":865},{},[],"Traditional tools often miss these threats not due to a lack of sophistication, but because they’re looking from the outside in. The browser is where the attack actually unfolds. Without visibility there, key indicators of compromise go undetected.",{"data":34974,"content":34978,"nodeType":890},{"target":34975},{"sys":34976},{"id":34977,"type":887,"linkType":888},"1UGu43QxCiYofkeGtOMp5J",[],{"data":34980,"content":34981,"nodeType":904},{},[34982],{"data":34983,"marks":34984,"value":34986,"nodeType":865},{},[34985],{"type":902},"Rethinking where phishing defense happens",{"data":34988,"content":34989,"nodeType":881},{},[34990],{"data":34991,"marks":34992,"value":34993,"nodeType":865},{},[],"Push changes where phishing protection happens, from upstream detection to point-of-interaction control. Instead of chasing malicious links through email gateways or external threat feeds, Push embeds lightweight, always-on protection directly, as users go about their work in the browser.",{"data":34995,"content":34996,"nodeType":881},{},[34997],{"data":34998,"marks":34999,"value":35000,"nodeType":865},{},[],"Push monitors what’s happening in each session: how pages are built, how they behave, and how users interact with them. That means it can recognize when a login prompt doesn’t match your identity provider or when a script behaves like part of a phishing toolkit.",{"data":35002,"content":35003,"nodeType":881},{},[35004],{"data":35005,"marks":35006,"value":35007,"nodeType":865},{},[],"When Push identifies something suspicious, it takes action right away. Logins are interrupted before any data is exposed. Users get clear guidance in-browser. And security teams receive detailed telemetry that shows exactly what happened, who was targeted, and how the threat was stopped.",{"data":35009,"content":35013,"nodeType":890},{"target":35010},{"sys":35011},{"id":35012,"type":887,"linkType":888},"7Hu3kypFWwJAGOuQp0kYmU",[],{"data":35015,"content":35016,"nodeType":894},{},[],{"data":35018,"content":35019,"nodeType":904},{},[35020],{"data":35021,"marks":35022,"value":35024,"nodeType":865},{},[35023],{"type":902},"The benefits of browser-native phishing defense",{"data":35026,"content":35027,"nodeType":1860},{},[35028],{"data":35029,"marks":35030,"value":35032,"nodeType":865},{},[35031],{"type":902},"True zero-day protection",{"data":35034,"content":35035,"nodeType":881},{},[35036],{"data":35037,"marks":35038,"value":35039,"nodeType":865},{},[],"Push doesn’t rely on known indicators of compromise. It evaluates the actual behavior and context of every session in real-time. Whether the phishing site was created 5 months ago or 5 minutes ago is irrelevant — Push detects it and shuts it down.",{"data":35041,"content":35042,"nodeType":1860},{},[35043],{"data":35044,"marks":35045,"value":35047,"nodeType":865},{},[35046],{"type":902},"Contextual threat detection",{"data":35049,"content":35050,"nodeType":881},{},[35051],{"data":35052,"marks":35053,"value":35054,"nodeType":865},{},[],"Because Push operates in the browser, it sees everything:",{"data":35056,"content":35057,"nodeType":1818},{},[35058,35068,35078,35097,35107],{"data":35059,"content":35060,"nodeType":1734},{},[35061],{"data":35062,"content":35063,"nodeType":881},{},[35064],{"data":35065,"marks":35066,"value":35067,"nodeType":865},{},[],"The page layout",{"data":35069,"content":35070,"nodeType":1734},{},[35071],{"data":35072,"content":35073,"nodeType":881},{},[35074],{"data":35075,"marks":35076,"value":35077,"nodeType":865},{},[],"Where the user came from",{"data":35079,"content":35080,"nodeType":1734},{},[35081],{"data":35082,"content":35083,"nodeType":881},{},[35084,35087,35094],{"data":35085,"marks":35086,"value":30549,"nodeType":865},{},[],{"data":35088,"content":35089,"nodeType":876},{"uri":30552},[35090],{"data":35091,"marks":35092,"value":30558,"nodeType":865},{},[35093],{"type":874},{"data":35095,"marks":35096,"value":21,"nodeType":865},{},[],{"data":35098,"content":35099,"nodeType":1734},{},[35100],{"data":35101,"content":35102,"nodeType":881},{},[35103],{"data":35104,"marks":35105,"value":35106,"nodeType":865},{},[],"What scripts are running",{"data":35108,"content":35109,"nodeType":1734},{},[35110],{"data":35111,"content":35112,"nodeType":881},{},[35113],{"data":35114,"marks":35115,"value":35116,"nodeType":865},{},[],"And where credentials are being sent",{"data":35118,"content":35119,"nodeType":881},{},[35120],{"data":35121,"marks":35122,"value":35123,"nodeType":865},{},[],"This context enables Push to stop even well-camouflaged phishing attempts, including AitM attacks that bypass MFA.",{"data":35125,"content":35126,"nodeType":1860},{},[35127],{"data":35128,"marks":35129,"value":35131,"nodeType":865},{},[35130],{"type":902},"Real-time interception of malicious activity",{"data":35133,"content":35134,"nodeType":881},{},[35135],{"data":35136,"marks":35137,"value":35138,"nodeType":865},{},[],"As soon as a phishing attempt is confirmed, the response is immediate:",{"data":35140,"content":35141,"nodeType":1818},{},[35142,35152,35162],{"data":35143,"content":35144,"nodeType":1734},{},[35145],{"data":35146,"content":35147,"nodeType":881},{},[35148],{"data":35149,"marks":35150,"value":35151,"nodeType":865},{},[],"Credential entry is halted.",{"data":35153,"content":35154,"nodeType":1734},{},[35155],{"data":35156,"content":35157,"nodeType":881},{},[35158],{"data":35159,"marks":35160,"value":35161,"nodeType":865},{},[],"Sessions are revoked.",{"data":35163,"content":35164,"nodeType":1734},{},[35165],{"data":35166,"content":35167,"nodeType":881},{},[35168],{"data":35169,"marks":35170,"value":35171,"nodeType":865},{},[],"The user is protected without delay.",{"data":35173,"content":35174,"nodeType":1860},{},[35175],{"data":35176,"marks":35177,"value":35179,"nodeType":865},{},[35178],{"type":902},"Reduced incident response overhead",{"data":35181,"content":35182,"nodeType":881},{},[35183],{"data":35184,"marks":35185,"value":35186,"nodeType":865},{},[],"Most phishing attacks end in hours of IR and expensive cleanup. With Push, attacks don’t escalate beyond the initial click. That means fewer compromised accounts, fewer escalations, and less fatigue on your security team.",{"data":35188,"content":35189,"nodeType":1860},{},[35190],{"data":35191,"marks":35192,"value":35194,"nodeType":865},{},[35193],{"type":902},"Empowered, educated users",{"data":35196,"content":35197,"nodeType":881},{},[35198],{"data":35199,"marks":35200,"value":35201,"nodeType":865},{},[],"Push doesn’t just block phishing; it helps users learn from it. When someone interacts with a suspicious page, they get clear, actionable feedback right in the browser. Over time, these in-the-moment cues help build stronger phishing awareness across your workforce. Employee-facing messages are fully customizable to match the tone and style of your organization.",{"data":35203,"content":35204,"nodeType":1860},{},[35205],{"data":35206,"marks":35207,"value":35209,"nodeType":865},{},[35208],{"type":902},"A new paradigm for identity security",{"data":35211,"content":35212,"nodeType":881},{},[35213],{"data":35214,"marks":35215,"value":35216,"nodeType":865},{},[],"While phishing detection is core, Push also helps you defend your entire browser-based identity attack surface. That means protecting against other common forms of account compromise, like:",{"data":35218,"content":35219,"nodeType":1818},{},[35220,35230,35240,35250,35260],{"data":35221,"content":35222,"nodeType":1734},{},[35223],{"data":35224,"content":35225,"nodeType":881},{},[35226],{"data":35227,"marks":35228,"value":35229,"nodeType":865},{},[],"Employees using breached or reused passwords",{"data":35231,"content":35232,"nodeType":1734},{},[35233],{"data":35234,"content":35235,"nodeType":881},{},[35236],{"data":35237,"marks":35238,"value":35239,"nodeType":865},{},[],"Missing or misconfigured MFA",{"data":35241,"content":35242,"nodeType":1734},{},[35243],{"data":35244,"content":35245,"nodeType":881},{},[35246],{"data":35247,"marks":35248,"value":35249,"nodeType":865},{},[],"Ghost logins that bypass your identity provider",{"data":35251,"content":35252,"nodeType":1734},{},[35253],{"data":35254,"content":35255,"nodeType":881},{},[35256],{"data":35257,"marks":35258,"value":35259,"nodeType":865},{},[],"Token-based session hijacking",{"data":35261,"content":35262,"nodeType":1734},{},[35263],{"data":35264,"content":35265,"nodeType":881},{},[35266],{"data":35267,"marks":35268,"value":35269,"nodeType":865},{},[],"Shadow SaaS usage",{"data":35271,"content":35272,"nodeType":881},{},[35273],{"data":35274,"marks":35275,"value":35276,"nodeType":865},{},[],"Because Push runs directly in the browser, it gives you visibility across every app your employees access, whether it’s officially managed or not. And it doesn’t just alert, it actively helps you fix the issues, guiding users to take action when risks are found.",{"data":35278,"content":35279,"nodeType":894},{},[],{"data":35281,"content":35282,"nodeType":904},{},[35283],{"data":35284,"marks":35285,"value":35287,"nodeType":865},{},[35286],{"type":902},"Modern phishing requires a modern defense",{"data":35289,"content":35290,"nodeType":881},{},[35291],{"data":35292,"marks":35293,"value":35294,"nodeType":865},{},[],"Phishing is no longer an email problem. It’s not even just a domain reputation problem. It’s an identity attack problem, and the only place you can see those attacks in action is inside the browser.",{"data":35296,"content":35297,"nodeType":881},{},[35298,35302,35309],{"data":35299,"marks":35300,"value":35301,"nodeType":865},{},[],"Push Security gives you a new advantage: proactive, in-browser protection against modern phishing campaigns — ",{"data":35303,"content":35304,"nodeType":876},{"uri":34800},[35305],{"data":35306,"marks":35307,"value":35308,"nodeType":865},{},[],"even those with never-before-seen phishing sites",{"data":35310,"marks":35311,"value":959,"nodeType":865},{},[],{"data":35313,"content":35314,"nodeType":1818},{},[35315,35325,35335],{"data":35316,"content":35317,"nodeType":1734},{},[35318],{"data":35319,"content":35320,"nodeType":881},{},[35321],{"data":35322,"marks":35323,"value":35324,"nodeType":865},{},[],"See the phish happen.",{"data":35326,"content":35327,"nodeType":1734},{},[35328],{"data":35329,"content":35330,"nodeType":881},{},[35331],{"data":35332,"marks":35333,"value":35334,"nodeType":865},{},[],"Stop it in real time.",{"data":35336,"content":35337,"nodeType":1734},{},[35338],{"data":35339,"content":35340,"nodeType":881},{},[35341],{"data":35342,"marks":35343,"value":35344,"nodeType":865},{},[],"Keep your workforce identities safe.",{"data":35346,"content":35347,"nodeType":881},{},[35348,35353,35361],{"data":35349,"marks":35350,"value":35352,"nodeType":865},{},[35351],{"type":902},"Want to see Push in action? ",{"data":35354,"content":35355,"nodeType":876},{"uri":6048},[35356],{"data":35357,"marks":35358,"value":35360,"nodeType":865},{},[35359],{"type":902},"Book a demo",{"data":35362,"marks":35363,"value":35365,"nodeType":865},{},[35364],{"type":902}," and watch a real-time phishing attack get stopped mid-flow.",{"data":35367,"content":35371,"nodeType":890},{"target":35368},{"sys":35369},{"id":35370,"type":887,"linkType":888},"7eSsPjEj178j3ViloaChbQ",[],{"data":35373,"content":35374,"nodeType":881},{},[35375],{"data":35376,"marks":35377,"value":21,"nodeType":865},{},[],"How browser-level controls change the fight against phishing","Attackers are routinely defeating conventional email, network, and endpoint-based security controls. Here's how browser controls can level the playing field.","2025-06-26T00:00:00.000Z","how-browser-level-controls-change-the-fight-against-phishing",{"items":35383},[35384,35386],{"sys":35385,"name":4507},{"id":4506},{"sys":35387,"name":342},{"id":4510},{"items":35389},[35390],{"fullName":35391,"firstName":35392,"jobTitle":20082,"profilePicture":35393},"Peyton Padfield","Peyton",{"url":35394},"https://images.ctfassets.net/y1cdw1ablpvd/1GU01HXElmc07nwi89qP3b/3188050420106c62e9df2ed4e4893b7f/1677005177901__1_.jpeg","blog/phishing-detection-evasion-launch",{"json":35397},{"data":35398,"content":35399,"nodeType":1463},{},[35400],{"data":35401,"content":35402,"nodeType":881},{},[35403],{"data":35404,"marks":35405,"value":35406,"nodeType":865},{},[],"We’ve published our latest resource for security teams breaking down the techniques that modern phishing attacks are using to evade detection. ",{"id":18994,"publishedAt":35408},"2026-08-12T11:53:56.673Z",{"items":35410},[35411,35413],{"sys":35412,"name":342},{"id":4510},{"sys":35414,"name":4507},{"id":4506},{"items":35416},[35417,35419,35421,35423,35425,35427,35429,35431,35433,35435,35437,35439,35441,35443,35445,35447,35449,35451],{"sys":35418,"name":279,"slug":280,"tier":31},{"id":276},{"sys":35420,"name":519,"slug":520,"tier":31},{"id":516},{"sys":35422,"name":413,"slug":414,"tier":31},{"id":410},{"sys":35424,"name":642,"slug":643,"tier":31},{"id":639},{"sys":35426,"name":342,"slug":343,"tier":31},{"id":339},{"sys":35428,"name":545,"slug":546,"tier":31},{"id":542},{"sys":35430,"name":324,"slug":325,"tier":45},{"id":321},{"sys":35432,"name":351,"slug":352,"tier":45},{"id":348},{"sys":35434,"name":261,"slug":262,"tier":45},{"id":258},{"sys":35436,"name":466,"slug":467,"tier":45},{"id":463},{"sys":35438,"name":511,"slug":512,"tier":45},{"id":508},{"sys":35440,"name":440,"slug":441,"tier":45},{"id":437},{"sys":35442,"name":475,"slug":476,"tier":45},{"id":472},{"sys":35444,"name":607,"slug":608,"tier":45},{"id":604},{"sys":35446,"name":484,"slug":485,"tier":45},{"id":481},{"sys":35448,"name":589,"slug":590,"tier":45},{"id":586},{"sys":35450,"name":493,"slug":494,"tier":45},{"id":490},{"sys":35452,"name":404,"slug":405,"tier":45},{"id":401},"KS25yfGGyFkEvtm7x2C_DuE8axnzVzfod00dLc-oRVc",{"id":35455,"title":34748,"authorsCollection":35456,"content":35461,"extension":228,"faqItemsCollection":36092,"faqTitle":59,"featured":6,"hashTags":59,"meta":36094,"metaTitle":36095,"ogImage":59,"postType":7216,"publishedDate":34750,"relatedBlogPostsCollection":36096,"slug":34751,"stem":37991,"subtitle":59,"summary":37992,"synopsis":34749,"sys":38003,"tagsCollection":38005,"topicsCollection":38011,"__hash__":38041},"blog/blog/mfa-downgrade-attacks.json",{"items":35457},[35458],{"fullName":4514,"firstName":4515,"jobTitle":4516,"socialLinks":35459,"profilePicture":35460},[11822],{"url":4518},{"json":35462,"links":36034},{"data":35463,"content":35464,"nodeType":1463},{},[35465,35471,35477,35482,35502,35519,35522,35529,35535,35541,35548,35564,35567,35574,35580,35585,35591,35596,35599,35606,35612,35618,35639,35645,35675,35681,35688,35704,35710,35715,35738,35764,35771,35777,35783,35813,35816,35823,35839,35845,35866,35872,35877,35880,35887,35893,36002,36005,36012,36018],{"data":35466,"content":35467,"nodeType":881},{},[35468],{"data":35469,"marks":35470,"value":34106,"nodeType":865},{},[],{"data":35472,"content":35473,"nodeType":881},{},[35474],{"data":35475,"marks":35476,"value":34113,"nodeType":865},{},[],{"data":35478,"content":35481,"nodeType":890},{"target":35479},{"sys":35480},{"id":34118,"type":887,"linkType":888},[],{"data":35483,"content":35484,"nodeType":881},{},[35485,35488,35492,35495,35499],{"data":35486,"marks":35487,"value":34126,"nodeType":865},{},[],{"data":35489,"marks":35490,"value":34131,"nodeType":865},{},[35491],{"type":874},{"data":35493,"marks":35494,"value":34135,"nodeType":865},{},[],{"data":35496,"marks":35497,"value":34140,"nodeType":865},{},[35498],{"type":874},{"data":35500,"marks":35501,"value":34144,"nodeType":865},{},[],{"data":35503,"content":35504,"nodeType":881},{},[35505,35508,35516],{"data":35506,"marks":35507,"value":34151,"nodeType":865},{},[],{"data":35509,"content":35510,"nodeType":876},{"uri":34154},[35511],{"data":35512,"marks":35513,"value":34161,"nodeType":865},{},[35514,35515],{"type":874},{"type":902},{"data":35517,"marks":35518,"value":959,"nodeType":865},{},[],{"data":35520,"content":35521,"nodeType":894},{},[],{"data":35523,"content":35524,"nodeType":904},{},[35525],{"data":35526,"marks":35527,"value":34175,"nodeType":865},{},[35528],{"type":902},{"data":35530,"content":35531,"nodeType":881},{},[35532],{"data":35533,"marks":35534,"value":34182,"nodeType":865},{},[],{"data":35536,"content":35537,"nodeType":881},{},[35538],{"data":35539,"marks":35540,"value":34189,"nodeType":865},{},[],{"data":35542,"content":35543,"nodeType":881},{},[35544],{"data":35545,"marks":35546,"value":34197,"nodeType":865},{},[35547],{"type":902},{"data":35549,"content":35550,"nodeType":881},{},[35551,35554,35561],{"data":35552,"marks":35553,"value":34204,"nodeType":865},{},[],{"data":35555,"content":35556,"nodeType":876},{"uri":34207},[35557],{"data":35558,"marks":35559,"value":34213,"nodeType":865},{},[35560],{"type":874},{"data":35562,"marks":35563,"value":34217,"nodeType":865},{},[],{"data":35565,"content":35566,"nodeType":894},{},[],{"data":35568,"content":35569,"nodeType":904},{},[35570],{"data":35571,"marks":35572,"value":34228,"nodeType":865},{},[35573],{"type":902},{"data":35575,"content":35576,"nodeType":881},{},[35577],{"data":35578,"marks":35579,"value":34235,"nodeType":865},{},[],{"data":35581,"content":35584,"nodeType":890},{"target":35582},{"sys":35583},{"id":30209,"type":887,"linkType":888},[],{"data":35586,"content":35587,"nodeType":881},{},[35588],{"data":35589,"marks":35590,"value":34247,"nodeType":865},{},[],{"data":35592,"content":35595,"nodeType":890},{"target":35593},{"sys":35594},{"id":34252,"type":887,"linkType":888},[],{"data":35597,"content":35598,"nodeType":894},{},[],{"data":35600,"content":35601,"nodeType":904},{},[35602],{"data":35603,"marks":35604,"value":34264,"nodeType":865},{},[35605],{"type":902},{"data":35607,"content":35608,"nodeType":881},{},[35609],{"data":35610,"marks":35611,"value":34271,"nodeType":865},{},[],{"data":35613,"content":35614,"nodeType":881},{},[35615],{"data":35616,"marks":35617,"value":34278,"nodeType":865},{},[],{"data":35619,"content":35620,"nodeType":1818},{},[35621,35630],{"data":35622,"content":35623,"nodeType":1734},{},[35624],{"data":35625,"content":35626,"nodeType":881},{},[35627],{"data":35628,"marks":35629,"value":34291,"nodeType":865},{},[],{"data":35631,"content":35632,"nodeType":1734},{},[35633],{"data":35634,"content":35635,"nodeType":881},{},[35636],{"data":35637,"marks":35638,"value":34301,"nodeType":865},{},[],{"data":35640,"content":35641,"nodeType":881},{},[35642],{"data":35643,"marks":35644,"value":34308,"nodeType":865},{},[],{"data":35646,"content":35647,"nodeType":1818},{},[35648,35657,35666],{"data":35649,"content":35650,"nodeType":1734},{},[35651],{"data":35652,"content":35653,"nodeType":881},{},[35654],{"data":35655,"marks":35656,"value":34321,"nodeType":865},{},[],{"data":35658,"content":35659,"nodeType":1734},{},[35660],{"data":35661,"content":35662,"nodeType":881},{},[35663],{"data":35664,"marks":35665,"value":34331,"nodeType":865},{},[],{"data":35667,"content":35668,"nodeType":1734},{},[35669],{"data":35670,"content":35671,"nodeType":881},{},[35672],{"data":35673,"marks":35674,"value":34341,"nodeType":865},{},[],{"data":35676,"content":35677,"nodeType":881},{},[35678],{"data":35679,"marks":35680,"value":34348,"nodeType":865},{},[],{"data":35682,"content":35683,"nodeType":1860},{},[35684],{"data":35685,"marks":35686,"value":34356,"nodeType":865},{},[35687],{"type":902},{"data":35689,"content":35690,"nodeType":881},{},[35691,35694,35701],{"data":35692,"marks":35693,"value":34363,"nodeType":865},{},[],{"data":35695,"content":35696,"nodeType":876},{"uri":34366},[35697],{"data":35698,"marks":35699,"value":1718,"nodeType":865},{},[35700],{"type":874},{"data":35702,"marks":35703,"value":34375,"nodeType":865},{},[],{"data":35705,"content":35706,"nodeType":881},{},[35707],{"data":35708,"marks":35709,"value":34382,"nodeType":865},{},[],{"data":35711,"content":35714,"nodeType":890},{"target":35712},{"sys":35713},{"id":34387,"type":887,"linkType":888},[],{"data":35716,"content":35717,"nodeType":881},{},[35718,35721,35725,35728,35735],{"data":35719,"marks":35720,"value":34395,"nodeType":865},{},[],{"data":35722,"marks":35723,"value":34400,"nodeType":865},{},[35724],{"type":902},{"data":35726,"marks":35727,"value":34404,"nodeType":865},{},[],{"data":35729,"content":35730,"nodeType":876},{"uri":11116},[35731],{"data":35732,"marks":35733,"value":11122,"nodeType":865},{},[35734],{"type":874},{"data":35736,"marks":35737,"value":34415,"nodeType":865},{},[],{"data":35739,"content":35740,"nodeType":881},{},[35741,35744,35751,35754,35761],{"data":35742,"marks":35743,"value":34422,"nodeType":865},{},[],{"data":35745,"content":35746,"nodeType":876},{"uri":22763},[35747],{"data":35748,"marks":35749,"value":22769,"nodeType":865},{},[35750],{"type":874},{"data":35752,"marks":35753,"value":1651,"nodeType":865},{},[],{"data":35755,"content":35756,"nodeType":876},{"uri":34435},[35757],{"data":35758,"marks":35759,"value":34441,"nodeType":865},{},[35760],{"type":874},{"data":35762,"marks":35763,"value":34445,"nodeType":865},{},[],{"data":35765,"content":35766,"nodeType":1860},{},[35767],{"data":35768,"marks":35769,"value":34453,"nodeType":865},{},[35770],{"type":902},{"data":35772,"content":35773,"nodeType":881},{},[35774],{"data":35775,"marks":35776,"value":34460,"nodeType":865},{},[],{"data":35778,"content":35779,"nodeType":881},{},[35780],{"data":35781,"marks":35782,"value":34467,"nodeType":865},{},[],{"data":35784,"content":35785,"nodeType":1818},{},[35786,35795,35804],{"data":35787,"content":35788,"nodeType":1734},{},[35789],{"data":35790,"content":35791,"nodeType":881},{},[35792],{"data":35793,"marks":35794,"value":34480,"nodeType":865},{},[],{"data":35796,"content":35797,"nodeType":1734},{},[35798],{"data":35799,"content":35800,"nodeType":881},{},[35801],{"data":35802,"marks":35803,"value":34490,"nodeType":865},{},[],{"data":35805,"content":35806,"nodeType":1734},{},[35807],{"data":35808,"content":35809,"nodeType":881},{},[35810],{"data":35811,"marks":35812,"value":34500,"nodeType":865},{},[],{"data":35814,"content":35815,"nodeType":894},{},[],{"data":35817,"content":35818,"nodeType":904},{},[35819],{"data":35820,"marks":35821,"value":34511,"nodeType":865},{},[35822],{"type":902},{"data":35824,"content":35825,"nodeType":881},{},[35826,35829,35836],{"data":35827,"marks":35828,"value":34518,"nodeType":865},{},[],{"data":35830,"content":35831,"nodeType":876},{"uri":30250},[35832],{"data":35833,"marks":35834,"value":34526,"nodeType":865},{},[35835],{"type":874},{"data":35837,"marks":35838,"value":34530,"nodeType":865},{},[],{"data":35840,"content":35841,"nodeType":881},{},[35842],{"data":35843,"marks":35844,"value":34537,"nodeType":865},{},[],{"data":35846,"content":35847,"nodeType":1818},{},[35848,35857],{"data":35849,"content":35850,"nodeType":1734},{},[35851],{"data":35852,"content":35853,"nodeType":881},{},[35854],{"data":35855,"marks":35856,"value":34550,"nodeType":865},{},[],{"data":35858,"content":35859,"nodeType":1734},{},[35860],{"data":35861,"content":35862,"nodeType":881},{},[35863],{"data":35864,"marks":35865,"value":34560,"nodeType":865},{},[],{"data":35867,"content":35868,"nodeType":881},{},[35869],{"data":35870,"marks":35871,"value":34567,"nodeType":865},{},[],{"data":35873,"content":35876,"nodeType":890},{"target":35874},{"sys":35875},{"id":34572,"type":887,"linkType":888},[],{"data":35878,"content":35879,"nodeType":894},{},[],{"data":35881,"content":35882,"nodeType":904},{},[35883],{"data":35884,"marks":35885,"value":34584,"nodeType":865},{},[35886],{"type":902},{"data":35888,"content":35889,"nodeType":881},{},[35890],{"data":35891,"marks":35892,"value":34591,"nodeType":865},{},[],{"data":35894,"content":35895,"nodeType":1818},{},[35896,35925,35954,35973],{"data":35897,"content":35898,"nodeType":1734},{},[35899],{"data":35900,"content":35901,"nodeType":881},{},[35902,35905,35912,35915,35922],{"data":35903,"marks":35904,"value":21,"nodeType":865},{},[],{"data":35906,"content":35907,"nodeType":876},{"uri":30327},[35908],{"data":35909,"marks":35910,"value":34611,"nodeType":865},{},[35911],{"type":874},{"data":35913,"marks":35914,"value":34615,"nodeType":865},{},[],{"data":35916,"content":35917,"nodeType":876},{"uri":34618},[35918],{"data":35919,"marks":35920,"value":34624,"nodeType":865},{},[35921],{"type":874},{"data":35923,"marks":35924,"value":30302,"nodeType":865},{},[],{"data":35926,"content":35927,"nodeType":1734},{},[35928],{"data":35929,"content":35930,"nodeType":881},{},[35931,35934,35941,35944,35951],{"data":35932,"marks":35933,"value":21,"nodeType":865},{},[],{"data":35935,"content":35936,"nodeType":876},{"uri":18095},[35937],{"data":35938,"marks":35939,"value":24657,"nodeType":865},{},[35940],{"type":874},{"data":35942,"marks":35943,"value":34647,"nodeType":865},{},[],{"data":35945,"content":35946,"nodeType":876},{"uri":34650},[35947],{"data":35948,"marks":35949,"value":34656,"nodeType":865},{},[35950],{"type":874},{"data":35952,"marks":35953,"value":34660,"nodeType":865},{},[],{"data":35955,"content":35956,"nodeType":1734},{},[35957],{"data":35958,"content":35959,"nodeType":881},{},[35960,35963,35970],{"data":35961,"marks":35962,"value":21,"nodeType":865},{},[],{"data":35964,"content":35965,"nodeType":876},{"uri":1526},[35966],{"data":35967,"marks":35968,"value":360,"nodeType":865},{},[35969],{"type":874},{"data":35971,"marks":35972,"value":34680,"nodeType":865},{},[],{"data":35974,"content":35975,"nodeType":1734},{},[35976],{"data":35977,"content":35978,"nodeType":881},{},[35979,35982,35989,35992,35999],{"data":35980,"marks":35981,"value":21,"nodeType":865},{},[],{"data":35983,"content":35984,"nodeType":876},{"uri":30350},[35985],{"data":35986,"marks":35987,"value":34697,"nodeType":865},{},[35988],{"type":874},{"data":35990,"marks":35991,"value":34701,"nodeType":865},{},[],{"data":35993,"content":35994,"nodeType":876},{"uri":34704},[35995],{"data":35996,"marks":35997,"value":34710,"nodeType":865},{},[35998],{"type":874},{"data":36000,"marks":36001,"value":34714,"nodeType":865},{},[],{"data":36003,"content":36004,"nodeType":894},{},[],{"data":36006,"content":36007,"nodeType":904},{},[36008],{"data":36009,"marks":36010,"value":29766,"nodeType":865},{},[36011],{"type":902},{"data":36013,"content":36014,"nodeType":881},{},[36015],{"data":36016,"marks":36017,"value":34731,"nodeType":865},{},[],{"data":36019,"content":36020,"nodeType":881},{},[36021,36024,36031],{"data":36022,"marks":36023,"value":31701,"nodeType":865},{},[],{"data":36025,"content":36026,"nodeType":876},{"uri":6048},[36027],{"data":36028,"marks":36029,"value":4495,"nodeType":865},{},[36030],{"type":874},{"data":36032,"marks":36033,"value":959,"nodeType":865},{},[],{"entries":36035},{"hyperlink":36036,"inline":36037,"block":36038},[],[],[36039,36053,36055,36063,36088],{"sys":36040,"__typename":7015,"content":36041,"name":36052,"title":59},{"id":34118},{"json":36042},{"nodeType":1463,"data":36043,"content":36044},{},[36045],{"nodeType":881,"data":36046,"content":36047},{},[36048],{"nodeType":865,"value":36049,"marks":36050,"data":36051},"MFA-bypassing Attacker-in-the-Middle phishing kits are the standard choice for attackers today. These work by intercepting the authenticated session created when a victim enters their password and completes an MFA check. To do this, the phishing website simply passes messages between the user and the real website — hence “Attacker-in-the-Middle”.",[],{},"MFA downgrade insight box 1",{"sys":36054,"__typename":7100,"title":30701,"arcadeDemoUrl":30702,"playText":7102},{"id":30209},{"sys":36056,"__typename":7008,"title":36057,"caption":36058,"layoutMode":59,"file":36059},{"id":34252},"Tycoon Passkeys Code Snippet","Tycoon code snippet from a phishing campaign targeting Google accounts.",{"url":36060,"width":36061,"height":36062},"https://images.ctfassets.net/y1cdw1ablpvd/21d3KTcWt9GBJ4712OoPYg/4062faca94e8e326db8fc84fd7a21f74/carbon_1.png",1784,2066,{"sys":36064,"__typename":7015,"content":36065,"name":36087,"title":59},{"id":34387},{"json":36066},{"data":36067,"content":36068,"nodeType":1463},{},[36069],{"data":36070,"content":36071,"nodeType":881},{},[36072,36076,36084],{"data":36073,"marks":36074,"value":36075,"nodeType":865},{},[],"We wrote about the big variance in app identity security controls ",{"data":36077,"content":36078,"nodeType":876},{"uri":30376},[36079],{"data":36080,"marks":36081,"value":36083,"nodeType":865},{},[36082],{"type":874},"in a recent blog post",{"data":36085,"marks":36086,"value":959,"nodeType":865},{},[],"MFA downgrade insight box 2",{"sys":36089,"__typename":7100,"title":36090,"arcadeDemoUrl":36091,"playText":7102},{"id":34572},"How Push stops phishing attacks in the browser","https://demo.arcade.software/SyrZLMa3pLKrNudoaQnD?embed",{"items":36093},[],{},"How attackers are getting around phishing-resistant auth",{"items":36097},[36098,36773,37326],{"__typename":1485,"sys":36099,"content":36101,"title":36760,"synopsis":36761,"hashTags":59,"publishedDate":35380,"slug":36762,"tagsCollection":36763,"authorsCollection":36769},{"id":36100},"3c9KMXYa1A9rOg61Kmg7j4",{"json":36102},{"data":36103,"content":36104,"nodeType":1463},{},[36105,36148,36155,36162,36192,36199,36202,36210,36230,36236,36243,36250,36257,36260,36268,36275,36295,36302,36308,36311,36319,36326,36394,36401,36404,36412,36419,36426,36528,36535,36538,36545,36574,36581,36584,36591,36598,36618,36625,36628,36635,36642,36648,36655,36661,36668,36711,36718,36725,36728,36736,36743],{"data":36106,"content":36107,"nodeType":881},{},[36108,36112,36120,36123,36132,36135,36144],{"data":36109,"marks":36110,"value":36111,"nodeType":865},{},[],"App-Specific Passwords (ASPs) are a way for users to access applications that do not support MFA or are otherwise incompatible with a platform’s standard login workflows. They are intended to enable a user to login to “legacy” (typically desktop) applications that do not support modern authentication (e.g. OAuth 2.0). For example, you might use this feature to allow a third-party mail client access to an email account by logging in with your ",{"data":36113,"content":36115,"nodeType":876},{"uri":36114},"https://support.microsoft.com/en-gb/account-billing/how-to-get-and-use-app-passwords-5896ed9b-4263-e681-128a-a6f2979a7944",[36116],{"data":36117,"marks":36118,"value":1718,"nodeType":865},{},[36119],{"type":874},{"data":36121,"marks":36122,"value":1877,"nodeType":865},{},[],{"data":36124,"content":36126,"nodeType":876},{"uri":36125},"https://support.google.com/accounts/answer/185833?hl=en",[36127],{"data":36128,"marks":36129,"value":36131,"nodeType":865},{},[36130],{"type":874},"Google",{"data":36133,"marks":36134,"value":4487,"nodeType":865},{},[],{"data":36136,"content":36138,"nodeType":876},{"uri":36137},"https://support.apple.com/en-us/102654",[36139],{"data":36140,"marks":36141,"value":36143,"nodeType":865},{},[36142],{"type":874},"Apple",{"data":36145,"marks":36146,"value":36147,"nodeType":865},{},[]," account. ",{"data":36149,"content":36150,"nodeType":881},{},[36151],{"data":36152,"marks":36153,"value":36154,"nodeType":865},{},[],"The logic behind this is that it is comparatively more secure than giving your critical IdP password to less secure apps — likely due to the volume of accounts compromised as a result of third-party breaches. It also means that if someone phishes your primary account password that normally has a second factor, that specific password can’t be used without the second factor. ",{"data":36156,"content":36157,"nodeType":881},{},[36158],{"data":36159,"marks":36160,"value":36161,"nodeType":865},{},[],"However, if an ASP is acquired by an attacker, it can be used to login to the target app — circumventing phishing-resistant authentication methods such as passkeys, and bypassing MFA checks. It effectively provides a method of sidestepping your preferred login method. So for example, if you're an organization that uses a passwordless login to access your Google Workspace account and has disabled secondary login methods (the gold standard in terms of secure authentication), an ASP gives attackers a way around this. ",{"data":36163,"content":36164,"nodeType":881},{},[36165,36169,36177,36181,36188],{"data":36166,"marks":36167,"value":36168,"nodeType":865},{},[],"With recent evidence of exploitation in the wild in the form of ",{"data":36170,"content":36171,"nodeType":876},{"uri":30327},[36172],{"data":36173,"marks":36174,"value":36176,"nodeType":865},{},[36175],{"type":874},"app-specific password phishing",{"data":36178,"marks":36179,"value":36180,"nodeType":865},{},[],", our latest addition to the ",{"data":36182,"content":36183,"nodeType":876},{"uri":5192},[36184],{"data":36185,"marks":36186,"value":32109,"nodeType":865},{},[36187],{"type":874},{"data":36189,"marks":36190,"value":36191,"nodeType":865},{},[],", it’s important that security teams are aware of this technique, what the risks are, and how to defend against it.  ",{"data":36193,"content":36194,"nodeType":881},{},[36195],{"data":36196,"marks":36197,"value":36198,"nodeType":865},{},[],"Let’s take a quick look at how this actually works before we dive into the malicious use cases. ",{"data":36200,"content":36201,"nodeType":894},{},[],{"data":36203,"content":36204,"nodeType":904},{},[36205],{"data":36206,"marks":36207,"value":36209,"nodeType":865},{},[36208],{"type":902},"ASPs 101",{"data":36211,"content":36212,"nodeType":881},{},[36213,36217,36226],{"data":36214,"marks":36215,"value":36216,"nodeType":865},{},[],"ASPs are pretty straightforward. You log into your chosen account (e.g. Microsoft, Google, or Apple) and navigate to the ASP creation page — in Google’s case ",{"data":36218,"content":36220,"nodeType":876},{"uri":36219},"http://myaccount.google.com/apppasswords",[36221],{"data":36222,"marks":36223,"value":36225,"nodeType":865},{},[36224],{"type":874},"myaccount.google.com/apppasswords",{"data":36227,"marks":36228,"value":36229,"nodeType":865},{},[],". Then, it’s as simple as typing in a name and hitting the “create” button. ",{"data":36231,"content":36235,"nodeType":890},{"target":36232},{"sys":36233},{"id":36234,"type":887,"linkType":888},"76qanYHiwrSyrkwlYnCuCZ",[],{"data":36237,"content":36238,"nodeType":881},{},[36239],{"data":36240,"marks":36241,"value":36242,"nodeType":865},{},[],"This isn’t actually app-specific in the sense that it’s tied to a specific app at the point of creation, but the idea is that you’d create a unique password for each app you want to log into. ",{"data":36244,"content":36245,"nodeType":881},{},[36246],{"data":36247,"marks":36248,"value":36249,"nodeType":865},{},[],"From this point, you can use the password along with your email address to log into apps normally. It’s important to note that this isn’t available for every app, but is specifically intended for things like third-party email clients. By logging in with an ASP, you are also granting specific permissions to the app. So in the case of Google, you can view, send and delete emails, access contacts, and access the calendar, but you can’t add mail rules, or access other G-Suite apps like Google Drive.   ",{"data":36251,"content":36252,"nodeType":881},{},[36253],{"data":36254,"marks":36255,"value":36256,"nodeType":865},{},[],"It’s important to note that you can’t use this as a substitute for SSO — e.g. you can’t authenticate to a third-party app like Slack using your Google account with an ASP, so the risk is somewhat limited to basic email functionality. That said, email access gives an attacker plenty to work with, and it’s enough to move laterally to other accounts through password and MFA resets — so there’s plenty of scope to expand the blast radius with a little extra legwork.  ",{"data":36258,"content":36259,"nodeType":894},{},[],{"data":36261,"content":36262,"nodeType":904},{},[36263],{"data":36264,"marks":36265,"value":36267,"nodeType":865},{},[36266],{"type":902},"How ASP phishing works",{"data":36269,"content":36270,"nodeType":881},{},[36271],{"data":36272,"marks":36273,"value":36274,"nodeType":865},{},[],"While logging in with an ASP doesn’t grant an attacker full access to the account, there’s still a lot that an attacker can do with access to email, contact, and calendar information. It’s certainly enough to be used in social engineering attacks impersonating the compromised user, as well as generally monitoring email activity. ",{"data":36276,"content":36277,"nodeType":881},{},[36278,36282,36291],{"data":36279,"marks":36280,"value":36281,"nodeType":865},{},[],"An ",{"data":36283,"content":36285,"nodeType":876},{"uri":36284},"https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia",[36286],{"data":36287,"marks":36288,"value":36290,"nodeType":865},{},[36289],{"type":874},"example of this was recently disclosed",{"data":36292,"marks":36293,"value":36294,"nodeType":865},{},[]," where an expert on Russian information operations was targeted with a sophisticated and personalized social engineering attack, where the attacker was able to establish persistent access to the victim’s mailbox using ASPs by logging into a mail client. ",{"data":36296,"content":36297,"nodeType":881},{},[36298],{"data":36299,"marks":36300,"value":36301,"nodeType":865},{},[],"This involved a sophisticated lure impersonating the US Department of State instructing the victim on how to create and share an ASP with the attacker, granting access to their Google mailbox. ",{"data":36303,"content":36307,"nodeType":890},{"target":36304},{"sys":36305},{"id":36306,"type":887,"linkType":888},"Lt93bzQNcEzg2OoCSrgED",[],{"data":36309,"content":36310,"nodeType":894},{},[],{"data":36312,"content":36313,"nodeType":904},{},[36314],{"data":36315,"marks":36316,"value":36318,"nodeType":865},{},[36317],{"type":902},"Benefits and limitations of ASP phishing",{"data":36320,"content":36321,"nodeType":881},{},[36322],{"data":36323,"marks":36324,"value":36325,"nodeType":865},{},[],"This approach has a few advantages over conventional credential phishing:",{"data":36327,"content":36328,"nodeType":1818},{},[36329,36339,36349,36359],{"data":36330,"content":36331,"nodeType":1734},{},[36332],{"data":36333,"content":36334,"nodeType":881},{},[36335],{"data":36336,"marks":36337,"value":36338,"nodeType":865},{},[],"It completely sidesteps otherwise phishing-resistant login methods such as passkeys, and by design does not require MFA. ",{"data":36340,"content":36341,"nodeType":1734},{},[36342],{"data":36343,"content":36344,"nodeType":881},{},[36345],{"data":36346,"marks":36347,"value":36348,"nodeType":865},{},[],"This kind of attack also naturally doesn’t trigger many typical phishing or malware-based detections. As it’s pure social engineering, there is no malicious link, page, or file to analyse. ",{"data":36350,"content":36351,"nodeType":1734},{},[36352],{"data":36353,"content":36354,"nodeType":881},{},[36355],{"data":36356,"marks":36357,"value":36358,"nodeType":865},{},[],"For less technically aware victims, this might present a more effective alternative to traditional credential phishing — awareness training won’t extend to this kind of use case. ",{"data":36360,"content":36361,"nodeType":1734},{},[36362],{"data":36363,"content":36364,"nodeType":881},{},[36365,36369,36378,36382,36391],{"data":36366,"marks":36367,"value":36368,"nodeType":865},{},[],"While generic security alert emails are generated when an app password is created, visibility of actual login events is limited. For example, ",{"data":36370,"content":36372,"nodeType":876},{"uri":36371},"https://issuetracker.google.com/issues/298128558",[36373],{"data":36374,"marks":36375,"value":36377,"nodeType":865},{},[36376],{"type":874},"Google provides no logs for ASP creation and usage",{"data":36379,"marks":36380,"value":36381,"nodeType":865},{},[],", while ",{"data":36383,"content":36385,"nodeType":876},{"uri":36384},"https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords",[36386],{"data":36387,"marks":36388,"value":36390,"nodeType":865},{},[36389],{"type":874},"Microsoft provides no on-premises logging or auditing capability",{"data":36392,"marks":36393,"value":30204,"nodeType":865},{},[],{"data":36395,"content":36396,"nodeType":881},{},[36397],{"data":36398,"marks":36399,"value":36400,"nodeType":865},{},[],"However, there are also limitations that will probably see this technique remain a niche choice for attackers. Namely, the complexity of the attack doesn’t necessarily map to the payoff, where it doesn’t result in full account compromise and the permissions/scopes of an ASP login are limited. This means that it lends itself to multi-step attacks, most likely as part of more targeted and stealthy attacks against specific individuals (as seen in the example above). For this reason, attackers are likely to prioritize other methods when they are available. ",{"data":36402,"content":36403,"nodeType":894},{},[],{"data":36405,"content":36406,"nodeType":904},{},[36407],{"data":36408,"marks":36409,"value":36411,"nodeType":865},{},[36410],{"type":902},"Comparing ASPs with other auth bypasses",{"data":36413,"content":36414,"nodeType":881},{},[36415],{"data":36416,"marks":36417,"value":36418,"nodeType":865},{},[],"ASP phishing is part of a growing trend of phishing techniques focused on bypassing conventional authentication. With more organizations investing in phishing-resistant authentication methods like passkeys/WebAuthn and using SSO as standard, attackers are increasingly looking to circumvent the standard login process entirely. ",{"data":36420,"content":36421,"nodeType":881},{},[36422],{"data":36423,"marks":36424,"value":36425,"nodeType":865},{},[],"Similar phishing approaches designed to circumvent an account’s authentication controls include:",{"data":36427,"content":36428,"nodeType":1818},{},[36429,36451,36480,36499],{"data":36430,"content":36431,"nodeType":1734},{},[36432],{"data":36433,"content":36434,"nodeType":881},{},[36435,36439,36447],{"data":36436,"marks":36437,"value":36438,"nodeType":865},{},[],"Phishing for ",{"data":36440,"content":36441,"nodeType":876},{"uri":30315},[36442],{"data":36443,"marks":36444,"value":36446,"nodeType":865},{},[36445],{"type":874},"API keys",{"data":36448,"marks":36449,"value":36450,"nodeType":865},{},[],", which has the advantage of granting full access to the account, and persisting even if the account password is changed (in contrast, Google resets all ASPs if the account password is changed). ",{"data":36452,"content":36453,"nodeType":1734},{},[36454],{"data":36455,"content":36456,"nodeType":881},{},[36457,36460,36467,36470,36477],{"data":36458,"marks":36459,"value":21,"nodeType":865},{},[],{"data":36461,"content":36462,"nodeType":876},{"uri":18095},[36463],{"data":36464,"marks":36465,"value":24657,"nodeType":865},{},[36466],{"type":874},{"data":36468,"marks":36469,"value":34647,"nodeType":865},{},[],{"data":36471,"content":36472,"nodeType":876},{"uri":34650},[36473],{"data":36474,"marks":36475,"value":34656,"nodeType":865},{},[36476],{"type":874},{"data":36478,"marks":36479,"value":34660,"nodeType":865},{},[],{"data":36481,"content":36482,"nodeType":1734},{},[36483],{"data":36484,"content":36485,"nodeType":881},{},[36486,36489,36496],{"data":36487,"marks":36488,"value":21,"nodeType":865},{},[],{"data":36490,"content":36491,"nodeType":876},{"uri":1526},[36492],{"data":36493,"marks":36494,"value":360,"nodeType":865},{},[36495],{"type":874},{"data":36497,"marks":36498,"value":34680,"nodeType":865},{},[],{"data":36500,"content":36501,"nodeType":1734},{},[36502],{"data":36503,"content":36504,"nodeType":881},{},[36505,36508,36515,36518,36525],{"data":36506,"marks":36507,"value":21,"nodeType":865},{},[],{"data":36509,"content":36510,"nodeType":876},{"uri":30350},[36511],{"data":36512,"marks":36513,"value":34697,"nodeType":865},{},[36514],{"type":874},{"data":36516,"marks":36517,"value":34701,"nodeType":865},{},[],{"data":36519,"content":36520,"nodeType":876},{"uri":34704},[36521],{"data":36522,"marks":36523,"value":34710,"nodeType":865},{},[36524],{"type":874},{"data":36526,"marks":36527,"value":34714,"nodeType":865},{},[],{"data":36529,"content":36530,"nodeType":881},{},[36531],{"data":36532,"marks":36533,"value":36534,"nodeType":865},{},[],"Clearly, ASP phishing is part of a much bigger trend in which attackers are moving away from conventional phishing tactics in order to sidestep the authentication process. ",{"data":36536,"content":36537,"nodeType":894},{},[],{"data":36539,"content":36540,"nodeType":904},{},[36541],{"data":36542,"marks":36543,"value":29161,"nodeType":865},{},[36544],{"type":902},{"data":36546,"content":36547,"nodeType":881},{},[36548,36552,36559,36563,36570],{"data":36549,"marks":36550,"value":36551,"nodeType":865},{},[],"There is a common misconception that adopting SSO-based logins, with a locked-down IdP account is an identity security silver bullet. The reality is that identity, authentication, and authorization is a complex and little-understood space. Even with SSO, there are ",{"data":36553,"content":36554,"nodeType":876},{"uri":11116},[36555],{"data":36556,"marks":36557,"value":11122,"nodeType":865},{},[36558],{"type":874},{"data":36560,"marks":36561,"value":36562,"nodeType":865},{},[],", backup login and MFA methods susceptible to ",{"data":36564,"content":36565,"nodeType":876},{"uri":34154},[36566],{"data":36567,"marks":36568,"value":24505,"nodeType":865},{},[36569],{"type":874},{"data":36571,"marks":36572,"value":36573,"nodeType":865},{},[],", and as we’ve seen with ASP phishing and similar techniques, many, many more ways to compromise an identity. ",{"data":36575,"content":36576,"nodeType":881},{},[36577],{"data":36578,"marks":36579,"value":36580,"nodeType":865},{},[],"Security teams need to approach the complexity of identity security with their eyes open to reality. Without a full picture of how your various workforce identities can be accessed by your users, exploitable gaps will inevitably be left for attackers to take advantage of. ",{"data":36582,"content":36583,"nodeType":894},{},[],{"data":36585,"content":36586,"nodeType":904},{},[36587],{"data":36588,"marks":36589,"value":7774,"nodeType":865},{},[36590],{"type":902},{"data":36592,"content":36593,"nodeType":881},{},[36594],{"data":36595,"marks":36596,"value":36597,"nodeType":865},{},[],"Given the logging challenges relating to ASP creation and use, the best option is to prevent ASPs from being created in the first place. ",{"data":36599,"content":36600,"nodeType":881},{},[36601,36605,36614],{"data":36602,"marks":36603,"value":36604,"nodeType":865},{},[],"By default, users can't create app passwords in Microsoft. The app passwords feature must be enabled before users can use them. To check if this option is turned on, ",{"data":36606,"content":36608,"nodeType":876},{"uri":36607},"https://learn.microsoft.com/en-gb/entra/identity/authentication/howto-mfa-app-passwords",[36609],{"data":36610,"marks":36611,"value":36613,"nodeType":865},{},[36612],{"type":874},"you can see and toggle the setting in Entra",{"data":36615,"marks":36616,"value":36617,"nodeType":865},{},[]," by browsing to Conditional Access > Named locations > Configure MFA trusted IPs > Multifactor authentication page > Allow users to create app passwords to sign in to non-browser apps option.",{"data":36619,"content":36620,"nodeType":881},{},[36621],{"data":36622,"marks":36623,"value":36624,"nodeType":865},{},[],"Apple and Google ASPs can’t be disabled in the same way… but don’t worry. That’s where Push comes in. ",{"data":36626,"content":36627,"nodeType":894},{},[],{"data":36629,"content":36630,"nodeType":904},{},[36631],{"data":36632,"marks":36633,"value":5936,"nodeType":865},{},[36634],{"type":902},{"data":36636,"content":36637,"nodeType":881},{},[36638],{"data":36639,"marks":36640,"value":36641,"nodeType":865},{},[],"We’re working on adding visibility for ASPs being created, but users of our browser-based security platform can use existing features to prevent ASP phishing. Realistically, there’s no good reason for the average user to be configuring ASPs. So, you can use our URL blocking feature to prevent employees from accessing the pages for ASP creation on relevant apps. ",{"data":36643,"content":36647,"nodeType":890},{"target":36644},{"sys":36645},{"id":36646,"type":887,"linkType":888},"5i0Ou5a27XOt7gxJo9cu0P",[],{"data":36649,"content":36650,"nodeType":881},{},[36651],{"data":36652,"marks":36653,"value":36654,"nodeType":865},{},[],"When a user tries to access the page, they’ll see this message instead and a security alert will be generated. ",{"data":36656,"content":36660,"nodeType":890},{"target":36657},{"sys":36658},{"id":36659,"type":887,"linkType":888},"7nsimiWtv5XOuKkE9wL3A3",[],{"data":36662,"content":36663,"nodeType":881},{},[36664],{"data":36665,"marks":36666,"value":36667,"nodeType":865},{},[],"It is recommended that you block the following URLs for Google and Apple:",{"data":36669,"content":36670,"nodeType":1818},{},[36671,36690],{"data":36672,"content":36673,"nodeType":1734},{},[36674],{"data":36675,"content":36676,"nodeType":881},{},[36677,36680,36687],{"data":36678,"marks":36679,"value":21,"nodeType":865},{},[],{"data":36681,"content":36682,"nodeType":876},{"uri":36219},[36683],{"data":36684,"marks":36685,"value":36225,"nodeType":865},{},[36686],{"type":874},{"data":36688,"marks":36689,"value":21,"nodeType":865},{},[],{"data":36691,"content":36692,"nodeType":1734},{},[36693],{"data":36694,"content":36695,"nodeType":881},{},[36696,36699,36708],{"data":36697,"marks":36698,"value":21,"nodeType":865},{},[],{"data":36700,"content":36702,"nodeType":876},{"uri":36701},"http://appleid.apple.com/account/manage/security/secondary-password",[36703],{"data":36704,"marks":36705,"value":36707,"nodeType":865},{},[36706],{"type":874},"appleid.apple.com/account/manage/security/secondary-password",{"data":36709,"marks":36710,"value":21,"nodeType":865},{},[],{"data":36712,"content":36713,"nodeType":881},{},[36714],{"data":36715,"marks":36716,"value":36717,"nodeType":865},{},[],"Unfortunately, there is no specific link to the Microsoft creation page — but as established above, this should not be enabled by default in Microsoft. ",{"data":36719,"content":36720,"nodeType":881},{},[36721],{"data":36722,"marks":36723,"value":36724,"nodeType":865},{},[],"If you encounter any more apps which allow ASPs, you can similarly add the specific ASP creation page to the list of blocked URLs.",{"data":36726,"content":36727,"nodeType":894},{},[],{"data":36729,"content":36730,"nodeType":904},{},[36731],{"data":36732,"marks":36733,"value":36735,"nodeType":865},{},[36734],{"type":902},"Want to learn more about Push?",{"data":36737,"content":36738,"nodeType":881},{},[36739],{"data":36740,"marks":36741,"value":36742,"nodeType":865},{},[],"And that’s not all — Push provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use, like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more. ",{"data":36744,"content":36745,"nodeType":881},{},[36746,36749,36757],{"data":36747,"marks":36748,"value":31701,"nodeType":865},{},[],{"data":36750,"content":36752,"nodeType":876},{"uri":36751},"https://pushsecurity.com/",[36753],{"data":36754,"marks":36755,"value":4495,"nodeType":865},{},[36756],{"type":874},{"data":36758,"marks":36759,"value":959,"nodeType":865},{},[],"App-Specific Password phishing: another novel way to get around passkeys and MFA","How App-Specific Password phishing is being used in the wild to bypass phishing-resistant authentication controls like passkeys. ","app-specific-password-phishing",{"items":36764},[36765,36767],{"sys":36766,"name":4507},{"id":4506},{"sys":36768,"name":342},{"id":4510},{"items":36770},[36771],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":36772},{"url":5377},{"__typename":1485,"sys":36774,"content":36775,"title":35378,"synopsis":35379,"hashTags":59,"publishedDate":35380,"slug":35381,"tagsCollection":37316,"authorsCollection":37322},{"id":34764},{"json":36776},{"data":36777,"content":36778,"nodeType":1463},{},[36779,36785,36791,36798,36821,36827,36832,36835,36842,36848,36854,36893,36899,36905,36908,36915,36921,36927,36933,36949,36955,36960,36967,36973,36979,36985,36990,36993,37000,37007,37013,37020,37026,37084,37090,37097,37103,37133,37140,37146,37153,37159,37166,37172,37220,37226,37229,37236,37242,37257,37287,37305,37310],{"data":36780,"content":36781,"nodeType":881},{},[36782],{"data":36783,"marks":36784,"value":34775,"nodeType":865},{},[],{"data":36786,"content":36787,"nodeType":881},{},[36788],{"data":36789,"marks":36790,"value":34782,"nodeType":865},{},[],{"data":36792,"content":36793,"nodeType":881},{},[36794],{"data":36795,"marks":36796,"value":34790,"nodeType":865},{},[36797],{"type":902},{"data":36799,"content":36800,"nodeType":881},{},[36801,36804,36811,36814,36818],{"data":36802,"marks":36803,"value":34797,"nodeType":865},{},[],{"data":36805,"content":36806,"nodeType":876},{"uri":34800},[36807],{"data":36808,"marks":36809,"value":34806,"nodeType":865},{},[36810],{"type":874},{"data":36812,"marks":36813,"value":34810,"nodeType":865},{},[],{"data":36815,"marks":36816,"value":34815,"nodeType":865},{},[36817],{"type":5120},{"data":36819,"marks":36820,"value":34819,"nodeType":865},{},[],{"data":36822,"content":36823,"nodeType":881},{},[36824],{"data":36825,"marks":36826,"value":34826,"nodeType":865},{},[],{"data":36828,"content":36831,"nodeType":890},{"target":36829},{"sys":36830},{"id":34831,"type":887,"linkType":888},[],{"data":36833,"content":36834,"nodeType":894},{},[],{"data":36836,"content":36837,"nodeType":904},{},[36838],{"data":36839,"marks":36840,"value":34843,"nodeType":865},{},[36841],{"type":902},{"data":36843,"content":36844,"nodeType":881},{},[36845],{"data":36846,"marks":36847,"value":34850,"nodeType":865},{},[],{"data":36849,"content":36850,"nodeType":881},{},[36851],{"data":36852,"marks":36853,"value":34857,"nodeType":865},{},[],{"data":36855,"content":36856,"nodeType":1818},{},[36857,36866,36875,36884],{"data":36858,"content":36859,"nodeType":1734},{},[36860],{"data":36861,"content":36862,"nodeType":881},{},[36863],{"data":36864,"marks":36865,"value":34870,"nodeType":865},{},[],{"data":36867,"content":36868,"nodeType":1734},{},[36869],{"data":36870,"content":36871,"nodeType":881},{},[36872],{"data":36873,"marks":36874,"value":34880,"nodeType":865},{},[],{"data":36876,"content":36877,"nodeType":1734},{},[36878],{"data":36879,"content":36880,"nodeType":881},{},[36881],{"data":36882,"marks":36883,"value":34890,"nodeType":865},{},[],{"data":36885,"content":36886,"nodeType":1734},{},[36887],{"data":36888,"content":36889,"nodeType":881},{},[36890],{"data":36891,"marks":36892,"value":34900,"nodeType":865},{},[],{"data":36894,"content":36895,"nodeType":881},{},[36896],{"data":36897,"marks":36898,"value":34907,"nodeType":865},{},[],{"data":36900,"content":36901,"nodeType":881},{},[36902],{"data":36903,"marks":36904,"value":34914,"nodeType":865},{},[],{"data":36906,"content":36907,"nodeType":894},{},[],{"data":36909,"content":36910,"nodeType":904},{},[36911],{"data":36912,"marks":36913,"value":34925,"nodeType":865},{},[36914],{"type":902},{"data":36916,"content":36917,"nodeType":881},{},[36918],{"data":36919,"marks":36920,"value":34932,"nodeType":865},{},[],{"data":36922,"content":36923,"nodeType":881},{},[36924],{"data":36925,"marks":36926,"value":34939,"nodeType":865},{},[],{"data":36928,"content":36929,"nodeType":881},{},[36930],{"data":36931,"marks":36932,"value":34946,"nodeType":865},{},[],{"data":36934,"content":36935,"nodeType":881},{},[36936,36939,36946],{"data":36937,"marks":36938,"value":34953,"nodeType":865},{},[],{"data":36940,"content":36941,"nodeType":876},{"uri":5836},[36942],{"data":36943,"marks":36944,"value":34961,"nodeType":865},{},[36945],{"type":874},{"data":36947,"marks":36948,"value":34965,"nodeType":865},{},[],{"data":36950,"content":36951,"nodeType":881},{},[36952],{"data":36953,"marks":36954,"value":34972,"nodeType":865},{},[],{"data":36956,"content":36959,"nodeType":890},{"target":36957},{"sys":36958},{"id":34977,"type":887,"linkType":888},[],{"data":36961,"content":36962,"nodeType":904},{},[36963],{"data":36964,"marks":36965,"value":34986,"nodeType":865},{},[36966],{"type":902},{"data":36968,"content":36969,"nodeType":881},{},[36970],{"data":36971,"marks":36972,"value":34993,"nodeType":865},{},[],{"data":36974,"content":36975,"nodeType":881},{},[36976],{"data":36977,"marks":36978,"value":35000,"nodeType":865},{},[],{"data":36980,"content":36981,"nodeType":881},{},[36982],{"data":36983,"marks":36984,"value":35007,"nodeType":865},{},[],{"data":36986,"content":36989,"nodeType":890},{"target":36987},{"sys":36988},{"id":35012,"type":887,"linkType":888},[],{"data":36991,"content":36992,"nodeType":894},{},[],{"data":36994,"content":36995,"nodeType":904},{},[36996],{"data":36997,"marks":36998,"value":35024,"nodeType":865},{},[36999],{"type":902},{"data":37001,"content":37002,"nodeType":1860},{},[37003],{"data":37004,"marks":37005,"value":35032,"nodeType":865},{},[37006],{"type":902},{"data":37008,"content":37009,"nodeType":881},{},[37010],{"data":37011,"marks":37012,"value":35039,"nodeType":865},{},[],{"data":37014,"content":37015,"nodeType":1860},{},[37016],{"data":37017,"marks":37018,"value":35047,"nodeType":865},{},[37019],{"type":902},{"data":37021,"content":37022,"nodeType":881},{},[37023],{"data":37024,"marks":37025,"value":35054,"nodeType":865},{},[],{"data":37027,"content":37028,"nodeType":1818},{},[37029,37038,37047,37066,37075],{"data":37030,"content":37031,"nodeType":1734},{},[37032],{"data":37033,"content":37034,"nodeType":881},{},[37035],{"data":37036,"marks":37037,"value":35067,"nodeType":865},{},[],{"data":37039,"content":37040,"nodeType":1734},{},[37041],{"data":37042,"content":37043,"nodeType":881},{},[37044],{"data":37045,"marks":37046,"value":35077,"nodeType":865},{},[],{"data":37048,"content":37049,"nodeType":1734},{},[37050],{"data":37051,"content":37052,"nodeType":881},{},[37053,37056,37063],{"data":37054,"marks":37055,"value":30549,"nodeType":865},{},[],{"data":37057,"content":37058,"nodeType":876},{"uri":30552},[37059],{"data":37060,"marks":37061,"value":30558,"nodeType":865},{},[37062],{"type":874},{"data":37064,"marks":37065,"value":21,"nodeType":865},{},[],{"data":37067,"content":37068,"nodeType":1734},{},[37069],{"data":37070,"content":37071,"nodeType":881},{},[37072],{"data":37073,"marks":37074,"value":35106,"nodeType":865},{},[],{"data":37076,"content":37077,"nodeType":1734},{},[37078],{"data":37079,"content":37080,"nodeType":881},{},[37081],{"data":37082,"marks":37083,"value":35116,"nodeType":865},{},[],{"data":37085,"content":37086,"nodeType":881},{},[37087],{"data":37088,"marks":37089,"value":35123,"nodeType":865},{},[],{"data":37091,"content":37092,"nodeType":1860},{},[37093],{"data":37094,"marks":37095,"value":35131,"nodeType":865},{},[37096],{"type":902},{"data":37098,"content":37099,"nodeType":881},{},[37100],{"data":37101,"marks":37102,"value":35138,"nodeType":865},{},[],{"data":37104,"content":37105,"nodeType":1818},{},[37106,37115,37124],{"data":37107,"content":37108,"nodeType":1734},{},[37109],{"data":37110,"content":37111,"nodeType":881},{},[37112],{"data":37113,"marks":37114,"value":35151,"nodeType":865},{},[],{"data":37116,"content":37117,"nodeType":1734},{},[37118],{"data":37119,"content":37120,"nodeType":881},{},[37121],{"data":37122,"marks":37123,"value":35161,"nodeType":865},{},[],{"data":37125,"content":37126,"nodeType":1734},{},[37127],{"data":37128,"content":37129,"nodeType":881},{},[37130],{"data":37131,"marks":37132,"value":35171,"nodeType":865},{},[],{"data":37134,"content":37135,"nodeType":1860},{},[37136],{"data":37137,"marks":37138,"value":35179,"nodeType":865},{},[37139],{"type":902},{"data":37141,"content":37142,"nodeType":881},{},[37143],{"data":37144,"marks":37145,"value":35186,"nodeType":865},{},[],{"data":37147,"content":37148,"nodeType":1860},{},[37149],{"data":37150,"marks":37151,"value":35194,"nodeType":865},{},[37152],{"type":902},{"data":37154,"content":37155,"nodeType":881},{},[37156],{"data":37157,"marks":37158,"value":35201,"nodeType":865},{},[],{"data":37160,"content":37161,"nodeType":1860},{},[37162],{"data":37163,"marks":37164,"value":35209,"nodeType":865},{},[37165],{"type":902},{"data":37167,"content":37168,"nodeType":881},{},[37169],{"data":37170,"marks":37171,"value":35216,"nodeType":865},{},[],{"data":37173,"content":37174,"nodeType":1818},{},[37175,37184,37193,37202,37211],{"data":37176,"content":37177,"nodeType":1734},{},[37178],{"data":37179,"content":37180,"nodeType":881},{},[37181],{"data":37182,"marks":37183,"value":35229,"nodeType":865},{},[],{"data":37185,"content":37186,"nodeType":1734},{},[37187],{"data":37188,"content":37189,"nodeType":881},{},[37190],{"data":37191,"marks":37192,"value":35239,"nodeType":865},{},[],{"data":37194,"content":37195,"nodeType":1734},{},[37196],{"data":37197,"content":37198,"nodeType":881},{},[37199],{"data":37200,"marks":37201,"value":35249,"nodeType":865},{},[],{"data":37203,"content":37204,"nodeType":1734},{},[37205],{"data":37206,"content":37207,"nodeType":881},{},[37208],{"data":37209,"marks":37210,"value":35259,"nodeType":865},{},[],{"data":37212,"content":37213,"nodeType":1734},{},[37214],{"data":37215,"content":37216,"nodeType":881},{},[37217],{"data":37218,"marks":37219,"value":35269,"nodeType":865},{},[],{"data":37221,"content":37222,"nodeType":881},{},[37223],{"data":37224,"marks":37225,"value":35276,"nodeType":865},{},[],{"data":37227,"content":37228,"nodeType":894},{},[],{"data":37230,"content":37231,"nodeType":904},{},[37232],{"data":37233,"marks":37234,"value":35287,"nodeType":865},{},[37235],{"type":902},{"data":37237,"content":37238,"nodeType":881},{},[37239],{"data":37240,"marks":37241,"value":35294,"nodeType":865},{},[],{"data":37243,"content":37244,"nodeType":881},{},[37245,37248,37254],{"data":37246,"marks":37247,"value":35301,"nodeType":865},{},[],{"data":37249,"content":37250,"nodeType":876},{"uri":34800},[37251],{"data":37252,"marks":37253,"value":35308,"nodeType":865},{},[],{"data":37255,"marks":37256,"value":959,"nodeType":865},{},[],{"data":37258,"content":37259,"nodeType":1818},{},[37260,37269,37278],{"data":37261,"content":37262,"nodeType":1734},{},[37263],{"data":37264,"content":37265,"nodeType":881},{},[37266],{"data":37267,"marks":37268,"value":35324,"nodeType":865},{},[],{"data":37270,"content":37271,"nodeType":1734},{},[37272],{"data":37273,"content":37274,"nodeType":881},{},[37275],{"data":37276,"marks":37277,"value":35334,"nodeType":865},{},[],{"data":37279,"content":37280,"nodeType":1734},{},[37281],{"data":37282,"content":37283,"nodeType":881},{},[37284],{"data":37285,"marks":37286,"value":35344,"nodeType":865},{},[],{"data":37288,"content":37289,"nodeType":881},{},[37290,37294,37301],{"data":37291,"marks":37292,"value":35352,"nodeType":865},{},[37293],{"type":902},{"data":37295,"content":37296,"nodeType":876},{"uri":6048},[37297],{"data":37298,"marks":37299,"value":35360,"nodeType":865},{},[37300],{"type":902},{"data":37302,"marks":37303,"value":35365,"nodeType":865},{},[37304],{"type":902},{"data":37306,"content":37309,"nodeType":890},{"target":37307},{"sys":37308},{"id":35370,"type":887,"linkType":888},[],{"data":37311,"content":37312,"nodeType":881},{},[37313],{"data":37314,"marks":37315,"value":21,"nodeType":865},{},[],{"items":37317},[37318,37320],{"sys":37319,"name":4507},{"id":4506},{"sys":37321,"name":342},{"id":4510},{"items":37323},[37324],{"fullName":35391,"firstName":35392,"jobTitle":20082,"profilePicture":37325},{"url":35394},{"__typename":1485,"sys":37327,"content":37329,"title":37977,"synopsis":37978,"hashTags":59,"publishedDate":37979,"slug":37980,"tagsCollection":37981,"authorsCollection":37987},{"id":37328},"3dtvtDQdcQ6fAW7CB8VOFP",{"json":37330},{"data":37331,"content":37332,"nodeType":1463},{},[37333,37340,37347,37354,37357,37365,37372,37392,37425,37431,37451,37457,37482,37485,37493,37500,37516,37531,37537,37544,37551,37557,37573,37576,37584,37591,37598,37605,37612,37615,37623,37630,37637,37657,37664,37672,37714,37721,37727,37734,37740,37747,37750,37758,37773,37780,37822,37834,37837,37845,37852,37859,37892,37899,37919,37925,37931,37934,37941,37948,37965,37971],{"data":37334,"content":37335,"nodeType":881},{},[37336],{"data":37337,"marks":37338,"value":37339,"nodeType":865},{},[],"Phishing attacks remain a huge challenge for organizations in 2025. In fact, with attackers increasingly leveraging identity-based techniques over software exploits, phishing arguably poses a bigger threat than ever before. ",{"data":37341,"content":37342,"nodeType":881},{},[37343],{"data":37344,"marks":37345,"value":37346,"nodeType":865},{},[],"Attackers are turning to identity attacks like phishing because they can achieve all of the same objectives as they would in a traditional endpoint or network attack, simply by logging into a victim’s account. And with organizations now using hundreds of internet apps across their workforce, the scope of accounts that can be phished or targeted with stolen credentials has grown exponentially. ",{"data":37348,"content":37349,"nodeType":881},{},[37350],{"data":37351,"marks":37352,"value":37353,"nodeType":865},{},[],"With MFA-bypassing phishing kits the new normal, capable of phishing accounts protected by SMS, OTP, and push-based methods, detection controls are being put under constant pressure as prevention controls fall short. ",{"data":37355,"content":37356,"nodeType":894},{},[],{"data":37358,"content":37359,"nodeType":904},{},[37360],{"data":37361,"marks":37362,"value":37364,"nodeType":865},{},[37363],{"type":902},"Attackers are bypassing detection controls",{"data":37366,"content":37367,"nodeType":881},{},[37368],{"data":37369,"marks":37370,"value":37371,"nodeType":865},{},[],"The majority of phishing detection and control enforcement is focused at the email and network layer — typically at the Secure Email Gateway (SEG), Secure Web Gateway (SWG)/proxy, or both. ",{"data":37373,"content":37374,"nodeType":881},{},[37375,37379,37388],{"data":37376,"marks":37377,"value":37378,"nodeType":865},{},[],"But attackers know this, ",{"data":37380,"content":37382,"nodeType":876},{"uri":37381},"https://pushsecurity.com/blog/how-aitm-phishing-kits-evade-detection-p2/",[37383],{"data":37384,"marks":37385,"value":37387,"nodeType":865},{},[37386],{"type":874},"and are taking steps to avoid these controls",{"data":37389,"marks":37390,"value":37391,"nodeType":865},{},[],", by:",{"data":37393,"content":37394,"nodeType":1818},{},[37395,37405,37415],{"data":37396,"content":37397,"nodeType":1734},{},[37398],{"data":37399,"content":37400,"nodeType":881},{},[37401],{"data":37402,"marks":37403,"value":37404,"nodeType":865},{},[],"Routinely evading IoC driven blocklists by dynamically rotating and updating commonly signatured elements like IPs, domains, and URLs.",{"data":37406,"content":37407,"nodeType":1734},{},[37408],{"data":37409,"content":37410,"nodeType":881},{},[37411],{"data":37412,"marks":37413,"value":37414,"nodeType":865},{},[],"Preventing analysis of their phishing pages by implementing bot protection like CAPTCHA or Cloudflare Turnstile alongside other detection evasion methods. ",{"data":37416,"content":37417,"nodeType":1734},{},[37418],{"data":37419,"content":37420,"nodeType":881},{},[37421],{"data":37422,"marks":37423,"value":37424,"nodeType":865},{},[],"Changing visual and DOM elements on the page so that even when the page is loaded, detection signatures may fail to trigger.  ",{"data":37426,"content":37430,"nodeType":890},{"target":37427},{"sys":37428},{"id":37429,"type":887,"linkType":888},"5w44LsamEfcwSACx3MA997",[],{"data":37432,"content":37433,"nodeType":881},{},[37434,37438,37447],{"data":37435,"marks":37436,"value":37437,"nodeType":865},{},[],"And in fact, by launching multi- and cross-channel attacks, attackers are evading email-based controls entirely. Just see ",{"data":37439,"content":37441,"nodeType":876},{"uri":37440},"https://pushsecurity.com/blog/investigating-a-recent-malvertising-campaign-targeting-onfido-customers/?utm_campaign=12081956-FY25Q2_Hacker-News-Article&utm_source=thehackernews&utm_medium=sponsored&utm_content=external-article",[37442],{"data":37443,"marks":37444,"value":37446,"nodeType":865},{},[37445],{"type":874},"this recent example",{"data":37448,"marks":37449,"value":37450,"nodeType":865},{},[],", where attackers impersonating Onfido delivered their phishing attack via malicious Google ads (aka malvertising) — bypassing email altogether. ",{"data":37452,"content":37456,"nodeType":890},{"target":37453},{"sys":37454},{"id":37455,"type":887,"linkType":888},"3sGmVHl1Rwjyw3TMZSYuy4",[],{"data":37458,"content":37459,"nodeType":881},{},[37460,37464,37469,37473,37478],{"data":37461,"marks":37462,"value":37463,"nodeType":865},{},[],"It’s worth pointing out the limitations of email-based solutions here too. Email has some additional checks around the sender’s reputation and things like DMARC/DKIM, but these don’t actually identify malicious ",{"data":37465,"marks":37466,"value":37468,"nodeType":865},{},[37467],{"type":902},"pages",{"data":37470,"marks":37471,"value":37472,"nodeType":865},{},[],". Similarly, some modern email solutions are doing much deeper analysis of the ",{"data":37474,"marks":37475,"value":37477,"nodeType":865},{},[37476],{"type":902},"content",{"data":37479,"marks":37480,"value":37481,"nodeType":865},{},[]," of an email. But… that doesn’t really help with identifying the phishing sites themselves (just indicates that one might be linked in the email). This is much more appropriate for BEC-style attacks where the goal is to social engineer the victim, as opposed to linking them to a malicious page. And this still doesn’t help with attacks launched over different mediums as we’ve highlighted above.",{"data":37483,"content":37484,"nodeType":894},{},[],{"data":37486,"content":37487,"nodeType":904},{},[37488],{"data":37489,"marks":37490,"value":37492,"nodeType":865},{},[37491],{"type":902},"How browser-based detection and response can level the playing field",{"data":37494,"content":37495,"nodeType":881},{},[37496],{"data":37497,"marks":37498,"value":37499,"nodeType":865},{},[],"Most phishing attacks involve the delivery of a malicious link to a user. The user clicks the link and loads a malicious page. In the vast majority of cases, the malicious page is a login portal for a specific website, where the goal for the attacker is to steal the victim’s account.",{"data":37501,"content":37502,"nodeType":881},{},[37503,37507,37512],{"data":37504,"marks":37505,"value":37506,"nodeType":865},{},[],"These attacks are happening pretty much exclusively in the victim’s browser. So rather than building more email or network based controls looking from the outside-in at phishing pages accessed in the browser, there’s a huge opportunity presented by building phishing detection and response capabilities ",{"data":37508,"marks":37509,"value":37511,"nodeType":865},{},[37510],{"type":5120},"inside",{"data":37513,"marks":37514,"value":37515,"nodeType":865},{},[]," the browser. ",{"data":37517,"content":37518,"nodeType":881},{},[37519,37523,37528],{"data":37520,"marks":37521,"value":37522,"nodeType":865},{},[],"When we look at the history of detection and response, this makes a lot of sense. When endpoint attacks skyrocketed in the late 2000s / early 2010s, they took advantage of the fact that defenders were trying to detect malware with primarily network-based detections, signature-based analysis of files, and running files in sandboxes (which was reliably defeated with sandbox-aware malware and using things as simple as putting an execution delay in the code). But this gave way to EDR, which presented a better way of observing and intercepting malicious software in ",{"data":37524,"marks":37525,"value":37527,"nodeType":865},{},[37526],{"type":902},"real-time",{"data":37529,"marks":37530,"value":1032,"nodeType":865},{},[],{"data":37532,"content":37536,"nodeType":890},{"target":37533},{"sys":37534},{"id":37535,"type":887,"linkType":888},"1KFwJvbIMiWHb1erWlljZf",[],{"data":37538,"content":37539,"nodeType":881},{},[37540],{"data":37541,"marks":37542,"value":37543,"nodeType":865},{},[],"The key here was getting inside the data stream to be able to observe activity in real-time on the endpoint. ",{"data":37545,"content":37546,"nodeType":881},{},[37547],{"data":37548,"marks":37549,"value":37550,"nodeType":865},{},[],"We’re in a similar position today. Modern phishing attacks are happening on web pages accessed via the browser, and the tools we’re relying on — email, network, even endpoint — don’t have the required visibility. They’re looking from the outside-in. ",{"data":37552,"content":37556,"nodeType":890},{"target":37553},{"sys":37554},{"id":37555,"type":887,"linkType":888},"59t6AcjpRjs3VQQXQO3PWu",[],{"data":37558,"content":37559,"nodeType":881},{},[37560,37564,37569],{"data":37561,"marks":37562,"value":37563,"nodeType":865},{},[],"But what if we could do detection and response from ",{"data":37565,"marks":37566,"value":37568,"nodeType":865},{},[37567],{"type":902},"inside the browser?",{"data":37570,"marks":37571,"value":37572,"nodeType":865},{},[]," Here’s three reasons why the browser is best for stopping phishing attacks:",{"data":37574,"content":37575,"nodeType":894},{},[],{"data":37577,"content":37578,"nodeType":904},{},[37579],{"data":37580,"marks":37581,"value":37583,"nodeType":865},{},[37582],{"type":902},"#1: Analyze pages, not links",{"data":37585,"content":37586,"nodeType":881},{},[37587],{"data":37588,"marks":37589,"value":37590,"nodeType":865},{},[],"Common phishing detections rely on the analysis of links or static HTML as opposed to malicious pages. Modern phishing pages are no longer static HTML — like most other modern web pages, these are dynamic web apps rendered in the browser, with JavaScript dynamically rewriting the page and launching the malicious content. This means that most basic, static checks fail to identify the malicious content running on the page. ",{"data":37592,"content":37593,"nodeType":881},{},[37594],{"data":37595,"marks":37596,"value":37597,"nodeType":865},{},[],"Without deeper analysis, you’re reliant on analyzing things like domains, URLs and IP addresses against known-bad blocklists. But these are all highly disposable. Attackers are buying them in bulk, constantly taking over legitimate domains, and generally planning for the fact that they’ll get through a lot of them. Modern phishing architecture is also able to dynamically rotate and update the links served to visitors from a continually refreshed pool (so every person that clicks the link gets served a different URL) and even going as far as using things like one-time magic links (which also means that any security team members trying to investigate the page later won’t be able to do so). ",{"data":37599,"content":37600,"nodeType":881},{},[37601],{"data":37602,"marks":37603,"value":37604,"nodeType":865},{},[],"Ultimately, this means that blocklists just aren’t that effective — because it’s trivial for attackers to change the indicators being used to create detections. If you think about the Pyramid of Pain, these indicators sit right at the bottom — the kind of thing we’ve been moving away from for years in the endpoint security world.  ",{"data":37606,"content":37607,"nodeType":881},{},[37608],{"data":37609,"marks":37610,"value":37611,"nodeType":865},{},[],"But in the browser, you can observe the rendered web page in all its glory. With much deeper visibility of the page (and its malicious elements) you can…",{"data":37613,"content":37614,"nodeType":894},{},[],{"data":37616,"content":37617,"nodeType":904},{},[37618],{"data":37619,"marks":37620,"value":37622,"nodeType":865},{},[37621],{"type":902},"#2: Detect TTPs, not IoCs",{"data":37624,"content":37625,"nodeType":881},{},[37626],{"data":37627,"marks":37628,"value":37629,"nodeType":865},{},[],"Even where TTP-based detections are in play, they’re typically reliant on either piecing together network requests, or loading the page in a sandbox. ",{"data":37631,"content":37632,"nodeType":881},{},[37633],{"data":37634,"marks":37635,"value":37636,"nodeType":865},{},[],"However, attackers are getting pretty good at evading sandbox analysis — simply by implementing bot protection by requiring user interaction with a CAPTCHA or Cloudflare Turnstile. Even if you can get past Turnstile, then you’ll need to supply the correct URL parameters and headers, and execute JavaScript, to be served the malicious page. This means that a defender who knows the domain name can’t discover the malicious behavior just by making a simple HTTP(S) request to the domain.",{"data":37638,"content":37639,"nodeType":881},{},[37640,37644,37653],{"data":37641,"marks":37642,"value":37643,"nodeType":865},{},[],"And if all this wasn’t enough, ",{"data":37645,"content":37647,"nodeType":876},{"uri":37646},"https://pushsecurity.com/blog/how-aitm-phishing-kits-evade-detection-p2/?utm_campaign=12081956-FY25Q2_Hacker-News-Article&utm_source=thehackernews&utm_medium=sponsored&utm_content=external-article",[37648],{"data":37649,"marks":37650,"value":37652,"nodeType":865},{},[37651],{"type":874},"they’re also obfuscating both visual and DOM elements to prevent signature-based detections from picking them up",{"data":37654,"marks":37655,"value":37656,"nodeType":865},{},[]," — so even if you can land on the page, there’s a high chance that your detections won’t trigger.",{"data":37658,"content":37659,"nodeType":881},{},[37660],{"data":37661,"marks":37662,"value":37663,"nodeType":865},{},[],"When using a proxy, you’ll have some visibility of the network traffic generated by a user accessing and interacting with a page. However, you’ll struggle to correlate key actions like whether the user entered their password with the specific tab when dealing with the sheer volume of disorganized network traffic data. ",{"data":37665,"content":37666,"nodeType":881},{},[37667],{"data":37668,"marks":37669,"value":37671,"nodeType":865},{},[37670],{"type":902},"But you get much better visibility of all this in the browser, with access to:",{"data":37673,"content":37674,"nodeType":1818},{},[37675,37684,37694,37704],{"data":37676,"content":37677,"nodeType":1734},{},[37678],{"data":37679,"content":37680,"nodeType":881},{},[37681],{"data":37682,"marks":37683,"value":31242,"nodeType":865},{},[],{"data":37685,"content":37686,"nodeType":1734},{},[37687],{"data":37688,"content":37689,"nodeType":881},{},[37690],{"data":37691,"marks":37692,"value":37693,"nodeType":865},{},[],"Full user interaction tracing — every click, keystroke, or DOM change can be traced",{"data":37695,"content":37696,"nodeType":1734},{},[37697],{"data":37698,"content":37699,"nodeType":881},{},[37700],{"data":37701,"marks":37702,"value":37703,"nodeType":865},{},[],"Full inspection at every layer of execution, not just initial HTML served",{"data":37705,"content":37706,"nodeType":1734},{},[37707],{"data":37708,"content":37709,"nodeType":881},{},[37710],{"data":37711,"marks":37712,"value":37713,"nodeType":865},{},[],"Full access to browser APIs, to correlate with browser history, local storage, attached cookies, etc.",{"data":37715,"content":37716,"nodeType":881},{},[37717],{"data":37718,"marks":37719,"value":37720,"nodeType":865},{},[],"This gives you everything you need to build high-fidelity detections focused on page behavior and user interaction – that are much harder for attackers to get around when compared to IoC-based detections. ",{"data":37722,"content":37726,"nodeType":890},{"target":37723},{"sys":37724},{"id":37725,"type":887,"linkType":888},"1YggWcADAWgt3sUkXMsVIw",[],{"data":37728,"content":37729,"nodeType":881},{},[37730],{"data":37731,"marks":37732,"value":37733,"nodeType":865},{},[],"In the browser, you get much better visibility of the user and page behavior to enable phishing page detection.",{"data":37735,"content":37739,"nodeType":890},{"target":37736},{"sys":37737},{"id":37738,"type":887,"linkType":888},"1BKgjnYkLJIRW0LJZYpfga",[],{"data":37741,"content":37742,"nodeType":881},{},[37743],{"data":37744,"marks":37745,"value":37746,"nodeType":865},{},[],"And with this new visibility, because you’re in the browser and seeing the page at the same time as the user is interacting with it, you can…",{"data":37748,"content":37749,"nodeType":894},{},[],{"data":37751,"content":37752,"nodeType":904},{},[37753],{"data":37754,"marks":37755,"value":37757,"nodeType":865},{},[37756],{"type":902},"#3: Intercept in real time, not post mortem",{"data":37759,"content":37760,"nodeType":881},{},[37761,37765,37770],{"data":37762,"marks":37763,"value":37764,"nodeType":865},{},[],"For non-browser solutions, ",{"data":37766,"marks":37767,"value":37769,"nodeType":865},{},[37768],{"type":902},"real-time phishing detection is basically nonexistent",{"data":37771,"marks":37772,"value":1032,"nodeType":865},{},[],{"data":37774,"content":37775,"nodeType":881},{},[37776],{"data":37777,"marks":37778,"value":37779,"nodeType":865},{},[],"At best, your proxy-based solution might be able to detect malicious behavior via the network traffic generated by your user interacting with the page. But because of the complexity of reconstructing network requests post-TLS-encryption, this typically happens on a time delay and is not entirely reliable. ",{"data":37781,"content":37782,"nodeType":881},{},[37783,37787,37792,37796,37801,37805,37809,37813,37818],{"data":37784,"marks":37785,"value":37786,"nodeType":865},{},[],"If a page is flagged, it usually requires further investigation by a security team to rule out any false positives and kick off an investigation. This can take ",{"data":37788,"marks":37789,"value":37791,"nodeType":865},{},[37790],{"type":902},"hours",{"data":37793,"marks":37794,"value":37795,"nodeType":865},{},[]," at best, probably ",{"data":37797,"marks":37798,"value":37800,"nodeType":865},{},[37799],{"type":902},"days",{"data":37802,"marks":37803,"value":37804,"nodeType":865},{},[],". Then, once a page is identified as malicious and IoCs are created, it can take ",{"data":37806,"marks":37807,"value":37800,"nodeType":865},{},[37808],{"type":902},{"data":37810,"marks":37811,"value":37812,"nodeType":865},{},[]," or even ",{"data":37814,"marks":37815,"value":37817,"nodeType":865},{},[37816],{"type":902},"weeks",{"data":37819,"marks":37820,"value":37821,"nodeType":865},{},[]," before the information is distributed, TI feeds are updated, and ingested into blocklists. ",{"data":37823,"content":37824,"nodeType":881},{},[37825,37829],{"data":37826,"marks":37827,"value":37828,"nodeType":865},{},[],"But in the browser, you’re observing the page in real-time, as the user sees it, from inside the browser. This is a game changer when it comes to not just detecting, but intercepting and shutting down attacks before a user is phished and the damage is done. ",{"data":37830,"marks":37831,"value":37833,"nodeType":865},{},[37832],{"type":902},"This changes the focus from post mortem containment and cleanup, to pre-compromise interception in real time. ",{"data":37835,"content":37836,"nodeType":894},{},[],{"data":37838,"content":37839,"nodeType":904},{},[37840],{"data":37841,"marks":37842,"value":37844,"nodeType":865},{},[37843],{"type":902},"The future of phishing detection and response is browser based",{"data":37846,"content":37847,"nodeType":881},{},[37848],{"data":37849,"marks":37850,"value":37851,"nodeType":865},{},[],"Push provides a browser-based identity security solution that intercepts phishing attacks as they happen — in employee browsers. Being in the browser delivers a lot of advantages when it comes to detecting and intercepting phishing attacks. You see the live webpage that the user sees, as they see it, meaning you have much better visibility of malicious elements running on the page. It also means that you can implement real-time controls that kick in when a malicious element is detected. ",{"data":37853,"content":37854,"nodeType":881},{},[37855],{"data":37856,"marks":37857,"value":37858,"nodeType":865},{},[],"When a phishing attack hits a user with Push, regardless of the delivery channel, our browser extension inspects the webpage running in the user's browser. Push observes that the webpage is a login page and the user is entering their password into the page, detecting that:",{"data":37860,"content":37861,"nodeType":1818},{},[37862,37872,37882],{"data":37863,"content":37864,"nodeType":1734},{},[37865],{"data":37866,"content":37867,"nodeType":881},{},[37868],{"data":37869,"marks":37870,"value":37871,"nodeType":865},{},[],"The password the user is entering into the phishing site has been used to log into another site previously. This means that the password is being reused (bad) or the user is being phished (even worse).  ",{"data":37873,"content":37874,"nodeType":1734},{},[37875],{"data":37876,"content":37877,"nodeType":881},{},[37878],{"data":37879,"marks":37880,"value":37881,"nodeType":865},{},[],"The web page is cloned from a legitimate login page that has been fingerprinted by Push. ",{"data":37883,"content":37884,"nodeType":1734},{},[37885],{"data":37886,"content":37887,"nodeType":881},{},[37888],{"data":37889,"marks":37890,"value":37891,"nodeType":865},{},[],"A phishing toolkit is running on the web page. ",{"data":37893,"content":37894,"nodeType":881},{},[37895],{"data":37896,"marks":37897,"value":37898,"nodeType":865},{},[],"As a result, the user is blocked from interacting with the phishing site and prevented from continuing. ",{"data":37900,"content":37901,"nodeType":881},{},[37902,37907,37916],{"data":37903,"marks":37904,"value":37906,"nodeType":865},{},[37905],{"type":902},"These are good examples of detections that are difficult (or impossible) for an attacker to evade — you can’t phish a victim if they can’t enter their credentials into your phishing site! ",{"data":37908,"content":37910,"nodeType":876},{"uri":37909},"https://pushsecurity.com/blog/detecting-and-blocking-phishing-attacks-in-the-browser/?utm_campaign=12081956-FY25Q2_Hacker-News-Article&utm_source=thehackernews&utm_medium=sponsored&utm_content=external-article",[37911],{"data":37912,"marks":37913,"value":37915,"nodeType":865},{},[37914],{"type":874},"Find out more about how Push detects and blocks phishing attacks here.",{"data":37917,"marks":37918,"value":21,"nodeType":865},{},[],{"data":37920,"content":37924,"nodeType":890},{"target":37921},{"sys":37922},{"id":37923,"type":887,"linkType":888},"4ixcEsEW4EyqckOTmP5Pbb",[],{"data":37926,"content":37930,"nodeType":890},{"target":37927},{"sys":37928},{"id":37929,"type":887,"linkType":888},"4PJKxWTroEPohYm4mklfl6",[],{"data":37932,"content":37933,"nodeType":894},{},[],{"data":37935,"content":37936,"nodeType":904},{},[37937],{"data":37938,"marks":37939,"value":29766,"nodeType":865},{},[37940],{"type":902},{"data":37942,"content":37943,"nodeType":881},{},[37944],{"data":37945,"marks":37946,"value":37947,"nodeType":865},{},[],"It doesn’t stop there — Push provides comprehensive identity attack detection and response capabilities against techniques like credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more. ",{"data":37949,"content":37950,"nodeType":881},{},[37951,37954,37962],{"data":37952,"marks":37953,"value":31701,"nodeType":865},{},[],{"data":37955,"content":37957,"nodeType":876},{"uri":37956},"https://pushsecurity.com/demo?utm_campaign=12081956-FY25Q2_Hacker-News-Article&utm_source=thehackernews&utm_medium=sponsored&utm_content=external-article",[37958],{"data":37959,"marks":37960,"value":4495,"nodeType":865},{},[37961],{"type":874},{"data":37963,"marks":37964,"value":959,"nodeType":865},{},[],{"data":37966,"content":37970,"nodeType":890},{"target":37967},{"sys":37968},{"id":37969,"type":887,"linkType":888},"2DviJNOMbKgbcqwkNl0LDP",[],{"data":37972,"content":37973,"nodeType":881},{},[37974],{"data":37975,"marks":37976,"value":21,"nodeType":865},{},[],"Three reasons why browser is best for stopping phishing attacks","Why being in the browser gives defenders a key advantage over network and email phishing prevention, detection, and response tools. ","2025-04-28T00:00:00.000Z","three-reasons-why-browser-is-best-for-stopping-phishing-attacks",{"items":37982},[37983,37985],{"sys":37984,"name":342},{"id":4510},{"sys":37986,"name":4507},{"id":4506},{"items":37988},[37989],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":37990},{"url":5377},"blog/mfa-downgrade-attacks",{"json":37993},{"data":37994,"content":37995,"nodeType":1463},{},[37996],{"data":37997,"content":37998,"nodeType":881},{},[37999],{"data":38000,"marks":38001,"value":38002,"nodeType":865},{},[],"MFA downgrade (also known as auth downgrade) is an increasingly common technique used by attackers to bypass phishing-resistant authentication methods registered to an account — simply by selecting an alternative (phishable) method. ",{"id":34095,"publishedAt":38004},"2026-08-12T11:53:58.140Z",{"items":38006},[38007,38009],{"sys":38008,"name":342},{"id":4510},{"sys":38010,"name":4507},{"id":4506},{"items":38012},[38013,38015,38017,38019,38021,38023,38025,38027,38029,38031,38033,38035,38037,38039],{"sys":38014,"name":279,"slug":280,"tier":31},{"id":276},{"sys":38016,"name":413,"slug":414,"tier":31},{"id":410},{"sys":38018,"name":519,"slug":520,"tier":31},{"id":516},{"sys":38020,"name":342,"slug":343,"tier":31},{"id":339},{"sys":38022,"name":466,"slug":467,"tier":45},{"id":463},{"sys":38024,"name":324,"slug":325,"tier":45},{"id":321},{"sys":38026,"name":493,"slug":494,"tier":45},{"id":490},{"sys":38028,"name":261,"slug":262,"tier":45},{"id":258},{"sys":38030,"name":457,"slug":458,"tier":45},{"id":454},{"sys":38032,"name":511,"slug":512,"tier":45},{"id":508},{"sys":38034,"name":395,"slug":396,"tier":45},{"id":392},{"sys":38036,"name":484,"slug":485,"tier":45},{"id":481},{"sys":38038,"name":360,"slug":361,"tier":45},{"id":357},{"sys":38040,"name":404,"slug":405,"tier":45},{"id":401},"TdIWvxAWk6HxiHM6_ywXanD9PluTDY4edl7mPI6NeTQ",{"id":38043,"title":36760,"authorsCollection":38044,"content":38049,"extension":228,"faqItemsCollection":38668,"faqTitle":59,"featured":6,"hashTags":59,"meta":38670,"metaTitle":38671,"ogImage":59,"postType":7216,"publishedDate":35380,"relatedBlogPostsCollection":38672,"slug":36762,"stem":40033,"subtitle":59,"summary":40034,"synopsis":36761,"sys":40045,"tagsCollection":40047,"topicsCollection":40053,"__hash__":40079},"blog/blog/app-specific-password-phishing.json",{"items":38045},[38046],{"fullName":5373,"firstName":5374,"jobTitle":5375,"socialLinks":38047,"profilePicture":38048},[6440],{"url":5377},{"json":38050,"links":38636},{"data":38051,"content":38052,"nodeType":1463},{},[38053,38089,38095,38101,38127,38133,38136,38143,38159,38164,38170,38176,38182,38185,38192,38198,38214,38220,38225,38228,38235,38241,38300,38306,38309,38316,38322,38328,38427,38433,38436,38443,38469,38475,38478,38485,38491,38507,38513,38516,38523,38529,38534,38540,38545,38551,38592,38598,38604,38607,38614,38620],{"data":38054,"content":38055,"nodeType":881},{},[38056,38059,38066,38069,38076,38079,38086],{"data":38057,"marks":38058,"value":36111,"nodeType":865},{},[],{"data":38060,"content":38061,"nodeType":876},{"uri":36114},[38062],{"data":38063,"marks":38064,"value":1718,"nodeType":865},{},[38065],{"type":874},{"data":38067,"marks":38068,"value":1877,"nodeType":865},{},[],{"data":38070,"content":38071,"nodeType":876},{"uri":36125},[38072],{"data":38073,"marks":38074,"value":36131,"nodeType":865},{},[38075],{"type":874},{"data":38077,"marks":38078,"value":4487,"nodeType":865},{},[],{"data":38080,"content":38081,"nodeType":876},{"uri":36137},[38082],{"data":38083,"marks":38084,"value":36143,"nodeType":865},{},[38085],{"type":874},{"data":38087,"marks":38088,"value":36147,"nodeType":865},{},[],{"data":38090,"content":38091,"nodeType":881},{},[38092],{"data":38093,"marks":38094,"value":36154,"nodeType":865},{},[],{"data":38096,"content":38097,"nodeType":881},{},[38098],{"data":38099,"marks":38100,"value":36161,"nodeType":865},{},[],{"data":38102,"content":38103,"nodeType":881},{},[38104,38107,38114,38117,38124],{"data":38105,"marks":38106,"value":36168,"nodeType":865},{},[],{"data":38108,"content":38109,"nodeType":876},{"uri":30327},[38110],{"data":38111,"marks":38112,"value":36176,"nodeType":865},{},[38113],{"type":874},{"data":38115,"marks":38116,"value":36180,"nodeType":865},{},[],{"data":38118,"content":38119,"nodeType":876},{"uri":5192},[38120],{"data":38121,"marks":38122,"value":32109,"nodeType":865},{},[38123],{"type":874},{"data":38125,"marks":38126,"value":36191,"nodeType":865},{},[],{"data":38128,"content":38129,"nodeType":881},{},[38130],{"data":38131,"marks":38132,"value":36198,"nodeType":865},{},[],{"data":38134,"content":38135,"nodeType":894},{},[],{"data":38137,"content":38138,"nodeType":904},{},[38139],{"data":38140,"marks":38141,"value":36209,"nodeType":865},{},[38142],{"type":902},{"data":38144,"content":38145,"nodeType":881},{},[38146,38149,38156],{"data":38147,"marks":38148,"value":36216,"nodeType":865},{},[],{"data":38150,"content":38151,"nodeType":876},{"uri":36219},[38152],{"data":38153,"marks":38154,"value":36225,"nodeType":865},{},[38155],{"type":874},{"data":38157,"marks":38158,"value":36229,"nodeType":865},{},[],{"data":38160,"content":38163,"nodeType":890},{"target":38161},{"sys":38162},{"id":36234,"type":887,"linkType":888},[],{"data":38165,"content":38166,"nodeType":881},{},[38167],{"data":38168,"marks":38169,"value":36242,"nodeType":865},{},[],{"data":38171,"content":38172,"nodeType":881},{},[38173],{"data":38174,"marks":38175,"value":36249,"nodeType":865},{},[],{"data":38177,"content":38178,"nodeType":881},{},[38179],{"data":38180,"marks":38181,"value":36256,"nodeType":865},{},[],{"data":38183,"content":38184,"nodeType":894},{},[],{"data":38186,"content":38187,"nodeType":904},{},[38188],{"data":38189,"marks":38190,"value":36267,"nodeType":865},{},[38191],{"type":902},{"data":38193,"content":38194,"nodeType":881},{},[38195],{"data":38196,"marks":38197,"value":36274,"nodeType":865},{},[],{"data":38199,"content":38200,"nodeType":881},{},[38201,38204,38211],{"data":38202,"marks":38203,"value":36281,"nodeType":865},{},[],{"data":38205,"content":38206,"nodeType":876},{"uri":36284},[38207],{"data":38208,"marks":38209,"value":36290,"nodeType":865},{},[38210],{"type":874},{"data":38212,"marks":38213,"value":36294,"nodeType":865},{},[],{"data":38215,"content":38216,"nodeType":881},{},[38217],{"data":38218,"marks":38219,"value":36301,"nodeType":865},{},[],{"data":38221,"content":38224,"nodeType":890},{"target":38222},{"sys":38223},{"id":36306,"type":887,"linkType":888},[],{"data":38226,"content":38227,"nodeType":894},{},[],{"data":38229,"content":38230,"nodeType":904},{},[38231],{"data":38232,"marks":38233,"value":36318,"nodeType":865},{},[38234],{"type":902},{"data":38236,"content":38237,"nodeType":881},{},[38238],{"data":38239,"marks":38240,"value":36325,"nodeType":865},{},[],{"data":38242,"content":38243,"nodeType":1818},{},[38244,38253,38262,38271],{"data":38245,"content":38246,"nodeType":1734},{},[38247],{"data":38248,"content":38249,"nodeType":881},{},[38250],{"data":38251,"marks":38252,"value":36338,"nodeType":865},{},[],{"data":38254,"content":38255,"nodeType":1734},{},[38256],{"data":38257,"content":38258,"nodeType":881},{},[38259],{"data":38260,"marks":38261,"value":36348,"nodeType":865},{},[],{"data":38263,"content":38264,"nodeType":1734},{},[38265],{"data":38266,"content":38267,"nodeType":881},{},[38268],{"data":38269,"marks":38270,"value":36358,"nodeType":865},{},[],{"data":38272,"content":38273,"nodeType":1734},{},[38274],{"data":38275,"content":38276,"nodeType":881},{},[38277,38280,38287,38290,38297],{"data":38278,"marks":38279,"value":36368,"nodeType":865},{},[],{"data":38281,"content":38282,"nodeType":876},{"uri":36371},[38283],{"data":38284,"marks":38285,"value":36377,"nodeType":865},{},[38286],{"type":874},{"data":38288,"marks":38289,"value":36381,"nodeType":865},{},[],{"data":38291,"content":38292,"nodeType":876},{"uri":36384},[38293],{"data":38294,"marks":38295,"value":36390,"nodeType":865},{},[38296],{"type":874},{"data":38298,"marks":38299,"value":30204,"nodeType":865},{},[],{"data":38301,"content":38302,"nodeType":881},{},[38303],{"data":38304,"marks":38305,"value":36400,"nodeType":865},{},[],{"data":38307,"content":38308,"nodeType":894},{},[],{"data":38310,"content":38311,"nodeType":904},{},[38312],{"data":38313,"marks":38314,"value":36411,"nodeType":865},{},[38315],{"type":902},{"data":38317,"content":38318,"nodeType":881},{},[38319],{"data":38320,"marks":38321,"value":36418,"nodeType":865},{},[],{"data":38323,"content":38324,"nodeType":881},{},[38325],{"data":38326,"marks":38327,"value":36425,"nodeType":865},{},[],{"data":38329,"content":38330,"nodeType":1818},{},[38331,38350,38379,38398],{"data":38332,"content":38333,"nodeType":1734},{},[38334],{"data":38335,"content":38336,"nodeType":881},{},[38337,38340,38347],{"data":38338,"marks":38339,"value":36438,"nodeType":865},{},[],{"data":38341,"content":38342,"nodeType":876},{"uri":30315},[38343],{"data":38344,"marks":38345,"value":36446,"nodeType":865},{},[38346],{"type":874},{"data":38348,"marks":38349,"value":36450,"nodeType":865},{},[],{"data":38351,"content":38352,"nodeType":1734},{},[38353],{"data":38354,"content":38355,"nodeType":881},{},[38356,38359,38366,38369,38376],{"data":38357,"marks":38358,"value":21,"nodeType":865},{},[],{"data":38360,"content":38361,"nodeType":876},{"uri":18095},[38362],{"data":38363,"marks":38364,"value":24657,"nodeType":865},{},[38365],{"type":874},{"data":38367,"marks":38368,"value":34647,"nodeType":865},{},[],{"data":38370,"content":38371,"nodeType":876},{"uri":34650},[38372],{"data":38373,"marks":38374,"value":34656,"nodeType":865},{},[38375],{"type":874},{"data":38377,"marks":38378,"value":34660,"nodeType":865},{},[],{"data":38380,"content":38381,"nodeType":1734},{},[38382],{"data":38383,"content":38384,"nodeType":881},{},[38385,38388,38395],{"data":38386,"marks":38387,"value":21,"nodeType":865},{},[],{"data":38389,"content":38390,"nodeType":876},{"uri":1526},[38391],{"data":38392,"marks":38393,"value":360,"nodeType":865},{},[38394],{"type":874},{"data":38396,"marks":38397,"value":34680,"nodeType":865},{},[],{"data":38399,"content":38400,"nodeType":1734},{},[38401],{"data":38402,"content":38403,"nodeType":881},{},[38404,38407,38414,38417,38424],{"data":38405,"marks":38406,"value":21,"nodeType":865},{},[],{"data":38408,"content":38409,"nodeType":876},{"uri":30350},[38410],{"data":38411,"marks":38412,"value":34697,"nodeType":865},{},[38413],{"type":874},{"data":38415,"marks":38416,"value":34701,"nodeType":865},{},[],{"data":38418,"content":38419,"nodeType":876},{"uri":34704},[38420],{"data":38421,"marks":38422,"value":34710,"nodeType":865},{},[38423],{"type":874},{"data":38425,"marks":38426,"value":34714,"nodeType":865},{},[],{"data":38428,"content":38429,"nodeType":881},{},[38430],{"data":38431,"marks":38432,"value":36534,"nodeType":865},{},[],{"data":38434,"content":38435,"nodeType":894},{},[],{"data":38437,"content":38438,"nodeType":904},{},[38439],{"data":38440,"marks":38441,"value":29161,"nodeType":865},{},[38442],{"type":902},{"data":38444,"content":38445,"nodeType":881},{},[38446,38449,38456,38459,38466],{"data":38447,"marks":38448,"value":36551,"nodeType":865},{},[],{"data":38450,"content":38451,"nodeType":876},{"uri":11116},[38452],{"data":38453,"marks":38454,"value":11122,"nodeType":865},{},[38455],{"type":874},{"data":38457,"marks":38458,"value":36562,"nodeType":865},{},[],{"data":38460,"content":38461,"nodeType":876},{"uri":34154},[38462],{"data":38463,"marks":38464,"value":24505,"nodeType":865},{},[38465],{"type":874},{"data":38467,"marks":38468,"value":36573,"nodeType":865},{},[],{"data":38470,"content":38471,"nodeType":881},{},[38472],{"data":38473,"marks":38474,"value":36580,"nodeType":865},{},[],{"data":38476,"content":38477,"nodeType":894},{},[],{"data":38479,"content":38480,"nodeType":904},{},[38481],{"data":38482,"marks":38483,"value":7774,"nodeType":865},{},[38484],{"type":902},{"data":38486,"content":38487,"nodeType":881},{},[38488],{"data":38489,"marks":38490,"value":36597,"nodeType":865},{},[],{"data":38492,"content":38493,"nodeType":881},{},[38494,38497,38504],{"data":38495,"marks":38496,"value":36604,"nodeType":865},{},[],{"data":38498,"content":38499,"nodeType":876},{"uri":36607},[38500],{"data":38501,"marks":38502,"value":36613,"nodeType":865},{},[38503],{"type":874},{"data":38505,"marks":38506,"value":36617,"nodeType":865},{},[],{"data":38508,"content":38509,"nodeType":881},{},[38510],{"data":38511,"marks":38512,"value":36624,"nodeType":865},{},[],{"data":38514,"content":38515,"nodeType":894},{},[],{"data":38517,"content":38518,"nodeType":904},{},[38519],{"data":38520,"marks":38521,"value":5936,"nodeType":865},{},[38522],{"type":902},{"data":38524,"content":38525,"nodeType":881},{},[38526],{"data":38527,"marks":38528,"value":36641,"nodeType":865},{},[],{"data":38530,"content":38533,"nodeType":890},{"target":38531},{"sys":38532},{"id":36646,"type":887,"linkType":888},[],{"data":38535,"content":38536,"nodeType":881},{},[38537],{"data":38538,"marks":38539,"value":36654,"nodeType":865},{},[],{"data":38541,"content":38544,"nodeType":890},{"target":38542},{"sys":38543},{"id":36659,"type":887,"linkType":888},[],{"data":38546,"content":38547,"nodeType":881},{},[38548],{"data":38549,"marks":38550,"value":36667,"nodeType":865},{},[],{"data":38552,"content":38553,"nodeType":1818},{},[38554,38573],{"data":38555,"content":38556,"nodeType":1734},{},[38557],{"data":38558,"content":38559,"nodeType":881},{},[38560,38563,38570],{"data":38561,"marks":38562,"value":21,"nodeType":865},{},[],{"data":38564,"content":38565,"nodeType":876},{"uri":36219},[38566],{"data":38567,"marks":38568,"value":36225,"nodeType":865},{},[38569],{"type":874},{"data":38571,"marks":38572,"value":21,"nodeType":865},{},[],{"data":38574,"content":38575,"nodeType":1734},{},[38576],{"data":38577,"content":38578,"nodeType":881},{},[38579,38582,38589],{"data":38580,"marks":38581,"value":21,"nodeType":865},{},[],{"data":38583,"content":38584,"nodeType":876},{"uri":36701},[38585],{"data":38586,"marks":38587,"value":36707,"nodeType":865},{},[38588],{"type":874},{"data":38590,"marks":38591,"value":21,"nodeType":865},{},[],{"data":38593,"content":38594,"nodeType":881},{},[38595],{"data":38596,"marks":38597,"value":36717,"nodeType":865},{},[],{"data":38599,"content":38600,"nodeType":881},{},[38601],{"data":38602,"marks":38603,"value":36724,"nodeType":865},{},[],{"data":38605,"content":38606,"nodeType":894},{},[],{"data":38608,"content":38609,"nodeType":904},{},[38610],{"data":38611,"marks":38612,"value":36735,"nodeType":865},{},[38613],{"type":902},{"data":38615,"content":38616,"nodeType":881},{},[38617],{"data":38618,"marks":38619,"value":36742,"nodeType":865},{},[],{"data":38621,"content":38622,"nodeType":881},{},[38623,38626,38633],{"data":38624,"marks":38625,"value":31701,"nodeType":865},{},[],{"data":38627,"content":38628,"nodeType":876},{"uri":36751},[38629],{"data":38630,"marks":38631,"value":4495,"nodeType":865},{},[38632],{"type":874},{"data":38634,"marks":38635,"value":959,"nodeType":865},{},[],{"entries":38637},{"hyperlink":38638,"inline":38639,"block":38640},[],[],[38641,38648,38655,38661],{"sys":38642,"__typename":7008,"title":38643,"caption":38644,"layoutMode":59,"file":38645},{"id":36234},"Creating an ASP in Google","Creating an ASP for a Google account",{"url":38646,"width":7012,"height":38647},"https://images.ctfassets.net/y1cdw1ablpvd/3fMIrxHzMvOH5bE4Xb4mNO/ae1b57f12534c3abdeca4dd54ddcb77f/image3.png",1118,{"sys":38649,"__typename":7008,"title":38650,"caption":38651,"layoutMode":59,"file":38652},{"id":36306},"ASP phishing lure","A highly convincing ASP phishing lure used in a targeted attack",{"url":38653,"width":38654,"height":24963},"https://images.ctfassets.net/y1cdw1ablpvd/46CywsxmjD6CfOHkGjyTiF/01d6d255dd82a4df7f0f81e97817c761/image1.png",1570,{"sys":38656,"__typename":7008,"title":38657,"caption":38657,"layoutMode":59,"file":38658},{"id":36646},"Configuring URL blocking for ASP creation pages",{"url":38659,"width":7012,"height":38660},"https://images.ctfassets.net/y1cdw1ablpvd/1Psq6fCOCTr8lDFl0USd9a/b2171432f2ce2b812be4f339c0d74b71/image2.png",1402,{"sys":38662,"__typename":7008,"title":38663,"caption":38664,"layoutMode":59,"file":38665},{"id":36659},"URL blocking message","Customizable message that the user sees when trying to access a blocked URL",{"url":38666,"width":38647,"height":38667},"https://images.ctfassets.net/y1cdw1ablpvd/1b5DZjswtUn8gBc2XQfsBp/2ac0dcc25029cf887b69d253419e6970/image4.png",376,{"items":38669},[],{},"App-Specific Password phishing and how to prevent it",{"items":38673},[38674,39007,39579],{"__typename":1485,"sys":38675,"content":38677,"title":38993,"synopsis":38994,"hashTags":59,"publishedDate":38995,"slug":38996,"tagsCollection":38997,"authorsCollection":39003},{"id":38676},"4bYO5rVy9n2OO3vtMVQeda",{"json":38678},{"data":38679,"content":38680,"nodeType":1463},{},[38681,38688,38707,38723,38730,38737,38740,38747,38754,38807,38814,38820,38823,38830,38837,38844,38851,38858,38875,38881,38888,38895,38912,38918,38925,38932,38939,38946,38953,38956,38963,38981,38987],{"data":38682,"content":38683,"nodeType":904},{},[38684],{"data":38685,"marks":38686,"value":38687,"nodeType":865},{},[],"All phishing eventually leads to the browser",{"data":38689,"content":38690,"nodeType":881},{},[38691,38695,38704],{"data":38692,"marks":38693,"value":38694,"nodeType":865},{},[],"The best attack detection methods are those that focus on ",{"data":38696,"content":38698,"nodeType":876},{"uri":38697},"https://pushsecurity.com/blog/our-design-philosophy-detecting-what-matters/",[38699],{"data":38700,"marks":38701,"value":38703,"nodeType":865},{},[38702],{"type":874},"detecting indicators that are difficult for attackers to change or obfuscate",{"data":38705,"marks":38706,"value":1032,"nodeType":865},{},[],{"data":38708,"content":38709,"nodeType":881},{},[38710,38714,38719],{"data":38711,"marks":38712,"value":38713,"nodeType":865},{},[],"For a credential phishing attack to succeed, the victim ",{"data":38715,"marks":38716,"value":38718,"nodeType":865},{},[38717],{"type":874},"has",{"data":38720,"marks":38721,"value":38722,"nodeType":865},{},[]," to enter their password into a webpage. There’s no two-ways about it, attackers cannot change this. ",{"data":38724,"content":38725,"nodeType":881},{},[38726],{"data":38727,"marks":38728,"value":38729,"nodeType":865},{},[],"So it stands to reason that, if you can detect this user behavior, and block them from entering their password, then you can stop phishing. ",{"data":38731,"content":38732,"nodeType":881},{},[38733],{"data":38734,"marks":38735,"value":38736,"nodeType":865},{},[],"This is exactly what Push does.",{"data":38738,"content":38739,"nodeType":894},{},[],{"data":38741,"content":38742,"nodeType":1860},{},[38743],{"data":38744,"marks":38745,"value":38746,"nodeType":865},{},[],"Most anti-phishing tools are easily bypassed",{"data":38748,"content":38749,"nodeType":881},{},[38750],{"data":38751,"marks":38752,"value":38753,"nodeType":865},{},[],"Other anti-phishing tools rely on detecting elements of the attack that attackers can change and hide, such as domains or the webpage contents. Attackers use tricks to evade these detection, like:",{"data":38755,"content":38756,"nodeType":1818},{},[38757,38767,38777,38787,38797],{"data":38758,"content":38759,"nodeType":1734},{},[38760],{"data":38761,"content":38762,"nodeType":881},{},[38763],{"data":38764,"marks":38765,"value":38766,"nodeType":865},{},[],"Using Cloudflare Workers to block automatic analysis of their phishing site",{"data":38768,"content":38769,"nodeType":1734},{},[38770],{"data":38771,"content":38772,"nodeType":881},{},[38773],{"data":38774,"marks":38775,"value":38776,"nodeType":865},{},[],"Hacking a Wordpress blog to get a reputable domain that passes domain checks ",{"data":38778,"content":38779,"nodeType":1734},{},[38780],{"data":38781,"content":38782,"nodeType":881},{},[38783],{"data":38784,"marks":38785,"value":38786,"nodeType":865},{},[],"Using redirects and rotating the URLs delivered to the victim to bypass link analysis",{"data":38788,"content":38789,"nodeType":1734},{},[38790],{"data":38791,"content":38792,"nodeType":881},{},[38793],{"data":38794,"marks":38795,"value":38796,"nodeType":865},{},[],"Randomizing the HTML title for the web page to bypass blocklists ",{"data":38798,"content":38799,"nodeType":1734},{},[38800],{"data":38801,"content":38802,"nodeType":881},{},[38803],{"data":38804,"marks":38805,"value":38806,"nodeType":865},{},[],"One-time phishing links that only work the first time they are clicked",{"data":38808,"content":38809,"nodeType":881},{},[38810],{"data":38811,"marks":38812,"value":38813,"nodeType":865},{},[],"Push is putting an end to this game of cat and mouse, by keeping it really simple; you can’t phish someone who can’t put their password into a phishing page. ",{"data":38815,"content":38819,"nodeType":890},{"target":38816},{"sys":38817},{"id":38818,"type":887,"linkType":888},"6AwOZSpqaChmeksnj4SyWE",[],{"data":38821,"content":38822,"nodeType":894},{},[],{"data":38824,"content":38825,"nodeType":1860},{},[38826],{"data":38827,"marks":38828,"value":38829,"nodeType":865},{},[],"Domain-binding passwords",{"data":38831,"content":38832,"nodeType":881},{},[38833],{"data":38834,"marks":38835,"value":38836,"nodeType":865},{},[],"If you’re familiar with how passkeys are domain-bound, then think of what Push does as domain-binding passwords. We pin the password to its legitimate domain(s) and then don’t allow it to be entered into any webpage on any other domain. ",{"data":38838,"content":38839,"nodeType":881},{},[38840],{"data":38841,"marks":38842,"value":38843,"nodeType":865},{},[],"But just because you’ve stopped your users from being phished doesn’t mean you don’t want to know when attackers are attempting to phish your users and how. ",{"data":38845,"content":38846,"nodeType":881},{},[38847],{"data":38848,"marks":38849,"value":38850,"nodeType":865},{},[],"Push still inspects webpages to see if attackers are rendering cloned app login pages in the browser or if known AitM and BitM toolkits are being used. This way you don’t lose visibility of the unsuccessful attacks that are targeting your users. Think of it as a handy second and third layer of defense.",{"data":38852,"content":38853,"nodeType":881},{},[38854],{"data":38855,"marks":38856,"value":38857,"nodeType":865},{},[],"Lets run through a quick before and after example:",{"data":38859,"content":38860,"nodeType":1860},{},[38861,38865,38871],{"data":38862,"marks":38863,"value":38864,"nodeType":865},{},[],"Scenario 1: An attacker attempts to phish an employee that ",{"data":38866,"marks":38867,"value":38870,"nodeType":865},{},[38868,38869],{"type":874},{"type":902},"doesn’t",{"data":38872,"marks":38873,"value":38874,"nodeType":865},{},[]," have Push deployed to their browser.",{"data":38876,"content":38880,"nodeType":890},{"target":38877},{"sys":38878},{"id":38879,"type":887,"linkType":888},"2CbGMUSJsP1mNeHkmpLl6N",[],{"data":38882,"content":38883,"nodeType":881},{},[38884],{"data":38885,"marks":38886,"value":38887,"nodeType":865},{},[],"Here, an attacker hacks a Wordpress blog to get a reputable domain and then runs a phishing toolkit on the webpage. They email one of your employees a link to it. Your SWG / email scanning solution inspects it in a sandbox but the phish kit detects this and redirects to a benign site so that it passes the inspection. ",{"data":38889,"content":38890,"nodeType":881},{},[38891],{"data":38892,"marks":38893,"value":38894,"nodeType":865},{},[],"Your user gets the email with the link and is now free to interact with the phishing page. They enter their credentials plus MFA code into the page and voila! The attacker steals them and is able to compromise the user’s account.  ",{"data":38896,"content":38897,"nodeType":1860},{},[38898,38902,38908],{"data":38899,"marks":38900,"value":38901,"nodeType":865},{},[],"Scenario 2: An attacker attempts to phish an employee that ",{"data":38903,"marks":38904,"value":38907,"nodeType":865},{},[38905,38906],{"type":874},{"type":902},"does",{"data":38909,"marks":38910,"value":38911,"nodeType":865},{},[]," have Push deployed to their browser. ",{"data":38913,"content":38917,"nodeType":890},{"target":38914},{"sys":38915},{"id":38916,"type":887,"linkType":888},"77smnID1woCfFJrJPyTvKY",[],{"data":38919,"content":38920,"nodeType":881},{},[38921],{"data":38922,"marks":38923,"value":38924,"nodeType":865},{},[],"This time, the attacker uses the same phishing toolkit and domain from the first example. But in reality, they don’t have to send it to your employee using email, instead, they could use LinkedIn messenger, Slack, Teams, or any application that allows employees to communicate with each other. ",{"data":38926,"content":38927,"nodeType":881},{},[38928],{"data":38929,"marks":38930,"value":38931,"nodeType":865},{},[],"Like before, the user receives the link, opens it and starts to enter their credentials into the webpage. This time though, the Push browser extension inspects the webpage running in the user's browser. Push observes that the webpage is a login page and the user is entering their password into the page.",{"data":38933,"content":38934,"nodeType":881},{},[38935],{"data":38936,"marks":38937,"value":38938,"nodeType":865},{},[],"The first detection Push makes is checking that the password the user is entering matches the domain that password is pinned to. Since it doesn't match, based on this detection alone the user is automatically redirected to a blocking page. An important point to make here is that the password never leaves the user’s browser and the check is made using a shortened salted hash of the password.   ",{"data":38940,"content":38941,"nodeType":881},{},[38942],{"data":38943,"marks":38944,"value":38945,"nodeType":865},{},[],"The second detection Push makes is that the rendered web app is using a cloned app login page. The third detection is that a phishing toolkit is running in the web app code. ",{"data":38947,"content":38948,"nodeType":881},{},[38949],{"data":38950,"marks":38951,"value":38952,"nodeType":865},{},[],"In this particular scenario these second and third detections serve as useful context for understanding the nature of the phishing attack. But both will still redirect to a blocking page if they are triggered in isolation of the other phishing detections. ",{"data":38954,"content":38955,"nodeType":894},{},[],{"data":38957,"content":38958,"nodeType":904},{},[38959],{"data":38960,"marks":38961,"value":38962,"nodeType":865},{},[],"We don’t just stop phishing attacks",{"data":38964,"content":38965,"nodeType":881},{},[38966,38970,38978],{"data":38967,"marks":38968,"value":38969,"nodeType":865},{},[],"We also detect other identity-related attack techniques used to compromise user accounts. That includes credential stuffing, password spraying and session hijacking using stolen session tokens. If you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":38971,"content":38972,"nodeType":876},{"uri":6048},[38973],{"data":38974,"marks":38975,"value":38977,"nodeType":865},{},[38976],{"type":874},"book some time with one of our team",{"data":38979,"marks":38980,"value":30204,"nodeType":865},{},[],{"data":38982,"content":38986,"nodeType":890},{"target":38983},{"sys":38984},{"id":38985,"type":887,"linkType":888},"2JSmYDaiAciOx7Z1MRuJlA",[],{"data":38988,"content":38989,"nodeType":881},{},[38990],{"data":38991,"marks":38992,"value":21,"nodeType":865},{},[],"Detecting and blocking phishing attacks in the browser","How Push detects and blocks phishing attempts in the browser – explained in less than two minutes. ","2024-10-23T00:00:00.000Z","detecting-and-blocking-phishing-attacks-in-the-browser",{"items":38998},[38999,39001],{"sys":39000,"name":4507},{"id":4506},{"sys":39002,"name":342},{"id":4510},{"items":39004},[39005],{"fullName":32085,"firstName":32086,"jobTitle":20082,"profilePicture":39006},{"url":32088},{"__typename":1485,"sys":39008,"content":39009,"title":37977,"synopsis":37978,"hashTags":59,"publishedDate":37979,"slug":37980,"tagsCollection":39569,"authorsCollection":39575},{"id":37328},{"json":39010},{"data":39011,"content":39012,"nodeType":1463},{},[39013,39019,39025,39031,39034,39041,39047,39063,39093,39098,39114,39119,39139,39142,39149,39155,39168,39181,39186,39192,39198,39203,39216,39219,39226,39232,39238,39244,39250,39253,39260,39266,39272,39288,39294,39301,39340,39346,39351,39357,39362,39368,39371,39378,39391,39397,39431,39441,39444,39451,39457,39463,39493,39499,39516,39521,39526,39529,39536,39542,39558,39563],{"data":39014,"content":39015,"nodeType":881},{},[39016],{"data":39017,"marks":39018,"value":37339,"nodeType":865},{},[],{"data":39020,"content":39021,"nodeType":881},{},[39022],{"data":39023,"marks":39024,"value":37346,"nodeType":865},{},[],{"data":39026,"content":39027,"nodeType":881},{},[39028],{"data":39029,"marks":39030,"value":37353,"nodeType":865},{},[],{"data":39032,"content":39033,"nodeType":894},{},[],{"data":39035,"content":39036,"nodeType":904},{},[39037],{"data":39038,"marks":39039,"value":37364,"nodeType":865},{},[39040],{"type":902},{"data":39042,"content":39043,"nodeType":881},{},[39044],{"data":39045,"marks":39046,"value":37371,"nodeType":865},{},[],{"data":39048,"content":39049,"nodeType":881},{},[39050,39053,39060],{"data":39051,"marks":39052,"value":37378,"nodeType":865},{},[],{"data":39054,"content":39055,"nodeType":876},{"uri":37381},[39056],{"data":39057,"marks":39058,"value":37387,"nodeType":865},{},[39059],{"type":874},{"data":39061,"marks":39062,"value":37391,"nodeType":865},{},[],{"data":39064,"content":39065,"nodeType":1818},{},[39066,39075,39084],{"data":39067,"content":39068,"nodeType":1734},{},[39069],{"data":39070,"content":39071,"nodeType":881},{},[39072],{"data":39073,"marks":39074,"value":37404,"nodeType":865},{},[],{"data":39076,"content":39077,"nodeType":1734},{},[39078],{"data":39079,"content":39080,"nodeType":881},{},[39081],{"data":39082,"marks":39083,"value":37414,"nodeType":865},{},[],{"data":39085,"content":39086,"nodeType":1734},{},[39087],{"data":39088,"content":39089,"nodeType":881},{},[39090],{"data":39091,"marks":39092,"value":37424,"nodeType":865},{},[],{"data":39094,"content":39097,"nodeType":890},{"target":39095},{"sys":39096},{"id":37429,"type":887,"linkType":888},[],{"data":39099,"content":39100,"nodeType":881},{},[39101,39104,39111],{"data":39102,"marks":39103,"value":37437,"nodeType":865},{},[],{"data":39105,"content":39106,"nodeType":876},{"uri":37440},[39107],{"data":39108,"marks":39109,"value":37446,"nodeType":865},{},[39110],{"type":874},{"data":39112,"marks":39113,"value":37450,"nodeType":865},{},[],{"data":39115,"content":39118,"nodeType":890},{"target":39116},{"sys":39117},{"id":37455,"type":887,"linkType":888},[],{"data":39120,"content":39121,"nodeType":881},{},[39122,39125,39129,39132,39136],{"data":39123,"marks":39124,"value":37463,"nodeType":865},{},[],{"data":39126,"marks":39127,"value":37468,"nodeType":865},{},[39128],{"type":902},{"data":39130,"marks":39131,"value":37472,"nodeType":865},{},[],{"data":39133,"marks":39134,"value":37477,"nodeType":865},{},[39135],{"type":902},{"data":39137,"marks":39138,"value":37481,"nodeType":865},{},[],{"data":39140,"content":39141,"nodeType":894},{},[],{"data":39143,"content":39144,"nodeType":904},{},[39145],{"data":39146,"marks":39147,"value":37492,"nodeType":865},{},[39148],{"type":902},{"data":39150,"content":39151,"nodeType":881},{},[39152],{"data":39153,"marks":39154,"value":37499,"nodeType":865},{},[],{"data":39156,"content":39157,"nodeType":881},{},[39158,39161,39165],{"data":39159,"marks":39160,"value":37506,"nodeType":865},{},[],{"data":39162,"marks":39163,"value":37511,"nodeType":865},{},[39164],{"type":5120},{"data":39166,"marks":39167,"value":37515,"nodeType":865},{},[],{"data":39169,"content":39170,"nodeType":881},{},[39171,39174,39178],{"data":39172,"marks":39173,"value":37522,"nodeType":865},{},[],{"data":39175,"marks":39176,"value":37527,"nodeType":865},{},[39177],{"type":902},{"data":39179,"marks":39180,"value":1032,"nodeType":865},{},[],{"data":39182,"content":39185,"nodeType":890},{"target":39183},{"sys":39184},{"id":37535,"type":887,"linkType":888},[],{"data":39187,"content":39188,"nodeType":881},{},[39189],{"data":39190,"marks":39191,"value":37543,"nodeType":865},{},[],{"data":39193,"content":39194,"nodeType":881},{},[39195],{"data":39196,"marks":39197,"value":37550,"nodeType":865},{},[],{"data":39199,"content":39202,"nodeType":890},{"target":39200},{"sys":39201},{"id":37555,"type":887,"linkType":888},[],{"data":39204,"content":39205,"nodeType":881},{},[39206,39209,39213],{"data":39207,"marks":39208,"value":37563,"nodeType":865},{},[],{"data":39210,"marks":39211,"value":37568,"nodeType":865},{},[39212],{"type":902},{"data":39214,"marks":39215,"value":37572,"nodeType":865},{},[],{"data":39217,"content":39218,"nodeType":894},{},[],{"data":39220,"content":39221,"nodeType":904},{},[39222],{"data":39223,"marks":39224,"value":37583,"nodeType":865},{},[39225],{"type":902},{"data":39227,"content":39228,"nodeType":881},{},[39229],{"data":39230,"marks":39231,"value":37590,"nodeType":865},{},[],{"data":39233,"content":39234,"nodeType":881},{},[39235],{"data":39236,"marks":39237,"value":37597,"nodeType":865},{},[],{"data":39239,"content":39240,"nodeType":881},{},[39241],{"data":39242,"marks":39243,"value":37604,"nodeType":865},{},[],{"data":39245,"content":39246,"nodeType":881},{},[39247],{"data":39248,"marks":39249,"value":37611,"nodeType":865},{},[],{"data":39251,"content":39252,"nodeType":894},{},[],{"data":39254,"content":39255,"nodeType":904},{},[39256],{"data":39257,"marks":39258,"value":37622,"nodeType":865},{},[39259],{"type":902},{"data":39261,"content":39262,"nodeType":881},{},[39263],{"data":39264,"marks":39265,"value":37629,"nodeType":865},{},[],{"data":39267,"content":39268,"nodeType":881},{},[39269],{"data":39270,"marks":39271,"value":37636,"nodeType":865},{},[],{"data":39273,"content":39274,"nodeType":881},{},[39275,39278,39285],{"data":39276,"marks":39277,"value":37643,"nodeType":865},{},[],{"data":39279,"content":39280,"nodeType":876},{"uri":37646},[39281],{"data":39282,"marks":39283,"value":37652,"nodeType":865},{},[39284],{"type":874},{"data":39286,"marks":39287,"value":37656,"nodeType":865},{},[],{"data":39289,"content":39290,"nodeType":881},{},[39291],{"data":39292,"marks":39293,"value":37663,"nodeType":865},{},[],{"data":39295,"content":39296,"nodeType":881},{},[39297],{"data":39298,"marks":39299,"value":37671,"nodeType":865},{},[39300],{"type":902},{"data":39302,"content":39303,"nodeType":1818},{},[39304,39313,39322,39331],{"data":39305,"content":39306,"nodeType":1734},{},[39307],{"data":39308,"content":39309,"nodeType":881},{},[39310],{"data":39311,"marks":39312,"value":31242,"nodeType":865},{},[],{"data":39314,"content":39315,"nodeType":1734},{},[39316],{"data":39317,"content":39318,"nodeType":881},{},[39319],{"data":39320,"marks":39321,"value":37693,"nodeType":865},{},[],{"data":39323,"content":39324,"nodeType":1734},{},[39325],{"data":39326,"content":39327,"nodeType":881},{},[39328],{"data":39329,"marks":39330,"value":37703,"nodeType":865},{},[],{"data":39332,"content":39333,"nodeType":1734},{},[39334],{"data":39335,"content":39336,"nodeType":881},{},[39337],{"data":39338,"marks":39339,"value":37713,"nodeType":865},{},[],{"data":39341,"content":39342,"nodeType":881},{},[39343],{"data":39344,"marks":39345,"value":37720,"nodeType":865},{},[],{"data":39347,"content":39350,"nodeType":890},{"target":39348},{"sys":39349},{"id":37725,"type":887,"linkType":888},[],{"data":39352,"content":39353,"nodeType":881},{},[39354],{"data":39355,"marks":39356,"value":37733,"nodeType":865},{},[],{"data":39358,"content":39361,"nodeType":890},{"target":39359},{"sys":39360},{"id":37738,"type":887,"linkType":888},[],{"data":39363,"content":39364,"nodeType":881},{},[39365],{"data":39366,"marks":39367,"value":37746,"nodeType":865},{},[],{"data":39369,"content":39370,"nodeType":894},{},[],{"data":39372,"content":39373,"nodeType":904},{},[39374],{"data":39375,"marks":39376,"value":37757,"nodeType":865},{},[39377],{"type":902},{"data":39379,"content":39380,"nodeType":881},{},[39381,39384,39388],{"data":39382,"marks":39383,"value":37764,"nodeType":865},{},[],{"data":39385,"marks":39386,"value":37769,"nodeType":865},{},[39387],{"type":902},{"data":39389,"marks":39390,"value":1032,"nodeType":865},{},[],{"data":39392,"content":39393,"nodeType":881},{},[39394],{"data":39395,"marks":39396,"value":37779,"nodeType":865},{},[],{"data":39398,"content":39399,"nodeType":881},{},[39400,39403,39407,39410,39414,39417,39421,39424,39428],{"data":39401,"marks":39402,"value":37786,"nodeType":865},{},[],{"data":39404,"marks":39405,"value":37791,"nodeType":865},{},[39406],{"type":902},{"data":39408,"marks":39409,"value":37795,"nodeType":865},{},[],{"data":39411,"marks":39412,"value":37800,"nodeType":865},{},[39413],{"type":902},{"data":39415,"marks":39416,"value":37804,"nodeType":865},{},[],{"data":39418,"marks":39419,"value":37800,"nodeType":865},{},[39420],{"type":902},{"data":39422,"marks":39423,"value":37812,"nodeType":865},{},[],{"data":39425,"marks":39426,"value":37817,"nodeType":865},{},[39427],{"type":902},{"data":39429,"marks":39430,"value":37821,"nodeType":865},{},[],{"data":39432,"content":39433,"nodeType":881},{},[39434,39437],{"data":39435,"marks":39436,"value":37828,"nodeType":865},{},[],{"data":39438,"marks":39439,"value":37833,"nodeType":865},{},[39440],{"type":902},{"data":39442,"content":39443,"nodeType":894},{},[],{"data":39445,"content":39446,"nodeType":904},{},[39447],{"data":39448,"marks":39449,"value":37844,"nodeType":865},{},[39450],{"type":902},{"data":39452,"content":39453,"nodeType":881},{},[39454],{"data":39455,"marks":39456,"value":37851,"nodeType":865},{},[],{"data":39458,"content":39459,"nodeType":881},{},[39460],{"data":39461,"marks":39462,"value":37858,"nodeType":865},{},[],{"data":39464,"content":39465,"nodeType":1818},{},[39466,39475,39484],{"data":39467,"content":39468,"nodeType":1734},{},[39469],{"data":39470,"content":39471,"nodeType":881},{},[39472],{"data":39473,"marks":39474,"value":37871,"nodeType":865},{},[],{"data":39476,"content":39477,"nodeType":1734},{},[39478],{"data":39479,"content":39480,"nodeType":881},{},[39481],{"data":39482,"marks":39483,"value":37881,"nodeType":865},{},[],{"data":39485,"content":39486,"nodeType":1734},{},[39487],{"data":39488,"content":39489,"nodeType":881},{},[39490],{"data":39491,"marks":39492,"value":37891,"nodeType":865},{},[],{"data":39494,"content":39495,"nodeType":881},{},[39496],{"data":39497,"marks":39498,"value":37898,"nodeType":865},{},[],{"data":39500,"content":39501,"nodeType":881},{},[39502,39506,39513],{"data":39503,"marks":39504,"value":37906,"nodeType":865},{},[39505],{"type":902},{"data":39507,"content":39508,"nodeType":876},{"uri":37909},[39509],{"data":39510,"marks":39511,"value":37915,"nodeType":865},{},[39512],{"type":874},{"data":39514,"marks":39515,"value":21,"nodeType":865},{},[],{"data":39517,"content":39520,"nodeType":890},{"target":39518},{"sys":39519},{"id":37923,"type":887,"linkType":888},[],{"data":39522,"content":39525,"nodeType":890},{"target":39523},{"sys":39524},{"id":37929,"type":887,"linkType":888},[],{"data":39527,"content":39528,"nodeType":894},{},[],{"data":39530,"content":39531,"nodeType":904},{},[39532],{"data":39533,"marks":39534,"value":29766,"nodeType":865},{},[39535],{"type":902},{"data":39537,"content":39538,"nodeType":881},{},[39539],{"data":39540,"marks":39541,"value":37947,"nodeType":865},{},[],{"data":39543,"content":39544,"nodeType":881},{},[39545,39548,39555],{"data":39546,"marks":39547,"value":31701,"nodeType":865},{},[],{"data":39549,"content":39550,"nodeType":876},{"uri":37956},[39551],{"data":39552,"marks":39553,"value":4495,"nodeType":865},{},[39554],{"type":874},{"data":39556,"marks":39557,"value":959,"nodeType":865},{},[],{"data":39559,"content":39562,"nodeType":890},{"target":39560},{"sys":39561},{"id":37969,"type":887,"linkType":888},[],{"data":39564,"content":39565,"nodeType":881},{},[39566],{"data":39567,"marks":39568,"value":21,"nodeType":865},{},[],{"items":39570},[39571,39573],{"sys":39572,"name":342},{"id":4510},{"sys":39574,"name":4507},{"id":4506},{"items":39576},[39577],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":39578},{"url":5377},{"__typename":1485,"sys":39580,"content":39582,"title":40019,"synopsis":40020,"hashTags":59,"publishedDate":40021,"slug":40022,"tagsCollection":40023,"authorsCollection":40029},{"id":39581},"3uLWz59In1waXGcLB9cnPq",{"json":39583},{"data":39584,"content":39585,"nodeType":1463},{},[39586,39615,39635,39642,39649,39652,39660,39667,39673,39679,39685,39692,39712,39718,39721,39729,39736,39743,39750,39756,39763,39770,39776,39783,39803,39809,39816,39819,39827,39834,39840,39847,39892,39898,39905,39908,39916,39923,39930,39936,39941,39947,39950,39958,39965,39971,39978,39985,39988,39995,40001],{"data":39587,"content":39588,"nodeType":881},{},[39589,39592,39599,39603,39611],{"data":39590,"marks":39591,"value":21,"nodeType":865},{},[],{"data":39593,"content":39594,"nodeType":876},{"uri":18095},[39595],{"data":39596,"marks":39597,"value":24657,"nodeType":865},{},[39598],{"type":874},{"data":39600,"marks":39601,"value":39602,"nodeType":865},{},[]," was one of the first techniques we added to the ",{"data":39604,"content":39606,"nodeType":876},{"uri":39605},"https://github.com/pushsecurity/saas-attacks?tab=readme-ov-file",[39607],{"data":39608,"marks":39609,"value":32109,"nodeType":865},{},[39610],{"type":874},{"data":39612,"marks":39613,"value":39614,"nodeType":865},{},[],", where attackers trick users into authorizing malicious OAuth apps. ",{"data":39616,"content":39617,"nodeType":881},{},[39618,39622,39631],{"data":39619,"marks":39620,"value":39621,"nodeType":865},{},[],"The attacker sends a phishing link to a target that requests permissions to access sensitive data or permissions to perform dangerous actions for an app the victim is using. If the target grants consent for the permissions, the adversary gains that level of access over the target’s account — and certain data and functionality ",{"data":39623,"content":39625,"nodeType":876},{"uri":39624},"https://pushsecurity.com/blog/the-risky-terrain-of-oauth-scopes-in-third-party/",[39626],{"data":39627,"marks":39628,"value":39630,"nodeType":865},{},[39629],{"type":874},"depending on the scopes granted",{"data":39632,"marks":39633,"value":39634,"nodeType":865},{},[],". This attack bypasses MFA entirely (including phishing-resistant MFA) by sidestepping the login process — think of it as an authorization attack, as opposed to an authentication one. Naturally, this means it also persists through typical authentication changes like a password reset. ",{"data":39636,"content":39637,"nodeType":881},{},[39638],{"data":39639,"marks":39640,"value":39641,"nodeType":865},{},[],"Consent phishing has been primarily aimed at getting access to larger cloud platforms like Microsoft Azure or Google Workspace tenants, or more complex apps like GitHub. These apps present an obvious opportunity to attackers in terms of the functionality and and data they contain.  ",{"data":39643,"content":39644,"nodeType":881},{},[39645],{"data":39646,"marks":39647,"value":39648,"nodeType":865},{},[],"Two separate cases of consent phishing have hit the headlines this month representing very different use cases — let’s compare them. ",{"data":39650,"content":39651,"nodeType":894},{},[],{"data":39653,"content":39654,"nodeType":904},{},[39655],{"data":39656,"marks":39657,"value":39659,"nodeType":865},{},[39658],{"type":902},"1. Classic consent phishing",{"data":39661,"content":39662,"nodeType":881},{},[39663],{"data":39664,"marks":39665,"value":39666,"nodeType":865},{},[],"Attackers targeted GitHub users across 12,000 repositories by creating fake security alert issues in GitHub repositories. These legit-looking alerts send the victim to a GitHub authorization page for a \"gitsecurityapp\" OAuth app that requests a lot of very risky scopes granting full access to a user's account and repositories.",{"data":39668,"content":39672,"nodeType":890},{"target":39669},{"sys":39670},{"id":39671,"type":887,"linkType":888},"7s7VLePAQzhzXJ6cFkSCAe",[],{"data":39674,"content":39678,"nodeType":890},{"target":39675},{"sys":39676},{"id":39677,"type":887,"linkType":888},"5dppSzNOgffeZTZK2lG6V5",[],{"data":39680,"content":39684,"nodeType":890},{"target":39681},{"sys":39682},{"id":39683,"type":887,"linkType":888},"1dsYU7bM5mPW1AXyRLnqpp",[],{"data":39686,"content":39687,"nodeType":881},{},[39688],{"data":39689,"marks":39690,"value":39691,"nodeType":865},{},[],"Once authorized, the attacker has extensive access to the account, from which point they can modify repositories to conduct further attacks against users (e.g. by infecting them with malware), poison the repos and services connected to the repository, and exfiltrate any sensitive data the account has access to. ",{"data":39693,"content":39694,"nodeType":881},{},[39695,39699,39708],{"data":39696,"marks":39697,"value":39698,"nodeType":865},{},[],"Alongside consent phishing, this is an example of ",{"data":39700,"content":39702,"nodeType":876},{"uri":39701},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/in-app_phishing/description.md",[39703],{"data":39704,"marks":39705,"value":39707,"nodeType":865},{},[39706],{"type":874},"in-app phishing",{"data":39709,"marks":39710,"value":39711,"nodeType":865},{},[],", which avoids delivering the message via corporate email. Even if the target gets an email notification, the phish isn’t delivered via email directly, and so email-based scanning solutions won’t detect it — they’ll receive a legitimate notification email directly from GitHub. It’s also less likely to raise suspicion as GitHub issue notifications are expected, increasing the click chance. ",{"data":39713,"content":39717,"nodeType":890},{"target":39714},{"sys":39715},{"id":39716,"type":887,"linkType":888},"6d6MMyPQ7vaY2KrJTHGeO6",[],{"data":39719,"content":39720,"nodeType":894},{},[],{"data":39722,"content":39723,"nodeType":904},{},[39724],{"data":39725,"marks":39726,"value":39728,"nodeType":865},{},[39727],{"type":902},"2. Not really consent phishing?",{"data":39730,"content":39731,"nodeType":881},{},[39732],{"data":39733,"marks":39734,"value":39735,"nodeType":865},{},[],"This example is much more unusual. In this case, the attacker used malicious Microsoft OAuth apps impersonating Adobe and DocuSign. ",{"data":39737,"content":39738,"nodeType":881},{},[39739],{"data":39740,"marks":39741,"value":39742,"nodeType":865},{},[],"Rather than trying to grab lots of juicy permissions for Microsoft, the attacker used consent phishing to prevent automated analysis of their phishing page by security tools. To be served the real phishing page, you need to first authorize the fake OAuth app — meaning that security tools and bots won’t be able to reach the page to determine if it’s malicious or not. ",{"data":39744,"content":39745,"nodeType":881},{},[39746],{"data":39747,"marks":39748,"value":39749,"nodeType":865},{},[],"The attack started with attackers sending phishing emails to target users with a fake password reset lure. ",{"data":39751,"content":39755,"nodeType":890},{"target":39752},{"sys":39753},{"id":39754,"type":887,"linkType":888},"3cLd6EbraN9fKuGgL0kkgC",[],{"data":39757,"content":39758,"nodeType":881},{},[39759],{"data":39760,"marks":39761,"value":39762,"nodeType":865},{},[],"Because the initial phishing link directs to the legitimate login.microsoftonline.com URL, it appears legitimate and bypasses common domain-based security checks. ",{"data":39764,"content":39765,"nodeType":881},{},[39766],{"data":39767,"marks":39768,"value":39769,"nodeType":865},{},[],"After clicking the link, the user signs into their real Microsoft account (this might even happen automatically if the user is already signed in on the device/browser they’re using). They are then redirected to a permissions request page for the fake OAuth app. ",{"data":39771,"content":39775,"nodeType":890},{"target":39772},{"sys":39773},{"id":39774,"type":887,"linkType":888},"6O4CSx1VCoPAIjjsnKzu75",[],{"data":39777,"content":39778,"nodeType":881},{},[39779],{"data":39780,"marks":39781,"value":39782,"nodeType":865},{},[],"The permissions requested by the app (profile, email, openid) are so limited as to be basically unexploitable. They are also the same permissions you would accept if you were authorizing Microsoft to perform a social login (SSO via OIDC) to a third party app.",{"data":39784,"content":39785,"nodeType":881},{},[39786,39790,39799],{"data":39787,"marks":39788,"value":39789,"nodeType":865},{},[],"Clicking the link redirects the victim to the malicious page but masks it using the legit Cloudflare Turnstile service. As well as making the page look more credible (since its fronted by a legit service to block bots) this is a common detection evasion technique we’ve ",{"data":39791,"content":39793,"nodeType":876},{"uri":39792},"https://pushsecurity.com/blog/how-aitm-phishing-kits-evade-detection/",[39794],{"data":39795,"marks":39796,"value":39798,"nodeType":865},{},[39797],{"type":874},"blogged about previously",{"data":39800,"marks":39801,"value":39802,"nodeType":865},{},[]," which prevents security solutions from accessing and analysing the malicious page. ",{"data":39804,"content":39808,"nodeType":890},{"target":39805},{"sys":39806},{"id":39807,"type":887,"linkType":888},"7csybR6fJlCWsRy91CbNYL",[],{"data":39810,"content":39811,"nodeType":881},{},[39812],{"data":39813,"marks":39814,"value":39815,"nodeType":865},{},[],"After completing the verification, the page (and the malicious phishing kit element) is finally loaded. If the victim authenticates, the session will be stolen by the attacker, along with the captured credentials and MFA code. ",{"data":39817,"content":39818,"nodeType":894},{},[],{"data":39820,"content":39821,"nodeType":904},{},[39822],{"data":39823,"marks":39824,"value":39826,"nodeType":865},{},[39825],{"type":902},"Using consent phishing to evade detection",{"data":39828,"content":39829,"nodeType":881},{},[39830],{"data":39831,"marks":39832,"value":39833,"nodeType":865},{},[],"The attacker is essentially using their fake OAuth app to prevent security analysts and bots from analysing the real phishing page, because the first page loaded is a link to a legitimate Microsoft domain. They’re also layering it with a range of other detection evasion techniques like using Cloudflare Turnstile.  ",{"data":39835,"content":39839,"nodeType":890},{"target":39836},{"sys":39837},{"id":39838,"type":887,"linkType":888},"4Bi9YoMwWVmKoWfkh5tiTA",[],{"data":39841,"content":39842,"nodeType":881},{},[39843],{"data":39844,"marks":39845,"value":39846,"nodeType":865},{},[],"We’ve previously blogged about how attackers are using layered detection evasion techniques to circumvent typical phishing page detections, which are often email-based, including:",{"data":39848,"content":39849,"nodeType":1818},{},[39850,39871],{"data":39851,"content":39852,"nodeType":1734},{},[39853],{"data":39854,"content":39855,"nodeType":881},{},[39856,39859,39867],{"data":39857,"marks":39858,"value":21,"nodeType":865},{},[],{"data":39860,"content":39861,"nodeType":876},{"uri":39792},[39862],{"data":39863,"marks":39864,"value":39866,"nodeType":865},{},[39865],{"type":874},"Prevent analysis of phishing pages",{"data":39868,"marks":39869,"value":39870,"nodeType":865},{},[]," by security bots, including using legitimate services like Cloudflare Workers and Turnstile (as above), CAPTCHA, and various sandbox-aware techniques to ensure only the intended victim is served the phishing page, such as only providing the correct parameters to load the page if the correct path is followed (rather than attempting to load the malicious page by going directly to the domain). ",{"data":39872,"content":39873,"nodeType":1734},{},[39874],{"data":39875,"content":39876,"nodeType":881},{},[39877,39880,39888],{"data":39878,"marks":39879,"value":21,"nodeType":865},{},[],{"data":39881,"content":39882,"nodeType":876},{"uri":37381},[39883],{"data":39884,"marks":39885,"value":39887,"nodeType":865},{},[39886],{"type":874},"DOM and visual obfuscation",{"data":39889,"marks":39890,"value":39891,"nodeType":865},{},[]," of phishing pages when the victim does land on the page to prevent it from being identified as malicious through signature-based detection of page elements. ",{"data":39893,"content":39897,"nodeType":890},{"target":39894},{"sys":39895},{"id":39896,"type":887,"linkType":888},"2dN8np5odBecf7r1vBr69K",[],{"data":39899,"content":39900,"nodeType":881},{},[39901],{"data":39902,"marks":39903,"value":39904,"nodeType":865},{},[],"This seems a bit overkill and many of the steps here are likely to raise suspicion — like the fact that you’re never asked to provide the original code for the password reset, and are asked to unexpectedly consent to an OAuth app. But clearly, the attacker is more concerned about bypassing technical safeguards than human ones (not a great endorsement for the state of phishing awareness training). ",{"data":39906,"content":39907,"nodeType":894},{},[],{"data":39909,"content":39910,"nodeType":904},{},[39911],{"data":39912,"marks":39913,"value":39915,"nodeType":865},{},[39914],{"type":902},"How Push detects and blocks phishing attacks",{"data":39917,"content":39918,"nodeType":881},{},[39919],{"data":39920,"marks":39921,"value":39922,"nodeType":865},{},[],"Push overcomes the various detection evasion techniques shown here by using in-browser detections based on the phishing page that the user sees. This means that no matter where the user accesses the link from (email, IM platform, social media, or anywhere else on the internet) Push can observe and analyse the page to determine if it's malicious. ",{"data":39924,"content":39925,"nodeType":881},{},[39926],{"data":39927,"marks":39928,"value":39929,"nodeType":865},{},[],"Push uses layered detections based on identifying the phishing kit running on the page itself, whether the page is cloned from a legitimate login page, as well as detecting whether the credentials being entered on the page have been used to log into your SSO account previously. ",{"data":39931,"content":39935,"nodeType":890},{"target":39932},{"sys":39933},{"id":39934,"type":887,"linkType":888},"6B1toQAf44rDzQZijYRd9g",[],{"data":39937,"content":39940,"nodeType":890},{"target":39938},{"sys":39939},{"id":37923,"type":887,"linkType":888},[],{"data":39942,"content":39946,"nodeType":890},{"target":39943},{"sys":39944},{"id":39945,"type":887,"linkType":888},"01musWa3FUiO0CVFNWfwcy",[],{"data":39948,"content":39949,"nodeType":894},{},[],{"data":39951,"content":39952,"nodeType":904},{},[39953],{"data":39954,"marks":39955,"value":39957,"nodeType":865},{},[39956],{"type":902},"Using Push to review OAuth integrations",{"data":39959,"content":39960,"nodeType":881},{},[39961],{"data":39962,"marks":39963,"value":39964,"nodeType":865},{},[],"You can also use Push to discover and remove risky OAuth integrations accepted by your users. ",{"data":39966,"content":39970,"nodeType":890},{"target":39967},{"sys":39968},{"id":39969,"type":887,"linkType":888},"5kJvy5SBcWLrK2EhLyR1ZD",[],{"data":39972,"content":39973,"nodeType":881},{},[39974],{"data":39975,"marks":39976,"value":39977,"nodeType":865},{},[],"This shows which OAuth apps have been added, which apps they are integrated with, what permissions they’ve been granted, as well as other properties that indicate risk (e.g. whether the app’s publisher has been verified). ",{"data":39979,"content":39980,"nodeType":881},{},[39981],{"data":39982,"marks":39983,"value":39984,"nodeType":865},{},[],"If your users are consent phished, you’ll be notified via webhook event that a new integration has been added. These risky integrations can be removed via the Push platform by clicking ‘delete integration’. ",{"data":39986,"content":39987,"nodeType":894},{},[],{"data":39989,"content":39990,"nodeType":904},{},[39991],{"data":39992,"marks":39993,"value":38962,"nodeType":865},{},[39994],{"type":902},{"data":39996,"content":39997,"nodeType":881},{},[39998],{"data":39999,"marks":40000,"value":37947,"nodeType":865},{},[],{"data":40002,"content":40003,"nodeType":881},{},[40004,40007,40015],{"data":40005,"marks":40006,"value":31701,"nodeType":865},{},[],{"data":40008,"content":40010,"nodeType":876},{"uri":40009},"https://pushsecurity.com/demo?utm_campaign=9983377-FY25Q1_Bleeping-Computer-Organic-Article&utm_source=bleepingcomputer&utm_medium=sponsored-content&utm_content=organic%20article",[40011],{"data":40012,"marks":40013,"value":38977,"nodeType":865},{},[40014],{"type":874},{"data":40016,"marks":40017,"value":40018,"nodeType":865},{},[]," for a live demo.","How consent phishing is evolving to defeat detection controls","Consent phishing is where attackers trick users into authorizing access for malicious OAuth apps. Here's how attackers are using this technique in the wild.","2025-03-31T00:00:00.000Z","how-consent-phishing-is-evolving",{"items":40024},[40025,40027],{"sys":40026,"name":4507},{"id":4506},{"sys":40028,"name":342},{"id":4510},{"items":40030},[40031],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":40032},{"url":5377},"blog/app-specific-password-phishing",{"json":40035},{"data":40036,"content":40037,"nodeType":1463},{},[40038],{"data":40039,"content":40040,"nodeType":881},{},[40041],{"data":40042,"marks":40043,"value":40044,"nodeType":865},{},[],"Attackers in the wild have been observed using advanced social engineering tactics to convince victims to create and share App-Specific Passwords, representing the latest in phishing tactics capable of sidestepping otherwise phishing-resistant login methods, and bypassing MFA checks. ",{"id":36100,"publishedAt":40046},"2026-08-12T11:54:05.231Z",{"items":40048},[40049,40051],{"sys":40050,"name":4507},{"id":4506},{"sys":40052,"name":342},{"id":4510},{"items":40054},[40055,40057,40059,40061,40063,40065,40067,40069,40071,40073,40075,40077],{"sys":40056,"name":279,"slug":280,"tier":31},{"id":276},{"sys":40058,"name":519,"slug":520,"tier":31},{"id":516},{"sys":40060,"name":413,"slug":414,"tier":31},{"id":410},{"sys":40062,"name":342,"slug":343,"tier":31},{"id":339},{"sys":40064,"name":466,"slug":467,"tier":45},{"id":463},{"sys":40066,"name":324,"slug":325,"tier":45},{"id":321},{"sys":40068,"name":493,"slug":494,"tier":45},{"id":490},{"sys":40070,"name":607,"slug":608,"tier":45},{"id":604},{"sys":40072,"name":484,"slug":485,"tier":45},{"id":481},{"sys":40074,"name":360,"slug":361,"tier":45},{"id":357},{"sys":40076,"name":395,"slug":396,"tier":45},{"id":392},{"sys":40078,"name":404,"slug":405,"tier":45},{"id":401},"yRb4iizavauRegTYOxqqBEmetZps4T2uiwq65xrITDk",{"id":40081,"title":40082,"authorsCollection":40083,"content":40088,"extension":228,"faqItemsCollection":40967,"faqTitle":59,"featured":6,"hashTags":59,"meta":40969,"metaTitle":40970,"ogImage":40971,"postType":40972,"publishedDate":40973,"relatedBlogPostsCollection":40974,"slug":42287,"stem":42288,"subtitle":59,"summary":42289,"synopsis":42300,"sys":42301,"tagsCollection":42304,"topicsCollection":42310,"__hash__":42350},"blog/blog/dissecting-a-recent-mailchimp-phishing-attack.json","Dissecting a recent MailChimp phishing attack",{"items":40084},[40085],{"fullName":5373,"firstName":5374,"jobTitle":5375,"socialLinks":40086,"profilePicture":40087},[6440],{"url":5377},{"json":40089,"links":40849},{"data":40090,"content":40091,"nodeType":1463},{},[40092,40099,40132,40139,40158,40165,40168,40175,40182,40188,40195,40201,40207,40214,40231,40237,40244,40247,40255,40274,40297,40304,40312,40319,40326,40332,40340,40359,40378,40384,40391,40397,40405,40437,40443,40450,40453,40461,40468,40488,40495,40501,40509,40516,40523,40530,40537,40605,40612,40620,40639,40645,40652,40659,40665,40672,40678,40686,40693,40699,40705,40712,40715,40722,40752,40759,40778,40785,40796,40803,40806,40813,40832],{"data":40093,"content":40094,"nodeType":881},{},[40095],{"data":40096,"marks":40097,"value":40098,"nodeType":865},{},[],"Phishing attacks using Attacker-in-the-Middle (AitM) kits are increasingly the default for both credential harvesting campaigns and targeted phishing attacks. It’s easy to see why, too:",{"data":40100,"content":40101,"nodeType":1818},{},[40102,40112,40122],{"data":40103,"content":40104,"nodeType":1734},{},[40105],{"data":40106,"content":40107,"nodeType":881},{},[40108],{"data":40109,"marks":40110,"value":40111,"nodeType":865},{},[],"They’re very difficult to spot as a user and often function like the real page should, logging the victim into the genuine site once the phish is complete",{"data":40113,"content":40114,"nodeType":1734},{},[40115],{"data":40116,"content":40117,"nodeType":881},{},[40118],{"data":40119,"marks":40120,"value":40121,"nodeType":865},{},[],"They’re incredibly scalable, and attackers have an increasing number of options to choose from when it comes to off-the-shelf tools and commercial Phishing-as-a-Service offerings ",{"data":40123,"content":40124,"nodeType":1734},{},[40125],{"data":40126,"content":40127,"nodeType":881},{},[40128],{"data":40129,"marks":40130,"value":40131,"nodeType":865},{},[],"And most importantly, they reliably bypass 99% of the MFA methods encountered in the wild, defeating OTP, SMS and push-based authentication",{"data":40133,"content":40134,"nodeType":881},{},[40135],{"data":40136,"marks":40137,"value":40138,"nodeType":865},{},[],"There are basically no downsides to AitM for an attacker. But all the same, they don’t get all that much publicity — probably because traditional phishing prevention solutions are failing to detect them (before the attack succeeds, anyway — and nobody really wants to own up to that). ",{"data":40140,"content":40141,"nodeType":881},{},[40142,40146,40155],{"data":40143,"marks":40144,"value":40145,"nodeType":865},{},[],"So, it’s refreshing to see Troy Hunt, creator of the widely used Have I Been Pwned (HIBP) service, ",{"data":40147,"content":40149,"nodeType":876},{"uri":40148},"https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/",[40150],{"data":40151,"marks":40152,"value":40154,"nodeType":865},{},[40153],{"type":874},"publicly discussing a recent attack he fell victim to",{"data":40156,"marks":40157,"value":1032,"nodeType":865},{},[],{"data":40159,"content":40160,"nodeType":881},{},[40161],{"data":40162,"marks":40163,"value":40164,"nodeType":865},{},[],"Before we consider the significance of Troy failing to spot the phish — the creator of one of the most widely used services for stolen passwords, working with government on phishing prevention guidance — let's start by breaking down the attack itself. ",{"data":40166,"content":40167,"nodeType":894},{},[],{"data":40169,"content":40170,"nodeType":904},{},[40171],{"data":40172,"marks":40173,"value":18964,"nodeType":865},{},[40174],{"type":902},{"data":40176,"content":40177,"nodeType":881},{},[40178],{"data":40179,"marks":40180,"value":40181,"nodeType":865},{},[],"Troy received a phishing email appearing to be from MailChimp prompting him to sign into his account, with the lure informing him it had had been restricted due to a spam complaint",{"data":40183,"content":40187,"nodeType":890},{"target":40184},{"sys":40185},{"id":40186,"type":887,"linkType":888},"5A4CPvTyKhClC8LgHY5916",[],{"data":40189,"content":40190,"nodeType":881},{},[40191],{"data":40192,"marks":40193,"value":40194,"nodeType":865},{},[],"The email matched Mailchimp’s brand, but the sender address was obviously suspicious. Unfortunately, Troy initially accessed the email via mobile, which hid the sender address — which he then missed when accessing from his PC. ",{"data":40196,"content":40200,"nodeType":890},{"target":40197},{"sys":40198},{"id":40199,"type":887,"linkType":888},"1JWw4jO3qxxJeHO3qtMuZc",[],{"data":40202,"content":40206,"nodeType":890},{"target":40203},{"sys":40204},{"id":40205,"type":887,"linkType":888},"1ebM2R90arTKlCmxmtvYjz",[],{"data":40208,"content":40209,"nodeType":881},{},[40210],{"data":40211,"marks":40212,"value":40213,"nodeType":865},{},[],"Troy was directed to the page hxxps://mailchimp-sso.com. Troy entered his credentials and MFA token and logged in. The page hung and he realized he had been phished…",{"data":40215,"content":40216,"nodeType":881},{},[40217,40221,40228],{"data":40218,"marks":40219,"value":40220,"nodeType":865},{},[],"The attack then automatically executed, with the attacker exporting 16,000 contact records from MailChimp and creating an API key to provide backdoor access to the app (a form of ",{"data":40222,"content":40223,"nodeType":876},{"uri":11116},[40224],{"data":40225,"marks":40226,"value":16930,"nodeType":865},{},[40227],{"type":874},{"data":40229,"marks":40230,"value":30302,"nodeType":865},{},[],{"data":40232,"content":40236,"nodeType":890},{"target":40233},{"sys":40234},{"id":40235,"type":887,"linkType":888},"2MDWfQFU69GaiMCxdvvq8U",[],{"data":40238,"content":40239,"nodeType":881},{},[40240],{"data":40241,"marks":40242,"value":40243,"nodeType":865},{},[],"Let’s have a look at what makes this attack interesting. ",{"data":40245,"content":40246,"nodeType":894},{},[],{"data":40248,"content":40249,"nodeType":904},{},[40250],{"data":40251,"marks":40252,"value":40254,"nodeType":865},{},[40253],{"type":902},"Breaking the attack down",{"data":40256,"content":40257,"nodeType":881},{},[40258,40262,40270],{"data":40259,"marks":40260,"value":40261,"nodeType":865},{},[],"As far as ",{"data":40263,"content":40264,"nodeType":876},{"uri":37381},[40265],{"data":40266,"marks":40267,"value":40269,"nodeType":865},{},[40268],{"type":874},"some of the AitM attacks we’ve observed in the wild",{"data":40271,"marks":40272,"value":40273,"nodeType":865},{},[]," go, this wasn’t the most advanced example we’ve seen: ",{"data":40275,"content":40276,"nodeType":1818},{},[40277,40287],{"data":40278,"content":40279,"nodeType":1734},{},[40280],{"data":40281,"content":40282,"nodeType":881},{},[40283],{"data":40284,"marks":40285,"value":40286,"nodeType":865},{},[],"It didn’t try to obfuscate the notably suspicious sender address or use a legit SaaS service to give the email sender a reputable domain.",{"data":40288,"content":40289,"nodeType":1734},{},[40290],{"data":40291,"content":40292,"nodeType":881},{},[40293],{"data":40294,"marks":40295,"value":40296,"nodeType":865},{},[],"It didn’t see the victim access the real login page, and instead terminated the connection at the point the credentials were captured — meaning Troy was immediately suspicious (I guess it doesn’t really matter given the attack executed instantly, automatically).",{"data":40298,"content":40299,"nodeType":881},{},[40300],{"data":40301,"marks":40302,"value":40303,"nodeType":865},{},[],"That said, it did use a few interesting tricks and techniques. ",{"data":40305,"content":40306,"nodeType":1860},{},[40307],{"data":40308,"marks":40309,"value":40311,"nodeType":865},{},[40310],{"type":902},"Enumerating suitable victims",{"data":40313,"content":40314,"nodeType":881},{},[40315],{"data":40316,"marks":40317,"value":40318,"nodeType":865},{},[],"It’s notable that Troy claims the email he used to access MailChimp wasn’t used anywhere else — meaning the attacker probably guessed it. The domain is partially obscured here but it's likely that this is Troy’s own personal domain. It isn’t too much of a stretch to imagine that organizations frequently set up dedicated email addresses for their MailChimp accounts or newsletters generally (e.g. mailchimp@exampledomain.com). ",{"data":40320,"content":40321,"nodeType":881},{},[40322],{"data":40323,"marks":40324,"value":40325,"nodeType":865},{},[],"Undeniably, Troy’s MailChimp account is probably more of a target than most given the success of his newsletter, but it’s still likely that the attacker spammed many possible address and domain combinations to see what stuck. There’s a degree of luck, but also some smart guesswork at play here. ",{"data":40327,"content":40331,"nodeType":890},{"target":40328},{"sys":40329},{"id":40330,"type":887,"linkType":888},"5TgXthj5tsvWX87QHZH1WQ",[],{"data":40333,"content":40334,"nodeType":1860},{},[40335],{"data":40336,"marks":40337,"value":40339,"nodeType":865},{},[40338],{"type":902},"Using legit services like Cloudflare to defeat detections ",{"data":40341,"content":40342,"nodeType":881},{},[40343,40347,40355],{"data":40344,"marks":40345,"value":40346,"nodeType":865},{},[],"The attacker used Cloudflare to host the domain, which is ",{"data":40348,"content":40349,"nodeType":876},{"uri":39792},[40350],{"data":40351,"marks":40352,"value":40354,"nodeType":865},{},[40353],{"type":874},"consistent with what we’ve observed attackers doing in the wild",{"data":40356,"marks":40357,"value":40358,"nodeType":865},{},[],". Even if this means that Cloudflare will probably take the domain down eventually, they aren’t great at identifying the page right away. Given the rate at which attacker infrastructure is burned and rotated, the pros outweigh the cons for the attacker by giving the site legitimate hosting infrastructure, which can defeat some of the common checks performed by anti-phishing tools.",{"data":40360,"content":40361,"nodeType":881},{},[40362,40366,40374],{"data":40363,"marks":40364,"value":40365,"nodeType":865},{},[],"Troy also mentions seeing a 'Cloudflare anti-automation widget' when accessing the page, which is most likely Cloudflare Turnstile — a creative alternative to CAPTCHA to prevent security bots from accessing and loading malicious pages to analyse them. We've seen attackers use Turnstile ",{"data":40367,"content":40368,"nodeType":876},{"uri":39792},[40369],{"data":40370,"marks":40371,"value":40373,"nodeType":865},{},[40372],{"type":874},"along with a host of other obfuscation techniques",{"data":40375,"marks":40376,"value":40377,"nodeType":865},{},[]," to defeat common detections by preventing security tools from analysing the malicious page. ",{"data":40379,"content":40383,"nodeType":890},{"target":40380},{"sys":40381},{"id":40382,"type":887,"linkType":888},"2X1r1qbE5CVcJ0xVcESGK7",[],{"data":40385,"content":40386,"nodeType":881},{},[40387],{"data":40388,"marks":40389,"value":40390,"nodeType":865},{},[],"Although this page has now been taken down, the campaign undoubtedly continues — another will have been rotated in to take its place. ",{"data":40392,"content":40396,"nodeType":890},{"target":40393},{"sys":40394},{"id":40395,"type":887,"linkType":888},"26wnNFTED2f6O1HtqL3Cgu",[],{"data":40398,"content":40399,"nodeType":1860},{},[40400],{"data":40401,"marks":40402,"value":40404,"nodeType":865},{},[40403],{"type":902},"Configuring ghost logins via API keys to backdoor the account ",{"data":40406,"content":40407,"nodeType":881},{},[40408,40412,40421,40425,40433],{"data":40409,"marks":40410,"value":40411,"nodeType":865},{},[],"The attacker also configured an API key — a smart way to backdoor an app and something we’ve previously ",{"data":40413,"content":40415,"nodeType":876},{"uri":40414},"https://pushsecurity.com/resources/phishing-detecting-evilginx-evilnovnc-muraena-and-modlishka",[40416],{"data":40417,"marks":40418,"value":40420,"nodeType":865},{},[40419],{"type":874},"demonstrated in our webinars",{"data":40422,"marks":40423,"value":40424,"nodeType":865},{},[]," as a ",{"data":40426,"content":40427,"nodeType":876},{"uri":5192},[40428],{"data":40429,"marks":40430,"value":40432,"nodeType":865},{},[40431],{"type":874},"SaaS-native attack technique",{"data":40434,"marks":40435,"value":40436,"nodeType":865},{},[]," for persistence. It means that even if the credentials are changed, the attacker can maintain access to the account.",{"data":40438,"content":40442,"nodeType":890},{"target":40439},{"sys":40440},{"id":40441,"type":887,"linkType":888},"35GkKL1rXnWHNZa1EBHLyD",[],{"data":40444,"content":40445,"nodeType":881},{},[40446],{"data":40447,"marks":40448,"value":40449,"nodeType":865},{},[],"Now, as a security pro, Troy noticed this and deleted it — but many less technical victims wouldn’t know to do this. It’s also not unusual for automated emails from applications to go to spam — meaning some victims potentially wouldn’t spot the notification sent to them. ",{"data":40451,"content":40452,"nodeType":894},{},[],{"data":40454,"content":40455,"nodeType":904},{},[40456],{"data":40457,"marks":40458,"value":40460,"nodeType":865},{},[40459],{"type":902},"But — why MailChimp? ",{"data":40462,"content":40463,"nodeType":881},{},[40464],{"data":40465,"marks":40466,"value":40467,"nodeType":865},{},[],"This was the big question we asked ourselves when looking into this attack. Most phishing attacks targeting businesses tend to focus on core platforms like Microsoft, Google Workspace, etc. — usually Identity Providers (IdPs) that provide both access to email and downstream apps via SSO. It’s the biggest bang for their buck and most tooling is preconfigured to support these platforms. So MailChimp seems an unusual choice at first glance. ",{"data":40469,"content":40470,"nodeType":881},{},[40471,40475,40484],{"data":40472,"marks":40473,"value":40474,"nodeType":865},{},[],"But, we’ve seen recently that it's getting easier for attackers to ",{"data":40476,"content":40478,"nodeType":876},{"uri":40477},"https://www.bleepingcomputer.com/news/security/darcula-phaas-can-now-auto-generate-phishing-kits-for-any-brand/",[40479],{"data":40480,"marks":40481,"value":40483,"nodeType":865},{},[40482],{"type":874},"impersonate a broader range of brands",{"data":40485,"marks":40486,"value":40487,"nodeType":865},{},[],". And there’s something to be said for targeting an app like MailChimp — your guard is naturally probably lower than it would be for a Microsoft-based phish, increasing the chance of success. ",{"data":40489,"content":40490,"nodeType":881},{},[40491],{"data":40492,"marks":40493,"value":40494,"nodeType":865},{},[],"But what’s the payout? The data collected doesn’t seem to be overly valuable — 16k records including email address, IP, and rough geolocation data. Not particularly exploitable by itself…",{"data":40496,"content":40500,"nodeType":890},{"target":40497},{"sys":40498},{"id":40499,"type":887,"linkType":888},"OjZtHXit6WO6Zd9tCUYpJ",[],{"data":40502,"content":40503,"nodeType":1860},{},[40504],{"data":40505,"marks":40506,"value":40508,"nodeType":865},{},[40507],{"type":902},"Part of a multi stage attack? ",{"data":40510,"content":40511,"nodeType":881},{},[40512],{"data":40513,"marks":40514,"value":40515,"nodeType":865},{},[],"This gets a lot more interesting when you consider the different things an attacker might do as part of a broader campaign. ",{"data":40517,"content":40518,"nodeType":881},{},[40519],{"data":40520,"marks":40521,"value":40522,"nodeType":865},{},[],"With access to MailChimp, an attacker can send emails on behalf of the compromised account. These emails are highly trusted and expected from the sender, meaning people receiving them are much more likely to engage with the content, click the links, etc. ",{"data":40524,"content":40525,"nodeType":881},{},[40526],{"data":40527,"marks":40528,"value":40529,"nodeType":865},{},[],"So what if an attacker compromised an account, inserted a load of malicious links into the newsletter, and used it in itself as a mass-phishing vector, designed to capture user credentials or deliver malware? Pretty devious! If you scale this up across multiple victims (and not all of them realize that they’ve been phished) you’ve suddenly got your hands on an incredibly valuable phishing vector that is much more likely to succeed than your average cold approach. ",{"data":40531,"content":40532,"nodeType":881},{},[40533],{"data":40534,"marks":40535,"value":40536,"nodeType":865},{},[],"Then, with the additional victims, you could target accounts that are much more inherently valuable to an attacker. You could:",{"data":40538,"content":40539,"nodeType":1818},{},[40540,40572,40595],{"data":40541,"content":40542,"nodeType":1734},{},[40543],{"data":40544,"content":40545,"nodeType":881},{},[40546,40550,40557,40561,40568],{"data":40547,"marks":40548,"value":40549,"nodeType":865},{},[],"Deploy infostealer malware, which has dominated the headlines since the success of the ",{"data":40551,"content":40552,"nodeType":876},{"uri":11103},[40553],{"data":40554,"marks":40555,"value":30085,"nodeType":865},{},[40556],{"type":874},{"data":40558,"marks":40559,"value":40560,"nodeType":865},{},[]," attacks last year, and are continually resulting in data breaches via attackers logging into apps using stolen credentials such as the recent attacks on ",{"data":40562,"content":40563,"nodeType":876},{"uri":5836},[40564],{"data":40565,"marks":40566,"value":34961,"nodeType":865},{},[40567],{"type":874},{"data":40569,"marks":40570,"value":40571,"nodeType":865},{},[]," platforms.",{"data":40573,"content":40574,"nodeType":1734},{},[40575],{"data":40576,"content":40577,"nodeType":881},{},[40578,40582,40591],{"data":40579,"marks":40580,"value":40581,"nodeType":865},{},[],"Target personal apps for banking, email, e-com, and other easily monetizable services — which is increasingly easy to do at-scale using ",{"data":40583,"content":40585,"nodeType":876},{"uri":40584},"https://www.bleepingcomputer.com/news/security/new-atlantis-aio-automates-credential-stuffing-on-140-services/",[40586],{"data":40587,"marks":40588,"value":40590,"nodeType":865},{},[40589],{"type":874},"tooling for hire",{"data":40592,"marks":40593,"value":40594,"nodeType":865},{},[]," with stolen credentials.",{"data":40596,"content":40597,"nodeType":1734},{},[40598],{"data":40599,"content":40600,"nodeType":881},{},[40601],{"data":40602,"marks":40603,"value":40604,"nodeType":865},{},[],"Even attempt to deploy ransomware and other malicious software to progress an attack on user devices and networks (a pretty relevant use case for the many subscribers of Troy’s newsletter accessing it on their corporate device!).",{"data":40606,"content":40607,"nodeType":881},{},[40608],{"data":40609,"marks":40610,"value":40611,"nodeType":865},{},[],"Even grabbing the list of newsletter sign-ups could enable the attacker to perform this attack from a different MailChimp account, so anyone subscribed to Troy’s newsletter should be wary of emails impersonating Troy’s newsletter reaching them from a different sender address than usual. ",{"data":40613,"content":40614,"nodeType":1860},{},[40615],{"data":40616,"marks":40617,"value":40619,"nodeType":865},{},[40618],{"type":902},"Account security limitations",{"data":40621,"content":40622,"nodeType":881},{},[40623,40627,40635],{"data":40624,"marks":40625,"value":40626,"nodeType":865},{},[],"On the theme of MailChimp, it’s also notable that MailChimp doesn’t appear to offer SAML support. ",{"data":40628,"content":40630,"nodeType":876},{"uri":40629},"https://www.okta.com/integrations/mailchimp/",[40631],{"data":40632,"marks":40633,"value":40634,"nodeType":865},{},[],"Okta lists the app as only available for SWA",{"data":40636,"marks":40637,"value":40638,"nodeType":865},{},[]," (where separate credentials are created to access the app, managed through Okta — more like a password manager than genuine SSO via SAML or OIDC).",{"data":40640,"content":40644,"nodeType":890},{"target":40641},{"sys":40642},{"id":40643,"type":887,"linkType":888},"7b4RZhUIqJMF1OxmyR0qKH",[],{"data":40646,"content":40647,"nodeType":881},{},[40648],{"data":40649,"marks":40650,"value":40651,"nodeType":865},{},[],"This means you’re forced to use a username and password. Your only SSO option is to sign in with Google — which many non-Google Workspace users may not have access to. ",{"data":40653,"content":40654,"nodeType":881},{},[40655],{"data":40656,"marks":40657,"value":40658,"nodeType":865},{},[],"As Troy points out, MailChimp also fails to offer support for phishing-resistant MFA. This is pretty typical (if disappointing) for the long tail of SaaS apps, which typically leave WebAuthn / passkey support to the IdP. Except in this case, support for SSO in general is limited, meaning you can only use passkeys if you’re logging in with Google. ",{"data":40660,"content":40664,"nodeType":890},{"target":40661},{"sys":40662},{"id":40663,"type":887,"linkType":888},"2lT7fBiOq4JxpMxSLrdUOv",[],{"data":40666,"content":40667,"nodeType":881},{},[40668],{"data":40669,"marks":40670,"value":40671,"nodeType":865},{},[],"So it’s possible that attackers have noticed that accounts in MailChimp are far more likely to have insecure accounts than other traditional phishing targets — simply because they cannot be configured as securely. ",{"data":40673,"content":40677,"nodeType":890},{"target":40674},{"sys":40675},{"id":40676,"type":887,"linkType":888},"30APqb65kzTA4ySWJIkxGh",[],{"data":40679,"content":40680,"nodeType":1860},{},[40681],{"data":40682,"marks":40683,"value":40685,"nodeType":865},{},[40684],{"type":902},"It might not just be MailChimp",{"data":40687,"content":40688,"nodeType":881},{},[40689],{"data":40690,"marks":40691,"value":40692,"nodeType":865},{},[],"It looks like the same attackers have previously targeted ActiveCampaign, a marketing email and automation platform, based on GitHub comments from December. A domain previously flagged as malicious relating to ActiveCampaign currently redirects to the malicious MailChimp domain seen in Troy’s attack.",{"data":40694,"content":40698,"nodeType":890},{"target":40695},{"sys":40696},{"id":40697,"type":887,"linkType":888},"7M8W9vAYdqPN8NMU8Ug7jq",[],{"data":40700,"content":40704,"nodeType":890},{"target":40701},{"sys":40702},{"id":40703,"type":887,"linkType":888},"7CJfZwc9BpzIL7Fma1Y6o1",[],{"data":40706,"content":40707,"nodeType":881},{},[40708],{"data":40709,"marks":40710,"value":40711,"nodeType":865},{},[],"This could point to a broader campaign targeting similar SaaS platforms for marketing automation and email distribution.",{"data":40713,"content":40714,"nodeType":894},{},[],{"data":40716,"content":40717,"nodeType":904},{},[40718],{"data":40719,"marks":40720,"value":6015,"nodeType":865},{},[40721],{"type":902},{"data":40723,"content":40724,"nodeType":881},{},[40725,40729,40736,40739,40748],{"data":40726,"marks":40727,"value":40728,"nodeType":865},{},[],"MailChimp might seem an unusual target but there are a lot of ways that attackers can abuse SaaS services, as we’ve discussed at length in our public research with the ",{"data":40730,"content":40731,"nodeType":876},{"uri":5192},[40732],{"data":40733,"marks":40734,"value":32109,"nodeType":865},{},[40735],{"type":874},{"data":40737,"marks":40738,"value":1651,"nodeType":865},{},[],{"data":40740,"content":40742,"nodeType":876},{"uri":40741},"https://pushsecurity.com/resources/",[40743],{"data":40744,"marks":40745,"value":40747,"nodeType":865},{},[40746],{"type":874},"many webinars and conference talks",{"data":40749,"marks":40750,"value":40751,"nodeType":865},{},[],". Account takeover through modern phishing attacks like the one we've analysed here is key to unlocking this attack surface. ",{"data":40753,"content":40754,"nodeType":881},{},[40755],{"data":40756,"marks":40757,"value":40758,"nodeType":865},{},[],"While the vast majority of phishing attacks that we observe do focus on core platforms like Microsoft, Google Workspace and Okta, it makes sense that attackers are broadening their focus to take advantage of the fact that phishing targeting these accounts is less obviously a target, and these accounts are often much less securely configured. But there are many ways to target the interconnected ecosystem of SaaS apps in creative ways that most organizations (and users) are seriously underprepared for. ",{"data":40760,"content":40761,"nodeType":881},{},[40762,40766,40774],{"data":40763,"marks":40764,"value":40765,"nodeType":865},{},[],"Attackers have been targeting consumers and individuals via their sprawl of internet apps for some time — are more business-focused threat groups waking up to the opportunity of targeting SaaS? After all, it’s a ",{"data":40767,"content":40768,"nodeType":876},{"uri":31056},[40769],{"data":40770,"marks":40771,"value":40773,"nodeType":865},{},[40772],{"type":874},"great way to evade established controls elsewhere on the network and endpoints",{"data":40775,"marks":40776,"value":40777,"nodeType":865},{},[],", and you can achieve your objectives simply by logging in to (often weakly secured) user accounts.  ",{"data":40779,"content":40780,"nodeType":881},{},[40781],{"data":40782,"marks":40783,"value":40784,"nodeType":865},{},[],"The moral of the story? Phishing attacks are getting pretty sophisticated (and often much more sophisticated than this). Even security pros get phished sometimes!",{"data":40786,"content":40787,"nodeType":970},{},[40788],{"data":40789,"content":40790,"nodeType":881},{},[40791],{"data":40792,"marks":40793,"value":40795,"nodeType":865},{},[40794],{"type":902},"This is clear indicator that we need stronger technical controls to prevent phishing. If even someone like Troy can be phished, the only reasonable conclusion is that humans will always be susceptible to phishing, no matter how much awareness training they receive. ",{"data":40797,"content":40798,"nodeType":881},{},[40799],{"data":40800,"marks":40801,"value":40802,"nodeType":865},{},[],"A big thanks to Troy for sharing his write-up of the incident!",{"data":40804,"content":40805,"nodeType":894},{},[],{"data":40807,"content":40808,"nodeType":904},{},[40809],{"data":40810,"marks":40811,"value":5936,"nodeType":865},{},[40812],{"type":902},{"data":40814,"content":40815,"nodeType":881},{},[40816,40820,40829],{"data":40817,"marks":40818,"value":40819,"nodeType":865},{},[],"Push takes a unique browser-based approach to detecting and intercepting phishing attacks that overcomes many of the tricks and techniques attackers use to defeat conventional anti-phishing controls. To learn more, ",{"data":40821,"content":40823,"nodeType":876},{"uri":40822},"https://pushsecurity.com/blog/why-its-time-for-phishing-prevention-to-move-beyond-email/",[40824],{"data":40825,"marks":40826,"value":40828,"nodeType":865},{},[40827],{"type":874},"check out our recent blog post",{"data":40830,"marks":40831,"value":1032,"nodeType":865},{},[],{"data":40833,"content":40834,"nodeType":881},{},[40835,40839,40846],{"data":40836,"marks":40837,"value":40838,"nodeType":865},{},[],"And if you want to see how Push helps you to detect and defeat common identity attack techniques like AiTM phishing, credential stuffing, and session hijacking while improving your workforce identity posture, book some time with one of our team for a ",{"data":40840,"content":40841,"nodeType":876},{"uri":6048},[40842],{"data":40843,"marks":40844,"value":5355,"nodeType":865},{},[40845],{"type":874},{"data":40847,"marks":40848,"value":959,"nodeType":865},{},[],{"entries":40850},{"hyperlink":40851,"inline":40852,"block":40853},[],[],[40854,40862,40869,40895,40902,40907,40915,40922,40928,40935,40942,40950,40954,40961],{"sys":40855,"__typename":7008,"title":40856,"caption":40857,"layoutMode":59,"file":40858},{"id":40186},"Mailchimp phishing email","Phishing email mimicking the design of MailChimp emails. ",{"url":40859,"width":40860,"height":40861},"https://images.ctfassets.net/y1cdw1ablpvd/GgbsjVF5x9BcsSuR4Gc7s/8f2931a02751edd5e0ebe49fc14540d5/image1.png",1216,1473,{"sys":40863,"__typename":7008,"title":40864,"caption":40865,"layoutMode":59,"file":40866},{"id":40199},"Mailchimp blog image 2","The sender address is from a custom domain that doesn't match MailChimp.",{"url":40867,"width":40868,"height":282},"https://images.ctfassets.net/y1cdw1ablpvd/13as7RS1LRKBQYUVsrfaEq/ffd3dac7a39db009ba5f93e4b448a752/image3.png",450,{"sys":40870,"__typename":7015,"content":40871,"name":40894,"title":59},{"id":40205},{"json":40872},{"data":40873,"content":40874,"nodeType":1463},{},[40875],{"data":40876,"content":40877,"nodeType":881},{},[40878,40882,40891],{"data":40879,"marks":40880,"value":40881,"nodeType":865},{},[],"It’s notable that this email wasn’t actually sent from MailChimp as we’ve seen with other recent attacks where attackers have used third-party SaaS services to send their emails, making them appear more legitimate (such as in ",{"data":40883,"content":40885,"nodeType":876},{"uri":40884},"https://thehackernews.com/2024/12/hubphish-exploits-hubspot-tools-to.html",[40886],{"data":40887,"marks":40888,"value":40890,"nodeType":865},{},[40889],{"type":874},"recent campaigns leveraging HubSpot and DocuSign",{"data":40892,"marks":40893,"value":30302,"nodeType":865},{},[],"Mailchimp blog insight box 1",{"sys":40896,"__typename":7008,"title":40897,"caption":40898,"layoutMode":59,"file":40899},{"id":40235},"Mailchimp blog image 3","Suspicious activity notifications sent at 06:59, 07:00, and 07:01 show how quickly the attack was executed.",{"url":40900,"width":7012,"height":40901},"https://images.ctfassets.net/y1cdw1ablpvd/32prbL1kkdUuSHt7iZv0i9/6dc274e7ff9b22993f9e633c04f05dc5/image10.png",352,{"sys":40903,"__typename":7008,"title":40904,"caption":40905,"layoutMode":59,"file":40906},{"id":40330},"Mailchimp blog image 4","The attacker enumerated Troy's dedicated email used for MailChimp.",{"url":40867,"width":40868,"height":282},{"sys":40908,"__typename":7008,"title":40909,"caption":40910,"layoutMode":59,"file":40911},{"id":40382},"Mailchimp blog image 5","Cloudflare Turnstile is often used to prevent security bots from analysing the attacker's phishing page. ",{"url":40912,"width":40913,"height":40914},"https://images.ctfassets.net/y1cdw1ablpvd/DbEYzQt7m3jY56ALCYWEy/59846e7bd4a3ed204722a9d561e97231/image2.png",938,361,{"sys":40916,"__typename":7008,"title":40917,"caption":40918,"layoutMode":59,"file":40919},{"id":40395},"Mailchimp blog image 6","The site is now being flagged as malicious.",{"url":40920,"width":7012,"height":40921},"https://images.ctfassets.net/y1cdw1ablpvd/7pVNsGvPJC1hMGGPuwznYX/e06f3881f8a6fb8742dd9c95068f4f25/image5.png",1540,{"sys":40923,"__typename":7008,"title":40917,"caption":40924,"layoutMode":59,"file":40925},{"id":40441},"The attacker created an API key for backdoor access to the app.",{"url":40926,"width":7012,"height":40927},"https://images.ctfassets.net/y1cdw1ablpvd/4kQE2MpMXV5edYTZ567NpA/45e5c8d26510959dd91440508280b82b/image9.png",333,{"sys":40929,"__typename":7008,"title":40930,"caption":40931,"layoutMode":59,"file":40932},{"id":40499},"Mailchimp blog image 7","Data captured by the attacker from the exported mailing list.",{"url":40933,"width":17841,"height":40934},"https://images.ctfassets.net/y1cdw1ablpvd/1uOXeOFOEglg6Dzv3kPNud/bd6957fef3cfcdffe02e00f3a9f54b49/image8.png",276,{"sys":40936,"__typename":7008,"title":40937,"caption":40938,"layoutMode":59,"file":40939},{"id":40643},"Mailchimp blog image 8","MailChimp only offers 'Continue with Google' as an SSO option.",{"url":40940,"width":7012,"height":40941},"https://images.ctfassets.net/y1cdw1ablpvd/13VC1YYs1ts8aVO6cbaovA/6cdcf47472e267c25625171a6b8e9653/image7.png",977,{"sys":40943,"__typename":7008,"title":40944,"caption":40945,"layoutMode":59,"file":40946},{"id":40663},"Mailchimp blog image 9","MailChimp only supports phishable MFA factors",{"url":40947,"width":40948,"height":40949},"https://images.ctfassets.net/y1cdw1ablpvd/2FcpNMwmFmmyp1P9NZ9aCx/9e6d9a407d9db243f2f210d39013c731/image6.png",600,410,{"sys":40951,"__typename":1471,"type":1472,"ctaText":40952,"buttonLabel":40953,"buttonColour":1475,"buttonUrl":30376},{"id":40676},"Learn more about the common security gaps created by app developers that contribute to SaaS identity breaches.","Read the blog",{"sys":40955,"__typename":7008,"title":40956,"caption":59,"layoutMode":59,"file":40957},{"id":40697},"Mailchimp blog image 10",{"url":40958,"width":40959,"height":40960},"https://images.ctfassets.net/y1cdw1ablpvd/5nzmVTjx3clYWDr0hlKPu2/aac584ccda7de2c15d704b14ee0d8c6e/image4.png",1400,1620,{"sys":40962,"__typename":40963,"name":40964,"type":40965,"syntax":40966},{"id":40703},"CodeBlockComponent","Mailchimp blog code snippet","shell","hxxps://groupf.emlnk9.com/lt.php?x=3DZy~GE6KXOf6a4s-tI6hRVt3H2piwDuwehiY5THVXeZ5sF_y0y.zOlz5X2gk.~wjvYxZHP",{"items":40968},[],{},"When even Troy Hunt got phished",{"url":40859},"breach-analysis","2025-03-28T00:00:00.000Z",{"items":40975},[40976,41368,42001],{"__typename":1485,"sys":40977,"content":40978,"title":40019,"synopsis":40020,"hashTags":59,"publishedDate":40021,"slug":40022,"tagsCollection":41358,"authorsCollection":41364},{"id":39581},{"json":40979},{"data":40980,"content":40981,"nodeType":1463},{},[40982,41008,41024,41030,41036,41039,41046,41052,41057,41062,41067,41073,41089,41094,41097,41104,41110,41116,41122,41127,41133,41139,41144,41150,41166,41171,41177,41180,41187,41193,41198,41204,41245,41250,41256,41259,41266,41272,41278,41283,41288,41293,41296,41303,41309,41314,41320,41326,41329,41336,41342],{"data":40983,"content":40984,"nodeType":881},{},[40985,40988,40995,40998,41005],{"data":40986,"marks":40987,"value":21,"nodeType":865},{},[],{"data":40989,"content":40990,"nodeType":876},{"uri":18095},[40991],{"data":40992,"marks":40993,"value":24657,"nodeType":865},{},[40994],{"type":874},{"data":40996,"marks":40997,"value":39602,"nodeType":865},{},[],{"data":40999,"content":41000,"nodeType":876},{"uri":39605},[41001],{"data":41002,"marks":41003,"value":32109,"nodeType":865},{},[41004],{"type":874},{"data":41006,"marks":41007,"value":39614,"nodeType":865},{},[],{"data":41009,"content":41010,"nodeType":881},{},[41011,41014,41021],{"data":41012,"marks":41013,"value":39621,"nodeType":865},{},[],{"data":41015,"content":41016,"nodeType":876},{"uri":39624},[41017],{"data":41018,"marks":41019,"value":39630,"nodeType":865},{},[41020],{"type":874},{"data":41022,"marks":41023,"value":39634,"nodeType":865},{},[],{"data":41025,"content":41026,"nodeType":881},{},[41027],{"data":41028,"marks":41029,"value":39641,"nodeType":865},{},[],{"data":41031,"content":41032,"nodeType":881},{},[41033],{"data":41034,"marks":41035,"value":39648,"nodeType":865},{},[],{"data":41037,"content":41038,"nodeType":894},{},[],{"data":41040,"content":41041,"nodeType":904},{},[41042],{"data":41043,"marks":41044,"value":39659,"nodeType":865},{},[41045],{"type":902},{"data":41047,"content":41048,"nodeType":881},{},[41049],{"data":41050,"marks":41051,"value":39666,"nodeType":865},{},[],{"data":41053,"content":41056,"nodeType":890},{"target":41054},{"sys":41055},{"id":39671,"type":887,"linkType":888},[],{"data":41058,"content":41061,"nodeType":890},{"target":41059},{"sys":41060},{"id":39677,"type":887,"linkType":888},[],{"data":41063,"content":41066,"nodeType":890},{"target":41064},{"sys":41065},{"id":39683,"type":887,"linkType":888},[],{"data":41068,"content":41069,"nodeType":881},{},[41070],{"data":41071,"marks":41072,"value":39691,"nodeType":865},{},[],{"data":41074,"content":41075,"nodeType":881},{},[41076,41079,41086],{"data":41077,"marks":41078,"value":39698,"nodeType":865},{},[],{"data":41080,"content":41081,"nodeType":876},{"uri":39701},[41082],{"data":41083,"marks":41084,"value":39707,"nodeType":865},{},[41085],{"type":874},{"data":41087,"marks":41088,"value":39711,"nodeType":865},{},[],{"data":41090,"content":41093,"nodeType":890},{"target":41091},{"sys":41092},{"id":39716,"type":887,"linkType":888},[],{"data":41095,"content":41096,"nodeType":894},{},[],{"data":41098,"content":41099,"nodeType":904},{},[41100],{"data":41101,"marks":41102,"value":39728,"nodeType":865},{},[41103],{"type":902},{"data":41105,"content":41106,"nodeType":881},{},[41107],{"data":41108,"marks":41109,"value":39735,"nodeType":865},{},[],{"data":41111,"content":41112,"nodeType":881},{},[41113],{"data":41114,"marks":41115,"value":39742,"nodeType":865},{},[],{"data":41117,"content":41118,"nodeType":881},{},[41119],{"data":41120,"marks":41121,"value":39749,"nodeType":865},{},[],{"data":41123,"content":41126,"nodeType":890},{"target":41124},{"sys":41125},{"id":39754,"type":887,"linkType":888},[],{"data":41128,"content":41129,"nodeType":881},{},[41130],{"data":41131,"marks":41132,"value":39762,"nodeType":865},{},[],{"data":41134,"content":41135,"nodeType":881},{},[41136],{"data":41137,"marks":41138,"value":39769,"nodeType":865},{},[],{"data":41140,"content":41143,"nodeType":890},{"target":41141},{"sys":41142},{"id":39774,"type":887,"linkType":888},[],{"data":41145,"content":41146,"nodeType":881},{},[41147],{"data":41148,"marks":41149,"value":39782,"nodeType":865},{},[],{"data":41151,"content":41152,"nodeType":881},{},[41153,41156,41163],{"data":41154,"marks":41155,"value":39789,"nodeType":865},{},[],{"data":41157,"content":41158,"nodeType":876},{"uri":39792},[41159],{"data":41160,"marks":41161,"value":39798,"nodeType":865},{},[41162],{"type":874},{"data":41164,"marks":41165,"value":39802,"nodeType":865},{},[],{"data":41167,"content":41170,"nodeType":890},{"target":41168},{"sys":41169},{"id":39807,"type":887,"linkType":888},[],{"data":41172,"content":41173,"nodeType":881},{},[41174],{"data":41175,"marks":41176,"value":39815,"nodeType":865},{},[],{"data":41178,"content":41179,"nodeType":894},{},[],{"data":41181,"content":41182,"nodeType":904},{},[41183],{"data":41184,"marks":41185,"value":39826,"nodeType":865},{},[41186],{"type":902},{"data":41188,"content":41189,"nodeType":881},{},[41190],{"data":41191,"marks":41192,"value":39833,"nodeType":865},{},[],{"data":41194,"content":41197,"nodeType":890},{"target":41195},{"sys":41196},{"id":39838,"type":887,"linkType":888},[],{"data":41199,"content":41200,"nodeType":881},{},[41201],{"data":41202,"marks":41203,"value":39846,"nodeType":865},{},[],{"data":41205,"content":41206,"nodeType":1818},{},[41207,41226],{"data":41208,"content":41209,"nodeType":1734},{},[41210],{"data":41211,"content":41212,"nodeType":881},{},[41213,41216,41223],{"data":41214,"marks":41215,"value":21,"nodeType":865},{},[],{"data":41217,"content":41218,"nodeType":876},{"uri":39792},[41219],{"data":41220,"marks":41221,"value":39866,"nodeType":865},{},[41222],{"type":874},{"data":41224,"marks":41225,"value":39870,"nodeType":865},{},[],{"data":41227,"content":41228,"nodeType":1734},{},[41229],{"data":41230,"content":41231,"nodeType":881},{},[41232,41235,41242],{"data":41233,"marks":41234,"value":21,"nodeType":865},{},[],{"data":41236,"content":41237,"nodeType":876},{"uri":37381},[41238],{"data":41239,"marks":41240,"value":39887,"nodeType":865},{},[41241],{"type":874},{"data":41243,"marks":41244,"value":39891,"nodeType":865},{},[],{"data":41246,"content":41249,"nodeType":890},{"target":41247},{"sys":41248},{"id":39896,"type":887,"linkType":888},[],{"data":41251,"content":41252,"nodeType":881},{},[41253],{"data":41254,"marks":41255,"value":39904,"nodeType":865},{},[],{"data":41257,"content":41258,"nodeType":894},{},[],{"data":41260,"content":41261,"nodeType":904},{},[41262],{"data":41263,"marks":41264,"value":39915,"nodeType":865},{},[41265],{"type":902},{"data":41267,"content":41268,"nodeType":881},{},[41269],{"data":41270,"marks":41271,"value":39922,"nodeType":865},{},[],{"data":41273,"content":41274,"nodeType":881},{},[41275],{"data":41276,"marks":41277,"value":39929,"nodeType":865},{},[],{"data":41279,"content":41282,"nodeType":890},{"target":41280},{"sys":41281},{"id":39934,"type":887,"linkType":888},[],{"data":41284,"content":41287,"nodeType":890},{"target":41285},{"sys":41286},{"id":37923,"type":887,"linkType":888},[],{"data":41289,"content":41292,"nodeType":890},{"target":41290},{"sys":41291},{"id":39945,"type":887,"linkType":888},[],{"data":41294,"content":41295,"nodeType":894},{},[],{"data":41297,"content":41298,"nodeType":904},{},[41299],{"data":41300,"marks":41301,"value":39957,"nodeType":865},{},[41302],{"type":902},{"data":41304,"content":41305,"nodeType":881},{},[41306],{"data":41307,"marks":41308,"value":39964,"nodeType":865},{},[],{"data":41310,"content":41313,"nodeType":890},{"target":41311},{"sys":41312},{"id":39969,"type":887,"linkType":888},[],{"data":41315,"content":41316,"nodeType":881},{},[41317],{"data":41318,"marks":41319,"value":39977,"nodeType":865},{},[],{"data":41321,"content":41322,"nodeType":881},{},[41323],{"data":41324,"marks":41325,"value":39984,"nodeType":865},{},[],{"data":41327,"content":41328,"nodeType":894},{},[],{"data":41330,"content":41331,"nodeType":904},{},[41332],{"data":41333,"marks":41334,"value":38962,"nodeType":865},{},[41335],{"type":902},{"data":41337,"content":41338,"nodeType":881},{},[41339],{"data":41340,"marks":41341,"value":37947,"nodeType":865},{},[],{"data":41343,"content":41344,"nodeType":881},{},[41345,41348,41355],{"data":41346,"marks":41347,"value":31701,"nodeType":865},{},[],{"data":41349,"content":41350,"nodeType":876},{"uri":40009},[41351],{"data":41352,"marks":41353,"value":38977,"nodeType":865},{},[41354],{"type":874},{"data":41356,"marks":41357,"value":40018,"nodeType":865},{},[],{"items":41359},[41360,41362],{"sys":41361,"name":4507},{"id":4506},{"sys":41363,"name":342},{"id":4510},{"items":41365},[41366],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":41367},{"url":5377},{"__typename":1485,"sys":41369,"content":41371,"title":41987,"synopsis":41988,"hashTags":59,"publishedDate":41989,"slug":41990,"tagsCollection":41991,"authorsCollection":41997},{"id":41370},"4UgGUvlZNqkJtx9nNprKg0",{"json":41372},{"data":41373,"content":41374,"nodeType":1463},{},[41375,41382,41413,41419,41426,41429,41437,41444,41451,41484,41491,41498,41505,41508,41516,41535,41542,41549,41555,41562,41569,41572,41580,41587,41594,41600,41607,41627,41660,41667,41670,41678,41685,41692,41698,41705,41712,41719,41724,41731,41737,41744,41747,41755,41762,41769,41772,41780,41787,41794,41801,41804,41812,41819,41826,41833,41840,41847,41852,41859,41866,41871,41878,41910,41916,41928,41948,41954,41957,41964,41970],{"data":41376,"content":41377,"nodeType":881},{},[41378],{"data":41379,"marks":41380,"value":41381,"nodeType":865},{},[],"Most organizations today have invested in an email security solution of some description. But even the most premium tools have significant limitations when it comes to modern phishing attacks. ",{"data":41383,"content":41384,"nodeType":881},{},[41385,41389,41397,41401,41410],{"data":41386,"marks":41387,"value":41388,"nodeType":865},{},[],"The data speaks for itself — phishing remains as big a problem as it ever was (if not bigger!) despite enormous investment in security products and training. In 2024, identity-based attack vectors involving a human element (phishing and stolen credentials) accounted for 80% of the initial access observed by ",{"data":41390,"content":41392,"nodeType":876},{"uri":41391},"https://www.verizon.com/business/en-gb/resources/reports/dbir/",[41393],{"data":41394,"marks":41395,"value":11582,"nodeType":865},{},[41396],{"type":874},{"data":41398,"marks":41399,"value":41400,"nodeType":865},{},[],", while 69% of organizations experienced a phishing incident in 2024 according to ",{"data":41402,"content":41404,"nodeType":876},{"uri":41403},"https://www.idsalliance.org/white-paper/2024-trends-in-securing-digital-identities/",[41405],{"data":41406,"marks":41407,"value":41409,"nodeType":865},{},[41408],{"type":874},"IDSA",{"data":41411,"marks":41412,"value":1032,"nodeType":865},{},[],{"data":41414,"content":41418,"nodeType":890},{"target":41415},{"sys":41416},{"id":41417,"type":887,"linkType":888},"4urh9lIuo0ePgVIJZNtP2B",[],{"data":41420,"content":41421,"nodeType":881},{},[41422],{"data":41423,"marks":41424,"value":41425,"nodeType":865},{},[],"So, why are phishing attacks still so effective for attackers? ",{"data":41427,"content":41428,"nodeType":894},{},[],{"data":41430,"content":41431,"nodeType":904},{},[41432],{"data":41433,"marks":41434,"value":41436,"nodeType":865},{},[41435],{"type":902},"Modern phishing attacks are evading established controls",{"data":41438,"content":41439,"nodeType":881},{},[41440],{"data":41441,"marks":41442,"value":41443,"nodeType":865},{},[],"Let’s start with the lay of the land: What controls and capabilities do organizations typically rely on when it comes to blocking credential phishing?  ",{"data":41445,"content":41446,"nodeType":881},{},[41447],{"data":41448,"marks":41449,"value":41450,"nodeType":865},{},[],"If you’re using an email security solution, you’re relying on the following core capabilities when it comes to detecting malicious phishing pages:",{"data":41452,"content":41453,"nodeType":1818},{},[41454,41469],{"data":41455,"content":41456,"nodeType":1734},{},[41457],{"data":41458,"content":41459,"nodeType":881},{},[41460,41465],{"data":41461,"marks":41462,"value":41464,"nodeType":865},{},[41463],{"type":902},"Known-bad blocklists:",{"data":41466,"marks":41467,"value":41468,"nodeType":865},{},[]," Block users from accessing known-bad or unapproved domains/URLs, and block traffic from known-bad malicious IPs, using Threat Intelligence (TI) feeds.",{"data":41470,"content":41471,"nodeType":1734},{},[41472],{"data":41473,"content":41474,"nodeType":881},{},[41475,41480],{"data":41476,"marks":41477,"value":41479,"nodeType":865},{},[41478],{"type":902},"Malicious webpage detection:",{"data":41481,"marks":41482,"value":41483,"nodeType":865},{},[]," Inspect webpages by loading them in a sandbox to detect malicious elements.",{"data":41485,"content":41486,"nodeType":881},{},[41487],{"data":41488,"marks":41489,"value":41490,"nodeType":865},{},[],"This also applies to other solutions that rely on these capabilities, such as web-based content filtering (e.g. Google Safe Browsing), CASB, SASE, SWG, etc. ",{"data":41492,"content":41493,"nodeType":881},{},[41494],{"data":41495,"marks":41496,"value":41497,"nodeType":865},{},[],"But, attackers are now using specific tactics, techniques, procedures (TTPs) and tooling designed to defeat these solutions. ",{"data":41499,"content":41500,"nodeType":881},{},[41501],{"data":41502,"marks":41503,"value":41504,"nodeType":865},{},[],"Let’s look at where these controls are falling short. ",{"data":41506,"content":41507,"nodeType":894},{},[],{"data":41509,"content":41510,"nodeType":904},{},[41511],{"data":41512,"marks":41513,"value":41515,"nodeType":865},{},[41514],{"type":902},"Attackers are innovating with new tooling and techniques",{"data":41517,"content":41518,"nodeType":881},{},[41519,41523,41532],{"data":41520,"marks":41521,"value":41522,"nodeType":865},{},[],"The vast majority of phishing attacks today are executed using ",{"data":41524,"content":41526,"nodeType":876},{"uri":41525},"https://pushsecurity.com/blog/phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm/?utm_campaign=9983377-FY25Q1_Bleeping-Computer-Organic-Article&utm_source=bleepingcomputer&utm_medium=sponsored-content&utm_content=organic%20article",[41527],{"data":41528,"marks":41529,"value":41531,"nodeType":865},{},[41530],{"type":874},"AitM phishing kits — otherwise known as “MFA bypass” kits",{"data":41533,"marks":41534,"value":959,"nodeType":865},{},[],{"data":41536,"content":41537,"nodeType":881},{},[41538],{"data":41539,"marks":41540,"value":41541,"nodeType":865},{},[],"These kits use dedicated tooling to act as a proxy between the target and a legitimate login portal for an application. This allows the target to log in successfully with a legitimate service they use and even continue to interact with it. ",{"data":41543,"content":41544,"nodeType":881},{},[41545],{"data":41546,"marks":41547,"value":41548,"nodeType":865},{},[],"As it’s a proxy to the real application, the page will appear exactly as the user expects, because they are logging into the legitimate site – just taking a detour via the attacker’s device. However, because the attacker is sitting in the middle of this connection, they are able to observe all interactions, intercept authentication material like credentials, MFA codes, and session tokens to take control of the authenticated session and gain control of the user account. ",{"data":41550,"content":41554,"nodeType":890},{"target":41551},{"sys":41552},{"id":41553,"type":887,"linkType":888},"3ZAawfzPVfhb8cmvWNZEVK",[],{"data":41556,"content":41557,"nodeType":881},{},[41558],{"data":41559,"marks":41560,"value":41561,"nodeType":865},{},[],"MFA was once widely regarded as the silver bullet for phishing (we all remember the Microsoft stat “MFA prevents over 99% of identity-based attacks”) but this is no longer the case. ",{"data":41563,"content":41564,"nodeType":881},{},[41565],{"data":41566,"marks":41567,"value":41568,"nodeType":865},{},[],"Not only are these kits incredibly effective at bypassing other anti-phishing controls like MFA, attackers are building them specifically to evade common detection tooling and techniques. ",{"data":41570,"content":41571,"nodeType":894},{},[],{"data":41573,"content":41574,"nodeType":1860},{},[41575],{"data":41576,"marks":41577,"value":41579,"nodeType":865},{},[41578],{"type":902},"Known-bad blocklists can’t keep up",{"data":41581,"content":41582,"nodeType":881},{},[41583],{"data":41584,"marks":41585,"value":41586,"nodeType":865},{},[],"The fundamental limitation with known-bad blocklists is that they focus on indicators that are easy for attackers to change, in turn making detections based on them easy to bypass. ",{"data":41588,"content":41589,"nodeType":881},{},[41590],{"data":41591,"marks":41592,"value":41593,"nodeType":865},{},[],"Attackers have gotten pretty good at disguising and rotating these elements. In modern phishing attacks, every target can receive a unique email and link. Even just using a URL shortener can bypass this. It’s equivalent to a malware hash – trivial to change, and therefore not a great thing to pin your detections on. The kind of detection that sits right at the bottom of the Pyramid of Pain. ",{"data":41595,"content":41599,"nodeType":890},{"target":41596},{"sys":41597},{"id":41598,"type":887,"linkType":888},"6cG2fx3AikwptyEyXKrYCK",[],{"data":41601,"content":41602,"nodeType":881},{},[41603],{"data":41604,"marks":41605,"value":41606,"nodeType":865},{},[],"You could look at which IP address the user connects to, but these days it’s very simple for attackers to add a new IP to their cloud-hosted server. If a domain is flagged as known-bad, the attacker only has to register a new domain, or compromise a WordPress server on an already trusted domain. Both of these things are happening on a massive scale as attackers pre-plan for the fact that their domains will be burned at some point. Attackers are more than happy to spend $10-$20 per new domain in the grand scheme of the potential proceeds of crime. ",{"data":41608,"content":41609,"nodeType":881},{},[41610,41614,41623],{"data":41611,"marks":41612,"value":41613,"nodeType":865},{},[],"For example, ",{"data":41615,"content":41617,"nodeType":876},{"uri":41616},"https://pushsecurity.com/blog/how-aitm-phishing-kits-evade-detection/?utm_campaign=9983377-FY25Q1_Bleeping-Computer-Organic-Article&utm_source=bleepingcomputer&utm_medium=sponsored-content&utm_content=organic%20article",[41618],{"data":41619,"marks":41620,"value":41622,"nodeType":865},{},[41621],{"type":874},"recent examples of Adversary-in-the-Middle phishing kits",{"data":41624,"marks":41625,"value":41626,"nodeType":865},{},[]," including Tycoon, Nakedpages, Evilginx were seen to rotate the URLs they resolve to (from a continually refreshed pool of URLs), mask the HTTP Referer header to disguise suspicious redirects, and redirect to benign (legitimate) domains if anyone but the intended victims attempted to visit the page. ",{"data":41628,"content":41629,"nodeType":881},{},[41630,41634,41643,41647,41656],{"data":41631,"marks":41632,"value":41633,"nodeType":865},{},[],"And in many cases, attackers are ",{"data":41635,"content":41637,"nodeType":876},{"uri":41636},"https://www.bleepingcomputer.com/news/security/campaign-abusing-hubspot-targets-20-000-microsoft-azure-accounts/",[41638],{"data":41639,"marks":41640,"value":41642,"nodeType":865},{},[41641],{"type":874},"leveraging legitimate SaaS services",{"data":41644,"marks":41645,"value":41646,"nodeType":865},{},[]," to conduct their campaigns (",{"data":41648,"content":41650,"nodeType":876},{"uri":41649},"https://www.bleepingcomputer.com/news/security/proofpoint-settings-exploited-to-send-millions-of-phishing-emails-daily/",[41651],{"data":41652,"marks":41653,"value":41655,"nodeType":865},{},[41654],{"type":874},"sometimes even using email protection services themselves!",{"data":41657,"marks":41658,"value":41659,"nodeType":865},{},[],") making it even harder to filter genuine from harmful links. ",{"data":41661,"content":41662,"nodeType":881},{},[41663],{"data":41664,"marks":41665,"value":41666,"nodeType":865},{},[],"But there’s a bigger issue here – for defenders to know that a URL, IP, or domain name is bad, it needs to be reported first. When are things reported? Typically after being used in an attack — so unfortunately, someone always gets hurt. ",{"data":41668,"content":41669,"nodeType":894},{},[],{"data":41671,"content":41672,"nodeType":1860},{},[41673],{"data":41674,"marks":41675,"value":41677,"nodeType":865},{},[41676],{"type":902},"Malicious webpage detections are failing",{"data":41679,"content":41680,"nodeType":881},{},[41681],{"data":41682,"marks":41683,"value":41684,"nodeType":865},{},[],"Attackers are using various tricks to prevent security tools and bots from reaching their phishing pages to analyse them. ",{"data":41686,"content":41687,"nodeType":881},{},[41688],{"data":41689,"marks":41690,"value":41691,"nodeType":865},{},[],"Using legitimate services to host their domains is increasingly common, with services like Cloudflare Workers used for the initial gateway, and Cloudflare Turnstile to prevent security bots from advancing to the page. ",{"data":41693,"content":41697,"nodeType":890},{"target":41694},{"sys":41695},{"id":41696,"type":887,"linkType":888},"4XNxLbiZf3xUK1WeFDjjxl",[],{"data":41699,"content":41700,"nodeType":881},{},[41701],{"data":41702,"marks":41703,"value":41704,"nodeType":865},{},[],"Even if you can get past Turnstile, then you’ll need to supply the correct URL parameters and headers, and execute JavaScript, to be served the malicious page. This means that a defender who knows the domain name can’t discover the malicious behavior just by making a simple HTTP(S) request to the domain.",{"data":41706,"content":41707,"nodeType":881},{},[41708],{"data":41709,"marks":41710,"value":41711,"nodeType":865},{},[],"And if all this wasn’t enough, they’re also obfuscating both visual and DOM elements to prevent signature-based detections from picking them up — so even if you can land on the page, there’s a high chance that your detections won’t trigger. ",{"data":41713,"content":41714,"nodeType":881},{},[41715],{"data":41716,"marks":41717,"value":41718,"nodeType":865},{},[],"By changing the DOM structure, attackers are loading functionally equivalent pages that look very different under the hood.",{"data":41720,"content":41723,"nodeType":890},{"target":41721},{"sys":41722},{"id":39896,"type":887,"linkType":888},[],{"data":41725,"content":41726,"nodeType":881},{},[41727],{"data":41728,"marks":41729,"value":41730,"nodeType":865},{},[],"They’re also randomizing page titles, dynamically decoding text, changing the size and name of image elements, using different favicons, blurring backgrounds, substituting logos, and more… all to defeat common detections. ",{"data":41732,"content":41736,"nodeType":890},{"target":41733},{"sys":41734},{"id":41735,"type":887,"linkType":888},"3hlzM3qIqaZHy3qxtnRS5x",[],{"data":41738,"content":41739,"nodeType":881},{},[41740],{"data":41741,"marks":41742,"value":41743,"nodeType":865},{},[],"With all this, it’s no surprise that defenders can’t keep up. ",{"data":41745,"content":41746,"nodeType":894},{},[],{"data":41748,"content":41749,"nodeType":904},{},[41750],{"data":41751,"marks":41752,"value":41754,"nodeType":865},{},[41753],{"type":902},"The verdict",{"data":41756,"content":41757,"nodeType":881},{},[41758],{"data":41759,"marks":41760,"value":41761,"nodeType":865},{},[],"Historically, the industry has seen email security solutions and anti-phishing as the same thing. But it’s clear that email-based phishing protection isn’t really cutting it when it comes to modern credential phishing attacks (the most common and impactful phishing variant today). ",{"data":41763,"content":41764,"nodeType":881},{},[41765],{"data":41766,"marks":41767,"value":41768,"nodeType":865},{},[],"This isn’t to say that email-based solutions have no value — far from it. But relying on email scanners to detect phishing pages as a single line of defense isn’t enough anymore. ",{"data":41770,"content":41771,"nodeType":894},{},[],{"data":41773,"content":41774,"nodeType":904},{},[41775],{"data":41776,"marks":41777,"value":41779,"nodeType":865},{},[41778],{"type":902},"Building better phishing controls",{"data":41781,"content":41782,"nodeType":881},{},[41783],{"data":41784,"marks":41785,"value":41786,"nodeType":865},{},[],"The key to solving this problem is, put simply, building better controls. But to do this, we need to move away from email as being the primary (or often the only) place where phishing attacks can be stopped. ",{"data":41788,"content":41789,"nodeType":881},{},[41790],{"data":41791,"marks":41792,"value":41793,"nodeType":865},{},[],"While email is the main delivery vector for phishing attacks (at least, according to the data we have, which comes primarily from email security solutions) it’s not the only one. Phishing links are increasingly delivered to victims over IM platforms, social media — and generally over the internet. ",{"data":41795,"content":41796,"nodeType":881},{},[41797],{"data":41798,"marks":41799,"value":41800,"nodeType":865},{},[],"A better solution to the problem would therefore be able to follow the user across the sites they use, and see the actual phishing pages as the user sees them, as opposed to a sandbox (which, as we’ve discussed, attackers are well prepared for). ",{"data":41802,"content":41803,"nodeType":894},{},[],{"data":41805,"content":41806,"nodeType":1860},{},[41807],{"data":41808,"marks":41809,"value":41811,"nodeType":865},{},[41810],{"type":902},"Is browser-based phishing protection the solution?",{"data":41813,"content":41814,"nodeType":881},{},[41815],{"data":41816,"marks":41817,"value":41818,"nodeType":865},{},[],"While we’ve been conditioned to think about phishing as something that happens over email, it’s actually the browser where most of the action happens, regardless of the initial delivery channel.",{"data":41820,"content":41821,"nodeType":881},{},[41822],{"data":41823,"marks":41824,"value":41825,"nodeType":865},{},[],"And while it’s tempting to view the delivery of a phishing link as the attack itself, the phish can’t succeed unless the victim enters their genuine credentials on the malicious page. ",{"data":41827,"content":41828,"nodeType":881},{},[41829],{"data":41830,"marks":41831,"value":41832,"nodeType":865},{},[],"Push provides a browser-based identity security solution that stops phishing attacks where they happen — in employee browsers. ",{"data":41834,"content":41835,"nodeType":881},{},[41836],{"data":41837,"marks":41838,"value":41839,"nodeType":865},{},[],"Being in the browser delivers a lot of advantages when it comes to detecting and intercepting phishing attacks. You see the live webpage that the user sees, meaning you have much better visibility of malicious elements running on the page. It also means that you can implement real-time controls that kick in when a malicious element is detected. ",{"data":41841,"content":41842,"nodeType":881},{},[41843],{"data":41844,"marks":41845,"value":41846,"nodeType":865},{},[],"There’s a clear difference when you compare a phishing attack with and without Push. ",{"data":41848,"content":41851,"nodeType":890},{"target":41849},{"sys":41850},{"id":38879,"type":887,"linkType":888},[],{"data":41853,"content":41854,"nodeType":881},{},[41855],{"data":41856,"marks":41857,"value":41858,"nodeType":865},{},[],"Here, an attacker hacks a WordPress blog to get a reputable domain and then runs a phishing toolkit on the webpage. They email one of your employees a link to it. Your SWG or email scanning solution inspects it in a sandbox but the phish kit detects this and redirects to a benign site so that it passes the inspection. ",{"data":41860,"content":41861,"nodeType":881},{},[41862],{"data":41863,"marks":41864,"value":41865,"nodeType":865},{},[],"Your user gets the email with the link and is now free to interact with the phishing page. They enter their credentials plus MFA code into the page and voila! The attacker steals the authenticated session and takes over the user’s account.  ",{"data":41867,"content":41870,"nodeType":890},{"target":41868},{"sys":41869},{"id":38916,"type":887,"linkType":888},[],{"data":41872,"content":41873,"nodeType":881},{},[41874],{"data":41875,"marks":41876,"value":41877,"nodeType":865},{},[],"But with Push, our browser extension inspects the webpage running in the user's browser. Push observes that the webpage is a login page and the user is entering their password into the page, detecting that:",{"data":41879,"content":41880,"nodeType":1818},{},[41881,41891,41901],{"data":41882,"content":41883,"nodeType":1734},{},[41884],{"data":41885,"content":41886,"nodeType":881},{},[41887],{"data":41888,"marks":41889,"value":41890,"nodeType":865},{},[],"The password the user is entering matches the domain that password is pinned to. Since it doesn't match, based on this detection alone the user is automatically redirected to a blocking page. ",{"data":41892,"content":41893,"nodeType":1734},{},[41894],{"data":41895,"content":41896,"nodeType":881},{},[41897],{"data":41898,"marks":41899,"value":41900,"nodeType":865},{},[],"The rendered web app is using a cloned app login page.",{"data":41902,"content":41903,"nodeType":1734},{},[41904],{"data":41905,"content":41906,"nodeType":881},{},[41907],{"data":41908,"marks":41909,"value":37891,"nodeType":865},{},[],{"data":41911,"content":41912,"nodeType":881},{},[41913],{"data":41914,"marks":41915,"value":37898,"nodeType":865},{},[],{"data":41917,"content":41918,"nodeType":881},{},[41919,41923],{"data":41920,"marks":41921,"value":41922,"nodeType":865},{},[],"These are good examples of detections that are difficult (or impossible) for an attacker to evade — ",{"data":41924,"marks":41925,"value":41927,"nodeType":865},{},[41926],{"type":902},"you can’t phish a victim if they can’t enter their credentials into your phishing site! ",{"data":41929,"content":41930,"nodeType":881},{},[41931,41935,41944],{"data":41932,"marks":41933,"value":41934,"nodeType":865},{},[],"If we look at the Pyramid of Pain again, we can see that these are much harder detections for attackers to get around, ",{"data":41936,"content":41938,"nodeType":876},{"uri":41937},"https://pushsecurity.com/blog/shifting-detection-left-for-more-effective-itdr/?utm_campaign=9983377-FY25Q1_Bleeping-Computer-Organic-Article&utm_source=bleepingcomputer&utm_medium=sponsored-content&utm_content=organic%20article",[41939],{"data":41940,"marks":41941,"value":41943,"nodeType":865},{},[41942],{"type":874},"enabling earlier detection and interception of account takeover ",{"data":41945,"marks":41946,"value":41947,"nodeType":865},{},[],"when compared to static, TI-driven blocklists — stopping attacks before anyone gets hurt.",{"data":41949,"content":41953,"nodeType":890},{"target":41950},{"sys":41951},{"id":41952,"type":887,"linkType":888},"6q8H7vA8k7mLrSsr5R0TZ1",[],{"data":41955,"content":41956,"nodeType":894},{},[],{"data":41958,"content":41959,"nodeType":904},{},[41960],{"data":41961,"marks":41962,"value":38962,"nodeType":865},{},[41963],{"type":902},{"data":41965,"content":41966,"nodeType":881},{},[41967],{"data":41968,"marks":41969,"value":37947,"nodeType":865},{},[],{"data":41971,"content":41972,"nodeType":881},{},[41973,41976,41983],{"data":41974,"marks":41975,"value":31701,"nodeType":865},{},[],{"data":41977,"content":41978,"nodeType":876},{"uri":40009},[41979],{"data":41980,"marks":41981,"value":38977,"nodeType":865},{},[41982],{"type":874},{"data":41984,"marks":41985,"value":41986,"nodeType":865},{},[]," for a live demo. ","Why it's time for phishing prevention to move beyond email","Modern MFA-bypass phishing attacks are routinely defeating primarily email-based security controls. Why are controls failing and what can we do about it? ","2025-03-20T00:00:00.000Z","why-its-time-for-phishing-prevention-to-move-beyond-email",{"items":41992},[41993,41995],{"sys":41994,"name":4507},{"id":4506},{"sys":41996,"name":342},{"id":4510},{"items":41998},[41999],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":42000},{"url":5377},{"__typename":1485,"sys":42002,"content":42003,"title":38993,"synopsis":38994,"hashTags":59,"publishedDate":38995,"slug":38996,"tagsCollection":42277,"authorsCollection":42283},{"id":38676},{"json":42004},{"data":42005,"content":42006,"nodeType":1463},{},[42007,42013,42029,42042,42048,42054,42057,42063,42069,42117,42123,42128,42131,42137,42143,42149,42155,42161,42175,42180,42186,42192,42206,42211,42217,42223,42229,42235,42241,42244,42250,42266,42271],{"data":42008,"content":42009,"nodeType":904},{},[42010],{"data":42011,"marks":42012,"value":38687,"nodeType":865},{},[],{"data":42014,"content":42015,"nodeType":881},{},[42016,42019,42026],{"data":42017,"marks":42018,"value":38694,"nodeType":865},{},[],{"data":42020,"content":42021,"nodeType":876},{"uri":38697},[42022],{"data":42023,"marks":42024,"value":38703,"nodeType":865},{},[42025],{"type":874},{"data":42027,"marks":42028,"value":1032,"nodeType":865},{},[],{"data":42030,"content":42031,"nodeType":881},{},[42032,42035,42039],{"data":42033,"marks":42034,"value":38713,"nodeType":865},{},[],{"data":42036,"marks":42037,"value":38718,"nodeType":865},{},[42038],{"type":874},{"data":42040,"marks":42041,"value":38722,"nodeType":865},{},[],{"data":42043,"content":42044,"nodeType":881},{},[42045],{"data":42046,"marks":42047,"value":38729,"nodeType":865},{},[],{"data":42049,"content":42050,"nodeType":881},{},[42051],{"data":42052,"marks":42053,"value":38736,"nodeType":865},{},[],{"data":42055,"content":42056,"nodeType":894},{},[],{"data":42058,"content":42059,"nodeType":1860},{},[42060],{"data":42061,"marks":42062,"value":38746,"nodeType":865},{},[],{"data":42064,"content":42065,"nodeType":881},{},[42066],{"data":42067,"marks":42068,"value":38753,"nodeType":865},{},[],{"data":42070,"content":42071,"nodeType":1818},{},[42072,42081,42090,42099,42108],{"data":42073,"content":42074,"nodeType":1734},{},[42075],{"data":42076,"content":42077,"nodeType":881},{},[42078],{"data":42079,"marks":42080,"value":38766,"nodeType":865},{},[],{"data":42082,"content":42083,"nodeType":1734},{},[42084],{"data":42085,"content":42086,"nodeType":881},{},[42087],{"data":42088,"marks":42089,"value":38776,"nodeType":865},{},[],{"data":42091,"content":42092,"nodeType":1734},{},[42093],{"data":42094,"content":42095,"nodeType":881},{},[42096],{"data":42097,"marks":42098,"value":38786,"nodeType":865},{},[],{"data":42100,"content":42101,"nodeType":1734},{},[42102],{"data":42103,"content":42104,"nodeType":881},{},[42105],{"data":42106,"marks":42107,"value":38796,"nodeType":865},{},[],{"data":42109,"content":42110,"nodeType":1734},{},[42111],{"data":42112,"content":42113,"nodeType":881},{},[42114],{"data":42115,"marks":42116,"value":38806,"nodeType":865},{},[],{"data":42118,"content":42119,"nodeType":881},{},[42120],{"data":42121,"marks":42122,"value":38813,"nodeType":865},{},[],{"data":42124,"content":42127,"nodeType":890},{"target":42125},{"sys":42126},{"id":38818,"type":887,"linkType":888},[],{"data":42129,"content":42130,"nodeType":894},{},[],{"data":42132,"content":42133,"nodeType":1860},{},[42134],{"data":42135,"marks":42136,"value":38829,"nodeType":865},{},[],{"data":42138,"content":42139,"nodeType":881},{},[42140],{"data":42141,"marks":42142,"value":38836,"nodeType":865},{},[],{"data":42144,"content":42145,"nodeType":881},{},[42146],{"data":42147,"marks":42148,"value":38843,"nodeType":865},{},[],{"data":42150,"content":42151,"nodeType":881},{},[42152],{"data":42153,"marks":42154,"value":38850,"nodeType":865},{},[],{"data":42156,"content":42157,"nodeType":881},{},[42158],{"data":42159,"marks":42160,"value":38857,"nodeType":865},{},[],{"data":42162,"content":42163,"nodeType":1860},{},[42164,42167,42172],{"data":42165,"marks":42166,"value":38864,"nodeType":865},{},[],{"data":42168,"marks":42169,"value":38870,"nodeType":865},{},[42170,42171],{"type":874},{"type":902},{"data":42173,"marks":42174,"value":38874,"nodeType":865},{},[],{"data":42176,"content":42179,"nodeType":890},{"target":42177},{"sys":42178},{"id":38879,"type":887,"linkType":888},[],{"data":42181,"content":42182,"nodeType":881},{},[42183],{"data":42184,"marks":42185,"value":38887,"nodeType":865},{},[],{"data":42187,"content":42188,"nodeType":881},{},[42189],{"data":42190,"marks":42191,"value":38894,"nodeType":865},{},[],{"data":42193,"content":42194,"nodeType":1860},{},[42195,42198,42203],{"data":42196,"marks":42197,"value":38901,"nodeType":865},{},[],{"data":42199,"marks":42200,"value":38907,"nodeType":865},{},[42201,42202],{"type":874},{"type":902},{"data":42204,"marks":42205,"value":38911,"nodeType":865},{},[],{"data":42207,"content":42210,"nodeType":890},{"target":42208},{"sys":42209},{"id":38916,"type":887,"linkType":888},[],{"data":42212,"content":42213,"nodeType":881},{},[42214],{"data":42215,"marks":42216,"value":38924,"nodeType":865},{},[],{"data":42218,"content":42219,"nodeType":881},{},[42220],{"data":42221,"marks":42222,"value":38931,"nodeType":865},{},[],{"data":42224,"content":42225,"nodeType":881},{},[42226],{"data":42227,"marks":42228,"value":38938,"nodeType":865},{},[],{"data":42230,"content":42231,"nodeType":881},{},[42232],{"data":42233,"marks":42234,"value":38945,"nodeType":865},{},[],{"data":42236,"content":42237,"nodeType":881},{},[42238],{"data":42239,"marks":42240,"value":38952,"nodeType":865},{},[],{"data":42242,"content":42243,"nodeType":894},{},[],{"data":42245,"content":42246,"nodeType":904},{},[42247],{"data":42248,"marks":42249,"value":38962,"nodeType":865},{},[],{"data":42251,"content":42252,"nodeType":881},{},[42253,42256,42263],{"data":42254,"marks":42255,"value":38969,"nodeType":865},{},[],{"data":42257,"content":42258,"nodeType":876},{"uri":6048},[42259],{"data":42260,"marks":42261,"value":38977,"nodeType":865},{},[42262],{"type":874},{"data":42264,"marks":42265,"value":30204,"nodeType":865},{},[],{"data":42267,"content":42270,"nodeType":890},{"target":42268},{"sys":42269},{"id":38985,"type":887,"linkType":888},[],{"data":42272,"content":42273,"nodeType":881},{},[42274],{"data":42275,"marks":42276,"value":21,"nodeType":865},{},[],{"items":42278},[42279,42281],{"sys":42280,"name":4507},{"id":4506},{"sys":42282,"name":342},{"id":4510},{"items":42284},[42285],{"fullName":32085,"firstName":32086,"jobTitle":20082,"profilePicture":42286},{"url":32088},"dissecting-a-recent-mailchimp-phishing-attack","blog/dissecting-a-recent-mailchimp-phishing-attack",{"json":42290},{"data":42291,"content":42292,"nodeType":1463},{},[42293],{"data":42294,"content":42295,"nodeType":881},{},[42296],{"data":42297,"marks":42298,"value":42299,"nodeType":865},{},[],"Have I Been Pwned creator and well-known security person Troy Hunt recently blogged about a phishing attack he fell for — a rare example of Attacker-in-the-Middle phishing being publicly discussed. Here’s what it tells us about how phishing is evolving and why even the best awareness training won't stop phishing attacks. ","HIBP creator and well-known security person Troy Hunt recently blogged about a phish he fell for. Here’s what it tells us about how phishing is evolving. ",{"id":42302,"publishedAt":42303},"3RhqaMQEBAQBdfHDQeoELF","2026-08-12T11:54:21.148Z",{"items":42305},[42306,42308],{"sys":42307,"name":4507},{"id":4506},{"sys":42309,"name":342},{"id":4510},{"items":42311},[42312,42314,42316,42318,42320,42322,42324,42326,42328,42330,42332,42334,42336,42338,42340,42342,42344,42346,42348],{"sys":42313,"name":279,"slug":280,"tier":31},{"id":276},{"sys":42315,"name":519,"slug":520,"tier":31},{"id":516},{"sys":42317,"name":413,"slug":414,"tier":31},{"id":410},{"sys":42319,"name":545,"slug":546,"tier":31},{"id":542},{"sys":42321,"name":342,"slug":343,"tier":31},{"id":339},{"sys":42323,"name":642,"slug":643,"tier":31},{"id":639},{"sys":42325,"name":324,"slug":325,"tier":45},{"id":321},{"sys":42327,"name":261,"slug":262,"tier":45},{"id":258},{"sys":42329,"name":528,"slug":529,"tier":45},{"id":525},{"sys":42331,"name":511,"slug":512,"tier":45},{"id":508},{"sys":42333,"name":466,"slug":467,"tier":45},{"id":463},{"sys":42335,"name":395,"slug":396,"tier":45},{"id":392},{"sys":42337,"name":422,"slug":423,"tier":45},{"id":419},{"sys":42339,"name":333,"slug":334,"tier":45},{"id":330},{"sys":42341,"name":571,"slug":572,"tier":45},{"id":568},{"sys":42343,"name":554,"slug":555,"tier":45},{"id":551},{"sys":42345,"name":502,"slug":503,"tier":45},{"id":499},{"sys":42347,"name":493,"slug":494,"tier":45},{"id":490},{"sys":42349,"name":431,"slug":432,"tier":45},{"id":428},"sZWoklIg0e2vgGAzpil8zIaBU6TuWysHnHs-WKQSO4s",{"id":42352,"title":42353,"authorsCollection":42354,"content":42359,"extension":228,"faqItemsCollection":43412,"faqTitle":59,"featured":6,"hashTags":59,"meta":43414,"metaTitle":43415,"ogImage":43416,"postType":1480,"publishedDate":43418,"relatedBlogPostsCollection":43419,"slug":45876,"stem":45877,"subtitle":45878,"summary":45879,"synopsis":45890,"sys":45891,"tagsCollection":45894,"topicsCollection":45900,"__hash__":45932},"blog/blog/minimum-viable-identity-security.json","Minimum Viable Identity Security",{"items":42355},[42356],{"fullName":5373,"firstName":5374,"jobTitle":5375,"socialLinks":42357,"profilePicture":42358},[6440],{"url":5377},{"json":42360,"links":43242},{"data":42361,"content":42362,"nodeType":1463},{},[42363,42370,42377,42384,42390,42393,42401,42420,42427,42434,42441,42464,42472,42475,42483,42490,42497,42504,42511,42517,42524,42531,42564,42571,42579,42585,42592,42610,42629,42635,42641,42649,42669,42675,42682,42689,42722,42730,42737,42743,42750,42757,42786,42794,42814,42822,42842,42850,42857,42863,42870,42873,42881,42901,42957,42964,42971,42979,42986,43009,43016,43035,43041,43048,43054,43061,43124,43132,43152,43159,43182,43185,43193,43200,43206,43213,43230,43236],{"data":42364,"content":42365,"nodeType":881},{},[42366],{"data":42367,"marks":42368,"value":42369,"nodeType":865},{},[],"A lot happened last year in the world of identity security — particularly in terms of the attacks we’ve experienced targeting internet applications and services. With this trend certain to continue in 2025, it’s more important than ever that product vendors build products with a secure baseline of fundamental controls and safeguards.",{"data":42371,"content":42372,"nodeType":881},{},[42373],{"data":42374,"marks":42375,"value":42376,"nodeType":865},{},[],"The vast majority of the identity vulnerabilities we observe in the wild are the result of multiple auth mechanisms being attached to a single account. The more methods that are configured (or are configurable), the greater the risk that insecure identities will be created — and exploited by attackers. ",{"data":42378,"content":42379,"nodeType":881},{},[42380],{"data":42381,"marks":42382,"value":42383,"nodeType":865},{},[],"The good news is that with a coordinated response from app vendors, this surface can be significantly reduced. The bad news is that right now, we’re very far from a universal standard when it comes to how apps handle authentication and identities. ",{"data":42385,"content":42389,"nodeType":890},{"target":42386},{"sys":42387},{"id":42388,"type":887,"linkType":888},"4QoPUiP5q6Mwj1eWUZT15Q",[],{"data":42391,"content":42392,"nodeType":894},{},[],{"data":42394,"content":42395,"nodeType":904},{},[42396],{"data":42397,"marks":42398,"value":42400,"nodeType":865},{},[42399],{"type":902},"Where to start?",{"data":42402,"content":42403,"nodeType":881},{},[42404,42407,42416],{"data":42405,"marks":42406,"value":5069,"nodeType":865},{},[],{"data":42408,"content":42410,"nodeType":876},{"uri":42409},"https://mvsp.dev/mvsp.en/",[42411],{"data":42412,"marks":42413,"value":42415,"nodeType":865},{},[42414],{"type":874},"Minimum Viable Secure Product (MVSP)",{"data":42417,"marks":42418,"value":42419,"nodeType":865},{},[]," initiative is a great resource for product and engineering teams that sets out essential controls that should be implemented in enterprise-ready products and services. MVSP does a fantastic job of getting to the heart of what’s important for vendor products, as compared to more general frameworks and standards like ISO and NIST that cover wider controls that should be implemented across the enterprise. ",{"data":42421,"content":42422,"nodeType":881},{},[42423],{"data":42424,"marks":42425,"value":42426,"nodeType":865},{},[],"We don’t want to reinvent the wheel, so we won’t be redoing the fundamentals already covered in MVSP. But MVSP inspired us to think – what are the vendor controls that would make a meaningful difference against the identity attacks we’re seeing in the wild? ",{"data":42428,"content":42429,"nodeType":881},{},[42430],{"data":42431,"marks":42432,"value":42433,"nodeType":865},{},[],"With better, consistent security standards, SaaS developers can close off a number of ATO techniques and generally make life much more difficult for attackers. ",{"data":42435,"content":42436,"nodeType":881},{},[42437],{"data":42438,"marks":42439,"value":42440,"nodeType":865},{},[],"We’ve identified two key areas of potential improvement which would make a material difference to ATO resilience:",{"data":42442,"content":42443,"nodeType":1818},{},[42444,42454],{"data":42445,"content":42446,"nodeType":1734},{},[42447],{"data":42448,"content":42449,"nodeType":881},{},[42450],{"data":42451,"marks":42452,"value":42453,"nodeType":865},{},[],"Many of the emerging TTPs could be seriously impaired (or prevented entirely) with improved authentication and identity management controls. ",{"data":42455,"content":42456,"nodeType":1734},{},[42457],{"data":42458,"content":42459,"nodeType":881},{},[42460],{"data":42461,"marks":42462,"value":42463,"nodeType":865},{},[],"Detecting attacks and responding to identity breaches on third-party apps is a nightmare due to the availability of log data (or lack thereof). ",{"data":42465,"content":42466,"nodeType":881},{},[42467],{"data":42468,"marks":42469,"value":42471,"nodeType":865},{},[42470],{"type":902},"Let’s look at the changes that app vendors can make to improve the situation. ",{"data":42473,"content":42474,"nodeType":894},{},[],{"data":42476,"content":42477,"nodeType":904},{},[42478],{"data":42479,"marks":42480,"value":42482,"nodeType":865},{},[42481],{"type":902},"Provide the visibility and control to manage and harden identities",{"data":42484,"content":42485,"nodeType":881},{},[42486],{"data":42487,"marks":42488,"value":42489,"nodeType":865},{},[],"In the context of SaaS, identity security controls are your best (and in many cases, your last) defense against cyber attacks. ",{"data":42491,"content":42492,"nodeType":881},{},[42493],{"data":42494,"marks":42495,"value":42496,"nodeType":865},{},[],"Pretty much every SaaS attack involves ATO through identity-based techniques, such as phishing, credential stuffing, or session hijacking using stolen cookies. In contrast, very few involve classic vulnerability exploitation (e.g. injection vulns, cross-site scripting, etc.). ",{"data":42498,"content":42499,"nodeType":881},{},[42500],{"data":42501,"marks":42502,"value":42503,"nodeType":865},{},[],"When all an attacker needs to do is log into an app and dump the data to succeed, there isn’t much in the way of post-ATO activity to detect and respond to (even if you had the logs you need, more on this later) — which is why robust authentication controls to prevent unauthorized access are so important. ",{"data":42505,"content":42506,"nodeType":881},{},[42507],{"data":42508,"marks":42509,"value":42510,"nodeType":865},{},[],"If post-ATO activity does occur, it is often to compromise additional accounts with in-app administrative privileges as opposed to pivoting to other environments. ",{"data":42512,"content":42516,"nodeType":890},{"target":42513},{"sys":42514},{"id":42515,"type":887,"linkType":888},"3l9SxYjTtls6URgbI0NiU3",[],{"data":42518,"content":42519,"nodeType":881},{},[42520],{"data":42521,"marks":42522,"value":42523,"nodeType":865},{},[],"As you’d expect, many apps prioritize a frictionless user experience over security. This is one of the main drivers of insecure authentication implementation. Consistent implementation of identity and authentication controls would go a long way to reducing the susceptibility of apps to the majority of identity attack techniques. ",{"data":42525,"content":42526,"nodeType":881},{},[42527],{"data":42528,"marks":42529,"value":42530,"nodeType":865},{},[],"In terms of authentication and identity management, MVSP focuses on:",{"data":42532,"content":42533,"nodeType":1818},{},[42534,42544,42554],{"data":42535,"content":42536,"nodeType":1734},{},[42537],{"data":42538,"content":42539,"nodeType":881},{},[42540],{"data":42541,"marks":42542,"value":42543,"nodeType":865},{},[],"Providing an SSO mechanism, ",{"data":42545,"content":42546,"nodeType":1734},{},[42547],{"data":42548,"content":42549,"nodeType":881},{},[42550],{"data":42551,"marks":42552,"value":42553,"nodeType":865},{},[],"Implementing a robust password policy, and ",{"data":42555,"content":42556,"nodeType":1734},{},[42557],{"data":42558,"content":42559,"nodeType":881},{},[42560],{"data":42561,"marks":42562,"value":42563,"nodeType":865},{},[],"Logically separating data/functions based on the needs of a user type/group. ",{"data":42565,"content":42566,"nodeType":881},{},[42567],{"data":42568,"marks":42569,"value":42570,"nodeType":865},{},[],"We can go beyond these basic auth controls to prevent identity attacks by providing better default security configurations, and giving admins more visibility and control over identities. ",{"data":42572,"content":42573,"nodeType":1860},{},[42574],{"data":42575,"marks":42576,"value":42578,"nodeType":865},{},[42577],{"type":902},"1. Allow one active login method (and require external re-verification to change to another).",{"data":42580,"content":42584,"nodeType":890},{"target":42581},{"sys":42582},{"id":42583,"type":887,"linkType":888},"65YwkaNS3LjB1vZsYQtXQH",[],{"data":42586,"content":42587,"nodeType":881},{},[42588],{"data":42589,"marks":42590,"value":42591,"nodeType":865},{},[],"There is very rarely a need for multiple authentication methods to be active for the same account at the same time. Perhaps you upgrade from a local password to OIDC or SAML — but there’s no need to have multiple SSO logins from different providers at once, and there’s no need to continue using a local password after adding an SSO method. One exception is Administrators retaining local password access to access the tenant in case SAML configuration breaks (commonly because certificates expire) but in all other cases it’s an anti-pattern to allow any user more than one auth method. ",{"data":42593,"content":42594,"nodeType":881},{},[42595,42599,42606],{"data":42596,"marks":42597,"value":42598,"nodeType":865},{},[],"We call these alternative login methods (especially when they are in addition to SAML — so e.g. local password or OIDC logins using Google or Microsoft) ",{"data":42600,"content":42601,"nodeType":876},{"uri":11116},[42602],{"data":42603,"marks":42604,"value":11122,"nodeType":865},{},[42605],{"type":874},{"data":42607,"marks":42608,"value":42609,"nodeType":865},{},[]," because they provide attackers with a way around a company’s chosen enterprise SSO option. ",{"data":42611,"content":42612,"nodeType":881},{},[42613,42617,42625],{"data":42614,"marks":42615,"value":42616,"nodeType":865},{},[],"This situation most commonly arises because apps automatically merge login methods. So for example, if a user normally logs in with a password, but then attempts to login using an OIDC of social login — many apps automatically merge that new login method with the existing account. This is particularly problematic when it’s done without further verification steps — leading to ",{"data":42618,"content":42619,"nodeType":876},{"uri":34704},[42620],{"data":42621,"marks":42622,"value":42624,"nodeType":865},{},[42623],{"type":874},"cross-IdP attacks",{"data":42626,"marks":42627,"value":42628,"nodeType":865},{},[],". Ideally, apps should disable the old log method when a new one is enabled, but at the very least, external verification of the change should be required (e.g. via email). ",{"data":42630,"content":42634,"nodeType":890},{"target":42631},{"sys":42632},{"id":42633,"type":887,"linkType":888},"4rcDwo3EmNtkjOLQmf1A7V",[],{"data":42636,"content":42640,"nodeType":890},{"target":42637},{"sys":42638},{"id":42639,"type":887,"linkType":888},"19iDG0ARpziXraEx2Ca7xp",[],{"data":42642,"content":42643,"nodeType":1860},{},[42644],{"data":42645,"marks":42646,"value":42648,"nodeType":865},{},[42647],{"type":902},"2. Require external verification of changes to IdP configuration settings.",{"data":42650,"content":42651,"nodeType":881},{},[42652,42656,42665],{"data":42653,"marks":42654,"value":42655,"nodeType":865},{},[],"Attackers that are able to compromise one account with the level of privilege required to change the SAML settings in-app (typically an app admin), even on an app that is otherwise uninteresting or low risk – can perform an attack technique known as ",{"data":42657,"content":42659,"nodeType":876},{"uri":42658},"https://pushsecurity.com/blog/samljacking-a-poisoned-tenant/",[42660],{"data":42661,"marks":42662,"value":42664,"nodeType":865},{},[42663],{"type":874},"SAMLjacking",{"data":42666,"marks":42667,"value":42668,"nodeType":865},{},[],". This can be used to direct users to authenticate to the app via an attacker-controlled IdP tenant (so e.g. an attacker’s own Okta instance or phishing page that looks like Okta/MS/Google) to capture additional credentials and facilitate further compromise of accounts. ",{"data":42670,"content":42674,"nodeType":890},{"target":42671},{"sys":42672},{"id":42673,"type":887,"linkType":888},"4YfQDIY2hhE77h2xDr9Ja",[],{"data":42676,"content":42677,"nodeType":881},{},[42678],{"data":42679,"marks":42680,"value":42681,"nodeType":865},{},[],"To mitigate this, any SAML changes should require external verification, ideally through an out-of-band method like DNS Verification. If this can’t be achieved and you need to rely on email, the request should be sent to all app admins (to increase awareness of the risky change) and come with a cooldown period before the change takes effect. This improves the chance that an attacker’s SAMLjacking attack can be intercepted before half of the victim’s workforce gets keylogged — not after!",{"data":42683,"content":42684,"nodeType":881},{},[42685],{"data":42686,"marks":42687,"value":42688,"nodeType":865},{},[],"Other viable control options include:",{"data":42690,"content":42691,"nodeType":1818},{},[42692,42702,42712],{"data":42693,"content":42694,"nodeType":1734},{},[42695],{"data":42696,"content":42697,"nodeType":881},{},[42698],{"data":42699,"marks":42700,"value":42701,"nodeType":865},{},[],"Once SAML is configured, ensure it can't be edited without contacting the app developer",{"data":42703,"content":42704,"nodeType":1734},{},[42705],{"data":42706,"content":42707,"nodeType":881},{},[42708],{"data":42709,"marks":42710,"value":42711,"nodeType":865},{},[],"Service Provider initiated flows not enabled by default to stop attackers from hijacking logins using Home Realm Discovery for domains they don't own",{"data":42713,"content":42714,"nodeType":1734},{},[42715],{"data":42716,"content":42717,"nodeType":881},{},[42718],{"data":42719,"marks":42720,"value":42721,"nodeType":865},{},[],"Disallow new signups using password or OIDC logins when a domain is connected via SAML",{"data":42723,"content":42724,"nodeType":1860},{},[42725],{"data":42726,"marks":42727,"value":42729,"nodeType":865},{},[42728],{"type":902},"3. Provide admins with visibility of account authentication (login methods, MFA methods, IdPs used) and allow them to be restricted or removed. ",{"data":42731,"content":42732,"nodeType":881},{},[42733],{"data":42734,"marks":42735,"value":42736,"nodeType":865},{},[],"Many apps provide very limited information to admins about the configuration of identities within their tenant, and fewer still provide any mechanism for admins to take action if gaps or potential weak points are discovered. Some don’t even provide information about which accounts have access to the tenant at all. As a security team member this is maddening. ",{"data":42738,"content":42742,"nodeType":890},{"target":42739},{"sys":42740},{"id":42741,"type":887,"linkType":888},"5z3zNE7z9TWUJsYCmwew1S",[],{"data":42744,"content":42745,"nodeType":881},{},[42746],{"data":42747,"marks":42748,"value":42749,"nodeType":865},{},[],"It’s vital that, at the bare minimum, admins can access information (ideally in a dashboard) with the accounts, all login methods configured, MFA factors set, and the SSO methods used (specifying the IdP and protocol). All login methods should be visible to security admins, including secondary email addresses, social login connections, and so on. ",{"data":42751,"content":42752,"nodeType":881},{},[42753],{"data":42754,"marks":42755,"value":42756,"nodeType":865},{},[],"It should then also be possible to set a preferred method (e.g. only SAML from Microsoft, or OIDC from Google) and delete or disable ones that pose a risk. ",{"data":42758,"content":42759,"nodeType":881},{},[42760,42764,42771,42774,42782],{"data":42761,"marks":42762,"value":42763,"nodeType":865},{},[],"For security teams to be able to clean up insecure identities, they need to be able to make changes inside the app without requiring an action from the user. This means removing phishable MFA factors to prevent ",{"data":42765,"content":42766,"nodeType":876},{"uri":11059},[42767],{"data":42768,"marks":42769,"value":11064,"nodeType":865},{},[42770],{"type":874},{"data":42772,"marks":42773,"value":1651,"nodeType":865},{},[],{"data":42775,"content":42776,"nodeType":876},{"uri":34154},[42777],{"data":42778,"marks":42779,"value":42781,"nodeType":865},{},[42780],{"type":874},"MFA downgrade",{"data":42783,"marks":42784,"value":42785,"nodeType":865},{},[]," attacks.  ",{"data":42787,"content":42788,"nodeType":1860},{},[42789],{"data":42790,"marks":42791,"value":42793,"nodeType":865},{},[42792],{"type":902},"4. Support the use of domain-bound credentials (whether in the form of a passkey or MFA method) that are phishing resistant (FIDO key).",{"data":42795,"content":42796,"nodeType":881},{},[42797,42801,42810],{"data":42798,"marks":42799,"value":42800,"nodeType":865},{},[],"It’s no longer the case that simply having MFA is enough to stop identity attacks. The vast majority of phishing campaigns now make use of ",{"data":42802,"content":42804,"nodeType":876},{"uri":42803},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/aitm_phishing/description.md",[42805],{"data":42806,"marks":42807,"value":42809,"nodeType":865},{},[42808],{"type":874},"AitM toolkits designed to bypass MFA",{"data":42811,"marks":42812,"value":42813,"nodeType":865},{},[],". The only MFA methods considered to be phishing resistant are those using device-bound authentication methods such as passkeys/WebAuthn. However, only a handful of apps actually support these authentication methods. While the majority of SSO apps do support them, apps should provide support locally as well, particularly for B2C use-cases where enterprise SSO isn’t being used. ",{"data":42815,"content":42816,"nodeType":1860},{},[42817],{"data":42818,"marks":42819,"value":42821,"nodeType":865},{},[42820],{"type":902},"5. Allow active sessions to be viewed and remotely terminated by administrators.",{"data":42823,"content":42824,"nodeType":881},{},[42825,42829,42838],{"data":42826,"marks":42827,"value":42828,"nodeType":865},{},[],"Most apps have no way of viewing valid sessions and session activity, even as an administrator. With session hijacking attacks using ",{"data":42830,"content":42832,"nodeType":876},{"uri":42831},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/session_cookie_theft/description.md",[42833],{"data":42834,"marks":42835,"value":42837,"nodeType":865},{},[42836],{"type":874},"stolen session cookies",{"data":42839,"marks":42840,"value":42841,"nodeType":865},{},[]," on the rise, being able to (at the very least) terminate sessions that are suspected to have been compromised is key to effective incident response. In an ideal world, you would be able to view the properties of the session (such as the browser, IP, location that the session is being accessed from) to identify unusual or suspicious activity, which could in turn be leveraged by SecOps teams for their detection workflows. ",{"data":42843,"content":42844,"nodeType":1860},{},[42845],{"data":42846,"marks":42847,"value":42849,"nodeType":865},{},[42848],{"type":902},"6. Allow admins to prevent users with a matching domain from auto-joining a company tenant without being invited or approved by an admin, and notify when they do. ",{"data":42851,"content":42852,"nodeType":881},{},[42853],{"data":42854,"marks":42855,"value":42856,"nodeType":865},{},[],"Many apps do not provide the level of granular permissions that we’ve come to associate with enterprise cloud platforms — often because it simply isn’t necessary. This means that a lot of the time, the average user can access most, if not all of the data stored within an app. This is problematic if any user with a matching domain can join a company’s app tenant. This creates insider risk, as well as increasing the blast radius of ATO of an IdP account in terms of affected apps — it’s not just the apps they’re actively using, but any they can sign up to as well. ",{"data":42858,"content":42862,"nodeType":890},{"target":42859},{"sys":42860},{"id":42861,"type":887,"linkType":888},"SKchIQFHSWumQsORBYNs5",[],{"data":42864,"content":42865,"nodeType":881},{},[42866],{"data":42867,"marks":42868,"value":42869,"nodeType":865},{},[],"To address this, apps should allow admins to lock down their app tenant to be invite-only should they desire (and enable it by default), and at least issue email notifications to admins whenever a new user joins the company’s app tenant — prompting the admin to check that the event is expected. ",{"data":42871,"content":42872,"nodeType":894},{},[],{"data":42874,"content":42875,"nodeType":904},{},[42876],{"data":42877,"marks":42878,"value":42880,"nodeType":865},{},[42879],{"type":902},"Enable security teams to detect and respond to identity attacks",{"data":42882,"content":42883,"nodeType":881},{},[42884,42888,42897],{"data":42885,"marks":42886,"value":42887,"nodeType":865},{},[],"Security teams required to respond to incidents affecting SaaS apps are ",{"data":42889,"content":42891,"nodeType":876},{"uri":42890},"https://mayakaczorowski.com/blogs/what-sucks-in-security",[42892],{"data":42893,"marks":42894,"value":42896,"nodeType":865},{},[42895],{"type":874},"united in how painful it is",{"data":42898,"marks":42899,"value":42900,"nodeType":865},{},[],": ",{"data":42902,"content":42903,"nodeType":1818},{},[42904,42927,42937,42947],{"data":42905,"content":42906,"nodeType":1734},{},[42907],{"data":42908,"content":42909,"nodeType":881},{},[42910,42914,42923],{"data":42911,"marks":42912,"value":42913,"nodeType":865},{},[],"Many SaaS providers don’t offer audit logs at all (",{"data":42915,"content":42917,"nodeType":876},{"uri":42916},"https://audit-logs.tax/",[42918],{"data":42919,"marks":42920,"value":42922,"nodeType":865},{},[42921],{"type":874},"or charge extra for the privilege",{"data":42924,"marks":42925,"value":42926,"nodeType":865},{},[],"). ",{"data":42928,"content":42929,"nodeType":1734},{},[42930],{"data":42931,"content":42932,"nodeType":881},{},[42933],{"data":42934,"marks":42935,"value":42936,"nodeType":865},{},[],"Even when logs are available, they might be incomplete, like missing login events, or critical pieces of information in the event needed to decide whether it’s malicious or not.",{"data":42938,"content":42939,"nodeType":1734},{},[42940],{"data":42941,"content":42942,"nodeType":881},{},[42943],{"data":42944,"marks":42945,"value":42946,"nodeType":865},{},[],"The lack of standardization across tools creates ingestion challenges, with each app requiring custom development work.",{"data":42948,"content":42949,"nodeType":1734},{},[42950],{"data":42951,"content":42952,"nodeType":881},{},[42953],{"data":42954,"marks":42955,"value":42956,"nodeType":865},{},[],"The logs you really need can’t always be accessed programmatically. The provider might have them, but you’ll need to put in a request – that could take hours or days to respond to. ",{"data":42958,"content":42959,"nodeType":881},{},[42960],{"data":42961,"marks":42962,"value":42963,"nodeType":865},{},[],"All of this makes it very challenging to ingest meaningful security log data from SaaS and harness it for detection and response. Hours or days is an eternity when you’re in the midst of a live incident, and is inevitably going to result in a worse outcome for the business. ",{"data":42965,"content":42966,"nodeType":881},{},[42967],{"data":42968,"marks":42969,"value":42970,"nodeType":865},{},[],"MVSP specifies that authentication events should be logged (and for how long they should be stored), but practically there is little consistency in the types of event and the fields captured. App vendors should make sure that the data points they provide (and the format that logs are provided in) can be practically used by security teams. ",{"data":42972,"content":42973,"nodeType":1860},{},[42974],{"data":42975,"marks":42976,"value":42978,"nodeType":865},{},[42977],{"type":902},"7. Log detailed authentication/login information.",{"data":42980,"content":42981,"nodeType":881},{},[42982],{"data":42983,"marks":42984,"value":42985,"nodeType":865},{},[],"Authentication information is arguably the most important log source in the context of SaaS services which lack granular permissions management, because: ",{"data":42987,"content":42988,"nodeType":1818},{},[42989,42999],{"data":42990,"content":42991,"nodeType":1734},{},[42992],{"data":42993,"content":42994,"nodeType":881},{},[42995],{"data":42996,"marks":42997,"value":42998,"nodeType":865},{},[],"If you know a malicious user accessed the app, you can infer/assume the likely impact, and respond accordingly. ",{"data":43000,"content":43001,"nodeType":1734},{},[43002],{"data":43003,"content":43004,"nodeType":881},{},[43005],{"data":43006,"marks":43007,"value":43008,"nodeType":865},{},[],"Attacker behavior in-app is often indistinguishable from typical user behavior.",{"data":43010,"content":43011,"nodeType":881},{},[43012],{"data":43013,"marks":43014,"value":43015,"nodeType":865},{},[],"This means it’s vital to understand who accessed the app, at what time, and from where.",{"data":43017,"content":43018,"nodeType":881},{},[43019,43022,43031],{"data":43020,"marks":43021,"value":5069,"nodeType":865},{},[],{"data":43023,"content":43025,"nodeType":876},{"uri":43024},"https://eventmaturitymatrix.com/#salesforce-real-time-event-monitoring-urieventstream",[43026],{"data":43027,"marks":43028,"value":43030,"nodeType":865},{},[43029],{"type":874},"SaaS Event Maturity Matrix",{"data":43032,"marks":43033,"value":43034,"nodeType":865},{},[]," provides a great starting point when looking at the availability of authentication logs across different platforms. ",{"data":43036,"content":43040,"nodeType":890},{"target":43037},{"sys":43038},{"id":43039,"type":887,"linkType":888},"4NppB8YnmXHIQjvLwx79JW",[],{"data":43042,"content":43043,"nodeType":881},{},[43044],{"data":43045,"marks":43046,"value":43047,"nodeType":865},{},[],"We recommend that all providers include the following Authentication and MFA Verification log fields:",{"data":43049,"content":43053,"nodeType":890},{"target":43050},{"sys":43051},{"id":43052,"type":887,"linkType":888},"67uAYr6RA3DIr7mUCBgzyn",[],{"data":43055,"content":43056,"nodeType":881},{},[43057],{"data":43058,"marks":43059,"value":43060,"nodeType":865},{},[],"With this level of granular information it will be much easier for security teams to reliably differentiate malicious from legitimate access, independently or when combined with other data points:",{"data":43062,"content":43063,"nodeType":1818},{},[43064,43074,43084,43094,43104,43114],{"data":43065,"content":43066,"nodeType":1734},{},[43067],{"data":43068,"content":43069,"nodeType":881},{},[43070],{"data":43071,"marks":43072,"value":43073,"nodeType":865},{},[],"Identify suspicious logins due to location/impossible travel",{"data":43075,"content":43076,"nodeType":1734},{},[43077],{"data":43078,"content":43079,"nodeType":881},{},[43080],{"data":43081,"marks":43082,"value":43083,"nodeType":865},{},[],"Identify failed login attempts due to either credential or MFA failures, indicating possible credential stuffing attacks",{"data":43085,"content":43086,"nodeType":1734},{},[43087],{"data":43088,"content":43089,"nodeType":881},{},[43090],{"data":43091,"marks":43092,"value":43093,"nodeType":865},{},[],"Identify the IdP used to login to detect unapproved or unusual IdP logins (a possible indicator of cross-IdP impersonation)",{"data":43095,"content":43096,"nodeType":1734},{},[43097],{"data":43098,"content":43099,"nodeType":881},{},[43100],{"data":43101,"marks":43102,"value":43103,"nodeType":865},{},[],"Identify where an unexpected (less secure) MFA method is used, indicating a potential MFA downgrade attack",{"data":43105,"content":43106,"nodeType":1734},{},[43107],{"data":43108,"content":43109,"nodeType":881},{},[43110],{"data":43111,"marks":43112,"value":43113,"nodeType":865},{},[],"Detect risky changes to authentication such as initiating SAML configuration changes, tracking which user initiated it and when it completed",{"data":43115,"content":43116,"nodeType":1734},{},[43117],{"data":43118,"content":43119,"nodeType":881},{},[43120],{"data":43121,"marks":43122,"value":43123,"nodeType":865},{},[],"Differentiate active session location from the device/client/location of the original session (to detect session hijacking attacks)",{"data":43125,"content":43126,"nodeType":1860},{},[43127],{"data":43128,"marks":43129,"value":43131,"nodeType":865},{},[43130],{"type":902},"8. Make audit logs available in a format and using a mechanism that is easy to ingest into common security tools. ",{"data":43133,"content":43134,"nodeType":881},{},[43135,43139,43148],{"data":43136,"marks":43137,"value":43138,"nodeType":865},{},[],"Even where logs are available, security teams often have to wrestle with the format they are provided in to be able to make use of them. While JSON is pretty much the de facto standard nowadays, the absence of a common schema and field names is often the tricky part — complicated by the fact that there are multiple competing standards. At the very least, complying with at least one of the more established schemas (e.g. the ",{"data":43140,"content":43142,"nodeType":876},{"uri":43141},"https://www.elastic.co/guide/en/ecs/current/ecs-reference.html",[43143],{"data":43144,"marks":43145,"value":43147,"nodeType":865},{},[43146],{"type":874},"Elastic Common Schema",{"data":43149,"marks":43150,"value":43151,"nodeType":865},{},[],") will provide a level of standardisation to make things easier for security teams.",{"data":43153,"content":43154,"nodeType":881},{},[43155],{"data":43156,"marks":43157,"value":43158,"nodeType":865},{},[],"Arguably an even bigger challenge is pulling the events you actually need from the data — so making it possible to stream logs or access them programmatically to minimize collection delays is a key change that app developers can implement regardless of the schema used, that will make life easier for SecOps teams. With that in mind: ",{"data":43160,"content":43161,"nodeType":1818},{},[43162,43172],{"data":43163,"content":43164,"nodeType":1734},{},[43165],{"data":43166,"content":43167,"nodeType":881},{},[43168],{"data":43169,"marks":43170,"value":43171,"nodeType":865},{},[],"Login events indicating a potential identity attack should emit preconfigured webhook events to enable security teams to better detect and respond, (such as in the context of the use cases above). ",{"data":43173,"content":43174,"nodeType":1734},{},[43175],{"data":43176,"content":43177,"nodeType":881},{},[43178],{"data":43179,"marks":43180,"value":43181,"nodeType":865},{},[],"API access should also be provided to ensure that logs can be extracted to inform point-in-time investigations in the event of a suspected incident. (It’s no good if you have to request that certain logs be sent to you during a time-sensitive security incident.) ",{"data":43183,"content":43184,"nodeType":894},{},[],{"data":43186,"content":43187,"nodeType":904},{},[43188],{"data":43189,"marks":43190,"value":43192,"nodeType":865},{},[43191],{"type":902},"Final thoughts",{"data":43194,"content":43195,"nodeType":881},{},[43196],{"data":43197,"marks":43198,"value":43199,"nodeType":865},{},[],"The key takeaway here is that the scope for identity attacks and abuse could be significantly mitigated with a better standard of app-level controls. If you’re familiar with Push, you’ll recognize that many of our features compensate for these gaps in visibility and control — made necessary by the fact that so many apps don’t provide basic information about the accounts within your tenant, or give you any controls to manage authentication in accordance with your risk profile.",{"data":43201,"content":43205,"nodeType":890},{"target":43202},{"sys":43203},{"id":43204,"type":887,"linkType":888},"2skTQlf4ssC083ilExzKPW",[],{"data":43207,"content":43208,"nodeType":881},{},[43209],{"data":43210,"marks":43211,"value":43212,"nodeType":865},{},[],"If you agree with us and think that stronger identity controls around authentication and security logging are needed, then consider adding these suggestions to your procurement requirements when on-boarding new apps and services. ",{"data":43214,"content":43215,"nodeType":881},{},[43216,43219,43226],{"data":43217,"marks":43218,"value":21,"nodeType":865},{},[],{"data":43220,"content":43221,"nodeType":876},{"uri":6048},[43222],{"data":43223,"marks":43224,"value":35360,"nodeType":865},{},[43225],{"type":874},{"data":43227,"marks":43228,"value":43229,"nodeType":865},{},[]," to find out how Push can mitigate widespread application security gaps and secure your identity attack surface. ",{"data":43231,"content":43235,"nodeType":890},{"target":43232},{"sys":43233},{"id":43234,"type":887,"linkType":888},"34OTFgwuW60VWzW4FAqwXi",[],{"data":43237,"content":43238,"nodeType":881},{},[43239],{"data":43240,"marks":43241,"value":21,"nodeType":865},{},[],{"entries":43243},{"hyperlink":43244,"inline":43245,"block":43246},[],[],[43247,43250,43254,43269,43298,43305,43319,43353,43378,43386,43393,43407],{"sys":43248,"__typename":1471,"type":1472,"ctaText":43249,"buttonLabel":30676,"buttonColour":30677,"buttonUrl":30913},{"id":42388},"Get our latest ebook to learn about the evolution of identity attacks in 2024 and their role in public breaches. ",{"sys":43251,"__typename":1471,"type":1472,"ctaText":43252,"buttonLabel":43253,"buttonColour":1475,"buttonUrl":31056},{"id":42515},"Learn how Push provides defense in depth against identity attacks before account takeover.","Read the Blog",{"sys":43255,"__typename":7015,"content":43256,"name":43268,"title":59},{"id":42583},{"json":43257},{"data":43258,"content":43259,"nodeType":1463},{},[43260],{"data":43261,"content":43262,"nodeType":881},{},[43263],{"data":43264,"marks":43265,"value":43267,"nodeType":865},{},[43266],{"type":902},"If you don’t take anything else away from this piece, this control alone will get rid of 80% of the complexity and room for vulnerabilities to creep in. ","MVSI insight box",{"sys":43270,"__typename":7015,"content":43271,"name":43297,"title":59},{"id":42633},{"json":43272},{"nodeType":1463,"data":43273,"content":43274},{},[43275,43290],{"nodeType":881,"data":43276,"content":43277},{},[43278,43282,43287],{"nodeType":865,"value":43279,"marks":43280,"data":43281},"We recently saw a great example of a practical solution to this problem — HubSpot have introduced a feature where any user that is no longer using a password to log in ",[],{},{"nodeType":865,"value":43283,"marks":43284,"data":43286},"will have their password removed automatically",[43285],{"type":902},{},{"nodeType":865,"value":14775,"marks":43288,"data":43289},[],{},{"nodeType":881,"data":43291,"content":43292},{},[43293],{"nodeType":865,"value":43294,"marks":43295,"data":43296},"This means that users consciously opting for more secure SSO-based logins will get the added benefit of the app automatically cleaning up unused login methods. This is an excellent QOL feature and demonstrates a real understanding of the security risk posed by ghost logins. ",[],{},"MVSP insight box",{"sys":43299,"__typename":7008,"title":43300,"caption":59,"layoutMode":59,"file":43301},{"id":42639},"HubSpot automatic password removal",{"url":43302,"width":43303,"height":43304},"https://images.ctfassets.net/y1cdw1ablpvd/1noqvZD8IxO8DLcYLu6uPb/b84a0e8bf80f009895d59d0e16454786/Group_542.png",1470,2078,{"sys":43306,"__typename":7015,"content":43307,"name":43318,"title":59},{"id":42673},{"json":43308},{"nodeType":1463,"data":43309,"content":43310},{},[43311],{"nodeType":881,"data":43312,"content":43313},{},[43314],{"nodeType":865,"value":43315,"marks":43316,"data":43317},"Using SAMLjacking, an attacker can turn the compromise of a low risk app/identity into a much more serious one by using it to capture SSO credentials for other users of the app. ",[],{},"MVSI Insight box 2",{"sys":43320,"__typename":7015,"content":43321,"name":43352,"title":59},{"id":42741},{"json":43322},{"nodeType":1463,"data":43323,"content":43324},{},[43325],{"nodeType":881,"data":43326,"content":43327},{},[43328,43332,43339,43343,43348],{"nodeType":865,"value":43329,"marks":43330,"data":43331},"One of the leading causes of identity breaches is when ",[],{},{"nodeType":876,"data":43333,"content":43334},{"uri":11116},[43335],{"nodeType":865,"value":11122,"marks":43336,"data":43338},[43337],{"type":874},{},{"nodeType":865,"value":43340,"marks":43341,"data":43342}," (usually a weak, breached or reused password) exist alongside a more secure login method (e.g. SAML SSO). These ghost logins can be exploitable either as a single factor, or with a weak/phishable MFA method. It doesn’t matter if your employees ",[],{},{"nodeType":865,"value":43344,"marks":43345,"data":43347},"typically",[43346],{"type":5120},{},{"nodeType":865,"value":43349,"marks":43350,"data":43351}," log in with SAML, if insecure local logins exist alongside it — because attackers can take advantage of this. ",[],{},"MVSI insight box 3",{"sys":43354,"__typename":7015,"content":43355,"name":43377,"title":59},{"id":42861},{"json":43356},{"nodeType":1463,"data":43357,"content":43358},{},[43359],{"nodeType":881,"data":43360,"content":43361},{},[43362,43366,43373],{"nodeType":865,"value":43363,"marks":43364,"data":43365},"You might assume that a user with access to an IdP account also has access to the email connected to that account, but as we’ve seen with ",[],{},{"nodeType":876,"data":43367,"content":43368},{"uri":34704},[43369],{"nodeType":865,"value":30356,"marks":43370,"data":43372},[43371],{"type":874},{},{"nodeType":865,"value":43374,"marks":43375,"data":43376},", this isn’t necessarily the case. ",[],{},"MVSI insight box 4",{"sys":43379,"__typename":7008,"title":43380,"caption":43381,"layoutMode":59,"file":43382},{"id":43039},"MVSI: Example Okta login history logs","Example of Okta login history logs",{"url":43383,"width":43384,"height":43385},"https://images.ctfassets.net/y1cdw1ablpvd/2oRCAyYH72TfB2EsGxQDFK/325fceea5222e1404141e7ed89ba4b53/image1.png",1578,1418,{"sys":43387,"__typename":7008,"title":43388,"caption":59,"layoutMode":59,"file":43389},{"id":43052},"MVSI Recommended Logs",{"url":43390,"width":43391,"height":43392},"https://images.ctfassets.net/y1cdw1ablpvd/GWJoQawV0uYCn4vdVxcXy/00bae170edfc839c7e1f37427eb309c7/Screenshot_2025-02-10_at_12.00.14.png",1264,526,{"sys":43394,"__typename":7015,"content":43395,"name":43406,"title":59},{"id":43204},{"json":43396},{"nodeType":1463,"data":43397,"content":43398},{},[43399],{"nodeType":881,"data":43400,"content":43401},{},[43402],{"nodeType":865,"value":43403,"marks":43404,"data":43405},"This is certainly not intended as a definitive standard or exhaustive list of identity controls — but hopefully provides any app developers or standards authors with food for thought! We speak for other potential customers when we say that including these controls would make your app much more attractive to the security and compliance teams of prospective buyers. ",[],{},"MVSI insight box 5",{"sys":43408,"__typename":1471,"type":1472,"ctaText":43409,"buttonLabel":43410,"buttonColour":43411,"buttonUrl":6048},{"id":43234},"Book a demo to see how Push prevents and detects identity attacks across all apps your employees use. ","Book a Demo","orange",{"items":43413},[],{},"8 ways app developers can mitigate identity-based attacks",{"url":43417},"https://images.ctfassets.net/y1cdw1ablpvd/5EErNKIkhkUn2Y9OCLlDjR/2e5c107747f8d881d87484577bfd895c/Dan_Blog_Thumbnail.jpg","2025-02-10T00:00:00.000Z",{"items":43420},[43421,44611,45244],{"__typename":1485,"sys":43422,"content":43424,"title":44597,"synopsis":44598,"hashTags":59,"publishedDate":44599,"slug":44600,"tagsCollection":44601,"authorsCollection":44607},{"id":43423},"5KqYY7p174lSpuinfTfEZU",{"json":43425},{"data":43426,"content":43427,"nodeType":1463},{},[43428,43435,43490,43497,43500,43507,43514,43547,43559,43562,43569,43580,43587,43607,43613,43633,43640,43650,43670,43690,43697,43716,43722,43742,43745,43752,43759,43766,43785,43803,43810,43829,43836,43843,43868,43875,43895,43916,43922,43929,43948,43951,43958,43975,43994,44001,44054,44061,44064,44071,44078,44097,44117,44124,44131,44138,44159,44166,44173,44179,44185,44188,44195,44202,44209,44229,44239,44258,44265,44272,44282,44289,44296,44317,44323,44326,44333,44340,44347,44418,44425,44432,44439,44447,44468,44475,44481,44492,44513,44520,44528,44549,44556,44563,44569,44572,44579],{"data":43429,"content":43430,"nodeType":881},{},[43431],{"data":43432,"marks":43433,"value":43434,"nodeType":865},{},[],"From massive breaches like the Snowflake incident to novel phishing techniques documented by Push researchers, 2024 was the year that identity attacks left their mark. Looking back over what we saw in the wild and what we found through Push’s own research, three key themes stand out:",{"data":43436,"content":43437,"nodeType":1818},{},[43438,43457,43467],{"data":43439,"content":43440,"nodeType":1734},{},[43441],{"data":43442,"content":43443,"nodeType":881},{},[43444,43448,43453],{"data":43445,"marks":43446,"value":43447,"nodeType":865},{},[],"Account takeover techniques on cloud apps are fundamentally different from traditional network-based attacks. To have the best chance of preventing account takeover, defenders need to  disrupt attacks ",{"data":43449,"marks":43450,"value":43452,"nodeType":865},{},[43451],{"type":5120},"before",{"data":43454,"marks":43455,"value":43456,"nodeType":865},{},[]," they’re successful.",{"data":43458,"content":43459,"nodeType":1734},{},[43460],{"data":43461,"content":43462,"nodeType":881},{},[43463],{"data":43464,"marks":43465,"value":43466,"nodeType":865},{},[],"It’s not easy or practical to maintain 100 percent compliance on identity posture standards in a world where employees are using and signing up to apps outside of IT oversight — but it is possible to make this work a lot easier by using tools that help you scale your remediation activities.",{"data":43468,"content":43469,"nodeType":1734},{},[43470],{"data":43471,"content":43472,"nodeType":881},{},[43473,43477,43486],{"data":43474,"marks":43475,"value":43476,"nodeType":865},{},[],"Despite another year where cybersecurity spend increased (now up to almost $1,100 per user, according to ",{"data":43478,"content":43480,"nodeType":876},{"uri":43479},"https://www.forrester.com/report/2024-cybersecurity-benchmarks-global/RES181118",[43481],{"data":43482,"marks":43483,"value":43485,"nodeType":865},{},[43484],{"type":874},"Forrester",{"data":43487,"marks":43488,"value":43489,"nodeType":865},{},[],"), existing approaches are not successfully preventing account takeovers. Security teams need to be able to detect and respond to these attacks where they happen: The browser.",{"data":43491,"content":43492,"nodeType":881},{},[43493],{"data":43494,"marks":43495,"value":43496,"nodeType":865},{},[],"In this article, we’ll take a look back at how these themes influenced key features we delivered for Push customers in 2024.",{"data":43498,"content":43499,"nodeType":894},{},[],{"data":43501,"content":43502,"nodeType":904},{},[43503],{"data":43504,"marks":43505,"value":43506,"nodeType":865},{},[],"Defending against modern phishing attacks",{"data":43508,"content":43509,"nodeType":881},{},[43510],{"data":43511,"marks":43512,"value":43513,"nodeType":865},{},[],"Phishing techniques that bypass MFA are now the norm, and few organizations have successfully achieved full coverage of phishing-resistant MFA methods. ",{"data":43515,"content":43516,"nodeType":881},{},[43517,43521,43530,43534,43543],{"data":43518,"marks":43519,"value":43520,"nodeType":865},{},[],"Equally, while phishing attacks via email remain the most commonly reported vector, phishing attacks increasingly target users outside of email. For example, phishing links are often encountered through normal internet use — such as ",{"data":43522,"content":43524,"nodeType":876},{"uri":43523},"https://www.bleepingcomputer.com/news/security/hackers-use-google-search-ads-to-steal-google-ads-accounts/",[43525],{"data":43526,"marks":43527,"value":43529,"nodeType":865},{},[43528],{"type":874},"in malicious Google ads",{"data":43531,"marks":43532,"value":43533,"nodeType":865},{},[]," — and attackers frequently conduct their campaigns over IM platforms like Slack and Teams. Late last year there was ",{"data":43535,"content":43537,"nodeType":876},{"uri":43536},"https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ?utm_source=share&utm_medium=member_desktop",[43538],{"data":43539,"marks":43540,"value":43542,"nodeType":865},{},[43541],{"type":874},"a rise in attackers inundating users with spam via Teams",{"data":43544,"marks":43545,"value":43546,"nodeType":865},{},[],", combined with phone scams posing as IT admins. Since anti-phishing controls are usually email-based, they fail to protect users from attacks taking place elsewhere. ",{"data":43548,"content":43549,"nodeType":881},{},[43550,43554],{"data":43551,"marks":43552,"value":43553,"nodeType":865},{},[],"At Push, we’ve built a suite of anti-phishing features over the last year that act as a defense-in-depth approach to the types of modern phishing techniques we’ve been observing in the wild. ",{"data":43555,"marks":43556,"value":43558,"nodeType":865},{},[43557],{"type":902},"Here’s what we built and why.",{"data":43560,"content":43561,"nodeType":894},{},[],{"data":43563,"content":43564,"nodeType":904},{},[43565],{"data":43566,"marks":43567,"value":43568,"nodeType":865},{},[],"Protecting passwords used for SSO",{"data":43570,"content":43571,"nodeType":1860},{},[43572,43577],{"data":43573,"marks":43574,"value":43576,"nodeType":865},{},[43575],{"type":902},"What happened?",{"data":43578,"marks":43579,"value":2091,"nodeType":865},{},[],{"data":43581,"content":43582,"nodeType":881},{},[43583],{"data":43584,"marks":43585,"value":43586,"nodeType":865},{},[],"Attackers explicitly targeted Okta, Entra, and Google Workspace accounts in 2023 and 2024, so we knew a top priority would be protecting identity provider accounts. These IdP accounts are a key target because they allow attackers to move laterally to other valuable apps and data via SSO following the initial account takeover.",{"data":43588,"content":43589,"nodeType":881},{},[43590,43594,43603],{"data":43591,"marks":43592,"value":43593,"nodeType":865},{},[],"It’s not just the typical IdPs you need to watch out for, either: Apps like GitHub, Slack, Salesforce, Facebook, X, and others all provide SSO functionality, increasing the blast radius of a compromise. And as we reported in ",{"data":43595,"content":43597,"nodeType":876},{"uri":43596},"https://pushsecurity.com/blog/cross-idp-impersonation/",[43598],{"data":43599,"marks":43600,"value":43602,"nodeType":865},{},[43601],{"type":874},"our research on cross-IdP impersonation",{"data":43604,"marks":43605,"value":43606,"nodeType":865},{},[],", apps can be accessed using multiple SSO methods simultaneously — and 3 in 5 apps that we tested recently did not require re-verification by default when adding a new login method.",{"data":43608,"content":43612,"nodeType":890},{"target":43609},{"sys":43610},{"id":43611,"type":887,"linkType":888},"3EOOr4dVQoiPjl2ucUs1mA",[],{"data":43614,"content":43615,"nodeType":881},{},[43616,43620,43629],{"data":43617,"marks":43618,"value":43619,"nodeType":865},{},[],"Phishing is a problem that would be significantly reduced in a world without passwords. But while the ideal case is that organizations can put in place phishing-resistant authentication methods like passkeys or other WebAuthn-based methods, the reality is that ",{"data":43621,"content":43623,"nodeType":876},{"uri":43622},"https://www.ncsc.gov.uk/blog-post/passkeys-not-perfect-getting-better",[43624],{"data":43625,"marks":43626,"value":43628,"nodeType":865},{},[43627],{"type":874},"it’s not a perfect solution right now",{"data":43630,"marks":43631,"value":43632,"nodeType":865},{},[]," — widespread passkey implementation is hard to achieve.",{"data":43634,"content":43635,"nodeType":881},{},[43636],{"data":43637,"marks":43638,"value":43639,"nodeType":865},{},[],"One of the key advantages of passkeys is that they are domain-bound: Meaning they can’t be used on a site with the wrong domain. So, we started thinking: What if it were possible to essentially domain-bind a password? ",{"data":43641,"content":43642,"nodeType":1860},{},[43643,43647],{"data":43644,"marks":43645,"value":19156,"nodeType":865},{},[43646],{"type":902},{"data":43648,"marks":43649,"value":2091,"nodeType":865},{},[],{"data":43651,"content":43652,"nodeType":881},{},[43653,43657,43666],{"data":43654,"marks":43655,"value":43656,"nodeType":865},{},[],"In the first half of 2024, we delivered our ",{"data":43658,"content":43659,"nodeType":876},{"uri":17092},[43660],{"data":43661,"marks":43662,"value":43665,"nodeType":865},{},[43663,43664],{"type":874},{"type":902},"SSO password protection",{"data":43667,"marks":43668,"value":43669,"nodeType":865},{},[]," feature, which allows Push administrators to block employees from entering their IdP password into any site that’s not the identity provider — in effect domain-binding SSO credentials. ",{"data":43671,"content":43672,"nodeType":881},{},[43673,43677,43686],{"data":43674,"marks":43675,"value":43676,"nodeType":865},{},[],"Push accomplishes this via the Push browser agent, which ",{"data":43678,"content":43680,"nodeType":876},{"uri":43679},"https://pushsecurity.com/help/10109/#how-does-sso-password-protection-work",[43681],{"data":43682,"marks":43683,"value":43685,"nodeType":865},{},[43684],{"type":874},"observes and fingerprints",{"data":43687,"marks":43688,"value":43689,"nodeType":865},{},[]," the user’s SSO password and legitimate SSO login pages, and then enforces in-browser controls to prevent an SSO password from being submitted on any URL that doesn’t match the legitimate provider, an extremely strong anti-phishing protection. Separately, Push also verifies that passwords it observes are not easily guessable.",{"data":43691,"content":43692,"nodeType":881},{},[43693],{"data":43694,"marks":43695,"value":43696,"nodeType":865},{},[],"The idea behind this approach is to gain some similar benefits to passkeys — by ensuring that passwords used for SSO access to your apps cannot be phished and are unique and strong — but in a way that “just works” with existing password-based authentication. ",{"data":43698,"content":43699,"nodeType":881},{},[43700,43704,43712],{"data":43701,"marks":43702,"value":43703,"nodeType":865},{},[],"Organizations that monitor for SSO password reuse will find that the practice turns out to be incredibly widespread, so being able to detect and prevent password reuse — even outside of actual phishing attempts — is an asset to security teams. (Our ",{"data":43705,"content":43706,"nodeType":876},{"uri":30250},[43707],{"data":43708,"marks":43709,"value":43711,"nodeType":865},{},[43710],{"type":874},"research shows",{"data":43713,"marks":43714,"value":43715,"nodeType":865},{},[]," that 10% of IdP accounts are using a password that is shared with another app — where it is much more likely to be compromised.) ",{"data":43717,"content":43721,"nodeType":890},{"target":43718},{"sys":43719},{"id":43720,"type":887,"linkType":888},"4Ce999wf4mqCZwu1jLofsx",[],{"data":43723,"content":43724,"nodeType":881},{},[43725,43729,43738],{"data":43726,"marks":43727,"value":43728,"nodeType":865},{},[],"By streaming events to your SIEM and setting up a simple automation, you can also use Push-supplied intelligence on SSO password reuse to ",{"data":43730,"content":43732,"nodeType":876},{"uri":43731},"https://pushsecurity.com/blog/automating-sso-password-resets-using-push/",[43733],{"data":43734,"marks":43735,"value":43737,"nodeType":865},{},[43736],{"type":874},"automatically reset",{"data":43739,"marks":43740,"value":43741,"nodeType":865},{},[]," potentially compromised passwords — this provides instant response to successful phishing and gets rid of password re-use of your most sensitive credentials in one move - the kind of combo we love!",{"data":43743,"content":43744,"nodeType":894},{},[],{"data":43746,"content":43747,"nodeType":904},{},[43748],{"data":43749,"marks":43750,"value":43751,"nodeType":865},{},[],"Blocking AitM phishing and cloned login pages",{"data":43753,"content":43754,"nodeType":1860},{},[43755],{"data":43756,"marks":43757,"value":43576,"nodeType":865},{},[43758],{"type":902},{"data":43760,"content":43761,"nodeType":881},{},[43762],{"data":43763,"marks":43764,"value":43765,"nodeType":865},{},[],"When you’re able to detect SSO passwords being used in all the wrong places, it’s not surprising that one of the main offenders is phishing attacks. ",{"data":43767,"content":43768,"nodeType":881},{},[43769,43773,43781],{"data":43770,"marks":43771,"value":43772,"nodeType":865},{},[],"In 2024, we wrote extensively about the rise in ",{"data":43774,"content":43775,"nodeType":876},{"uri":28776},[43776],{"data":43777,"marks":43778,"value":43780,"nodeType":865},{},[43779],{"type":874},"modern phishing attacks",{"data":43782,"marks":43783,"value":43784,"nodeType":865},{},[]," that use adversary-in-the middle toolkits (AiTM), including EvilNoVNC, Evilginx, and others.",{"data":43786,"content":43787,"nodeType":881},{},[43788,43792,43800],{"data":43789,"marks":43790,"value":43791,"nodeType":865},{},[],"AiTM phishing is a newer variant of phishing that allows attackers to bypass MFA protection by using tools that act as a proxy between the end-user and a legitimate login portal. AitM attacks increased 146% in 2023 (",{"data":43793,"content":43795,"nodeType":876},{"uri":43794},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Microsoft%20Digital%20Defense%20Report%202024%20%281%29.pdf",[43796],{"data":43797,"marks":43798,"value":1718,"nodeType":865},{},[43799],{"type":874},{"data":43801,"marks":43802,"value":30302,"nodeType":865},{},[],{"data":43804,"content":43805,"nodeType":881},{},[43806],{"data":43807,"marks":43808,"value":43809,"nodeType":865},{},[],"This trend in tradecraft was reflected in our own customer base last year, but what’s interesting is that we observed a lot of phish kits and tactics that were new — meaning traditional detections failed to find them before Push did. ",{"data":43811,"content":43812,"nodeType":881},{},[43813,43817,43825],{"data":43814,"marks":43815,"value":43816,"nodeType":865},{},[],"In particular, we saw newer ",{"data":43818,"content":43819,"nodeType":876},{"uri":39792},[43820],{"data":43821,"marks":43822,"value":43824,"nodeType":865},{},[43823],{"type":874},"web-based obfuscation techniques",{"data":43826,"marks":43827,"value":43828,"nodeType":865},{},[]," that allowed attackers to get past the features of email security tools like web gateways and email scanning appliances, such as bypassing web sandbox analysis, and deter other forms of automated investigation by using Cloudflare Turnstile and other tactics — similar to the approaches legit websites use to protect against automated bots (this is essentially the same problem for both).",{"data":43830,"content":43831,"nodeType":881},{},[43832],{"data":43833,"marks":43834,"value":43835,"nodeType":865},{},[],"The gap in existing controls was obvious: When all phishing routes eventually lead to the browser, security teams need to be able to detect and respond in the browser. To do this well they need to observe what the employee sees, not what loads in a sandbox.",{"data":43837,"content":43838,"nodeType":1860},{},[43839],{"data":43840,"marks":43841,"value":19156,"nodeType":865},{},[43842],{"type":902},{"data":43844,"content":43845,"nodeType":881},{},[43846,43850,43860,43865],{"data":43847,"marks":43848,"value":43849,"nodeType":865},{},[],"To address this gap, we released new capabilities for the Push browser agent to be able to ",{"data":43851,"content":43853,"nodeType":876},{"uri":43852},"https://pushsecurity.com/blog/introducing-aitm-phishing-toolkit-detection-powered-by-the-push-browser/",[43854],{"data":43855,"marks":43856,"value":43859,"nodeType":865},{},[43857,43858],{"type":874},{"type":902},"detect and block",{"data":43861,"marks":43862,"value":43864,"nodeType":865},{},[43863],{"type":902}," when a site is running AiTM phishing toolkits",{"data":43866,"marks":43867,"value":1032,"nodeType":865},{},[],{"data":43869,"content":43870,"nodeType":881},{},[43871],{"data":43872,"marks":43873,"value":43874,"nodeType":865},{},[],"Push does this via a set of readymade detections for common AiTM tools. By dynamically analyzing the behavior of malware in the browser, the Push browser agent can find indicators of compromise beyond just domains, file names, IP addresses, etc., focusing instead on behavioral attributes, such as Javascript calls being made or data structures saved to local storage.",{"data":43876,"content":43877,"nodeType":881},{},[43878,43882,43891],{"data":43879,"marks":43880,"value":43881,"nodeType":865},{},[],"This approach of focusing on the top of the ",{"data":43883,"content":43885,"nodeType":876},{"uri":43884},"https://pushsecurity.com/blog/our-design-philosophy-detecting-what-matters/#id-building-effective-identity-threat-detection-controls_id-scenario-detecting-a-web-based-phishing-attack",[43886],{"data":43887,"marks":43888,"value":43890,"nodeType":865},{},[43889],{"type":874},"Pyramid of Pain",{"data":43892,"marks":43893,"value":43894,"nodeType":865},{},[]," — e.g. building detections for attributes of an attack that are the hardest for attackers to change, and therefore the most reliably accurate — is core to Push’s design philosophy. ",{"data":43896,"content":43897,"nodeType":881},{},[43898,43902,43912],{"data":43899,"marks":43900,"value":43901,"nodeType":865},{},[],"Finally, toward the second half of the year, we released ",{"data":43903,"content":43905,"nodeType":876},{"uri":43904},"https://pushsecurity.com/blog/introducing-cloned-login-page-detection/",[43906],{"data":43907,"marks":43908,"value":43911,"nodeType":865},{},[43909,43910],{"type":874},{"type":902},"cloned login page detection",{"data":43913,"marks":43914,"value":43915,"nodeType":865},{},[],", a natural extension of our layered approach to preventing phishing attacks in the browser. With this security control, you can identify malicious webpages that are masquerading as legitimate IdP login portals. ",{"data":43917,"content":43921,"nodeType":890},{"target":43918},{"sys":43919},{"id":43920,"type":887,"linkType":888},"4y25OxesssUk9lzEx12HFa",[],{"data":43923,"content":43924,"nodeType":881},{},[43925],{"data":43926,"marks":43927,"value":43928,"nodeType":865},{},[],"When a cloned login page is detected, you can add the URL to your blocklist in Push and prevent any other employees from being targeted. ",{"data":43930,"content":43931,"nodeType":881},{},[43932,43936,43944],{"data":43933,"marks":43934,"value":43935,"nodeType":865},{},[],"By layering multiple anti-phishing controls that all prevent account takeover, defenders have the best chance at thwarting the ",{"data":43937,"content":43938,"nodeType":876},{"uri":31056},[43939],{"data":43940,"marks":43941,"value":43943,"nodeType":865},{},[43942],{"type":874},"short, fast attack chains",{"data":43945,"marks":43946,"value":43947,"nodeType":865},{},[]," that are emblematic of today’s identity attacks.",{"data":43949,"content":43950,"nodeType":894},{},[],{"data":43952,"content":43953,"nodeType":904},{},[43954],{"data":43955,"marks":43956,"value":43957,"nodeType":865},{},[],"Defending against stolen sessions and stolen credentials",{"data":43959,"content":43960,"nodeType":881},{},[43961,43965,43972],{"data":43962,"marks":43963,"value":43964,"nodeType":865},{},[],"With as little as $10 to buy a stolen password and a little skill, attackers capitalized on the use of stolen credentials last year. Stolen creds were the No. 1 attacker action in 2023 and 2024, according to ",{"data":43966,"content":43967,"nodeType":876},{"uri":41391},[43968],{"data":43969,"marks":43970,"value":11582,"nodeType":865},{},[43971],{"type":874},{"data":43973,"marks":43974,"value":959,"nodeType":865},{},[],{"data":43976,"content":43977,"nodeType":881},{},[43978,43982,43990],{"data":43979,"marks":43980,"value":43981,"nodeType":865},{},[],"Nowhere was this more plain than in the ",{"data":43983,"content":43984,"nodeType":876},{"uri":11103},[43985],{"data":43986,"marks":43987,"value":43989,"nodeType":865},{},[43988],{"type":874},"attacks on Snowflake customers",{"data":43991,"marks":43992,"value":43993,"nodeType":865},{},[],", one of the biggest breaches of last year. In this incident, cyber criminals targeted around 165 customers of the cloud-based data warehouse tool Snowflake by taking over accounts using credentials harvested from infostealer infections dating as far back as 2020.",{"data":43995,"content":43996,"nodeType":881},{},[43997],{"data":43998,"marks":43999,"value":44000,"nodeType":865},{},[],"The Snowflake incident underscored the challenges of control and visibility that security teams face when attempting to secure identities on a patchwork of managed and unmanaged apps:",{"data":44002,"content":44003,"nodeType":1818},{},[44004,44014,44024,44034,44044],{"data":44005,"content":44006,"nodeType":1734},{},[44007],{"data":44008,"content":44009,"nodeType":881},{},[44010],{"data":44011,"marks":44012,"value":44013,"nodeType":865},{},[],"Do I know all the workforce accounts my employees use?",{"data":44015,"content":44016,"nodeType":1734},{},[44017],{"data":44018,"content":44019,"nodeType":881},{},[44020],{"data":44021,"marks":44022,"value":44023,"nodeType":865},{},[],"Do those accounts have a strong security posture?",{"data":44025,"content":44026,"nodeType":1734},{},[44027],{"data":44028,"content":44029,"nodeType":881},{},[44030],{"data":44031,"marks":44032,"value":44033,"nodeType":865},{},[],"Do those accounts use MFA? The most phishing-resistant methods?",{"data":44035,"content":44036,"nodeType":1734},{},[44037],{"data":44038,"content":44039,"nodeType":881},{},[44040],{"data":44041,"marks":44042,"value":44043,"nodeType":865},{},[],"Do I have tools to detect, respond, and remediate after an account takeover or breach of a critical software vendor?",{"data":44045,"content":44046,"nodeType":1734},{},[44047],{"data":44048,"content":44049,"nodeType":881},{},[44050],{"data":44051,"marks":44052,"value":44053,"nodeType":865},{},[],"Do I know when a session has been stolen, pointing to a device compromised by infostealer malware?",{"data":44055,"content":44056,"nodeType":881},{},[44057],{"data":44058,"marks":44059,"value":44060,"nodeType":865},{},[],"Here’s what we delivered last year to make it easier for security teams to protect their organizations from the threat of stolen sessions and stolen creds.",{"data":44062,"content":44063,"nodeType":894},{},[],{"data":44065,"content":44066,"nodeType":904},{},[44067],{"data":44068,"marks":44069,"value":44070,"nodeType":865},{},[],"Detecting stolen sessions",{"data":44072,"content":44073,"nodeType":1860},{},[44074],{"data":44075,"marks":44076,"value":43576,"nodeType":865},{},[44077],{"type":902},{"data":44079,"content":44080,"nodeType":881},{},[44081,44084,44093],{"data":44082,"marks":44083,"value":21,"nodeType":865},{},[],{"data":44085,"content":44087,"nodeType":876},{"uri":44086},"https://pushsecurity.com/blog/what-the-rise-of-infostealers-says-about-identity-attacks/",[44088],{"data":44089,"marks":44090,"value":44092,"nodeType":865},{},[44091],{"type":874},"Infostealer malware",{"data":44094,"marks":44095,"value":44096,"nodeType":865},{},[]," — a type of malware designed to collect user credentials, including session cookies, from end-user devices — had a very successful 2024, accounting for nearly 10 percent of activity that Red Canary was able to associate with named threats, and the majority of all detected malware that Sophos threat researchers documented last year.",{"data":44098,"content":44099,"nodeType":881},{},[44100,44104,44113],{"data":44101,"marks":44102,"value":44103,"nodeType":865},{},[],"While the use of stolen credentials is rampant, often facilitated by successful infostealer campaigns, a related attack type also ",{"data":44105,"content":44107,"nodeType":876},{"uri":44106},"https://pushsecurity.com/blog/what-the-rise-of-infostealers-says-about-identity-attacks/#id-the-state-of-infostealers-today",[44108],{"data":44109,"marks":44110,"value":44112,"nodeType":865},{},[44111],{"type":874},"jumped in prevalence",{"data":44114,"marks":44115,"value":44116,"nodeType":865},{},[]," last year: session token theft attacks.",{"data":44118,"content":44119,"nodeType":881},{},[44120],{"data":44121,"marks":44122,"value":44123,"nodeType":865},{},[],"Using stolen tokens, adversaries don’t need to bypass MFA directly. They can simply import the tokens into their browser and assume an already authorized session. ",{"data":44125,"content":44126,"nodeType":1860},{},[44127],{"data":44128,"marks":44129,"value":19156,"nodeType":865},{},[44130],{"type":902},{"data":44132,"content":44133,"nodeType":881},{},[44134],{"data":44135,"marks":44136,"value":44137,"nodeType":865},{},[],"In order to detect a stolen session in use, you need telemetry that allows you to tie activity to a trusted endpoint. This didn’t previously exist, and you have to be in the browser to do it. So that’s what we built. ",{"data":44139,"content":44140,"nodeType":881},{},[44141,44145,44155],{"data":44142,"marks":44143,"value":44144,"nodeType":865},{},[],"Push’s ",{"data":44146,"content":44148,"nodeType":876},{"uri":44147},"https://pushsecurity.com/blog/introducing-session-token-theft-detection-why-browser-is-best/",[44149],{"data":44150,"marks":44151,"value":44154,"nodeType":865},{},[44152,44153],{"type":874},{"type":902},"session theft detection",{"data":44156,"marks":44157,"value":44158,"nodeType":865},{},[]," capability uses the power of the Push browser extension to inject a unique marker into the user-agent string of sessions that occur in browsers enrolled in Push. ",{"data":44160,"content":44161,"nodeType":881},{},[44162],{"data":44163,"marks":44164,"value":44165,"nodeType":865},{},[],"By analyzing logs from your IdP in your SIEM, you can then identify activity from the same session that both has and that lacks the Push marker, indicating that a session has been extracted from the browser and maliciously imported into a different browser that is not enrolled in Push.",{"data":44167,"content":44168,"nodeType":881},{},[44169],{"data":44170,"marks":44171,"value":44172,"nodeType":865},{},[],"This is a reliable signal that a stolen session token is being used and an endpoint has been compromised.",{"data":44174,"content":44178,"nodeType":890},{"target":44175},{"sys":44176},{"id":44177,"type":887,"linkType":888},"1XNNkaoW64t3PPvC54KGXF",[],{"data":44180,"content":44184,"nodeType":890},{"target":44181},{"sys":44182},{"id":44183,"type":887,"linkType":888},"6dOEnPzZXd9DqeSdalqlzO",[],{"data":44186,"content":44187,"nodeType":894},{},[],{"data":44189,"content":44190,"nodeType":904},{},[44191],{"data":44192,"marks":44193,"value":44194,"nodeType":865},{},[],"Detecting compromised credentials",{"data":44196,"content":44197,"nodeType":1860},{},[44198],{"data":44199,"marks":44200,"value":43576,"nodeType":865},{},[44201],{"type":902},{"data":44203,"content":44204,"nodeType":881},{},[44205],{"data":44206,"marks":44207,"value":44208,"nodeType":865},{},[],"Alongside stolen session cookies, stolen credentials made a lot of headlines last year. The 2024 Verizon DBIR found that 79% of web application compromises were the result of breached creds, and researchers at IBM found a 71% year-over-year increase in cyberattacks using stolen or compromised credentials.",{"data":44210,"content":44211,"nodeType":881},{},[44212,44216,44225],{"data":44213,"marks":44214,"value":44215,"nodeType":865},{},[],"In Push’s own research, we counted ",{"data":44217,"content":44219,"nodeType":876},{"uri":44218},"https://pushsecurity.com/blog/2024-identity-breaches/",[44220],{"data":44221,"marks":44222,"value":44224,"nodeType":865},{},[44223],{"type":874},"30 public identity-related breaches",{"data":44226,"marks":44227,"value":44228,"nodeType":865},{},[]," in 2024 where the breach and the breach vector were disclosed. Of those, nearly three-quarters were the result of compromised credentials, including notable breaches such as Microsoft, Change Healthcare, and the attacks on Snowflake customers.",{"data":44230,"content":44231,"nodeType":970},{},[44232],{"data":44233,"content":44234,"nodeType":881},{},[44235],{"data":44236,"marks":44237,"value":44238,"nodeType":865},{},[],"73% of public identity-related breaches in 2024 were the result of compromised credentials (the rest were phishing attacks). ",{"data":44240,"content":44241,"nodeType":881},{},[44242,44246,44254],{"data":44243,"marks":44244,"value":44245,"nodeType":865},{},[],"The influx of compromised credentials has been amplified by the ",{"data":44247,"content":44248,"nodeType":876},{"uri":44086},[44249],{"data":44250,"marks":44251,"value":44253,"nodeType":865},{},[44252],{"type":874},"rise of infostealers",{"data":44255,"marks":44256,"value":44257,"nodeType":865},{},[],", which contribute the vast majority of valid stolen credentials, alongside mass credential phishing campaigns and third-party data breach dumps. ",{"data":44259,"content":44260,"nodeType":881},{},[44261],{"data":44262,"marks":44263,"value":44264,"nodeType":865},{},[],"And while there’s no shortage of threat intelligence about stolen credentials for sale on the web, security teams struggle to separate the needle from the haystack because a large portion of TI on stolen creds is out of date.",{"data":44266,"content":44267,"nodeType":881},{},[44268],{"data":44269,"marks":44270,"value":44271,"nodeType":865},{},[],"In evaluating TI data here at Push, we reviewed 5,763 username and password combos that matched domains in use by Push customers. We found that less than 1% of the creds in a multi-vendor dataset were true positives. In other words, 99.5% of the stolen creds we checked were false positives at the time of review — illustrating the challenge security teams face when trying to extract actionable intelligence from this kind of data. ",{"data":44273,"content":44274,"nodeType":970},{},[44275],{"data":44276,"content":44277,"nodeType":881},{},[44278],{"data":44279,"marks":44280,"value":44281,"nodeType":865},{},[],"99.5% of the findings in compromised credential feeds were found to be false positives.",{"data":44283,"content":44284,"nodeType":1860},{},[44285],{"data":44286,"marks":44287,"value":19156,"nodeType":865},{},[44288],{"type":902},{"data":44290,"content":44291,"nodeType":881},{},[44292],{"data":44293,"marks":44294,"value":44295,"nodeType":865},{},[],"Using its browser agent, Push assesses the strength of end-user passwords by creating and analyzing a truncated, salted SHA256 hash of the password for a given account. (These k-anonymized fingerprints are never seen by Push’s back-end and exist only in local browser extension storage.) ",{"data":44297,"content":44298,"nodeType":881},{},[44299,44303,44313],{"data":44300,"marks":44301,"value":44302,"nodeType":865},{},[],"These fingerprints give Push a directly observable source of truth for corporate creds, which allowed us to build a ",{"data":44304,"content":44306,"nodeType":876},{"uri":44305},"https://pushsecurity.com/blog/verified-stolen-credential-detection/",[44307],{"data":44308,"marks":44309,"value":44312,"nodeType":865},{},[44310,44311],{"type":874},{"type":902},"verified stolen credential detection",{"data":44314,"marks":44315,"value":44316,"nodeType":865},{},[]," capability last year that removes all false positives from TI sources to pinpoint only those stolen creds still actively in use by employees.",{"data":44318,"content":44322,"nodeType":890},{"target":44319},{"sys":44320},{"id":44321,"type":887,"linkType":888},"3BITHZvDadjHpOAqIn0g4w",[],{"data":44324,"content":44325,"nodeType":894},{},[],{"data":44327,"content":44328,"nodeType":904},{},[44329],{"data":44330,"marks":44331,"value":44332,"nodeType":865},{},[],"Reducing and securing shadow IT and account sprawl",{"data":44334,"content":44335,"nodeType":881},{},[44336],{"data":44337,"marks":44338,"value":44339,"nodeType":865},{},[],"You can think of this last part of the story as the ground from which the attack trends we’ve been talking about emerged: The shift to doing business almost entirely in the browser, and the resulting sprawl in accounts and unmanaged apps, leading to an explosion of internet-facing identities for threat actors to target.",{"data":44341,"content":44342,"nodeType":881},{},[44343],{"data":44344,"marks":44345,"value":44346,"nodeType":865},{},[],"Even in organizations with mature security practices, the challenge of getting 100% compliance with identity posture best practices is evident. Last year, Push researchers analyzed a data set of 300,000 accounts from our customer base and found that:",{"data":44348,"content":44349,"nodeType":1818},{},[44350,44369,44388],{"data":44351,"content":44352,"nodeType":1734},{},[44353],{"data":44354,"content":44355,"nodeType":881},{},[44356,44360,44365],{"data":44357,"marks":44358,"value":44359,"nodeType":865},{},[],"Organizations have ",{"data":44361,"marks":44362,"value":44364,"nodeType":865},{},[44363],{"type":902},"more apps and identities than they thought",{"data":44366,"marks":44367,"value":44368,"nodeType":865},{},[]," — an average of ~15 identities per employee and ~220 apps per organization.",{"data":44370,"content":44371,"nodeType":1734},{},[44372],{"data":44373,"content":44374,"nodeType":881},{},[44375,44379,44384],{"data":44376,"marks":44377,"value":44378,"nodeType":865},{},[],"Many accounts ",{"data":44380,"marks":44381,"value":44383,"nodeType":865},{},[44382],{"type":902},"lack basic security protections",{"data":44385,"marks":44386,"value":44387,"nodeType":865},{},[],", with 37% of accounts lacking any form of MFA and ~9% of accounts using a password that is leaked, weak, or reused, making them especially susceptible to account takeover. On accounts where password is the only login method in use (e.g. not using SSO or any other federated login like OIDC), there was no MFA in use in 4 out of 5 cases.",{"data":44389,"content":44390,"nodeType":1734},{},[44391],{"data":44392,"content":44393,"nodeType":881},{},[44394,44398,44403,44407,44414],{"data":44395,"marks":44396,"value":44397,"nodeType":865},{},[],"Security ",{"data":44399,"marks":44400,"value":44402,"nodeType":865},{},[44401],{"type":902},"gaps persist even with SSO",{"data":44404,"marks":44405,"value":44406,"nodeType":865},{},[]," accounts — with 10% of SSO-using accounts also having a local password, a risk for ",{"data":44408,"content":44409,"nodeType":876},{"uri":16924},[44410],{"data":44411,"marks":44412,"value":11122,"nodeType":865},{},[44413],{"type":874},{"data":44415,"marks":44416,"value":44417,"nodeType":865},{},[],"; and 1 in 5 IdP accounts themselves missing MFA.",{"data":44419,"content":44420,"nodeType":881},{},[44421],{"data":44422,"marks":44423,"value":44424,"nodeType":865},{},[],"From our perspective, organizations need scalable controls, and they need easy-to-deploy tools that get them visibility of all their workforce identities, apps, and accounts alongside telemetry that makes the information actionable.",{"data":44426,"content":44427,"nodeType":881},{},[44428],{"data":44429,"marks":44430,"value":44431,"nodeType":865},{},[],"Push already provides a real-time inventory of all your accounts and apps, including internal corporate apps, and analyzes the security posture, login methods, and MFA status of those accounts to offer a comprehensive picture of your identity attack surface. ",{"data":44433,"content":44434,"nodeType":881},{},[44435],{"data":44436,"marks":44437,"value":44438,"nodeType":865},{},[],"To help customers enforce their security policies even more seamlessly, here’s what we built last year:",{"data":44440,"content":44441,"nodeType":1860},{},[44442],{"data":44443,"marks":44444,"value":44446,"nodeType":865},{},[44445],{"type":902},"1. App banners",{"data":44448,"content":44449,"nodeType":881},{},[44450,44454,44464],{"data":44451,"marks":44452,"value":44453,"nodeType":865},{},[],"With a range of modes from informing to blocking, ",{"data":44455,"content":44457,"nodeType":876},{"uri":44456},"https://pushsecurity.com/help/10106#start",[44458],{"data":44459,"marks":44460,"value":44463,"nodeType":865},{},[44461,44462],{"type":874},{"type":902},"app banners",{"data":44465,"marks":44466,"value":44467,"nodeType":865},{},[]," allow security teams to communicate best practices and policies with end-users directly in their browser. It works by displaying a banner with your custom message on the login and signup pages for workplace apps. ",{"data":44469,"content":44470,"nodeType":881},{},[44471],{"data":44472,"marks":44473,"value":44474,"nodeType":865},{},[],"Using configuration rules, you can set conditions for how banner controls get applied. Common use cases include: Restricting use of GenAI software; carving out an exception for admins on a specific app; reminding users to log in with SSO instead of a password, and others. ",{"data":44476,"content":44480,"nodeType":890},{"target":44477},{"sys":44478},{"id":44479,"type":887,"linkType":888},"4RPHmeMLyZmb5V8rXYLtey",[],{"data":44482,"content":44483,"nodeType":1860},{},[44484,44489],{"data":44485,"marks":44486,"value":44488,"nodeType":865},{},[44487],{"type":902},"2. Password manager identification",{"data":44490,"marks":44491,"value":2091,"nodeType":865},{},[],{"data":44493,"content":44494,"nodeType":881},{},[44495,44499,44509],{"data":44496,"marks":44497,"value":44498,"nodeType":865},{},[],"We also expanded Push’s capability to observe employees’ account security posture by adding an identification of ",{"data":44500,"content":44502,"nodeType":876},{"uri":44501},"https://pushsecurity.com/blog/stop-users-saving-corp-creds-into-personal-password-managers/",[44503],{"data":44504,"marks":44505,"value":44508,"nodeType":865},{},[44506,44507],{"type":874},{"type":902},"which password manager",{"data":44510,"marks":44511,"value":44512,"nodeType":865},{},[]," (if any) they’re using. ",{"data":44514,"content":44515,"nodeType":881},{},[44516],{"data":44517,"marks":44518,"value":44519,"nodeType":865},{},[],"We’ve heard from many security teams that they’re concerned about corporate credentials being stored in unapproved password managers — not to mention the ROI from ensuring employees are all using the corporate password manager you already pay for. This feature helps them achieve both objectives.",{"data":44521,"content":44522,"nodeType":1860},{},[44523],{"data":44524,"marks":44525,"value":44527,"nodeType":865},{},[44526],{"type":902},"3. MFA enforcement",{"data":44529,"content":44530,"nodeType":881},{},[44531,44535,44545],{"data":44532,"marks":44533,"value":44534,"nodeType":865},{},[],"Finally, we rounded out 2024 with a new security control called ",{"data":44536,"content":44538,"nodeType":876},{"uri":44537},"https://pushsecurity.com/blog/enforce-mfa-on-third-party-apps/",[44539],{"data":44540,"marks":44541,"value":44544,"nodeType":865},{},[44542,44543],{"type":874},{"type":902},"MFA enforcement",{"data":44546,"marks":44547,"value":44548,"nodeType":865},{},[]," that builds on the popular app banners concept by detecting when users lack MFA and then prompting them to register for MFA. ",{"data":44550,"content":44551,"nodeType":881},{},[44552],{"data":44553,"marks":44554,"value":44555,"nodeType":865},{},[],"Admins choose which apps they wish to enforce MFA on, and the Push extension does the rest. ",{"data":44557,"content":44558,"nodeType":881},{},[44559],{"data":44560,"marks":44561,"value":44562,"nodeType":865},{},[],"Security teams we work with are especially eager to use this feature to close MFA coverage gaps on non-SSO and otherwise unmanaged applications.",{"data":44564,"content":44568,"nodeType":890},{"target":44565},{"sys":44566},{"id":44567,"type":887,"linkType":888},"4imhff7SWJi2Gan5iFEs2P",[],{"data":44570,"content":44571,"nodeType":894},{},[],{"data":44573,"content":44574,"nodeType":904},{},[44575],{"data":44576,"marks":44577,"value":44578,"nodeType":865},{},[],"Want to see more?",{"data":44580,"content":44581,"nodeType":881},{},[44582,44586,44593],{"data":44583,"marks":44584,"value":44585,"nodeType":865},{},[],"There’s a lot we didn’t touch on here that Push can help you achieve. If you’d like to learn more, ",{"data":44587,"content":44588,"nodeType":876},{"uri":6048},[44589],{"data":44590,"marks":44591,"value":44592,"nodeType":865},{},[],"set up a demo with our team",{"data":44594,"marks":44595,"value":44596,"nodeType":865},{},[]," or sign up yourself to have a look at the platform.","How real-world attacks and research drove Push’s most popular features of 2024","How in-the-wild attacks and our own R&D inspired what we built in 2024 to stop account takeover and reduce security risks across your workforce identities. ","2025-01-16T00:00:00.000Z","push-features-2024",{"items":44602},[44603,44605],{"sys":44604,"name":342},{"id":4510},{"sys":44606,"name":297},{"id":6385},{"items":44608},[44609],{"fullName":20080,"firstName":20081,"jobTitle":20082,"profilePicture":44610},{"url":20084},{"__typename":1485,"sys":44612,"content":44614,"title":45232,"synopsis":45233,"hashTags":59,"publishedDate":45234,"slug":45235,"tagsCollection":45236,"authorsCollection":45240},{"id":44613},"1pJdOGN0dOd3BKVqO4CxHh",{"json":44615},{"data":44616,"content":44617,"nodeType":1463},{},[44618,44625,44632,44639,44658,44665,44672,44675,44683,44690,44697,44704,44710,44717,44720,44728,44735,44742,44749,44756,44762,44769,44772,44780,44788,44795,44802,44809,44829,44837,44844,44851,44858,44865,44873,44880,44887,44893,44896,44904,44911,44918,44925,44932,44939,44942,44950,44957,44964,44971,44978,44985,45093,45109,45116,45122,45125,45133,45140,45207,45214],{"data":44619,"content":44620,"nodeType":881},{},[44621],{"data":44622,"marks":44623,"value":44624,"nodeType":865},{},[],"2024 was an unprecedented year in terms of the impact of identity-based attacks. Or that’s what it felt like anyway, so I decided to trawl through a year of news to see if reality stacked up. ",{"data":44626,"content":44627,"nodeType":881},{},[44628],{"data":44629,"marks":44630,"value":44631,"nodeType":865},{},[],"My main obstacles here were the ever-disappointing levels of public information disclosure for cyber breaches. Even where breaches are disclosed, it’s rare that any public information contains the nature of the initial access vector (though I can’t say I’m surprised — it’s hard to argue the ‘highly sophisticated’ nature of a breach that involved stolen credentials and no MFA). ",{"data":44633,"content":44634,"nodeType":881},{},[44635],{"data":44636,"marks":44637,"value":44638,"nodeType":865},{},[],"Publicly disclosed breaches are just the tip of the iceberg, and with the rise in data theft and extortion over more disruptive attacks (e.g. ransomware), there is often no obvious service interruption indicating that an incident has taken place. This makes it more likely that these situations can be settled quietly or smoothed over, without hitting the headlines. ",{"data":44640,"content":44641,"nodeType":881},{},[44642,44646,44655],{"data":44643,"marks":44644,"value":44645,"nodeType":865},{},[],"That said, the requirement that US companies submit a Form-8K for breaches of a material nature does appear to have increased the number of voluntary declarations (inside the US, at least) and the growing willingness of the SEC to prosecute negligent or misleading behavior is also a considerable motivator, such as ",{"data":44647,"content":44649,"nodeType":876},{"uri":44648},"https://www.bleepingcomputer.com/news/security/sec-charges-tech-companies-for-downplaying-solarwinds-breaches/",[44650],{"data":44651,"marks":44652,"value":44654,"nodeType":865},{},[44653],{"type":874},"the recent prosecution of companies for misleading investors about the impact of the 2020 SolarWinds Orion hack",{"data":44656,"marks":44657,"value":959,"nodeType":865},{},[],{"data":44659,"content":44660,"nodeType":881},{},[44661],{"data":44662,"marks":44663,"value":44664,"nodeType":865},{},[],"Despite all this, I totalled 30 breaches that were the result of an identity-based initial access vector, such as phishing, credential stuffing, social engineering, session hijacking, etc. To make the list, it had to have appeared in the public domain, confirmed by the victim or an authoritative source, and the breach vector had to have been named. ",{"data":44666,"content":44667,"nodeType":881},{},[44668],{"data":44669,"marks":44670,"value":44671,"nodeType":865},{},[],"Public identity-related breaches in 2024 resulted in hundreds of millions of breached customer records (with the final impact of many still yet to appear in the public domain).",{"data":44673,"content":44674,"nodeType":894},{},[],{"data":44676,"content":44677,"nodeType":904},{},[44678],{"data":44679,"marks":44680,"value":44682,"nodeType":865},{},[44681],{"type":902},"What is an identity attack?",{"data":44684,"content":44685,"nodeType":881},{},[44686],{"data":44687,"marks":44688,"value":44689,"nodeType":865},{},[],"First, what do we mean by identity attack? ",{"data":44691,"content":44692,"nodeType":881},{},[44693],{"data":44694,"marks":44695,"value":44696,"nodeType":865},{},[],"An identity attack is any attack (regardless of the steps that follow) involving identity-based techniques, such as phishing, credential stuffing, and session hijacking, to log into an account/service. Basically, where identity is the initial breach vector.",{"data":44698,"content":44699,"nodeType":881},{},[44700],{"data":44701,"marks":44702,"value":44703,"nodeType":865},{},[],"The length and complexity of the overall attack chain will vary. For example, a SaaS-based account takeover where the attacker logs in and dumps the data from the app is naturally going to be more direct than a scenario in which an identity-based compromise leads to the takeover of an endpoint or device in a traditional networking environment. ",{"data":44705,"content":44709,"nodeType":890},{"target":44706},{"sys":44707},{"id":44708,"type":887,"linkType":888},"SCbhb6dzXnaKUianhgLEL",[],{"data":44711,"content":44712,"nodeType":881},{},[44713],{"data":44714,"marks":44715,"value":44716,"nodeType":865},{},[],"In 2024, we’ve seen examples of both SaaS-based account takeover as well as identity attacks being used for initial access to more traditional networks, often resulting in ransomware deployment.",{"data":44718,"content":44719,"nodeType":894},{},[],{"data":44721,"content":44722,"nodeType":904},{},[44723],{"data":44724,"marks":44725,"value":44727,"nodeType":865},{},[44726],{"type":902},"Breakdown of public identity breaches in 2024",{"data":44729,"content":44730,"nodeType":881},{},[44731],{"data":44732,"marks":44733,"value":44734,"nodeType":865},{},[],"It’s always tricky to gauge the impact of a cyber breach, particularly when considering the limited information typically shared. Different types of breach are easier to assess than others — for example, any breach involving extortion/ransom payment has a clear cost associated. Regulator fines and penalties are also clear cut. But aside from these, you’re looking at the extent of any disruption/downtime, recovery costs, and the like. Long term, indirect impacts such as the loss of customer confidence are naturally tricky to estimate. ",{"data":44736,"content":44737,"nodeType":881},{},[44738],{"data":44739,"marks":44740,"value":44741,"nodeType":865},{},[],"However, many identity breaches don’t even have these metrics to go by. The general shift toward data theft only (as opposed to ransomware deployment) continued in 2024, and many of the public identity breaches reflect this. In these attacks, attackers steal data to extort a ransom payment, blackmail end-customers, and/or sell the data via underground criminal marketplaces. ",{"data":44743,"content":44744,"nodeType":881},{},[44745],{"data":44746,"marks":44747,"value":44748,"nodeType":865},{},[],"The one consistent metric we do have is the number of breached records, which is available in many (but not all) cases. Some organizations have attempted to calculate the financial impact per breached record. Most notably IBMs annual ‘Cost of a Data Breach’ report estimates the average data breach to cost $4.88m, and the cost per compromised record to be $169. But when applied to the sheer magnitude of 2024’s biggest attacks (in the region of hundreds of millions of breached records) the figures quickly reach unbelievable levels. ",{"data":44750,"content":44751,"nodeType":881},{},[44752],{"data":44753,"marks":44754,"value":44755,"nodeType":865},{},[],"All this is to say: It’s hard to pin down the relative impact of data breaches. But with the information available (profile of the victim organization, type of data impacted, number of customers impacted) it’s possible to provide a finger-in-the-air assessment — which is what I’ve attempted to do below. Here, we can see the overall month-by-month impact of public identity breaches, dated from when they were first reported (or using dates provided in said reports). ",{"data":44757,"content":44761,"nodeType":890},{"target":44758},{"sys":44759},{"id":44760,"type":887,"linkType":888},"2XYuNqLuKhZbISb4II9IW4",[],{"data":44763,"content":44764,"nodeType":881},{},[44765],{"data":44766,"marks":44767,"value":44768,"nodeType":865},{},[],"Let’s take a closer look at the most notable breaches (and why they were especially significant). ",{"data":44770,"content":44771,"nodeType":894},{},[],{"data":44773,"content":44774,"nodeType":904},{},[44775],{"data":44776,"marks":44777,"value":44779,"nodeType":865},{},[44778],{"type":902},"Top 3 public identity-related breaches in 2024",{"data":44781,"content":44782,"nodeType":1860},{},[44783],{"data":44784,"marks":44785,"value":44787,"nodeType":865},{},[44786],{"type":902},"#3: Microsoft — January 2024",{"data":44789,"content":44790,"nodeType":881},{},[44791],{"data":44792,"marks":44793,"value":44794,"nodeType":865},{},[],"The threat group known as APT29, associated with the Russian SVR intelligence service, utilized password spray attacks that successfully compromised a non-production tenant account that did not have multi-factor authentication (MFA) enabled. They then leveraged this account to compromise a ‘test’ OAuth application that had elevated access to the Microsoft corporate environment. This was then used to access the email accounts of Microsoft employees. ",{"data":44796,"content":44797,"nodeType":881},{},[44798],{"data":44799,"marks":44800,"value":44801,"nodeType":865},{},[],"The attacks then continued throughout the year using information stolen from Microsoft mailboxes, with password spraying attacks increasing tenfold since the initial attack, resulting in the further compromise of source code repositories. ",{"data":44803,"content":44804,"nodeType":881},{},[44805],{"data":44806,"marks":44807,"value":44808,"nodeType":865},{},[],"Microsoft has shared limited information about the breach, but despite this it caused a significant stir. We can expect the number of email accounts compromised to be significant, given that it was later suggested that at least 100 external organizations had been contacted by Microsoft regarding their communications being breached (we only know this because 100-ish organizations reported the email as spam). The list of companies impacted included both public and private sector organizations, from major enterprises to government agencies in the US and other countries. ",{"data":44810,"content":44811,"nodeType":881},{},[44812,44816,44825],{"data":44813,"marks":44814,"value":44815,"nodeType":865},{},[],"Microsoft’s challenges with credential management didn’t end here either, ",{"data":44817,"content":44819,"nodeType":876},{"uri":44818},"https://pushsecurity.com/blog/learning-from-the-servicenow-disclosure/",[44820],{"data":44821,"marks":44822,"value":44824,"nodeType":865},{},[44823],{"type":874},"with bug bounty hunters able to use stolen credentials from a TI platform to breach Microsoft’s ServiceNow tenant",{"data":44826,"marks":44827,"value":44828,"nodeType":865},{},[],", accessing 1,000s of support ticket descriptions and attachments, and 250k+ employee emails.",{"data":44830,"content":44831,"nodeType":1860},{},[44832],{"data":44833,"marks":44834,"value":44836,"nodeType":865},{},[44835],{"type":902},"#2: Change Healthcare — February 2024",{"data":44838,"content":44839,"nodeType":881},{},[44840],{"data":44841,"marks":44842,"value":44843,"nodeType":865},{},[],"In February, attackers stole 6TB of data from UnitedHealth subsidiary Change Healthcare as part of a severe ransomware attack that caused massive disruption to the US healthcare industry. This impacted a wide range of critical services used by healthcare providers across the U.S., including payment processing, prescription writing, and insurance claims, and caused financial damages estimated at $872 million. The attack impacted the personal medical data of over 100M customers. ",{"data":44845,"content":44846,"nodeType":881},{},[44847],{"data":44848,"marks":44849,"value":44850,"nodeType":865},{},[],"The attacker used stolen credentials to breach the company's Citrix remote access service, which did not have multi-factor authentication enabled, as the initial breach vector for the attack. ",{"data":44852,"content":44853,"nodeType":881},{},[44854],{"data":44855,"marks":44856,"value":44857,"nodeType":865},{},[],"Following the attack, the organization's IT team replaced thousands of laptops, rotated credentials, and completely rebuilt Change Healthcare's data center network and core services.",{"data":44859,"content":44860,"nodeType":881},{},[44861],{"data":44862,"marks":44863,"value":44864,"nodeType":865},{},[],"The UnitedHealth Group admitted to paying a ransom demand to receive a decryptor and for the threat actors to delete the stolen data. The ransom payment was allegedly $22 million, according to the BlackCat ransomware affiliate who conducted the attack.",{"data":44866,"content":44867,"nodeType":1860},{},[44868],{"data":44869,"marks":44870,"value":44872,"nodeType":865},{},[44871],{"type":902},"#1: Snowflake — April-June 2024",{"data":44874,"content":44875,"nodeType":881},{},[44876],{"data":44877,"marks":44878,"value":44879,"nodeType":865},{},[],"165 organizations around the world were targeted using stolen credentials gathered from infostealer infections dating back to 2020. The impacted accounts lacked MFA, meaning successful authentication only required a valid username and password. As the Snowflake credentials found in infostealer malware credential dumps had not been rotated or updated, they remained valid and could be used to authenticate to user accounts on Snowflake tenants belonging to various customers. It has been touted by some news outlets as ‘one of the biggest breaches ever’. ",{"data":44881,"content":44882,"nodeType":881},{},[44883],{"data":44884,"marks":44885,"value":44886,"nodeType":865},{},[],"In total, nine public victims were named following the breach, collectively impacting hundreds of millions of their respective customers. Data was put up for sale on criminal forums for fees ranging from $150k to $2m per organization, while AT&T was also confirmed as paying an undisclosed ransom fee. ",{"data":44888,"content":44892,"nodeType":890},{"target":44889},{"sys":44890},{"id":44891,"type":887,"linkType":888},"68txz4KkLmCX2hF9QySUZs",[],{"data":44894,"content":44895,"nodeType":894},{},[],{"data":44897,"content":44898,"nodeType":904},{},[44899],{"data":44900,"marks":44901,"value":44903,"nodeType":865},{},[44902],{"type":902},"Identity attacks vs. other attacks in 2024",{"data":44905,"content":44906,"nodeType":881},{},[44907],{"data":44908,"marks":44909,"value":44910,"nodeType":865},{},[],"In many ways, 2024 was a year of identity attacks. The attacks on Snowflake customers was unarguably one of (if not the most) significant cyber security event of the year (at least, if you exclude CrowdStrike causing a worldwide outage in July) — certainly, it was the largest perpetrated by a criminal group against commercial enterprises. ",{"data":44912,"content":44913,"nodeType":881},{},[44914],{"data":44915,"marks":44916,"value":44917,"nodeType":865},{},[],"Arguably the biggest non-identity story of the year was the Chinese state-sponsored “Salt Typhoon” campaign against global telecommunications firms, with at least nine major providers compromised — including AT&T, Verizon, and T-Mobile. The group reportedly focused on infiltrating telecommunications infrastructure to steal text messages, phone call information, and voicemails from targeted people. The threat actors also targeted the wiretapping platforms used by the US government, raising serious national security concerns.",{"data":44919,"content":44920,"nodeType":881},{},[44921],{"data":44922,"marks":44923,"value":44924,"nodeType":865},{},[],"Undoubtedly this was one of the biggest intelligence compromises in US history and is of major significance. But it’s also arguable that identity attacks had a more widespread commercial impact in 2024 when we look at the big picture.   ",{"data":44926,"content":44927,"nodeType":881},{},[44928],{"data":44929,"marks":44930,"value":44931,"nodeType":865},{},[],"Attacks on edge networking devices were also incredibly prominent, as were very much interlinked with the targeting of telecommunications infrastructure. A barrage of 0-days generated a huge amount of concern about the software security practices of many vendors. ",{"data":44933,"content":44934,"nodeType":881},{},[44935],{"data":44936,"marks":44937,"value":44938,"nodeType":865},{},[],"But despite these honorable mentions, the runaway threat of the year was an identity-based one… ",{"data":44940,"content":44941,"nodeType":894},{},[],{"data":44943,"content":44944,"nodeType":904},{},[44945],{"data":44946,"marks":44947,"value":44949,"nodeType":865},{},[44948],{"type":902},"Threat of the year: Infostealers",{"data":44951,"content":44952,"nodeType":881},{},[44953],{"data":44954,"marks":44955,"value":44956,"nodeType":865},{},[],"2024 saw an unprecedented rise in the role of infostealers. The played a huge role in the attacks on Snowflake customers, where 80% of the accounts were targeted using credentials found in infostealer infections. ",{"data":44958,"content":44959,"nodeType":881},{},[44960],{"data":44961,"marks":44962,"value":44963,"nodeType":865},{},[],"News relating to new infostealer variants and distributions campaigns came thick and fast in 2024, as attackers sought to harvest credentials from victims to use as part of their own malicious campaigns, or to sell on to other criminals on underground marketplaces for compromised credentials. Attackers leaned into alternative distribution channels, branching away from email-based campaigns to target victims via gaming forums, Facebook ads, and YouTube video descriptions. GitHub was also continuously targeted as a malware distribution mechanism throughout the year — and the majority of the time it was to push infostealers. ",{"data":44965,"content":44966,"nodeType":881},{},[44967],{"data":44968,"marks":44969,"value":44970,"nodeType":865},{},[],"Infostealers are the weapon of choice for attackers looking to harvest credentials at scale. Compared to credential harvesting phishing campaigns, infostealers target a much broader range of credentials, taking everything saved in the victim’s browser (and often also from local apps, including password managers).",{"data":44972,"content":44973,"nodeType":881},{},[44974],{"data":44975,"marks":44976,"value":44977,"nodeType":865},{},[],"Infostealers are nothing new, but have historically been seen as a problem affecting less secure personal devices and accounts. But 2024 has demonstrated that infostealers are finding ways to harvest business data — by finding ways around controls like EDR, and because of the ways that personal and business identities and accounts are converging in the modern workplace. For example, it’s not uncommon for employees to log into their personal Google account on their work device (and vice versa), inadvertently saving corporate credentials to their personal password store — which is later compromised through an infostealer infection on a personal device. ",{"data":44979,"content":44980,"nodeType":881},{},[44981],{"data":44982,"marks":44983,"value":44984,"nodeType":865},{},[],"The impact of infostealers (and the resulting stolen credentials and session cookies) is underlined by various figures:",{"data":44986,"content":44987,"nodeType":1818},{},[44988,45008,45030,45052,45072],{"data":44989,"content":44990,"nodeType":1734},{},[44991],{"data":44992,"content":44993,"nodeType":881},{},[44994,44998,45005],{"data":44995,"marks":44996,"value":44997,"nodeType":865},{},[],"79% of web application compromises were the result of breached credentials (",{"data":44999,"content":45000,"nodeType":876},{"uri":41391},[45001],{"data":45002,"marks":45003,"value":11582,"nodeType":865},{},[45004],{"type":874},{"data":45006,"marks":45007,"value":30302,"nodeType":865},{},[],{"data":45009,"content":45010,"nodeType":1734},{},[45011],{"data":45012,"content":45013,"nodeType":881},{},[45014,45018,45027],{"data":45015,"marks":45016,"value":45017,"nodeType":865},{},[],"Infostealer activity increased by 266% in 2023, while the number of attacks featuring valid credentials saw a 71% increase year-over-year (",{"data":45019,"content":45021,"nodeType":876},{"uri":45020},"https://www.ibm.com/downloads/cas/L0GKXDWJ",[45022],{"data":45023,"marks":45024,"value":45026,"nodeType":865},{},[45025],{"type":874},"IBM",{"data":45028,"marks":45029,"value":30302,"nodeType":865},{},[],{"data":45031,"content":45032,"nodeType":1734},{},[45033],{"data":45034,"content":45035,"nodeType":881},{},[45036,45040,45049],{"data":45037,"marks":45038,"value":45039,"nodeType":865},{},[],"Nearly half of the malware detected last year targeted victims’ data specifically, and the majority of that malware was classified as infostealers (",{"data":45041,"content":45043,"nodeType":876},{"uri":45042},"https://news.sophos.com/en-us/2024/03/12/2024-sophos-threat-report/",[45044],{"data":45045,"marks":45046,"value":45048,"nodeType":865},{},[45047],{"type":874},"Sophos",{"data":45050,"marks":45051,"value":30302,"nodeType":865},{},[],{"data":45053,"content":45054,"nodeType":1734},{},[45055],{"data":45056,"content":45057,"nodeType":881},{},[45058,45062,45069],{"data":45059,"marks":45060,"value":45061,"nodeType":865},{},[],"39,000 session token attacks are detected per day (",{"data":45063,"content":45064,"nodeType":876},{"uri":43794},[45065],{"data":45066,"marks":45067,"value":1718,"nodeType":865},{},[45068],{"type":874},{"data":45070,"marks":45071,"value":30302,"nodeType":865},{},[],{"data":45073,"content":45074,"nodeType":1734},{},[45075],{"data":45076,"content":45077,"nodeType":881},{},[45078,45082,45090],{"data":45079,"marks":45080,"value":45081,"nodeType":865},{},[],"Attacks on session cookies happen at the same rough order of magnitude as password-based attacks (",{"data":45083,"content":45085,"nodeType":876},{"uri":45084},"https://github.com/WICG/dbsc/issues/13#issuecomment-1977657864",[45086],{"data":45087,"marks":45088,"value":36131,"nodeType":865},{},[45089],{"type":874},{"data":45091,"marks":45092,"value":30302,"nodeType":865},{},[],{"data":45094,"content":45095,"nodeType":881},{},[45096,45100,45105],{"data":45097,"marks":45098,"value":45099,"nodeType":865},{},[],"And of the confirmed identity-based breaches in the public domain that we identified, ",{"data":45101,"marks":45102,"value":45104,"nodeType":865},{},[45103],{"type":902},"a whopping 73% were the result of compromised credentials ",{"data":45106,"marks":45107,"value":45108,"nodeType":865},{},[],"(the rest were phishing attacks). ",{"data":45110,"content":45111,"nodeType":881},{},[45112],{"data":45113,"marks":45114,"value":45115,"nodeType":865},{},[],"As the primary source of compromised credentials, it’s fair to say that infostealers deserve the top spot for 2024.",{"data":45117,"content":45121,"nodeType":890},{"target":45118},{"sys":45119},{"id":45120,"type":887,"linkType":888},"7mMQEYQTXKAajIGFviDJKt",[],{"data":45123,"content":45124,"nodeType":894},{},[],{"data":45126,"content":45127,"nodeType":904},{},[45128],{"data":45129,"marks":45130,"value":45132,"nodeType":865},{},[45131],{"type":902},"Defend against infostealers with Push",{"data":45134,"content":45135,"nodeType":881},{},[45136],{"data":45137,"marks":45138,"value":45139,"nodeType":865},{},[],"As a browser-based identity security platform designed to stop identity attacks, Push helps organizations to defend against the rise in infostealers by:",{"data":45141,"content":45142,"nodeType":1818},{},[45143,45176,45197],{"data":45144,"content":45145,"nodeType":1734},{},[45146],{"data":45147,"content":45148,"nodeType":881},{},[45149,45152,45160,45164,45172],{"data":45150,"marks":45151,"value":21,"nodeType":865},{},[],{"data":45153,"content":45154,"nodeType":876},{"uri":44305},[45155],{"data":45156,"marks":45157,"value":45159,"nodeType":865},{},[45158],{"type":874},"Alerting you whenever the valid credentials your employees are using appear in a compromised credential data feed",{"data":45161,"marks":45162,"value":45163,"nodeType":865},{},[],", which can be leveraged to ",{"data":45165,"content":45166,"nodeType":876},{"uri":43731},[45167],{"data":45168,"marks":45169,"value":45171,"nodeType":865},{},[45170],{"type":874},"trigger automated password resets",{"data":45173,"marks":45174,"value":45175,"nodeType":865},{},[]," whenever an event fires and is received by your SIEM tool.",{"data":45177,"content":45178,"nodeType":1734},{},[45179],{"data":45180,"content":45181,"nodeType":881},{},[45182,45185,45193],{"data":45183,"marks":45184,"value":21,"nodeType":865},{},[],{"data":45186,"content":45187,"nodeType":876},{"uri":44147},[45188],{"data":45189,"marks":45190,"value":45192,"nodeType":865},{},[45191],{"type":874},"Detecting session hijacking attacks using stolen cookies to identify when an attacker logs into an app",{"data":45194,"marks":45195,"value":45196,"nodeType":865},{},[]," from an unmanaged device without the Push browser extension — this can also be used to detect suspicious access in general!",{"data":45198,"content":45199,"nodeType":1734},{},[45200],{"data":45201,"content":45202,"nodeType":881},{},[45203],{"data":45204,"marks":45205,"value":45206,"nodeType":865},{},[],"Enabling you to enforce MFA the next time an employee logs into an app (even when the app itself doesn’t allow you to enforce mandatory MFA) — particularly handy if a weak, breached, or reused password is detected for their account!  ",{"data":45208,"content":45209,"nodeType":881},{},[45210],{"data":45211,"marks":45212,"value":45213,"nodeType":865},{},[],"And much, much more. ",{"data":45215,"content":45216,"nodeType":881},{},[45217,45221,45229],{"data":45218,"marks":45219,"value":45220,"nodeType":865},{},[],"If you’d like to explore the platform yourself and discover more of our great features, you can ",{"data":45222,"content":45223,"nodeType":876},{"uri":1453},[45224],{"data":45225,"marks":45226,"value":45228,"nodeType":865},{},[45227],{"type":874},"request a demo",{"data":45230,"marks":45231,"value":959,"nodeType":865},{},[],"Looking back on identity-based breaches in 2024","Reviewing public breaches that stemmed from identity attacks in 2024. ","2025-01-10T00:00:00.000Z","2024-identity-breaches",{"items":45237},[45238],{"sys":45239,"name":4507},{"id":4506},{"items":45241},[45242],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":45243},{"url":5377},{"__typename":1485,"sys":45245,"content":45247,"title":45862,"synopsis":45863,"hashTags":59,"publishedDate":45864,"slug":45865,"tagsCollection":45866,"authorsCollection":45872},{"id":45246},"SiALa9w13C6q3OzeTeUum",{"json":45248},{"data":45249,"content":45250,"nodeType":1463},{},[45251,45258,45274,45281,45287,45294,45301,45304,45311,45318,45325,45348,45355,45371,45374,45381,45388,45411,45418,45425,45443,45449,45456,45475,45481,45488,45534,45542,45549,45561,45573,45580,45613,45620,45623,45630,45650,45657,45664,45671,45674,45681,45689,45696,45703,45766,45773,45780,45787,45820,45826,45833,45840,45846],{"data":45252,"content":45253,"nodeType":881},{},[45254],{"data":45255,"marks":45256,"value":45257,"nodeType":865},{},[],"Computer-Using Agents (CUAs) are a new type of AI agent that drives your browser/OS for you. With the research preview release of OpenAI Operator last week, it’s likely that we’ll be seeing a lot more of this technology in the future as OpenAI iterates and competitors launch their own versions. ",{"data":45259,"content":45260,"nodeType":881},{},[45261,45265,45270],{"data":45262,"marks":45263,"value":45264,"nodeType":865},{},[],"These models run on the same UI as the user sees, rather than using code or API based add-ons or tools (e.g. with access via API keys). In Operator’s case, the agent runs in its own browser, where it can navigate to and interact with webpages by typing, clicking, and scrolling. It effectively sees and interacts with pages as a human would, ",{"data":45266,"marks":45267,"value":45269,"nodeType":865},{},[45268],{"type":902},"using human (not machine) identities",{"data":45271,"marks":45272,"value":45273,"nodeType":865},{},[]," — taking actions on the web without requiring custom API integrations. ",{"data":45275,"content":45276,"nodeType":881},{},[45277],{"data":45278,"marks":45279,"value":45280,"nodeType":865},{},[],"This means that a user describes a task, and Operator performs it autonomously on their behalf. The examples provided by OpenAI are things like booking a dinner reservation or shopping for groceries — but naturally the potential use cases are much, much broader, especially in a work context.",{"data":45282,"content":45286,"nodeType":890},{"target":45283},{"sys":45284},{"id":45285,"type":887,"linkType":888},"5mWWi5mfqEcSQX12gOtyQm",[],{"data":45288,"content":45289,"nodeType":881},{},[45290],{"data":45291,"marks":45292,"value":45293,"nodeType":865},{},[],"Obviously the broad impact of this technology is almost impossible to predict this early in the game. But since we’re focussed on identity security at Push, we can at least describe some of the very predictable impacts in this area.",{"data":45295,"content":45296,"nodeType":881},{},[45297],{"data":45298,"marks":45299,"value":45300,"nodeType":865},{},[],"CUAs like Operator are essentially very flexible no-code automation platforms. This means that these tools (or future iterations of them) will enable low-cost, low-effort automation of common web tasks — the very tasks that app developers and vendors have worked hard to prevent from being automated — including those frequently performed by attackers.",{"data":45302,"content":45303,"nodeType":894},{},[],{"data":45305,"content":45306,"nodeType":904},{},[45307],{"data":45308,"marks":45309,"value":45310,"nodeType":865},{},[],"Why do CUAs stand to benefit attackers more than previous AI tools? ",{"data":45312,"content":45313,"nodeType":881},{},[45314],{"data":45315,"marks":45316,"value":45317,"nodeType":865},{},[],"Organizations have been concerned about the security and privacy implications of GenAI tools and platforms for a while now — mainly concerning the risk of inputting sensitive data into LLMs, and prompt injection attacks in which models can be tricked into disclosing internal data. ",{"data":45319,"content":45320,"nodeType":881},{},[45321],{"data":45322,"marks":45323,"value":45324,"nodeType":865},{},[],"But so far, the primary impact of GenAI on attacker capabilities specifically has been mainly limited to the use of LLMs for the creation of phishing emails and in AI-assisted malware development — no doubt significant, but not exactly transformative. And although the concept of an AI agent is nothing new, they haven’t been particularly common outside of research circles. ",{"data":45326,"content":45327,"nodeType":881},{},[45328,45332,45337,45340,45345],{"data":45329,"marks":45330,"value":45331,"nodeType":865},{},[],"CUAs, on the other hand, use LLMs trained using datasets which make them far more able to understand and interact with web pages. Coupled with what is essentially a production-grade integration between browser and LLM, and you have an agent that is able to understand and interact with websites to achieve an outcome, with minimal human input and oversight (as opposed to simply scraping the data) ",{"data":45333,"marks":45334,"value":45336,"nodeType":865},{},[45335],{"type":902},"with much the same behaviors and capabilities",{"data":45338,"marks":45339,"value":2091,"nodeType":865},{},[],{"data":45341,"marks":45342,"value":45344,"nodeType":865},{},[45343],{"type":902},"as a human operator.",{"data":45346,"marks":45347,"value":2862,"nodeType":865},{},[],{"data":45349,"content":45350,"nodeType":881},{},[45351],{"data":45352,"marks":45353,"value":45354,"nodeType":865},{},[],"By performing actions autonomously on the user’s behalf, it has a lot in common with a low/no-code automation platform like Zapier or Make.com — except it doesn’t perform actions via API, but by performing actions in the browser as a user would. Unlike no/low-code automations, it doesn’t need a strict or rigid step-by-step description of tasks that should be automated and can dynamically generate steps like a human does. ",{"data":45356,"content":45357,"nodeType":881},{},[45358,45362,45367],{"data":45359,"marks":45360,"value":45361,"nodeType":865},{},[],"None of this can’t be done using other automation tools, but it’s the difference between writing code to automate a task by hand and asking a human assistant to do something for you — ",{"data":45363,"marks":45364,"value":45366,"nodeType":865},{},[45365],{"type":902},"the effort required is reduced by orders of magnitude.",{"data":45368,"marks":45369,"value":45370,"nodeType":865},{},[]," This makes it both more flexible and accessible to a much wider range of users. ",{"data":45372,"content":45373,"nodeType":894},{},[],{"data":45375,"content":45376,"nodeType":904},{},[45377],{"data":45378,"marks":45379,"value":45380,"nodeType":865},{},[],"How can CUAs be abused by attackers?",{"data":45382,"content":45383,"nodeType":881},{},[45384],{"data":45385,"marks":45386,"value":45387,"nodeType":865},{},[],"There are two main groups of attack to be aware of:",{"data":45389,"content":45390,"nodeType":1818},{},[45391,45401],{"data":45392,"content":45393,"nodeType":1734},{},[45394],{"data":45395,"content":45396,"nodeType":881},{},[45397],{"data":45398,"marks":45399,"value":45400,"nodeType":865},{},[],"Attacks enabled by the technology (CUA)",{"data":45402,"content":45403,"nodeType":1734},{},[45404],{"data":45405,"content":45406,"nodeType":881},{},[45407],{"data":45408,"marks":45409,"value":45410,"nodeType":865},{},[],"Attacks against specific CUA tools/implementations (e.g. Operator)",{"data":45412,"content":45413,"nodeType":881},{},[45414],{"data":45415,"marks":45416,"value":45417,"nodeType":865},{},[],"Because the answer to the latter question is subjective depending on the CUA being targeted (and Operator is still in its “research preview” release) we’ll focus on how attackers can potentially use CUAs for malicious purposes in general. ",{"data":45419,"content":45420,"nodeType":1860},{},[45421],{"data":45422,"marks":45423,"value":45424,"nodeType":865},{},[],"How attackers can use their own CUAs to conduct AI-powered cyber attacks",{"data":45426,"content":45427,"nodeType":881},{},[45428,45432,45440],{"data":45429,"marks":45430,"value":45431,"nodeType":865},{},[],"The most obvious use-case for an attacker-controlled CUA is targeting internet-based app accounts. Most organizations are now using hundreds of apps, with thousands of sprawling identities (including both inside enterprise SSO connected accounts and local username & password logins) — ",{"data":45433,"content":45434,"nodeType":876},{"uri":30250},[45435],{"data":45436,"marks":45437,"value":45439,"nodeType":865},{},[45438],{"type":874},"many of which are highly vulnerable to even low-sophistication attack techniques",{"data":45441,"marks":45442,"value":1032,"nodeType":865},{},[],{"data":45444,"content":45448,"nodeType":890},{"target":45445},{"sys":45446},{"id":45447,"type":887,"linkType":888},"7itjimRwqpkrCF7YRI8FTq",[],{"data":45450,"content":45451,"nodeType":881},{},[45452],{"data":45453,"marks":45454,"value":45455,"nodeType":865},{},[],"Previously, identity attacks against modern SaaS environments and the sprawl of apps and accounts required a lot of manual work to scale. Because web identities are implemented in mostly bespoke ways across thousands of sites (and they are constantly changing) attacks on them are challenging to automate. Further, the act of logging in using automated methods has been impacted by widespread bot protection — specifically to prevent malicious automation. ",{"data":45457,"content":45458,"nodeType":881},{},[45459,45463,45471],{"data":45460,"marks":45461,"value":45462,"nodeType":865},{},[],"So, attackers end up sending phishing links through email, and targeting only a few high value apps for cred stuffing — despite the availability of credentials online (which, ",{"data":45464,"content":45465,"nodeType":876},{"uri":11103},[45466],{"data":45467,"marks":45468,"value":45470,"nodeType":865},{},[45469],{"type":874},"as the Snowflake attacks demonstrate",{"data":45472,"marks":45473,"value":45474,"nodeType":865},{},[],", can be an untapped treasure trove for attackers).",{"data":45476,"content":45480,"nodeType":890},{"target":45477},{"sys":45478},{"id":45479,"type":887,"linkType":888},"24HV5O6LJ12ZVECTSel2WL",[],{"data":45482,"content":45483,"nodeType":881},{},[45484],{"data":45485,"marks":45486,"value":45487,"nodeType":865},{},[],"We know that about 1 in 3 users re-use passwords, so there is a great chance a lot of those exact same credentials were actually valid for many other apps. It’s very tough to manually test each credential by logging into even a few dozen apps (or building a web automation to do so). But this is significantly easier if you can ask a CUA to: ",{"data":45489,"content":45490,"nodeType":1818},{},[45491,45501,45511],{"data":45492,"content":45493,"nodeType":1734},{},[45494],{"data":45495,"content":45496,"nodeType":881},{},[45497],{"data":45498,"marks":45499,"value":45500,"nodeType":865},{},[],"“Find a list of the top 1000 SaaS apps”. ",{"data":45502,"content":45503,"nodeType":1734},{},[45504],{"data":45505,"content":45506,"nodeType":881},{},[45507],{"data":45508,"marks":45509,"value":45510,"nodeType":865},{},[],"“Try to login to the app using this username and password. Let me know which apps you successfully logged into”. ",{"data":45512,"content":45513,"nodeType":1734},{},[45514],{"data":45515,"content":45516,"nodeType":881},{},[45517,45521,45530],{"data":45518,"marks":45519,"value":45520,"nodeType":865},{},[],"“Use ",{"data":45522,"content":45524,"nodeType":876},{"uri":45523},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/takeout_services/description.md",[45525],{"data":45526,"marks":45527,"value":45529,"nodeType":865},{},[45528],{"type":874},"takeout services",{"data":45531,"marks":45532,"value":45533,"nodeType":865},{},[]," to download data from each app and send it to this location, grouping by company name” (or even just ask the model to cut and paste or download the data from the account).",{"data":45535,"content":45536,"nodeType":881},{},[45537],{"data":45538,"marks":45539,"value":45541,"nodeType":865},{},[45540],{"type":902},"This is how you really scale these attacks.",{"data":45543,"content":45544,"nodeType":881},{},[45545],{"data":45546,"marks":45547,"value":45548,"nodeType":865},{},[],"CUA agents also change how and where phishing can take place. Where phishing takes place outside of email, it’s much less likely to be intercepted by enterprise anti-phishing controls. You could:",{"data":45550,"content":45551,"nodeType":881},{},[45552,45557],{"data":45553,"marks":45554,"value":45556,"nodeType":865},{},[45555],{"type":902},"1.",{"data":45558,"marks":45559,"value":45560,"nodeType":865},{},[]," Task an agent to create Reddit, Discord, and Slack accounts, login, and find the 100 (or 10000?) biggest subreddits/communities/channels. Now have it join those, and write posts that seem relevant to ongoing threads, or write targeted DMs and include links to a phishing page. If the account gets banned, no problem, automatically start over. Not enough karma? Instruct the agent to build karma.",{"data":45562,"content":45563,"nodeType":881},{},[45564,45569],{"data":45565,"marks":45566,"value":45568,"nodeType":865},{},[45567],{"type":902},"2.",{"data":45570,"marks":45571,"value":45572,"nodeType":865},{},[]," Or consider a more targeted scenario: connect to a specific target (or group of targets) via LinkedIn, read all your target’s posts and comments, and using that context start a conversation with them, using a topic you know that will interest them to create a phishing lure, and direct them to your phishing site. ",{"data":45574,"content":45575,"nodeType":1860},{},[45576],{"data":45577,"marks":45578,"value":45579,"nodeType":865},{},[],"Operator caveats",{"data":45581,"content":45582,"nodeType":881},{},[45583,45587,45596,45600,45609],{"data":45584,"marks":45585,"value":45586,"nodeType":865},{},[],"Now, it’s worth pointing out that Operator has controls that are designed to prevent this sort of abuse. ",{"data":45588,"content":45590,"nodeType":876},{"uri":45589},"https://openai.com/index/introducing-operator/",[45591],{"data":45592,"marks":45593,"value":45595,"nodeType":865},{},[45594],{"type":874},"For example",{"data":45597,"marks":45598,"value":45599,"nodeType":865},{},[],", Operator is trained to proactively ask the user to take over for tasks that require login, payment details, or when solving CAPTCHAs. The ",{"data":45601,"content":45603,"nodeType":876},{"uri":45602},"https://openai.com/index/operator-system-card/",[45604],{"data":45605,"marks":45606,"value":45608,"nodeType":865},{},[45607],{"type":874},"Operator System Card",{"data":45610,"marks":45611,"value":45612,"nodeType":865},{},[]," also cites proactive refusals of high-risk tasks, confirmation prompts before critical actions, and active monitoring systems to detect and mitigate potential threats.",{"data":45614,"content":45615,"nodeType":881},{},[45616],{"data":45617,"marks":45618,"value":45619,"nodeType":865},{},[],"It’s unclear at this point how resistant Operator will be to attack or abuse, but really, as we said earlier, this is not about Operator — once CUA tech becomes more widely available (if recent trends are anything to go by) there’s no doubt that models will emerge with fewer (or no) safety controls. ",{"data":45621,"content":45622,"nodeType":894},{},[],{"data":45624,"content":45625,"nodeType":904},{},[45626],{"data":45627,"marks":45628,"value":45629,"nodeType":865},{},[],"Why CUA-based automation is a problem for security teams",{"data":45631,"content":45632,"nodeType":881},{},[45633,45637,45646],{"data":45634,"marks":45635,"value":45636,"nodeType":865},{},[],"Attackers have been using automation tools forever, and in response, developers have been building protections against them (e.g. Cloudflare Turnstile and CAPTCHAs). Using LLMs to super power them isn’t even new, nor is using automation apps for malicious purposes (see our SaaS attack matrix entry for ",{"data":45638,"content":45640,"nodeType":876},{"uri":45639},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/shadow_workflows/description.md",[45641],{"data":45642,"marks":45643,"value":45645,"nodeType":865},{},[45644],{"type":874},"shadow workflows",{"data":45647,"marks":45648,"value":45649,"nodeType":865},{},[],") — so what’s the difference?",{"data":45651,"content":45652,"nodeType":881},{},[45653],{"data":45654,"marks":45655,"value":45656,"nodeType":865},{},[],"Previously, attackers needed to tie together automated browsers, get bot protection bypasses working, write code to extract screenshots from these browsers, pump those screenshots into a traditional LLM, generate response actions, and write code to execute those actions using browser automation. It was a lot of manual work — and needed constant maintenance — and wasn’t very effective because the general LLMs weren’t good at interpreting what they were seeing.",{"data":45658,"content":45659,"nodeType":881},{},[45660],{"data":45661,"marks":45662,"value":45663,"nodeType":865},{},[],"So, this isn’t so much a change in capability but a signal that there is going to be a massive increase in performance compared to other AI agents. Bundle the new model’s ability to understand with the ability to interact with webpages and you have something that might soon create real world impact at scale. ",{"data":45665,"content":45666,"nodeType":881},{},[45667],{"data":45668,"marks":45669,"value":45670,"nodeType":865},{},[],"Perhaps the only real obstacles are safety controls and cost. But as we’ve seen after previous GenAI launches, most recently with DeepSeek — competitors have been fast following with models that out-perform the original. Some of these models will be open and contain far fewer safety protections. An open CUA model in the future might be the trigger that enables attackers to leverage these capabilities at scale. ",{"data":45672,"content":45673,"nodeType":894},{},[],{"data":45675,"content":45676,"nodeType":904},{},[45677],{"data":45678,"marks":45679,"value":45680,"nodeType":865},{},[],"So what?",{"data":45682,"content":45683,"nodeType":881},{},[45684],{"data":45685,"marks":45686,"value":45688,"nodeType":865},{},[45687],{"type":902},"The TL;DR is that the adoption of CUAs has the potential to significantly lower the cost to attackers of running identity attacks such as phishing and credential stuffing, while increasing their reach.",{"data":45690,"content":45691,"nodeType":881},{},[45692],{"data":45693,"marks":45694,"value":45695,"nodeType":865},{},[],"We can expect improved account takeover attacks in the future as this technology becomes more widespread, with phishing attacks being increasingly delivered outside of traditional (well-protected) mediums like email, and credential stuffing being weaponized on an even more widespread scale, across a broader range of apps. These capabilities will also become more accessible, with even less advanced attackers able to harness them.",{"data":45697,"content":45698,"nodeType":881},{},[45699],{"data":45700,"marks":45701,"value":45702,"nodeType":865},{},[],"Right now, Operator runs in a sandboxed browser environment. But going forward, more value will require an increased ability to perform authenticated access as the user — so one could imagine a world where new features are built to expose passwords into this sandbox — or that these agents will be enabled outside these sandboxes and operate in your browser (primarily) or directly on your OS using agents. We’ve already seen these agents implemented as browser extensions. This makes sense as extensions can see the tab, and interact with the page — and some early extension-based agents have existed for a while:",{"data":45704,"content":45705,"nodeType":1818},{},[45706,45726,45746],{"data":45707,"content":45708,"nodeType":1734},{},[45709],{"data":45710,"content":45711,"nodeType":881},{},[45712,45715,45723],{"data":45713,"marks":45714,"value":21,"nodeType":865},{},[],{"data":45716,"content":45718,"nodeType":876},{"uri":45717},"https://github.com/richardyc/Chrome-GPT",[45719],{"data":45720,"marks":45721,"value":45717,"nodeType":865},{},[45722],{"type":874},{"data":45724,"marks":45725,"value":2862,"nodeType":865},{},[],{"data":45727,"content":45728,"nodeType":1734},{},[45729],{"data":45730,"content":45731,"nodeType":881},{},[45732,45735,45743],{"data":45733,"marks":45734,"value":21,"nodeType":865},{},[],{"data":45736,"content":45738,"nodeType":876},{"uri":45737},"https://github.com/handrew/browserpilot",[45739],{"data":45740,"marks":45741,"value":45737,"nodeType":865},{},[45742],{"type":874},{"data":45744,"marks":45745,"value":21,"nodeType":865},{},[],{"data":45747,"content":45748,"nodeType":1734},{},[45749],{"data":45750,"content":45751,"nodeType":881},{},[45752,45755,45763],{"data":45753,"marks":45754,"value":21,"nodeType":865},{},[],{"data":45756,"content":45758,"nodeType":876},{"uri":45757},"https://github.com/TaxyAI/browser-extension",[45759],{"data":45760,"marks":45761,"value":45757,"nodeType":865},{},[45762],{"type":874},{"data":45764,"marks":45765,"value":959,"nodeType":865},{},[],{"data":45767,"content":45768,"nodeType":881},{},[45769],{"data":45770,"marks":45771,"value":45772,"nodeType":865},{},[],"If we have agents operating on user endpoints, not in sandboxes, that means they will have access to all identities that are already authenticated, or that can be automatically authenticated (password manager autofills etc.). There’s nothing fundamentally stopping you from prompt-injecting a victim's CUA and tricking it into creating a malicious integration, or sending you an API key.",{"data":45774,"content":45775,"nodeType":1860},{},[45776],{"data":45777,"marks":45778,"value":45779,"nodeType":865},{},[],"So to summarize...",{"data":45781,"content":45782,"nodeType":881},{},[45783],{"data":45784,"marks":45785,"value":45786,"nodeType":865},{},[],"Organizations should anticipate an increase in identity attacks targeting web-based apps and services using techniques that can be amplified by CUAs such as phishing and credential stuffing. We recommend that organizations:",{"data":45788,"content":45789,"nodeType":1818},{},[45790,45800,45810],{"data":45791,"content":45792,"nodeType":1734},{},[45793],{"data":45794,"content":45795,"nodeType":881},{},[45796],{"data":45797,"marks":45798,"value":45799,"nodeType":865},{},[],"Anticipate an increase in phishing attacks delivered outside of email, and evaluate your detection capabilities for mediums such as IM platforms and social media sites.",{"data":45801,"content":45802,"nodeType":1734},{},[45803],{"data":45804,"content":45805,"nodeType":881},{},[45806],{"data":45807,"marks":45808,"value":45809,"nodeType":865},{},[],"Find and harden identities that could be vulnerable to attacks using techniques that can be automated (e.g. mass credential stuffing) such as those missing phishing resistant MFA (or MFA altogether).",{"data":45811,"content":45812,"nodeType":1734},{},[45813],{"data":45814,"content":45815,"nodeType":881},{},[45816],{"data":45817,"marks":45818,"value":45819,"nodeType":865},{},[],"Ensure that all identities are suitably protected — even those outside the scope of traditional identity stores (such as Active Directory and modern equivalents e.g. Entra, Okta) used to access the much broader set of web-based services. ",{"data":45821,"content":45822,"nodeType":1860},{},[45823],{"data":45824,"marks":45825,"value":5936,"nodeType":865},{},[],{"data":45827,"content":45828,"nodeType":881},{},[45829],{"data":45830,"marks":45831,"value":45832,"nodeType":865},{},[],"AI-powered or not, identity attacks are what Push is designed to combat. Our features and controls designed to stop account takeover via phishing, credential stuffing, and session hijacking remain effective in this new world — in fact, as attackers are granted the ability to conduct these attacks with greater speed and scale, they become more valuable than ever. ",{"data":45834,"content":45835,"nodeType":881},{},[45836],{"data":45837,"marks":45838,"value":45839,"nodeType":865},{},[],"If you're interested in learning more, check out our on-demand webinar where we demonstrate the use of CUAs for automating identity attacks, particularly in the context of SaaS account takeover. ",{"data":45841,"content":45845,"nodeType":890},{"target":45842},{"sys":45843},{"id":45844,"type":887,"linkType":888},"UCmd5kqVZ03ce5Cs9M0r5",[],{"data":45847,"content":45848,"nodeType":881},{},[45849,45853,45859],{"data":45850,"marks":45851,"value":45852,"nodeType":865},{},[],"If you’d like to learn more about Push, ",{"data":45854,"content":45855,"nodeType":876},{"uri":6048},[45856],{"data":45857,"marks":45858,"value":44592,"nodeType":865},{},[],{"data":45860,"marks":45861,"value":44596,"nodeType":865},{},[],"Considering the security implications of Computer-Using Agents (like OpenAI Operator)","CUAs are a new type of AI agent that drives your browser/OS for you, enabling effortless automation of web tasks — including those performed by attackers.","2025-01-28T00:00:00.000Z","considering-the-impact-of-computer-using-agents",{"items":45867},[45868,45870],{"sys":45869,"name":4507},{"id":4506},{"sys":45871,"name":297},{"id":6385},{"items":45873},[45874],{"fullName":32651,"firstName":32652,"jobTitle":32653,"profilePicture":45875},{"url":32655},"minimum-viable-identity-security","blog/minimum-viable-identity-security","8 ways app developers can go beyond MVSP to mitigate identity-based attacks",{"json":45880},{"data":45881,"content":45882,"nodeType":1463},{},[45883],{"data":45884,"content":45885,"nodeType":881},{},[45886],{"data":45887,"marks":45888,"value":45889,"nodeType":865},{},[],"How app developers can go beyond the Minimum Viable Secure Product (MVSP) controls framework to implement better identity protections and prevent identity-based attacks. ","How app developers can go beyond Minimum Viable Secure Product (MVSP) to implement better identity protections and prevent identity-based attacks. ",{"id":45892,"publishedAt":45893},"1VGP8VIzwMh0zjNOzU5qaq","2026-08-13T09:35:15.589Z",{"items":45895},[45896,45898],{"sys":45897,"name":297},{"id":6385},{"sys":45899,"name":342},{"id":4510},{"items":45901},[45902,45904,45906,45908,45910,45912,45914,45916,45918,45920,45922,45924,45926,45928,45930],{"sys":45903,"name":413,"slug":414,"tier":31},{"id":410},{"sys":45905,"name":545,"slug":546,"tier":31},{"id":542},{"sys":45907,"name":297,"slug":298,"tier":31},{"id":294},{"sys":45909,"name":342,"slug":343,"tier":31},{"id":339},{"sys":45911,"name":502,"slug":503,"tier":45},{"id":499},{"sys":45913,"name":457,"slug":458,"tier":45},{"id":454},{"sys":45915,"name":395,"slug":396,"tier":45},{"id":392},{"sys":45917,"name":571,"slug":572,"tier":45},{"id":568},{"sys":45919,"name":333,"slug":334,"tier":45},{"id":330},{"sys":45921,"name":466,"slug":467,"tier":45},{"id":463},{"sys":45923,"name":493,"slug":494,"tier":45},{"id":490},{"sys":45925,"name":484,"slug":485,"tier":45},{"id":481},{"sys":45927,"name":404,"slug":405,"tier":45},{"id":401},{"sys":45929,"name":324,"slug":325,"tier":45},{"id":321},{"sys":45931,"name":598,"slug":599,"tier":45},{"id":595},"36eBiMftHHKz8mXIjsEN0ybWULXePeHjkaI21BYrWJE",{"id":45934,"title":45935,"authorsCollection":45936,"content":45941,"extension":228,"faqItemsCollection":47195,"faqTitle":59,"featured":6,"hashTags":59,"meta":47197,"metaTitle":47198,"ogImage":59,"postType":33230,"publishedDate":47199,"relatedBlogPostsCollection":47200,"slug":48806,"stem":48807,"subtitle":59,"summary":48808,"synopsis":48819,"sys":48820,"tagsCollection":48822,"topicsCollection":48828,"__hash__":48858},"blog/blog/guide-to-secure-browser-extension-deployment.json","Guide to secure browser extension deployment",{"items":45937},[45938],{"fullName":32651,"firstName":32652,"jobTitle":32653,"socialLinks":45939,"profilePicture":45940},[32737],{"url":32655},{"json":45942,"links":47168},{"data":45943,"content":45944,"nodeType":1463},{},[45945,45952,45955,45962,45969,46002,46009,46012,46019,46039,46071,46078,46085,46088,46095,46102,46109,46132,46139,46146,46149,46156,46163,46170,46177,46184,46191,46198,46205,46212,46219,46252,46259,46266,46269,46276,46283,46289,46296,46329,46336,46339,46346,46353,46360,46383,46390,46397,46404,46411,46418,46425,46432,46439,46472,46515,46522,46529,46536,46543,46550,46557,46564,46612,46618,46638,46645,46678,46685,46691,46694,46701,46708,46715,46722,46729,46736,46743,46750,46757,46760,46767,46774,46781,46788,46808,46815,46822,46855,46862,46869,46876,46883,46890,46956,46959,46966,46973,47016,47019,47025,47032,47052,47059,47066,47073,47076,47083,47090,47097,47117,47124,47131,47138,47145,47152],{"data":45946,"content":45947,"nodeType":881},{},[45948],{"data":45949,"marks":45950,"value":45951,"nodeType":865},{},[],"Inline with what was targeted in this campaign, our focus here is on the extension deployment process. All browser vendors stand to benefit from greater security in this area — we hope that sharing what we’ve learned is useful, and look forward to comments and feedback so we can collectively reduce the scope for attacks on browser extensions in the future. ",{"data":45953,"content":45954,"nodeType":894},{},[],{"data":45956,"content":45957,"nodeType":904},{},[45958],{"data":45959,"marks":45960,"value":45961,"nodeType":865},{},[],"TL;DR",{"data":45963,"content":45964,"nodeType":881},{},[45965],{"data":45966,"marks":45967,"value":45968,"nodeType":865},{},[],"In this blog, we’ll start with some background and walk through the “why” before discussing the key improvements that we feel are needed. But if you don’t care about the why or just want to cut to the chase, the key parts of defending against these attacks are:",{"data":45970,"content":45971,"nodeType":1818},{},[45972,45982,45992],{"data":45973,"content":45974,"nodeType":1734},{},[45975],{"data":45976,"content":45977,"nodeType":881},{},[45978],{"data":45979,"marks":45980,"value":45981,"nodeType":865},{},[],"Disable always-on access for all users to the browser extension store developer portals — you need to automate deployments through CI/CD to enable this.",{"data":45983,"content":45984,"nodeType":1734},{},[45985],{"data":45986,"content":45987,"nodeType":881},{},[45988],{"data":45989,"marks":45990,"value":45991,"nodeType":865},{},[],"Implement a multiparty approval process for extension deployments.",{"data":45993,"content":45994,"nodeType":1734},{},[45995],{"data":45996,"content":45997,"nodeType":881},{},[45998],{"data":45999,"marks":46000,"value":46001,"nodeType":865},{},[],"Secure your admin identities.",{"data":46003,"content":46004,"nodeType":881},{},[46005],{"data":46006,"marks":46007,"value":46008,"nodeType":865},{},[],"For details of how to do this practically, skip ahead to the “Recommended security architecture” section.",{"data":46010,"content":46011,"nodeType":894},{},[],{"data":46013,"content":46014,"nodeType":904},{},[46015],{"data":46016,"marks":46017,"value":46018,"nodeType":865},{},[],"Background: The Cyberhaven incident",{"data":46020,"content":46021,"nodeType":881},{},[46022,46026,46035],{"data":46023,"marks":46024,"value":46025,"nodeType":865},{},[],"In December 2024, a campaign targeting browser extension developers was launched, and succeeded in compromising at least ",{"data":46027,"content":46029,"nodeType":876},{"uri":46028},"https://www.bleepingcomputer.com/news/security/new-details-reveal-how-hackers-hijacked-35-google-chrome-extensions/",[46030],{"data":46031,"marks":46032,"value":46034,"nodeType":865},{},[46033],{"type":874},"35 Google Chrome extensions",{"data":46036,"marks":46037,"value":46038,"nodeType":865},{},[],". Cyberhaven’s extension was the most notable of these, and the campaign has inherited their name.",{"data":46040,"content":46041,"nodeType":881},{},[46042,46046,46054,46058,46067],{"data":46043,"marks":46044,"value":46045,"nodeType":865},{},[],"The campaign targeted extension devs through the support email address listed on the extension stores, but notably, the ",{"data":46047,"content":46048,"nodeType":876},{"uri":18095},[46049],{"data":46050,"marks":46051,"value":46053,"nodeType":865},{},[46052],{"type":874},"consent phishing attack technique",{"data":46055,"marks":46056,"value":46057,"nodeType":865},{},[]," was used. While not a new technique, it has rarely been seen — especially given how powerful it is. Rather than a traditional credential and MFA phishing attacks which harvest credentials (or session tokens to bypass MFA), with consent phishing the attacker's goal is to trick the victim into granting them an OAuth token to perform actions on their behalf. In this case the permission or scope used by the attacker granted that token the ability to upload and publish new versions of the victim’s extension to the Chrome Web Store — which in this case included some backdoor code that executed commands that were dynamically configured by the attacker. For more in-depth information, see the ",{"data":46059,"content":46061,"nodeType":876},{"uri":46060},"https://secureannex.com/blog/cyberhaven-extension-compromise/",[46062],{"data":46063,"marks":46064,"value":46066,"nodeType":865},{},[46065],{"type":874},"excellent analysis",{"data":46068,"marks":46069,"value":46070,"nodeType":865},{},[]," by the Secure Annex team.",{"data":46072,"content":46073,"nodeType":881},{},[46074],{"data":46075,"marks":46076,"value":46077,"nodeType":865},{},[],"Because of the dynamic nature of the commands sent to backdoored extensions, it’s difficult to be sure what the impact was — but whatever the case was in this specific incident, it’s perhaps more useful to understand what the impact to users might be so we can work to mitigate future attacks.",{"data":46079,"content":46080,"nodeType":881},{},[46081],{"data":46082,"marks":46083,"value":46084,"nodeType":865},{},[],"The simple fact is that for most common extensions that operate across multiple sites (like ad-blockers etc.), using fairly typical permissions, a backdoor would likely be able to reach credentials and session tokens. This would mean an attacker could use a backdoored extension to get access to a user’s accounts on various websites. This poses a very high impact to users, and something that all extension developers should be focused on preventing. ",{"data":46086,"content":46087,"nodeType":894},{},[],{"data":46089,"content":46090,"nodeType":904},{},[46091],{"data":46092,"marks":46093,"value":46094,"nodeType":865},{},[],"How do we stop the next iteration of this attack?",{"data":46096,"content":46097,"nodeType":881},{},[46098],{"data":46099,"marks":46100,"value":46101,"nodeType":865},{},[],"Given the value of the data, the relative ease with which this attack was performed (vs. for example something like a browser 0-day), and the success of the attack, it seems very likely this type of attack will happen again. As we saw in 2024, the success of the attacks on Snowflake customers gave rise to a huge increase in infostealer attacks. Attackers are quick to identify areas of potential opportunity and capitalize on them.",{"data":46103,"content":46104,"nodeType":881},{},[46105],{"data":46106,"marks":46107,"value":46108,"nodeType":865},{},[],"As an extension user, you should be mainly worried about one of two scenarios;",{"data":46110,"content":46111,"nodeType":1818},{},[46112,46122],{"data":46113,"content":46114,"nodeType":1734},{},[46115],{"data":46116,"content":46117,"nodeType":881},{},[46118],{"data":46119,"marks":46120,"value":46121,"nodeType":865},{},[],"The developer of the extension adds malicious code to an extension, they publish the update to the app store, your browser automatically updates, and malicious code runs in your browser",{"data":46123,"content":46124,"nodeType":1734},{},[46125],{"data":46126,"content":46127,"nodeType":881},{},[46128],{"data":46129,"marks":46130,"value":46131,"nodeType":865},{},[],"The developer of your extension is attacked, and the attacker gains access to publish an updated version of the extension to the app store, and uses this to push an update that includes their backdoor, your browser automatically updates, and malicious code runs in your browser",{"data":46133,"content":46134,"nodeType":881},{},[46135],{"data":46136,"marks":46137,"value":46138,"nodeType":865},{},[],"However, since we’re writing this for honest extension developers, and these attacks targeted the second scenario, that’s what we’ll be focussing on. ",{"data":46140,"content":46141,"nodeType":881},{},[46142],{"data":46143,"marks":46144,"value":46145,"nodeType":865},{},[],"The challenge then is to make sure that only legitimate developers can push updates to the extension store. Easy to say, harder to do in the real world.",{"data":46147,"content":46148,"nodeType":894},{},[],{"data":46150,"content":46151,"nodeType":904},{},[46152],{"data":46153,"marks":46154,"value":46155,"nodeType":865},{},[],"Primer on extension stores and the publication process",{"data":46157,"content":46158,"nodeType":881},{},[46159],{"data":46160,"marks":46161,"value":46162,"nodeType":865},{},[],"As a light intro for folks that aren’t extension developers but are still interested, here’s a very brief description of this process. It’s not critical to understand the inner workings and differences between the stores to follow this blog, but it is very interesting (in my opinion). ",{"data":46164,"content":46165,"nodeType":881},{},[46166],{"data":46167,"marks":46168,"value":46169,"nodeType":865},{},[],"At Push we publish to three main extension stores; Chrome Web Store (this lets us cover all the Chromium-based browsers including Edge and Arc), Firefox Add-ons, and the Apple Store, so these are the stores we’re covering here.",{"data":46171,"content":46172,"nodeType":881},{},[46173],{"data":46174,"marks":46175,"value":46176,"nodeType":865},{},[],"The generic process is the same for all stores. To publish an update, you first build (or package, really) your extension source, upload it to your tenant/team/org in the store, and publish it. The publishing step triggers a manual review process in the Chrome and Apple stores, and once complete, the new version appears on the extension stores. In Firefox it goes straight out immediately.",{"data":46178,"content":46179,"nodeType":881},{},[46180],{"data":46181,"marks":46182,"value":46183,"nodeType":865},{},[],"A note on the reviews; if you aren’t adding new permissions (something we haven’t seen attackers do because it triggers a new interactive approval for the end-user when the extension is updated — something an attacker wants to avoid to evade detection) then our experience is that the the manual review process is typically fairly cursory. This is likely why the checks implemented at the store level failed to discover malicious updates in these cases.",{"data":46185,"content":46186,"nodeType":881},{},[46187],{"data":46188,"marks":46189,"value":46190,"nodeType":865},{},[],"While it’s possible to do this process completely manually, developers often automate builds and include some of the deployment steps above in the build automation process — I’ll use the term CI/CD to refer to this build and deployment process in the rest of this piece. All three stores provide API keys (albeit in different ways) to enable this process.",{"data":46192,"content":46193,"nodeType":881},{},[46194],{"data":46195,"marks":46196,"value":46197,"nodeType":865},{},[],"I’ll leave it there for now, but again see the “Extension store differences” section in the Appendix for more detail.",{"data":46199,"content":46200,"nodeType":1860},{},[46201],{"data":46202,"marks":46203,"value":46204,"nodeType":865},{},[],"So what's the problem with the stores?",{"data":46206,"content":46207,"nodeType":881},{},[46208],{"data":46209,"marks":46210,"value":46211,"nodeType":865},{},[],"Ok, so far it sounds like the stores are all pretty standardised, so what's the actual problem here? Why did these attacks succeed?",{"data":46213,"content":46214,"nodeType":881},{},[46215],{"data":46216,"marks":46217,"value":46218,"nodeType":865},{},[],"There are a few notable control gaps relating to the extension stores which made this attack possible, and could have mitigated it were they in place. ",{"data":46220,"content":46221,"nodeType":1818},{},[46222,46232,46242],{"data":46223,"content":46224,"nodeType":1734},{},[46225],{"data":46226,"content":46227,"nodeType":881},{},[46228],{"data":46229,"marks":46230,"value":46231,"nodeType":865},{},[],"Despite the massive risk related to publishing a malicious extension, none of the mainstream stores provide a mechanism to implement a multiparty approval process, increasing the number of successful phishing attempts required. ",{"data":46233,"content":46234,"nodeType":1734},{},[46235],{"data":46236,"content":46237,"nodeType":881},{},[46238],{"data":46239,"marks":46240,"value":46241,"nodeType":865},{},[],"Due to the lack of granular permissions in the Chrome store, any dev with access to the store could be phished. A slightly more granular permission model — for example the ability to have one developer with the permission to upload an extension (but not publish it), and another with the ability to publish an uploaded extension (but not upload a new package) — could have addressed this. ",{"data":46243,"content":46244,"nodeType":1734},{},[46245],{"data":46246,"content":46247,"nodeType":881},{},[46248],{"data":46249,"marks":46250,"value":46251,"nodeType":865},{},[],"No log stream that could be easily ingested by a SIEM tool is provided, making it much harder to detect and respond. ",{"data":46253,"content":46254,"nodeType":881},{},[46255],{"data":46256,"marks":46257,"value":46258,"nodeType":865},{},[],"But alas, we’re not here to complain about the stores — that’s a different blog post — we’re here to solve problems today!",{"data":46260,"content":46261,"nodeType":881},{},[46262],{"data":46263,"marks":46264,"value":46265,"nodeType":865},{},[],"I mentioned before that a multiparty approval process is key. But to understand why, it’s useful to think about this in terms of how this system will be attacked. Threat or attack models are typical approaches to doing this.",{"data":46267,"content":46268,"nodeType":894},{},[],{"data":46270,"content":46271,"nodeType":904},{},[46272],{"data":46273,"marks":46274,"value":46275,"nodeType":865},{},[],"Attack model for publishing a malicious extension",{"data":46277,"content":46278,"nodeType":881},{},[46279],{"data":46280,"marks":46281,"value":46282,"nodeType":865},{},[],"The main attack paths enabling an attacker to publish a malicious extension are outlined below. ",{"data":46284,"content":46288,"nodeType":890},{"target":46285},{"sys":46286},{"id":46287,"type":887,"linkType":888},"2RQTz9QmPxOxAvy4EtXIQZ",[],{"data":46290,"content":46291,"nodeType":881},{},[46292],{"data":46293,"marks":46294,"value":46295,"nodeType":865},{},[],"You don’t need to follow all the minutia of these attack paths, but some things to note about these attack paths are that they all target single points of failure (a single identity, a single endpoint), primarily through Social Engineering attacks:",{"data":46297,"content":46298,"nodeType":1818},{},[46299,46309,46319],{"data":46300,"content":46301,"nodeType":1734},{},[46302],{"data":46303,"content":46304,"nodeType":881},{},[46305],{"data":46306,"marks":46307,"value":46308,"nodeType":865},{},[],"A single user with access to the store needs to fall for a social engineering attack for this to work (as happened in this case). ",{"data":46310,"content":46311,"nodeType":1734},{},[46312],{"data":46313,"content":46314,"nodeType":881},{},[46315],{"data":46316,"marks":46317,"value":46318,"nodeType":865},{},[],"Many paths can be completed with an identity or endpoint attack, and in most cases a single identity or endpoint is sufficient.",{"data":46320,"content":46321,"nodeType":1734},{},[46322],{"data":46323,"content":46324,"nodeType":881},{},[46325],{"data":46326,"marks":46327,"value":46328,"nodeType":865},{},[],"Attacks against code repos and CI/CD flows are parallel paths, you need to trust those systems already.",{"data":46330,"content":46331,"nodeType":881},{},[46332],{"data":46333,"marks":46334,"value":46335,"nodeType":865},{},[],"So in designing a security architecture, we want to do as much to reduce single points of failure, and make social engineering ineffective (even when it succeeds).",{"data":46337,"content":46338,"nodeType":894},{},[],{"data":46340,"content":46341,"nodeType":904},{},[46342],{"data":46343,"marks":46344,"value":46345,"nodeType":865},{},[],"Recommended security architecture",{"data":46347,"content":46348,"nodeType":881},{},[46349],{"data":46350,"marks":46351,"value":46352,"nodeType":865},{},[],"You could literally write a book on everything it takes to secure identities, endpoints and code repositories in general, and we’ll certainly mention some of the identity controls we think are effective later on. One thing to note here is that whatever you implement, the attack that succeeds in the real-word today is vastly more likely to involve an element of social engineering vs. for example a vulnerability exploit. This is not just my opinion (solid as I like to think that is), but also well supported by threat reports like the Verizon DBIR, with 68% of attacks involving ‘the human element’ in the 2024 edition. ",{"data":46354,"content":46355,"nodeType":881},{},[46356],{"data":46357,"marks":46358,"value":46359,"nodeType":865},{},[],"In tackling attacks that involve social engineering, there are two main workable options:",{"data":46361,"content":46362,"nodeType":1818},{},[46363,46373],{"data":46364,"content":46365,"nodeType":1734},{},[46366],{"data":46367,"content":46368,"nodeType":881},{},[46369],{"data":46370,"marks":46371,"value":46372,"nodeType":865},{},[],"Remove the user’s ability to give the attacker what they need.",{"data":46374,"content":46375,"nodeType":1734},{},[46376],{"data":46377,"content":46378,"nodeType":881},{},[46379],{"data":46380,"marks":46381,"value":46382,"nodeType":865},{},[],"Assume that at least some users will fall for the attack, and make it as hard as possible for the attacker.",{"data":46384,"content":46385,"nodeType":881},{},[46386],{"data":46387,"marks":46388,"value":46389,"nodeType":865},{},[],"You may note I didn’t include security or awareness training in the above — essentially because I’ve never seen it be effective enough to be relied on, which is not to say it’s not very useful (especially if it’s well targeted and relevant — like unpacking what happened to Cyberhaven with your whole extension developer team would be!), just that technical controls are generally more reliable.",{"data":46391,"content":46392,"nodeType":881},{},[46393],{"data":46394,"marks":46395,"value":46396,"nodeType":865},{},[],"Anyway, back to what I think makes the cornerstones of a solution.",{"data":46398,"content":46399,"nodeType":1860},{},[46400],{"data":46401,"marks":46402,"value":46403,"nodeType":865},{},[],"Remove BAU access to extension stores",{"data":46405,"content":46406,"nodeType":881},{},[46407],{"data":46408,"marks":46409,"value":46410,"nodeType":865},{},[],"If developers don’t have access to extension stores, they cannot be manipulated into giving attackers access to API keys, they cannot grant attackers authorization to access the store on their behalf, and if the identities are compromised they cannot be used to access the store.",{"data":46412,"content":46413,"nodeType":881},{},[46414],{"data":46415,"marks":46416,"value":46417,"nodeType":865},{},[],"The key to achieving this is to lean fully into completely automated CI/CD processes for normal extension updates. This means that after you’ve configured the CI/CD flows, no developer needs access to the extension stores to do their normal work (publishing new versions of the extension).",{"data":46419,"content":46420,"nodeType":881},{},[46421],{"data":46422,"marks":46423,"value":46424,"nodeType":865},{},[],"Unfortunately, you will still need to access the web console manually for some tasks like updating branding, updating extension descriptions, and proving justification for new permissions (Chrome and Apple only). For our team, these tasks are infrequent enough that they can be handled using break-glass accounts.",{"data":46426,"content":46427,"nodeType":881},{},[46428],{"data":46429,"marks":46430,"value":46431,"nodeType":865},{},[],"A side note here: it might seem that you are just moving the risk around, from the extension store to the code repo & CI/CD system, but you are really already dependent on the security of these systems, so this is just removing the direct access to the extension store from the attack surface. You also have far greater flexibility and control in the CI/CD system as we’ll see in the “Implement multiparty approval in CI/CD” section below.",{"data":46433,"content":46434,"nodeType":1860},{},[46435],{"data":46436,"marks":46437,"value":46438,"nodeType":865},{},[],"Break-glass store admin accounts",{"data":46440,"content":46441,"nodeType":881},{},[46442,46446,46455,46459,46468],{"data":46443,"marks":46444,"value":46445,"nodeType":865},{},[],"In practice you might implement this by issuing developers that need access to the extension stores a second SSO identity that is dedicated to this. You could have a ",{"data":46447,"content":46449,"nodeType":876},{"uri":46448},"mailto:john@amce.com",[46450],{"data":46451,"marks":46452,"value":46454,"nodeType":865},{},[46453],{"type":874},"john@acme.com",{"data":46456,"marks":46457,"value":46458,"nodeType":865},{},[]," Google account to do normal development work, and a ",{"data":46460,"content":46462,"nodeType":876},{"uri":46461},"mailto:john.admin@acme.com",[46463],{"data":46464,"marks":46465,"value":46467,"nodeType":865},{},[46466],{"type":874},"john.admin@acme.com",{"data":46469,"marks":46470,"value":46471,"nodeType":865},{},[]," Google account to access the extension stores. You could also:",{"data":46473,"content":46474,"nodeType":1818},{},[46475,46485,46495,46505],{"data":46476,"content":46477,"nodeType":1734},{},[46478],{"data":46479,"content":46480,"nodeType":881},{},[46481],{"data":46482,"marks":46483,"value":46484,"nodeType":865},{},[],"Make the .admin accounts disabled by default in Google, and enable one of them at a time as and when needed (this should be very rare).",{"data":46486,"content":46487,"nodeType":1734},{},[46488],{"data":46489,"content":46490,"nodeType":881},{},[46491],{"data":46492,"marks":46493,"value":46494,"nodeType":865},{},[],"Put the .admin accounts in a separate OU in GWS, and configure that OU so that those accounts are not allowed to authorize any OAuth integrations.",{"data":46496,"content":46497,"nodeType":1734},{},[46498],{"data":46499,"content":46500,"nodeType":881},{},[46501],{"data":46502,"marks":46503,"value":46504,"nodeType":865},{},[],"Ensure that all the .admin accounts use hardware backed passkeys that don’t sync anywhere (we like Yubikeys) and disable password logins.",{"data":46506,"content":46507,"nodeType":1734},{},[46508],{"data":46509,"content":46510,"nodeType":881},{},[46511],{"data":46512,"marks":46513,"value":46514,"nodeType":865},{},[],"For bonus points, make sure .admin accounts can only be used on a separate dedicated endpoint (e.g. a locked-down Chromebook).",{"data":46516,"content":46517,"nodeType":881},{},[46518],{"data":46519,"marks":46520,"value":46521,"nodeType":865},{},[],"In this way you can have a setup where an attacker would have to successfully target a developer using a hardware-backed identity during the few minutes a year their account is active, and do so without using consent phishing attacks (because all OAuth integrations are disabled for your break-glass accounts). This is a majorly tall order for the attacker.",{"data":46523,"content":46524,"nodeType":1860},{},[46525],{"data":46526,"marks":46527,"value":46528,"nodeType":865},{},[],"Implement multiparty approval in CI/CD",{"data":46530,"content":46531,"nodeType":881},{},[46532],{"data":46533,"marks":46534,"value":46535,"nodeType":865},{},[],"If nobody has active BAU access to extension stores for more than very brief periods, the attacker’s next best option is to target the process that developers are using to publish, i.e. committing code to the repository and waiting for the CI/CD system to publish the extension automatically.",{"data":46537,"content":46538,"nodeType":881},{},[46539],{"data":46540,"marks":46541,"value":46542,"nodeType":865},{},[],"In practice this means the attacker would need to attack the identity (account) the employee uses to access the code repository (assuming a typical cloud hosted system like GitHub here), or sneak code in through an endpoint attack. Overwhelmingly, these attacks are likely to include an element of social engineering — whether that’s phishing credentials or session tokens, or tricking the user into downloading malware, perhaps through a malicious dependency or vscode extension.",{"data":46544,"content":46545,"nodeType":881},{},[46546],{"data":46547,"marks":46548,"value":46549,"nodeType":865},{},[],"We can make the attacker’s life exponentially harder by requiring that they successfully attack two developers, at the same time, before anyone notices. Quick intuition might make it seem like we’re only doubling the difficulty, but other red-teamers with experience doing this will agree that it’s often very easy to target a random user in a large population quickly (one employee in a large corporate), but a single user in a much smaller team (say an extension dev team) might take repeated attacks. When you need to target multiple users in a small team, in a single attack, and maintain the breach concurrently while taking actions (e.g. committing malicious code hoping no-one notices) it becomes much more likely that the alarm will be raised. ",{"data":46551,"content":46552,"nodeType":1860},{},[46553],{"data":46554,"marks":46555,"value":46556,"nodeType":865},{},[],"How to implement multiparty approval through CI/CD",{"data":46558,"content":46559,"nodeType":881},{},[46560],{"data":46561,"marks":46562,"value":46563,"nodeType":865},{},[],"There are probably dozens of ways to skin this cat, but I’ll share one way of doing this that works with mainstream tools and developer processes — using protected git branches.",{"data":46565,"content":46566,"nodeType":1818},{},[46567,46582,46597],{"data":46568,"content":46569,"nodeType":1734},{},[46570],{"data":46571,"content":46572,"nodeType":881},{},[46573,46578],{"data":46574,"marks":46575,"value":46577,"nodeType":865},{},[46576],{"type":902},"Step 1: ",{"data":46579,"marks":46580,"value":46581,"nodeType":865},{},[],"Setup multiple branches, these might be dev/stg/prd, or development/prerelease/release, and trigger automated build and deploy to the stores using CI/CD with PR merges to the prd/release branches. ",{"data":46583,"content":46584,"nodeType":1734},{},[46585],{"data":46586,"content":46587,"nodeType":881},{},[46588,46593],{"data":46589,"marks":46590,"value":46592,"nodeType":865},{},[46591],{"type":902},"Step 2: ",{"data":46594,"marks":46595,"value":46596,"nodeType":865},{},[],"Use branch protection rules that require a second (or even third) named or group of developers to review and approve the PR merge. This achieves multiparty approval.",{"data":46598,"content":46599,"nodeType":1734},{},[46600],{"data":46601,"content":46602,"nodeType":881},{},[46603,46608],{"data":46604,"marks":46605,"value":46607,"nodeType":865},{},[46606],{"type":902},"Step 3:",{"data":46609,"marks":46610,"value":46611,"nodeType":865},{},[]," Configure fully automated builds and deployments as part of your CI/CD flows. While this is possible for all three stores, some of the stores do make you jump through a few hoops. Take a look at the steps required to automate a publish to the Apple Store:",{"data":46613,"content":46617,"nodeType":890},{"target":46614},{"sys":46615},{"id":46616,"type":887,"linkType":888},"4b9fc1ZUj4HdKl6Iv7Yx8T",[],{"data":46619,"content":46620,"nodeType":881},{},[46621,46625,46634],{"data":46622,"marks":46623,"value":46624,"nodeType":865},{},[],"Since we’ve done the work of figuring this out once already, we extracted the critical steps into a ",{"data":46626,"content":46628,"nodeType":876},{"uri":46627},"https://github.com/pushsecurity/extension-security-guide",[46629],{"data":46630,"marks":46631,"value":46633,"nodeType":865},{},[46632],{"type":874},"companion Github repo",{"data":46635,"marks":46636,"value":46637,"nodeType":865},{},[]," to make this a bit easier to implement.",{"data":46639,"content":46640,"nodeType":881},{},[46641],{"data":46642,"marks":46643,"value":46644,"nodeType":865},{},[],"As we’ve described it so far, this is a fairly basic implementation, and there are several other controls you might consider to harden this process, including:",{"data":46646,"content":46647,"nodeType":1818},{},[46648,46658,46668],{"data":46649,"content":46650,"nodeType":1734},{},[46651],{"data":46652,"content":46653,"nodeType":881},{},[46654],{"data":46655,"marks":46656,"value":46657,"nodeType":865},{},[],"Make sure you use a secrets protection system to store Web Store API keys in the CI/CD (it’s no use if the attacker can read the API keys from a config file in your code).",{"data":46659,"content":46660,"nodeType":1734},{},[46661],{"data":46662,"content":46663,"nodeType":881},{},[46664],{"data":46665,"marks":46666,"value":46667,"nodeType":865},{},[],"Ensure that developers don’t have access to change branch protection rules, or access CI/CD secrets (otherwise one compromised developer account can undo all this good work — let DevOps or other admin users that are not extension developers handle this admin).",{"data":46669,"content":46670,"nodeType":1734},{},[46671],{"data":46672,"content":46673,"nodeType":881},{},[46674],{"data":46675,"marks":46676,"value":46677,"nodeType":865},{},[],"Enforce hardware-backed signed commits as a condition for PR merges (this makes it very very difficult to get bad code into the repo without also compromising your dev team’s Yubikeys)",{"data":46679,"content":46680,"nodeType":881},{},[46681],{"data":46682,"marks":46683,"value":46684,"nodeType":865},{},[],"Now you have strong hardware-backed multiparty authenticated deployments to the stores, and should end up with something that looks a bit like this:",{"data":46686,"content":46690,"nodeType":890},{"target":46687},{"sys":46688},{"id":46689,"type":887,"linkType":888},"6tWdfgYKyH2i2Zai05BxzB",[],{"data":46692,"content":46693,"nodeType":894},{},[],{"data":46695,"content":46696,"nodeType":904},{},[46697],{"data":46698,"marks":46699,"value":46700,"nodeType":865},{},[],"The next best attack path — IdP admin compromise",{"data":46702,"content":46703,"nodeType":881},{},[46704],{"data":46705,"marks":46706,"value":46707,"nodeType":865},{},[],"Once developers don’t have direct access to the stores, and you have multiparty approvals to get code into CI/CD, the next best attack paths are to target other single-points-of-failure — most likely the administrators. ",{"data":46709,"content":46710,"nodeType":881},{},[46711],{"data":46712,"marks":46713,"value":46714,"nodeType":865},{},[],"This might be the IdP (Google Workspace, Entra, Okta, etc.) admins, which can then be used to provision access to the stores, or simply recover one or more of the developer or break-glass accounts. Or it might target the code repo or CI/CD (GitHub in our example) admins which have access to API keys and can change branch protection rules.",{"data":46716,"content":46717,"nodeType":881},{},[46718],{"data":46719,"marks":46720,"value":46721,"nodeType":865},{},[],"Managing privileged identities like these admin accounts is a constant challenge, but continuing what is perhaps the central thread of this blog, identity attacks (likely through social engineering) are going to be the first port of call for an attacker.",{"data":46723,"content":46724,"nodeType":1860},{},[46725],{"data":46726,"marks":46727,"value":46728,"nodeType":865},{},[],"Recommendations for hardening admin identities",{"data":46730,"content":46731,"nodeType":881},{},[46732],{"data":46733,"marks":46734,"value":46735,"nodeType":865},{},[],"If there’s one thing we know here at Push, it’s identity security — but I’ll fight the urge to go into too much depth with generic recommendations, and focus on where there are opportunities specific to this scope.",{"data":46737,"content":46738,"nodeType":881},{},[46739],{"data":46740,"marks":46741,"value":46742,"nodeType":865},{},[],"One of the most critical aspects of securing these admin accounts is making sure that they are phishing resistant. Where possible, you should be using phishing resistant MFA methods. Typically this means some kind of domain bound security key using the WebAuthn protocol — a passkey using your fingerprint reader is good, something like Yubikey is great. I think this is pretty well understood, but where it goes wrong most often is when backup methods and alternative login methods exist. For example, you might be using an Google OIDC login secured with a Yubikey to access the Firefox store, but not realize that this account also has a password to set that doesn’t have MFA, or has phish-able MFA like SMS or an app-code set.",{"data":46744,"content":46745,"nodeType":881},{},[46746],{"data":46747,"marks":46748,"value":46749,"nodeType":865},{},[],"Attackers are increasingly using attacks that downgrade MFA methods (so the attacker will request the least secure active MFA method when phishing you, rather than the strong method you might use day-to-day), and this is completely automated in modern MFA-bypass phishing kits.",{"data":46751,"content":46752,"nodeType":881},{},[46753],{"data":46754,"marks":46755,"value":46756,"nodeType":865},{},[],"Warning, product plug coming 🙂 — what we do at Push is help you identify issues like these at scale, across all admin, break-glass, dev, and normal user accounts. We also block credential phishing by detecting when users try to enter their SSO credentials on the wrong page, detecting session theft, and can even monitor when credentials stolen via infostealers show up on underground forums.",{"data":46758,"content":46759,"nodeType":894},{},[],{"data":46761,"content":46762,"nodeType":904},{},[46763],{"data":46764,"marks":46765,"value":46766,"nodeType":865},{},[],"Going even further to harden extension deployment",{"data":46768,"content":46769,"nodeType":881},{},[46770],{"data":46771,"marks":46772,"value":46773,"nodeType":865},{},[],"This blog is already getting way too long, but there are a lot of other controls that can really help harden extension deployment — if there is interest I might go into detail in a future blog post, but for now let me just mention some of them.",{"data":46775,"content":46776,"nodeType":1860},{},[46777],{"data":46778,"marks":46779,"value":46780,"nodeType":865},{},[],"Multiparty approvals for Google",{"data":46782,"content":46783,"nodeType":881},{},[46784],{"data":46785,"marks":46786,"value":46787,"nodeType":865},{},[],"If you’re going to do multiparty approvals for extension deployments, then enabling this for admin actions that protect that infrastructure seems like a no-brainer.",{"data":46789,"content":46790,"nodeType":881},{},[46791,46795,46804],{"data":46792,"marks":46793,"value":46794,"nodeType":865},{},[],"Google allows you to enable ",{"data":46796,"content":46798,"nodeType":876},{"uri":46797},"https://support.google.com/a/answer/13790448?hl=en",[46799],{"data":46800,"marks":46801,"value":46803,"nodeType":865},{},[46802],{"type":874},"multiparty approval for sensitive actions",{"data":46805,"marks":46806,"value":46807,"nodeType":865},{},[]," in Google Workspace. We wish it was a bit more granular, and covered more configurable actions — but it’s an awesome start, nice work Google!",{"data":46809,"content":46810,"nodeType":1860},{},[46811],{"data":46812,"marks":46813,"value":46814,"nodeType":865},{},[],"Admin workstations",{"data":46816,"content":46817,"nodeType":881},{},[46818],{"data":46819,"marks":46820,"value":46821,"nodeType":865},{},[],"When we used to do red-team exercises, one of the most challenging controls to work around was when the admin accounts we were targeting were only used on dedicated admin workstations. Ideally those workstations would do nothing except admin tasks, and the accounts would be locked down, so in this case that might mean:",{"data":46823,"content":46824,"nodeType":1818},{},[46825,46835,46845],{"data":46826,"content":46827,"nodeType":1734},{},[46828],{"data":46829,"content":46830,"nodeType":881},{},[46831],{"data":46832,"marks":46833,"value":46834,"nodeType":865},{},[],"No email access",{"data":46836,"content":46837,"nodeType":1734},{},[46838],{"data":46839,"content":46840,"nodeType":881},{},[46841],{"data":46842,"marks":46843,"value":46844,"nodeType":865},{},[],"No extensions",{"data":46846,"content":46847,"nodeType":1734},{},[46848],{"data":46849,"content":46850,"nodeType":881},{},[46851],{"data":46852,"marks":46853,"value":46854,"nodeType":865},{},[],"No OAuth apps",{"data":46856,"content":46857,"nodeType":881},{},[46858],{"data":46859,"marks":46860,"value":46861,"nodeType":865},{},[],"This becomes incredibly challenging to attack — but it does come with some obvious painful UX impact for admins, so I don’t think this is a no-brainer for everyone.",{"data":46863,"content":46864,"nodeType":1860},{},[46865],{"data":46866,"marks":46867,"value":46868,"nodeType":865},{},[],"Isolate support emails",{"data":46870,"content":46871,"nodeType":881},{},[46872],{"data":46873,"marks":46874,"value":46875,"nodeType":865},{},[],"Sending your support emails to extension developers creates a direct path to start social engineering — something attackers used to great effect in this campaign. If your developers are not also your frontline support team, consider ringfencing developers from that public support email group so attackers have to at least do some reconnaissance work to identify the developers to target.",{"data":46877,"content":46878,"nodeType":1860},{},[46879],{"data":46880,"marks":46881,"value":46882,"nodeType":865},{},[],"Detection and response",{"data":46884,"content":46885,"nodeType":881},{},[46886],{"data":46887,"marks":46888,"value":46889,"nodeType":865},{},[],"As always there are a myriad of things that can be monitored. We think high value would be doing things like:",{"data":46891,"content":46892,"nodeType":1818},{},[46893,46936,46946],{"data":46894,"content":46895,"nodeType":1734},{},[46896,46903],{"data":46897,"content":46898,"nodeType":881},{},[46899],{"data":46900,"marks":46901,"value":46902,"nodeType":865},{},[],"Checking whether new versions of your extension appearing in the store is directly related or caused by the CI/CD process, and:",{"data":46904,"content":46905,"nodeType":1818},{},[46906,46916,46926],{"data":46907,"content":46908,"nodeType":1734},{},[46909],{"data":46910,"content":46911,"nodeType":881},{},[46912],{"data":46913,"marks":46914,"value":46915,"nodeType":865},{},[],"Alert if there is no direct link here.",{"data":46917,"content":46918,"nodeType":1734},{},[46919],{"data":46920,"content":46921,"nodeType":881},{},[46922],{"data":46923,"marks":46924,"value":46925,"nodeType":865},{},[],"You can configure email alerts to trigger this automated check.",{"data":46927,"content":46928,"nodeType":1734},{},[46929],{"data":46930,"content":46931,"nodeType":881},{},[46932],{"data":46933,"marks":46934,"value":46935,"nodeType":865},{},[],"You could consider immediate automated roll-back to a previous version of the extension if it wasn’t published via the CI/CD system.",{"data":46937,"content":46938,"nodeType":1734},{},[46939],{"data":46940,"content":46941,"nodeType":881},{},[46942],{"data":46943,"marks":46944,"value":46945,"nodeType":865},{},[],"Any activity on break-glass accounts — these accounts should only be used after they are activated by admins to complete a specific task, so this is an obvious alert to configure.",{"data":46947,"content":46948,"nodeType":1734},{},[46949],{"data":46950,"content":46951,"nodeType":881},{},[46952],{"data":46953,"marks":46954,"value":46955,"nodeType":865},{},[],"Unusual activity on service accounts — this is a bit of work to profile, but very valuable.",{"data":46957,"content":46958,"nodeType":894},{},[],{"data":46960,"content":46961,"nodeType":904},{},[46962],{"data":46963,"marks":46964,"value":46965,"nodeType":865},{},[],"Our request to extension stores",{"data":46967,"content":46968,"nodeType":881},{},[46969],{"data":46970,"marks":46971,"value":46972,"nodeType":865},{},[],"I’ll use this opportunity to make an open request to the browser extension stores for a couple of features that I think would really benefit the entire ecosystem:",{"data":46974,"content":46975,"nodeType":1818},{},[46976,46986,46996,47006],{"data":46977,"content":46978,"nodeType":1734},{},[46979],{"data":46980,"content":46981,"nodeType":881},{},[46982],{"data":46983,"marks":46984,"value":46985,"nodeType":865},{},[],"Add the ability to configure an explicit multiparty approval process (and show the public which extensions have enabled these controls!).",{"data":46987,"content":46988,"nodeType":1734},{},[46989],{"data":46990,"content":46991,"nodeType":881},{},[46992],{"data":46993,"marks":46994,"value":46995,"nodeType":865},{},[],"More granular permissions or roles (e.g. only edit descriptions, only only upload, only publish, only accept new terms).",{"data":46997,"content":46998,"nodeType":1734},{},[46999],{"data":47000,"content":47001,"nodeType":881},{},[47002],{"data":47003,"marks":47004,"value":47005,"nodeType":865},{},[],"Better logs and monitoring – making it easier to ingest events related to your extension via the store into a SIEM would make alerts much easier to configure.",{"data":47007,"content":47008,"nodeType":1734},{},[47009],{"data":47010,"content":47011,"nodeType":881},{},[47012],{"data":47013,"marks":47014,"value":47015,"nodeType":865},{},[],"Enforce stronger default identity security controls (even if only for risky or popular extensions) — we enforce MFA by default for GitHub repositories now, it’s about time that we require MFA to access an extension store as well.",{"data":47017,"content":47018,"nodeType":894},{},[],{"data":47020,"content":47021,"nodeType":904},{},[47022],{"data":47023,"marks":47024,"value":29161,"nodeType":865},{},[],{"data":47026,"content":47027,"nodeType":881},{},[47028],{"data":47029,"marks":47030,"value":47031,"nodeType":865},{},[],"We’ve seen in the past that the successful use of new techniques seem to inspire other attackers and lead to many similar attacks, so the smart money is on this happening again.",{"data":47033,"content":47034,"nodeType":881},{},[47035,47039,47048],{"data":47036,"marks":47037,"value":47038,"nodeType":865},{},[],"There is lots to work needed to secure this process, and hopefully this blog has provided a starting point. We’d love to hear from you — let’s start ",{"data":47040,"content":47042,"nodeType":876},{"uri":47041},"https://github.com/pushsecurity/extension-security-guide/discussions",[47043],{"data":47044,"marks":47045,"value":47047,"nodeType":865},{},[47046],{"type":874},"sharing some ideas",{"data":47049,"marks":47050,"value":47051,"nodeType":865},{},[]," around hardening this process even more!",{"data":47053,"content":47054,"nodeType":881},{},[47055],{"data":47056,"marks":47057,"value":47058,"nodeType":865},{},[],"If you're a customer rather than an extension developer, this guide hopefully gives you a sense of the supply chain attacks that are likely to happen in the future. Asking your vendors which steps they’ve taken to prevent these attacks might be a sensible addition to your vendor risk assessment process (when the product includes a browser extension). ",{"data":47060,"content":47061,"nodeType":881},{},[47062],{"data":47063,"marks":47064,"value":47065,"nodeType":865},{},[],"This kind of due diligence is viable where the developer is a vendor you have a commercial relationship with, but is a non-starter when it’s an extension that’s offered for free by well meaning open source developers. In these cases a sensible response might be to require approvals for new browser extensions, a technical risk review based on (at least) the permissions the extension is asking for, and managed browser policies to control and further limit what some or all extensions can do. For example, you may decide to block access for extensions to your IdP’s domains to protect your SSO accounts. ",{"data":47067,"content":47068,"nodeType":881},{},[47069],{"data":47070,"marks":47071,"value":47072,"nodeType":865},{},[],"We’ll be releasing guidance on how to manage third party extensions used in your organization in the near future — subscribe to our mailing list to be notified when we do.",{"data":47074,"content":47075,"nodeType":894},{},[],{"data":47077,"content":47078,"nodeType":904},{},[47079],{"data":47080,"marks":47081,"value":47082,"nodeType":865},{},[],"Appendix: Extension store differences",{"data":47084,"content":47085,"nodeType":881},{},[47086],{"data":47087,"marks":47088,"value":47089,"nodeType":865},{},[],"We covered the general process of publishing extensions to the different stores in the “Primer on extension stores and the publication process” section above, now let’s talk about the differences between the stores. Let’s start with how they provision for automated deployments.",{"data":47091,"content":47092,"nodeType":1860},{},[47093],{"data":47094,"marks":47095,"value":47096,"nodeType":865},{},[],"Automation keys",{"data":47098,"content":47099,"nodeType":881},{},[47100,47104,47113],{"data":47101,"marks":47102,"value":47103,"nodeType":865},{},[],"The Chrome Web Store allows automation through an OAuth app. As described in ",{"data":47105,"content":47107,"nodeType":876},{"uri":47106},"https://developer.chrome.com/docs/webstore/using-api",[47108],{"data":47109,"marks":47110,"value":47112,"nodeType":865},{},[47111],{"type":874},"their documentation",{"data":47114,"marks":47115,"value":47116,"nodeType":865},{},[],", the process is for a developer to create a custom OAuth app (a client on OAuth speak), then a user with access to the store authorizes the OAuth app to access the chrome store on their behalf using the https://www.googleapis.com/auth/chromewebstore scope. ",{"data":47118,"content":47119,"nodeType":881},{},[47120],{"data":47121,"marks":47122,"value":47123,"nodeType":865},{},[],"If this sounds familiar, that’s because this is exactly what attackers tricked developers into doing using their own OAuth app in the Cyberhave campaign. In the normal flow, the developer then uses a service key linked to the OAuth app in their CI/CD flow to automate the deployment process.",{"data":47125,"content":47126,"nodeType":881},{},[47127],{"data":47128,"marks":47129,"value":47130,"nodeType":865},{},[],"The situation is a bit simpler for Firefox and Apple, which both work by developers just creating simple static API keys, though Apple does allow you to create personal API keys linked to a single account (and that account’s permissions).",{"data":47132,"content":47133,"nodeType":1860},{},[47134],{"data":47135,"marks":47136,"value":47137,"nodeType":865},{},[],"Accessing the store",{"data":47139,"content":47140,"nodeType":881},{},[47141],{"data":47142,"marks":47143,"value":47144,"nodeType":865},{},[],"In a business environment, using SSO to access apps is extremely useful as it simplifies the provisioning and security-ops work of maintaining secure identities — and often provides more secure authentication methods (e.g. hardware backed WebAuthn MFA) than the target app does (as is the case for the web stores). It also simplifies and centralizes the ability to log and monitor the use of these accounts. I can’t recommend the use of strong SSO authentication enough in cases like this where ensuring you have the right controls in place is paramount.",{"data":47146,"content":47147,"nodeType":881},{},[47148],{"data":47149,"marks":47150,"value":47151,"nodeType":865},{},[],"Fortunately all the stores provide SSO login methods. For the Chrome store, users login (only) using Google SSO accounts — and if they are part of a Google Workspace, access can be provisioned through membership to a group. Firefox allows access using a username and password, but also offers OIDC SSO logins through Google or Apple accounts. If you make use of Managed Apple IDs, Apple offers OIDC SSO authentication as well. ",{"data":47153,"content":47154,"nodeType":881},{},[47155,47159,47164],{"data":47156,"marks":47157,"value":47158,"nodeType":865},{},[],"For Chrome and Firefox there is no real concept of roles (or nothing really useful), and ",{"data":47160,"marks":47161,"value":47163,"nodeType":865},{},[47162],{"type":874},"you should assume any user with access to a team in your account has the ability to publish extension updates",{"data":47165,"marks":47166,"value":47167,"nodeType":865},{},[],". Apple offers more granular roles and permissions - and there are low privileged roles that can’t publish updates.",{"entries":47169},{"hyperlink":47170,"inline":47171,"block":47172},[],[],[47173,47181,47188],{"sys":47174,"__typename":7008,"title":47175,"caption":47176,"layoutMode":59,"file":47177},{"id":46287},"Attack paths to publishing a malicious extension","Graphic showing the possible high-level attack paths to publishing a malicious extension. The path in bold (consent phishing) represents the path traversed in the Cyberhaven breach. ",{"url":47178,"width":47179,"height":47180},"https://images.ctfassets.net/y1cdw1ablpvd/449fRkebgBONYaYRJQuZZd/f1b9d7487dd6208516a760b5cac458a4/Attack_paths_to_publishing_a_malicious_extension.png",1423,1912,{"sys":47182,"__typename":7008,"title":47183,"caption":47183,"layoutMode":59,"file":47184},{"id":46616},"Steps required to automate a publish to the Apple store",{"url":47185,"width":47186,"height":47187},"https://images.ctfassets.net/y1cdw1ablpvd/63QG3teGwNduKQkKP7QfVo/7a78a4b433ab426bd6b8935b0701137c/image2.png",676,506,{"sys":47189,"__typename":7008,"title":47190,"caption":47191,"layoutMode":59,"file":47192},{"id":46689},"Secure multiparty auth diagram","Strong hardware-backed multiparty authenticated deployments to the stores",{"url":47193,"width":47194,"height":24963},"https://images.ctfassets.net/y1cdw1ablpvd/6j4ZRB7D1VA7TfcvIED9Q1/ebf88ffa4082759f77f5a99594a1a9b7/Secure_multiparty_auth_diagram__3_.png",1920,{"items":47196},[],{},"How to securely deploy browser extensions to the web store","2025-01-14T00:00:00.000Z",{"items":47201},[47202,47908,48256],{"__typename":1485,"sys":47203,"content":47205,"title":47894,"synopsis":47895,"hashTags":59,"publishedDate":47896,"slug":47897,"tagsCollection":47898,"authorsCollection":47904},{"id":47204},"6rflXTFCRMvmM8JU8ZPSCt",{"json":47206},{"data":47207,"content":47208,"nodeType":1463},{},[47209,47216,47223,47230,47237,47244,47251,47257,47264,47271,47278,47285,47301,47308,47315,47322,47329,47336,47343,47350,47356,47363,47370,47377,47384,47390,47398,47405,47412,47419,47426,47434,47441,47447,47454,47461,47484,47491,47524,47531,47547,47555,47562,47569,47576,47583,47636,47643,47649,47656,47663,47670,47678,47685,47692,47699,47730,47737,47771,47778,47785,47792,47799,47807,47814,47821,47828,47835,47842,47849,47856,47863,47882,47888],{"data":47210,"content":47211,"nodeType":904},{},[47212],{"data":47213,"marks":47214,"value":47215,"nodeType":865},{},[],"What is in an identity?",{"data":47217,"content":47218,"nodeType":881},{},[47219],{"data":47220,"marks":47221,"value":47222,"nodeType":865},{},[],"Like real identities, digital identities are a little hard to define. Formally it’s a mapping of a human into the digital world, but more often this term is used as synonymous with a credential (e.g. a username and password, a Multi-Factor Authentication (MFA) device, or a fingerprint) - the thing you use to prove you own the identity in an authentication process. When people say an identity is breached, they typically mean the credentials have been stolen.",{"data":47224,"content":47225,"nodeType":881},{},[47226],{"data":47227,"marks":47228,"value":47229,"nodeType":865},{},[],"This is a useful simplification, but bear in mind that reality is a bit more complex. For example - identities are typically tied to an account on an application (you want to login to Slack, Slack knows your password), but can also trust a third party (an Identity Provider or IdP) to authenticate an identity on your behalf in what’s known as federation (“login with Google” on Slack).",{"data":47231,"content":47232,"nodeType":881},{},[47233],{"data":47234,"marks":47235,"value":47236,"nodeType":865},{},[],"Surprisingly, it’s very common for modern apps to allow a user to authenticate to the same account using a local credential (a username and password) and a federated identity (e.g. the “login with Google” or “login with Microsoft” buttons) interchangeably.",{"data":47238,"content":47239,"nodeType":881},{},[47240],{"data":47241,"marks":47242,"value":47243,"nodeType":865},{},[],"That’s how you could wind up with multiple identities tied to a single account, or multiple accounts tied to a single federated identity. This is exactly what you see for real users - and every weird in-between case to boot.",{"data":47245,"content":47246,"nodeType":904},{},[47247],{"data":47248,"marks":47249,"value":47250,"nodeType":865},{},[],"The “new perimeter” … from a red-teamer’s perspective",{"data":47252,"content":47253,"nodeType":881},{},[47254],{"data":47255,"marks":47256,"value":21,"nodeType":865},{},[],{"data":47258,"content":47259,"nodeType":881},{},[47260],{"data":47261,"marks":47262,"value":47263,"nodeType":865},{},[],"To see how identities are the new thing, it helps to see how we got here.",{"data":47265,"content":47266,"nodeType":1860},{},[47267],{"data":47268,"marks":47269,"value":47270,"nodeType":865},{},[],"The good old days",{"data":47272,"content":47273,"nodeType":881},{},[47274],{"data":47275,"marks":47276,"value":47277,"nodeType":865},{},[],"A couple of decades ago, I was just getting started as a red-teamer or penetration tester, or whatever you want to call it. The job is to do what real attackers do so clients could understand the attack techniques and better defend against them. The most stressful part of each project was the first step - getting initial access to the target - getting past their perimeter and into the (usually) soft internals.",{"data":47279,"content":47280,"nodeType":881},{},[47281],{"data":47282,"marks":47283,"value":47284,"nodeType":865},{},[],"A security perimeter is a boundary at which controls can be enforced. From an offensive perspective, a security perimeter is the same as an attack surface: where you can target initial attacks to gain a foothold, from which you can launch further attacks. I use perimeter and attack surface interchangeably going forward.",{"data":47286,"content":47287,"nodeType":881},{},[47288,47292,47297],{"data":47289,"marks":47290,"value":47291,"nodeType":865},{},[],"A perimeter can be physical, like a wall around a house, or virtual like the network boundary between an internal network and the internet where controls are things like firewalls. A couple of decades ago this internet network boundary was ",{"data":47293,"marks":47294,"value":47296,"nodeType":865},{},[47295],{"type":5120},"the",{"data":47298,"marks":47299,"value":47300,"nodeType":865},{},[]," perimeter. As any decent red-teamer during this era, we had a pretty well-oiled process of mapping a client’s external network, scanning it for services, and then identifying and exploiting known vulnerabilities in those services. With this foothold on a target network, we could pivot to other, more sensitive internal systems.",{"data":47302,"content":47303,"nodeType":881},{},[47304],{"data":47305,"marks":47306,"value":47307,"nodeType":865},{},[],"Blue teams started having success with automated vulnerability scanning and patching programs, during this time. Then red teams responded by focusing on finding new vulnerabilities, especially in custom code like web applications. I fondly remember using techniques like xp_cmdshell with SQL injection to get access to breach perimeter systems and get access to internal networks. As DMZs, SDLC, vuln scanning and a dozen other tactics became generally adopted things improved to the point where those standard red-team playbooks weren’t working anymore. ",{"data":47309,"content":47310,"nodeType":1860},{},[47311],{"data":47312,"marks":47313,"value":47314,"nodeType":865},{},[],"The shift to targeting users and their endpoints",{"data":47316,"content":47317,"nodeType":881},{},[47318],{"data":47319,"marks":47320,"value":47321,"nodeType":865},{},[],"About a decade ago, attackers realized it was easier to breach the perimeter and gain access to internal networks by simply targeting users with endpoints directly connected to the internal network. At the time the main techniques were email phishing and malicious web pages delivering exploits or straight malware. We put down Burp and our other web app testing tools and started spending our time crafting phishing emails with malicious macro-laden Microsoft Office documents for that initial entrypoint.",{"data":47323,"content":47324,"nodeType":881},{},[47325],{"data":47326,"marks":47327,"value":47328,"nodeType":865},{},[],"Defenders were on the back foot and even back then the “train your employees to spot attacks” advice felt as totally unrealistic as it’s now proved to be. The zeitgeist suggested, \"Attackers only need to succeed once; defenders must succeed every time.\" Defenders were blind and the focus was firmly on detection. Much much better telemetry was needed, which spawned the endpoint detection and response (EDR) revolution. ",{"data":47330,"content":47331,"nodeType":881},{},[47332],{"data":47333,"marks":47334,"value":47335,"nodeType":865},{},[],"EDR required immediate changes to red team tactics, and together with better endpoint security defaults, automatic OS updates (that actually started working) and memory exploit protections (things like DEP and ASLR) the timelines for successful attacks were stretching a lot.",{"data":47337,"content":47338,"nodeType":1860},{},[47339],{"data":47340,"marks":47341,"value":47342,"nodeType":865},{},[],"The modern perimeter",{"data":47344,"content":47345,"nodeType":881},{},[47346],{"data":47347,"marks":47348,"value":47349,"nodeType":865},{},[],"Attackers have had to change tactics yet again, due to the rising cost of attacking endpoints and the fact that data has moved off endpoints and internal networks and onto cloud systems or Software as a Service (SaaS) applications.",{"data":47351,"content":47355,"nodeType":890},{"target":47352},{"sys":47353},{"id":47354,"type":887,"linkType":888},"79wGG37CY7aBdRrdjO5eQY",[],{"data":47357,"content":47358,"nodeType":881},{},[47359],{"data":47360,"marks":47361,"value":47362,"nodeType":865},{},[],"Identities have always existed as a target for attackers and were a critical part of the kill chain, but they used to be protected by some other perimeter, be that a network perimeter or an endpoint perimeter. ",{"data":47364,"content":47365,"nodeType":881},{},[47366],{"data":47367,"marks":47368,"value":47369,"nodeType":865},{},[],"This has fundamentally changed as modern work applications are now directly exposed to the internet  - and the only thing needed to access these apps are identities. That means identities are now no longer the second or third target but the initial target, the new perimeter.",{"data":47371,"content":47372,"nodeType":904},{},[47373],{"data":47374,"marks":47375,"value":47376,"nodeType":865},{},[],"Securing the (identity) perimeter",{"data":47378,"content":47379,"nodeType":881},{},[47380],{"data":47381,"marks":47382,"value":47383,"nodeType":865},{},[],"To understand how we can protect this new perimeter, I’ll discuss the general approach to securing any perimeter, and then how this applies to the identity attack surface.",{"data":47385,"content":47389,"nodeType":890},{"target":47386},{"sys":47387},{"id":47388,"type":887,"linkType":888},"c0YSk60vVULBPorLkkBPL",[],{"data":47391,"content":47392,"nodeType":1860},{},[47393],{"data":47394,"marks":47395,"value":47397,"nodeType":865},{},[47396],{"type":902},"1. Map your perimeter",{"data":47399,"content":47400,"nodeType":881},{},[47401],{"data":47402,"marks":47403,"value":47404,"nodeType":865},{},[],"It’s impossible to secure what you don’t know about. Whether your perimeter is made of network services, user endpoints or identities, you must know what they are before you can implement controls to protect them, and crucially, verify those controls are effective.",{"data":47406,"content":47407,"nodeType":881},{},[47408],{"data":47409,"marks":47410,"value":47411,"nodeType":865},{},[],"In a traditional network setting, you might ask IT to inventory public network ranges, domains you own, and internet facing servers and services to get visibility into your attack surface. This is a pretty complex task and lots of the static inventory will quickly become outdated and incomplete. That’s why many orgs will perform network discovery activities to find internet-exposed network services, using anything from basic network scans to find onsite or self-hosted services to querying APIs in cloud infrastructure platforms (like AWS or Azure).",{"data":47413,"content":47414,"nodeType":881},{},[47415],{"data":47416,"marks":47417,"value":47418,"nodeType":865},{},[],"There are parallels in the identity perimeter space, like querying Identity Providers (IdPs like Entra/AzureAD or Okta) for federated identities to map the attack surface. Unfortunately there is no equivalent to scanning your public network ranges for identities, since you can’t scan or query an app to find accounts on your domain (would that we could!). This problem is compounded by the fact that while IT and developers are typically the only ones that can create and expose new network services, most apps allow any employee to create a new identity by signing up to a free account outside your SSO solution.",{"data":47420,"content":47421,"nodeType":881},{},[47422],{"data":47423,"marks":47424,"value":47425,"nodeType":865},{},[],"Knowing your perimeter without a technical solution is going to be a very hit and miss affair. To have confidence that you understand your identity perimeter, you need an inventory solution that can discover SSO identities (the easy part), as well as identities created outside SSO, like local accounts those employees created just by signing up. To secure identities it’s not enough to know that an employee is accessing an app website, you need to know if they are logged in and what identity they are using (is the username a company email or personal gmail?) or you’ll be dealing with endless false positives.",{"data":47427,"content":47428,"nodeType":1860},{},[47429],{"data":47430,"marks":47431,"value":47433,"nodeType":865},{},[47432],{"type":902},"2. Reduce the size of your attack surface",{"data":47435,"content":47436,"nodeType":881},{},[47437],{"data":47438,"marks":47439,"value":47440,"nodeType":865},{},[],"Once you have an idea of what makes up your perimeter, it’s generally a good idea to make it as small as possible. If you halve the number of network services an attacker can target, that means you can spend twice as long per service to secure the ones that remain - the same goes for identities!",{"data":47442,"content":47446,"nodeType":890},{"target":47443},{"sys":47444},{"id":47445,"type":887,"linkType":888},"2XZ5vADLzuEnc2aAdZrkbO",[],{"data":47448,"content":47449,"nodeType":881},{},[47450],{"data":47451,"marks":47452,"value":47453,"nodeType":865},{},[],"To start this process, remove unused or unnecessary targets from the perimeter. ",{"data":47455,"content":47456,"nodeType":881},{},[47457],{"data":47458,"marks":47459,"value":47460,"nodeType":865},{},[],"On a network perimeter that might mean:",{"data":47462,"content":47463,"nodeType":1818},{},[47464,47474],{"data":47465,"content":47466,"nodeType":1734},{},[47467],{"data":47468,"content":47469,"nodeType":881},{},[47470],{"data":47471,"marks":47472,"value":47473,"nodeType":865},{},[],"Shutting down unused servers or",{"data":47475,"content":47476,"nodeType":1734},{},[47477],{"data":47478,"content":47479,"nodeType":881},{},[47480],{"data":47481,"marks":47482,"value":47483,"nodeType":865},{},[],"Firewalling services that don’t need to be exposed to the internet.",{"data":47485,"content":47486,"nodeType":881},{},[47487],{"data":47488,"marks":47489,"value":47490,"nodeType":865},{},[],"In the identity space, you might:",{"data":47492,"content":47493,"nodeType":1818},{},[47494,47504,47514],{"data":47495,"content":47496,"nodeType":1734},{},[47497],{"data":47498,"content":47499,"nodeType":881},{},[47500],{"data":47501,"marks":47502,"value":47503,"nodeType":865},{},[],"Make sure new accounts use existing federated identities,",{"data":47505,"content":47506,"nodeType":1734},{},[47507],{"data":47508,"content":47509,"nodeType":881},{},[47510],{"data":47511,"marks":47512,"value":47513,"nodeType":865},{},[],"Delete or disable unused SSO identities on your IdP, or ",{"data":47515,"content":47516,"nodeType":1734},{},[47517],{"data":47518,"content":47519,"nodeType":881},{},[47520],{"data":47521,"marks":47522,"value":47523,"nodeType":865},{},[],"Manually delete unnecessary user accounts on work apps.",{"data":47525,"content":47526,"nodeType":881},{},[47527],{"data":47528,"marks":47529,"value":47530,"nodeType":865},{},[],"Manually deleting an unmanaged local identity on an app, e.g. after an employee leaves your org, is a (very) non-trivial task. This is because you often don’t known of the accounts and don't have access to manage the account (the IT or security team aren’t admin on the app tenant where it exists). You might have access to the user’s mailbox and be able to get access to the account by going through an account recovery flow and delete the account that way - but this is very time consuming and even more difficult if the user enabled MFA (which is what you want them to do!).",{"data":47532,"content":47533,"nodeType":881},{},[47534,47538,47543],{"data":47535,"marks":47536,"value":47537,"nodeType":865},{},[],"Given the difficulty of managing these accounts, a better strategy is to ",{"data":47539,"marks":47540,"value":47542,"nodeType":865},{},[47541],{"type":902},"make sure they never exist in the first place",{"data":47544,"marks":47545,"value":47546,"nodeType":865},{},[],". If you find you have lots of identities on an app you may decide the risk warrants IT effort and you can take over management of the app and integrate it with your IdP solution - or ask employees to use an alternative app instead. You can also use browser-based technical controls to prevent users from creating local identities in the first place.",{"data":47548,"content":47549,"nodeType":1860},{},[47550],{"data":47551,"marks":47552,"value":47554,"nodeType":865},{},[47553],{"type":902},"3. Harden the perimeter",{"data":47556,"content":47557,"nodeType":881},{},[47558],{"data":47559,"marks":47560,"value":47561,"nodeType":865},{},[],"Once you’ve made the perimeter as small as possible, the next step is to make it more difficult to breach that perimeter. Similar to the other objectives, but especially here, there are two sides to this. First the implementation; you have processes, configuration standards, and tools to make sure network services are updated and securely configured. Virtually no one achieves success simply through implementing good processes, you must continually verify that these processes work and that it continues to work.",{"data":47563,"content":47564,"nodeType":881},{},[47565],{"data":47566,"marks":47567,"value":47568,"nodeType":865},{},[],"To verify network controls are in place and working you do something like vulnerability scanning, where you check the perimeter for known vulnerabilities that an attacker could exploit and gain a foothold on your internal network. You might even have a risk profile that means you are concerned about more targeted attacks and hire pentesters or run a bug-bounty program to find weaknesses that can’t be automatically discovered. Very few organizations with an external network of any significant size perform a vulnerability scan for the first time - even a low-quality automated one - and find no serious issues. ",{"data":47570,"content":47571,"nodeType":881},{},[47572],{"data":47573,"marks":47574,"value":47575,"nodeType":865},{},[],"In the identity space, the status-quo is to be content with making policies and implementing and configuring an SSO system without explicit verification that it works as it should. We should be following the same level of verification processes for the identity perimeter as we do/did for the endpoint and network perimeter. ",{"data":47577,"content":47578,"nodeType":881},{},[47579],{"data":47580,"marks":47581,"value":47582,"nodeType":865},{},[],"In this case, the vulnerabilities we are looking for aren’t unpatched systems or zero-days. Instead, we’re looking for:",{"data":47584,"content":47585,"nodeType":1818},{},[47586,47596,47606,47616,47626],{"data":47587,"content":47588,"nodeType":1734},{},[47589],{"data":47590,"content":47591,"nodeType":881},{},[47592],{"data":47593,"marks":47594,"value":47595,"nodeType":865},{},[],"Accounts without MFA, ",{"data":47597,"content":47598,"nodeType":1734},{},[47599],{"data":47600,"content":47601,"nodeType":881},{},[47602],{"data":47603,"marks":47604,"value":47605,"nodeType":865},{},[],"Those using weak MFA methods that make them phish-able,",{"data":47607,"content":47608,"nodeType":1734},{},[47609],{"data":47610,"content":47611,"nodeType":881},{},[47612],{"data":47613,"marks":47614,"value":47615,"nodeType":865},{},[],"Employees re-using the same password across multiple accounts, ",{"data":47617,"content":47618,"nodeType":1734},{},[47619],{"data":47620,"content":47621,"nodeType":881},{},[47622],{"data":47623,"marks":47624,"value":47625,"nodeType":865},{},[],"Passwords that exist in public breach dumps,",{"data":47627,"content":47628,"nodeType":1734},{},[47629],{"data":47630,"content":47631,"nodeType":881},{},[47632],{"data":47633,"marks":47634,"value":47635,"nodeType":865},{},[],"Identities that should be in SSO but aren’t.",{"data":47637,"content":47638,"nodeType":881},{},[47639],{"data":47640,"marks":47641,"value":47642,"nodeType":865},{},[],"It’s not yet standard practice to test or verify that identity controls are in place, but if the past has taught us anything it soon will be. You'd be surprised how many times we find that the MFA policies security teams thought they had in place, actually aren't.",{"data":47644,"content":47648,"nodeType":890},{"target":47645},{"sys":47646},{"id":47647,"type":887,"linkType":888},"4w5UZcf5hJ7ADuoT5W2tkC",[],{"data":47650,"content":47651,"nodeType":881},{},[47652],{"data":47653,"marks":47654,"value":47655,"nodeType":865},{},[],"Part of the reason for this lack of verification is due to lack of awareness. While identities used to be an internal thing that we protected with the network perimeter, online identities today are external and have slowly become the perimeter, almost without anyone noticing. While online identities are external, they are absolutely part of your attack surface and must be controlled and hardened to some extent.",{"data":47657,"content":47658,"nodeType":881},{},[47659],{"data":47660,"marks":47661,"value":47662,"nodeType":865},{},[],"Verifying controls is also really difficult, which is another reason we may not be making it a crucial step in the process. Customers feel that SSO solutions are security solutions and using security tools on security tools feel wrong. But it’s no different to vuln-scanning to ensure your firewalls are patched and don’t have default passwords. ",{"data":47664,"content":47665,"nodeType":881},{},[47666],{"data":47667,"marks":47668,"value":47669,"nodeType":865},{},[],"Verification can also be legally challenging because it’s not yet clear whether pentesters or red teamers are allowed to target online identities during assessments. Often these assets aren’t considered in scope during client assessments. This means these vulnerabilities rarely end up in pentest reports and therefore don’t enter many organization’s security or risk management processes. Since you own the identities (even on a third party identity solution or app) and are allowed to grant permission to the red team to use these identities, it seems to me that adding identities to the scope is distinct from bug hunting or vulnerability research on these apps (which is the legally challenging aspect). I would strongly recommend that you discuss including online identities with the red team as part of your next pentest.",{"data":47671,"content":47672,"nodeType":1860},{},[47673],{"data":47674,"marks":47675,"value":47677,"nodeType":865},{},[47676],{"type":902},"4. Limit breach impact",{"data":47679,"content":47680,"nodeType":881},{},[47681],{"data":47682,"marks":47683,"value":47684,"nodeType":865},{},[],"The unfortunate reality is that regardless of what we do to harden a perimeter, there will always be a chance that breaches occur. The goal is to reduce that risk by minimizing the attack surface and hardening identities. ",{"data":47686,"content":47687,"nodeType":881},{},[47688],{"data":47689,"marks":47690,"value":47691,"nodeType":865},{},[],"When an attacker does get a foothold (by compromising an identity, for instance) you need to to restrict their further actions. Risk involves both the likelihood and the impact of an event. Previously, we focused on reducing the likelihood of breaches. Now, we're also aiming to lessen the impact if they do occur.",{"data":47693,"content":47694,"nodeType":881},{},[47695],{"data":47696,"marks":47697,"value":47698,"nodeType":865},{},[],"In our network perimeter story, we might think of using a DMZ network to restrict network access for systems exposed to the internet. A common example of a failure to limit impact on a Windows endpoint breach is having service accounts on all endpoints with Domain Administrator permission - which effectively turns a breach of any endpoint very quickly into a breach of every endpoint.",{"data":47700,"content":47701,"nodeType":881},{},[47702,47706,47715,47719,47726],{"data":47703,"marks":47704,"value":47705,"nodeType":865},{},[],"In an identity context, we need to think not only of the direct effect of an identity compromise (e.g. what data can this account read), but also of further lateral movement attacks. Consider this ",{"data":47707,"content":47709,"nodeType":876},{"uri":47708},"https://pushsecurity.com/blog/oktajacking/",[47710],{"data":47711,"marks":47712,"value":47714,"nodeType":865},{},[47713],{"type":874},"Oktajacking",{"data":47716,"marks":47717,"value":47718,"nodeType":865},{},[]," case study where a breached identity with admin permissions on an otherwise low-risk app which is connected to SSO can be used to perform a ",{"data":47720,"content":47722,"nodeType":876},{"uri":47721},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/samljacking/description.md",[47723],{"data":47724,"marks":47725,"value":42664,"nodeType":865},{},[],{"data":47727,"marks":47728,"value":47729,"nodeType":865},{},[]," attack that compromises SSO credentials for all other users of the same low-risk app.",{"data":47731,"content":47732,"nodeType":881},{},[47733],{"data":47734,"marks":47735,"value":47736,"nodeType":865},{},[],"In contrast to traditional network or endpoint breaches, identity breaches are scoped to the permissions that the compromised account has. If an identity is compromised, whatever that identity is authorized to do is the scope of the breach. For example:",{"data":47738,"content":47739,"nodeType":1818},{},[47740,47750],{"data":47741,"content":47742,"nodeType":1734},{},[47743],{"data":47744,"content":47745,"nodeType":881},{},[47746],{"data":47747,"marks":47748,"value":47749,"nodeType":865},{},[],"If an identity with read access to a code repository was breached you might consider that all the source code (hopefully no secrets!) they had read access to was taken unless you can prove otherwise. This is often more difficult than you expect - last time I checked Github (by far the world's most popular source code repository app) logs didn’t include, for example, zipped repo downloads. ",{"data":47751,"content":47752,"nodeType":1734},{},[47753],{"data":47754,"content":47755,"nodeType":881},{},[47756,47760,47768],{"data":47757,"marks":47758,"value":47759,"nodeType":865},{},[],"If an identity with write permission was compromised, you would also need to check all commits/changes to ensure no code was backdoored. The same applies for other apps - think of an identity with write access to a wiki being used to ",{"data":47761,"content":47763,"nodeType":876},{"uri":47762},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/link_backdooring/description.md",[47764],{"data":47765,"marks":47766,"value":47767,"nodeType":865},{},[],"drop links to phishing pages",{"data":47769,"marks":47770,"value":959,"nodeType":865},{},[],{"data":47772,"content":47773,"nodeType":881},{},[47774],{"data":47775,"marks":47776,"value":47777,"nodeType":865},{},[],"For primary cloud collaboration platforms with complex data types (think O365 or Google Workspace) your IT team is likely already managing policies to limit the data that a user can read. For primary cloud hosting platforms your DevOps teams are likely maintaining policies to manage privileged access to production systems. The situation is typically very different for the few dozen high risk “core apps” beyond the 2 or 3 apps that receive a lot of attention and have dedicated teams.",{"data":47779,"content":47780,"nodeType":881},{},[47781],{"data":47782,"marks":47783,"value":47784,"nodeType":865},{},[],"Starting to review roles and permissions across the few dozen or so high-risk apps that are not as actively managed (or more likely self-managed by the teams using them) is a good way to start addressing the residual risk. The good news here is that most modern work apps use a much simpler permission model based largely around predefined roles like Owner, Admin, or Employee or similar variations. This means less flexibility, but also makes it a lot easier to manage permissions for identities on these apps - on balance, a good trade!",{"data":47786,"content":47787,"nodeType":881},{},[47788],{"data":47789,"marks":47790,"value":47791,"nodeType":865},{},[],"Consider this as part of your identity and access management review process. Something that used to be scoped around Active Directory group membership, but in a modern online identity context, now must be applied across many different work apps. ",{"data":47793,"content":47794,"nodeType":881},{},[47795],{"data":47796,"marks":47797,"value":47798,"nodeType":865},{},[],"Unless you want to try to get access to each tenant of each app and normalize this data into a mega-spreadsheet, you need access to this data in your identity inventory. This is an especially big challenge as teams find many of the apps they care about support authentication through SSO, but not authorization.",{"data":47800,"content":47801,"nodeType":1860},{},[47802],{"data":47803,"marks":47804,"value":47806,"nodeType":865},{},[47805],{"type":902},"5. Detect and respond to attacks",{"data":47808,"content":47809,"nodeType":881},{},[47810],{"data":47811,"marks":47812,"value":47813,"nodeType":865},{},[],"Your last line of defense in protecting a perimeter is to monitor for attacks. It’s typically when controls and detections fail that breaches end in the news. ",{"data":47815,"content":47816,"nodeType":881},{},[47817],{"data":47818,"marks":47819,"value":47820,"nodeType":865},{},[],"Telemetry is the core building block of attack detection. Typically, you might ingest audit or event logs into a SIEM system. To detect attacks against identities, you’ll typically want to start with telemetry from SSO or IdP logs. These will provide some minimal coverage of many of the IT managed apps, but unfortunately attacks are more likely to happen on apps that aren’t SSO integrated, so we need a strategy to cover these as well. An identity inventory is a critical starting point to identify non-SSO apps from which you can collect event logs, as well as giving you visibility of the identities that are not covered.",{"data":47822,"content":47823,"nodeType":881},{},[47824],{"data":47825,"marks":47826,"value":47827,"nodeType":865},{},[],"Monitoring breaches for hosted work apps is different from other domains, largely because you are almost totally reliant on the app vendor to produce the telemetry. Unfortunately (I suspect primarily due to lack of customer demand), many apps don’t offer any centralized logging functionality at all, and those that do offer limited audit logs, or only do so on the top tier “enterprise” license plans. ",{"data":47829,"content":47830,"nodeType":881},{},[47831],{"data":47832,"marks":47833,"value":47834,"nodeType":865},{},[],"In the network or endpoint world, when you need more telemetry you have all the access you need to install software or hardware to generate that additional telemetry. You could put a network monitoring appliance in-line with your internet gateways or install an endpoint (EDR) agent to generate more telemetry than your router or endpoint OS will generate. You can add a proxy in front of an app for your users, but (except for a very small number of highly configurable apps) you can’t make attackers go through your proxy.",{"data":47836,"content":47837,"nodeType":881},{},[47838],{"data":47839,"marks":47840,"value":47841,"nodeType":865},{},[],"What you can do, however, is generate additional telemetry on what happens to your employee’s identities in the browser. This is possible through browser extensions which can be managed through the enterprise management features available for all mainstream browsers (Chrome, Edge, Firefox, Safari, Brave etc. etc.). This is incredibly powerful, and useful in directly detecting a range of identity attacks like phishing (is an employee trying to enter an SSO password into an app that isn’t the SSO login page?), but also through correlations with existing application or IdP logs that indicate account takeover (e.g. has there been a login event that wasn’t observed through the employee’s browser as well).",{"data":47843,"content":47844,"nodeType":904},{},[47845],{"data":47846,"marks":47847,"value":47848,"nodeType":865},{},[],"Same, but different",{"data":47850,"content":47851,"nodeType":881},{},[47852],{"data":47853,"marks":47854,"value":47855,"nodeType":865},{},[],"Whether we’re looking at the Verizon DBIR or just keeping up with security news, it’s clear that identity-based attacks are already responsible for a significant number of breaches. Attackers have started shifting their focus and security teams need to recognize this shift and adapt.",{"data":47857,"content":47858,"nodeType":881},{},[47859],{"data":47860,"marks":47861,"value":47862,"nodeType":865},{},[],"This doesn’t require that we fundamentally rethink security or anything that radical, just that we apply what we’ve learned over the last couple of decades to this new domain. There are some new technologies and protocols to understand, new tools are needed, but the fundamentals like authentication and authorization are already familiar to any security professional. ",{"data":47864,"content":47865,"nodeType":881},{},[47866,47870,47878],{"data":47867,"marks":47868,"value":47869,"nodeType":865},{},[],"If you follow what I’ve outlined here, a lot of the decisions we’ve made with building Push will make perfect sense. For example, you can’t make API integrations with apps to find identities when you don’t know about the apps or identities yet, so we needed a unique new data source. We use our own custom-built browser extension that’s force-deployed to your workforce, so we can observe employee identities as they are used in the browser. This gives us some pretty unique capabilities. If you found this interesting, follow us on ",{"data":47871,"content":47873,"nodeType":876},{"uri":47872},"https://www.linkedin.com/company/push-security",[47874],{"data":47875,"marks":47876,"value":47877,"nodeType":865},{},[],"Linkedin",{"data":47879,"marks":47880,"value":47881,"nodeType":865},{},[]," for more detailed blogs as we unpack this topic.",{"data":47883,"content":47887,"nodeType":890},{"target":47884},{"sys":47885},{"id":47886,"type":887,"linkType":888},"H7m9DHmbE945FO193oLYP",[],{"data":47889,"content":47890,"nodeType":881},{},[47891],{"data":47892,"marks":47893,"value":21,"nodeType":865},{},[],"5 ways to defeat identity-based attacks","In this blog post we will cover what identities are, how we secure perimeters in general, and and how this maps to the identity space.\n","2024-02-26T00:00:00.000Z","5-ways-to-defeat-identity-based-attacks",{"items":47899},[47900,47902],{"sys":47901,"name":297},{"id":6385},{"sys":47903,"name":342},{"id":4510},{"items":47905},[47906],{"fullName":32651,"firstName":32652,"jobTitle":32653,"profilePicture":47907},{"url":32655},{"__typename":1485,"sys":47909,"content":47911,"title":48238,"synopsis":48239,"hashTags":59,"publishedDate":48240,"slug":48241,"tagsCollection":48242,"authorsCollection":48248},{"id":47910},"75wcCkoZEKwEMl7zBmDMtT",{"json":47912},{"data":47913,"content":47914,"nodeType":1463},{},[47915,47922,47929,47948,47966,47989,47996,48012,48019,48026,48033,48036,48043,48063,48081,48087,48107,48114,48121,48127,48134,48140,48173,48180,48199,48202,48209,48220,48226,48232],{"data":47916,"content":47917,"nodeType":904},{},[47918],{"data":47919,"marks":47920,"value":47921,"nodeType":865},{},[],"Preventing credential attacks with automated password resets ",{"data":47923,"content":47924,"nodeType":881},{},[47925],{"data":47926,"marks":47927,"value":47928,"nodeType":865},{},[],"Preventing credential attacks is not an easy task, especially if you’re a member of the security team tasked with protecting some of your organization’s most valued assets: SSO identities.",{"data":47930,"content":47931,"nodeType":881},{},[47932,47936,47945],{"data":47933,"marks":47934,"value":47935,"nodeType":865},{},[],"IdP accounts such as a user’s Okta, Entra, or Google Workspace login are the most lucrative identities that an attacker can take over. By compromising an SSO identity, attackers not only gain access to the account itself, but also any downstream apps accessed via SSO – and the juicy data and functionality stored there. This was evidenced earlier this year when ",{"data":47937,"content":47939,"nodeType":876},{"uri":47938},"https://www.bleepingcomputer.com/news/security/okta-warns-of-unprecedented-credential-stuffing-attacks-on-customers/",[47940],{"data":47941,"marks":47942,"value":47944,"nodeType":865},{},[47943],{"type":874},"Okta users experienced unprecedented levels of credential stuffing attacks",{"data":47946,"marks":47947,"value":1032,"nodeType":865},{},[],{"data":47949,"content":47950,"nodeType":881},{},[47951,47955,47963],{"data":47952,"marks":47953,"value":47954,"nodeType":865},{},[],"You might also be surprised to learn that even these most critical accounts have serious security gaps. For example, ",{"data":47956,"content":47957,"nodeType":876},{"uri":30250},[47958],{"data":47959,"marks":47960,"value":47962,"nodeType":865},{},[47961],{"type":874},"in a recent study we identified that",{"data":47964,"marks":47965,"value":24662,"nodeType":865},{},[],{"data":47967,"content":47968,"nodeType":1818},{},[47969,47979],{"data":47970,"content":47971,"nodeType":1734},{},[47972],{"data":47973,"content":47974,"nodeType":881},{},[47975],{"data":47976,"marks":47977,"value":47978,"nodeType":865},{},[],"1 in 5 IdP accounts does not have an MFA method set, leaving them exposed to single-factor compromises using stolen credentials.",{"data":47980,"content":47981,"nodeType":1734},{},[47982],{"data":47983,"content":47984,"nodeType":881},{},[47985],{"data":47986,"marks":47987,"value":47988,"nodeType":865},{},[],"10% of IdP accounts share a password that is used to access other identities. (We’re not talking about the actual SSO process here – many users will use the same password as they do to log into their Okta or Entra as they do personal accounts such as shopping or food delivery. Yes, really.)  ",{"data":47990,"content":47991,"nodeType":881},{},[47992],{"data":47993,"marks":47994,"value":47995,"nodeType":865},{},[],"It’s a constant worry that your CFO’s Microsoft, Google, or Okta credentials are going to show up in the next big darkweb password dump. Ideally you’d want to prevent users from reusing passwords across multiple services. That’s why your information security policy is mandating password manager use, right?",{"data":47997,"content":47998,"nodeType":881},{},[47999,48003,48008],{"data":48000,"marks":48001,"value":48002,"nodeType":865},{},[],"No matter how many policies you have in place, ",{"data":48004,"marks":48005,"value":48007,"nodeType":865},{},[48006],{"type":874},"people will inevitably use the same passwords across multiple services",{"data":48009,"marks":48010,"value":48011,"nodeType":865},{},[],". But who can blame them? Having to remember multiple passwords is a drag, especially when they find they can’t log into their company’s password manager from their home computers… The next best thing is to just reuse your Entra or Okta password across all services, right?!",{"data":48013,"content":48014,"nodeType":881},{},[48015],{"data":48016,"marks":48017,"value":48018,"nodeType":865},{},[],"At Push we realize that mistakes happen. That's why it's important to look out for when critical credentials are entered into a dodgy ecommerce platform, or the next entry lands on haveibeenpwnd.com.",{"data":48020,"content":48021,"nodeType":881},{},[48022],{"data":48023,"marks":48024,"value":48025,"nodeType":865},{},[],"By quickly forcing a password change when an SSO password is reused or breached, we can minimize the chance of it being abused by attackers. ",{"data":48027,"content":48028,"nodeType":881},{},[48029],{"data":48030,"marks":48031,"value":48032,"nodeType":865},{},[],"But how will you know when a password is reused or compromised? ",{"data":48034,"content":48035,"nodeType":894},{},[],{"data":48037,"content":48038,"nodeType":904},{},[48039],{"data":48040,"marks":48041,"value":48042,"nodeType":865},{},[],"Using Push data to alert on password vulnerabilities ",{"data":48044,"content":48045,"nodeType":881},{},[48046,48050,48059],{"data":48047,"marks":48048,"value":48049,"nodeType":865},{},[],"Enter the Push browser extension. Push fingerprints passwords (",{"data":48051,"content":48053,"nodeType":876},{"uri":48052},"https://pushsecurity.com/help/how-does-the-push-browser-extension-securely-track-reused-passwords",[48054],{"data":48055,"marks":48056,"value":48058,"nodeType":865},{},[48057],{"type":874},"in a safe way",{"data":48060,"marks":48061,"value":48062,"nodeType":865},{},[],") as they are used by employees to access apps in their browsers. ",{"data":48064,"content":48065,"nodeType":881},{},[48066,48070,48078],{"data":48067,"marks":48068,"value":48069,"nodeType":865},{},[],"When a user logs into an app using credentials that they’ve previously used to login to another account, Push fires off an alert. ",{"data":48071,"content":48072,"nodeType":876},{"uri":44305},[48073],{"data":48074,"marks":48075,"value":48077,"nodeType":865},{},[48076],{"type":874},"We can also detect when an active password is stolen and appears on a criminal forum",{"data":48079,"marks":48080,"value":1032,"nodeType":865},{},[],{"data":48082,"content":48086,"nodeType":890},{"target":48083},{"sys":48084},{"id":48085,"type":887,"linkType":888},"5He3FB0NT3D3lcbwiVtn02",[],{"data":48088,"content":48089,"nodeType":881},{},[48090,48094,48103],{"data":48091,"marks":48092,"value":48093,"nodeType":865},{},[],"If you’ve ",{"data":48095,"content":48097,"nodeType":876},{"uri":48096},"https://pushsecurity.com/help/audience/administrators/docs/connect-to-siem-or-soar/#start",[48098],{"data":48099,"marks":48100,"value":48102,"nodeType":865},{},[48101],{"type":874},"connected Push to your SIEM or SOAR",{"data":48104,"marks":48105,"value":48106,"nodeType":865},{},[],", you’ll be able to create a workflow to respond automatically. ",{"data":48108,"content":48109,"nodeType":1860},{},[48110],{"data":48111,"marks":48112,"value":48113,"nodeType":865},{},[],"Automating password resets in your SIEM using Push webhooks",{"data":48115,"content":48116,"nodeType":881},{},[48117],{"data":48118,"marks":48119,"value":48120,"nodeType":865},{},[],"You can automate password resets for accounts by ingesting this information via webhook into a SIEM, generating an alert. This in turn can fire off another webhook or workflow that sets the ‘force password change on next logon’ attribute on the user’s account.",{"data":48122,"content":48126,"nodeType":890},{"target":48123},{"sys":48124},{"id":48125,"type":887,"linkType":888},"5WFLIVm4DWcuH7a6owQlR1",[],{"data":48128,"content":48129,"nodeType":881},{},[48130],{"data":48131,"marks":48132,"value":48133,"nodeType":865},{},[],"Below is some POC python code we use internally. This is specific to Google Workspace, but the general logic should apply to any IdP that allows you to perform these actions via API calls.",{"data":48135,"content":48139,"nodeType":890},{"target":48136},{"sys":48137},{"id":48138,"type":887,"linkType":888},"4YNirRo8BlRrgGKwwzXE8R",[],{"data":48141,"content":48142,"nodeType":881},{},[48143,48147,48156,48160,48169],{"data":48144,"marks":48145,"value":48146,"nodeType":865},{},[],"You can perform similar functions in Microsoft Entra ID by modifying the user's ",{"data":48148,"content":48150,"nodeType":876},{"uri":48149},"https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http#:~:text=DisablePasswordExpiration%2C%20DisableStrongPassword.-,passwordProfile,-PasswordProfile",[48151],{"data":48152,"marks":48153,"value":48155,"nodeType":865},{},[48154],{"type":874},"passwordProfile",{"data":48157,"marks":48158,"value":48159,"nodeType":865},{},[]," attribute via Microsoft Graph API, or in Okta via the ",{"data":48161,"content":48163,"nodeType":876},{"uri":48162},"https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserCred/#tag/UserCred/operation/expirePassword",[48164],{"data":48165,"marks":48166,"value":48168,"nodeType":865},{},[48167],{"type":874},"expire_password",{"data":48170,"marks":48171,"value":48172,"nodeType":865},{},[]," API endpoint.",{"data":48174,"content":48175,"nodeType":881},{},[48176],{"data":48177,"marks":48178,"value":48179,"nodeType":865},{},[],"You aren’t limited to just IdP accounts either – any app with an API that provides this functionality can be configured for automated password resets using Push data. ",{"data":48181,"content":48182,"nodeType":881},{},[48183,48187,48195],{"data":48184,"marks":48185,"value":48186,"nodeType":865},{},[],"We also use SSO password data to ",{"data":48188,"content":48189,"nodeType":876},{"uri":17092},[48190],{"data":48191,"marks":48192,"value":48194,"nodeType":865},{},[48193],{"type":874},"prevent users from entering their SSO credentials into phishing sites",{"data":48196,"marks":48197,"value":48198,"nodeType":865},{},[],", providing strong anti-phishing protection that is extremely hard for attackers to bypass. ",{"data":48200,"content":48201,"nodeType":894},{},[],{"data":48203,"content":48204,"nodeType":904},{},[48205],{"data":48206,"marks":48207,"value":48208,"nodeType":865},{},[],"Preventing attackers from exploiting vulnerable credentials has never been easier",{"data":48210,"content":48211,"nodeType":881},{},[48212,48216],{"data":48213,"marks":48214,"value":48215,"nodeType":865},{},[],"This is just one of the possible SecOps use cases that Push streamlines and levels up for security teams. ",{"data":48217,"marks":48218,"value":48219,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.",{"data":48221,"content":48222,"nodeType":881},{},[48223],{"data":48224,"marks":48225,"value":6039,"nodeType":865},{},[],{"data":48227,"content":48231,"nodeType":890},{"target":48228},{"sys":48229},{"id":48230,"type":887,"linkType":888},"11p9wnGrZHqp3XPpThHFk3",[],{"data":48233,"content":48234,"nodeType":881},{},[48235],{"data":48236,"marks":48237,"value":21,"nodeType":865},{},[],"Automating SSO password resets using Push","Using Push to automate password resets for your most critical identities when a password vulnerability is detected.","2024-12-13T00:00:00.000Z","automating-sso-password-resets-using-push",{"items":48243},[48244,48246],{"sys":48245,"name":297},{"id":6385},{"sys":48247,"name":342},{"id":4510},{"items":48249},[48250],{"fullName":48251,"firstName":48252,"jobTitle":48253,"profilePicture":48254},"Johann Scheepers","Johann","Senior Security Engineer",{"url":48255},"https://images.ctfassets.net/y1cdw1ablpvd/75IEOH93vR0hbvxuqTu1m3/f6222745ee6892ea07bc18727a5a5ae7/T016S22KZ96-U02LU3SKC2D-e1e755770536-512.png",{"__typename":1485,"sys":48257,"content":48258,"title":45232,"synopsis":45233,"hashTags":59,"publishedDate":45234,"slug":45235,"tagsCollection":48798,"authorsCollection":48802},{"id":44613},{"json":48259},{"data":48260,"content":48261,"nodeType":1463},{},[48262,48268,48274,48280,48296,48302,48308,48311,48318,48324,48330,48336,48341,48347,48350,48357,48363,48369,48375,48381,48386,48392,48395,48402,48409,48415,48421,48427,48443,48450,48456,48462,48468,48474,48481,48487,48493,48498,48501,48508,48514,48520,48526,48532,48538,48541,48548,48554,48560,48566,48572,48578,48676,48689,48695,48700,48703,48710,48716,48776,48782],{"data":48263,"content":48264,"nodeType":881},{},[48265],{"data":48266,"marks":48267,"value":44624,"nodeType":865},{},[],{"data":48269,"content":48270,"nodeType":881},{},[48271],{"data":48272,"marks":48273,"value":44631,"nodeType":865},{},[],{"data":48275,"content":48276,"nodeType":881},{},[48277],{"data":48278,"marks":48279,"value":44638,"nodeType":865},{},[],{"data":48281,"content":48282,"nodeType":881},{},[48283,48286,48293],{"data":48284,"marks":48285,"value":44645,"nodeType":865},{},[],{"data":48287,"content":48288,"nodeType":876},{"uri":44648},[48289],{"data":48290,"marks":48291,"value":44654,"nodeType":865},{},[48292],{"type":874},{"data":48294,"marks":48295,"value":959,"nodeType":865},{},[],{"data":48297,"content":48298,"nodeType":881},{},[48299],{"data":48300,"marks":48301,"value":44664,"nodeType":865},{},[],{"data":48303,"content":48304,"nodeType":881},{},[48305],{"data":48306,"marks":48307,"value":44671,"nodeType":865},{},[],{"data":48309,"content":48310,"nodeType":894},{},[],{"data":48312,"content":48313,"nodeType":904},{},[48314],{"data":48315,"marks":48316,"value":44682,"nodeType":865},{},[48317],{"type":902},{"data":48319,"content":48320,"nodeType":881},{},[48321],{"data":48322,"marks":48323,"value":44689,"nodeType":865},{},[],{"data":48325,"content":48326,"nodeType":881},{},[48327],{"data":48328,"marks":48329,"value":44696,"nodeType":865},{},[],{"data":48331,"content":48332,"nodeType":881},{},[48333],{"data":48334,"marks":48335,"value":44703,"nodeType":865},{},[],{"data":48337,"content":48340,"nodeType":890},{"target":48338},{"sys":48339},{"id":44708,"type":887,"linkType":888},[],{"data":48342,"content":48343,"nodeType":881},{},[48344],{"data":48345,"marks":48346,"value":44716,"nodeType":865},{},[],{"data":48348,"content":48349,"nodeType":894},{},[],{"data":48351,"content":48352,"nodeType":904},{},[48353],{"data":48354,"marks":48355,"value":44727,"nodeType":865},{},[48356],{"type":902},{"data":48358,"content":48359,"nodeType":881},{},[48360],{"data":48361,"marks":48362,"value":44734,"nodeType":865},{},[],{"data":48364,"content":48365,"nodeType":881},{},[48366],{"data":48367,"marks":48368,"value":44741,"nodeType":865},{},[],{"data":48370,"content":48371,"nodeType":881},{},[48372],{"data":48373,"marks":48374,"value":44748,"nodeType":865},{},[],{"data":48376,"content":48377,"nodeType":881},{},[48378],{"data":48379,"marks":48380,"value":44755,"nodeType":865},{},[],{"data":48382,"content":48385,"nodeType":890},{"target":48383},{"sys":48384},{"id":44760,"type":887,"linkType":888},[],{"data":48387,"content":48388,"nodeType":881},{},[48389],{"data":48390,"marks":48391,"value":44768,"nodeType":865},{},[],{"data":48393,"content":48394,"nodeType":894},{},[],{"data":48396,"content":48397,"nodeType":904},{},[48398],{"data":48399,"marks":48400,"value":44779,"nodeType":865},{},[48401],{"type":902},{"data":48403,"content":48404,"nodeType":1860},{},[48405],{"data":48406,"marks":48407,"value":44787,"nodeType":865},{},[48408],{"type":902},{"data":48410,"content":48411,"nodeType":881},{},[48412],{"data":48413,"marks":48414,"value":44794,"nodeType":865},{},[],{"data":48416,"content":48417,"nodeType":881},{},[48418],{"data":48419,"marks":48420,"value":44801,"nodeType":865},{},[],{"data":48422,"content":48423,"nodeType":881},{},[48424],{"data":48425,"marks":48426,"value":44808,"nodeType":865},{},[],{"data":48428,"content":48429,"nodeType":881},{},[48430,48433,48440],{"data":48431,"marks":48432,"value":44815,"nodeType":865},{},[],{"data":48434,"content":48435,"nodeType":876},{"uri":44818},[48436],{"data":48437,"marks":48438,"value":44824,"nodeType":865},{},[48439],{"type":874},{"data":48441,"marks":48442,"value":44828,"nodeType":865},{},[],{"data":48444,"content":48445,"nodeType":1860},{},[48446],{"data":48447,"marks":48448,"value":44836,"nodeType":865},{},[48449],{"type":902},{"data":48451,"content":48452,"nodeType":881},{},[48453],{"data":48454,"marks":48455,"value":44843,"nodeType":865},{},[],{"data":48457,"content":48458,"nodeType":881},{},[48459],{"data":48460,"marks":48461,"value":44850,"nodeType":865},{},[],{"data":48463,"content":48464,"nodeType":881},{},[48465],{"data":48466,"marks":48467,"value":44857,"nodeType":865},{},[],{"data":48469,"content":48470,"nodeType":881},{},[48471],{"data":48472,"marks":48473,"value":44864,"nodeType":865},{},[],{"data":48475,"content":48476,"nodeType":1860},{},[48477],{"data":48478,"marks":48479,"value":44872,"nodeType":865},{},[48480],{"type":902},{"data":48482,"content":48483,"nodeType":881},{},[48484],{"data":48485,"marks":48486,"value":44879,"nodeType":865},{},[],{"data":48488,"content":48489,"nodeType":881},{},[48490],{"data":48491,"marks":48492,"value":44886,"nodeType":865},{},[],{"data":48494,"content":48497,"nodeType":890},{"target":48495},{"sys":48496},{"id":44891,"type":887,"linkType":888},[],{"data":48499,"content":48500,"nodeType":894},{},[],{"data":48502,"content":48503,"nodeType":904},{},[48504],{"data":48505,"marks":48506,"value":44903,"nodeType":865},{},[48507],{"type":902},{"data":48509,"content":48510,"nodeType":881},{},[48511],{"data":48512,"marks":48513,"value":44910,"nodeType":865},{},[],{"data":48515,"content":48516,"nodeType":881},{},[48517],{"data":48518,"marks":48519,"value":44917,"nodeType":865},{},[],{"data":48521,"content":48522,"nodeType":881},{},[48523],{"data":48524,"marks":48525,"value":44924,"nodeType":865},{},[],{"data":48527,"content":48528,"nodeType":881},{},[48529],{"data":48530,"marks":48531,"value":44931,"nodeType":865},{},[],{"data":48533,"content":48534,"nodeType":881},{},[48535],{"data":48536,"marks":48537,"value":44938,"nodeType":865},{},[],{"data":48539,"content":48540,"nodeType":894},{},[],{"data":48542,"content":48543,"nodeType":904},{},[48544],{"data":48545,"marks":48546,"value":44949,"nodeType":865},{},[48547],{"type":902},{"data":48549,"content":48550,"nodeType":881},{},[48551],{"data":48552,"marks":48553,"value":44956,"nodeType":865},{},[],{"data":48555,"content":48556,"nodeType":881},{},[48557],{"data":48558,"marks":48559,"value":44963,"nodeType":865},{},[],{"data":48561,"content":48562,"nodeType":881},{},[48563],{"data":48564,"marks":48565,"value":44970,"nodeType":865},{},[],{"data":48567,"content":48568,"nodeType":881},{},[48569],{"data":48570,"marks":48571,"value":44977,"nodeType":865},{},[],{"data":48573,"content":48574,"nodeType":881},{},[48575],{"data":48576,"marks":48577,"value":44984,"nodeType":865},{},[],{"data":48579,"content":48580,"nodeType":1818},{},[48581,48600,48619,48638,48657],{"data":48582,"content":48583,"nodeType":1734},{},[48584],{"data":48585,"content":48586,"nodeType":881},{},[48587,48590,48597],{"data":48588,"marks":48589,"value":44997,"nodeType":865},{},[],{"data":48591,"content":48592,"nodeType":876},{"uri":41391},[48593],{"data":48594,"marks":48595,"value":11582,"nodeType":865},{},[48596],{"type":874},{"data":48598,"marks":48599,"value":30302,"nodeType":865},{},[],{"data":48601,"content":48602,"nodeType":1734},{},[48603],{"data":48604,"content":48605,"nodeType":881},{},[48606,48609,48616],{"data":48607,"marks":48608,"value":45017,"nodeType":865},{},[],{"data":48610,"content":48611,"nodeType":876},{"uri":45020},[48612],{"data":48613,"marks":48614,"value":45026,"nodeType":865},{},[48615],{"type":874},{"data":48617,"marks":48618,"value":30302,"nodeType":865},{},[],{"data":48620,"content":48621,"nodeType":1734},{},[48622],{"data":48623,"content":48624,"nodeType":881},{},[48625,48628,48635],{"data":48626,"marks":48627,"value":45039,"nodeType":865},{},[],{"data":48629,"content":48630,"nodeType":876},{"uri":45042},[48631],{"data":48632,"marks":48633,"value":45048,"nodeType":865},{},[48634],{"type":874},{"data":48636,"marks":48637,"value":30302,"nodeType":865},{},[],{"data":48639,"content":48640,"nodeType":1734},{},[48641],{"data":48642,"content":48643,"nodeType":881},{},[48644,48647,48654],{"data":48645,"marks":48646,"value":45061,"nodeType":865},{},[],{"data":48648,"content":48649,"nodeType":876},{"uri":43794},[48650],{"data":48651,"marks":48652,"value":1718,"nodeType":865},{},[48653],{"type":874},{"data":48655,"marks":48656,"value":30302,"nodeType":865},{},[],{"data":48658,"content":48659,"nodeType":1734},{},[48660],{"data":48661,"content":48662,"nodeType":881},{},[48663,48666,48673],{"data":48664,"marks":48665,"value":45081,"nodeType":865},{},[],{"data":48667,"content":48668,"nodeType":876},{"uri":45084},[48669],{"data":48670,"marks":48671,"value":36131,"nodeType":865},{},[48672],{"type":874},{"data":48674,"marks":48675,"value":30302,"nodeType":865},{},[],{"data":48677,"content":48678,"nodeType":881},{},[48679,48682,48686],{"data":48680,"marks":48681,"value":45099,"nodeType":865},{},[],{"data":48683,"marks":48684,"value":45104,"nodeType":865},{},[48685],{"type":902},{"data":48687,"marks":48688,"value":45108,"nodeType":865},{},[],{"data":48690,"content":48691,"nodeType":881},{},[48692],{"data":48693,"marks":48694,"value":45115,"nodeType":865},{},[],{"data":48696,"content":48699,"nodeType":890},{"target":48697},{"sys":48698},{"id":45120,"type":887,"linkType":888},[],{"data":48701,"content":48702,"nodeType":894},{},[],{"data":48704,"content":48705,"nodeType":904},{},[48706],{"data":48707,"marks":48708,"value":45132,"nodeType":865},{},[48709],{"type":902},{"data":48711,"content":48712,"nodeType":881},{},[48713],{"data":48714,"marks":48715,"value":45139,"nodeType":865},{},[],{"data":48717,"content":48718,"nodeType":1818},{},[48719,48748,48767],{"data":48720,"content":48721,"nodeType":1734},{},[48722],{"data":48723,"content":48724,"nodeType":881},{},[48725,48728,48735,48738,48745],{"data":48726,"marks":48727,"value":21,"nodeType":865},{},[],{"data":48729,"content":48730,"nodeType":876},{"uri":44305},[48731],{"data":48732,"marks":48733,"value":45159,"nodeType":865},{},[48734],{"type":874},{"data":48736,"marks":48737,"value":45163,"nodeType":865},{},[],{"data":48739,"content":48740,"nodeType":876},{"uri":43731},[48741],{"data":48742,"marks":48743,"value":45171,"nodeType":865},{},[48744],{"type":874},{"data":48746,"marks":48747,"value":45175,"nodeType":865},{},[],{"data":48749,"content":48750,"nodeType":1734},{},[48751],{"data":48752,"content":48753,"nodeType":881},{},[48754,48757,48764],{"data":48755,"marks":48756,"value":21,"nodeType":865},{},[],{"data":48758,"content":48759,"nodeType":876},{"uri":44147},[48760],{"data":48761,"marks":48762,"value":45192,"nodeType":865},{},[48763],{"type":874},{"data":48765,"marks":48766,"value":45196,"nodeType":865},{},[],{"data":48768,"content":48769,"nodeType":1734},{},[48770],{"data":48771,"content":48772,"nodeType":881},{},[48773],{"data":48774,"marks":48775,"value":45206,"nodeType":865},{},[],{"data":48777,"content":48778,"nodeType":881},{},[48779],{"data":48780,"marks":48781,"value":45213,"nodeType":865},{},[],{"data":48783,"content":48784,"nodeType":881},{},[48785,48788,48795],{"data":48786,"marks":48787,"value":45220,"nodeType":865},{},[],{"data":48789,"content":48790,"nodeType":876},{"uri":1453},[48791],{"data":48792,"marks":48793,"value":45228,"nodeType":865},{},[48794],{"type":874},{"data":48796,"marks":48797,"value":959,"nodeType":865},{},[],{"items":48799},[48800],{"sys":48801,"name":4507},{"id":4506},{"items":48803},[48804],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":48805},{"url":5377},"guide-to-secure-browser-extension-deployment","blog/guide-to-secure-browser-extension-deployment",{"json":48809},{"data":48810,"content":48811,"nodeType":1463},{},[48812],{"data":48813,"content":48814,"nodeType":881},{},[48815],{"data":48816,"marks":48817,"value":48818,"nodeType":865},{},[],"This blog is intended as a resource for other extension developers looking to improve the security of their extension in the wake of the Cyberhaven attacks. ","How extension developers can improve their security controls to prevent extension compromise.",{"id":19810,"publishedAt":48821},"2026-08-12T11:54:35.418Z",{"items":48823},[48824,48826],{"sys":48825,"name":297},{"id":6385},{"sys":48827,"name":342},{"id":4510},{"items":48829},[48830,48832,48834,48836,48838,48840,48842,48844,48846,48848,48850,48852,48854,48856],{"sys":48831,"name":297,"slug":298,"tier":31},{"id":294},{"sys":48833,"name":413,"slug":414,"tier":31},{"id":410},{"sys":48835,"name":279,"slug":280,"tier":31},{"id":276},{"sys":48837,"name":616,"slug":617,"tier":31},{"id":613},{"sys":48839,"name":342,"slug":343,"tier":31},{"id":339},{"sys":48841,"name":288,"slug":289,"tier":45},{"id":285},{"sys":48843,"name":484,"slug":485,"tier":45},{"id":481},{"sys":48845,"name":607,"slug":608,"tier":45},{"id":604},{"sys":48847,"name":324,"slug":325,"tier":45},{"id":321},{"sys":48849,"name":457,"slug":458,"tier":45},{"id":454},{"sys":48851,"name":502,"slug":503,"tier":45},{"id":499},{"sys":48853,"name":633,"slug":634,"tier":45},{"id":630},{"sys":48855,"name":493,"slug":494,"tier":45},{"id":490},{"sys":48857,"name":422,"slug":423,"tier":45},{"id":419},"vrbRLYoMP8Y7pPleME4QIik_4Kc8bWXVUhV2thaWwV8",{"id":48860,"title":48861,"authorsCollection":48862,"content":48867,"extension":228,"faqItemsCollection":50256,"faqTitle":59,"featured":6,"hashTags":59,"meta":50258,"metaTitle":50259,"ogImage":59,"postType":7216,"publishedDate":50260,"relatedBlogPostsCollection":50261,"slug":52149,"stem":52150,"subtitle":59,"summary":52151,"synopsis":52170,"sys":52171,"tagsCollection":52174,"topicsCollection":52180,"__hash__":52208},"blog/blog/a-new-class-of-phishing-verification-phishing-and-cross-idp-impersonation.json","A new class of phishing: Verification phishing and cross-IdP impersonation",{"items":48863},[48864],{"fullName":4514,"firstName":4515,"jobTitle":4516,"socialLinks":48865,"profilePicture":48866},[11822],{"url":4518},{"json":48868,"links":50153},{"data":48869,"content":48870,"nodeType":1463},{},[48871,48878,48885,48918,48925,48932,48935,48942,48959,48979,48986,48992,49010,49017,49042,49045,49052,49059,49066,49073,49080,49086,49104,49111,49114,49121,49128,49135,49142,49149,49197,49200,49206,49213,49219,49222,49228,49259,49279,49286,49292,49295,49302,49319,49339,49346,49399,49405,49408,49415,49422,49429,49504,49507,49514,49521,49528,49534,49537,49544,49563,49581,49597,49604,49607,49614,49621,49628,49635,49638,49645,49652,49659,49666,49669,49676,49683,49690,49696,49702,49705,49712,49719,49726,49732,49735,49742,49749,49756,49762,49765,49772,49779,49786,49792,49798,49805,49824,49831,49837,49844,49847,49854,49861,49868,49875,49878,49885,49892,49898,49901,49908,49915,49922,49954,49957,49964,49971,49989,49996,50003,50010,50016,50019,50026,50033,50052,50055,50061,50068,50120,50127,50134,50141,50147],{"data":48872,"content":48873,"nodeType":881},{},[48874],{"data":48875,"marks":48876,"value":48877,"nodeType":865},{},[],"Many organizations make use of a centralized managed identity provider (IdP) that they use as an SSO gateway, such as Microsoft Entra, Okta, Google Workspace etc. ",{"data":48879,"content":48880,"nodeType":881},{},[48881],{"data":48882,"marks":48883,"value":48884,"nodeType":865},{},[],"In a perfect world, every account, on every business application, would be:",{"data":48886,"content":48887,"nodeType":1818},{},[48888,48898,48908],{"data":48889,"content":48890,"nodeType":1734},{},[48891],{"data":48892,"content":48893,"nodeType":881},{},[48894],{"data":48895,"marks":48896,"value":48897,"nodeType":865},{},[],"Accessed via SSO from an IdP account via SAML or OIDC protocols.",{"data":48899,"content":48900,"nodeType":1734},{},[48901],{"data":48902,"content":48903,"nodeType":881},{},[48904],{"data":48905,"marks":48906,"value":48907,"nodeType":865},{},[],"Protected by strong authentication controls such as phishing-resistant factors such as passkeys or Okta Fastpass.",{"data":48909,"content":48910,"nodeType":1734},{},[48911],{"data":48912,"content":48913,"nodeType":881},{},[48914],{"data":48915,"marks":48916,"value":48917,"nodeType":865},{},[],"Configured to provide strong centralized audit logging. ",{"data":48919,"content":48920,"nodeType":881},{},[48921],{"data":48922,"marks":48923,"value":48924,"nodeType":865},{},[],"This would in theory provide broad protection against identity attacks — there are no credentials to steal or be phished (even using modern AiTM phish kits) and the logging would provide threat hunting and incident response teams with a great data source for detection and response. ",{"data":48926,"content":48927,"nodeType":881},{},[48928],{"data":48929,"marks":48930,"value":48931,"nodeType":865},{},[],"But what if it were possible to compromise downstream SaaS applications directly and circumvent every single control we just outlined? No password needed, no MFA needed, no SSO audit logs — and all it took was the ability to phish a verification code from a target user. This is what is often possible using verification phishing when combined with cross-IdP impersonation. ",{"data":48933,"content":48934,"nodeType":894},{},[],{"data":48936,"content":48937,"nodeType":904},{},[48938],{"data":48939,"marks":48940,"value":48941,"nodeType":865},{},[],"What is cross-IdP impersonation?",{"data":48943,"content":48944,"nodeType":881},{},[48945,48948,48955],{"data":48946,"marks":48947,"value":21,"nodeType":865},{},[],{"data":48949,"content":48950,"nodeType":876},{"uri":30350},[48951],{"data":48952,"marks":48953,"value":34697,"nodeType":865},{},[48954],{"type":874},{"data":48956,"marks":48957,"value":48958,"nodeType":865},{},[]," is when you authenticate to an application as a user but using a different IdP from the one used ordinarily by the target organization. Depending on the configuration of the target application, this can potentially allow very strict authentication controls to be either partially or completely circumvented. ",{"data":48960,"content":48961,"nodeType":881},{},[48962,48966,48975],{"data":48963,"marks":48964,"value":48965,"nodeType":865},{},[],"Let’s look at an example. Say an organization uses Microsoft Entra as their primary IdP. Their users have email addresses of ",{"data":48967,"content":48969,"nodeType":876},{"uri":48968},"mailto:user@example.com",[48970],{"data":48971,"marks":48972,"value":48974,"nodeType":865},{},[48973],{"type":874},"user@example.com",{"data":48976,"marks":48977,"value":48978,"nodeType":865},{},[],", they authenticate using strong MFA to Microsoft and then either SAML or OIDC login to their downstream applications. ",{"data":48980,"content":48981,"nodeType":881},{},[48982],{"data":48983,"marks":48984,"value":48985,"nodeType":865},{},[],"However, some of their downstream applications support many different login methods to support different customers, as is extremely common for SaaS vendors. Let’s say they are using the Atlassian suite of products, which support many different login methods as shown below:",{"data":48987,"content":48991,"nodeType":890},{"target":48988},{"sys":48989},{"id":48990,"type":887,"linkType":888},"5tV8ypsY7V1P5VpVOeJXUO",[],{"data":48993,"content":48994,"nodeType":881},{},[48995,48999,49006],{"data":48996,"marks":48997,"value":48998,"nodeType":865},{},[],"The legitimate user normally clicks the Microsoft button to perform an OIDC social login. However, what happens if an attacker somehow gains access to an account with a different IdP using the target user’s email address? So they somehow gain access to ",{"data":49000,"content":49001,"nodeType":876},{"uri":48968},[49002],{"data":49003,"marks":49004,"value":48974,"nodeType":865},{},[49005],{"type":874},{"data":49007,"marks":49008,"value":49009,"nodeType":865},{},[]," as an account for Apple or Google. Then, in the default configuration of Atlassian, they can click the Apple or Google buttons and login directly to the downstream application without ever touching the organization’s secure Microsoft Entra tenant.",{"data":49011,"content":49012,"nodeType":881},{},[49013],{"data":49014,"marks":49015,"value":49016,"nodeType":865},{},[],"But how would an attacker gain access to an Apple or Google account anyway? Wouldn’t they have to authenticate using Microsoft to login to those services and so it becomes a circular problem? Well actually, no. In many cases, an organization won’t have accounts with other major IdPs and so those accounts don’t actually exist. ",{"data":49018,"content":49019,"nodeType":881},{},[49020,49024,49029,49033,49038],{"data":49021,"marks":49022,"value":49023,"nodeType":865},{},[],"So rather than take over ",{"data":49025,"marks":49026,"value":49028,"nodeType":865},{},[49027],{"type":874},"existing",{"data":49030,"marks":49031,"value":49032,"nodeType":865},{},[]," accounts, what if an attacker could somehow ",{"data":49034,"marks":49035,"value":49037,"nodeType":865},{},[49036],{"type":874},"create",{"data":49039,"marks":49040,"value":49041,"nodeType":865},{},[]," a new one?",{"data":49043,"content":49044,"nodeType":894},{},[],{"data":49046,"content":49047,"nodeType":904},{},[49048],{"data":49049,"marks":49050,"value":49051,"nodeType":865},{},[],"What is verification phishing?",{"data":49053,"content":49054,"nodeType":881},{},[49055],{"data":49056,"marks":49057,"value":49058,"nodeType":865},{},[],"The primary concern for most organizations is preventing attackers from gaining access to core business applications and data and, consequently, the identities that allow access to those applications and data — therefore, protecting IdP accounts used for SSO is a Tier-1 priority. ",{"data":49060,"content":49061,"nodeType":881},{},[49062],{"data":49063,"marks":49064,"value":49065,"nodeType":865},{},[],"However, preventing accounts being created on other applications they do not use, and therefore do not contain company data, is not a direct concern — unless legitimate users start using those applications and entering company data. This is normally only considered in the context of a shadow SaaS problem — an important, but very different, security issue.",{"data":49067,"content":49068,"nodeType":881},{},[49069],{"data":49070,"marks":49071,"value":49072,"nodeType":865},{},[],"For SaaS vendors though, unwanted and unverified signups can be a painful issue as they are often associated with spam or general misuse of their platforms. Therefore, it’s very common (but not universal) for SaaS vendors to require some basic verification steps for new accounts to raise the bar and prevent common abuse patterns — most commonly, this involves sending an email to the given email address to require either a link to be clicked or to supply a verification code to be used to verify the address. ",{"data":49074,"content":49075,"nodeType":881},{},[49076],{"data":49077,"marks":49078,"value":49079,"nodeType":865},{},[],"For example, here’s what Google sends when creating a new Google account attached to an existing email address:",{"data":49081,"content":49085,"nodeType":890},{"target":49082},{"sys":49083},{"id":49084,"type":887,"linkType":888},"4Smkx9soF6ob3W1BZaqy3P",[],{"data":49087,"content":49088,"nodeType":881},{},[49089,49093,49100],{"data":49090,"marks":49091,"value":49092,"nodeType":865},{},[],"So let’s say an attacker wants to register a new account as ",{"data":49094,"content":49095,"nodeType":876},{"uri":48968},[49096],{"data":49097,"marks":49098,"value":48974,"nodeType":865},{},[49099],{"type":874},{"data":49101,"marks":49102,"value":49103,"nodeType":865},{},[]," with an application that is not used by the target user (or even the target organization). What would they need to do? Well in many cases, they can create the account, set the password and any other details like MFA or phone number directly — all they need to do is convince the user to click the link in the verification email or supply the verification code included.",{"data":49105,"content":49106,"nodeType":881},{},[49107],{"data":49108,"marks":49109,"value":49110,"nodeType":865},{},[],"So that’s what verification phishing is: Using phishing, or some other form of social engineering, to convince a target user to verify an account. But how difficult is that? Well, actually, not very!",{"data":49112,"content":49113,"nodeType":894},{},[],{"data":49115,"content":49116,"nodeType":904},{},[49117],{"data":49118,"marks":49119,"value":49120,"nodeType":865},{},[],"Verification phishing scenarios",{"data":49122,"content":49123,"nodeType":881},{},[49124],{"data":49125,"marks":49126,"value":49127,"nodeType":865},{},[],"No matter how hard we try to stop phishing with user awareness training and phishing simulations, phishing still succeeds to some extent.",{"data":49129,"content":49130,"nodeType":881},{},[49131],{"data":49132,"marks":49133,"value":49134,"nodeType":865},{},[],"Typically, we train users to be suspicious of clicking links in emails, to check the domains of any links carefully and to be especially careful when prompted for entering a password for an account they use.",{"data":49136,"content":49137,"nodeType":881},{},[49138],{"data":49139,"marks":49140,"value":49141,"nodeType":865},{},[],"But what are we asking our target users to do with verification phishing? Simply asking them to click a link, or supply a verification code, in an email from a legitimate address for an account they know does not exist — so from their perspective, what are they giving away? What’s the risk, really?",{"data":49143,"content":49144,"nodeType":881},{},[49145],{"data":49146,"marks":49147,"value":49148,"nodeType":865},{},[],"With a bit of clever thought behind the social engineering effort, we should see much higher success rates with verification phishing than with conventional password phishing. Let’s consider a few strategies that could be used, with differing sophistication levels:",{"data":49150,"content":49151,"nodeType":1818},{},[49152,49167,49182],{"data":49153,"content":49154,"nodeType":1734},{},[49155],{"data":49156,"content":49157,"nodeType":881},{},[49158,49163],{"data":49159,"marks":49160,"value":49162,"nodeType":865},{},[49161],{"type":902},"Pretext emails",{"data":49164,"marks":49165,"value":49166,"nodeType":865},{},[]," – a classic and simple email approach",{"data":49168,"content":49169,"nodeType":1734},{},[49170],{"data":49171,"content":49172,"nodeType":881},{},[49173,49178],{"data":49174,"marks":49175,"value":49177,"nodeType":865},{},[49176],{"type":902},"IM phishing",{"data":49179,"marks":49180,"value":49181,"nodeType":865},{},[]," – hands-on-keyboard social engineering effort but using IM",{"data":49183,"content":49184,"nodeType":1734},{},[49185],{"data":49186,"content":49187,"nodeType":881},{},[49188,49193],{"data":49189,"marks":49190,"value":49192,"nodeType":865},{},[49191],{"type":902},"AiTM verification phishing",{"data":49194,"marks":49195,"value":49196,"nodeType":865},{},[]," – a technically sophisticated approach requiring new tooling",{"data":49198,"content":49199,"nodeType":894},{},[],{"data":49201,"content":49202,"nodeType":1860},{},[49203],{"data":49204,"marks":49205,"value":49162,"nodeType":865},{},[],{"data":49207,"content":49208,"nodeType":881},{},[49209],{"data":49210,"marks":49211,"value":49212,"nodeType":865},{},[],"We could create a false pretext by emailing users ahead of time to be expecting the verification email and take advantage of the fact the incoming verification email will be from a legitimate address to create an additional sense of trust. We’ll use Google as an example in this case.",{"data":49214,"content":49218,"nodeType":890},{"target":49215},{"sys":49216},{"id":49217,"type":887,"linkType":888},"4YQzNZOxyg7zGxCReAJonK",[],{"data":49220,"content":49221,"nodeType":894},{},[],{"data":49223,"content":49224,"nodeType":1860},{},[49225],{"data":49226,"marks":49227,"value":49177,"nodeType":865},{},[],{"data":49229,"content":49230,"nodeType":881},{},[49231,49235,49244,49247,49256],{"data":49232,"marks":49233,"value":49234,"nodeType":865},{},[],"IM phishing is a great way to conduct modern phishing attacks as users generally have more trust in IM platforms than email. Since the advent of Slack Connect and Teams external access, this has been possible as an external initial access vector too. If you’re interested in this technique in general, check out our previous posts on ",{"data":49236,"content":49238,"nodeType":876},{"uri":49237},"https://pushsecurity.com/blog/slack-phishing-for-initial-access/",[49239],{"data":49240,"marks":49241,"value":49243,"nodeType":865},{},[49242],{"type":874},"Slack phishing",{"data":49245,"marks":49246,"value":1651,"nodeType":865},{},[],{"data":49248,"content":49250,"nodeType":876},{"uri":49249},"https://pushsecurity.com/blog/phishing-microsoft-teams-for-initial-access/",[49251],{"data":49252,"marks":49253,"value":49255,"nodeType":865},{},[49254],{"type":874},"Teams phishing",{"data":49257,"marks":49258,"value":959,"nodeType":865},{},[],{"data":49260,"content":49261,"nodeType":881},{},[49262,49266,49275],{"data":49263,"marks":49264,"value":49265,"nodeType":865},{},[],"It also has the advantage that the instant nature of it makes it great for building a social engineering pretext. This is more of a classic interactive social engineering effort over a new delivery vector (IM), than a single message or link-based phishing attack, and so is a more targeted attack strategy. It’s not too dissimilar from ",{"data":49267,"content":49269,"nodeType":876},{"uri":49268},"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/",[49270],{"data":49271,"marks":49272,"value":49274,"nodeType":865},{},[49273],{"type":874},"strategies used by Scattered Spider to social engineer their way past MFA controls",{"data":49276,"marks":49277,"value":49278,"nodeType":865},{},[],", except they generally used phone and SMS delivery vectors. ",{"data":49280,"content":49281,"nodeType":881},{},[49282],{"data":49283,"marks":49284,"value":49285,"nodeType":865},{},[],"Consider the following exchange, and ask yourself how many users could fall for this strategy. I’ll play the victim myself this time and we’ll use Apple as an example.",{"data":49287,"content":49291,"nodeType":890},{"target":49288},{"sys":49289},{"id":49290,"type":887,"linkType":888},"11A6zC4ZA6NRorrC5UCqUE",[],{"data":49293,"content":49294,"nodeType":894},{},[],{"data":49296,"content":49297,"nodeType":1860},{},[49298],{"data":49299,"marks":49300,"value":49301,"nodeType":865},{},[],"AiTM verification phishing ",{"data":49303,"content":49304,"nodeType":881},{},[49305,49308,49315],{"data":49306,"marks":49307,"value":21,"nodeType":865},{},[],{"data":49309,"content":49310,"nodeType":876},{"uri":28776},[49311],{"data":49312,"marks":49313,"value":261,"nodeType":865},{},[49314],{"type":874},{"data":49316,"marks":49317,"value":49318,"nodeType":865},{},[]," to bypass common SSO and MFA protections is now a commonly used technique by attackers, with a range of open-source and criminal tools implementing this in the wild. However, there is nothing stopping a similar approach being used to make verification phishing much more effective and scalable than it is currently. ",{"data":49320,"content":49321,"nodeType":881},{},[49322,49326,49335],{"data":49323,"marks":49324,"value":49325,"nodeType":865},{},[],"If current AiTM tooling, such as the popular AiTM tool ",{"data":49327,"content":49329,"nodeType":876},{"uri":49328},"https://github.com/kgretzky/evilginx2",[49330],{"data":49331,"marks":49332,"value":49334,"nodeType":865},{},[49333],{"type":874},"Evilginx",{"data":49336,"marks":49337,"value":49338,"nodeType":865},{},[],", evolves to integrate this capability then it is likely to be by far the most effective verification phishing technique.",{"data":49340,"content":49341,"nodeType":881},{},[49342],{"data":49343,"marks":49344,"value":49345,"nodeType":865},{},[],"Consider the IM phishing example with Slack given above turned into an interactive website.  We would probably see the following steps occur:",{"data":49347,"content":49348,"nodeType":1818},{},[49349,49359,49369,49379,49389],{"data":49350,"content":49351,"nodeType":1734},{},[49352],{"data":49353,"content":49354,"nodeType":881},{},[49355],{"data":49356,"marks":49357,"value":49358,"nodeType":865},{},[],"Phishing email sent with a link asking the user to register if they would like to take part in the Apple device trial",{"data":49360,"content":49361,"nodeType":1734},{},[49362],{"data":49363,"content":49364,"nodeType":881},{},[49365],{"data":49366,"marks":49367,"value":49368,"nodeType":865},{},[],"User clicks link and is taken to a custom phishing website that informs them they will need to verify their email for an Apple account to be provisioned for their new device",{"data":49370,"content":49371,"nodeType":1734},{},[49372],{"data":49373,"content":49374,"nodeType":881},{},[49375],{"data":49376,"marks":49377,"value":49378,"nodeType":865},{},[],"User clicks a verification button and the AiTM tool automatically registers a new Apple account and prompts for the verification code",{"data":49380,"content":49381,"nodeType":1734},{},[49382],{"data":49383,"content":49384,"nodeType":881},{},[49385],{"data":49386,"marks":49387,"value":49388,"nodeType":865},{},[],"The target user sees the verification email from Apple arrive in their inbox and copies the code into the phishing website",{"data":49390,"content":49391,"nodeType":1734},{},[49392],{"data":49393,"content":49394,"nodeType":881},{},[49395],{"data":49396,"marks":49397,"value":49398,"nodeType":865},{},[],"The AiTM tool verifies the Apple account using the supplied code and the attack is complete",{"data":49400,"content":49404,"nodeType":890},{"target":49401},{"sys":49402},{"id":49403,"type":887,"linkType":888},"5JP8lyDNKJf3P3XcbI83Bw",[],{"data":49406,"content":49407,"nodeType":894},{},[],{"data":49409,"content":49410,"nodeType":904},{},[49411],{"data":49412,"marks":49413,"value":49414,"nodeType":865},{},[],"Putting it all together (with demo)",{"data":49416,"content":49417,"nodeType":881},{},[49418],{"data":49419,"marks":49420,"value":49421,"nodeType":865},{},[],"Now that we’re familiar with cross-IdP impersonation and verification phishing, let’s consider what a full attack chain looks like and what the impact is. ",{"data":49423,"content":49424,"nodeType":881},{},[49425],{"data":49426,"marks":49427,"value":49428,"nodeType":865},{},[],"In doing so, we’ll consider an organization that uses Microsoft Entra as their SSO with strong phishing-resistant MFA and logging and an example downstream SaaS app being Atlassian, which is accessed using a Microsoft social login for SSO. ",{"data":49430,"content":49431,"nodeType":1818},{},[49432,49453,49463,49473,49494],{"data":49433,"content":49434,"nodeType":1734},{},[49435],{"data":49436,"content":49437,"nodeType":881},{},[49438,49442,49449],{"data":49439,"marks":49440,"value":49441,"nodeType":865},{},[],"Attacker registers for an IdP account, such as an Apple account with ",{"data":49443,"content":49444,"nodeType":876},{"uri":48968},[49445],{"data":49446,"marks":49447,"value":48974,"nodeType":865},{},[49448],{"type":874},{"data":49450,"marks":49451,"value":49452,"nodeType":865},{},[]," and sets a password",{"data":49454,"content":49455,"nodeType":1734},{},[49456],{"data":49457,"content":49458,"nodeType":881},{},[49459],{"data":49460,"marks":49461,"value":49462,"nodeType":865},{},[],"Attacker begins the verification phishing process and convinces a user to supply the verification code",{"data":49464,"content":49465,"nodeType":1734},{},[49466],{"data":49467,"content":49468,"nodeType":881},{},[49469],{"data":49470,"marks":49471,"value":49472,"nodeType":865},{},[],"Attacker verifies their newly created Apple account using the verification code",{"data":49474,"content":49475,"nodeType":1734},{},[49476],{"data":49477,"content":49478,"nodeType":881},{},[49479,49483,49490],{"data":49480,"marks":49481,"value":49482,"nodeType":865},{},[],"Attacker logs in to Atlassian using “Login with Apple” as ",{"data":49484,"content":49485,"nodeType":876},{"uri":48968},[49486],{"data":49487,"marks":49488,"value":48974,"nodeType":865},{},[49489],{"type":874},{"data":49491,"marks":49492,"value":49493,"nodeType":865},{},[],", without having to know the user’s password or MFA factors",{"data":49495,"content":49496,"nodeType":1734},{},[49497],{"data":49498,"content":49499,"nodeType":881},{},[49500],{"data":49501,"marks":49502,"value":49503,"nodeType":865},{},[],"There are no logs generated in Microsoft to show an SSO login to Atlassian was made as it happened via the attacker’s Apple account – the only logs would be within Atlassian itself",{"data":49505,"content":49506,"nodeType":894},{},[],{"data":49508,"content":49509,"nodeType":1860},{},[49510],{"data":49511,"marks":49512,"value":49513,"nodeType":865},{},[],"Cross-IdP impersonation attack demo",{"data":49515,"content":49516,"nodeType":881},{},[49517],{"data":49518,"marks":49519,"value":49520,"nodeType":865},{},[],"At this point, there’s no better way to demonstrate the attack than to show it. The following narrated video shows cross-idp impersonation in action to compromise an Atlassian account that is normally accessed using a Microsoft Entra account for SSO that is strongly protected with passkeys. ",{"data":49522,"content":49523,"nodeType":881},{},[49524],{"data":49525,"marks":49526,"value":49527,"nodeType":865},{},[],"For the purposes of this demo, we assume some form of successful verification phishing is performed and focus on demonstrating the cross-IdP impersonation aspect.",{"data":49529,"content":49533,"nodeType":890},{"target":49530},{"sys":49531},{"id":49532,"type":887,"linkType":888},"1rfmqEdOlYeWCkpQE0c0IE",[],{"data":49535,"content":49536,"nodeType":894},{},[],{"data":49538,"content":49539,"nodeType":904},{},[49540],{"data":49541,"marks":49542,"value":49543,"nodeType":865},{},[],"It doesn't stop there: cross-IdP impersonation for persistence",{"data":49545,"content":49546,"nodeType":881},{},[49547,49551,49559],{"data":49548,"marks":49549,"value":49550,"nodeType":865},{},[],"The problems with cross-IdP impersonation don’t stop at the initial access layer. Consider an attacker who has gained temporary control of an SSO user account, or email inbox, through some other means and is looking to maintain access. Perhaps they have used an ",{"data":49552,"content":49553,"nodeType":876},{"uri":28776},[49554],{"data":49555,"marks":49556,"value":49558,"nodeType":865},{},[49557],{"type":874},"AiTM phishing attack",{"data":49560,"marks":49561,"value":49562,"nodeType":865},{},[]," to compromise the user’s core SSO identity. ",{"data":49564,"content":49565,"nodeType":881},{},[49566,49570,49577],{"data":49567,"marks":49568,"value":49569,"nodeType":865},{},[],"A common method for achieving this is to create ",{"data":49571,"content":49572,"nodeType":876},{"uri":11116},[49573],{"data":49574,"marks":49575,"value":11122,"nodeType":865},{},[49576],{"type":874},{"data":49578,"marks":49579,"value":49580,"nodeType":865},{},[]," on downstream SaaS applications. This depends on what each application supports but it can involve connecting secondary email addresses, connecting separate social accounts, creating API keys or any method that allows a different way to authenticate to the application. These allow the attacker to maintain their access to those applications even if their access to the core SSO identity for the user is revoked. The downside is that it has to be performed on a per-application basis.",{"data":49582,"content":49583,"nodeType":881},{},[49584,49588,49593],{"data":49585,"marks":49586,"value":49587,"nodeType":865},{},[],"However, ",{"data":49589,"marks":49590,"value":49592,"nodeType":865},{},[49591],{"type":902},"cross-IdP impersonation is arguably the most powerful ghost login method available",{"data":49594,"marks":49595,"value":49596,"nodeType":865},{},[],". If you already have access to a user’s email inbox through another attack then there is no need to perform verification phishing. Simply register an account with Google/Apple/LinkedIn/X/GitHub or any other major IdP using the email address you have control over, verifying the accounts, and then deleting the email evidence.",{"data":49598,"content":49599,"nodeType":881},{},[49600],{"data":49601,"marks":49602,"value":49603,"nodeType":865},{},[],"An attacker who does this will then maintain the ability to login to any downstream SaaS applications that support any of those login methods without additional verification steps — even if original SSO/email compromise efforts are discovered and contained. In effect, a single persistence technique could potentially maintain access to a range of different downstream applications. ",{"data":49605,"content":49606,"nodeType":894},{},[],{"data":49608,"content":49609,"nodeType":904},{},[49610],{"data":49611,"marks":49612,"value":49613,"nodeType":865},{},[],"Why (and when) is this attack possible?",{"data":49615,"content":49616,"nodeType":881},{},[49617],{"data":49618,"marks":49619,"value":49620,"nodeType":865},{},[],"Most SaaS applications support a range of different authentication methods to provide flexibility for the wide range of customers they have and generally make it as simple to sign up as possible — a consequence of product-led growth marketing strategies.",{"data":49622,"content":49623,"nodeType":881},{},[49624],{"data":49625,"marks":49626,"value":49627,"nodeType":865},{},[],"Using more secure, locked-down authentication methods is often left as a task for the administrators of a given customer’s tenant. However, when hundreds of SaaS apps are in use, this doesn’t always happen — maybe the app was self-adopted by a specific team and the security team doesn’t know about it, or they simply haven’t gotten around to it. ",{"data":49629,"content":49630,"nodeType":881},{},[49631],{"data":49632,"marks":49633,"value":49634,"nodeType":865},{},[],"There are far too many applications out there to provide an exhaustive list of what configurations and behaviors are available. Instead, I’ll provide some examples of the different types of controls/configuration you may encounter that can help or hinder this attack technique.",{"data":49636,"content":49637,"nodeType":894},{},[],{"data":49639,"content":49640,"nodeType":1860},{},[49641],{"data":49642,"marks":49643,"value":49644,"nodeType":865},{},[],"1) Default allow",{"data":49646,"content":49647,"nodeType":881},{},[49648],{"data":49649,"marks":49650,"value":49651,"nodeType":865},{},[],"This is the primary vulnerable case like we have seen with the Atlassian example in this article. Once you have created an account on an application then all other sign-in methods are available by default, making it a prime target for cross-IdP impersonation. ",{"data":49653,"content":49654,"nodeType":881},{},[49655],{"data":49656,"marks":49657,"value":49658,"nodeType":865},{},[],"An important caveat here is this is not a case of Atlassian being uniquely vulnerable. This is a widespread issue with many SaaS apps behaving this way by default. We just used Atlassian as an example because it’s a particularly popular app. ",{"data":49660,"content":49661,"nodeType":881},{},[49662],{"data":49663,"marks":49664,"value":49665,"nodeType":865},{},[],"This also doesn’t mean you have to accept this limitation. It’s often possible to disable other methods, but it requires that app administrators proactively take that step. For example, Atlassian allows third-party logins to be disabled entirely, and more advanced control of authentication options is possible using the Atlassian Guard product too. (See the section on configurable controls, below.)",{"data":49667,"content":49668,"nodeType":894},{},[],{"data":49670,"content":49671,"nodeType":1860},{},[49672],{"data":49673,"marks":49674,"value":49675,"nodeType":865},{},[],"2) Email verification",{"data":49677,"content":49678,"nodeType":881},{},[49679],{"data":49680,"marks":49681,"value":49682,"nodeType":865},{},[],"Some applications will require their own email verification when a new login method is used. This does not completely prevent the issue, as it’s possible to perform verification phishing of this too, but it’s definitely a mitigating factor that makes an attacker’s life more difficult.",{"data":49684,"content":49685,"nodeType":881},{},[49686],{"data":49687,"marks":49688,"value":49689,"nodeType":865},{},[],"The following screenshots show how this works for Adobe as an example. When logging in with a Google account in this case, it prompts for a verification code from email in order to connect the Google account to the pre-existing Adobe account.",{"data":49691,"content":49695,"nodeType":890},{"target":49692},{"sys":49693},{"id":49694,"type":887,"linkType":888},"92VAmeVKmQ3FWSwSP3mHv",[],{"data":49697,"content":49701,"nodeType":890},{"target":49698},{"sys":49699},{"id":49700,"type":887,"linkType":888},"6UqNnTdjZxisCUA7Q2gZWQ",[],{"data":49703,"content":49704,"nodeType":894},{},[],{"data":49706,"content":49707,"nodeType":1860},{},[49708],{"data":49709,"marks":49710,"value":49711,"nodeType":865},{},[],"3) Device Verification",{"data":49713,"content":49714,"nodeType":881},{},[49715],{"data":49716,"marks":49717,"value":49718,"nodeType":865},{},[],"Some applications will treat any login from a new device (typically a new browser without a specific cookie set) as requiring a verification code from the linked email account. Again, this isn’t full protection as it still allows a second verification phishing attack, but it is a significant mitigating factor.",{"data":49720,"content":49721,"nodeType":881},{},[49722],{"data":49723,"marks":49724,"value":49725,"nodeType":865},{},[],"An example of this with HubSpot is shown below:",{"data":49727,"content":49731,"nodeType":890},{"target":49728},{"sys":49729},{"id":49730,"type":887,"linkType":888},"4QcTjWAgv4w0LSqxXTw2CT",[],{"data":49733,"content":49734,"nodeType":894},{},[],{"data":49736,"content":49737,"nodeType":1860},{},[49738],{"data":49739,"marks":49740,"value":49741,"nodeType":865},{},[],"4) Pinned authentication",{"data":49743,"content":49744,"nodeType":881},{},[49745],{"data":49746,"marks":49747,"value":49748,"nodeType":865},{},[],"This is probably the most effective default control that some SaaS apps implement. Once an account has been created, the original authentication method is pinned as being the only acceptable authentication method. Authenticating using a different method will produce an error that cannot be circumvented without using the original authentication method first.",{"data":49750,"content":49751,"nodeType":881},{},[49752],{"data":49753,"marks":49754,"value":49755,"nodeType":865},{},[],"We can see an example of this with Mailchimp below, where we can see after a successful authentication with our malicious Google account we receive an error to indicate that the account is not connected to Google and the original credentials must be used instead.",{"data":49757,"content":49761,"nodeType":890},{"target":49758},{"sys":49759},{"id":49760,"type":887,"linkType":888},"27b5V0Pmguo4rpwwHHSO7v",[],{"data":49763,"content":49764,"nodeType":894},{},[],{"data":49766,"content":49767,"nodeType":1860},{},[49768],{"data":49769,"marks":49770,"value":49771,"nodeType":865},{},[],"5) Configurable controls",{"data":49773,"content":49774,"nodeType":881},{},[49775],{"data":49776,"marks":49777,"value":49778,"nodeType":865},{},[],"Many SaaS applications, even if they have no controls in place by default, allow administrators to lock the configuration down if they want to. For example, all supported authentication methods may work by default but it may be possible to disable these individually to ensure only the intended authentication method is possible.",{"data":49780,"content":49781,"nodeType":881},{},[49782],{"data":49783,"marks":49784,"value":49785,"nodeType":865},{},[],"For example, in the case of the Atlassian example we used earlier, it’s possible to disable third-party logins entirely in a basic subscription. More advanced controls over authentication are available using a separate Atlassian Guard subscription:",{"data":49787,"content":49791,"nodeType":890},{"target":49788},{"sys":49789},{"id":49790,"type":887,"linkType":888},"7JA8XMaUJsMcvqsQOLUTVQ",[],{"data":49793,"content":49797,"nodeType":890},{"target":49794},{"sys":49795},{"id":49796,"type":887,"linkType":888},"29n6vvFCjz3s667ESNdgW5",[],{"data":49799,"content":49800,"nodeType":881},{},[49801],{"data":49802,"marks":49803,"value":49804,"nodeType":865},{},[],"To give another example, a default Datadog instance may allow Google logins and so be vulnerable to cross-IdP impersonation if password logins or SAML-based SSO logins are normally used. However, an administrator can disable Google logins across the entire organization or on a per-user basis if they wish. ",{"data":49806,"content":49807,"nodeType":881},{},[49808,49812,49821],{"data":49809,"marks":49810,"value":49811,"nodeType":865},{},[],"Alternatively, if an administrator disables both Google and password-based logins then only SAML-based logins will be allowed. Datadog refers to this as ",{"data":49813,"content":49815,"nodeType":876},{"uri":49814},"https://docs.datadoghq.com/account_management/saml/",[49816],{"data":49817,"marks":49818,"value":49820,"nodeType":865},{},[49819],{"type":874},"‘SAML strict’",{"data":49822,"marks":49823,"value":1032,"nodeType":865},{},[],{"data":49825,"content":49826,"nodeType":881},{},[49827],{"data":49828,"marks":49829,"value":49830,"nodeType":865},{},[],"This functionality is available without any separate subscriptions:",{"data":49832,"content":49836,"nodeType":890},{"target":49833},{"sys":49834},{"id":49835,"type":887,"linkType":888},"5RMHXJpjSgnZJJx8uf3214",[],{"data":49838,"content":49839,"nodeType":881},{},[49840],{"data":49841,"marks":49842,"value":49843,"nodeType":865},{},[],"To give credit where it’s due, it’s worth noting that the examples we’ve used in this blog post offer ways of mitigating this attack – but this isn’t always the case. Many more apps don’t offer this kind of in-app control, leaving customers exposed.  ",{"data":49845,"content":49846,"nodeType":894},{},[],{"data":49848,"content":49849,"nodeType":904},{},[49850],{"data":49851,"marks":49852,"value":49853,"nodeType":865},{},[],"What steps can SaaS customers take to protect against this threat?",{"data":49855,"content":49856,"nodeType":881},{},[49857],{"data":49858,"marks":49859,"value":49860,"nodeType":865},{},[],"In an ideal world, all SaaS vendors would only support the strongest authentication methods available, default to pinning authentication to the first method used for an account, and allow administrators to flexibly configure authentication rules where required. ",{"data":49862,"content":49863,"nodeType":881},{},[49864],{"data":49865,"marks":49866,"value":49867,"nodeType":865},{},[],"But we don’t live in an ideal world. Many SaaS apps don’t even support SSO and the overwhelming majority of them default to single-factor authentication when users sign up. So how can the average organizations stop their strong SSO controls from being bypassed using cross-IdP impersonation and verification phishing?",{"data":49869,"content":49870,"nodeType":881},{},[49871],{"data":49872,"marks":49873,"value":49874,"nodeType":865},{},[],"Luckily, there are some pragmatic options to significantly increase resilience to these attacks.",{"data":49876,"content":49877,"nodeType":894},{},[],{"data":49879,"content":49880,"nodeType":1860},{},[49881],{"data":49882,"marks":49883,"value":49884,"nodeType":865},{},[],"Lock your domain with other IdPs",{"data":49886,"content":49887,"nodeType":881},{},[49888],{"data":49889,"marks":49890,"value":49891,"nodeType":865},{},[],"Some IdPs allow you to register and lock your domain with them in order to prevent the creation of personal accounts with them. Apple is one example where you can lock your domain using Apple Business Manager. Maybe you aren’t an Apple user as an organization overall but you want to make sure nobody can create Apple accounts on your domain. Well, you can use this feature to entirely prevent this threat! (For Apple, at least.)",{"data":49893,"content":49897,"nodeType":890},{"target":49894},{"sys":49895},{"id":49896,"type":887,"linkType":888},"56sqxSy9QuTxzOGvUmcYBK",[],{"data":49899,"content":49900,"nodeType":894},{},[],{"data":49902,"content":49903,"nodeType":1860},{},[49904],{"data":49905,"marks":49906,"value":49907,"nodeType":865},{},[],"Create detection rules for verification emails from IdP vendors",{"data":49909,"content":49910,"nodeType":881},{},[49911],{"data":49912,"marks":49913,"value":49914,"nodeType":865},{},[],"There are a relatively small number of IdPs that account for the overwhelming majority of social login methods that can be used across a larger number of SaaS apps and the verification emails they send come from predictable addresses with predictable subjects and body formats.  ",{"data":49916,"content":49917,"nodeType":881},{},[49918],{"data":49919,"marks":49920,"value":49921,"nodeType":865},{},[],"Your threat hunting teams can create detection rules for this so you are alerted any time a verification request is made on a different IdP vendor. Whether this is from verification phishing, persistence mechanisms or just legitimate users creating shadow SaaS identities, it’s very easy for you to find out about it and then take actions accordingly.",{"data":49923,"content":49924,"nodeType":881},{},[49925,49929,49938,49942,49950],{"data":49926,"marks":49927,"value":49928,"nodeType":865},{},[],"Our friends at ",{"data":49930,"content":49932,"nodeType":876},{"uri":49931},"https://sublime.security/",[49933],{"data":49934,"marks":49935,"value":49937,"nodeType":865},{},[49936],{"type":874},"Sublime Security",{"data":49939,"marks":49940,"value":49941,"nodeType":865},{},[]," don't miss a beat, and have already ",{"data":49943,"content":49945,"nodeType":876},{"uri":49944},"https://github.com/sublime-security/sublime-rules/blob/8f8ef92f605f1bd87197315939beb0035c28869f/discovery-rules/new_account_verification_code.yml",[49946],{"data":49947,"marks":49948,"value":49949,"nodeType":865},{},[],"released a detection rule",{"data":49951,"marks":49952,"value":49953,"nodeType":865},{},[]," for this, allowing you to alert on new account creation emails for Apple, GitHub, Microsoft, Google, and Slack.",{"data":49955,"content":49956,"nodeType":894},{},[],{"data":49958,"content":49959,"nodeType":1860},{},[49960],{"data":49961,"marks":49962,"value":49963,"nodeType":865},{},[],"Audit your SaaS applications for susceptibility to cross-IdP impersonation",{"data":49965,"content":49966,"nodeType":881},{},[49967],{"data":49968,"marks":49969,"value":49970,"nodeType":865},{},[],"Ok, this one is more work, as you might have hundreds of SaaS applications in use overall. It’s better to start with a shortlist of the most widely used and sensitive applications (you’re probably looking at 10 to 20 apps). ",{"data":49972,"content":49973,"nodeType":881},{},[49974,49978,49985],{"data":49975,"marks":49976,"value":49977,"nodeType":865},{},[],"Discovering all the applications in use across your organization and the login methods they use to them is the first part of the problem. It’s also common for multiple login methods to be in use for the same application, a problem known as ",{"data":49979,"content":49980,"nodeType":876},{"uri":16924},[49981],{"data":49982,"marks":49983,"value":11122,"nodeType":865},{},[49984],{"type":874},{"data":49986,"marks":49987,"value":49988,"nodeType":865},{},[],". When you factor in how tricky it is to collect information on application accounts and login methods, and the mixed controls available to enforce the desired configuration in-app, This step is actually much harder than it sounds.",{"data":49990,"content":49991,"nodeType":881},{},[49992],{"data":49993,"marks":49994,"value":49995,"nodeType":865},{},[],"Once you have a list of applications, have your security teams create accounts with other IdPs and then see which of your SaaS applications allow them to login with cross-IdP impersonation, or otherwise which of the controls listed previously apply (e.g. email verification, device verification, pinned authentication etc).",{"data":49997,"content":49998,"nodeType":881},{},[49999],{"data":50000,"marks":50001,"value":50002,"nodeType":865},{},[],"Depending on the results of this, you can reduce vulnerability on an app-by-app basis. Where apps allow it through configuration, have the application owners configure your tenant to restrict authentication options. ",{"data":50004,"content":50005,"nodeType":881},{},[50006],{"data":50007,"marks":50008,"value":50009,"nodeType":865},{},[],"And if you find an application that does not support this feature then pressure the vendor with a feature request, the same as you might for a vendor that doesn’t support SSO.",{"data":50011,"content":50015,"nodeType":890},{"target":50012},{"sys":50013},{"id":50014,"type":887,"linkType":888},"6lsemiR9tRQ1eOPOh3rtfc",[],{"data":50017,"content":50018,"nodeType":894},{},[],{"data":50020,"content":50021,"nodeType":1860},{},[50022],{"data":50023,"marks":50024,"value":50025,"nodeType":865},{},[],"Ask your red teams to add this technique to their attack simulations",{"data":50027,"content":50028,"nodeType":881},{},[50029],{"data":50030,"marks":50031,"value":50032,"nodeType":865},{},[],"Whether using internal or external red teams, proper adversarial simulation is key to understanding the realistic vulnerability of your organization to a range of attack scenarios. Next time you have a red team operation planned, ask them if they can attempt cross-IdP impersonation and verification phishing as part of an end-to-end attack chain to assess your vulnerability and detection and response controls appropriately. ",{"data":50034,"content":50035,"nodeType":881},{},[50036,50040,50048],{"data":50037,"marks":50038,"value":50039,"nodeType":865},{},[],"In fact, you should probably be asking them to be putting a huge focus on identity attacks in general. Ask them if they can use the ",{"data":50041,"content":50042,"nodeType":876},{"uri":5192},[50043],{"data":50044,"marks":50045,"value":50047,"nodeType":865},{},[50046],{"type":874},"open-source SaaS attacks matrix ",{"data":50049,"marks":50050,"value":50051,"nodeType":865},{},[],"as a basis for an identity attack focused red team operation.",{"data":50053,"content":50054,"nodeType":894},{},[],{"data":50056,"content":50057,"nodeType":904},{},[50058],{"data":50059,"marks":50060,"value":29161,"nodeType":865},{},[],{"data":50062,"content":50063,"nodeType":881},{},[50064],{"data":50065,"marks":50066,"value":50067,"nodeType":865},{},[],"We’ve seen how cross-IdP impersonation enables SaaS applications to be accessed using accounts outside the control of an organization and thus bypassing all controls enforced by SSO, such as:",{"data":50069,"content":50070,"nodeType":1818},{},[50071,50081,50090,50100,50110],{"data":50072,"content":50073,"nodeType":1734},{},[50074],{"data":50075,"content":50076,"nodeType":881},{},[50077],{"data":50078,"marks":50079,"value":50080,"nodeType":865},{},[],"Strong password requirements",{"data":50082,"content":50083,"nodeType":1734},{},[50084],{"data":50085,"content":50086,"nodeType":881},{},[50087],{"data":50088,"marks":50089,"value":457,"nodeType":865},{},[],{"data":50091,"content":50092,"nodeType":1734},{},[50093],{"data":50094,"content":50095,"nodeType":881},{},[50096],{"data":50097,"marks":50098,"value":50099,"nodeType":865},{},[],"Phishing-resistant authentication e.g. passkeys or Okta Fastpass",{"data":50101,"content":50102,"nodeType":1734},{},[50103],{"data":50104,"content":50105,"nodeType":881},{},[50106],{"data":50107,"marks":50108,"value":50109,"nodeType":865},{},[],"IP/Location restrictions",{"data":50111,"content":50112,"nodeType":1734},{},[50113],{"data":50114,"content":50115,"nodeType":881},{},[50116],{"data":50117,"marks":50118,"value":50119,"nodeType":865},{},[],"Authentication logs",{"data":50121,"content":50122,"nodeType":881},{},[50123],{"data":50124,"marks":50125,"value":50126,"nodeType":865},{},[],"During the initial access phase of an attack, combining cross-IdP impersonation with verification phishing can allow external attackers to gain permanent access to a range of downstream SaaS applications through the compromise of a single verification code, even if they are normally protected by a rock-solid SSO implementation.",{"data":50128,"content":50129,"nodeType":881},{},[50130],{"data":50131,"marks":50132,"value":50133,"nodeType":865},{},[],"During the persistence phase of a compromise, an attacker can utilize cross-IdP impersonation as an extremely powerful ghost login method in order to maintain access to a range of SaaS applications through a single mechanism, even if containment exercises later remove their access to the original SSO account or email inbox they compromised.",{"data":50135,"content":50136,"nodeType":881},{},[50137],{"data":50138,"marks":50139,"value":50140,"nodeType":865},{},[],"It is extremely important that organizations understand the threat these attacks pose, evaluate their vulnerability to these attacks and implement the prevention and detection controls provided above accordingly. ",{"data":50142,"content":50146,"nodeType":890},{"target":50143},{"sys":50144},{"id":50145,"type":887,"linkType":888},"3j4TX3jabfyWrhlXjo8ZHX",[],{"data":50148,"content":50149,"nodeType":881},{},[50150],{"data":50151,"marks":50152,"value":21,"nodeType":865},{},[],{"entries":50154},{"hyperlink":50155,"inline":50156,"block":50157},[],[],[50158,50165,50172,50178,50185,50189,50196,50204,50209,50215,50220,50226,50233,50240,50247,50252],{"sys":50159,"__typename":7008,"title":50160,"caption":50160,"layoutMode":59,"file":50161},{"id":48990},"Default Atlassian login page showing the range of social login methods available",{"url":50162,"width":50163,"height":50164},"https://images.ctfassets.net/y1cdw1ablpvd/7G7oxoeV5vQNAbOrjs7LWh/fc4570accb729c55c23186db302cd0f9/image10.png",397,516,{"sys":50166,"__typename":7008,"title":50167,"caption":50167,"layoutMode":59,"file":50168},{"id":49084},"Google email verification example",{"url":50169,"width":50170,"height":50171},"https://images.ctfassets.net/y1cdw1ablpvd/1j2a1rr1xZJs4jhgUMphQc/9b8e23fa928f15873b8cffed1cd7421e/image8.png",852,776,{"sys":50173,"__typename":7008,"title":50174,"caption":50174,"layoutMode":59,"file":50175},{"id":49217},"Pretext email example to perform verification phishing",{"url":50176,"width":50177,"height":7045},"https://images.ctfassets.net/y1cdw1ablpvd/6tHP6GZWFDK38IMQHMWI5B/090ed3f69bf0479afde71001c13d8141/image3__1_.png",560,{"sys":50179,"__typename":7008,"title":50180,"caption":50180,"layoutMode":59,"file":50181},{"id":49290},"Slack social engineering example for verification phishing",{"url":50182,"width":50183,"height":50184},"https://images.ctfassets.net/y1cdw1ablpvd/1JFyQPB1Gk1HPCKxhh7Eus/e0a7c69d12e1374c0a3761a0b00eefce/image6.png",818,652,{"sys":50186,"__typename":1471,"type":1472,"ctaText":50187,"buttonLabel":21701,"buttonColour":30677,"buttonUrl":50188},{"id":49403},"Want to learn more about why AiTM attacks are so successful? Register for our webinar on Dec 5th to find out how phishing toolkits are getting through your detection controls.","https://pushsecurity.com/webinar/phish-kit-teardown",{"sys":50190,"__typename":50191,"title":50192,"youTubeUrl":50193,"imagePlaceholder":50194},{"id":49532},"ExternalVideo","Verification Phishing & Cross-IdP Impersonation Demo","https://www.youtube.com/watch?v=53JMEmZV6ck",{"url":50195,"width":47194,"height":24963},"https://images.ctfassets.net/y1cdw1ablpvd/KXQAXbpFMRJprAkzoKhtx/ac370fb92687122022e753120bb7cb47/Slide_Front_Cover__20_.png",{"sys":50197,"__typename":7008,"title":50198,"caption":50199,"layoutMode":59,"file":50200},{"id":49694},"Adobe Google account linking and verification","Adobe Google account linking and verification (1)",{"url":50201,"width":50202,"height":50203},"https://images.ctfassets.net/y1cdw1ablpvd/3KeKxlgHPx3H2TbBd8WfQ1/ae1bdb07d43eaef106b74cd23752fbcf/image4.png",1436,900,{"sys":50205,"__typename":7008,"title":50206,"caption":50206,"layoutMode":59,"file":50207},{"id":49700},"Adobe Google account linking and verification (2)",{"url":50208,"width":50202,"height":50203},"https://images.ctfassets.net/y1cdw1ablpvd/6YVMDFtLttuF8E4g88G4la/b7dc3a4e37f5dd39c36ee739700e7048/image1.png",{"sys":50210,"__typename":7008,"title":50211,"caption":50211,"layoutMode":59,"file":50212},{"id":49730},"HubSpot unrecognized device email verification",{"url":50213,"width":50202,"height":50214},"https://images.ctfassets.net/y1cdw1ablpvd/1S8swPaBQ9K8PzU81NTphI/69bf04d6084e7df74b47f211d935d271/image7.png",824,{"sys":50216,"__typename":7008,"title":50217,"caption":50217,"layoutMode":59,"file":50218},{"id":49760},"Mailchimp pinned authentication requiring original login method",{"url":50219,"width":50202,"height":50203},"https://images.ctfassets.net/y1cdw1ablpvd/1fNIa9cZywrQ9CxuuZkWUA/b344fa67a49acb7f8fcd015517a4fc87/image11.png",{"sys":50221,"__typename":7008,"title":50222,"caption":50222,"layoutMode":59,"file":50223},{"id":49790},"Basic Atlassian authentication policies allowing third-party logins to be disabled",{"url":50224,"width":50225,"height":50203},"https://images.ctfassets.net/y1cdw1ablpvd/1SlxwxNhriIrLHho1acSsJ/99e99d1ec5445286fd42692a9d4772de/image12.png",1475,{"sys":50227,"__typename":7008,"title":50228,"caption":50228,"layoutMode":59,"file":50229},{"id":49796},"Atlassian Guard allows more advanced controls, including enforced SSO",{"url":50230,"width":50231,"height":50232},"https://images.ctfassets.net/y1cdw1ablpvd/716nNbqfT1A0xtWQPaFqp/e64839cb4c1eed8dcfe4d7460063fc53/image9.png",434,471,{"sys":50234,"__typename":7008,"title":50235,"caption":50235,"layoutMode":59,"file":50236},{"id":49835},"Datadog administrative screen for enabling/disabling login methods",{"url":50237,"width":50238,"height":50239},"https://images.ctfassets.net/y1cdw1ablpvd/4wwOBe1ojQ0noPXv1aWU8Q/df962016e42277e46454acd38baabef1/image5.png",935,620,{"sys":50241,"__typename":7008,"title":50242,"caption":50242,"layoutMode":59,"file":50243},{"id":49896},"Apple business manager update providing more options to manage verified domains",{"url":50244,"width":50245,"height":50246},"https://images.ctfassets.net/y1cdw1ablpvd/3NH2d6WMqAmPfrPMQas4e0/35676fdc69d7e91c3c1dd163fe3ff51d/image2.png",1394,942,{"sys":50248,"__typename":1471,"type":50249,"ctaText":50250,"buttonLabel":50251,"buttonColour":1475,"buttonUrl":6048},{"id":50014},"Demo","See how Push helps you to find and fix vulnerable identities at-scale, by identifying applications, login methods, and insecure configurations","Book Demo",{"sys":50253,"__typename":1471,"type":1472,"ctaText":50254,"buttonLabel":50255,"buttonColour":30677,"buttonUrl":43596},{"id":50145},"To read more about Cross-IdP impersonation and examples in the wild, check out this blog post","Read Blog",{"items":50257},[],{},"Combining Verification Phishing and Cross-IdP Impersonation","2024-11-23T00:00:00.000Z",{"items":50262},[50263,51165,51863],{"__typename":1485,"sys":50264,"content":50266,"title":51151,"synopsis":51152,"hashTags":59,"publishedDate":51153,"slug":51154,"tagsCollection":51155,"authorsCollection":51161},{"id":50265},"2PpB1KSjZkmpzYDhDLRBYx",{"json":50267},{"data":50268,"content":50269,"nodeType":1463},{},[50270,50277,50284,50312,50319,50322,50329,50337,50357,50364,50371,50377,50384,50391,50414,50421,50428,50468,50475,50478,50485,50521,50527,50534,50541,50544,50552,50559,50592,50598,50605,50608,50616,50636,50643,50650,50668,50671,50679,50699,50706,50722,50737,50740,50748,50767,50774,50781,50874,50881,50886,50893,50900,50933,50940,50943,50951,50958,50965,50997,51004,51011,51014,51022,51041,51048,51055,51098,51103,51110,51128,51133,51139,51145],{"data":50271,"content":50272,"nodeType":881},{},[50273],{"data":50274,"marks":50275,"value":50276,"nodeType":865},{},[],"Two stories have hit the headlines in recent months involving attackers and researchers, demonstrating ways of taking over a SaaS account by accessing it using an SSO login from an IdP that you’ve never used before.",{"data":50278,"content":50279,"nodeType":881},{},[50280],{"data":50281,"marks":50282,"value":50283,"nodeType":865},{},[],"Yes, you read that right. An attacker created an IdP account on an IdP that you don’t use. And because the account matched your actual company domain, they used it to log into your actual downstream accounts on the apps that you use. ",{"data":50285,"content":50286,"nodeType":881},{},[50287,50291,50297,50301,50308],{"data":50288,"marks":50289,"value":50290,"nodeType":865},{},[],"We're calling this technique ",{"data":50292,"content":50293,"nodeType":876},{"uri":30350},[50294],{"data":50295,"marks":50296,"value":30356,"nodeType":865},{},[],{"data":50298,"marks":50299,"value":50300,"nodeType":865},{},[],". If you’re familiar with our other research, this is basically ",{"data":50302,"content":50303,"nodeType":876},{"uri":16924},[50304],{"data":50305,"marks":50306,"value":11122,"nodeType":865},{},[50307],{"type":874},{"data":50309,"marks":50310,"value":50311,"nodeType":865},{},[]," on steroids — you’re effectively making your own! ",{"data":50313,"content":50314,"nodeType":881},{},[50315],{"data":50316,"marks":50317,"value":50318,"nodeType":865},{},[],"Let’s take a look at some examples.",{"data":50320,"content":50321,"nodeType":894},{},[],{"data":50323,"content":50324,"nodeType":904},{},[50325],{"data":50326,"marks":50327,"value":50328,"nodeType":865},{},[],"Cross-IdP impersonation in the wild",{"data":50330,"content":50331,"nodeType":1860},{},[50332],{"data":50333,"marks":50334,"value":50336,"nodeType":865},{},[50335],{"type":902},"Spoofing Zendesk support emails and infiltrating connected apps (via Apple SSO)",{"data":50338,"content":50339,"nodeType":881},{},[50340,50344,50353],{"data":50341,"marks":50342,"value":50343,"nodeType":865},{},[],"A 15-year-old researcher was able to ",{"data":50345,"content":50347,"nodeType":876},{"uri":50346},"https://gist.github.com/hackermondev/68ec8ed145fcee49d2f5e2b9d2cf2e52",[50348],{"data":50349,"marks":50350,"value":50352,"nodeType":865},{},[50351],{"type":874},"access Zendesk support ticket history via spoofing a company’s support email, and later use it to access connected apps",{"data":50354,"marks":50355,"value":50356,"nodeType":865},{},[]," (Slack, in this case) via SSO, successfully targeting hundreds of companies.  ",{"data":50358,"content":50359,"nodeType":881},{},[50360],{"data":50361,"marks":50362,"value":50363,"nodeType":865},{},[],"The attack is based around the fact that Zendesk support tickets are easy to enumerate. The typical method of setting up Zendesk is to have your existing support email address (e.g. support@company.com) forward emails to Zendesk. ",{"data":50365,"content":50366,"nodeType":881},{},[50367],{"data":50368,"marks":50369,"value":50370,"nodeType":865},{},[],"The researcher was able to abuse this feature to create an account for an existing company domain on an IdP not currently being used by the company, and then use that account to authenticate to a third-party app used by the company. ",{"data":50372,"content":50376,"nodeType":890},{"target":50373},{"sys":50374},{"id":50375,"type":887,"linkType":888},"3A6fHQ0XB2qAjQdJGvAb9N",[],{"data":50378,"content":50379,"nodeType":881},{},[50380],{"data":50381,"marks":50382,"value":50383,"nodeType":865},{},[],"The researcher found that, although Zendesk had started blocking emails from ‘noreply@’ addresses (probably to prevent this kind of attack), Apple sent its verification emails from an ‘appleid@’ address, making the attack possible when using Apple IdP.",{"data":50385,"content":50386,"nodeType":881},{},[50387],{"data":50388,"marks":50389,"value":50390,"nodeType":865},{},[],"There’s a couple of things to note here:",{"data":50392,"content":50393,"nodeType":1818},{},[50394,50404],{"data":50395,"content":50396,"nodeType":1734},{},[50397],{"data":50398,"content":50399,"nodeType":881},{},[50400],{"data":50401,"marks":50402,"value":50403,"nodeType":865},{},[],"Apple could be swapped out for any IdP that doesn’t send verification emails from a ‘noreply@’ address.",{"data":50405,"content":50406,"nodeType":1734},{},[50407],{"data":50408,"content":50409,"nodeType":881},{},[50410],{"data":50411,"marks":50412,"value":50413,"nodeType":865},{},[],"Slack could be swapped out for just about any downstream SaaS app. ",{"data":50415,"content":50416,"nodeType":881},{},[50417],{"data":50418,"marks":50419,"value":50420,"nodeType":865},{},[],"Taking a step back — what if an attacker had discovered this exploit? The researcher states that, after Zendesk refused to acknowledge the issue through its bug bounty program operated by HackerOne, he individually contacted ‘hundreds’ of affected organizations. ",{"data":50422,"content":50423,"nodeType":881},{},[50424],{"data":50425,"marks":50426,"value":50427,"nodeType":865},{},[],"So that’s hundreds of vulnerable organizations, and potentially tens to hundreds of business apps per victim organization that could be accessed via Apple SSO. Any app that allows ‘sign in with Apple’ could be targeted where:",{"data":50429,"content":50430,"nodeType":1818},{},[50431,50449],{"data":50432,"content":50433,"nodeType":1734},{},[50434],{"data":50435,"content":50436,"nodeType":881},{},[50437,50441,50445],{"data":50438,"marks":50439,"value":50440,"nodeType":865},{},[],"An app with an ",{"data":50442,"marks":50443,"value":49028,"nodeType":865},{},[50444],{"type":874},{"data":50446,"marks":50447,"value":50448,"nodeType":865},{},[]," account belonging to the specific email & domain combination could be taken over.",{"data":50450,"content":50451,"nodeType":1734},{},[50452],{"data":50453,"content":50454,"nodeType":881},{},[50455,50459,50464],{"data":50456,"marks":50457,"value":50458,"nodeType":865},{},[],"A ",{"data":50460,"marks":50461,"value":50463,"nodeType":865},{},[50462],{"type":874},"new",{"data":50465,"marks":50466,"value":50467,"nodeType":865},{},[]," account could also be created on apps allowing anyone with a company email to join the company tenant. ",{"data":50469,"content":50470,"nodeType":881},{},[50471],{"data":50472,"marks":50473,"value":50474,"nodeType":865},{},[],"It’s unclear whether Zendesk will have implemented a global fix for the issue either, as the vulnerability stems from a configuration option that could be remediated by disabling email collaboration, but is on by default. ",{"data":50476,"content":50477,"nodeType":894},{},[],{"data":50479,"content":50480,"nodeType":1860},{},[50481],{"data":50482,"marks":50483,"value":50484,"nodeType":865},{},[],"Google domain verification bug similarities",{"data":50486,"content":50487,"nodeType":881},{},[50488,50492,50501,50505,50510,50513,50518],{"data":50489,"marks":50490,"value":50491,"nodeType":865},{},[],"The Zendesk attack shares some similarities with ",{"data":50493,"content":50495,"nodeType":876},{"uri":50494},"https://krebsonsecurity.com/2024/07/crooks-bypassed-googles-email-verification-to-create-workspace-accounts-access-3rd-party-services/",[50496],{"data":50497,"marks":50498,"value":50500,"nodeType":865},{},[50499],{"type":874},"a recent (now resolved) Google email verification vulnerability",{"data":50502,"marks":50503,"value":50504,"nodeType":865},{},[]," which allowed a newly created Google account/domain to be used to authenticate to downstream apps via SSO — ",{"data":50506,"marks":50507,"value":50509,"nodeType":865},{},[50508],{"type":902},"this time",{"data":50511,"marks":50512,"value":2091,"nodeType":865},{},[],{"data":50514,"marks":50515,"value":50517,"nodeType":865},{},[50516],{"type":902},"without verifying ownership of the domain",{"data":50519,"marks":50520,"value":1032,"nodeType":865},{},[],{"data":50522,"content":50526,"nodeType":890},{"target":50523},{"sys":50524},{"id":50525,"type":887,"linkType":888},"6EeN0uKbhz9daUOo4E6wzR",[],{"data":50528,"content":50529,"nodeType":881},{},[50530],{"data":50531,"marks":50532,"value":50533,"nodeType":865},{},[],"Whereas the Zendesk attack took advantage of Apple email configs, this attack was much more direct in that Google enabled SSO to downstream apps prior to domain verification. ",{"data":50535,"content":50536,"nodeType":881},{},[50537],{"data":50538,"marks":50539,"value":50540,"nodeType":865},{},[],"The Google attack is definitely a bug rather than abusing a feature, and has since been patched. But, we’re starting to see a concerning pattern emerge. ",{"data":50542,"content":50543,"nodeType":894},{},[],{"data":50545,"content":50546,"nodeType":904},{},[50547],{"data":50548,"marks":50549,"value":50551,"nodeType":865},{},[50550],{"type":902},"How big of a problem is this?",{"data":50553,"content":50554,"nodeType":881},{},[50555],{"data":50556,"marks":50557,"value":50558,"nodeType":865},{},[],"First, let’s recap the general attack path:",{"data":50560,"content":50561,"nodeType":1818},{},[50562,50572,50582],{"data":50563,"content":50564,"nodeType":1734},{},[50565],{"data":50566,"content":50567,"nodeType":881},{},[50568],{"data":50569,"marks":50570,"value":50571,"nodeType":865},{},[],"The attacker signs up for an account on an app that functions as an IdP, linking it to the victim’s existing company email address via the ‘use existing email’ option.",{"data":50573,"content":50574,"nodeType":1734},{},[50575],{"data":50576,"content":50577,"nodeType":881},{},[50578],{"data":50579,"marks":50580,"value":50581,"nodeType":865},{},[],"The attacker either bypasses domain verification or verifies the domain via email (typically by clicking a link or entering a one-time password) either through an attack like the ones above, or by social engineering the victim user.",{"data":50583,"content":50584,"nodeType":1734},{},[50585],{"data":50586,"content":50587,"nodeType":881},{},[50588],{"data":50589,"marks":50590,"value":50591,"nodeType":865},{},[],"The attacker logs into an account on a downstream app using the ‘sign in with …’ SSO login option. ",{"data":50593,"content":50597,"nodeType":890},{"target":50594},{"sys":50595},{"id":50596,"type":887,"linkType":888},"5lz0Nqq3j3Q1XasHYszRXy",[],{"data":50599,"content":50600,"nodeType":881},{},[50601],{"data":50602,"marks":50603,"value":50604,"nodeType":865},{},[],"Let’s look more closely at why this is a cause for concern.",{"data":50606,"content":50607,"nodeType":894},{},[],{"data":50609,"content":50610,"nodeType":1860},{},[50611],{"data":50612,"marks":50613,"value":50615,"nodeType":865},{},[50614],{"type":902},"It gets around your most hardened IdP accounts",{"data":50617,"content":50618,"nodeType":881},{},[50619,50623,50632],{"data":50620,"marks":50621,"value":50622,"nodeType":865},{},[],"The notion of IdP impersonation isn’t necessarily new. Take for example ",{"data":50624,"content":50626,"nodeType":876},{"uri":50625},"https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection",[50627],{"data":50628,"marks":50629,"value":50631,"nodeType":865},{},[50630],{"type":874},"cross-tenant impersonation",{"data":50633,"marks":50634,"value":50635,"nodeType":865},{},[],", which focuses on mapping an attacker-controlled Okta tenant to a compromised Okta tenant to give full access to connected user accounts and enable unrestricted lateral movement.",{"data":50637,"content":50638,"nodeType":881},{},[50639],{"data":50640,"marks":50641,"value":50642,"nodeType":865},{},[],"Cross-IdP impersonation, however, doesn’t require that you’ve already compromised an IdP admin account. You pick a user account (or multiple) that you want to take over, you enroll them with a new IdP matching the tenant and address structure, and then authenticate to whichever apps you’re interested in taking over. ",{"data":50644,"content":50645,"nodeType":881},{},[50646],{"data":50647,"marks":50648,"value":50649,"nodeType":865},{},[],"So, compromising your target’s main IdP isn’t necessary when the data and functionality that you’re most interested in lives in downstream apps. This means that even if your primary IdP is super locked down with phishing-resistant authentication (e.g. passkeys) this technique enables attackers to get around it. ",{"data":50651,"content":50652,"nodeType":881},{},[50653,50657,50665],{"data":50654,"marks":50655,"value":50656,"nodeType":865},{},[],"And a smart attacker who does their OSINT will identify potential app admins whose accounts to mirror, eliminating any noise that would be generated by privilege escalation & lateral movement attempts such as ",{"data":50658,"content":50659,"nodeType":876},{"uri":39701},[50660],{"data":50661,"marks":50662,"value":50664,"nodeType":865},{},[50663],{"type":874},"in-app phishing.",{"data":50666,"marks":50667,"value":2862,"nodeType":865},{},[],{"data":50669,"content":50670,"nodeType":894},{},[],{"data":50672,"content":50673,"nodeType":1860},{},[50674],{"data":50675,"marks":50676,"value":50678,"nodeType":865},{},[50677],{"type":902},"App-based prevention measures are inconsistent",{"data":50680,"content":50681,"nodeType":881},{},[50682,50686,50695],{"data":50683,"marks":50684,"value":50685,"nodeType":865},{},[],"It’s worth noting that this attack doesn’t work the same on all apps. At the point of using a new login method to access an app, ",{"data":50687,"content":50689,"nodeType":876},{"uri":50688},"https://auth0.com/docs/manage-users/user-accounts/user-account-linking",[50690],{"data":50691,"marks":50692,"value":50694,"nodeType":865},{},[50693],{"type":874},"it is considered best practice to require re-verification",{"data":50696,"marks":50697,"value":50698,"nodeType":865},{},[]," — for example by logging in with the original login method, or approving the request via an email code or link. ",{"data":50700,"content":50701,"nodeType":881},{},[50702],{"data":50703,"marks":50704,"value":50705,"nodeType":865},{},[],"Requiring re-authentication with the original login method is probably game over for the attacker, but if the attacker has already found a way of verifying a new IdP via email, the latter option is probably less of an obstacle. ",{"data":50707,"content":50708,"nodeType":881},{},[50709,50713,50718],{"data":50710,"marks":50711,"value":50712,"nodeType":865},{},[],"But not all apps follow these best practices around adding new login methods. We tested a range of the most popular apps that our customers use by creating an account, adding a password and an SSO method, and subsequently adding another SSO method using a different IdP, and ",{"data":50714,"marks":50715,"value":50717,"nodeType":865},{},[50716],{"type":902},"found that 60% (3 in 5) of the apps we tested do not require re-verification by default",{"data":50719,"marks":50720,"value":50721,"nodeType":865},{},[]," when adding a new SSO login method.",{"data":50723,"content":50724,"nodeType":970},{},[50725],{"data":50726,"content":50727,"nodeType":881},{},[50728,50733],{"data":50729,"marks":50730,"value":50732,"nodeType":865},{},[50731],{"type":902},"60% (3 in 5) of the apps we tested do not require re-verification by default",{"data":50734,"marks":50735,"value":50736,"nodeType":865},{},[]," when adding a new SSO login method",{"data":50738,"content":50739,"nodeType":894},{},[],{"data":50741,"content":50742,"nodeType":1860},{},[50743],{"data":50744,"marks":50745,"value":50747,"nodeType":865},{},[50746],{"type":902},"There are more IdPs than you realize",{"data":50749,"content":50750,"nodeType":881},{},[50751,50755,50763],{"data":50752,"marks":50753,"value":50754,"nodeType":865},{},[],"IdP accounts have always been a valuable target. Earlier this year we saw ",{"data":50756,"content":50757,"nodeType":876},{"uri":47938},[50758],{"data":50759,"marks":50760,"value":50762,"nodeType":865},{},[50761],{"type":874},"a dramatic spike in the attacks on Okta accounts",{"data":50764,"marks":50765,"value":50766,"nodeType":865},{},[],", for example. But these accounts are often well protected with strong credentials (or passkeys) and MFA. ",{"data":50768,"content":50769,"nodeType":881},{},[50770],{"data":50771,"marks":50772,"value":50773,"nodeType":865},{},[],"In contrast, cross-IdP impersonation gives attackers a way of getting the benefit of an IdP compromise without needing to take over a locked down IdP account. ",{"data":50775,"content":50776,"nodeType":881},{},[50777],{"data":50778,"marks":50779,"value":50780,"nodeType":865},{},[],"Apps accept a wide variety of SSO login options. An app might support any combination of, for example:",{"data":50782,"content":50783,"nodeType":1818},{},[50784,50794,50804,50814,50824,50834,50844,50854,50864],{"data":50785,"content":50786,"nodeType":1734},{},[50787],{"data":50788,"content":50789,"nodeType":881},{},[50790],{"data":50791,"marks":50792,"value":50793,"nodeType":865},{},[],"Log in with Google",{"data":50795,"content":50796,"nodeType":1734},{},[50797],{"data":50798,"content":50799,"nodeType":881},{},[50800],{"data":50801,"marks":50802,"value":50803,"nodeType":865},{},[],"Log in with Facebook",{"data":50805,"content":50806,"nodeType":1734},{},[50807],{"data":50808,"content":50809,"nodeType":881},{},[50810],{"data":50811,"marks":50812,"value":50813,"nodeType":865},{},[],"Log in with Apple",{"data":50815,"content":50816,"nodeType":1734},{},[50817],{"data":50818,"content":50819,"nodeType":881},{},[50820],{"data":50821,"marks":50822,"value":50823,"nodeType":865},{},[],"Log in with X",{"data":50825,"content":50826,"nodeType":1734},{},[50827],{"data":50828,"content":50829,"nodeType":881},{},[50830],{"data":50831,"marks":50832,"value":50833,"nodeType":865},{},[],"Log in with Microsoft",{"data":50835,"content":50836,"nodeType":1734},{},[50837],{"data":50838,"content":50839,"nodeType":881},{},[50840],{"data":50841,"marks":50842,"value":50843,"nodeType":865},{},[],"Log in with GitHub",{"data":50845,"content":50846,"nodeType":1734},{},[50847],{"data":50848,"content":50849,"nodeType":881},{},[50850],{"data":50851,"marks":50852,"value":50853,"nodeType":865},{},[],"Log in with Okta ",{"data":50855,"content":50856,"nodeType":1734},{},[50857],{"data":50858,"content":50859,"nodeType":881},{},[50860],{"data":50861,"marks":50862,"value":50863,"nodeType":865},{},[],"Log in with SAML",{"data":50865,"content":50866,"nodeType":1734},{},[50867],{"data":50868,"content":50869,"nodeType":881},{},[50870],{"data":50871,"marks":50872,"value":50873,"nodeType":865},{},[],"Log in with SSO",{"data":50875,"content":50876,"nodeType":881},{},[50877],{"data":50878,"marks":50879,"value":50880,"nodeType":865},{},[],"And there are many, many IdPs — probably more than you realize — all of which could potentially be hijacked by an attacker to impersonate your organization.  ",{"data":50882,"content":50885,"nodeType":890},{"target":50883},{"sys":50884},{"id":43611,"type":887,"linkType":888},[],{"data":50887,"content":50888,"nodeType":881},{},[50889],{"data":50890,"marks":50891,"value":50892,"nodeType":865},{},[],"But it’s not just about attackers creating new IdP accounts: What other IdPs might your users have inadvertently created? And are these accounts as securely configured as your primary company IdP (most commonly Okta, Microsoft Entra, or Google Workspace)?",{"data":50894,"content":50895,"nodeType":881},{},[50896],{"data":50897,"marks":50898,"value":50899,"nodeType":865},{},[],"In fact, there are a few different scenarios to be aware of here:",{"data":50901,"content":50902,"nodeType":1818},{},[50903,50913,50923],{"data":50904,"content":50905,"nodeType":1734},{},[50906],{"data":50907,"content":50908,"nodeType":881},{},[50909],{"data":50910,"marks":50911,"value":50912,"nodeType":865},{},[],"An attacker creates a new account on a previously unused IdP mapping to your company domain and email, and exploits a flaw to bypass domain verification.",{"data":50914,"content":50915,"nodeType":1734},{},[50916],{"data":50917,"content":50918,"nodeType":881},{},[50919],{"data":50920,"marks":50921,"value":50922,"nodeType":865},{},[],"An attacker creates a new account on a previously unused IdP mapping to your company domain and email, and social engineers the target user to convince them to complete the domain verification request. ",{"data":50924,"content":50925,"nodeType":1734},{},[50926],{"data":50927,"content":50928,"nodeType":881},{},[50929],{"data":50930,"marks":50931,"value":50932,"nodeType":865},{},[],"A legitimate user signs up for an account that functions as an IdP with their company email, using a weak password and no MFA. This account is later compromised by an attacker. ",{"data":50934,"content":50935,"nodeType":881},{},[50936],{"data":50937,"marks":50938,"value":50939,"nodeType":865},{},[],"In all of these cases, an attacker would be able to authenticate to downstream apps and take over user accounts. ",{"data":50941,"content":50942,"nodeType":894},{},[],{"data":50944,"content":50945,"nodeType":1860},{},[50946],{"data":50947,"marks":50948,"value":50950,"nodeType":865},{},[50949],{"type":902},"We’re only scratching the surface of what’s possible",{"data":50952,"content":50953,"nodeType":881},{},[50954],{"data":50955,"marks":50956,"value":50957,"nodeType":865},{},[],"The Zendesk attack demonstrates a creative way of abusing an app’s functionality, combined with the way in which the Apple IdP is configured. ",{"data":50959,"content":50960,"nodeType":881},{},[50961],{"data":50962,"marks":50963,"value":50964,"nodeType":865},{},[],"It would be naive to suggest that similar issues don’t exist for other IdPs. Or that apps other than Zendesk don’t have features that can be exploited.",{"data":50966,"content":50967,"nodeType":881},{},[50968,50972,50981,50985,50993],{"data":50969,"marks":50970,"value":50971,"nodeType":865},{},[],"For example, we’ve previously documented ",{"data":50973,"content":50975,"nodeType":876},{"uri":50974},"https://pushsecurity.com/blog/nearly-invisible-attack-chain/#id-an-example-attack-zapier",[50976],{"data":50977,"marks":50978,"value":50980,"nodeType":865},{},[50979],{"type":874},"using Zapier to create malicious automated workflows",{"data":50982,"marks":50983,"value":50984,"nodeType":865},{},[]," to compromise integrated apps, or ",{"data":50986,"content":50987,"nodeType":876},{"uri":47708},[50988],{"data":50989,"marks":50990,"value":50992,"nodeType":865},{},[50991],{"type":874},"changing the SAML configuration of an app",{"data":50994,"marks":50995,"value":50996,"nodeType":865},{},[]," to direct logins to a malicious Okta tenant. ",{"data":50998,"content":50999,"nodeType":881},{},[51000],{"data":51001,"marks":51002,"value":51003,"nodeType":865},{},[],"Until now, there hasn’t been much research in this space. It’s not surprising when we consider that this kind of bug bounty isn’t paying out, and I know of only a handful of forward-thinking security consultancies conducting any real offensive security testing with their clients in this space. ",{"data":51005,"content":51006,"nodeType":881},{},[51007],{"data":51008,"marks":51009,"value":51010,"nodeType":865},{},[],"All organizations should be taking SaaS and identity attacks seriously — a good starting point would be to normalize SaaS and IdP configuration testing as part of routine security assessments, as well as demonstrating in-app post exploitation activity to raise awareness of how direct and dangerous these attacks can be. ",{"data":51012,"content":51013,"nodeType":894},{},[],{"data":51015,"content":51016,"nodeType":904},{},[51017],{"data":51018,"marks":51019,"value":51021,"nodeType":865},{},[51020],{"type":902},"Expect more cross-IdP impersonation in future",{"data":51023,"content":51024,"nodeType":881},{},[51025,51029,51037],{"data":51026,"marks":51027,"value":51028,"nodeType":865},{},[],"With the ",{"data":51030,"content":51031,"nodeType":876},{"uri":5072},[51032],{"data":51033,"marks":51034,"value":51036,"nodeType":865},{},[51035],{"type":874},"success of the attacks on Snowflake customers",{"data":51038,"marks":51039,"value":51040,"nodeType":865},{},[]," it feels like attackers and researchers are starting to take note, and the research scrutiny is amping up. It would be wise to expect more of these attacks in future. ",{"data":51042,"content":51043,"nodeType":881},{},[51044],{"data":51045,"marks":51046,"value":51047,"nodeType":865},{},[],"Cross-IdP impersonation could be largely prevented if all apps required re-verification upon adding a new login method by default (specifically, requiring that you log in with the original method, not approving via email link/code). This is yet another example of the inconsistencies in SaaS authentication introducing vulnerabilities. ",{"data":51049,"content":51050,"nodeType":881},{},[51051],{"data":51052,"marks":51053,"value":51054,"nodeType":865},{},[],"As this is unlikely to happen anytime soon, to mitigate the threat of cross-IdP impersonation we recommend that you:",{"data":51056,"content":51057,"nodeType":1818},{},[51058,51068,51078,51088],{"data":51059,"content":51060,"nodeType":1734},{},[51061],{"data":51062,"content":51063,"nodeType":881},{},[51064],{"data":51065,"marks":51066,"value":51067,"nodeType":865},{},[],"Set email alerts for employees receiving IdP activation emails to their corporate mailbox and forward to your SIEM. This will provide visibility both of unauthorized IdPs being connected to your domain by employees (which can lead to your corporate apps and accounts being compromised via less secure accounts, such as their Apple, LinkedIn, X, etc.), and of attackers attempting to register a new IdP as part of an attack. ",{"data":51069,"content":51070,"nodeType":1734},{},[51071],{"data":51072,"content":51073,"nodeType":881},{},[51074],{"data":51075,"marks":51076,"value":51077,"nodeType":865},{},[],"Warn users of the risks associated with creating new IdP accounts and connecting them to their primary corporate email (as well as the possibility of phishing scams designed to trick the user into completing the verification process or passing on a verification code). ",{"data":51079,"content":51080,"nodeType":1734},{},[51081],{"data":51082,"content":51083,"nodeType":881},{},[51084],{"data":51085,"marks":51086,"value":51087,"nodeType":865},{},[],"Where configurable, require downstream applications to enforce re-verification when adding new SSO methods. Requiring login with the original method, rather than email approval, is a more secure approach.",{"data":51089,"content":51090,"nodeType":1734},{},[51091],{"data":51092,"content":51093,"nodeType":881},{},[51094],{"data":51095,"marks":51096,"value":51097,"nodeType":865},{},[],"Where possible, prevent the conversion of personal accounts to corporate accounts within the main IdP providers. For example, Apple Business Manager recently released the ability to lock your domain and prevent new accounts being created, as well as locking the authentication to your preferred IdP (preventing local accounts from being created) — convenient timing!",{"data":51099,"content":51102,"nodeType":890},{"target":51100},{"sys":51101},{"id":49896,"type":887,"linkType":888},[],{"data":51104,"content":51105,"nodeType":881},{},[51106],{"data":51107,"marks":51108,"value":51109,"nodeType":865},{},[],"However, your ability to prevent attackers from creating new accounts on IdPs and connecting them to your domain is going to vary from IdP to IdP, so complete remediation may not be possible. And unless handled carefully, joining multiple IdPs to your primary IdP has the potential to increase your attack surface, not reduce it!",{"data":51111,"content":51112,"nodeType":881},{},[51113,51117,51124],{"data":51114,"marks":51115,"value":51116,"nodeType":865},{},[],"If you want a bit more technical detail on how this technique can be combined with verification phishing to reliably create new IdP accounts, ",{"data":51118,"content":51119,"nodeType":876},{"uri":34704},[51120],{"data":51121,"marks":51122,"value":51123,"nodeType":865},{},[],"check out this blog post.",{"data":51125,"marks":51126,"value":51127,"nodeType":865},{},[]," Here's a quick demo of the attack chain to whet your appetite... ",{"data":51129,"content":51132,"nodeType":890},{"target":51130},{"sys":51131},{"id":49532,"type":887,"linkType":888},[],{"data":51134,"content":51135,"nodeType":881},{},[51136],{"data":51137,"marks":51138,"value":21,"nodeType":865},{},[],{"data":51140,"content":51144,"nodeType":890},{"target":51141},{"sys":51142},{"id":51143,"type":887,"linkType":888},"3MGuq0h7IfW7F2ueNbc5v4",[],{"data":51146,"content":51147,"nodeType":881},{},[51148],{"data":51149,"marks":51150,"value":21,"nodeType":865},{},[],"Cross-IdP impersonation: Hijacking SSO to access downstream apps","Cross-IdP impersonation is a method of hijacking SSO to access downstream apps — without needing to compromise accounts on your company’s main IdP. ","2024-11-19T00:00:00.000Z","cross-idp-impersonation",{"items":51156},[51157,51159],{"sys":51158,"name":4507},{"id":4506},{"sys":51160,"name":342},{"id":4510},{"items":51162},[51163],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":51164},{"url":5377},{"__typename":1485,"sys":51166,"content":51168,"title":51849,"synopsis":51850,"hashTags":59,"publishedDate":51851,"slug":51852,"tagsCollection":51853,"authorsCollection":51859},{"id":51167},"6XHbplcolYfUeAB6x3olYQ",{"json":51169},{"data":51170,"content":51171,"nodeType":1463},{},[51172,51179,51198,51231,51238,51244,51251,51258,51291,51298,51305,51312,51319,51326,51333,51340,51347,51354,51361,51368,51375,51382,51389,51396,51403,51410,51416,51422,51429,51436,51443,51450,51456,51463,51470,51488,51495,51515,51521,51528,51535,51542,51549,51555,51562,51569,51576,51583,51590,51596,51602,51609,51616,51623,51630,51637,51644,51650,51657,51664,51671,51678,51685,51691,51697,51704,51711,51718,51724,51731,51738,51745,51751,51758,51764,51771,51777,51795,51813,51820,51837,51843],{"data":51173,"content":51174,"nodeType":904},{},[51175],{"data":51176,"marks":51177,"value":51178,"nodeType":865},{},[],"Picking up where we left off...",{"data":51180,"content":51181,"nodeType":881},{},[51182,51186,51194],{"data":51183,"marks":51184,"value":51185,"nodeType":865},{},[],"In our previous ",{"data":51187,"content":51188,"nodeType":876},{"uri":39792},[51189],{"data":51190,"marks":51191,"value":51193,"nodeType":865},{},[51192],{"type":874},"blog post",{"data":51195,"marks":51196,"value":51197,"nodeType":865},{},[],", we looked at a range of techniques implemented by a then-recent instance of the NakedPages AiTM phishing kit for evading detection. The techniques covered previously were mostly intended to make two detection strategies for defenders much more difficult:",{"data":51199,"content":51200,"nodeType":1818},{},[51201,51216],{"data":51202,"content":51203,"nodeType":1734},{},[51204],{"data":51205,"content":51206,"nodeType":881},{},[51207,51212],{"data":51208,"marks":51209,"value":51211,"nodeType":865},{},[51210],{"type":902},"Writing toolkit signatures",{"data":51213,"marks":51214,"value":51215,"nodeType":865},{},[],": Through heavy use of randomization, constantly changing hosting domains/IPs, legitimate hosting options etc., it becomes very difficult for defenders to maintain effective signatures to detect either generic phishing kit code or where they are hosted.",{"data":51217,"content":51218,"nodeType":1734},{},[51219],{"data":51220,"content":51221,"nodeType":881},{},[51222,51227],{"data":51223,"marks":51224,"value":51226,"nodeType":865},{},[51225],{"type":902},"Automating dynamic analysis",{"data":51228,"marks":51229,"value":51230,"nodeType":865},{},[],": Similarly to sandbox evasion for malware, phishing kits are designed to evade automated discovery and analysis, e.g. by using Cloudflare Turnstile bot detection, and requiring legitimate browser interaction and JavaScript execution in order for execution flow to reach the malicious phishing functionality.",{"data":51232,"content":51233,"nodeType":881},{},[51234],{"data":51235,"marks":51236,"value":51237,"nodeType":865},{},[],"In this blog post, we're diving deeper into a specific category of signature-based detection and how attackers are getting around them: Login page signatures. ",{"data":51239,"content":51243,"nodeType":890},{"target":51240},{"sys":51241},{"id":51242,"type":887,"linkType":888},"1aaDMth4Cxv6CMT0PJW5py",[],{"data":51245,"content":51246,"nodeType":904},{},[51247],{"data":51248,"marks":51249,"value":51250,"nodeType":865},{},[],"Login page signatures 101",{"data":51252,"content":51253,"nodeType":881},{},[51254],{"data":51255,"marks":51256,"value":51257,"nodeType":865},{},[],"The overwhelming majority of common AiTM phishing kits in the wild now are targeting the most dominant identity providers (IdPs), such as Microsoft Entra or Google Workspace. They typically emulate the login pages of these platforms to ensure the victim uses the correct password and MFA factor and completes the login process, so the attacker can steal the valid session.",{"data":51259,"content":51260,"nodeType":881},{},[51261,51265,51270,51273,51278,51282,51287],{"data":51262,"marks":51263,"value":51264,"nodeType":865},{},[],"As a result, security product vendors are naturally looking to move away from unreliable detections based on signaturing ever-changing phishing kits, toward detecting login pages that ",{"data":51266,"marks":51267,"value":51269,"nodeType":865},{},[51268],{"type":902},"look like",{"data":51271,"marks":51272,"value":2091,"nodeType":865},{},[],{"data":51274,"marks":51275,"value":51277,"nodeType":865},{},[51276],{"type":902},"Microsoft Entra, Google Workspace",{"data":51279,"marks":51280,"value":51281,"nodeType":865},{},[]," (or any other common IdP) ",{"data":51283,"marks":51284,"value":51286,"nodeType":865},{},[51285],{"type":902},"but are not hosted on the official domains",{"data":51288,"marks":51289,"value":51290,"nodeType":865},{},[],". The benefit here is that you’re focusing on a fixed, known target, rather than a constantly moving one (e.g. phishing kit codebases).",{"data":51292,"content":51293,"nodeType":881},{},[51294],{"data":51295,"marks":51296,"value":51297,"nodeType":865},{},[],"However, attackers have managed to stay one step ahead and are already using a wide range of techniques to break these detections and counter the countermeasures.",{"data":51299,"content":51300,"nodeType":904},{},[51301],{"data":51302,"marks":51303,"value":51304,"nodeType":865},{},[],"Signature evasion strategies",{"data":51306,"content":51307,"nodeType":881},{},[51308],{"data":51309,"marks":51310,"value":51311,"nodeType":865},{},[],"Well, like most good ideas, someone else has already had it — many phishing kits pre-emptively take steps to evade detections based on login page signatures. The specific evasion techniques used are a useful insight into what detection techniques are out there and are needing to be circumvented. ",{"data":51313,"content":51314,"nodeType":881},{},[51315],{"data":51316,"marks":51317,"value":51318,"nodeType":865},{},[],"Before we delve into the specific examples, let’s first consider the general strategies for this: document object model (DOM) obfuscation, and visual obfuscation. ",{"data":51320,"content":51321,"nodeType":1860},{},[51322],{"data":51323,"marks":51324,"value":51325,"nodeType":865},{},[],"DOM obfuscation",{"data":51327,"content":51328,"nodeType":881},{},[51329],{"data":51330,"marks":51331,"value":51332,"nodeType":865},{},[],"This is the more traditional evasion approach. The goal for an attacker is to have a login page that is visually identical to the real page when viewed with the human eye. ",{"data":51334,"content":51335,"nodeType":881},{},[51336],{"data":51337,"marks":51338,"value":51339,"nodeType":865},{},[],"But that doesn’t mean the underlying DOM (or loaded HTML, CSS, and JS code) needs to be the same, or even similar, to the real login page. It’s possible to  construct a completely different DOM that ensures the same visual output with a very different underlying code. ",{"data":51341,"content":51342,"nodeType":881},{},[51343],{"data":51344,"marks":51345,"value":51346,"nodeType":865},{},[],"It’s also possible to use dynamic modification techniques to ensure the DOM changes during execution to frustrate fixed point-in-time analysis controls, like those that may be used by web proxies.  ",{"data":51348,"content":51349,"nodeType":1860},{},[51350],{"data":51351,"marks":51352,"value":51353,"nodeType":865},{},[],"Visual obfuscation",{"data":51355,"content":51356,"nodeType":881},{},[51357],{"data":51358,"marks":51359,"value":51360,"nodeType":865},{},[],"With the ever-increasing capabilities of machine learning (ML) and other artificial intelligence (AI) technologies, we don’t just have to look at the underlying code and text signatures anymore. There are a range of computer vision based techniques that can be used to simulate a more human approach to assessing if a login page matches another example. ",{"data":51362,"content":51363,"nodeType":881},{},[51364],{"data":51365,"marks":51366,"value":51367,"nodeType":865},{},[],"Therefore, another approach to defeat login page signatures would be to perform visual obfuscation techniques that can frustrate computer vision-based detections, while still fooling a human user.",{"data":51369,"content":51370,"nodeType":904},{},[51371],{"data":51372,"marks":51373,"value":51374,"nodeType":865},{},[],"DOM obfuscation techniques",{"data":51376,"content":51377,"nodeType":881},{},[51378],{"data":51379,"marks":51380,"value":51381,"nodeType":865},{},[],"For consistency, we’re going to focus on Microsoft login phishing kits as they are the most common (by far), but we’ll pick from some different samples we’ve observed. Let’s start with a few examples of DOM obfuscation we have seen in the wild:",{"data":51383,"content":51384,"nodeType":1860},{},[51385],{"data":51386,"marks":51387,"value":51388,"nodeType":865},{},[],"#1 – DOM structure change",{"data":51390,"content":51391,"nodeType":881},{},[51392],{"data":51393,"marks":51394,"value":51395,"nodeType":865},{},[],"If an attacker were to simply clone Microsoft’s login page, then we’d expect to see a very similar (if not identical) DOM structure, right? After all, the simplest way to emulate a web page visually is either to copy the HTML directly or transparently proxy requests to the real target with minimal changes, as tools like Evilginx do. This would make detection far simpler as we’d have a known code structure to look for. ",{"data":51397,"content":51398,"nodeType":881},{},[51399],{"data":51400,"marks":51401,"value":51402,"nodeType":865},{},[],"Unfortunately, it’s pretty common for attackers to deliberately use a completely different DOM structure for something that’s almost identical to the eye. It takes a lot more effort to implement this and so the reason for it is almost certainly to avoid this detection technique.  ",{"data":51404,"content":51405,"nodeType":881},{},[51406],{"data":51407,"marks":51408,"value":51409,"nodeType":865},{},[],"Check out the examples below to see a high-level interpretation of the DOM structure for a legitimate Microsoft login page and one phishing example. You can see how they are visually very similar, but radically different from one another when looking at DOM code:",{"data":51411,"content":51415,"nodeType":890},{"target":51412},{"sys":51413},{"id":51414,"type":887,"linkType":888},"4amv144ZzTBmd9ssh66kkr",[],{"data":51417,"content":51421,"nodeType":890},{"target":51418},{"sys":51419},{"id":51420,"type":887,"linkType":888},"2gC49b2f2Th4wAEWLPvAnL",[],{"data":51423,"content":51424,"nodeType":1860},{},[51425],{"data":51426,"marks":51427,"value":51428,"nodeType":865},{},[],"#2 – Randomizing page titles",{"data":51430,"content":51431,"nodeType":881},{},[51432],{"data":51433,"marks":51434,"value":51435,"nodeType":865},{},[],"The HTML page title is one very specific place to check for similarity. For Microsoft, it can change slightly depending on the service, but if we use Outlook as an example then the page title is “Sign in to Outlook”. This also has a favicon of the Microsoft logo (another issue we’ll visit later in the article). \n\nIt’s unsurprising that attackers are randomizing the page title to evade basic detections – how many users would really notice any difference?",{"data":51437,"content":51438,"nodeType":881},{},[51439],{"data":51440,"marks":51441,"value":51442,"nodeType":865},{},[],"Some kits, such as the NakedPages case study we looked at in the previous article, use purely randomized alphanumeric text. Others use english words that may seem innocuous if a user does inspect them, but are in fact randomized between iterations to ensure any one set that is flagged will not completely block the phishing kit from operating. ",{"data":51444,"content":51445,"nodeType":881},{},[51446],{"data":51447,"marks":51448,"value":51449,"nodeType":865},{},[],"For example, see three refreshed examples of the same phishing kit below when compared with the legitimate Outlook login page title next to it.",{"data":51451,"content":51455,"nodeType":890},{"target":51452},{"sys":51453},{"id":51454,"type":887,"linkType":888},"2KuHCssISCeGYeZNC005pV",[],{"data":51457,"content":51458,"nodeType":1860},{},[51459],{"data":51460,"marks":51461,"value":51462,"nodeType":865},{},[],"#3 – Desktop control techniques (e.g. NoVNC)",{"data":51464,"content":51465,"nodeType":881},{},[51466],{"data":51467,"marks":51468,"value":51469,"nodeType":865},{},[],"The most common AiTM phishing technique is some form of a web proxy method, where the victim interacts with a legitimate website that is proxying certain requests to the real backend. However, this is not the only method. Some tools utilize a Browser-in-the-Middle (BiTM) technique that involves using desktop sharing technologies to remotely control an attacker’s browser instead. ",{"data":51471,"content":51472,"nodeType":881},{},[51473,51477,51485],{"data":51474,"marks":51475,"value":51476,"nodeType":865},{},[],"If you want to know more about this, check out our ",{"data":51478,"content":51479,"nodeType":876},{"uri":28776},[51480],{"data":51481,"marks":51482,"value":51484,"nodeType":865},{},[51483],{"type":874},"previous article on AiTM phishing",{"data":51486,"marks":51487,"value":959,"nodeType":865},{},[],{"data":51489,"content":51490,"nodeType":881},{},[51491],{"data":51492,"marks":51493,"value":51494,"nodeType":865},{},[],"The upside of this for an attacker is that the website is actually completely different from the target website under the hood. If anything, it just looks like any other website making use of similar technologies like NoVNC.",{"data":51496,"content":51497,"nodeType":881},{},[51498,51502,51511],{"data":51499,"marks":51500,"value":51501,"nodeType":865},{},[],"For example, see the following screenshot example of using the open-source BiTM tool, ",{"data":51503,"content":51505,"nodeType":876},{"uri":51504},"https://github.com/JoelGMSec/EvilnoVNC",[51506],{"data":51507,"marks":51508,"value":51510,"nodeType":865},{},[51509],{"type":874},"EvilNoVNC",{"data":51512,"marks":51513,"value":51514,"nodeType":865},{},[],". You can see how the underlying HTML and DOM are completely different due to the use of this technique, with effectively the entire page just being an HTML canvas element that is rendered like a video.",{"data":51516,"content":51520,"nodeType":890},{"target":51517},{"sys":51518},{"id":51519,"type":887,"linkType":888},"60Jt2P0ip14ycdtS9qLPhc",[],{"data":51522,"content":51523,"nodeType":1860},{},[51524],{"data":51525,"marks":51526,"value":51527,"nodeType":865},{},[],"#4 – Dynamic text decoding",{"data":51529,"content":51530,"nodeType":881},{},[51531],{"data":51532,"marks":51533,"value":51534,"nodeType":865},{},[],"Sometimes there may be very specific strings that detection tools might try to signature on. Let’s use the example of text that appears visually on the login page. While most login text can be pretty generic, e.g. “Sign in”, that’s not always the case. To appear authentic, it’s better for an attacker to keep it the same, but that leaves it vulnerable to signature detection. ",{"data":51536,"content":51537,"nodeType":881},{},[51538],{"data":51539,"marks":51540,"value":51541,"nodeType":865},{},[],"For example, the placeholder text on Microsoft’s login page is “Email, phone, or Skype”. Particularly given Microsoft’s historical acquisition of Skype, this is actually a pretty specific piece of text that you won’t usually find in the username field of a login page very often. ",{"data":51543,"content":51544,"nodeType":881},{},[51545],{"data":51546,"marks":51547,"value":51548,"nodeType":865},{},[],"So how do you keep this text but make it harder to signature on? Well you fall back to classic decoding techniques to avoid static signatures. In this case, that is decoded from base64 using JavaScript’s atob() function in order to load that text dynamically during execution rather than have it statically within the HTML. This makes it harder to create a signature using common point-in-time static analysis techniques.",{"data":51550,"content":51554,"nodeType":890},{"target":51551},{"sys":51552},{"id":51553,"type":887,"linkType":888},"1PymaE09il5CubFvwSfLqW",[],{"data":51556,"content":51557,"nodeType":1860},{},[51558],{"data":51559,"marks":51560,"value":51561,"nodeType":865},{},[],"#5 – Image element obfuscation",{"data":51563,"content":51564,"nodeType":881},{},[51565],{"data":51566,"marks":51567,"value":51568,"nodeType":865},{},[],"We’re starting to shift towards more visual-based obfuscation elements now, but first let’s cover  an interesting example that straddles the two.",{"data":51570,"content":51571,"nodeType":881},{},[51572],{"data":51573,"marks":51574,"value":51575,"nodeType":865},{},[],"Many login pages will have very clear examples of vendor logos present in specific locations and elements as part of a login page. This is a huge part of an authentic visual experience and so attackers would like to keep them there. However, as defenders we could specifically look for these elements, both for pure structural matching techniques or as a pre-processing step for visual matching techniques later (e.g. visually matching a logo, rather than the entire page). ",{"data":51577,"content":51578,"nodeType":881},{},[51579],{"data":51580,"marks":51581,"value":51582,"nodeType":865},{},[],"For this reason, attackers might want to obfuscate this aspect in order to make it difficult to match or locate the images used within the login page, while still ensuring they appear visually identical to a user.",{"data":51584,"content":51585,"nodeType":881},{},[51586],{"data":51587,"marks":51588,"value":51589,"nodeType":865},{},[],"Below, we can see a comparison of a legitimate Microsoft login page and a phishing kit. You can see how in the original a standard HTML \u003Cimg> element of a specific size and name are used. In comparison, our phishing kit has replaced this with a \u003Cdiv> element of a different size and made use of background image styling to ensure the \u003Cdiv> ends up with the same visual appearance despite the structural differences.",{"data":51591,"content":51595,"nodeType":890},{"target":51592},{"sys":51593},{"id":51594,"type":887,"linkType":888},"4MvwXZDjMA56ZYSdjKpu9R",[],{"data":51597,"content":51601,"nodeType":890},{"target":51598},{"sys":51599},{"id":51600,"type":887,"linkType":888},"6tNMjTvHuAWkuK0x7ZEgKr",[],{"data":51603,"content":51604,"nodeType":904},{},[51605],{"data":51606,"marks":51607,"value":51608,"nodeType":865},{},[],"Visual obfuscation techniques",{"data":51610,"content":51611,"nodeType":881},{},[51612],{"data":51613,"marks":51614,"value":51615,"nodeType":865},{},[],"As if that wasn’t enough, let’s move on to some visual obfuscation techniques that attackers are also using.",{"data":51617,"content":51618,"nodeType":1860},{},[51619],{"data":51620,"marks":51621,"value":51622,"nodeType":865},{},[],"#6 – Favicon changes",{"data":51624,"content":51625,"nodeType":881},{},[51626],{"data":51627,"marks":51628,"value":51629,"nodeType":865},{},[],"We effectively saw this earlier when speaking about HTML page title randomization. The favicon is also an easy place to look for the obvious use of vendor logos. How many legitimate websites are going to have the Microsoft logo as their favicon? If they do, they may quickly end up with a cease and desist letter!",{"data":51631,"content":51632,"nodeType":881},{},[51633],{"data":51634,"marks":51635,"value":51636,"nodeType":865},{},[],"Favicons also render at a fixed size, so if an attacker wants to ensure that the Microsoft logo appears as the favicon for their page, it gives defenders a fixed target to perform image recognition against for cloned logos. ",{"data":51638,"content":51639,"nodeType":881},{},[51640],{"data":51641,"marks":51642,"value":51643,"nodeType":865},{},[],"In this phishing kit example, it looks like the authors have decided they are better off just leaving the favicon empty to avoid being vulnerable to this detection technique.",{"data":51645,"content":51649,"nodeType":890},{"target":51646},{"sys":51647},{"id":51648,"type":887,"linkType":888},"7FknWWF9ri9eZvu8Prhkd5",[],{"data":51651,"content":51652,"nodeType":1860},{},[51653],{"data":51654,"marks":51655,"value":51656,"nodeType":865},{},[],"#7 – Blurred background images",{"data":51658,"content":51659,"nodeType":881},{},[51660],{"data":51661,"marks":51662,"value":51663,"nodeType":865},{},[],"Ok, this is a pretty clever one. Let’s say as a defender we wanted to perform sophisticated image recognition techniques to detect websites that look visually very similar to Microsoft’s login page overall. There may be many challenges around rendering resolution etc to deal with but conceptually we could look to match on the whole page. ",{"data":51665,"content":51666,"nodeType":881},{},[51667],{"data":51668,"marks":51669,"value":51670,"nodeType":865},{},[],"However, if an attacker makes a substantial visual change to the page that still appears authentic then this would prevent the technique from operating effectively. One common graphic design method used when a modal pops up is to blur the background. Some phishing kits use similar techniques on their login pages with a variety of different background images that are derived from legitimate Microsoft sources. ",{"data":51672,"content":51673,"nodeType":881},{},[51674],{"data":51675,"marks":51676,"value":51677,"nodeType":865},{},[],"The first time you see this, it’s easy to think you’ve seen this a hundred times before. It just seems very familiar and authentic… except it’s not. The real login page has a blank background. Therefore, any algorithms looking for visual similarity of the overall page are not going to match because they are actually radically different. ",{"data":51679,"content":51680,"nodeType":881},{},[51681],{"data":51682,"marks":51683,"value":51684,"nodeType":865},{},[],"This is a trick on the human brain and the way we interpret images, not a trick on a computer vision algorithm. Take a look at the phishing example and the real Microsoft login page below:",{"data":51686,"content":51690,"nodeType":890},{"target":51687},{"sys":51688},{"id":51689,"type":887,"linkType":888},"6KnrHECqltSOgSCGHIjYEL",[],{"data":51692,"content":51696,"nodeType":890},{"target":51693},{"sys":51694},{"id":51695,"type":887,"linkType":888},"1nb6K1MyBkON2eBHk1365B",[],{"data":51698,"content":51699,"nodeType":1860},{},[51700],{"data":51701,"marks":51702,"value":51703,"nodeType":865},{},[],"#8 – Logo substitution",{"data":51705,"content":51706,"nodeType":881},{},[51707],{"data":51708,"marks":51709,"value":51710,"nodeType":865},{},[],"You might have noticed one other change with the previous image – the logo that was used. We saw earlier how some phishing kits make it harder to identify individual logos within an image through DOM obfuscation techniques. However, the other approach is to substitute logos for similar ones that give a sense of authenticity to the user but are visually completely different.",{"data":51712,"content":51713,"nodeType":881},{},[51714],{"data":51715,"marks":51716,"value":51717,"nodeType":865},{},[],"In this case, the phishing kit has chosen to use the newer purple hexagon Microsoft 365 logo in place of the standard Microsoft logo on the login page. Users will no doubt be familiar with this logo as belonging to Microsoft and so it still gives the sense of authenticity. A computer vision algorithm looking to match the original logo won’t know that though!",{"data":51719,"content":51723,"nodeType":890},{"target":51720},{"sys":51721},{"id":51722,"type":887,"linkType":888},"5o1WRmupkYPr9QmeQUf5uF",[],{"data":51725,"content":51726,"nodeType":1860},{},[51727],{"data":51728,"marks":51729,"value":51730,"nodeType":865},{},[],"#9 - Sub-image obfuscation",{"data":51732,"content":51733,"nodeType":881},{},[51734],{"data":51735,"marks":51736,"value":51737,"nodeType":865},{},[],"Ok, so let’s say an attacker wants to use the real logo and they’ve even used the image element obfuscation method we saw earlier to dynamically set the image as a background image for a \u003Cdiv> element. ",{"data":51739,"content":51740,"nodeType":881},{},[51741],{"data":51742,"marks":51743,"value":51744,"nodeType":865},{},[],"However, it’s not impossible for these images to be isolated and analyzed. Perhaps a defender might enumerate all divs, compute the background images and analyze them all. We can see an example of using code to do this to determine the image used by a \u003Cdiv> element in a phishing kit below:",{"data":51746,"content":51750,"nodeType":890},{"target":51747},{"sys":51748},{"id":51749,"type":887,"linkType":888},"79e7r8I5p0Nh9hpqrRs9eJ",[],{"data":51752,"content":51753,"nodeType":881},{},[51754],{"data":51755,"marks":51756,"value":51757,"nodeType":865},{},[],"This gives us the base64 image data that was set as the background image. However, if we look at that image data directly we see it’s an obfuscated form of the image, even though it displays correctly when properly cropped as it’s embedded in the overall page:",{"data":51759,"content":51763,"nodeType":890},{"target":51760},{"sys":51761},{"id":51762,"type":887,"linkType":888},"jXlXRHrezWsZ27CiQIyBO",[],{"data":51765,"content":51766,"nodeType":881},{},[51767],{"data":51768,"marks":51769,"value":51770,"nodeType":865},{},[],"This makes it harder for a visual algorithm to match the logo as it’s clearly not exactly the same. Instead, careful construction of the div and related DOM has ensured that these obfuscated edge pieces do not show visually to the user.",{"data":51772,"content":51773,"nodeType":904},{},[51774],{"data":51775,"marks":51776,"value":29161,"nodeType":865},{},[],{"data":51778,"content":51779,"nodeType":881},{},[51780,51784,51791],{"data":51781,"marks":51782,"value":51783,"nodeType":865},{},[],"In ",{"data":51785,"content":51786,"nodeType":876},{"uri":39792},[51787],{"data":51788,"marks":51789,"value":51790,"nodeType":865},{},[],"our previous article",{"data":51792,"marks":51793,"value":51794,"nodeType":865},{},[],", we looked at a higher level set of techniques used by phishing kits to avoid detection. In this article, we’ve dived deeper into one particular strategy of breaking login page signatures and have shown how, even inside of this one strategy, there are many different sub-techniques being used to evade common detections.",{"data":51796,"content":51797,"nodeType":881},{},[51798,51802,51809],{"data":51799,"marks":51800,"value":51801,"nodeType":865},{},[],"Looking at the evasion techniques discussed here and in ",{"data":51803,"content":51804,"nodeType":876},{"uri":39792},[51805],{"data":51806,"marks":51807,"value":51808,"nodeType":865},{},[],"Part 1",{"data":51810,"marks":51811,"value":51812,"nodeType":865},{},[],", it’s pretty clear that attackers are consciously looking to bypass automated detection techniques typically implemented through either web traffic analysis (using a web proxy inspection tool or Secure Web Gateway) or website sandboxing (for example link analysis provided by an email security appliance).",{"data":51814,"content":51815,"nodeType":881},{},[51816],{"data":51817,"marks":51818,"value":51819,"nodeType":865},{},[],"On a positive note, this shows us that (at least some) detection tools are trending upwards on the Pyramid of Pain — moving away from nearly pointless signatures like IP addresses and domains towards more in-depth detections of specific tool techniques. Though it’s also fair to say that, in this cat-and-mouse game, it seems the attackers are maintaining the advantage. This may be because these detection technologies are widely available, and attackers can test their kits against these tools and change them just enough to bypass them.",{"data":51821,"content":51822,"nodeType":881},{},[51823,51827,51834],{"data":51824,"marks":51825,"value":51826,"nodeType":865},{},[],"If you’re interested in how Push is able to detect these attacks despite all these ever evolving evasion techniques by using browser telemetry and evaluating user interaction with these kits — ",{"data":51828,"content":51829,"nodeType":876},{"uri":17113},[51830],{"data":51831,"marks":51832,"value":51833,"nodeType":865},{},[],"take a look at how we do phishing detection.",{"data":51835,"marks":51836,"value":21,"nodeType":865},{},[],{"data":51838,"content":51842,"nodeType":890},{"target":51839},{"sys":51840},{"id":51841,"type":887,"linkType":888},"6H8HmAmYiGvs3T7kQLA4dd",[],{"data":51844,"content":51845,"nodeType":881},{},[51846],{"data":51847,"marks":51848,"value":21,"nodeType":865},{},[],"How AitM phishing kits evade detection: Part 2","How attackers are breaking detection signatures designed to identify phishing sites impersonating real login pages.","2024-11-12T00:00:00.000Z","how-aitm-phishing-kits-evade-detection-p2",{"items":51854},[51855,51857],{"sys":51856,"name":342},{"id":4510},{"sys":51858,"name":4507},{"id":4506},{"items":51860},[51861],{"fullName":4514,"firstName":4515,"jobTitle":4516,"profilePicture":51862},{"url":4518},{"__typename":1485,"sys":51864,"content":51865,"title":38993,"synopsis":38994,"hashTags":59,"publishedDate":38995,"slug":38996,"tagsCollection":52139,"authorsCollection":52145},{"id":38676},{"json":51866},{"data":51867,"content":51868,"nodeType":1463},{},[51869,51875,51891,51904,51910,51916,51919,51925,51931,51979,51985,51990,51993,51999,52005,52011,52017,52023,52037,52042,52048,52054,52068,52073,52079,52085,52091,52097,52103,52106,52112,52128,52133],{"data":51870,"content":51871,"nodeType":904},{},[51872],{"data":51873,"marks":51874,"value":38687,"nodeType":865},{},[],{"data":51876,"content":51877,"nodeType":881},{},[51878,51881,51888],{"data":51879,"marks":51880,"value":38694,"nodeType":865},{},[],{"data":51882,"content":51883,"nodeType":876},{"uri":38697},[51884],{"data":51885,"marks":51886,"value":38703,"nodeType":865},{},[51887],{"type":874},{"data":51889,"marks":51890,"value":1032,"nodeType":865},{},[],{"data":51892,"content":51893,"nodeType":881},{},[51894,51897,51901],{"data":51895,"marks":51896,"value":38713,"nodeType":865},{},[],{"data":51898,"marks":51899,"value":38718,"nodeType":865},{},[51900],{"type":874},{"data":51902,"marks":51903,"value":38722,"nodeType":865},{},[],{"data":51905,"content":51906,"nodeType":881},{},[51907],{"data":51908,"marks":51909,"value":38729,"nodeType":865},{},[],{"data":51911,"content":51912,"nodeType":881},{},[51913],{"data":51914,"marks":51915,"value":38736,"nodeType":865},{},[],{"data":51917,"content":51918,"nodeType":894},{},[],{"data":51920,"content":51921,"nodeType":1860},{},[51922],{"data":51923,"marks":51924,"value":38746,"nodeType":865},{},[],{"data":51926,"content":51927,"nodeType":881},{},[51928],{"data":51929,"marks":51930,"value":38753,"nodeType":865},{},[],{"data":51932,"content":51933,"nodeType":1818},{},[51934,51943,51952,51961,51970],{"data":51935,"content":51936,"nodeType":1734},{},[51937],{"data":51938,"content":51939,"nodeType":881},{},[51940],{"data":51941,"marks":51942,"value":38766,"nodeType":865},{},[],{"data":51944,"content":51945,"nodeType":1734},{},[51946],{"data":51947,"content":51948,"nodeType":881},{},[51949],{"data":51950,"marks":51951,"value":38776,"nodeType":865},{},[],{"data":51953,"content":51954,"nodeType":1734},{},[51955],{"data":51956,"content":51957,"nodeType":881},{},[51958],{"data":51959,"marks":51960,"value":38786,"nodeType":865},{},[],{"data":51962,"content":51963,"nodeType":1734},{},[51964],{"data":51965,"content":51966,"nodeType":881},{},[51967],{"data":51968,"marks":51969,"value":38796,"nodeType":865},{},[],{"data":51971,"content":51972,"nodeType":1734},{},[51973],{"data":51974,"content":51975,"nodeType":881},{},[51976],{"data":51977,"marks":51978,"value":38806,"nodeType":865},{},[],{"data":51980,"content":51981,"nodeType":881},{},[51982],{"data":51983,"marks":51984,"value":38813,"nodeType":865},{},[],{"data":51986,"content":51989,"nodeType":890},{"target":51987},{"sys":51988},{"id":38818,"type":887,"linkType":888},[],{"data":51991,"content":51992,"nodeType":894},{},[],{"data":51994,"content":51995,"nodeType":1860},{},[51996],{"data":51997,"marks":51998,"value":38829,"nodeType":865},{},[],{"data":52000,"content":52001,"nodeType":881},{},[52002],{"data":52003,"marks":52004,"value":38836,"nodeType":865},{},[],{"data":52006,"content":52007,"nodeType":881},{},[52008],{"data":52009,"marks":52010,"value":38843,"nodeType":865},{},[],{"data":52012,"content":52013,"nodeType":881},{},[52014],{"data":52015,"marks":52016,"value":38850,"nodeType":865},{},[],{"data":52018,"content":52019,"nodeType":881},{},[52020],{"data":52021,"marks":52022,"value":38857,"nodeType":865},{},[],{"data":52024,"content":52025,"nodeType":1860},{},[52026,52029,52034],{"data":52027,"marks":52028,"value":38864,"nodeType":865},{},[],{"data":52030,"marks":52031,"value":38870,"nodeType":865},{},[52032,52033],{"type":874},{"type":902},{"data":52035,"marks":52036,"value":38874,"nodeType":865},{},[],{"data":52038,"content":52041,"nodeType":890},{"target":52039},{"sys":52040},{"id":38879,"type":887,"linkType":888},[],{"data":52043,"content":52044,"nodeType":881},{},[52045],{"data":52046,"marks":52047,"value":38887,"nodeType":865},{},[],{"data":52049,"content":52050,"nodeType":881},{},[52051],{"data":52052,"marks":52053,"value":38894,"nodeType":865},{},[],{"data":52055,"content":52056,"nodeType":1860},{},[52057,52060,52065],{"data":52058,"marks":52059,"value":38901,"nodeType":865},{},[],{"data":52061,"marks":52062,"value":38907,"nodeType":865},{},[52063,52064],{"type":874},{"type":902},{"data":52066,"marks":52067,"value":38911,"nodeType":865},{},[],{"data":52069,"content":52072,"nodeType":890},{"target":52070},{"sys":52071},{"id":38916,"type":887,"linkType":888},[],{"data":52074,"content":52075,"nodeType":881},{},[52076],{"data":52077,"marks":52078,"value":38924,"nodeType":865},{},[],{"data":52080,"content":52081,"nodeType":881},{},[52082],{"data":52083,"marks":52084,"value":38931,"nodeType":865},{},[],{"data":52086,"content":52087,"nodeType":881},{},[52088],{"data":52089,"marks":52090,"value":38938,"nodeType":865},{},[],{"data":52092,"content":52093,"nodeType":881},{},[52094],{"data":52095,"marks":52096,"value":38945,"nodeType":865},{},[],{"data":52098,"content":52099,"nodeType":881},{},[52100],{"data":52101,"marks":52102,"value":38952,"nodeType":865},{},[],{"data":52104,"content":52105,"nodeType":894},{},[],{"data":52107,"content":52108,"nodeType":904},{},[52109],{"data":52110,"marks":52111,"value":38962,"nodeType":865},{},[],{"data":52113,"content":52114,"nodeType":881},{},[52115,52118,52125],{"data":52116,"marks":52117,"value":38969,"nodeType":865},{},[],{"data":52119,"content":52120,"nodeType":876},{"uri":6048},[52121],{"data":52122,"marks":52123,"value":38977,"nodeType":865},{},[52124],{"type":874},{"data":52126,"marks":52127,"value":30204,"nodeType":865},{},[],{"data":52129,"content":52132,"nodeType":890},{"target":52130},{"sys":52131},{"id":38985,"type":887,"linkType":888},[],{"data":52134,"content":52135,"nodeType":881},{},[52136],{"data":52137,"marks":52138,"value":21,"nodeType":865},{},[],{"items":52140},[52141,52143],{"sys":52142,"name":4507},{"id":4506},{"sys":52144,"name":342},{"id":4510},{"items":52146},[52147],{"fullName":32085,"firstName":32086,"jobTitle":20082,"profilePicture":52148},{"url":32088},"a-new-class-of-phishing-verification-phishing-and-cross-idp-impersonation","blog/a-new-class-of-phishing-verification-phishing-and-cross-idp-impersonation",{"json":52152},{"data":52153,"content":52154,"nodeType":1463},{},[52155],{"data":52156,"content":52157,"nodeType":881},{},[52158,52162,52166],{"data":52159,"marks":52160,"value":52161,"nodeType":865},{},[],"P",{"data":52163,"marks":52164,"value":52165,"nodeType":865},{},[],"hishing for email verification can be combined with cross-IdP impersonation gain direct access to downstream SaaS. ",{"data":52167,"marks":52168,"value":52169,"nodeType":865},{},[],"This means that accounts normally protected by strong SSO mechanisms using phishing-resistant MFA factors like passkeys or Okta Fastpass can be directly compromised through phishing a single OTP.","How phishing for email verification can be combined with cross-IdP impersonation to gain direct access to downstream SaaS and bypass hardened IdP accounts.\n",{"id":52172,"publishedAt":52173},"6aIClLltBiYMQYgKtQcKqz","2026-08-12T11:54:45.994Z",{"items":52175},[52176,52178],{"sys":52177,"name":4507},{"id":4506},{"sys":52179,"name":342},{"id":4510},{"items":52181},[52182,52184,52186,52188,52190,52192,52194,52196,52198,52200,52202,52204,52206],{"sys":52183,"name":279,"slug":280,"tier":31},{"id":276},{"sys":52185,"name":413,"slug":414,"tier":31},{"id":410},{"sys":52187,"name":519,"slug":520,"tier":31},{"id":516},{"sys":52189,"name":545,"slug":546,"tier":31},{"id":542},{"sys":52191,"name":261,"slug":262,"tier":45},{"id":258},{"sys":52193,"name":466,"slug":467,"tier":45},{"id":463},{"sys":52195,"name":324,"slug":325,"tier":45},{"id":321},{"sys":52197,"name":607,"slug":608,"tier":45},{"id":604},{"sys":52199,"name":395,"slug":396,"tier":45},{"id":392},{"sys":52201,"name":484,"slug":485,"tier":45},{"id":481},{"sys":52203,"name":457,"slug":458,"tier":45},{"id":454},{"sys":52205,"name":493,"slug":494,"tier":45},{"id":490},{"sys":52207,"name":475,"slug":476,"tier":45},{"id":472},"p_wkpCZ2pyZqAIoH1mlF3sFMEyFX86375Q6MdLkb4FM",{"id":52210,"title":51151,"authorsCollection":52211,"content":52216,"extension":228,"faqItemsCollection":53027,"faqTitle":59,"featured":6,"hashTags":59,"meta":53029,"metaTitle":53030,"ogImage":53031,"postType":7216,"publishedDate":51153,"relatedBlogPostsCollection":53032,"slug":51154,"stem":54676,"subtitle":59,"summary":54677,"synopsis":51152,"sys":54688,"tagsCollection":54690,"topicsCollection":54696,"__hash__":54720},"blog/blog/cross-idp-impersonation.json",{"items":52212},[52213],{"fullName":5373,"firstName":5374,"jobTitle":5375,"socialLinks":52214,"profilePicture":52215},[6440],{"url":5377},{"json":52217,"links":52989},{"data":52218,"content":52219,"nodeType":1463},{},[52220,52226,52232,52257,52263,52266,52272,52279,52295,52301,52307,52312,52318,52324,52345,52351,52357,52392,52398,52401,52407,52437,52442,52448,52454,52457,52464,52470,52500,52505,52511,52514,52521,52537,52543,52549,52565,52568,52575,52591,52597,52610,52623,52626,52633,52649,52655,52661,52745,52751,52756,52762,52768,52798,52804,52807,52814,52820,52826,52852,52858,52864,52867,52874,52890,52896,52902,52941,52946,52952,52967,52972,52978,52983],{"data":52221,"content":52222,"nodeType":881},{},[52223],{"data":52224,"marks":52225,"value":50276,"nodeType":865},{},[],{"data":52227,"content":52228,"nodeType":881},{},[52229],{"data":52230,"marks":52231,"value":50283,"nodeType":865},{},[],{"data":52233,"content":52234,"nodeType":881},{},[52235,52238,52244,52247,52254],{"data":52236,"marks":52237,"value":50290,"nodeType":865},{},[],{"data":52239,"content":52240,"nodeType":876},{"uri":30350},[52241],{"data":52242,"marks":52243,"value":30356,"nodeType":865},{},[],{"data":52245,"marks":52246,"value":50300,"nodeType":865},{},[],{"data":52248,"content":52249,"nodeType":876},{"uri":16924},[52250],{"data":52251,"marks":52252,"value":11122,"nodeType":865},{},[52253],{"type":874},{"data":52255,"marks":52256,"value":50311,"nodeType":865},{},[],{"data":52258,"content":52259,"nodeType":881},{},[52260],{"data":52261,"marks":52262,"value":50318,"nodeType":865},{},[],{"data":52264,"content":52265,"nodeType":894},{},[],{"data":52267,"content":52268,"nodeType":904},{},[52269],{"data":52270,"marks":52271,"value":50328,"nodeType":865},{},[],{"data":52273,"content":52274,"nodeType":1860},{},[52275],{"data":52276,"marks":52277,"value":50336,"nodeType":865},{},[52278],{"type":902},{"data":52280,"content":52281,"nodeType":881},{},[52282,52285,52292],{"data":52283,"marks":52284,"value":50343,"nodeType":865},{},[],{"data":52286,"content":52287,"nodeType":876},{"uri":50346},[52288],{"data":52289,"marks":52290,"value":50352,"nodeType":865},{},[52291],{"type":874},{"data":52293,"marks":52294,"value":50356,"nodeType":865},{},[],{"data":52296,"content":52297,"nodeType":881},{},[52298],{"data":52299,"marks":52300,"value":50363,"nodeType":865},{},[],{"data":52302,"content":52303,"nodeType":881},{},[52304],{"data":52305,"marks":52306,"value":50370,"nodeType":865},{},[],{"data":52308,"content":52311,"nodeType":890},{"target":52309},{"sys":52310},{"id":50375,"type":887,"linkType":888},[],{"data":52313,"content":52314,"nodeType":881},{},[52315],{"data":52316,"marks":52317,"value":50383,"nodeType":865},{},[],{"data":52319,"content":52320,"nodeType":881},{},[52321],{"data":52322,"marks":52323,"value":50390,"nodeType":865},{},[],{"data":52325,"content":52326,"nodeType":1818},{},[52327,52336],{"data":52328,"content":52329,"nodeType":1734},{},[52330],{"data":52331,"content":52332,"nodeType":881},{},[52333],{"data":52334,"marks":52335,"value":50403,"nodeType":865},{},[],{"data":52337,"content":52338,"nodeType":1734},{},[52339],{"data":52340,"content":52341,"nodeType":881},{},[52342],{"data":52343,"marks":52344,"value":50413,"nodeType":865},{},[],{"data":52346,"content":52347,"nodeType":881},{},[52348],{"data":52349,"marks":52350,"value":50420,"nodeType":865},{},[],{"data":52352,"content":52353,"nodeType":881},{},[52354],{"data":52355,"marks":52356,"value":50427,"nodeType":865},{},[],{"data":52358,"content":52359,"nodeType":1818},{},[52360,52376],{"data":52361,"content":52362,"nodeType":1734},{},[52363],{"data":52364,"content":52365,"nodeType":881},{},[52366,52369,52373],{"data":52367,"marks":52368,"value":50440,"nodeType":865},{},[],{"data":52370,"marks":52371,"value":49028,"nodeType":865},{},[52372],{"type":874},{"data":52374,"marks":52375,"value":50448,"nodeType":865},{},[],{"data":52377,"content":52378,"nodeType":1734},{},[52379],{"data":52380,"content":52381,"nodeType":881},{},[52382,52385,52389],{"data":52383,"marks":52384,"value":50458,"nodeType":865},{},[],{"data":52386,"marks":52387,"value":50463,"nodeType":865},{},[52388],{"type":874},{"data":52390,"marks":52391,"value":50467,"nodeType":865},{},[],{"data":52393,"content":52394,"nodeType":881},{},[52395],{"data":52396,"marks":52397,"value":50474,"nodeType":865},{},[],{"data":52399,"content":52400,"nodeType":894},{},[],{"data":52402,"content":52403,"nodeType":1860},{},[52404],{"data":52405,"marks":52406,"value":50484,"nodeType":865},{},[],{"data":52408,"content":52409,"nodeType":881},{},[52410,52413,52420,52423,52427,52430,52434],{"data":52411,"marks":52412,"value":50491,"nodeType":865},{},[],{"data":52414,"content":52415,"nodeType":876},{"uri":50494},[52416],{"data":52417,"marks":52418,"value":50500,"nodeType":865},{},[52419],{"type":874},{"data":52421,"marks":52422,"value":50504,"nodeType":865},{},[],{"data":52424,"marks":52425,"value":50509,"nodeType":865},{},[52426],{"type":902},{"data":52428,"marks":52429,"value":2091,"nodeType":865},{},[],{"data":52431,"marks":52432,"value":50517,"nodeType":865},{},[52433],{"type":902},{"data":52435,"marks":52436,"value":1032,"nodeType":865},{},[],{"data":52438,"content":52441,"nodeType":890},{"target":52439},{"sys":52440},{"id":50525,"type":887,"linkType":888},[],{"data":52443,"content":52444,"nodeType":881},{},[52445],{"data":52446,"marks":52447,"value":50533,"nodeType":865},{},[],{"data":52449,"content":52450,"nodeType":881},{},[52451],{"data":52452,"marks":52453,"value":50540,"nodeType":865},{},[],{"data":52455,"content":52456,"nodeType":894},{},[],{"data":52458,"content":52459,"nodeType":904},{},[52460],{"data":52461,"marks":52462,"value":50551,"nodeType":865},{},[52463],{"type":902},{"data":52465,"content":52466,"nodeType":881},{},[52467],{"data":52468,"marks":52469,"value":50558,"nodeType":865},{},[],{"data":52471,"content":52472,"nodeType":1818},{},[52473,52482,52491],{"data":52474,"content":52475,"nodeType":1734},{},[52476],{"data":52477,"content":52478,"nodeType":881},{},[52479],{"data":52480,"marks":52481,"value":50571,"nodeType":865},{},[],{"data":52483,"content":52484,"nodeType":1734},{},[52485],{"data":52486,"content":52487,"nodeType":881},{},[52488],{"data":52489,"marks":52490,"value":50581,"nodeType":865},{},[],{"data":52492,"content":52493,"nodeType":1734},{},[52494],{"data":52495,"content":52496,"nodeType":881},{},[52497],{"data":52498,"marks":52499,"value":50591,"nodeType":865},{},[],{"data":52501,"content":52504,"nodeType":890},{"target":52502},{"sys":52503},{"id":50596,"type":887,"linkType":888},[],{"data":52506,"content":52507,"nodeType":881},{},[52508],{"data":52509,"marks":52510,"value":50604,"nodeType":865},{},[],{"data":52512,"content":52513,"nodeType":894},{},[],{"data":52515,"content":52516,"nodeType":1860},{},[52517],{"data":52518,"marks":52519,"value":50615,"nodeType":865},{},[52520],{"type":902},{"data":52522,"content":52523,"nodeType":881},{},[52524,52527,52534],{"data":52525,"marks":52526,"value":50622,"nodeType":865},{},[],{"data":52528,"content":52529,"nodeType":876},{"uri":50625},[52530],{"data":52531,"marks":52532,"value":50631,"nodeType":865},{},[52533],{"type":874},{"data":52535,"marks":52536,"value":50635,"nodeType":865},{},[],{"data":52538,"content":52539,"nodeType":881},{},[52540],{"data":52541,"marks":52542,"value":50642,"nodeType":865},{},[],{"data":52544,"content":52545,"nodeType":881},{},[52546],{"data":52547,"marks":52548,"value":50649,"nodeType":865},{},[],{"data":52550,"content":52551,"nodeType":881},{},[52552,52555,52562],{"data":52553,"marks":52554,"value":50656,"nodeType":865},{},[],{"data":52556,"content":52557,"nodeType":876},{"uri":39701},[52558],{"data":52559,"marks":52560,"value":50664,"nodeType":865},{},[52561],{"type":874},{"data":52563,"marks":52564,"value":2862,"nodeType":865},{},[],{"data":52566,"content":52567,"nodeType":894},{},[],{"data":52569,"content":52570,"nodeType":1860},{},[52571],{"data":52572,"marks":52573,"value":50678,"nodeType":865},{},[52574],{"type":902},{"data":52576,"content":52577,"nodeType":881},{},[52578,52581,52588],{"data":52579,"marks":52580,"value":50685,"nodeType":865},{},[],{"data":52582,"content":52583,"nodeType":876},{"uri":50688},[52584],{"data":52585,"marks":52586,"value":50694,"nodeType":865},{},[52587],{"type":874},{"data":52589,"marks":52590,"value":50698,"nodeType":865},{},[],{"data":52592,"content":52593,"nodeType":881},{},[52594],{"data":52595,"marks":52596,"value":50705,"nodeType":865},{},[],{"data":52598,"content":52599,"nodeType":881},{},[52600,52603,52607],{"data":52601,"marks":52602,"value":50712,"nodeType":865},{},[],{"data":52604,"marks":52605,"value":50717,"nodeType":865},{},[52606],{"type":902},{"data":52608,"marks":52609,"value":50721,"nodeType":865},{},[],{"data":52611,"content":52612,"nodeType":970},{},[52613],{"data":52614,"content":52615,"nodeType":881},{},[52616,52620],{"data":52617,"marks":52618,"value":50732,"nodeType":865},{},[52619],{"type":902},{"data":52621,"marks":52622,"value":50736,"nodeType":865},{},[],{"data":52624,"content":52625,"nodeType":894},{},[],{"data":52627,"content":52628,"nodeType":1860},{},[52629],{"data":52630,"marks":52631,"value":50747,"nodeType":865},{},[52632],{"type":902},{"data":52634,"content":52635,"nodeType":881},{},[52636,52639,52646],{"data":52637,"marks":52638,"value":50754,"nodeType":865},{},[],{"data":52640,"content":52641,"nodeType":876},{"uri":47938},[52642],{"data":52643,"marks":52644,"value":50762,"nodeType":865},{},[52645],{"type":874},{"data":52647,"marks":52648,"value":50766,"nodeType":865},{},[],{"data":52650,"content":52651,"nodeType":881},{},[52652],{"data":52653,"marks":52654,"value":50773,"nodeType":865},{},[],{"data":52656,"content":52657,"nodeType":881},{},[52658],{"data":52659,"marks":52660,"value":50780,"nodeType":865},{},[],{"data":52662,"content":52663,"nodeType":1818},{},[52664,52673,52682,52691,52700,52709,52718,52727,52736],{"data":52665,"content":52666,"nodeType":1734},{},[52667],{"data":52668,"content":52669,"nodeType":881},{},[52670],{"data":52671,"marks":52672,"value":50793,"nodeType":865},{},[],{"data":52674,"content":52675,"nodeType":1734},{},[52676],{"data":52677,"content":52678,"nodeType":881},{},[52679],{"data":52680,"marks":52681,"value":50803,"nodeType":865},{},[],{"data":52683,"content":52684,"nodeType":1734},{},[52685],{"data":52686,"content":52687,"nodeType":881},{},[52688],{"data":52689,"marks":52690,"value":50813,"nodeType":865},{},[],{"data":52692,"content":52693,"nodeType":1734},{},[52694],{"data":52695,"content":52696,"nodeType":881},{},[52697],{"data":52698,"marks":52699,"value":50823,"nodeType":865},{},[],{"data":52701,"content":52702,"nodeType":1734},{},[52703],{"data":52704,"content":52705,"nodeType":881},{},[52706],{"data":52707,"marks":52708,"value":50833,"nodeType":865},{},[],{"data":52710,"content":52711,"nodeType":1734},{},[52712],{"data":52713,"content":52714,"nodeType":881},{},[52715],{"data":52716,"marks":52717,"value":50843,"nodeType":865},{},[],{"data":52719,"content":52720,"nodeType":1734},{},[52721],{"data":52722,"content":52723,"nodeType":881},{},[52724],{"data":52725,"marks":52726,"value":50853,"nodeType":865},{},[],{"data":52728,"content":52729,"nodeType":1734},{},[52730],{"data":52731,"content":52732,"nodeType":881},{},[52733],{"data":52734,"marks":52735,"value":50863,"nodeType":865},{},[],{"data":52737,"content":52738,"nodeType":1734},{},[52739],{"data":52740,"content":52741,"nodeType":881},{},[52742],{"data":52743,"marks":52744,"value":50873,"nodeType":865},{},[],{"data":52746,"content":52747,"nodeType":881},{},[52748],{"data":52749,"marks":52750,"value":50880,"nodeType":865},{},[],{"data":52752,"content":52755,"nodeType":890},{"target":52753},{"sys":52754},{"id":43611,"type":887,"linkType":888},[],{"data":52757,"content":52758,"nodeType":881},{},[52759],{"data":52760,"marks":52761,"value":50892,"nodeType":865},{},[],{"data":52763,"content":52764,"nodeType":881},{},[52765],{"data":52766,"marks":52767,"value":50899,"nodeType":865},{},[],{"data":52769,"content":52770,"nodeType":1818},{},[52771,52780,52789],{"data":52772,"content":52773,"nodeType":1734},{},[52774],{"data":52775,"content":52776,"nodeType":881},{},[52777],{"data":52778,"marks":52779,"value":50912,"nodeType":865},{},[],{"data":52781,"content":52782,"nodeType":1734},{},[52783],{"data":52784,"content":52785,"nodeType":881},{},[52786],{"data":52787,"marks":52788,"value":50922,"nodeType":865},{},[],{"data":52790,"content":52791,"nodeType":1734},{},[52792],{"data":52793,"content":52794,"nodeType":881},{},[52795],{"data":52796,"marks":52797,"value":50932,"nodeType":865},{},[],{"data":52799,"content":52800,"nodeType":881},{},[52801],{"data":52802,"marks":52803,"value":50939,"nodeType":865},{},[],{"data":52805,"content":52806,"nodeType":894},{},[],{"data":52808,"content":52809,"nodeType":1860},{},[52810],{"data":52811,"marks":52812,"value":50950,"nodeType":865},{},[52813],{"type":902},{"data":52815,"content":52816,"nodeType":881},{},[52817],{"data":52818,"marks":52819,"value":50957,"nodeType":865},{},[],{"data":52821,"content":52822,"nodeType":881},{},[52823],{"data":52824,"marks":52825,"value":50964,"nodeType":865},{},[],{"data":52827,"content":52828,"nodeType":881},{},[52829,52832,52839,52842,52849],{"data":52830,"marks":52831,"value":50971,"nodeType":865},{},[],{"data":52833,"content":52834,"nodeType":876},{"uri":50974},[52835],{"data":52836,"marks":52837,"value":50980,"nodeType":865},{},[52838],{"type":874},{"data":52840,"marks":52841,"value":50984,"nodeType":865},{},[],{"data":52843,"content":52844,"nodeType":876},{"uri":47708},[52845],{"data":52846,"marks":52847,"value":50992,"nodeType":865},{},[52848],{"type":874},{"data":52850,"marks":52851,"value":50996,"nodeType":865},{},[],{"data":52853,"content":52854,"nodeType":881},{},[52855],{"data":52856,"marks":52857,"value":51003,"nodeType":865},{},[],{"data":52859,"content":52860,"nodeType":881},{},[52861],{"data":52862,"marks":52863,"value":51010,"nodeType":865},{},[],{"data":52865,"content":52866,"nodeType":894},{},[],{"data":52868,"content":52869,"nodeType":904},{},[52870],{"data":52871,"marks":52872,"value":51021,"nodeType":865},{},[52873],{"type":902},{"data":52875,"content":52876,"nodeType":881},{},[52877,52880,52887],{"data":52878,"marks":52879,"value":51028,"nodeType":865},{},[],{"data":52881,"content":52882,"nodeType":876},{"uri":5072},[52883],{"data":52884,"marks":52885,"value":51036,"nodeType":865},{},[52886],{"type":874},{"data":52888,"marks":52889,"value":51040,"nodeType":865},{},[],{"data":52891,"content":52892,"nodeType":881},{},[52893],{"data":52894,"marks":52895,"value":51047,"nodeType":865},{},[],{"data":52897,"content":52898,"nodeType":881},{},[52899],{"data":52900,"marks":52901,"value":51054,"nodeType":865},{},[],{"data":52903,"content":52904,"nodeType":1818},{},[52905,52914,52923,52932],{"data":52906,"content":52907,"nodeType":1734},{},[52908],{"data":52909,"content":52910,"nodeType":881},{},[52911],{"data":52912,"marks":52913,"value":51067,"nodeType":865},{},[],{"data":52915,"content":52916,"nodeType":1734},{},[52917],{"data":52918,"content":52919,"nodeType":881},{},[52920],{"data":52921,"marks":52922,"value":51077,"nodeType":865},{},[],{"data":52924,"content":52925,"nodeType":1734},{},[52926],{"data":52927,"content":52928,"nodeType":881},{},[52929],{"data":52930,"marks":52931,"value":51087,"nodeType":865},{},[],{"data":52933,"content":52934,"nodeType":1734},{},[52935],{"data":52936,"content":52937,"nodeType":881},{},[52938],{"data":52939,"marks":52940,"value":51097,"nodeType":865},{},[],{"data":52942,"content":52945,"nodeType":890},{"target":52943},{"sys":52944},{"id":49896,"type":887,"linkType":888},[],{"data":52947,"content":52948,"nodeType":881},{},[52949],{"data":52950,"marks":52951,"value":51109,"nodeType":865},{},[],{"data":52953,"content":52954,"nodeType":881},{},[52955,52958,52964],{"data":52956,"marks":52957,"value":51116,"nodeType":865},{},[],{"data":52959,"content":52960,"nodeType":876},{"uri":34704},[52961],{"data":52962,"marks":52963,"value":51123,"nodeType":865},{},[],{"data":52965,"marks":52966,"value":51127,"nodeType":865},{},[],{"data":52968,"content":52971,"nodeType":890},{"target":52969},{"sys":52970},{"id":49532,"type":887,"linkType":888},[],{"data":52973,"content":52974,"nodeType":881},{},[52975],{"data":52976,"marks":52977,"value":21,"nodeType":865},{},[],{"data":52979,"content":52982,"nodeType":890},{"target":52980},{"sys":52981},{"id":51143,"type":887,"linkType":888},[],{"data":52984,"content":52985,"nodeType":881},{},[52986],{"data":52987,"marks":52988,"value":21,"nodeType":865},{},[],{"entries":52990},{"hyperlink":52991,"inline":52992,"block":52993},[],[],[52994,53001,53006,53011,53018,53021,53024],{"sys":52995,"__typename":7008,"title":52996,"caption":52996,"layoutMode":59,"file":52997},{"id":50375},"Zendesk to Slack attack path (via Apple SSO)",{"url":52998,"width":52999,"height":53000},"https://images.ctfassets.net/y1cdw1ablpvd/4i4h3IKgVEPtLH5Egs8qND/4b0c1c8dea8b4c0a8721cfceb51b925d/image5.png",1535,690,{"sys":53002,"__typename":7008,"title":53003,"caption":53003,"layoutMode":59,"file":53004},{"id":50525},"Google domain verification bypass",{"url":53005,"width":52999,"height":53000},"https://images.ctfassets.net/y1cdw1ablpvd/7EbqwEZZ6Z0J4bSmwAavvI/becb2d959771dfe75f86807779a1a933/image4.png",{"sys":53007,"__typename":7008,"title":53008,"caption":53008,"layoutMode":59,"file":53009},{"id":50596},"Generic cross-IdP impersonation attack path",{"url":53010,"width":52999,"height":53000},"https://images.ctfassets.net/y1cdw1ablpvd/3fPWMDLgVomv5ePNfVRJl1/fb870e9bfef9d402791086c3ce01f8fb/ServiceNow_Attack_Path__2_.png",{"sys":53012,"__typename":7008,"title":53013,"caption":53014,"layoutMode":59,"file":53015},{"id":43611},"Managed vs. unmanaged IdPs","Managed IdPs can be administered centrally by the organization (which owns and operates the IdP and the identities on it), whereas unmanaged ‘social’ IdPs are controlled by the vendor, and identities are owned and administered by the user.",{"url":53016,"width":14732,"height":53017},"https://images.ctfassets.net/y1cdw1ablpvd/6qDjvYcLbUxlC4w24VvDLO/4da66c4e755c9b1c00b285a5ab3f9c57/image1.png",1000,{"sys":53019,"__typename":7008,"title":50242,"caption":50242,"layoutMode":59,"file":53020},{"id":49896},{"url":50244,"width":50245,"height":50246},{"sys":53022,"__typename":50191,"title":50192,"youTubeUrl":50193,"imagePlaceholder":53023},{"id":49532},{"url":50195,"width":47194,"height":24963},{"sys":53025,"__typename":1471,"type":1472,"ctaText":53026,"buttonLabel":50255,"buttonColour":1475,"buttonUrl":34704},{"id":51143},"Learn how cross-IdP impersonation can be combined with verification phishing to bypass locked-down IdP accounts by phishing a single OTP",{"items":53028},[],{},"Cross-IdP impersonation: hijacking SSO using fraudulent IdPs",{"url":53010},{"items":53033},[53034,53554,54390],{"__typename":1485,"sys":53035,"content":53037,"title":53540,"synopsis":53541,"hashTags":59,"publishedDate":53542,"slug":53543,"tagsCollection":53544,"authorsCollection":53550},{"id":53036},"3N6eBccHWWc3cZWTZsaJVV",{"json":53038},{"data":53039,"content":53040,"nodeType":1463},{},[53041,53070,53090,53097,53104,53107,53115,53122,53147,53154,53160,53167,53174,53207,53210,53218,53225,53245,53248,53256,53263,53270,53276,53294,53297,53305,53322,53329,53336,53356,53359,53366,53373,53380,53387,53390,53398,53405,53425,53432,53439,53446,53453,53460,53463,53471,53478,53521],{"data":53042,"content":53043,"nodeType":881},{},[53044,53048,53055,53059,53066],{"data":53045,"marks":53046,"value":53047,"nodeType":865},{},[],"We’ve been shouting about the risk posed by account takeover attacks on third party apps since we first released the ",{"data":53049,"content":53050,"nodeType":876},{"uri":5192},[53051],{"data":53052,"marks":53053,"value":4540,"nodeType":865},{},[53054],{"type":874},{"data":53056,"marks":53057,"value":53058,"nodeType":865},{},[]," in early 2023. 18 months later (and with some encouragement from the success of the ",{"data":53060,"content":53061,"nodeType":876},{"uri":5072},[53062],{"data":53063,"marks":53064,"value":43989,"nodeType":865},{},[53065],{"type":874},{"data":53067,"marks":53068,"value":53069,"nodeType":865},{},[],") it feels like the security community has woken up to the risk — and attackers likewise have sensed the opportunity. ",{"data":53071,"content":53072,"nodeType":881},{},[53073,53077,53086],{"data":53074,"marks":53075,"value":53076,"nodeType":865},{},[],"Last week, it emerged that ",{"data":53078,"content":53080,"nodeType":876},{"uri":53079},"https://medium.com/@moblig/how-i-accessed-microsofts-servicenow-exposing-all-microsoft-employee-emails-chat-support-5f8d535eb63b",[53081],{"data":53082,"marks":53083,"value":53085,"nodeType":865},{},[53084],{"type":874},"bug bounty hunters were able to use stolen credentials from a TI platform to Microsoft’s ServiceNow tenant",{"data":53087,"marks":53088,"value":53089,"nodeType":865},{},[],", accessing 1,000s of support ticket descriptions and attachments, and 250k+ employee emails. ",{"data":53091,"content":53092,"nodeType":881},{},[53093],{"data":53094,"marks":53095,"value":53096,"nodeType":865},{},[],"But this isn’t specifically a Microsoft problem. The researcher could have picked from a long list of potential targets. If even Microsoft with their vast security resources can be caught off guard by this, what chance do other organizations have? If anything, it illustrates the scale of the challenge facing organizations when it comes to securing their identity surface. ",{"data":53098,"content":53099,"nodeType":881},{},[53100],{"data":53101,"marks":53102,"value":53103,"nodeType":865},{},[],"Let’s take a closer look at what we can learn from this attack — and what it tells us about the direction that identity attacks are (rapidly) heading in. ",{"data":53105,"content":53106,"nodeType":894},{},[],{"data":53108,"content":53109,"nodeType":904},{},[53110],{"data":53111,"marks":53112,"value":53114,"nodeType":865},{},[53113],{"type":902},"Taking over ServiceNow accounts through credential stuffing (via infostealers)",{"data":53116,"content":53117,"nodeType":881},{},[53118],{"data":53119,"marks":53120,"value":53121,"nodeType":865},{},[],"A bug bounty hunter was able to compromise Microsoft’s ServiceNow account using stolen credentials from historical infostealer infections, found using a commercial TI feed. ",{"data":53123,"content":53124,"nodeType":881},{},[53125,53129,53134,53138,53143],{"data":53126,"marks":53127,"value":53128,"nodeType":865},{},[],"The researcher was able to enumerate a login page for Microsoft at ",{"data":53130,"marks":53131,"value":53133,"nodeType":865},{},[53132],{"type":874},"microsoft.servicenow.com/login.do",{"data":53135,"marks":53136,"value":53137,"nodeType":865},{},[],", with the /login.do meaning that ",{"data":53139,"marks":53140,"value":53142,"nodeType":865},{},[53141],{"type":902},"SSO was enabled but not enforced",{"data":53144,"marks":53145,"value":53146,"nodeType":865},{},[],". At this point, the attacker was able to authenticate using the stolen credentials only (as the target account lacked MFA).",{"data":53148,"content":53149,"nodeType":881},{},[53150],{"data":53151,"marks":53152,"value":53153,"nodeType":865},{},[],"After logging in they were presented with a blank UI. However, because they now had an authenticated session, they were able to switch to the REST API, and subsequently access two key endpoints through which they were able to collect and exfiltrate sensitive data including 1,000s of support ticket attachments, over 250,000+ employee emails, and an xlsx file with historical ticket submissions to the MSRC team. ",{"data":53155,"content":53159,"nodeType":890},{"target":53156},{"sys":53157},{"id":53158,"type":887,"linkType":888},"1Q2cL7mJhQUx1it0tU3MhJ",[],{"data":53161,"content":53162,"nodeType":881},{},[53163],{"data":53164,"marks":53165,"value":53166,"nodeType":865},{},[],"Naturally, at this point the researcher ended their attack and sought out a bounty for their efforts. ",{"data":53168,"content":53169,"nodeType":881},{},[53170],{"data":53171,"marks":53172,"value":53173,"nodeType":865},{},[],"But a real attacker wouldn’t have stopped there. Immediately, you’d be thinking:",{"data":53175,"content":53176,"nodeType":1818},{},[53177,53187,53197],{"data":53178,"content":53179,"nodeType":1734},{},[53180],{"data":53181,"content":53182,"nodeType":881},{},[53183],{"data":53184,"marks":53185,"value":53186,"nodeType":865},{},[],"How many other organizations are likely impacted by this issue? Are there other credentials that correspond with these exposed login pages available online? ",{"data":53188,"content":53189,"nodeType":1734},{},[53190],{"data":53191,"content":53192,"nodeType":881},{},[53193],{"data":53194,"marks":53195,"value":53196,"nodeType":865},{},[],"Are there any ways that I could turn this access into a privileged account takeover? Would I be able to access even more information that way? ",{"data":53198,"content":53199,"nodeType":1734},{},[53200],{"data":53201,"content":53202,"nodeType":881},{},[53203],{"data":53204,"marks":53205,"value":53206,"nodeType":865},{},[],"How could this data be used to conduct further attacks? Would other criminal groups pay me for this information if I don’t want to do this myself? ",{"data":53208,"content":53209,"nodeType":894},{},[],{"data":53211,"content":53212,"nodeType":904},{},[53213],{"data":53214,"marks":53215,"value":53217,"nodeType":865},{},[53216],{"type":902},"This isn’t just a Microsoft problem",{"data":53219,"content":53220,"nodeType":881},{},[53221],{"data":53222,"marks":53223,"value":53224,"nodeType":865},{},[],"It seems unlikely that only Microsoft is affected here. Other ServiceNow tenants could have been taken over using the same approach. Other company credentials could be (will be) available online.",{"data":53226,"content":53227,"nodeType":881},{},[53228,53232,53241],{"data":53229,"marks":53230,"value":53231,"nodeType":865},{},[],"Using straightforward ",{"data":53233,"content":53235,"nodeType":876},{"uri":53234},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/subdomain_tenant_discovery/description.md",[53236],{"data":53237,"marks":53238,"value":53240,"nodeType":865},{},[53239],{"type":874},"tenant enumeration techniques",{"data":53242,"marks":53243,"value":53244,"nodeType":865},{},[]," and the list of ServiceNow named customers, it’s very easy to identify different customer tenants. And spending a few minutes using the same credential feed as the researcher, I found multiple organizations with many more breached credentials available linked to the same login.do page. ",{"data":53246,"content":53247,"nodeType":894},{},[],{"data":53249,"content":53250,"nodeType":904},{},[53251],{"data":53252,"marks":53253,"value":53255,"nodeType":865},{},[53254],{"type":902},"Similarities with Snowflake",{"data":53257,"content":53258,"nodeType":881},{},[53259],{"data":53260,"marks":53261,"value":53262,"nodeType":865},{},[],"There are no prizes for connecting this attack path with the infamous attacks on Snowflake customers earlier this year, which resulted in 165+ victims, and hundreds of millions of breached customer records. ",{"data":53264,"content":53265,"nodeType":881},{},[53266],{"data":53267,"marks":53268,"value":53269,"nodeType":865},{},[],"The Snowflake attack path was startlingly similar, and gives us a feel for what this attack could have turned into if conducted by a real attacker. ",{"data":53271,"content":53275,"nodeType":890},{"target":53272},{"sys":53273},{"id":53274,"type":887,"linkType":888},"2J92gFLs1wAAGC4nQTaiWu",[],{"data":53277,"content":53278,"nodeType":881},{},[53279,53283,53291],{"data":53280,"marks":53281,"value":53282,"nodeType":865},{},[],"Both attacks began with stolen credentials breached in historical infostealer infections. In Snowflake’s case, 80% of the credentials used were connected to infostealer infections dating back to 2020, ",{"data":53284,"content":53285,"nodeType":876},{"uri":5817},[53286],{"data":53287,"marks":53288,"value":53290,"nodeType":865},{},[53289],{"type":874},"according to Mandiant",{"data":53292,"marks":53293,"value":1032,"nodeType":865},{},[],{"data":53295,"content":53296,"nodeType":894},{},[],{"data":53298,"content":53299,"nodeType":904},{},[53300],{"data":53301,"marks":53302,"value":53304,"nodeType":865},{},[53303],{"type":902},"Ghost logins strike again",{"data":53306,"content":53307,"nodeType":881},{},[53308,53311,53318],{"data":53309,"marks":53310,"value":21,"nodeType":865},{},[],{"data":53312,"content":53313,"nodeType":876},{"uri":16924},[53314],{"data":53315,"marks":53316,"value":395,"nodeType":865},{},[53317],{"type":874},{"data":53319,"marks":53320,"value":53321,"nodeType":865},{},[]," are one of the leading factors in successful credential stuffing attacks. Simply put, ghost logins are often-forgotten local logins that are tricky for security teams to manage and secure.  ",{"data":53323,"content":53324,"nodeType":881},{},[53325],{"data":53326,"marks":53327,"value":53328,"nodeType":865},{},[],"Ghost logins are a problem for security teams because they often lack best practice security configurations, with things like weak, previously breached, and reused passwords — and no MFA. ",{"data":53330,"content":53331,"nodeType":881},{},[53332],{"data":53333,"marks":53334,"value":53335,"nodeType":865},{},[],"Many organizations think that by migrating an app to use SSO, where they’ve enforced MFA at the IdP level, it’s job done. However, this usually doesn’t eliminate previously created local accounts, meaning they need to be manually unset. But because organizations often lack app-level visibility of account configuration and login methods (it’s simply not provided by most app vendors) these accounts can fly under the radar for extended periods — often until situations like this when they are compromised. ",{"data":53337,"content":53338,"nodeType":881},{},[53339,53343,53352],{"data":53340,"marks":53341,"value":53342,"nodeType":865},{},[],"Ghost logins were a particular problem in the Snowflake attacks because MFA could not be globally enforced at the time of the incident. This meant that local accounts would need to be manually unset using the SQL interface — which unhelpfully ",{"data":53344,"content":53346,"nodeType":876},{"uri":53345},"https://pushsecurity.com/resources/video/demonstrating-ghost-logins-in-snowflake-and-how-to-remediate-them/",[53347],{"data":53348,"marks":53349,"value":53351,"nodeType":865},{},[53350],{"type":874},"provided inaccurate information about the account status and took extended periods of time to update",{"data":53353,"marks":53354,"value":53355,"nodeType":865},{},[]," after a change had been made, creating uncertainty and confusion for responders. But this is just one example of many illustrating how difficult in-app identity management can be. ",{"data":53357,"content":53358,"nodeType":894},{},[],{"data":53360,"content":53361,"nodeType":904},{},[53362],{"data":53363,"marks":53364,"value":45680,"nodeType":865},{},[53365],{"type":902},{"data":53367,"content":53368,"nodeType":881},{},[53369],{"data":53370,"marks":53371,"value":53372,"nodeType":865},{},[],"If we hadn’t realized it yet, attacks targeting third-party business apps are everywhere. It’s not just the flavor of the month — it’s here to stay. ",{"data":53374,"content":53375,"nodeType":881},{},[53376],{"data":53377,"marks":53378,"value":53379,"nodeType":865},{},[],"This is because it’s so easy for attackers to monetize these compromises. Log into app > dump data > profit. ",{"data":53381,"content":53382,"nodeType":881},{},[53383],{"data":53384,"marks":53385,"value":53386,"nodeType":865},{},[],"And the easiest way to achieve this isn’t through complex software exploits, it’s through identity attacks. In the ServiceNow case, using public information (that was available to the security team too) to log into an app. It’s too easy.",{"data":53388,"content":53389,"nodeType":894},{},[],{"data":53391,"content":53392,"nodeType":904},{},[53393],{"data":53394,"marks":53395,"value":53397,"nodeType":865},{},[53396],{"type":902},"Identity attacks are misunderstood",{"data":53399,"content":53400,"nodeType":881},{},[53401],{"data":53402,"marks":53403,"value":53404,"nodeType":865},{},[],"The researcher notes that, despite the severity of the bug, it wasn’t paid out under the MSRC bug bounty scheme. And while this is perhaps not a classic software exploit, you can’t argue about the risk it poses. This is just as impactful as any classic vulnerability, if not more so — because the technical barrier to entry is so much lower. ",{"data":53406,"content":53407,"nodeType":881},{},[53408,53412,53421],{"data":53409,"marks":53410,"value":53411,"nodeType":865},{},[],"Pat Gray of the Risky Biz podcast ",{"data":53413,"content":53415,"nodeType":876},{"uri":53414},"https://risky.biz/RB766/",[53416],{"data":53417,"marks":53418,"value":53420,"nodeType":865},{},[53419],{"type":874},"said of another recent disclosure",{"data":53422,"marks":53423,"value":53424,"nodeType":865},{},[],", where a 15 year-old researcher was able to turn a Zendesk ‘feature’ into hijacking Apple SSO to log into downstream SaaS, that there’s a lack of imagination in understanding how these third-party apps can be abused by an attacker. I’d tend to agree here.",{"data":53426,"content":53427,"nodeType":881},{},[53428],{"data":53429,"marks":53430,"value":53431,"nodeType":865},{},[],"Part of the challenge here is perhaps a lack of awareness of just how severe these issues are. Certainly in the Zendesk case, the initial disclosure (email spoofing) was thrown out, but when it was demonstrated that it could be used to take over downstream apps like Slack, affected companies were happy to pay up, and Zendesk (via HackerOne) got back in touch. ",{"data":53433,"content":53434,"nodeType":881},{},[53435],{"data":53436,"marks":53437,"value":53438,"nodeType":865},{},[],"If I were the researcher, I would have considered reporting this issue to ServiceNow too, not just Microsoft — as it undoubtedly affects many organizations. Yes, the fact that Microsoft credentials were accessible online is a Microsoft problem, but given the potential spread of organizations also susceptible to this attack, does the vendor not have a responsibility to help mitigate these attacks? I would hope that ServiceNow have contacted their customers to be cautious of experiencing an increase in credential stuffing attacks in the near future at the very least. ",{"data":53440,"content":53441,"nodeType":881},{},[53442],{"data":53443,"marks":53444,"value":53445,"nodeType":865},{},[],"There’s clearly a need for better security-by-default from SaaS vendors — things like mandatory MFA enforcement would be a good start. Because there are simply too many apps, and too many accounts to manage — and no effective centralized way of managing them across your SaaS inventory. ",{"data":53447,"content":53448,"nodeType":881},{},[53449],{"data":53450,"marks":53451,"value":53452,"nodeType":865},{},[],"It makes you wonder how many other apps are impacted by ‘on by default’ configurations that can be abused in ways we just don’t know about yet. Partly because nobody is really looking — bug bounties aren’t being paid out, and I know of only a handful of forward-thinking security consultancies conducting any real offensive security testing with their clients in this space. ",{"data":53454,"content":53455,"nodeType":881},{},[53456],{"data":53457,"marks":53458,"value":53459,"nodeType":865},{},[],"We are also reminded, again and again, that credential stuffing attacks are as effective as ever. Despite the investment in SSO, MFA, and all of the identity management and hygiene tools that organizations have nowadays, attackers and researchers keep finding gaps.  ",{"data":53461,"content":53462,"nodeType":894},{},[],{"data":53464,"content":53465,"nodeType":904},{},[53466],{"data":53467,"marks":53468,"value":53470,"nodeType":865},{},[53469],{"type":902},"What can you do about it? ",{"data":53472,"content":53473,"nodeType":881},{},[53474],{"data":53475,"marks":53476,"value":53477,"nodeType":865},{},[],"The most important step is to acknowledge the severity of the threat — and the ways that expected controls are failing.",{"data":53479,"content":53480,"nodeType":1818},{},[53481,53491,53501,53511],{"data":53482,"content":53483,"nodeType":1734},{},[53484],{"data":53485,"content":53486,"nodeType":881},{},[53487],{"data":53488,"marks":53489,"value":53490,"nodeType":865},{},[],"There will almost always be gaps in any organization’s identity security perimeter, simply because it’s almost impossible to have the required visibility — even if you’re Microsoft with your vast security resources.",{"data":53492,"content":53493,"nodeType":1734},{},[53494],{"data":53495,"content":53496,"nodeType":881},{},[53497],{"data":53498,"marks":53499,"value":53500,"nodeType":865},{},[],"There will always be ways to abuse app features and configurations, and we’ve barely begun to scratch the surface of what’s now possible in the world of connected SaaS.",{"data":53502,"content":53503,"nodeType":1734},{},[53504],{"data":53505,"content":53506,"nodeType":881},{},[53507],{"data":53508,"marks":53509,"value":53510,"nodeType":865},{},[],"These attacks are very difficult to intercept once an attacker is active inside an app, because there’s very little meaningful visibility. ",{"data":53512,"content":53513,"nodeType":1734},{},[53514],{"data":53515,"content":53516,"nodeType":881},{},[53517],{"data":53518,"marks":53519,"value":53520,"nodeType":865},{},[],"Once they’re inside, the attack can be over incredibly quickly, and can be repeated across app tenants for maximum impact (again, just look at Snowflake). ",{"data":53522,"content":53523,"nodeType":881},{},[53524,53528,53536],{"data":53525,"marks":53526,"value":53527,"nodeType":865},{},[],"At Push, we’re focused primarily on detecting and intercepting account takeover for these reasons — it’s your earliest opportunity, and for many attacks it’s also your last. If you want to learn more, ",{"data":53529,"content":53530,"nodeType":876},{"uri":31056},[53531],{"data":53532,"marks":53533,"value":53535,"nodeType":865},{},[53534],{"type":874},"check out our recent design philosophy blog",{"data":53537,"marks":53538,"value":53539,"nodeType":865},{},[]," discussing why we’re shifting detection left to focus on account takeover.  ","What we can learn from the recent ServiceNow/Microsoft disclosure","Account takeover on third-party apps is the flavor of the month for security researchers — what can we learn from it? ","2024-11-01T00:00:00.000Z","learning-from-the-servicenow-disclosure",{"items":53545},[53546,53548],{"sys":53547,"name":4507},{"id":4506},{"sys":53549,"name":297},{"id":6385},{"items":53551},[53552],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":53553},{"url":5377},{"__typename":1485,"sys":53555,"content":53557,"title":54376,"synopsis":54377,"hashTags":59,"publishedDate":54378,"slug":54379,"tagsCollection":54380,"authorsCollection":54386},{"id":53556},"174u87EYeKMKHzYYxBLlHO",{"json":53558},{"data":53559,"content":53560,"nodeType":1463},{},[53561,53568,53575,53582,53612,53619,53626,53643,53650,53657,53675,53682,53689,53696,53702,53709,53752,53759,53766,53773,53796,53803,53810,53817,53865,53872,53879,53886,53893,53905,53912,53920,53927,53960,53967,53974,53981,53988,54053,54061,54068,54075,54109,54116,54124,54131,54138,54150,54166,54195,54213,54220,54237,54244,54251,54268,54275,54282,54289,54322,54329,54347,54364,54370],{"data":53562,"content":53563,"nodeType":881},{},[53564],{"data":53565,"marks":53566,"value":53567,"nodeType":865},{},[],"Identity attacks like phishing, credential stuffing, and session hijacking are now the leading cause of cyber security breaches, as attackers shift their attention to the sprawl of third-party applications and services that has become the backbone of business IT. ",{"data":53569,"content":53570,"nodeType":881},{},[53571],{"data":53572,"marks":53573,"value":53574,"nodeType":865},{},[],"The attacker’s goal in these attacks is account takeover: logging into a user account to access your company app tenant. From there, the attacker can usually achieve all of their objectives from inside the compromised app, usually involving dumping sensitive data with which to hold the company to ransom, or selling the data on underground criminal marketplaces. ",{"data":53576,"content":53577,"nodeType":881},{},[53578],{"data":53579,"marks":53580,"value":53581,"nodeType":865},{},[],"These attack techniques have been commonplace for over a decade — but the shift in attack context away from attacking endpoints (user devices and servers) to cloud services is seeing something of an identity attack renaissance. ",{"data":53583,"content":53584,"nodeType":881},{},[53585,53588,53595,53599,53608],{"data":53586,"marks":53587,"value":21,"nodeType":865},{},[],{"data":53589,"content":53590,"nodeType":876},{"uri":11116},[53591],{"data":53592,"marks":53593,"value":395,"nodeType":865},{},[53594],{"type":874},{"data":53596,"marks":53597,"value":53598,"nodeType":865},{},[]," are one of the leading factors in successful ",{"data":53600,"content":53602,"nodeType":876},{"uri":53601},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/credential_stuffing/description.md",[53603],{"data":53604,"marks":53605,"value":53607,"nodeType":865},{},[53606],{"type":874},"credential stuffing",{"data":53609,"marks":53610,"value":53611,"nodeType":865},{},[]," attacks driving account takeover.",{"data":53613,"content":53614,"nodeType":904},{},[53615],{"data":53616,"marks":53617,"value":53618,"nodeType":865},{},[],"Ghost logins 101",{"data":53620,"content":53621,"nodeType":881},{},[53622],{"data":53623,"marks":53624,"value":53625,"nodeType":865},{},[],"Simply put, ghost logins are often-forgotten alternative login methods that are tricky for security teams to manage and secure — because they don’t know about them. Because of this, they’re likely to possess weak configurations that make them susceptible to account takeover attacks. ",{"data":53627,"content":53628,"nodeType":881},{},[53629,53633,53640],{"data":53630,"marks":53631,"value":53632,"nodeType":865},{},[],"We found that ",{"data":53634,"content":53635,"nodeType":876},{"uri":30250},[53636],{"data":53637,"marks":53638,"value":53639,"nodeType":865},{},[],"ghost logins are present in ~10% of the accounts per organization",{"data":53641,"marks":53642,"value":14775,"nodeType":865},{},[],{"data":53644,"content":53645,"nodeType":1860},{},[53646],{"data":53647,"marks":53648,"value":53649,"nodeType":865},{},[],"Why do ghost logins exist?",{"data":53651,"content":53652,"nodeType":881},{},[53653],{"data":53654,"marks":53655,"value":53656,"nodeType":865},{},[],"Identity management used to be something that was centrally contained and managed using an enterprise identity service like Active Directory. Most users probably only had one or two identities that you really cared about: the one they used to log into their company laptop and domain, and maybe also to log into a VPN. ",{"data":53658,"content":53659,"nodeType":881},{},[53660,53664,53671],{"data":53661,"marks":53662,"value":53663,"nodeType":865},{},[],"Now, there are ",{"data":53665,"content":53666,"nodeType":876},{"uri":30250},[53667],{"data":53668,"marks":53669,"value":53670,"nodeType":865},{},[],"200+ business apps in use per company, creating 1000s of sprawled identities",{"data":53672,"marks":53673,"value":53674,"nodeType":865},{},[]," across an ecosystem of business apps and services accessed over the internet.",{"data":53676,"content":53677,"nodeType":881},{},[53678],{"data":53679,"marks":53680,"value":53681,"nodeType":865},{},[],"Most businesses have tried to solve this problem with single sign on (SSO). The logic being that if you can use a single set of credentials (and therefore, a single identity) to access all of your business apps, and then secure those credentials with MFA, then this problem goes away. However…",{"data":53683,"content":53684,"nodeType":1860},{},[53685],{"data":53686,"marks":53687,"value":53688,"nodeType":865},{},[],"SSO expectations versus reality",{"data":53690,"content":53691,"nodeType":881},{},[53692],{"data":53693,"marks":53694,"value":53695,"nodeType":865},{},[],"Unfortunately, the reality of SSO implementation is flawed. Most apps accept multiple login methods that can be configured — and used — simultaneously (yes, most apps don’t have proper session controls).  ",{"data":53697,"content":53701,"nodeType":890},{"target":53698},{"sys":53699},{"id":53700,"type":887,"linkType":888},"3sOz3HkiyJpY9nFtGCWEOV",[],{"data":53703,"content":53704,"nodeType":881},{},[53705],{"data":53706,"marks":53707,"value":53708,"nodeType":865},{},[],"This is made worse by the fact that:",{"data":53710,"content":53711,"nodeType":1818},{},[53712,53722,53732,53742],{"data":53713,"content":53714,"nodeType":1734},{},[53715],{"data":53716,"content":53717,"nodeType":881},{},[53718],{"data":53719,"marks":53720,"value":53721,"nodeType":865},{},[],"Most apps can't be locked down to restrict which login methods are accepted.",{"data":53723,"content":53724,"nodeType":1734},{},[53725],{"data":53726,"content":53727,"nodeType":881},{},[53728],{"data":53729,"marks":53730,"value":53731,"nodeType":865},{},[],"Users often self-adopt apps, and default to a username and password (and typically miss out MFA). ",{"data":53733,"content":53734,"nodeType":1734},{},[53735],{"data":53736,"content":53737,"nodeType":881},{},[53738],{"data":53739,"marks":53740,"value":53741,"nodeType":865},{},[],"SSO isn’t always possible if you aren’t using a supported IdP — and only one in three apps support SAML, the preferred enterprise-grade protocol.",{"data":53743,"content":53744,"nodeType":1734},{},[53745],{"data":53746,"content":53747,"nodeType":881},{},[53748],{"data":53749,"marks":53750,"value":53751,"nodeType":865},{},[],"Even where SSO is possible, configuring an app for SSO doesn't automatically delete any legacy local logins.",{"data":53753,"content":53754,"nodeType":881},{},[53755],{"data":53756,"marks":53757,"value":53758,"nodeType":865},{},[],"Inevitably, this means that there are many situations in which users will create local accounts — typically with a username and password, and without MFA. This is how ghost logins are born.",{"data":53760,"content":53761,"nodeType":1860},{},[53762],{"data":53763,"marks":53764,"value":53765,"nodeType":865},{},[],"How are ghost logins created? ",{"data":53767,"content":53768,"nodeType":881},{},[53769],{"data":53770,"marks":53771,"value":53772,"nodeType":865},{},[],"Ghost logins can be created in the following ways:",{"data":53774,"content":53775,"nodeType":1818},{},[53776,53786],{"data":53777,"content":53778,"nodeType":1734},{},[53779],{"data":53780,"content":53781,"nodeType":881},{},[53782],{"data":53783,"marks":53784,"value":53785,"nodeType":865},{},[],"A user self-adopts an app, setting up an account with a local username and password. The app is later adopted companywide and brought under SSO. This creates an additional SSO login method, likely as the default, but the local login will continue to exist unless explicitly disabled or deleted. ",{"data":53787,"content":53788,"nodeType":1734},{},[53789],{"data":53790,"content":53791,"nodeType":881},{},[53792],{"data":53793,"marks":53794,"value":53795,"nodeType":865},{},[],"Secondary/backup login methods can often be added later in the app settings after logging in. This includes things like setting up a secondary email to send a login link to, or setting up API access to remove the need to authenticate altogether. ",{"data":53797,"content":53798,"nodeType":881},{},[53799],{"data":53800,"marks":53801,"value":53802,"nodeType":865},{},[],"So, ghost logins are very easily introduced through the normal course of app adoption and use by employees. ",{"data":53804,"content":53805,"nodeType":1860},{},[53806],{"data":53807,"marks":53808,"value":53809,"nodeType":865},{},[],"Why do ghost logins pose a risk? ",{"data":53811,"content":53812,"nodeType":881},{},[53813],{"data":53814,"marks":53815,"value":53816,"nodeType":865},{},[],"Ghost logins pose a risk for a number of reasons, as they: ",{"data":53818,"content":53819,"nodeType":1818},{},[53820,53835,53850],{"data":53821,"content":53822,"nodeType":1734},{},[53823],{"data":53824,"content":53825,"nodeType":881},{},[53826,53831],{"data":53827,"marks":53828,"value":53830,"nodeType":865},{},[53829],{"type":902},"Typically have less secure configurations ",{"data":53832,"marks":53833,"value":53834,"nodeType":865},{},[],"than your preferred login method – and may be missing key controls like MFA.  ",{"data":53836,"content":53837,"nodeType":1734},{},[53838],{"data":53839,"content":53840,"nodeType":881},{},[53841,53846],{"data":53842,"marks":53843,"value":53845,"nodeType":865},{},[53844],{"type":902},"Are effectively shadow logins",{"data":53847,"marks":53848,"value":53849,"nodeType":865},{},[]," – IT/security don’t know about them, and if using an IdP as your primary identity security interface, they won’t necessarily be visible without taking a deeper look at individual apps. ",{"data":53851,"content":53852,"nodeType":1734},{},[53853],{"data":53854,"content":53855,"nodeType":881},{},[53856,53861],{"data":53857,"marks":53858,"value":53860,"nodeType":865},{},[53859],{"type":902},"Can be used simultaneously with SSO",{"data":53862,"marks":53863,"value":53864,"nodeType":865},{},[]," – so you can have an unrestricted number of concurrent sessions with SSO and non SSO logins active at the same time, without the user being kicked out of the previous session.",{"data":53866,"content":53867,"nodeType":881},{},[53868],{"data":53869,"marks":53870,"value":53871,"nodeType":865},{},[],"Ghost logins provide opportunities for attackers to bypass security controls for initial access and persistence in an application (which we’ll come onto in more detail later). They also provide an opportunity for malicious insiders, e.g. a disgruntled employee, to access systems even after SSO access is revoked. If the security team relies on IdP logs to audit app logins, these accounts can go undetected.",{"data":53873,"content":53874,"nodeType":881},{},[53875],{"data":53876,"marks":53877,"value":53878,"nodeType":865},{},[],"To be able to identify them, you’d need to log into the app admin dashboard. But depending on how the app was adopted, you (as a security admin) may not even be an app-level admin — it’s not unusual for individual teams to administer their own apps. And even if you do have access, it’s not always easy (or possible) to gather this level of information about user account configuration. ",{"data":53880,"content":53881,"nodeType":881},{},[53882],{"data":53883,"marks":53884,"value":53885,"nodeType":865},{},[],"It’s very easy to see how these vulnerable login methods can be overlooked by security teams – let’s look at how they can be identified and exploited by attackers. ",{"data":53887,"content":53888,"nodeType":904},{},[53889],{"data":53890,"marks":53891,"value":53892,"nodeType":865},{},[],"How can ghost logins be exploited by attackers?",{"data":53894,"content":53895,"nodeType":881},{},[53896,53901],{"data":53897,"marks":53898,"value":53900,"nodeType":865},{},[53899],{"type":902},"Let’s take an example scenario:",{"data":53902,"marks":53903,"value":53904,"nodeType":865},{},[]," You’re using an IdP solution like Okta or Microsoft/Entra with SAML SSO as the default login method for your core business apps. Via your IdP you require MFA when authenticating to your IdP apps page, and also potentially when signing into an individual connected app. ",{"data":53906,"content":53907,"nodeType":881},{},[53908],{"data":53909,"marks":53910,"value":53911,"nodeType":865},{},[],"However, you only recently introduced your IdP solution, and your users previously accessed this app with a local username and password. Although you asked your users to configure MFA in the app itself, not all of them did. And when you deployed your IdP solution, you didn’t manually unset all the local password-based logins for the apps you connected to it. ",{"data":53913,"content":53914,"nodeType":881},{},[53915],{"data":53916,"marks":53917,"value":53919,"nodeType":865},{},[53918],{"type":902},"Unknown to you, there are now hundreds of local accounts for core business apps which lack MFA. ",{"data":53921,"content":53922,"nodeType":881},{},[53923],{"data":53924,"marks":53925,"value":53926,"nodeType":865},{},[],"There are two main scenarios in which ghost logins can be utilized by an attacker:",{"data":53928,"content":53929,"nodeType":1818},{},[53930,53945],{"data":53931,"content":53932,"nodeType":1734},{},[53933],{"data":53934,"content":53935,"nodeType":881},{},[53936,53941],{"data":53937,"marks":53938,"value":53940,"nodeType":865},{},[53939],{"type":902},"To bypass robustly configured login methods",{"data":53942,"marks":53943,"value":53944,"nodeType":865},{},[]," such as SSO to compromise an app identity during the initial access phase of an attack. ",{"data":53946,"content":53947,"nodeType":1734},{},[53948],{"data":53949,"content":53950,"nodeType":881},{},[53951,53956],{"data":53952,"marks":53953,"value":53955,"nodeType":865},{},[53954],{"type":902},"To create additional login methods for an already compromised account to ensure persistent access",{"data":53957,"marks":53958,"value":53959,"nodeType":865},{},[]," – even if the original compromised login method is revoked or disabled. This could be either the result of compromising an identity belonging to a specific app, or having previously compromised an IdP account (e.g. Okta).",{"data":53961,"content":53962,"nodeType":881},{},[53963],{"data":53964,"marks":53965,"value":53966,"nodeType":865},{},[],"Let's look at these use cases in more detail. ",{"data":53968,"content":53969,"nodeType":1860},{},[53970],{"data":53971,"marks":53972,"value":53973,"nodeType":865},{},[],"Ghost logins for initial access",{"data":53975,"content":53976,"nodeType":881},{},[53977],{"data":53978,"marks":53979,"value":53980,"nodeType":865},{},[],"Arguably the most dangerous use case for ghost logins is to conduct credential attacks against accounts using a username and password. Logins with a weak or guessable password, or a reused password that has appeared in a public data breach dump, are primed for account takeover. ",{"data":53982,"content":53983,"nodeType":881},{},[53984],{"data":53985,"marks":53986,"value":53987,"nodeType":865},{},[],"The cyber crime ecosystem is leaning toward the theft, sale, and use of stolen credentials (not just emails and passwords, but session tokens too). ",{"data":53989,"content":53990,"nodeType":1818},{},[53991,54011,54031],{"data":53992,"content":53993,"nodeType":1734},{},[53994],{"data":53995,"content":53996,"nodeType":881},{},[53997,54001,54008],{"data":53998,"marks":53999,"value":54000,"nodeType":865},{},[],"There are 600 million identity attacks per day, with 99% involving passwords (",{"data":54002,"content":54003,"nodeType":876},{"uri":43794},[54004],{"data":54005,"marks":54006,"value":1718,"nodeType":865},{},[54007],{"type":874},{"data":54009,"marks":54010,"value":30302,"nodeType":865},{},[],{"data":54012,"content":54013,"nodeType":1734},{},[54014],{"data":54015,"content":54016,"nodeType":881},{},[54017,54021,54028],{"data":54018,"marks":54019,"value":54020,"nodeType":865},{},[],"Over 1000 credentials are posted online per day, per marketplace with an average sale price of $10, and 65% posted less than one day after being collected (",{"data":54022,"content":54023,"nodeType":876},{"uri":41391},[54024],{"data":54025,"marks":54026,"value":11582,"nodeType":865},{},[54027],{"type":874},{"data":54029,"marks":54030,"value":30302,"nodeType":865},{},[],{"data":54032,"content":54033,"nodeType":1734},{},[54034],{"data":54035,"content":54036,"nodeType":881},{},[54037,54041,54050],{"data":54038,"marks":54039,"value":54040,"nodeType":865},{},[],"One million new stealer logs are distributed every month, with an estimated 3-5% containing credentials and session cookies to corporate IT environments (",{"data":54042,"content":54044,"nodeType":876},{"uri":54043},"https://www.bleepingcomputer.com/news/security/single-sign-on-and-the-cybercrime-ecosystem/",[54045],{"data":54046,"marks":54047,"value":54049,"nodeType":865},{},[54048],{"type":874},"Flare",{"data":54051,"marks":54052,"value":30302,"nodeType":865},{},[],{"data":54054,"content":54055,"nodeType":881},{},[54056],{"data":54057,"marks":54058,"value":54060,"nodeType":865},{},[54059],{"type":902},"So, it’s easier than ever for attackers to gather breached credentials and weaponize them at scale. ",{"data":54062,"content":54063,"nodeType":881},{},[54064],{"data":54065,"marks":54066,"value":54067,"nodeType":865},{},[],"Realistically, any username and password combination for addresses belonging to a specific organization/domain can be attempted on any app. Breached credential data will often provide a strong indicator of other apps also in use for that organization. And for apps with a custom tenant URL (that cannot be easily guessed) data dumps often helpfully include the URLs for those login pages, too.  ",{"data":54069,"content":54070,"nodeType":881},{},[54071],{"data":54072,"marks":54073,"value":54074,"nodeType":865},{},[],"The risk posed by the massive amounts of leaked credentials available is heightened because: ",{"data":54076,"content":54077,"nodeType":1818},{},[54078,54099],{"data":54079,"content":54080,"nodeType":1734},{},[54081],{"data":54082,"content":54083,"nodeType":881},{},[54084,54088,54095],{"data":54085,"marks":54086,"value":54087,"nodeType":865},{},[],"Many employees reuse passwords, with ",{"data":54089,"content":54090,"nodeType":876},{"uri":30250},[54091],{"data":54092,"marks":54093,"value":54094,"nodeType":865},{},[],"~9% of all accounts using a breached, weak, or reused password",{"data":54096,"marks":54097,"value":54098,"nodeType":865},{},[],". This isn’t just for low-risk apps either, and includes the reuse of highly sensitive IdP creds. ",{"data":54100,"content":54101,"nodeType":1734},{},[54102],{"data":54103,"content":54104,"nodeType":881},{},[54105],{"data":54106,"marks":54107,"value":54108,"nodeType":865},{},[],"Organizations don’t typically rotate or enforce changes to SaaS app passwords in the same way they might for company account/device login connected to Active Directory.  ",{"data":54110,"content":54111,"nodeType":881},{},[54112],{"data":54113,"marks":54114,"value":54115,"nodeType":865},{},[],"Ghost logins aren’t limited to just username and password either. For example, a breached social account such as Facebook or Google can result in a broader compromise if those accounts have been connected to any corporate apps.   ",{"data":54117,"content":54118,"nodeType":881},{},[54119],{"data":54120,"marks":54121,"value":54123,"nodeType":865},{},[54122],{"type":902},"So, exploiting ghost logins can be a highly effective method for attackers to gain initial access to a user account from which to launch further attacks.  ",{"data":54125,"content":54126,"nodeType":1860},{},[54127],{"data":54128,"marks":54129,"value":54130,"nodeType":865},{},[],"Ghost logins for persistence and defense evasion",{"data":54132,"content":54133,"nodeType":881},{},[54134],{"data":54135,"marks":54136,"value":54137,"nodeType":865},{},[],"Now, we’ll take a look at how attackers can leverage ghost logins as part of the later stages of an attack, having already established an initial foothold via account compromise. ",{"data":54139,"content":54140,"nodeType":881},{},[54141,54145],{"data":54142,"marks":54143,"value":54144,"nodeType":865},{},[],"If an organization has a reasonable level of security monitoring in-place (depending on log availability from the particular app vendor), or a victim receives a notification about an unusual login (e.g. from a new device or unusual IP) then access to an account can be short-lived. ",{"data":54146,"marks":54147,"value":54149,"nodeType":865},{},[54148],{"type":902},"However, ghost logins can provide attackers with the tools to maintain persistent access to a compromised account, even if the initial compromised login method is disabled or revoked. ",{"data":54151,"content":54152,"nodeType":881},{},[54153,54157,54162],{"data":54154,"marks":54155,"value":54156,"nodeType":865},{},[],"For example, if a social login is used to access an account, an adversary may be able to configure a separate username/password login, or even (though much less commonly) connect a second social account that the adversary controls. This allows the adversary to maintain persistent access to the user account ",{"data":54158,"marks":54159,"value":54161,"nodeType":865},{},[54160],{"type":902},"even in the event of password changes or MFA changes",{"data":54163,"marks":54164,"value":54165,"nodeType":865},{},[],". The attack will go unnoticed if the victim organization relies on SSO logs for auditing access to SaaS applications because the attack bypasses SSO, as the login remains local to the SaaS app or, in the case of an OIDC SSO login, the adversary’s own social account.",{"data":54167,"content":54168,"nodeType":881},{},[54169,54173,54180,54184,54192],{"data":54170,"marks":54171,"value":54172,"nodeType":865},{},[],"Another quirk is that it’s common for ordinary users to become app-level admins when an app is self-adopted by an individual or team. If an attacker is able to gain control of such an account, it can then be used to target other users without needing to deliver phishing links by hijacking SAML-based authentication. In this scenario, users attempting to sign in using SAML SSO are directed it to an attacker-controlled tenant in a watering hole attack (also known as ",{"data":54174,"content":54175,"nodeType":876},{"uri":47721},[54176],{"data":54177,"marks":54178,"value":42664,"nodeType":865},{},[54179],{"type":874},{"data":54181,"marks":54182,"value":54183,"nodeType":865},{},[],", which you can ",{"data":54185,"content":54186,"nodeType":876},{"uri":42658},[54187],{"data":54188,"marks":54189,"value":54191,"nodeType":865},{},[54190],{"type":874},"read more about in another blog post",{"data":54193,"marks":54194,"value":42926,"nodeType":865},{},[],{"data":54196,"content":54197,"nodeType":881},{},[54198,54202,54210],{"data":54199,"marks":54200,"value":54201,"nodeType":865},{},[],"If you're curious as to how an attacker might be able to compromise an IdP account such as Okta, ",{"data":54203,"content":54204,"nodeType":876},{"uri":28776},[54205],{"data":54206,"marks":54207,"value":54209,"nodeType":865},{},[54208],{"type":874},"you should check out our blog post on AitM and BitM phishing techniques",{"data":54211,"marks":54212,"value":30204,"nodeType":865},{},[],{"data":54214,"content":54215,"nodeType":904},{},[54216],{"data":54217,"marks":54218,"value":54219,"nodeType":865},{},[],"Case study: Snowflake",{"data":54221,"content":54222,"nodeType":881},{},[54223,54226,54233],{"data":54224,"marks":54225,"value":5069,"nodeType":865},{},[],{"data":54227,"content":54228,"nodeType":876},{"uri":5072},[54229],{"data":54230,"marks":54231,"value":54232,"nodeType":865},{},[],"recent attacks on 165 Snowflake customers",{"data":54234,"marks":54235,"value":54236,"nodeType":865},{},[],", resulting in hundreds of millions of breached customer records, were the product of a credential stuffing campaign using stolen credentials from infostealer infections dating back to 2020. ",{"data":54238,"content":54239,"nodeType":881},{},[54240],{"data":54241,"marks":54242,"value":54243,"nodeType":865},{},[],"The industry response to Snowflake was typical: check whether Snowflake has been set up for SSO, and if so, job done — we’re protected by MFA.",{"data":54245,"content":54246,"nodeType":881},{},[54247],{"data":54248,"marks":54249,"value":54250,"nodeType":865},{},[],"The reality was that MFA was not — and could not — be centrally enforced for username and password accounts. Even if MFA was applied at the IdP level for SSO logins, it was not enforced for local username and password logins. It needed to be opted-into by the user. ",{"data":54252,"content":54253,"nodeType":881},{},[54254,54258,54265],{"data":54255,"marks":54256,"value":54257,"nodeType":865},{},[],"This meant the most logical thing to do was to disable local accounts. But because Snowflake is essentially a cloud-hosted SQL database, there was no easy-to-use GUI to access local account config data. Once you’d managed to get an admin account with the right permissions, you needed to run various commands to find and unset the accounts. ",{"data":54259,"content":54260,"nodeType":876},{"uri":53345},[54261],{"data":54262,"marks":54263,"value":54264,"nodeType":865},{},[],"But if you didn’t have the exact type of admin account, misleading results would be returned — and even after you had fixed the vulnerability it took hours to update the database. ",{"data":54266,"marks":54267,"value":21,"nodeType":865},{},[],{"data":54269,"content":54270,"nodeType":881},{},[54271],{"data":54272,"marks":54273,"value":54274,"nodeType":865},{},[],"This meant that organizations were exposed to these attacks for a prolonged period, and were left uncertain as to whether they had addressed the vulnerabilities or not. ",{"data":54276,"content":54277,"nodeType":904},{},[54278],{"data":54279,"marks":54280,"value":54281,"nodeType":865},{},[],"Using Push to find and fix ghost logins across your app inventory",{"data":54283,"content":54284,"nodeType":881},{},[54285],{"data":54286,"marks":54287,"value":54288,"nodeType":865},{},[],"Finding and fixing ghost logins is a challenge for most organizations. Since you can’t rely on the view provided by your IdP, you need to:",{"data":54290,"content":54291,"nodeType":1818},{},[54292,54302,54312],{"data":54293,"content":54294,"nodeType":1734},{},[54295],{"data":54296,"content":54297,"nodeType":881},{},[54298],{"data":54299,"marks":54300,"value":54301,"nodeType":865},{},[],"Discover the apps in use across your organization",{"data":54303,"content":54304,"nodeType":1734},{},[54305],{"data":54306,"content":54307,"nodeType":881},{},[54308],{"data":54309,"marks":54310,"value":54311,"nodeType":865},{},[],"Get admin rights, audit each app, and unset any local credentials (enforcing MFA at the app-level too if you can, for good measure)",{"data":54313,"content":54314,"nodeType":1734},{},[54315],{"data":54316,"content":54317,"nodeType":881},{},[54318],{"data":54319,"marks":54320,"value":54321,"nodeType":865},{},[],"Configure the app to prevent local accounts being created (again, if possible)",{"data":54323,"content":54324,"nodeType":881},{},[54325],{"data":54326,"marks":54327,"value":54328,"nodeType":865},{},[],"Not only is this a sisyphean task with continually moving goalposts, but depending on which apps you use, and how they’ve been designed, it may not be possible to remediate every instance of ghost logins. For that reason, it’s important to also invest in your identity threat detection and response capabilities — for when, not if, an account takeover attempt occurs. ",{"data":54330,"content":54331,"nodeType":881},{},[54332,54336,54344],{"data":54333,"marks":54334,"value":54335,"nodeType":865},{},[],"Push helps organizations to defend against ghost logins and other identity threats with a defense-in-depth approach: Using a browser-based agent to generate visibility of all logins (not just via IdP logs) while also detecting, intercepting, and shutting down account takeover attempts via phishing, credential stuffing, and session hijacking. ",{"data":54337,"content":54338,"nodeType":876},{"uri":36751},[54339],{"data":54340,"marks":54341,"value":54343,"nodeType":865},{},[54342],{"type":874},"Learn more here.",{"data":54345,"marks":54346,"value":21,"nodeType":865},{},[],{"data":54348,"content":54349,"nodeType":881},{},[54350,54354,54361],{"data":54351,"marks":54352,"value":54353,"nodeType":865},{},[],"And if you'd like to learn more about ghost logins and other identity attack techniques, ",{"data":54355,"content":54356,"nodeType":876},{"uri":39605},[54357],{"data":54358,"marks":54359,"value":54360,"nodeType":865},{},[],"check out the SaaS attack matrix on GitHub",{"data":54362,"marks":54363,"value":14775,"nodeType":865},{},[],{"data":54365,"content":54369,"nodeType":890},{"target":54366},{"sys":54367},{"id":54368,"type":887,"linkType":888},"1VMpMgZvx9hgps2OoxCTmF",[],{"data":54371,"content":54372,"nodeType":881},{},[54373],{"data":54374,"marks":54375,"value":21,"nodeType":865},{},[],"Ghost logins: When forgotten identities come back to haunt you","How ghost logins can be used by cyber attackers for account takeover and persistence.","2024-07-10T00:00:00.000Z","ghost-logins-when-forgotten-identities-come-back-to-haunt-you",{"items":54381},[54382,54384],{"sys":54383,"name":4507},{"id":4506},{"sys":54385,"name":342},{"id":4510},{"items":54387},[54388],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":54389},{"url":5377},{"__typename":1485,"sys":54391,"content":54392,"title":38993,"synopsis":38994,"hashTags":59,"publishedDate":38995,"slug":38996,"tagsCollection":54666,"authorsCollection":54672},{"id":38676},{"json":54393},{"data":54394,"content":54395,"nodeType":1463},{},[54396,54402,54418,54431,54437,54443,54446,54452,54458,54506,54512,54517,54520,54526,54532,54538,54544,54550,54564,54569,54575,54581,54595,54600,54606,54612,54618,54624,54630,54633,54639,54655,54660],{"data":54397,"content":54398,"nodeType":904},{},[54399],{"data":54400,"marks":54401,"value":38687,"nodeType":865},{},[],{"data":54403,"content":54404,"nodeType":881},{},[54405,54408,54415],{"data":54406,"marks":54407,"value":38694,"nodeType":865},{},[],{"data":54409,"content":54410,"nodeType":876},{"uri":38697},[54411],{"data":54412,"marks":54413,"value":38703,"nodeType":865},{},[54414],{"type":874},{"data":54416,"marks":54417,"value":1032,"nodeType":865},{},[],{"data":54419,"content":54420,"nodeType":881},{},[54421,54424,54428],{"data":54422,"marks":54423,"value":38713,"nodeType":865},{},[],{"data":54425,"marks":54426,"value":38718,"nodeType":865},{},[54427],{"type":874},{"data":54429,"marks":54430,"value":38722,"nodeType":865},{},[],{"data":54432,"content":54433,"nodeType":881},{},[54434],{"data":54435,"marks":54436,"value":38729,"nodeType":865},{},[],{"data":54438,"content":54439,"nodeType":881},{},[54440],{"data":54441,"marks":54442,"value":38736,"nodeType":865},{},[],{"data":54444,"content":54445,"nodeType":894},{},[],{"data":54447,"content":54448,"nodeType":1860},{},[54449],{"data":54450,"marks":54451,"value":38746,"nodeType":865},{},[],{"data":54453,"content":54454,"nodeType":881},{},[54455],{"data":54456,"marks":54457,"value":38753,"nodeType":865},{},[],{"data":54459,"content":54460,"nodeType":1818},{},[54461,54470,54479,54488,54497],{"data":54462,"content":54463,"nodeType":1734},{},[54464],{"data":54465,"content":54466,"nodeType":881},{},[54467],{"data":54468,"marks":54469,"value":38766,"nodeType":865},{},[],{"data":54471,"content":54472,"nodeType":1734},{},[54473],{"data":54474,"content":54475,"nodeType":881},{},[54476],{"data":54477,"marks":54478,"value":38776,"nodeType":865},{},[],{"data":54480,"content":54481,"nodeType":1734},{},[54482],{"data":54483,"content":54484,"nodeType":881},{},[54485],{"data":54486,"marks":54487,"value":38786,"nodeType":865},{},[],{"data":54489,"content":54490,"nodeType":1734},{},[54491],{"data":54492,"content":54493,"nodeType":881},{},[54494],{"data":54495,"marks":54496,"value":38796,"nodeType":865},{},[],{"data":54498,"content":54499,"nodeType":1734},{},[54500],{"data":54501,"content":54502,"nodeType":881},{},[54503],{"data":54504,"marks":54505,"value":38806,"nodeType":865},{},[],{"data":54507,"content":54508,"nodeType":881},{},[54509],{"data":54510,"marks":54511,"value":38813,"nodeType":865},{},[],{"data":54513,"content":54516,"nodeType":890},{"target":54514},{"sys":54515},{"id":38818,"type":887,"linkType":888},[],{"data":54518,"content":54519,"nodeType":894},{},[],{"data":54521,"content":54522,"nodeType":1860},{},[54523],{"data":54524,"marks":54525,"value":38829,"nodeType":865},{},[],{"data":54527,"content":54528,"nodeType":881},{},[54529],{"data":54530,"marks":54531,"value":38836,"nodeType":865},{},[],{"data":54533,"content":54534,"nodeType":881},{},[54535],{"data":54536,"marks":54537,"value":38843,"nodeType":865},{},[],{"data":54539,"content":54540,"nodeType":881},{},[54541],{"data":54542,"marks":54543,"value":38850,"nodeType":865},{},[],{"data":54545,"content":54546,"nodeType":881},{},[54547],{"data":54548,"marks":54549,"value":38857,"nodeType":865},{},[],{"data":54551,"content":54552,"nodeType":1860},{},[54553,54556,54561],{"data":54554,"marks":54555,"value":38864,"nodeType":865},{},[],{"data":54557,"marks":54558,"value":38870,"nodeType":865},{},[54559,54560],{"type":874},{"type":902},{"data":54562,"marks":54563,"value":38874,"nodeType":865},{},[],{"data":54565,"content":54568,"nodeType":890},{"target":54566},{"sys":54567},{"id":38879,"type":887,"linkType":888},[],{"data":54570,"content":54571,"nodeType":881},{},[54572],{"data":54573,"marks":54574,"value":38887,"nodeType":865},{},[],{"data":54576,"content":54577,"nodeType":881},{},[54578],{"data":54579,"marks":54580,"value":38894,"nodeType":865},{},[],{"data":54582,"content":54583,"nodeType":1860},{},[54584,54587,54592],{"data":54585,"marks":54586,"value":38901,"nodeType":865},{},[],{"data":54588,"marks":54589,"value":38907,"nodeType":865},{},[54590,54591],{"type":874},{"type":902},{"data":54593,"marks":54594,"value":38911,"nodeType":865},{},[],{"data":54596,"content":54599,"nodeType":890},{"target":54597},{"sys":54598},{"id":38916,"type":887,"linkType":888},[],{"data":54601,"content":54602,"nodeType":881},{},[54603],{"data":54604,"marks":54605,"value":38924,"nodeType":865},{},[],{"data":54607,"content":54608,"nodeType":881},{},[54609],{"data":54610,"marks":54611,"value":38931,"nodeType":865},{},[],{"data":54613,"content":54614,"nodeType":881},{},[54615],{"data":54616,"marks":54617,"value":38938,"nodeType":865},{},[],{"data":54619,"content":54620,"nodeType":881},{},[54621],{"data":54622,"marks":54623,"value":38945,"nodeType":865},{},[],{"data":54625,"content":54626,"nodeType":881},{},[54627],{"data":54628,"marks":54629,"value":38952,"nodeType":865},{},[],{"data":54631,"content":54632,"nodeType":894},{},[],{"data":54634,"content":54635,"nodeType":904},{},[54636],{"data":54637,"marks":54638,"value":38962,"nodeType":865},{},[],{"data":54640,"content":54641,"nodeType":881},{},[54642,54645,54652],{"data":54643,"marks":54644,"value":38969,"nodeType":865},{},[],{"data":54646,"content":54647,"nodeType":876},{"uri":6048},[54648],{"data":54649,"marks":54650,"value":38977,"nodeType":865},{},[54651],{"type":874},{"data":54653,"marks":54654,"value":30204,"nodeType":865},{},[],{"data":54656,"content":54659,"nodeType":890},{"target":54657},{"sys":54658},{"id":38985,"type":887,"linkType":888},[],{"data":54661,"content":54662,"nodeType":881},{},[54663],{"data":54664,"marks":54665,"value":21,"nodeType":865},{},[],{"items":54667},[54668,54670],{"sys":54669,"name":4507},{"id":4506},{"sys":54671,"name":342},{"id":4510},{"items":54673},[54674],{"fullName":32085,"firstName":32086,"jobTitle":20082,"profilePicture":54675},{"url":32088},"blog/cross-idp-impersonation",{"json":54678},{"data":54679,"content":54680,"nodeType":1463},{},[54681],{"data":54682,"content":54683,"nodeType":881},{},[54684],{"data":54685,"marks":54686,"value":54687,"nodeType":865},{},[],"Cross-IdP impersonation is a growing trend as a method of hijacking SSO to access downstream apps — without needing to compromise accounts on your company’s main IdP. ",{"id":50265,"publishedAt":54689},"2026-08-12T11:54:49.043Z",{"items":54691},[54692,54694],{"sys":54693,"name":4507},{"id":4506},{"sys":54695,"name":342},{"id":4510},{"items":54697},[54698,54700,54702,54704,54706,54708,54710,54712,54714,54716,54718],{"sys":54699,"name":279,"slug":280,"tier":31},{"id":276},{"sys":54701,"name":413,"slug":414,"tier":31},{"id":410},{"sys":54703,"name":545,"slug":546,"tier":31},{"id":542},{"sys":54705,"name":519,"slug":520,"tier":31},{"id":516},{"sys":54707,"name":395,"slug":396,"tier":45},{"id":392},{"sys":54709,"name":607,"slug":608,"tier":45},{"id":604},{"sys":54711,"name":466,"slug":467,"tier":45},{"id":463},{"sys":54713,"name":324,"slug":325,"tier":45},{"id":321},{"sys":54715,"name":484,"slug":485,"tier":45},{"id":481},{"sys":54717,"name":457,"slug":458,"tier":45},{"id":454},{"sys":54719,"name":493,"slug":494,"tier":45},{"id":490},"q2canFjajmFQA8xZKpztcW90H_hRgA-e1JkBNQ9F9SU",{"id":54722,"title":38993,"authorsCollection":54723,"content":54729,"extension":228,"faqItemsCollection":55028,"faqTitle":59,"featured":6,"hashTags":59,"meta":55030,"metaTitle":55031,"ogImage":59,"postType":55032,"publishedDate":38995,"relatedBlogPostsCollection":55033,"slug":38996,"stem":56893,"subtitle":59,"summary":56894,"synopsis":38994,"sys":56919,"tagsCollection":56921,"topicsCollection":56927,"__hash__":56953},"blog/blog/detecting-and-blocking-phishing-attacks-in-the-browser.json",{"items":54724},[54725],{"fullName":32085,"firstName":32086,"jobTitle":20082,"socialLinks":54726,"profilePicture":54728},[54727],"https://www.linkedin.com/in/alexhenshall/",{"url":32088},{"json":54730,"links":55003},{"data":54731,"content":54732,"nodeType":1463},{},[54733,54739,54755,54768,54774,54780,54783,54789,54795,54843,54849,54854,54857,54863,54869,54875,54881,54887,54901,54906,54912,54918,54932,54937,54943,54949,54955,54961,54967,54970,54976,54992,54997],{"data":54734,"content":54735,"nodeType":904},{},[54736],{"data":54737,"marks":54738,"value":38687,"nodeType":865},{},[],{"data":54740,"content":54741,"nodeType":881},{},[54742,54745,54752],{"data":54743,"marks":54744,"value":38694,"nodeType":865},{},[],{"data":54746,"content":54747,"nodeType":876},{"uri":38697},[54748],{"data":54749,"marks":54750,"value":38703,"nodeType":865},{},[54751],{"type":874},{"data":54753,"marks":54754,"value":1032,"nodeType":865},{},[],{"data":54756,"content":54757,"nodeType":881},{},[54758,54761,54765],{"data":54759,"marks":54760,"value":38713,"nodeType":865},{},[],{"data":54762,"marks":54763,"value":38718,"nodeType":865},{},[54764],{"type":874},{"data":54766,"marks":54767,"value":38722,"nodeType":865},{},[],{"data":54769,"content":54770,"nodeType":881},{},[54771],{"data":54772,"marks":54773,"value":38729,"nodeType":865},{},[],{"data":54775,"content":54776,"nodeType":881},{},[54777],{"data":54778,"marks":54779,"value":38736,"nodeType":865},{},[],{"data":54781,"content":54782,"nodeType":894},{},[],{"data":54784,"content":54785,"nodeType":1860},{},[54786],{"data":54787,"marks":54788,"value":38746,"nodeType":865},{},[],{"data":54790,"content":54791,"nodeType":881},{},[54792],{"data":54793,"marks":54794,"value":38753,"nodeType":865},{},[],{"data":54796,"content":54797,"nodeType":1818},{},[54798,54807,54816,54825,54834],{"data":54799,"content":54800,"nodeType":1734},{},[54801],{"data":54802,"content":54803,"nodeType":881},{},[54804],{"data":54805,"marks":54806,"value":38766,"nodeType":865},{},[],{"data":54808,"content":54809,"nodeType":1734},{},[54810],{"data":54811,"content":54812,"nodeType":881},{},[54813],{"data":54814,"marks":54815,"value":38776,"nodeType":865},{},[],{"data":54817,"content":54818,"nodeType":1734},{},[54819],{"data":54820,"content":54821,"nodeType":881},{},[54822],{"data":54823,"marks":54824,"value":38786,"nodeType":865},{},[],{"data":54826,"content":54827,"nodeType":1734},{},[54828],{"data":54829,"content":54830,"nodeType":881},{},[54831],{"data":54832,"marks":54833,"value":38796,"nodeType":865},{},[],{"data":54835,"content":54836,"nodeType":1734},{},[54837],{"data":54838,"content":54839,"nodeType":881},{},[54840],{"data":54841,"marks":54842,"value":38806,"nodeType":865},{},[],{"data":54844,"content":54845,"nodeType":881},{},[54846],{"data":54847,"marks":54848,"value":38813,"nodeType":865},{},[],{"data":54850,"content":54853,"nodeType":890},{"target":54851},{"sys":54852},{"id":38818,"type":887,"linkType":888},[],{"data":54855,"content":54856,"nodeType":894},{},[],{"data":54858,"content":54859,"nodeType":1860},{},[54860],{"data":54861,"marks":54862,"value":38829,"nodeType":865},{},[],{"data":54864,"content":54865,"nodeType":881},{},[54866],{"data":54867,"marks":54868,"value":38836,"nodeType":865},{},[],{"data":54870,"content":54871,"nodeType":881},{},[54872],{"data":54873,"marks":54874,"value":38843,"nodeType":865},{},[],{"data":54876,"content":54877,"nodeType":881},{},[54878],{"data":54879,"marks":54880,"value":38850,"nodeType":865},{},[],{"data":54882,"content":54883,"nodeType":881},{},[54884],{"data":54885,"marks":54886,"value":38857,"nodeType":865},{},[],{"data":54888,"content":54889,"nodeType":1860},{},[54890,54893,54898],{"data":54891,"marks":54892,"value":38864,"nodeType":865},{},[],{"data":54894,"marks":54895,"value":38870,"nodeType":865},{},[54896,54897],{"type":874},{"type":902},{"data":54899,"marks":54900,"value":38874,"nodeType":865},{},[],{"data":54902,"content":54905,"nodeType":890},{"target":54903},{"sys":54904},{"id":38879,"type":887,"linkType":888},[],{"data":54907,"content":54908,"nodeType":881},{},[54909],{"data":54910,"marks":54911,"value":38887,"nodeType":865},{},[],{"data":54913,"content":54914,"nodeType":881},{},[54915],{"data":54916,"marks":54917,"value":38894,"nodeType":865},{},[],{"data":54919,"content":54920,"nodeType":1860},{},[54921,54924,54929],{"data":54922,"marks":54923,"value":38901,"nodeType":865},{},[],{"data":54925,"marks":54926,"value":38907,"nodeType":865},{},[54927,54928],{"type":874},{"type":902},{"data":54930,"marks":54931,"value":38911,"nodeType":865},{},[],{"data":54933,"content":54936,"nodeType":890},{"target":54934},{"sys":54935},{"id":38916,"type":887,"linkType":888},[],{"data":54938,"content":54939,"nodeType":881},{},[54940],{"data":54941,"marks":54942,"value":38924,"nodeType":865},{},[],{"data":54944,"content":54945,"nodeType":881},{},[54946],{"data":54947,"marks":54948,"value":38931,"nodeType":865},{},[],{"data":54950,"content":54951,"nodeType":881},{},[54952],{"data":54953,"marks":54954,"value":38938,"nodeType":865},{},[],{"data":54956,"content":54957,"nodeType":881},{},[54958],{"data":54959,"marks":54960,"value":38945,"nodeType":865},{},[],{"data":54962,"content":54963,"nodeType":881},{},[54964],{"data":54965,"marks":54966,"value":38952,"nodeType":865},{},[],{"data":54968,"content":54969,"nodeType":894},{},[],{"data":54971,"content":54972,"nodeType":904},{},[54973],{"data":54974,"marks":54975,"value":38962,"nodeType":865},{},[],{"data":54977,"content":54978,"nodeType":881},{},[54979,54982,54989],{"data":54980,"marks":54981,"value":38969,"nodeType":865},{},[],{"data":54983,"content":54984,"nodeType":876},{"uri":6048},[54985],{"data":54986,"marks":54987,"value":38977,"nodeType":865},{},[54988],{"type":874},{"data":54990,"marks":54991,"value":30204,"nodeType":865},{},[],{"data":54993,"content":54996,"nodeType":890},{"target":54994},{"sys":54995},{"id":38985,"type":887,"linkType":888},[],{"data":54998,"content":54999,"nodeType":881},{},[55000],{"data":55001,"marks":55002,"value":21,"nodeType":865},{},[],{"entries":55004},{"hyperlink":55005,"inline":55006,"block":55007},[],[],[55008,55012,55019,55025],{"sys":55009,"__typename":1471,"type":1472,"ctaText":55010,"buttonLabel":21701,"buttonColour":30677,"buttonUrl":55011},{"id":38818},"Scattered Spider have been observed using AiTM phish kits and detection evasion techniques in 2025. Learn about their TTP evolution in our new webinar.","https://pushsecurity.com/webinar/scatteredspider",{"sys":55013,"__typename":7008,"title":55014,"caption":55015,"layoutMode":59,"file":55016},{"id":38879},"Phishing detection without Push","Phishing detection: Without Push (it's not looking good...)",{"url":55017,"width":52999,"height":55018},"https://images.ctfassets.net/y1cdw1ablpvd/1oBYz6u0WH0gMnd89bkZjU/61bf589f62b898b91e4f8045caf1d4e1/Phishing_detection_without_Push__3_.png",764,{"sys":55020,"__typename":7008,"title":55021,"caption":55022,"layoutMode":59,"file":55023},{"id":38916},"Phishing detection: With Push","Phishing detection: With Push (Pow! Take that attacker)",{"url":55024,"width":52999,"height":55018},"https://images.ctfassets.net/y1cdw1ablpvd/7lxmav3wYkltbFp3N9KeIQ/06080c5b629590fe3551cf5944f011ec/Phishing_detection_with_Push__2_.png",{"sys":55026,"__typename":1471,"type":1472,"ctaText":55027,"buttonLabel":43253,"buttonColour":1475,"buttonUrl":30615},{"id":38985},"Forget email or network controls — find out why the browser is best when it comes to detecting and blocking phishing attacks in real time.",{"items":55029},[],{},"How Push detects and blocks phishing attacks in the browser","product-feature",{"items":55034},[55035,55607,56411],{"__typename":1485,"sys":55036,"content":55037,"title":37977,"synopsis":37978,"hashTags":59,"publishedDate":37979,"slug":37980,"tagsCollection":55597,"authorsCollection":55603},{"id":37328},{"json":55038},{"data":55039,"content":55040,"nodeType":1463},{},[55041,55047,55053,55059,55062,55069,55075,55091,55121,55126,55142,55147,55167,55170,55177,55183,55196,55209,55214,55220,55226,55231,55244,55247,55254,55260,55266,55272,55278,55281,55288,55294,55300,55316,55322,55329,55368,55374,55379,55385,55390,55396,55399,55406,55419,55425,55459,55469,55472,55479,55485,55491,55521,55527,55544,55549,55554,55557,55564,55570,55586,55591],{"data":55042,"content":55043,"nodeType":881},{},[55044],{"data":55045,"marks":55046,"value":37339,"nodeType":865},{},[],{"data":55048,"content":55049,"nodeType":881},{},[55050],{"data":55051,"marks":55052,"value":37346,"nodeType":865},{},[],{"data":55054,"content":55055,"nodeType":881},{},[55056],{"data":55057,"marks":55058,"value":37353,"nodeType":865},{},[],{"data":55060,"content":55061,"nodeType":894},{},[],{"data":55063,"content":55064,"nodeType":904},{},[55065],{"data":55066,"marks":55067,"value":37364,"nodeType":865},{},[55068],{"type":902},{"data":55070,"content":55071,"nodeType":881},{},[55072],{"data":55073,"marks":55074,"value":37371,"nodeType":865},{},[],{"data":55076,"content":55077,"nodeType":881},{},[55078,55081,55088],{"data":55079,"marks":55080,"value":37378,"nodeType":865},{},[],{"data":55082,"content":55083,"nodeType":876},{"uri":37381},[55084],{"data":55085,"marks":55086,"value":37387,"nodeType":865},{},[55087],{"type":874},{"data":55089,"marks":55090,"value":37391,"nodeType":865},{},[],{"data":55092,"content":55093,"nodeType":1818},{},[55094,55103,55112],{"data":55095,"content":55096,"nodeType":1734},{},[55097],{"data":55098,"content":55099,"nodeType":881},{},[55100],{"data":55101,"marks":55102,"value":37404,"nodeType":865},{},[],{"data":55104,"content":55105,"nodeType":1734},{},[55106],{"data":55107,"content":55108,"nodeType":881},{},[55109],{"data":55110,"marks":55111,"value":37414,"nodeType":865},{},[],{"data":55113,"content":55114,"nodeType":1734},{},[55115],{"data":55116,"content":55117,"nodeType":881},{},[55118],{"data":55119,"marks":55120,"value":37424,"nodeType":865},{},[],{"data":55122,"content":55125,"nodeType":890},{"target":55123},{"sys":55124},{"id":37429,"type":887,"linkType":888},[],{"data":55127,"content":55128,"nodeType":881},{},[55129,55132,55139],{"data":55130,"marks":55131,"value":37437,"nodeType":865},{},[],{"data":55133,"content":55134,"nodeType":876},{"uri":37440},[55135],{"data":55136,"marks":55137,"value":37446,"nodeType":865},{},[55138],{"type":874},{"data":55140,"marks":55141,"value":37450,"nodeType":865},{},[],{"data":55143,"content":55146,"nodeType":890},{"target":55144},{"sys":55145},{"id":37455,"type":887,"linkType":888},[],{"data":55148,"content":55149,"nodeType":881},{},[55150,55153,55157,55160,55164],{"data":55151,"marks":55152,"value":37463,"nodeType":865},{},[],{"data":55154,"marks":55155,"value":37468,"nodeType":865},{},[55156],{"type":902},{"data":55158,"marks":55159,"value":37472,"nodeType":865},{},[],{"data":55161,"marks":55162,"value":37477,"nodeType":865},{},[55163],{"type":902},{"data":55165,"marks":55166,"value":37481,"nodeType":865},{},[],{"data":55168,"content":55169,"nodeType":894},{},[],{"data":55171,"content":55172,"nodeType":904},{},[55173],{"data":55174,"marks":55175,"value":37492,"nodeType":865},{},[55176],{"type":902},{"data":55178,"content":55179,"nodeType":881},{},[55180],{"data":55181,"marks":55182,"value":37499,"nodeType":865},{},[],{"data":55184,"content":55185,"nodeType":881},{},[55186,55189,55193],{"data":55187,"marks":55188,"value":37506,"nodeType":865},{},[],{"data":55190,"marks":55191,"value":37511,"nodeType":865},{},[55192],{"type":5120},{"data":55194,"marks":55195,"value":37515,"nodeType":865},{},[],{"data":55197,"content":55198,"nodeType":881},{},[55199,55202,55206],{"data":55200,"marks":55201,"value":37522,"nodeType":865},{},[],{"data":55203,"marks":55204,"value":37527,"nodeType":865},{},[55205],{"type":902},{"data":55207,"marks":55208,"value":1032,"nodeType":865},{},[],{"data":55210,"content":55213,"nodeType":890},{"target":55211},{"sys":55212},{"id":37535,"type":887,"linkType":888},[],{"data":55215,"content":55216,"nodeType":881},{},[55217],{"data":55218,"marks":55219,"value":37543,"nodeType":865},{},[],{"data":55221,"content":55222,"nodeType":881},{},[55223],{"data":55224,"marks":55225,"value":37550,"nodeType":865},{},[],{"data":55227,"content":55230,"nodeType":890},{"target":55228},{"sys":55229},{"id":37555,"type":887,"linkType":888},[],{"data":55232,"content":55233,"nodeType":881},{},[55234,55237,55241],{"data":55235,"marks":55236,"value":37563,"nodeType":865},{},[],{"data":55238,"marks":55239,"value":37568,"nodeType":865},{},[55240],{"type":902},{"data":55242,"marks":55243,"value":37572,"nodeType":865},{},[],{"data":55245,"content":55246,"nodeType":894},{},[],{"data":55248,"content":55249,"nodeType":904},{},[55250],{"data":55251,"marks":55252,"value":37583,"nodeType":865},{},[55253],{"type":902},{"data":55255,"content":55256,"nodeType":881},{},[55257],{"data":55258,"marks":55259,"value":37590,"nodeType":865},{},[],{"data":55261,"content":55262,"nodeType":881},{},[55263],{"data":55264,"marks":55265,"value":37597,"nodeType":865},{},[],{"data":55267,"content":55268,"nodeType":881},{},[55269],{"data":55270,"marks":55271,"value":37604,"nodeType":865},{},[],{"data":55273,"content":55274,"nodeType":881},{},[55275],{"data":55276,"marks":55277,"value":37611,"nodeType":865},{},[],{"data":55279,"content":55280,"nodeType":894},{},[],{"data":55282,"content":55283,"nodeType":904},{},[55284],{"data":55285,"marks":55286,"value":37622,"nodeType":865},{},[55287],{"type":902},{"data":55289,"content":55290,"nodeType":881},{},[55291],{"data":55292,"marks":55293,"value":37629,"nodeType":865},{},[],{"data":55295,"content":55296,"nodeType":881},{},[55297],{"data":55298,"marks":55299,"value":37636,"nodeType":865},{},[],{"data":55301,"content":55302,"nodeType":881},{},[55303,55306,55313],{"data":55304,"marks":55305,"value":37643,"nodeType":865},{},[],{"data":55307,"content":55308,"nodeType":876},{"uri":37646},[55309],{"data":55310,"marks":55311,"value":37652,"nodeType":865},{},[55312],{"type":874},{"data":55314,"marks":55315,"value":37656,"nodeType":865},{},[],{"data":55317,"content":55318,"nodeType":881},{},[55319],{"data":55320,"marks":55321,"value":37663,"nodeType":865},{},[],{"data":55323,"content":55324,"nodeType":881},{},[55325],{"data":55326,"marks":55327,"value":37671,"nodeType":865},{},[55328],{"type":902},{"data":55330,"content":55331,"nodeType":1818},{},[55332,55341,55350,55359],{"data":55333,"content":55334,"nodeType":1734},{},[55335],{"data":55336,"content":55337,"nodeType":881},{},[55338],{"data":55339,"marks":55340,"value":31242,"nodeType":865},{},[],{"data":55342,"content":55343,"nodeType":1734},{},[55344],{"data":55345,"content":55346,"nodeType":881},{},[55347],{"data":55348,"marks":55349,"value":37693,"nodeType":865},{},[],{"data":55351,"content":55352,"nodeType":1734},{},[55353],{"data":55354,"content":55355,"nodeType":881},{},[55356],{"data":55357,"marks":55358,"value":37703,"nodeType":865},{},[],{"data":55360,"content":55361,"nodeType":1734},{},[55362],{"data":55363,"content":55364,"nodeType":881},{},[55365],{"data":55366,"marks":55367,"value":37713,"nodeType":865},{},[],{"data":55369,"content":55370,"nodeType":881},{},[55371],{"data":55372,"marks":55373,"value":37720,"nodeType":865},{},[],{"data":55375,"content":55378,"nodeType":890},{"target":55376},{"sys":55377},{"id":37725,"type":887,"linkType":888},[],{"data":55380,"content":55381,"nodeType":881},{},[55382],{"data":55383,"marks":55384,"value":37733,"nodeType":865},{},[],{"data":55386,"content":55389,"nodeType":890},{"target":55387},{"sys":55388},{"id":37738,"type":887,"linkType":888},[],{"data":55391,"content":55392,"nodeType":881},{},[55393],{"data":55394,"marks":55395,"value":37746,"nodeType":865},{},[],{"data":55397,"content":55398,"nodeType":894},{},[],{"data":55400,"content":55401,"nodeType":904},{},[55402],{"data":55403,"marks":55404,"value":37757,"nodeType":865},{},[55405],{"type":902},{"data":55407,"content":55408,"nodeType":881},{},[55409,55412,55416],{"data":55410,"marks":55411,"value":37764,"nodeType":865},{},[],{"data":55413,"marks":55414,"value":37769,"nodeType":865},{},[55415],{"type":902},{"data":55417,"marks":55418,"value":1032,"nodeType":865},{},[],{"data":55420,"content":55421,"nodeType":881},{},[55422],{"data":55423,"marks":55424,"value":37779,"nodeType":865},{},[],{"data":55426,"content":55427,"nodeType":881},{},[55428,55431,55435,55438,55442,55445,55449,55452,55456],{"data":55429,"marks":55430,"value":37786,"nodeType":865},{},[],{"data":55432,"marks":55433,"value":37791,"nodeType":865},{},[55434],{"type":902},{"data":55436,"marks":55437,"value":37795,"nodeType":865},{},[],{"data":55439,"marks":55440,"value":37800,"nodeType":865},{},[55441],{"type":902},{"data":55443,"marks":55444,"value":37804,"nodeType":865},{},[],{"data":55446,"marks":55447,"value":37800,"nodeType":865},{},[55448],{"type":902},{"data":55450,"marks":55451,"value":37812,"nodeType":865},{},[],{"data":55453,"marks":55454,"value":37817,"nodeType":865},{},[55455],{"type":902},{"data":55457,"marks":55458,"value":37821,"nodeType":865},{},[],{"data":55460,"content":55461,"nodeType":881},{},[55462,55465],{"data":55463,"marks":55464,"value":37828,"nodeType":865},{},[],{"data":55466,"marks":55467,"value":37833,"nodeType":865},{},[55468],{"type":902},{"data":55470,"content":55471,"nodeType":894},{},[],{"data":55473,"content":55474,"nodeType":904},{},[55475],{"data":55476,"marks":55477,"value":37844,"nodeType":865},{},[55478],{"type":902},{"data":55480,"content":55481,"nodeType":881},{},[55482],{"data":55483,"marks":55484,"value":37851,"nodeType":865},{},[],{"data":55486,"content":55487,"nodeType":881},{},[55488],{"data":55489,"marks":55490,"value":37858,"nodeType":865},{},[],{"data":55492,"content":55493,"nodeType":1818},{},[55494,55503,55512],{"data":55495,"content":55496,"nodeType":1734},{},[55497],{"data":55498,"content":55499,"nodeType":881},{},[55500],{"data":55501,"marks":55502,"value":37871,"nodeType":865},{},[],{"data":55504,"content":55505,"nodeType":1734},{},[55506],{"data":55507,"content":55508,"nodeType":881},{},[55509],{"data":55510,"marks":55511,"value":37881,"nodeType":865},{},[],{"data":55513,"content":55514,"nodeType":1734},{},[55515],{"data":55516,"content":55517,"nodeType":881},{},[55518],{"data":55519,"marks":55520,"value":37891,"nodeType":865},{},[],{"data":55522,"content":55523,"nodeType":881},{},[55524],{"data":55525,"marks":55526,"value":37898,"nodeType":865},{},[],{"data":55528,"content":55529,"nodeType":881},{},[55530,55534,55541],{"data":55531,"marks":55532,"value":37906,"nodeType":865},{},[55533],{"type":902},{"data":55535,"content":55536,"nodeType":876},{"uri":37909},[55537],{"data":55538,"marks":55539,"value":37915,"nodeType":865},{},[55540],{"type":874},{"data":55542,"marks":55543,"value":21,"nodeType":865},{},[],{"data":55545,"content":55548,"nodeType":890},{"target":55546},{"sys":55547},{"id":37923,"type":887,"linkType":888},[],{"data":55550,"content":55553,"nodeType":890},{"target":55551},{"sys":55552},{"id":37929,"type":887,"linkType":888},[],{"data":55555,"content":55556,"nodeType":894},{},[],{"data":55558,"content":55559,"nodeType":904},{},[55560],{"data":55561,"marks":55562,"value":29766,"nodeType":865},{},[55563],{"type":902},{"data":55565,"content":55566,"nodeType":881},{},[55567],{"data":55568,"marks":55569,"value":37947,"nodeType":865},{},[],{"data":55571,"content":55572,"nodeType":881},{},[55573,55576,55583],{"data":55574,"marks":55575,"value":31701,"nodeType":865},{},[],{"data":55577,"content":55578,"nodeType":876},{"uri":37956},[55579],{"data":55580,"marks":55581,"value":4495,"nodeType":865},{},[55582],{"type":874},{"data":55584,"marks":55585,"value":959,"nodeType":865},{},[],{"data":55587,"content":55590,"nodeType":890},{"target":55588},{"sys":55589},{"id":37969,"type":887,"linkType":888},[],{"data":55592,"content":55593,"nodeType":881},{},[55594],{"data":55595,"marks":55596,"value":21,"nodeType":865},{},[],{"items":55598},[55599,55601],{"sys":55600,"name":342},{"id":4510},{"sys":55602,"name":4507},{"id":4506},{"items":55604},[55605],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":55606},{"url":5377},{"__typename":1485,"sys":55608,"content":55610,"title":56395,"synopsis":56396,"hashTags":59,"publishedDate":56397,"slug":56398,"tagsCollection":56399,"authorsCollection":56407},{"id":55609},"20FcoPvHu7zXkTQyv9MmK0",{"json":55611},{"data":55612,"content":55613,"nodeType":1463},{},[55614,55620,55627,55678,55685,55692,55707,55714,55721,55805,55812,55818,55825,55832,55847,55854,55860,55883,55907,55913,55933,55939,55946,55977,55984,55991,55997,56014,56021,56028,56035,56042,56048,56066,56073,56080,56087,56094,56100,56119,56126,56133,56139,56157,56164,56171,56178,56226,56233,56304,56319,56325,56332,56339,56346,56353,56371,56377],{"data":55615,"content":55619,"nodeType":890},{"target":55616},{"sys":55617},{"id":55618,"type":887,"linkType":888},"7rud2H1hcTAOhxh9zHzxP6",[],{"data":55621,"content":55622,"nodeType":881},{},[55623],{"data":55624,"marks":55625,"value":55626,"nodeType":865},{},[],"If someone asked you where you work, you probably wouldn’t answer, “My browser.” But that would be the truth.",{"data":55628,"content":55629,"nodeType":881},{},[55630,55634,55642,55645,55653,55656,55663,55666,55674],{"data":55631,"marks":55632,"value":55633,"nodeType":865},{},[],"(Threat actors already know where you work, of course, and they’ve been capitalizing on the massive shift to cloud-based workforces. Just look at any of the ",{"data":55635,"content":55637,"nodeType":876},{"uri":55636},"https://www.crowdstrike.com/global-threat-report/",[55638],{"data":55639,"marks":55640,"value":55641,"nodeType":865},{},[],"latest",{"data":55643,"marks":55644,"value":2091,"nodeType":865},{},[],{"data":55646,"content":55648,"nodeType":876},{"uri":55647},"https://redcanary.com/threat-detection-report/techniques/cloud-accounts/",[55649],{"data":55650,"marks":55651,"value":55652,"nodeType":865},{},[],"threat",{"data":55654,"marks":55655,"value":2091,"nodeType":865},{},[],{"data":55657,"content":55658,"nodeType":876},{"uri":11576},[55659],{"data":55660,"marks":55661,"value":55662,"nodeType":865},{},[],"research",{"data":55664,"marks":55665,"value":2091,"nodeType":865},{},[],{"data":55667,"content":55669,"nodeType":876},{"uri":55668},"https://www.lab539.com/blog/6-months-tracking-aitm-campaigns",[55670],{"data":55671,"marks":55672,"value":55673,"nodeType":865},{},[],"reports",{"data":55675,"marks":55676,"value":55677,"nodeType":865},{},[]," on identity-based attacks to see how good a job they’ve been doing.)",{"data":55679,"content":55680,"nodeType":881},{},[55681],{"data":55682,"marks":55683,"value":55684,"nodeType":865},{},[],"To get visibility of your infrastructure in order to build a strong detection and response program, the equation used to look something like:",{"data":55686,"content":55687,"nodeType":881},{},[55688],{"data":55689,"marks":55690,"value":55691,"nodeType":865},{},[],"Network traffic + Logs + Endpoints = Profit!",{"data":55693,"content":55694,"nodeType":881},{},[55695,55699,55704],{"data":55696,"marks":55697,"value":55698,"nodeType":865},{},[],"But now there’s a missing piece, as identity infrastructure sprawls across IdPs, core apps, shadow SaaS and third-party integrations: ",{"data":55700,"marks":55701,"value":55703,"nodeType":865},{},[55702],{"type":902},"Browser telemetry",{"data":55705,"marks":55706,"value":959,"nodeType":865},{},[],{"data":55708,"content":55709,"nodeType":881},{},[55710],{"data":55711,"marks":55712,"value":55713,"nodeType":865},{},[],"As a browser agent, Push is uniquely positioned to provide telemetry you can’t easily get anywhere else. We believe that this missing piece is the key to stopping identity attacks by providing the context both for first-class detections and security controls, as well as key correlations for events you observe in traditional log sources.",{"data":55715,"content":55716,"nodeType":881},{},[55717],{"data":55718,"marks":55719,"value":55720,"nodeType":865},{},[],"Now we have a better way to bring Push’s data to life to solve meaningful security challenges:",{"data":55722,"content":55723,"nodeType":1818},{},[55724,55754],{"data":55725,"content":55726,"nodeType":1734},{},[55727],{"data":55728,"content":55729,"nodeType":881},{},[55730,55735,55739,55750],{"data":55731,"marks":55732,"value":55734,"nodeType":865},{},[55733],{"type":902},"Plug-and-play security controls",{"data":55736,"marks":55737,"value":55738,"nodeType":865},{},[],", accessible from the new ",{"data":55740,"content":55744,"nodeType":19000},{"target":55741},{"sys":55742},{"id":55743,"type":887,"linkType":888},"BtDLgVZRWQ3Ov4WgDQX1W",[55745],{"data":55746,"marks":55747,"value":55749,"nodeType":865},{},[55748],{"type":902},"Controls",{"data":55751,"marks":55752,"value":55753,"nodeType":865},{},[]," page in the Push platform",{"data":55755,"content":55756,"nodeType":1734},{},[55757],{"data":55758,"content":55759,"nodeType":881},{},[55760,55765,55769,55777,55780,55788,55792,55801],{"data":55761,"marks":55762,"value":55764,"nodeType":865},{},[55763],{"type":902},"Choose-your-own-adventure tooling",{"data":55766,"marks":55767,"value":55768,"nodeType":865},{},[],", including a ",{"data":55770,"content":55772,"nodeType":876},{"uri":55771},"https://pushsecurity.redoc.ly/rest-v1/",[55773],{"data":55774,"marks":55775,"value":55776,"nodeType":865},{},[],"REST API",{"data":55778,"marks":55779,"value":1877,"nodeType":865},{},[],{"data":55781,"content":55783,"nodeType":876},{"uri":55782},"https://pushsecurity.redoc.ly/webhooks-v1/",[55784],{"data":55785,"marks":55786,"value":55787,"nodeType":865},{},[],"webhooks",{"data":55789,"marks":55790,"value":55791,"nodeType":865},{},[],", and a new ",{"data":55793,"content":55795,"nodeType":876},{"uri":55794},"/help/audience/administrators/docs/connect-to-siem-or-soar/#using-the-events-page",[55796],{"data":55797,"marks":55798,"value":55800,"nodeType":865},{},[55799],{"type":902},"Events",{"data":55802,"marks":55803,"value":55804,"nodeType":865},{},[]," page to help you visualize and build custom detections and automations.",{"data":55806,"content":55807,"nodeType":881},{},[55808],{"data":55809,"marks":55810,"value":55811,"nodeType":865},{},[],"Let’s take a closer look.",{"data":55813,"content":55817,"nodeType":890},{"target":55814},{"sys":55815},{"id":55816,"type":887,"linkType":888},"6iKFd9Qys2SSuNqKVQB7ka",[],{"data":55819,"content":55820,"nodeType":904},{},[55821],{"data":55822,"marks":55823,"value":55824,"nodeType":865},{},[],"Plug-and-play controls",{"data":55826,"content":55827,"nodeType":881},{},[55828],{"data":55829,"marks":55830,"value":55831,"nodeType":865},{},[],"Security visibility without security control is a recipe for a stress headache, so we’re big believers in providing meaningful interventions that are easy to use.",{"data":55833,"content":55834,"nodeType":881},{},[55835,55839,55843],{"data":55836,"marks":55837,"value":55838,"nodeType":865},{},[],"With the new ",{"data":55840,"marks":55841,"value":55749,"nodeType":865},{},[55842],{"type":902},{"data":55844,"marks":55845,"value":55846,"nodeType":865},{},[]," page in the Push admin console, you can now find these preconfigured detections and interventions in one place. They cover use cases that any organization can benefit from, and take a unique browser-based approach to solving some thorny issues.",{"data":55848,"content":55849,"nodeType":881},{},[55850],{"data":55851,"marks":55852,"value":55853,"nodeType":865},{},[],"These controls include:",{"data":55855,"content":55856,"nodeType":1860},{},[55857],{"data":55858,"marks":55859,"value":19214,"nodeType":865},{},[],{"data":55861,"content":55862,"nodeType":881},{},[55863,55867,55872,55875,55880],{"data":55864,"marks":55865,"value":55866,"nodeType":865},{},[],"Detect and block when employees visit webpages that use advanced phishing tools such as Evilginx or EvilNoVNC, among others. These adversary-in-the-middle (AitM) toolkits can mimic legitimate login screens, such as an Okta login page, to steal ",{"data":55868,"marks":55869,"value":55871,"nodeType":865},{},[55870],{"type":902},"credentials",{"data":55873,"marks":55874,"value":1651,"nodeType":865},{},[],{"data":55876,"marks":55877,"value":55879,"nodeType":865},{},[55878],{"type":902},"MFA codes",{"data":55881,"marks":55882,"value":959,"nodeType":865},{},[],{"data":55884,"content":55885,"nodeType":881},{},[55886,55890,55895,55898,55903],{"data":55887,"marks":55888,"value":55889,"nodeType":865},{},[],"Push emits a webhook event when the browser agent detects attributes of these malware. You can also set Push to ",{"data":55891,"marks":55892,"value":55894,"nodeType":865},{},[55893],{"type":902},"Warn",{"data":55896,"marks":55897,"value":8048,"nodeType":865},{},[],{"data":55899,"marks":55900,"value":55902,"nodeType":865},{},[55901],{"type":902},"Block",{"data":55904,"marks":55905,"value":55906,"nodeType":865},{},[]," mode to display a customizable message to end-users when they encounter a phishing site.",{"data":55908,"content":55912,"nodeType":890},{"target":55909},{"sys":55910},{"id":55911,"type":887,"linkType":888},"2ylIkR0JXHkFStGuCFRjlN",[],{"data":55914,"content":55915,"nodeType":881},{},[55916,55920,55930],{"data":55917,"marks":55918,"value":55919,"nodeType":865},{},[],"More about ",{"data":55921,"content":55925,"nodeType":19000},{"target":55922},{"sys":55923},{"id":55924,"type":887,"linkType":888},"7KRnTSnJAbbiho69gNyN0B",[55926],{"data":55927,"marks":55928,"value":55929,"nodeType":865},{},[],"phishing tool detection",{"data":55931,"marks":55932,"value":21,"nodeType":865},{},[],{"data":55934,"content":55935,"nodeType":1860},{},[55936],{"data":55937,"marks":55938,"value":43665,"nodeType":865},{},[],{"data":55940,"content":55941,"nodeType":881},{},[55942],{"data":55943,"marks":55944,"value":55945,"nodeType":865},{},[],"Prevent employees from reusing their corporate SSO password on any page that doesn’t belong to the identity provider, including phishing sites. This means that even if that employee was the first person to get phished using a new attacker site, Push still detects it and blocks it.",{"data":55947,"content":55948,"nodeType":881},{},[55949,55953,55957,55960,55964,55968,55973],{"data":55950,"marks":55951,"value":55952,"nodeType":865},{},[],"Customize the message that end-users see in ",{"data":55954,"marks":55955,"value":55894,"nodeType":865},{},[55956],{"type":902},{"data":55958,"marks":55959,"value":8048,"nodeType":865},{},[],{"data":55961,"marks":55962,"value":55902,"nodeType":865},{},[55963],{"type":902},{"data":55965,"marks":55966,"value":55967,"nodeType":865},{},[]," mode, or start out in ",{"data":55969,"marks":55970,"value":55972,"nodeType":865},{},[55971],{"type":902},"Monitor",{"data":55974,"marks":55975,"value":55976,"nodeType":865},{},[]," mode to catch any false positives before you enforce the control.",{"data":55978,"content":55979,"nodeType":881},{},[55980],{"data":55981,"marks":55982,"value":55983,"nodeType":865},{},[],"This feature supports the following identity providers: Okta, Microsoft 365, Google Workspace, JumpCloud, Duo, and Ping Identity.",{"data":55985,"content":55986,"nodeType":881},{},[55987],{"data":55988,"marks":55989,"value":55990,"nodeType":865},{},[],"Push will also emit a webhook event when an SSO password is used, and if an employee clicks through the warning screen.",{"data":55992,"content":55996,"nodeType":890},{"target":55993},{"sys":55994},{"id":55995,"type":887,"linkType":888},"25c8M2gWYFST7yYxGEji2s",[],{"data":55998,"content":55999,"nodeType":881},{},[56000,56003,56011],{"data":56001,"marks":56002,"value":55919,"nodeType":865},{},[],{"data":56004,"content":56007,"nodeType":19000},{"target":56005},{"sys":56006},{"id":19725,"type":887,"linkType":888},[56008],{"data":56009,"marks":56010,"value":43665,"nodeType":865},{},[],{"data":56012,"marks":56013,"value":21,"nodeType":865},{},[],{"data":56015,"content":56016,"nodeType":1860},{},[56017],{"data":56018,"marks":56019,"value":56020,"nodeType":865},{},[],"URL blocking",{"data":56022,"content":56023,"nodeType":881},{},[56024],{"data":56025,"marks":56026,"value":56027,"nodeType":865},{},[],"When you find malicious sites you want to block, such as when responding to a phishing incident, add them to a blocklist and prevent other employees from accessing those sites. ",{"data":56029,"content":56030,"nodeType":881},{},[56031],{"data":56032,"marks":56033,"value":56034,"nodeType":865},{},[],"URL blocking can be used in tandem with Push’s anti-phishing controls, so that as you discover malicious sites, you can block them from a central blocklist. This offers a kind of herd immunity where you can block other users from visiting a malicious site as soon as you have a single incident.",{"data":56036,"content":56037,"nodeType":881},{},[56038],{"data":56039,"marks":56040,"value":56041,"nodeType":865},{},[],"You can programmatically manage the blocklist using the Push REST API or sync to other threat intelligence sources you consume.",{"data":56043,"content":56047,"nodeType":890},{"target":56044},{"sys":56045},{"id":56046,"type":887,"linkType":888},"3m00cFiUDAnddsOBOpkeiZ",[],{"data":56049,"content":56050,"nodeType":881},{},[56051,56054,56063],{"data":56052,"marks":56053,"value":55919,"nodeType":865},{},[],{"data":56055,"content":56059,"nodeType":19000},{"target":56056},{"sys":56057},{"id":56058,"type":887,"linkType":888},"P0coHgQAdRL0YTu4Rwd4z",[56060],{"data":56061,"marks":56062,"value":56020,"nodeType":865},{},[],{"data":56064,"marks":56065,"value":21,"nodeType":865},{},[],{"data":56067,"content":56068,"nodeType":1860},{},[56069],{"data":56070,"marks":56071,"value":56072,"nodeType":865},{},[],"Session token theft detection",{"data":56074,"content":56075,"nodeType":881},{},[56076],{"data":56077,"marks":56078,"value":56079,"nodeType":865},{},[],"Inject a unique marker provided by the Push browser agent into the User Agent string of sessions that occur in browsers enrolled in Push. ",{"data":56081,"content":56082,"nodeType":881},{},[56083],{"data":56084,"marks":56085,"value":56086,"nodeType":865},{},[],"By analyzing logs from your IdP, you can identify activity from the same session that both has the Push marker and that lacks the marker. This can only ever happen when a session is extracted from a browser and maliciously imported into a different browser.",{"data":56088,"content":56089,"nodeType":881},{},[56090],{"data":56091,"marks":56092,"value":56093,"nodeType":865},{},[],"This is a high-fidelity signal that a session token has been stolen and is being used.",{"data":56095,"content":56099,"nodeType":890},{"target":56096},{"sys":56097},{"id":56098,"type":887,"linkType":888},"43rk3TCqN269Vr2YWT4llP",[],{"data":56101,"content":56102,"nodeType":881},{},[56103,56106,56116],{"data":56104,"marks":56105,"value":55919,"nodeType":865},{},[],{"data":56107,"content":56111,"nodeType":19000},{"target":56108},{"sys":56109},{"id":56110,"type":887,"linkType":888},"1UMZdjyNQt4Y7NBb2wuK4L",[56112],{"data":56113,"marks":56114,"value":56115,"nodeType":865},{},[],"session token theft detection",{"data":56117,"marks":56118,"value":21,"nodeType":865},{},[],{"data":56120,"content":56121,"nodeType":1860},{},[56122],{"data":56123,"marks":56124,"value":56125,"nodeType":865},{},[],"App banners",{"data":56127,"content":56128,"nodeType":881},{},[56129],{"data":56130,"marks":56131,"value":56132,"nodeType":865},{},[],"Add guardrails to employees’ use of SaaS apps with in-browser app banner messages you customize with your own text. You can require users to acknowledge having read a message before they can access an app, or even require them to submit a reason for using an app before they can log in.",{"data":56134,"content":56138,"nodeType":890},{"target":56135},{"sys":56136},{"id":56137,"type":887,"linkType":888},"5nEKTBz6mauHI5mg8jB4ea",[],{"data":56140,"content":56141,"nodeType":881},{},[56142,56145,56154],{"data":56143,"marks":56144,"value":55919,"nodeType":865},{},[],{"data":56146,"content":56150,"nodeType":19000},{"target":56147},{"sys":56148},{"id":56149,"type":887,"linkType":888},"2ZpKnuljaUH0jzVaae4SMN",[56151],{"data":56152,"marks":56153,"value":44463,"nodeType":865},{},[],{"data":56155,"marks":56156,"value":21,"nodeType":865},{},[],{"data":56158,"content":56159,"nodeType":904},{},[56160],{"data":56161,"marks":56162,"value":56163,"nodeType":865},{},[],"Choose your own adventure",{"data":56165,"content":56166,"nodeType":881},{},[56167],{"data":56168,"marks":56169,"value":56170,"nodeType":865},{},[],"Want to do something creative? We've got you covered. Push provides a wealth of raw telemetry via the Push REST API and webhook events. Use this data to build both proactive and reactive security operations workflows, or add missing context to other sources, such as your IdP, application, or endpoint logs.",{"data":56172,"content":56173,"nodeType":881},{},[56174],{"data":56175,"marks":56176,"value":56177,"nodeType":865},{},[],"You can use this browser telemetry to:",{"data":56179,"content":56180,"nodeType":1818},{},[56181,56196,56211],{"data":56182,"content":56183,"nodeType":1734},{},[56184],{"data":56185,"content":56186,"nodeType":881},{},[56187,56192],{"data":56188,"marks":56189,"value":56191,"nodeType":865},{},[56190],{"type":902},"Harden identities and reduce account compromise",{"data":56193,"marks":56194,"value":56195,"nodeType":865},{},[],", such as alerting you when passwords are identified in public data breaches or when employees are using an unapproved app or when an SSO app is accessed via local account.",{"data":56197,"content":56198,"nodeType":1734},{},[56199],{"data":56200,"content":56201,"nodeType":881},{},[56202,56207],{"data":56203,"marks":56204,"value":56206,"nodeType":865},{},[56205],{"type":902},"Monitor for suspicious activity or high-risk changes",{"data":56208,"marks":56209,"value":56210,"nodeType":865},{},[],", such as checking for MFA method changes, or flagging when employees reuse corporate SSO passwords or visit sites running phishing malware.",{"data":56212,"content":56213,"nodeType":1734},{},[56214],{"data":56215,"content":56216,"nodeType":881},{},[56217,56222],{"data":56218,"marks":56219,"value":56221,"nodeType":865},{},[56220],{"type":902},"Investigate indicators of compromise",{"data":56223,"marks":56224,"value":56225,"nodeType":865},{},[],", such as correlating login events with platform logs, searching for recent signups to risky apps, or identifying post-compromise lateral movement opportunities.",{"data":56227,"content":56228,"nodeType":881},{},[56229],{"data":56230,"marks":56231,"value":56232,"nodeType":865},{},[],"In the “make my life easier” category, you can also use Push telemetry to:",{"data":56234,"content":56235,"nodeType":1818},{},[56236,56255,56274,56289],{"data":56237,"content":56238,"nodeType":1734},{},[56239],{"data":56240,"content":56241,"nodeType":881},{},[56242,56246,56251],{"data":56243,"marks":56244,"value":56245,"nodeType":865},{},[],"Automate a workflow ",{"data":56247,"marks":56248,"value":56250,"nodeType":865},{},[56249],{"type":902},"showing you all the accounts and apps used by an offboarded employee",{"data":56252,"marks":56253,"value":56254,"nodeType":865},{},[],", and their account login methods.",{"data":56256,"content":56257,"nodeType":1734},{},[56258],{"data":56259,"content":56260,"nodeType":881},{},[56261,56265,56270],{"data":56262,"marks":56263,"value":56264,"nodeType":865},{},[],"Automate a workflow to",{"data":56266,"marks":56267,"value":56269,"nodeType":865},{},[56268],{"type":902}," revoke licenses on SaaS after a period of inactivity",{"data":56271,"marks":56272,"value":56273,"nodeType":865},{},[],", saving money.",{"data":56275,"content":56276,"nodeType":1734},{},[56277],{"data":56278,"content":56279,"nodeType":881},{},[56280,56285],{"data":56281,"marks":56282,"value":56284,"nodeType":865},{},[56283],{"type":902},"Build an approved apps list in your company wiki",{"data":56286,"marks":56287,"value":56288,"nodeType":865},{},[],", synced from Push’s source of truth.",{"data":56290,"content":56291,"nodeType":1734},{},[56292],{"data":56293,"content":56294,"nodeType":881},{},[56295,56300],{"data":56296,"marks":56297,"value":56299,"nodeType":865},{},[56298],{"type":902},"Force-reset an IdP password if Push finds a compromised password",{"data":56301,"marks":56302,"value":56303,"nodeType":865},{},[]," on an employee account.",{"data":56305,"content":56306,"nodeType":881},{},[56307,56311,56315],{"data":56308,"marks":56309,"value":56310,"nodeType":865},{},[],"To help you visualize and plan how you will use this telemetry, Push also provides an ",{"data":56312,"marks":56313,"value":55800,"nodeType":865},{},[56314],{"type":902},{"data":56316,"marks":56317,"value":56318,"nodeType":865},{},[]," page in the admin console with a rolling 7-day snapshot of all the events in your environment.",{"data":56320,"content":56324,"nodeType":890},{"target":56321},{"sys":56322},{"id":56323,"type":887,"linkType":888},"2a3bJ5sN8dJ0c1kQtZiag7",[],{"data":56326,"content":56327,"nodeType":881},{},[56328],{"data":56329,"marks":56330,"value":56331,"nodeType":865},{},[],"The Events page can help you see real-world examples, understand the attributes of each event, and gauge event volume before you ingest data into a SIEM or other platform.",{"data":56333,"content":56334,"nodeType":904},{},[56335],{"data":56336,"marks":56337,"value":56338,"nodeType":865},{},[],"What if you don’t have a SIEM?",{"data":56340,"content":56341,"nodeType":881},{},[56342],{"data":56343,"marks":56344,"value":56345,"nodeType":865},{},[],"While you’d need a SIEM for writing detections and performing log correlations, you can still get a lot of value out of Push telemetry if you don’t have one.",{"data":56347,"content":56348,"nodeType":881},{},[56349],{"data":56350,"marks":56351,"value":56352,"nodeType":865},{},[],"Use Push’s webhook events to send alerts directly to your Slack, Teams, or other chat platform, or build workflows that hook into your ticketing system or SOAR platform.",{"data":56354,"content":56355,"nodeType":881},{},[56356,56360,56367],{"data":56357,"marks":56358,"value":56359,"nodeType":865},{},[],"Review our ",{"data":56361,"content":56362,"nodeType":876},{"uri":55782},[56363],{"data":56364,"marks":56365,"value":56366,"nodeType":865},{},[],"webhooks documentation",{"data":56368,"marks":56369,"value":56370,"nodeType":865},{},[]," for a list of events.",{"data":56372,"content":56373,"nodeType":904},{},[56374],{"data":56375,"marks":56376,"value":30636,"nodeType":865},{},[],{"data":56378,"content":56379,"nodeType":881},{},[56380,56384,56391],{"data":56381,"marks":56382,"value":56383,"nodeType":865},{},[],"If you want to see Push in action, ",{"data":56385,"content":56387,"nodeType":876},{"uri":56386},"/demo/",[56388],{"data":56389,"marks":56390,"value":1458,"nodeType":865},{},[],{"data":56392,"marks":56393,"value":56394,"nodeType":865},{},[],". We’ll be happy to show you these features, along with how we discover all the apps your employees are using — even the ones not behind SSO.","Introducing set-and-forget controls that stop real-world identity attacks","Enable detections and interventions in the browser using Push’s new security controls.","2024-07-02T00:00:00.000Z","introducing-set-and-forget-controls-that-stop-real-world-identity-attacks",{"items":56400},[56401,56405],{"sys":56402,"name":56404},{"id":56403},"5jk0kqjSdSK2L0YiistQjY","Release notes",{"sys":56406,"name":342},{"id":4510},{"items":56408},[56409],{"fullName":20080,"firstName":20081,"jobTitle":20082,"profilePicture":56410},{"url":20084},{"__typename":1485,"sys":56412,"content":56414,"title":56879,"synopsis":56880,"hashTags":59,"publishedDate":56881,"slug":56882,"tagsCollection":56883,"authorsCollection":56889},{"id":56413},"51p0V5Vr4I9rapUytBWX0R",{"json":56415},{"data":56416,"content":56417,"nodeType":1463},{},[56418,56425,56432,56439,56445,56452,56458,56465,56472,56475,56483,56490,56497,56520,56527,56530,56538,56553,56559,56566,56572,56579,56586,56589,56597,56616,56621,56628,56634,56637,56645,56665,56671,56678,56684,56704,56710,56716,56719,56727,56734,56741,56747,56750,56758,56765,56772,56775,56783,56790,56797,56803,56810,56843,56849,56856,56863],{"data":56419,"content":56420,"nodeType":904},{},[56421],{"data":56422,"marks":56423,"value":18964,"nodeType":865},{},[56424],{"type":902},{"data":56426,"content":56427,"nodeType":881},{},[56428],{"data":56429,"marks":56430,"value":56431,"nodeType":865},{},[],"On April 11th our browser-based phishing detection controls were triggered for a user with the Push extension installed. ",{"data":56433,"content":56434,"nodeType":881},{},[56435],{"data":56436,"marks":56437,"value":56438,"nodeType":865},{},[],"The user had visited the url dashboard[.]onfido[.].us[.]com after entering a Google search for ‘onfido’, a site they had previously accessed for work and had an account on. A convincing looking Google ad duped the user into clicking the fake link.",{"data":56440,"content":56444,"nodeType":890},{"target":56441},{"sys":56442},{"id":56443,"type":887,"linkType":888},"5o1LEkZfeYVjMZmROi3Yh",[],{"data":56446,"content":56447,"nodeType":881},{},[56448],{"data":56449,"marks":56450,"value":56451,"nodeType":865},{},[],"Although the page was not the official login page for Onfido, it appeared legitimate enough at first glance to trick the user. ",{"data":56453,"content":56457,"nodeType":890},{"target":56454},{"sys":56455},{"id":56456,"type":887,"linkType":888},"4Tp1RJ3eSx7r79wwm9d9DZ",[],{"data":56459,"content":56460,"nodeType":881},{},[56461],{"data":56462,"marks":56463,"value":56464,"nodeType":865},{},[],"After clicking the link, the user was blocked from interacting with the malicious page running Evilginx by Push. We then took action to identify other Onfido users within the Push customer base and notify them accordingly of the campaign. ",{"data":56466,"content":56467,"nodeType":881},{},[56468],{"data":56469,"marks":56470,"value":56471,"nodeType":865},{},[],"There are a few interesting elements worth exploring. Let’s dive in. ",{"data":56473,"content":56474,"nodeType":894},{},[],{"data":56476,"content":56477,"nodeType":904},{},[56478],{"data":56479,"marks":56480,"value":56482,"nodeType":865},{},[56481],{"type":902},"Why Onfido?",{"data":56484,"content":56485,"nodeType":881},{},[56486],{"data":56487,"marks":56488,"value":56489,"nodeType":865},{},[],"Onfido is an interesting choice. It’s not your typical phishing target, which points to an interesting trend we’ve observed where attackers are diversifying their phishing targets. ",{"data":56491,"content":56492,"nodeType":881},{},[56493],{"data":56494,"marks":56495,"value":56496,"nodeType":865},{},[],"There are two main reasons for this:",{"data":56498,"content":56499,"nodeType":1818},{},[56500,56510],{"data":56501,"content":56502,"nodeType":1734},{},[56503],{"data":56504,"content":56505,"nodeType":881},{},[56506],{"data":56507,"marks":56508,"value":56509,"nodeType":865},{},[],"People are becoming increasingly suspicious of phishing attacks targeting core apps such as Microsoft, Google, Okta, etc. and are much more likely to spot real vs fake pages. ",{"data":56511,"content":56512,"nodeType":1734},{},[56513],{"data":56514,"content":56515,"nodeType":881},{},[56516],{"data":56517,"marks":56518,"value":56519,"nodeType":865},{},[],"Because highly targeted apps like IdPs and enterprise cloud platforms are becoming increasingly hardened from an identity perspective, attackers have a lower chance of success relative to accounts on the long tail of internet apps used by an organization — many of which simply cannot be securely configured in the same way (e.g. no passkey/WebAuthn support, limited admin controls to discover and remediate identity security gaps, etc.). ",{"data":56521,"content":56522,"nodeType":881},{},[56523],{"data":56524,"marks":56525,"value":56526,"nodeType":865},{},[],"Onfido is also an interesting example in that it definitely contains valuable data that attackers can take advantage of. As a digital identity solution, it presents a significant risk from both a personal and company perspective if compromised, with plenty of PII that can be leveraged to extort a victim — and clear bad press (and possible regulator scrutiny) if the data is leaked!",{"data":56528,"content":56529,"nodeType":894},{},[],{"data":56531,"content":56532,"nodeType":904},{},[56533],{"data":56534,"marks":56535,"value":56537,"nodeType":865},{},[56536],{"type":902},"Why Google ads?",{"data":56539,"content":56540,"nodeType":881},{},[56541,56545,56549],{"data":56542,"marks":56543,"value":56544,"nodeType":865},{},[],"The attack is a form of ",{"data":56546,"marks":56547,"value":441,"nodeType":865},{},[56548],{"type":902},{"data":56550,"marks":56551,"value":56552,"nodeType":865},{},[]," where attackers distribute malicious links via ads — in this case, via Google. This is just one example of the many non-email phishing channels that attackers have at their disposal today. ",{"data":56554,"content":56558,"nodeType":890},{"target":56555},{"sys":56556},{"id":56557,"type":887,"linkType":888},"7kfeOKGXEWVL5RW5jFnQBo",[],{"data":56560,"content":56561,"nodeType":881},{},[56562],{"data":56563,"marks":56564,"value":56565,"nodeType":865},{},[],"The use of malvertising has a couple of notable advantages here. Namely, because Google ads do not use the same reputation-based checks as an email security provider does, the attacker can use freshly created domains to conduct the attack. Usually, attackers would aim to take over existing domains with a reputation already built up, or spend 6-12 months bedding in their domains so that they pass mail filters. ",{"data":56567,"content":56571,"nodeType":890},{"target":56568},{"sys":56569},{"id":56570,"type":887,"linkType":888},"499fj1Xark8Bj7iQjv9Vsm",[],{"data":56573,"content":56574,"nodeType":881},{},[56575],{"data":56576,"marks":56577,"value":56578,"nodeType":865},{},[],"But in this case, the domain was registered only shortly before being used. We detected it only a few hours after it had been registered — and it’s already been taken down since (no doubt to be replaced with the next one). This means it’s easy for attackers to spin up these malvertising campaigns at will, without any real forward planning. ",{"data":56580,"content":56581,"nodeType":881},{},[56582],{"data":56583,"marks":56584,"value":56585,"nodeType":865},{},[],"In fact, malvertising doesn’t require much effort on the attacker’s part whatsoever. As a watering hole, you put the link up and wait for the clicks to roll in. Unfortunately, many people Google search for sites that they frequently use rather than accessing via bookmark, opening them up to these kinds of malvertising attacks. ",{"data":56587,"content":56588,"nodeType":894},{},[],{"data":56590,"content":56591,"nodeType":1860},{},[56592],{"data":56593,"marks":56594,"value":56596,"nodeType":865},{},[56595],{"type":902},"No frills ",{"data":56598,"content":56599,"nodeType":881},{},[56600,56604,56612],{"data":56601,"marks":56602,"value":56603,"nodeType":865},{},[],"Unlike many of the other campaigns using MFA-bypass phishing kits we’ve seen in the wild, the attacker put very little effort into obfuscating the malicious page. We’ve seen some using things like Cloudflare Turnstile, CAPTCHA, or even ",{"data":56605,"content":56606,"nodeType":876},{"uri":34650},[56607],{"data":56608,"marks":56609,"value":56611,"nodeType":865},{},[56610],{"type":874},"Consent Phishing for OIDC scopes ",{"data":56613,"marks":56614,"value":56615,"nodeType":865},{},[],"to break sandbox detections and prevent security tools from reaching the malicious content to analyze it. ",{"data":56617,"content":56620,"nodeType":890},{"target":56618},{"sys":56619},{"id":39807,"type":887,"linkType":888},[],{"data":56622,"content":56623,"nodeType":881},{},[56624],{"data":56625,"marks":56626,"value":56627,"nodeType":865},{},[],"That said, there was evidence to suggest that the domain required a specific URL path — namely, the page must be accessed via Google ads to load. When the page was accessed without the correct parameters set, we were forwarded to a nonexistent page within the legitimate onfido.com domain, resulting in a 404 error.",{"data":56629,"content":56633,"nodeType":890},{"target":56630},{"sys":56631},{"id":56632,"type":887,"linkType":888},"658fTppp0l1YkoMERiQ1Oj",[],{"data":56635,"content":56636,"nodeType":894},{},[],{"data":56638,"content":56639,"nodeType":904},{},[56640],{"data":56641,"marks":56642,"value":56644,"nodeType":865},{},[56643],{"type":902},"What’s interesting about the domain?",{"data":56646,"content":56647,"nodeType":881},{},[56648,56652,56661],{"data":56649,"marks":56650,"value":56651,"nodeType":865},{},[],"One of the things that really stood out to us was the hosting domain — ",{"data":56653,"content":56655,"nodeType":876},{"uri":56654},"http://us.com",[56656],{"data":56657,"marks":56658,"value":56660,"nodeType":865},{},[56659],{"type":874},"us.com",{"data":56662,"marks":56663,"value":56664,"nodeType":865},{},[],". Unlike the official government TLD .us, us.com is designed to look and feel legit but does not require any US affiliation or evidence of a US presence. This isn’t a TLD, it’s just a domain selling subdomains within their domain. This means there’s no WHOIS information available on the domains. ",{"data":56666,"content":56670,"nodeType":890},{"target":56667},{"sys":56668},{"id":56669,"type":887,"linkType":888},"7HtOWLePxPclyfODqC0oR",[],{"data":56672,"content":56673,"nodeType":881},{},[56674],{"data":56675,"marks":56676,"value":56677,"nodeType":865},{},[],"This is incredibly deceptive to the user and will fool many people glancing at the link. It doesn’t look as obviously suspicious as your .xyz or .biz and has the feel of a legitimate domain. It’s also incredibly cheap to pick up .us.com domains right now. ",{"data":56679,"content":56683,"nodeType":890},{"target":56680},{"sys":56681},{"id":56682,"type":887,"linkType":888},"5CHWwlH2ZFZiVOQWMpkquy",[],{"data":56685,"content":56686,"nodeType":881},{},[56687,56691,56700],{"data":56688,"marks":56689,"value":56690,"nodeType":865},{},[],"You can find additional information on ",{"data":56692,"content":56694,"nodeType":876},{"uri":56693},"https://urlscan.io/result/0196338c-75ea-720c-a0e4-c2898acc4779/",[56695],{"data":56696,"marks":56697,"value":56699,"nodeType":865},{},[56698],{"type":874},"urlscan",{"data":56701,"marks":56702,"value":56703,"nodeType":865},{},[]," here.",{"data":56705,"content":56709,"nodeType":890},{"target":56706},{"sys":56707},{"id":56708,"type":887,"linkType":888},"6hdBHT8SrC6z7O0gIc7xnh",[],{"data":56711,"content":56715,"nodeType":890},{"target":56712},{"sys":56713},{"id":56714,"type":887,"linkType":888},"3KxFiCeGlk7fVC8k1oo7cX",[],{"data":56717,"content":56718,"nodeType":894},{},[],{"data":56720,"content":56721,"nodeType":904},{},[56722],{"data":56723,"marks":56724,"value":56726,"nodeType":865},{},[56725],{"type":902},"Isn’t Evilginx a red team tool?",{"data":56728,"content":56729,"nodeType":881},{},[56730],{"data":56731,"marks":56732,"value":56733,"nodeType":865},{},[],"Evilginx is nominally a red team tool, but we frequently spot it being used in phishing campaigns against our customers. Evilginx is a great choice for attackers looking to target non-standard web apps because it is capable of emulating a range of domains — it’s designed to be flexible and work for any page without generating a load of custom JavaScript that might stand out to security tools/analysts. ",{"data":56735,"content":56736,"nodeType":881},{},[56737],{"data":56738,"marks":56739,"value":56740,"nodeType":865},{},[],"If you want to see an example of Evilginx being used to phish a user, check out the example below. ",{"data":56742,"content":56746,"nodeType":890},{"target":56743},{"sys":56744},{"id":56745,"type":887,"linkType":888},"7IuP0mcRZJkL8YGNoZo5Dj",[],{"data":56748,"content":56749,"nodeType":894},{},[],{"data":56751,"content":56752,"nodeType":904},{},[56753],{"data":56754,"marks":56755,"value":56757,"nodeType":865},{},[56756],{"type":902},"What can you do about it?",{"data":56759,"content":56760,"nodeType":881},{},[56761],{"data":56762,"marks":56763,"value":56764,"nodeType":865},{},[],"There’s not a huge amount of impartial advice to give here unfortunately. With malicious Google ads not going away anytime soon, response action is limited. If you are an Onfido user, be sure to block the URL and any related patterns (we noticed that after appearing to have been taken down initially, the site has reappeared at dashboard[.]onfido[.]us[.]com/users/sign_in and no longer appears to require the same URL path). However, it goes without saying that this is a temporary measure and the attacker will no doubt rotate the domain in the near future. ",{"data":56766,"content":56767,"nodeType":881},{},[56768],{"data":56769,"marks":56770,"value":56771,"nodeType":865},{},[],"One good option is to encourage your users to bookmark their links rather than Google searching for the page. If you’re using an IdP with an application dashboard like Okta, Microsoft, or Google, this provides a convenient way to find all your apps in one place. ",{"data":56773,"content":56774,"nodeType":894},{},[],{"data":56776,"content":56777,"nodeType":904},{},[56778],{"data":56779,"marks":56780,"value":56782,"nodeType":865},{},[56781],{"type":902},"Bonus: How Push stopped the attack",{"data":56784,"content":56785,"nodeType":881},{},[56786],{"data":56787,"marks":56788,"value":56789,"nodeType":865},{},[],"Interested in how we stopped the attack?",{"data":56791,"content":56792,"nodeType":881},{},[56793],{"data":56794,"marks":56795,"value":56796,"nodeType":865},{},[],"When the user visited the page, Push detected Evilginx running on the page and blocked the user. Check it out.",{"data":56798,"content":56802,"nodeType":890},{"target":56799},{"sys":56800},{"id":56801,"type":887,"linkType":888},"5QavzZPS4siFvHCBhpujEe",[],{"data":56804,"content":56805,"nodeType":881},{},[56806],{"data":56807,"marks":56808,"value":56809,"nodeType":865},{},[],"Using our browser-based security platform, you can also see all users with an account on Onfido across your workforce. Using Push, you can:",{"data":56811,"content":56812,"nodeType":1818},{},[56813,56823,56833],{"data":56814,"content":56815,"nodeType":1734},{},[56816],{"data":56817,"content":56818,"nodeType":881},{},[56819],{"data":56820,"marks":56821,"value":56822,"nodeType":865},{},[],"Quickly identify which users have a password-based login set for their account (and therefore could be phished). ",{"data":56824,"content":56825,"nodeType":1734},{},[56826],{"data":56827,"content":56828,"nodeType":881},{},[56829],{"data":56830,"marks":56831,"value":56832,"nodeType":865},{},[],"Identify users to enable them to be contacted about the attacks targeting Onfido.",{"data":56834,"content":56835,"nodeType":1734},{},[56836],{"data":56837,"content":56838,"nodeType":881},{},[56839],{"data":56840,"marks":56841,"value":56842,"nodeType":865},{},[],"Set an app banner for Onfido warning users of the attacks and guiding them to access and login to the app via your SSO solution. ",{"data":56844,"content":56848,"nodeType":890},{"target":56845},{"sys":56846},{"id":56847,"type":887,"linkType":888},"23B4EHUs1vt0se5r1cUI4t",[],{"data":56850,"content":56851,"nodeType":1860},{},[56852],{"data":56853,"marks":56854,"value":38962,"nodeType":865},{},[56855],{"type":902},{"data":56857,"content":56858,"nodeType":881},{},[56859],{"data":56860,"marks":56861,"value":56862,"nodeType":865},{},[],"It doesn’t stop there — Push provides comprehensive identity attack detection and response capabilities against techniques like credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more. ",{"data":56864,"content":56865,"nodeType":881},{},[56866,56870,56876],{"data":56867,"marks":56868,"value":56869,"nodeType":865},{},[],"If you want to learn more about how Push helps you to detect and defeat advanced identity attack techniques in the browser, ",{"data":56871,"content":56872,"nodeType":876},{"uri":1453},[56873],{"data":56874,"marks":56875,"value":38977,"nodeType":865},{},[],{"data":56877,"marks":56878,"value":40018,"nodeType":865},{},[],"Investigating a recent malvertising campaign targeting Onfido customers","We recently investigated a malvertising campaign using Evilginx to target Onfido customers via Google ads.","2025-04-15T00:00:00.000Z","investigating-a-recent-malvertising-campaign-targeting-onfido-customers",{"items":56884},[56885,56887],{"sys":56886,"name":4507},{"id":4506},{"sys":56888,"name":342},{"id":4510},{"items":56890},[56891],{"fullName":4514,"firstName":4515,"jobTitle":4516,"profilePicture":56892},{"url":4518},"blog/detecting-and-blocking-phishing-attacks-in-the-browser",{"json":56895},{"data":56896,"content":56897,"nodeType":1463},{},[56898,56905,56912],{"data":56899,"content":56900,"nodeType":881},{},[56901],{"data":56902,"marks":56903,"value":56904,"nodeType":865},{},[],"It takes less than two minutes to explain how Push detects and blocks phishing attempts in the browser. ",{"data":56906,"content":56907,"nodeType":881},{},[56908],{"data":56909,"marks":56910,"value":56911,"nodeType":865},{},[],"Do you know what also takes less than two minutes? ",{"data":56913,"content":56914,"nodeType":881},{},[56915],{"data":56916,"marks":56917,"value":56918,"nodeType":865},{},[],"Actually enabling Push’s phishing detection and blocking controls for all your employees! ",{"id":38676,"publishedAt":56920},"2026-08-12T11:54:57.716Z",{"items":56922},[56923,56925],{"sys":56924,"name":4507},{"id":4506},{"sys":56926,"name":342},{"id":4510},{"items":56928},[56929,56931,56933,56935,56937,56939,56941,56943,56945,56947,56949,56951],{"sys":56930,"name":519,"slug":520,"tier":31},{"id":516},{"sys":56932,"name":279,"slug":280,"tier":31},{"id":276},{"sys":56934,"name":297,"slug":298,"tier":31},{"id":294},{"sys":56936,"name":342,"slug":343,"tier":31},{"id":339},{"sys":56938,"name":261,"slug":262,"tier":45},{"id":258},{"sys":56940,"name":324,"slug":325,"tier":45},{"id":321},{"sys":56942,"name":571,"slug":572,"tier":45},{"id":568},{"sys":56944,"name":502,"slug":503,"tier":45},{"id":499},{"sys":56946,"name":351,"slug":352,"tier":45},{"id":348},{"sys":56948,"name":624,"slug":625,"tier":45},{"id":621},{"sys":56950,"name":475,"slug":476,"tier":45},{"id":472},{"sys":56952,"name":493,"slug":494,"tier":45},{"id":490},"BWqTngm_515-EU1cnOXBI788ETG62GxT_LtpSxu_VlE",{"id":56955,"title":56956,"authorsCollection":56957,"content":56962,"extension":228,"faqItemsCollection":57282,"faqTitle":59,"featured":6,"hashTags":59,"meta":57284,"metaTitle":57285,"ogImage":57286,"postType":7216,"publishedDate":57288,"relatedBlogPostsCollection":57289,"slug":60098,"stem":60099,"subtitle":59,"summary":60100,"synopsis":60111,"sys":60112,"tagsCollection":60115,"topicsCollection":60121,"__hash__":60153},"blog/blog/how-many-vulnerable-identities-do-you-have.json","How many vulnerable identities do you have?",{"items":56958},[56959],{"fullName":5373,"firstName":5374,"jobTitle":5375,"socialLinks":56960,"profilePicture":56961},[6440],{"url":5377},{"json":56963,"links":57263},{"data":56964,"content":56965,"nodeType":1463},{},[56966,56973,56980,56987,56994,57001,57008,57015,57021,57028,57035,57042,57049,57056,57075,57082,57089,57106,57113,57124,57131,57160,57167,57174,57181,57188,57193,57200,57207,57214,57221,57228,57234,57252,57257],{"data":56967,"content":56968,"nodeType":881},{},[56969],{"data":56970,"marks":56971,"value":56972,"nodeType":865},{},[],"There are many factors that can make a user account vulnerable to identity-based attack techniques. Using Push data, we calculated how many vulnerable identities the average organization has, showing how different vulnerabilities leave an identity exposed to different methods of account takeover. ",{"data":56974,"content":56975,"nodeType":904},{},[56976],{"data":56977,"marks":56978,"value":56979,"nodeType":865},{},[],"Our dataset",{"data":56981,"content":56982,"nodeType":881},{},[56983],{"data":56984,"marks":56985,"value":56986,"nodeType":865},{},[],"This analysis is based on a snapshot of when organizations begin using the Push platform, once enrollment has completed. Data from trial and partially deployed organizations is excluded. ",{"data":56988,"content":56989,"nodeType":881},{},[56990],{"data":56991,"marks":56992,"value":56993,"nodeType":865},{},[],"Early adopters of new identity security products like Push are likely to have a higher than average level of maturity in this area – even prior to using Push. So, the findings may not be accurate for all organizations, particularly those with lower awareness of identity security challenges. ",{"data":56995,"content":56996,"nodeType":881},{},[56997],{"data":56998,"marks":56999,"value":57000,"nodeType":865},{},[],"It’s also worth noting that passwordless authentication makes up a very small percentage of the overall authentication factors detected. If you’re in the minority of organizations that have widely adopted something like passkeys or biometric authentication, your identity posture will probably look quite different. But, you should still be wary of backup phishable factors and SSO gaps – more on this below.",{"data":57002,"content":57003,"nodeType":904},{},[57004],{"data":57005,"marks":57006,"value":57007,"nodeType":865},{},[],"Identity configurations and how they can be exploited",{"data":57009,"content":57010,"nodeType":881},{},[57011],{"data":57012,"marks":57013,"value":57014,"nodeType":865},{},[],"We analyzed a sample dataset of 300,000 accounts and the associated login methods – this is what we found. ",{"data":57016,"content":57020,"nodeType":890},{"target":57017},{"sys":57018},{"id":57019,"type":887,"linkType":888},"2QnWVpPYRyJQaQ5TuKSSLp",[],{"data":57022,"content":57023,"nodeType":881},{},[57024],{"data":57025,"marks":57026,"value":57027,"nodeType":865},{},[],"Some of the key insights are explored below. ",{"data":57029,"content":57030,"nodeType":1860},{},[57031],{"data":57032,"marks":57033,"value":57034,"nodeType":865},{},[],"Organizations are using more apps and identities than they realize",{"data":57036,"content":57037,"nodeType":881},{},[57038],{"data":57039,"marks":57040,"value":57041,"nodeType":865},{},[],"On average, each employee has ~15 identities tied to the business apps that they use, and each organization uses ~220 apps. The number of apps per organization doesn't show a strong correlation with the size of the organization. But, the number of accounts per user does tend to be lower for organizations with a larger employee base. ",{"data":57043,"content":57044,"nodeType":1860},{},[57045],{"data":57046,"marks":57047,"value":57048,"nodeType":865},{},[],"Many accounts lack the most basic protections",{"data":57050,"content":57051,"nodeType":881},{},[57052],{"data":57053,"marks":57054,"value":57055,"nodeType":865},{},[],"37% of all accounts do not have MFA set, while ~9% of accounts with a password also have a breached, weak, or reused password, making them highly susceptible to account takeover. ",{"data":57057,"content":57058,"nodeType":881},{},[57059,57063,57071],{"data":57060,"marks":57061,"value":57062,"nodeType":865},{},[],"This might not seem that high at face value – but it’s enough that attackers can feasibly take over accounts linked to every business app used in the organization just by abusing password vulnerabilities through attacks like ",{"data":57064,"content":57066,"nodeType":876},{"uri":57065},"https://pushsecurity.com/blog/what-is-credential-stuffing/",[57067],{"data":57068,"marks":57069,"value":53607,"nodeType":865},{},[57070],{"type":874},{"data":57072,"marks":57073,"value":57074,"nodeType":865},{},[],". For a 1,000 user organization, this leaves them with 1,367 user accounts that are highly vulnerable to account takeover.",{"data":57076,"content":57077,"nodeType":881},{},[57078],{"data":57079,"marks":57080,"value":57081,"nodeType":865},{},[],"The situation gets worse when a password is the sole login method set, with these accounts lacking MFA in 4 out of 5 cases. ",{"data":57083,"content":57084,"nodeType":1860},{},[57085],{"data":57086,"marks":57087,"value":57088,"nodeType":865},{},[],"SSO is not a silver bullet",{"data":57090,"content":57091,"nodeType":881},{},[57092,57096,57103],{"data":57093,"marks":57094,"value":57095,"nodeType":865},{},[],"SSO can be used to reduce an organization's susceptibility to password-based attacks, but the vast majority (97%) of SSO logins track back to an original password login to an IdP (due to the marginal use of passwordless authentication) while in 10% of cases a local password login is set alongside SSO – potentially introducing ",{"data":57097,"content":57098,"nodeType":876},{"uri":16924},[57099],{"data":57100,"marks":57101,"value":11122,"nodeType":865},{},[57102],{"type":874},{"data":57104,"marks":57105,"value":959,"nodeType":865},{},[],{"data":57107,"content":57108,"nodeType":881},{},[57109],{"data":57110,"marks":57111,"value":57112,"nodeType":865},{},[],"You might expect these password-based logins to be highly scrutinized due to the criticality of these accounts – but we found that 1 in 5 IdP accounts is missing MFA, and a non-unique password is present for 10% of IdP accounts (meaning that if the same username and password combination is compromised on another app, the risk of a lateral account compromise is much higher). ",{"data":57114,"content":57115,"nodeType":881},{},[57116,57120],{"data":57117,"marks":57118,"value":57119,"nodeType":865},{},[],"Since Microsoft, Okta, and Google IdP accounts are the most targeted identities by attackers due to their value if compromised, these accounts are under a huge amount of pressure from attackers – ",{"data":57121,"marks":57122,"value":57123,"nodeType":865},{},[],"multiplying the risk to single factor authentication IdP accounts.",{"data":57125,"content":57126,"nodeType":1860},{},[57127],{"data":57128,"marks":57129,"value":57130,"nodeType":865},{},[],"Pretty much all identities can be phished",{"data":57132,"content":57133,"nodeType":881},{},[57134,57138,57146,57150,57156],{"data":57135,"marks":57136,"value":57137,"nodeType":865},{},[],"Almost all identities (~99%) are susceptible to phishing attacks – either because MFA is missing, or the types of MFA implemented are weak to modern phishing attacks such as ",{"data":57139,"content":57140,"nodeType":876},{"uri":28776},[57141],{"data":57142,"marks":57143,"value":57145,"nodeType":865},{},[57144],{"type":874},"Adversary in the Middle (AitM) phishing kits",{"data":57147,"marks":57148,"value":57149,"nodeType":865},{},[],", or techniques such as ",{"data":57151,"content":57152,"nodeType":876},{"uri":11059},[57153],{"data":57154,"marks":57155,"value":11064,"nodeType":865},{},[],{"data":57157,"marks":57158,"value":57159,"nodeType":865},{},[],". The most common MFA methods are phone call, push notification, and one-time passcode – all of which are phishable or bypassable. ",{"data":57161,"content":57162,"nodeType":881},{},[57163],{"data":57164,"marks":57165,"value":57166,"nodeType":865},{},[],"Even in the small number of cases where we identified a passwordless authentication method that is regarded as phishing-resistant (e.g. passkeys, biometrics, etc.) there is a backup, phishable method set for over half of them. ",{"data":57168,"content":57169,"nodeType":904},{},[57170],{"data":57171,"marks":57172,"value":57173,"nodeType":865},{},[],"So... what does this mean in real terms? ",{"data":57175,"content":57176,"nodeType":881},{},[57177],{"data":57178,"marks":57179,"value":57180,"nodeType":865},{},[],"The main conclusion from the data is that identity vulnerabilities exist almost everywhere. Some are certainly more likely to be exploited than others (e.g. an account with a reused password and no MFA is a higher risk than an account with MFA) but attackers have the means to take over most accounts using widely available tooling and know-how. ",{"data":57182,"content":57183,"nodeType":881},{},[57184],{"data":57185,"marks":57186,"value":57187,"nodeType":865},{},[],"To bring this to life, here’s an infographic representing the identity attack surface for a 1,000 seat organization. ",{"data":57189,"content":57192,"nodeType":890},{"target":57190},{"sys":57191},{"id":30365,"type":887,"linkType":888},[],{"data":57194,"content":57195,"nodeType":881},{},[57196],{"data":57197,"marks":57198,"value":57199,"nodeType":865},{},[],"This shows that investing in your identity security baseline only gets you so far – ultimately, you need to be prepared to detect and respond to attacks rather than relying on prevention alone. That said, progress over perfection should always be the aim when it comes to posture management, and shoring up your identity vulnerabilities is an important long-term project. ",{"data":57201,"content":57202,"nodeType":904},{},[57203],{"data":57204,"marks":57205,"value":57206,"nodeType":865},{},[],"Detection and response is the key",{"data":57208,"content":57209,"nodeType":881},{},[57210],{"data":57211,"marks":57212,"value":57213,"nodeType":865},{},[],"Looking at the scale of the challenge, it’s pretty clear that completely scrubbing your workforce identities of all possible vulnerabilities isn’t really an achievable goal. A strong baseline is important, but it will only ever get you so far. Rather than playing whack-a-mole, organizations need to prepare to detect and respond to the techniques and tools being used by attackers when they exploit these vulnerabilities.  ",{"data":57215,"content":57216,"nodeType":881},{},[57217],{"data":57218,"marks":57219,"value":57220,"nodeType":865},{},[],"This is nothing new – this approach has been preached by security operations leaders for more than a decade. But until now, identity security has been much more focused on prevention than detection and response. And with attackers increasingly turning to identity attacks, the sheer volume of identity vulnerabilities (and the rate that they are introduced) means that posture management alone isn’t sufficient.",{"data":57222,"content":57223,"nodeType":881},{},[57224],{"data":57225,"marks":57226,"value":57227,"nodeType":865},{},[],"Like endpoint and network security before, you can no longer rely on prevention alone, and organizations need to ensure they can detect and respond to indicators of identity attacks to be able to manage the risk effectively. ",{"data":57229,"content":57230,"nodeType":904},{},[57231],{"data":57232,"marks":57233,"value":5936,"nodeType":865},{},[],{"data":57235,"content":57236,"nodeType":881},{},[57237,57241,57249],{"data":57238,"marks":57239,"value":57240,"nodeType":865},{},[],"Push helps organizations to detect and prevent identity attacks as they happen, by intercepting and shutting down attacks in the browser. It also provides valuable data to find and fix identity vulnerabilities before they can be exploited. ",{"data":57242,"content":57243,"nodeType":876},{"uri":6048},[57244],{"data":57245,"marks":57246,"value":57248,"nodeType":865},{},[57247],{"type":874},"Book a demo here to find out more.",{"data":57250,"marks":57251,"value":21,"nodeType":865},{},[],{"data":57253,"content":57256,"nodeType":890},{"target":57254},{"sys":57255},{"id":48230,"type":887,"linkType":888},[],{"data":57258,"content":57259,"nodeType":881},{},[57260],{"data":57261,"marks":57262,"value":21,"nodeType":865},{},[],{"entries":57264},{"hyperlink":57265,"inline":57266,"block":57267},[],[],[57268,57275,57278],{"sys":57269,"__typename":7008,"title":57270,"caption":57271,"layoutMode":59,"file":57272},{"id":57019},"Sankey","How identity vulnerabilities are introduced based on account authentication methods, and how they can be exploited using different attack techniques.",{"url":57273,"width":57274,"height":57274},"https://images.ctfassets.net/y1cdw1ablpvd/55oogXnSqSaDWXvUS0QhES/9e14e2456093c868881578a02d925e29/Sankey_chart_-_Final.png",4320,{"sys":57276,"__typename":7008,"title":30705,"caption":30706,"layoutMode":59,"file":57277},{"id":30365},{"url":30708,"width":30709,"height":30710},{"sys":57279,"__typename":1471,"type":50249,"ctaText":57280,"buttonLabel":57281,"buttonColour":1475,"buttonUrl":59},{"id":48230},"Book a demo to see how Push stops account takeover","Book demo",{"items":57283},[],{},"Using Push data to quantify identity vulnerabilities",{"url":57287},"https://images.ctfassets.net/y1cdw1ablpvd/7v4Zx9Ac2V6txIpDbp0WU4/ae2916d0cd69f4f7e47bf0fc1cff07d3/Sankey_chart_-_cropped_-_higher_res__1_.png","2024-10-15T00:00:00.000Z",{"items":57290},[57291,58445,59674],{"__typename":1485,"sys":57292,"content":57294,"title":58431,"synopsis":58432,"hashTags":59,"publishedDate":58433,"slug":58434,"tagsCollection":58435,"authorsCollection":58441},{"id":57293},"4OrixXXLxRmSDxa7PF9gfM",{"json":57295},{"data":57296,"content":57297,"nodeType":1463},{},[57298,57330,57342,57358,57365,57372,57375,57382,57389,57509,57516,57523,57617,57624,57631,57684,57691,57714,57771,57774,57781,57800,57820,57827,57846,57853,57865,57868,57875,57882,57930,57937,57944,57962,57965,57972,57979,57986,58005,58012,58019,58026,58046,58053,58060,58067,58074,58093,58100,58107,58114,58121,58150,58156,58159,58166,58173,58179,58186,58193,58216,58223,58230,58273,58289,58308,58314,58321,58328,58335,58367,58412,58419,58425],{"data":57299,"content":57300,"nodeType":881},{},[57301,57305,57314,57318,57326],{"data":57302,"marks":57303,"value":57304,"nodeType":865},{},[],"Infostealer malware seems to be grabbing the headlines right now. It’s easy to see why, too, after laying claim to one of the ",{"data":57306,"content":57308,"nodeType":876},{"uri":57307},"https://www.wired.com/story/snowflake-breach-advanced-auto-parts-lendingtree/",[57309],{"data":57310,"marks":57311,"value":57313,"nodeType":865},{},[57312],{"type":874},"biggest breaches in history",{"data":57315,"marks":57316,"value":57317,"nodeType":865},{},[],". The ",{"data":57319,"content":57320,"nodeType":876},{"uri":5072},[57321],{"data":57322,"marks":57323,"value":57325,"nodeType":865},{},[57324],{"type":874},"recent attacks on Snowflake customers",{"data":57327,"marks":57328,"value":57329,"nodeType":865},{},[]," saw ~165 businesses compromised using stolen credentials, resulting in millions of breached customer records, with the full impact still emerging. ",{"data":57331,"content":57332,"nodeType":881},{},[57333,57337],{"data":57334,"marks":57335,"value":57336,"nodeType":865},{},[],"Notably, ",{"data":57338,"marks":57339,"value":57341,"nodeType":865},{},[57340],{"type":902},"80% of the credentials used to access Snowflake customer accounts had found their way online after being stolen in infostealer infections – dating back as early as 2020. ",{"data":57343,"content":57344,"nodeType":881},{},[57345,57349,57354],{"data":57346,"marks":57347,"value":57348,"nodeType":865},{},[],"The Snowflake situation is a reminder of how lucrative stolen credentials can be for attackers – and how the cybercrime ecosystem has tilted as a result. As the saying goes nowadays, ",{"data":57350,"marks":57351,"value":57353,"nodeType":865},{},[57352],{"type":902},"hackers don’t hack in, they log in",{"data":57355,"marks":57356,"value":57357,"nodeType":865},{},[],". Stolen credentials are the lowest hanging fruit available to attackers, and their appetite (and the ecosystem needed to feed it) is insatiable. As an attacker, the prospect of picking up access to a major enterprise for just $10 or less (or even for free) is hard to resist – why wouldn’t you buy a ticket and take the gamble?  ",{"data":57359,"content":57360,"nodeType":881},{},[57361],{"data":57362,"marks":57363,"value":57364,"nodeType":865},{},[],"Infostealers are a huge part of the shift toward identity attacks. Along with phishing, infostealers are the primary mechanism for attackers to harvest credentials. Unlike phishing, infostealers can collect a large number of credentials (and other helpful data saved in the browser) in one fell swoop. But, they do have limitations. For example, you would expect any credible EDR to detect and block these attacks. And yet, the success of the attacks on Snowflake customers show us that gaps are being found and exploited.  ",{"data":57366,"content":57367,"nodeType":881},{},[57368],{"data":57369,"marks":57370,"value":57371,"nodeType":865},{},[],"In this article, we’ll look at the history of infostealers, how they work, and what the trends show us about how the cybercrime ecosystem is leaning into the opportunity they present.    ",{"data":57373,"content":57374,"nodeType":894},{},[],{"data":57376,"content":57377,"nodeType":904},{},[57378],{"data":57379,"marks":57380,"value":57381,"nodeType":865},{},[],"The state of infostealers today",{"data":57383,"content":57384,"nodeType":881},{},[57385],{"data":57386,"marks":57387,"value":57388,"nodeType":865},{},[],"Infostealers, and the mass credential harvesting they enable, are a big part of the rise in identity attacks. The stats support this, as:",{"data":57390,"content":57391,"nodeType":1818},{},[57392,57411,57430,57451,57470,57489],{"data":57393,"content":57394,"nodeType":1734},{},[57395],{"data":57396,"content":57397,"nodeType":881},{},[57398,57401,57408],{"data":57399,"marks":57400,"value":54040,"nodeType":865},{},[],{"data":57402,"content":57403,"nodeType":876},{"uri":54043},[57404],{"data":57405,"marks":57406,"value":54049,"nodeType":865},{},[57407],{"type":874},{"data":57409,"marks":57410,"value":30302,"nodeType":865},{},[],{"data":57412,"content":57413,"nodeType":1734},{},[57414],{"data":57415,"content":57416,"nodeType":881},{},[57417,57420,57427],{"data":57418,"marks":57419,"value":45017,"nodeType":865},{},[],{"data":57421,"content":57422,"nodeType":876},{"uri":45020},[57423],{"data":57424,"marks":57425,"value":45026,"nodeType":865},{},[57426],{"type":874},{"data":57428,"marks":57429,"value":30302,"nodeType":865},{},[],{"data":57431,"content":57432,"nodeType":1734},{},[57433],{"data":57434,"content":57435,"nodeType":881},{},[57436,57440,57448],{"data":57437,"marks":57438,"value":57439,"nodeType":865},{},[],"147,000 token replay attacks were detected by Microsoft in 2023, an 111% increase year-over-year (",{"data":57441,"content":57443,"nodeType":876},{"uri":57442},"https://techcommunity.microsoft.com/t5/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/ba-p/4062700",[57444],{"data":57445,"marks":57446,"value":1718,"nodeType":865},{},[57447],{"type":874},{"data":57449,"marks":57450,"value":42926,"nodeType":865},{},[],{"data":57452,"content":57453,"nodeType":1734},{},[57454],{"data":57455,"content":57456,"nodeType":881},{},[57457,57460,57467],{"data":57458,"marks":57459,"value":54020,"nodeType":865},{},[],{"data":57461,"content":57462,"nodeType":876},{"uri":41391},[57463],{"data":57464,"marks":57465,"value":11582,"nodeType":865},{},[57466],{"type":874},{"data":57468,"marks":57469,"value":30302,"nodeType":865},{},[],{"data":57471,"content":57472,"nodeType":1734},{},[57473],{"data":57474,"content":57475,"nodeType":881},{},[57476,57480,57486],{"data":57477,"marks":57478,"value":57479,"nodeType":865},{},[],"Nearly half of the malware detected last year by Sophos targeted victims’ data specifically, and the majority of that malware was classified as infostealers (",{"data":57481,"content":57482,"nodeType":876},{"uri":45042},[57483],{"data":57484,"marks":57485,"value":45048,"nodeType":865},{},[],{"data":57487,"marks":57488,"value":30302,"nodeType":865},{},[],{"data":57490,"content":57491,"nodeType":1734},{},[57492],{"data":57493,"content":57494,"nodeType":881},{},[57495,57499,57506],{"data":57496,"marks":57497,"value":57498,"nodeType":865},{},[],"Attacks on session cookies happen at the same order of magnitude as password-based attacks (",{"data":57500,"content":57501,"nodeType":876},{"uri":45084},[57502],{"data":57503,"marks":57504,"value":36131,"nodeType":865},{},[57505],{"type":874},{"data":57507,"marks":57508,"value":30302,"nodeType":865},{},[],{"data":57510,"content":57511,"nodeType":1860},{},[57512],{"data":57513,"marks":57514,"value":57515,"nodeType":865},{},[],"How did we get here?",{"data":57517,"content":57518,"nodeType":881},{},[57519],{"data":57520,"marks":57521,"value":57522,"nodeType":865},{},[],"Let’s go back to the beginning. When they first emerged, infostealers were designed to steal online banking and credit card information. The most notable early example comes from as far back as 2006 with the ZeuS trojan. After the ZeuS source code was leaked in March 2011, the creation of multiple variants boosted the popularity of this type of malware and inspired the development of infostealers with increasingly sophisticated capabilities.",{"data":57524,"content":57525,"nodeType":881},{},[57526,57530,57539,57543,57552,57556,57565,57568,57577,57580,57589,57592,57601,57604,57613],{"data":57527,"marks":57528,"value":57529,"nodeType":865},{},[],"Modern infostealers rose to prominence in around 2018 with the emergence of ",{"data":57531,"content":57533,"nodeType":876},{"uri":57532},"https://malpedia.caad.fkie.fraunhofer.de/details/win.arkei_stealer",[57534],{"data":57535,"marks":57536,"value":57538,"nodeType":865},{},[57537],{"type":874},"Arkei",{"data":57540,"marks":57541,"value":57542,"nodeType":865},{},[],", which quickly spawned the more popular ",{"data":57544,"content":57546,"nodeType":876},{"uri":57545},"https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar",[57547],{"data":57548,"marks":57549,"value":57551,"nodeType":865},{},[57550],{"type":874},"Vidar",{"data":57553,"marks":57554,"value":57555,"nodeType":865},{},[]," stealer. Today, some of the most popular families are ",{"data":57557,"content":57559,"nodeType":876},{"uri":57558},"https://malpedia.caad.fkie.fraunhofer.de/details/win.risepro",[57560],{"data":57561,"marks":57562,"value":57564,"nodeType":865},{},[57563],{"type":874},"RisePro",{"data":57566,"marks":57567,"value":1877,"nodeType":865},{},[],{"data":57569,"content":57571,"nodeType":876},{"uri":57570},"https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer",[57572],{"data":57573,"marks":57574,"value":57576,"nodeType":865},{},[57575],{"type":874},"RedLine",{"data":57578,"marks":57579,"value":1877,"nodeType":865},{},[],{"data":57581,"content":57583,"nodeType":876},{"uri":57582},"https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc",[57584],{"data":57585,"marks":57586,"value":57588,"nodeType":865},{},[57587],{"type":874},"StealC",{"data":57590,"marks":57591,"value":1877,"nodeType":865},{},[],{"data":57593,"content":57595,"nodeType":876},{"uri":57594},"https://malpedia.caad.fkie.fraunhofer.de/details/win.raccoon",[57596],{"data":57597,"marks":57598,"value":57600,"nodeType":865},{},[57599],{"type":874},"Raccoon",{"data":57602,"marks":57603,"value":1791,"nodeType":865},{},[],{"data":57605,"content":57607,"nodeType":876},{"uri":57606},"https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma",[57608],{"data":57609,"marks":57610,"value":57612,"nodeType":865},{},[57611],{"type":874},"Lumma",{"data":57614,"marks":57615,"value":57616,"nodeType":865},{},[],", with new variants and families appearing all the time. ",{"data":57618,"content":57619,"nodeType":881},{},[57620],{"data":57621,"marks":57622,"value":57623,"nodeType":865},{},[],"Infostealers are used by all manner of threat actors of varying levels of sophistication. For larger groups with sufficient resources, the creation of new, custom stealers and malware packages is a common tactic to attempt to evade detection. ",{"data":57625,"content":57626,"nodeType":881},{},[57627],{"data":57628,"marks":57629,"value":57630,"nodeType":865},{},[],"But despite all the variants, infostealers do have common capabilities and characteristics, such as:",{"data":57632,"content":57633,"nodeType":1818},{},[57634,57644,57654,57664,57674],{"data":57635,"content":57636,"nodeType":1734},{},[57637],{"data":57638,"content":57639,"nodeType":881},{},[57640],{"data":57641,"marks":57642,"value":57643,"nodeType":865},{},[],"Extracting information from the browsers of a compromised device, such as passwords, cookies, autofill information, downloaded file information.",{"data":57645,"content":57646,"nodeType":1734},{},[57647],{"data":57648,"content":57649,"nodeType":881},{},[57650],{"data":57651,"marks":57652,"value":57653,"nodeType":865},{},[],"Snapshotting the desktop and system inventory, with details such as the username, location data, hardware configuration, and information regarding installed security software.",{"data":57655,"content":57656,"nodeType":1734},{},[57657],{"data":57658,"content":57659,"nodeType":881},{},[57660],{"data":57661,"marks":57662,"value":57663,"nodeType":865},{},[],"Sending stolen data back to a C2 server.",{"data":57665,"content":57666,"nodeType":1734},{},[57667],{"data":57668,"content":57669,"nodeType":881},{},[57670],{"data":57671,"marks":57672,"value":57673,"nodeType":865},{},[],"Facilitating the deployment of additional tools and malware as part of a package. ",{"data":57675,"content":57676,"nodeType":1734},{},[57677],{"data":57678,"content":57679,"nodeType":881},{},[57680],{"data":57681,"marks":57682,"value":57683,"nodeType":865},{},[],"Often (but not always) self-terminating once complete, leaving little trace on the victim machine and no ongoing behavior that might be detected. ",{"data":57685,"content":57686,"nodeType":881},{},[57687],{"data":57688,"marks":57689,"value":57690,"nodeType":865},{},[],"Infostealers are distributed in similar ways to other types of malware, such as:",{"data":57692,"content":57693,"nodeType":1818},{},[57694,57704],{"data":57695,"content":57696,"nodeType":1734},{},[57697],{"data":57698,"content":57699,"nodeType":881},{},[57700],{"data":57701,"marks":57702,"value":57703,"nodeType":865},{},[],"Delivery of malicious executable files via phishing emails or by having a victim download content from a malicious website. ",{"data":57705,"content":57706,"nodeType":1734},{},[57707],{"data":57708,"content":57709,"nodeType":881},{},[57710],{"data":57711,"marks":57712,"value":57713,"nodeType":865},{},[],"‘Drive-by’ style attacks where the victim has only to visit an infected website.",{"data":57715,"content":57716,"nodeType":881},{},[57717,57721,57730,57733,57742,57745,57754,57758,57767],{"data":57718,"marks":57719,"value":57720,"nodeType":865},{},[],"They’re typically spread via malvertising, P2P downloads, and deceptive software download sites. ",{"data":57722,"content":57724,"nodeType":876},{"uri":57723},"https://www.bleepingcomputer.com/news/security/fake-cheat-lures-gamers-into-spreading-infostealer-malware/",[57725],{"data":57726,"marks":57727,"value":57729,"nodeType":865},{},[57728],{"type":874},"Gaming forums",{"data":57731,"marks":57732,"value":1877,"nodeType":865},{},[],{"data":57734,"content":57736,"nodeType":876},{"uri":57735},"https://cybersecuritynews.com/facebook-account-hijack-malware/",[57737],{"data":57738,"marks":57739,"value":57741,"nodeType":865},{},[57740],{"type":874},"Facebook ads",{"data":57743,"marks":57744,"value":1791,"nodeType":865},{},[],{"data":57746,"content":57748,"nodeType":876},{"uri":57747},"https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube",[57749],{"data":57750,"marks":57751,"value":57753,"nodeType":865},{},[57752],{"type":874},"YouTube video descriptions",{"data":57755,"marks":57756,"value":57757,"nodeType":865},{},[]," are popular locations for malicious links, but recent examples also include ",{"data":57759,"content":57761,"nodeType":876},{"uri":57760},"https://www.bleepingcomputer.com/news/security/over-3-000-github-accounts-used-by-malware-distribution-service/",[57762],{"data":57763,"marks":57764,"value":57766,"nodeType":865},{},[57765],{"type":874},"complex malware distribution networks on GitHub",{"data":57768,"marks":57769,"value":57770,"nodeType":865},{},[]," – such as the recent campaign from ‘Stargazer Goblin’ with more than 3,000 fake accounts creating and promoting hundreds of fake repositories to increase their apparent legitimacy and make them more likely to appear on GitHub's trending section.",{"data":57772,"content":57773,"nodeType":894},{},[],{"data":57775,"content":57776,"nodeType":904},{},[57777],{"data":57778,"marks":57779,"value":57780,"nodeType":865},{},[],"Infostealers are key to the cybercrime ecosystem",{"data":57782,"content":57783,"nodeType":881},{},[57784,57788,57796],{"data":57785,"marks":57786,"value":57787,"nodeType":865},{},[],"After being stolen, ",{"data":57789,"content":57790,"nodeType":876},{"uri":54043},[57791],{"data":57792,"marks":57793,"value":57795,"nodeType":865},{},[57794],{"type":874},"infostealer data inevitably finds its way onto hacker forums and marketplaces",{"data":57797,"marks":57798,"value":57799,"nodeType":865},{},[],", both on the clearweb and darkweb. Popular infostealers have their own dedicated Telegram channels to advertise and sell stolen data. Private channels also exist, with the channel owner distributing tens of thousands of logs per week to a limited number of threat actors who pay $200-$400 for access to the channel. This allows them to get ‘first pick’ of stolen logs, which are later shared through public Telegram channels. ",{"data":57801,"content":57802,"nodeType":881},{},[57803,57807,57816],{"data":57804,"marks":57805,"value":57806,"nodeType":865},{},[],"Public data eventually makes its way onto services such as Have I Been Pwned (HIBP), which gives individuals and security teams some visibility of which credentials have been compromised. For example, ",{"data":57808,"content":57810,"nodeType":876},{"uri":57809},"https://www.troyhunt.com/telegram-combolists-and-361m-email-addresses/",[57811],{"data":57812,"marks":57813,"value":57815,"nodeType":865},{},[57814],{"type":874},"in June, Troy Hunt (creator of HIBP) wrote",{"data":57817,"marks":57818,"value":57819,"nodeType":865},{},[]," about the impact of channels like Telegram and the sale of combolists (username, password, login portal URL), after being sent 122GB of data scraped out of thousands of Telegram channels, containing 361M unique email addresses (of which 151M had never been seen in HIBP before). ",{"data":57821,"content":57822,"nodeType":881},{},[57823],{"data":57824,"marks":57825,"value":57826,"nodeType":865},{},[],"The cybercrime ecosystem is complex, with a developed supply chain and organizations fulfilling different roles as a result: from malware-as-a-service developers, to initial access brokers, to the operators that actually conduct the attacks (be they ransomware, data theft, etc.) – and many, many other roles in between. Sometimes, a single group and/or its affiliates will conduct the full chain, but this is far less common today. ",{"data":57828,"content":57829,"nodeType":881},{},[57830,57833,57842],{"data":57831,"marks":57832,"value":21,"nodeType":865},{},[],{"data":57834,"content":57836,"nodeType":876},{"uri":57835},"https://www.secureworks.com/research/the-growing-threat-from-infostealers",[57837],{"data":57838,"marks":57839,"value":57841,"nodeType":865},{},[57840],{"type":874},"Infostealers are often sold by malware developers to other attackers as a monthly subscription service.",{"data":57843,"marks":57844,"value":57845,"nodeType":865},{},[]," The price can range from $50 to over $1,000 USD per month for access to a stealer command and control (C2) server operated by the developer. The service often features a range of support functions, including multiple ways to view, download, and share stolen data. Self-hosted stealer C2 servers are also available and are usually sold for a flat fee. ",{"data":57847,"content":57848,"nodeType":881},{},[57849],{"data":57850,"marks":57851,"value":57852,"nodeType":865},{},[],"There’s also evidence that there is an element of target coordination – with one marketplace, Russian Market, allowing users to ‘preorder’ credentials for a $1,000 USD deposit from 2022. ",{"data":57854,"content":57855,"nodeType":881},{},[57856,57861],{"data":57857,"marks":57858,"value":57860,"nodeType":865},{},[57859],{"type":902},"So what? Well, there's evidently an abundance of breached data already online, and attackers have the tools readily available to have this pile grow exponentially bigger and more useful.",{"data":57862,"marks":57863,"value":57864,"nodeType":865},{},[]," It’s also probably more coordinated than we like to admit – a particularly intimidating prospect in the wake of Snowflake, which will no doubt have many criminals smelling blood in the water. ",{"data":57866,"content":57867,"nodeType":894},{},[],{"data":57869,"content":57870,"nodeType":904},{},[57871],{"data":57872,"marks":57873,"value":57874,"nodeType":865},{},[],"How can stolen data be abused by attackers? ",{"data":57876,"content":57877,"nodeType":881},{},[57878],{"data":57879,"marks":57880,"value":57881,"nodeType":865},{},[],"It’s pretty obvious that attackers getting access to all of your passwords and session cookies is bad, but there is a clear value hierarchy from a corporate security perspective. So, from highest to lowest risk:",{"data":57883,"content":57884,"nodeType":1818},{},[57885,57900,57915],{"data":57886,"content":57887,"nodeType":1734},{},[57888],{"data":57889,"content":57890,"nodeType":881},{},[57891,57896],{"data":57892,"marks":57893,"value":57895,"nodeType":865},{},[57894],{"type":902},"Stolen session cookies",{"data":57897,"marks":57898,"value":57899,"nodeType":865},{},[]," simply need to be imported into an attacker’s browser to resume an active session on an app. That means access can be gained without needing to enter a username and password, or pass any MFA checks. ",{"data":57901,"content":57902,"nodeType":1734},{},[57903],{"data":57904,"content":57905,"nodeType":881},{},[57906,57911],{"data":57907,"marks":57908,"value":57910,"nodeType":865},{},[57909],{"type":902},"Stolen usernames, passwords",{"data":57912,"marks":57913,"value":57914,"nodeType":865},{},[],", and login page URLs can be used to access any accounts that lack MFA. ",{"data":57916,"content":57917,"nodeType":1734},{},[57918],{"data":57919,"content":57920,"nodeType":881},{},[57921,57926],{"data":57922,"marks":57923,"value":57925,"nodeType":865},{},[57924],{"type":902},"Stolen autofill data",{"data":57927,"marks":57928,"value":57929,"nodeType":865},{},[]," can be used to gather other valuable information that could be useful for impersonating the victim when speaking to social engineering IT support staff, for example to reset or remove MFA.",{"data":57931,"content":57932,"nodeType":881},{},[57933],{"data":57934,"marks":57935,"value":57936,"nodeType":865},{},[],"Naturally, stolen session cookies are the most valuable prize, but they are often valid for only a limited time before the user must re-authenticate, and active sessions can often be terminated by security admins. Unfortunately, it’s not that uncommon for sessions to last for up to a month, or even sometimes indefinitely.",{"data":57938,"content":57939,"nodeType":881},{},[57940],{"data":57941,"marks":57942,"value":57943,"nodeType":865},{},[],"Stolen usernames and passwords are a different story. As the Snowflake breaches demonstrate, passwords can remain valid for years after a breach, particularly in the world of SaaS apps where mandatory password rotation is not as common as for a user’s primary domain account.",{"data":57945,"content":57946,"nodeType":881},{},[57947,57951,57958],{"data":57948,"marks":57949,"value":57950,"nodeType":865},{},[],"There’s also the problem of ",{"data":57952,"content":57953,"nodeType":876},{"uri":16924},[57954],{"data":57955,"marks":57956,"value":11122,"nodeType":865},{},[57957],{"type":874},{"data":57959,"marks":57960,"value":57961,"nodeType":865},{},[]," – where a local login with a username and password (and probably lacking MFA) can exist alongside other, more secure login methods such as SSO. Given the fact that many apps are self-adopted by users, these accounts continue to exist even when an app is subsequently added to SSO via the chosen IdP, meaning they can fly under the radar of security teams. ",{"data":57963,"content":57964,"nodeType":894},{},[],{"data":57966,"content":57967,"nodeType":904},{},[57968],{"data":57969,"marks":57970,"value":57971,"nodeType":865},{},[],"Should you be concerned about infostealers?",{"data":57973,"content":57974,"nodeType":881},{},[57975],{"data":57976,"marks":57977,"value":57978,"nodeType":865},{},[],"It’s commonly thought that infostealers are primarily a concern for unmanaged devices that lack security controls common to corporate IT, such as EDR. But there’s a couple of reasons why corporate users are also at risk:",{"data":57980,"content":57981,"nodeType":1860},{},[57982],{"data":57983,"marks":57984,"value":57985,"nodeType":865},{},[],"EDR can be bypassed",{"data":57987,"content":57988,"nodeType":881},{},[57989,57993,58002],{"data":57990,"marks":57991,"value":57992,"nodeType":865},{},[],"EDR is seen as the go-to solution for defending against infostealer malware. However, attackers are always looking for ways to get around security controls by obfuscating malicious behavior and evading signature-based checks. For example, ",{"data":57994,"content":57996,"nodeType":876},{"uri":57995},"https://thehackernews.com/2024/07/microsoft-defender-flaw-exploited-to.html",[57997],{"data":57998,"marks":57999,"value":58001,"nodeType":865},{},[58000],{"type":874},"a flaw in Microsoft Defender SmartScreen was recently exploited to deliver infostealer malware",{"data":58003,"marks":58004,"value":959,"nodeType":865},{},[],{"data":58006,"content":58007,"nodeType":881},{},[58008],{"data":58009,"marks":58010,"value":58011,"nodeType":865},{},[],"Getting total coverage across your endpoint estate is notoriously difficult, if not totally unrealistic. Unless the malware is stopped on execution, then data will inevitably be stolen, and will continue to be taken until stopped (or it self-terminates). And once an attacker has stolen employee credentials or sessions, the credential stuffing and session hijacking attacks that come next won’t touch the endpoint. For those reasons, you can’t rely on EDR as a single line of defense against infostealers.",{"data":58013,"content":58014,"nodeType":1860},{},[58015],{"data":58016,"marks":58017,"value":58018,"nodeType":865},{},[],"Unmanaged devices such as BYOD or third-parties are vulnerable",{"data":58020,"content":58021,"nodeType":881},{},[58022],{"data":58023,"marks":58024,"value":58025,"nodeType":865},{},[],"Companies that support BYOD often have less secure configurations than those with fully managed devices. The same applies to third-party contractors, who often use their own devices to access company systems on a temporary basis. ",{"data":58027,"content":58028,"nodeType":881},{},[58029,58033,58042],{"data":58030,"marks":58031,"value":58032,"nodeType":865},{},[],"This issue was acutely felt in the Snowflake attacks: There is some suggestion that targeting key third-party suppliers – ",{"data":58034,"content":58036,"nodeType":876},{"uri":58035},"https://www.wired.com/story/epam-snowflake-ticketmaster-breach-shinyhunters/",[58037],{"data":58038,"marks":58039,"value":58041,"nodeType":865},{},[58040],{"type":874},"such as EPAM Systems, a software engineering firm and Snowflake ‘Elite Tier Partner’",{"data":58043,"marks":58044,"value":58045,"nodeType":865},{},[]," – yielded some of the access needed. It’s unclear what came first, but it’s possible (likely, even) that EPAM was identified as a target specifically because of its lucrative customer base – third-parties are a known weak point for red teamers, so it would be foolish to assume that attackers don’t also think this way. It’s possible too that EPAM were specifically targeted because of their Snowflake chops – adding another indicator that Snowflake was potentially a premeditated attack inspired by the availability of Snowflake credentials online. ",{"data":58047,"content":58048,"nodeType":1860},{},[58049],{"data":58050,"marks":58051,"value":58052,"nodeType":865},{},[],"Browser profiles can be synced across devices, increasing the blast radius",{"data":58054,"content":58055,"nodeType":881},{},[58056],{"data":58057,"marks":58058,"value":58059,"nodeType":865},{},[],"It’s not uncommon for employees to access their personal email accounts from company devices. When accessing any browser, you are typically prompted to sign in with your account credentials (e.g. your Google account). If a user signs into a browser on a company device with a personal account, you’re usually prompted to sync your account across devices. This usually means that any saved passwords, search history, and settings are shared across devices. ",{"data":58061,"content":58062,"nodeType":881},{},[58063],{"data":58064,"marks":58065,"value":58066,"nodeType":865},{},[],"Naturally, this means that if a personal device is compromised where you’re also logged into the browser profile, then an infostealer will be able to harvest information saved into that profile across devices.",{"data":58068,"content":58069,"nodeType":881},{},[58070],{"data":58071,"marks":58072,"value":58073,"nodeType":865},{},[],"Even when using separate browser profiles for work and personal, it’s easy for the two to converge, or to slip into using the wrong profile. Accessing personal accounts (or at least synchronizing data across accounts) is usually a workplace policy violation, but it’s unfortunately all too common. ",{"data":58075,"content":58076,"nodeType":881},{},[58077,58081,58090],{"data":58078,"marks":58079,"value":58080,"nodeType":865},{},[],"Previous vulnerabilities have exacerbated this problem, such as ",{"data":58082,"content":58084,"nodeType":876},{"uri":58083},"https://thehackernews.com/2024/01/malware-using-google-multilogin-exploit.html",[58085],{"data":58086,"marks":58087,"value":58089,"nodeType":865},{},[58088],{"type":874},"an exploit affecting Google MultiLogin to maintain access to synced accounts even after a password reset",{"data":58091,"marks":58092,"value":1032,"nodeType":865},{},[],{"data":58094,"content":58095,"nodeType":1860},{},[58096],{"data":58097,"marks":58098,"value":58099,"nodeType":865},{},[],"Are infostealers a bigger problem than credential phishing? ",{"data":58101,"content":58102,"nodeType":881},{},[58103],{"data":58104,"marks":58105,"value":58106,"nodeType":865},{},[],"The short answer is: No. The longer answer is: They are both part of the bigger problem of identity attacks, and attackers can wield both approaches simultaneously. ",{"data":58108,"content":58109,"nodeType":881},{},[58110],{"data":58111,"marks":58112,"value":58113,"nodeType":865},{},[],"While they are delivered to victims in similar ways to phishing links, most organizations are arguably better protected against infostealers than modern phishing attacks because endpoint security controls provide another layer of protection, in theory – whereas modern phishing attacks don’t necessarily involve the delivery of malware that executes on the device. ",{"data":58115,"content":58116,"nodeType":881},{},[58117],{"data":58118,"marks":58119,"value":58120,"nodeType":865},{},[],"Infostealers arguably provide more bang for the attacker’s buck, grabbing a stack of credentials and useful data in one go. In contrast, phishing is usually much more targeted, and involves the compromise of a narrower set of credentials – typically focusing on a particular site or app. ",{"data":58122,"content":58123,"nodeType":881},{},[58124,58128,58136,58140,58146],{"data":58125,"marks":58126,"value":58127,"nodeType":865},{},[],"It’s worth focusing on the TTP, not the particular tool being used: The attacker technique here is ",{"data":58129,"content":58130,"nodeType":876},{"uri":42831},[58131],{"data":58132,"marks":58133,"value":58135,"nodeType":865},{},[58134],{"type":874},"session cookie theft",{"data":58137,"marks":58138,"value":58139,"nodeType":865},{},[],", and subsequently session hijacking by importing the cookie into the attacker’s browser. Both infostealers and ",{"data":58141,"content":58142,"nodeType":876},{"uri":28776},[58143],{"data":58144,"marks":58145,"value":43780,"nodeType":865},{},[],{"data":58147,"marks":58148,"value":58149,"nodeType":865},{},[]," involve the theft of session tokens, and so are valid means to achieve this end. In fact, there’s nothing to stop threat groups from employing both simultaneously.",{"data":58151,"content":58155,"nodeType":890},{"target":58152},{"sys":58153},{"id":58154,"type":887,"linkType":888},"7fil6aaQDFfJGYUnQ14k10",[],{"data":58157,"content":58158,"nodeType":894},{},[],{"data":58160,"content":58161,"nodeType":904},{},[58162],{"data":58163,"marks":58164,"value":58165,"nodeType":865},{},[],"Infostealers in action",{"data":58167,"content":58168,"nodeType":881},{},[58169],{"data":58170,"marks":58171,"value":58172,"nodeType":865},{},[],"Check out the video demo below to see the attack chain in action from the point of an infostealer compromise, showing session cookie theft, reimporting the cookies into the attacker's browser, and evading policy-based controls in M365. It also shows the targeting of downstream apps that are usually accessed via SSO in the context of both a Microsoft Entra and Okta compromise.",{"data":58174,"content":58178,"nodeType":890},{"target":58175},{"sys":58176},{"id":58177,"type":887,"linkType":888},"4J7LqqjQX2W52AbmcVmjUt",[],{"data":58180,"content":58181,"nodeType":904},{},[58182],{"data":58183,"marks":58184,"value":58185,"nodeType":865},{},[],"What can organizations do about the infostealer threat? ",{"data":58187,"content":58188,"nodeType":881},{},[58189],{"data":58190,"marks":58191,"value":58192,"nodeType":865},{},[],"Security teams should have two main concerns:",{"data":58194,"content":58195,"nodeType":1818},{},[58196,58206],{"data":58197,"content":58198,"nodeType":1734},{},[58199],{"data":58200,"content":58201,"nodeType":881},{},[58202],{"data":58203,"marks":58204,"value":58205,"nodeType":865},{},[],"Data that is already out there from historical data dumps, but is still valid. ",{"data":58207,"content":58208,"nodeType":1734},{},[58209],{"data":58210,"content":58211,"nodeType":881},{},[58212],{"data":58213,"marks":58214,"value":58215,"nodeType":865},{},[],"Data in private channels that attackers could use in the future, that you are blind to. ",{"data":58217,"content":58218,"nodeType":881},{},[58219],{"data":58220,"marks":58221,"value":58222,"nodeType":865},{},[],"As always, the root-cause of the problem is a lack of meaningful visibility of what apps your employees are using (including those outside your IdP) and whether the associated identities are configured securely. ",{"data":58224,"content":58225,"nodeType":881},{},[58226],{"data":58227,"marks":58228,"value":58229,"nodeType":865},{},[],"A layered, defense-in-depth approach is required to resolve the issue, by:",{"data":58231,"content":58232,"nodeType":1818},{},[58233,58243,58253,58263],{"data":58234,"content":58235,"nodeType":1734},{},[58236],{"data":58237,"content":58238,"nodeType":881},{},[58239],{"data":58240,"marks":58241,"value":58242,"nodeType":865},{},[],"Deploying MFA across all your identities and apps, including any local logins that can’t be put behind SSO. ",{"data":58244,"content":58245,"nodeType":1734},{},[58246],{"data":58247,"content":58248,"nodeType":881},{},[58249],{"data":58250,"marks":58251,"value":58252,"nodeType":865},{},[],"Configuring time-limited session lifetimes for all apps to ensure that any stolen session tokens can only be used temporarily. ",{"data":58254,"content":58255,"nodeType":1734},{},[58256],{"data":58257,"content":58258,"nodeType":881},{},[58259],{"data":58260,"marks":58261,"value":58262,"nodeType":865},{},[],"Ensuring that employees don’t access or synchronize personal accounts on their work devices, as well as limiting non-work activities on their work device as much as possible.",{"data":58264,"content":58265,"nodeType":1734},{},[58266],{"data":58267,"content":58268,"nodeType":881},{},[58269],{"data":58270,"marks":58271,"value":58272,"nodeType":865},{},[],"Implementing a robust EDR/MDR solution to detect and respond to malware compromises on user devices. ",{"data":58274,"content":58275,"nodeType":881},{},[58276,58280,58285],{"data":58277,"marks":58278,"value":58279,"nodeType":865},{},[],"Organizations also have the option of investing in a commercial TI feed to detect and report data breaches affecting employees. But in our experience, these feeds contain ",{"data":58281,"marks":58282,"value":58284,"nodeType":865},{},[58283],{"type":902},"a lot ",{"data":58286,"marks":58287,"value":58288,"nodeType":865},{},[],"of false positives – so unless you have password visibility for employee accounts across apps, it’s going to waste a chunk of valuable time for you and your employees.",{"data":58290,"content":58291,"nodeType":881},{},[58292,58296,58304],{"data":58293,"marks":58294,"value":58295,"nodeType":865},{},[],"It would be remiss of us not to mention our recently released ",{"data":58297,"content":58298,"nodeType":876},{"uri":44147},[58299],{"data":58300,"marks":58301,"value":58303,"nodeType":865},{},[58302],{"type":874},"session token theft detection feature",{"data":58305,"marks":58306,"value":58307,"nodeType":865},{},[]," that identifies session token theft by adding telemetry to the user agent string – using the power of our browser agent to create a new high-fidelity signal for security teams. It can also be applied more generally to detect any session taking place in an unmanaged browser – so you can use it to spot unauthorized access to company apps in general, too.  ",{"data":58309,"content":58313,"nodeType":890},{"target":58310},{"sys":58311},{"id":58312,"type":887,"linkType":888},"3XgpqEGzZSD2J0uvnCg5D8",[],{"data":58315,"content":58316,"nodeType":1860},{},[58317],{"data":58318,"marks":58319,"value":58320,"nodeType":865},{},[],"What’s next for infostealers?",{"data":58322,"content":58323,"nodeType":881},{},[58324],{"data":58325,"marks":58326,"value":58327,"nodeType":865},{},[],"All the signs point to the fact that infostealers will continue being a useful tool in the attacker’s arsenal. The Snowflake attacks in particular are both a warning for defenders and encouragement for attackers. It's also a good reminder that while infostealers were once used to harvest things like VPN creds to pivot to the internal network, they're now largely used to target third-party services over the internet. ",{"data":58329,"content":58330,"nodeType":881},{},[58331],{"data":58332,"marks":58333,"value":58334,"nodeType":865},{},[],"To evade EDR, it’s likely that we’ll see a growing number of families and variants used by individual groups, or better ‘enterprise’ capabilities from malware-as-a-service vendors. ",{"data":58336,"content":58337,"nodeType":881},{},[58338,58342,58351,58355,58363],{"data":58339,"marks":58340,"value":58341,"nodeType":865},{},[],"One notable quirk is that, to date, infostealers have not really branched out from targeting browsers. Take the example of password manager apps – you would think this would be an obvious target, right? But, they’re not usually targeted (",{"data":58343,"content":58345,"nodeType":876},{"uri":58344},"https://securitysenses.com/posts/malware-targeting-password-managers",[58346],{"data":58347,"marks":58348,"value":58350,"nodeType":865},{},[58349],{"type":874},"with some exceptions",{"data":58352,"marks":58353,"value":58354,"nodeType":865},{},[],"). And when they do, ",{"data":58356,"content":58357,"nodeType":876},{"uri":58344},[58358],{"data":58359,"marks":58360,"value":58362,"nodeType":865},{},[58361],{"type":874},"they work by eavesdropping on the password manager’s browser extension in action",{"data":58364,"marks":58365,"value":58366,"nodeType":865},{},[]," – meaning they are intercepted one-at-a-time as the user uses them, rather than targeting the password manager directly and exporting the saved passwords all at once. It will be interesting to see whether these capabilities are added in the future. ",{"data":58368,"content":58369,"nodeType":881},{},[58370,58374,58383,58386,58395,58399,58408],{"data":58371,"marks":58372,"value":58373,"nodeType":865},{},[],"On the other hand, there are defensive security developments that could reduce the ability of attackers to leverage things like stolen session tokens, such as ",{"data":58375,"content":58377,"nodeType":876},{"uri":58376},"https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection",[58378],{"data":58379,"marks":58380,"value":58382,"nodeType":865},{},[58381],{"type":874},"Microsoft’s token binding feature in Entra",{"data":58384,"marks":58385,"value":4487,"nodeType":865},{},[],{"data":58387,"content":58389,"nodeType":876},{"uri":58388},"https://blog.chromium.org/2024/04/fighting-cookie-theft-using-device.html",[58390],{"data":58391,"marks":58392,"value":58394,"nodeType":865},{},[58393],{"type":874},"Google’s device bound session cookies",{"data":58396,"marks":58397,"value":58398,"nodeType":865},{},[],". Google also released an ",{"data":58400,"content":58402,"nodeType":876},{"uri":58401},"https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html?m=1",[58403],{"data":58404,"marks":58405,"value":58407,"nodeType":865},{},[58406],{"type":874},"app-bound encryption feature",{"data":58409,"marks":58410,"value":58411,"nodeType":865},{},[],", which adds additional protection against infostealers attempting to steal browser data in Chrome if the underlying Windows device is compromised. ",{"data":58413,"content":58414,"nodeType":881},{},[58415],{"data":58416,"marks":58417,"value":58418,"nodeType":865},{},[],"That said, mature versions of these controls are still years away, and while session cookie theft is a key risk of infostealers, it’s not the only risk – so alternative controls and mitigations remain valuable to security teams in the present. ",{"data":58420,"content":58424,"nodeType":890},{"target":58421},{"sys":58422},{"id":58423,"type":887,"linkType":888},"5loTnpvwGD3kaKMXBp23hZ",[],{"data":58426,"content":58427,"nodeType":881},{},[58428],{"data":58429,"marks":58430,"value":21,"nodeType":865},{},[],"What the rise of infostealers says about identity attacks","What the rise in popularity of infostealers tells us about the cybercrime ecosystem and the shift toward identity attacks. ","2024-07-31T00:00:00.000Z","what-the-rise-of-infostealers-says-about-identity-attacks",{"items":58436},[58437,58439],{"sys":58438,"name":4507},{"id":4506},{"sys":58440,"name":342},{"id":4510},{"items":58442},[58443],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":58444},{"url":5377},{"__typename":1485,"sys":58446,"content":58448,"title":59660,"synopsis":59661,"hashTags":59,"publishedDate":59662,"slug":59663,"tagsCollection":59664,"authorsCollection":59670},{"id":58447},"489LTCEVau7lh88tLgSPX5",{"json":58449},{"data":58450,"content":58451,"nodeType":1463},{},[58452,58459,58479,58486,58492,58499,58532,58538,58544,58551,58558,58564,58571,58591,58598,58605,58611,58618,58625,58673,58691,58698,58705,58712,58717,58724,58731,58738,58745,58752,58759,58771,58777,58784,58802,58820,58827,58834,58854,58861,58878,58885,58934,58941,58960,58967,58972,58989,59007,59014,59032,59039,59045,59052,59068,59075,59082,59088,59095,59102,59109,59116,59121,59128,59135,59142,59149,59155,59162,59169,59181,59197,59204,59211,59277,59284,59291,59298,59305,59312,59319,59326,59333,59351,59358,59364,59371,59377,59384,59391,59398,59404,59411,59418,59425,59458,59465,59472,59479,59486,59493,59500,59507,59514,59562,59568,59575,59618,59624,59631,59648,59654],{"data":58453,"content":58454,"nodeType":881},{},[58455],{"data":58456,"marks":58457,"value":58458,"nodeType":865},{},[],"The last time “hacking” topped the attacker actions chart in a Verizon DBIR, Gamestop was being saved by Redditors, ChatGPT didn’t exist, and Will Smith was welcome at the Oscars. ",{"data":58460,"content":58461,"nodeType":881},{},[58462,58466,58475],{"data":58463,"marks":58464,"value":58465,"nodeType":865},{},[],"That’s right, it was back in the ",{"data":58467,"content":58469,"nodeType":876},{"uri":58468},"https://www.verizon.com/business/resources/reports/dbir/2021/masters-guide/",[58470],{"data":58471,"marks":58472,"value":58474,"nodeType":865},{},[58473],{"type":874},"2021 DBIR",{"data":58476,"marks":58477,"value":58478,"nodeType":865},{},[]," that good old-fashioned hacking was the thing hackers did the most. ",{"data":58480,"content":58481,"nodeType":881},{},[58482],{"data":58483,"marks":58484,"value":58485,"nodeType":865},{},[],"In every report since, stolen credentials have been the most common “select way-in” (weird term, I know). In this year’s DBIR, stolen credentials accounted for roughly half of the breaches recorded. ",{"data":58487,"content":58491,"nodeType":890},{"target":58488},{"sys":58489},{"id":58490,"type":887,"linkType":888},"16WQ5Siz92HZKCjDsxWBdr",[],{"data":58493,"content":58494,"nodeType":881},{},[58495],{"data":58496,"marks":58497,"value":58498,"nodeType":865},{},[],"These stats, along with others like CrowdStrike’s widely cited “80% of attacks involve identity and compromised credentials,” continue to prove that “hackers don’t hack in, they log in.” ",{"data":58500,"content":58501,"nodeType":881},{},[58502,58506,58515,58519,58528],{"data":58503,"marks":58504,"value":58505,"nodeType":865},{},[],"In the last year, more stories behind those statistics have started to emerge with a series of high profile “no-hack” identity attacks hitting the headlines – the most recent being the ",{"data":58507,"content":58509,"nodeType":876},{"uri":58508},"https://pushsecurity.com/resources/video/snowflake-the-tip-of-the-iceberg/",[58510],{"data":58511,"marks":58512,"value":58514,"nodeType":865},{},[58513],{"type":874},"Snowflake incident",{"data":58516,"marks":58517,"value":58518,"nodeType":865},{},[],". You can read more about that breach and others in our repository of ",{"data":58520,"content":58522,"nodeType":876},{"uri":58521},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/",[58523],{"data":58524,"marks":58525,"value":58527,"nodeType":865},{},[58526],{"type":874},"identity attacks in the wild",{"data":58529,"marks":58530,"value":58531,"nodeType":865},{},[]," where we take a deep dive into the techniques attackers have been using. ",{"data":58533,"content":58537,"nodeType":890},{"target":58534},{"sys":58535},{"id":58536,"type":887,"linkType":888},"6QY3hnMLMJvnk6zYHYa6pf",[],{"data":58539,"content":58543,"nodeType":890},{"target":58540},{"sys":58541},{"id":58542,"type":887,"linkType":888},"7oAUuhbwgEH5XnDZrm5Zk9",[],{"data":58545,"content":58546,"nodeType":881},{},[58547],{"data":58548,"marks":58549,"value":58550,"nodeType":865},{},[],"Why should they go to the effort of targeting hardened and well-monitored attack surfaces like networks and endpoints with 0-day exploits or EDR-evading malware, when they can instead simply take a set of stolen credentials and fire them at popular business apps to see which pop open?",{"data":58552,"content":58553,"nodeType":881},{},[58554],{"data":58555,"marks":58556,"value":58557,"nodeType":865},{},[],"Taking over an account is the equivalent of compromising an endpoint or getting a foothold on a web-facing server. From this point, an attacker can move laterally, escalate their privileges, and achieve their objective of deploying ransomware, stealing data or disrupting business-critical systems. ",{"data":58559,"content":58563,"nodeType":890},{"target":58560},{"sys":58561},{"id":58562,"type":887,"linkType":888},"3vdbE3kqFxvhE145q2CwOy",[],{"data":58565,"content":58566,"nodeType":881},{},[58567],{"data":58568,"marks":58569,"value":58570,"nodeType":865},{},[],"The data shows that account takeover, whether it’s using stolen credentials or session tokens, is now the route of least resistance for attackers, and the #1 attack vector for security teams to defend against.",{"data":58572,"content":58573,"nodeType":881},{},[58574,58578,58587],{"data":58575,"marks":58576,"value":58577,"nodeType":865},{},[],"I’m sure you already use a number of tools to secure your workforce identities – MFA, SSO, EDR, etc., and all of them have an important role to play. That said, they also have limitations that attackers are exploiting. We’ve laid out some of the ",{"data":58579,"content":58581,"nodeType":876},{"uri":58580},"https://pushsecurity.com/blog/5-reasons-why-push-security-shouldnt-exist/",[58582],{"data":58583,"marks":58584,"value":58586,"nodeType":865},{},[58585],{"type":874},"typical misconceptions that can undermine an identity security strategy",{"data":58588,"marks":58589,"value":58590,"nodeType":865},{},[]," so you can avoid the common pitfalls and achieve defense in depth.",{"data":58592,"content":58593,"nodeType":904},{},[58594],{"data":58595,"marks":58596,"value":58597,"nodeType":865},{},[],"Push vs. account takeover techniques",{"data":58599,"content":58600,"nodeType":881},{},[58601],{"data":58602,"marks":58603,"value":58604,"nodeType":865},{},[],"In this article, we’re going to show you how to use Push to bolster your identity security strategy and prevent account takeover. More specifically, we’ll cover how Push prevents, detects, and blocks some of the common attack techniques seen in this account takeover attack chain:",{"data":58606,"content":58610,"nodeType":890},{"target":58607},{"sys":58608},{"id":58609,"type":887,"linkType":888},"1FPMzCU0mBgpg1GMSz1sJH",[],{"data":58612,"content":58613,"nodeType":881},{},[58614],{"data":58615,"marks":58616,"value":58617,"nodeType":865},{},[],"Push uses browser data collected by our browser agent to either detect the attack techniques directly, or identify the vulnerabilities being exploited. Upon making a detection, the browser agent enforces a relevant security control to either block the attack or prevent the user from introducing a vulnerability.",{"data":58619,"content":58620,"nodeType":881},{},[58621],{"data":58622,"marks":58623,"value":58624,"nodeType":865},{},[],"If you’re wondering why we’ve opted to build our tool in the browser, the short answer is that being in the browser gives us:",{"data":58626,"content":58627,"nodeType":1818},{},[58628,58643,58658],{"data":58629,"content":58630,"nodeType":1734},{},[58631],{"data":58632,"content":58633,"nodeType":881},{},[58634,58639],{"data":58635,"marks":58636,"value":58638,"nodeType":865},{},[58637],{"type":902},"The broadest visibility",{"data":58640,"marks":58641,"value":58642,"nodeType":865},{},[]," across all workforce identities, including unmanaged identities outside your IdP.",{"data":58644,"content":58645,"nodeType":1734},{},[58646],{"data":58647,"content":58648,"nodeType":881},{},[58649,58654],{"data":58650,"marks":58651,"value":58653,"nodeType":865},{},[58652],{"type":902},"The best telemetry",{"data":58655,"marks":58656,"value":58657,"nodeType":865},{},[]," for detecting identity attack TTPs and tools.",{"data":58659,"content":58660,"nodeType":1734},{},[58661],{"data":58662,"content":58663,"nodeType":881},{},[58664,58669],{"data":58665,"marks":58666,"value":58668,"nodeType":865},{},[58667],{"type":902},"The perfect enforcement point",{"data":58670,"marks":58671,"value":58672,"nodeType":865},{},[]," for stopping attacker actions or risky employee actions in real time. ",{"data":58674,"content":58675,"nodeType":881},{},[58676,58680,58688],{"data":58677,"marks":58678,"value":58679,"nodeType":865},{},[],"If you want a more detailed technical explanation, you can read this article by Dan on ",{"data":58681,"content":58682,"nodeType":876},{"uri":31096},[58683],{"data":58684,"marks":58685,"value":58687,"nodeType":865},{},[58686],{"type":874},"why browser data is a better source of telemetry for detecting identity attacks than network, IdP and app logs",{"data":58689,"marks":58690,"value":959,"nodeType":865},{},[],{"data":58692,"content":58693,"nodeType":881},{},[58694],{"data":58695,"marks":58696,"value":58697,"nodeType":865},{},[],"Now we’ve cleared that up, let's look at some account takeover techniques.",{"data":58699,"content":58700,"nodeType":904},{},[58701],{"data":58702,"marks":58703,"value":58704,"nodeType":865},{},[],"Part 1: Phishing (including AitM and BitM toolkits)",{"data":58706,"content":58707,"nodeType":881},{},[58708],{"data":58709,"marks":58710,"value":58711,"nodeType":865},{},[],"Phishing has been around since forever and there’s a mature category of solutions that are designed to detect and prevent it. But despite solutions like security awareness training, phishing domain detection services and email filtering tools, phishing is still one of the top breach vectors. ",{"data":58713,"content":58716,"nodeType":890},{"target":58714},{"sys":58715},{"id":41417,"type":887,"linkType":888},[],{"data":58718,"content":58719,"nodeType":881},{},[58720],{"data":58721,"marks":58722,"value":58723,"nodeType":865},{},[],"We’ve all been conditioned to think about phishing as something that happens over email, but it’s actually the browser where most of the action happens, regardless of the initial delivery channel. Push’s position in the browser gives you the ideal vantage point for detecting and stopping phishing attacks.",{"data":58725,"content":58726,"nodeType":881},{},[58727],{"data":58728,"marks":58729,"value":58730,"nodeType":865},{},[],"The Push browser agent performs both passive observation and active interrogation in order to detect employees having their passwords harvested or visiting cloned app login pages or pages using AitM/BitM toolkits. Phishing attacks are detected in real time so Push blocks them before your employees can enter their credentials.",{"data":58732,"content":58733,"nodeType":1860},{},[58734],{"data":58735,"marks":58736,"value":58737,"nodeType":865},{},[],"Detecting phishing through user behavior",{"data":58739,"content":58740,"nodeType":881},{},[58741],{"data":58742,"marks":58743,"value":58744,"nodeType":865},{},[],"Rather than trying to detect phishing websites and domains that constantly change, Push detects and blocks phishing attempts based on observing user behavior in the browser.",{"data":58746,"content":58747,"nodeType":881},{},[58748],{"data":58749,"marks":58750,"value":58751,"nodeType":865},{},[],"Push does this by observing all logins and generating a fingerprint (or technically a k-anonymized salted partial hash) of the user’s password. This fingerprint is then stored locally to allow Push to perform comparisons.",{"data":58753,"content":58754,"nodeType":881},{},[58755],{"data":58756,"marks":58757,"value":58758,"nodeType":865},{},[],"To detect potential phishing attacks, the browser agent compares the observed password fingerprint to known fingerprints for passwords that already exist in local storage.",{"data":58760,"content":58761,"nodeType":881},{},[58762,58767],{"data":58763,"marks":58764,"value":58766,"nodeType":865},{},[58765],{"type":902},"This means that it works even if that employee was the first person to get phished using a new attacker site: ",{"data":58768,"marks":58769,"value":58770,"nodeType":865},{},[],"Push still detects it and blocks it before your employee can submit their credentials. It also works regardless of the delivery vector used to get the phishing link to the intended victim.",{"data":58772,"content":58776,"nodeType":890},{"target":58773},{"sys":58774},{"id":58775,"type":887,"linkType":888},"2V2My5IpdVUwh4QugqInUw",[],{"data":58778,"content":58779,"nodeType":881},{},[58780],{"data":58781,"marks":58782,"value":58783,"nodeType":865},{},[],"Once you’ve discovered a malicious site, you can use Push’s companion feature, URL blocking, to add the domain to a blocklist and prevent your other end-users from even visiting the site.",{"data":58785,"content":58786,"nodeType":881},{},[58787,58791,58798],{"data":58788,"marks":58789,"value":58790,"nodeType":865},{},[],"You can programmatically manage URL blocking as part of responding to an attempted phishing incident by using the ",{"data":58792,"content":58793,"nodeType":876},{"uri":55771},[58794],{"data":58795,"marks":58796,"value":58797,"nodeType":865},{},[],"Push REST API",{"data":58799,"marks":58800,"value":58801,"nodeType":865},{},[]," to automatically add URLs to the blocklist or to sync with other threat intelligence sources of known-bad sites.",{"data":58803,"content":58804,"nodeType":881},{},[58805,58809,58817],{"data":58806,"marks":58807,"value":58808,"nodeType":865},{},[],"You can find out more about this control in this ",{"data":58810,"content":58811,"nodeType":876},{"uri":17092},[58812],{"data":58813,"marks":58814,"value":58816,"nodeType":865},{},[58815],{"type":874},"deep-dive article",{"data":58818,"marks":58819,"value":1032,"nodeType":865},{},[],{"data":58821,"content":58822,"nodeType":1860},{},[58823],{"data":58824,"marks":58825,"value":58826,"nodeType":865},{},[],"Detecting cloned login pages",{"data":58828,"content":58829,"nodeType":881},{},[58830],{"data":58831,"marks":58832,"value":58833,"nodeType":865},{},[],"It’s now very easy for attackers to create cloned login pages that appear to be legitimate, tricking users into providing their credentials. ",{"data":58835,"content":58836,"nodeType":881},{},[58837,58841,58850],{"data":58838,"marks":58839,"value":58840,"nodeType":865},{},[],"There’s a number of phishing kits that allow the attacker to simply copy the HTML code from a legitimate website and duplicate it on the malicious site, creating a virtually identical interface that tricks users into entering their credentials. A final sprinkle of typosquatting techniques completes the illusion of legitimacy. The Federal Communications Commission (FCC) ",{"data":58842,"content":58844,"nodeType":876},{"uri":58843},"https://www.nextgov.com/cybersecurity/2024/03/fcc-staff-targeted-phishing-attack-cloned-agency-login-site/394609/",[58845],{"data":58846,"marks":58847,"value":58849,"nodeType":865},{},[58848],{"type":874},"was a recent target",{"data":58851,"marks":58852,"value":58853,"nodeType":865},{},[]," of this kind of attack. ",{"data":58855,"content":58856,"nodeType":881},{},[58857],{"data":58858,"marks":58859,"value":58860,"nodeType":865},{},[],"Push’s cloned app detection feature detects fraudulent login pages by inspecting the resources and structure of pages users log into and fingerprinting them so they can be used to detect when that action occurs on the wrong domain. ",{"data":58862,"content":58863,"nodeType":881},{},[58864,58868,58875],{"data":58865,"marks":58866,"value":58867,"nodeType":865},{},[],"You can ",{"data":58869,"content":58870,"nodeType":876},{"uri":43904},[58871],{"data":58872,"marks":58873,"value":58874,"nodeType":865},{},[],"read more about this feature here",{"data":58876,"marks":58877,"value":959,"nodeType":865},{},[],{"data":58879,"content":58880,"nodeType":1860},{},[58881],{"data":58882,"marks":58883,"value":58884,"nodeType":865},{},[],"Detecting AitM and BitM toolkits",{"data":58886,"content":58887,"nodeType":881},{},[58888,58892,58900,58903,58911,58914,58920,58923,58931],{"data":58889,"marks":58890,"value":58891,"nodeType":865},{},[],"Adversary-in-the-Middle (AitM) phishing is a technique that uses dedicated tooling to act as a proxy between the target and a legitimate login portal for an application, principally to bypass MFA. As it’s a proxy to the real application, the page will appear exactly as the user expects, making this technique difficult to spot. Popular AitM toolkits include ",{"data":58893,"content":58895,"nodeType":876},{"uri":58894},"https://github.com/drk1wi/Modlishka",[58896],{"data":58897,"marks":58898,"value":58899,"nodeType":865},{},[],"Modlishka",{"data":58901,"marks":58902,"value":1877,"nodeType":865},{},[],{"data":58904,"content":58906,"nodeType":876},{"uri":58905},"https://github.com/muraenateam/muraena",[58907],{"data":58908,"marks":58909,"value":58910,"nodeType":865},{},[],"Muraena",{"data":58912,"marks":58913,"value":1877,"nodeType":865},{},[],{"data":58915,"content":58916,"nodeType":876},{"uri":49328},[58917],{"data":58918,"marks":58919,"value":49334,"nodeType":865},{},[],{"data":58921,"marks":58922,"value":1651,"nodeType":865},{},[],{"data":58924,"content":58926,"nodeType":876},{"uri":58925},"https://www.bleepingcomputer.com/news/security/evilproxy-uses-indeedcom-open-redirect-for-microsoft-365-phishing/",[58927],{"data":58928,"marks":58929,"value":58930,"nodeType":865},{},[],"Evilproxy",{"data":58932,"marks":58933,"value":1032,"nodeType":865},{},[],{"data":58935,"content":58936,"nodeType":881},{},[58937],{"data":58938,"marks":58939,"value":58940,"nodeType":865},{},[],"Browser-in-the-Middle (BitM) toolkits are different to AitM toolkits because they don’t act as a reverse proxy. Instead, they trick their victim into directly controlling the attacker’s own browser using remote desktop screen sharing and control approaches — think of this like VNC or RDP but using the browser as a client. This is the virtual equivalent of an attacker handing their laptop to their victim, asking them to log in to an app for them, and then taking their laptop back afterwards.",{"data":58942,"content":58943,"nodeType":881},{},[58944,58948,58957],{"data":58945,"marks":58946,"value":58947,"nodeType":865},{},[],"We’ve conducted a lot of research into AitM and BitM toolkits recently. If you want to learn more about how they work and see a demo of them in action, ",{"data":58949,"content":58951,"nodeType":876},{"uri":58950},"https://pushsecurity.com/resources/video/phishing-detecting-evilginx-evilnovnc-muraena-and-modlishka/",[58952],{"data":58953,"marks":58954,"value":58956,"nodeType":865},{},[58955],{"type":874},"head over here",{"data":58958,"marks":58959,"value":1032,"nodeType":865},{},[],{"data":58961,"content":58962,"nodeType":881},{},[58963],{"data":58964,"marks":58965,"value":58966,"nodeType":865},{},[],"Push gives you a preconfigured set of detections for AitM and BitM toolkits, informed by our threat detection team’s research into their behavior. This phishing tool detection feature will automatically prevent users from accessing a site that’s running one of these malicious tools, and display a custom warning message to your end-users.",{"data":58968,"content":58971,"nodeType":890},{"target":58969},{"sys":58970},{"id":37923,"type":887,"linkType":888},[],{"data":58973,"content":58974,"nodeType":881},{},[58975,58979,58985],{"data":58976,"marks":58977,"value":58978,"nodeType":865},{},[],"Administrators can also consume phishing tool detection events via the ",{"data":58980,"content":58981,"nodeType":876},{"uri":55771},[58982],{"data":58983,"marks":58984,"value":58797,"nodeType":865},{},[],{"data":58986,"marks":58987,"value":58988,"nodeType":865},{},[]," into their SIEM or use Push’s webhooks to alert when a warn or block event has occurred.",{"data":58990,"content":58991,"nodeType":881},{},[58992,58996,59004],{"data":58993,"marks":58994,"value":58995,"nodeType":865},{},[],"You can read a full write-up of this feature if you want to ",{"data":58997,"content":58998,"nodeType":876},{"uri":43852},[58999],{"data":59000,"marks":59001,"value":59003,"nodeType":865},{},[59002],{"type":874},"learn more",{"data":59005,"marks":59006,"value":1032,"nodeType":865},{},[],{"data":59008,"content":59009,"nodeType":904},{},[59010],{"data":59011,"marks":59012,"value":59013,"nodeType":865},{},[],"Part 2: Infostealer malware",{"data":59015,"content":59016,"nodeType":881},{},[59017,59021,59028],{"data":59018,"marks":59019,"value":59020,"nodeType":865},{},[],"The recent ",{"data":59022,"content":59023,"nodeType":876},{"uri":5072},[59024],{"data":59025,"marks":59026,"value":5077,"nodeType":865},{},[59027],{"type":874},{"data":59029,"marks":59030,"value":59031,"nodeType":865},{},[]," highlighted how infostealer malware is becoming a serious issue for security teams. As well as being able to steal credentials for account takeover, infostealers can also be used to steal session tokens which then allow the attacker to assume an already authorized session without needing to bypass MFA.   ",{"data":59033,"content":59034,"nodeType":881},{},[59035],{"data":59036,"marks":59037,"value":59038,"nodeType":865},{},[],"Nearly half of the malware detected last year by Sophos targeted victims’ data specifically, and the majority of that malware was classified as infostealers. ",{"data":59040,"content":59044,"nodeType":890},{"target":59041},{"sys":59042},{"id":59043,"type":887,"linkType":888},"66B5MBFIhbmky7VuLGbuM3",[],{"data":59046,"content":59047,"nodeType":881},{},[59048],{"data":59049,"marks":59050,"value":59051,"nodeType":865},{},[],"Infostealers are primarily being used by Initial Access Brokers to harvest credentials and session tokens that they then sell to other threat actors intent on executing more penetrating attacks (e.g. ransomware).  ",{"data":59053,"content":59054,"nodeType":881},{},[59055,59058,59065],{"data":59056,"marks":59057,"value":57992,"nodeType":865},{},[],{"data":59059,"content":59060,"nodeType":876},{"uri":57995},[59061],{"data":59062,"marks":59063,"value":58001,"nodeType":865},{},[59064],{"type":874},{"data":59066,"marks":59067,"value":959,"nodeType":865},{},[],{"data":59069,"content":59070,"nodeType":881},{},[59071],{"data":59072,"marks":59073,"value":59074,"nodeType":865},{},[],"Getting total coverage across your endpoint estate is notoriously difficult, if not totally unrealistic. Unless the malware is stopped on execution, then data will inevitably be stolen, and will continue to be taken until stopped (or it self-terminates). And once an attacker has stolen employee credentials or sessions, the credential stuffing and session hijacking attacks that come next won’t touch the endpoint. ",{"data":59076,"content":59077,"nodeType":881},{},[59078],{"data":59079,"marks":59080,"value":59081,"nodeType":865},{},[],"For those reasons, you can’t rely on EDR as a single line of defense against infostealers. Push gives you those extra layers of defense to stop account takeover attempts that use stolen credentials and sessions.",{"data":59083,"content":59087,"nodeType":890},{"target":59084},{"sys":59085},{"id":59086,"type":887,"linkType":888},"4YB6DLIE5TvaAsAAUoJd5v",[],{"data":59089,"content":59090,"nodeType":1860},{},[59091],{"data":59092,"marks":59093,"value":59094,"nodeType":865},{},[],"Detecting stolen sessions ",{"data":59096,"content":59097,"nodeType":881},{},[59098],{"data":59099,"marks":59100,"value":59101,"nodeType":865},{},[],"Push uses its browser agent to inject a unique marker into the user agent string of sessions that occur in browsers enrolled in Push. You then add the list of domains where you wish to inject the marker into sessions, such as an identity provider like Okta or Microsoft. ",{"data":59103,"content":59104,"nodeType":881},{},[59105],{"data":59106,"marks":59107,"value":59108,"nodeType":865},{},[],"By analyzing logs from the IdP, you can identify activity from the same session that both has the Push marker and that lacks the marker. This can only ever happen when a session is extracted from a browser and maliciously imported into a different browser.",{"data":59110,"content":59111,"nodeType":881},{},[59112],{"data":59113,"marks":59114,"value":59115,"nodeType":865},{},[],"This is a high-fidelity signal that a stolen session token is being used by an attacker. It’s certainly a lot cleaner than relying on IP-based or geolocation-based signals, which result in frequent false positives.",{"data":59117,"content":59120,"nodeType":890},{"target":59118},{"sys":59119},{"id":44177,"type":887,"linkType":888},[],{"data":59122,"content":59123,"nodeType":1860},{},[59124],{"data":59125,"marks":59126,"value":59127,"nodeType":865},{},[],"Detecting stolen credentials being sold on the dark web",{"data":59129,"content":59130,"nodeType":881},{},[59131],{"data":59132,"marks":59133,"value":59134,"nodeType":865},{},[],"Push integrates stolen credential threat intelligence and alerts you when your employees’ credentials are being sold on the dark web. ",{"data":59136,"content":59137,"nodeType":881},{},[59138],{"data":59139,"marks":59140,"value":59141,"nodeType":865},{},[],"Commercial TI feeds of stolen credentials have been available for some time. But what we’ve found is that the false-positive rate is incredibly high and the vast majority of credentials are no longer in use.",{"data":59143,"content":59144,"nodeType":881},{},[59145],{"data":59146,"marks":59147,"value":59148,"nodeType":865},{},[],"Push validates that leaked credentials match those that are currently being used by your employees to authenticate on any apps they are using in the browser. That means that any alerts or automated actions generated by Push are actionable true positives, cutting out a huge amount of noise and saving your security team time. ",{"data":59150,"content":59154,"nodeType":890},{"target":59151},{"sys":59152},{"id":59153,"type":887,"linkType":888},"3RnPM0ioGWi3CFMLkxQanO",[],{"data":59156,"content":59157,"nodeType":904},{},[59158],{"data":59159,"marks":59160,"value":59161,"nodeType":865},{},[],"Part 3: Credential stuffing",{"data":59163,"content":59164,"nodeType":881},{},[59165],{"data":59166,"marks":59167,"value":59168,"nodeType":865},{},[],"The previous sections looked at how Push detects and stops common techniques used for stealing and acquiring credentials. We’re now going to cover how Push stops stolen credentials from being used to access and take over employee accounts. ",{"data":59170,"content":59171,"nodeType":881},{},[59172,59177],{"data":59173,"marks":59174,"value":59176,"nodeType":865},{},[59175],{"type":902},"Credential stuffing ",{"data":59178,"marks":59179,"value":59180,"nodeType":865},{},[],"is when attackers use tools that automate the process of taking a list of stolen passwords and retargeting those credentials against different apps.",{"data":59182,"content":59183,"nodeType":881},{},[59184,59188,59193],{"data":59185,"marks":59186,"value":59187,"nodeType":865},{},[],"Closely related to credential stuffing is ",{"data":59189,"marks":59190,"value":59192,"nodeType":865},{},[59191],{"type":902},"password spraying",{"data":59194,"marks":59195,"value":59196,"nodeType":865},{},[],". Instead of using stolen credentials, an attacker uses a list of commonly used usernames and passwords to attempt to compromise accounts. ",{"data":59198,"content":59199,"nodeType":881},{},[59200],{"data":59201,"marks":59202,"value":59203,"nodeType":865},{},[],"Both credential stuffing and password spraying are high-volume, automated attacks, and they are an unrelenting problem for most businesses. Microsoft observes 4,000 of them every second and nearly half of all login requests Auth0 receive each day are attempts at credential stuffing. ",{"data":59205,"content":59206,"nodeType":881},{},[59207],{"data":59208,"marks":59209,"value":59210,"nodeType":865},{},[],"The true scale of the problem is hard to grasp, as neither app vendors nor users have effective means of monitoring for unauthorized access. Typically these breaches are only detected when:",{"data":59212,"content":59213,"nodeType":1818},{},[59214,59234,59255],{"data":59215,"content":59216,"nodeType":1734},{},[59217],{"data":59218,"content":59219,"nodeType":881},{},[59220,59224,59231],{"data":59221,"marks":59222,"value":59223,"nodeType":865},{},[],"The attacker leaks the data they’ve stolen, like in the ",{"data":59225,"content":59226,"nodeType":876},{"uri":5072},[59227],{"data":59228,"marks":59229,"value":5077,"nodeType":865},{},[59230],{"type":874},{"data":59232,"marks":59233,"value":1032,"nodeType":865},{},[],{"data":59235,"content":59236,"nodeType":1734},{},[59237],{"data":59238,"content":59239,"nodeType":881},{},[59240,59244,59252],{"data":59241,"marks":59242,"value":59243,"nodeType":865},{},[],"The attacker deploys ransomware that results in business disruption, like that suffered by ",{"data":59245,"content":59246,"nodeType":876},{"uri":31881},[59247],{"data":59248,"marks":59249,"value":59251,"nodeType":865},{},[59250],{"type":874},"MGM resorts",{"data":59253,"marks":59254,"value":959,"nodeType":865},{},[],{"data":59256,"content":59257,"nodeType":1734},{},[59258],{"data":59259,"content":59260,"nodeType":881},{},[59261,59265,59274],{"data":59262,"marks":59263,"value":59264,"nodeType":865},{},[],"The attackers use a compromised account to do something deliberately in the public eye. For example, when the SEC’s X (formerly Twitter) account was compromised and ",{"data":59266,"content":59268,"nodeType":876},{"uri":59267},"https://incyber.org/en/article/fake-sec-tweet-triggers-bitcoin-surge/#:~:text=The%20fake%20headline%20convinced%20a,an%20unauthorized%20tweet%20was%20posted.",[59269],{"data":59270,"marks":59271,"value":59273,"nodeType":865},{},[59272],{"type":874},"sent out a message announcing the approval of Bitcoin ETF",{"data":59275,"marks":59276,"value":30204,"nodeType":865},{},[],{"data":59278,"content":59279,"nodeType":881},{},[59280],{"data":59281,"marks":59282,"value":59283,"nodeType":865},{},[],"Push gives you a number of controls to combat attacks using stolen and guessed passwords, both to prevent them from occurring, and detect them when they do.",{"data":59285,"content":59286,"nodeType":1860},{},[59287],{"data":59288,"marks":59289,"value":59290,"nodeType":865},{},[],"Prevent employees using credentials that have already been stolen and leaked",{"data":59292,"content":59293,"nodeType":881},{},[59294],{"data":59295,"marks":59296,"value":59297,"nodeType":865},{},[],"First, let's stop your employees from using any credentials that have already been stolen and are available to attackers for use in a credential-stuffing attack. ",{"data":59299,"content":59300,"nodeType":881},{},[59301],{"data":59302,"marks":59303,"value":59304,"nodeType":865},{},[],"Push monitors stolen credential threat intelligence and compares it to the credentials employees are currently using to access their apps. ",{"data":59306,"content":59307,"nodeType":881},{},[59308],{"data":59309,"marks":59310,"value":59311,"nodeType":865},{},[],"You might be wondering, “Does that mean Push sees all our employees’ passwords!?” No. Rather, we use a fingerprint of each password and it's checked locally in the users’ browser and never leaves it. ",{"data":59313,"content":59314,"nodeType":881},{},[59315],{"data":59316,"marks":59317,"value":59318,"nodeType":865},{},[],"When we get a match – a stolen password that could successfully be used in a credential-stuffing attack – Push alerts you.",{"data":59320,"content":59321,"nodeType":1860},{},[59322],{"data":59323,"marks":59324,"value":59325,"nodeType":865},{},[],"Enforce MFA on all employee accounts",{"data":59327,"content":59328,"nodeType":881},{},[59329],{"data":59330,"marks":59331,"value":59332,"nodeType":865},{},[],"Next step is to secure the accounts most vulnerable to a credential stuffing attack – those that only use a password for single-factor authentication. ",{"data":59334,"content":59335,"nodeType":881},{},[59336,59340,59348],{"data":59337,"marks":59338,"value":59339,"nodeType":865},{},[],"If you’re using SSO to access apps, then it’s easy to overlook instances where local accounts (e.g. username and password logins) are missing MFA – particularly if you’re relying on an IdP solution to audit and enforce MFA. ",{"data":59341,"content":59342,"nodeType":876},{"uri":16924},[59343],{"data":59344,"marks":59345,"value":59347,"nodeType":865},{},[59346],{"type":874},"You can read more about this problem in our blog post on ghost logins",{"data":59349,"marks":59350,"value":1032,"nodeType":865},{},[],{"data":59352,"content":59353,"nodeType":881},{},[59354],{"data":59355,"marks":59356,"value":59357,"nodeType":865},{},[],"Push observes every login made by your employees (both inside and outside SSO) and inspects the authentication protocols used. Accounts that are missing MFA are identified and presented to you in the Push platform.",{"data":59359,"content":59363,"nodeType":890},{"target":59360},{"sys":59361},{"id":59362,"type":887,"linkType":888},"4t1PHxzadoTBjtJua6dzuJ",[],{"data":59365,"content":59366,"nodeType":881},{},[59367],{"data":59368,"marks":59369,"value":59370,"nodeType":865},{},[],"You can then use Push to enforce MFA on employee accounts, or present them with in-browser guidance requesting that they enable it themselves.  ",{"data":59372,"content":59376,"nodeType":890},{"target":59373},{"sys":59374},{"id":59375,"type":887,"linkType":888},"3JSTEJGtLT0hfwnkpLRP4K",[],{"data":59378,"content":59379,"nodeType":1860},{},[59380],{"data":59381,"marks":59382,"value":59383,"nodeType":865},{},[],"Prevent multiple accounts being compromised by credential stuffing due to password reuse",{"data":59385,"content":59386,"nodeType":881},{},[59387],{"data":59388,"marks":59389,"value":59390,"nodeType":865},{},[],"The credential stuffing tools that attackers use will target a long list of popular business apps. If a password is reused across multiple apps and is breached, the blast radius is naturally increased – the attacker will be able to hijack multiple accounts, across numerous business applications.",{"data":59392,"content":59393,"nodeType":881},{},[59394],{"data":59395,"marks":59396,"value":59397,"nodeType":865},{},[],"Push detects when employees are trying to use the same password across multiple apps. When this happens, you can request that they change their password.",{"data":59399,"content":59403,"nodeType":890},{"target":59400},{"sys":59401},{"id":59402,"type":887,"linkType":888},"7ARHp2JPiHeKRYHwa2jwIZ",[],{"data":59405,"content":59406,"nodeType":1860},{},[59407],{"data":59408,"marks":59409,"value":59410,"nodeType":865},{},[],"Prevent password spraying breaches",{"data":59412,"content":59413,"nodeType":881},{},[59414],{"data":59415,"marks":59416,"value":59417,"nodeType":865},{},[],"To stop your employees’ accounts from being breached by password spraying attacks, Push checks every password to see if it is easily guessable for attackers.",{"data":59419,"content":59420,"nodeType":881},{},[59421],{"data":59422,"marks":59423,"value":59424,"nodeType":865},{},[],"To determine if a password is easily guessable, the Push browser agent automatically checks the password against:",{"data":59426,"content":59427,"nodeType":1818},{},[59428,59438,59448],{"data":59429,"content":59430,"nodeType":1734},{},[59431],{"data":59432,"content":59433,"nodeType":881},{},[59434],{"data":59435,"marks":59436,"value":59437,"nodeType":865},{},[],"A list of top 10,000 weak base passwords.",{"data":59439,"content":59440,"nodeType":1734},{},[59441],{"data":59442,"content":59443,"nodeType":881},{},[59444],{"data":59445,"marks":59446,"value":59447,"nodeType":865},{},[],"Number and special character variations on these weak base passwords, for example: Password1! or January2022.",{"data":59449,"content":59450,"nodeType":1734},{},[59451],{"data":59452,"content":59453,"nodeType":881},{},[59454],{"data":59455,"marks":59456,"value":59457,"nodeType":865},{},[],"Variations on these weak base passwords that replace letters with numerals (1337), for example: P455w0rd.",{"data":59459,"content":59460,"nodeType":881},{},[59461],{"data":59462,"marks":59463,"value":59464,"nodeType":865},{},[],"You can also add your own custom word list that employees and attackers will predictably try and use. Push will then stop those words being used as part of passwords.",{"data":59466,"content":59467,"nodeType":1860},{},[59468],{"data":59469,"marks":59470,"value":59471,"nodeType":865},{},[],"Detect unauthorized sessions  ",{"data":59473,"content":59474,"nodeType":881},{},[59475],{"data":59476,"marks":59477,"value":59478,"nodeType":865},{},[],"Once you have enabled all the Push controls that prevent employees from creating and using accounts that can be easily compromised by credential stuffing and password spraying attacks, the next line of defense is to detect when accounts are taken over.",{"data":59480,"content":59481,"nodeType":881},{},[59482],{"data":59483,"marks":59484,"value":59485,"nodeType":865},{},[],"Push uses its browser agent to inject a unique marker into the user agent string of sessions that occur in browsers enrolled in Push. You then add the list of domains that you want to have injected with the session marker. ",{"data":59487,"content":59488,"nodeType":881},{},[59489],{"data":59490,"marks":59491,"value":59492,"nodeType":865},{},[],"By analyzing logs from the IdP, you can identify activity from the same session that both has the Push marker and that lacks the marker. This indicates that the session is not being used by the legitimate user (your employees) in their usual work browser, and could be an attacker using their account. ",{"data":59494,"content":59495,"nodeType":1860},{},[59496],{"data":59497,"marks":59498,"value":59499,"nodeType":865},{},[],"Reduce your identity attack surface",{"data":59501,"content":59502,"nodeType":881},{},[59503],{"data":59504,"marks":59505,"value":59506,"nodeType":865},{},[],"Finally, you’ll likely want to reduce your attack surface that can be targeted by credential stuffing. In other words, reduce the number of username and password accounts your employees have. ",{"data":59508,"content":59509,"nodeType":881},{},[59510],{"data":59511,"marks":59512,"value":59513,"nodeType":865},{},[],"There are a few ways that Push can help you do this.",{"data":59515,"content":59516,"nodeType":1818},{},[59517,59532,59547],{"data":59518,"content":59519,"nodeType":1734},{},[59520],{"data":59521,"content":59522,"nodeType":881},{},[59523,59528],{"data":59524,"marks":59525,"value":59527,"nodeType":865},{},[59526],{"type":902},"Block access to unapproved apps",{"data":59529,"marks":59530,"value":59531,"nodeType":865},{},[],". Using Push, you can create a block list of apps that you don’t want your users to create accounts and identities on.",{"data":59533,"content":59534,"nodeType":1734},{},[59535],{"data":59536,"content":59537,"nodeType":881},{},[59538,59543],{"data":59539,"marks":59540,"value":59542,"nodeType":865},{},[59541],{"type":902},"Use app banners to stop users from creating local accounts",{"data":59544,"marks":59545,"value":59546,"nodeType":865},{},[],". When an employee goes to sign up to an app, Push will present an app banner that tells them to use their SSO identity and not to create a username and password account.",{"data":59548,"content":59549,"nodeType":1734},{},[59550],{"data":59551,"content":59552,"nodeType":881},{},[59553,59558],{"data":59554,"marks":59555,"value":59557,"nodeType":865},{},[59556],{"type":902},"Get existing accounts and apps behind SSO",{"data":59559,"marks":59560,"value":59561,"nodeType":865},{},[],". Push shows you how your employees are logging in to every account on every app, including whether they’re using SAML or OIDC SSO. Armed with this data, you can get your employees to use your preferred SSO solution on the apps where it’s already available, and look into whether other popular apps being used in the business offer SSO.",{"data":59563,"content":59567,"nodeType":890},{"target":59564},{"sys":59565},{"id":59566,"type":887,"linkType":888},"3y8L55hbcQaRYPCdYYb3xA",[],{"data":59569,"content":59570,"nodeType":904},{},[59571],{"data":59572,"marks":59573,"value":59574,"nodeType":865},{},[],"Stop account takeover at the push of a button",{"data":59576,"content":59577,"nodeType":881},{},[59578,59582,59589,59593,59598,59601,59606,59610,59614],{"data":59579,"marks":59580,"value":59581,"nodeType":865},{},[],"We’ve described a lot of controls in this article. The good news is that they’re all pre-configured on the the ",{"data":59583,"content":59585,"nodeType":876},{"uri":59584},"https://pushsecurity.com/help/audience/administrators/docs/manage-security-controls/#start",[59586],{"data":59587,"marks":59588,"value":55749,"nodeType":865},{},[],{"data":59590,"marks":59591,"value":59592,"nodeType":865},{},[]," page in the Push platform. When you get started with Push, you can simply turn on all the controls you want, and decide whether you want them to work in ",{"data":59594,"marks":59595,"value":59597,"nodeType":865},{},[59596],{"type":902},"monitor",{"data":59599,"marks":59600,"value":1877,"nodeType":865},{},[],{"data":59602,"marks":59603,"value":59605,"nodeType":865},{},[59604],{"type":902},"warn",{"data":59607,"marks":59608,"value":59609,"nodeType":865},{},[]," mode or ",{"data":59611,"marks":59612,"value":87,"nodeType":865},{},[59613],{"type":902},{"data":59615,"marks":59616,"value":59617,"nodeType":865},{},[]," mode.    ",{"data":59619,"content":59623,"nodeType":890},{"target":59620},{"sys":59621},{"id":59622,"type":887,"linkType":888},"6FCuO78yQMNZvkcbcALmis",[],{"data":59625,"content":59626,"nodeType":1860},{},[59627],{"data":59628,"marks":59629,"value":59630,"nodeType":865},{},[],"See it for yourself",{"data":59632,"content":59633,"nodeType":881},{},[59634,59638,59644],{"data":59635,"marks":59636,"value":59637,"nodeType":865},{},[],"To learn more, ",{"data":59639,"content":59640,"nodeType":876},{"uri":6048},[59641],{"data":59642,"marks":59643,"value":1458,"nodeType":865},{},[],{"data":59645,"marks":59646,"value":59647,"nodeType":865},{},[],". We’ll be happy to show you these features, along with how we discover all the apps your employees are using, even the ones not behind SSO.",{"data":59649,"content":59653,"nodeType":890},{"target":59650},{"sys":59651},{"id":59652,"type":887,"linkType":888},"4IRtR9zicpB7lXdz2RvIlK",[],{"data":59655,"content":59656,"nodeType":881},{},[59657],{"data":59658,"marks":59659,"value":21,"nodeType":865},{},[],"Hackers don’t hack in, they log in: How to prevent account takeover with Push","How Push stops attackers from using identity attack tools and techniques to compromise your employee user accounts. ","2024-08-19T00:00:00.000Z","how-to-prevent-account-takeover-with-push",{"items":59665},[59666,59668],{"sys":59667,"name":342},{"id":4510},{"sys":59669,"name":4507},{"id":4506},{"items":59671},[59672],{"fullName":32085,"firstName":32086,"jobTitle":20082,"profilePicture":59673},{"url":32088},{"__typename":1485,"sys":59675,"content":59677,"title":60084,"synopsis":60085,"hashTags":59,"publishedDate":60086,"slug":60087,"tagsCollection":60088,"authorsCollection":60094},{"id":59676},"4EfGLsD4qOkE4AoTUoL83m",{"json":59678},{"data":59679,"content":59680,"nodeType":1463},{},[59681,59687,59708,59729,59747,59767,59790,59797,59817,59838,59845,59851,59858,59865,59872,59879,59886,59893,59900,59907,59914,59934,59941,59947,59969,59976,59991,59997,60016,60023,60030,60036,60043,60061,60067],{"data":59682,"content":59686,"nodeType":890},{"target":59683},{"sys":59684},{"id":59685,"type":887,"linkType":888},"B8i0EK90Dn7FLrJXR4ANh",[],{"data":59688,"content":59689,"nodeType":881},{},[59690,59694,59704],{"data":59691,"marks":59692,"value":59693,"nodeType":865},{},[],"Is the golden era of MFA protection over? Watch a demo of an ",{"data":59695,"content":59699,"nodeType":19000},{"target":59696},{"sys":59697},{"id":59698,"type":887,"linkType":888},"7DJnckJxP4CXyXhPJJpby5",[59700],{"data":59701,"marks":59702,"value":59703,"nodeType":865},{},[],"EvilNoVNC phishing attack",{"data":59705,"marks":59706,"value":59707,"nodeType":865},{},[]," and you may be left sweating a little and whispering “FIDO2” like a protection spell.",{"data":59709,"content":59710,"nodeType":881},{},[59711,59715,59725],{"data":59712,"marks":59713,"value":59714,"nodeType":865},{},[],"With the widespread adoption of MFA, attackers are ",{"data":59716,"content":59720,"nodeType":19000},{"target":59717},{"sys":59718},{"id":59719,"type":887,"linkType":888},"6XIts2UEnrsJDki8gKDXyI",[59721],{"data":59722,"marks":59723,"value":59724,"nodeType":865},{},[],"increasingly turning",{"data":59726,"marks":59727,"value":59728,"nodeType":865},{},[]," to more sophisticated methods of credential theft as their initial point of entry. ",{"data":59730,"content":59731,"nodeType":881},{},[59732,59736,59743],{"data":59733,"marks":59734,"value":59735,"nodeType":865},{},[],"Newer phishing approaches include reverse proxies as well as tools that mimic legitimate login pages by rendering the webpages and then displaying those renders to the unsuspecting end-user. While these tools are not always common knowledge among blue teams, their use is ",{"data":59737,"content":59738,"nodeType":876},{"uri":55668},[59739],{"data":59740,"marks":59741,"value":59742,"nodeType":865},{},[],"on the rise",{"data":59744,"marks":59745,"value":59746,"nodeType":865},{},[],", an unsurprising response to the broad use of multi-factor authentication in many organizations.",{"data":59748,"content":59749,"nodeType":881},{},[59750,59754,59763],{"data":59751,"marks":59752,"value":59753,"nodeType":865},{},[],"What sets this generation of ",{"data":59755,"content":59758,"nodeType":19000},{"target":59756},{"sys":59757},{"id":59698,"type":887,"linkType":888},[59759],{"data":59760,"marks":59761,"value":59762,"nodeType":865},{},[],"Adversary-in-the-Middle (AitM) phishing tools",{"data":59764,"marks":59765,"value":59766,"nodeType":865},{},[]," apart? ",{"data":59768,"content":59769,"nodeType":1818},{},[59770,59780],{"data":59771,"content":59772,"nodeType":1734},{},[59773],{"data":59774,"content":59775,"nodeType":881},{},[59776],{"data":59777,"marks":59778,"value":59779,"nodeType":865},{},[],"They act as a proxy between the user and a legitimate web login page, allowing the attacker to bypass MFA and harvest credentials and session tokens.",{"data":59781,"content":59782,"nodeType":1734},{},[59783],{"data":59784,"content":59785,"nodeType":881},{},[59786],{"data":59787,"marks":59788,"value":59789,"nodeType":865},{},[],"They give off little scent to end-users, because the end-user is logging into the legitimate site, just by taking a detour via the attacker’s device.",{"data":59791,"content":59792,"nodeType":881},{},[59793],{"data":59794,"marks":59795,"value":59796,"nodeType":865},{},[],"These AitM tools are also difficult to detect — unless you have eyes in the browser.",{"data":59798,"content":59799,"nodeType":881},{},[59800,59804,59813],{"data":59801,"marks":59802,"value":59803,"nodeType":865},{},[],"Powered by the Push browser agent, Push now offers a ",{"data":59805,"content":59808,"nodeType":19000},{"target":59806},{"sys":59807},{"id":55924,"type":887,"linkType":888},[59809],{"data":59810,"marks":59811,"value":59812,"nodeType":865},{},[],"preconfigured set of detections",{"data":59814,"marks":59815,"value":59816,"nodeType":865},{},[]," for phishing tools like Evilginx and others, informed by our threat detection team’s research into their behavior. This phishing tool detection feature will automatically prevent users from accessing a site that’s running one of these malicious tools, and display a custom warning message to your end-users.",{"data":59818,"content":59819,"nodeType":881},{},[59820,59824,59834],{"data":59821,"marks":59822,"value":59823,"nodeType":865},{},[],"While Push already provides strong phishing protection by ",{"data":59825,"content":59829,"nodeType":19000},{"target":59826},{"sys":59827},{"id":59828,"type":887,"linkType":888},"4UtRVoFElDduWJBx9Sa4Cw",[59830],{"data":59831,"marks":59832,"value":59833,"nodeType":865},{},[],"preventing SSO password use",{"data":59835,"marks":59836,"value":59837,"nodeType":865},{},[]," on non-IdP webpages (in other words, it stops you from using your Okta password on any page that isn’t an Okta login page), this new feature allows us to sharpen our anti-phishing capabilities by detecting malware on a site before a user even interacts with the page. ",{"data":59839,"content":59840,"nodeType":881},{},[59841],{"data":59842,"marks":59843,"value":59844,"nodeType":865},{},[],"In this article, we’ll describe our approach to detecting these newer phishing tools, including how we’re borrowing techniques from the world of EDR, and how you can combine phishing tool detection with other Push controls for a defense-in-depth strategy that covers both the user and the application sides of the equation.",{"data":59846,"content":59850,"nodeType":890},{"target":59847},{"sys":59848},{"id":59849,"type":887,"linkType":888},"59q6klX2j7ClgUvmix93sG",[],{"data":59852,"content":59853,"nodeType":904},{},[59854],{"data":59855,"marks":59856,"value":59857,"nodeType":865},{},[],"Taking a page from EDR",{"data":59859,"content":59860,"nodeType":881},{},[59861],{"data":59862,"marks":59863,"value":59864,"nodeType":865},{},[],"Most phishing prevention solutions rely on lists of known-bad sites as the source of intelligence. These are always going to be a step behind reality because they rely on ever-shifting secondary attributes such as domain names (though we won’t be disabling Chrome Safe Browsing anytime soon, and we’re not trying to replace it).",{"data":59866,"content":59867,"nodeType":881},{},[59868],{"data":59869,"marks":59870,"value":59871,"nodeType":865},{},[],"As veterans of the EDR world, we’re drawn to think in analogous terms. With detecting AitM phishing tools, that means expanding on the concept of dynamic analysis on the endpoint. EDR allows you to dynamically analyze the behavior of malware live and at scale, rather than focusing on easy-to-change indicators like file hashes or domain names.",{"data":59873,"content":59874,"nodeType":881},{},[59875],{"data":59876,"marks":59877,"value":59878,"nodeType":865},{},[],"Applying this idea to malware that runs in the browser requires a solution that is in the browser, like the Push browser agent.",{"data":59880,"content":59881,"nodeType":881},{},[59882],{"data":59883,"marks":59884,"value":59885,"nodeType":865},{},[],"So we’re expanding the attributes that are traditionally analyzed to spot indicators of compromise (IoCs) beyond domains, file names, file hashes, IP addresses, etc., to also include behavioral attributes of malware that are much harder to change, such as Javascript calls being made or data structures saved to local storage.",{"data":59887,"content":59888,"nodeType":881},{},[59889],{"data":59890,"marks":59891,"value":59892,"nodeType":865},{},[],"By performing behavioral analysis on AitM automated proxy tools, we can directly analyze the application for a precise and immediate identification. ",{"data":59894,"content":59895,"nodeType":881},{},[59896],{"data":59897,"marks":59898,"value":59899,"nodeType":865},{},[],"Push researchers are regularly identifying and adding detections for new toolkits — think of this like Push’s database of threat research in action.",{"data":59901,"content":59902,"nodeType":904},{},[59903],{"data":59904,"marks":59905,"value":59906,"nodeType":865},{},[],"How it works",{"data":59908,"content":59909,"nodeType":881},{},[59910],{"data":59911,"marks":59912,"value":59913,"nodeType":865},{},[],"If you’re new to Push, a bit of context may be useful. Push uses a browser agent deployed to employee browsers (we support all major browsers) to prevent, detect, and block identity attacks. ",{"data":59915,"content":59916,"nodeType":881},{},[59917,59921,59930],{"data":59918,"marks":59919,"value":59920,"nodeType":865},{},[],"By directly observing user behavior at the login event, Push provides broad and actionable context across all the apps your employees are using, how they are accessing them, their MFA methods, and where they’re using insecure and reused passwords. With this context as the foundation, Push enforces your desired ",{"data":59922,"content":59925,"nodeType":19000},{"target":59923},{"sys":59924},{"id":55743,"type":887,"linkType":888},[59926],{"data":59927,"marks":59928,"value":59929,"nodeType":865},{},[],"security controls",{"data":59931,"marks":59932,"value":59933,"nodeType":865},{},[],", including preventing SSO password reuse, blocking malicious websites, or steering employees to approved apps only.",{"data":59935,"content":59936,"nodeType":881},{},[59937],{"data":59938,"marks":59939,"value":59940,"nodeType":865},{},[],"Once configured by an administrator, phishing tool detection will immediately check for the fingerprints of these toolkits as end-users visit websites and then display your custom warn or block message. ",{"data":59942,"content":59946,"nodeType":890},{"target":59943},{"sys":59944},{"id":59945,"type":887,"linkType":888},"1LdHJjTDlOiie5mctbAVvZ",[],{"data":59948,"content":59949,"nodeType":881},{},[59950,59953,59957,59961,59965],{"data":59951,"marks":59952,"value":51783,"nodeType":865},{},[],{"data":59954,"marks":59955,"value":55902,"nodeType":865},{},[59956],{"type":902},{"data":59958,"marks":59959,"value":59960,"nodeType":865},{},[]," mode, users cannot proceed to the site where malicious software has been detected. In ",{"data":59962,"marks":59963,"value":55894,"nodeType":865},{},[59964],{"type":902},{"data":59966,"marks":59967,"value":59968,"nodeType":865},{},[]," mode, users can choose to proceed if they are sure it’s not a phishing site.",{"data":59970,"content":59971,"nodeType":881},{},[59972],{"data":59973,"marks":59974,"value":59975,"nodeType":865},{},[],"In both cases, users do not need to interact with a page (by typing, clicking, etc.) for Push to trigger the custom message. ",{"data":59977,"content":59978,"nodeType":881},{},[59979,59982,59988],{"data":59980,"marks":59981,"value":58978,"nodeType":865},{},[],{"data":59983,"content":59984,"nodeType":876},{"uri":55771},[59985],{"data":59986,"marks":59987,"value":58797,"nodeType":865},{},[],{"data":59989,"marks":59990,"value":58988,"nodeType":865},{},[],{"data":59992,"content":59996,"nodeType":890},{"target":59993},{"sys":59994},{"id":59995,"type":887,"linkType":888},"6oAhxLBPVxN3Rcw2kFeVtG",[],{"data":59998,"content":59999,"nodeType":881},{},[60000,60004,60012],{"data":60001,"marks":60002,"value":60003,"nodeType":865},{},[],"Pairing this phishing detection capability with Push’s ",{"data":60005,"content":60008,"nodeType":19000},{"target":60006},{"sys":60007},{"id":19725,"type":887,"linkType":888},[60009],{"data":60010,"marks":60011,"value":43665,"nodeType":865},{},[],{"data":60013,"marks":60014,"value":60015,"nodeType":865},{},[]," feature provides a strong defense-in-depth strategy for stopping credential theft.",{"data":60017,"content":60018,"nodeType":881},{},[60019],{"data":60020,"marks":60021,"value":60022,"nodeType":865},{},[],"SSO password protection works by analyzing user behavior — namely, is a user entering their SSO password onto a page that does not belong to the legitimate identity provider.",{"data":60024,"content":60025,"nodeType":881},{},[60026],{"data":60027,"marks":60028,"value":60029,"nodeType":865},{},[],"Phishing tool detection adds in the application-level behavioral analysis. In addition, when Push identifies a new, previously unknown phishing tool in the wild via blocked SSO credential theft, we add its fingerprints to the browser agent’s detective capabilities.  ",{"data":60031,"content":60032,"nodeType":904},{},[60033],{"data":60034,"marks":60035,"value":5242,"nodeType":865},{},[],{"data":60037,"content":60038,"nodeType":881},{},[60039],{"data":60040,"marks":60041,"value":60042,"nodeType":865},{},[],"We’re just scratching the surface on this approach and are exploring how Push can identify and block other web-delivered malware and Javascript-based attack types beyond AitM tools. Think HTML smuggling, tabnabbing, and the like.",{"data":60044,"content":60045,"nodeType":881},{},[60046,60050,60058],{"data":60047,"marks":60048,"value":60049,"nodeType":865},{},[],"Got feedback? We’d ",{"data":60051,"content":60053,"nodeType":876},{"uri":60052},"/contact/",[60054],{"data":60055,"marks":60056,"value":60057,"nodeType":865},{},[],"love to talk",{"data":60059,"marks":60060,"value":959,"nodeType":865},{},[],{"data":60062,"content":60063,"nodeType":904},{},[60064],{"data":60065,"marks":60066,"value":30636,"nodeType":865},{},[],{"data":60068,"content":60069,"nodeType":881},{},[60070,60074,60080],{"data":60071,"marks":60072,"value":60073,"nodeType":865},{},[],"To see Push in action, ",{"data":60075,"content":60076,"nodeType":876},{"uri":6048},[60077],{"data":60078,"marks":60079,"value":1458,"nodeType":865},{},[],{"data":60081,"marks":60082,"value":60083,"nodeType":865},{},[],". We’ll be happy to show you this feature, along with how we discover all the apps your employees are using, even the ones not behind SSO, and how we detect vulnerable identities and stop identity attacks with browser-based controls.","Introducing AitM phishing toolkit detection, powered by the Push browser agent","Push analyzes behavioral attributes of malware to identify phishing tools like Evilginx and NakedPages and immediately block end-users from visiting them.","2024-06-06T00:00:00.000Z","introducing-aitm-phishing-toolkit-detection-powered-by-the-push-browser",{"items":60089},[60090,60092],{"sys":60091,"name":56404},{"id":56403},{"sys":60093,"name":342},{"id":4510},{"items":60095},[60096],{"fullName":20080,"firstName":20081,"jobTitle":20082,"profilePicture":60097},{"url":20084},"how-many-vulnerable-identities-do-you-have","blog/how-many-vulnerable-identities-do-you-have",{"json":60101},{"data":60102,"content":60103,"nodeType":1463},{},[60104],{"data":60105,"content":60106,"nodeType":881},{},[60107],{"data":60108,"marks":60109,"value":60110,"nodeType":865},{},[],"Answering key questions about your exposure to identity threats using Push data.","Using Push data to calculate how many vulnerable identities the average organization has, and how they lead to different methods of account takeover. ",{"id":60113,"publishedAt":60114},"2oCKAlWLSHMLeZF6j8YniH","2026-08-13T09:35:13.714Z",{"items":60116},[60117,60119],{"sys":60118,"name":4507},{"id":4506},{"sys":60120,"name":342},{"id":4510},{"items":60122},[60123,60125,60127,60129,60131,60133,60135,60137,60139,60141,60143,60145,60147,60149,60151],{"sys":60124,"name":413,"slug":414,"tier":31},{"id":410},{"sys":60126,"name":297,"slug":298,"tier":31},{"id":294},{"sys":60128,"name":342,"slug":343,"tier":31},{"id":339},{"sys":60130,"name":519,"slug":520,"tier":31},{"id":516},{"sys":60132,"name":545,"slug":546,"tier":31},{"id":542},{"sys":60134,"name":279,"slug":280,"tier":31},{"id":276},{"sys":60136,"name":502,"slug":503,"tier":45},{"id":499},{"sys":60138,"name":457,"slug":458,"tier":45},{"id":454},{"sys":60140,"name":466,"slug":467,"tier":45},{"id":463},{"sys":60142,"name":333,"slug":334,"tier":45},{"id":330},{"sys":60144,"name":395,"slug":396,"tier":45},{"id":392},{"sys":60146,"name":404,"slug":405,"tier":45},{"id":401},{"sys":60148,"name":261,"slug":262,"tier":45},{"id":258},{"sys":60150,"name":493,"slug":494,"tier":45},{"id":490},{"sys":60152,"name":324,"slug":325,"tier":45},{"id":321},"x2kYyrqykcVvQGdZELgLzkiJpuYBM8pvyrM1l0e2ab0",{"id":60155,"title":60156,"authorsCollection":60157,"content":60162,"extension":228,"faqItemsCollection":61213,"faqTitle":59,"featured":6,"hashTags":59,"meta":61215,"metaTitle":61216,"ogImage":59,"postType":7216,"publishedDate":61217,"relatedBlogPostsCollection":61218,"slug":63624,"stem":63625,"subtitle":59,"summary":63626,"synopsis":63637,"sys":63638,"tagsCollection":63641,"topicsCollection":63647,"__hash__":63691},"blog/blog/the-saas-attack-matrix-one-year-on.json","The SaaS attack matrix: A year in review",{"items":60158},[60159],{"fullName":5373,"firstName":5374,"jobTitle":5375,"socialLinks":60160,"profilePicture":60161},[6440],{"url":5377},{"json":60163,"links":61204},{"data":60164,"content":60165,"nodeType":1463},{},[60166,60184,60191,60198,60205,60212,60215,60222,60305,60312,60319,60326,60341,60360,60367,60370,60377,60384,60390,60407,60431,60438,60445,60476,60507,60514,60532,60539,60546,60553,60561,60568,60597,60603,60620,60652,60659,60678,60685,60691,60709,60716,60723,60726,60733,60740,60747,60750,60757,60764,60771,60790,60919,60926,60929,60936,60943,61044,61051,61058,61061,61068,61075,61125,61132,61139,61142,61148,61155,61173,61192,61198],{"data":60167,"content":60168,"nodeType":881},{},[60169,60173,60180],{"data":60170,"marks":60171,"value":60172,"nodeType":865},{},[],"When we created the ",{"data":60174,"content":60175,"nodeType":876},{"uri":5192},[60176],{"data":60177,"marks":60178,"value":4540,"nodeType":865},{},[60179],{"type":874},{"data":60181,"marks":60182,"value":60183,"nodeType":865},{},[],", we made a conscious break away from the endpoint-focused techniques captured in industry resources like the MITRE ATT&CK Framework. ",{"data":60185,"content":60186,"nodeType":881},{},[60187],{"data":60188,"marks":60189,"value":60190,"nodeType":865},{},[],"At the time, we were anticipating a shift that was yet to fully materialize. But, a lot can change (and has changed) in the space of a year. We’ve seen the impact of SaaS account takeover attacks laid bare. Snowflake, billed one of the biggest breaches in history, is a telling example that we’ll no doubt look back on as a watershed moment. ",{"data":60192,"content":60193,"nodeType":881},{},[60194],{"data":60195,"marks":60196,"value":60197,"nodeType":865},{},[],"It isn’t an exaggeration or marketing fluff to say that identity attacks are the #1 threat facing organizations today. SaaS apps, and the identities that are used to access them, are clearly the weakest link – and therefore the lowest-hanging fruit for attackers to reach for. ",{"data":60199,"content":60200,"nodeType":881},{},[60201],{"data":60202,"marks":60203,"value":60204,"nodeType":865},{},[],"This makes resources like the SaaS attack matrix more relevant than ever – both for red teams seeking to emulate the latest offensive techniques, and blue teams trying to defend against them. Understanding these techniques is essential for building effective defenses, and identifying where new platforms and controls are required to do so. ",{"data":60206,"content":60207,"nodeType":881},{},[60208],{"data":60209,"marks":60210,"value":60211,"nodeType":865},{},[],"Let’s take a look at what we’ve learned so far.",{"data":60213,"content":60214,"nodeType":894},{},[],{"data":60216,"content":60217,"nodeType":904},{},[60218],{"data":60219,"marks":60220,"value":60221,"nodeType":865},{},[],"Hot right now: Initial access techniques",{"data":60223,"content":60224,"nodeType":881},{},[60225,60229,60236,60239,60247,60250,60257,60260,60268,60271,60280,60284,60291,60294,60302],{"data":60226,"marks":60227,"value":60228,"nodeType":865},{},[],"The majority of techniques we've seen rise to prominence in 2023/4 sit predominantly in the initial access phase. Since the matrix first launched, we’ve added more techniques to initial access than any other category, including ",{"data":60230,"content":60231,"nodeType":876},{"uri":11116},[60232],{"data":60233,"marks":60234,"value":11122,"nodeType":865},{},[60235],{"type":874},{"data":60237,"marks":60238,"value":1877,"nodeType":865},{},[],{"data":60240,"content":60241,"nodeType":876},{"uri":42803},[60242],{"data":60243,"marks":60244,"value":60246,"nodeType":865},{},[60245],{"type":874},"AitM phishing",{"data":60248,"marks":60249,"value":1877,"nodeType":865},{},[],{"data":60251,"content":60252,"nodeType":876},{"uri":42831},[60253],{"data":60254,"marks":60255,"value":58135,"nodeType":865},{},[60256],{"type":874},{"data":60258,"marks":60259,"value":1877,"nodeType":865},{},[],{"data":60261,"content":60262,"nodeType":876},{"uri":34154},[60263],{"data":60264,"marks":60265,"value":60267,"nodeType":865},{},[60266],{"type":874},"MFA downgrade attacks",{"data":60269,"marks":60270,"value":1791,"nodeType":865},{},[],{"data":60272,"content":60274,"nodeType":876},{"uri":60273},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/guest_access_abuse/description.md",[60275],{"data":60276,"marks":60277,"value":60279,"nodeType":865},{},[60278],{"type":874},"guest access abuse,",{"data":60281,"marks":60282,"value":60283,"nodeType":865},{},[]," all of which are methods of account takeover – complementing the classics like ",{"data":60285,"content":60286,"nodeType":876},{"uri":53601},[60287],{"data":60288,"marks":60289,"value":53607,"nodeType":865},{},[60290],{"type":874},{"data":60292,"marks":60293,"value":1651,"nodeType":865},{},[],{"data":60295,"content":60297,"nodeType":876},{"uri":60296},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/email_phishing/description.md",[60298],{"data":60299,"marks":60300,"value":60301,"nodeType":865},{},[],"email phishing",{"data":60303,"marks":60304,"value":959,"nodeType":865},{},[],{"data":60306,"content":60307,"nodeType":881},{},[60308],{"data":60309,"marks":60310,"value":60311,"nodeType":865},{},[],"We’ll spend a bit of time delving into these techniques in the next section, but let’s first consider what this tells us about SaaS attacks. ",{"data":60313,"content":60314,"nodeType":1860},{},[60315],{"data":60316,"marks":60317,"value":60318,"nodeType":865},{},[],"Identity attacks are the leading cause of SaaS breaches",{"data":60320,"content":60321,"nodeType":881},{},[60322],{"data":60323,"marks":60324,"value":60325,"nodeType":865},{},[],"The initial identity attack designed to achieve account takeover is the most important part of the SaaS attack chain. The fact that attackers are focused on finding new ways of compromising identities illustrates the value, but also the fragility of the identity controls that most organizations are relying on (which may also be one of the reasons attackers are fixated on it). Whether we’re talking about anti-phishing protections, conditional access policies, or MFA – attackers are continually finding new ways of getting around them.",{"data":60327,"content":60328,"nodeType":881},{},[60329,60333,60338],{"data":60330,"marks":60331,"value":60332,"nodeType":865},{},[],"And, if all an attacker really needs to do to cause harm is log into an app and abuse its legitimate features and functions, there really is no margin for error – you need to successfully stop the initial identity attack ",{"data":60334,"marks":60335,"value":60337,"nodeType":865},{},[60336],{"type":902},"every time",{"data":60339,"marks":60340,"value":14775,"nodeType":865},{},[],{"data":60342,"content":60343,"nodeType":881},{},[60344,60348,60356],{"data":60345,"marks":60346,"value":60347,"nodeType":865},{},[],"You can’t rely on your endpoint and network controls to catch them later like you used to. Equally, it’s unlikely that your CASB or DLP solution can stop a legitimate app using legitimate features like ",{"data":60349,"content":60350,"nodeType":876},{"uri":45639},[60351],{"data":60352,"marks":60353,"value":60355,"nodeType":865},{},[60354],{"type":874},"API-based workflows",{"data":60357,"marks":60358,"value":60359,"nodeType":865},{},[]," from sending data to attacker-controlled infrastructure. ",{"data":60361,"content":60362,"nodeType":881},{},[60363],{"data":60364,"marks":60365,"value":60366,"nodeType":865},{},[],"It’s a classic case of attackers only needing to win once. And right now, it’s a numbers game that they’re winning enough to keep them coming back for more. ",{"data":60368,"content":60369,"nodeType":894},{},[],{"data":60371,"content":60372,"nodeType":904},{},[60373],{"data":60374,"marks":60375,"value":60376,"nodeType":865},{},[],"Most wanted: Techniques gaining notoriety in the wild",{"data":60378,"content":60379,"nodeType":881},{},[60380],{"data":60381,"marks":60382,"value":60383,"nodeType":865},{},[],"Let’s take a closer look at some of the techniques we’ve seen rise to prominence in 2023/4. ",{"data":60385,"content":60386,"nodeType":1860},{},[60387],{"data":60388,"marks":60389,"value":395,"nodeType":865},{},[],{"data":60391,"content":60392,"nodeType":881},{},[60393,60396,60403],{"data":60394,"marks":60395,"value":21,"nodeType":865},{},[],{"data":60397,"content":60398,"nodeType":876},{"uri":11116},[60399],{"data":60400,"marks":60401,"value":395,"nodeType":865},{},[60402],{"type":874},{"data":60404,"marks":60405,"value":60406,"nodeType":865},{},[]," is a technique that exploits the fact that SaaS user accounts often enable multiple simultaneous logins using different sign-in methods. ",{"data":60408,"content":60409,"nodeType":881},{},[60410,60414,60419,60422,60427],{"data":60411,"marks":60412,"value":60413,"nodeType":865},{},[],"Ghost logins can be used for both the ",{"data":60415,"marks":60416,"value":60418,"nodeType":865},{},[60417],{"type":902},"initial access",{"data":60420,"marks":60421,"value":1651,"nodeType":865},{},[],{"data":60423,"marks":60424,"value":60426,"nodeType":865},{},[60425],{"type":902},"persistence",{"data":60428,"marks":60429,"value":60430,"nodeType":865},{},[]," stages of a cyber attack, doubling up as a defense evasion technique because of low login method visibility.",{"data":60432,"content":60433,"nodeType":881},{},[60434],{"data":60435,"marks":60436,"value":60437,"nodeType":865},{},[],"For initial access, the technique exploits the fact that local and SSO logins can exist simultaneously. Given that many apps are self-adopted by users, it’s likely that many users will default to a local username and password login at this stage. If the app is later adopted companywide and brought into SSO, the original local login will continue to exist unless explicitly disabled or deleted. ",{"data":60439,"content":60440,"nodeType":881},{},[60441],{"data":60442,"marks":60443,"value":60444,"nodeType":865},{},[],"Because MFA is applied at the app and IdP level independently, it is possible to end up with an SSO login that requires MFA (via the IdP login), but a local login that does not. This creates an easy target identity for attackers to look for. When combined with other identity vulnerabilities such as weak, breached, and/or reused passwords, attackers can easily automate ghost login discovery and exploitation at scale.  ",{"data":60446,"content":60447,"nodeType":881},{},[60448,60452,60460,60464,60472],{"data":60449,"marks":60450,"value":60451,"nodeType":865},{},[],"We saw the impact of ghost logins for initial access with ",{"data":60453,"content":60454,"nodeType":876},{"uri":5072},[60455],{"data":60456,"marks":60457,"value":60459,"nodeType":865},{},[60458],{"type":874},"the recent ShinyHunters campaign against Snowflake customers",{"data":60461,"marks":60462,"value":60463,"nodeType":865},{},[],". Because Snowflake accounts did not require mandatory MFA for accounts, or give admins the ability to enforce MFA by default, attackers were able to find and exploit a large number of Snowflake accounts using breached credentials from historical data breach dumps. Much of the industry response focused on ensuring SSO and MFA were deployed, but ",{"data":60465,"content":60466,"nodeType":876},{"uri":53345},[60467],{"data":60468,"marks":60469,"value":60471,"nodeType":865},{},[60470],{"type":874},"the practicalities of gathering data and manually unsetting local passwords in Snowflake",{"data":60473,"marks":60474,"value":60475,"nodeType":865},{},[]," meant that ghost logins were easy to overlook by organizations responding to the attacks.   ",{"data":60477,"content":60478,"nodeType":881},{},[60479,60483,60491,60495,60503],{"data":60480,"marks":60481,"value":60482,"nodeType":865},{},[],"Ghost logins can also be created after an attacker has established access to an app. For example, if a social login is used to access an account, an adversary may be able to configure a separate username/password login, or even (though much less commonly) connect a second social account that the adversary controls. If the account has sufficient privileges, it may also be possible to ",{"data":60484,"content":60485,"nodeType":876},{"uri":42658},[60486],{"data":60487,"marks":60488,"value":60490,"nodeType":865},{},[60489],{"type":874},"set up or change the SAML login settings to inject a malicious URL",{"data":60492,"marks":60493,"value":60494,"nodeType":865},{},[]," (for example to an attacker controlled tenant) or simply ",{"data":60496,"content":60497,"nodeType":876},{"uri":30315},[60498],{"data":60499,"marks":60500,"value":60502,"nodeType":865},{},[60501],{"type":874},"configure API access",{"data":60504,"marks":60505,"value":60506,"nodeType":865},{},[]," to forgo the need to log in entirely. ",{"data":60508,"content":60509,"nodeType":1860},{},[60510],{"data":60511,"marks":60512,"value":60513,"nodeType":865},{},[],"AitM phishing ",{"data":60515,"content":60516,"nodeType":881},{},[60517,60520,60528],{"data":60518,"marks":60519,"value":21,"nodeType":865},{},[],{"data":60521,"content":60522,"nodeType":876},{"uri":42803},[60523],{"data":60524,"marks":60525,"value":60527,"nodeType":865},{},[60526],{"type":874},"Adversary-in-the-Middle (AitM) phishing",{"data":60529,"marks":60530,"value":60531,"nodeType":865},{},[]," is a newer variant of phishing that uses dedicated tooling to act as a web proxy between the victim and a legitimate login portal for an application the victim has access to, principally to make it easier to defeat MFA protection (with the victim responding to the MFA request as part of the attack).",{"data":60533,"content":60534,"nodeType":881},{},[60535],{"data":60536,"marks":60537,"value":60538,"nodeType":865},{},[],"As it’s a proxy to the real application, the page will appear exactly as the user expects, because they are logging into the legitimate site – just taking a detour via the attacker’s device. For example, if accessing their webmail, the user will see all their real emails; if accessing their cloud file store then all their real files will be present, etc. ",{"data":60540,"content":60541,"nodeType":881},{},[60542],{"data":60543,"marks":60544,"value":60545,"nodeType":865},{},[],"This gives AitM an increased sense of authenticity and makes the compromise less obvious to the user. Because the attacker is sitting in the middle of this connection, they are able to observe all interactions and take control of the authenticated session. ",{"data":60547,"content":60548,"nodeType":881},{},[60549],{"data":60550,"marks":60551,"value":60552,"nodeType":865},{},[],"Alongside AitM phishing is Browser-in-the-Middle (BitM), really a form of sub-technique. Rather than act as a reverse web proxy, this technique tricks a target into directly controlling the attacker’s own browser remotely using desktop screen sharing and control approaches (such as VNC and RDP). ",{"data":60554,"content":60555,"nodeType":881},{},[60556],{"data":60557,"marks":60558,"value":60560,"nodeType":865},{},[60559],{"type":902},"This is the virtual equivalent of an attacker handing their laptop to their victim, asking them to login to Okta for them, and then taking their laptop back afterwards.",{"data":60562,"content":60563,"nodeType":881},{},[60564],{"data":60565,"marks":60566,"value":60567,"nodeType":865},{},[],"A growing majority of modern phishing attacks typically leverage AitM or BitM tooling – they are now the standard choice for threat actors, offering the ability to bypass MFA without any real tradeoff. ",{"data":60569,"content":60570,"nodeType":881},{},[60571,60575,60583,60586,60594],{"data":60572,"marks":60573,"value":60574,"nodeType":865},{},[],"For more information you can ",{"data":60576,"content":60577,"nodeType":876},{"uri":28776},[60578],{"data":60579,"marks":60580,"value":60582,"nodeType":865},{},[60581],{"type":874},"read our recent blog post",{"data":60584,"marks":60585,"value":8048,"nodeType":865},{},[],{"data":60587,"content":60588,"nodeType":876},{"uri":58950},[60589],{"data":60590,"marks":60591,"value":60593,"nodeType":865},{},[60592],{"type":874},"watch our on-demand webinar on Phishing 2.0 to see AitM and BitM tools like Evilginx and EvilnoVNC in action",{"data":60595,"marks":60596,"value":1032,"nodeType":865},{},[],{"data":60598,"content":60599,"nodeType":1860},{},[60600],{"data":60601,"marks":60602,"value":333,"nodeType":865},{},[],{"data":60604,"content":60605,"nodeType":881},{},[60606,60609,60616],{"data":60607,"marks":60608,"value":21,"nodeType":865},{},[],{"data":60610,"content":60611,"nodeType":876},{"uri":53601},[60612],{"data":60613,"marks":60614,"value":333,"nodeType":865},{},[60615],{"type":874},{"data":60617,"marks":60618,"value":60619,"nodeType":865},{},[]," attacks continue to pose a risk to organizations. Despite the fact that MFA has now become an expected control, accounts without MFA continue to be hacked as a result of using weak, reused, and/or previously breached credentials. ",{"data":60621,"content":60622,"nodeType":881},{},[60623,60627,60635,60639,60648],{"data":60624,"marks":60625,"value":60626,"nodeType":865},{},[],"Credential stuffing is being fed by an increase in the number of ",{"data":60628,"content":60630,"nodeType":876},{"uri":60629},"https://pushsecurity.com/blog/what-the-rise-of-infostealers-says-about-identity-attacks/?utm_source=ebook&utm_medium=organic",[60631],{"data":60632,"marks":60633,"value":423,"nodeType":865},{},[60634],{"type":874},{"data":60636,"marks":60637,"value":60638,"nodeType":865},{},[]," attacks designed to harvest credentials to be sold on criminal marketplaces. Infostealers have been boosted by the success of the Snowflake attacks (",{"data":60640,"content":60642,"nodeType":876},{"uri":60641},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-snowflake-june-2024?utm_source=ebook&utm_medium=organic",[60643],{"data":60644,"marks":60645,"value":60647,"nodeType":865},{},[60646],{"type":874},"where 80% of the credentials used to access accounts could be traced back to infostealer infections dating back to 2020",{"data":60649,"marks":60650,"value":60651,"nodeType":865},{},[],"). ",{"data":60653,"content":60654,"nodeType":1860},{},[60655],{"data":60656,"marks":60657,"value":60658,"nodeType":865},{},[],"Session cookie theft",{"data":60660,"content":60661,"nodeType":881},{},[60662,60666,60674],{"data":60663,"marks":60664,"value":60665,"nodeType":865},{},[],"Attackers are increasingly ",{"data":60667,"content":60668,"nodeType":876},{"uri":42831},[60669],{"data":60670,"marks":60671,"value":60673,"nodeType":865},{},[60672],{"type":874},"targeting session cookies",{"data":60675,"marks":60676,"value":60677,"nodeType":865},{},[]," to be able to hijack live user sessions as a means of getting around MFA. Although session cookies are predominantly stolen via infostealers, techniques like AitM and BitM phishing described above are also methods of stealing session cookies and hijacking sessions.",{"data":60679,"content":60680,"nodeType":881},{},[60681],{"data":60682,"marks":60683,"value":60684,"nodeType":865},{},[],"While the majority of infostealer data dumps result in credential stuffing attacks rather than session hijacking, as the infostealer marketplace continues to heat up, it’s likely that more instances of session cookie theft will be the cause of breaches going forward. ",{"data":60686,"content":60687,"nodeType":1860},{},[60688],{"data":60689,"marks":60690,"value":42781,"nodeType":865},{},[],{"data":60692,"content":60693,"nodeType":881},{},[60694,60698,60705],{"data":60695,"marks":60696,"value":60697,"nodeType":865},{},[],"While many organizations are waking up to the fact that it’s not enough to have any old MFA method, it’s still often overlooked that you need to actually remove or disable the phishable methods. Otherwise, in many cases they remain valid, opening affected identities up to ",{"data":60699,"content":60700,"nodeType":876},{"uri":34154},[60701],{"data":60702,"marks":60703,"value":42781,"nodeType":865},{},[60704],{"type":874},{"data":60706,"marks":60707,"value":60708,"nodeType":865},{},[]," attacks. ",{"data":60710,"content":60711,"nodeType":881},{},[60712],{"data":60713,"marks":60714,"value":60715,"nodeType":865},{},[],"Just because a user has a phishing-resistant factor setup (such as passkeys) and may use them by default, it does not mean they are necessarily enforced. Often, services support the use of multiple authentication options, particularly for second factors. In particular, passkeys are device-bound and so enforcing their use prevents logins from other devices and can cause recovery issues in a lost/broken device scenario. Therefore, it’s common for the default case to be that passkey authentication is optional, rather than required.",{"data":60717,"content":60718,"nodeType":881},{},[60719],{"data":60720,"marks":60721,"value":60722,"nodeType":865},{},[],"When used in combination with AitM phishing tools, it’s possible for attackers to modify requests/responses so as to prevent the ability of passkeys to be selected as a login option and prompting the user to use vulnerable factors, such as passwords, TOTPs and push notifications instead. Since the server-side supports other authentication options, if the user continues and enters one of these alternative factors then their authenticated session will be compromised – despite the fact they usually use phishing-resistant MFA methods like passkeys or similar.",{"data":60724,"content":60725,"nodeType":894},{},[],{"data":60727,"content":60728,"nodeType":904},{},[60729],{"data":60730,"marks":60731,"value":60732,"nodeType":865},{},[],"Use case inspo: How red teamers are using the SaaS attack matrix",{"data":60734,"content":60735,"nodeType":881},{},[60736],{"data":60737,"marks":60738,"value":60739,"nodeType":865},{},[],"The techniques that advanced red teams are using to (ethically) hack into their clients are always a good indicator of what direction hackers in the real world are headed.  ",{"data":60741,"content":60742,"nodeType":881},{},[60743],{"data":60744,"marks":60745,"value":60746,"nodeType":865},{},[],"We spoke to a few of the best red teams around to see how they are using the matrix: Let’s see what they had to say. ",{"data":60748,"content":60749,"nodeType":894},{},[],{"data":60751,"content":60752,"nodeType":1860},{},[60753],{"data":60754,"marks":60755,"value":60756,"nodeType":865},{},[],"Rob Maslen | Managing Principal Consultant | MDSec",{"data":60758,"content":60759,"nodeType":881},{},[60760],{"data":60761,"marks":60762,"value":60763,"nodeType":865},{},[],"“We use the matrix throughout our engagements: When scoping and proposing projects to clients, during testing to assist our consultants in successfully utilizing novel SaaS-attack techniques, and for reporting to provide a common language across the vendors that they work with. ",{"data":60765,"content":60766,"nodeType":881},{},[60767],{"data":60768,"marks":60769,"value":60770,"nodeType":865},{},[],"It’s been most useful to us when performing engagements on more modern Zero Trust Environments where macOS is predominantly the Operating System of choice. The objectives tend to be either access to critical applications that reside within the cloud and require the compromise of SaaS credentials, or to gain privileged access to a SaaS application. Whilst resources like the MITRE ATT&CK Framework can help to describe the techniques that have been used against a more traditional environment, the SaaS Matrix aids with performing and describing attacks against a more modern infrastructure.  ",{"data":60772,"content":60773,"nodeType":881},{},[60774,60778,60786],{"data":60775,"marks":60776,"value":60777,"nodeType":865},{},[],"The technique we’ve seen most success with, across both traditional Active Directory attacks and more modern Zero Trust Environments, is ",{"data":60779,"content":60780,"nodeType":876},{"uri":42831},[60781],{"data":60782,"marks":60783,"value":60785,"nodeType":865},{},[60784],{"type":874},"Session Cookie Theft",{"data":60787,"marks":60788,"value":60789,"nodeType":865},{},[],". The protection of browser cookies (for inexplicable reasons) has had less engineering attention than it should have, opening up opportunities for lateral movement using session cookies, credentials, or API keys recovered from a host becomes a key technique. In our experience defensive tooling has yet to catch up with this threat. ",{"data":60791,"content":60792,"nodeType":881},{},[60793,60797,60805,60808,60817,60820,60829,60832,60839,60842,60849,60852,60860,60863,60870,60873,60882,60885,60892,60896,60905,60908,60916],{"data":60794,"marks":60795,"value":60796,"nodeType":865},{},[],"We’ve also seen success with various techniques across Kill Chain stages, including ",{"data":60798,"content":60799,"nodeType":876},{"uri":53234},[60800],{"data":60801,"marks":60802,"value":60804,"nodeType":865},{},[60803],{"type":874},"Subdomain tenant discovery",{"data":60806,"marks":60807,"value":1877,"nodeType":865},{},[],{"data":60809,"content":60811,"nodeType":876},{"uri":60810},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/dns_reconnaissance/description.md",[60812],{"data":60813,"marks":60814,"value":60816,"nodeType":865},{},[60815],{"type":874},"DNS reconnaissance",{"data":60818,"marks":60819,"value":1877,"nodeType":865},{},[],{"data":60821,"content":60823,"nodeType":876},{"uri":60822},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/username_enumeration/description.md",[60824],{"data":60825,"marks":60826,"value":60828,"nodeType":865},{},[60827],{"type":874},"username enumeration",{"data":60830,"marks":60831,"value":1877,"nodeType":865},{},[],{"data":60833,"content":60834,"nodeType":876},{"uri":18095},[60835],{"data":60836,"marks":60837,"value":7567,"nodeType":865},{},[60838],{"type":874},{"data":60840,"marks":60841,"value":1877,"nodeType":865},{},[],{"data":60843,"content":60844,"nodeType":876},{"uri":1526},[60845],{"data":60846,"marks":60847,"value":1307,"nodeType":865},{},[60848],{"type":874},{"data":60850,"marks":60851,"value":1877,"nodeType":865},{},[],{"data":60853,"content":60854,"nodeType":876},{"uri":60273},[60855],{"data":60856,"marks":60857,"value":60859,"nodeType":865},{},[60858],{"type":874},"guest access abuse",{"data":60861,"marks":60862,"value":1877,"nodeType":865},{},[],{"data":60864,"content":60865,"nodeType":876},{"uri":45639},[60866],{"data":60867,"marks":60868,"value":45645,"nodeType":865},{},[60869],{"type":874},{"data":60871,"marks":60872,"value":1877,"nodeType":865},{},[],{"data":60874,"content":60876,"nodeType":876},{"uri":60875},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/oauth_tokens/description.md",[60877],{"data":60878,"marks":60879,"value":60881,"nodeType":865},{},[60880],{"type":874},"OAuth tokens",{"data":60883,"marks":60884,"value":1877,"nodeType":865},{},[],{"data":60886,"content":60887,"nodeType":876},{"uri":30315},[60888],{"data":60889,"marks":60890,"value":36446,"nodeType":865},{},[60891],{"type":874},{"data":60893,"marks":60894,"value":60895,"nodeType":865},{},[]," (as long as you ensure the target isn't notified – make sure you delete the notification of creation email!), ",{"data":60897,"content":60899,"nodeType":876},{"uri":60898},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/api_secret_theft/description.md",[60900],{"data":60901,"marks":60902,"value":60904,"nodeType":865},{},[60903],{"type":874},"API secret theft",{"data":60906,"marks":60907,"value":1791,"nodeType":865},{},[],{"data":60909,"content":60910,"nodeType":876},{"uri":47762},[60911],{"data":60912,"marks":60913,"value":60915,"nodeType":865},{},[60914],{"type":874},"link backdooring",{"data":60917,"marks":60918,"value":1032,"nodeType":865},{},[],{"data":60920,"content":60921,"nodeType":881},{},[60922],{"data":60923,"marks":60924,"value":60925,"nodeType":865},{},[],"Embracing the modern Zero Trust architecture with its greater SaaS usage does not come without security risks, and while it does invalidate a large number of the attacks that can be performed within an AD environment, the SaaS attack matrix is a great way of illustrating how these attacks work, as well as helping red and blue teams respectively to simulate and defend against them.\" ",{"data":60927,"content":60928,"nodeType":894},{},[],{"data":60930,"content":60931,"nodeType":1860},{},[60932],{"data":60933,"marks":60934,"value":60935,"nodeType":865},{},[],"Tom Ellson | Head of Offensive Security | Stripe OLT",{"data":60937,"content":60938,"nodeType":881},{},[60939],{"data":60940,"marks":60941,"value":60942,"nodeType":865},{},[],"“We've used the SaaS attack matrix across several cloud-native engagements, for both initial access and lateral movement. My go-to techniques so far have been:",{"data":60944,"content":60945,"nodeType":1818},{},[60946,60973,60995,61017],{"data":60947,"content":60948,"nodeType":1734},{},[60949],{"data":60950,"content":60951,"nodeType":881},{},[60952,60955,60965,60969],{"data":60953,"marks":60954,"value":21,"nodeType":865},{},[],{"data":60956,"content":60958,"nodeType":876},{"uri":60957},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/im_phishing/description.md",[60959],{"data":60960,"marks":60961,"value":60964,"nodeType":865},{},[60962,60963],{"type":874},{"type":902},"IM phishing:",{"data":60966,"marks":60967,"value":2091,"nodeType":865},{},[60968],{"type":902},{"data":60970,"marks":60971,"value":60972,"nodeType":865},{},[],"Phishing via Microsoft Teams in particular has been highly successful, especially when paired with a number of abusable “features” (working as intended, clearly). ",{"data":60974,"content":60975,"nodeType":1734},{},[60976],{"data":60977,"content":60978,"nodeType":881},{},[60979,60982,60991],{"data":60980,"marks":60981,"value":21,"nodeType":865},{},[],{"data":60983,"content":60984,"nodeType":876},{"uri":1526},[60985],{"data":60986,"marks":60987,"value":60990,"nodeType":865},{},[60988,60989],{"type":874},{"type":902},"Device code phishing:",{"data":60992,"marks":60993,"value":60994,"nodeType":865},{},[]," We use this for both initial access and persistence. It’s a great way of getting around MFA by tricking the victim into following the device approval process for our device, but using their device. ",{"data":60996,"content":60997,"nodeType":1734},{},[60998],{"data":60999,"content":61000,"nodeType":881},{},[61001,61004,61013],{"data":61002,"marks":61003,"value":21,"nodeType":865},{},[],{"data":61005,"content":61006,"nodeType":876},{"uri":42803},[61007],{"data":61008,"marks":61009,"value":61012,"nodeType":865},{},[61010,61011],{"type":874},{"type":902},"AitM phishing:",{"data":61014,"marks":61015,"value":61016,"nodeType":865},{},[]," This is now a staple for credential harvesting. Better security controls force us to abuse other avenues to bypass conditional access policies, such as extraction of the PRT token from the end user device, thus granting us claimed access, which can be achieved using AitM and BitM techniques.",{"data":61018,"content":61019,"nodeType":1734},{},[61020],{"data":61021,"content":61022,"nodeType":881},{},[61023,61026,61036,61040],{"data":61024,"marks":61025,"value":21,"nodeType":865},{},[],{"data":61027,"content":61029,"nodeType":876},{"uri":61028},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/oauth_token_enumeration/description.md",[61030],{"data":61031,"marks":61032,"value":61035,"nodeType":865},{},[61033,61034],{"type":874},{"type":902},"OAuth token enumeration:",{"data":61037,"marks":61038,"value":2091,"nodeType":865},{},[61039],{"type":902},{"data":61041,"marks":61042,"value":61043,"nodeType":865},{},[],"Once an account has been compromised, the Myapps portal is commonly used to validate the accessible applications and further target downstream apps to access data and functionality. ",{"data":61045,"content":61046,"nodeType":881},{},[61047],{"data":61048,"marks":61049,"value":61050,"nodeType":865},{},[],"We’re usually targeting M365 environments but have still found these attack techniques to be highly effective. In some cases, we’ve leveraged other SaaS applications such as abusing in-app phishing via GitHub to compromise development pipelines. The matrix is particularly useful as a playbook of further attacks once initial access has been established. Even just the awareness of how to pivot from SaaS to SaaS (and sometimes back to Microsoft or Google) is really eye-opening for red teams, and adds a new dimension to the security testing that our clients are used to experiencing. ",{"data":61052,"content":61053,"nodeType":881},{},[61054],{"data":61055,"marks":61056,"value":61057,"nodeType":865},{},[],"Because of the success of using these methods, we’ve now incorporated the SaaS attack matrix techniques into our purple teaming methodology to ensure that our clients can build awareness of their detection visibility gaps when it comes to identity attacks, and are routinely benchmarked against them.”  ",{"data":61059,"content":61060,"nodeType":894},{},[],{"data":61062,"content":61063,"nodeType":1860},{},[61064],{"data":61065,"marks":61066,"value":61067,"nodeType":865},{},[],"Max Corbridge | Head of Adversarial Simulation | JUMPSEC",{"data":61069,"content":61070,"nodeType":881},{},[61071],{"data":61072,"marks":61073,"value":61074,"nodeType":865},{},[],"“I’ve been a big fan of the matrix from day one. We use it for two main purposes – as a catalog of TTPs to apply during threat modeling exercises with cloud-native clients, and as a guide for how to apply novel TTPs to different apps and situations. The wiki descriptions, video demonstrations and references help enormously with this. ",{"data":61076,"content":61077,"nodeType":881},{},[61078,61082,61089,61092,61099,61102,61111,61114,61121],{"data":61079,"marks":61080,"value":61081,"nodeType":865},{},[],"We’ve mostly relied on ",{"data":61083,"content":61084,"nodeType":876},{"uri":60957},[61085],{"data":61086,"marks":61087,"value":49177,"nodeType":865},{},[61088],{"type":874},{"data":61090,"marks":61091,"value":1877,"nodeType":865},{},[],{"data":61093,"content":61094,"nodeType":876},{"uri":42803},[61095],{"data":61096,"marks":61097,"value":60246,"nodeType":865},{},[61098],{"type":874},{"data":61100,"marks":61101,"value":1877,"nodeType":865},{},[],{"data":61103,"content":61105,"nodeType":876},{"uri":61104},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/abuse_existing_oauth_integrations/description.md",[61106],{"data":61107,"marks":61108,"value":61110,"nodeType":865},{},[61109],{"type":874},"abusing OAuth integrations",{"data":61112,"marks":61113,"value":1791,"nodeType":865},{},[],{"data":61115,"content":61116,"nodeType":876},{"uri":47721},[61117],{"data":61118,"marks":61119,"value":42664,"nodeType":865},{},[61120],{"type":874},{"data":61122,"marks":61123,"value":61124,"nodeType":865},{},[],". In one recent engagement, we were able to compromise a cloud identity with limited permissions in the target Azure environment. We were able to enumerate additional OAuth integrations to laterally move to a third-party IT Service Management SaaS application, which presented a much easier target to elevate privileges. We actually ended up finding a number of 0-days in the application, which we then used as a trusted platform to launch a covert spear-phishing campaign against specific high-privilege users, communicating back-and-forth as though we were a genuine support team, and hiding risky changes to cover our tracks. Ultimately we were able to pivot back into the target Azure estate, but now with administrative privileges. ",{"data":61126,"content":61127,"nodeType":881},{},[61128],{"data":61129,"marks":61130,"value":61131,"nodeType":865},{},[],"This really shows how third-party identities and apps are often the soft underbelly for a lot of otherwise pretty secure orgs that we work with, and we’re enjoying the challenge of finding new ways of getting to the crown jewels. ",{"data":61133,"content":61134,"nodeType":881},{},[61135],{"data":61136,"marks":61137,"value":61138,"nodeType":865},{},[],"In my eyes the world of cloud and SaaS-native attack techniques is under-researched for how increasingly relevant it is becoming. Many of the older TTPs and tradecraft are no longer relevant in a cloud-native world, and even when the techniques are consistent with the ways we used to target networks and endpoints, the context and how it actually works is completely different. So, resources like the SaaS attack matrix will continue to be needed for both offensive and defensive security practitioners going forwards”.",{"data":61140,"content":61141,"nodeType":894},{},[],{"data":61143,"content":61144,"nodeType":904},{},[61145],{"data":61146,"marks":61147,"value":32595,"nodeType":865},{},[],{"data":61149,"content":61150,"nodeType":881},{},[61151],{"data":61152,"marks":61153,"value":61154,"nodeType":865},{},[],"Hopefully you're now feeling inspired to get involved and start applying the SaaS attack matrix yourself. And if you’ve been using the matrix and want to share your experience with us, we’d love to hear from you. ",{"data":61156,"content":61157,"nodeType":881},{},[61158,61162,61169],{"data":61159,"marks":61160,"value":61161,"nodeType":865},{},[],"We hope to see your comments, discussions, or PRs on ",{"data":61163,"content":61164,"nodeType":876},{"uri":5192},[61165],{"data":61166,"marks":61167,"value":4287,"nodeType":865},{},[61168],{"type":874},{"data":61170,"marks":61171,"value":61172,"nodeType":865},{},[],"!",{"data":61174,"content":61175,"nodeType":881},{},[61176,61180,61189],{"data":61177,"marks":61178,"value":61179,"nodeType":865},{},[],"If this has piqued your interest, we’ve just released a 2024 edition of our SaaS attacks report: ",{"data":61181,"content":61183,"nodeType":876},{"uri":61182},"https://pushsecurity.com/resources/book/saas-attacks-report/",[61184],{"data":61185,"marks":61186,"value":61188,"nodeType":865},{},[61187],{"type":874},"get your copy here",{"data":61190,"marks":61191,"value":1032,"nodeType":865},{},[],{"data":61193,"content":61197,"nodeType":890},{"target":61194},{"sys":61195},{"id":61196,"type":887,"linkType":888},"J11G6XCdDAYu0GQbKGCnm",[],{"data":61199,"content":61200,"nodeType":881},{},[61201],{"data":61202,"marks":61203,"value":21,"nodeType":865},{},[],{"entries":61205},{"hyperlink":61206,"inline":61207,"block":61208},[],[],[61209],{"sys":61210,"__typename":1471,"type":1472,"ctaText":61211,"buttonLabel":61212,"buttonColour":1475,"buttonUrl":61182},{"id":61196},"Check out the SaaS Attacks Report to learn about how identity attacks are the leading cause of SaaS breaches in 2024","Download the report",{"items":61214},[],{},"Reflecting on a year of SaaS identity attacks","2024-08-27T00:00:00.000Z",{"items":61219},[61220,62277,62935],{"__typename":1485,"sys":61221,"content":61222,"title":59660,"synopsis":59661,"hashTags":59,"publishedDate":59662,"slug":59663,"tagsCollection":62267,"authorsCollection":62273},{"id":58447},{"json":61223},{"data":61224,"content":61225,"nodeType":1463},{},[61226,61232,61248,61254,61259,61265,61291,61296,61301,61307,61313,61318,61324,61340,61346,61352,61357,61363,61369,61411,61427,61433,61439,61445,61450,61456,61462,61468,61474,61480,61486,61496,61501,61507,61522,61538,61544,61550,61566,61572,61587,61593,61635,61641,61657,61663,61668,61683,61699,61705,61721,61727,61732,61738,61754,61760,61766,61771,61777,61783,61789,61795,61800,61806,61812,61818,61824,61829,61835,61841,61851,61864,61870,61876,61936,61942,61948,61954,61960,61966,61972,61978,61984,62000,62006,62011,62017,62022,62028,62034,62040,62045,62051,62057,62063,62093,62099,62105,62111,62117,62123,62129,62135,62141,62183,62188,62194,62230,62235,62241,62256,62261],{"data":61227,"content":61228,"nodeType":881},{},[61229],{"data":61230,"marks":61231,"value":58458,"nodeType":865},{},[],{"data":61233,"content":61234,"nodeType":881},{},[61235,61238,61245],{"data":61236,"marks":61237,"value":58465,"nodeType":865},{},[],{"data":61239,"content":61240,"nodeType":876},{"uri":58468},[61241],{"data":61242,"marks":61243,"value":58474,"nodeType":865},{},[61244],{"type":874},{"data":61246,"marks":61247,"value":58478,"nodeType":865},{},[],{"data":61249,"content":61250,"nodeType":881},{},[61251],{"data":61252,"marks":61253,"value":58485,"nodeType":865},{},[],{"data":61255,"content":61258,"nodeType":890},{"target":61256},{"sys":61257},{"id":58490,"type":887,"linkType":888},[],{"data":61260,"content":61261,"nodeType":881},{},[61262],{"data":61263,"marks":61264,"value":58498,"nodeType":865},{},[],{"data":61266,"content":61267,"nodeType":881},{},[61268,61271,61278,61281,61288],{"data":61269,"marks":61270,"value":58505,"nodeType":865},{},[],{"data":61272,"content":61273,"nodeType":876},{"uri":58508},[61274],{"data":61275,"marks":61276,"value":58514,"nodeType":865},{},[61277],{"type":874},{"data":61279,"marks":61280,"value":58518,"nodeType":865},{},[],{"data":61282,"content":61283,"nodeType":876},{"uri":58521},[61284],{"data":61285,"marks":61286,"value":58527,"nodeType":865},{},[61287],{"type":874},{"data":61289,"marks":61290,"value":58531,"nodeType":865},{},[],{"data":61292,"content":61295,"nodeType":890},{"target":61293},{"sys":61294},{"id":58536,"type":887,"linkType":888},[],{"data":61297,"content":61300,"nodeType":890},{"target":61298},{"sys":61299},{"id":58542,"type":887,"linkType":888},[],{"data":61302,"content":61303,"nodeType":881},{},[61304],{"data":61305,"marks":61306,"value":58550,"nodeType":865},{},[],{"data":61308,"content":61309,"nodeType":881},{},[61310],{"data":61311,"marks":61312,"value":58557,"nodeType":865},{},[],{"data":61314,"content":61317,"nodeType":890},{"target":61315},{"sys":61316},{"id":58562,"type":887,"linkType":888},[],{"data":61319,"content":61320,"nodeType":881},{},[61321],{"data":61322,"marks":61323,"value":58570,"nodeType":865},{},[],{"data":61325,"content":61326,"nodeType":881},{},[61327,61330,61337],{"data":61328,"marks":61329,"value":58577,"nodeType":865},{},[],{"data":61331,"content":61332,"nodeType":876},{"uri":58580},[61333],{"data":61334,"marks":61335,"value":58586,"nodeType":865},{},[61336],{"type":874},{"data":61338,"marks":61339,"value":58590,"nodeType":865},{},[],{"data":61341,"content":61342,"nodeType":904},{},[61343],{"data":61344,"marks":61345,"value":58597,"nodeType":865},{},[],{"data":61347,"content":61348,"nodeType":881},{},[61349],{"data":61350,"marks":61351,"value":58604,"nodeType":865},{},[],{"data":61353,"content":61356,"nodeType":890},{"target":61354},{"sys":61355},{"id":58609,"type":887,"linkType":888},[],{"data":61358,"content":61359,"nodeType":881},{},[61360],{"data":61361,"marks":61362,"value":58617,"nodeType":865},{},[],{"data":61364,"content":61365,"nodeType":881},{},[61366],{"data":61367,"marks":61368,"value":58624,"nodeType":865},{},[],{"data":61370,"content":61371,"nodeType":1818},{},[61372,61385,61398],{"data":61373,"content":61374,"nodeType":1734},{},[61375],{"data":61376,"content":61377,"nodeType":881},{},[61378,61382],{"data":61379,"marks":61380,"value":58638,"nodeType":865},{},[61381],{"type":902},{"data":61383,"marks":61384,"value":58642,"nodeType":865},{},[],{"data":61386,"content":61387,"nodeType":1734},{},[61388],{"data":61389,"content":61390,"nodeType":881},{},[61391,61395],{"data":61392,"marks":61393,"value":58653,"nodeType":865},{},[61394],{"type":902},{"data":61396,"marks":61397,"value":58657,"nodeType":865},{},[],{"data":61399,"content":61400,"nodeType":1734},{},[61401],{"data":61402,"content":61403,"nodeType":881},{},[61404,61408],{"data":61405,"marks":61406,"value":58668,"nodeType":865},{},[61407],{"type":902},{"data":61409,"marks":61410,"value":58672,"nodeType":865},{},[],{"data":61412,"content":61413,"nodeType":881},{},[61414,61417,61424],{"data":61415,"marks":61416,"value":58679,"nodeType":865},{},[],{"data":61418,"content":61419,"nodeType":876},{"uri":31096},[61420],{"data":61421,"marks":61422,"value":58687,"nodeType":865},{},[61423],{"type":874},{"data":61425,"marks":61426,"value":959,"nodeType":865},{},[],{"data":61428,"content":61429,"nodeType":881},{},[61430],{"data":61431,"marks":61432,"value":58697,"nodeType":865},{},[],{"data":61434,"content":61435,"nodeType":904},{},[61436],{"data":61437,"marks":61438,"value":58704,"nodeType":865},{},[],{"data":61440,"content":61441,"nodeType":881},{},[61442],{"data":61443,"marks":61444,"value":58711,"nodeType":865},{},[],{"data":61446,"content":61449,"nodeType":890},{"target":61447},{"sys":61448},{"id":41417,"type":887,"linkType":888},[],{"data":61451,"content":61452,"nodeType":881},{},[61453],{"data":61454,"marks":61455,"value":58723,"nodeType":865},{},[],{"data":61457,"content":61458,"nodeType":881},{},[61459],{"data":61460,"marks":61461,"value":58730,"nodeType":865},{},[],{"data":61463,"content":61464,"nodeType":1860},{},[61465],{"data":61466,"marks":61467,"value":58737,"nodeType":865},{},[],{"data":61469,"content":61470,"nodeType":881},{},[61471],{"data":61472,"marks":61473,"value":58744,"nodeType":865},{},[],{"data":61475,"content":61476,"nodeType":881},{},[61477],{"data":61478,"marks":61479,"value":58751,"nodeType":865},{},[],{"data":61481,"content":61482,"nodeType":881},{},[61483],{"data":61484,"marks":61485,"value":58758,"nodeType":865},{},[],{"data":61487,"content":61488,"nodeType":881},{},[61489,61493],{"data":61490,"marks":61491,"value":58766,"nodeType":865},{},[61492],{"type":902},{"data":61494,"marks":61495,"value":58770,"nodeType":865},{},[],{"data":61497,"content":61500,"nodeType":890},{"target":61498},{"sys":61499},{"id":58775,"type":887,"linkType":888},[],{"data":61502,"content":61503,"nodeType":881},{},[61504],{"data":61505,"marks":61506,"value":58783,"nodeType":865},{},[],{"data":61508,"content":61509,"nodeType":881},{},[61510,61513,61519],{"data":61511,"marks":61512,"value":58790,"nodeType":865},{},[],{"data":61514,"content":61515,"nodeType":876},{"uri":55771},[61516],{"data":61517,"marks":61518,"value":58797,"nodeType":865},{},[],{"data":61520,"marks":61521,"value":58801,"nodeType":865},{},[],{"data":61523,"content":61524,"nodeType":881},{},[61525,61528,61535],{"data":61526,"marks":61527,"value":58808,"nodeType":865},{},[],{"data":61529,"content":61530,"nodeType":876},{"uri":17092},[61531],{"data":61532,"marks":61533,"value":58816,"nodeType":865},{},[61534],{"type":874},{"data":61536,"marks":61537,"value":1032,"nodeType":865},{},[],{"data":61539,"content":61540,"nodeType":1860},{},[61541],{"data":61542,"marks":61543,"value":58826,"nodeType":865},{},[],{"data":61545,"content":61546,"nodeType":881},{},[61547],{"data":61548,"marks":61549,"value":58833,"nodeType":865},{},[],{"data":61551,"content":61552,"nodeType":881},{},[61553,61556,61563],{"data":61554,"marks":61555,"value":58840,"nodeType":865},{},[],{"data":61557,"content":61558,"nodeType":876},{"uri":58843},[61559],{"data":61560,"marks":61561,"value":58849,"nodeType":865},{},[61562],{"type":874},{"data":61564,"marks":61565,"value":58853,"nodeType":865},{},[],{"data":61567,"content":61568,"nodeType":881},{},[61569],{"data":61570,"marks":61571,"value":58860,"nodeType":865},{},[],{"data":61573,"content":61574,"nodeType":881},{},[61575,61578,61584],{"data":61576,"marks":61577,"value":58867,"nodeType":865},{},[],{"data":61579,"content":61580,"nodeType":876},{"uri":43904},[61581],{"data":61582,"marks":61583,"value":58874,"nodeType":865},{},[],{"data":61585,"marks":61586,"value":959,"nodeType":865},{},[],{"data":61588,"content":61589,"nodeType":1860},{},[61590],{"data":61591,"marks":61592,"value":58884,"nodeType":865},{},[],{"data":61594,"content":61595,"nodeType":881},{},[61596,61599,61605,61608,61614,61617,61623,61626,61632],{"data":61597,"marks":61598,"value":58891,"nodeType":865},{},[],{"data":61600,"content":61601,"nodeType":876},{"uri":58894},[61602],{"data":61603,"marks":61604,"value":58899,"nodeType":865},{},[],{"data":61606,"marks":61607,"value":1877,"nodeType":865},{},[],{"data":61609,"content":61610,"nodeType":876},{"uri":58905},[61611],{"data":61612,"marks":61613,"value":58910,"nodeType":865},{},[],{"data":61615,"marks":61616,"value":1877,"nodeType":865},{},[],{"data":61618,"content":61619,"nodeType":876},{"uri":49328},[61620],{"data":61621,"marks":61622,"value":49334,"nodeType":865},{},[],{"data":61624,"marks":61625,"value":1651,"nodeType":865},{},[],{"data":61627,"content":61628,"nodeType":876},{"uri":58925},[61629],{"data":61630,"marks":61631,"value":58930,"nodeType":865},{},[],{"data":61633,"marks":61634,"value":1032,"nodeType":865},{},[],{"data":61636,"content":61637,"nodeType":881},{},[61638],{"data":61639,"marks":61640,"value":58940,"nodeType":865},{},[],{"data":61642,"content":61643,"nodeType":881},{},[61644,61647,61654],{"data":61645,"marks":61646,"value":58947,"nodeType":865},{},[],{"data":61648,"content":61649,"nodeType":876},{"uri":58950},[61650],{"data":61651,"marks":61652,"value":58956,"nodeType":865},{},[61653],{"type":874},{"data":61655,"marks":61656,"value":1032,"nodeType":865},{},[],{"data":61658,"content":61659,"nodeType":881},{},[61660],{"data":61661,"marks":61662,"value":58966,"nodeType":865},{},[],{"data":61664,"content":61667,"nodeType":890},{"target":61665},{"sys":61666},{"id":37923,"type":887,"linkType":888},[],{"data":61669,"content":61670,"nodeType":881},{},[61671,61674,61680],{"data":61672,"marks":61673,"value":58978,"nodeType":865},{},[],{"data":61675,"content":61676,"nodeType":876},{"uri":55771},[61677],{"data":61678,"marks":61679,"value":58797,"nodeType":865},{},[],{"data":61681,"marks":61682,"value":58988,"nodeType":865},{},[],{"data":61684,"content":61685,"nodeType":881},{},[61686,61689,61696],{"data":61687,"marks":61688,"value":58995,"nodeType":865},{},[],{"data":61690,"content":61691,"nodeType":876},{"uri":43852},[61692],{"data":61693,"marks":61694,"value":59003,"nodeType":865},{},[61695],{"type":874},{"data":61697,"marks":61698,"value":1032,"nodeType":865},{},[],{"data":61700,"content":61701,"nodeType":904},{},[61702],{"data":61703,"marks":61704,"value":59013,"nodeType":865},{},[],{"data":61706,"content":61707,"nodeType":881},{},[61708,61711,61718],{"data":61709,"marks":61710,"value":59020,"nodeType":865},{},[],{"data":61712,"content":61713,"nodeType":876},{"uri":5072},[61714],{"data":61715,"marks":61716,"value":5077,"nodeType":865},{},[61717],{"type":874},{"data":61719,"marks":61720,"value":59031,"nodeType":865},{},[],{"data":61722,"content":61723,"nodeType":881},{},[61724],{"data":61725,"marks":61726,"value":59038,"nodeType":865},{},[],{"data":61728,"content":61731,"nodeType":890},{"target":61729},{"sys":61730},{"id":59043,"type":887,"linkType":888},[],{"data":61733,"content":61734,"nodeType":881},{},[61735],{"data":61736,"marks":61737,"value":59051,"nodeType":865},{},[],{"data":61739,"content":61740,"nodeType":881},{},[61741,61744,61751],{"data":61742,"marks":61743,"value":57992,"nodeType":865},{},[],{"data":61745,"content":61746,"nodeType":876},{"uri":57995},[61747],{"data":61748,"marks":61749,"value":58001,"nodeType":865},{},[61750],{"type":874},{"data":61752,"marks":61753,"value":959,"nodeType":865},{},[],{"data":61755,"content":61756,"nodeType":881},{},[61757],{"data":61758,"marks":61759,"value":59074,"nodeType":865},{},[],{"data":61761,"content":61762,"nodeType":881},{},[61763],{"data":61764,"marks":61765,"value":59081,"nodeType":865},{},[],{"data":61767,"content":61770,"nodeType":890},{"target":61768},{"sys":61769},{"id":59086,"type":887,"linkType":888},[],{"data":61772,"content":61773,"nodeType":1860},{},[61774],{"data":61775,"marks":61776,"value":59094,"nodeType":865},{},[],{"data":61778,"content":61779,"nodeType":881},{},[61780],{"data":61781,"marks":61782,"value":59101,"nodeType":865},{},[],{"data":61784,"content":61785,"nodeType":881},{},[61786],{"data":61787,"marks":61788,"value":59108,"nodeType":865},{},[],{"data":61790,"content":61791,"nodeType":881},{},[61792],{"data":61793,"marks":61794,"value":59115,"nodeType":865},{},[],{"data":61796,"content":61799,"nodeType":890},{"target":61797},{"sys":61798},{"id":44177,"type":887,"linkType":888},[],{"data":61801,"content":61802,"nodeType":1860},{},[61803],{"data":61804,"marks":61805,"value":59127,"nodeType":865},{},[],{"data":61807,"content":61808,"nodeType":881},{},[61809],{"data":61810,"marks":61811,"value":59134,"nodeType":865},{},[],{"data":61813,"content":61814,"nodeType":881},{},[61815],{"data":61816,"marks":61817,"value":59141,"nodeType":865},{},[],{"data":61819,"content":61820,"nodeType":881},{},[61821],{"data":61822,"marks":61823,"value":59148,"nodeType":865},{},[],{"data":61825,"content":61828,"nodeType":890},{"target":61826},{"sys":61827},{"id":59153,"type":887,"linkType":888},[],{"data":61830,"content":61831,"nodeType":904},{},[61832],{"data":61833,"marks":61834,"value":59161,"nodeType":865},{},[],{"data":61836,"content":61837,"nodeType":881},{},[61838],{"data":61839,"marks":61840,"value":59168,"nodeType":865},{},[],{"data":61842,"content":61843,"nodeType":881},{},[61844,61848],{"data":61845,"marks":61846,"value":59176,"nodeType":865},{},[61847],{"type":902},{"data":61849,"marks":61850,"value":59180,"nodeType":865},{},[],{"data":61852,"content":61853,"nodeType":881},{},[61854,61857,61861],{"data":61855,"marks":61856,"value":59187,"nodeType":865},{},[],{"data":61858,"marks":61859,"value":59192,"nodeType":865},{},[61860],{"type":902},{"data":61862,"marks":61863,"value":59196,"nodeType":865},{},[],{"data":61865,"content":61866,"nodeType":881},{},[61867],{"data":61868,"marks":61869,"value":59203,"nodeType":865},{},[],{"data":61871,"content":61872,"nodeType":881},{},[61873],{"data":61874,"marks":61875,"value":59210,"nodeType":865},{},[],{"data":61877,"content":61878,"nodeType":1818},{},[61879,61898,61917],{"data":61880,"content":61881,"nodeType":1734},{},[61882],{"data":61883,"content":61884,"nodeType":881},{},[61885,61888,61895],{"data":61886,"marks":61887,"value":59223,"nodeType":865},{},[],{"data":61889,"content":61890,"nodeType":876},{"uri":5072},[61891],{"data":61892,"marks":61893,"value":5077,"nodeType":865},{},[61894],{"type":874},{"data":61896,"marks":61897,"value":1032,"nodeType":865},{},[],{"data":61899,"content":61900,"nodeType":1734},{},[61901],{"data":61902,"content":61903,"nodeType":881},{},[61904,61907,61914],{"data":61905,"marks":61906,"value":59243,"nodeType":865},{},[],{"data":61908,"content":61909,"nodeType":876},{"uri":31881},[61910],{"data":61911,"marks":61912,"value":59251,"nodeType":865},{},[61913],{"type":874},{"data":61915,"marks":61916,"value":959,"nodeType":865},{},[],{"data":61918,"content":61919,"nodeType":1734},{},[61920],{"data":61921,"content":61922,"nodeType":881},{},[61923,61926,61933],{"data":61924,"marks":61925,"value":59264,"nodeType":865},{},[],{"data":61927,"content":61928,"nodeType":876},{"uri":59267},[61929],{"data":61930,"marks":61931,"value":59273,"nodeType":865},{},[61932],{"type":874},{"data":61934,"marks":61935,"value":30204,"nodeType":865},{},[],{"data":61937,"content":61938,"nodeType":881},{},[61939],{"data":61940,"marks":61941,"value":59283,"nodeType":865},{},[],{"data":61943,"content":61944,"nodeType":1860},{},[61945],{"data":61946,"marks":61947,"value":59290,"nodeType":865},{},[],{"data":61949,"content":61950,"nodeType":881},{},[61951],{"data":61952,"marks":61953,"value":59297,"nodeType":865},{},[],{"data":61955,"content":61956,"nodeType":881},{},[61957],{"data":61958,"marks":61959,"value":59304,"nodeType":865},{},[],{"data":61961,"content":61962,"nodeType":881},{},[61963],{"data":61964,"marks":61965,"value":59311,"nodeType":865},{},[],{"data":61967,"content":61968,"nodeType":881},{},[61969],{"data":61970,"marks":61971,"value":59318,"nodeType":865},{},[],{"data":61973,"content":61974,"nodeType":1860},{},[61975],{"data":61976,"marks":61977,"value":59325,"nodeType":865},{},[],{"data":61979,"content":61980,"nodeType":881},{},[61981],{"data":61982,"marks":61983,"value":59332,"nodeType":865},{},[],{"data":61985,"content":61986,"nodeType":881},{},[61987,61990,61997],{"data":61988,"marks":61989,"value":59339,"nodeType":865},{},[],{"data":61991,"content":61992,"nodeType":876},{"uri":16924},[61993],{"data":61994,"marks":61995,"value":59347,"nodeType":865},{},[61996],{"type":874},{"data":61998,"marks":61999,"value":1032,"nodeType":865},{},[],{"data":62001,"content":62002,"nodeType":881},{},[62003],{"data":62004,"marks":62005,"value":59357,"nodeType":865},{},[],{"data":62007,"content":62010,"nodeType":890},{"target":62008},{"sys":62009},{"id":59362,"type":887,"linkType":888},[],{"data":62012,"content":62013,"nodeType":881},{},[62014],{"data":62015,"marks":62016,"value":59370,"nodeType":865},{},[],{"data":62018,"content":62021,"nodeType":890},{"target":62019},{"sys":62020},{"id":59375,"type":887,"linkType":888},[],{"data":62023,"content":62024,"nodeType":1860},{},[62025],{"data":62026,"marks":62027,"value":59383,"nodeType":865},{},[],{"data":62029,"content":62030,"nodeType":881},{},[62031],{"data":62032,"marks":62033,"value":59390,"nodeType":865},{},[],{"data":62035,"content":62036,"nodeType":881},{},[62037],{"data":62038,"marks":62039,"value":59397,"nodeType":865},{},[],{"data":62041,"content":62044,"nodeType":890},{"target":62042},{"sys":62043},{"id":59402,"type":887,"linkType":888},[],{"data":62046,"content":62047,"nodeType":1860},{},[62048],{"data":62049,"marks":62050,"value":59410,"nodeType":865},{},[],{"data":62052,"content":62053,"nodeType":881},{},[62054],{"data":62055,"marks":62056,"value":59417,"nodeType":865},{},[],{"data":62058,"content":62059,"nodeType":881},{},[62060],{"data":62061,"marks":62062,"value":59424,"nodeType":865},{},[],{"data":62064,"content":62065,"nodeType":1818},{},[62066,62075,62084],{"data":62067,"content":62068,"nodeType":1734},{},[62069],{"data":62070,"content":62071,"nodeType":881},{},[62072],{"data":62073,"marks":62074,"value":59437,"nodeType":865},{},[],{"data":62076,"content":62077,"nodeType":1734},{},[62078],{"data":62079,"content":62080,"nodeType":881},{},[62081],{"data":62082,"marks":62083,"value":59447,"nodeType":865},{},[],{"data":62085,"content":62086,"nodeType":1734},{},[62087],{"data":62088,"content":62089,"nodeType":881},{},[62090],{"data":62091,"marks":62092,"value":59457,"nodeType":865},{},[],{"data":62094,"content":62095,"nodeType":881},{},[62096],{"data":62097,"marks":62098,"value":59464,"nodeType":865},{},[],{"data":62100,"content":62101,"nodeType":1860},{},[62102],{"data":62103,"marks":62104,"value":59471,"nodeType":865},{},[],{"data":62106,"content":62107,"nodeType":881},{},[62108],{"data":62109,"marks":62110,"value":59478,"nodeType":865},{},[],{"data":62112,"content":62113,"nodeType":881},{},[62114],{"data":62115,"marks":62116,"value":59485,"nodeType":865},{},[],{"data":62118,"content":62119,"nodeType":881},{},[62120],{"data":62121,"marks":62122,"value":59492,"nodeType":865},{},[],{"data":62124,"content":62125,"nodeType":1860},{},[62126],{"data":62127,"marks":62128,"value":59499,"nodeType":865},{},[],{"data":62130,"content":62131,"nodeType":881},{},[62132],{"data":62133,"marks":62134,"value":59506,"nodeType":865},{},[],{"data":62136,"content":62137,"nodeType":881},{},[62138],{"data":62139,"marks":62140,"value":59513,"nodeType":865},{},[],{"data":62142,"content":62143,"nodeType":1818},{},[62144,62157,62170],{"data":62145,"content":62146,"nodeType":1734},{},[62147],{"data":62148,"content":62149,"nodeType":881},{},[62150,62154],{"data":62151,"marks":62152,"value":59527,"nodeType":865},{},[62153],{"type":902},{"data":62155,"marks":62156,"value":59531,"nodeType":865},{},[],{"data":62158,"content":62159,"nodeType":1734},{},[62160],{"data":62161,"content":62162,"nodeType":881},{},[62163,62167],{"data":62164,"marks":62165,"value":59542,"nodeType":865},{},[62166],{"type":902},{"data":62168,"marks":62169,"value":59546,"nodeType":865},{},[],{"data":62171,"content":62172,"nodeType":1734},{},[62173],{"data":62174,"content":62175,"nodeType":881},{},[62176,62180],{"data":62177,"marks":62178,"value":59557,"nodeType":865},{},[62179],{"type":902},{"data":62181,"marks":62182,"value":59561,"nodeType":865},{},[],{"data":62184,"content":62187,"nodeType":890},{"target":62185},{"sys":62186},{"id":59566,"type":887,"linkType":888},[],{"data":62189,"content":62190,"nodeType":904},{},[62191],{"data":62192,"marks":62193,"value":59574,"nodeType":865},{},[],{"data":62195,"content":62196,"nodeType":881},{},[62197,62200,62206,62209,62213,62216,62220,62223,62227],{"data":62198,"marks":62199,"value":59581,"nodeType":865},{},[],{"data":62201,"content":62202,"nodeType":876},{"uri":59584},[62203],{"data":62204,"marks":62205,"value":55749,"nodeType":865},{},[],{"data":62207,"marks":62208,"value":59592,"nodeType":865},{},[],{"data":62210,"marks":62211,"value":59597,"nodeType":865},{},[62212],{"type":902},{"data":62214,"marks":62215,"value":1877,"nodeType":865},{},[],{"data":62217,"marks":62218,"value":59605,"nodeType":865},{},[62219],{"type":902},{"data":62221,"marks":62222,"value":59609,"nodeType":865},{},[],{"data":62224,"marks":62225,"value":87,"nodeType":865},{},[62226],{"type":902},{"data":62228,"marks":62229,"value":59617,"nodeType":865},{},[],{"data":62231,"content":62234,"nodeType":890},{"target":62232},{"sys":62233},{"id":59622,"type":887,"linkType":888},[],{"data":62236,"content":62237,"nodeType":1860},{},[62238],{"data":62239,"marks":62240,"value":59630,"nodeType":865},{},[],{"data":62242,"content":62243,"nodeType":881},{},[62244,62247,62253],{"data":62245,"marks":62246,"value":59637,"nodeType":865},{},[],{"data":62248,"content":62249,"nodeType":876},{"uri":6048},[62250],{"data":62251,"marks":62252,"value":1458,"nodeType":865},{},[],{"data":62254,"marks":62255,"value":59647,"nodeType":865},{},[],{"data":62257,"content":62260,"nodeType":890},{"target":62258},{"sys":62259},{"id":59652,"type":887,"linkType":888},[],{"data":62262,"content":62263,"nodeType":881},{},[62264],{"data":62265,"marks":62266,"value":21,"nodeType":865},{},[],{"items":62268},[62269,62271],{"sys":62270,"name":342},{"id":4510},{"sys":62272,"name":4507},{"id":4506},{"items":62274},[62275],{"fullName":32085,"firstName":32086,"jobTitle":20082,"profilePicture":62276},{"url":32088},{"__typename":1485,"sys":62278,"content":62280,"title":62921,"synopsis":62922,"hashTags":59,"publishedDate":62923,"slug":62924,"tagsCollection":62925,"authorsCollection":62931},{"id":62279},"1qegIy4rMdm5XZXnIEoKpE",{"json":62281},{"data":62282,"content":62283,"nodeType":1463},{},[62284,62291,62298,62322,62327,62334,62341,62344,62351,62371,62377,62384,62423,62430,62437,62444,62451,62458,62465,62483,62491,62494,62501,62508,62515,62522,62529,62536,62543,62591,62598,62605,62612,62632,62639,62646,62653,62660,62667,62674,62681,62698,62715,62758,62765,62772,62835,62842,62845,62852,62868,62886,62893,62899,62905,62908,62914],{"data":62285,"content":62286,"nodeType":881},{},[62287],{"data":62288,"marks":62289,"value":62290,"nodeType":865},{},[],"The field of threat detection and security monitoring has changed significantly over the last decade. Security tools and product categories have been added and replaced, specialist disciplines established, and methodologies created. ",{"data":62292,"content":62293,"nodeType":881},{},[62294],{"data":62295,"marks":62296,"value":62297,"nodeType":865},{},[],"Naturally, defenders have had to mature their approach because of the changing nature of the threat facing organizations. Attackers have always looked for new ways to target their victims, and naturally, defenders have had to adapt, forcing attackers to change things up… it’s a cat and mouse game. ",{"data":62299,"content":62300,"nodeType":881},{},[62301,62305,62313,62317],{"data":62302,"marks":62303,"value":62304,"nodeType":865},{},[],"Blue teamers have used the concept of the ",{"data":62306,"content":62308,"nodeType":876},{"uri":62307},"https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html",[62309],{"data":62310,"marks":62311,"value":43890,"nodeType":865},{},[62312],{"type":874},{"data":62314,"marks":62315,"value":62316,"nodeType":865},{},[]," for over a decade. The logic is simple: ",{"data":62318,"marks":62319,"value":62321,"nodeType":865},{},[62320],{"type":902},"Focus on detecting and responding to indicators that are hard for attackers to change. ",{"data":62323,"content":62326,"nodeType":890},{"target":62324},{"sys":62325},{"id":41598,"type":887,"linkType":888},[],{"data":62328,"content":62329,"nodeType":881},{},[62330],{"data":62331,"marks":62332,"value":62333,"nodeType":865},{},[],"If an attacker only has to tweak a variable to get around your detection rule, like adding a space to change a hash value, it’s probably not a very good detection. It’s not going to remain effective for long and you’re always going to be one step behind the attacker – waiting for them to make their next move so you can react. This usually ends up meaning that attackers enjoy at least some success before they can be shut out again. ",{"data":62335,"content":62336,"nodeType":881},{},[62337],{"data":62338,"marks":62339,"value":62340,"nodeType":865},{},[],"The Pyramid of Pain – and the goal of implementing hard-to-bypass detections that hit attackers where it hurts – is central to our design philosophy. But before we get into how we apply this approach, and the types of controls we’ve created as a result, it’s useful to look at how IT and security have changed since the Pyramid was created more than a decade ago. ",{"data":62342,"content":62343,"nodeType":894},{},[],{"data":62345,"content":62346,"nodeType":904},{},[62347],{"data":62348,"marks":62349,"value":62350,"nodeType":865},{},[],"A new era for cyber security",{"data":62352,"content":62353,"nodeType":881},{},[62354,62358,62367],{"data":62355,"marks":62356,"value":62357,"nodeType":865},{},[],"We’ve spoken a lot about how we’re in the midst of a new era in cybersecurity, in which identity is now the outermost digital perimeter for security teams to defend. (",{"data":62359,"content":62361,"nodeType":876},{"uri":62360},"https://pushsecurity.com/resources/video/the-new-saas-cyber-kill-chain-so-con-2024/",[62362],{"data":62363,"marks":62364,"value":62366,"nodeType":865},{},[62365],{"type":874},"You’ll be familiar with this if you’ve seen any of Luke’s talks on the New SaaS Cyber Kill Chain.",{"data":62368,"marks":62369,"value":62370,"nodeType":865},{},[],") ",{"data":62372,"content":62376,"nodeType":890},{"target":62373},{"sys":62374},{"id":62375,"type":887,"linkType":888},"6nYSZAYpsbj78jKm0q75zs",[],{"data":62378,"content":62379,"nodeType":881},{},[62380],{"data":62381,"marks":62382,"value":62383,"nodeType":865},{},[],"This is primarily because modern working is no longer contained to a heavily centralized corporate network, and instead happens primarily in applications accessed over the internet via web browser.",{"data":62385,"content":62386,"nodeType":881},{},[62387,62391,62398,62402,62408,62412,62419],{"data":62388,"marks":62389,"value":62390,"nodeType":865},{},[],"In this new world, attacks don’t even have to touch the old perimeters, because all the data and functionality they could want exists on the public internet. As a result, we’re seeing more and more ",{"data":62392,"content":62393,"nodeType":876},{"uri":4535},[62394],{"data":62395,"marks":62396,"value":62397,"nodeType":865},{},[],"attacks targeting SaaS apps",{"data":62399,"marks":62400,"value":62401,"nodeType":865},{},[],", with the entire attack chain being concluded outside customer networks, not touching any traditional endpoints or networks. The ",{"data":62403,"content":62404,"nodeType":876},{"uri":5072},[62405],{"data":62406,"marks":62407,"value":57325,"nodeType":865},{},[],{"data":62409,"marks":62410,"value":62411,"nodeType":865},{},[],", hailed ",{"data":62413,"content":62414,"nodeType":876},{"uri":57307},[62415],{"data":62416,"marks":62417,"value":62418,"nodeType":865},{},[],"one of the biggest breaches in history",{"data":62420,"marks":62421,"value":62422,"nodeType":865},{},[],", demonstrate this risk all too well. ",{"data":62424,"content":62425,"nodeType":881},{},[62426],{"data":62427,"marks":62428,"value":62429,"nodeType":865},{},[],"This creates a problem for security teams looking to detect and respond to these attacks. ",{"data":62431,"content":62432,"nodeType":1860},{},[62433],{"data":62434,"marks":62435,"value":62436,"nodeType":865},{},[],"Attacks today are shorter and faster, but just as dangerous",{"data":62438,"content":62439,"nodeType":881},{},[62440],{"data":62441,"marks":62442,"value":62443,"nodeType":865},{},[],"Detecting and responding to identity attacks – phishing, credential stuffing, etc. – used to be just one possible method of initial access in quite a lengthy Kill Chain that stretched from the compromise of the user device, pivoting to internal network resources, escalating privileges, moving laterally, and finally achieving their objectives.",{"data":62445,"content":62446,"nodeType":881},{},[62447],{"data":62448,"marks":62449,"value":62450,"nodeType":865},{},[],"This meant that defenders could adopt an assumed compromise mentality and build layered detections, as well as proactively hunting for threats across these various stages and layers of the network. The more actions an attacker has to perform, the more opportunities for detection, and the higher the likelihood that they’ll be caught in the act before any real, lasting damage can be caused. ",{"data":62452,"content":62453,"nodeType":881},{},[62454],{"data":62455,"marks":62456,"value":62457,"nodeType":865},{},[],"Today, attackers have a lot of opportunities to cause significant damage for much less effort than before. For example, if the goal is to compromise an app like Snowflake and dump the data from it, the Kill Chain is way shorter than a traditional network-based attack. And all the great tools and security products you have, like EDR, don’t come into play. ",{"data":62459,"content":62460,"nodeType":881},{},[62461],{"data":62462,"marks":62463,"value":62464,"nodeType":865},{},[],"This means that the initial layer of anti-account takeover controls are much more important in this context. But, the historical detections in this space – email gateway security products, analyzing web pages for malicious content, and URL blocklisting – are either less relevant, or built upon easy to bypass detections toward the bottom of the Pyramid of Pain. ",{"data":62466,"content":62467,"nodeType":881},{},[62468,62472,62479],{"data":62469,"marks":62470,"value":62471,"nodeType":865},{},[],"As an example, ",{"data":62473,"content":62474,"nodeType":876},{"uri":39792},[62475],{"data":62476,"marks":62477,"value":62478,"nodeType":865},{},[],"we recently published an article on all the ways that AitM phishing sites are evading detection",{"data":62480,"marks":62481,"value":62482,"nodeType":865},{},[],". TL;DR – there are a lot, and they seem to be quite effective. But this is partly because the majority of the detections they're trying to avoid are built on shaky ground.   ",{"data":62484,"content":62485,"nodeType":881},{},[62486],{"data":62487,"marks":62488,"value":62490,"nodeType":865},{},[62489],{"type":902},"So what? Well, it’s clear that the controls that the industry has relied on in the past to stop identity attacks are too easy to bypass, and are no longer sufficient. ",{"data":62492,"content":62493,"nodeType":894},{},[],{"data":62495,"content":62496,"nodeType":904},{},[62497],{"data":62498,"marks":62499,"value":62500,"nodeType":865},{},[],"Building effective identity threat detection controls",{"data":62502,"content":62503,"nodeType":881},{},[62504],{"data":62505,"marks":62506,"value":62507,"nodeType":865},{},[],"Now we’ve covered the problem that we set out to solve, let’s look at what we’re doing differently. ",{"data":62509,"content":62510,"nodeType":881},{},[62511],{"data":62512,"marks":62513,"value":62514,"nodeType":865},{},[],"In order to climb the Pyramid toward the apex, you need to find ways to detect increasingly generic parts of an attack technique. So you want to avoid things like what a specific malware’s code looks like, or where it connects back to. But what the malware does, or what happens when it runs, is more generic, and therefore more interesting to us.  ",{"data":62516,"content":62517,"nodeType":881},{},[62518],{"data":62519,"marks":62520,"value":62521,"nodeType":865},{},[],"The shift from static code signatures and fuzzy hashes to dynamic analysis of what code does on a live system is at the heart of why EDR killed antivirus a decade ago. It proved at-scale the value of moving detections up the pyramid.",{"data":62523,"content":62524,"nodeType":881},{},[62525],{"data":62526,"marks":62527,"value":62528,"nodeType":865},{},[],"We’re always on the lookout for ways to move our detections up the pyramid as well. It’s easiest to explain how we’ve applied this by looking at an example. ",{"data":62530,"content":62531,"nodeType":1860},{},[62532],{"data":62533,"marks":62534,"value":62535,"nodeType":865},{},[],"Scenario: Detecting a web-based phishing attack",{"data":62537,"content":62538,"nodeType":881},{},[62539],{"data":62540,"marks":62541,"value":62542,"nodeType":865},{},[],"Let’s break down the stages of a web-based phishing attack as an example. For a user to be successfully phished:",{"data":62544,"content":62545,"nodeType":1818},{},[62546,62561,62576],{"data":62547,"content":62548,"nodeType":1734},{},[62549],{"data":62550,"content":62551,"nodeType":881},{},[62552,62557],{"data":62553,"marks":62554,"value":62556,"nodeType":865},{},[62555],{"type":902},"Stage 1:",{"data":62558,"marks":62559,"value":62560,"nodeType":865},{},[]," The victim must be lured to visit a website.",{"data":62562,"content":62563,"nodeType":1734},{},[62564],{"data":62565,"content":62566,"nodeType":881},{},[62567,62572],{"data":62568,"marks":62569,"value":62571,"nodeType":865},{},[62570],{"type":902},"Stage 2:",{"data":62573,"marks":62574,"value":62575,"nodeType":865},{},[]," The website must somehow trick or convince the user that it’s legitimate and trustworthy, for example by mimicking a legitimate site.",{"data":62577,"content":62578,"nodeType":1734},{},[62579],{"data":62580,"content":62581,"nodeType":881},{},[62582,62587],{"data":62583,"marks":62584,"value":62586,"nodeType":865},{},[62585],{"type":902},"Stage 3:",{"data":62588,"marks":62589,"value":62590,"nodeType":865},{},[]," The user must enter their actual credentials into that website.",{"data":62592,"content":62593,"nodeType":881},{},[62594],{"data":62595,"marks":62596,"value":62597,"nodeType":865},{},[],"So, how might you go about detecting this attack? Let’s start from the bottom of the pyramid and work our way up.",{"data":62599,"content":62600,"nodeType":1860},{},[62601],{"data":62602,"marks":62603,"value":62604,"nodeType":865},{},[],"Stage 1: Determining if a URL, IP, or domain is bad",{"data":62606,"content":62607,"nodeType":881},{},[62608],{"data":62609,"marks":62610,"value":62611,"nodeType":865},{},[],"You might start by looking for the lure – historically an email. You could look for links in emails, or links in attachments in an email and then check if they are bad (which is essentially what email security products do). You could look for known-bad URLs in emails, but these change for every phishing campaign. In modern attacks, every target can receive a unique email and link. Even just using a URL shortener can bypass this. It’s equivalent to a malware hash – trivial to change, and therefore not a great thing to pin your detections on. ",{"data":62613,"content":62614,"nodeType":881},{},[62615,62619,62628],{"data":62616,"marks":62617,"value":62618,"nodeType":865},{},[],"You could look at which IP address the user connects to, but these days it’s very simple for attackers to add a new IP to their cloud-hosted server. If a domain is flagged as known-bad, the attacker only has to register a new domain, or compromise a WordPress server on an already trusted domain. Both of these things are ",{"data":62620,"content":62622,"nodeType":876},{"uri":62621},"https://www.bleepingcomputer.com/news/security/revolver-rabbit-gang-registers-500-000-domains-for-malware-campaigns/",[62623],{"data":62624,"marks":62625,"value":62627,"nodeType":865},{},[62626],{"type":874},"happening on a massive scale",{"data":62629,"marks":62630,"value":62631,"nodeType":865},{},[]," as attackers pre-plan for the fact that their domains will be burned at some point. Attackers are more than happy to spend $10-$20 per new domain in the grand scheme of the potential proceeds of crime. ",{"data":62633,"content":62634,"nodeType":881},{},[62635],{"data":62636,"marks":62637,"value":62638,"nodeType":865},{},[],"But there’s a more fundamental flaw here – for defenders to know that a URL, IP, or domain name is bad, it needs to be reported first. When are things reported? Typically after being used in an attack – so unfortunately, someone always gets hurt.  ",{"data":62640,"content":62641,"nodeType":1860},{},[62642],{"data":62643,"marks":62644,"value":62645,"nodeType":865},{},[],"Stage 2: Determining if a site is legitimate",{"data":62647,"content":62648,"nodeType":881},{},[62649],{"data":62650,"marks":62651,"value":62652,"nodeType":865},{},[],"So how can we detect a phishing website, on day-zero, the first time anyone runs into it? Well we can look at the second step – does the URL resemble a real website, does the HTML code for a page look similar to a legitimate login page for a known website, is it loading the same image files? This is not trivial to detect, but with the right fuzzy matches and image analysis it can be automated.",{"data":62654,"content":62655,"nodeType":881},{},[62656],{"data":62657,"marks":62658,"value":62659,"nodeType":865},{},[],"We’ve now moved up a level on the Pyramid – we’re detecting website artifacts. If we see a legitimate looking website on an unknown domain, it’s likely to be a malicious clone.",{"data":62661,"content":62662,"nodeType":881},{},[62663],{"data":62664,"marks":62665,"value":62666,"nodeType":865},{},[],"Unfortunately, the attacker’s website doesn’t need to send each visitor to the same website. It can change dynamically based on where the visitor is coming from – or even randomly, so that not all visitors are served the phishing page. This means that tools which resolve where the links in emails go to be able to analyze them (such as email security appliances) don’t necessarily see the same site the user is actually visiting – a fact that is commonly abused by attackers to bypass detection. It’s critical that detection happens on the actual web page that the victim sees.",{"data":62668,"content":62669,"nodeType":1860},{},[62670],{"data":62671,"marks":62672,"value":62673,"nodeType":865},{},[],"Stage 3: Detecting the user entering their credentials",{"data":62675,"content":62676,"nodeType":881},{},[62677],{"data":62678,"marks":62679,"value":62680,"nodeType":865},{},[],"For a phishing attack to succeed, the victim must enter their actual credentials into the webpage. If you can stop the user entering their real password, there’s no attack. There’s no getting around it. ",{"data":62682,"content":62683,"nodeType":881},{},[62684,62688,62695],{"data":62685,"marks":62686,"value":62687,"nodeType":865},{},[],"So, this is exactly what we did: Earlier this year, we released a control which ",{"data":62689,"content":62690,"nodeType":876},{"uri":17092},[62691],{"data":62692,"marks":62693,"value":62694,"nodeType":865},{},[],"stops users from entering their password belonging to a particular login page anywhere else",{"data":62696,"marks":62697,"value":959,"nodeType":865},{},[],{"data":62699,"content":62700,"nodeType":881},{},[62701,62705,62712],{"data":62702,"marks":62703,"value":62704,"nodeType":865},{},[],"Seems simple, right? By focusing on this generic action, that always has to happen, you can essentially stop your users being phished altogether. This means, it doesn’t matter ",{"data":62706,"content":62707,"nodeType":876},{"uri":39792},[62708],{"data":62709,"marks":62710,"value":62711,"nodeType":865},{},[],"what the attacker does before that point",{"data":62713,"marks":62714,"value":24662,"nodeType":865},{},[],{"data":62716,"content":62717,"nodeType":1818},{},[62718,62728,62738,62748],{"data":62719,"content":62720,"nodeType":1734},{},[62721],{"data":62722,"content":62723,"nodeType":881},{},[62724],{"data":62725,"marks":62726,"value":62727,"nodeType":865},{},[],"It doesn't matter if they run the site using Cloudflare Workers to block automatic analysis.",{"data":62729,"content":62730,"nodeType":1734},{},[62731],{"data":62732,"content":62733,"nodeType":881},{},[62734],{"data":62735,"marks":62736,"value":62737,"nodeType":865},{},[],"It doesn’t matter if they hack a WordPress blog to get a reputable domain.",{"data":62739,"content":62740,"nodeType":1734},{},[62741],{"data":62742,"content":62743,"nodeType":881},{},[62744],{"data":62745,"marks":62746,"value":62747,"nodeType":865},{},[],"It doesn’t matter if they use clever redirects and rotate the URLs delivered to the user.",{"data":62749,"content":62750,"nodeType":1734},{},[62751],{"data":62752,"content":62753,"nodeType":881},{},[62754],{"data":62755,"marks":62756,"value":62757,"nodeType":865},{},[],"It doesn’t matter if they randomize the HTML title for the web page. ",{"data":62759,"content":62760,"nodeType":881},{},[62761],{"data":62762,"marks":62763,"value":62764,"nodeType":865},{},[],"They can’t avoid the fact that a user is required to enter their credentials on the page for the attack to succeed. ",{"data":62766,"content":62767,"nodeType":881},{},[62768],{"data":62769,"marks":62770,"value":62771,"nodeType":865},{},[],"So, when you apply the Pyramid of Pain to some of the controls we’ve shipped this year, we get a clear feel for the value, from highest to lowest:",{"data":62773,"content":62774,"nodeType":1818},{},[62775,62795,62815],{"data":62776,"content":62777,"nodeType":1734},{},[62778],{"data":62779,"content":62780,"nodeType":881},{},[62781,62785,62792],{"data":62782,"marks":62783,"value":62784,"nodeType":865},{},[],"User Behavior: ",{"data":62786,"content":62787,"nodeType":876},{"uri":17092},[62788],{"data":62789,"marks":62790,"value":62791,"nodeType":865},{},[],"Detecting and blocking the user behavior of entering their password into any site that the password doesn’t belong to",{"data":62793,"marks":62794,"value":1032,"nodeType":865},{},[],{"data":62796,"content":62797,"nodeType":1734},{},[62798],{"data":62799,"content":62800,"nodeType":881},{},[62801,62805,62812],{"data":62802,"marks":62803,"value":62804,"nodeType":865},{},[],"Tool Behavior: ",{"data":62806,"content":62807,"nodeType":876},{"uri":43904},[62808],{"data":62809,"marks":62810,"value":62811,"nodeType":865},{},[],"Detecting when a login page that you access is cloned from a legitimate page.",{"data":62813,"marks":62814,"value":21,"nodeType":865},{},[],{"data":62816,"content":62817,"nodeType":1734},{},[62818],{"data":62819,"content":62820,"nodeType":881},{},[62821,62825,62832],{"data":62822,"marks":62823,"value":62824,"nodeType":865},{},[],"Tool Signature: ",{"data":62826,"content":62827,"nodeType":876},{"uri":43852},[62828],{"data":62829,"marks":62830,"value":62831,"nodeType":865},{},[],"Detecting and blocking access to a page with a known phishing kit signature present on the page",{"data":62833,"marks":62834,"value":1032,"nodeType":865},{},[],{"data":62836,"content":62837,"nodeType":881},{},[62838],{"data":62839,"marks":62840,"value":62841,"nodeType":865},{},[],"Naturally, we want to continue focusing on the apex of the Pyramid – at TTPs and Tools – to ensure that the controls we build are as robust as possible, and can’t be bypassed by attackers. ",{"data":62843,"content":62844,"nodeType":894},{},[],{"data":62846,"content":62847,"nodeType":904},{},[62848],{"data":62849,"marks":62850,"value":62851,"nodeType":865},{},[],"The power of the Push browser agent",{"data":62853,"content":62854,"nodeType":881},{},[62855,62859,62864],{"data":62856,"marks":62857,"value":62858,"nodeType":865},{},[],"You might ask: ",{"data":62860,"marks":62861,"value":62863,"nodeType":865},{},[62862],{"type":902},"If it’s so simple, why hasn’t this been done yet?",{"data":62865,"marks":62866,"value":62867,"nodeType":865},{},[]," Well, before now, there was no good way of doing it! Teams simply didn’t have tools in the right place to be able to capture the level of data needed, or respond effectively (i.e. automatically, at the point of impact). ",{"data":62869,"content":62870,"nodeType":881},{},[62871,62875,62882],{"data":62872,"marks":62873,"value":62874,"nodeType":865},{},[],"This is where being in the browser comes into play. The browser is a great place to observe the behavior of a page in real time, without needing to reconstruct decrypted HTTP data post-TLS termination and try to guess what the rendered page in all its Javascript-infused glory actually does, ",{"data":62876,"content":62877,"nodeType":876},{"uri":31096},[62878],{"data":62879,"marks":62880,"value":62881,"nodeType":865},{},[],"as we’ve blogged about previously",{"data":62883,"marks":62884,"value":62885,"nodeType":865},{},[],". As we’ve seen through the ability to not only detect but prevent phishing attacks, it’s also a great control enforcement point, as you’re able to intercept the user at the point of impact, and you sit as closely as possible to where their work typically happens – in the browser. ",{"data":62887,"content":62888,"nodeType":881},{},[62889],{"data":62890,"marks":62891,"value":62892,"nodeType":865},{},[],"To illustrate how crucial the browser is to implementing controls that sit at the apex of the Pyramid of Pain, we created a modified version designed specifically for identity attacks. ",{"data":62894,"content":62898,"nodeType":890},{"target":62895},{"sys":62896},{"id":62897,"type":887,"linkType":888},"HrK2xQak6KfjInDbeSgv8",[],{"data":62900,"content":62904,"nodeType":890},{"target":62901},{"sys":62902},{"id":62903,"type":887,"linkType":888},"7kLilJ8Y08smUI9ttM3BSO",[],{"data":62906,"content":62907,"nodeType":894},{},[],{"data":62909,"content":62910,"nodeType":904},{},[62911],{"data":62912,"marks":62913,"value":29161,"nodeType":865},{},[],{"data":62915,"content":62916,"nodeType":881},{},[62917],{"data":62918,"marks":62919,"value":62920,"nodeType":865},{},[],"Hopefully, this blog post has shone a light on why we do things the way we do here at Push. The goal of building generic detections that are difficult, painful, and costly for attackers to bypass is a key part of our design strategy, and we look forward to sharing many more controls with you that demonstrate this in the future.","Our design philosophy: Detecting what matters","This is the first blog in a short series we’re putting together about the ‘why’ behind the ‘what’ at Push. This entry is focused on threat detection. ","2024-08-05T00:00:00.000Z","our-design-philosophy-detecting-what-matters",{"items":62926},[62927,62929],{"sys":62928,"name":342},{"id":4510},{"sys":62930,"name":4507},{"id":4506},{"items":62932},[62933],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":62934},{"url":5377},{"__typename":1485,"sys":62936,"content":62937,"title":56395,"synopsis":56396,"hashTags":59,"publishedDate":56397,"slug":56398,"tagsCollection":63614,"authorsCollection":63620},{"id":55609},{"json":62938},{"data":62939,"content":62940,"nodeType":1463},{},[62941,62946,62952,62994,63000,63006,63019,63025,63031,63100,63106,63111,63117,63123,63136,63142,63148,63168,63188,63193,63210,63216,63222,63249,63255,63261,63266,63283,63289,63295,63301,63307,63312,63329,63335,63341,63347,63353,63358,63375,63381,63387,63392,63409,63415,63421,63427,63469,63475,63536,63549,63554,63560,63566,63572,63578,63593,63599],{"data":62942,"content":62945,"nodeType":890},{"target":62943},{"sys":62944},{"id":55618,"type":887,"linkType":888},[],{"data":62947,"content":62948,"nodeType":881},{},[62949],{"data":62950,"marks":62951,"value":55626,"nodeType":865},{},[],{"data":62953,"content":62954,"nodeType":881},{},[62955,62958,62964,62967,62973,62976,62982,62985,62991],{"data":62956,"marks":62957,"value":55633,"nodeType":865},{},[],{"data":62959,"content":62960,"nodeType":876},{"uri":55636},[62961],{"data":62962,"marks":62963,"value":55641,"nodeType":865},{},[],{"data":62965,"marks":62966,"value":2091,"nodeType":865},{},[],{"data":62968,"content":62969,"nodeType":876},{"uri":55647},[62970],{"data":62971,"marks":62972,"value":55652,"nodeType":865},{},[],{"data":62974,"marks":62975,"value":2091,"nodeType":865},{},[],{"data":62977,"content":62978,"nodeType":876},{"uri":11576},[62979],{"data":62980,"marks":62981,"value":55662,"nodeType":865},{},[],{"data":62983,"marks":62984,"value":2091,"nodeType":865},{},[],{"data":62986,"content":62987,"nodeType":876},{"uri":55668},[62988],{"data":62989,"marks":62990,"value":55673,"nodeType":865},{},[],{"data":62992,"marks":62993,"value":55677,"nodeType":865},{},[],{"data":62995,"content":62996,"nodeType":881},{},[62997],{"data":62998,"marks":62999,"value":55684,"nodeType":865},{},[],{"data":63001,"content":63002,"nodeType":881},{},[63003],{"data":63004,"marks":63005,"value":55691,"nodeType":865},{},[],{"data":63007,"content":63008,"nodeType":881},{},[63009,63012,63016],{"data":63010,"marks":63011,"value":55698,"nodeType":865},{},[],{"data":63013,"marks":63014,"value":55703,"nodeType":865},{},[63015],{"type":902},{"data":63017,"marks":63018,"value":959,"nodeType":865},{},[],{"data":63020,"content":63021,"nodeType":881},{},[63022],{"data":63023,"marks":63024,"value":55713,"nodeType":865},{},[],{"data":63026,"content":63027,"nodeType":881},{},[63028],{"data":63029,"marks":63030,"value":55720,"nodeType":865},{},[],{"data":63032,"content":63033,"nodeType":1818},{},[63034,63059],{"data":63035,"content":63036,"nodeType":1734},{},[63037],{"data":63038,"content":63039,"nodeType":881},{},[63040,63044,63047,63056],{"data":63041,"marks":63042,"value":55734,"nodeType":865},{},[63043],{"type":902},{"data":63045,"marks":63046,"value":55738,"nodeType":865},{},[],{"data":63048,"content":63051,"nodeType":19000},{"target":63049},{"sys":63050},{"id":55743,"type":887,"linkType":888},[63052],{"data":63053,"marks":63054,"value":55749,"nodeType":865},{},[63055],{"type":902},{"data":63057,"marks":63058,"value":55753,"nodeType":865},{},[],{"data":63060,"content":63061,"nodeType":1734},{},[63062],{"data":63063,"content":63064,"nodeType":881},{},[63065,63069,63072,63078,63081,63087,63090,63097],{"data":63066,"marks":63067,"value":55764,"nodeType":865},{},[63068],{"type":902},{"data":63070,"marks":63071,"value":55768,"nodeType":865},{},[],{"data":63073,"content":63074,"nodeType":876},{"uri":55771},[63075],{"data":63076,"marks":63077,"value":55776,"nodeType":865},{},[],{"data":63079,"marks":63080,"value":1877,"nodeType":865},{},[],{"data":63082,"content":63083,"nodeType":876},{"uri":55782},[63084],{"data":63085,"marks":63086,"value":55787,"nodeType":865},{},[],{"data":63088,"marks":63089,"value":55791,"nodeType":865},{},[],{"data":63091,"content":63092,"nodeType":876},{"uri":55794},[63093],{"data":63094,"marks":63095,"value":55800,"nodeType":865},{},[63096],{"type":902},{"data":63098,"marks":63099,"value":55804,"nodeType":865},{},[],{"data":63101,"content":63102,"nodeType":881},{},[63103],{"data":63104,"marks":63105,"value":55811,"nodeType":865},{},[],{"data":63107,"content":63110,"nodeType":890},{"target":63108},{"sys":63109},{"id":55816,"type":887,"linkType":888},[],{"data":63112,"content":63113,"nodeType":904},{},[63114],{"data":63115,"marks":63116,"value":55824,"nodeType":865},{},[],{"data":63118,"content":63119,"nodeType":881},{},[63120],{"data":63121,"marks":63122,"value":55831,"nodeType":865},{},[],{"data":63124,"content":63125,"nodeType":881},{},[63126,63129,63133],{"data":63127,"marks":63128,"value":55838,"nodeType":865},{},[],{"data":63130,"marks":63131,"value":55749,"nodeType":865},{},[63132],{"type":902},{"data":63134,"marks":63135,"value":55846,"nodeType":865},{},[],{"data":63137,"content":63138,"nodeType":881},{},[63139],{"data":63140,"marks":63141,"value":55853,"nodeType":865},{},[],{"data":63143,"content":63144,"nodeType":1860},{},[63145],{"data":63146,"marks":63147,"value":19214,"nodeType":865},{},[],{"data":63149,"content":63150,"nodeType":881},{},[63151,63154,63158,63161,63165],{"data":63152,"marks":63153,"value":55866,"nodeType":865},{},[],{"data":63155,"marks":63156,"value":55871,"nodeType":865},{},[63157],{"type":902},{"data":63159,"marks":63160,"value":1651,"nodeType":865},{},[],{"data":63162,"marks":63163,"value":55879,"nodeType":865},{},[63164],{"type":902},{"data":63166,"marks":63167,"value":959,"nodeType":865},{},[],{"data":63169,"content":63170,"nodeType":881},{},[63171,63174,63178,63181,63185],{"data":63172,"marks":63173,"value":55889,"nodeType":865},{},[],{"data":63175,"marks":63176,"value":55894,"nodeType":865},{},[63177],{"type":902},{"data":63179,"marks":63180,"value":8048,"nodeType":865},{},[],{"data":63182,"marks":63183,"value":55902,"nodeType":865},{},[63184],{"type":902},{"data":63186,"marks":63187,"value":55906,"nodeType":865},{},[],{"data":63189,"content":63192,"nodeType":890},{"target":63190},{"sys":63191},{"id":55911,"type":887,"linkType":888},[],{"data":63194,"content":63195,"nodeType":881},{},[63196,63199,63207],{"data":63197,"marks":63198,"value":55919,"nodeType":865},{},[],{"data":63200,"content":63203,"nodeType":19000},{"target":63201},{"sys":63202},{"id":55924,"type":887,"linkType":888},[63204],{"data":63205,"marks":63206,"value":55929,"nodeType":865},{},[],{"data":63208,"marks":63209,"value":21,"nodeType":865},{},[],{"data":63211,"content":63212,"nodeType":1860},{},[63213],{"data":63214,"marks":63215,"value":43665,"nodeType":865},{},[],{"data":63217,"content":63218,"nodeType":881},{},[63219],{"data":63220,"marks":63221,"value":55945,"nodeType":865},{},[],{"data":63223,"content":63224,"nodeType":881},{},[63225,63228,63232,63235,63239,63242,63246],{"data":63226,"marks":63227,"value":55952,"nodeType":865},{},[],{"data":63229,"marks":63230,"value":55894,"nodeType":865},{},[63231],{"type":902},{"data":63233,"marks":63234,"value":8048,"nodeType":865},{},[],{"data":63236,"marks":63237,"value":55902,"nodeType":865},{},[63238],{"type":902},{"data":63240,"marks":63241,"value":55967,"nodeType":865},{},[],{"data":63243,"marks":63244,"value":55972,"nodeType":865},{},[63245],{"type":902},{"data":63247,"marks":63248,"value":55976,"nodeType":865},{},[],{"data":63250,"content":63251,"nodeType":881},{},[63252],{"data":63253,"marks":63254,"value":55983,"nodeType":865},{},[],{"data":63256,"content":63257,"nodeType":881},{},[63258],{"data":63259,"marks":63260,"value":55990,"nodeType":865},{},[],{"data":63262,"content":63265,"nodeType":890},{"target":63263},{"sys":63264},{"id":55995,"type":887,"linkType":888},[],{"data":63267,"content":63268,"nodeType":881},{},[63269,63272,63280],{"data":63270,"marks":63271,"value":55919,"nodeType":865},{},[],{"data":63273,"content":63276,"nodeType":19000},{"target":63274},{"sys":63275},{"id":19725,"type":887,"linkType":888},[63277],{"data":63278,"marks":63279,"value":43665,"nodeType":865},{},[],{"data":63281,"marks":63282,"value":21,"nodeType":865},{},[],{"data":63284,"content":63285,"nodeType":1860},{},[63286],{"data":63287,"marks":63288,"value":56020,"nodeType":865},{},[],{"data":63290,"content":63291,"nodeType":881},{},[63292],{"data":63293,"marks":63294,"value":56027,"nodeType":865},{},[],{"data":63296,"content":63297,"nodeType":881},{},[63298],{"data":63299,"marks":63300,"value":56034,"nodeType":865},{},[],{"data":63302,"content":63303,"nodeType":881},{},[63304],{"data":63305,"marks":63306,"value":56041,"nodeType":865},{},[],{"data":63308,"content":63311,"nodeType":890},{"target":63309},{"sys":63310},{"id":56046,"type":887,"linkType":888},[],{"data":63313,"content":63314,"nodeType":881},{},[63315,63318,63326],{"data":63316,"marks":63317,"value":55919,"nodeType":865},{},[],{"data":63319,"content":63322,"nodeType":19000},{"target":63320},{"sys":63321},{"id":56058,"type":887,"linkType":888},[63323],{"data":63324,"marks":63325,"value":56020,"nodeType":865},{},[],{"data":63327,"marks":63328,"value":21,"nodeType":865},{},[],{"data":63330,"content":63331,"nodeType":1860},{},[63332],{"data":63333,"marks":63334,"value":56072,"nodeType":865},{},[],{"data":63336,"content":63337,"nodeType":881},{},[63338],{"data":63339,"marks":63340,"value":56079,"nodeType":865},{},[],{"data":63342,"content":63343,"nodeType":881},{},[63344],{"data":63345,"marks":63346,"value":56086,"nodeType":865},{},[],{"data":63348,"content":63349,"nodeType":881},{},[63350],{"data":63351,"marks":63352,"value":56093,"nodeType":865},{},[],{"data":63354,"content":63357,"nodeType":890},{"target":63355},{"sys":63356},{"id":56098,"type":887,"linkType":888},[],{"data":63359,"content":63360,"nodeType":881},{},[63361,63364,63372],{"data":63362,"marks":63363,"value":55919,"nodeType":865},{},[],{"data":63365,"content":63368,"nodeType":19000},{"target":63366},{"sys":63367},{"id":56110,"type":887,"linkType":888},[63369],{"data":63370,"marks":63371,"value":56115,"nodeType":865},{},[],{"data":63373,"marks":63374,"value":21,"nodeType":865},{},[],{"data":63376,"content":63377,"nodeType":1860},{},[63378],{"data":63379,"marks":63380,"value":56125,"nodeType":865},{},[],{"data":63382,"content":63383,"nodeType":881},{},[63384],{"data":63385,"marks":63386,"value":56132,"nodeType":865},{},[],{"data":63388,"content":63391,"nodeType":890},{"target":63389},{"sys":63390},{"id":56137,"type":887,"linkType":888},[],{"data":63393,"content":63394,"nodeType":881},{},[63395,63398,63406],{"data":63396,"marks":63397,"value":55919,"nodeType":865},{},[],{"data":63399,"content":63402,"nodeType":19000},{"target":63400},{"sys":63401},{"id":56149,"type":887,"linkType":888},[63403],{"data":63404,"marks":63405,"value":44463,"nodeType":865},{},[],{"data":63407,"marks":63408,"value":21,"nodeType":865},{},[],{"data":63410,"content":63411,"nodeType":904},{},[63412],{"data":63413,"marks":63414,"value":56163,"nodeType":865},{},[],{"data":63416,"content":63417,"nodeType":881},{},[63418],{"data":63419,"marks":63420,"value":56170,"nodeType":865},{},[],{"data":63422,"content":63423,"nodeType":881},{},[63424],{"data":63425,"marks":63426,"value":56177,"nodeType":865},{},[],{"data":63428,"content":63429,"nodeType":1818},{},[63430,63443,63456],{"data":63431,"content":63432,"nodeType":1734},{},[63433],{"data":63434,"content":63435,"nodeType":881},{},[63436,63440],{"data":63437,"marks":63438,"value":56191,"nodeType":865},{},[63439],{"type":902},{"data":63441,"marks":63442,"value":56195,"nodeType":865},{},[],{"data":63444,"content":63445,"nodeType":1734},{},[63446],{"data":63447,"content":63448,"nodeType":881},{},[63449,63453],{"data":63450,"marks":63451,"value":56206,"nodeType":865},{},[63452],{"type":902},{"data":63454,"marks":63455,"value":56210,"nodeType":865},{},[],{"data":63457,"content":63458,"nodeType":1734},{},[63459],{"data":63460,"content":63461,"nodeType":881},{},[63462,63466],{"data":63463,"marks":63464,"value":56221,"nodeType":865},{},[63465],{"type":902},{"data":63467,"marks":63468,"value":56225,"nodeType":865},{},[],{"data":63470,"content":63471,"nodeType":881},{},[63472],{"data":63473,"marks":63474,"value":56232,"nodeType":865},{},[],{"data":63476,"content":63477,"nodeType":1818},{},[63478,63494,63510,63523],{"data":63479,"content":63480,"nodeType":1734},{},[63481],{"data":63482,"content":63483,"nodeType":881},{},[63484,63487,63491],{"data":63485,"marks":63486,"value":56245,"nodeType":865},{},[],{"data":63488,"marks":63489,"value":56250,"nodeType":865},{},[63490],{"type":902},{"data":63492,"marks":63493,"value":56254,"nodeType":865},{},[],{"data":63495,"content":63496,"nodeType":1734},{},[63497],{"data":63498,"content":63499,"nodeType":881},{},[63500,63503,63507],{"data":63501,"marks":63502,"value":56264,"nodeType":865},{},[],{"data":63504,"marks":63505,"value":56269,"nodeType":865},{},[63506],{"type":902},{"data":63508,"marks":63509,"value":56273,"nodeType":865},{},[],{"data":63511,"content":63512,"nodeType":1734},{},[63513],{"data":63514,"content":63515,"nodeType":881},{},[63516,63520],{"data":63517,"marks":63518,"value":56284,"nodeType":865},{},[63519],{"type":902},{"data":63521,"marks":63522,"value":56288,"nodeType":865},{},[],{"data":63524,"content":63525,"nodeType":1734},{},[63526],{"data":63527,"content":63528,"nodeType":881},{},[63529,63533],{"data":63530,"marks":63531,"value":56299,"nodeType":865},{},[63532],{"type":902},{"data":63534,"marks":63535,"value":56303,"nodeType":865},{},[],{"data":63537,"content":63538,"nodeType":881},{},[63539,63542,63546],{"data":63540,"marks":63541,"value":56310,"nodeType":865},{},[],{"data":63543,"marks":63544,"value":55800,"nodeType":865},{},[63545],{"type":902},{"data":63547,"marks":63548,"value":56318,"nodeType":865},{},[],{"data":63550,"content":63553,"nodeType":890},{"target":63551},{"sys":63552},{"id":56323,"type":887,"linkType":888},[],{"data":63555,"content":63556,"nodeType":881},{},[63557],{"data":63558,"marks":63559,"value":56331,"nodeType":865},{},[],{"data":63561,"content":63562,"nodeType":904},{},[63563],{"data":63564,"marks":63565,"value":56338,"nodeType":865},{},[],{"data":63567,"content":63568,"nodeType":881},{},[63569],{"data":63570,"marks":63571,"value":56345,"nodeType":865},{},[],{"data":63573,"content":63574,"nodeType":881},{},[63575],{"data":63576,"marks":63577,"value":56352,"nodeType":865},{},[],{"data":63579,"content":63580,"nodeType":881},{},[63581,63584,63590],{"data":63582,"marks":63583,"value":56359,"nodeType":865},{},[],{"data":63585,"content":63586,"nodeType":876},{"uri":55782},[63587],{"data":63588,"marks":63589,"value":56366,"nodeType":865},{},[],{"data":63591,"marks":63592,"value":56370,"nodeType":865},{},[],{"data":63594,"content":63595,"nodeType":904},{},[63596],{"data":63597,"marks":63598,"value":30636,"nodeType":865},{},[],{"data":63600,"content":63601,"nodeType":881},{},[63602,63605,63611],{"data":63603,"marks":63604,"value":56383,"nodeType":865},{},[],{"data":63606,"content":63607,"nodeType":876},{"uri":56386},[63608],{"data":63609,"marks":63610,"value":1458,"nodeType":865},{},[],{"data":63612,"marks":63613,"value":56394,"nodeType":865},{},[],{"items":63615},[63616,63618],{"sys":63617,"name":56404},{"id":56403},{"sys":63619,"name":342},{"id":4510},{"items":63621},[63622],{"fullName":20080,"firstName":20081,"jobTitle":20082,"profilePicture":63623},{"url":20084},"the-saas-attack-matrix-one-year-on","blog/the-saas-attack-matrix-one-year-on",{"json":63627},{"data":63628,"content":63629,"nodeType":1463},{},[63630],{"data":63631,"content":63632,"nodeType":881},{},[63633],{"data":63634,"marks":63635,"value":63636,"nodeType":865},{},[],"It’s been almost exactly a year since we released the SaaS attack matrix – our open source repository of SaaS-native attack techniques. So, it’s a good time to look at what’s changed, and which techniques we’ve seen rise to prominence in the wild.","It’s been almost exactly a year since we released our open source repository of SaaS-native attack techniques. Let's reflect on what’s changed. ",{"id":63639,"publishedAt":63640},"1LxqUNZpD2VynzSqbv719Z","2026-08-13T09:35:39.358Z",{"items":63642},[63643,63645],{"sys":63644,"name":4507},{"id":4506},{"sys":63646,"name":342},{"id":4510},{"items":63648},[63649,63651,63653,63655,63657,63659,63661,63663,63665,63667,63669,63671,63673,63675,63677,63679,63681,63683,63685,63687,63689],{"sys":63650,"name":279,"slug":280,"tier":31},{"id":276},{"sys":63652,"name":413,"slug":414,"tier":31},{"id":410},{"sys":63654,"name":545,"slug":546,"tier":31},{"id":542},{"sys":63656,"name":519,"slug":520,"tier":31},{"id":516},{"sys":63658,"name":342,"slug":343,"tier":31},{"id":339},{"sys":63660,"name":642,"slug":643,"tier":31},{"id":639},{"sys":63662,"name":404,"slug":405,"tier":45},{"id":401},{"sys":63664,"name":395,"slug":396,"tier":45},{"id":392},{"sys":63666,"name":261,"slug":262,"tier":45},{"id":258},{"sys":63668,"name":333,"slug":334,"tier":45},{"id":330},{"sys":63670,"name":571,"slug":572,"tier":45},{"id":568},{"sys":63672,"name":466,"slug":467,"tier":45},{"id":463},{"sys":63674,"name":422,"slug":423,"tier":45},{"id":419},{"sys":63676,"name":484,"slug":485,"tier":45},{"id":481},{"sys":63678,"name":360,"slug":361,"tier":45},{"id":357},{"sys":63680,"name":324,"slug":325,"tier":45},{"id":321},{"sys":63682,"name":475,"slug":476,"tier":45},{"id":472},{"sys":63684,"name":493,"slug":494,"tier":45},{"id":490},{"sys":63686,"name":457,"slug":458,"tier":45},{"id":454},{"sys":63688,"name":528,"slug":529,"tier":45},{"id":525},{"sys":63690,"name":607,"slug":608,"tier":45},{"id":604},"1qLYwpklFCCOQjGasNIGRR4kcmC-AB4PH8sAombT0uI",{"id":63693,"title":63694,"authorsCollection":63695,"content":63700,"extension":228,"faqItemsCollection":65084,"faqTitle":59,"featured":6,"hashTags":59,"meta":65086,"metaTitle":65087,"ogImage":59,"postType":1480,"publishedDate":65088,"relatedBlogPostsCollection":65089,"slug":69471,"stem":69472,"subtitle":59,"summary":69473,"synopsis":69491,"sys":69492,"tagsCollection":69495,"topicsCollection":69501,"__hash__":69547},"blog/blog/5-reasons-why-push-security-shouldnt-exist.json","5 reasons why Push Security shouldn’t exist",{"items":63696},[63697],{"fullName":5373,"firstName":5374,"jobTitle":5375,"socialLinks":63698,"profilePicture":63699},[6440],{"url":5377},{"json":63701,"links":65062},{"data":63702,"content":63703,"nodeType":1463},{},[63704,63724,63730,63737,63744,63765,63772,63775,63782,63789,63796,63803,63889,63896,63986,63994,64001,64008,64016,64019,64026,64033,64040,64069,64102,64131,64138,64145,64175,64182,64214,64221,64249,64256,64263,64290,64302,64309,64328,64359,64371,64374,64381,64401,64413,64431,64446,64453,64471,64501,64520,64527,64534,64552,64559,64567,64570,64577,64584,64622,64630,64637,64644,64651,64735,64759,64766,64773,64785,64804,64816,64819,64826,64833,64896,64914,64920,64923,64930,64959,64966,64973,65051,65056],{"data":63705,"content":63706,"nodeType":881},{},[63707,63711,63720],{"data":63708,"marks":63709,"value":63710,"nodeType":865},{},[],"If you caught ",{"data":63712,"content":63714,"nodeType":876},{"uri":63713},"https://cisoseries.com/securing-identities-in-the-cloud/",[63715],{"data":63716,"marks":63717,"value":63719,"nodeType":865},{},[63718],{"type":874},"our CEO Adam’s recent appearance on the Defense in Depth podcast",{"data":63721,"marks":63722,"value":63723,"nodeType":865},{},[]," you’ll have heard some top-tier banter between Geoff and David on the problem of identity security – and how, in Geoff’s words, “way too many people” think they’ve got it covered when it comes to identity attacks.",{"data":63725,"content":63729,"nodeType":890},{"target":63726},{"sys":63727},{"id":63728,"type":887,"linkType":888},"UcfFq2lOiMMJKaDfaNBqx",[],{"data":63731,"content":63732,"nodeType":881},{},[63733],{"data":63734,"marks":63735,"value":63736,"nodeType":865},{},[],"At Push, we’re constantly exploring the limits of controls against the latest threats. But naturally, security teams with hundreds of priorities can’t afford to dedicate the same amount of research time to this problem that we can. This means we come across a lot of common misconceptions about how controls like MFA, SSO and EDR perform against current identity attack techniques. ",{"data":63738,"content":63739,"nodeType":881},{},[63740],{"data":63741,"marks":63742,"value":63743,"nodeType":865},{},[],"These common misconceptions are severely impacting the ability of security teams to plan for, and defend against, identity-based attacks – giving attackers the window of opportunity they need to continue exploiting people and businesses. ",{"data":63745,"content":63746,"nodeType":881},{},[63747,63751,63756,63760],{"data":63748,"marks":63749,"value":63750,"nodeType":865},{},[],"So, we hope that this allows you a clearer perspective when building your identity security strategy, with a realistic view of what a particular control will give you – and what it won’t. ",{"data":63752,"marks":63753,"value":63755,"nodeType":865},{},[63754],{"type":902},"That isn’t to say you should discard any of these controls; they all have an important part to play! ",{"data":63757,"marks":63758,"value":63759,"nodeType":865},{},[],"But, it’s important to be aware of their limitations to be able to build a resilient security model, ",{"data":63761,"marks":63762,"value":63764,"nodeType":865},{},[63763],{"type":902},"with strategic defense in depth to compensate for known weaknesses. ",{"data":63766,"content":63767,"nodeType":881},{},[63768],{"data":63769,"marks":63770,"value":63771,"nodeType":865},{},[],"Without further ado, here are the top reasons why Push Security shouldn’t exist. ",{"data":63773,"content":63774,"nodeType":894},{},[],{"data":63776,"content":63777,"nodeType":904},{},[63778],{"data":63779,"marks":63780,"value":63781,"nodeType":865},{},[],"Reason 1: “Browser-based attacks aren’t a priority”",{"data":63783,"content":63784,"nodeType":881},{},[63785],{"data":63786,"marks":63787,"value":63788,"nodeType":865},{},[],"Particularly in the current economic climate, with many security teams feeling the squeeze, organizations often haven’t budgeted (mentally or financially) for a new kind of threat to factor into their modelling. ",{"data":63790,"content":63791,"nodeType":881},{},[63792],{"data":63793,"marks":63794,"value":63795,"nodeType":865},{},[],"We get it, now isn’t a great time to be tackling a new problem. Getting the budget to do the same as last year is difficult enough, never mind adding something new. ",{"data":63797,"content":63798,"nodeType":881},{},[63799],{"data":63800,"marks":63801,"value":63802,"nodeType":865},{},[],"But, there’s clear evidence that we're facing something a new kind of security problem. Modern attacks are consciously evading the network and endpoint, and are increasingly playing out entirely over the internet in the form of account takeover. ",{"data":63804,"content":63805,"nodeType":1818},{},[63806,63827,63847,63868],{"data":63807,"content":63808,"nodeType":1734},{},[63809],{"data":63810,"content":63811,"nodeType":881},{},[63812,63816,63823],{"data":63813,"marks":63814,"value":63815,"nodeType":865},{},[],"Stolen creds are the #1 breach vector in 79% of web app attacks (",{"data":63817,"content":63818,"nodeType":876},{"uri":41391},[63819],{"data":63820,"marks":63821,"value":11582,"nodeType":865},{},[63822],{"type":874},{"data":63824,"marks":63825,"value":63826,"nodeType":865},{},[],").  ",{"data":63828,"content":63829,"nodeType":1734},{},[63830],{"data":63831,"content":63832,"nodeType":881},{},[63833,63837,63844],{"data":63834,"marks":63835,"value":63836,"nodeType":865},{},[],"147,000 token replay attacks in 2023, 111% increase year-over-year (",{"data":63838,"content":63839,"nodeType":876},{"uri":57442},[63840],{"data":63841,"marks":63842,"value":1718,"nodeType":865},{},[63843],{"type":874},{"data":63845,"marks":63846,"value":42926,"nodeType":865},{},[],{"data":63848,"content":63849,"nodeType":1734},{},[63850],{"data":63851,"content":63852,"nodeType":881},{},[63853,63857,63865],{"data":63854,"marks":63855,"value":63856,"nodeType":865},{},[],"80% of attacks involve identity and compromised credentials (",{"data":63858,"content":63860,"nodeType":876},{"uri":63859},"https://www.crowdstrike.com/blog/relentless-threat-activity-puts-identities-in-the-crosshairs/",[63861],{"data":63862,"marks":63863,"value":18848,"nodeType":865},{},[63864],{"type":874},{"data":63866,"marks":63867,"value":63826,"nodeType":865},{},[],{"data":63869,"content":63870,"nodeType":1734},{},[63871],{"data":63872,"content":63873,"nodeType":881},{},[63874,63878,63886],{"data":63875,"marks":63876,"value":63877,"nodeType":865},{},[],"4,000 password-based attacks per second observed (",{"data":63879,"content":63881,"nodeType":876},{"uri":63880},"https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023",[63882],{"data":63883,"marks":63884,"value":1718,"nodeType":865},{},[63885],{"type":874},{"data":63887,"marks":63888,"value":30302,"nodeType":865},{},[],{"data":63890,"content":63891,"nodeType":881},{},[63892],{"data":63893,"marks":63894,"value":63895,"nodeType":865},{},[],"It’s also telling that the cyber crime ecosystem itself seems to be leaning toward the theft, sale, and use of stolen credentials (not just emails and passwords, but session tokens too). ",{"data":63897,"content":63898,"nodeType":1818},{},[63899,63920,63942,63964],{"data":63900,"content":63901,"nodeType":1734},{},[63902],{"data":63903,"content":63904,"nodeType":881},{},[63905,63908,63916],{"data":63906,"marks":63907,"value":21,"nodeType":865},{},[],{"data":63909,"content":63910,"nodeType":876},{"uri":41391},[63911],{"data":63912,"marks":63913,"value":63915,"nodeType":865},{},[63914],{"type":874},"According to the 2024 DBIR",{"data":63917,"marks":63918,"value":63919,"nodeType":865},{},[],", more than 1000 credentials appear on criminal forums and marketplaces every day, with the majority (65%) appearing less than a day after first being discovered. ",{"data":63921,"content":63922,"nodeType":1734},{},[63923],{"data":63924,"content":63925,"nodeType":881},{},[63926,63930,63938],{"data":63927,"marks":63928,"value":63929,"nodeType":865},{},[],"In June, ",{"data":63931,"content":63932,"nodeType":876},{"uri":57809},[63933],{"data":63934,"marks":63935,"value":63937,"nodeType":865},{},[63936],{"type":874},"Troy Hunt at Have I Been Pwned (HIBP) wrote about the impact of channels like Telegram",{"data":63939,"marks":63940,"value":63941,"nodeType":865},{},[]," and the sale of combolists (username, password, login portal URL), after being sent 122GB of data scraped out of thousands of Telegram channels, containing 361M unique email addresses (of which 151M had never been seen in HIBP before). ",{"data":63943,"content":63944,"nodeType":1734},{},[63945],{"data":63946,"content":63947,"nodeType":881},{},[63948,63952,63961],{"data":63949,"marks":63950,"value":63951,"nodeType":865},{},[],"In July, ",{"data":63953,"content":63955,"nodeType":876},{"uri":63954},"https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/",[63956],{"data":63957,"marks":63958,"value":63960,"nodeType":865},{},[63959],{"type":874},"10 billion passwords were leaked in the RockYou2024 compilation",{"data":63962,"marks":63963,"value":1032,"nodeType":865},{},[],{"data":63965,"content":63966,"nodeType":1734},{},[63967],{"data":63968,"content":63969,"nodeType":881},{},[63970,63974,63982],{"data":63971,"marks":63972,"value":63973,"nodeType":865},{},[],"And ultimately, ",{"data":63975,"content":63976,"nodeType":876},{"uri":58521},[63977],{"data":63978,"marks":63979,"value":63981,"nodeType":865},{},[63980],{"type":874},"high-profile breaches",{"data":63983,"marks":63984,"value":63985,"nodeType":865},{},[]," of Snowflake customers, Microsoft, Okta, and others reinforce the threat behind the numbers, all of which are the result of identity attacks. ",{"data":63987,"content":63988,"nodeType":881},{},[63989],{"data":63990,"marks":63991,"value":63993,"nodeType":865},{},[63992],{"type":902},"So, if a business uses any third-party provided web applications or services, then its workforce identities are the lowest-hanging fruit for attackers to pick, and the risk of account takeover should be high up on the risk register. ",{"data":63995,"content":63996,"nodeType":881},{},[63997],{"data":63998,"marks":63999,"value":64000,"nodeType":865},{},[],"Yes, it’s tough to redo budgets on the fly or rip up a five year plan. But, asymmetrical cyber TTPs have always sought to undermine the best laid plans of CISOs – attackers usually look in the places that defenders aren't. ",{"data":64002,"content":64003,"nodeType":881},{},[64004],{"data":64005,"marks":64006,"value":64007,"nodeType":865},{},[],"When looking at the evidence, is securing the identity attack surface really a lower priority than adding a CASB, CSPM, or shiny new AI tool? Even when we look at historical recurring spend on things like EDR or vulnerability management, it’s arguable that the risk of identity attacks has overtaken software-based exploits for many organizations whose traditional networks are shrinking, while their cloud app estate grows. ",{"data":64009,"content":64010,"nodeType":881},{},[64011],{"data":64012,"marks":64013,"value":64015,"nodeType":865},{},[64014],{"type":902},"It’s important to consider what’s right for your business, but the evidence shows us that securing the identity attack surface promises real risk reduction in the face of a genuine threat. ",{"data":64017,"content":64018,"nodeType":894},{},[],{"data":64020,"content":64021,"nodeType":904},{},[64022],{"data":64023,"marks":64024,"value":64025,"nodeType":865},{},[],"Reason 2: “Our business apps are all behind SSO”",{"data":64027,"content":64028,"nodeType":881},{},[64029],{"data":64030,"marks":64031,"value":64032,"nodeType":865},{},[],"SSO is often seen as a utopia where each employee has a single, secure digital identity that is used to access all of their work applications. When businesses are using SSO, we usually hear:",{"data":64034,"content":64035,"nodeType":1860},{},[64036],{"data":64037,"marks":64038,"value":64039,"nodeType":865},{},[],"“Everything is behind SSO, there are no apps outside of it.”",{"data":64041,"content":64042,"nodeType":881},{},[64043,64047,64056,64060,64065],{"data":64044,"marks":64045,"value":64046,"nodeType":865},{},[],"Unfortunately, organizations are always using more apps than they realize. The impact of ",{"data":64048,"content":64050,"nodeType":876},{"uri":64049},"https://productled.com/blog/product-led-growth-definition",[64051],{"data":64052,"marks":64053,"value":64055,"nodeType":865},{},[64054],{"type":874},"product-led growth",{"data":64057,"marks":64058,"value":64059,"nodeType":865},{},[]," on the self adoption of cloud services is well documented, and we see that ",{"data":64061,"marks":64062,"value":64064,"nodeType":865},{},[64063],{"type":902},"even SMEs typically have 100+ apps in their estate",{"data":64066,"marks":64067,"value":64068,"nodeType":865},{},[],", and the number of apps per business continues to grow year on year. ",{"data":64070,"content":64071,"nodeType":881},{},[64072,64076,64081,64085,64089,64093,64098],{"data":64073,"marks":64074,"value":64075,"nodeType":865},{},[],"So, while every ",{"data":64077,"marks":64078,"value":64080,"nodeType":865},{},[64079],{"type":902},"known ",{"data":64082,"marks":64083,"value":64084,"nodeType":865},{},[],"app",{"data":64086,"marks":64087,"value":2091,"nodeType":865},{},[64088],{"type":902},{"data":64090,"marks":64091,"value":64092,"nodeType":865},{},[],"might be behind SSO, this still leaves tens or hundreds of ",{"data":64094,"marks":64095,"value":64097,"nodeType":865},{},[64096],{"type":902},"unknown",{"data":64099,"marks":64100,"value":64101,"nodeType":865},{},[]," apps, with thousands of associated identities. ",{"data":64103,"content":64104,"nodeType":881},{},[64105,64109,64114,64118,64127],{"data":64106,"marks":64107,"value":64108,"nodeType":865},{},[],"But even if you did know about every app, the fact of the matter is ",{"data":64110,"marks":64111,"value":64113,"nodeType":865},{},[64112],{"type":902},"that fewer than 1 in 3 apps actually support SAML SSO",{"data":64115,"marks":64116,"value":64117,"nodeType":865},{},[],", and many of those ",{"data":64119,"content":64121,"nodeType":876},{"uri":64120},"https://sso.tax/",[64122],{"data":64123,"marks":64124,"value":64126,"nodeType":865},{},[64125],{"type":874},"only at the premium tier",{"data":64128,"marks":64129,"value":64130,"nodeType":865},{},[],". Our data shows that the proportion of apps actually behind SSO is even lower, at 1 in 5. So getting everything behind SSO just isn’t a realistic goal for any organization. ",{"data":64132,"content":64133,"nodeType":1860},{},[64134],{"data":64135,"marks":64136,"value":64137,"nodeType":865},{},[],"“Everything important is behind SSO, and the apps that aren’t don’t pose a risk.” ",{"data":64139,"content":64140,"nodeType":881},{},[64141],{"data":64142,"marks":64143,"value":64144,"nodeType":865},{},[],"There’s often a view that if it wasn’t centrally procured, IT wasn’t involved, and it’s not behind SSO, then it’s just not a concern. But apps can have complex integrations and permissions that increase the potential blast radius of an app compromise. ",{"data":64146,"content":64147,"nodeType":881},{},[64148,64152,64160,64164,64171],{"data":64149,"marks":64150,"value":64151,"nodeType":865},{},[],"We’ve published ",{"data":64153,"content":64154,"nodeType":876},{"uri":5192},[64155],{"data":64156,"marks":64157,"value":64159,"nodeType":865},{},[64158],{"type":874},"extensive research on SaaS-native attack techniques",{"data":64161,"marks":64162,"value":64163,"nodeType":865},{},[]," and documented many of the scenarios in which attackers can expand from hijacking a single SaaS app with a small number of users into a larger-scale compromise, for example through ",{"data":64165,"content":64166,"nodeType":876},{"uri":42658},[64167],{"data":64168,"marks":64169,"value":42664,"nodeType":865},{},[64170],{"type":874},{"data":64172,"marks":64173,"value":64174,"nodeType":865},{},[],": Modifying SAML for a compromised app to redirect users to a malicious domain during the authentication process that proxies a legitimate authentication service (e.g. Google, Okta or Microsoft) – effectively acting as a watering hole for further credential harvesting. ",{"data":64176,"content":64177,"nodeType":881},{},[64178],{"data":64179,"marks":64180,"value":64181,"nodeType":865},{},[],"Also, the value of an app is not necessarily tied to the number of users it has in the business. A sales and marketing app can contain huge amounts of sensitive data, as can developer apps – just look at Snowflake! It only takes a single account to be created, a single integration to be set up, to result in a major data breach down the line. ",{"data":64183,"content":64184,"nodeType":881},{},[64185,64189,64198,64201,64210],{"data":64186,"marks":64187,"value":64188,"nodeType":865},{},[],"You can check out our ",{"data":64190,"content":64192,"nodeType":876},{"uri":64191},"https://pushsecurity.com/blog/",[64193],{"data":64194,"marks":64195,"value":64197,"nodeType":865},{},[64196],{"type":874},"blog page",{"data":64199,"marks":64200,"value":8048,"nodeType":865},{},[],{"data":64202,"content":64204,"nodeType":876},{"uri":64203},"https://www.youtube.com/watch?v=xZIQd_0v9sE&t=12s",[64205],{"data":64206,"marks":64207,"value":64209,"nodeType":865},{},[64208],{"type":874},"watch one of our videos",{"data":64211,"marks":64212,"value":64213,"nodeType":865},{},[]," for more information.   ",{"data":64215,"content":64216,"nodeType":1860},{},[64217],{"data":64218,"marks":64219,"value":64220,"nodeType":865},{},[],"Ghost logins: A nightmare for SSO, dreamy for attackers",{"data":64222,"content":64223,"nodeType":881},{},[64224,64228,64233,64237,64245],{"data":64225,"marks":64226,"value":64227,"nodeType":865},{},[],"You might already be feeling a bit deflated that SSO isn’t going to give you everything you wanted, and we’re sorry to be the bearer of bad news. Unfortunately, ",{"data":64229,"marks":64230,"value":64232,"nodeType":865},{},[64231],{"type":902},"even if you are using SSO, additional login methods can still exist alongside SSO",{"data":64234,"marks":64235,"value":64236,"nodeType":865},{},[],". We call these ",{"data":64238,"content":64239,"nodeType":876},{"uri":11116},[64240],{"data":64241,"marks":64242,"value":11122,"nodeType":865},{},[64243,64244],{"type":874},{"type":902},{"data":64246,"marks":64247,"value":1032,"nodeType":865},{},[64248],{"type":902},{"data":64250,"content":64251,"nodeType":881},{},[64252],{"data":64253,"marks":64254,"value":64255,"nodeType":865},{},[],"Ghost logins are effectively any alternative login method. In addition to SSO, you could have a local password, a social login (e.g., login with Google, Facebook, etc.), backup emails, or API-based login methods. ",{"data":64257,"content":64258,"nodeType":881},{},[64259],{"data":64260,"marks":64261,"value":64262,"nodeType":865},{},[],"Multiple methods are often enabled by default and need to be explicitly disabled at the app level. Further, migrating an existing app to SSO doesn’t automatically remove local accounts, but effectively adds an SSO layer on top. ",{"data":64264,"content":64265,"nodeType":881},{},[64266,64270,64275,64279,64287],{"data":64267,"marks":64268,"value":64269,"nodeType":865},{},[],"The final problem here is that because MFA is applied separately at the app level and SSO level, ",{"data":64271,"marks":64272,"value":64274,"nodeType":865},{},[64273],{"type":902},"you can have local logins without MFA, at the same time as SSO logins with MFA — that can be used concurrently.",{"data":64276,"marks":64277,"value":64278,"nodeType":865},{},[]," This was acutely felt during the recent Snowflake breaches, ",{"data":64280,"content":64281,"nodeType":876},{"uri":53345},[64282],{"data":64283,"marks":64284,"value":64286,"nodeType":865},{},[64285],{"type":874},"where in-app identification and disabling of non-SSO logins proved to be particularly error-prone",{"data":64288,"marks":64289,"value":30204,"nodeType":865},{},[],{"data":64291,"content":64292,"nodeType":881},{},[64293,64297],{"data":64294,"marks":64295,"value":64296,"nodeType":865},{},[],"The result here is that credential stuffing attacks can still prove successful against your SSO-joined apps if local logins exist, and MFA hasn’t been specifically set at the app level. ",{"data":64298,"marks":64299,"value":64301,"nodeType":865},{},[64300],{"type":902},"And unless you’ve specifically disabled them and unset every non-SSO login for every app, they probably do. ",{"data":64303,"content":64304,"nodeType":1860},{},[64305],{"data":64306,"marks":64307,"value":64308,"nodeType":865},{},[],"The verdict: SSO is great, but it's no silver bullet",{"data":64310,"content":64311,"nodeType":881},{},[64312,64316,64324],{"data":64313,"marks":64314,"value":64315,"nodeType":865},{},[],"While SSO is invariably a beneficial security control, ",{"data":64317,"content":64319,"nodeType":876},{"uri":64318},"https://pushsecurity.com/blog/ghost-logins-when-forgotten-identities-come-back-to-haunt-you/#id-how-can-ghost-logins-be-abused-by-attackers_id-ghost-logins-for-persistence-and-defense-evasion",[64320],{"data":64321,"marks":64322,"value":64323,"nodeType":865},{},[],"attackers can also naturally exploit it to gain access to a large number of downstream applications",{"data":64325,"marks":64326,"value":64327,"nodeType":865},{},[],". If you compromise an IdP account like Okta, you can then access any connected app, often without requiring any further authentication.",{"data":64329,"content":64330,"nodeType":881},{},[64331,64335,64343,64347,64356],{"data":64332,"marks":64333,"value":64334,"nodeType":865},{},[],"We’ve seen this recently, with an ",{"data":64336,"content":64337,"nodeType":876},{"uri":47938},[64338],{"data":64339,"marks":64340,"value":64342,"nodeType":865},{},[64341],{"type":874},"unprecedented spike in credential stuffing attacks reported by Okta",{"data":64344,"marks":64345,"value":64346,"nodeType":865},{},[],", as well as ",{"data":64348,"content":64350,"nodeType":876},{"uri":64349},"https://www.bleepingcomputer.com/news/security/okta-warns-of-credential-stuffing-attacks-targeting-its-cors-feature/",[64351],{"data":64352,"marks":64353,"value":64355,"nodeType":865},{},[64354],{"type":874},"attacks looking to exploit Okta’s CORS feature",{"data":64357,"marks":64358,"value":1032,"nodeType":865},{},[],{"data":64360,"content":64361,"nodeType":881},{},[64362,64367],{"data":64363,"marks":64364,"value":64366,"nodeType":865},{},[64365],{"type":902},"Ultimately, the promised land of a 1:1 employee to identity ratio just isn’t realistic. ",{"data":64368,"marks":64369,"value":64370,"nodeType":865},{},[],"So while SSO is a big part of the solution to identity attacks, it’s not a silver bullet.   ",{"data":64372,"content":64373,"nodeType":894},{},[],{"data":64375,"content":64376,"nodeType":904},{},[64377],{"data":64378,"marks":64379,"value":64380,"nodeType":865},{},[],"Reason 3: “We’ve got MFA deployed everywhere”",{"data":64382,"content":64383,"nodeType":881},{},[64384,64388,64397],{"data":64385,"marks":64386,"value":64387,"nodeType":865},{},[],"Microsoft famously stated that ",{"data":64389,"content":64391,"nodeType":876},{"uri":64390},"https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023#:~:text=Outlier%20attacks%20make%20up%20just,of%20compromise%20by%2099.2%20percent.",[64392],{"data":64393,"marks":64394,"value":64396,"nodeType":865},{},[64395],{"type":874},"MFA reduces the risk of compromise by 99.2%",{"data":64398,"marks":64399,"value":64400,"nodeType":865},{},[],". But this doesn’t mean that it stops 99% of attacks. Or, that it should make up 99% of your defense. ",{"data":64402,"content":64403,"nodeType":881},{},[64404,64408],{"data":64405,"marks":64406,"value":64407,"nodeType":865},{},[],"MFA unarguably raises the bar for attackers, even if that bar is still pretty low. Naturally, accounts without MFA are an easier target. ",{"data":64409,"marks":64410,"value":64412,"nodeType":865},{},[64411],{"type":902},"But the problem is that MFA isn’t an enterprise-wide castle wall. It’s more like a row of hurdles with gaps in-between. ",{"data":64414,"content":64415,"nodeType":881},{},[64416,64420,64428],{"data":64417,"marks":64418,"value":64419,"nodeType":865},{},[],"MFA is usually handled separately at the SSO level and app level. For apps that are self-adopted by end users, they can't be relied on to add in a security control that will introduce friction to their user experience. Building on the aforementioned ghost logins, even if MFA is adopted at the SSO level, local logins can exist without MFA unless also applied at the app level. ",{"data":64421,"content":64422,"nodeType":876},{"uri":53345},[64423],{"data":64424,"marks":64425,"value":64427,"nodeType":865},{},[64426],{"type":874},"The recent Snowflake breach is a perfect example of this problem",{"data":64429,"marks":64430,"value":1032,"nodeType":865},{},[],{"data":64432,"content":64433,"nodeType":881},{},[64434,64438,64443],{"data":64435,"marks":64436,"value":64437,"nodeType":865},{},[],"Because of this, ",{"data":64439,"marks":64440,"value":64442,"nodeType":865},{},[64441],{"type":902},"we find that only around 1 in 3 identities actually have MFA enabled",{"data":64444,"marks":64445,"value":1032,"nodeType":865},{},[],{"data":64447,"content":64448,"nodeType":1860},{},[64449],{"data":64450,"marks":64451,"value":64452,"nodeType":865},{},[],"\"MFA protects us against phishing attacks\"",{"data":64454,"content":64455,"nodeType":881},{},[64456,64460,64467],{"data":64457,"marks":64458,"value":64459,"nodeType":865},{},[],"Even where MFA is deployed, most MFA methods are proven to be phishable or otherwise bypassable. SMS and push-based MFA are susceptible to well known bypasses including SIM swapping and ",{"data":64461,"content":64462,"nodeType":876},{"uri":11059},[64463],{"data":64464,"marks":64465,"value":11064,"nodeType":865},{},[64466],{"type":874},{"data":64468,"marks":64469,"value":64470,"nodeType":865},{},[]," attacks. TOTP is a little better, but still vulnerable. ",{"data":64472,"content":64473,"nodeType":881},{},[64474,64478,64486,64490,64498],{"data":64475,"marks":64476,"value":64477,"nodeType":865},{},[],"Many attacks are simply cutting out the middleman and focusing on ",{"data":64479,"content":64480,"nodeType":876},{"uri":42831},[64481],{"data":64482,"marks":64483,"value":64485,"nodeType":865},{},[64484],{"type":874},"using stolen session tokens",{"data":64487,"marks":64488,"value":64489,"nodeType":865},{},[]," to bypass MFA. The most common method for this is via infostealers, which typically scrape all credentials (e.g. usernames, passwords, login pages, session tokens) as well as other information stored in the browser of an infected device. ",{"data":64491,"content":64492,"nodeType":876},{"uri":58035},[64493],{"data":64494,"marks":64495,"value":64497,"nodeType":865},{},[64496],{"type":874},"Infostealers played a major role in the recent Snowflake breach",{"data":64499,"marks":64500,"value":1032,"nodeType":865},{},[],{"data":64502,"content":64503,"nodeType":881},{},[64504,64508,64516],{"data":64505,"marks":64506,"value":64507,"nodeType":865},{},[],"Additionally, ",{"data":64509,"content":64510,"nodeType":876},{"uri":28776},[64511],{"data":64512,"marks":64513,"value":64515,"nodeType":865},{},[64514],{"type":874},"modern phishing techniques like adversary-in-the-middle (AitM) and browser-in-the-middle (BitM)",{"data":64517,"marks":64518,"value":64519,"nodeType":865},{},[]," see the attacker steal the live session and associated tokens from the victim, with the victim prompted to complete the MFA process as part of the attack. ",{"data":64521,"content":64522,"nodeType":1860},{},[64523],{"data":64524,"marks":64525,"value":64526,"nodeType":865},{},[],"“We’re using passkeys”",{"data":64528,"content":64529,"nodeType":881},{},[64530],{"data":64531,"marks":64532,"value":64533,"nodeType":865},{},[],"Great! Passkey users are in a better position than 99% of other businesses. Passkeys are widely accepted to be phishing resistant – at least for now, although as more businesses use them, new ways of getting around them will no doubt be discovered by attackers. ",{"data":64535,"content":64536,"nodeType":881},{},[64537,64541,64549],{"data":64538,"marks":64539,"value":64540,"nodeType":865},{},[],"But, MFA downgrade attacks are possible. There are often backup MFA methods set that can be selected by canceling the authentication prompt and selecting a different method. Even when these aren’t selectable, ",{"data":64542,"content":64543,"nodeType":876},{"uri":28715},[64544],{"data":64545,"marks":64546,"value":64548,"nodeType":865},{},[64547],{"type":874},"researchers have demonstrated ways of downgrading authentication to use a phishable method",{"data":64550,"marks":64551,"value":1032,"nodeType":865},{},[],{"data":64553,"content":64554,"nodeType":881},{},[64555],{"data":64556,"marks":64557,"value":64558,"nodeType":865},{},[],"Most apps are designed primarily for user flexibility, not security. And backup methods have a legitimate use-case – what if the authenticator device is lost or stops working? If passkeys are the only authentication method, you just got locked out of all of your accounts. But at least no hackers can access them either, right?",{"data":64560,"content":64561,"nodeType":881},{},[64562],{"data":64563,"marks":64564,"value":64566,"nodeType":865},{},[64565],{"type":902},"Like SSO, unless backup MFA methods are disabled for all identities and apps, and all users have enabled MFA across all their accounts and login methods, this isn’t a silver bullet either.  ",{"data":64568,"content":64569,"nodeType":894},{},[],{"data":64571,"content":64572,"nodeType":904},{},[64573],{"data":64574,"marks":64575,"value":64576,"nodeType":865},{},[],"Reason 4: “We’ve got anti-phishing controls already”",{"data":64578,"content":64579,"nodeType":881},{},[64580],{"data":64581,"marks":64582,"value":64583,"nodeType":865},{},[],"Identity attacks have evolved significantly in recent years, as have the environments being targeted by attackers with the shift to cloud services and decentralized business IT. Unfortunately, traditional anti-phishing controls weren’t designed for this reality. ",{"data":64585,"content":64586,"nodeType":1818},{},[64587,64607],{"data":64588,"content":64589,"nodeType":1734},{},[64590],{"data":64591,"content":64592,"nodeType":881},{},[64593,64598,64603],{"data":64594,"marks":64595,"value":64597,"nodeType":865},{},[64596],{"type":902},"A",{"data":64599,"marks":64600,"value":64602,"nodeType":865},{},[64601],{"type":902},"ttacks used to be focused on a single VPN/webmail endpoint ",{"data":64604,"marks":64605,"value":64606,"nodeType":865},{},[],"that was naturally easier to protect than 100+ SaaS apps (especially if the security team isn’t even aware of them). Attackers now have 1000s of sprawled identities to target per enterprise, increasing the chance that weak or reused passwords will be found. ",{"data":64608,"content":64609,"nodeType":1734},{},[64610],{"data":64611,"content":64612,"nodeType":881},{},[64613,64618],{"data":64614,"marks":64615,"value":64617,"nodeType":865},{},[64616],{"type":902},"Likewise, security teams only needed to care about a small set of credentials ",{"data":64619,"marks":64620,"value":64621,"nodeType":865},{},[],"relating to user directory accounts and VPN/remote access tooling used to tunnel into the corporate network. Now, business functions and data are dispersed across cloud apps rather than being neatly contained in on-prem apps and databases.",{"data":64623,"content":64624,"nodeType":881},{},[64625],{"data":64626,"marks":64627,"value":64629,"nodeType":865},{},[64628],{"type":902},"Now, attackers have more platforms on which to phish your users, more credentials to choose from, and more apps to spray them across, while security teams have a much larger surface to defend.",{"data":64631,"content":64632,"nodeType":1860},{},[64633],{"data":64634,"marks":64635,"value":64636,"nodeType":865},{},[],"“Our email and content filtering controls stop phishing attacks”",{"data":64638,"content":64639,"nodeType":881},{},[64640],{"data":64641,"marks":64642,"value":64643,"nodeType":865},{},[],"Existing phishing prevention solutions have tried to solve the problem by protecting the inbox, a common (but not the only) attack vector, or by blocking lists of known-bad domains. ",{"data":64645,"content":64646,"nodeType":881},{},[64647],{"data":64648,"marks":64649,"value":64650,"nodeType":865},{},[],"But, these approaches have major shortcomings:",{"data":64652,"content":64653,"nodeType":1818},{},[64654,64692,64707],{"data":64655,"content":64656,"nodeType":1734},{},[64657],{"data":64658,"content":64659,"nodeType":881},{},[64660,64665,64669,64677,64680,64688],{"data":64661,"marks":64662,"value":64664,"nodeType":865},{},[64663],{"type":902},"Incomplete coverage: ",{"data":64666,"marks":64667,"value":64668,"nodeType":865},{},[],"Email-based phishing prevention tools can catch general spray-and-pray email phishing campaigns, but it only takes a small amount of tailoring to fly under their radar. The use of LLM tools to tailor phishing emails for their intended victims already makes this possible at scale. Email-based tools also fail to cover phishing attacks beyond the inbox, such as ",{"data":64670,"content":64671,"nodeType":876},{"uri":49237},[64672],{"data":64673,"marks":64674,"value":64676,"nodeType":865},{},[64675],{"type":874},"Slack",{"data":64678,"marks":64679,"value":1651,"nodeType":865},{},[],{"data":64681,"content":64682,"nodeType":876},{"uri":49249},[64683],{"data":64684,"marks":64685,"value":64687,"nodeType":865},{},[64686],{"type":874},"Teams",{"data":64689,"marks":64690,"value":64691,"nodeType":865},{},[]," phishing.",{"data":64693,"content":64694,"nodeType":1734},{},[64695],{"data":64696,"content":64697,"nodeType":881},{},[64698,64703],{"data":64699,"marks":64700,"value":64702,"nodeType":865},{},[64701],{"type":902},"Expired intel: ",{"data":64704,"marks":64705,"value":64706,"nodeType":865},{},[],"Tools that rely on known-bad domains always have an incomplete picture because a domain must be reported as malicious in order to get added to a blocklist. Meanwhile, attackers can spin up new sites or host phishing pages on existing sites by exploiting vulnerabilities in them, bypassing rules around preventing visits to newly registered domains. It’s like trying to hit a moving target.",{"data":64708,"content":64709,"nodeType":1734},{},[64710],{"data":64711,"content":64712,"nodeType":881},{},[64713,64718,64722,64731],{"data":64714,"marks":64715,"value":64717,"nodeType":865},{},[64716],{"type":902},"Web-based obfuscation: ",{"data":64719,"marks":64720,"value":64721,"nodeType":865},{},[],"Attacker tools and malicious implants running on webpages are constantly evolving to evade fingerprinting, and attackers are using techniques like ",{"data":64723,"content":64725,"nodeType":876},{"uri":64724},"https://www.cyfirma.com/research/html-smuggling-a-stealthier-approach-to-deliver-malware/",[64726],{"data":64727,"marks":64728,"value":64730,"nodeType":865},{},[64729],{"type":874},"HTML smuggling",{"data":64732,"marks":64733,"value":64734,"nodeType":865},{},[]," to get around web-based controls put in place by developers. ",{"data":64736,"content":64737,"nodeType":881},{},[64738,64742,64747,64751,64756],{"data":64739,"marks":64740,"value":64741,"nodeType":865},{},[],"Even if these controls are sometimes successful, attackers have reliably demonstrated ways to get around them, ",{"data":64743,"marks":64744,"value":64746,"nodeType":865},{},[64745],{"type":902},"it really is a cat-and-mouse game at this point",{"data":64748,"marks":64749,"value":64750,"nodeType":865},{},[],". There usually needs to be a compromise before the attacker's infrastructure or tooling can be tagged and blocked, but ",{"data":64752,"marks":64753,"value":64755,"nodeType":865},{},[64754],{"type":902},"they evolve so rapidly that defenders are always one step behind",{"data":64757,"marks":64758,"value":1032,"nodeType":865},{},[],{"data":64760,"content":64761,"nodeType":1860},{},[64762],{"data":64763,"marks":64764,"value":64765,"nodeType":865},{},[],"“All our employees use a password manager”",{"data":64767,"content":64768,"nodeType":881},{},[64769],{"data":64770,"marks":64771,"value":64772,"nodeType":865},{},[],"Password managers are increasingly necessary due to the large number of credentials that users now have to juggle. Since the majority of apps don’t support SAML SSO, the need for separate credentials per app isn’t going away any time soon. ",{"data":64774,"content":64775,"nodeType":881},{},[64776,64780],{"data":64777,"marks":64778,"value":64779,"nodeType":865},{},[],"We often find 2 or more password managers in use per organization (not exactly optimal), but despite increased password manager adoption we see consistently high levels of password reuse, ",{"data":64781,"marks":64782,"value":64784,"nodeType":865},{},[64783],{"type":902},"with 1 in 3 users reusing passwords – including their sensitive IdP credentials. ",{"data":64786,"content":64787,"nodeType":881},{},[64788,64792,64800],{"data":64789,"marks":64790,"value":64791,"nodeType":865},{},[],"High levels of password reuse shows us that password managers don’t automatically result in secure employee behaviors, while widespread credential reuse significantly increases exposure to ",{"data":64793,"content":64794,"nodeType":876},{"uri":57065},[64795],{"data":64796,"marks":64797,"value":64799,"nodeType":865},{},[64798],{"type":874},"credential stuffing attacks",{"data":64801,"marks":64802,"value":64803,"nodeType":865},{},[]," where attackers spray known username and password combinations across a range of app login pages.  ",{"data":64805,"content":64806,"nodeType":881},{},[64807,64812],{"data":64808,"marks":64809,"value":64811,"nodeType":865},{},[64810],{"type":902},"Generally, businesses have very limited visibility into employee password data",{"data":64813,"marks":64814,"value":64815,"nodeType":865},{},[]," to be able to enforce good practice or accurately respond to data breaches involving credential dumps, even if employees are using a password manager (or several, as the case may be).  ",{"data":64817,"content":64818,"nodeType":894},{},[],{"data":64820,"content":64821,"nodeType":904},{},[64822],{"data":64823,"marks":64824,"value":64825,"nodeType":865},{},[],"Reason 5: “We’ve got all the security data we need”",{"data":64827,"content":64828,"nodeType":881},{},[64829],{"data":64830,"marks":64831,"value":64832,"nodeType":865},{},[],"Organizations looking to protect themselves from modern identity attacks suffer from a pretty substantial telemetry gap. ",{"data":64834,"content":64835,"nodeType":1818},{},[64836,64851,64866,64881],{"data":64837,"content":64838,"nodeType":1734},{},[64839],{"data":64840,"content":64841,"nodeType":881},{},[64842,64847],{"data":64843,"marks":64844,"value":64846,"nodeType":865},{},[64845],{"type":902},"Endpoint logs ",{"data":64848,"marks":64849,"value":64850,"nodeType":865},{},[],"won’t show anything meaningful because most identity attacks don’t need to target the endpoint – no malware is deployed, everything happens in the browser, over the internet. ",{"data":64852,"content":64853,"nodeType":1734},{},[64854],{"data":64855,"content":64856,"nodeType":881},{},[64857,64862],{"data":64858,"marks":64859,"value":64861,"nodeType":865},{},[64860],{"type":902},"Application logs",{"data":64863,"marks":64864,"value":64865,"nodeType":865},{},[]," are limited in availability, scope, and ease of ingestion, with most app vendors providing substandard logging, and requiring complex custom integrations to get what little data is available. ",{"data":64867,"content":64868,"nodeType":1734},{},[64869],{"data":64870,"content":64871,"nodeType":881},{},[64872,64877],{"data":64873,"marks":64874,"value":64876,"nodeType":865},{},[64875],{"type":902},"Network logs",{"data":64878,"marks":64879,"value":64880,"nodeType":865},{},[]," (such as via web proxy) struggle to gather and piece together identity data points at-scale, across different apps, due to the sheer volume and broken format of the data post-TLS-termination. ",{"data":64882,"content":64883,"nodeType":1734},{},[64884],{"data":64885,"content":64886,"nodeType":881},{},[64887,64892],{"data":64888,"marks":64889,"value":64891,"nodeType":865},{},[64890],{"type":902},"Identity provider logs",{"data":64893,"marks":64894,"value":64895,"nodeType":865},{},[]," naturally only cover SSO integrated apps (and therefore don’t cover ⅔ of your business apps) and look exclusively at authentication, and so are blind to client side attacks like phishing. ",{"data":64897,"content":64898,"nodeType":881},{},[64899,64903,64911],{"data":64900,"marks":64901,"value":64902,"nodeType":865},{},[],"Unless you’re ingesting data from a browser-based solution like Push, it’s unlikely you have a full monitoring visibility of your identity attack surface. ",{"data":64904,"content":64905,"nodeType":876},{"uri":31096},[64906],{"data":64907,"marks":64908,"value":64910,"nodeType":865},{},[64909],{"type":874},"Read more on the value of browser telemetry here. ",{"data":64912,"marks":64913,"value":21,"nodeType":865},{},[],{"data":64915,"content":64919,"nodeType":890},{"target":64916},{"sys":64917},{"id":64918,"type":887,"linkType":888},"5jPCGPO1tnIkoI7MKW4oUi",[],{"data":64921,"content":64922,"nodeType":894},{},[],{"data":64924,"content":64925,"nodeType":904},{},[64926],{"data":64927,"marks":64928,"value":64929,"nodeType":865},{},[],"Maybe there’s a reason for Push to exist after all!",{"data":64931,"content":64932,"nodeType":881},{},[64933,64938,64942,64947,64950,64955],{"data":64934,"marks":64935,"value":64937,"nodeType":865},{},[64936],{"type":902},"The key takeaway here is that there are no quick fixes or silver bullets. ",{"data":64939,"marks":64940,"value":64941,"nodeType":865},{},[],"Things like SSO, MFA, and password managers are all part of the solution, ",{"data":64943,"marks":64944,"value":64946,"nodeType":865},{},[64945],{"type":902},"but",{"data":64948,"marks":64949,"value":2091,"nodeType":865},{},[],{"data":64951,"marks":64952,"value":64954,"nodeType":865},{},[64953],{"type":902},"aren’t set-and-forget controls",{"data":64956,"marks":64957,"value":64958,"nodeType":865},{},[],". They need to be continually monitored and maintained to ensure they remain effective.",{"data":64960,"content":64961,"nodeType":881},{},[64962],{"data":64963,"marks":64964,"value":64965,"nodeType":865},{},[],"Push stops identity attacks by continually finding and fixing identity vulnerabilities, providing deep context to manage the identity attack surface without looking through blinkers at the IdP or individual apps. ",{"data":64967,"content":64968,"nodeType":881},{},[64969],{"data":64970,"marks":64971,"value":64972,"nodeType":865},{},[],"Push helps businesses to get the most out of their identity controls (and bridge the gaps they leave) by:",{"data":64974,"content":64975,"nodeType":1818},{},[64976,64991,65006,65021,65036],{"data":64977,"content":64978,"nodeType":1734},{},[64979],{"data":64980,"content":64981,"nodeType":881},{},[64982,64987],{"data":64983,"marks":64984,"value":64986,"nodeType":865},{},[64985],{"type":902},"Locating all business apps",{"data":64988,"marks":64989,"value":64990,"nodeType":865},{},[],", not just those plugged into your IdP, so they can be put behind SSO (where possible) or at least securely managed and configured.",{"data":64992,"content":64993,"nodeType":1734},{},[64994],{"data":64995,"content":64996,"nodeType":881},{},[64997,65002],{"data":64998,"marks":64999,"value":65001,"nodeType":865},{},[65000],{"type":902},"Identifying all workforce identities, associated login types, and MFA methods",{"data":65003,"marks":65004,"value":65005,"nodeType":865},{},[]," to more clearly pinpoint gaps, harden identities, and remediate vulnerabilities like ghost logins.",{"data":65007,"content":65008,"nodeType":1734},{},[65009],{"data":65010,"content":65011,"nodeType":881},{},[65012,65017],{"data":65013,"marks":65014,"value":65016,"nodeType":865},{},[65015],{"type":902},"Stopping account takeover attempts",{"data":65018,"marks":65019,"value":65020,"nodeType":865},{},[]," by detecting and blocking AitM and BitM phishing toolkits running on webpages, blocking sensitive credential reuse to prevent credential phishing, and identifying stolen sessions running in attacker browsers. ",{"data":65022,"content":65023,"nodeType":1734},{},[65024],{"data":65025,"content":65026,"nodeType":881},{},[65027,65032],{"data":65028,"marks":65029,"value":65031,"nodeType":865},{},[65030],{"type":902},"Preventing password-based attacks",{"data":65033,"marks":65034,"value":65035,"nodeType":865},{},[]," by detecting the use of weak, reused, and breached passwords across the app estate.  ",{"data":65037,"content":65038,"nodeType":1734},{},[65039],{"data":65040,"content":65041,"nodeType":881},{},[65042,65047],{"data":65043,"marks":65044,"value":65046,"nodeType":865},{},[65045],{"type":902},"Providing unique telemetry in the browser",{"data":65048,"marks":65049,"value":65050,"nodeType":865},{},[]," to build both proactive and reactive security operations workflows, or add missing context to other data sources, such as IdP, application, or endpoint logs.",{"data":65052,"content":65055,"nodeType":890},{"target":65053},{"sys":65054},{"id":48230,"type":887,"linkType":888},[],{"data":65057,"content":65058,"nodeType":881},{},[65059],{"data":65060,"marks":65061,"value":21,"nodeType":865},{},[],{"entries":65063},{"hyperlink":65064,"inline":65065,"block":65066},[],[],[65067,65074,65082],{"sys":65068,"__typename":7008,"title":65069,"caption":65070,"layoutMode":59,"file":65071},{"id":63728},"Nobody has any identity problems, right?","Push Security’s cheekiest advisor, Geoff Belknap.",{"url":65072,"width":65073,"height":65073},"https://images.ctfassets.net/y1cdw1ablpvd/28qcLq225o8kusjQQQUnCC/98b10fe4f9e6916eb7657f60ab869062/Geoff_Ad__1_.png",1210,{"sys":65075,"__typename":7008,"title":65076,"caption":65077,"layoutMode":59,"file":65078},{"id":64918},"Telemetry comparison table","The browser presents a significant advantage over other sources of identity attack data.",{"url":65079,"width":65080,"height":65081},"https://images.ctfassets.net/y1cdw1ablpvd/4feAEpfP6tetyTjcLIopwG/5bec8c8c10e6e328ebe258bc59bc3cb6/Frame_627570__7_.png",2444,894,{"sys":65083,"__typename":1471,"type":50249,"ctaText":57280,"buttonLabel":57281,"buttonColour":1475,"buttonUrl":59},{"id":48230},{"items":65085},[],{},"Tackling common browser & identity security misconceptions","2024-07-11T00:00:00.000Z",{"items":65090},[65091,68052,68741],{"__typename":1485,"sys":65092,"content":65093,"title":68038,"synopsis":68039,"hashTags":59,"publishedDate":68040,"slug":68041,"tagsCollection":68042,"authorsCollection":68048},{"id":59719},{"json":65094},{"data":65095,"content":65096,"nodeType":1463},{},[65097,65104,65136,65143,65149,65156,65176,65199,65206,65213,65237,65253,65260,65272,65279,65282,65289,65296,65312,65324,65335,65365,65368,65375,65393,65400,65408,65503,65510,65648,65655,65773,65780,65787,65959,65966,65973,66056,66059,66066,66073,66080,66143,66150,66183,66190,66233,66239,66245,66478,66484,66492,66499,66502,66509,66516,66523,66576,66583,66626,66633,66666,66672,66678,66844,66850,66858,66865,66873,66880,66888,66895,66898,66905,66912,66919,66982,66989,67022,67029,67062,67068,67074,67180,67183,67190,67197,67204,67267,67274,67307,67314,67347,67353,67359,67533,67536,67543,67550,67557,67630,67637,67670,67677,67710,67716,67722,67952,67955,67962,67969,67976,67983,67986,67993,68000,68007,68010,68017,68024,68031],{"data":65098,"content":65099,"nodeType":904},{},[65100],{"data":65101,"marks":65102,"value":65103,"nodeType":865},{},[],"Browser-based Identity attacks on the rise?",{"data":65105,"content":65106,"nodeType":881},{},[65107,65111,65120,65124,65133],{"data":65108,"marks":65109,"value":65110,"nodeType":865},{},[],"Identity has been recorded as the #1 cyber attack vector since forever. You don’t have to look particularly hard to find statistics to support this. In 2023, one source reports that ",{"data":65112,"content":65114,"nodeType":876},{"uri":65113},"https://www.csoonline.com/article/648894/identity-based-security-threats-are-growing-rapidly-report.html",[65115],{"data":65116,"marks":65117,"value":65119,"nodeType":865},{},[65118],{"type":874},"4/5 breaches involved identity and compromised credentials",{"data":65121,"marks":65122,"value":65123,"nodeType":865},{},[],", while another suggests that ",{"data":65125,"content":65127,"nodeType":876},{"uri":65126},"https://rakgarg.substack.com/p/identity-crisis-the-biggest-prize",[65128],{"data":65129,"marks":65130,"value":65132,"nodeType":865},{},[65131],{"type":874},"75% of breaches are caused by mismanaged identity, access, or privileges",{"data":65134,"marks":65135,"value":959,"nodeType":865},{},[],{"data":65137,"content":65138,"nodeType":881},{},[65139],{"data":65140,"marks":65141,"value":65142,"nodeType":865},{},[],"Phishing, social engineering, credential stuffing, and business email compromise have morphed into a homogenous understanding of identity threats that are generally tackled through a combination of email security tooling, content access controls, and user awareness. ",{"data":65144,"content":65148,"nodeType":890},{"target":65145},{"sys":65146},{"id":65147,"type":887,"linkType":888},"5NRWvCl0xsoWcpgHbcQIkf",[],{"data":65150,"content":65151,"nodeType":881},{},[65152],{"data":65153,"marks":65154,"value":65155,"nodeType":865},{},[],"The fact that such attacks have been reported as the top security threat for so long probably means that people pay less attention to identity threats. Ransomware grabs the headlines, and rightly so in many cases, but phishing feels like a “known known” that we have a plan for (even if the plan often fails). ",{"data":65157,"content":65158,"nodeType":881},{},[65159,65163,65172],{"data":65160,"marks":65161,"value":65162,"nodeType":865},{},[],"In fact, there’s a problem with messaging generally. The ",{"data":65164,"content":65166,"nodeType":876},{"uri":65165},"https://www.verizon.com/business/resources/T78/reports/data-breach-investigation-report_2015.pdf",[65167],{"data":65168,"marks":65169,"value":65171,"nodeType":865},{},[65170],{"type":874},"2015 Verizon DBIR",{"data":65173,"marks":65174,"value":65175,"nodeType":865},{},[]," contains plenty of stats that still ring largely true today. For example:",{"data":65177,"content":65178,"nodeType":1818},{},[65179,65189],{"data":65180,"content":65181,"nodeType":1734},{},[65182],{"data":65183,"content":65184,"nodeType":881},{},[65185],{"data":65186,"marks":65187,"value":65188,"nodeType":865},{},[],"In the 2013 DBIR, phishing was associated with over 95% of incidents attributed to state sponsored actors, and for two years running, more than two-thirds of incidents have featured phishing",{"data":65190,"content":65191,"nodeType":1734},{},[65192],{"data":65193,"content":65194,"nodeType":881},{},[65195],{"data":65196,"marks":65197,"value":65198,"nodeType":865},{},[],"In 60% of cases, attackers are able to compromise an organization within minutes",{"data":65200,"content":65201,"nodeType":881},{},[65202],{"data":65203,"marks":65204,"value":65205,"nodeType":865},{},[],"Remove the dates and a lot of the report still stands up. ",{"data":65207,"content":65208,"nodeType":1860},{},[65209],{"data":65210,"marks":65211,"value":65212,"nodeType":865},{},[],"Bad then, worse now",{"data":65214,"content":65215,"nodeType":881},{},[65216,65220,65225,65229,65234],{"data":65217,"marks":65218,"value":65219,"nodeType":865},{},[],"But browser-based identity attacks ",{"data":65221,"marks":65222,"value":65224,"nodeType":865},{},[65223],{"type":902},"are",{"data":65226,"marks":65227,"value":65228,"nodeType":865},{},[]," worse than they used to be. Yes, credential stuffing, phishing, and SIM swapping may not be the most sophisticated attacks, but they remain as effective as ever. ",{"data":65230,"marks":65231,"value":65233,"nodeType":865},{},[65232],{"type":5120},"As the saying goes, if it ain’t broke — don’t fix it.",{"data":65235,"marks":65236,"value":2862,"nodeType":865},{},[],{"data":65238,"content":65239,"nodeType":881},{},[65240,65244,65249],{"data":65241,"marks":65242,"value":65243,"nodeType":865},{},[],"Recent attacks have moved toward a broader targeting of the ",{"data":65245,"marks":65246,"value":65248,"nodeType":865},{},[65247],{"type":902},"identity infrastructure",{"data":65250,"marks":65251,"value":65252,"nodeType":865},{},[],". While phishing and social engineering was once primarily a delivery mechanism for malicious payloads to be executed on endpoint, it is now used to harvest credentials and secrets for identity-based attacks against cloud apps and services. ",{"data":65254,"content":65255,"nodeType":881},{},[65256],{"data":65257,"marks":65258,"value":65259,"nodeType":865},{},[],"And because businesses have migrated to more cloud-based services and infrastructure, the compromise of an identity now has different consequences.",{"data":65261,"content":65262,"nodeType":881},{},[65263,65267],{"data":65264,"marks":65265,"value":65266,"nodeType":865},{},[],"The data and functionality that attackers seek has moved off endpoints and internal networks and onto cloud systems and SaaS applications, which organizations are using in large numbers (tens to hundreds). The modern way of working means that applications are more often than not directly exposed to the internet — and the only thing needed to access these apps are identities. ",{"data":65268,"marks":65269,"value":65271,"nodeType":865},{},[65270],{"type":902},"Naturally, it's much harder to stop credential stuffing attacks against 100 SaaS apps than the single centralized external VPN/webmail endpoint of yesteryear. ",{"data":65273,"content":65274,"nodeType":881},{},[65275],{"data":65276,"marks":65277,"value":65278,"nodeType":865},{},[],"It’s clear that stats alone don’t adequately capture the identity threat. So we have to look beyond the numbers to find out why. ",{"data":65280,"content":65281,"nodeType":894},{},[],{"data":65283,"content":65284,"nodeType":904},{},[65285],{"data":65286,"marks":65287,"value":65288,"nodeType":865},{},[],"Using this resource",{"data":65290,"content":65291,"nodeType":881},{},[65292],{"data":65293,"marks":65294,"value":65295,"nodeType":865},{},[],"To cut through some of the noise, we’ve compiled this list of reported attacks and explored what they mean for the identity threat landscape. ",{"data":65297,"content":65298,"nodeType":881},{},[65299,65303,65308],{"data":65300,"marks":65301,"value":65302,"nodeType":865},{},[],"This is not intended to be an exhaustive list of all attacks involving the compromise of digital identities (the list would be endless!). Nor is it something you should read all in one go (unless you ",{"data":65304,"marks":65305,"value":65307,"nodeType":865},{},[65306],{"type":5120},"really",{"data":65309,"marks":65310,"value":65311,"nodeType":865},{},[]," want to, we won’t stop you). We want it to be a resource that you can refer back to, that we will continue to update as new attacks are recorded. ",{"data":65313,"content":65314,"nodeType":881},{},[65315,65319],{"data":65316,"marks":65317,"value":65318,"nodeType":865},{},[],"In this context we define identity attacks as ",{"data":65320,"marks":65321,"value":65323,"nodeType":865},{},[65322],{"type":902},"attacks targeting cloud identities and their associated identity management systems, protocols, applications, and infrastructure. ",{"data":65325,"content":65326,"nodeType":881},{},[65327,65331],{"data":65328,"marks":65329,"value":65330,"nodeType":865},{},[],"The attacks recorded below are high profile examples of browser-based identity attacks",{"data":65332,"marks":65333,"value":65334,"nodeType":865},{},[]," that demonstrate how threat actors are leveraging the cloud identity plane to evade established cyber defenses and traverse new attack paths to achieve their goals. We’ve focused on attacks targeting identity infrastructure itself that are notable for their bypassing of traditional environments and established controls (e.g. Networkless or SaaS-to-SaaS attack paths). ",{"data":65336,"content":65337,"nodeType":881},{},[65338,65342,65349,65353,65362],{"data":65339,"marks":65340,"value":65341,"nodeType":865},{},[],"As with all publicly disclosed breaches, the level of detail and transparency we see varies. Where possible, we've mapped the threat actor Tactics, Techniques and Procedures to our ",{"data":65343,"content":65344,"nodeType":876},{"uri":4573},[65345],{"data":65346,"marks":65347,"value":4578,"nodeType":865},{},[65348],{"type":874},{"data":65350,"marks":65351,"value":65352,"nodeType":865},{},[]," (previously the SaaS Attack Matrix). To learn more about SaaS attack techniques ",{"data":65354,"content":65356,"nodeType":876},{"uri":65355},"https://pushsecurity.com/blog/saas-attack-techniques/#id-problems-with-observing-saas-attacks",[65357],{"data":65358,"marks":65359,"value":65361,"nodeType":865},{},[65360],{"type":874},"read the blog",{"data":65363,"marks":65364,"value":14775,"nodeType":865},{},[],{"data":65366,"content":65367,"nodeType":894},{},[],{"data":65369,"content":65370,"nodeType":904},{},[65371],{"data":65372,"marks":65373,"value":65374,"nodeType":865},{},[],"Snowflake – June 2024",{"data":65376,"content":65377,"nodeType":881},{},[65378,65382,65390],{"data":65379,"marks":65380,"value":65381,"nodeType":865},{},[],"The threat group known as ShinyHunters (also tracked as UNC5537) has claimed responsibility for breaching multiple organizations using Snowflake, a cloud-based data warehousing and analytics platform. The breach stems from the historical compromise of credentials used to access customer-specific Snowflake tenants, via infostealer infections. These credentials were used as part of a targeted campaign against Snowflake customers, which was exacerbated by the widespread absence of MFA due to the lack of MFA enforcement by default. At the time of writing, approximately 165 customers have been impacted globally ",{"data":65383,"content":65384,"nodeType":876},{"uri":5817},[65385],{"data":65386,"marks":65387,"value":65389,"nodeType":865},{},[65388],{"type":874},"according to a report by Mandiant",{"data":65391,"marks":65392,"value":1032,"nodeType":865},{},[],{"data":65394,"content":65395,"nodeType":1860},{},[65396],{"data":65397,"marks":65398,"value":65399,"nodeType":865},{},[],"How did Snowflake get breached?",{"data":65401,"content":65402,"nodeType":881},{},[65403],{"data":65404,"marks":65405,"value":65407,"nodeType":865},{},[65406],{"type":5120},"It’s worth noting that customers/users of Snowflake were breached via their Snowflake tenants, and no central breach of Snowflake's own systems occurred.",{"data":65409,"content":65410,"nodeType":1818},{},[65411,65421,65443,65453,65463,65473,65483,65493],{"data":65412,"content":65413,"nodeType":1734},{},[65414],{"data":65415,"content":65416,"nodeType":881},{},[65417],{"data":65418,"marks":65419,"value":65420,"nodeType":865},{},[],"Snowflake users were infected with infostealer malware that harvested credentials from user devices over an extended period. The threat actor used Snowflake customer credentials that were previously exposed via several infostealer malware variants, including; VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA and METASTEALER.",{"data":65422,"content":65423,"nodeType":1734},{},[65424],{"data":65425,"content":65426,"nodeType":881},{},[65427,65431,65439],{"data":65428,"marks":65429,"value":65430,"nodeType":865},{},[],"Credentials appeared on criminal marketplaces e.g. dark web forums and ",{"data":65432,"content":65433,"nodeType":876},{"uri":57809},[65434],{"data":65435,"marks":65436,"value":65438,"nodeType":865},{},[65437],{"type":874},"Telegram channels",{"data":65440,"marks":65441,"value":65442,"nodeType":865},{},[]," as combolists (username, password, and login portal combinations). ",{"data":65444,"content":65445,"nodeType":1734},{},[65446],{"data":65447,"content":65448,"nodeType":881},{},[65449],{"data":65450,"marks":65451,"value":65452,"nodeType":865},{},[],"Criminal groups (either ShinyHunters or another organization) saw the potential in targeting Snowflake users, based on the availability of credentials, number of customer organizations, and the value of the data that can be accessed in Snowflake. ",{"data":65454,"content":65455,"nodeType":1734},{},[65456],{"data":65457,"content":65458,"nodeType":881},{},[65459],{"data":65460,"marks":65461,"value":65462,"nodeType":865},{},[],"ShinyHunters embarked on a large-scale campaign targeting Snowflake customer accounts using previously breached credentials. ",{"data":65464,"content":65465,"nodeType":1734},{},[65466],{"data":65467,"content":65468,"nodeType":881},{},[65469],{"data":65470,"marks":65471,"value":65472,"nodeType":865},{},[],"ShinyHunters accessed user accounts that lacked MFA, belonging to approximately 165 Snowflake customers. ",{"data":65474,"content":65475,"nodeType":1734},{},[65476],{"data":65477,"content":65478,"nodeType":881},{},[65479],{"data":65480,"marks":65481,"value":65482,"nodeType":865},{},[],"ShinyHunters used SQL-based reconnaissance, staging, and data exfiltration techniques, expedited by custom hacker tooling developed specifically for Snowflake, to conduct attacks at scale.",{"data":65484,"content":65485,"nodeType":1734},{},[65486],{"data":65487,"content":65488,"nodeType":881},{},[65489],{"data":65490,"marks":65491,"value":65492,"nodeType":865},{},[],"ShinyHunters acquired massive quantities of Snowflake data based on the information that each customer stored in Snowflake or connected apps. The most sensitive data declared so far pertains to end-customers of each victim, for example PII, bank account and card information, etc.  ",{"data":65494,"content":65495,"nodeType":1734},{},[65496],{"data":65497,"content":65498,"nodeType":881},{},[65499],{"data":65500,"marks":65501,"value":65502,"nodeType":865},{},[],"ShinyHunters began attempts to extort Snowflake and end-customers using the data acquired. ",{"data":65504,"content":65505,"nodeType":1860},{},[65506],{"data":65507,"marks":65508,"value":65509,"nodeType":865},{},[],"What was the impact of the Snowflake breach?",{"data":65511,"content":65512,"nodeType":1818},{},[65513,65532,65563,65591,65610,65629],{"data":65514,"content":65515,"nodeType":1734},{},[65516],{"data":65517,"content":65518,"nodeType":881},{},[65519,65523,65528],{"data":65520,"marks":65521,"value":65522,"nodeType":865},{},[],"Approximately ",{"data":65524,"marks":65525,"value":65527,"nodeType":865},{},[65526],{"type":902},"165 victims were identified by Mandiant",{"data":65529,"marks":65530,"value":65531,"nodeType":865},{},[],". Organizations are gradually coming forward to declare the breach and release customer communications accordingly, but not all victims have been named.",{"data":65533,"content":65534,"nodeType":1734},{},[65535],{"data":65536,"content":65537,"nodeType":881},{},[65538,65542,65547,65551,65559],{"data":65539,"marks":65540,"value":65541,"nodeType":865},{},[],"Based on the figures being suggested so far, the impact upon end-customers is huge, with the data of ",{"data":65543,"marks":65544,"value":65546,"nodeType":865},{},[65545],{"type":902},"hundreds of millions of people exposed",{"data":65548,"marks":65549,"value":65550,"nodeType":865},{},[],", and has been touted by some news outlets as ‘",{"data":65552,"content":65553,"nodeType":876},{"uri":57307},[65554],{"data":65555,"marks":65556,"value":65558,"nodeType":865},{},[65557],{"type":874},"one of the biggest breaches ever",{"data":65560,"marks":65561,"value":65562,"nodeType":865},{},[],"’.  ",{"data":65564,"content":65565,"nodeType":1734},{},[65566],{"data":65567,"content":65568,"nodeType":881},{},[65569,65573,65578,65582,65587],{"data":65570,"marks":65571,"value":65572,"nodeType":865},{},[],"The impact on the affected businesses is largely unknown at this stage. It’s clear that the victims will suffer ",{"data":65574,"marks":65575,"value":65577,"nodeType":865},{},[65576],{"type":902},"reputational damage",{"data":65579,"marks":65580,"value":65581,"nodeType":865},{},[]," based on the extent of their individual breaches, and possibly face other ",{"data":65583,"marks":65584,"value":65586,"nodeType":865},{},[65585],{"type":902},"penalties and sanctions",{"data":65588,"marks":65589,"value":65590,"nodeType":865},{},[]," if they are found to be at fault by their respective regulators and/or national information security authorities. ",{"data":65592,"content":65593,"nodeType":1734},{},[65594],{"data":65595,"content":65596,"nodeType":881},{},[65597,65601,65606],{"data":65598,"marks":65599,"value":65600,"nodeType":865},{},[],"The impact upon individuals will be significant, with high potential for further targeting in terms of ",{"data":65602,"marks":65603,"value":65605,"nodeType":865},{},[65604],{"type":902},"identity theft, blackmail, financial crime",{"data":65607,"marks":65608,"value":65609,"nodeType":865},{},[],", etc.  ",{"data":65611,"content":65612,"nodeType":1734},{},[65613],{"data":65614,"content":65615,"nodeType":881},{},[65616,65620,65625],{"data":65617,"marks":65618,"value":65619,"nodeType":865},{},[],"It is unclear what data has been exposed in addition to personal data affecting end-customers. If other sensitive commercial or business data pertaining to ",{"data":65621,"marks":65622,"value":65624,"nodeType":865},{},[65623],{"type":902},"Intellectual Property",{"data":65626,"marks":65627,"value":65628,"nodeType":865},{},[]," has been exposed then this data may also be sold on via other nefarious channels, with a potential future impact.",{"data":65630,"content":65631,"nodeType":1734},{},[65632],{"data":65633,"content":65634,"nodeType":881},{},[65635,65639,65644],{"data":65636,"marks":65637,"value":65638,"nodeType":865},{},[],"Given the lack of MFA for the compromised accounts, there has been a general criticism of the ‘opt-in’ nature of MFA for SaaS services, with many security professionals suggesting that ",{"data":65640,"marks":65641,"value":65643,"nodeType":865},{},[65642],{"type":902},"Snowflake should enforce MFA by default",{"data":65645,"marks":65646,"value":65647,"nodeType":865},{},[]," given the critical nature of the service. ",{"data":65649,"content":65650,"nodeType":1860},{},[65651],{"data":65652,"marks":65653,"value":65654,"nodeType":865},{},[],"What stands out in the Snowflake breach?",{"data":65656,"content":65657,"nodeType":1818},{},[65658,65677,65718,65745],{"data":65659,"content":65660,"nodeType":1734},{},[65661],{"data":65662,"content":65663,"nodeType":881},{},[65664,65668,65673],{"data":65665,"marks":65666,"value":65667,"nodeType":865},{},[],"The breach ",{"data":65669,"marks":65670,"value":65672,"nodeType":865},{},[65671],{"type":902},"was achieved by using stolen credentials dating back as far as 2020",{"data":65674,"marks":65675,"value":65676,"nodeType":865},{},[],", that had not been rotated or changed. This indicates that many of the credentials used were not necessarily the result of any recent data sharing. This highlights the potential risk of breached credentials already in the public domain; particularly in the case of cloud services that may not be subject to the same levels of credential hygiene as other traditional network logins. ",{"data":65678,"content":65679,"nodeType":1734},{},[65680],{"data":65681,"content":65682,"nodeType":881},{},[65683,65687,65695,65698,65703,65707,65715],{"data":65684,"marks":65685,"value":65686,"nodeType":865},{},[],"Much of the industry response has focused on ensuring that accounts are using SSO (and therefore are protected by MFA at the IdP level). However, due to the existence of ",{"data":65688,"content":65690,"nodeType":876},{"uri":65689},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/ghost-logins",[65691],{"data":65692,"marks":65693,"value":11122,"nodeType":865},{},[65694],{"type":874},{"data":65696,"marks":65697,"value":1877,"nodeType":865},{},[],{"data":65699,"marks":65700,"value":65702,"nodeType":865},{},[65701],{"type":902},"local logins without MFA can exist simultaneously with the SSO login unless expressly disabled",{"data":65704,"marks":65705,"value":65706,"nodeType":865},{},[],". Organizations using Snowflake that are looking to lock down their accounts can ",{"data":65708,"content":65709,"nodeType":876},{"uri":53345},[65710],{"data":65711,"marks":65712,"value":65714,"nodeType":865},{},[65713],{"type":874},"watch our recent demo of how to effectively remediate this vulnerability in Snowflake",{"data":65716,"marks":65717,"value":30204,"nodeType":865},{},[],{"data":65719,"content":65720,"nodeType":1734},{},[65721],{"data":65722,"content":65723,"nodeType":881},{},[65724,65729,65733,65741],{"data":65725,"marks":65726,"value":65728,"nodeType":865},{},[65727],{"type":902},"80% of the credentials were gathered through infostealer malware",{"data":65730,"marks":65731,"value":65732,"nodeType":865},{},[],". Typically, this occurs when unmanaged devices are used to access company resources, or personal browser profiles are synchronized on both work and personal devices. Malware deployed to an insecure personal device can then access and steal credentials for company resources. This situation usually occurs when working with third-party contractors on a BYOD basis; ",{"data":65734,"content":65735,"nodeType":876},{"uri":58035},[65736],{"data":65737,"marks":65738,"value":65740,"nodeType":865},{},[65739],{"type":874},"a recent article indicates that Ukraine-based EPAM Systems",{"data":65742,"marks":65743,"value":65744,"nodeType":865},{},[],", an engineering and digital service provider and “Elite Tier Partner” of Snowflake, was one such organization breached in this way. Organizations consuming Snowflake-related services from EPAM were then subsequently affected, as the compromise of EPAM users granted access to a large number of Snowflake credentials for various company tenants.  ",{"data":65746,"content":65747,"nodeType":1734},{},[65748],{"data":65749,"content":65750,"nodeType":881},{},[65751,65755,65760,65764,65769],{"data":65752,"marks":65753,"value":65754,"nodeType":865},{},[],"While attacker activity has focused on Snowflake to date, the success of this attack will signal the potential for further credential based attacks against similar apps. ",{"data":65756,"marks":65757,"value":65759,"nodeType":865},{},[65758],{"type":902},"There may already be a 'Snowflake 2.0' among the credentials already available online",{"data":65761,"marks":65762,"value":65763,"nodeType":865},{},[],". Further, credentials can be used against a wide range of apps to capitalize on potential ",{"data":65765,"marks":65766,"value":65768,"nodeType":865},{},[65767],{"type":902},"password reuse (which we see for 1 in 3 employees)",{"data":65770,"marks":65771,"value":65772,"nodeType":865},{},[],", so the exact creds for a particular app don’t have to be explicitly breached, so long as the domain for the login portal can be guessed or has been exposed elsewhere.   ",{"data":65774,"content":65775,"nodeType":1860},{},[65776],{"data":65777,"marks":65778,"value":65779,"nodeType":865},{},[],"Browser & Identity Attacks Matrix mapping",{"data":65781,"content":65782,"nodeType":881},{},[65783],{"data":65784,"marks":65785,"value":65786,"nodeType":865},{},[],"For more information on each TTP please navigate to the entries linked in the table below. ",{"data":65788,"content":65789,"nodeType":2270},{},[65790,65834,65896],{"data":65791,"content":65792,"nodeType":2032},{},[65793,65804,65814,65824],{"data":65794,"content":65795,"nodeType":65803},{},[65796],{"data":65797,"content":65798,"nodeType":881},{},[65799],{"data":65800,"marks":65801,"value":65802,"nodeType":865},{},[],"ID","table-header-cell",{"data":65805,"content":65806,"nodeType":65803},{},[65807],{"data":65808,"content":65809,"nodeType":881},{},[65810],{"data":65811,"marks":65812,"value":65813,"nodeType":865},{},[],"Name",{"data":65815,"content":65816,"nodeType":65803},{},[65817],{"data":65818,"content":65819,"nodeType":881},{},[65820],{"data":65821,"marks":65822,"value":65823,"nodeType":865},{},[],"Stage",{"data":65825,"content":65826,"nodeType":65803},{},[65827],{"data":65828,"content":65829,"nodeType":881},{},[65830],{"data":65831,"marks":65832,"value":65833,"nodeType":865},{},[],"Description",{"data":65835,"content":65836,"nodeType":2032},{},[65837,65857,65876,65886],{"data":65838,"content":65839,"nodeType":2021},{},[65840],{"data":65841,"content":65842,"nodeType":881},{},[65843,65846,65854],{"data":65844,"marks":65845,"value":21,"nodeType":865},{},[],{"data":65847,"content":65848,"nodeType":876},{"uri":11116},[65849],{"data":65850,"marks":65851,"value":65853,"nodeType":865},{},[65852],{"type":874},"SAT1017",{"data":65855,"marks":65856,"value":21,"nodeType":865},{},[],{"data":65858,"content":65859,"nodeType":2021},{},[65860],{"data":65861,"content":65862,"nodeType":881},{},[65863,65866,65873],{"data":65864,"marks":65865,"value":21,"nodeType":865},{},[],{"data":65867,"content":65868,"nodeType":876},{"uri":65689},[65869],{"data":65870,"marks":65871,"value":395,"nodeType":865},{},[65872],{"type":874},{"data":65874,"marks":65875,"value":21,"nodeType":865},{},[],{"data":65877,"content":65878,"nodeType":2021},{},[65879],{"data":65880,"content":65881,"nodeType":881},{},[65882],{"data":65883,"marks":65884,"value":65885,"nodeType":865},{},[],"Initial Access; Persistence; Defense Evasion",{"data":65887,"content":65888,"nodeType":2021},{},[65889],{"data":65890,"content":65891,"nodeType":881},{},[65892],{"data":65893,"marks":65894,"value":65895,"nodeType":865},{},[],"Abusing non-SSO additional login methods such as password-based authentication (local to the SaaS app), social logins, API access, etc. ",{"data":65897,"content":65898,"nodeType":2032},{},[65899,65919,65939,65949],{"data":65900,"content":65901,"nodeType":2021},{},[65902],{"data":65903,"content":65904,"nodeType":881},{},[65905,65908,65916],{"data":65906,"marks":65907,"value":21,"nodeType":865},{},[],{"data":65909,"content":65910,"nodeType":876},{"uri":42831},[65911],{"data":65912,"marks":65913,"value":65915,"nodeType":865},{},[65914],{"type":874},"SAT1044",{"data":65917,"marks":65918,"value":21,"nodeType":865},{},[],{"data":65920,"content":65921,"nodeType":2021},{},[65922],{"data":65923,"content":65924,"nodeType":881},{},[65925,65928,65936],{"data":65926,"marks":65927,"value":21,"nodeType":865},{},[],{"data":65929,"content":65931,"nodeType":876},{"uri":65930},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/session-cookie-theft",[65932],{"data":65933,"marks":65934,"value":60658,"nodeType":865},{},[65935],{"type":874},{"data":65937,"marks":65938,"value":21,"nodeType":865},{},[],{"data":65940,"content":65941,"nodeType":2021},{},[65942],{"data":65943,"content":65944,"nodeType":881},{},[65945],{"data":65946,"marks":65947,"value":65948,"nodeType":865},{},[],"Lateral Movement; Defense Evasion",{"data":65950,"content":65951,"nodeType":2021},{},[65952],{"data":65953,"content":65954,"nodeType":881},{},[65955],{"data":65956,"marks":65957,"value":65958,"nodeType":865},{},[],"Session cookies are used to pivot from an endpoint compromise and laterally move to downstream SaaS applications.",{"data":65960,"content":65961,"nodeType":1860},{},[65962],{"data":65963,"marks":65964,"value":65965,"nodeType":865},{},[],"Related breaches",{"data":65967,"content":65968,"nodeType":881},{},[65969],{"data":65970,"marks":65971,"value":65972,"nodeType":865},{},[],"Named victims are listed below:",{"data":65974,"content":65975,"nodeType":1818},{},[65976,65986,65996,66006,66016,66026,66036,66046],{"data":65977,"content":65978,"nodeType":1734},{},[65979],{"data":65980,"content":65981,"nodeType":881},{},[65982],{"data":65983,"marks":65984,"value":65985,"nodeType":865},{},[],"Ticketmaster",{"data":65987,"content":65988,"nodeType":1734},{},[65989],{"data":65990,"content":65991,"nodeType":881},{},[65992],{"data":65993,"marks":65994,"value":65995,"nodeType":865},{},[],"Santander",{"data":65997,"content":65998,"nodeType":1734},{},[65999],{"data":66000,"content":66001,"nodeType":881},{},[66002],{"data":66003,"marks":66004,"value":66005,"nodeType":865},{},[],"Neiman Marcus",{"data":66007,"content":66008,"nodeType":1734},{},[66009],{"data":66010,"content":66011,"nodeType":881},{},[66012],{"data":66013,"marks":66014,"value":66015,"nodeType":865},{},[],"Los Angeles Unified",{"data":66017,"content":66018,"nodeType":1734},{},[66019],{"data":66020,"content":66021,"nodeType":881},{},[66022],{"data":66023,"marks":66024,"value":66025,"nodeType":865},{},[],"Pure Storage",{"data":66027,"content":66028,"nodeType":1734},{},[66029],{"data":66030,"content":66031,"nodeType":881},{},[66032],{"data":66033,"marks":66034,"value":66035,"nodeType":865},{},[],"Advance Auto Parts",{"data":66037,"content":66038,"nodeType":1734},{},[66039],{"data":66040,"content":66041,"nodeType":881},{},[66042],{"data":66043,"marks":66044,"value":66045,"nodeType":865},{},[],"Truist Bank",{"data":66047,"content":66048,"nodeType":1734},{},[66049],{"data":66050,"content":66051,"nodeType":881},{},[66052],{"data":66053,"marks":66054,"value":66055,"nodeType":865},{},[],"Lending Tree",{"data":66057,"content":66058,"nodeType":894},{},[],{"data":66060,"content":66061,"nodeType":904},{},[66062],{"data":66063,"marks":66064,"value":66065,"nodeType":865},{},[],"Microsoft — January 2024",{"data":66067,"content":66068,"nodeType":881},{},[66069],{"data":66070,"marks":66071,"value":66072,"nodeType":865},{},[],"The threat group known as APT29 (also known as “The Dukes”, “Cozy Bear”, and labeled “Midnight Blizzard” by Microsoft) executed a cleverly executed password-guessing attack to compromise test cloud identities that were also lacking MFA. Attackers then leveraged this access to compromise some OAuth applications that allowed lateral movement to Microsoft’s corporate environment and the creation of other malicious OAuth applications to achieve persistence.",{"data":66074,"content":66075,"nodeType":1860},{},[66076],{"data":66077,"marks":66078,"value":66079,"nodeType":865},{},[],"How did Microsoft get breached?",{"data":66081,"content":66082,"nodeType":1818},{},[66083,66093,66103,66113,66123,66133],{"data":66084,"content":66085,"nodeType":1734},{},[66086],{"data":66087,"content":66088,"nodeType":881},{},[66089],{"data":66090,"marks":66091,"value":66092,"nodeType":865},{},[],"APT29 utilized password spraying / credential stuffing attacks to compromise test cloud identities that were also lacking MFA, attached to a non-production test tenant.",{"data":66094,"content":66095,"nodeType":1734},{},[66096],{"data":66097,"content":66098,"nodeType":881},{},[66099],{"data":66100,"marks":66101,"value":66102,"nodeType":865},{},[],"APT29 leveraged their initial access to the test tenant to identify and compromise a test OAuth application that had access to the Microsoft corporate environment by leveraging permissive Entra ID roles in the test tenant.",{"data":66104,"content":66105,"nodeType":1734},{},[66106],{"data":66107,"content":66108,"nodeType":881},{},[66109],{"data":66110,"marks":66111,"value":66112,"nodeType":865},{},[],"APT29 used the existing configurations to access the Microsoft corporate Entra ID tenant whereupon the app registration from the test tenant was installed as a service principal in the corporate tenant, granting the equivalent of global admin rights.",{"data":66114,"content":66115,"nodeType":1734},{},[66116],{"data":66117,"content":66118,"nodeType":881},{},[66119],{"data":66120,"marks":66121,"value":66122,"nodeType":865},{},[],"Using these new permissions, APT29 registered additional malicious OAuth applications in the Microsoft corporate environment, and created a new user in the Microsoft corporate tenant to grant consent to the new malicious OAuth apps, thereby achieving persistent access to the environment.",{"data":66124,"content":66125,"nodeType":1734},{},[66126],{"data":66127,"content":66128,"nodeType":881},{},[66129],{"data":66130,"marks":66131,"value":66132,"nodeType":865},{},[],"APT29 leveraged the elevated (maximum) privileges assigned to the ‘test’ app service principal to grant app roles to other newly created app service principals, granting them the Office 365 Exchange Online full_access_as_app role in the corporate tenant, which allows access to mailboxes.",{"data":66134,"content":66135,"nodeType":1734},{},[66136],{"data":66137,"content":66138,"nodeType":881},{},[66139],{"data":66140,"marks":66141,"value":66142,"nodeType":865},{},[],"APT29 leveraged these malicious OAuth applications to authenticate to Microsoft Exchange Online and target Microsoft corporate email accounts.",{"data":66144,"content":66145,"nodeType":1860},{},[66146],{"data":66147,"marks":66148,"value":66149,"nodeType":865},{},[],"What was the impact of the Microsoft breach?",{"data":66151,"content":66152,"nodeType":1818},{},[66153,66163,66173],{"data":66154,"content":66155,"nodeType":1734},{},[66156],{"data":66157,"content":66158,"nodeType":881},{},[66159],{"data":66160,"marks":66161,"value":66162,"nodeType":865},{},[],"APT29 had access to Microsoft corporate email accounts, including members of the senior leadership team and employees in the cybersecurity, legal, and other functions, resulting in sensitive data leakage.",{"data":66164,"content":66165,"nodeType":1734},{},[66166],{"data":66167,"content":66168,"nodeType":881},{},[66169],{"data":66170,"marks":66171,"value":66172,"nodeType":865},{},[],"Microsoft has not disclosed any further impacts at this time, but it is likely that the adversary had complete, unmitigated control of the Microsoft corporate tenant for a period of time, with global administrator level access.",{"data":66174,"content":66175,"nodeType":1734},{},[66176],{"data":66177,"content":66178,"nodeType":881},{},[66179],{"data":66180,"marks":66181,"value":66182,"nodeType":865},{},[],"Since the initial attack there has been evidence of continued targeting, with password spraying attacks reportedly increasing tenfold, likely informed by stolen information.",{"data":66184,"content":66185,"nodeType":1860},{},[66186],{"data":66187,"marks":66188,"value":66189,"nodeType":865},{},[],"What stands out in the Microsoft breach?",{"data":66191,"content":66192,"nodeType":1818},{},[66193,66203,66213,66223],{"data":66194,"content":66195,"nodeType":1734},{},[66196],{"data":66197,"content":66198,"nodeType":881},{},[66199],{"data":66200,"marks":66201,"value":66202,"nodeType":865},{},[],"The attack was covert and targeted, with APT29 tailoring the attack to a limited number of accounts and using a low number of attempts to evade detection and avoid account blocks based on the volume of failures.",{"data":66204,"content":66205,"nodeType":1734},{},[66206],{"data":66207,"content":66208,"nodeType":881},{},[66209],{"data":66210,"marks":66211,"value":66212,"nodeType":865},{},[],"APT29 used residential proxy networks when interacting with the compromised tenant and, subsequently, with Exchange Online to obfuscate the source of their attack and avoid impossible travel detections. ",{"data":66214,"content":66215,"nodeType":1734},{},[66216],{"data":66217,"content":66218,"nodeType":881},{},[66219],{"data":66220,"marks":66221,"value":66222,"nodeType":865},{},[],"APT29 demonstrated mature and in-depth understanding of cloud infrastructure, protocols, and workflows, particularly in terms of privilege escalation and lateral movement.",{"data":66224,"content":66225,"nodeType":1734},{},[66226],{"data":66227,"content":66228,"nodeType":881},{},[66229],{"data":66230,"marks":66231,"value":66232,"nodeType":865},{},[],"If even Microsoft (an organization with pretty much unrivaled security resources) can’t ensure that all their accounts are protected by MFA and that there are no weak links between test/dev and prod systems, this should be a wake-up call for any company that thinks their MFA implementation is flawless. ",{"data":66234,"content":66235,"nodeType":1860},{},[66236],{"data":66237,"marks":66238,"value":65779,"nodeType":865},{},[],{"data":66240,"content":66241,"nodeType":881},{},[66242],{"data":66243,"marks":66244,"value":65786,"nodeType":865},{},[],{"data":66246,"content":66247,"nodeType":2270},{},[66248,66288,66351,66414],{"data":66249,"content":66250,"nodeType":2032},{},[66251,66260,66270,66279],{"data":66252,"content":66253,"nodeType":65803},{},[66254],{"data":66255,"content":66256,"nodeType":881},{},[66257],{"data":66258,"marks":66259,"value":65802,"nodeType":865},{},[],{"data":66261,"content":66262,"nodeType":65803},{},[66263],{"data":66264,"content":66265,"nodeType":881},{},[66266],{"data":66267,"marks":66268,"value":66269,"nodeType":865},{},[],"Technique",{"data":66271,"content":66272,"nodeType":65803},{},[66273],{"data":66274,"content":66275,"nodeType":881},{},[66276],{"data":66277,"marks":66278,"value":65823,"nodeType":865},{},[],{"data":66280,"content":66281,"nodeType":65803},{},[66282],{"data":66283,"content":66284,"nodeType":881},{},[66285],{"data":66286,"marks":66287,"value":65833,"nodeType":865},{},[],{"data":66289,"content":66290,"nodeType":2032},{},[66291,66311,66331,66341],{"data":66292,"content":66293,"nodeType":2021},{},[66294],{"data":66295,"content":66296,"nodeType":881},{},[66297,66300,66308],{"data":66298,"marks":66299,"value":21,"nodeType":865},{},[],{"data":66301,"content":66302,"nodeType":876},{"uri":53601},[66303],{"data":66304,"marks":66305,"value":66307,"nodeType":865},{},[66306],{"type":874},"SAT1011",{"data":66309,"marks":66310,"value":21,"nodeType":865},{},[],{"data":66312,"content":66313,"nodeType":2021},{},[66314],{"data":66315,"content":66316,"nodeType":881},{},[66317,66320,66328],{"data":66318,"marks":66319,"value":21,"nodeType":865},{},[],{"data":66321,"content":66323,"nodeType":876},{"uri":66322},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/credential-stuffing",[66324],{"data":66325,"marks":66326,"value":333,"nodeType":865},{},[66327],{"type":874},{"data":66329,"marks":66330,"value":21,"nodeType":865},{},[],{"data":66332,"content":66333,"nodeType":2021},{},[66334],{"data":66335,"content":66336,"nodeType":881},{},[66337],{"data":66338,"marks":66339,"value":66340,"nodeType":865},{},[],"Initial Access",{"data":66342,"content":66343,"nodeType":2021},{},[66344],{"data":66345,"content":66346,"nodeType":881},{},[66347],{"data":66348,"marks":66349,"value":66350,"nodeType":865},{},[],"Attempt to authenticate to a SaaS account by guessing a large number of passwords ",{"data":66352,"content":66353,"nodeType":2032},{},[66354,66374,66394,66404],{"data":66355,"content":66356,"nodeType":2021},{},[66357],{"data":66358,"content":66359,"nodeType":881},{},[66360,66363,66371],{"data":66361,"marks":66362,"value":21,"nodeType":865},{},[],{"data":66364,"content":66365,"nodeType":876},{"uri":60875},[66366],{"data":66367,"marks":66368,"value":66370,"nodeType":865},{},[66369],{"type":874},"SAT1027",{"data":66372,"marks":66373,"value":21,"nodeType":865},{},[],{"data":66375,"content":66376,"nodeType":2021},{},[66377],{"data":66378,"content":66379,"nodeType":881},{},[66380,66383,66391],{"data":66381,"marks":66382,"value":21,"nodeType":865},{},[],{"data":66384,"content":66386,"nodeType":876},{"uri":66385},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/oauth-tokens",[66387],{"data":66388,"marks":66389,"value":60881,"nodeType":865},{},[66390],{"type":874},{"data":66392,"marks":66393,"value":21,"nodeType":865},{},[],{"data":66395,"content":66396,"nodeType":2021},{},[66397],{"data":66398,"content":66399,"nodeType":881},{},[66400],{"data":66401,"marks":66402,"value":66403,"nodeType":865},{},[],"Execution; Persistence; Defense Evasion",{"data":66405,"content":66406,"nodeType":2021},{},[66407],{"data":66408,"content":66409,"nodeType":881},{},[66410],{"data":66411,"marks":66412,"value":66413,"nodeType":865},{},[],"Use a malicious OAuth app to create an OAuth token, using arbitrary permissions to maintain long-term programmatic access to a compromised user account.",{"data":66415,"content":66416,"nodeType":2032},{},[66417,66437,66458,66468],{"data":66418,"content":66419,"nodeType":2021},{},[66420],{"data":66421,"content":66422,"nodeType":881},{},[66423,66426,66434],{"data":66424,"marks":66425,"value":21,"nodeType":865},{},[],{"data":66427,"content":66428,"nodeType":876},{"uri":61104},[66429],{"data":66430,"marks":66431,"value":66433,"nodeType":865},{},[66432],{"type":874},"SAT1001",{"data":66435,"marks":66436,"value":21,"nodeType":865},{},[],{"data":66438,"content":66439,"nodeType":2021},{},[66440],{"data":66441,"content":66442,"nodeType":881},{},[66443,66446,66455],{"data":66444,"marks":66445,"value":21,"nodeType":865},{},[],{"data":66447,"content":66449,"nodeType":876},{"uri":66448},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/abuse-existing-oauth-integrations",[66450],{"data":66451,"marks":66452,"value":66454,"nodeType":865},{},[66453],{"type":874},"Abuse existing OAuth integrations",{"data":66456,"marks":66457,"value":21,"nodeType":865},{},[],{"data":66459,"content":66460,"nodeType":2021},{},[66461],{"data":66462,"content":66463,"nodeType":881},{},[66464],{"data":66465,"marks":66466,"value":66467,"nodeType":865},{},[],"Privilege Escalation;\nLateral Movement",{"data":66469,"content":66470,"nodeType":2021},{},[66471],{"data":66472,"content":66473,"nodeType":881},{},[66474],{"data":66475,"marks":66476,"value":66477,"nodeType":865},{},[],"If an adversary compromises a SaaS account integrated with other apps, they can escalate privileges and move laterally to other apps.",{"data":66479,"content":66480,"nodeType":1860},{},[66481],{"data":66482,"marks":66483,"value":65965,"nodeType":865},{},[],{"data":66485,"content":66486,"nodeType":881},{},[66487],{"data":66488,"marks":66489,"value":66491,"nodeType":865},{},[66490],{"type":902},"Hewlett Packard Enterprise (HPE) — May 2023",{"data":66493,"content":66494,"nodeType":881},{},[66495],{"data":66496,"marks":66497,"value":66498,"nodeType":865},{},[],"At the time of the Microsoft breach becoming public knowledge, HPE disclosed that they had become aware of a historical incident in Dec 2023, involving unauthorized access to and exfiltration of a limited number of SharePoint files as early as May 2023. Hackers accessed and exfiltrated data from HPE mailboxes belonging to individuals in the cybersecurity, go-to-market, business segments, and other functions. No further information is available on the techniques used or impact of the breach. ",{"data":66500,"content":66501,"nodeType":894},{},[],{"data":66503,"content":66504,"nodeType":904},{},[66505],{"data":66506,"marks":66507,"value":66508,"nodeType":865},{},[],"Okta — October 2023",{"data":66510,"content":66511,"nodeType":881},{},[66512],{"data":66513,"marks":66514,"value":66515,"nodeType":865},{},[],"An unknown threat group compromised an Okta employee's personal Google account that was being used on a company-managed device, granting the threat actor access to a service account for Okta’s customer support system, that included session tokens for 134 customers. This was then used to hijack the legitimate Okta sessions of five customers. ",{"data":66517,"content":66518,"nodeType":1860},{},[66519],{"data":66520,"marks":66521,"value":66522,"nodeType":865},{},[],"How did Okta get breached?",{"data":66524,"content":66525,"nodeType":1818},{},[66526,66536,66546,66556,66566],{"data":66527,"content":66528,"nodeType":1734},{},[66529],{"data":66530,"content":66531,"nodeType":881},{},[66532],{"data":66533,"marks":66534,"value":66535,"nodeType":865},{},[],"The threat actor compromised a personal Google account that the user had accessed from their Okta-managed work device by signing into their personal profile from the Chrome browser.",{"data":66537,"content":66538,"nodeType":1734},{},[66539],{"data":66540,"content":66541,"nodeType":881},{},[66542],{"data":66543,"marks":66544,"value":66545,"nodeType":865},{},[],"The personal account credentials are likely to have been compromised in a historical data breach and did not have MFA enabled.",{"data":66547,"content":66548,"nodeType":1734},{},[66549],{"data":66550,"content":66551,"nodeType":881},{},[66552],{"data":66553,"marks":66554,"value":66555,"nodeType":865},{},[],"The username and password of a service account for Okta’s customer support system had been saved into the employee’s personal Google account and was therefore compromised.",{"data":66557,"content":66558,"nodeType":1734},{},[66559],{"data":66560,"content":66561,"nodeType":881},{},[66562],{"data":66563,"marks":66564,"value":66565,"nodeType":865},{},[],"The threat actor was able to access the service account by logging in using the stolen credentials, which again likely did not have MFA deployed as a service account.",{"data":66567,"content":66568,"nodeType":1734},{},[66569],{"data":66570,"content":66571,"nodeType":881},{},[66572],{"data":66573,"marks":66574,"value":66575,"nodeType":865},{},[],"The threat actor was able to use session tokens in the HAR files to impersonate staff and hijack the legitimate Okta sessions of five customers, including 1Password, BeyondTrust, and Cloudflare.",{"data":66577,"content":66578,"nodeType":1860},{},[66579],{"data":66580,"marks":66581,"value":66582,"nodeType":865},{},[],"What was the impact of the Okta breach?",{"data":66584,"content":66585,"nodeType":1818},{},[66586,66596,66606,66616],{"data":66587,"content":66588,"nodeType":1734},{},[66589],{"data":66590,"content":66591,"nodeType":881},{},[66592],{"data":66593,"marks":66594,"value":66595,"nodeType":865},{},[],"The threat actor gained unauthorized access to files inside Okta’s customer support system associated with 134 Okta customers.",{"data":66597,"content":66598,"nodeType":1734},{},[66599],{"data":66600,"content":66601,"nodeType":881},{},[66602],{"data":66603,"marks":66604,"value":66605,"nodeType":865},{},[],"The threat actor was able to use these session tokens to hijack the legitimate Okta sessions of 5 (publicly disclosed) customers.",{"data":66607,"content":66608,"nodeType":1734},{},[66609],{"data":66610,"content":66611,"nodeType":881},{},[66612],{"data":66613,"marks":66614,"value":66615,"nodeType":865},{},[],"Okta originally claimed the breach had impacted only 1% of customers, but later found that a report run and downloaded by the threat actor contained the names and email addresses of all 18,400 Okta customer support users, as well as some Okta employee information, meaning 100% of customer support users were impacted.",{"data":66617,"content":66618,"nodeType":1734},{},[66619],{"data":66620,"content":66621,"nodeType":881},{},[66622],{"data":66623,"marks":66624,"value":66625,"nodeType":865},{},[],"Okta users are at higher risk of phishing and credential stuffing attacks based on the data stolen by the threat actor, increasing the importance of robust MFA implementation.",{"data":66627,"content":66628,"nodeType":1860},{},[66629],{"data":66630,"marks":66631,"value":66632,"nodeType":865},{},[],"What stands out in the Okta breach?",{"data":66634,"content":66635,"nodeType":1818},{},[66636,66646,66656],{"data":66637,"content":66638,"nodeType":1734},{},[66639],{"data":66640,"content":66641,"nodeType":881},{},[66642],{"data":66643,"marks":66644,"value":66645,"nodeType":865},{},[],"This attack demonstrates the risk associated with cloud Identity Providers and the potential goldmine that they are to attackers. Much in the same way that the manufacturers of physical and virtual network appliances are continuously probed for software vulnerabilities, cloud IdPs like Okta present a huge potential opportunity, both in terms of targeting specific organizational instances as well as the Okta organization. This attack showcases the possibility of third-party supply chain attacks to target downstream organizations using IdP services. ",{"data":66647,"content":66648,"nodeType":1734},{},[66649],{"data":66650,"content":66651,"nodeType":881},{},[66652],{"data":66653,"marks":66654,"value":66655,"nodeType":865},{},[],"Similar to the Microsoft breach, gaps were discovered and exploited in Okta’s MFA coverage and implementation, highlighting that there are gaps in even the most mature organizations. ",{"data":66657,"content":66658,"nodeType":1734},{},[66659],{"data":66660,"content":66661,"nodeType":881},{},[66662],{"data":66663,"marks":66664,"value":66665,"nodeType":865},{},[],"The subsequent attack on Cloudflare (see below) and the scale of the recovery effort demonstrates the significant operational overhead in responding to and recovering from a breach of identity infrastructure, with a similar or greater scale than a traditional Active Directory compromise. While addressing the incident, Cloudflare's staff rotated all production credentials (over 5,000 unique ones), physically segmented test and staging systems, performed forensic triage on 4,893 systems, reimaged and rebooted all systems on the company's global network, including all Atlassian servers (Jira, Confluence, and Bitbucket) and machines accessed by the threat actor. All equipment in Cloudflare's Brazil data center, which was unsuccessfully targeted by the threat actor, was later returned to the manufacturers to ensure that the data center was secure.",{"data":66667,"content":66668,"nodeType":1860},{},[66669],{"data":66670,"marks":66671,"value":65779,"nodeType":865},{},[],{"data":66673,"content":66674,"nodeType":881},{},[66675],{"data":66676,"marks":66677,"value":65786,"nodeType":865},{},[],{"data":66679,"content":66680,"nodeType":2270},{},[66681,66720,66779],{"data":66682,"content":66683,"nodeType":2032},{},[66684,66693,66702,66711],{"data":66685,"content":66686,"nodeType":65803},{},[66687],{"data":66688,"content":66689,"nodeType":881},{},[66690],{"data":66691,"marks":66692,"value":65802,"nodeType":865},{},[],{"data":66694,"content":66695,"nodeType":65803},{},[66696],{"data":66697,"content":66698,"nodeType":881},{},[66699],{"data":66700,"marks":66701,"value":66269,"nodeType":865},{},[],{"data":66703,"content":66704,"nodeType":65803},{},[66705],{"data":66706,"content":66707,"nodeType":881},{},[66708],{"data":66709,"marks":66710,"value":65823,"nodeType":865},{},[],{"data":66712,"content":66713,"nodeType":65803},{},[66714],{"data":66715,"content":66716,"nodeType":881},{},[66717],{"data":66718,"marks":66719,"value":65833,"nodeType":865},{},[],{"data":66721,"content":66722,"nodeType":2032},{},[66723,66742,66761,66770],{"data":66724,"content":66725,"nodeType":2021},{},[66726],{"data":66727,"content":66728,"nodeType":881},{},[66729,66732,66739],{"data":66730,"marks":66731,"value":21,"nodeType":865},{},[],{"data":66733,"content":66734,"nodeType":876},{"uri":53601},[66735],{"data":66736,"marks":66737,"value":66307,"nodeType":865},{},[66738],{"type":874},{"data":66740,"marks":66741,"value":21,"nodeType":865},{},[],{"data":66743,"content":66744,"nodeType":2021},{},[66745],{"data":66746,"content":66747,"nodeType":881},{},[66748,66751,66758],{"data":66749,"marks":66750,"value":21,"nodeType":865},{},[],{"data":66752,"content":66753,"nodeType":876},{"uri":66322},[66754],{"data":66755,"marks":66756,"value":333,"nodeType":865},{},[66757],{"type":874},{"data":66759,"marks":66760,"value":21,"nodeType":865},{},[],{"data":66762,"content":66763,"nodeType":2021},{},[66764],{"data":66765,"content":66766,"nodeType":881},{},[66767],{"data":66768,"marks":66769,"value":66340,"nodeType":865},{},[],{"data":66771,"content":66772,"nodeType":2021},{},[66773],{"data":66774,"content":66775,"nodeType":881},{},[66776],{"data":66777,"marks":66778,"value":66350,"nodeType":865},{},[],{"data":66780,"content":66781,"nodeType":2032},{},[66782,66803,66824,66834],{"data":66783,"content":66784,"nodeType":2021},{},[66785],{"data":66786,"content":66787,"nodeType":881},{},[66788,66791,66800],{"data":66789,"marks":66790,"value":21,"nodeType":865},{},[],{"data":66792,"content":66794,"nodeType":876},{"uri":66793},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/password_scraping/description.md",[66795],{"data":66796,"marks":66797,"value":66799,"nodeType":865},{},[66798],{"type":874},"SAT1028",{"data":66801,"marks":66802,"value":21,"nodeType":865},{},[],{"data":66804,"content":66805,"nodeType":2021},{},[66806],{"data":66807,"content":66808,"nodeType":881},{},[66809,66812,66821],{"data":66810,"marks":66811,"value":21,"nodeType":865},{},[],{"data":66813,"content":66815,"nodeType":876},{"uri":66814},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/password-scraping",[66816],{"data":66817,"marks":66818,"value":66820,"nodeType":865},{},[66819],{"type":874},"Password Scraping",{"data":66822,"marks":66823,"value":21,"nodeType":865},{},[],{"data":66825,"content":66826,"nodeType":2021},{},[66827],{"data":66828,"content":66829,"nodeType":881},{},[66830],{"data":66831,"marks":66832,"value":66833,"nodeType":865},{},[],"Credential Access",{"data":66835,"content":66836,"nodeType":2021},{},[66837],{"data":66838,"content":66839,"nodeType":881},{},[66840],{"data":66841,"marks":66842,"value":66843,"nodeType":865},{},[],"Collection of credentials and secrets from repositories e.g. password managers, SaaS file stores, etc.",{"data":66845,"content":66846,"nodeType":1860},{},[66847],{"data":66848,"marks":66849,"value":65965,"nodeType":865},{},[],{"data":66851,"content":66852,"nodeType":881},{},[66853],{"data":66854,"marks":66855,"value":66857,"nodeType":865},{},[66856],{"type":902},"Cloudflare — November 2023",{"data":66859,"content":66860,"nodeType":881},{},[66861],{"data":66862,"marks":66863,"value":66864,"nodeType":865},{},[],"The threat actor used tokens and credentials that had not been rotated to breach Cloudflare’s internal Atlassian server and access its Confluence wiki, Jira bug database, and Bitbucket source code management system. The threat actor first gained access to Cloudflare's self-hosted Atlassian server and then accessed the company's Confluence and Jira systems following a reconnaissance stage. Cloudflare says that this breach did not impact customer data or systems or the provision of services.",{"data":66866,"content":66867,"nodeType":881},{},[66868],{"data":66869,"marks":66870,"value":66872,"nodeType":865},{},[66871],{"type":902},"1Password — October 2023",{"data":66874,"content":66875,"nodeType":881},{},[66876],{"data":66877,"marks":66878,"value":66879,"nodeType":865},{},[],"1Password reported unsolicited activity in their Okta environment which was traced to a suspicious IP address. Later it was confirmed that an threat actor had accessed 1Password’s Okta environment using administrative privileges. They attempted to access the IT team member’s user dashboard, but that attempt was blocked by Okta. They also requested a report of administrative users, which was identified as suspicious and triggered an investigation. 1Password says it terminated the activity, investigated, and found no compromise of user data or other sensitive systems, either employee-facing or user-facing.",{"data":66881,"content":66882,"nodeType":881},{},[66883],{"data":66884,"marks":66885,"value":66887,"nodeType":865},{},[66886],{"type":902},"BeyondTrust - October 2023",{"data":66889,"content":66890,"nodeType":881},{},[66891],{"data":66892,"marks":66893,"value":66894,"nodeType":865},{},[],"BeyondTrust security teams detected an identity-centric attack on an in-house Okta administrator account. BeyondTrust blocked all access to the threat actor, and verified that they did not gain access to any systems. BeyondTrust has confirmed that there was no additional exposure to our internal systems or BeyondTrust’s customers.",{"data":66896,"content":66897,"nodeType":894},{},[],{"data":66899,"content":66900,"nodeType":904},{},[66901],{"data":66902,"marks":66903,"value":66904,"nodeType":865},{},[],"MGM Resorts — September 2023",{"data":66906,"content":66907,"nodeType":881},{},[66908],{"data":66909,"marks":66910,"value":66911,"nodeType":865},{},[],"The threat group known as Scattered Spider socially engineered MGM help desk personnel to grant ‘super admin’ access to the Okta tenant, which was then used to steal data and deploy ransomware, resulting in significant business disruption. ",{"data":66913,"content":66914,"nodeType":1860},{},[66915],{"data":66916,"marks":66917,"value":66918,"nodeType":865},{},[],"How did MGM get breached?",{"data":66920,"content":66921,"nodeType":1818},{},[66922,66932,66942,66952,66962,66972],{"data":66923,"content":66924,"nodeType":1734},{},[66925],{"data":66926,"content":66927,"nodeType":881},{},[66928],{"data":66929,"marks":66930,"value":66931,"nodeType":865},{},[],"Scattered Spider researched MGM employees on LinkedIn to identify individuals likely to have privileged Okta access, specifically Super Administrator privileges. ",{"data":66933,"content":66934,"nodeType":1734},{},[66935],{"data":66936,"content":66937,"nodeType":881},{},[66938],{"data":66939,"marks":66940,"value":66941,"nodeType":865},{},[],"Scattered Spider contacted the IT help desk impersonating an employee with a privileged account asking for an authentication reset (password and MFA).",{"data":66943,"content":66944,"nodeType":1734},{},[66945],{"data":66946,"content":66947,"nodeType":881},{},[66948],{"data":66949,"marks":66950,"value":66951,"nodeType":865},{},[],"With privileged access, the compromised Super Administrator accounts were used to assign higher privileges to other accounts, circumventing MFA by removing enrolled authenticators and/or removing MFA from authentication policies.",{"data":66953,"content":66954,"nodeType":1734},{},[66955],{"data":66956,"content":66957,"nodeType":881},{},[66958],{"data":66959,"marks":66960,"value":66961,"nodeType":865},{},[],"Scattered Spider registered a second, attacker-controlled IdP via Org2Org using inbound federation, granting the ability to impersonate users and access applications on their behalf. By matching the username of target accounts in the second IdP to the original, the attacker was able to SSO into target applications. ",{"data":66963,"content":66964,"nodeType":1734},{},[66965],{"data":66966,"content":66967,"nodeType":881},{},[66968],{"data":66969,"marks":66970,"value":66971,"nodeType":865},{},[],"Through inbound federation, Scattered Spider obtained global admin rights in Azure, effectively granting full control over connected systems and granting domain admin privileges in target environments.",{"data":66973,"content":66974,"nodeType":1734},{},[66975],{"data":66976,"content":66977,"nodeType":881},{},[66978],{"data":66979,"marks":66980,"value":66981,"nodeType":865},{},[],"Scattered Spider deployed encryption software to around 100 ESXi servers and exfiltrated data, disrupting core business operations.",{"data":66983,"content":66984,"nodeType":1860},{},[66985],{"data":66986,"marks":66987,"value":66988,"nodeType":865},{},[],"What was the impact of the MGM breach?",{"data":66990,"content":66991,"nodeType":1818},{},[66992,67002,67012],{"data":66993,"content":66994,"nodeType":1734},{},[66995],{"data":66996,"content":66997,"nodeType":881},{},[66998],{"data":66999,"marks":67000,"value":67001,"nodeType":865},{},[],"Led to a 36-hour outage of multiple MGM IT systems and affected a number of its casinos on the Las Vegas strip, including the Bellagio, Excalibur, Luxor, Mandalay Bay and New York New York.",{"data":67003,"content":67004,"nodeType":1734},{},[67005],{"data":67006,"content":67007,"nodeType":881},{},[67008],{"data":67009,"marks":67010,"value":67011,"nodeType":865},{},[],"Personal data compromise of an unspecified number of customers including various contact information, dates of births, genders, driver’s license numbers, social security numbers, and passport information. ",{"data":67013,"content":67014,"nodeType":1734},{},[67015],{"data":67016,"content":67017,"nodeType":881},{},[67018],{"data":67019,"marks":67020,"value":67021,"nodeType":865},{},[],"MGM reported that the attack would cause a $100 million hit to its third-quarter results, including $10 million in one-time cyber security consulting fees. ",{"data":67023,"content":67024,"nodeType":1860},{},[67025],{"data":67026,"marks":67027,"value":67028,"nodeType":865},{},[],"What stands out in the MGM breach?",{"data":67030,"content":67031,"nodeType":1818},{},[67032,67042,67052],{"data":67033,"content":67034,"nodeType":1734},{},[67035],{"data":67036,"content":67037,"nodeType":881},{},[67038],{"data":67039,"marks":67040,"value":67041,"nodeType":865},{},[],"The MGM breach demonstrates how financially motivated organized criminal groups are specifically targeting the identity infrastructure of an organization (e.g. the chosen IdP solution) and leveraging cloud-native functionality. ",{"data":67043,"content":67044,"nodeType":1734},{},[67045],{"data":67046,"content":67047,"nodeType":881},{},[67048],{"data":67049,"marks":67050,"value":67051,"nodeType":865},{},[],"The MGM breach is notable for being a hybrid attack that ended in what has become a typical “actions on objective” for ransomware operators and their affiliates - the propagation of malware and encryption of core business servers. In this way attackers are leveraging the newer functionality that cloud services provide them to target non-cloud/on-premise resources. This potentially indicates that attackers see cloud applications and services as the path of least resistance to achieving their goals, exploiting more limited security team visibility and understanding of these services compared to more traditional (now well protected) targets. ",{"data":67053,"content":67054,"nodeType":1734},{},[67055],{"data":67056,"content":67057,"nodeType":881},{},[67058],{"data":67059,"marks":67060,"value":67061,"nodeType":865},{},[],"While attackers were focused on taking control of the cloud IdP, the initial access vector was notable for being a more traditional method (vishing) to bypass the need to acquire credentials (password and MFA token). This type of technique remains consistently effective, regardless of the technology landscape and whether MFA is correctly implemented or not.    ",{"data":67063,"content":67064,"nodeType":1860},{},[67065],{"data":67066,"marks":67067,"value":65779,"nodeType":865},{},[],{"data":67069,"content":67070,"nodeType":881},{},[67071],{"data":67072,"marks":67073,"value":65786,"nodeType":865},{},[],{"data":67075,"content":67076,"nodeType":2270},{},[67077,67116],{"data":67078,"content":67079,"nodeType":2032},{},[67080,67089,67098,67107],{"data":67081,"content":67082,"nodeType":65803},{},[67083],{"data":67084,"content":67085,"nodeType":881},{},[67086],{"data":67087,"marks":67088,"value":65802,"nodeType":865},{},[],{"data":67090,"content":67091,"nodeType":65803},{},[67092],{"data":67093,"content":67094,"nodeType":881},{},[67095],{"data":67096,"marks":67097,"value":66269,"nodeType":865},{},[],{"data":67099,"content":67100,"nodeType":65803},{},[67101],{"data":67102,"content":67103,"nodeType":881},{},[67104],{"data":67105,"marks":67106,"value":65823,"nodeType":865},{},[],{"data":67108,"content":67109,"nodeType":65803},{},[67110],{"data":67111,"content":67112,"nodeType":881},{},[67113],{"data":67114,"marks":67115,"value":65833,"nodeType":865},{},[],{"data":67117,"content":67118,"nodeType":2032},{},[67119,67139,67160,67170],{"data":67120,"content":67121,"nodeType":2021},{},[67122],{"data":67123,"content":67124,"nodeType":881},{},[67125,67128,67136],{"data":67126,"marks":67127,"value":21,"nodeType":865},{},[],{"data":67129,"content":67130,"nodeType":876},{"uri":11271},[67131],{"data":67132,"marks":67133,"value":67135,"nodeType":865},{},[67134],{"type":874},"SAT1041",{"data":67137,"marks":67138,"value":21,"nodeType":865},{},[],{"data":67140,"content":67141,"nodeType":2021},{},[67142],{"data":67143,"content":67144,"nodeType":881},{},[67145,67148,67157],{"data":67146,"marks":67147,"value":21,"nodeType":865},{},[],{"data":67149,"content":67151,"nodeType":876},{"uri":67150},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/inbound-federation",[67152],{"data":67153,"marks":67154,"value":67156,"nodeType":865},{},[67155],{"type":874},"Inbound Federation",{"data":67158,"marks":67159,"value":21,"nodeType":865},{},[],{"data":67161,"content":67162,"nodeType":2021},{},[67163],{"data":67164,"content":67165,"nodeType":881},{},[67166],{"data":67167,"marks":67168,"value":67169,"nodeType":865},{},[],"Persistence; Lateral Movement",{"data":67171,"content":67172,"nodeType":2021},{},[67173],{"data":67174,"content":67175,"nodeType":881},{},[67176],{"data":67177,"marks":67178,"value":67179,"nodeType":865},{},[],"Inbound federation allows users to login to a target identity provider by authenticating with a source identity provider",{"data":67181,"content":67182,"nodeType":894},{},[],{"data":67184,"content":67185,"nodeType":904},{},[67186],{"data":67187,"marks":67188,"value":67189,"nodeType":865},{},[],"Retool — August 2023",{"data":67191,"content":67192,"nodeType":881},{},[67193],{"data":67194,"marks":67195,"value":67196,"nodeType":865},{},[],"Software development company Retool disclosed that the accounts of 27 of its cloud customers were compromised following a targeted SMS-based social engineering attack, which was enabled by Google Authenticator’s default synchronization of MFA tokens with the associated Google account.  ",{"data":67198,"content":67199,"nodeType":1860},{},[67200],{"data":67201,"marks":67202,"value":67203,"nodeType":865},{},[],"How did Retool get breached?",{"data":67205,"content":67206,"nodeType":1818},{},[67207,67217,67227,67237,67247,67257],{"data":67208,"content":67209,"nodeType":1734},{},[67210],{"data":67211,"content":67212,"nodeType":881},{},[67213],{"data":67214,"marks":67215,"value":67216,"nodeType":865},{},[],"The threat actor launched a targeted SMS-based phishing campaign against Retool employees with a custom lure relating to their workplace healthcare coverage.",{"data":67218,"content":67219,"nodeType":1734},{},[67220],{"data":67221,"content":67222,"nodeType":881},{},[67223],{"data":67224,"marks":67225,"value":67226,"nodeType":865},{},[],"The timing coincided with a recently announced migration of logins to Okta, and the message contained a url disguised to look like their internal identity portal.",{"data":67228,"content":67229,"nodeType":1734},{},[67230],{"data":67231,"content":67232,"nodeType":881},{},[67233],{"data":67234,"marks":67235,"value":67236,"nodeType":865},{},[],"After logging into the fake portal – which included an MFA form – the threat actor called the employee impersonating an IT team member, deepfaking the IT employee’s real voice and using real information about the company to build trust.",{"data":67238,"content":67239,"nodeType":1734},{},[67240],{"data":67241,"content":67242,"nodeType":881},{},[67243],{"data":67244,"marks":67245,"value":67246,"nodeType":865},{},[],"The phished employee shared an MFA OTP token which allowed the threat actor to add their own personal device to the employee’s Okta account and enabled their own Okta MFA from that point forward.",{"data":67248,"content":67249,"nodeType":1734},{},[67250],{"data":67251,"content":67252,"nodeType":881},{},[67253],{"data":67254,"marks":67255,"value":67256,"nodeType":865},{},[],"Due to the Google Authenticator synchronization feature that syncs MFA codes to the cloud by default, meaning that access to a Google account immediately gave access to all MFA tokens held within that account.",{"data":67258,"content":67259,"nodeType":1734},{},[67260],{"data":67261,"content":67262,"nodeType":881},{},[67263],{"data":67264,"marks":67265,"value":67266,"nodeType":865},{},[],"This enabled the threat actor to take over a number of identities associated with a range of target apps and change the credentials.",{"data":67268,"content":67269,"nodeType":1860},{},[67270],{"data":67271,"marks":67272,"value":67273,"nodeType":865},{},[],"What was the impact of the Retool breach?",{"data":67275,"content":67276,"nodeType":1818},{},[67277,67287,67297],{"data":67278,"content":67279,"nodeType":1734},{},[67280],{"data":67281,"content":67282,"nodeType":881},{},[67283],{"data":67284,"marks":67285,"value":67286,"nodeType":865},{},[],"A total of 27 customers were impacted, with the threat actor specifically targeting customers in the Crypto industry.",{"data":67288,"content":67289,"nodeType":1734},{},[67290],{"data":67291,"content":67292,"nodeType":881},{},[67293],{"data":67294,"marks":67295,"value":67296,"nodeType":865},{},[],"After taking over the accounts, the threat actor was observed gathering information and exploring the Retool apps.",{"data":67298,"content":67299,"nodeType":1734},{},[67300],{"data":67301,"content":67302,"nodeType":881},{},[67303],{"data":67304,"marks":67305,"value":67306,"nodeType":865},{},[],"After learning of the attack, Retool revoked all internal authenticated sessions (Okta, GSuite, etc.) for employees, locked down access to the affected accounts, notified the affected customers, and restored their accounts to their original state.",{"data":67308,"content":67309,"nodeType":1860},{},[67310],{"data":67311,"marks":67312,"value":67313,"nodeType":865},{},[],"What stands out in the Retool breach?",{"data":67315,"content":67316,"nodeType":1818},{},[67317,67327,67337],{"data":67318,"content":67319,"nodeType":1734},{},[67320],{"data":67321,"content":67322,"nodeType":881},{},[67323],{"data":67324,"marks":67325,"value":67326,"nodeType":865},{},[],"Like the MGM breach, the Retool breach demonstrates how financially motivated organized criminal groups are specifically targeting the identity infrastructure of an organization (e.g. the chosen IdP solution) and leveraging cloud-native functionality. ",{"data":67328,"content":67329,"nodeType":1734},{},[67330],{"data":67331,"content":67332,"nodeType":881},{},[67333],{"data":67334,"marks":67335,"value":67336,"nodeType":865},{},[],"A further similarity with the MGM breach, while attackers were focused on taking control of the cloud IdP, the initial access vector was notable for being a more traditional method (SMS phishing in this case) to bypass the need to acquire credentials (password and MFA token). This type of technique remains consistently effective, regardless of the technology landscape and whether MFA is correctly implemented or not.    ",{"data":67338,"content":67339,"nodeType":1734},{},[67340],{"data":67341,"content":67342,"nodeType":881},{},[67343],{"data":67344,"marks":67345,"value":67346,"nodeType":865},{},[],"In this case, the attacker abused inherent weaknesses in Google Authenticator, which came under fire following the breach for its default synchronization of MFA codes to the cloud when connected to an account, in order to move laterally and compromise other target apps. ",{"data":67348,"content":67349,"nodeType":1860},{},[67350],{"data":67351,"marks":67352,"value":65779,"nodeType":865},{},[],{"data":67354,"content":67355,"nodeType":881},{},[67356],{"data":67357,"marks":67358,"value":65786,"nodeType":865},{},[],{"data":67360,"content":67361,"nodeType":2270},{},[67362,67401,67466],{"data":67363,"content":67364,"nodeType":2032},{},[67365,67374,67383,67392],{"data":67366,"content":67367,"nodeType":65803},{},[67368],{"data":67369,"content":67370,"nodeType":881},{},[67371],{"data":67372,"marks":67373,"value":65802,"nodeType":865},{},[],{"data":67375,"content":67376,"nodeType":65803},{},[67377],{"data":67378,"content":67379,"nodeType":881},{},[67380],{"data":67381,"marks":67382,"value":66269,"nodeType":865},{},[],{"data":67384,"content":67385,"nodeType":65803},{},[67386],{"data":67387,"content":67388,"nodeType":881},{},[67389],{"data":67390,"marks":67391,"value":65823,"nodeType":865},{},[],{"data":67393,"content":67394,"nodeType":65803},{},[67395],{"data":67396,"content":67397,"nodeType":881},{},[67398],{"data":67399,"marks":67400,"value":65833,"nodeType":865},{},[],{"data":67402,"content":67403,"nodeType":2032},{},[67404,67425,67447,67456],{"data":67405,"content":67406,"nodeType":2021},{},[67407],{"data":67408,"content":67409,"nodeType":881},{},[67410,67414,67422],{"data":67411,"marks":67412,"value":21,"nodeType":865},{},[67413],{"type":874},{"data":67415,"content":67416,"nodeType":876},{"uri":42803},[67417],{"data":67418,"marks":67419,"value":67421,"nodeType":865},{},[67420],{"type":874},"SAT1042",{"data":67423,"marks":67424,"value":21,"nodeType":865},{},[],{"data":67426,"content":67427,"nodeType":2021},{},[67428],{"data":67429,"content":67430,"nodeType":881},{},[67431,67435,67444],{"data":67432,"marks":67433,"value":21,"nodeType":865},{},[67434],{"type":874},{"data":67436,"content":67438,"nodeType":876},{"uri":67437},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/aitm-phishing",[67439],{"data":67440,"marks":67441,"value":67443,"nodeType":865},{},[67442],{"type":874},"AiTM Phishing",{"data":67445,"marks":67446,"value":21,"nodeType":865},{},[],{"data":67448,"content":67449,"nodeType":2021},{},[67450],{"data":67451,"content":67452,"nodeType":881},{},[67453],{"data":67454,"marks":67455,"value":66340,"nodeType":865},{},[],{"data":67457,"content":67458,"nodeType":2021},{},[67459],{"data":67460,"content":67461,"nodeType":881},{},[67462],{"data":67463,"marks":67464,"value":67465,"nodeType":865},{},[],"Attacker-in-the-Middle (AiTM) phishing uses dedicated tooling to act as a web proxy between the victim and a legitimate login portal for an application the victim has access to, principally to make it easier to defeat MFA protection.",{"data":67467,"content":67468,"nodeType":2032},{},[67469,67490,67513,67523],{"data":67470,"content":67471,"nodeType":2021},{},[67472],{"data":67473,"content":67474,"nodeType":881},{},[67475,67478,67487],{"data":67476,"marks":67477,"value":21,"nodeType":865},{},[],{"data":67479,"content":67481,"nodeType":876},{"uri":67480},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/device_enrollment/description.md",[67482],{"data":67483,"marks":67484,"value":67486,"nodeType":865},{},[67485],{"type":874},"SAT1043",{"data":67488,"marks":67489,"value":21,"nodeType":865},{},[],{"data":67491,"content":67492,"nodeType":2021},{},[67493],{"data":67494,"content":67495,"nodeType":881},{},[67496,67500,67509],{"data":67497,"marks":67498,"value":21,"nodeType":865},{},[67499],{"type":874},{"data":67501,"content":67503,"nodeType":876},{"uri":67502},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/device-enrollment",[67504],{"data":67505,"marks":67506,"value":67508,"nodeType":865},{},[67507],{"type":874},"Device Enrollment",{"data":67510,"marks":67511,"value":21,"nodeType":865},{},[67512],{"type":874},{"data":67514,"content":67515,"nodeType":2021},{},[67516],{"data":67517,"content":67518,"nodeType":881},{},[67519],{"data":67520,"marks":67521,"value":67522,"nodeType":865},{},[],"Initial Access; Persistence",{"data":67524,"content":67525,"nodeType":2021},{},[67526],{"data":67527,"content":67528,"nodeType":881},{},[67529],{"data":67530,"marks":67531,"value":67532,"nodeType":865},{},[],"Enrollment of a new MFA device in order to allow an adversary to complete MFA challenges for future authentication. ",{"data":67534,"content":67535,"nodeType":894},{},[],{"data":67537,"content":67538,"nodeType":904},{},[67539],{"data":67540,"marks":67541,"value":67542,"nodeType":865},{},[],"GitHub / Heroku / Travis-CI / npm — April 2022",{"data":67544,"content":67545,"nodeType":881},{},[67546],{"data":67547,"marks":67548,"value":67549,"nodeType":865},{},[],"An unknown threat actor used stolen OAuth user tokens (issued to Heroku and Travis-CI) to download data from private repositories. The threat actor then compromised an internal Heroku customer database as well as accessed and stole data from dozens of downstream organizations using Heroku and Travis-CI-maintained OAuth apps.",{"data":67551,"content":67552,"nodeType":1860},{},[67553],{"data":67554,"marks":67555,"value":67556,"nodeType":865},{},[],"How did they get breached?",{"data":67558,"content":67559,"nodeType":1818},{},[67560,67570,67580,67590,67600,67610,67620],{"data":67561,"content":67562,"nodeType":1734},{},[67563],{"data":67564,"content":67565,"nodeType":881},{},[67566],{"data":67567,"marks":67568,"value":67569,"nodeType":865},{},[],"The threat actor obtained access to two third-party OAuth integrators, Heroku and Travis-CI, accessing databases and downloading stored customer GitHub integration OAuth tokens. These tokens had earlier been used by Travis-CI and Heroku OAuth applications to integrate with GitHub to deploy applications.",{"data":67571,"content":67572,"nodeType":1734},{},[67573],{"data":67574,"content":67575,"nodeType":881},{},[67576],{"data":67577,"marks":67578,"value":67579,"nodeType":865},{},[],"Access to the environment was gained by leveraging a compromised token for a Heroku machine account, but it is not disclosed how the threat actor achieved this. ",{"data":67581,"content":67582,"nodeType":1734},{},[67583],{"data":67584,"content":67585,"nodeType":881},{},[67586],{"data":67587,"marks":67588,"value":67589,"nodeType":865},{},[],"The threat actor authenticated to the GitHub API using the stolen OAuth tokens issued to Heroku and Travis CI.",{"data":67591,"content":67592,"nodeType":1734},{},[67593],{"data":67594,"content":67595,"nodeType":881},{},[67596],{"data":67597,"marks":67598,"value":67599,"nodeType":865},{},[],"For users who had the affected Heroku or Travis CI OAuth apps authorized in their GitHub accounts, the threat actor listed all the user's organizations.",{"data":67601,"content":67602,"nodeType":1734},{},[67603],{"data":67604,"content":67605,"nodeType":881},{},[67606],{"data":67607,"marks":67608,"value":67609,"nodeType":865},{},[],"The threat actor then selected targets based on the listed organizations.",{"data":67611,"content":67612,"nodeType":1734},{},[67613],{"data":67614,"content":67615,"nodeType":881},{},[67616],{"data":67617,"marks":67618,"value":67619,"nodeType":865},{},[],"The threat actor listed the private repositories for user accounts of interest and proceeded to clone private repositories of interest.",{"data":67621,"content":67622,"nodeType":1734},{},[67623],{"data":67624,"content":67625,"nodeType":881},{},[67626],{"data":67627,"marks":67628,"value":67629,"nodeType":865},{},[],"GitHub identified unauthorized access to their npm production infrastructure using a compromised AWS API key, obtained by the threat actor when they downloaded a set of private npm repositories using a stolen OAuth token from one of the two affected third-party OAuth applications.",{"data":67631,"content":67632,"nodeType":1860},{},[67633],{"data":67634,"marks":67635,"value":67636,"nodeType":865},{},[],"What was the impact?",{"data":67638,"content":67639,"nodeType":1818},{},[67640,67650,67660],{"data":67641,"content":67642,"nodeType":1734},{},[67643],{"data":67644,"content":67645,"nodeType":881},{},[67646],{"data":67647,"marks":67648,"value":67649,"nodeType":865},{},[],"By stealing these OAuth tokens, the threat actor could access and download data from GitHub repositories belonging to those who authorized the compromised Heroku or Travis CI OAuth apps with their accounts. ",{"data":67651,"content":67652,"nodeType":1734},{},[67653],{"data":67654,"content":67655,"nodeType":881},{},[67656],{"data":67657,"marks":67658,"value":67659,"nodeType":865},{},[],"The threat actor was able to mine the downloaded private repositories for secrets that could be used to pivot to other infrastructure, stealing data from dozens of organizations. ",{"data":67661,"content":67662,"nodeType":1734},{},[67663],{"data":67664,"content":67665,"nodeType":881},{},[67666],{"data":67667,"marks":67668,"value":67669,"nodeType":865},{},[],"In addition to user repo’s downstream, the compromised token for a Heroku machine account obtained by threat actors also allowed unauthorized access into Heroku's internal database of customer accounts, enabling the threat actor to extract the hashed and salted passwords. ",{"data":67671,"content":67672,"nodeType":1860},{},[67673],{"data":67674,"marks":67675,"value":67676,"nodeType":865},{},[],"What stands out in the Github breach?",{"data":67678,"content":67679,"nodeType":1818},{},[67680,67690,67700],{"data":67681,"content":67682,"nodeType":1734},{},[67683],{"data":67684,"content":67685,"nodeType":881},{},[67686],{"data":67687,"marks":67688,"value":67689,"nodeType":865},{},[],"Similar to the Okta breach, this attack showcases the possibility of third-party supply chain attacks to target downstream organizations using cloud SaaS services. In this case, targeting OAuth integrators as opposed to IdP providers, but with a similar goal and impact of compromising the real target organizations downstream. ",{"data":67691,"content":67692,"nodeType":1734},{},[67693],{"data":67694,"content":67695,"nodeType":881},{},[67696],{"data":67697,"marks":67698,"value":67699,"nodeType":865},{},[],"Applications like Github are an obvious target for attackers due to their widespread adoption. There have been numerous attacks leveraging Github as the vehicle for attacks by compromising repo’s to insert malicious code, or registering malicious copycat repo’s to dupe users into using them. ",{"data":67701,"content":67702,"nodeType":1734},{},[67703],{"data":67704,"content":67705,"nodeType":881},{},[67706],{"data":67707,"marks":67708,"value":67709,"nodeType":865},{},[],"Unlike the attacks abusing the functionality of Github (repo poisoning) which target the legitimate developer processes when using the app, this attack could have been prevented at the identity layer before the attacker was able to breach the Heroku/Travis-CI accounts. ",{"data":67711,"content":67712,"nodeType":1860},{},[67713],{"data":67714,"marks":67715,"value":65779,"nodeType":865},{},[],{"data":67717,"content":67718,"nodeType":881},{},[67719],{"data":67720,"marks":67721,"value":65786,"nodeType":865},{},[],{"data":67723,"content":67724,"nodeType":2270},{},[67725,67764,67824,67887],{"data":67726,"content":67727,"nodeType":2032},{},[67728,67737,67746,67755],{"data":67729,"content":67730,"nodeType":65803},{},[67731],{"data":67732,"content":67733,"nodeType":881},{},[67734],{"data":67735,"marks":67736,"value":65802,"nodeType":865},{},[],{"data":67738,"content":67739,"nodeType":65803},{},[67740],{"data":67741,"content":67742,"nodeType":881},{},[67743],{"data":67744,"marks":67745,"value":66269,"nodeType":865},{},[],{"data":67747,"content":67748,"nodeType":65803},{},[67749],{"data":67750,"content":67751,"nodeType":881},{},[67752],{"data":67753,"marks":67754,"value":65823,"nodeType":865},{},[],{"data":67756,"content":67757,"nodeType":65803},{},[67758],{"data":67759,"content":67760,"nodeType":881},{},[67761],{"data":67762,"marks":67763,"value":65833,"nodeType":865},{},[],{"data":67765,"content":67766,"nodeType":2032},{},[67767,67786,67805,67815],{"data":67768,"content":67769,"nodeType":2021},{},[67770],{"data":67771,"content":67772,"nodeType":881},{},[67773,67776,67783],{"data":67774,"marks":67775,"value":21,"nodeType":865},{},[],{"data":67777,"content":67778,"nodeType":876},{"uri":61104},[67779],{"data":67780,"marks":67781,"value":66433,"nodeType":865},{},[67782],{"type":874},{"data":67784,"marks":67785,"value":21,"nodeType":865},{},[],{"data":67787,"content":67788,"nodeType":2021},{},[67789],{"data":67790,"content":67791,"nodeType":881},{},[67792,67795,67802],{"data":67793,"marks":67794,"value":21,"nodeType":865},{},[],{"data":67796,"content":67797,"nodeType":876},{"uri":66448},[67798],{"data":67799,"marks":67800,"value":66454,"nodeType":865},{},[67801],{"type":874},{"data":67803,"marks":67804,"value":21,"nodeType":865},{},[],{"data":67806,"content":67807,"nodeType":2021},{},[67808],{"data":67809,"content":67810,"nodeType":881},{},[67811],{"data":67812,"marks":67813,"value":67814,"nodeType":865},{},[],"Privilege Escalation; Lateral Movement",{"data":67816,"content":67817,"nodeType":2021},{},[67818],{"data":67819,"content":67820,"nodeType":881},{},[67821],{"data":67822,"marks":67823,"value":66477,"nodeType":865},{},[],{"data":67825,"content":67826,"nodeType":2032},{},[67827,67847,67867,67877],{"data":67828,"content":67829,"nodeType":2021},{},[67830],{"data":67831,"content":67832,"nodeType":881},{},[67833,67836,67844],{"data":67834,"marks":67835,"value":21,"nodeType":865},{},[],{"data":67837,"content":67838,"nodeType":876},{"uri":30315},[67839],{"data":67840,"marks":67841,"value":67843,"nodeType":865},{},[67842],{"type":874},"SAT1004",{"data":67845,"marks":67846,"value":21,"nodeType":865},{},[],{"data":67848,"content":67849,"nodeType":2021},{},[67850],{"data":67851,"content":67852,"nodeType":881},{},[67853,67856,67864],{"data":67854,"marks":67855,"value":21,"nodeType":865},{},[],{"data":67857,"content":67859,"nodeType":876},{"uri":67858},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/api-keys",[67860],{"data":67861,"marks":67862,"value":36446,"nodeType":865},{},[67863],{"type":874},{"data":67865,"marks":67866,"value":21,"nodeType":865},{},[],{"data":67868,"content":67869,"nodeType":2021},{},[67870],{"data":67871,"content":67872,"nodeType":881},{},[67873],{"data":67874,"marks":67875,"value":67876,"nodeType":865},{},[],"Persistence; Defense Evasion",{"data":67878,"content":67879,"nodeType":2021},{},[67880],{"data":67881,"content":67882,"nodeType":881},{},[67883],{"data":67884,"marks":67885,"value":67886,"nodeType":865},{},[],"An adversary that has compromised an account could then read existing API keys from the app settings, if the app allows this, or create a new API key.",{"data":67888,"content":67889,"nodeType":2032},{},[67890,67911,67932,67942],{"data":67891,"content":67892,"nodeType":2021},{},[67893],{"data":67894,"content":67895,"nodeType":881},{},[67896,67899,67908],{"data":67897,"marks":67898,"value":21,"nodeType":865},{},[],{"data":67900,"content":67902,"nodeType":876},{"uri":67901},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/app_directory_lookup/description.md#app-directory-lookup",[67903],{"data":67904,"marks":67905,"value":67907,"nodeType":865},{},[67906],{"type":874},"SAT1006",{"data":67909,"marks":67910,"value":21,"nodeType":865},{},[],{"data":67912,"content":67913,"nodeType":2021},{},[67914],{"data":67915,"content":67916,"nodeType":881},{},[67917,67920,67929],{"data":67918,"marks":67919,"value":21,"nodeType":865},{},[],{"data":67921,"content":67923,"nodeType":876},{"uri":67922},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/app-directory-lookup",[67924],{"data":67925,"marks":67926,"value":67928,"nodeType":865},{},[67927],{"type":874},"App directory lookup",{"data":67930,"marks":67931,"value":21,"nodeType":865},{},[],{"data":67933,"content":67934,"nodeType":2021},{},[67935],{"data":67936,"content":67937,"nodeType":881},{},[67938],{"data":67939,"marks":67940,"value":67941,"nodeType":865},{},[],"Discovery",{"data":67943,"content":67944,"nodeType":2021},{},[67945],{"data":67946,"content":67947,"nodeType":881},{},[67948],{"data":67949,"marks":67950,"value":67951,"nodeType":865},{},[],"An adversary who has gained a foothold via a SaaS app could download the list of users accessible to them in order to better target attacks against other users.",{"data":67953,"content":67954,"nodeType":894},{},[],{"data":67956,"content":67957,"nodeType":904},{},[67958],{"data":67959,"marks":67960,"value":67961,"nodeType":865},{},[],"Other notable attacks",{"data":67963,"content":67964,"nodeType":1860},{},[67965],{"data":67966,"marks":67967,"value":67968,"nodeType":865},{},[],"SEC X hack — January 2024",{"data":67970,"content":67971,"nodeType":881},{},[67972],{"data":67973,"marks":67974,"value":67975,"nodeType":865},{},[],"The X account for the U.S. Securities and Exchange Commission was victim to a SIM swapping attack, whereupon the attacker used the social media platform to issue a fake announcement on the approval of Bitcoin ETFs on security exchanges.",{"data":67977,"content":67978,"nodeType":881},{},[67979],{"data":67980,"marks":67981,"value":67982,"nodeType":865},{},[],"Once the threat actors controlled the number, they reset the password for the @SECGov account, and created the fake announcement. The SEC also confirmed that multi-factor authentication was not enabled on the account, as they had asked X support to disable it when they encountered problems logging into the account.",{"data":67984,"content":67985,"nodeType":894},{},[],{"data":67987,"content":67988,"nodeType":1860},{},[67989],{"data":67990,"marks":67991,"value":67992,"nodeType":865},{},[],"Mandiant X hack — January 2024",{"data":67994,"content":67995,"nodeType":881},{},[67996],{"data":67997,"marks":67998,"value":67999,"nodeType":865},{},[],"The X account for Mandiant was hacked by a Drainer-as-a-Service (DaaS) gang in a brute force attack. MFA was not enabled on the account. The threat actor used the social media account to share links redirecting to a phishing page to steal cryptocurrency. ",{"data":68001,"content":68002,"nodeType":881},{},[68003],{"data":68004,"marks":68005,"value":68006,"nodeType":865},{},[],"The attacker used a wallet drainer dubbed CLINKSINK. This same drainer has been used since December to steal funds and tokens from users of Solana cryptocurrency as part of a large-scale campaign involving at least 35 affiliate IDs linked to a shared DaaS.",{"data":68008,"content":68009,"nodeType":894},{},[],{"data":68011,"content":68012,"nodeType":1860},{},[68013],{"data":68014,"marks":68015,"value":68016,"nodeType":865},{},[],"23andMe data breach — April 2023",{"data":68018,"content":68019,"nodeType":881},{},[68020],{"data":68021,"marks":68022,"value":68023,"nodeType":865},{},[],"Genetic testing provider 23andMe confirmed that hackers downloaded the data of 6.9 million people of the existing 14 million customers after breaching around 14,000 user accounts. ",{"data":68025,"content":68026,"nodeType":881},{},[68027],{"data":68028,"marks":68029,"value":68030,"nodeType":865},{},[],"The attacker stole health reports and raw genotype data of customers affected by a credential stuffing attack that went unnoticed for five months, from April 29 to September 27. ",{"data":68032,"content":68033,"nodeType":881},{},[68034],{"data":68035,"marks":68036,"value":68037,"nodeType":865},{},[],"The credentials used by the attackers to breach the customers' accounts were stolen in other data breaches or used on previously compromised online platforms, and targeted accounts without MFA. ","Tracking identity-based attacks in the wild","To help organizations keep track of how browser-based identity attacks are evolving, we've put together this index of recent breaches.","2024-03-21T00:00:00.000Z","identity-attacks-in-the-wild",{"items":68043},[68044,68046],{"sys":68045,"name":4507},{"id":4506},{"sys":68047,"name":342},{"id":4510},{"items":68049},[68050],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":68051},{"url":5377},{"__typename":1485,"sys":68053,"content":68054,"title":56395,"synopsis":56396,"hashTags":59,"publishedDate":56397,"slug":56398,"tagsCollection":68731,"authorsCollection":68737},{"id":55609},{"json":68055},{"data":68056,"content":68057,"nodeType":1463},{},[68058,68063,68069,68111,68117,68123,68136,68142,68148,68217,68223,68228,68234,68240,68253,68259,68265,68285,68305,68310,68327,68333,68339,68366,68372,68378,68383,68400,68406,68412,68418,68424,68429,68446,68452,68458,68464,68470,68475,68492,68498,68504,68509,68526,68532,68538,68544,68586,68592,68653,68666,68671,68677,68683,68689,68695,68710,68716],{"data":68059,"content":68062,"nodeType":890},{"target":68060},{"sys":68061},{"id":55618,"type":887,"linkType":888},[],{"data":68064,"content":68065,"nodeType":881},{},[68066],{"data":68067,"marks":68068,"value":55626,"nodeType":865},{},[],{"data":68070,"content":68071,"nodeType":881},{},[68072,68075,68081,68084,68090,68093,68099,68102,68108],{"data":68073,"marks":68074,"value":55633,"nodeType":865},{},[],{"data":68076,"content":68077,"nodeType":876},{"uri":55636},[68078],{"data":68079,"marks":68080,"value":55641,"nodeType":865},{},[],{"data":68082,"marks":68083,"value":2091,"nodeType":865},{},[],{"data":68085,"content":68086,"nodeType":876},{"uri":55647},[68087],{"data":68088,"marks":68089,"value":55652,"nodeType":865},{},[],{"data":68091,"marks":68092,"value":2091,"nodeType":865},{},[],{"data":68094,"content":68095,"nodeType":876},{"uri":11576},[68096],{"data":68097,"marks":68098,"value":55662,"nodeType":865},{},[],{"data":68100,"marks":68101,"value":2091,"nodeType":865},{},[],{"data":68103,"content":68104,"nodeType":876},{"uri":55668},[68105],{"data":68106,"marks":68107,"value":55673,"nodeType":865},{},[],{"data":68109,"marks":68110,"value":55677,"nodeType":865},{},[],{"data":68112,"content":68113,"nodeType":881},{},[68114],{"data":68115,"marks":68116,"value":55684,"nodeType":865},{},[],{"data":68118,"content":68119,"nodeType":881},{},[68120],{"data":68121,"marks":68122,"value":55691,"nodeType":865},{},[],{"data":68124,"content":68125,"nodeType":881},{},[68126,68129,68133],{"data":68127,"marks":68128,"value":55698,"nodeType":865},{},[],{"data":68130,"marks":68131,"value":55703,"nodeType":865},{},[68132],{"type":902},{"data":68134,"marks":68135,"value":959,"nodeType":865},{},[],{"data":68137,"content":68138,"nodeType":881},{},[68139],{"data":68140,"marks":68141,"value":55713,"nodeType":865},{},[],{"data":68143,"content":68144,"nodeType":881},{},[68145],{"data":68146,"marks":68147,"value":55720,"nodeType":865},{},[],{"data":68149,"content":68150,"nodeType":1818},{},[68151,68176],{"data":68152,"content":68153,"nodeType":1734},{},[68154],{"data":68155,"content":68156,"nodeType":881},{},[68157,68161,68164,68173],{"data":68158,"marks":68159,"value":55734,"nodeType":865},{},[68160],{"type":902},{"data":68162,"marks":68163,"value":55738,"nodeType":865},{},[],{"data":68165,"content":68168,"nodeType":19000},{"target":68166},{"sys":68167},{"id":55743,"type":887,"linkType":888},[68169],{"data":68170,"marks":68171,"value":55749,"nodeType":865},{},[68172],{"type":902},{"data":68174,"marks":68175,"value":55753,"nodeType":865},{},[],{"data":68177,"content":68178,"nodeType":1734},{},[68179],{"data":68180,"content":68181,"nodeType":881},{},[68182,68186,68189,68195,68198,68204,68207,68214],{"data":68183,"marks":68184,"value":55764,"nodeType":865},{},[68185],{"type":902},{"data":68187,"marks":68188,"value":55768,"nodeType":865},{},[],{"data":68190,"content":68191,"nodeType":876},{"uri":55771},[68192],{"data":68193,"marks":68194,"value":55776,"nodeType":865},{},[],{"data":68196,"marks":68197,"value":1877,"nodeType":865},{},[],{"data":68199,"content":68200,"nodeType":876},{"uri":55782},[68201],{"data":68202,"marks":68203,"value":55787,"nodeType":865},{},[],{"data":68205,"marks":68206,"value":55791,"nodeType":865},{},[],{"data":68208,"content":68209,"nodeType":876},{"uri":55794},[68210],{"data":68211,"marks":68212,"value":55800,"nodeType":865},{},[68213],{"type":902},{"data":68215,"marks":68216,"value":55804,"nodeType":865},{},[],{"data":68218,"content":68219,"nodeType":881},{},[68220],{"data":68221,"marks":68222,"value":55811,"nodeType":865},{},[],{"data":68224,"content":68227,"nodeType":890},{"target":68225},{"sys":68226},{"id":55816,"type":887,"linkType":888},[],{"data":68229,"content":68230,"nodeType":904},{},[68231],{"data":68232,"marks":68233,"value":55824,"nodeType":865},{},[],{"data":68235,"content":68236,"nodeType":881},{},[68237],{"data":68238,"marks":68239,"value":55831,"nodeType":865},{},[],{"data":68241,"content":68242,"nodeType":881},{},[68243,68246,68250],{"data":68244,"marks":68245,"value":55838,"nodeType":865},{},[],{"data":68247,"marks":68248,"value":55749,"nodeType":865},{},[68249],{"type":902},{"data":68251,"marks":68252,"value":55846,"nodeType":865},{},[],{"data":68254,"content":68255,"nodeType":881},{},[68256],{"data":68257,"marks":68258,"value":55853,"nodeType":865},{},[],{"data":68260,"content":68261,"nodeType":1860},{},[68262],{"data":68263,"marks":68264,"value":19214,"nodeType":865},{},[],{"data":68266,"content":68267,"nodeType":881},{},[68268,68271,68275,68278,68282],{"data":68269,"marks":68270,"value":55866,"nodeType":865},{},[],{"data":68272,"marks":68273,"value":55871,"nodeType":865},{},[68274],{"type":902},{"data":68276,"marks":68277,"value":1651,"nodeType":865},{},[],{"data":68279,"marks":68280,"value":55879,"nodeType":865},{},[68281],{"type":902},{"data":68283,"marks":68284,"value":959,"nodeType":865},{},[],{"data":68286,"content":68287,"nodeType":881},{},[68288,68291,68295,68298,68302],{"data":68289,"marks":68290,"value":55889,"nodeType":865},{},[],{"data":68292,"marks":68293,"value":55894,"nodeType":865},{},[68294],{"type":902},{"data":68296,"marks":68297,"value":8048,"nodeType":865},{},[],{"data":68299,"marks":68300,"value":55902,"nodeType":865},{},[68301],{"type":902},{"data":68303,"marks":68304,"value":55906,"nodeType":865},{},[],{"data":68306,"content":68309,"nodeType":890},{"target":68307},{"sys":68308},{"id":55911,"type":887,"linkType":888},[],{"data":68311,"content":68312,"nodeType":881},{},[68313,68316,68324],{"data":68314,"marks":68315,"value":55919,"nodeType":865},{},[],{"data":68317,"content":68320,"nodeType":19000},{"target":68318},{"sys":68319},{"id":55924,"type":887,"linkType":888},[68321],{"data":68322,"marks":68323,"value":55929,"nodeType":865},{},[],{"data":68325,"marks":68326,"value":21,"nodeType":865},{},[],{"data":68328,"content":68329,"nodeType":1860},{},[68330],{"data":68331,"marks":68332,"value":43665,"nodeType":865},{},[],{"data":68334,"content":68335,"nodeType":881},{},[68336],{"data":68337,"marks":68338,"value":55945,"nodeType":865},{},[],{"data":68340,"content":68341,"nodeType":881},{},[68342,68345,68349,68352,68356,68359,68363],{"data":68343,"marks":68344,"value":55952,"nodeType":865},{},[],{"data":68346,"marks":68347,"value":55894,"nodeType":865},{},[68348],{"type":902},{"data":68350,"marks":68351,"value":8048,"nodeType":865},{},[],{"data":68353,"marks":68354,"value":55902,"nodeType":865},{},[68355],{"type":902},{"data":68357,"marks":68358,"value":55967,"nodeType":865},{},[],{"data":68360,"marks":68361,"value":55972,"nodeType":865},{},[68362],{"type":902},{"data":68364,"marks":68365,"value":55976,"nodeType":865},{},[],{"data":68367,"content":68368,"nodeType":881},{},[68369],{"data":68370,"marks":68371,"value":55983,"nodeType":865},{},[],{"data":68373,"content":68374,"nodeType":881},{},[68375],{"data":68376,"marks":68377,"value":55990,"nodeType":865},{},[],{"data":68379,"content":68382,"nodeType":890},{"target":68380},{"sys":68381},{"id":55995,"type":887,"linkType":888},[],{"data":68384,"content":68385,"nodeType":881},{},[68386,68389,68397],{"data":68387,"marks":68388,"value":55919,"nodeType":865},{},[],{"data":68390,"content":68393,"nodeType":19000},{"target":68391},{"sys":68392},{"id":19725,"type":887,"linkType":888},[68394],{"data":68395,"marks":68396,"value":43665,"nodeType":865},{},[],{"data":68398,"marks":68399,"value":21,"nodeType":865},{},[],{"data":68401,"content":68402,"nodeType":1860},{},[68403],{"data":68404,"marks":68405,"value":56020,"nodeType":865},{},[],{"data":68407,"content":68408,"nodeType":881},{},[68409],{"data":68410,"marks":68411,"value":56027,"nodeType":865},{},[],{"data":68413,"content":68414,"nodeType":881},{},[68415],{"data":68416,"marks":68417,"value":56034,"nodeType":865},{},[],{"data":68419,"content":68420,"nodeType":881},{},[68421],{"data":68422,"marks":68423,"value":56041,"nodeType":865},{},[],{"data":68425,"content":68428,"nodeType":890},{"target":68426},{"sys":68427},{"id":56046,"type":887,"linkType":888},[],{"data":68430,"content":68431,"nodeType":881},{},[68432,68435,68443],{"data":68433,"marks":68434,"value":55919,"nodeType":865},{},[],{"data":68436,"content":68439,"nodeType":19000},{"target":68437},{"sys":68438},{"id":56058,"type":887,"linkType":888},[68440],{"data":68441,"marks":68442,"value":56020,"nodeType":865},{},[],{"data":68444,"marks":68445,"value":21,"nodeType":865},{},[],{"data":68447,"content":68448,"nodeType":1860},{},[68449],{"data":68450,"marks":68451,"value":56072,"nodeType":865},{},[],{"data":68453,"content":68454,"nodeType":881},{},[68455],{"data":68456,"marks":68457,"value":56079,"nodeType":865},{},[],{"data":68459,"content":68460,"nodeType":881},{},[68461],{"data":68462,"marks":68463,"value":56086,"nodeType":865},{},[],{"data":68465,"content":68466,"nodeType":881},{},[68467],{"data":68468,"marks":68469,"value":56093,"nodeType":865},{},[],{"data":68471,"content":68474,"nodeType":890},{"target":68472},{"sys":68473},{"id":56098,"type":887,"linkType":888},[],{"data":68476,"content":68477,"nodeType":881},{},[68478,68481,68489],{"data":68479,"marks":68480,"value":55919,"nodeType":865},{},[],{"data":68482,"content":68485,"nodeType":19000},{"target":68483},{"sys":68484},{"id":56110,"type":887,"linkType":888},[68486],{"data":68487,"marks":68488,"value":56115,"nodeType":865},{},[],{"data":68490,"marks":68491,"value":21,"nodeType":865},{},[],{"data":68493,"content":68494,"nodeType":1860},{},[68495],{"data":68496,"marks":68497,"value":56125,"nodeType":865},{},[],{"data":68499,"content":68500,"nodeType":881},{},[68501],{"data":68502,"marks":68503,"value":56132,"nodeType":865},{},[],{"data":68505,"content":68508,"nodeType":890},{"target":68506},{"sys":68507},{"id":56137,"type":887,"linkType":888},[],{"data":68510,"content":68511,"nodeType":881},{},[68512,68515,68523],{"data":68513,"marks":68514,"value":55919,"nodeType":865},{},[],{"data":68516,"content":68519,"nodeType":19000},{"target":68517},{"sys":68518},{"id":56149,"type":887,"linkType":888},[68520],{"data":68521,"marks":68522,"value":44463,"nodeType":865},{},[],{"data":68524,"marks":68525,"value":21,"nodeType":865},{},[],{"data":68527,"content":68528,"nodeType":904},{},[68529],{"data":68530,"marks":68531,"value":56163,"nodeType":865},{},[],{"data":68533,"content":68534,"nodeType":881},{},[68535],{"data":68536,"marks":68537,"value":56170,"nodeType":865},{},[],{"data":68539,"content":68540,"nodeType":881},{},[68541],{"data":68542,"marks":68543,"value":56177,"nodeType":865},{},[],{"data":68545,"content":68546,"nodeType":1818},{},[68547,68560,68573],{"data":68548,"content":68549,"nodeType":1734},{},[68550],{"data":68551,"content":68552,"nodeType":881},{},[68553,68557],{"data":68554,"marks":68555,"value":56191,"nodeType":865},{},[68556],{"type":902},{"data":68558,"marks":68559,"value":56195,"nodeType":865},{},[],{"data":68561,"content":68562,"nodeType":1734},{},[68563],{"data":68564,"content":68565,"nodeType":881},{},[68566,68570],{"data":68567,"marks":68568,"value":56206,"nodeType":865},{},[68569],{"type":902},{"data":68571,"marks":68572,"value":56210,"nodeType":865},{},[],{"data":68574,"content":68575,"nodeType":1734},{},[68576],{"data":68577,"content":68578,"nodeType":881},{},[68579,68583],{"data":68580,"marks":68581,"value":56221,"nodeType":865},{},[68582],{"type":902},{"data":68584,"marks":68585,"value":56225,"nodeType":865},{},[],{"data":68587,"content":68588,"nodeType":881},{},[68589],{"data":68590,"marks":68591,"value":56232,"nodeType":865},{},[],{"data":68593,"content":68594,"nodeType":1818},{},[68595,68611,68627,68640],{"data":68596,"content":68597,"nodeType":1734},{},[68598],{"data":68599,"content":68600,"nodeType":881},{},[68601,68604,68608],{"data":68602,"marks":68603,"value":56245,"nodeType":865},{},[],{"data":68605,"marks":68606,"value":56250,"nodeType":865},{},[68607],{"type":902},{"data":68609,"marks":68610,"value":56254,"nodeType":865},{},[],{"data":68612,"content":68613,"nodeType":1734},{},[68614],{"data":68615,"content":68616,"nodeType":881},{},[68617,68620,68624],{"data":68618,"marks":68619,"value":56264,"nodeType":865},{},[],{"data":68621,"marks":68622,"value":56269,"nodeType":865},{},[68623],{"type":902},{"data":68625,"marks":68626,"value":56273,"nodeType":865},{},[],{"data":68628,"content":68629,"nodeType":1734},{},[68630],{"data":68631,"content":68632,"nodeType":881},{},[68633,68637],{"data":68634,"marks":68635,"value":56284,"nodeType":865},{},[68636],{"type":902},{"data":68638,"marks":68639,"value":56288,"nodeType":865},{},[],{"data":68641,"content":68642,"nodeType":1734},{},[68643],{"data":68644,"content":68645,"nodeType":881},{},[68646,68650],{"data":68647,"marks":68648,"value":56299,"nodeType":865},{},[68649],{"type":902},{"data":68651,"marks":68652,"value":56303,"nodeType":865},{},[],{"data":68654,"content":68655,"nodeType":881},{},[68656,68659,68663],{"data":68657,"marks":68658,"value":56310,"nodeType":865},{},[],{"data":68660,"marks":68661,"value":55800,"nodeType":865},{},[68662],{"type":902},{"data":68664,"marks":68665,"value":56318,"nodeType":865},{},[],{"data":68667,"content":68670,"nodeType":890},{"target":68668},{"sys":68669},{"id":56323,"type":887,"linkType":888},[],{"data":68672,"content":68673,"nodeType":881},{},[68674],{"data":68675,"marks":68676,"value":56331,"nodeType":865},{},[],{"data":68678,"content":68679,"nodeType":904},{},[68680],{"data":68681,"marks":68682,"value":56338,"nodeType":865},{},[],{"data":68684,"content":68685,"nodeType":881},{},[68686],{"data":68687,"marks":68688,"value":56345,"nodeType":865},{},[],{"data":68690,"content":68691,"nodeType":881},{},[68692],{"data":68693,"marks":68694,"value":56352,"nodeType":865},{},[],{"data":68696,"content":68697,"nodeType":881},{},[68698,68701,68707],{"data":68699,"marks":68700,"value":56359,"nodeType":865},{},[],{"data":68702,"content":68703,"nodeType":876},{"uri":55782},[68704],{"data":68705,"marks":68706,"value":56366,"nodeType":865},{},[],{"data":68708,"marks":68709,"value":56370,"nodeType":865},{},[],{"data":68711,"content":68712,"nodeType":904},{},[68713],{"data":68714,"marks":68715,"value":30636,"nodeType":865},{},[],{"data":68717,"content":68718,"nodeType":881},{},[68719,68722,68728],{"data":68720,"marks":68721,"value":56383,"nodeType":865},{},[],{"data":68723,"content":68724,"nodeType":876},{"uri":56386},[68725],{"data":68726,"marks":68727,"value":1458,"nodeType":865},{},[],{"data":68729,"marks":68730,"value":56394,"nodeType":865},{},[],{"items":68732},[68733,68735],{"sys":68734,"name":56404},{"id":56403},{"sys":68736,"name":342},{"id":4510},{"items":68738},[68739],{"fullName":20080,"firstName":20081,"jobTitle":20082,"profilePicture":68740},{"url":20084},{"__typename":1485,"sys":68742,"content":68743,"title":54376,"synopsis":54377,"hashTags":59,"publishedDate":54378,"slug":54379,"tagsCollection":69461,"authorsCollection":69467},{"id":53556},{"json":68744},{"data":68745,"content":68746,"nodeType":1463},{},[68747,68753,68759,68765,68791,68797,68803,68818,68824,68830,68845,68851,68857,68863,68868,68874,68913,68919,68925,68931,68952,68958,68964,68970,69012,69018,69024,69030,69036,69046,69052,69059,69065,69094,69100,69106,69112,69118,69178,69185,69191,69197,69227,69233,69240,69246,69252,69262,69275,69301,69317,69323,69338,69344,69350,69365,69371,69377,69383,69413,69419,69435,69450,69455],{"data":68748,"content":68749,"nodeType":881},{},[68750],{"data":68751,"marks":68752,"value":53567,"nodeType":865},{},[],{"data":68754,"content":68755,"nodeType":881},{},[68756],{"data":68757,"marks":68758,"value":53574,"nodeType":865},{},[],{"data":68760,"content":68761,"nodeType":881},{},[68762],{"data":68763,"marks":68764,"value":53581,"nodeType":865},{},[],{"data":68766,"content":68767,"nodeType":881},{},[68768,68771,68778,68781,68788],{"data":68769,"marks":68770,"value":21,"nodeType":865},{},[],{"data":68772,"content":68773,"nodeType":876},{"uri":11116},[68774],{"data":68775,"marks":68776,"value":395,"nodeType":865},{},[68777],{"type":874},{"data":68779,"marks":68780,"value":53598,"nodeType":865},{},[],{"data":68782,"content":68783,"nodeType":876},{"uri":53601},[68784],{"data":68785,"marks":68786,"value":53607,"nodeType":865},{},[68787],{"type":874},{"data":68789,"marks":68790,"value":53611,"nodeType":865},{},[],{"data":68792,"content":68793,"nodeType":904},{},[68794],{"data":68795,"marks":68796,"value":53618,"nodeType":865},{},[],{"data":68798,"content":68799,"nodeType":881},{},[68800],{"data":68801,"marks":68802,"value":53625,"nodeType":865},{},[],{"data":68804,"content":68805,"nodeType":881},{},[68806,68809,68815],{"data":68807,"marks":68808,"value":53632,"nodeType":865},{},[],{"data":68810,"content":68811,"nodeType":876},{"uri":30250},[68812],{"data":68813,"marks":68814,"value":53639,"nodeType":865},{},[],{"data":68816,"marks":68817,"value":14775,"nodeType":865},{},[],{"data":68819,"content":68820,"nodeType":1860},{},[68821],{"data":68822,"marks":68823,"value":53649,"nodeType":865},{},[],{"data":68825,"content":68826,"nodeType":881},{},[68827],{"data":68828,"marks":68829,"value":53656,"nodeType":865},{},[],{"data":68831,"content":68832,"nodeType":881},{},[68833,68836,68842],{"data":68834,"marks":68835,"value":53663,"nodeType":865},{},[],{"data":68837,"content":68838,"nodeType":876},{"uri":30250},[68839],{"data":68840,"marks":68841,"value":53670,"nodeType":865},{},[],{"data":68843,"marks":68844,"value":53674,"nodeType":865},{},[],{"data":68846,"content":68847,"nodeType":881},{},[68848],{"data":68849,"marks":68850,"value":53681,"nodeType":865},{},[],{"data":68852,"content":68853,"nodeType":1860},{},[68854],{"data":68855,"marks":68856,"value":53688,"nodeType":865},{},[],{"data":68858,"content":68859,"nodeType":881},{},[68860],{"data":68861,"marks":68862,"value":53695,"nodeType":865},{},[],{"data":68864,"content":68867,"nodeType":890},{"target":68865},{"sys":68866},{"id":53700,"type":887,"linkType":888},[],{"data":68869,"content":68870,"nodeType":881},{},[68871],{"data":68872,"marks":68873,"value":53708,"nodeType":865},{},[],{"data":68875,"content":68876,"nodeType":1818},{},[68877,68886,68895,68904],{"data":68878,"content":68879,"nodeType":1734},{},[68880],{"data":68881,"content":68882,"nodeType":881},{},[68883],{"data":68884,"marks":68885,"value":53721,"nodeType":865},{},[],{"data":68887,"content":68888,"nodeType":1734},{},[68889],{"data":68890,"content":68891,"nodeType":881},{},[68892],{"data":68893,"marks":68894,"value":53731,"nodeType":865},{},[],{"data":68896,"content":68897,"nodeType":1734},{},[68898],{"data":68899,"content":68900,"nodeType":881},{},[68901],{"data":68902,"marks":68903,"value":53741,"nodeType":865},{},[],{"data":68905,"content":68906,"nodeType":1734},{},[68907],{"data":68908,"content":68909,"nodeType":881},{},[68910],{"data":68911,"marks":68912,"value":53751,"nodeType":865},{},[],{"data":68914,"content":68915,"nodeType":881},{},[68916],{"data":68917,"marks":68918,"value":53758,"nodeType":865},{},[],{"data":68920,"content":68921,"nodeType":1860},{},[68922],{"data":68923,"marks":68924,"value":53765,"nodeType":865},{},[],{"data":68926,"content":68927,"nodeType":881},{},[68928],{"data":68929,"marks":68930,"value":53772,"nodeType":865},{},[],{"data":68932,"content":68933,"nodeType":1818},{},[68934,68943],{"data":68935,"content":68936,"nodeType":1734},{},[68937],{"data":68938,"content":68939,"nodeType":881},{},[68940],{"data":68941,"marks":68942,"value":53785,"nodeType":865},{},[],{"data":68944,"content":68945,"nodeType":1734},{},[68946],{"data":68947,"content":68948,"nodeType":881},{},[68949],{"data":68950,"marks":68951,"value":53795,"nodeType":865},{},[],{"data":68953,"content":68954,"nodeType":881},{},[68955],{"data":68956,"marks":68957,"value":53802,"nodeType":865},{},[],{"data":68959,"content":68960,"nodeType":1860},{},[68961],{"data":68962,"marks":68963,"value":53809,"nodeType":865},{},[],{"data":68965,"content":68966,"nodeType":881},{},[68967],{"data":68968,"marks":68969,"value":53816,"nodeType":865},{},[],{"data":68971,"content":68972,"nodeType":1818},{},[68973,68986,68999],{"data":68974,"content":68975,"nodeType":1734},{},[68976],{"data":68977,"content":68978,"nodeType":881},{},[68979,68983],{"data":68980,"marks":68981,"value":53830,"nodeType":865},{},[68982],{"type":902},{"data":68984,"marks":68985,"value":53834,"nodeType":865},{},[],{"data":68987,"content":68988,"nodeType":1734},{},[68989],{"data":68990,"content":68991,"nodeType":881},{},[68992,68996],{"data":68993,"marks":68994,"value":53845,"nodeType":865},{},[68995],{"type":902},{"data":68997,"marks":68998,"value":53849,"nodeType":865},{},[],{"data":69000,"content":69001,"nodeType":1734},{},[69002],{"data":69003,"content":69004,"nodeType":881},{},[69005,69009],{"data":69006,"marks":69007,"value":53860,"nodeType":865},{},[69008],{"type":902},{"data":69010,"marks":69011,"value":53864,"nodeType":865},{},[],{"data":69013,"content":69014,"nodeType":881},{},[69015],{"data":69016,"marks":69017,"value":53871,"nodeType":865},{},[],{"data":69019,"content":69020,"nodeType":881},{},[69021],{"data":69022,"marks":69023,"value":53878,"nodeType":865},{},[],{"data":69025,"content":69026,"nodeType":881},{},[69027],{"data":69028,"marks":69029,"value":53885,"nodeType":865},{},[],{"data":69031,"content":69032,"nodeType":904},{},[69033],{"data":69034,"marks":69035,"value":53892,"nodeType":865},{},[],{"data":69037,"content":69038,"nodeType":881},{},[69039,69043],{"data":69040,"marks":69041,"value":53900,"nodeType":865},{},[69042],{"type":902},{"data":69044,"marks":69045,"value":53904,"nodeType":865},{},[],{"data":69047,"content":69048,"nodeType":881},{},[69049],{"data":69050,"marks":69051,"value":53911,"nodeType":865},{},[],{"data":69053,"content":69054,"nodeType":881},{},[69055],{"data":69056,"marks":69057,"value":53919,"nodeType":865},{},[69058],{"type":902},{"data":69060,"content":69061,"nodeType":881},{},[69062],{"data":69063,"marks":69064,"value":53926,"nodeType":865},{},[],{"data":69066,"content":69067,"nodeType":1818},{},[69068,69081],{"data":69069,"content":69070,"nodeType":1734},{},[69071],{"data":69072,"content":69073,"nodeType":881},{},[69074,69078],{"data":69075,"marks":69076,"value":53940,"nodeType":865},{},[69077],{"type":902},{"data":69079,"marks":69080,"value":53944,"nodeType":865},{},[],{"data":69082,"content":69083,"nodeType":1734},{},[69084],{"data":69085,"content":69086,"nodeType":881},{},[69087,69091],{"data":69088,"marks":69089,"value":53955,"nodeType":865},{},[69090],{"type":902},{"data":69092,"marks":69093,"value":53959,"nodeType":865},{},[],{"data":69095,"content":69096,"nodeType":881},{},[69097],{"data":69098,"marks":69099,"value":53966,"nodeType":865},{},[],{"data":69101,"content":69102,"nodeType":1860},{},[69103],{"data":69104,"marks":69105,"value":53973,"nodeType":865},{},[],{"data":69107,"content":69108,"nodeType":881},{},[69109],{"data":69110,"marks":69111,"value":53980,"nodeType":865},{},[],{"data":69113,"content":69114,"nodeType":881},{},[69115],{"data":69116,"marks":69117,"value":53987,"nodeType":865},{},[],{"data":69119,"content":69120,"nodeType":1818},{},[69121,69140,69159],{"data":69122,"content":69123,"nodeType":1734},{},[69124],{"data":69125,"content":69126,"nodeType":881},{},[69127,69130,69137],{"data":69128,"marks":69129,"value":54000,"nodeType":865},{},[],{"data":69131,"content":69132,"nodeType":876},{"uri":43794},[69133],{"data":69134,"marks":69135,"value":1718,"nodeType":865},{},[69136],{"type":874},{"data":69138,"marks":69139,"value":30302,"nodeType":865},{},[],{"data":69141,"content":69142,"nodeType":1734},{},[69143],{"data":69144,"content":69145,"nodeType":881},{},[69146,69149,69156],{"data":69147,"marks":69148,"value":54020,"nodeType":865},{},[],{"data":69150,"content":69151,"nodeType":876},{"uri":41391},[69152],{"data":69153,"marks":69154,"value":11582,"nodeType":865},{},[69155],{"type":874},{"data":69157,"marks":69158,"value":30302,"nodeType":865},{},[],{"data":69160,"content":69161,"nodeType":1734},{},[69162],{"data":69163,"content":69164,"nodeType":881},{},[69165,69168,69175],{"data":69166,"marks":69167,"value":54040,"nodeType":865},{},[],{"data":69169,"content":69170,"nodeType":876},{"uri":54043},[69171],{"data":69172,"marks":69173,"value":54049,"nodeType":865},{},[69174],{"type":874},{"data":69176,"marks":69177,"value":30302,"nodeType":865},{},[],{"data":69179,"content":69180,"nodeType":881},{},[69181],{"data":69182,"marks":69183,"value":54060,"nodeType":865},{},[69184],{"type":902},{"data":69186,"content":69187,"nodeType":881},{},[69188],{"data":69189,"marks":69190,"value":54067,"nodeType":865},{},[],{"data":69192,"content":69193,"nodeType":881},{},[69194],{"data":69195,"marks":69196,"value":54074,"nodeType":865},{},[],{"data":69198,"content":69199,"nodeType":1818},{},[69200,69218],{"data":69201,"content":69202,"nodeType":1734},{},[69203],{"data":69204,"content":69205,"nodeType":881},{},[69206,69209,69215],{"data":69207,"marks":69208,"value":54087,"nodeType":865},{},[],{"data":69210,"content":69211,"nodeType":876},{"uri":30250},[69212],{"data":69213,"marks":69214,"value":54094,"nodeType":865},{},[],{"data":69216,"marks":69217,"value":54098,"nodeType":865},{},[],{"data":69219,"content":69220,"nodeType":1734},{},[69221],{"data":69222,"content":69223,"nodeType":881},{},[69224],{"data":69225,"marks":69226,"value":54108,"nodeType":865},{},[],{"data":69228,"content":69229,"nodeType":881},{},[69230],{"data":69231,"marks":69232,"value":54115,"nodeType":865},{},[],{"data":69234,"content":69235,"nodeType":881},{},[69236],{"data":69237,"marks":69238,"value":54123,"nodeType":865},{},[69239],{"type":902},{"data":69241,"content":69242,"nodeType":1860},{},[69243],{"data":69244,"marks":69245,"value":54130,"nodeType":865},{},[],{"data":69247,"content":69248,"nodeType":881},{},[69249],{"data":69250,"marks":69251,"value":54137,"nodeType":865},{},[],{"data":69253,"content":69254,"nodeType":881},{},[69255,69258],{"data":69256,"marks":69257,"value":54144,"nodeType":865},{},[],{"data":69259,"marks":69260,"value":54149,"nodeType":865},{},[69261],{"type":902},{"data":69263,"content":69264,"nodeType":881},{},[69265,69268,69272],{"data":69266,"marks":69267,"value":54156,"nodeType":865},{},[],{"data":69269,"marks":69270,"value":54161,"nodeType":865},{},[69271],{"type":902},{"data":69273,"marks":69274,"value":54165,"nodeType":865},{},[],{"data":69276,"content":69277,"nodeType":881},{},[69278,69281,69288,69291,69298],{"data":69279,"marks":69280,"value":54172,"nodeType":865},{},[],{"data":69282,"content":69283,"nodeType":876},{"uri":47721},[69284],{"data":69285,"marks":69286,"value":42664,"nodeType":865},{},[69287],{"type":874},{"data":69289,"marks":69290,"value":54183,"nodeType":865},{},[],{"data":69292,"content":69293,"nodeType":876},{"uri":42658},[69294],{"data":69295,"marks":69296,"value":54191,"nodeType":865},{},[69297],{"type":874},{"data":69299,"marks":69300,"value":42926,"nodeType":865},{},[],{"data":69302,"content":69303,"nodeType":881},{},[69304,69307,69314],{"data":69305,"marks":69306,"value":54201,"nodeType":865},{},[],{"data":69308,"content":69309,"nodeType":876},{"uri":28776},[69310],{"data":69311,"marks":69312,"value":54209,"nodeType":865},{},[69313],{"type":874},{"data":69315,"marks":69316,"value":30204,"nodeType":865},{},[],{"data":69318,"content":69319,"nodeType":904},{},[69320],{"data":69321,"marks":69322,"value":54219,"nodeType":865},{},[],{"data":69324,"content":69325,"nodeType":881},{},[69326,69329,69335],{"data":69327,"marks":69328,"value":5069,"nodeType":865},{},[],{"data":69330,"content":69331,"nodeType":876},{"uri":5072},[69332],{"data":69333,"marks":69334,"value":54232,"nodeType":865},{},[],{"data":69336,"marks":69337,"value":54236,"nodeType":865},{},[],{"data":69339,"content":69340,"nodeType":881},{},[69341],{"data":69342,"marks":69343,"value":54243,"nodeType":865},{},[],{"data":69345,"content":69346,"nodeType":881},{},[69347],{"data":69348,"marks":69349,"value":54250,"nodeType":865},{},[],{"data":69351,"content":69352,"nodeType":881},{},[69353,69356,69362],{"data":69354,"marks":69355,"value":54257,"nodeType":865},{},[],{"data":69357,"content":69358,"nodeType":876},{"uri":53345},[69359],{"data":69360,"marks":69361,"value":54264,"nodeType":865},{},[],{"data":69363,"marks":69364,"value":21,"nodeType":865},{},[],{"data":69366,"content":69367,"nodeType":881},{},[69368],{"data":69369,"marks":69370,"value":54274,"nodeType":865},{},[],{"data":69372,"content":69373,"nodeType":904},{},[69374],{"data":69375,"marks":69376,"value":54281,"nodeType":865},{},[],{"data":69378,"content":69379,"nodeType":881},{},[69380],{"data":69381,"marks":69382,"value":54288,"nodeType":865},{},[],{"data":69384,"content":69385,"nodeType":1818},{},[69386,69395,69404],{"data":69387,"content":69388,"nodeType":1734},{},[69389],{"data":69390,"content":69391,"nodeType":881},{},[69392],{"data":69393,"marks":69394,"value":54301,"nodeType":865},{},[],{"data":69396,"content":69397,"nodeType":1734},{},[69398],{"data":69399,"content":69400,"nodeType":881},{},[69401],{"data":69402,"marks":69403,"value":54311,"nodeType":865},{},[],{"data":69405,"content":69406,"nodeType":1734},{},[69407],{"data":69408,"content":69409,"nodeType":881},{},[69410],{"data":69411,"marks":69412,"value":54321,"nodeType":865},{},[],{"data":69414,"content":69415,"nodeType":881},{},[69416],{"data":69417,"marks":69418,"value":54328,"nodeType":865},{},[],{"data":69420,"content":69421,"nodeType":881},{},[69422,69425,69432],{"data":69423,"marks":69424,"value":54335,"nodeType":865},{},[],{"data":69426,"content":69427,"nodeType":876},{"uri":36751},[69428],{"data":69429,"marks":69430,"value":54343,"nodeType":865},{},[69431],{"type":874},{"data":69433,"marks":69434,"value":21,"nodeType":865},{},[],{"data":69436,"content":69437,"nodeType":881},{},[69438,69441,69447],{"data":69439,"marks":69440,"value":54353,"nodeType":865},{},[],{"data":69442,"content":69443,"nodeType":876},{"uri":39605},[69444],{"data":69445,"marks":69446,"value":54360,"nodeType":865},{},[],{"data":69448,"marks":69449,"value":14775,"nodeType":865},{},[],{"data":69451,"content":69454,"nodeType":890},{"target":69452},{"sys":69453},{"id":54368,"type":887,"linkType":888},[],{"data":69456,"content":69457,"nodeType":881},{},[69458],{"data":69459,"marks":69460,"value":21,"nodeType":865},{},[],{"items":69462},[69463,69465],{"sys":69464,"name":4507},{"id":4506},{"sys":69466,"name":342},{"id":4510},{"items":69468},[69469],{"fullName":5373,"firstName":5374,"jobTitle":5375,"profilePicture":69470},{"url":5377},"5-reasons-why-push-security-shouldnt-exist","blog/5-reasons-why-push-security-shouldnt-exist",{"json":69474},{"data":69475,"content":69476,"nodeType":1463},{},[69477,69484],{"data":69478,"content":69479,"nodeType":881},{},[69480],{"data":69481,"marks":69482,"value":69483,"nodeType":865},{},[],"If current security controls worked perfectly, Push wouldn't need to exist – unfortunately, they don't, so here we are!",{"data":69485,"content":69486,"nodeType":881},{},[69487],{"data":69488,"marks":69489,"value":69490,"nodeType":865},{},[],"In this article, we break down common misconceptions about identity controls like MFA, SSO, passkeys, and password managers, exploring some of the gaps they leave and how to fill them to achieve defense in depth.","Breaking down common misconceptions about identity threats and controls like MFA, SSO, passkeys, password managers, and more.",{"id":69493,"publishedAt":69494},"1fp5aOCIcGHDbdQ0amCYOf","2026-08-12T11:55:11.772Z",{"items":69496},[69497,69499],{"sys":69498,"name":342},{"id":4510},{"sys":69500,"name":297},{"id":6385},{"items":69502},[69503,69505,69507,69509,69511,69513,69515,69517,69519,69521,69523,69525,69527,69529,69531,69533,69535,69537,69539,69541,69543,69545],{"sys":69504,"name":413,"slug":414,"tier":31},{"id":410},{"sys":69506,"name":297,"slug":298,"tier":31},{"id":294},{"sys":69508,"name":279,"slug":280,"tier":31},{"id":276},{"sys":69510,"name":519,"slug":520,"tier":31},{"id":516},{"sys":69512,"name":545,"slug":546,"tier":31},{"id":542},{"sys":69514,"name":342,"slug":343,"tier":31},{"id":339},{"sys":69516,"name":395,"slug":396,"tier":45},{"id":392},{"sys":69518,"name":457,"slug":458,"tier":45},{"id":454},{"sys":69520,"name":466,"slug":467,"tier":45},{"id":463},{"sys":69522,"name":333,"slug":334,"tier":45},{"id":330},{"sys":69524,"name":589,"slug":590,"tier":45},{"id":586},{"sys":69526,"name":261,"slug":262,"tier":45},{"id":258},{"sys":69528,"name":571,"slug":572,"tier":45},{"id":568},{"sys":69530,"name":422,"slug":423,"tier":45},{"id":419},{"sys":69532,"name":502,"slug":503,"tier":45},{"id":499},{"sys":69534,"name":493,"slug":494,"tier":45},{"id":490},{"sys":69536,"name":404,"slug":405,"tier":45},{"id":401},{"sys":69538,"name":377,"slug":378,"tier":45},{"id":374},{"sys":69540,"name":624,"slug":625,"tier":45},{"id":621},{"sys":69542,"name":306,"slug":307,"tier":45},{"id":303},{"sys":69544,"name":598,"slug":599,"tier":45},{"id":595},{"sys":69546,"name":475,"slug":476,"tier":45},{"id":472},"7ekz7o6jH_LJs1GGrGDh2SvoDhuQmK1UIytQMiVACOw",{"id":69549,"title":69550,"authorsCollection":69551,"content":69559,"extension":228,"faqItemsCollection":70342,"faqTitle":59,"featured":6,"hashTags":70344,"meta":70345,"metaTitle":70346,"ogImage":59,"postType":33230,"publishedDate":70347,"relatedBlogPostsCollection":70348,"slug":70350,"stem":70351,"subtitle":59,"summary":70352,"synopsis":70363,"sys":70364,"tagsCollection":70367,"topicsCollection":70375,"__hash__":70383},"blog/blog/which-mfa-methods-should-you-use.json","Which MFA methods should you use?",{"items":69552},[69553],{"fullName":69554,"firstName":69555,"jobTitle":69556,"socialLinks":59,"profilePicture":69557},"Andy Waugh","Andy","VP Product",{"url":69558},"https://images.ctfassets.net/y1cdw1ablpvd/3Rf76rJn6S9inMb4dUnAIJ/0a787f8141d05b95300e2fe77c4493fa/DSC_6868.jpg",{"json":69560,"links":70290},{"data":69561,"content":69562,"nodeType":1463},{},[69563,69579,69586,69629,69636,69681,69688,70047,70053,70059,70066,70073,70080,70086,70093,70100,70107,70114,70121,70128,70135,70142,70161,70168,70175,70182,70189,70196,70226,70233,70240,70247,70254,70261,70268,70271,70278,70284],{"data":69564,"content":69565,"nodeType":881},{},[69566,69570,69575],{"data":69567,"marks":69568,"value":69569,"nodeType":865},{},[],"Before we start, ",{"data":69571,"marks":69572,"value":69574,"nodeType":865},{},[69573],{"type":902},"MFA with any method is better than no MFA at all",{"data":69576,"marks":69577,"value":69578,"nodeType":865},{},[],". Although some methods are better than others, they're all leagues ahead of passwords alone. If, for whatever reason, you can only implement MFA using a weaker second factor, you should still do it. You can always improve later and you'll have made a significant improvement even with the weaker second factor.",{"data":69580,"content":69581,"nodeType":881},{},[69582],{"data":69583,"marks":69584,"value":69585,"nodeType":865},{},[],"So, how can one factor be better than others? Here's how we think about it:",{"data":69587,"content":69588,"nodeType":1818},{},[69589,69599,69609,69619],{"data":69590,"content":69591,"nodeType":1734},{},[69592],{"data":69593,"content":69594,"nodeType":881},{},[69595],{"data":69596,"marks":69597,"value":69598,"nodeType":865},{},[],"User experience: how easy is it to use?",{"data":69600,"content":69601,"nodeType":1734},{},[69602],{"data":69603,"content":69604,"nodeType":881},{},[69605],{"data":69606,"marks":69607,"value":69608,"nodeType":865},{},[],"Security: how easy is it for someone to compromise?",{"data":69610,"content":69611,"nodeType":1734},{},[69612],{"data":69613,"content":69614,"nodeType":881},{},[69615],{"data":69616,"marks":69617,"value":69618,"nodeType":865},{},[],"Cost: do you need to upgrade your SaaS license, or buy physical bits?",{"data":69620,"content":69621,"nodeType":1734},{},[69622],{"data":69623,"content":69624,"nodeType":881},{},[69625],{"data":69626,"marks":69627,"value":69628,"nodeType":865},{},[],"Support: how widely can it be used?",{"data":69630,"content":69631,"nodeType":1860},{},[69632],{"data":69633,"marks":69634,"value":69635,"nodeType":865},{},[],"Just want the answers? ",{"data":69637,"content":69638,"nodeType":1818},{},[69639,69649,69671],{"data":69640,"content":69641,"nodeType":1734},{},[69642],{"data":69643,"content":69644,"nodeType":881},{},[69645],{"data":69646,"marks":69647,"value":69648,"nodeType":865},{},[],"Using an app on your phone, like Microsoft or Google Authenticator, to receive notifications or use a one-time password are the top all-round options today - they're free, intuitive for users, relatively easy to set up, and widely supported. ",{"data":69650,"content":69651,"nodeType":1734},{},[69652],{"data":69653,"content":69654,"nodeType":881},{},[69655,69659,69667],{"data":69656,"marks":69657,"value":69658,"nodeType":865},{},[],"The gold standard is a FIDO2-capable security key, like the ",{"data":69660,"content":69662,"nodeType":876},{"uri":69661},"https://www.yubico.com/products/yubikey-5-overview/",[69663],{"data":69664,"marks":69665,"value":69666,"nodeType":865},{},[],"YubiKey 5 series",{"data":69668,"marks":69669,"value":69670,"nodeType":865},{},[],", or a security key built-in to your device, like Touch ID  - it's the most secure, provides the best user experience, but has an upfront cost as each user will need a key or a compatible device. The main drawback today is they aren't supported on all platforms yet so might not be an option everywhere.",{"data":69672,"content":69673,"nodeType":1734},{},[69674],{"data":69675,"content":69676,"nodeType":881},{},[69677],{"data":69678,"marks":69679,"value":69680,"nodeType":865},{},[],"Factors that rely on your phone number, such as SMS and phone calls should be avoided if possible as they are the least secure and provide the worst user experience.",{"data":69682,"content":69683,"nodeType":881},{},[69684],{"data":69685,"marks":69686,"value":69687,"nodeType":865},{},[],"Here's a summary:",{"data":69689,"content":69690,"nodeType":2270},{},[69691,69744,69796,69846,69898,69947,69998],{"data":69692,"content":69693,"nodeType":2032},{},[69694,69704,69714,69724,69734],{"data":69695,"content":69696,"nodeType":65803},{},[69697],{"data":69698,"content":69699,"nodeType":881},{},[69700],{"data":69701,"marks":69702,"value":69703,"nodeType":865},{},[],"Method",{"data":69705,"content":69706,"nodeType":65803},{},[69707],{"data":69708,"content":69709,"nodeType":881},{},[69710],{"data":69711,"marks":69712,"value":69713,"nodeType":865},{},[],"User experience",{"data":69715,"content":69716,"nodeType":65803},{},[69717],{"data":69718,"content":69719,"nodeType":881},{},[69720],{"data":69721,"marks":69722,"value":69723,"nodeType":865},{},[],"Security",{"data":69725,"content":69726,"nodeType":65803},{},[69727],{"data":69728,"content":69729,"nodeType":881},{},[69730],{"data":69731,"marks":69732,"value":69733,"nodeType":865},{},[],"Cost",{"data":69735,"content":69736,"nodeType":65803},{},[69737],{"data":69738,"content":69739,"nodeType":881},{},[69740],{"data":69741,"marks":69742,"value":69743,"nodeType":865},{},[],"Support",{"data":69745,"content":69746,"nodeType":2032},{},[69747,69757,69767,69776,69786],{"data":69748,"content":69749,"nodeType":2021},{},[69750],{"data":69751,"content":69752,"nodeType":881},{},[69753],{"data":69754,"marks":69755,"value":69756,"nodeType":865},{},[],"App Notification",{"data":69758,"content":69759,"nodeType":2021},{},[69760],{"data":69761,"content":69762,"nodeType":881},{},[69763],{"data":69764,"marks":69765,"value":69766,"nodeType":865},{},[],"Good",{"data":69768,"content":69769,"nodeType":2021},{},[69770],{"data":69771,"content":69772,"nodeType":881},{},[69773],{"data":69774,"marks":69775,"value":69766,"nodeType":865},{},[],{"data":69777,"content":69778,"nodeType":2021},{},[69779],{"data":69780,"content":69781,"nodeType":881},{},[69782],{"data":69783,"marks":69784,"value":69785,"nodeType":865},{},[],"Free",{"data":69787,"content":69788,"nodeType":2021},{},[69789],{"data":69790,"content":69791,"nodeType":881},{},[69792],{"data":69793,"marks":69794,"value":69795,"nodeType":865},{},[],"Widely supported",{"data":69797,"content":69798,"nodeType":2032},{},[69799,69809,69819,69828,69837],{"data":69800,"content":69801,"nodeType":2021},{},[69802],{"data":69803,"content":69804,"nodeType":881},{},[69805],{"data":69806,"marks":69807,"value":69808,"nodeType":865},{},[],"App code",{"data":69810,"content":69811,"nodeType":2021},{},[69812],{"data":69813,"content":69814,"nodeType":881},{},[69815],{"data":69816,"marks":69817,"value":69818,"nodeType":865},{},[],"Moderate",{"data":69820,"content":69821,"nodeType":2021},{},[69822],{"data":69823,"content":69824,"nodeType":881},{},[69825],{"data":69826,"marks":69827,"value":69766,"nodeType":865},{},[],{"data":69829,"content":69830,"nodeType":2021},{},[69831],{"data":69832,"content":69833,"nodeType":881},{},[69834],{"data":69835,"marks":69836,"value":69785,"nodeType":865},{},[],{"data":69838,"content":69839,"nodeType":2021},{},[69840],{"data":69841,"content":69842,"nodeType":881},{},[69843],{"data":69844,"marks":69845,"value":69795,"nodeType":865},{},[],{"data":69847,"content":69848,"nodeType":2032},{},[69849,69859,69869,69878,69888],{"data":69850,"content":69851,"nodeType":2021},{},[69852],{"data":69853,"content":69854,"nodeType":881},{},[69855],{"data":69856,"marks":69857,"value":69858,"nodeType":865},{},[],"Security key (external)",{"data":69860,"content":69861,"nodeType":2021},{},[69862],{"data":69863,"content":69864,"nodeType":881},{},[69865],{"data":69866,"marks":69867,"value":69868,"nodeType":865},{},[],"Best",{"data":69870,"content":69871,"nodeType":2021},{},[69872],{"data":69873,"content":69874,"nodeType":881},{},[69875],{"data":69876,"marks":69877,"value":69868,"nodeType":865},{},[],{"data":69879,"content":69880,"nodeType":2021},{},[69881],{"data":69882,"content":69883,"nodeType":881},{},[69884],{"data":69885,"marks":69886,"value":69887,"nodeType":865},{},[],"Expensive",{"data":69889,"content":69890,"nodeType":2021},{},[69891],{"data":69892,"content":69893,"nodeType":881},{},[69894],{"data":69895,"marks":69896,"value":69897,"nodeType":865},{},[],"Some platforms",{"data":69899,"content":69900,"nodeType":2032},{},[69901,69911,69920,69929,69938],{"data":69902,"content":69903,"nodeType":2021},{},[69904],{"data":69905,"content":69906,"nodeType":881},{},[69907],{"data":69908,"marks":69909,"value":69910,"nodeType":865},{},[],"Security key (internal)",{"data":69912,"content":69913,"nodeType":2021},{},[69914],{"data":69915,"content":69916,"nodeType":881},{},[69917],{"data":69918,"marks":69919,"value":69868,"nodeType":865},{},[],{"data":69921,"content":69922,"nodeType":2021},{},[69923],{"data":69924,"content":69925,"nodeType":881},{},[69926],{"data":69927,"marks":69928,"value":69868,"nodeType":865},{},[],{"data":69930,"content":69931,"nodeType":2021},{},[69932],{"data":69933,"content":69934,"nodeType":881},{},[69935],{"data":69936,"marks":69937,"value":69785,"nodeType":865},{},[],{"data":69939,"content":69940,"nodeType":2021},{},[69941],{"data":69942,"content":69943,"nodeType":881},{},[69944],{"data":69945,"marks":69946,"value":69897,"nodeType":865},{},[],{"data":69948,"content":69949,"nodeType":2032},{},[69950,69960,69970,69979,69989],{"data":69951,"content":69952,"nodeType":2021},{},[69953],{"data":69954,"content":69955,"nodeType":881},{},[69956],{"data":69957,"marks":69958,"value":69959,"nodeType":865},{},[],"SMS",{"data":69961,"content":69962,"nodeType":2021},{},[69963],{"data":69964,"content":69965,"nodeType":881},{},[69966],{"data":69967,"marks":69968,"value":69969,"nodeType":865},{},[],"Poor",{"data":69971,"content":69972,"nodeType":2021},{},[69973],{"data":69974,"content":69975,"nodeType":881},{},[69976],{"data":69977,"marks":69978,"value":69969,"nodeType":865},{},[],{"data":69980,"content":69981,"nodeType":2021},{},[69982],{"data":69983,"content":69984,"nodeType":881},{},[69985],{"data":69986,"marks":69987,"value":69988,"nodeType":865},{},[],"Cheap",{"data":69990,"content":69991,"nodeType":2021},{},[69992],{"data":69993,"content":69994,"nodeType":881},{},[69995],{"data":69996,"marks":69997,"value":69795,"nodeType":865},{},[],{"data":69999,"content":70000,"nodeType":2032},{},[70001,70011,70020,70029,70038],{"data":70002,"content":70003,"nodeType":2021},{},[70004],{"data":70005,"content":70006,"nodeType":881},{},[70007],{"data":70008,"marks":70009,"value":70010,"nodeType":865},{},[],"Phone call",{"data":70012,"content":70013,"nodeType":2021},{},[70014],{"data":70015,"content":70016,"nodeType":881},{},[70017],{"data":70018,"marks":70019,"value":69969,"nodeType":865},{},[],{"data":70021,"content":70022,"nodeType":2021},{},[70023],{"data":70024,"content":70025,"nodeType":881},{},[70026],{"data":70027,"marks":70028,"value":69969,"nodeType":865},{},[],{"data":70030,"content":70031,"nodeType":2021},{},[70032],{"data":70033,"content":70034,"nodeType":881},{},[70035],{"data":70036,"marks":70037,"value":69988,"nodeType":865},{},[],{"data":70039,"content":70040,"nodeType":2021},{},[70041],{"data":70042,"content":70043,"nodeType":881},{},[70044],{"data":70045,"marks":70046,"value":69795,"nodeType":865},{},[],{"data":70048,"content":70052,"nodeType":890},{"target":70049},{"sys":70050},{"id":70051,"type":887,"linkType":888},"7rgrP5FFAKG63lscwhAsW1",[],{"data":70054,"content":70055,"nodeType":1860},{},[70056],{"data":70057,"marks":70058,"value":69756,"nodeType":865},{},[],{"data":70060,"content":70061,"nodeType":881},{},[70062],{"data":70063,"marks":70064,"value":70065,"nodeType":865},{},[],"One of the most common methods today is the app notification. Using an app on your phone, like Microsoft Authenticator, to receive a push notification when you login.",{"data":70067,"content":70068,"nodeType":881},{},[70069],{"data":70070,"marks":70071,"value":70072,"nodeType":865},{},[],"Free, easy to use, and secure - this is a good choice if your users all have devices to install the app on and will reliably have a network connection to receive the notification.",{"data":70074,"content":70075,"nodeType":881},{},[70076],{"data":70077,"marks":70078,"value":70079,"nodeType":865},{},[],"Your challenges with using this method will be getting the app setup on everyone's device, getting everyone enrolled, and making sure users understand to only hit approve when they actually performed a login (seriously).",{"data":70081,"content":70085,"nodeType":890},{"target":70082},{"sys":70083},{"id":70084,"type":887,"linkType":888},"4ybLnYAdHltdWCluLbr4di",[],{"data":70087,"content":70088,"nodeType":1860},{},[70089],{"data":70090,"marks":70091,"value":70092,"nodeType":865},{},[],"App Code",{"data":70094,"content":70095,"nodeType":881},{},[70096],{"data":70097,"marks":70098,"value":70099,"nodeType":865},{},[],"The early days of MFA looked like RSA tokens; those devices you used to have to carry on a key chain with a code that changed every minute. Those devices worked by having a \"seed\" value that both the device and the server knew which changed predictably. So long as that seed value stayed safe, this provided a convenient second factor for users that was difficult to compromise.",{"data":70101,"content":70102,"nodeType":881},{},[70103],{"data":70104,"marks":70105,"value":70106,"nodeType":865},{},[],"Today, this approach is more common via an app, where the app provides a code that changes every minute, but the concept is exactly the same.",{"data":70108,"content":70109,"nodeType":881},{},[70110],{"data":70111,"marks":70112,"value":70113,"nodeType":865},{},[],"This approach uses what is officially called One Time Passwords (OTP) but is often just referred to as an app code. It has some advantages, such as not needing signal after setup which can be handy if that's a concern. ",{"data":70115,"content":70116,"nodeType":881},{},[70117],{"data":70118,"marks":70119,"value":70120,"nodeType":865},{},[],"However, as was true of the RSA tokens of the past, if the seed value is compromised all future values can be predicted. The odds of this happening in practice are exceptionally low so this remains a good choice.",{"data":70122,"content":70123,"nodeType":881},{},[70124],{"data":70125,"marks":70126,"value":70127,"nodeType":865},{},[],"Your challenges with using this method will again be mostly in rolling it out to all users and getting everyone setup.",{"data":70129,"content":70130,"nodeType":1860},{},[70131],{"data":70132,"marks":70133,"value":70134,"nodeType":865},{},[],"Text message / phone call",{"data":70136,"content":70137,"nodeType":881},{},[70138],{"data":70139,"marks":70140,"value":70141,"nodeType":865},{},[],"As MFA gained popularity, receiving a code via text message (SMS), or sometimes a phone call, quickly became the de-facto method. Before everyone had smartphones and therefore the ability to install apps, using text messages or phone calls was the only way to implement MFA without having to provision RSA tokens for everyone in the team.",{"data":70143,"content":70144,"nodeType":881},{},[70145,70149,70157],{"data":70146,"marks":70147,"value":70148,"nodeType":865},{},[],"The major downside to using these methods is their reliance on the security of the phone number. If attackers really want to target an account, and they know the phone number used for MFA, they can try something called ",{"data":70150,"content":70152,"nodeType":876},{"uri":70151},"https://en.wikipedia.org/wiki/SIM_swap_scam",[70153],{"data":70154,"marks":70155,"value":70156,"nodeType":865},{},[],"SIM-swapping",{"data":70158,"marks":70159,"value":70160,"nodeType":865},{},[]," to hijack the phone number, and hence nullify the MFA.",{"data":70162,"content":70163,"nodeType":881},{},[70164],{"data":70165,"marks":70166,"value":70167,"nodeType":865},{},[],"The most important thing to note in that scenario is how targeted it is. With no MFA, any attacker on the Internet can simply guess passwords on an account - the cost is extremely low. To bypass SMS or phone call MFA using SIM swapping has a significantly higher cost. The attack is definitely practical, but would only happen when you're specifically targeted.",{"data":70169,"content":70170,"nodeType":881},{},[70171],{"data":70172,"marks":70173,"value":70174,"nodeType":865},{},[],"Additionally, the user experience isn't as good. Firstly, the user must have mobile signal to receive the SMS or call. Secondly, there can often be a delay in delivery, due to the less-reliable mobile network. Finally, there is almost always a usage cost associated with these methods, since it costs money to send SMSs or make phone calls.",{"data":70176,"content":70177,"nodeType":881},{},[70178],{"data":70179,"marks":70180,"value":70181,"nodeType":865},{},[],"Because of this, SMS or phone calls are often considered least desirable MFA methods today.",{"data":70183,"content":70184,"nodeType":1860},{},[70185],{"data":70186,"marks":70187,"value":70188,"nodeType":865},{},[],"Security keys",{"data":70190,"content":70191,"nodeType":881},{},[70192],{"data":70193,"marks":70194,"value":70195,"nodeType":865},{},[],"FIDO2 is the name for a set of authentication protocols and standards developed by a consortium of tech companies to be the future of authentication. FIDO2 solves a lot of the problems we've dealt with in the past: it's secure, usable, impossible to spoof.",{"data":70197,"content":70198,"nodeType":881},{},[70199,70203,70211,70215,70222],{"data":70200,"marks":70201,"value":70202,"nodeType":865},{},[],"Without digging into the weeds of how that works (",{"data":70204,"content":70206,"nodeType":876},{"uri":70205},"https://fidoalliance.org/fido2/",[70207],{"data":70208,"marks":70209,"value":70210,"nodeType":865},{},[],"the official page from the FIDO alliance is worth a read if you're interested",{"data":70212,"marks":70213,"value":70214,"nodeType":865},{},[],"), you will need what's commonly referred to as a \"security key\" to make use of it. This is a small physical device, often plugged into your USB port - modern devices that understand FIDO2, like the ",{"data":70216,"content":70217,"nodeType":876},{"uri":69661},[70218],{"data":70219,"marks":70220,"value":70221,"nodeType":865},{},[],"YubiKey 5 Series",{"data":70223,"marks":70224,"value":70225,"nodeType":865},{},[],", are preferable. Once setup, you simply touch the key on login and the magic of cryptography ensures a high degree of security.",{"data":70227,"content":70228,"nodeType":881},{},[70229],{"data":70230,"marks":70231,"value":70232,"nodeType":865},{},[],"In fact, this approach is so secure, it is the basis of a \"passwordless\" revolution, where this strong factor of authentication can feasibly be used as a single-factor of authentication, and users don't even need to remember passwords anymore. Though in its infancy at the moment, expect to hear more about that in the coming years.",{"data":70234,"content":70235,"nodeType":881},{},[70236],{"data":70237,"marks":70238,"value":70239,"nodeType":865},{},[],"The primary drawback of this method is the cost, with devices typically costing around $50 each. Also, although you can expect them to be supported on major platforms, they aren't supported as widely as other methods just yet.",{"data":70241,"content":70242,"nodeType":881},{},[70243],{"data":70244,"marks":70245,"value":70246,"nodeType":865},{},[],"If you are unable to justify their cost for all users, a common implementation is to use security keys for high privilege accounts.",{"data":70248,"content":70249,"nodeType":1860},{},[70250],{"data":70251,"marks":70252,"value":70253,"nodeType":865},{},[],"Built-in security keys",{"data":70255,"content":70256,"nodeType":881},{},[70257],{"data":70258,"marks":70259,"value":70260,"nodeType":865},{},[],"Many modern mobile devices like laptops, tablets and phones have built-in security keys (e.g. Apple TouchId,  Android phones, and Windows Hello). These have many of the advantages of stand-alone security keys, but without the cost!",{"data":70262,"content":70263,"nodeType":881},{},[70264],{"data":70265,"marks":70266,"value":70267,"nodeType":865},{},[],"Support for these keys is a fairly recent development and is still ongoing but opens up an exciting future where users will increasingly be able to very easily add a second factor, or even go passwordless, in a secure way, without much effort or thought.",{"data":70269,"content":70270,"nodeType":894},{},[],{"data":70272,"content":70273,"nodeType":881},{},[70274],{"data":70275,"marks":70276,"value":70277,"nodeType":865},{},[],"In conclusion there are multiple options you can choose from to fit almost any scenario you have. While some options are better than others, even the worst option is still a massive improvement on passwords alone. In the end, the best MFA method is the one you can start rolling out today, you can always improve down the line.",{"data":70279,"content":70283,"nodeType":890},{"target":70280},{"sys":70281},{"id":70282,"type":887,"linkType":888},"2y0INxqAi594O7rCAVKhTI",[],{"data":70285,"content":70286,"nodeType":881},{},[70287],{"data":70288,"marks":70289,"value":21,"nodeType":865},{},[],{"entries":70291},{"hyperlink":70292,"inline":70293,"block":70294},[],[],[70295,70311,70337],{"sys":70296,"__typename":70297,"content":70298,"title":70309,"buttonText":29766,"buttonUrl":70310,"signupRedirectUrl":59},{"id":70051},"ActionBlockComponent",{"json":70299},{"data":70300,"content":70301,"nodeType":1463},{},[70302],{"data":70303,"content":70304,"nodeType":881},{},[70305],{"data":70306,"marks":70307,"value":70308,"nodeType":865},{},[],"Use our platform to quickly check out which MFA methods your users have registered. Follow our detailed guidance and use our automations to speed through any future MFA deployments or improvements with ease.","Want to find out which MFA methods are used by your organisation?","/features/adopt-multi-factor-authentication/",{"sys":70312,"__typename":7015,"content":70313,"name":70336,"title":59},{"id":70084},{"json":70314},{"nodeType":1463,"data":70315,"content":70316},{},[70317,70329],{"nodeType":881,"content":70318,"data":70328},[70319,70324],{"nodeType":865,"value":70320,"marks":70321,"data":70323},"Hint",[70322],{"type":902},{},{"nodeType":865,"value":70325,"marks":70326,"data":70327},": where available, and where they are the sole user of the device, allow users to have platforms \"remember their device\", so they only get prompted once a month or similar. ",[],{},{},{"nodeType":881,"content":70330,"data":70335},[70331],{"nodeType":865,"value":70332,"marks":70333,"data":70334},"Reducing the volume of MFA prompts will greatly reduce the chance of a user accepting prompts they didn't initiate.",[],{},{},"MFA: reduce MFA prompts insight",{"sys":70338,"__typename":1471,"type":70339,"ctaText":70340,"buttonLabel":70341,"buttonColour":43411,"buttonUrl":59},{"id":70282},"LinkedIn","See more original research and technical content from Push","Follow us on LinkedIn",{"items":70343},[],[457],{},"The most secure multi-factor authentication methods","2021-03-15T00:00:00.000+01:00",{"items":70349},[],"which-mfa-methods-should-you-use","blog/which-mfa-methods-should-you-use",{"json":70353},{"data":70354,"content":70355,"nodeType":1463},{},[70356],{"data":70357,"content":70358,"nodeType":881},{},[70359],{"data":70360,"marks":70361,"value":70362,"nodeType":865},{},[],"We all know Multi-Factor Authentication (MFA) is a good idea but how important is the \"factor\" you choose? From the classic SMS to the modern Yubikey, and everything in-between, we've got you covered when it comes to MFA methods.","SMS, Authenticator apps, Security Keys, and more! We compare them from a user experience, security, cost, and security aspect.",{"id":70365,"publishedAt":70366},"73JjdrO5GKRzYum97MqJ9q","2026-08-12T11:46:14.853Z",{"items":70368},[70369,70373],{"sys":70370,"name":70372},{"id":70371},"1gZi8NrRy2v9OqPV7C4dwD","Risk management",{"sys":70374,"name":297},{"id":6385},{"items":70376},[70377,70379,70381],{"sys":70378,"name":413,"slug":414,"tier":31},{"id":410},{"sys":70380,"name":457,"slug":458,"tier":45},{"id":454},{"sys":70382,"name":493,"slug":494,"tier":45},{"id":490},"hk3IuZVUoNvtK88J-vfACwlB5I1lOViwOghsoDx1Ris",1787040081363]