[{"data":1,"prerenderedAt":40236},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":36,"navbar-about-highlight":108,"navbar-resource-highlight":182,"blog-topics":226,"trust-badges":656,"solution-nav":677,"fa-icon-solid-faUserSecret":800,"fa-icon-sharp-regular-faLaptopCode":804,"fa-icon-solid-faPlugCircleXmark":806,"fa-icon-sharp-regular-faPuzzlePiece":808,"fa-icon-solid-faFileCircleXmark":810,"fa-icon-solid-faGhost":813,"fa-icon-solid-faQrcode":816,"fa-icon-solid-faCookieBite":818,"fa-icon-sharp-regular-faFishingRod":820,"fa-icon-sharp-regular-faUserSecret":822,"fa-icon-sharp-regular-faRadar":824,"fa-icon-sharp-regular-faSatelliteDish":826,"fa-icon-sharp-regular-faShieldCheck":828,"fa-icon-sharp-regular-faBrainCircuit":830,"fa-icon-solid-faMobileScreenButton":832,"fa-icon-brands-faChrome":834,"fa-icon-solid-faDisplay":836,"fa-icon-solid-faFilter":838,"fa-icon-solid-faCloudArrowUp":840,"blog-topic-ransomware":842},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"meta":14,"query":22,"data":23,"variations":28,"lastUpdated":29,"firstPublished":30,"testRatio":31,"createdBy":32,"lastUpdatedBy":33,"folders":34,"rev":35},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",{"breakpoints":15,"hasAutosaves":19,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},768,640,320,true,"data","",[],{"link":24,"text":25,"type":26,"url":27},{},"Get our latest report analyzing browser attack techniques in 2026","web-banner","https://pushsecurity.com/resources/browser-attacks-report",{},1774258294825,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],"j7ew2tin4q",{"createdBy":37,"createdDate":38,"data":39,"folders":94,"id":95,"lastUpdated":96,"lastUpdatedBy":97,"meta":98,"modelId":102,"name":103,"published":13,"query":104,"testRatio":31,"variations":105,"firstPublished":106,"stageModifiedSincePublish":6,"rev":107},"ST0tXQM8slWpFrmioqKHmENB2qe2",1774965361051,{"ctaText":40,"text":41,"url":21,"blocks":42,"state":90},"ewrererw","testrfesssssssssss",[43,70,78],{"@type":44,"@version":45,"id":46,"component":47,"responsiveStyles":60},"@builder.io/sdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":48,"tag":48,"options":49,"isRSC":59},"TopBannerContent",{"text":50,"ctaText":51,"url":52,"mainText":53,"cta":56},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https://pushsecurity.com/webinar/state-of-browser-security",{"content":54,"fontSize":55},"\u003Cp class=\"\">Do you know how much AI is in your workforce? Find out August 20th.\u003C/p>","text-base",{"content":57,"fontSize":55,"url":58},"\u003Cp class=\"\">Save your seat →\u003C/p>","https://pushsecurity.com/webinar/shadow-ai",null,{"large":61},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66,"marginTop":67,"marginBottom":67,"fontSize":68,"fontWeight":69},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"@type":44,"@version":45,"id":71,"component":72,"responsiveStyles":76},"builder-a2e1f4b9f30b464bb814d7f5de5b0aa7",{"name":73,"options":74,"isRSC":59},"Custom Code",{"code":75,"scriptsClientOnly":6},"\u003Cstyle>\n  .top-banner.bg-web-orange{background:rgb(114, 79, 255);}\n\u003C/style>\n",{"large":77},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66},{"id":79,"@type":44,"tagName":80,"properties":81,"responsiveStyles":85},"builder-pixel-k74nkzlquog","img",{"src":82,"aria-hidden":83,"alt":21,"role":84,"width":65,"height":65},"https://cdn.builder.io/api/v1/pixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true","presentation",{"large":86},{"height":65,"width":65,"display":87,"opacity":65,"overflow":88,"pointerEvents":89},"block","hidden","none",{"deviceSize":91,"location":92},"large",{"path":21,"query":93},{},[],"fd266d0172cc47429be7ad10f48c99ad",1786155414606,"kYgMv6WsbvfmlOUYqR2SFwGzw6e2",{"breakpoints":99,"hasAutosaves":6,"hasErrors":6,"hasLinks":6,"kind":100,"lastPreviewUrl":101},{"medium":16,"small":17,"xsmall":18},"component","https://pushsecurity.com/?builder.space=f3a1111ff5be48cdbb123cd9f5795a05&builder.user.permissions=read%2Ccreate%2Cpublish%2CeditDesigns%2CeditLayouts%2CeditLayers%2CeditContentPriority%2CeditFolders%2CcreateProjects%2CsendPullRequests%2CfusionHostingPublish&builder.user.role.name=Designer&builder.user.role.id=creator&builder.cachebust=true&builder.preview=always-visible-banner&builder.noCache=true&builder.allowTextEdit=true&__builder_editing__=true&builder.overrides.always-visible-banner=fd266d0172cc47429be7ad10f48c99ad&builder.overrides.fd266d0172cc47429be7ad10f48c99ad=fd266d0172cc47429be7ad10f48c99ad&builder.options.locale=Default","0678d178ec8b41efb8a23c09dba7874d","always visible banner",[],{},1774968080803,"1lcyl36j3gz",[109,145],{"createdBy":32,"createdDate":110,"data":111,"folders":134,"id":135,"lastUpdated":136,"lastUpdatedBy":32,"meta":137,"modelId":139,"name":140,"published":13,"query":141,"stageModifiedSincePublish":6,"testRatio":31,"variations":142,"firstPublished":143,"rev":144},1776247359804,{"link":112,"testimonial":113,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":117},"@builder.io/core:Reference","f028f2b685bb47cd8bf9e82a26dd5a79","testimonial",{"query":118,"folders":119,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":123,"variations":127,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":130,"rev":132},[],[],1735823466309,"We found Push to be more accurate when compared to competitors and the browser agent offered features that others couldn’t match.","42035571a56940ac98bff4544aa79aa5",{"author":124,"jobTitle":125,"quote":121,"image":126},"Jason Waits","\u003Cp>CISO at Inductive Automation\u003C/p>","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07",{},1735910703862,1735823501152,{"kind":20,"lastPreviewUrl":21,"breakpoints":131,"hasAutosaves":19},{"small":17,"medium":16},"xal7chkxmdh","/customer-stories/inductive-automation",[],"9136a8f18b3b4a6ba29b8653a99372b1",1776247404986,{"breakpoints":138,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"20d9eaa352304613b3d1a794b400703d","testimonial-inductive-automation",[],{},1776247404973,"5mqgwlt47hs",{"createdBy":32,"createdDate":146,"data":147,"folders":174,"id":175,"lastUpdated":176,"lastUpdatedBy":32,"meta":177,"modelId":139,"name":172,"published":13,"query":179,"stageModifiedSincePublish":6,"testRatio":31,"variations":180,"firstPublished":181,"rev":144},1776255761419,{"description":148,"image":149,"link":150,"testimonial":153,"title":172,"type":173},"Learn about the latest techniques being used in the wild.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F7b4a5ebf81d64e8c9d7fc35f6c96c4a9",{"text":151,"url":152},"Download now","/resources/browser-attacks-report",{"@type":114,"id":154,"model":116,"value":155},"192acbb1f9ca4cac918c0ec435a8bae3",{"query":156,"folders":157,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":160,"variations":166,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":169,"rev":171},[],[],1728981467463,"Push does for identity what CrowdStrike did for the endpoint",{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},"https://cdn.builder.io/o/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F8b30e8ca50064058bbaef0f3c6164575%2Fcompressed?apiKey=f3a1111ff5be48cdbb123cd9f5795a05&token=8b30e8ca50064058bbaef0f3c6164575&alt=media&optimized=true","\u003Cp>Deputy CISO at Microsoft\u003C/p>\u003Cp>Former LinkedIn, Slack, Palantir\u003C/p>","Geoff Belknap","Push does for identity what CrowdStrike did for the endpoint.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F748f0ad0a5064a00a13f4721fcc8dea1",{},1742902158597,1728981782923,{"kind":20,"lastPreviewUrl":21,"breakpoints":170,"hasAutosaves":19},{"small":17,"medium":16},"kg131t0jkvo","Report: 2026 Browser Attack Techniques","resource",[],"05a9322735fc427db12e2740e4302300",1776255810913,{"breakpoints":178,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},[],{},1776255810900,[183,205],{"createdBy":32,"createdDate":184,"data":185,"folders":195,"id":196,"lastUpdated":197,"lastUpdatedBy":32,"meta":198,"modelId":200,"name":172,"published":13,"query":201,"stageModifiedSincePublish":6,"testRatio":31,"variations":202,"firstPublished":203,"rev":204},1776256900280,{"description":148,"image":149,"link":186,"testimonial":187,"title":172,"type":173},{"text":151,"url":152},{"@type":114,"id":154,"model":116,"value":188},{"query":189,"folders":190,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":191,"variations":192,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":193,"rev":171},[],[],{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":194,"hasAutosaves":19},{"small":17,"medium":16},[],"1f429607996e4e5fae8fe3f9b9610e55",1776256937553,{"breakpoints":199,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"4829faa81e7c4ee8bd2d000e160e8d3c",[],{},1776256937540,"470xio0yv7r",{"createdBy":32,"createdDate":206,"data":207,"folders":217,"id":218,"lastUpdated":219,"lastUpdatedBy":32,"meta":220,"modelId":200,"name":222,"published":13,"query":223,"stageModifiedSincePublish":6,"testRatio":31,"variations":224,"firstPublished":225,"rev":204},1776256949234,{"link":208,"testimonial":209,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":210},{"query":211,"folders":212,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":213,"variations":214,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":215,"rev":132},[],[],{"author":124,"jobTitle":125,"quote":121,"image":126},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":216,"hasAutosaves":19},{"small":17,"medium":16},[],"ce043785b71b4ece98eac811ecf4ba10",1776256974140,{"breakpoints":221,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"inductive-automation",[],{},1776256974130,{"id":227,"extension":228,"items":229,"meta":653,"stem":654,"__hash__":655},"blogTopics/blogtopics.json","json",[230,239,247,256,265,274,283,292,301,310,319,328,337,346,355,363,372,381,390,399,408,417,426,435,443,452,461,470,479,488,497,506,514,523,532,540,549,558,566,575,584,593,602,611,619,628,637,645],{"sys":231,"faqItemsCollection":233,"name":235,"slug":236,"tier":31,"intro":237,"faqTitle":59,"postCount":238,"hasPage":19},{"id":232},"topic-ai",{"items":234},[],"AI","ai","AI is reshaping both sides of the security equation: employees adopt AI tools faster than security teams can track them, while attackers use AI to scale and automate campaigns. Shadow AI adoption may now outpace wider shadow SaaS, and attackers are already turning AI chatbot platforms into malware delivery channels. Push has researched the offensive potential of computer-using agents and now applies AI agents to its own threat hunting. This hub covers AI as risk, target, and defensive tool.",22,{"sys":240,"faqItemsCollection":242,"name":244,"slug":245,"tier":45,"intro":246,"faqTitle":59,"postCount":238,"hasPage":19},{"id":241},"topic-ai-attacks",{"items":243},[],"AI attacks","ai-attacks","AI attacks run in both directions: attackers using AI to scale phishing, malware delivery, and identity attacks, and AI platforms themselves becoming the attack surface. Push has researched how computer-using agents can automate identity attacks, and has seen the poisoned tenant technique it coined used against its own employees in the wild.",{"sys":248,"faqItemsCollection":250,"name":252,"slug":253,"tier":45,"intro":254,"faqTitle":59,"postCount":255,"hasPage":19},{"id":249},"topic-ai-governance",{"items":251},[],"AI governance","ai-governance","AI governance is how organizations set and enforce rules for workplace AI use — which tools are allowed, what data can enter them, and how to evidence it to regulators. With US, EU, and UK AI regulations converging on obligations most organizations can’t yet meet, Push’s research makes the case that enforcement starts in the browser, where AI tools are actually used.",9,{"sys":257,"faqItemsCollection":259,"name":261,"slug":262,"tier":45,"intro":263,"faqTitle":59,"postCount":264,"hasPage":19},{"id":258},"topic-aitm",{"items":260},[],"AiTM phishing","aitm","Adversary-in-the-middle (AiTM) phishing proxies a real login page through an attacker-controlled site, capturing credentials, MFA codes, and session tokens in real time to bypass multi-factor authentication. Push’s research into kits like Evilginx and Sneaky2FA documents how they evade URL- and signature-based detection — and why analyzing toolkit behavior in the browser catches attacks that blocklists miss.",77,{"sys":266,"faqItemsCollection":268,"name":270,"slug":271,"tier":45,"intro":272,"faqTitle":59,"postCount":273,"hasPage":6},{"id":267},"topic-bec",{"items":269},[],"BEC","bec","Business email compromise (BEC) turns a hijacked mailbox into a fraud tool: attackers use mail rules, auto-forwarding, and payment redirection to steal money while staying invisible to the account owner. Alongside a first-hand case study of a BEC attack that nearly cost an engineering firm millions, Push breaks down these mailbox persistence tricks and how to detect them.",3,{"sys":275,"faqItemsCollection":277,"name":279,"slug":280,"tier":31,"intro":281,"faqTitle":59,"postCount":282,"hasPage":19},{"id":276},"topic-browser-attacks",{"items":278},[],"Browser attacks","browser-attacks","Browser attacks target users through the web pages, sessions, and extensions they rely on every day — bypassing endpoint and network defenses that never see inside the browser. Techniques like AiTM phishing kits, ClickFix-style copy-paste attacks, OAuth consent abuse, malvertising, and browser sync abuse have become a leading path to account takeover. Push researchers analyze these attacks in the wild, from infiltrating criminal phishing panels to dissecting toolkits like ConsentFix and Sneaky2FA. Use this hub to track how the techniques evolve and how to defend against them.",118,{"sys":284,"faqItemsCollection":286,"name":288,"slug":289,"tier":45,"intro":290,"faqTitle":59,"postCount":291,"hasPage":19},{"id":285},"topic-browser-extensions",{"items":287},[],"Browser extensions","browser-extensions","Browser extensions cut both ways for security teams: malicious or compromised extensions are a growing attack vector, while an extension is also the lightest-weight way to deploy security controls into the browsers employees already use. These posts cover both sides — extension-borne risks like browser sync attacks and the limits of risk scoring, and how Push uses its extension to detect threats and block risky extensions.",30,{"sys":293,"faqItemsCollection":295,"name":297,"slug":298,"tier":31,"intro":299,"faqTitle":59,"postCount":300,"hasPage":19},{"id":294},"topic-browser-security",{"items":296},[],"Browser security","browser-security","Work now happens in the browser, making browser security — visibility and control at the point where users meet the web — a core layer of enterprise defense. Endpoint, network, and email tools miss attacks that unfold inside the browser session, from AiTM phishing to risky extensions and shadow SaaS. Push has published extensively on choosing between enterprise browsers and browser extensions, using browser telemetry, and making the business case for browser security. Start here for both strategy and hands-on guidance.",127,{"sys":302,"faqItemsCollection":304,"name":306,"slug":307,"tier":45,"intro":308,"faqTitle":59,"postCount":309,"hasPage":19},{"id":303},"topic-casb",{"items":305},[],"CASB","casb","Cloud access security brokers (CASBs) govern cloud app usage through API integrations and network proxies — an approach that works for sanctioned apps but struggles with the long tail of shadow SaaS employees adopt on their own. Because every SaaS signup happens in a browser, Push captures that adoption in real time at the point of login, and these posts cover what proxy-based discovery misses.",12,{"sys":311,"faqItemsCollection":313,"name":315,"slug":316,"tier":45,"intro":317,"faqTitle":59,"postCount":318,"hasPage":19},{"id":312},"topic-clickfix",{"items":314},[],"ClickFix","clickfix","ClickFix attacks trick users into copying and running malicious commands themselves — typically through fake CAPTCHA, error, or fix-it prompts — so malware executes without a download for security tools to scan. Push researchers track the technique’s evolution in the wild and identified the ConsentFix and InstallFix variants, which extend it to OAuth consent grants and fake install guides.",39,{"sys":320,"faqItemsCollection":322,"name":324,"slug":325,"tier":45,"intro":326,"faqTitle":59,"postCount":327,"hasPage":19},{"id":321},"topic-credential-phishing",{"items":323},[],"Credential phishing","credential-phishing","Credential phishing steals usernames and passwords through fake login pages impersonating the services employees use, handing attackers direct access to corporate accounts. Attackers don’t hack in — they log in. Push’s browser extension analyzes login pages as users actually see them, blocking cloned pages and stopping employees from entering company passwords on lookalike sites.",89,{"sys":329,"faqItemsCollection":331,"name":333,"slug":334,"tier":45,"intro":335,"faqTitle":59,"postCount":336,"hasPage":19},{"id":330},"topic-credential-stuffing",{"items":332},[],"Credential stuffing","credential-stuffing","Credential stuffing is an attack where criminals replay username-password pairs stolen from one breach against other services, exploiting password reuse to take over accounts. Major breaches have shown how far a single set of stolen credentials can travel. Push detects verified stolen credentials by comparing employee passwords against breach datasets and dark-web threat intelligence, eliminating false positives.",64,{"sys":338,"faqItemsCollection":340,"name":342,"slug":343,"tier":31,"intro":344,"faqTitle":59,"postCount":345,"hasPage":19},{"id":339},"topic-detection-and-response",{"items":341},[],"Detection & response","detection-and-response","Detection and response is being reshaped as attacks move into the browser, where EDR, SIEM, and network tools have limited visibility. Modern phishing kits evade signature-based detection, and most malicious pages have never been seen before — so technique-level, in-browser detection matters more than known-bad indicators. Push’s work here spans high-fidelity browser telemetry, session token theft detection, and agentic threat hunting, plus practical IR guidance for compromised SaaS accounts and malicious OAuth apps. These posts cover both the philosophy and the workflows.",101,{"sys":347,"faqItemsCollection":349,"name":351,"slug":352,"tier":45,"intro":353,"faqTitle":59,"postCount":354,"hasPage":19},{"id":348},"topic-detection-engineering",{"items":350},[],"Detection engineering","detection-engineering","Detection engineering turns threat research into reliable, high-fidelity detections — and as AI accelerates the churn of attacker infrastructure, indicator-based detection is collapsing in favor of technique-level approaches. Here you’ll find teardowns of AiTM kits, ClickFix pages, and malvertising campaigns, alongside Push’s own account of building an agentic threat hunting pipeline that turns hunts into shipped detections.",42,{"sys":356,"faqItemsCollection":358,"name":360,"slug":361,"tier":45,"intro":362,"faqTitle":59,"postCount":238,"hasPage":19},{"id":357},"topic-device-code-phishing",{"items":359},[],"Device code phishing","device-code-phishing","Device code phishing abuses the OAuth device authorization flow: attackers generate a legitimate sign-in code, trick the victim into entering it on the vendor’s real login page, and walk away with access tokens — no fake site or password capture required. Push research tracked a sharp spike in adoption during 2026 as attackers use the technique to sidestep standard access controls.",{"sys":364,"faqItemsCollection":366,"name":368,"slug":369,"tier":45,"intro":370,"faqTitle":59,"postCount":371,"hasPage":19},{"id":365},"topic-dlp",{"items":367},[],"DLP","dlp","Data loss prevention (DLP) is the practice of stopping sensitive data from leaving your control — a problem that has shifted from email and endpoints to the browser, where employees move data into SaaS and AI tools. Push applies controls at that point of use, from keeping corporate credentials out of personal password managers to governing what flows into unsanctioned apps.",15,{"sys":373,"faqItemsCollection":375,"name":377,"slug":378,"tier":45,"intro":379,"faqTitle":59,"postCount":380,"hasPage":19},{"id":374},"topic-edr",{"items":376},[],"EDR","edr","Endpoint detection and response (EDR) watches processes, files, and memory on the device — a vantage point that never sees the phishing pages, stolen sessions, and identity attacks playing out inside the browser. That’s not an EDR failure; attackers have simply moved where it can’t follow. These posts map that gap and show how Push pairs browser-level detection and response with endpoint security to close it.",24,{"sys":382,"faqItemsCollection":384,"name":386,"slug":387,"tier":45,"intro":388,"faqTitle":59,"postCount":389,"hasPage":19},{"id":383},"topic-enterprise-browser",{"items":385},[],"Enterprise browser","enterprise-browser","An enterprise browser is a standalone, security-hardened browser that organizations deploy in place of Chrome, Edge, or other defaults. The real buying question is whether replacing the browser beats securing the browsers employees already use — a trade-off these posts examine directly, alongside analysis of Omdia’s secure enterprise browser market report and Push’s framework for weighing full browsers against extension-based deployment.",6,{"sys":391,"faqItemsCollection":393,"name":395,"slug":396,"tier":45,"intro":397,"faqTitle":59,"postCount":398,"hasPage":19},{"id":392},"topic-ghost-logins",{"items":394},[],"Ghost logins","ghost-logins","Ghost logins are overlooked authentication routes into an account — like a password login lingering behind SSO, or a forgotten secondary auth method — that attackers exploit for account takeover and persistence. Push coined the term after research showing how these forgotten login paths let attackers sidestep the MFA and SSO controls guarding an account’s primary sign-in method.",48,{"sys":400,"faqItemsCollection":402,"name":404,"slug":405,"tier":45,"intro":406,"faqTitle":59,"postCount":407,"hasPage":19},{"id":401},"topic-identity-attacks",{"items":403},[],"Identity attacks","identity-attacks","Identity attacks target user accounts rather than infrastructure — phishing credentials, stealing sessions, abusing OAuth grants — because logging in is easier than hacking in. Identity-based techniques are now the leading cause of breaches. Push’s offensive research maps these techniques continuously, coining attacks like SAMLjacking and the poisoned tenant before they appeared in the wild.",56,{"sys":409,"faqItemsCollection":411,"name":413,"slug":414,"tier":31,"intro":415,"faqTitle":59,"postCount":416,"hasPage":19},{"id":410},"topic-identity-security",{"items":412},[],"Identity security","identity-security","Identity security is the practice of protecting workforce accounts, credentials, and sessions — the primary route attackers now use to breach organizations. Instead of hacking in, attackers log in: through phished credentials, stolen session tokens, MFA bypass, and forgotten ghost logins. Push’s research team documents these techniques continuously, from cross-IdP impersonation and SAMLjacking to analyses of major identity-driven breaches. This hub collects that research alongside practical guidance on MFA, SSO, and stopping account takeover.",154,{"sys":418,"faqItemsCollection":420,"name":422,"slug":423,"tier":45,"intro":424,"faqTitle":59,"postCount":425,"hasPage":19},{"id":419},"topic-infostealer",{"items":421},[],"Infostealer","infostealer","Infostealers are malware built to harvest saved passwords, cookies, and session tokens from infected devices, supplying the stolen credentials behind some of the most consequential breaches of recent years. Push traces the ecosystem trading this data and checks employee passwords against threat intel feeds, flagging verified stolen credentials before attackers can log in with them.",52,{"sys":427,"faqItemsCollection":429,"name":431,"slug":432,"tier":45,"intro":433,"faqTitle":59,"postCount":434,"hasPage":19},{"id":428},"topic-legitimate-service-abuse",{"items":430},[],"Legitimate service abuse","legitimate-service-abuse","Legitimate service abuse means staging attacks on trusted platforms — Google Ads, AI chatbot share pages, office.com links, Slack, SaaS tenants — so malicious content inherits the reputation of the service hosting it. Push research has documented the pattern repeatedly, from malvertising run through hijacked Google Ad Manager accounts to phishing links generated by Active Directory Federation Services.",28,{"sys":436,"faqItemsCollection":438,"name":440,"slug":441,"tier":45,"intro":442,"faqTitle":59,"postCount":291,"hasPage":19},{"id":437},"topic-malvertising",{"items":439},[],"Malvertising","malvertising","Malvertising uses paid search and display ads to put phishing pages and malware in front of users, often by impersonating trusted brands at the top of Google results. Push tracks these campaigns continuously — intercepting live attacks spoofing well-known brands — and has documented how criminals hijack Google Ads accounts to fund and run them.",{"sys":444,"faqItemsCollection":446,"name":448,"slug":449,"tier":45,"intro":450,"faqTitle":59,"postCount":451,"hasPage":19},{"id":445},"topic-malware-delivery",{"items":447},[],"Malware delivery","malware-delivery","Malware delivery has moved into the browser: rather than email attachments, attackers now rely on malvertising, fake install guides, and ClickFix-style copy-paste lures to get code running on endpoints. Push research on techniques like InstallFix maps the playbook, and in-browser detection of malicious copy and paste blocks these attacks before commands reach the endpoint.",13,{"sys":453,"faqItemsCollection":455,"name":457,"slug":458,"tier":45,"intro":459,"faqTitle":59,"postCount":460,"hasPage":19},{"id":454},"topic-mfa",{"items":456},[],"MFA","mfa","Multi-factor authentication (MFA) requires a second proof of identity beyond a password, and it remains one of the most effective controls against account takeover. Regulators from Cyber Essentials to NYDFS now mandate it across cloud services. Push enforces MFA in the browser on third-party apps — even those with no native enforcement option — and shows security teams where coverage gaps remain.",83,{"sys":462,"faqItemsCollection":464,"name":466,"slug":467,"tier":45,"intro":468,"faqTitle":59,"postCount":469,"hasPage":19},{"id":463},"topic-mfa-bypass",{"items":465},[],"MFA bypass","mfa-bypass","MFA bypass covers the techniques attackers use to defeat multi-factor authentication — AiTM phishing kits, consent phishing, device code phishing, and MFA downgrade attacks among them. None of these break the second factor; they route around it. Push researchers regularly get hands-on with phishing kits like Evilginx and Sneaky2FA, analyzing how these attacks work in the wild and how they evolve.",58,{"sys":471,"faqItemsCollection":473,"name":475,"slug":476,"tier":45,"intro":477,"faqTitle":59,"postCount":478,"hasPage":19},{"id":472},"topic-non-email-phishing",{"items":474},[],"Non-email phishing","non-email-phishing","Non-email phishing delivers malicious links through channels your secure email gateway never sees — social media messages, IM apps like Slack and Teams, search ads, and SMS. Push has intercepted live campaigns arriving via LinkedIn DMs, malvertising, and messaging platforms, which is why it detects phishing pages in the browser at the point of click, regardless of delivery channel.",51,{"sys":480,"faqItemsCollection":482,"name":484,"slug":485,"tier":45,"intro":486,"faqTitle":59,"postCount":487,"hasPage":19},{"id":481},"topic-oauth-abuse",{"items":483},[],"OAuth abuse","oauth-abuse","OAuth abuse is attackers exploiting app-to-app authorization — consent phishing, malicious OAuth apps, stolen tokens, and device code flows — to gain persistent access to cloud tenants without touching a password or MFA prompt. Push tracks these techniques continuously and discovered ConsentFix, a browser-native attack in the wild that pairs OAuth consent phishing with a ClickFix-style prompt.",70,{"sys":489,"faqItemsCollection":491,"name":493,"slug":494,"tier":45,"intro":495,"faqTitle":59,"postCount":496,"hasPage":19},{"id":490},"topic-passkeys",{"items":492},[],"Passkeys","passkeys","Passkeys are phishing-resistant credentials that replace passwords with cryptographic key pairs bound to a user’s device. They defeat conventional credential phishing, but attackers adapt: Push research has documented MFA downgrade, app-specific password phishing, and device code phishing being used in the wild to route around passkey-protected accounts. Deploying passkeys is step one; closing those fallback paths is step two.",21,{"sys":498,"faqItemsCollection":500,"name":502,"slug":503,"tier":45,"intro":504,"faqTitle":59,"postCount":505,"hasPage":19},{"id":499},"topic-password-security",{"items":501},[],"Password security","password-security","Password security is the practice of keeping workforce credentials strong, unique, and out of attackers’ hands — still a frontline defense while most SaaS logins depend on passwords. Expiration policies don’t fix weak or reused passwords; visibility does. Push observes real logins in the browser to flag weak, reused, and breached passwords and guide employees to reset them on any app.",79,{"sys":507,"faqItemsCollection":509,"name":511,"slug":512,"tier":45,"intro":513,"faqTitle":59,"postCount":318,"hasPage":19},{"id":508},"topic-phaas",{"items":510},[],"PhaaS","phaas","Phishing-as-a-service (PhaaS) platforms sell ready-made phishing kits, hosted infrastructure, and management panels on subscription, letting low-skill criminals run MFA-bypassing campaigns at scale. Kits like Evilginx, Tycoon2FA, Sneaky2FA, FlowerStorm, and EvilTokens each add their own evasion and session-theft capabilities, and new entrants appear regularly. Push researchers continuously get hands-on with these tools — investigating attacks in the wild, reverse-engineering kit behavior, and turning that research into detections.",{"sys":515,"faqItemsCollection":517,"name":519,"slug":520,"tier":31,"intro":521,"faqTitle":59,"postCount":522,"hasPage":19},{"id":516},"topic-phishing",{"items":518},[],"Phishing","phishing","Phishing remains the most common way attackers compromise business accounts — and it has moved far beyond suspicious emails. Modern campaigns use AiTM toolkits that bypass MFA, consent phishing against OAuth, device code phishing, and lures delivered through malvertising, LinkedIn, and Slack. Push detects and blocks these attacks in the browser, and its researchers publish teardowns of live campaigns and kits like Evilginx and Sneaky2FA. Read on for how phishing actually works today and what stops it.",91,{"sys":524,"faqItemsCollection":526,"name":528,"slug":529,"tier":45,"intro":530,"faqTitle":59,"postCount":531,"hasPage":19},{"id":525},"topic-public-breach",{"items":527},[],"Public breach","public-breach","Public breaches are the disclosed incidents that show how attacks actually unfold once the headlines fade. Push’s breach analyses keep finding identity at the entry point: stolen credentials, OAuth abuse, and missing MFA recur across the incidents analyzed here.",29,{"sys":533,"faqItemsCollection":535,"name":537,"slug":538,"tier":45,"intro":539,"faqTitle":59,"postCount":451,"hasPage":19},{"id":534},"topic-ransomware",{"items":536},[],"Ransomware","ransomware","Ransomware attacks increasingly begin with an identity, not an exploit: stolen credentials, MFA bypass, and help desk scams give operators their initial foothold. The analysis here follows that front end of the kill chain — how identity compromise leads to ransomware deployment, and the breaches driving regulators toward tighter MFA requirements.",{"sys":541,"faqItemsCollection":543,"name":545,"slug":546,"tier":31,"intro":547,"faqTitle":59,"postCount":548,"hasPage":19},{"id":542},"topic-saas-security",{"items":544},[],"SaaS security","saas-security","SaaS security means protecting the sprawl of cloud apps, accounts, and integrations your employees adopt — often without IT ever knowing. Shadow SaaS, risky OAuth grants, ghost logins, and unmanaged third-party access create attack paths traditional controls can’t see, as recent high-profile breaches have demonstrated. Building on the original SaaS attack matrix, Push continues to map SaaS-native attack techniques alongside practical guides for discovering and securing unsanctioned apps, and this hub gathers all of it.",96,{"sys":550,"faqItemsCollection":552,"name":554,"slug":555,"tier":45,"intro":556,"faqTitle":59,"postCount":557,"hasPage":6},{"id":551},"topic-security-training",{"items":553},[],"Security training","security-training","Security training aims to teach employees to recognize and avoid attacks — yet modern phishing routinely fools even seasoned security professionals. Push argues that training budgets work harder as real-time, in-browser intervention: guardrails and warnings at the moment of risk, rather than lessons employees must recall under pressure.",4,{"sys":559,"faqItemsCollection":561,"name":563,"slug":564,"tier":45,"intro":565,"faqTitle":59,"postCount":389,"hasPage":19},{"id":560},"topic-seo-poisoning",{"items":562},[],"SEO poisoning","seo-poisoning","SEO poisoning manipulates search engine results so malicious pages rank prominently for the software, tools, or services users are actively searching for, turning a routine search into an infection vector. It often pairs with malvertising and ClickFix-style payloads — Push has documented attackers abusing shared pages on legitimate AI chatbot domains to deliver malware from trusted infrastructure.",{"sys":567,"faqItemsCollection":569,"name":571,"slug":572,"tier":45,"intro":573,"faqTitle":59,"postCount":574,"hasPage":19},{"id":568},"topic-session-hijacking",{"items":570},[],"Session hijacking","session-hijacking","Session hijacking is the theft of an authenticated session — usually via stolen session cookies or tokens — letting attackers walk past passwords and MFA into a live account. AiTM phishing kits and infostealers have made it a mainstream attack technique across both criminal and targeted intrusions. Push’s browser agent detects session token theft by adding telemetry to the user agent string, creating a high-fidelity signal for security teams.",74,{"sys":576,"faqItemsCollection":578,"name":580,"slug":581,"tier":45,"intro":582,"faqTitle":59,"postCount":583,"hasPage":19},{"id":577},"topic-shadow-ai",{"items":579},[],"Shadow AI","shadow-ai","Shadow AI is employees’ unsanctioned use of AI tools at work, putting corporate data into chatbots and assistants that security teams never approved and can’t see. Push’s own browser telemetry shows AI adoption acting as a force multiplier for shadow IT — potentially now outscaling shadow SaaS — and this hub tracks that research, real-world breach examples, and practical controls.",20,{"sys":585,"faqItemsCollection":587,"name":589,"slug":590,"tier":45,"intro":591,"faqTitle":59,"postCount":592,"hasPage":19},{"id":586},"topic-shadow-saas",{"items":588},[],"Shadow SaaS","shadow-saas","Shadow SaaS is the cloud applications employees adopt for work without IT approval, each one creating unmanaged accounts, identities, and data outside your security controls. Push covers the problem end to end — from browser-based SaaS discovery to in-browser app banners and MFA enforcement — alongside breach analyses that show where unmanaged accounts lead.",75,{"sys":594,"faqItemsCollection":596,"name":598,"slug":599,"tier":45,"intro":600,"faqTitle":59,"postCount":601,"hasPage":19},{"id":595},"topic-siem",{"items":597},[],"SIEM","siem","A SIEM is only as good as the telemetry feeding it, and most log sources never see what happens inside the browser — where phishing, session token theft, and account takeover actually play out. Push streams browser-level detections and identity telemetry into SIEMs, and these posts show how that data improves detection fidelity and cuts alert fatigue.",19,{"sys":603,"faqItemsCollection":605,"name":607,"slug":608,"tier":45,"intro":609,"faqTitle":59,"postCount":610,"hasPage":19},{"id":604},"topic-social-engineering",{"items":606},[],"Social engineering","social-engineering","Social engineering is the manipulation of people — through phishing pages, help desk impersonation, vishing calls, and poisoned tenant invites — into handing over access that no exploit could take. Coverage here tracks how threat actors run these plays — drawing on Push’s ongoing investigation of live phishing infrastructure and criminal tooling.",59,{"sys":612,"faqItemsCollection":614,"name":616,"slug":617,"tier":31,"intro":618,"faqTitle":59,"postCount":557,"hasPage":6},{"id":613},"topic-supply-chain-security",{"items":615},[],"Supply chain security","supply-chain-security","Supply chain security extends beyond your own perimeter to the vendors, platforms, and browser extensions your organization depends on. A compromised third party can hand attackers legitimate access — as recent campaigns against SaaS providers have shown. Push’s research examines the browser-extension supply chain in particular: why extension risk scores fail to predict compromise, and how developers can harden extensions against takeover. These posts frame supply chain risk through a browser and identity lens.",{"sys":620,"faqItemsCollection":622,"name":624,"slug":625,"tier":45,"intro":626,"faqTitle":59,"postCount":627,"hasPage":19},{"id":621},"topic-swg",{"items":623},[],"SWG","swg","A secure web gateway (SWG) filters and inspects web traffic in transit, sitting in the network path between users and the internet. That position shows you the packet but not the session: Push’s research on AitM phishing kits documents how attackers break the signatures proxies rely on, and these posts explain why phishing detection is moving from the network path into the browser itself.",17,{"sys":629,"faqItemsCollection":631,"name":633,"slug":634,"tier":45,"intro":635,"faqTitle":59,"postCount":636,"hasPage":19},{"id":630},"topic-third-party-risk",{"items":632},[],"Third-party risk","third-party-risk","Third-party risk is the exposure your organization inherits from vendors, SaaS providers, and integrations that hold your data or access your tenants — a chain now extended one employee sign-up at a time. This hub collects Push’s breach analyses and guides for assessing OAuth integrations, managing browser extensions, and responding when a supplier is compromised.",44,{"sys":638,"faqItemsCollection":640,"name":642,"slug":643,"tier":31,"intro":644,"faqTitle":59,"postCount":398,"hasPage":19},{"id":639},"topic-threat-landscape",{"items":641},[],"Threat landscape","threat-landscape","The enterprise threat landscape is now defined by identity attacks: criminals log in with phished, stolen, or stuffed credentials rather than breaking infrastructure. Threat actors keep proving how effective help desk scams, MFA bypass, and session theft are against well-defended organizations. Drawing on breach analyses, annual phishing trend reviews, and in-the-wild campaign tracking, Push documents how attacker TTPs are shifting. This hub is where to follow those changes.",{"sys":646,"faqItemsCollection":648,"name":650,"slug":651,"tier":45,"intro":652,"faqTitle":59,"postCount":371,"hasPage":19},{"id":647},"topic-vishing",{"items":649},[],"Vishing","vishing","Vishing — voice phishing — uses phone calls to impersonate IT support, help desks, or employees, talking targets into password resets, MFA approvals, or opening attacker-controlled pages. Threat actors now routinely pair calls with AiTM phishing to hijack SSO accounts, a chain Push has analyzed across campaigns targeting hundreds of organizations.",{},"blogtopics","w0ITersBlkytyrxHNkTEFmGsSW5X9NfdbmeXV1u8bAo",[657,661,665,669,673],{"title":658,"logo":659,"createdDate":660},"SOC2","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fb6727a5e00004d6e9e69fc3068b8b64c",1784291539953,{"title":662,"logo":663,"createdDate":664},"GDPR","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffe49f53211674deaa5a6640d929cdf42?format=webp",1784291672535,{"title":666,"logo":667,"createdDate":668},"Cyber essentials","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F53558c1045a342a7a28def960cd54ae7?format=webp",1784291702710,{"title":670,"logo":671,"createdDate":672},"ISO IEC 27001","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F578a404a61cf45db951a41fe3554d12d",1784291766222,{"title":674,"logo":675,"createdDate":676},"ISO IEC 27701","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fbe219844b13242fbba531959579a753c",1784291858848,[678,730,775],{"id":679,"label":680,"text":21,"navIcon":681,"items":682},"stop-browser-based-attacks","Stop browser-based attacks","solid:faShieldHalved",[683,688,693,698,703,708,712,717,721,725],{"title":684,"text":685,"url":686,"navIcon":687},"Adversary-in-the-Middle","Detect and block AiTM proxies stealing session tokens.","/solution/stop-browser-based-attacks/adversary-in-the-middle-attacks","solid:faUserSecret",{"title":689,"text":690,"url":691,"navIcon":692},"ClickFix (+Fix variants)","Block attacks that trick users into running malicious code.","/solution/stop-browser-based-attacks/clickfix-fix-variants","sharp-regular:faLaptopCode",{"title":694,"text":695,"url":696,"navIcon":697},"Malicious OAuth integrations","Detect suspicious OAuth consent flows and stop persistent access.","/solution/stop-browser-based-attacks/malicious-oauth-integrations","solid:faPlugCircleXmark",{"title":699,"text":700,"url":701,"navIcon":702},"Malicious browser extensions","Shine a light on risky browser extensions.","/solution/stop-browser-based-attacks/malicious-browser-extensions","sharp-regular:faPuzzlePiece",{"title":704,"text":705,"url":706,"navIcon":707},"Malicious file downloads","Gain visibility into browser downloads and block malicious files.","/solution/stop-browser-based-attacks/malicious-file-downloads","solid:faFileCircleXmark",{"title":395,"text":709,"url":710,"navIcon":711},"Surface hidden login paths that bypass SSO and expose accounts.","/solution/stop-browser-based-attacks/ghost-logins","solid:faGhost",{"title":713,"text":714,"url":715,"navIcon":716},"Mobile phishing (QR & SMS)","Detect phishing links delivered via SMS and QR codes.","/solution/stop-browser-based-attacks/mobile-phishing-qr-code-sms","solid:faQrcode",{"title":333,"text":718,"url":719,"navIcon":720},"Identify reused and compromised credentials across SaaS logins.","/solution/stop-browser-based-attacks/credential-stuffing","custom:credentialStuffing",{"title":571,"text":722,"url":723,"navIcon":724},"Detect and block stolen session tokens before attackers get access.","/solution/stop-browser-based-attacks/session-hijacking","solid:faCookieBite",{"title":726,"text":727,"url":728,"navIcon":729},"Zero-day phishing","Detect phishing TTPs directly in the browser and stop credential theft.","/solution/stop-browser-based-attacks/zero-day-phishing","sharp-regular:faFishingRod",{"id":731,"label":732,"text":21,"navIcon":733,"items":734},"achieve-security-outcomes","Achieve security outcomes","solid:faCheckToSlot",[735,740,745,750,755,760,765,770],{"title":736,"text":737,"url":738,"navIcon":739},"Stop account takeover","Stop ATO with stolen credential and compromised token detection.","/solution/achieve-security-outcomes/stop-account-takeover","sharp-regular:faUserSecret",{"title":741,"text":742,"url":743,"navIcon":744},"Harden unmanaged identities","Harden access paths with visibility, detection, and guardrails.","/solution/achieve-security-outcomes/harden-unmanaged-identities","sharp-regular:faRadar",{"title":746,"text":747,"url":748,"navIcon":749},"Investigate browser-related incidents","Investigate and respond faster with unique browser telemetry.","/solution/achieve-security-outcomes/investigate-browser-related-incidents","sharp-regular:faSatelliteDish",{"title":751,"text":752,"url":753,"navIcon":754},"Secure shadow SaaS","See and control shadow SaaS in the browser.","/solution/achieve-security-outcomes/secure-shadow-saas","sharp-regular:faShieldCheck",{"title":756,"text":757,"url":758,"navIcon":759},"Secure AI","See and control AI apps in the browser.","/solution/achieve-security-outcomes/secure-ai","sharp-regular:faBrainCircuit",{"title":761,"text":762,"url":763,"navIcon":764},"Secure BYOD","Extend consistent browser-based protection to unmanaged devices.","/solution/achieve-security-outcomes/secure-bring-your-own-device","solid:faMobileScreenButton",{"title":766,"text":767,"url":768,"navIcon":769},"Secure Chromebooks","Secure browser activity on Chromebooks without endpoint agents.","/solution/achieve-security-outcomes/secure-chromebooks","brands:faChrome",{"title":771,"text":772,"url":773,"navIcon":774},"Investigate and stop data loss","Detect and prevent data loss across AI tools, apps, and sessions.","/solution/achieve-security-outcomes/investigate-and-stop-data-loss","custom:investigateAndStopDataLoss",{"id":776,"label":777,"text":21,"navIcon":778,"items":779},"tool-replacements","Tool replacements","solid:faScrewdriverWrench",[780,785,790,795],{"title":781,"text":782,"url":783,"navIcon":784},"Remote browser isolation","Detect attacks that look like normal browsing.","/solution/tool-replacements/remote-browser-isolation","solid:faDisplay",{"title":786,"text":787,"url":788,"navIcon":789},"Secure web gateways","Detect attacks inside the browser after SWGs allowed the connection.","/solution/tool-replacements/secure-web-gateways","solid:faFilter",{"title":791,"text":792,"url":793,"navIcon":794},"Cloud access security broker","Catch browser-based identity threats in real time, not after the fact.","/solution/tool-replacements/cloud-access-security-broker","solid:faCloudArrowUp",{"title":796,"text":797,"url":798,"navIcon":799},"Security awareness training","Block real phishing instead of training users on simulations.","/solution/tool-replacements/security-awareness-training","custom:securityAwareness",{"w":801,"h":802,"d":803},448,512,"M171-16c-36.4 0-57.8 58.3-68.3 112L72 96c-13.3 0-24 10.7-24 24s10.7 24 24 24l24 0 0 32c0 17 3.3 33.2 9.3 48l-9.3 0 0 0-20.5 0c-15.2 0-27.5 12.3-27.5 27.5 0 3 .5 5.9 1.4 8.7l28.9 86.6C40.2 379.6 16 428.1 16 482.3 16 498.7 29.3 512 45.7 512l356.6 0c16.4 0 29.7-13.3 29.7-29.7 0-54.2-24.2-102.7-62.3-135.4l28.9-86.6c.9-2.8 1.4-5.7 1.4-8.7 0-15.2-12.3-27.5-27.5-27.5l-20.5 0 0 0-9.3 0c6-14.8 9.3-31 9.3-48l0-32 24 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-30.7 0c-10.4-53.7-31.9-112-68.3-112-9.6 0-19 3.9-27.5 8.2-8.2 4.1-18.4 7.8-25.5 7.8s-17.3-3.7-25.5-7.8C190-12.1 180.6-16 171-16zm93.7 484.4l-24.8-70.9 27.9-32.5c2.7-3.2 4.2-7.2 4.2-11.4 0-9.7-7.8-17.5-17.5-17.5l-61 0c-9.7 0-17.5 7.8-17.5 17.5 0 4.2 1.5 8.2 4.2 11.4l27.9 32.5-24.8 70.9-57-180.4 35.7 0c18.4 10.2 39.5 16 62 16s43.6-5.8 62-16l35.7 0-57 180.4zM224 256c-34.7 0-64.2-22.1-75.3-53 5.7 3.2 12.3 5 19.3 5l12.4 0c16.5 0 31.1-10.6 36.3-26.2 2.3-7 12.2-7 14.5 0 5.2 15.6 19.9 26.2 36.3 26.2l12.4 0c7 0 13.6-1.8 19.3-5-11.1 30.9-40.6 53-75.3 53z",{"w":17,"h":802,"d":805},"M112 80l416 0 0 224 48 0 0-272-512 0 0 272 48 0 0-224zM48 404.1l0-4.1 544 0 0 4.1-27.9 27.9-488.2 0-27.9-27.9zM592 352l-592 0 0 72 56 56 528 0 56-56 0-72-48 0zM281 169l17-17-33.9-33.9c-6.1 6.1-27.8 27.8-65 65l-17 17c6.1 6.1 27.8 27.8 65 65l17 17 33.9-33.9c-9-9-25-25-48-48l31-31zM393 135l-17-17-33.9 33.9c9 9 25 25 48 48-23 23-39 39-48 48L376 281.9c6.1-6.1 27.8-27.8 65-65l17-17c-6.1-6.1-27.8-27.8-65-65z",{"w":17,"h":802,"d":807},"M192-32c17.7 0 32 14.3 32 32l0 96 128 0 0-96c0-17.7 14.3-32 32-32s32 14.3 32 32l0 96 64 0c17.7 0 32 14.3 32 32s-14.3 32-32 32l0 48.7c-98.6 8.1-176 90.7-176 191.3 0 27.3 5.7 53.3 16 76.9l0 3.1c0 17.7-14.3 32-32 32s-32-14.3-32-32l0-66.7C165.2 398.1 96 319.1 96 224l0-64c-17.7 0-32-14.3-32-32S78.3 96 96 96l64 0 0-96c0-17.7 14.3-32 32-32zM496 256a144 144 0 1 1 0 288 144 144 0 1 1 0-288zm59.3 107.3c6.2-6.2 6.2-16.4 0-22.6s-16.4-6.2-22.6 0l-36.7 36.7-36.7-36.7c-6.2-6.2-16.4-6.2-22.6 0s-6.2 16.4 0 22.6l36.7 36.7-36.7 36.7c-6.2 6.2-6.2 16.4 0 22.6s16.4 6.2 22.6 0l36.7-36.7 36.7 36.7c6.2 6.2 16.4 6.2 22.6 0s6.2-16.4 0-22.6l-36.7-36.7 36.7-36.7z",{"w":802,"h":802,"d":809},"M201.1 57.3c-7 5.3-9.1 10.7-9.1 14.7 0 4.5 2.8 11.2 12.4 16.9l11.6 7 0 48.1-168 0 0 60.5c7.4-2.9 15.5-4.5 24-4.5 43.1 0 72 39.4 72 80s-28.9 80-72 80c-8.5 0-16.6-1.6-24-4.5l0 108.5 108.5 0c-2.9-7.4-4.5-15.5-4.5-24 0-43.1 39.4-72 80-72s80 28.9 80 72c0 8.5-1.6 16.6-4.5 24l60.5 0 0-168 48.1 0 7 11.6c5.8 9.6 12.4 12.4 16.9 12.4 4 0 9.5-2.1 14.7-9.1s9.3-17.9 9.3-30.9-4-23.8-9.3-30.9-10.7-9.1-14.7-9.1c-4.5 0-11.2 2.8-16.9 12.4l-7 11.6-48.1 0 0-120-120 0 0-48.1 11.6-7c9.6-5.8 12.4-12.4 12.4-16.9 0-4-2.1-9.5-9.1-14.7S245 48 232 48 208.2 52 201.1 57.3zM172.3 18.9C188.5 6.8 209.6 0 232 0S275.5 6.8 291.7 18.9 320 49.5 320 72c0 8.6-1.8 16.7-4.9 24l100.9 0 0 100.9c7.3-3.1 15.4-4.9 24-4.9 22.5 0 41 12.2 53.1 28.3s18.9 37.3 18.9 59.7-6.8 43.5-18.9 59.7-30.6 28.3-53.1 28.3c-8.6 0-16.7-1.8-24-4.9l0 148.9-168 0 0-49.3 8.2-7.2c5.4-4.7 7.8-10.3 7.8-15.5 0-9.9-10.7-24-32-24s-32 14.1-32 24c0 5.3 2.4 10.8 7.8 15.5l8.2 7.2 0 49.3-216 0 0-216 49.3 0 7.2 8.2c4.7 5.4 10.3 7.8 15.5 7.8 9.9 0 24-10.7 24-32s-14.1-32-24-32c-5.3 0-10.8 2.4-15.5 7.8L49.3 264 0 264 0 96 148.9 96c-3.1-7.3-4.9-15.4-4.9-24 0-22.5 12.2-41 28.3-53.1z",{"w":811,"h":802,"d":812},576,"M96 0C60.7 0 32 28.7 32 64l0 384c0 35.3 28.7 64 64 64l180 0c-22.7-31.5-36-70.2-36-112 0-100.6 77.4-183.2 176-191.3l0-38.1c0-17-6.7-33.3-18.7-45.3L290.7 18.7C278.7 6.7 262.5 0 245.5 0L96 0zM357.5 176L264 176c-13.3 0-24-10.7-24-24L240 58.5 357.5 176zM432 544a144 144 0 1 0 0-288 144 144 0 1 0 0 288zm59.3-180.7l-36.7 36.7 36.7 36.7c6.2 6.2 6.2 16.4 0 22.6s-16.4 6.2-22.6 0l-36.7-36.7-36.7 36.7c-6.2 6.2-16.4 6.2-22.6 0s-6.2-16.4 0-22.6l36.7-36.7-36.7-36.7c-6.2-6.2-6.2-16.4 0-22.6s16.4-6.2 22.6 0l36.7 36.7 36.7-36.7c6.2-6.2 16.4-6.2 22.6 0s6.2 16.4 0 22.6z",{"w":814,"h":802,"d":815},384,"M40.1 467.1l-11.2 9C25.7 478.6 21.8 480 17.8 480 8 480 0 472 0 462.2L0 192C0 86 86 0 192 0S384 86 384 192l0 270.2c0 9.8-8 17.8-17.8 17.8-4 0-7.9-1.4-11.1-3.9l-11.2-9c-13.4-10.7-32.8-9-44.1 3.9L269.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6l-26.6-30.5c-12.7-14.6-35.4-14.6-48.2 0L141.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6L84.2 471c-11.3-12.9-30.7-14.6-44.1-3.9zM160 192a32 32 0 1 0 -64 0 32 32 0 1 0 64 0zm96 32a32 32 0 1 0 0-64 32 32 0 1 0 0 64z",{"w":801,"h":802,"d":817},"M64 160l64 0 0-64-64 0 0 64zM0 80C0 53.5 21.5 32 48 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48L0 80zM64 416l64 0 0-64-64 0 0 64zM0 336c0-26.5 21.5-48 48-48l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96zM320 96l0 64 64 0 0-64-64 0zM304 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96c0-26.5 21.5-48 48-48zM288 352a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm0 64c17.7 0 32 14.3 32 32s-14.3 32-32 32-32-14.3-32-32 14.3-32 32-32zm96 32c0-17.7 14.3-32 32-32s32 14.3 32 32-14.3 32-32 32-32-14.3-32-32zm32-96a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm-32 32a32 32 0 1 1 -64 0 32 32 0 1 1 64 0z",{"w":802,"h":802,"d":819},"M257.5 27.6c-.8-5.4-4.9-9.8-10.3-10.6-22.1-3.1-44.6 .9-64.4 11.4l-74 39.5C89.1 78.4 73.2 94.9 63.4 115L26.7 190.6c-9.8 20.1-13 42.9-9.1 64.9l14.5 82.8c3.9 22.1 14.6 42.3 30.7 57.9l60.3 58.4c16.1 15.6 36.6 25.6 58.7 28.7l83 11.7c22.1 3.1 44.6-.9 64.4-11.4l74-39.5c19.7-10.5 35.6-27 45.4-47.2l36.7-75.5c9.8-20.1 13-42.9 9.1-64.9-.9-5.3-5.3-9.3-10.6-10.1-51.5-8.2-92.8-47.1-104.5-97.4-1.8-7.6-8-13.4-15.7-14.6-54.6-8.7-97.7-52-106.2-106.8zM208 144a32 32 0 1 1 0 64 32 32 0 1 1 0-64zM144 336a32 32 0 1 1 64 0 32 32 0 1 1 -64 0zm224-64a32 32 0 1 1 0 64 32 32 0 1 1 0-64z",{"w":801,"h":802,"d":821},"M284.6 0l91.4 0 0 160-48 0 0-112-36.6 0-203.4 58.1 0 181.9 40 0 0 224-128 0 0-224 40 0 0-218.1 17.4-5 224-64 3.2-.9zM80 336l-32 0 0 128 32 0 0-128zm176 8c0-76.8 64-136 96-152 32 16 96 75.2 96 152 0 32-16 80-64 112l32 40 0 16-128 0 0-16 32-40c-48-32-64-80-64-112zm128-32a24 24 0 1 0 -48 0 24 24 0 1 0 48 0z",{"w":801,"h":802,"d":823},"M144-16l-48 112-48 0 0 48 48 0 0 32c0 17 3.3 33.2 9.3 48l-73.3 0 0 32 5.3 16 26.7 80-64 160 51.7 0 56.9-142.2 6.5-16.3c-1-3.1-10.1-30.3-27.2-81.5l51.4 0c22.6 19.9 52.2 32 84.7 32s62.1-12.1 84.7-32l51.4 0c-17.1 51.2-26.1 78.4-27.2 81.5l6.5 16.3 56.9 142.2 51.7 0-64-160 26.7-80 5.3-16 0-32-73.3 0c6-14.8 9.3-31 9.3-48l0-32 48 0 0-48-48 0-48-112-32 0-48 32-48-32-32 0zm80 272c-32.8 0-61-19.7-73.3-48l57.3 0 16-40 16 40 57.3 0c-12.3 28.3-40.5 48-73.3 48zm17.5 139.6l30.5-35.6 0-24-96 0 0 24 30.5 35.6-46.5 116.4 128 0-46.5-116.4z",{"w":802,"h":802,"d":825},"M497.4 49l17-17-33.9-33.9C473.6 4.9 453.3 25.2 419.7 58.8 375.4 22.1 318.5 0 256.4 0 115.1 0 .4 114.6 .4 256s114.6 256 256 256 256-114.6 256-256l-48 0c0 114.9-93.1 208-208 208s-208-93.1-208-208 93.1-208 208-208c48.8 0 93.7 16.8 129.1 44.9l-45.7 45.7c-23.5-16.8-52.3-26.6-83.4-26.6-79.5 0-144 64.5-144 144s64.5 144 144 144 144-64.5 144-144l-48 0c0 53-43 96-96 96s-96-43-96-96 43-96 96-96c17.8 0 34.5 4.8 48.8 13.3-52 52-79.5 79.5-82.7 82.7l33.9 33.9 17-17 224-224z",{"w":802,"h":802,"d":827},"M208 0l24 0C386.6 0 512 125.4 512 280l0 24-48 0 0-24C464 151.9 360.1 48 232 48l-24 0 0-48zm24 96c101.6 0 184 82.4 184 184l0 24-48 0 0-24c0-75.1-60.9-136-136-136l-24 0 0-48 24 0zM48 256c0 114.9 93.1 208 208 208 22.9 0 45-3.7 65.6-10.5l-263-263C51.7 211 48 233.1 48 256zM0 256c0-36.5 7.6-71.3 21.4-102.7 6.7-15.3 14.9-29.9 24.4-43.5 7.7 7.7 61.5 61.5 161.2 161.2 30.5-30.5 49.5-49.5 57-57L297.9 248c-7.5 7.5-26.5 26.5-57 57 99.7 99.7 153.5 153.5 161.2 161.2-13.6 9.5-28.2 17.7-43.5 24.4-31.4 13.8-66.2 21.4-102.7 21.4-141.4 0-256-114.6-256-256z",{"w":802,"h":802,"d":829},"M267.6 4.5l207.5 80.5 19.2 7.4 1.2 20.5c2.9 50-4.9 126.3-37.3 200.9-32.7 75.2-91.1 150-189.4 192.5l-12.7 5.5-12.7-5.5C144.9 463.9 86.6 389.2 53.9 313.9 21.5 239.3 13.7 162.9 16.6 113L17.8 92.5 37 85 244.5 4.5 256 0 267.6 4.5zM64.1 126C63.1 169.5 71 232.9 97.9 294.8 126.1 359.7 175 422.4 256 459.6 337.1 422.4 385.9 359.7 414.2 294.8 441 232.9 449 169.5 448 126L256 51.5 64.1 126zm302.3 44.7L352.3 190.1 249.8 330.9 233 354c-8.8-9.1-30.9-32-66.2-68.6l-16.7-17.3 34.5-33.3c9.5 9.8 23.9 24.7 43.2 44.7l85.6-117.7 14.1-19.4 38.8 28.2z",{"w":802,"h":802,"d":831},"M192 48l40 0 0 108-12.4 0c-7.6-16.5-24.3-28-43.6-28-26.5 0-48 21.5-48 48s21.5 48 48 48c19.4 0 36.1-11.5 43.6-28l12.4 0 0 56-92 0 0 56.4c-16.5 7.6-28 24.3-28 43.6 0 26.5 21.5 48 48 48s48-21.5 48-48c0-19.4-11.5-36.1-28-43.6l0-16.4 52 0 0 172-40 0c-16.8 0-31.2-10.3-37.1-25.1l-6.4-16-17.2 1c-1.1 .1-2.2 .1-3.2 .1-30.9 0-56-25.1-56-56 0-9.5 2.4-18.5 6.5-26.3l8.7-16.2-13.4-12.6c-11-10.2-17.8-24.8-17.8-40.9 0-21.6 12.2-40.4 30.3-49.8l22.6-11.7-13.1-21.9c-5-8.4-7.9-18.1-7.9-28.6 0-30.9 25.1-56 56-56l24 0 0-32c0-13.3 10.7-24 24-24zm88 148l12.4 0c7.6 16.5 24.3 28 43.6 28 26.5 0 48-21.5 48-48s-21.5-48-48-48c-19.4 0-36.1 11.5-43.6 28l-12.4 0 0-108 40 0c13.3 0 24 10.7 24 24l0 32 24 0c30.9 0 56 25.1 56 56 0 10.5-2.9 20.3-7.9 28.6l-13.1 21.9 22.6 11.7c18 9.3 30.3 28.1 30.3 49.8 0 16.1-6.8 30.7-17.8 40.9l-13.4 12.6 8.7 16.2c4.2 7.8 6.5 16.7 6.5 26.3 0 30.9-25.1 56-56 56-1.1 0-2.2 0-3.2-.1l-17.2-1-6.4 16C351.2 453.7 336.8 464 320 464l-40 0 0-76 92 0 0-56.4c16.5-7.6 28-24.3 28-43.6 0-26.5-21.5-48-48-48s-48 21.5-48 48c0 19.4 11.5 36.1 28 43.6l0 16.4-52 0 0-152zM192 512l128 0c31.1 0 58.4-16.2 74.1-40.5 52.7-5.1 93.9-49.5 93.9-103.5 0-11.5-1.9-22.5-5.3-32.9 13.4-17.5 21.3-39.4 21.3-63.1 0-32-14.5-60.6-37.1-79.7 3.3-10.2 5.1-21.1 5.1-32.3 0-49.6-34.8-91.1-81.3-101.5-6.3-33.3-35.6-58.5-70.7-58.5L192 0c-35.1 0-64.4 25.2-70.7 58.5-46.5 10.4-81.3 51.9-81.3 101.5 0 11.3 1.8 22.2 5.1 32.3-22.7 19.1-37.1 47.7-37.1 79.7 0 23.7 8 45.6 21.3 63.1-3.5 10.4-5.3 21.4-5.3 32.9 0 54 41.2 98.5 93.9 103.5 15.6 24.3 42.9 40.5 74.1 40.5zM336 192a16 16 0 1 1 0-32 16 16 0 1 1 0 32zm32 96a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zM176 352a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zm16-176a16 16 0 1 1 -32 0 16 16 0 1 1 32 0z",{"w":814,"h":802,"d":833},"M16 64C16 28.7 44.7 0 80 0L304 0c35.3 0 64 28.7 64 64l0 384c0 35.3-28.7 64-64 64L80 512c-35.3 0-64-28.7-64-64L16 64zm64 0l0 304 224 0 0-304-224 0zM192 472c17.7 0 32-14.3 32-32s-14.3-32-32-32-32 14.3-32 32 14.3 32 32 32z",{"w":802,"h":802,"d":835},"M0 256c0-46.6 12.5-90.4 34.3-128.9L144.1 318.3c21.9 39.2 63.8 65.7 111.9 65.7 14.3 0 27.1-2.3 40.8-6.6L220.5 509.6C95.9 492.3 0 385.3 0 256zm365.1 65.6c12.3-19.2 18.9-42.5 18.9-65.6 0-38.2-16.8-72.5-43.3-96l152.7 0c12 29.6 18.6 62.1 18.6 96 0 141.4-114.6 255.1-256 256L365.1 321.6zM477.8 128L256 128c-62.9 0-113.7 44.1-125.5 102.7L54.2 98.5C101 38.5 174 0 256 0 350.8 0 433.5 51.5 477.8 128zM344 256a88 88 0 1 1 -176 0 88 88 0 1 1 176 0z",{"w":802,"h":802,"d":837},"M448 96l0 256-384 0 0-256 384 0zM64 32C28.7 32 0 60.7 0 96L0 352c0 35.3 28.7 64 64 64l144 0-16 48-72 0c-13.3 0-24 10.7-24 24s10.7 24 24 24l272 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-72 0-16-48 144 0c35.3 0 64-28.7 64-64l0-256c0-35.3-28.7-64-64-64L64 32z",{"w":802,"h":802,"d":839},"M32 64C19.1 64 7.4 71.8 2.4 83.8S.2 109.5 9.4 118.6L192 301.3 192 416c0 8.5 3.4 16.6 9.4 22.6l64 64c9.2 9.2 22.9 11.9 34.9 6.9S320 492.9 320 480l0-178.7 182.6-182.6c9.2-9.2 11.9-22.9 6.9-34.9S492.9 64 480 64L32 64z",{"w":811,"h":802,"d":841},"M144 480c-79.5 0-144-64.5-144-144 0-63.4 41-117.2 97.9-136.5-1.3-7.7-1.9-15.5-1.9-23.5 0-79.5 64.5-144 144-144 55.4 0 103.5 31.3 127.6 77.1 14.2-8.3 30.8-13.1 48.4-13.1 53 0 96 43 96 96 0 15.7-3.8 30.6-10.5 43.7 44 20.3 74.5 64.7 74.5 116.3 0 70.7-57.3 128-128 128l-304 0zM305 191c-9.4-9.4-24.6-9.4-33.9 0l-72 72c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l31-31 0 102.1c0 13.3 10.7 24 24 24s24-10.7 24-24l0-102.1 31 31c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-72-72z",[843,4087,6735,10660,13516,15756,18435,20954,23791,26860,29920,33213,36378],{"id":844,"title":845,"authorsCollection":846,"content":854,"extension":228,"faqItemsCollection":1535,"faqTitle":59,"featured":6,"hashTags":59,"meta":1537,"metaTitle":1538,"ogImage":59,"postType":1539,"publishedDate":1540,"relatedBlogPostsCollection":1541,"slug":4003,"stem":4004,"subtitle":59,"summary":4005,"synopsis":4028,"sys":4029,"tagsCollection":4032,"topicsCollection":4040,"__hash__":4086},"blog/blog/7-things-we-learned-from-troy-hunt.json","Troy Hunt webinar recap: Lessons from 'Yes, you've been pwned' with Troy Hunt",{"items":847},[848],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":852},"Daniel Park","Daniel","Technical Content",{"url":853},"https://images.ctfassets.net/y1cdw1ablpvd/6Cwg1xVeCdzUvxBIMfnDO5/6b18ed126b53611e7b521da34f900d29/254-0-2.jpg",{"json":855,"links":1523},{"data":856,"content":857,"nodeType":1522},{},[858,867,876,880,890,910,917,924,955,974,977,985,992,1023,1030,1033,1041,1048,1055,1099,1106,1109,1117,1148,1155,1162,1194,1197,1205,1225,1232,1250,1253,1261,1268,1286,1329,1332,1340,1347,1386,1415,1466,1469,1477,1484,1491],{"data":859,"content":860,"nodeType":866},{},[861],{"data":862,"marks":863,"value":864,"nodeType":865},{},[],"The thread running through the whole conversation was identity: how attackers get it, why defenders struggle to protect it, and what the current generation of attacks means for security teams that thought they'd solved the credential problem.","text","paragraph",{"data":868,"content":874,"nodeType":875},{"target":869},{"sys":870},{"id":871,"type":872,"linkType":873},"5dcYX9bbre53KdZOF6PsyH","Link","Entry",[],"embedded-entry-block",{"data":877,"content":878,"nodeType":879},{},[],"hr",{"data":881,"content":882,"nodeType":889},{},[883],{"data":884,"marks":885,"value":888,"nodeType":865},{},[886],{"type":887},"bold","1. Compromised credentials are everywhere, and most organizations can't tell which ones matter","heading-1",{"data":891,"content":892,"nodeType":866},{},[893,897,906],{"data":894,"marks":895,"value":896,"nodeType":865},{},[],"The scale of enterprise identity is the backdrop for the entire conversation. The average employee maintains around 15 SaaS accounts, and only a fraction of those sit behind SSO. Of the last million logins observed by Push, ",{"data":898,"content":900,"nodeType":905},{"uri":899},"https://pushsecurity.com/blog/the-cisos-data-problem-and-how-browser-telemetry-can-help/",[901],{"data":902,"marks":903,"value":904,"nodeType":865},{},[],"1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA, and 1 in 5 used a weak, breached, or reused password","hyperlink",{"data":907,"marks":908,"value":909,"nodeType":865},{},[],". That's the starting posture — before you even account for how many of those credentials have already been stolen.",{"data":911,"content":912,"nodeType":866},{},[913],{"data":914,"marks":915,"value":916,"nodeType":865},{},[],"Troy's data suggests the answer is: most of them. \"We know credential reuse is massive,\" he said. \"We know attackers get credentials from one data breach and then they go along and they try them on all sorts of different services, and now you've got one data breach leading to multiple account takeovers.\" His service now holds billions of email addresses, monitors 400,000 domains including more than half the Fortune 500, and sends millions of breach notifications every year.",{"data":918,"content":919,"nodeType":866},{},[920],{"data":921,"marks":922,"value":923,"nodeType":865},{},[],"The problem compounds because, as Troy put it, \"data never really dies.\" Employees leave, but their credentials persist in breach datasets and across the SaaS apps they signed up for during their tenure. When an organization pulls its breach exposure data, a significant proportion of what comes back is noise — departed employees, fabricated email addresses, accounts for services that were never sanctioned. Mark described the operational reality: getting a notification that an email address has appeared in a breach \"can be very helpful context, but can also be a recipe for spending some time only to find out that maybe that person left two years ago.\"",{"data":925,"content":926,"nodeType":866},{},[927,931,939,943,951],{"data":928,"marks":929,"value":930,"nodeType":865},{},[],"The proof is in the breaches. The ",{"data":932,"content":934,"nodeType":905},{"uri":933},"https://pushsecurity.com/blog/snowflake-retro/",[935],{"data":936,"marks":937,"value":938,"nodeType":865},{},[],"Snowflake incident",{"data":940,"marks":941,"value":942,"nodeType":865},{},[]," was the watershed example — 80% of the compromised accounts had prior breach exposure in datasets dating back to 2020, but without MFA enforcement and without visibility into which credentials were actively in use, those warnings went unanswered while attackers walked in through the front door. The accounts still had local, password-based logins enabled — ",{"data":944,"content":946,"nodeType":905},{"uri":945},"https://pushsecurity.com/blog/ghost-logins-when-forgotten-identities-come-back-to-haunt-you/",[947],{"data":948,"marks":949,"value":950,"nodeType":865},{},[],"ghost logins",{"data":952,"marks":953,"value":954,"nodeType":865},{},[]," that persisted even in environments that thought they'd moved to SSO.",{"data":956,"content":957,"nodeType":866},{},[958,962,970],{"data":959,"marks":960,"value":961,"nodeType":865},{},[],"Push's approach is to ",{"data":963,"content":965,"nodeType":905},{"uri":964},"https://pushsecurity.com/blog/verified-stolen-credential-detection/",[966],{"data":967,"marks":968,"value":969,"nodeType":865},{},[],"match breach intelligence against observed login behavior",{"data":971,"marks":972,"value":973,"nodeType":865},{},[]," — correlating stolen credential feeds with the authentication events Push sees in the browser, so that a compromised credential only generates an alert when someone is actively logging in with it. That eliminates 99% of the false positives that make raw breach feeds so painful to operationalize, and turns a low-fidelity data source into something security teams can actually act on.",{"data":975,"content":976,"nodeType":879},{},[],{"data":978,"content":979,"nodeType":889},{},[980],{"data":981,"marks":982,"value":984,"nodeType":865},{},[983],{"type":887},"2. Attacks aren't slowing down — they're industrializing",{"data":986,"content":987,"nodeType":866},{},[988],{"data":989,"marks":990,"value":991,"nodeType":865},{},[],"With that many vulnerable credentials sitting in circulation, the question is how easily attackers can exploit them — and the answer, as Troy described it, is easier than ever. \"There's almost like the democratization of hacking tools,\" he said. \"When you get all of these things as a service — phishing as a service, ransomware as a service — you don't need to be particularly technically smart if you can go and pay someone else for access to their infrastructure.\"",{"data":993,"content":994,"nodeType":866},{},[995,999,1007,1011,1019],{"data":996,"marks":997,"value":998,"nodeType":865},{},[],"The criminal tooling ecosystem now mirrors legitimate SaaS: turnkey platforms with tiered pricing, customer support, and continuous development cycles. Phishing-as-a-Service kits like ",{"data":1000,"content":1002,"nodeType":905},{"uri":1001},"https://pushsecurity.com/blog/2025-top-phishing-trends/",[1003],{"data":1004,"marks":1005,"value":1006,"nodeType":865},{},[],"Tycoon2FA",{"data":1008,"marks":1009,"value":1010,"nodeType":865},{},[]," — responsible for 62% of phishing blocked by Microsoft — offer turnkey AiTM infrastructure that intercepts session tokens in real time and bypasses MFA out of the box. The kits are also converging: AiTM platforms are adding device code phishing modules, credential harvesting kits are adding session token capture, and ",{"data":1012,"content":1014,"nodeType":905},{"uri":1013},"https://pushsecurity.com/blog/introducing-the-browser-and-identity-attacks-matrix/",[1015],{"data":1016,"marks":1017,"value":1018,"nodeType":865},{},[],"60–70% of phishing attacks now originate from PhaaS platforms",{"data":1020,"marks":1021,"value":1022,"nodeType":865},{},[],". The sophistication of the attack no longer reflects the sophistication of the attacker.",{"data":1024,"content":1025,"nodeType":866},{},[1026],{"data":1027,"marks":1028,"value":1029,"nodeType":865},{},[],"As Troy said: \"If you look at this through the lens of the moral neutrality of technology, that rising tide lifts all boats. And some of those boats are criminals who can now do things easier than before.\"",{"data":1031,"content":1032,"nodeType":879},{},[],{"data":1034,"content":1035,"nodeType":889},{},[1036],{"data":1037,"marks":1038,"value":1040,"nodeType":865},{},[1039],{"type":887},"3. You don't need to be a hacker to breach a Fortune 100 company",{"data":1042,"content":1043,"nodeType":866},{},[1044],{"data":1045,"marks":1046,"value":1047,"nodeType":865},{},[],"One of the most striking threads in the conversation was Troy's observation about who is actually behind these breaches — and how little technical sophistication they bring to the table. \"The average age of people that are being arrested for a lot of these data breach style activities is around about 19,\" he said. \"Fortune 100 companies are being breached by a kid in his bedroom. That is wild.\"",{"data":1049,"content":1050,"nodeType":866},{},[1051],{"data":1052,"marks":1053,"value":1054,"nodeType":865},{},[],"The leverage is disproportionate precisely because the attacks don't require deep technical skill. \"A lot of the attacks lately have been social engineering attacks,\" Troy continued, noting with parental familiarity that \"kids are great at social engineering — if you've got kids, you know how good they are at social engineering.\"",{"data":1056,"content":1057,"nodeType":866},{},[1058,1062,1072,1076,1084,1088,1095],{"data":1059,"marks":1060,"value":1061,"nodeType":865},{},[],"The ",{"data":1063,"content":1065,"nodeType":905},{"uri":1064},"https://pushsecurity.com/blog/analyzing-the-instructure-breach/",[1066],{"data":1067,"marks":1068,"value":1071,"nodeType":865},{},[1069],{"type":1070},"underline","ShinyHunters",{"data":1073,"marks":1074,"value":1075,"nodeType":865},{},[]," ecosystem — the group Troy and Mark discussed as the dominant threat actor at the time of recording — exemplifies this pattern. They're getting into Salesforce instances via voice phishing, not through zero-day exploits, and the tooling behind their campaigns is industrialized enough that Push's research team was able to ",{"data":1077,"content":1079,"nodeType":905},{"uri":1078},"https://pushsecurity.com/blog/inside-criminal-phishing-panel/",[1080],{"data":1081,"marks":1082,"value":1083,"nodeType":865},{},[],"infiltrate one of their criminal phishing panels",{"data":1085,"marks":1086,"value":1087,"nodeType":865},{},[]," and observe real-time victim targeting across four distinct infrastructure clusters and over 400 linked domains. Our ",{"data":1089,"content":1090,"nodeType":905},{"uri":1064},[1091],{"data":1092,"marks":1093,"value":1094,"nodeType":865},{},[],"analysis of the Instructure breach",{"data":1096,"marks":1097,"value":1098,"nodeType":865},{},[]," broke down the three core techniques behind these campaigns — credential phishing, AiTM attacks, and account takeover — none of which require particular technical sophistication to execute.",{"data":1100,"content":1101,"nodeType":866},{},[1102],{"data":1103,"marks":1104,"value":1105,"nodeType":865},{},[],"The reproducible playbook Troy described is an identity attack pattern, not a software vulnerability. \"Once you do get a group that manages to find a reproducible pattern to gain access to these things, the same pattern is used by so many different organizations\". And identity attacks scale precisely because they target the weakest link in the chain: the way people actually log in.",{"data":1107,"content":1108,"nodeType":879},{},[],{"data":1110,"content":1111,"nodeType":889},{},[1112],{"data":1113,"marks":1114,"value":1116,"nodeType":865},{},[1115],{"type":887},"4. Your attack surface is bigger than your org chart",{"data":1118,"content":1119,"nodeType":866},{},[1120,1124,1132,1136,1144],{"data":1121,"marks":1122,"value":1123,"nodeType":865},{},[],"Troy connected the credential problem to the broader reality of modern enterprise architecture: the attack surface isn't defined by your systems anymore — it's defined by every external dependency your employees touch. \"We're seeing attacks against the likes of Okta, because obviously Okta holds identity,\" he said. \"",{"data":1125,"content":1126,"nodeType":905},{"uri":1064},[1127],{"data":1128,"marks":1129,"value":1131,"nodeType":865},{},[1130],{"type":1070},"Salesforce",{"data":1133,"marks":1134,"value":1135,"nodeType":865},{},[],", a couple of years ago it was things like ",{"data":1137,"content":1138,"nodeType":905},{"uri":933},[1139],{"data":1140,"marks":1141,"value":1143,"nodeType":865},{},[1142],{"type":1070},"Snowflake",{"data":1145,"marks":1146,"value":1147,"nodeType":865},{},[]," — these external dependencies, and then you have so many different entry points into them.\"",{"data":1149,"content":1150,"nodeType":866},{},[1151],{"data":1152,"marks":1153,"value":1154,"nodeType":865},{},[],"When Troy tried to describe the resulting complexity, the metaphor was telling: \"If you put all of this up on the board, sort of like crime fighter style and you draw the lines between everything, it's just an absolute spider web of interdependencies and access rights.\"",{"data":1156,"content":1157,"nodeType":866},{},[1158],{"data":1159,"marks":1160,"value":1161,"nodeType":865},{},[],"Mark made the point that the attack chain itself has shifted accordingly: \"The first part of the attack, the infostealer, might not even be something that happened in your environment. You're just gonna see the tail end of that attack chain.\" An employee's credentials get harvested from a personal device, sit in a criminal marketplace for months, and then get used to log into a SaaS app that your IdP doesn't even know exists — because the employee signed up with their corporate email and a reused password. With the average employee maintaining around 15 SaaS accounts, the organizational identity surface extends far beyond what any single IdP directory shows, and most of it is completely unmanaged.",{"data":1163,"content":1164,"nodeType":866},{},[1165,1169,1178,1182,1190],{"data":1166,"marks":1167,"value":1168,"nodeType":865},{},[],"This is the identity surface area Push is built to make visible: ",{"data":1170,"content":1172,"nodeType":905},{"uri":1171},"https://pushsecurity.com/uc/shadow-saas",[1173],{"data":1174,"marks":1175,"value":1177,"nodeType":865},{},[1176],{"type":1070},"shadow SaaS",{"data":1179,"marks":1180,"value":1181,"nodeType":865},{},[]," discovered through actual login events, authentication methods observed at the point of login, and the gap between what your IdP thinks is happening and ",{"data":1183,"content":1184,"nodeType":905},{"uri":945},[1185],{"data":1186,"marks":1187,"value":1189,"nodeType":865},{},[1188],{"type":1070},"how people are actually authenticating",{"data":1191,"marks":1192,"value":1193,"nodeType":865},{},[],".",{"data":1195,"content":1196,"nodeType":879},{},[],{"data":1198,"content":1199,"nodeType":889},{},[1200],{"data":1201,"marks":1202,"value":1204,"nodeType":865},{},[1203],{"type":887},"5. Even Troy Hunt got phished, showing the need for stronger technical protections, not just more awareness training ",{"data":1206,"content":1207,"nodeType":866},{},[1208,1212,1221],{"data":1209,"marks":1210,"value":1211,"nodeType":865},{},[],"Troy recounted the story of his ",{"data":1213,"content":1215,"nodeType":905},{"uri":1214},"https://pushsecurity.com/blog/dissecting-a-recent-mailchimp-phishing-attack/",[1216],{"data":1217,"marks":1218,"value":1220,"nodeType":865},{},[1219],{"type":1070},"own phishing incident",{"data":1222,"marks":1223,"value":1224,"nodeType":865},{},[],". \"My password out of 1Password got phished. My OTP out of 1Password got phished because it was a phishable form of 2FA,\" he said. \"And as a result, my mailing list got exposed. So I had to put my own mailing list into Have I Been Pwned and then email all my subscribers, which was, to be honest, slightly embarrassing.\"",{"data":1226,"content":1227,"nodeType":866},{},[1228],{"data":1229,"marks":1230,"value":1231,"nodeType":865},{},[],"If the person who runs Have I Been Pwned — someone who has spent over a decade immersed in breach data and credential security — can get phished, the lesson clearly isn't \"pay more attention.\" Troy was explicit about the takeaway: \"It reinforces the need for technical controls that are separate and complementary to the human controls. In my own case, the human controls broke down. Unfortunately there weren't sufficient technical controls in order to save me from myself.\"",{"data":1233,"content":1234,"nodeType":866},{},[1235,1239,1246],{"data":1236,"marks":1237,"value":1238,"nodeType":865},{},[],"Mark pushed the point further during the Q&A: \"Expecting users, even well-educated ones, even security practitioners, to be able to differentiate — I think that's just not a reasonable expectation.\" When phishing arrives from ",{"data":1240,"content":1241,"nodeType":905},{"uri":1013},[1242],{"data":1243,"marks":1244,"value":1245,"nodeType":865},{},[],"legitimate domains via notification pipeline abuse",{"data":1247,"marks":1248,"value":1249,"nodeType":865},{},[],", from compromised contacts on LinkedIn, and from sponsored Google search results  the signals users were trained to look for simply don't exist anymore. Training remains valuable as a layer, but the structural argument for technical controls inside the browser was reinforced throughout the session.",{"data":1251,"content":1252,"nodeType":879},{},[],{"data":1254,"content":1255,"nodeType":889},{},[1256],{"data":1257,"marks":1258,"value":1260,"nodeType":865},{},[1259],{"type":887},"6. MFA is necessary but it's not the finish line",{"data":1262,"content":1263,"nodeType":866},{},[1264],{"data":1265,"marks":1266,"value":1267,"nodeType":865},{},[],"Both speakers returned to MFA multiple times, and the consensus was clear: any MFA beats no MFA, but treating it as a solved problem is dangerous. Troy was direct: \"You can have the world's best non-phishable 2FA. But an infostealer gets you cookie material and they can replay that and it had browser fingerprints and things in it as well, then you've still got a problem.\" ",{"data":1269,"content":1270,"nodeType":866},{},[1271,1275,1282],{"data":1272,"marks":1273,"value":1274,"nodeType":865},{},[],"Mark reinforced this: \"We're seeing a lot of post-authentication attacks — session hijacking, consent attacks — where you can have the strongest authentication methods available, but if you're sidestepping or doing a post-authentication action, that's really not gonna matter.\" And with ",{"data":1276,"content":1277,"nodeType":905},{"uri":899},[1278],{"data":1279,"marks":1280,"value":1281,"nodeType":865},{},[],"2 in 5 logins observed by Push still lacking MFA at all",{"data":1283,"marks":1284,"value":1285,"nodeType":865},{},[],", many organizations haven't yet reached the baseline where post-authentication attacks are even the primary concern — they're still exposed to straightforward credential-based compromise at scale.",{"data":1287,"content":1288,"nodeType":866},{},[1289,1293,1301,1305,1313,1317,1325],{"data":1290,"marks":1291,"value":1292,"nodeType":865},{},[],"Push addresses both halves: ",{"data":1294,"content":1296,"nodeType":905},{"uri":1295},"https://pushsecurity.com/blog/introducing-set-and-forget-controls-that-stop-real-world-identity-attacks/",[1297],{"data":1298,"marks":1299,"value":1300,"nodeType":865},{},[],"MFA enforcement guardrails",{"data":1302,"marks":1303,"value":1304,"nodeType":865},{},[]," surface where MFA is missing and guide users toward enrollment, while ",{"data":1306,"content":1308,"nodeType":905},{"uri":1307},"https://pushsecurity.com/blog/guide-how-to-use-push-controls-to-protect-your-users-from-modern-attacks/",[1309],{"data":1310,"marks":1311,"value":1312,"nodeType":865},{},[],"session hijacking detection",{"data":1314,"marks":1315,"value":1316,"nodeType":865},{},[]," and",{"data":1318,"content":1320,"nodeType":905},{"uri":1319},"https://pushsecurity.com/blog/device-code-phishing/",[1321],{"data":1322,"marks":1323,"value":1324,"nodeType":865},{},[]," authorization attack protections",{"data":1326,"marks":1327,"value":1328,"nodeType":865},{},[]," — including device code phishing detection and OAuth consent monitoring — catch the post-authentication attacks MFA was never designed to stop.",{"data":1330,"content":1331,"nodeType":879},{},[],{"data":1333,"content":1334,"nodeType":889},{},[1335],{"data":1336,"marks":1337,"value":1339,"nodeType":865},{},[1338],{"type":887},"7. The ClickFix-to-infostealer-to-account takeover flywheel",{"data":1341,"content":1342,"nodeType":866},{},[1343],{"data":1344,"marks":1345,"value":1346,"nodeType":865},{},[],"The final thread that ran through the conversation was the self-reinforcing nature of the modern attack chain. Mark laid out the cycle explicitly: \"ClickFix to infostealer to account takeover, which results then in maybe more ad account takeover, so we distribute more ClickFix and it just kind of has this compounding effect.\"",{"data":1348,"content":1349,"nodeType":866},{},[1350,1354,1361,1365,1371,1375,1382],{"data":1351,"marks":1352,"value":1353,"nodeType":865},{},[],"This isn't a linear attack path — it's a flywheel. ",{"data":1355,"content":1357,"nodeType":905},{"uri":1356},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection/",[1358],{"data":1359,"marks":1360,"value":315,"nodeType":865},{},[],{"data":1362,"marks":1363,"value":1364,"nodeType":865},{},[]," silently injects a malicious command into the victim's clipboard and instructs them to paste and execute it, delivering infostealer malware that harvests credentials and session tokens from the browser. Those stolen credentials fuel credential stuffing attacks across every SaaS app the victim has accounts on — particularly apps with ",{"data":1366,"content":1367,"nodeType":905},{"uri":945},[1368],{"data":1369,"marks":1370,"value":950,"nodeType":865},{},[],{"data":1372,"marks":1373,"value":1374,"nodeType":865},{},[]," where local password-based authentication still works even after SSO was configured. Compromised advertising and social media accounts are then used to distribute more ClickFix lures through ",{"data":1376,"content":1377,"nodeType":905},{"uri":1013},[1378],{"data":1379,"marks":1380,"value":1381,"nodeType":865},{},[],"Google search results, malvertising, and compromised websites",{"data":1383,"marks":1384,"value":1385,"nodeType":865},{},[],", and the cycle starts again.",{"data":1387,"content":1388,"nodeType":866},{},[1389,1393,1400,1404,1411],{"data":1390,"marks":1391,"value":1392,"nodeType":865},{},[],"The scale compounds with every rotation, and the numbers suggest the flywheel is already spinning fast — ",{"data":1394,"content":1395,"nodeType":905},{"uri":1013},[1396],{"data":1397,"marks":1398,"value":1399,"nodeType":865},{},[],"54% of all ransomware attacks in 2025 traced back to infostealer-enabled credential theft",{"data":1401,"marks":1402,"value":1403,"nodeType":865},{},[],", and ClickFix was identified as ",{"data":1405,"content":1406,"nodeType":905},{"uri":1013},[1407],{"data":1408,"marks":1409,"value":1410,"nodeType":865},{},[],"the most common initial access vector",{"data":1412,"marks":1413,"value":1414,"nodeType":865},{},[]," by Microsoft last year.",{"data":1416,"content":1417,"nodeType":866},{},[1418,1422,1429,1433,1440,1444,1451,1455,1462],{"data":1419,"marks":1420,"value":1421,"nodeType":865},{},[],"Push breaks the chain at multiple points: detecting ",{"data":1423,"content":1424,"nodeType":905},{"uri":1356},[1425],{"data":1426,"marks":1427,"value":1428,"nodeType":865},{},[],"ClickFix clipboard injection",{"data":1430,"marks":1431,"value":1432,"nodeType":865},{},[]," before the payload reaches the endpoint, ",{"data":1434,"content":1435,"nodeType":905},{"uri":964},[1436],{"data":1437,"marks":1438,"value":1439,"nodeType":865},{},[],"identifying stolen credentials",{"data":1441,"marks":1442,"value":1443,"nodeType":865},{},[]," when they're actively used in login attempts, flagging ",{"data":1445,"content":1446,"nodeType":905},{"uri":1295},[1447],{"data":1448,"marks":1449,"value":1450,"nodeType":865},{},[],"accounts missing MFA",{"data":1452,"marks":1453,"value":1454,"nodeType":865},{},[],", and ",{"data":1456,"content":1457,"nodeType":905},{"uri":1307},[1458],{"data":1459,"marks":1460,"value":1461,"nodeType":865},{},[],"detecting session hijacking",{"data":1463,"marks":1464,"value":1465,"nodeType":865},{},[]," when stolen tokens are replayed outside the protected browser.",{"data":1467,"content":1468,"nodeType":879},{},[],{"data":1470,"content":1471,"nodeType":889},{},[1472],{"data":1473,"marks":1474,"value":1476,"nodeType":865},{},[1475],{"type":887},"The bigger picture",{"data":1478,"content":1479,"nodeType":866},{},[1480],{"data":1481,"marks":1482,"value":1483,"nodeType":865},{},[],"The conversation with Troy reinforced something we see in our own data every day: the credential problem isn't just an awareness problem — and better technical controls are needed. Organizations know credentials get compromised, they subscribe to breach notification services, and they run security awareness training, but without the ability to match that intelligence against what's actually happening in the browser — which credentials are in active use, which accounts lack MFA, which logins bypass SSO entirely — the gap between knowing about a compromised credential and being able to do anything about it remains vast.",{"data":1485,"content":1486,"nodeType":866},{},[1487],{"data":1488,"marks":1489,"value":1490,"nodeType":865},{},[],"Troy's work at Have I Been Pwned has made that gap more visible than anyone else could, and the conversation is worth watching in full for the practitioner-level detail he brings to a problem most organizations are still underestimating.",{"data":1492,"content":1493,"nodeType":866},{},[1494,1497,1506,1510,1518],{"data":1495,"marks":1496,"value":21,"nodeType":865},{},[],{"data":1498,"content":1500,"nodeType":905},{"uri":1499},"https://pushsecurity.com/resources/yes-youve-been-pwned",[1501],{"data":1502,"marks":1503,"value":1505,"nodeType":865},{},[1504],{"type":1070},"Watch the full webinar",{"data":1507,"marks":1508,"value":1509,"nodeType":865},{},[]," to hear the full conversation — or ",{"data":1511,"content":1513,"nodeType":905},{"uri":1512},"https://pushsecurity.com/demo",[1514],{"data":1515,"marks":1516,"value":1517,"nodeType":865},{},[],"book a demo",{"data":1519,"marks":1520,"value":1521,"nodeType":865},{},[]," to see how Push turns credential intelligence into actionable detections.","document",{"entries":1524},{"hyperlink":1525,"inline":1526,"block":1527},[],[],[1528],{"sys":1529,"__typename":1530,"type":1531,"ctaText":1532,"buttonLabel":1533,"buttonColour":1534,"buttonUrl":1499},{"id":871},"CtaWidget","Custom","Watch the full webinar on demand.","Click here","sunny orange",{"items":1536},[],{},"7 things we learned from our conversation with Troy Hunt","thought-leadership","2026-05-20T00:00:00.000Z",{"items":1542},[1543,2152,3017],{"__typename":1544,"sys":1545,"content":1547,"title":2135,"synopsis":2136,"hashTags":59,"publishedDate":2137,"slug":2138,"tagsCollection":2139,"authorsCollection":2148},"BlogPosts",{"id":1546},"6V12IJexyAkFFVIrbwlNPq",{"json":1548},{"data":1549,"content":1550,"nodeType":1522},{},[1551,1571,1577,1580,1588,1639,1650,1653,1661,1680,1687,1712,1730,1733,1741,1760,1767,1774,1784,1787,1795,1826,1844,1847,1855,1874,1881,1888,1891,1899,1918,1925,1943,1953,1960,1963,1971,1988,1995,2002,2014,2024,2041,2044,2052,2059,2107],{"data":1552,"content":1553,"nodeType":866},{},[1554,1558,1567],{"data":1555,"marks":1556,"value":1557,"nodeType":865},{},[],"We recently sat down with ",{"data":1559,"content":1561,"nodeType":905},{"uri":1560},"https://www.youtube.com/@_JohnHammond",[1562],{"data":1563,"marks":1564,"value":1566,"nodeType":865},{},[1565],{"type":1070},"John Hammond",{"data":1568,"marks":1569,"value":1570,"nodeType":865},{},[]," — Senior Principal Security Researcher at Huntress — for a live deep-dive into the browser-based attack techniques defining the 2026 threat landscape. The session covered AiTM phishing, ClickFix, ConsentFix, device code phishing, and the structural shifts making traditional security controls less effective against all of them. Here are seven takeaways.",{"data":1572,"content":1576,"nodeType":875},{"target":1573},{"sys":1574},{"id":1575,"type":872,"linkType":873},"5lJ49aLY0nApDeY69tNvUi",[],{"data":1578,"content":1579,"nodeType":879},{},[],{"data":1581,"content":1582,"nodeType":889},{},[1583],{"data":1584,"marks":1585,"value":1587,"nodeType":865},{},[1586],{"type":887},"1. Browser attacks are evolving faster than defenses can adapt",{"data":1589,"content":1590,"nodeType":866},{},[1591,1595,1602,1606,1613,1617,1624,1628,1636],{"data":1592,"marks":1593,"value":1594,"nodeType":865},{},[],"The overriding theme of the session wasn't any single technique — it was the pace of change across all of them. AiTM phishing has been ",{"data":1596,"content":1597,"nodeType":905},{"uri":1001},[1598],{"data":1599,"marks":1600,"value":1601,"nodeType":865},{},[],"the dominant phishing technique",{"data":1603,"marks":1604,"value":1605,"nodeType":865},{},[]," for a couple of years now, but the variants layered on top of it are arriving faster than most security teams can evaluate, let alone deploy defenses against. ClickFix went from novel to ",{"data":1607,"content":1608,"nodeType":905},{"uri":1013},[1609],{"data":1610,"marks":1611,"value":1612,"nodeType":865},{},[],"the most common initial access vector observed by Microsoft",{"data":1614,"marks":1615,"value":1616,"nodeType":865},{},[]," within about a year. Device code phishing went from near-zero to ",{"data":1618,"content":1619,"nodeType":905},{"uri":1319},[1620],{"data":1621,"marks":1622,"value":1623,"nodeType":865},{},[],"at least 12 distinct kits",{"data":1625,"marks":1626,"value":1627,"nodeType":865},{},[]," in a matter of months. ConsentFix was detected as a zero-day technique by Push in late 2025 and has already been ",{"data":1629,"content":1631,"nodeType":905},{"uri":1630},"https://pushsecurity.com/blog/consentfix-v3-analyzing-a-new-toolkit/",[1632],{"data":1633,"marks":1634,"value":1635,"nodeType":865},{},[],"operationalized on criminal forums",{"data":1637,"marks":1638,"value":1193,"nodeType":865},{},[],{"data":1640,"content":1641,"nodeType":1649},{},[1642],{"data":1643,"content":1644,"nodeType":866},{},[1645],{"data":1646,"marks":1647,"value":1648,"nodeType":865},{},[],"As Luke put it toward the end of the session: \"I've seen this develop so fast over the last two years. This isn't what's coming — this is now. This is where the battleground is.\"","blockquote",{"data":1651,"content":1652,"nodeType":879},{},[],{"data":1654,"content":1655,"nodeType":889},{},[1656],{"data":1657,"marks":1658,"value":1660,"nodeType":865},{},[1659],{"type":887},"2. AiTM phishing is table stakes for attackers ",{"data":1662,"content":1663,"nodeType":866},{},[1664,1668,1676],{"data":1665,"marks":1666,"value":1667,"nodeType":865},{},[],"Adversary-in-the-middle phishing — where a reverse proxy sits between the victim and the real login page, intercepting session tokens in real time to bypass MFA — is no longer an advanced technique. It's available as a commodity for-hire through Phishing-as-a-Service platforms like Tycoon2FA, Sneaky2FA, and others",{"data":1669,"content":1670,"nodeType":905},{"uri":1001},[1671],{"data":1672,"marks":1673,"value":1675,"nodeType":865},{},[1674],{"type":1070},",",{"data":1677,"marks":1678,"value":1679,"nodeType":865},{},[]," and the kits are getting harder to detect through traditional means.",{"data":1681,"content":1682,"nodeType":866},{},[1683],{"data":1684,"marks":1685,"value":1686,"nodeType":865},{},[],"Luke demoed the attacker's perspective using Evilginx — an open-source tool now commonly seen in criminal operations — showing how session tokens are captured in real time even when the victim enters their MFA code correctly. From the victim's side, the login feels completely normal.",{"data":1688,"content":1689,"nodeType":866},{},[1690,1695,1699,1708],{"data":1691,"marks":1692,"value":1694,"nodeType":865},{},[1693],{"type":887},"One of the key focuses in the session was how attackers are abusing legitimate infrastructure for both hosting and delivery of phishing pages. .",{"data":1696,"marks":1697,"value":1698,"nodeType":865},{},[]," The in-the-wild examples showed attack chains routing through multiple legitimate services — file-sharing platforms, TinyURL, Cloudflare Turnstile, Google Search redirects — before finally landing on the phishing page. This is a well established technique for ",{"data":1700,"content":1702,"nodeType":905},{"uri":1701},"https://phishing-techniques.pushsecurity.com/",[1703],{"data":1704,"marks":1705,"value":1707,"nodeType":865},{},[1706],{"type":1070},"detection evasion",{"data":1709,"marks":1710,"value":1711,"nodeType":865},{},[],". ",{"data":1713,"content":1714,"nodeType":866},{},[1715,1719,1726],{"data":1716,"marks":1717,"value":1718,"nodeType":865},{},[],"As John observed, \"the end user doesn't have that wherewithal or that observability understanding of how far they drove around across the internet\" before arriving at the credential-harvesting page. Push reconstructs these multi-hop chains into a ",{"data":1720,"content":1721,"nodeType":905},{"uri":1307},[1722],{"data":1723,"marks":1724,"value":1725,"nodeType":865},{},[],"complete timeline",{"data":1727,"marks":1728,"value":1729,"nodeType":865},{},[],", mapping the full redirect sequence even when individual hops are through trusted domains that wouldn't trigger any reputation-based alert — and crucially, detects malicious content on the phishing page itself rather than relying on known-bad IP and domain based checks that can only see the known-good sites used early in the chain.",{"data":1731,"content":1732,"nodeType":879},{},[],{"data":1734,"content":1735,"nodeType":889},{},[1736],{"data":1737,"marks":1738,"value":1740,"nodeType":865},{},[1739],{"type":887},"3. Email is losing its market share as a delivery vector",{"data":1742,"content":1743,"nodeType":866},{},[1744,1748,1756],{"data":1745,"marks":1746,"value":1747,"nodeType":865},{},[],"One of the most striking examples in the webinar was a targeted AiTM campaign ",{"data":1749,"content":1751,"nodeType":905},{"uri":1750},"https://pushsecurity.com/blog/new-phishing-campaign-identified-targeting-linkedin-users/",[1752],{"data":1753,"marks":1754,"value":1755,"nodeType":865},{},[],"Push detected last year",{"data":1757,"marks":1758,"value":1759,"nodeType":865},{},[]," that was delivered entirely via LinkedIn. Senior executives at tech companies received direct messages from compromised contacts — people they already knew, in some cases other employees of the same companies — offering involvement in private equity fundraising rounds connected to companies they had real involvement with. The targeting was precise and personal, and the redirect chain ran through sites.google.com and Microsoft Dynamics before landing on a cloned login page.",{"data":1761,"content":1762,"nodeType":866},{},[1763],{"data":1764,"marks":1765,"value":1766,"nodeType":865},{},[],"As Luke noted, LinkedIn occupies an unusual middle ground: \"It's this great way of targeting companies, but through a vector that can't really be monitored in the same way as other corporate systems, because it's kind of a personal platform.\" It's personal enough that companies can't realistically monitor it, but professional enough that employees routinely access it from corporate devices.",{"data":1768,"content":1769,"nodeType":866},{},[1770],{"data":1771,"marks":1772,"value":1773,"nodeType":865},{},[],"LinkedIn is only part of the shift. ClickFix attacks most commonly arrive via search results in 4 of 5 cases based on Push data. Luke noted \"not even malvertising, just organic search, uncovering legit websites that have been compromised.\" InstallFix pages appear as sponsored Google ads. ConsentFix pages were seeded on compromised websites found through normal browsing. In every case, the email gateway never sees the lure because the lure was never in an email. And of course, even if a compromised website is reported and removed, it’s easier than ever for an attacker to quickly tear down and rotate their sites to stay ahead of blocklists. ",{"data":1775,"content":1776,"nodeType":1649},{},[1777],{"data":1778,"content":1779,"nodeType":866},{},[1780],{"data":1781,"marks":1782,"value":1783,"nodeType":865},{},[],"As John put it: \"You could set up this lure or this trap out on the open internet so that anyone could fall for it at any point.\"",{"data":1785,"content":1786,"nodeType":879},{},[],{"data":1788,"content":1789,"nodeType":889},{},[1790],{"data":1791,"marks":1792,"value":1794,"nodeType":865},{},[1793],{"type":887},"4. ClickFix keeps evolving with multiple *Fix derivatives",{"data":1796,"content":1797,"nodeType":866},{},[1798,1802,1810,1814,1822],{"data":1799,"marks":1800,"value":1801,"nodeType":865},{},[],"ClickFix — where a malicious page silently writes a payload to the victim's clipboard and instructs them to paste and execute it — ",{"data":1803,"content":1804,"nodeType":905},{"uri":1356},[1805],{"data":1806,"marks":1807,"value":1809,"nodeType":865},{},[1808],{"type":1070},"spawned an entire family of variants since its emergence, according to Push’s research",{"data":1811,"marks":1812,"value":1813,"nodeType":865},{},[],". The webinar showed how far the social engineering has come: Luke demonstrated a ",{"data":1815,"content":1817,"nodeType":905},{"uri":1816},"https://pushsecurity.com/blog/the-most-advanced-clickfix-yet/",[1818],{"data":1819,"marks":1820,"value":1821,"nodeType":865},{},[],"particularly sophisticated variant",{"data":1823,"marks":1824,"value":1825,"nodeType":865},{},[]," on a compromised legitimate website with an embedded instructional video and a countdown timer to manufacture urgency, targeting macOS. As John noted: \"It can be cross-platform because you're just preying on the human weakness. The video smooths it over for the user experience.\"",{"data":1827,"content":1828,"nodeType":866},{},[1829,1833,1840],{"data":1830,"marks":1831,"value":1832,"nodeType":865},{},[],"The more important point was structural. Because the user manually pastes and executes the command, \"from the EDR's perspective, the user just manually ran this command,\" Luke explained. \"It actually breaks that link from an EDR's perspective.\" EDR behavioral detections weigh execution context heavily — a PowerShell command spawned from a browser process tree is suspicious, but the same command initiated through the Run dialog looks like normal activity. Push ",{"data":1834,"content":1835,"nodeType":905},{"uri":1356},[1836],{"data":1837,"marks":1838,"value":1839,"nodeType":865},{},[],"detects ClickFix at the clipboard-injection stage",{"data":1841,"marks":1842,"value":1843,"nodeType":865},{},[],", before the payload ever reaches the endpoint, to bolster endpoint-level detections and extend protection to machines like BYOD, contractor, or developer devices where EDR is often missing or tuned-down.",{"data":1845,"content":1846,"nodeType":879},{},[],{"data":1848,"content":1849,"nodeType":889},{},[1850],{"data":1851,"marks":1852,"value":1854,"nodeType":865},{},[1853],{"type":887},"5. InstallFix turned the AI tool boom into an attack surface overnight",{"data":1856,"content":1857,"nodeType":866},{},[1858,1861,1870],{"data":1859,"marks":1860,"value":21,"nodeType":865},{},[],{"data":1862,"content":1864,"nodeType":905},{"uri":1863},"https://pushsecurity.com/blog/installfix/",[1865],{"data":1866,"marks":1867,"value":1869,"nodeType":865},{},[1868],{"type":1070},"InstallFix",{"data":1871,"marks":1872,"value":1873,"nodeType":865},{},[]," — a ClickFix variant that clones legitimate developer tool installation pages and swaps the install command for a malicious payload — was one of the clearest examples of how quickly a new attack pattern can go from zero to dominant. Luke showed side-by-side comparisons of real and fake Claude Code installation pages that were visually identical except for the payload itself, and fake Notebook LM pages appearing as top Google sponsored results.",{"data":1875,"content":1876,"nodeType":866},{},[1877],{"data":1878,"marks":1879,"value":1880,"nodeType":865},{},[],"The trajectory Luke described was striking: \"It literally started one day and then it's just been nonstop for the last couple of months since it started. It obviously is working really well.\" John added that the Claude Code variant in particular has been \"running rampant,\" and that he personally knows someone who fell for it.",{"data":1882,"content":1883,"nodeType":866},{},[1884],{"data":1885,"marks":1886,"value":1887,"nodeType":865},{},[],"What makes InstallFix effective is that it exploits a workflow that's become completely normalized — the rise of AI tools has encouraged even non-technical users to install software via terminal commands copied from documentation pages. When the fake page looks identical to the real one and the install method is exactly what you'd expect, the only tell is a base64-encoded payload that most users wouldn't think to scrutinize.",{"data":1889,"content":1890,"nodeType":879},{},[],{"data":1892,"content":1893,"nodeType":889},{},[1894],{"data":1895,"marks":1896,"value":1898,"nodeType":865},{},[1897],{"type":887},"6. ConsentFix plays out entirely in the browser, and criminals just got the playbook",{"data":1900,"content":1901,"nodeType":866},{},[1902,1905,1914],{"data":1903,"marks":1904,"value":21,"nodeType":865},{},[],{"data":1906,"content":1908,"nodeType":905},{"uri":1907},"https://pushsecurity.com/blog/consentfix/",[1909],{"data":1910,"marks":1911,"value":1913,"nodeType":865},{},[1912],{"type":1070},"ConsentFix",{"data":1915,"marks":1916,"value":1917,"nodeType":865},{},[]," was a key focus in the webinar, and for good reason — it represents a fundamentally different class of browser attack. Rather than proxying credentials (AiTM) or injecting endpoint payloads (ClickFix), ConsentFix abuses the OAuth authorization code flow via the Azure CLI's localhost redirect to obtain access tokens without ever touching a password or MFA prompt. As John put it: \"This one is really tricky because the entire attack and technique lives only within the browser. There are no little EDR artifacts to poke and play at.\"",{"data":1919,"content":1920,"nodeType":866},{},[1921],{"data":1922,"marks":1923,"value":1924,"nodeType":865},{},[],"Luke described how Push first detected ConsentFix in the wild — a genuine zero-day discovery that took multiple encounters to fully understand. The attackers were fingerprinting visitors by IP and browser, triggering the payload only once per visitor across all compromised sites, and performing conditional access checks on the email address provided before deciding whether to proceed. \"It took us seeing it a few times before we cracked it,\" Luke explained. \"And then we were like — wow. What is this? I've never seen this before.\"",{"data":1926,"content":1927,"nodeType":866},{},[1928,1932,1939],{"data":1929,"marks":1930,"value":1931,"nodeType":865},{},[],"The session then took an interesting turn when John revealed something he hadn't previously shared publicly: a  ",{"data":1933,"content":1934,"nodeType":905},{"uri":1630},[1935],{"data":1936,"marks":1937,"value":1938,"nodeType":865},{},[],"ConsentFix v3 toolkit",{"data":1940,"marks":1941,"value":1942,"nodeType":865},{},[]," posted on a well-known criminal forum, complete with a tutorial video, step-by-step instructions, and a zero-infrastructure approach using Cloudflare Workers for hosting, Dropbox for PDF delivery, and Pipedream as an automated exfiltration channel. \"They don’t need any infrastructure,\" John noted. \"They don’t have to host any servers or VPS. They could just cast this out to the whole wide world on the open internet.\"",{"data":1944,"content":1945,"nodeType":1649},{},[1946],{"data":1947,"content":1948,"nodeType":866},{},[1949],{"data":1950,"marks":1951,"value":1952,"nodeType":865},{},[],"Luke's assessment was clear: \"When we published our first article, we were thinking, surely we're going to see a huge increase in this technique. We haven't really — until now.\" ",{"data":1954,"content":1955,"nodeType":866},{},[1956],{"data":1957,"marks":1958,"value":1959,"nodeType":865},{},[],"With the criminal ecosystem now tooled up, the expectation is that ConsentFix will follow the same commoditization arc as other techniques discussed in the session.",{"data":1961,"content":1962,"nodeType":879},{},[],{"data":1964,"content":1965,"nodeType":889},{},[1966],{"data":1967,"marks":1968,"value":1970,"nodeType":865},{},[1969],{"type":887},"7. Device code phishing is the technique both speakers fear most (and it's just getting started)",{"data":1972,"content":1973,"nodeType":866},{},[1974,1978,1985],{"data":1975,"marks":1976,"value":1977,"nodeType":865},{},[],"When John asked Luke which technique felt most dangerous, the answer was immediate: ",{"data":1979,"content":1980,"nodeType":905},{"uri":1319},[1981],{"data":1982,"marks":1983,"value":1984,"nodeType":865},{},[],"device code phishing",{"data":1986,"marks":1987,"value":1711,"nodeType":865},{},[],{"data":1989,"content":1990,"nodeType":866},{},[1991],{"data":1992,"marks":1993,"value":1994,"nodeType":865},{},[],"The technique abuses the OAuth 2.0 device authorization grant flow — originally designed for input-constrained devices like TVs, but now primarily used in enterprise environments for CLI tool authentication (Azure CLI, GitHub CLI, AWS CLI). That everyday enterprise usage is exactly what makes the phishing so effective: users in developer-heavy organizations are already habituated to entering short codes as part of their normal workflow. The victim enters a code on a legitimate Microsoft login page, and if they're already authenticated, the entire compromise happens without entering a password or completing an MFA challenge.",{"data":1996,"content":1997,"nodeType":866},{},[1998],{"data":1999,"marks":2000,"value":2001,"nodeType":865},{},[],"Push is now tracking at least 12 distinct device code phishing kits, \"literally within the last couple of months — from basically zero to this.\" EvilTokens dominates at an estimated 90–95% of detected volume, but the kit landscape is diversifying fast. Luke's theory: every existing AiTM vendor is adding device code phishing as a module. When Push investigated the Venom kit, its AiTM component triggered existing Sneaky2FA detections — suggesting the same actors or codebase behind both. \"That's why we've seen such a rapid increase — it's worked so well that everyone is just doing the same thing now.\"",{"data":2003,"content":2004,"nodeType":866},{},[2005,2010],{"data":2006,"marks":2007,"value":2009,"nodeType":865},{},[2008],{"type":887},"What makes device code phishing uniquely dangerous is how little friction it presents to the victim.",{"data":2011,"marks":2012,"value":2013,"nodeType":865},{},[]," As Luke explained: \"It's purely identity-driven. It completely bypasses 2FA, even bypasses phishing-resistant factors like passkeys. And it's just not something that seems malicious to your average user. We haven't trained people to worry about being given a code and being told to type that code.\"",{"data":2015,"content":2016,"nodeType":1649},{},[2017],{"data":2018,"content":2019,"nodeType":866},{},[2020],{"data":2021,"marks":2022,"value":2023,"nodeType":865},{},[],"John's closing take: \"It still feels early and emergent, even though the technique has been known for a while. It hasn't been weaponized like it has right now. I think device code is just at the starting gun.\" ",{"data":2025,"content":2026,"nodeType":866},{},[2027,2031,2038],{"data":2028,"marks":2029,"value":2030,"nodeType":865},{},[],"The blast radius extends beyond Microsoft too — GitHub, Salesforce, and other platforms support the same underlying flow, and was exploited in 2025’s massive Salesforce campaign operated by ",{"data":2032,"content":2033,"nodeType":905},{"uri":1064},[2034],{"data":2035,"marks":2036,"value":1071,"nodeType":865},{},[2037],{"type":1070},{"data":2039,"marks":2040,"value":1193,"nodeType":865},{},[],{"data":2042,"content":2043,"nodeType":879},{},[],{"data":2045,"content":2046,"nodeType":889},{},[2047],{"data":2048,"marks":2049,"value":2051,"nodeType":865},{},[2050],{"type":887},"What ties all of this together",{"data":2053,"content":2054,"nodeType":866},{},[2055],{"data":2056,"marks":2057,"value":2058,"nodeType":865},{},[],"Every technique covered in the webinar — AiTM, ClickFix, InstallFix, ConsentFix, device code phishing — is designed to operate in or through the browser, abuse legitimate infrastructure and authentication flows, and evade the traditional security stack. Email gateways don't see them because the delivery vector increasingly isn't email. EDR doesn't reliably block them because the attack either breaks the process tree attribution (ClickFix) or never touches the endpoint at all (ConsentFix, device code phishing). Network proxies don't see them because the attack plays out in client-side page content, DOM interactions, and OAuth flows that are invisible to traffic inspection.",{"data":2060,"content":2061,"nodeType":866},{},[2062,2066,2072,2075,2082,2085,2092,2096,2103],{"data":2063,"marks":2064,"value":2065,"nodeType":865},{},[],"Push detects all of them — ",{"data":2067,"content":2068,"nodeType":905},{"uri":1307},[2069],{"data":2070,"marks":2071,"value":261,"nodeType":865},{},[],{"data":2073,"marks":2074,"value":1675,"nodeType":865},{},[],{"data":2076,"content":2077,"nodeType":905},{"uri":1356},[2078],{"data":2079,"marks":2080,"value":2081,"nodeType":865},{},[]," ClickFix and the *Fix family",{"data":2083,"marks":2084,"value":1675,"nodeType":865},{},[],{"data":2086,"content":2087,"nodeType":905},{"uri":1907},[2088],{"data":2089,"marks":2090,"value":2091,"nodeType":865},{},[]," ConsentFix",{"data":2093,"marks":2094,"value":2095,"nodeType":865},{},[],", and",{"data":2097,"content":2098,"nodeType":905},{"uri":1319},[2099],{"data":2100,"marks":2101,"value":2102,"nodeType":865},{},[]," device code phishing",{"data":2104,"marks":2105,"value":2106,"nodeType":865},{},[]," — through behavioral detection at the browser layer, regardless of delivery channel, domain reputation, or infrastructure rotation. The detections target technique-class behaviors rather than specific kits or indicators, which is why Push detected ConsentFix as a zero-day and why new kit variants are typically caught by existing detection logic before a kit-specific rule is even written.",{"data":2108,"content":2109,"nodeType":866},{},[2110,2113,2121,2125,2131],{"data":2111,"marks":2112,"value":21,"nodeType":865},{},[],{"data":2114,"content":2116,"nodeType":905},{"uri":2115},"https://pushsecurity.com/resources/browser-attacks-why-browser-new-battleground",[2117],{"data":2118,"marks":2119,"value":1505,"nodeType":865},{},[2120],{"type":1070},{"data":2122,"marks":2123,"value":2124,"nodeType":865},{},[]," to see the demos, attack chain timelines, and in-the-wild examples discussed in this post — or ",{"data":2126,"content":2127,"nodeType":905},{"uri":1512},[2128],{"data":2129,"marks":2130,"value":1517,"nodeType":865},{},[],{"data":2132,"marks":2133,"value":2134,"nodeType":865},{},[]," to see how Push handles them.","7 things we learned from ‘Why the browser is the new battleground’ with John Hammond","Here are 7 things we learned from our conversation with John Hammond on the \"Why the browser is the new battleground\" webinar. ","2026-05-19T00:00:00.000Z","7-things-we-learned-from-john-hammond",{"items":2140},[2141,2145],{"sys":2142,"name":2144},{"id":2143},"6A5RXS31ZQx3PwryGb1IMy","Browser-based attacks",{"sys":2146,"name":297},{"id":2147},"3pjES4THCIfSAwhGdNwBcy",{"items":2149},[2150],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":2151},{"url":853},{"__typename":1544,"sys":2153,"content":2155,"title":2998,"synopsis":2999,"hashTags":59,"publishedDate":3000,"slug":3001,"tagsCollection":3002,"authorsCollection":3009},{"id":2154},"211Dd0EIrXPOFpvRgs0fEE",{"json":2156},{"data":2157,"content":2158,"nodeType":1522},{},[2159,2178,2197,2216,2222,2225,2233,2240,2247,2254,2261,2269,2272,2280,2287,2294,2301,2307,2316,2334,2341,2348,2364,2372,2403,2419,2426,2453,2461,2491,2498,2506,2524,2531,2538,2544,2551,2559,2578,2585,2604,2611,2614,2622,2629,2719,2726,2742,2745,2776,2795,2802,2809,2812,2820,2839,2846,2853,2870,2873,2881,2888,2921,2928,2945,2964,2970,2973,2980],{"data":2160,"content":2161,"nodeType":866},{},[2162,2166,2174],{"data":2163,"marks":2164,"value":2165,"nodeType":865},{},[],"When we released the ",{"data":2167,"content":2169,"nodeType":905},{"uri":2168},"https://pushsecurity.com/blog/saas-attack-techniques/",[2170],{"data":2171,"marks":2172,"value":2173,"nodeType":865},{},[],"SaaS attack matrix",{"data":2175,"marks":2176,"value":2177,"nodeType":865},{},[]," in 2023, we were anticipating a shift that was just beginning to take shape. The techniques that attackers were using to compromise cloud applications and identities weren't well represented in existing frameworks, and many of the ones we documented hadn't yet been widely observed in the wild.",{"data":2179,"content":2180,"nodeType":866},{},[2181,2185,2193],{"data":2182,"marks":2183,"value":2184,"nodeType":865},{},[],"A year later, we ",{"data":2186,"content":2188,"nodeType":905},{"uri":2187},"https://pushsecurity.com/blog/the-saas-attack-matrix-one-year-on/",[2189],{"data":2190,"marks":2191,"value":2192,"nodeType":865},{},[],"reviewed what had changed",{"data":2194,"marks":2195,"value":2196,"nodeType":865},{},[]," and found that the initial access phase — the techniques designed to compromise an identity in the first place — was where almost all of the attacker innovation was concentrated. And two years on, that trend has become the story of the modern threat landscape. ",{"data":2198,"content":2199,"nodeType":866},{},[2200,2204,2212],{"data":2201,"marks":2202,"value":2203,"nodeType":865},{},[],"Today, we're re-releasing the matrix as the ",{"data":2205,"content":2207,"nodeType":905},{"uri":2206},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/",[2208],{"data":2209,"marks":2210,"value":2211,"nodeType":865},{},[],"Browser & Identity Attacks Matrix",{"data":2213,"marks":2214,"value":2215,"nodeType":865},{},[],". The name change isn't cosmetic. It reflects that the attacks driving the most consequential breaches are browser-based and identity-first.",{"data":2217,"content":2221,"nodeType":875},{"target":2218},{"sys":2219},{"id":2220,"type":872,"linkType":873},"MSnrBRJtiQxpv2qxFLCVE",[],{"data":2223,"content":2224,"nodeType":879},{},[],{"data":2226,"content":2227,"nodeType":889},{},[2228],{"data":2229,"marks":2230,"value":2232,"nodeType":865},{},[2231],{"type":887},"Why the scope needed to change",{"data":2234,"content":2235,"nodeType":866},{},[2236],{"data":2237,"marks":2238,"value":2239,"nodeType":865},{},[],"The original SaaS attack matrix was built around a specific insight: that attacks targeting modern business applications played out entirely over the internet, without touching endpoints or internal networks in any way that EDR or network detection tools would recognize.",{"data":2241,"content":2242,"nodeType":866},{},[2243],{"data":2244,"marks":2245,"value":2246,"nodeType":865},{},[],"That framing was useful, and it remains true. But it anchored the matrix to the post-access phase — what attackers do once they're inside a SaaS application — and didn't give enough weight to the initial access techniques that determine whether attackers get there in the first place.",{"data":2248,"content":2249,"nodeType":866},{},[2250],{"data":2251,"marks":2252,"value":2253,"nodeType":865},{},[],"The problem is that initial access is where the overwhelming majority of attacker innovation and investment is concentrated, and the techniques being used to achieve it are best understood as browser and identity attacks rather than SaaS-specific ones. AiTM phishing, ClickFix and its growing family of clipboard-injection variants, device code phishing, OAuth consent abuse, credential stuffing powered by infostealer supply chains, malicious browser extensions all happen in or via the browser.",{"data":2255,"content":2256,"nodeType":866},{},[2257],{"data":2258,"marks":2259,"value":2260,"nodeType":865},{},[],"Another issue is that \"SaaS\" has arguably ceased to be a meaningful category. When we consider that most organizations run the majority of their business on cloud applications, the difference between what constitutes \"SaaS\" versus cloud versus just \"business IT\" is pretty blurry (and feels like an academic rather than practical difference).",{"data":2262,"content":2263,"nodeType":866},{},[2264],{"data":2265,"marks":2266,"value":2268,"nodeType":865},{},[2267],{"type":887},"So it's less about whether an attack is a \"SaaS attack\" and more about how these attacks actually play out. ",{"data":2270,"content":2271,"nodeType":879},{},[],{"data":2273,"content":2274,"nodeType":889},{},[2275],{"data":2276,"marks":2277,"value":2279,"nodeType":865},{},[2278],{"type":887},"The technique landscape has transformed",{"data":2281,"content":2282,"nodeType":866},{},[2283],{"data":2284,"marks":2285,"value":2286,"nodeType":865},{},[],"The second part to the change is the fact that scale and speed of attacker innovation in the space justifies it.",{"data":2288,"content":2289,"nodeType":866},{},[2290],{"data":2291,"marks":2292,"value":2293,"nodeType":865},{},[],"When we launched the matrix in mid-2023, AiTM phishing was emerging as a serious concern but was far from ubiquitous. ClickFix didn't exist as a named technique. Device code phishing was a curiosity documented by a handful of researchers. ConsentFix was years away from being discovered. Browser extension supply chain attacks were rare enough to be individually notable.",{"data":2295,"content":2296,"nodeType":866},{},[2297],{"data":2298,"marks":2299,"value":2300,"nodeType":865},{},[],"In the two and a half years since, every one of these has become a mainstream, industrialized attack technique — and several have converged in ways that would have been hard to predict.",{"data":2302,"content":2306,"nodeType":875},{"target":2303},{"sys":2304},{"id":2305,"type":872,"linkType":873},"5Kw2kSrL8u4VyslxK8HCtR",[],{"data":2308,"content":2309,"nodeType":2315},{},[2310],{"data":2311,"marks":2312,"value":2314,"nodeType":865},{},[2313],{"type":887},"AiTM phishing has become the default phishing method","heading-2",{"data":2317,"content":2318,"nodeType":866},{},[2319,2323,2330],{"data":2320,"marks":2321,"value":2322,"nodeType":865},{},[],"AiTM phishing is now the standard, powered by Phishing-as-a-Service kits that operate with the release cycles and customer support of legitimate SaaS products. Tycoon 2FA alone accounted for ",{"data":2324,"content":2325,"nodeType":905},{"uri":1001},[2326],{"data":2327,"marks":2328,"value":2329,"nodeType":865},{},[],"62% of phishing detected by Microsoft",{"data":2331,"marks":2332,"value":2333,"nodeType":865},{},[]," and over 64,000 confirmed incidents, with Sneaky2FA, FlowerStorm, Evilginx, and a growing roster of competitors filling out the marketplace.",{"data":2335,"content":2336,"nodeType":866},{},[2337],{"data":2338,"marks":2339,"value":2340,"nodeType":865},{},[],"AiTM is constantly evolving, with vendors adding new features, capabilities, detection evasion techniques, and so on. Abuse of legitimate platforms, and increasingly AI-assisted development means that it’s trivial for attackers to spin up and tear down infrastructure, scale their campaigns, target specific organizations with crafted pages and lures, and generally means that attackers can operate highly sophisticated attacks with minimal effort and complexity. This makes AiTM and other PhaaS-powered techniques extremely accessible to all kinds of criminals.  ",{"data":2342,"content":2343,"nodeType":866},{},[2344],{"data":2345,"marks":2346,"value":2347,"nodeType":865},{},[],"These kits are delivered across several browser-based channels — not just email. Push data consistently shows that roughly 1 in 3 phishing payloads we intercept arrive via social media, search ads, messaging apps, or other non-email vectors.",{"data":2349,"content":2350,"nodeType":866},{},[2351,2355,2360],{"data":2352,"marks":2353,"value":2354,"nodeType":865},{},[],"Vishing has also surged as a delivery channel — CrowdStrike documented a ",{"data":2356,"marks":2357,"value":2359,"nodeType":865},{},[2358],{"type":887},"442% year-over-year increase",{"data":2361,"marks":2362,"value":2363,"nodeType":865},{},[],", and Mandiant found it was the single most common initial vector in cloud compromises at 23%. But the trend that matters isn't voice calls in isolation; it's voice calls combined with browser-based payloads, where a live operator guides the victim into an AiTM page or device code flow that the call alone could not execute.",{"data":2365,"content":2366,"nodeType":2315},{},[2367],{"data":2368,"marks":2369,"value":2371,"nodeType":865},{},[2370],{"type":887},"ClickFix is the top reported initial access vector",{"data":2373,"content":2374,"nodeType":866},{},[2375,2379,2387,2391,2399],{"data":2376,"marks":2377,"value":2378,"nodeType":865},{},[],"ClickFix has gone from nonexistent to one of the most prevalent initial access techniques in under 18 months. Microsoft reported it as the ",{"data":2380,"content":2382,"nodeType":905},{"uri":2381},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf",[2383],{"data":2384,"marks":2385,"value":2386,"nodeType":865},{},[],"most common initial access vector in 2025",{"data":2388,"marks":2389,"value":2390,"nodeType":865},{},[],", accounting for 47% of observed attacks, while CrowdStrike documented a ",{"data":2392,"content":2394,"nodeType":905},{"uri":2393},"https://www.crowdstrike.com/explore/2026-global-threat-report",[2395],{"data":2396,"marks":2397,"value":2398,"nodeType":865},{},[],"563% increase",{"data":2400,"marks":2401,"value":2402,"nodeType":865},{},[]," in fake CAPTCHA lures (a top ClickFix style).",{"data":2404,"content":2405,"nodeType":866},{},[2406,2410,2415],{"data":2407,"marks":2408,"value":2409,"nodeType":865},{},[],"ClickFix is admittedly an outlier in a browser attacks matrix — the payload ultimately executes on the endpoint, not in the browser — but the delivery is overwhelmingly browser-based: ",{"data":2411,"marks":2412,"value":2414,"nodeType":865},{},[2413],{"type":887},"4 in 5 ClickFix payloads",{"data":2416,"marks":2417,"value":2418,"nodeType":865},{},[]," intercepted by Push arrive via search engines as a result of malvertising or compromised web pages, not email, which means the browser is the only control point that actually sees the attack before the user pastes the malicious command.",{"data":2420,"content":2421,"nodeType":866},{},[2422],{"data":2423,"marks":2424,"value":2425,"nodeType":865},{},[],"ClickFix is now the primary delivery mechanism for infostealer malware, which is in turn the primary source of the stolen credentials and session tokens that power credential stuffing and session hijacking — which means the technique sits at the start of a cycle where one class of browser-delivered attack generates the raw material for the next.",{"data":2427,"content":2428,"nodeType":866},{},[2429,2433,2439,2443,2449],{"data":2430,"marks":2431,"value":2432,"nodeType":865},{},[],"The success of ClickFix has predictably spawned a growing family of derivatives — FileFix, CrashFix, ",{"data":2434,"content":2435,"nodeType":905},{"uri":1863},[2436],{"data":2437,"marks":2438,"value":1869,"nodeType":865},{},[],{"data":2440,"marks":2441,"value":2442,"nodeType":865},{},[]," — and much of the naming is marketing hype around variations on the same clipboard-injection mechanic. But ",{"data":2444,"content":2445,"nodeType":905},{"uri":1907},[2446],{"data":2447,"marks":2448,"value":1913,"nodeType":865},{},[],{"data":2450,"marks":2451,"value":2452,"nodeType":865},{},[]," was a genuinely novel development.",{"data":2454,"content":2455,"nodeType":2315},{},[2456],{"data":2457,"marks":2458,"value":2460,"nodeType":865},{},[2459],{"type":887},"Browser-native ClickFix: ConsentFix",{"data":2462,"content":2463,"nodeType":866},{},[2464,2468,2476,2480,2487],{"data":2465,"marks":2466,"value":2467,"nodeType":865},{},[],"ConsentFix is a fully browser-native attack that merged ClickFix-style social engineering with OAuth consent abuse, compromising accounts through a legitimate Microsoft authorization flow with no endpoint component at all. ConsentFix was ",{"data":2469,"content":2471,"nodeType":905},{"uri":2470},"https://pushsecurity.com/blog/consentfix-debrief/",[2472],{"data":2473,"marks":2474,"value":2475,"nodeType":865},{},[],"traced to APT29",{"data":2477,"marks":2478,"value":2479,"nodeType":865},{},[]," and has since been ",{"data":2481,"content":2482,"nodeType":905},{"uri":1630},[2483],{"data":2484,"marks":2485,"value":2486,"nodeType":865},{},[],"commercialized on criminal forums",{"data":2488,"marks":2489,"value":2490,"nodeType":865},{},[],", following the same path from state-sponsored technique to commodity criminal tooling that we've seen repeatedly in this space.",{"data":2492,"content":2493,"nodeType":866},{},[2494],{"data":2495,"marks":2496,"value":2497,"nodeType":865},{},[],"ConsentFix demonstrates that the clipboard-injection mechanic can evolve into something that operates entirely within the browser, eliminating the endpoint detection surface that traditional ClickFix still exposed.",{"data":2499,"content":2500,"nodeType":2315},{},[2501],{"data":2502,"marks":2503,"value":2505,"nodeType":865},{},[2504],{"type":887},"Attackers have pivoted to authorization attacks to get around login controls",{"data":2507,"content":2508,"nodeType":866},{},[2509,2513,2520],{"data":2510,"marks":2511,"value":2512,"nodeType":865},{},[],"Authorization attacks like device code phishing have seen a ",{"data":2514,"content":2515,"nodeType":905},{"uri":1319},[2516],{"data":2517,"marks":2518,"value":2519,"nodeType":865},{},[],"37.5x increase",{"data":2521,"marks":2522,"value":2523,"nodeType":865},{},[]," since the start of 2026, with at least 12 distinct kits now offering the technique. It bypasses standard authentication controls — including passkeys — because the attack occurs through the OAuth device authorization flow rather than the standard login flow. ",{"data":2525,"content":2526,"nodeType":866},{},[2527],{"data":2528,"marks":2529,"value":2530,"nodeType":865},{},[],"The technique was first associated with nation-state actors like Storm-2372, but went from espionage-grade to commodity PhaaS tooling in roughly eighteen months, with kits like EvilTokens and Venom now offering turnkey device code phishing as a service.",{"data":2532,"content":2533,"nodeType":866},{},[2534],{"data":2535,"marks":2536,"value":2537,"nodeType":865},{},[],"The device code authorization is effectively performed post-authentication. If you already have an active session in your browser, entering the device code and selecting your account from a drop-down menu is all that's needed. No password or MFA required. You can see an example in the video below.",{"data":2539,"content":2543,"nodeType":875},{"target":2540},{"sys":2541},{"id":2542,"type":872,"linkType":873},"2WPb41lNRajdpt5pogQg8M",[],{"data":2545,"content":2546,"nodeType":866},{},[2547],{"data":2548,"marks":2549,"value":2550,"nodeType":865},{},[],"And the ecosystem is adapting to this opportunity: established AiTM vendors like Tycoon are adding authorization-focused options alongside their existing credential-harvesting capabilities, which points toward multi-technique platforms where operators pick the right tool for whatever defenses the target has in place.",{"data":2552,"content":2553,"nodeType":2315},{},[2554],{"data":2555,"marks":2556,"value":2558,"nodeType":865},{},[2557],{"type":887},"Malicious and hacked browser extensions are one of the fastest growing threats",{"data":2560,"content":2561,"nodeType":866},{},[2562,2566,2574],{"data":2563,"marks":2564,"value":2565,"nodeType":865},{},[],"Malicious browser extensions have matured from an occasional nuisance into a scalable supply chain attack vector. The ",{"data":2567,"content":2569,"nodeType":905},{"uri":2568},"https://pushsecurity.com/blog/why-browser-extension-risk-scoring-wont-predict-your-next-breach/",[2570],{"data":2571,"marks":2572,"value":2573,"nodeType":865},{},[],"Cyberhaven compromise",{"data":2575,"marks":2576,"value":2577,"nodeType":865},{},[]," in December 2024 — where approximately 35 extensions were weaponized through a single OAuth phishing campaign targeting developers — impacted 2.6 million users and demonstrated that extension supply chain attacks can achieve the kind of reach that used to require a compromised software update server.",{"data":2579,"content":2580,"nodeType":866},{},[2581],{"data":2582,"marks":2583,"value":2584,"nodeType":865},{},[],"Since Cyberhaven, the pace has only accelerated. In 2026 alone, researchers have publicly disclosed at least 250 confirmed malicious browser extensions affecting roughly 1.75 million users, alongside a further 370+ extensions engaged in undisclosed or policy-disclosed data harvesting affecting an additional 44 million users. That doesn't count the extensions from late-2025 campaigns (DarkSpectre, AITOPIA, Trust Wallet) whose impacts carried into 2026.",{"data":2586,"content":2587,"nodeType":866},{},[2588,2592,2600],{"data":2589,"marks":2590,"value":2591,"nodeType":865},{},[],"The attack paths have also expanded. Beyond phishing developers for take over Web Store accounts (the Cyberhaven playbook), attackers are buying existing extensions from developers, waiting for ownership transfers or abandonments to take over, and increasingly vibe-coding their own functional extensions from scratch to build an audience that can later be weaponized. The common thread is that ",{"data":2593,"content":2594,"nodeType":905},{"uri":2568},[2595],{"data":2596,"marks":2597,"value":2599,"nodeType":865},{},[2598],{"type":1070},"most malicious extensions didn't start out malicious",{"data":2601,"marks":2602,"value":2603,"nodeType":865},{},[]," — they started as legitimate tools and were turned into weapons after the fact.",{"data":2605,"content":2606,"nodeType":866},{},[2607],{"data":2608,"marks":2609,"value":2610,"nodeType":865},{},[],"None of this is happening in isolation. The threat landscape has reoriented around browser-based initial access and identity compromise — and the matrix needed to catch up.",{"data":2612,"content":2613,"nodeType":879},{},[],{"data":2615,"content":2616,"nodeType":889},{},[2617],{"data":2618,"marks":2619,"value":2621,"nodeType":865},{},[2620],{"type":887},"The evolution is playing out in public breaches",{"data":2623,"content":2624,"nodeType":866},{},[2625],{"data":2626,"marks":2627,"value":2628,"nodeType":865},{},[],"It’s worth reinforcing that when the SaaS matrix was first released, many of these attacks hadn’t been seen in the wild. The change today is staggering:",{"data":2630,"content":2631,"nodeType":2718},{},[2632,2655,2677,2697],{"data":2633,"content":2634,"nodeType":2654},{},[2635],{"data":2636,"content":2637,"nodeType":866},{},[2638,2642,2650],{"data":2639,"marks":2640,"value":2641,"nodeType":865},{},[],"When ",{"data":2643,"content":2645,"nodeType":905},{"uri":2644},"https://pushsecurity.com/blog/scattered-lapsus-hunters/",[2646],{"data":2647,"marks":2648,"value":2649,"nodeType":865},{},[],"Scattered Lapsus$ Hunters",{"data":2651,"marks":2652,"value":2653,"nodeType":865},{},[]," compromised over a thousand organizations' Salesforce tenants through device code phishing, the attack started with a phone call, moved through a browser-based authorization flow for the attacker’s app, and ended with mass data exfiltration via API.","list-item",{"data":2656,"content":2657,"nodeType":2654},{},[2658],{"data":2659,"content":2660,"nodeType":866},{},[2661,2665,2673],{"data":2662,"marks":2663,"value":2664,"nodeType":865},{},[],"When the same collective launched ",{"data":2666,"content":2668,"nodeType":905},{"uri":2667},"https://pushsecurity.com/blog/unpacking-the-latest-slh-campaign/",[2669],{"data":2670,"marks":2671,"value":2672,"nodeType":865},{},[],"AiTM phishing campaigns",{"data":2674,"marks":2675,"value":2676,"nodeType":865},{},[]," targeting Okta and Entra SSO, the phishing page was operated by a human in real time and delivered over a voice call — not email.",{"data":2678,"content":2679,"nodeType":2654},{},[2680],{"data":2681,"content":2682,"nodeType":866},{},[2683,2686,2693],{"data":2684,"marks":2685,"value":2641,"nodeType":865},{},[],{"data":2687,"content":2688,"nodeType":905},{"uri":1907},[2689],{"data":2690,"marks":2691,"value":2692,"nodeType":865},{},[],"APT29 deployed ConsentFix",{"data":2694,"marks":2695,"value":2696,"nodeType":865},{},[]," across dozens of compromised websites, the entire attack chain was browser-native, abusing a legitimate Microsoft OAuth flow to bypass MFA without proxying a single credential.",{"data":2698,"content":2699,"nodeType":2654},{},[2700],{"data":2701,"content":2702,"nodeType":866},{},[2703,2706,2714],{"data":2704,"marks":2705,"value":1061,"nodeType":865},{},[],{"data":2707,"content":2709,"nodeType":905},{"uri":2708},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-snowflake-june-2024",[2710],{"data":2711,"marks":2712,"value":2713,"nodeType":865},{},[],"Snowflake breach",{"data":2715,"marks":2716,"value":2717,"nodeType":865},{},[]," — arguably the most consequential credential-based campaign of the past several years — saw 165 organizations breached using credentials that had been sitting in infostealer dumps for years, replayed against Snowflake tenants that lacked mandatory MFA. The attack surface wasn't Snowflake's application logic; it was the identity hygiene gap that every organization carries across hundreds of apps.","unordered-list",{"data":2720,"content":2721,"nodeType":866},{},[2722],{"data":2723,"marks":2724,"value":2725,"nodeType":865},{},[],"And that’s just the big picture. Every month we’re tracking new public breaches involving browser and identity TTPs — which again, are just the tip of the iceberg when you consider that many breaches are settled quietly without hitting the headlines. ",{"data":2727,"content":2728,"nodeType":866},{},[2729,2733,2738],{"data":2730,"marks":2731,"value":2732,"nodeType":865},{},[],"One of the key drivers here is the shrinking time-to-exploit. CrowdStrike's average e-crime breakout time is down to ",{"data":2734,"marks":2735,"value":2737,"nodeType":865},{},[2736],{"type":887},"29 minutes",{"data":2739,"marks":2740,"value":2741,"nodeType":865},{},[],", with the fastest recorded at 27 seconds. When attackers can move from initial access to data exfiltration within minutes, the window for post-compromise detection collapses to near zero. The best chance of stopping the attack is at the point of initial access before the identity is compromised.",{"data":2743,"content":2744,"nodeType":879},{},[],{"data":2746,"content":2747,"nodeType":889},{},[2748,2753,2760,2765,2771],{"data":2749,"marks":2750,"value":2752,"nodeType":865},{},[2751],{"type":887},"Sidenote: why we're looking at attacks ",{"data":2754,"marks":2755,"value":2759,"nodeType":865},{},[2756,2758],{"type":2757},"italic",{"type":887},"in",{"data":2761,"marks":2762,"value":2764,"nodeType":865},{},[2763],{"type":887}," the browser, not ",{"data":2766,"marks":2767,"value":2770,"nodeType":865},{},[2768,2769],{"type":2757},{"type":887},"on",{"data":2772,"marks":2773,"value":2775,"nodeType":865},{},[2774],{"type":887}," the browser",{"data":2777,"content":2778,"nodeType":866},{},[2779,2783,2791],{"data":2780,"marks":2781,"value":2782,"nodeType":865},{},[],"Calling this a \"browser attacks\" matrix needs clarification. We're not talking about browser exploits — RCE vulnerabilities, sandbox escapes, memory corruption bugs. Those attacks target the browser itself, they're extraordinarily expensive to develop, and they're increasingly rare. Browser zero-days hit a ",{"data":2784,"content":2786,"nodeType":905},{"uri":2785},"https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review",[2787],{"data":2788,"marks":2789,"value":2790,"nodeType":865},{},[],"historic low of 9%",{"data":2792,"marks":2793,"value":2794,"nodeType":865},{},[]," of all zero-days reported to Google, and a Chrome RCE commands a $250,000 bug bounty.",{"data":2796,"content":2797,"nodeType":866},{},[2798],{"data":2799,"marks":2800,"value":2801,"nodeType":865},{},[],"In comparison, a one-year phishing kit rental costs $1,000. A bulk stolen credential list costs $15. An initial-access-broker-provided IdP admin account costs $3,000. When it costs orders of magnitude less to exploit the person using the browser than to exploit the browser itself, attackers will take the cheaper option every time.",{"data":2803,"content":2804,"nodeType":866},{},[2805],{"data":2806,"marks":2807,"value":2808,"nodeType":865},{},[],"It's worth heading off the obvious counterargument: won't AI-assisted vulnerability discovery eventually make browser exploits cheaper? Perhaps — but it will simultaneously make them easier for browser vendors to find and patch, and vendors like Google and Microsoft have the engineering capacity and financial incentive to scale AI-driven remediation far faster than attackers can scale exploit development.",{"data":2810,"content":2811,"nodeType":879},{},[],{"data":2813,"content":2814,"nodeType":889},{},[2815],{"data":2816,"marks":2817,"value":2819,"nodeType":865},{},[2818],{"type":887},"What hasn't changed",{"data":2821,"content":2822,"nodeType":866},{},[2823,2827,2835],{"data":2824,"marks":2825,"value":2826,"nodeType":865},{},[],"The matrix remains open-source, community-maintained, and available on ",{"data":2828,"content":2830,"nodeType":905},{"uri":2829},"https://github.com/pushsecurity/saas-attacks",[2831],{"data":2832,"marks":2833,"value":2834,"nodeType":865},{},[],"GitHub",{"data":2836,"marks":2837,"value":2838,"nodeType":865},{},[],". The goal is the same as it was in 2023: to give offensive and defensive security teams a shared reference point for the techniques that matter most.",{"data":2840,"content":2841,"nodeType":866},{},[2842],{"data":2843,"marks":2844,"value":2845,"nodeType":865},{},[],"We built it because there was a gap in how the industry talked about these techniques, and that gap still exists — MITRE ATT&CK remains essential for endpoint and network TTPs, but the browser-based, identity-first techniques behind most modern breaches are still underrepresented in traditional frameworks.",{"data":2847,"content":2848,"nodeType":866},{},[2849],{"data":2850,"marks":2851,"value":2852,"nodeType":865},{},[],"We continue to maintain the matrix with input from red teams, detection engineers, and threat researchers across the community. Some of the most valuable additions over the past two years have come from practitioners who encountered a technique on an engagement or in an investigation and contributed it back to the repository.",{"data":2854,"content":2855,"nodeType":866},{},[2856,2860,2867],{"data":2857,"marks":2858,"value":2859,"nodeType":865},{},[],"If you're an offensive security professional using these techniques on engagements, or a defender building detections against them, we want to hear from you. Submit a PR, open a discussion, or flag a technique we've missed on ",{"data":2861,"content":2863,"nodeType":905},{"uri":2862},"https://github.com/pushsecurity/browser-identity-attacks-matrix",[2864],{"data":2865,"marks":2866,"value":2834,"nodeType":865},{},[],{"data":2868,"marks":2869,"value":1193,"nodeType":865},{},[],{"data":2871,"content":2872,"nodeType":879},{},[],{"data":2874,"content":2875,"nodeType":889},{},[2876],{"data":2877,"marks":2878,"value":2880,"nodeType":865},{},[2879],{"type":887},"Looking ahead",{"data":2882,"content":2883,"nodeType":866},{},[2884],{"data":2885,"marks":2886,"value":2887,"nodeType":865},{},[],"The pace of attacker innovation in browser-based initial access techniques over the past 18 months has been unlike anything we've tracked before — technique after technique moving from research curiosity to industrialized criminal tooling within months, not years.",{"data":2889,"content":2890,"nodeType":2718},{},[2891,2901,2911],{"data":2892,"content":2893,"nodeType":2654},{},[2894],{"data":2895,"content":2896,"nodeType":866},{},[2897],{"data":2898,"marks":2899,"value":2900,"nodeType":865},{},[],"AiTM platforms are adding authorization-based attack options alongside their credential-harvesting capabilities.",{"data":2902,"content":2903,"nodeType":2654},{},[2904],{"data":2905,"content":2906,"nodeType":866},{},[2907],{"data":2908,"marks":2909,"value":2910,"nodeType":865},{},[],"ClickFix has spawned fully browser-native variants.",{"data":2912,"content":2913,"nodeType":2654},{},[2914],{"data":2915,"content":2916,"nodeType":866},{},[2917],{"data":2918,"marks":2919,"value":2920,"nodeType":865},{},[],"AI is lowering the cost of producing convincing social engineering and phishing infrastructure at scale.",{"data":2922,"content":2923,"nodeType":866},{},[2924],{"data":2925,"marks":2926,"value":2927,"nodeType":865},{},[],"We don't see any of this slowing down, and that's exactly why thinking about these attacks as a browser problem instead of siloing them across email, endpoint, network, and cloud categories, each with a partial view of the picture (and still missing the whole when combined).",{"data":2929,"content":2930,"nodeType":866},{},[2931,2935,2942],{"data":2932,"marks":2933,"value":2934,"nodeType":865},{},[],"The Browser & Identity Attacks Matrix is our contribution to keeping that shared understanding current. You can ",{"data":2936,"content":2937,"nodeType":905},{"uri":2206},[2938],{"data":2939,"marks":2940,"value":2941,"nodeType":865},{},[],"explore the matrix here",{"data":2943,"marks":2944,"value":1193,"nodeType":865},{},[],{"data":2946,"content":2947,"nodeType":866},{},[2948,2952,2960],{"data":2949,"marks":2950,"value":2951,"nodeType":865},{},[],"You can also read our recent ",{"data":2953,"content":2955,"nodeType":905},{"uri":2954},"https://pushsecurity.com/thank-you/browser-attacks-report",[2956],{"data":2957,"marks":2958,"value":2959,"nodeType":865},{},[],"browser attack techniques report",{"data":2961,"marks":2962,"value":2963,"nodeType":865},{},[]," for more information.",{"data":2965,"content":2969,"nodeType":875},{"target":2966},{"sys":2967},{"id":2968,"type":872,"linkType":873},"1hx6sxpyEzxn4F4jc1RGQi",[],{"data":2971,"content":2972,"nodeType":879},{},[],{"data":2974,"content":2975,"nodeType":866},{},[2976],{"data":2977,"marks":2978,"value":2979,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",{"data":2981,"content":2982,"nodeType":866},{},[2983,2987,2994],{"data":2984,"marks":2985,"value":2986,"nodeType":865},{},[],"Book a ",{"data":2988,"content":2989,"nodeType":905},{"uri":1512},[2990],{"data":2991,"marks":2992,"value":2993,"nodeType":865},{},[],"live demo",{"data":2995,"marks":2996,"value":2997,"nodeType":865},{},[]," to learn more.","Introducing the Browser & Identity Attacks Matrix","We're re-releasing the SaaS attack matrix as the Browser & Identity Attacks Matrix. Here's why we've decided to make the change and what it means.","2026-05-08T00:00:00.000Z","introducing-the-browser-and-identity-attacks-matrix",{"items":3003},[3004,3006],{"sys":3005,"name":2144},{"id":2143},{"sys":3007,"name":342},{"id":3008},"4ksQNCFeBf8H4QIORqpRLw",{"items":3010},[3011],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":3015},"Dan Green","Dan","Threat Research",{"url":3016},"https://images.ctfassets.net/y1cdw1ablpvd/7jik1VhFgA3kgzXBXTm2Vw/fcd8c171da644903d0827eafcfbcaad0/Dan_Headshot_2025.png",{"__typename":1544,"sys":3018,"content":3020,"title":3990,"synopsis":3991,"hashTags":59,"publishedDate":3000,"slug":3992,"tagsCollection":3993,"authorsCollection":3999},{"id":3019},"3jF1fypt08TNlSoWuoMWhj",{"json":3021},{"data":3022,"content":3023,"nodeType":1522},{},[3024,3050,3081,3124,3167,3173,3185,3188,3196,3246,3253,3276,3282,3285,3293,3321,3328,3336,3342,3345,3353,3360,3378,3385,3428,3435,3438,3446,3465,3520,3523,3531,3549,3567,3575,3582,3594,3606,3618,3630,3646,3654,3661,3664,3671,3678,3695,3698,3706,3724,3984],{"data":3025,"content":3026,"nodeType":866},{},[3027,3031,3037,3041,3046],{"data":3028,"marks":3029,"value":3030,"nodeType":865},{},[],"ShinyHunters and the broader SLH (",{"data":3032,"content":3033,"nodeType":905},{"uri":2644},[3034],{"data":3035,"marks":3036,"value":2649,"nodeType":865},{},[],{"data":3038,"marks":3039,"value":3040,"nodeType":865},{},[],") collective have claimed breaches at thousands of organizations over the past twelve months across retail, technology, aviation, financial services, media, gaming, and education, in what amounts to the most sustained data theft and extortion operation in recent cybercrime history. SLH's genealogy traces through a merger of Scattered Spider, Lapsus$, and ShinyHunters, all parts of ",{"data":3042,"marks":3043,"value":3045,"nodeType":865},{},[3044],{"type":887},"the Com",{"data":3047,"marks":3048,"value":3049,"nodeType":865},{},[],", a broader community of English-speaking cybercriminals with international links. ",{"data":3051,"content":3052,"nodeType":866},{},[3053,3057,3065,3069,3077],{"data":3054,"marks":3055,"value":3056,"nodeType":865},{},[],"The confirmed victim list reads like a Fortune 500 directory: Coca-Cola, Cisco, Qantas, Coinbase, ADT, Aflac, SoundCloud, Rockstar Games, Charter Communications, and recently ",{"data":3058,"content":3060,"nodeType":905},{"uri":3059},"https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attack/",[3061],{"data":3062,"marks":3063,"value":3064,"nodeType":865},{},[],"Instructure",{"data":3066,"marks":3067,"value":3068,"nodeType":865},{},[]," — whose breach ",{"data":3070,"content":3072,"nodeType":905},{"uri":3071},"https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/",[3073],{"data":3074,"marks":3075,"value":3076,"nodeType":865},{},[],"disrupted schools and universities nationwide",{"data":3078,"marks":3079,"value":3080,"nodeType":865},{},[]," during final exams — among dozens more named publicly and likely many more that haven't been (breaches settled quickly behind closed doors don't always make it into the public eye). ShinyHunters alone claimed over 1.5 billion stolen Salesforce records from a single campaign targeting more than 1,000 organizations.",{"data":3082,"content":3083,"nodeType":866},{},[3084,3088,3096,3100,3108,3112,3120],{"data":3085,"marks":3086,"value":3087,"nodeType":865},{},[],"Additional operating clusters, including Cordial Spider and Snarky Spider (which CrowdStrike ",{"data":3089,"content":3091,"nodeType":905},{"uri":3090},"https://cyberscoop.com/crowdstrike-cordial-spider-snarky-spider-extortion-attacks/",[3092],{"data":3093,"marks":3094,"value":3095,"nodeType":865},{},[],"characterizes as the new generation of Scattered Spider",{"data":3097,"marks":3098,"value":3099,"nodeType":865},{},[],") run parallel campaigns against different target sectors, unified not by shared infrastructure but by a shared playbook of techniques that exploit the structural weakness in modern SaaS-first organizations. ",{"data":3101,"content":3103,"nodeType":905},{"uri":3102},"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-03-12-Vishing-Campaigns-Lead-to-Data-Theft-and-Extortion.txt",[3104],{"data":3105,"marks":3106,"value":3107,"nodeType":865},{},[],"Unit 42 documented",{"data":3109,"marks":3110,"value":3111,"nodeType":865},{},[]," these groups moving from initial compromise to complete data exfiltration in under an hour — faster than most organizations can even begin to respond. Newer groups with links to the SLH ecosystem like CoinbaseCartel have also continued the tradition of weaponizing stolen credentials from the infostealer economy at scale, as ShinyHunters did in the ",{"data":3113,"content":3115,"nodeType":905},{"uri":3114},"https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/",[3116],{"data":3117,"marks":3118,"value":3119,"nodeType":865},{},[],"2024 Snowflake breach",{"data":3121,"marks":3122,"value":3123,"nodeType":865},{},[]," that compromised over 165 customer environments (and claimed another billion-plus records).",{"data":3125,"content":3126,"nodeType":866},{},[3127,3131,3139,3143,3151,3155,3163],{"data":3128,"marks":3129,"value":3130,"nodeType":865},{},[],"Not every SLH breach is browser-based — the Instructure breach (275 million individuals, ~330 school login portals defaced) began with a Salesforce tenant compromise in September 2025, but resurfaced in May 2026 after attackers exploited a ",{"data":3132,"content":3134,"nodeType":905},{"uri":3133},"https://www.bitdefender.com/en-gb/blog/businessinsights/technical-advisory-shinyhunters-breach-instructure-canvas-lms",[3135],{"data":3136,"marks":3137,"value":3138,"nodeType":865},{},[],"vulnerability affecting Canvas's Free-For-Teacher program",{"data":3140,"marks":3141,"value":3142,"nodeType":865},{},[]," (it's now been confirmed that Instructure \"",{"data":3144,"content":3146,"nodeType":905},{"uri":3145},"https://www.instructure.com/incident_update",[3147],{"data":3148,"marks":3149,"value":3150,"nodeType":865},{},[],"reached a settlement",{"data":3152,"marks":3153,"value":3154,"nodeType":865},{},[],"\" for the deletion of the data, and shut down the free account tier), while the Coinbase breach cost ",{"data":3156,"content":3158,"nodeType":905},{"uri":3157},"https://www.bleepingcomputer.com/news/security/coinbase-discloses-breach-faces-up-to-400-million-in-losses/",[3159],{"data":3160,"marks":3161,"value":3162,"nodeType":865},{},[],"$180M–400M through insider bribery",{"data":3164,"marks":3165,"value":3166,"nodeType":865},{},[]," — but these are the exceptions that prove the rule. ",{"data":3168,"content":3172,"nodeType":875},{"target":3169},{"sys":3170},{"id":3171,"type":872,"linkType":873},"4qNrbDyMJIumQfdbh9YVkU",[],{"data":3174,"content":3175,"nodeType":866},{},[3176,3181],{"data":3177,"marks":3178,"value":3180,"nodeType":865},{},[3179],{"type":887},"The vast majority of SLH campaigns over the past year converge on three browser-based attack vectors: vishing combined with AiTM phishing, device code phishing exploiting account authorization flows, and OAuth supply chain attacks through compromised third-party integrators.",{"data":3182,"marks":3183,"value":3184,"nodeType":865},{},[]," Each is well-documented, each has produced confirmed victims at scale, and each is detectable or preventable through browser-layer security controls.",{"data":3186,"content":3187,"nodeType":879},{},[],{"data":3189,"content":3190,"nodeType":889},{},[3191],{"data":3192,"marks":3193,"value":3195,"nodeType":865},{},[3194],{"type":887},"Vector 1: Vishing combined with AiTM phishing",{"data":3197,"content":3198,"nodeType":866},{},[3199,3203,3211,3214,3222,3225,3232,3236,3243],{"data":3200,"marks":3201,"value":3202,"nodeType":865},{},[],"The most visible campaign right now pairs targeted voice calls with adversary-in-the-middle phishing pages — an approach that ",{"data":3204,"content":3206,"nodeType":905},{"uri":3205},"https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft",[3207],{"data":3208,"marks":3209,"value":3210,"nodeType":865},{},[],"Mandiant",{"data":3212,"marks":3213,"value":1675,"nodeType":865},{},[],{"data":3215,"content":3217,"nodeType":905},{"uri":3216},"https://www.crowdstrike.com/en-us/blog/defending-against-cordial-spider-and-snarky-spider-with-falcon-shield/",[3218],{"data":3219,"marks":3220,"value":3221,"nodeType":865},{},[]," CrowdStrike",{"data":3223,"marks":3224,"value":2095,"nodeType":865},{},[],{"data":3226,"content":3227,"nodeType":905},{"uri":3102},[3228],{"data":3229,"marks":3230,"value":3231,"nodeType":865},{},[]," Unit 42",{"data":3233,"marks":3234,"value":3235,"nodeType":865},{},[]," have all documented from the incident response side, and which Push has ",{"data":3237,"content":3238,"nodeType":905},{"uri":1078},[3239],{"data":3240,"marks":3241,"value":3242,"nodeType":865},{},[],"documented from inside the attacker's own operator panels",{"data":3244,"marks":3245,"value":1193,"nodeType":865},{},[],{"data":3247,"content":3248,"nodeType":866},{},[3249],{"data":3250,"marks":3251,"value":3252,"nodeType":865},{},[],"An attacker impersonating IT support calls the target employee, establishes urgency — often citing a \"mandatory passkey rollout\" or a \"security compliance update\" — and directs them to a victim-branded AiTM phishing page (typically at a domain like \u003Ccompany>sso.com or \u003Ccompany>internal.com). The attack is processed by a live human in real time, relaying credentials and MFA codes to the legitimate identity provider as they are entered, capturing the resulting session token, and granting the attacker an authenticated session. ",{"data":3254,"content":3255,"nodeType":866},{},[3256,3260,3267,3271],{"data":3257,"marks":3258,"value":3259,"nodeType":865},{},[],"One of the reasons that this method is becoming so widespread is the commoditization of effective tools. Push's ",{"data":3261,"content":3262,"nodeType":905},{"uri":1078},[3263],{"data":3264,"marks":3265,"value":3266,"nodeType":865},{},[],"infiltration of the criminal phishing panels",{"data":3268,"marks":3269,"value":3270,"nodeType":865},{},[]," identified over 400 linked domains across four distinct infrastructure clusters. ",{"data":3272,"marks":3273,"value":3275,"nodeType":865},{},[3274],{"type":887},"This mirrors the pattern that turned AiTM phishing from a specialist capability into an industrialized market with competing PhaaS platforms, but with the added complication that voice phishing as the delivery vector makes the attack invisible to traditional anti-phishing controls at the email layer.",{"data":3277,"content":3281,"nodeType":875},{"target":3278},{"sys":3279},{"id":3280,"type":872,"linkType":873},"1Yhthl0PILGW7EmCcZUrNv",[],{"data":3283,"content":3284,"nodeType":879},{},[],{"data":3286,"content":3287,"nodeType":889},{},[3288],{"data":3289,"marks":3290,"value":3292,"nodeType":865},{},[3291],{"type":887},"Vector 2: Vishing combined with device code phishing",{"data":3294,"content":3295,"nodeType":866},{},[3296,3299,3306,3310,3317],{"data":3297,"marks":3298,"value":1061,"nodeType":865},{},[],{"data":3300,"content":3301,"nodeType":905},{"uri":2667},[3302],{"data":3303,"marks":3304,"value":3305,"nodeType":865},{},[],"ShinyHunters Salesforce campaign",{"data":3307,"marks":3308,"value":3309,"nodeType":865},{},[]," that ran through 2025 and into 2026 used device code phishing as one of its core methods, ",{"data":3311,"content":3312,"nodeType":905},{"uri":3114},[3313],{"data":3314,"marks":3315,"value":3316,"nodeType":865},{},[],"compromising over 1,000 organizations and claiming 1.5 billion stolen records",{"data":3318,"marks":3319,"value":3320,"nodeType":865},{},[]," — including an attempted extortion of Salesforce itself. The attack involved registering an attacker-controlled \"DataLoader\" application mimicking a legitimate Salesforce tool, configuring it to request broad OAuth scopes including full API access and refresh token generation, and guiding victims through the device authorization flow via vishing calls.",{"data":3322,"content":3323,"nodeType":866},{},[3324],{"data":3325,"marks":3326,"value":3327,"nodeType":865},{},[],"Device code phishing exploits the OAuth 2.0 device authorization grant — a flow designed for devices without browsers, like smart TVs, but used in a wide range of scenarios including CLI logins — by tricking users into entering a code on Microsoft's (or another identity provider's) legitimate verification page. Since the victim is usually signed into the app in their browser, there’s no login at all. They simply navigate to the app’s device code login page and enter an attacker-provided code to grant the attacker an access token. ",{"data":3329,"content":3330,"nodeType":866},{},[3331],{"data":3332,"marks":3333,"value":3335,"nodeType":865},{},[3334],{"type":887},"This is what makes device code phishing structurally different from AiTM: it defeats all MFA (including passkeys) because the attack doesn’t target the login, but the authorization layer instead.",{"data":3337,"content":3341,"nodeType":875},{"target":3338},{"sys":3339},{"id":3340,"type":872,"linkType":873},"3ElQz8sLATnR8RY5nVlBGM",[],{"data":3343,"content":3344,"nodeType":879},{},[],{"data":3346,"content":3347,"nodeType":889},{},[3348],{"data":3349,"marks":3350,"value":3352,"nodeType":865},{},[3351],{"type":887},"Vector 3: OAuth supply chain attacks through compromised integrators",{"data":3354,"content":3355,"nodeType":866},{},[3356],{"data":3357,"marks":3358,"value":3359,"nodeType":865},{},[],"The third vector does not require the attacker to phish the victim organization's employees at all. Instead, it exploits the OAuth trust relationships that organizations create when they connect third-party SaaS vendors into their environments — and the consequence is that every organization that authorized one of these integrations effectively extended its security boundary to include the vendor's own security posture.",{"data":3361,"content":3362,"nodeType":866},{},[3363,3366,3374],{"data":3364,"marks":3365,"value":1061,"nodeType":865},{},[],{"data":3367,"content":3369,"nodeType":905},{"uri":3368},"https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift",[3370],{"data":3371,"marks":3372,"value":3373,"nodeType":865},{},[],"Salesloft/Drift supply chain attack",{"data":3375,"marks":3376,"value":3377,"nodeType":865},{},[]," demonstrated this at scale in 2025: in an extension of the previously mentioned device code phishing campaign, the attacker compromised Salesloft's GitHub environment, used TruffleHog to find secrets, stole Drift OAuth tokens, and used them to access downstream Salesforce environments. The same pattern was later repeated at Gainsight. ",{"data":3379,"content":3380,"nodeType":866},{},[3381],{"data":3382,"marks":3383,"value":3384,"nodeType":865},{},[],"Along with the previously mentioned device code phishing attacks,  more than 1000 organizations were breached. The attackers then harvested AWS keys, Snowflake credentials, and stored passwords from breached Salesforce instances, compounding the access into progressively wider reach.",{"data":3386,"content":3387,"nodeType":866},{},[3388,3392,3400,3404,3412,3416,3424],{"data":3389,"marks":3390,"value":3391,"nodeType":865},{},[],"The same structural pattern has continued into 2026 with the Anodot supply chain compromise, which has produced confirmed breaches at ",{"data":3393,"content":3395,"nodeType":905},{"uri":3394},"https://www.bleepingcomputer.com/news/security/vimeo-data-breach-exposes-personal-information-of-119-000-people/",[3396],{"data":3397,"marks":3398,"value":3399,"nodeType":865},{},[],"Vimeo",{"data":3401,"marks":3402,"value":3403,"nodeType":865},{},[]," (119,000 users), Rockstar Games (78.6 million records), and ",{"data":3405,"content":3407,"nodeType":905},{"uri":3406},"https://www.bleepingcomputer.com/news/security/zara-data-breach-exposed-personal-information-of-197-000-people/",[3408],{"data":3409,"marks":3410,"value":3411,"nodeType":865},{},[],"Zara/Inditex",{"data":3413,"marks":3414,"value":3415,"nodeType":865},{},[]," (197,000 people), with further downstream victims likely still emerging. The ",{"data":3417,"content":3419,"nodeType":905},{"uri":3418},"https://pushsecurity.com/blog/unpacking-the-vercel-breach/",[3420],{"data":3421,"marks":3422,"value":3423,"nodeType":865},{},[],"Vercel breach",{"data":3425,"marks":3426,"value":3427,"nodeType":865},{},[],", which involved compromised OAuth tokens from Context.ai cascading into Google Workspace, also reinforces the same attack pattern (though it was likely not a ShinyHunters operation despite being claimed by someone pretending to be them).",{"data":3429,"content":3430,"nodeType":866},{},[3431],{"data":3432,"marks":3433,"value":3434,"nodeType":865},{},[],"A forgotten SaaS integration can easily become the pivot point for downstream compromise. The moment you authorize a third-party integration, your security boundary extends to include that vendor. If the third-party is compromised, every downstream customer organization with an active integration is exposed.",{"data":3436,"content":3437,"nodeType":879},{},[],{"data":3439,"content":3440,"nodeType":889},{},[3441],{"data":3442,"marks":3443,"value":3445,"nodeType":865},{},[3444],{"type":887},"The infostealer credential playbook sits alongside these attacks",{"data":3447,"content":3448,"nodeType":866},{},[3449,3453,3461],{"data":3450,"marks":3451,"value":3452,"nodeType":865},{},[],"Alongside the three vectors above, ShinyHunters has a track record of exploiting the infostealer credential economy at scale — and it predates any of them. The 2024 Snowflake campaign — 165+ customer environments compromised, over a billion records stolen from AT&T, Ticketmaster, Santander, and Advance Auto Parts among others — was built entirely on infostealer-harvested credentials replayed against MFA-less tenants, with ",{"data":3454,"content":3456,"nodeType":905},{"uri":3455},"https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",[3457],{"data":3458,"marks":3459,"value":3460,"nodeType":865},{},[],"Mandiant's investigation",{"data":3462,"marks":3463,"value":3464,"nodeType":865},{},[]," finding that 80% of compromised accounts had prior breach exposure in datasets dating back to 2020. The credentials were already circulating in criminal marketplaces; ShinyHunters simply purchased and operationalized them at industrial scale.",{"data":3466,"content":3467,"nodeType":866},{},[3468,3472,3480,3484,3492,3496,3504,3508,3516],{"data":3469,"marks":3470,"value":3471,"nodeType":865},{},[],"The same methodology powered the ",{"data":3473,"content":3475,"nodeType":905},{"uri":3474},"https://pushsecurity.com/blog/why-attackers-are-targeting-jira-with-stolen-credentials/",[3476],{"data":3477,"marks":3478,"value":3479,"nodeType":865},{},[],"HellCat Jira campaign",{"data":3481,"marks":3482,"value":3483,"nodeType":865},{},[]," through 2024–2025, and has now been industrialized as a standalone operation by ",{"data":3485,"content":3487,"nodeType":905},{"uri":3486},"https://www.halcyon.ai/jp/threat-group/coinbasecartel",[3488],{"data":3489,"marks":3490,"value":3491,"nodeType":865},{},[],"CoinbaseCartel",{"data":3493,"marks":3494,"value":3495,"nodeType":865},{},[],", another criminal group reported to be an offshoot of SLH. CoinbaseCartel's model is familiar: purchase old infostealer credentials, use them to access cloud and development environments, exfiltrate data, and demand ransom. ",{"data":3497,"content":3499,"nodeType":905},{"uri":3498},"https://www.infostealers.com/article/inside-the-coinbase-cartel-how-infostealer-credentials-fueled-a-100-company-ransomware-spree/",[3500],{"data":3501,"marks":3502,"value":3503,"nodeType":865},{},[],"Hudson Rock's analysis",{"data":3505,"marks":3506,"value":3507,"nodeType":865},{},[]," of the group's 170+ claimed victims confirms that roughly 80% had prior infostealer infections predating the attacks. The most recent named victim is ",{"data":3509,"content":3511,"nodeType":905},{"uri":3510},"https://www.bleepingcomputer.com/news/security/grafana-says-stolen-github-token-let-hackers-steal-codebase/",[3512],{"data":3513,"marks":3514,"value":3515,"nodeType":865},{},[],"Grafana",{"data":3517,"marks":3518,"value":3519,"nodeType":865},{},[],", where a GitHub token compromised via the TanStack npm supply chain attack and missed during credential rotation was used to download the codebase and attempt extortion. ",{"data":3521,"content":3522,"nodeType":879},{},[],{"data":3524,"content":3525,"nodeType":889},{},[3526],{"data":3527,"marks":3528,"value":3530,"nodeType":865},{},[3529],{"type":887},"These attacks all happen in the browser",{"data":3532,"content":3533,"nodeType":866},{},[3534,3538,3545],{"data":3535,"marks":3536,"value":3537,"nodeType":865},{},[],"Every one of these attack chains is a browser-based attack that either occurs in the browser (AiTM phishing, device code phishing) or could have been prevented at the browser layer (OAuth consent governance). The techniques are interchangeable — the",{"data":3539,"content":3540,"nodeType":905},{"uri":1319},[3541],{"data":3542,"marks":3543,"value":3544,"nodeType":865},{},[]," same criminal kits now offer AiTM and device code phishing side by side",{"data":3546,"marks":3547,"value":3548,"nodeType":865},{},[],", and the same threat actor (ShinyHunters) has used all three vectors across different campaigns within the same twelve-month period.",{"data":3550,"content":3551,"nodeType":866},{},[3552,3556,3563],{"data":3553,"marks":3554,"value":3555,"nodeType":865},{},[],"Additionally, infostealer infections themselves are increasingly delivered through browser-based methods like ",{"data":3557,"content":3559,"nodeType":905},{"uri":3558},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection",[3560],{"data":3561,"marks":3562,"value":315,"nodeType":865},{},[],{"data":3564,"marks":3565,"value":3566,"nodeType":865},{},[],", closing the loop between the credential supply side and the browser-layer detection point.",{"data":3568,"content":3569,"nodeType":2315},{},[3570],{"data":3571,"marks":3572,"value":3574,"nodeType":865},{},[3573],{"type":887},"How Push can help",{"data":3576,"content":3577,"nodeType":866},{},[3578],{"data":3579,"marks":3580,"value":3581,"nodeType":865},{},[],"Push operates at the exact point in each of these attack chains where automated intervention can still prevent the compromise. ",{"data":3583,"content":3584,"nodeType":866},{},[3585,3590],{"data":3586,"marks":3587,"value":3589,"nodeType":865},{},[3588],{"type":887},"For vishing + AiTM attacks, ",{"data":3591,"marks":3592,"value":3593,"nodeType":865},{},[],"Push's behavioral phishing detection analyzes and blocks the phishing page in real time by detecting it from the user's browser — regardless of the domains used, hosting infrastructure, or where the URL was delivered.  ",{"data":3595,"content":3596,"nodeType":866},{},[3597,3602],{"data":3598,"marks":3599,"value":3601,"nodeType":865},{},[3600],{"type":887},"For device code phishing,",{"data":3603,"marks":3604,"value":3605,"nodeType":865},{},[]," Push detects the phishing pages associated with device code phishing kits — including generic, technique-class detections that catch new kits without requiring kit-specific signatures. Second, Push provides an additional layer of protection on the legitimate device code authentication pages themselves, preventing users from entering attacker-supplied codes into them. Together, these detections cover both the kit-operated phishing infrastructure and the legitimate auth pages that the attack flow depends on.",{"data":3607,"content":3608,"nodeType":866},{},[3609,3614],{"data":3610,"marks":3611,"value":3613,"nodeType":865},{},[3612],{"type":887},"For OAuth supply chain attacks,",{"data":3615,"marks":3616,"value":3617,"nodeType":865},{},[]," Push's detects and controls OAuth consent flows at the browser layer — capturing which application is requesting access, what scopes it's requesting, and whether the grant should be permitted under organizational policy. Push customers can also block OAuth connection requests as they transit the browser, enabling security teams to stop unwanted integrations being added in the first place. ",{"data":3619,"content":3620,"nodeType":866},{},[3621,3626],{"data":3622,"marks":3623,"value":3625,"nodeType":865},{},[3624],{"type":887},"For the infostealer credential playbook,",{"data":3627,"marks":3628,"value":3629,"nodeType":865},{},[]," Push's stolen credential detection identifies when employees are using credentials that have appeared in breach datasets or dark web feeds — catching the moment a dormant infostealer credential surfaces at a browser-based login, as well as surfacing insecure login methods missing mitigating controls like MFA and enforcing them through in-browser guardrails. And on the supply side, Push's ClickFix detection addresses the browser-based delivery vector that is now the primary method for distributing infostealer malware in the first place.",{"data":3631,"content":3632,"nodeType":866},{},[3633,3636,3643],{"data":3634,"marks":3635,"value":21,"nodeType":865},{},[],{"data":3637,"content":3638,"nodeType":905},{"uri":1307},[3639],{"data":3640,"marks":3641,"value":3642,"nodeType":865},{},[],"Learn more about how you can use Push controls to protect your users from in-browser threats here. ",{"data":3644,"marks":3645,"value":21,"nodeType":865},{},[],{"data":3647,"content":3648,"nodeType":2315},{},[3649],{"data":3650,"marks":3651,"value":3653,"nodeType":865},{},[3652],{"type":887},"Closing thoughts",{"data":3655,"content":3656,"nodeType":866},{},[3657],{"data":3658,"marks":3659,"value":3660,"nodeType":865},{},[],"The campaigns documented in this post are not historical — they are ongoing, with new victims surfacing weekly and the underlying criminal infrastructure still actively developing. But the defensive strategy does not require anticipating which specific group, vector, or target sector comes next, because all of them converge on the same control point: the browser, where the attack begins or the integration decision is made. Organizations with browser-layer detection and OAuth governance in place have defense-in-depth against the full range of techniques these groups employ, regardless of which specific vector any given campaign uses.",{"data":3662,"content":3663,"nodeType":879},{},[],{"data":3665,"content":3666,"nodeType":866},{},[3667],{"data":3668,"marks":3669,"value":3670,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. ",{"data":3672,"content":3673,"nodeType":866},{},[3674],{"data":3675,"marks":3676,"value":3677,"nodeType":865},{},[],"Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",{"data":3679,"content":3680,"nodeType":866},{},[3681,3684,3692],{"data":3682,"marks":3683,"value":21,"nodeType":865},{},[],{"data":3685,"content":3687,"nodeType":905},{"uri":3686},"https://pushsecurity.com/demo/",[3688],{"data":3689,"marks":3690,"value":3691,"nodeType":865},{},[],"Book a live demo to learn more.",{"data":3693,"marks":3694,"value":21,"nodeType":865},{},[],{"data":3696,"content":3697,"nodeType":879},{},[],{"data":3699,"content":3700,"nodeType":889},{},[3701],{"data":3702,"marks":3703,"value":3705,"nodeType":865},{},[3704],{"type":887},"Appendix: named ShinyHunters victims since May 2025",{"data":3707,"content":3708,"nodeType":866},{},[3709,3713,3720],{"data":3710,"marks":3711,"value":3712,"nodeType":865},{},[],"To give an indication of the scale, the following table documents all publicly named victims attributed to ShinyHunters specifically since the Salesforce campaign began in May 2025. It is not exhaustive: ShinyHunters has claimed over 1,000 organizations in aggregate across its Salesforce campaigns alone, and many victims have not been publicly named. This list also doesn’t include the billion-plus records compromised in the 2024 Snowflake breaches. The major ransomware attacks executed against M&S, Co-op, and Jaguar Land Rover claimed by the ",{"data":3714,"content":3715,"nodeType":905},{"uri":2644},[3716],{"data":3717,"marks":3718,"value":3719,"nodeType":865},{},[],"Scattered Lapsus$ Hunters \"brand\"",{"data":3721,"marks":3722,"value":3723,"nodeType":865},{},[]," also aren't listed below. ",{"data":3725,"content":3726,"nodeType":3983},{},[3727,3776,3840,3888,3936],{"data":3728,"content":3729,"nodeType":3775},{},[3730,3742,3753,3764],{"data":3731,"content":3732,"nodeType":3741},{},[3733],{"data":3734,"content":3735,"nodeType":866},{},[3736],{"data":3737,"marks":3738,"value":3740,"nodeType":865},{},[3739],{"type":887},"Campaign","table-cell",{"data":3743,"content":3744,"nodeType":3741},{},[3745],{"data":3746,"content":3747,"nodeType":866},{},[3748],{"data":3749,"marks":3750,"value":3752,"nodeType":865},{},[3751],{"type":887},"Began",{"data":3754,"content":3755,"nodeType":3741},{},[3756],{"data":3757,"content":3758,"nodeType":866},{},[3759],{"data":3760,"marks":3761,"value":3763,"nodeType":865},{},[3762],{"type":887},"Named victims",{"data":3765,"content":3766,"nodeType":3741},{},[3767],{"data":3768,"content":3769,"nodeType":866},{},[3770],{"data":3771,"marks":3772,"value":3774,"nodeType":865},{},[3773],{"type":887},"Confirmed impact","table-row",{"data":3777,"content":3778,"nodeType":3775},{},[3779,3803,3813,3823],{"data":3780,"content":3781,"nodeType":3741},{},[3782],{"data":3783,"content":3784,"nodeType":866},{},[3785,3790,3794,3799],{"data":3786,"marks":3787,"value":3789,"nodeType":865},{},[3788],{"type":887},"ShinyHunters Salesforce Vishing",{"data":3791,"marks":3792,"value":3793,"nodeType":865},{},[]," (vishing + device code phishing → Salesforce connected app authorization) \n\n& ",{"data":3795,"marks":3796,"value":3798,"nodeType":865},{},[3797],{"type":887},"Salesloft/Drift Supply Chain",{"data":3800,"marks":3801,"value":3802,"nodeType":865},{},[]," (stolen OAuth tokens → downstream Salesforce access)",{"data":3804,"content":3805,"nodeType":3741},{},[3806],{"data":3807,"content":3808,"nodeType":866},{},[3809],{"data":3810,"marks":3811,"value":3812,"nodeType":865},{},[],"May 2025",{"data":3814,"content":3815,"nodeType":3741},{},[3816],{"data":3817,"content":3818,"nodeType":866},{},[3819],{"data":3820,"marks":3821,"value":3822,"nodeType":865},{},[],"Coca-Cola Europacific Partners, Cisco, Qantas, LVMH, Adidas, Google, Chanel, Pandora, Allianz Life, Air France-KLM, Farmers Insurance, Workday, TransUnion, Stellantis, Kering, Odido, Hallmark, Salesloft (origin), Toast, Avalara, Fastly, Cato Networks, Cloudflare, Palo Alto Networks, Zscaler, Tenable, Elastic, JFrog, CyberArk, Rubrik, BeyondTrust, Proofpoint, Workiva, Mercer Advisors, Beacon Pointe, Ameriprise, Kemper, Udemy, 7-Eleven, Mytheresa, Marcus & Millichap, Carnival, Pitney Bowes, Alert 360, Amtrak, McGraw-Hill, Canada Life, Charter Communications",{"data":3824,"content":3825,"nodeType":3741},{},[3826,3833],{"data":3827,"content":3828,"nodeType":866},{},[3829],{"data":3830,"marks":3831,"value":3832,"nodeType":865},{},[],"49 named victims. Confirmed individual impact includes 23M+ records (Coca-Cola), 5.7M records (Qantas), 6.2M customers (Odido), 4.4M consumers (TransUnion), up to 18M records (Stellantis), 13.5M emails (McGraw-Hill), 8.2M emails (Pitney Bowes), 7.5M emails (Carnival), 7-Eleven: 185K confirmed by HIBP (SSNs, driver's licenses; franchisee data), Charter Communications: millions of records claimed (company disputes scope). ",{"data":3834,"content":3835,"nodeType":866},{},[3836],{"data":3837,"marks":3838,"value":3839,"nodeType":865},{},[],"ShinyHunters claims 1.5B+ Salesforce records across 1,000+ organizations total.",{"data":3841,"content":3842,"nodeType":3775},{},[3843,3858,3868,3878],{"data":3844,"content":3845,"nodeType":3741},{},[3846],{"data":3847,"content":3848,"nodeType":866},{},[3849,3854],{"data":3850,"marks":3851,"value":3853,"nodeType":865},{},[3852],{"type":887},"Vishing + AiTM SSO",{"data":3855,"marks":3856,"value":3857,"nodeType":865},{},[]," (vishing → AiTM phishing page → SSO session capture → SaaS data exfiltration)",{"data":3859,"content":3860,"nodeType":3741},{},[3861],{"data":3862,"content":3863,"nodeType":866},{},[3864],{"data":3865,"marks":3866,"value":3867,"nodeType":865},{},[],"Aug 2025",{"data":3869,"content":3870,"nodeType":3741},{},[3871],{"data":3872,"content":3873,"nodeType":866},{},[3874],{"data":3875,"marks":3876,"value":3877,"nodeType":865},{},[],"SoundCloud, GrubHub, Panera Bread, Match Group, Crunchbase, Betterment, CarMax, Edmunds, CarGurus, Hims & Hers, University of Pennsylvania, Harvard University, Optimizely, TELUS Digital, Crunchyroll, ADT",{"data":3879,"content":3880,"nodeType":3741},{},[3881],{"data":3882,"content":3883,"nodeType":866},{},[3884],{"data":3885,"marks":3886,"value":3887,"nodeType":865},{},[],"16 named victims. Confirmed individual impact includes ~30M records (SoundCloud), ~14M records (Panera), 10M+ records (Match Group), ~20M records (Betterment), 5.5M people (ADT), 1M+ records (UPenn), ~1PB stolen from TELUS Digital ($65M ransom refused).",{"data":3889,"content":3890,"nodeType":3775},{},[3891,3906,3916,3926],{"data":3892,"content":3893,"nodeType":3741},{},[3894],{"data":3895,"content":3896,"nodeType":866},{},[3897,3902],{"data":3898,"marks":3899,"value":3901,"nodeType":865},{},[3900],{"type":887},"Anodot Supply Chain",{"data":3903,"marks":3904,"value":3905,"nodeType":865},{},[]," (stolen OAuth tokens → downstream Snowflake/BigQuery access)",{"data":3907,"content":3908,"nodeType":3741},{},[3909],{"data":3910,"content":3911,"nodeType":866},{},[3912],{"data":3913,"marks":3914,"value":3915,"nodeType":865},{},[],"Apr 2026",{"data":3917,"content":3918,"nodeType":3741},{},[3919],{"data":3920,"content":3921,"nodeType":866},{},[3922],{"data":3923,"marks":3924,"value":3925,"nodeType":865},{},[],"Anodot/Glassbox (origin), Rockstar Games, Vimeo, Zara/Inditex",{"data":3927,"content":3928,"nodeType":3741},{},[3929],{"data":3930,"content":3931,"nodeType":866},{},[3932],{"data":3933,"marks":3934,"value":3935,"nodeType":865},{},[],"4 named victims (12+ total claimed). 78.6M records (Rockstar Games), 197K individuals (Zara), 119K individuals (Vimeo).",{"data":3937,"content":3938,"nodeType":3775},{},[3939,3954,3963,3973],{"data":3940,"content":3941,"nodeType":3741},{},[3942],{"data":3943,"content":3944,"nodeType":866},{},[3945,3950],{"data":3946,"marks":3947,"value":3949,"nodeType":865},{},[3948],{"type":887},"Other SLH-attributed",{"data":3951,"marks":3952,"value":3953,"nodeType":865},{},[]," (misc. vectors including infostealer chains, CI/CD supply chain, SaaS platform compromise)",{"data":3955,"content":3956,"nodeType":3741},{},[3957],{"data":3958,"content":3959,"nodeType":866},{},[3960],{"data":3961,"marks":3962,"value":3812,"nodeType":865},{},[],{"data":3964,"content":3965,"nodeType":3741},{},[3966],{"data":3967,"content":3968,"nodeType":866},{},[3969],{"data":3970,"marks":3971,"value":3972,"nodeType":865},{},[],"UK Legal Aid Agency, Mixpanel, Wynn Resorts, Woflow, Vercel, European Commission, Mercor, Medtronic, Instructure",{"data":3974,"content":3975,"nodeType":3741},{},[3976],{"data":3977,"content":3978,"nodeType":866},{},[3979],{"data":3980,"marks":3981,"value":3982,"nodeType":865},{},[],"10 named victims across varied vectors. Notable: Vercel (Lumma Stealer → Context.ai OAuth app → Google Workspace), European Commission (poisoned Trivy GitHub Action → 340GB across 71 EU entities)","table",{"data":3985,"content":3986,"nodeType":866},{},[3987],{"data":3988,"marks":3989,"value":21,"nodeType":865},{},[],"The three attack techniques behind ShinyHunters' 2026 campaigns ","ShinyHunters' breach of Instructure is the latest in a long series of attacks. Here's our view of the big picture. ","analyzing-the-instructure-breach",{"items":3994},[3995,3997],{"sys":3996,"name":2144},{"id":2143},{"sys":3998,"name":342},{"id":3008},{"items":4000},[4001],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":4002},{"url":3016},"7-things-we-learned-from-troy-hunt","blog/7-things-we-learned-from-troy-hunt",{"json":4006},{"data":4007,"content":4008,"nodeType":1522},{},[4009],{"data":4010,"content":4011,"nodeType":866},{},[4012,4016,4024],{"data":4013,"marks":4014,"value":4015,"nodeType":865},{},[],"Troy Hunt — founder of ",{"data":4017,"content":4019,"nodeType":905},{"uri":4018},"https://haveibeenpwned.com/",[4020],{"data":4021,"marks":4022,"value":4023,"nodeType":865},{},[],"Have I Been Pwned",{"data":4025,"marks":4026,"value":4027,"nodeType":865},{},[],", and the person who has probably collected more breach data than anyone in history — joined Push field CTO Mark Orlando to talk about why credential-based attacks keep working, what breach data actually tells us about organizational risk, and why even the best human defenses aren't enough on their own.","Here are 7 things we learned from our conversation with Troy Hunt on the \"Yes, you've been pwned\" webinar. ",{"id":4030,"publishedAt":4031},"1a7lydXCDm3UakeiWQVPfQ","2026-08-12T12:00:54.383Z",{"items":4033},[4034,4036],{"sys":4035,"name":2144},{"id":2143},{"sys":4037,"name":4039},{"id":4038},"1gZi8NrRy2v9OqPV7C4dwD","Risk management",{"items":4041},[4042,4044,4046,4048,4050,4052,4054,4056,4058,4060,4062,4064,4066,4068,4070,4072,4074,4076,4078,4080,4082,4084],{"sys":4043,"name":279,"slug":280,"tier":31},{"id":276},{"sys":4045,"name":413,"slug":414,"tier":31},{"id":410},{"sys":4047,"name":519,"slug":520,"tier":31},{"id":516},{"sys":4049,"name":297,"slug":298,"tier":31},{"id":294},{"sys":4051,"name":642,"slug":643,"tier":31},{"id":639},{"sys":4053,"name":333,"slug":334,"tier":45},{"id":330},{"sys":4055,"name":502,"slug":503,"tier":45},{"id":499},{"sys":4057,"name":422,"slug":423,"tier":45},{"id":419},{"sys":4059,"name":511,"slug":512,"tier":45},{"id":508},{"sys":4061,"name":466,"slug":467,"tier":45},{"id":463},{"sys":4063,"name":571,"slug":572,"tier":45},{"id":568},{"sys":4065,"name":324,"slug":325,"tier":45},{"id":321},{"sys":4067,"name":261,"slug":262,"tier":45},{"id":258},{"sys":4069,"name":315,"slug":316,"tier":45},{"id":312},{"sys":4071,"name":395,"slug":396,"tier":45},{"id":392},{"sys":4073,"name":589,"slug":590,"tier":45},{"id":586},{"sys":4075,"name":457,"slug":458,"tier":45},{"id":454},{"sys":4077,"name":607,"slug":608,"tier":45},{"id":604},{"sys":4079,"name":475,"slug":476,"tier":45},{"id":472},{"sys":4081,"name":440,"slug":441,"tier":45},{"id":437},{"sys":4083,"name":537,"slug":538,"tier":45},{"id":534},{"sys":4085,"name":528,"slug":529,"tier":45},{"id":525},"-a4IwYePRXthOxupqmWqIxVJil-CjQyZKA0JJTofdUE",{"id":4088,"title":4089,"authorsCollection":4090,"content":4098,"extension":228,"faqItemsCollection":4708,"faqTitle":59,"featured":6,"hashTags":59,"meta":4710,"metaTitle":4711,"ogImage":59,"postType":1539,"publishedDate":1540,"relatedBlogPostsCollection":4712,"slug":6661,"stem":6662,"subtitle":59,"summary":6663,"synopsis":6674,"sys":6675,"tagsCollection":6678,"topicsCollection":6684,"__hash__":6734},"blog/blog/verizon-dbir-2026-review.json","What the Verizon DBIR tells us about how breaches happen in 2026",{"items":4091},[4092],{"fullName":4093,"firstName":4094,"jobTitle":4095,"socialLinks":59,"profilePicture":4096},"Mark Orlando","Mark","Field CTO",{"url":4097},"https://images.ctfassets.net/y1cdw1ablpvd/592PMwIQQFaa24k5SKBEKF/a33090d0ad95d1e3081f5d16a46ba826/image__68_.png",{"json":4099,"links":4630},{"data":4100,"content":4101,"nodeType":1522},{},[4102,4109,4112,4120,4136,4143,4150,4156,4164,4171,4178,4184,4201,4207,4223,4231,4247,4254,4261,4264,4272,4288,4294,4313,4319,4327,4350,4357,4360,4368,4375,4381,4388,4406,4414,4430,4433,4441,4457,4464,4471,4489,4492,4500,4507,4514,4521,4527,4535,4551,4558,4576,4579,4587,4594,4601,4608,4614],{"data":4103,"content":4104,"nodeType":866},{},[4105],{"data":4106,"marks":4107,"value":4108,"nodeType":865},{},[],"The headline finding getting the most airtime in 2026 is that vulnerability exploitation has overtaken credential abuse as the top single initial access vector, jumping to 31% from 20% the year before. The vulnerability management crisis driving this statistic is one of the most important stories in this year's data. But reading it as evidence that identity threats are receding would be a mistake, because the DBIR's own data tells a more complicated and more useful story when you look at the full picture.",{"data":4110,"content":4111,"nodeType":879},{},[],{"data":4113,"content":4114,"nodeType":889},{},[4115],{"data":4116,"marks":4117,"value":4119,"nodeType":865},{},[4118],{"type":887},"Vulnerability exploitation has caught up with identity — not replaced it",{"data":4121,"content":4122,"nodeType":866},{},[4123,4127,4132],{"data":4124,"marks":4125,"value":4126,"nodeType":865},{},[],"The DBIR's headline comparison pits vulnerability exploitation (31%) against credential abuse (13%) as individual vectors. That comparison is accurate but incomplete, because the DBIR tracks identity-related initial access across ",{"data":4128,"marks":4129,"value":4131,"nodeType":865},{},[4130],{"type":887},"three",{"data":4133,"marks":4134,"value":4135,"nodeType":865},{},[]," separate categories: phishing (16%), credential abuse (13%), and pretexting (6%). Before interpreting those numbers, there's a methodological wrinkle worth understanding.",{"data":4137,"content":4138,"nodeType":866},{},[4139],{"data":4140,"marks":4141,"value":4142,"nodeType":865},{},[],"This year's report added pretexting as a newly tracked initial access vector, reclassifying some incidents previously counted as credential abuse. The DBIR is transparent about the effect: without that change, credential abuse would have been 16% rather than 13%. On an apples-to-apples basis, identity-related initial access (phishing 16% + credential abuse 16%) comes to 32% — versus 31% for vulnerability exploitation.",{"data":4144,"content":4145,"nodeType":866},{},[4146],{"data":4147,"marks":4148,"value":4149,"nodeType":865},{},[],"To be precise about what moved: phishing held roughly flat year over year, but credential abuse saw a modest decline even on the adjusted basis (from 22% to 16%). Overall, the identity picture is broadly stable. The reason the two categories have converged is that vulnerability exploitation surged 55%, not that identity attacks meaningfully receded.",{"data":4151,"content":4155,"nodeType":875},{"target":4152},{"sys":4153},{"id":4154,"type":872,"linkType":873},"5GvSsSY4R6X34ZBMidZ54X",[],{"data":4157,"content":4158,"nodeType":2315},{},[4159],{"data":4160,"marks":4161,"value":4163,"nodeType":865},{},[4162],{"type":887},"The taxonomy gap",{"data":4165,"content":4166,"nodeType":866},{},[4167],{"data":4168,"marks":4169,"value":4170,"nodeType":865},{},[],"It's also worth asking how much the DBIR's initial access taxonomy can tell us. The figure that everyone is citing — Figure 10 — is labelled \"select enumerations,\" and the four tracked vectors (vulnerability exploitation, phishing, credential abuse, pretexting) add up to only 66% of initial access. A third of the picture isn't represented in the headline breakdown at all.",{"data":4172,"content":4173,"nodeType":866},{},[4174],{"data":4175,"marks":4176,"value":4177,"nodeType":865},{},[],"The cluster boundaries and where you draw them also changes the story. The DBIR classifies ClickFix under \"baiting\" — a category that covers malicious downloads and SEO poisoning — rather than phishing, even though the end goal is often the same: getting a user to execute something they shouldn't. Pretexting absorbed incidents that were previously credential abuse, shifting the numbers between categories. These are useful analytical clusters, but they aren't clean divisions of a neatly partitioned attack surface.",{"data":4179,"content":4183,"nodeType":875},{"target":4180},{"sys":4181},{"id":4182,"type":872,"linkType":873},"7t6ZcHDycaPOyLstX4r8zl",[],{"data":4185,"content":4186,"nodeType":866},{},[4187,4191,4198],{"data":4188,"marks":4189,"value":4190,"nodeType":865},{},[],"These are identity attacks at scale, and it isn't clear where — or whether — they show up in the DBIR's initial access vectors. This lack of depth in identity and in-browser attack vectors is common in many defensive models, which is why we've created our own ",{"data":4192,"content":4193,"nodeType":905},{"uri":2206},[4194],{"data":4195,"marks":4196,"value":4197,"nodeType":865},{},[],"Browser and Identity Attacks Matrix",{"data":4199,"marks":4200,"value":1193,"nodeType":865},{},[],{"data":4202,"content":4206,"nodeType":875},{"target":4203},{"sys":4204},{"id":4205,"type":872,"linkType":873},"53U3LHhhHFYnEpShdLmDqs",[],{"data":4208,"content":4209,"nodeType":866},{},[4210,4214,4219],{"data":4211,"marks":4212,"value":4213,"nodeType":865},{},[],"That convergence at initial access also understates the role credentials play across full breach chains. The DBIR states plainly that credential abuse at any point in the breach progression — not just as the first action — appears in ",{"data":4215,"marks":4216,"value":4218,"nodeType":865},{},[4217],{"type":887},"39% of all breaches",{"data":4220,"marks":4221,"value":4222,"nodeType":865},{},[],", making it the single most pervasive technique in the dataset. Credentials don't just open the front door; they unlock lateral movement, privilege escalation, and persistence throughout the attack chain.",{"data":4224,"content":4225,"nodeType":2315},{},[4226],{"data":4227,"marks":4228,"value":4230,"nodeType":865},{},[4229],{"type":887},"The vulnerability treadmill",{"data":4232,"content":4233,"nodeType":866},{},[4234,4238,4243],{"data":4235,"marks":4236,"value":4237,"nodeType":865},{},[],"The vulnerability exploitation surge itself is driven by a structural capacity crisis rather than a shift in attacker preference. Edge devices and VPNs now account for 22% of vulnerability-exploitation breaches, up from 3% the prior year — a ",{"data":4239,"marks":4240,"value":4242,"nodeType":865},{},[4241],{"type":2757},"sevenfold",{"data":4244,"marks":4245,"value":4246,"nodeType":865},{},[]," increase. Organizations face 50% more CISA KEV vulnerabilities to remediate than a year ago, median remediation time has increased from 32 to 43 days, and the volume of vulnerability records in the dataset has grown roughly eightfold.",{"data":4248,"content":4249,"nodeType":866},{},[4250],{"data":4251,"marks":4252,"value":4253,"nodeType":865},{},[],"This trend was already visible in last year's DBIR, when vulnerability exploitation jumped from 15% to 20%. AI-assisted exploit development may be compounding the problem — the DBIR's own data shows 32% of AI-assisted initial access targeting vulnerability exploitation — but the structural capacity crisis was accelerating well before AI became a meaningful factor in the attacker toolkit.",{"data":4255,"content":4256,"nodeType":866},{},[4257],{"data":4258,"marks":4259,"value":4260,"nodeType":865},{},[],"The vulnerability treadmill is accelerating, and the DBIR's remediation data shows defenders losing ground. But this is an additive problem, not a substitution. Both attack surfaces are growing. ",{"data":4262,"content":4263,"nodeType":879},{},[],{"data":4265,"content":4266,"nodeType":889},{},[4267],{"data":4268,"marks":4269,"value":4271,"nodeType":865},{},[4270],{"type":887},"Phishing has left the inbox",{"data":4273,"content":4274,"nodeType":866},{},[4275,4279,4284],{"data":4276,"marks":4277,"value":4278,"nodeType":865},{},[],"41% percent of social engineering breaches now involve vectors other than email, with approximately a quarter coming from social media or phone-based channels. Voice phishing simulations show a ",{"data":4280,"marks":4281,"value":4283,"nodeType":865},{},[4282],{"type":887},"40% higher success rate",{"data":4285,"marks":4286,"value":4287,"nodeType":865},{},[]," than email phishing — a median click rate of 2% versus 1.4%.",{"data":4289,"content":4293,"nodeType":875},{"target":4290},{"sys":4291},{"id":4292,"type":872,"linkType":873},"7pK8qqIDDNmHmJmlcybNoe",[],{"data":4295,"content":4296,"nodeType":866},{},[4297,4301,4309],{"data":4298,"marks":4299,"value":4300,"nodeType":865},{},[],"Even within the email channel, the data confirms what ",{"data":4302,"content":4304,"nodeType":905},{"uri":4303},"https://pushsecurity.com/blog/the-top-10-security-problems-you-can-solve-in-the-browser-ranked-by-value/",[4305],{"data":4306,"marks":4307,"value":4308,"nodeType":865},{},[],"browser-level detection data has been showing",{"data":4310,"marks":4311,"value":4312,"nodeType":865},{},[],": credential harvesting dominates. The DBIR's email security gateway breakdown shows 80% of blocked attacks are credential or session phishing, with only 10% involving malware delivery, 5% callback phishing, and 3% BEC. If you're running an email security gateway, the vast majority of what it catches is credential phishing — and 41% of social engineering is arriving through channels it can't see at all.",{"data":4314,"content":4318,"nodeType":875},{"target":4315},{"sys":4316},{"id":4317,"type":872,"linkType":873},"6CvwzQA3gJ8B3RFzLrH7Kp",[],{"data":4320,"content":4321,"nodeType":2315},{},[4322],{"data":4323,"marks":4324,"value":4326,"nodeType":865},{},[4325],{"type":887},"The ClickFix detection gap",{"data":4328,"content":4329,"nodeType":866},{},[4330,4334,4341,4345],{"data":4331,"marks":4332,"value":4333,"nodeType":865},{},[],"The DBIR reports ClickFix at only 2.7% of attacks detected at the browser level. For context, ",{"data":4335,"content":4336,"nodeType":905},{"uri":1356},[4337],{"data":4338,"marks":4339,"value":4340,"nodeType":865},{},[],"CrowdStrike reported a 563% increase in ClickFix lures",{"data":4342,"marks":4343,"value":4344,"nodeType":865},{},[]," over the same period and Microsoft identified it as the most common initial access point at 47% of observed attacks. Push's own data shows ClickFix at a significantly higher proportion of browser-level detections, ",{"data":4346,"marks":4347,"value":4349,"nodeType":865},{},[4348],{"type":887},"with 4 in 5 delivered via search engines specifically.",{"data":4351,"content":4352,"nodeType":866},{},[4353],{"data":4354,"marks":4355,"value":4356,"nodeType":865},{},[],"The gap is striking, and the most likely explanation is a visibility one. ClickFix attacks result in a malware download or script execution on the endpoint — and without browser-layer context, that execution looks like any other malware delivery. If a contributing organization doesn't have visibility into the browser session that preceded the payload, they'd attribute the incident to \"malware download\" or \"user execution\" rather than ClickFix specifically. The DBIR's 2.7% probably reflects how often contributors could trace the chain back to a ClickFix page, not how often ClickFix was actually the delivery mechanism.",{"data":4358,"content":4359,"nodeType":879},{},[],{"data":4361,"content":4362,"nodeType":889},{},[4363],{"data":4364,"marks":4365,"value":4367,"nodeType":865},{},[4366],{"type":887},"Stolen credentials are the ransomware on-ramp",{"data":4369,"content":4370,"nodeType":866},{},[4371],{"data":4372,"marks":4373,"value":4374,"nodeType":865},{},[],"One of the most powerful findings in this year's DBIR is the quantification of the relationship between credential compromise and ransomware outcomes. Fifty percent of ransomware victims had a credential or infostealer event occur within 95 days prior to the ransomware attack, drawing a causal line from credential theft to ransomware deployment.",{"data":4376,"content":4380,"nodeType":875},{"target":4377},{"sys":4378},{"id":4379,"type":872,"linkType":873},"3ZwG5UiweFR4fYiDaxJJDm",[],{"data":4382,"content":4383,"nodeType":866},{},[4384],{"data":4385,"marks":4386,"value":4387,"nodeType":865},{},[],"The infostealer supply chain data reinforces the picture. Infostealers are surfacing an average of 2,362 breached corporate credentials per month from organizational email domains in stealer log datasets, and 54% of devices in Initial Access Broker logs had at least one infostealer installed. The 95-day median window is consistent with the known timeline from credential harvest to ransomware deployment.",{"data":4389,"content":4390,"nodeType":866},{},[4391,4395,4402],{"data":4392,"marks":4393,"value":4394,"nodeType":865},{},[],"That timeline reinforces an argument we've been making about ",{"data":4396,"content":4397,"nodeType":905},{"uri":899},[4398],{"data":4399,"marks":4400,"value":4401,"nodeType":865},{},[],"where the intervention point needs to be",{"data":4403,"marks":4404,"value":4405,"nodeType":865},{},[],": detecting credential compromise upstream — at the point of credential entry, session creation, or stolen credential reuse — rather than waiting for the ransomware deployment that follows weeks or months later.",{"data":4407,"content":4408,"nodeType":2315},{},[4409],{"data":4410,"marks":4411,"value":4413,"nodeType":865},{},[4412],{"type":887},"Post-compromise tradecraft is shifting",{"data":4415,"content":4416,"nodeType":866},{},[4417,4421,4426],{"data":4418,"marks":4419,"value":4420,"nodeType":865},{},[],"The DBIR's post-compromise data adds another dimension. RMM tool abuse by threat actors showed a ",{"data":4422,"marks":4423,"value":4425,"nodeType":865},{},[4424],{"type":887},"240% increase",{"data":4427,"marks":4428,"value":4429,"nodeType":865},{},[]," over the prior year, while traditional backdoor and C2 malware usage fell 27%. Attackers are increasingly living off the land with the same remote access tools IT teams use. Post-compromise detection is getting harder, which makes catching the initial credential compromise upstream that much more valuable.",{"data":4431,"content":4432,"nodeType":879},{},[],{"data":4434,"content":4435,"nodeType":889},{},[4436],{"data":4437,"marks":4438,"value":4440,"nodeType":865},{},[4439],{"type":887},"Your vendors are half the problem",{"data":4442,"content":4443,"nodeType":866},{},[4444,4448,4453],{"data":4445,"marks":4446,"value":4447,"nodeType":865},{},[],"Third-party involvement in breaches reached ",{"data":4449,"marks":4450,"value":4452,"nodeType":865},{},[4451],{"type":887},"48%",{"data":4454,"marks":4455,"value":4456,"nodeType":865},{},[]," this year, up from 30% — a 60% increase that follows a prior year where the figure had already doubled.",{"data":4458,"content":4459,"nodeType":866},{},[4460],{"data":4461,"marks":4462,"value":4463,"nodeType":865},{},[],"The DBIR's root cause analysis maps directly to identity security: insecure authentication — absent MFA, improper credential rotation — and lack of least privilege enforcement account for a substantial share of cloud-based third-party incidents. Only 23% of third-party organizations fully remediated missing or improperly secured MFA on cloud accounts, and weak password and permission misconfigurations took a median of 8 months to resolve 50% of findings.",{"data":4465,"content":4466,"nodeType":866},{},[4467],{"data":4468,"marks":4469,"value":4470,"nodeType":865},{},[],"Eight months. That's the median timeline for third-party vendors to resolve the identity hygiene issues that create the attack surface in their environments — environments that your data lives in.",{"data":4472,"content":4473,"nodeType":866},{},[4474,4478,4485],{"data":4475,"marks":4476,"value":4477,"nodeType":865},{},[],"Extend that posture gap across every vendor and third-party integration, and you start to see why the third-party breach figure keeps climbing. Visibility into ",{"data":4479,"content":4480,"nodeType":905},{"uri":3418},[4481],{"data":4482,"marks":4483,"value":4484,"nodeType":865},{},[],"OAuth consent flows and third-party integration sprawl",{"data":4486,"marks":4487,"value":4488,"nodeType":865},{},[]," is the starting point for getting ahead of a supply chain problem that is structurally getting worse.",{"data":4490,"content":4491,"nodeType":879},{},[],{"data":4493,"content":4494,"nodeType":889},{},[4495],{"data":4496,"marks":4497,"value":4499,"nodeType":865},{},[4498],{"type":887},"AI is scaling known techniques — and creating new blind spots from the inside",{"data":4501,"content":4502,"nodeType":866},{},[4503],{"data":4504,"marks":4505,"value":4506,"nodeType":865},{},[],"The DBIR's AI analysis this year is grounded in a collaboration with Anthropic covering 793 threat actors who received enforcement action for violating acceptable use policy between March 2025 and February 2026. The findings are measured rather than alarmist: in the median case, actors sought AI assistance across about 15 distinct ATT&CK techniques, 44% of AI-assisted initial access was phishing-related, and less than 2.5% of techniques observed were classified as rare.",{"data":4508,"content":4509,"nodeType":866},{},[4510],{"data":4511,"marks":4512,"value":4513,"nodeType":865},{},[],"AI is currently an operational tool for attackers — automating and scaling known techniques rather than unlocking novel ones. Despite heavy AI-assisted focus on phishing, the DBIR's own incident dataset shows phishing as an initial access vector has barely changed year over year — suggesting AI may be uplifting less-experienced attackers to a higher baseline of lure quality without meaningfully increasing success rates against organizations that already have detection in place.",{"data":4515,"content":4516,"nodeType":866},{},[4517],{"data":4518,"marks":4519,"value":4520,"nodeType":865},{},[],"The more concerning number is the 32% of AI-assisted initial access targeting vulnerability exploitation — compounding the patching capacity crisis discussed earlier in a trend that was already accelerating before AI entered the picture.",{"data":4522,"content":4526,"nodeType":875},{"target":4523},{"sys":4524},{"id":4525,"type":872,"linkType":873},"4bFTnVx1SXMQzZSaICCJOn",[],{"data":4528,"content":4529,"nodeType":2315},{},[4530],{"data":4531,"marks":4532,"value":4534,"nodeType":865},{},[4533],{"type":887},"Shadow AI is the bigger problem",{"data":4536,"content":4537,"nodeType":866},{},[4538,4542,4547],{"data":4539,"marks":4540,"value":4541,"nodeType":865},{},[],"The sharper AI risk for most organizations, though, is internal. Forty-five percent of employees are now regular AI users on corporate devices — up from 15%, a threefold increase — and ",{"data":4543,"marks":4544,"value":4546,"nodeType":865},{},[4545],{"type":887},"67% of them use non-corporate accounts",{"data":4548,"marks":4549,"value":4550,"nodeType":865},{},[],". Shadow AI has become the third most common non-malicious insider action in DLP data, a fourfold increase over the prior year, with source code as the leading data type submitted to unauthorized AI platforms by a wide margin.",{"data":4552,"content":4553,"nodeType":866},{},[4554],{"data":4555,"marks":4556,"value":4557,"nodeType":865},{},[],"The browser extension angle is particularly relevant. More than 15% of users had unauthorized AI browser extensions installed, and the DBIR specifically notes that these extensions collect and retain browsing context from internal sites — creating a data exfiltration pathway that operates independently of traditional DLP controls.",{"data":4559,"content":4560,"nodeType":866},{},[4561,4565,4573],{"data":4562,"marks":4563,"value":4564,"nodeType":865},{},[],"This is moving faster than any previous shadow IT wave, and the data loss vector is the browser — where users interact with AI tools, where extensions collect context, and where OAuth consent grants connect AI services to corporate data. Visibility and control at that layer isn't a nice-to-have for AI governance; ",{"data":4566,"content":4568,"nodeType":905},{"uri":4567},"https://pushsecurity.com/blog/browser-extension-management-guide/",[4569],{"data":4570,"marks":4571,"value":4572,"nodeType":865},{},[],"it's the minimum viable starting point",{"data":4574,"marks":4575,"value":1193,"nodeType":865},{},[],{"data":4577,"content":4578,"nodeType":879},{},[],{"data":4580,"content":4581,"nodeType":889},{},[4582],{"data":4583,"marks":4584,"value":4586,"nodeType":865},{},[4585],{"type":887},"What this means for defenders",{"data":4588,"content":4589,"nodeType":866},{},[4590],{"data":4591,"marks":4592,"value":4593,"nodeType":865},{},[],"The DBIR's 2026 data paints a picture of converging pressures rather than shifting priorities. Vulnerability exploitation surged, but identity-related initial access is broadly stable and credential abuse at 39% across full breach chains remains the single most pervasive technique in the dataset. Phishing is arriving through channels that email gateways can't see. The infostealer-to-ransomware pipeline now has longitudinal data behind it. Third-party involvement keeps climbing because vendor identity hygiene takes months to remediate. And shadow AI is creating data exposure pathways that most security stacks weren't designed to see.",{"data":4595,"content":4596,"nodeType":866},{},[4597],{"data":4598,"marks":4599,"value":4600,"nodeType":865},{},[],"The common thread across all of these findings is that the browser — where credentials are entered, sessions are created, OAuth consent is granted, AI tools are accessed, and extensions collect data — is the layer where these risks converge and where defenders need visibility and control if they're going to address them at the point of risk rather than after the fact.",{"data":4602,"content":4603,"nodeType":866},{},[4604],{"data":4605,"marks":4606,"value":4607,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.",{"data":4609,"content":4610,"nodeType":866},{},[4611],{"data":4612,"marks":4613,"value":3677,"nodeType":865},{},[],{"data":4615,"content":4616,"nodeType":866},{},[4617,4620,4627],{"data":4618,"marks":4619,"value":21,"nodeType":865},{},[],{"data":4621,"content":4622,"nodeType":905},{"uri":1512},[4623],{"data":4624,"marks":4625,"value":3691,"nodeType":865},{},[4626],{"type":1070},{"data":4628,"marks":4629,"value":21,"nodeType":865},{},[],{"entries":4631},{"hyperlink":4632,"inline":4633,"block":4634},[],[],[4635,4643,4670,4677,4691,4696,4703],{"sys":4636,"__typename":4637,"title":4638,"caption":4638,"layoutMode":59,"file":4639},{"id":4154},"Image","DBIR Figure 10 (p.15) — Initial access vectors, select enumerations",{"url":4640,"width":4641,"height":4642},"https://images.ctfassets.net/y1cdw1ablpvd/18rPvZ4Sw11UCHE7MxzXkd/17d059302242b4034686b13ee3044c8e/image4.png",1999,1521,{"sys":4644,"__typename":4645,"content":4646,"name":4669,"title":59},{"id":4182},"InsightTextBlockComponent",{"json":4647},{"nodeType":1522,"data":4648,"content":4649},{},[4650],{"nodeType":866,"data":4651,"content":4652},{},[4653,4657,4665],{"nodeType":865,"value":4654,"marks":4655,"data":4656},"Some of the ",[],{},{"nodeType":905,"data":4658,"content":4660},{"uri":4659},"https://pushsecurity.com/blog/analyzing-the-instructure-breach",[4661],{"nodeType":865,"value":4662,"marks":4663,"data":4664},"most consequential identity-based campaigns of the past 12 months",[],{},{"nodeType":865,"value":4666,"marks":4667,"data":4668}," don't map cleanly to any of these categories — the mass Salesforce campaign that compromised over 1,000 organizations via device code phishing, the Anodot breach chain that pivoted through stored OAuth tokens to reach Snowflake customers, ConsentFix abusing Azure CLI's OAuth flow to bypass MFA entirely.",[],{},"DBIR 2026 IB1",{"sys":4671,"__typename":4637,"title":2211,"caption":4672,"layoutMode":59,"file":4673},{"id":4205},"Browser and identity-based techniques have exploded since we first launched our attack matrix",{"url":4674,"width":4675,"height":4676},"https://images.ctfassets.net/y1cdw1ablpvd/L0Yc77y9vzrKVD72BQGX2/4ffe0bf61bd62f025262b8efd74394b7/Browser___Identity_Attacks_Matrix__1_.png",6160,4432,{"sys":4678,"__typename":4645,"content":4679,"name":4690,"title":59},{"id":4292},{"json":4680},{"data":4681,"content":4682,"nodeType":1522},{},[4683],{"data":4684,"content":4685,"nodeType":866},{},[4686],{"data":4687,"marks":4688,"value":4689,"nodeType":865},{},[],"The data is a little confusing. The DBIR draws a line between Phishing (asynchronous — send a message and hope for a click) and Pretexting (synchronous — someone interacting with you in real time). Voice phishing over a phone call is Pretexting in VERIS, not Phishing, even though most practitioners would call it phishing. Browser-based credential harvesting delivered via SEO poisoning or malicious downloads falls under \"Baiting.\" So the 16% phishing figure probably understates the full scope of credential-harvesting social engineering as most defenders would define it.","DBIR IB2",{"sys":4692,"__typename":4637,"title":4693,"caption":4693,"layoutMode":59,"file":4694},{"id":4317},"DBIR Figure 54 (p.49) — Median percentage of email attack types by month",{"url":4695,"width":4641,"height":4642},"https://images.ctfassets.net/y1cdw1ablpvd/4eWtJSz2QhM6QgXXjNuBNs/e6a33a088b7b0fb0dd1649c5d9164b53/image1.png",{"sys":4697,"__typename":4637,"title":4698,"caption":4698,"layoutMode":59,"file":4699},{"id":4379},"DBIR Figure 48 (p.45) — Credential leakage events prior to ransomware",{"url":4700,"width":4701,"height":4702},"https://images.ctfassets.net/y1cdw1ablpvd/26NpMQ31lpHgp5x8FrDumz/f022f1ede66b171dd756d28009a7d4a5/image2.png",1772,776,{"sys":4704,"__typename":4637,"title":4705,"caption":4705,"layoutMode":59,"file":4706},{"id":4525},"DBIR Figure 65 (p.60) — Select data types in DLP events targeting generative AI tools",{"url":4707,"width":4641,"height":4642},"https://images.ctfassets.net/y1cdw1ablpvd/584Txvap6FW9GlFlin9GwB/f5f5488251d9faee7fedc3030d2390b1/image5.png",{"items":4709},[],{},"What the Verizon DBIR tells us about breaches in 2026",{"items":4713},[4714,5306,6139],{"__typename":1544,"sys":4715,"content":4717,"title":5292,"synopsis":5293,"hashTags":59,"publishedDate":5294,"slug":5295,"tagsCollection":5296,"authorsCollection":5302},{"id":4716},"217s8zu5idSdX25TUgbPQ1",{"json":4718},{"data":4719,"content":4720,"nodeType":1522},{},[4721,4739,4746,4753,4759,4762,4770,4786,4793,4799,4806,4889,4896,4901,4908,4914,4917,4925,4937,4944,4956,4959,4967,4983,4990,4997,5000,5008,5015,5031,5037,5053,5060,5067,5074,5090,5097,5100,5108,5115,5131,5138,5141,5149,5165,5172,5192,5204,5207,5215,5231,5238,5245,5252,5259,5262,5269,5275],{"data":4722,"content":4723,"nodeType":866},{},[4724,4727,4735],{"data":4725,"marks":4726,"value":1061,"nodeType":865},{},[],{"data":4728,"content":4730,"nodeType":905},{"uri":4729},"https://research.esg-global.com/reportaction/515202191/Marketing",[4731],{"data":4732,"marks":4733,"value":4734,"nodeType":865},{},[],"Omdia Browser Management and Security report",{"data":4736,"marks":4737,"value":4738,"nodeType":865},{},[],", based on a survey of 400 IT and security professionals across North America fielded in late 2025, is the most comprehensive industry data to date on how organizations are experiencing, prioritizing, and investing in the secure enterprise browser (SEB) market. ",{"data":4740,"content":4741,"nodeType":866},{},[4742],{"data":4743,"marks":4744,"value":4745,"nodeType":865},{},[],"For us at Push, it externally validates what we've known to be true for some time — the browser is where work happens, where attacks land, and where defenders need to be if they want to detect and stop threats before damage is done.",{"data":4747,"content":4748,"nodeType":866},{},[4749],{"data":4750,"marks":4751,"value":4752,"nodeType":865},{},[],"We pulled out seven findings that matter most for security teams evaluating their approach.",{"data":4754,"content":4758,"nodeType":875},{"target":4755},{"sys":4756},{"id":4757,"type":872,"linkType":873},"4aM879egIFYmDvOhzyNI9A",[],{"data":4760,"content":4761,"nodeType":879},{},[],{"data":4763,"content":4764,"nodeType":889},{},[4765],{"data":4766,"marks":4767,"value":4769,"nodeType":865},{},[4768],{"type":887},"1. The attacks driving concern are the ones happening inside the browser session",{"data":4771,"content":4772,"nodeType":866},{},[4773,4777,4782],{"data":4774,"marks":4775,"value":4776,"nodeType":865},{},[],"The threat picture is driving everything else in this report, so it's the right place to start. ",{"data":4778,"marks":4779,"value":4781,"nodeType":865},{},[4780],{"type":887},"49% of organizations suffered a successful browser-based attack in the last 12 months.",{"data":4783,"marks":4784,"value":4785,"nodeType":865},{},[]," Among those affected, browser-originated incidents account for roughly 37% of all security incidents — and 68% say that share has grown over the past two years. ",{"data":4787,"content":4788,"nodeType":866},{},[4789],{"data":4790,"marks":4791,"value":4792,"nodeType":865},{},[],"The browser is not an emerging threat vector. It’s worth noting here that these numbers are also likely lower than the reality, since many are only identified later in the kill chain. Without browser-level telemetry they can be difficult to trace back their source — which in the vast majority of cases, even for malware-driven attacks, is the browser. ",{"data":4794,"content":4798,"nodeType":875},{"target":4795},{"sys":4796},{"id":4797,"type":872,"linkType":873},"6Kcz8oILKVHmhQIo5Du6V",[],{"data":4800,"content":4801,"nodeType":866},{},[4802],{"data":4803,"marks":4804,"value":4805,"nodeType":865},{},[],"What stands out is that every one of the top attack categories plays out inside the browser session itself — not against the browser as a piece of software, but within the sessions where users interact with applications:",{"data":4807,"content":4808,"nodeType":2718},{},[4809,4819,4829,4839,4849,4859,4869,4879],{"data":4810,"content":4811,"nodeType":2654},{},[4812],{"data":4813,"content":4814,"nodeType":866},{},[4815],{"data":4816,"marks":4817,"value":4818,"nodeType":865},{},[],"Phishing (40%)",{"data":4820,"content":4821,"nodeType":2654},{},[4822],{"data":4823,"content":4824,"nodeType":866},{},[4825],{"data":4826,"marks":4827,"value":4828,"nodeType":865},{},[],"Data loss or leakage (38%)",{"data":4830,"content":4831,"nodeType":2654},{},[4832],{"data":4833,"content":4834,"nodeType":866},{},[4835],{"data":4836,"marks":4837,"value":4838,"nodeType":865},{},[],"Malicious browser extensions (34%)",{"data":4840,"content":4841,"nodeType":2654},{},[4842],{"data":4843,"content":4844,"nodeType":866},{},[4845],{"data":4846,"marks":4847,"value":4848,"nodeType":865},{},[],"Vulnerable browser extensions (33%)",{"data":4850,"content":4851,"nodeType":2654},{},[4852],{"data":4853,"content":4854,"nodeType":866},{},[4855],{"data":4856,"marks":4857,"value":4858,"nodeType":865},{},[],"Malicious scripts (31%)",{"data":4860,"content":4861,"nodeType":2654},{},[4862],{"data":4863,"content":4864,"nodeType":866},{},[4865],{"data":4866,"marks":4867,"value":4868,"nodeType":865},{},[],"Credential theft via browser (28%)",{"data":4870,"content":4871,"nodeType":2654},{},[4872],{"data":4873,"content":4874,"nodeType":866},{},[4875],{"data":4876,"marks":4877,"value":4878,"nodeType":865},{},[],"Cookie theft (22%)",{"data":4880,"content":4881,"nodeType":2654},{},[4882],{"data":4883,"content":4884,"nodeType":866},{},[4885],{"data":4886,"marks":4887,"value":4888,"nodeType":865},{},[],"AiTM attacks (17%)",{"data":4890,"content":4891,"nodeType":866},{},[4892],{"data":4893,"marks":4894,"value":4895,"nodeType":865},{},[],"Phishing, credential theft, cookie theft, and AiTM are attacks that target the user's interaction with a web page — the credential entry, the session creation, the token exchange. Malicious and vulnerable extensions are supply chain risks that operate inside the browser's own execution environment. Data loss happens through the browser when employees upload files, paste data into AI tools, or share information with unsanctioned applications. ",{"data":4897,"content":4900,"nodeType":875},{"target":4898},{"sys":4899},{"id":2305,"type":872,"linkType":873},[],{"data":4902,"content":4903,"nodeType":866},{},[4904],{"data":4905,"marks":4906,"value":4907,"nodeType":865},{},[],"None of these are attacks where network-layer traffic inspection, endpoint monitoring, or email scanning provides complete coverage, because the attack surface is the browser session itself.",{"data":4909,"content":4913,"nodeType":875},{"target":4910},{"sys":4911},{"id":4912,"type":872,"linkType":873},"5kI5h4Z31ByD73er7voayF",[],{"data":4915,"content":4916,"nodeType":879},{},[],{"data":4918,"content":4919,"nodeType":889},{},[4920],{"data":4921,"marks":4922,"value":4924,"nodeType":865},{},[4923],{"type":887},"2. Browser security is now a board-level priority",{"data":4926,"content":4927,"nodeType":866},{},[4928,4933],{"data":4929,"marks":4930,"value":4932,"nodeType":865},{},[4931],{"type":887},"88% of respondents rank browser security as at least a top-five security priority",{"data":4934,"marks":4935,"value":4936,"nodeType":865},{},[],", with more than a quarter (26%) calling it their single top priority. For context, this is a survey that covers the full spectrum of security concerns — cloud, supply chain, AI, insider risk — and browser security has risen above most of them.",{"data":4938,"content":4939,"nodeType":866},{},[4940],{"data":4941,"marks":4942,"value":4943,"nodeType":865},{},[],"This is not aspirational interest. The correlation between priority level and investment is sharp: among those who rank browser security as their top priority, 72% have significantly increased their investment due to emerging threats. Among those who rank it in their top five, that figure is 26%. The organizations that care most are spending the most.",{"data":4945,"content":4946,"nodeType":866},{},[4947,4952],{"data":4948,"marks":4949,"value":4951,"nodeType":865},{},[4950],{"type":887},"86% of respondents have increased their browser security investment in response to emerging threats",{"data":4953,"marks":4954,"value":4955,"nodeType":865},{},[],", with 36% saying the increase was significant. When you ask what's driving that spend, the answer is the threat landscape: the attacks cataloged in the previous section are the reason budgets are moving.",{"data":4957,"content":4958,"nodeType":879},{},[],{"data":4960,"content":4961,"nodeType":889},{},[4962],{"data":4963,"marks":4964,"value":4966,"nodeType":865},{},[4965],{"type":887},"3. Real budget is being allocated — and it's growing",{"data":4968,"content":4969,"nodeType":866},{},[4970,4974,4979],{"data":4971,"marks":4972,"value":4973,"nodeType":865},{},[],"Secure enterprise browser solutions already take up ",{"data":4975,"marks":4976,"value":4978,"nodeType":865},{},[4977],{"type":887},"12.6% of the average security budget",{"data":4980,"marks":4981,"value":4982,"nodeType":865},{},[]," — a substantial allocation for a category that didn't exist as a standalone line item a few years ago. And 85% of respondents expect to increase that spend over the next 12–24 months, with a quarter expecting significant increases.",{"data":4984,"content":4985,"nodeType":866},{},[4986],{"data":4987,"marks":4988,"value":4989,"nodeType":865},{},[],"Where the money comes from tells its own story. The most common funding model is a discrete line item within security program budgets (31%) or a dedicated secure browsing budget (30%). When organizations pull from an existing program budget, web security (26%) and endpoint security (21%) are the most common sources — while SASE/SSE accounts for just 9%, despite SASE vendors being the second most popular vendor category. That disconnect between vendor preference and budget origin suggests the SASE-bundled buying motion may be more aspirational than operational.",{"data":4991,"content":4992,"nodeType":866},{},[4993],{"data":4994,"marks":4995,"value":4996,"nodeType":865},{},[],"IT operations leadership is the top stakeholder in 82% of evaluations, with CISO and security leadership at 64% and CIOs at 42%. Day-to-day management sits primarily with IT Ops (77%) and SecOps (50%). This dual stakeholder picture — IT operations driving evaluation, security leadership providing strategic direction — shapes the competitive landscape in ways we'll come back to.",{"data":4998,"content":4999,"nodeType":879},{},[],{"data":5001,"content":5002,"nodeType":889},{},[5003],{"data":5004,"marks":5005,"value":5007,"nodeType":865},{},[5006],{"type":887},"4. AI is accelerating both the threat and the use case",{"data":5009,"content":5010,"nodeType":866},{},[5011],{"data":5012,"marks":5013,"value":5014,"nodeType":865},{},[],"AI shows up in this report from two directions, mirroring how it is reshaping the security landscape itself.",{"data":5016,"content":5017,"nodeType":866},{},[5018,5022,5027],{"data":5019,"marks":5020,"value":5021,"nodeType":865},{},[],"On the threat side, ",{"data":5023,"marks":5024,"value":5026,"nodeType":865},{},[5025],{"type":887},"AI-powered targeted phishing and social engineering is the top emerging concern",{"data":5028,"marks":5029,"value":5030,"nodeType":865},{},[],", cited by 75% of respondents as either very concerning or concerning. Data leakage via unsanctioned AI applications comes second at 71%, followed by deepfake/AI-generated malicious content at 69% and credential harvesting via fake AI or SaaS login pages at 66%. Every one of these threat categories involves the browser — AI-enhanced phishing lands in the browser, AI data leakage happens through browser-based AI tools, and fake AI login pages are browser-based credential harvesting.",{"data":5032,"content":5036,"nodeType":875},{"target":5033},{"sys":5034},{"id":5035,"type":872,"linkType":873},"2ajv2i5wn2GzKuyynQGlvq",[],{"data":5038,"content":5039,"nodeType":866},{},[5040,5044,5049],{"data":5041,"marks":5042,"value":5043,"nodeType":865},{},[],"On the adoption side, the picture is almost universal — and almost universally under-governed. ",{"data":5045,"marks":5046,"value":5048,"nodeType":865},{},[5047],{"type":887},"92% of organizations now allow employees to use public GenAI applications",{"data":5050,"marks":5051,"value":5052,"nodeType":865},{},[],", and virtually every organization has some kind of policy position: 37% have sanctioned one public app (with everything else unsanctioned), 39% have sanctioned multiple public apps (with others unsanctioned), and 23% restrict employees to a corporate instance while the public versions are unsanctioned. ",{"data":5054,"content":5055,"nodeType":866},{},[5056],{"data":5057,"marks":5058,"value":5059,"nodeType":865},{},[],"Even the 8% who don't allow GenAI at all have taken a policy position. Essentially 100% of organizations have a GenAI policy — but for the vast majority, that policy designates a large portion of public AI tool usage as unsanctioned, which raises the immediate question of whether they have the tooling to actually enforce it.",{"data":5061,"content":5062,"nodeType":866},{},[5063],{"data":5064,"marks":5065,"value":5066,"nodeType":865},{},[],"The answer, based on the current tooling landscape, appears to be: not quite. When Omdia asked how organizations currently secure GenAI usage, 58% rely on secure web gateways — tools that see traffic metadata but cannot observe what a user actually does inside a GenAI session — while 57% use secure browsing solutions and 57% use SaaS security solutions. ",{"data":5068,"content":5069,"nodeType":866},{},[5070],{"data":5071,"marks":5072,"value":5073,"nodeType":865},{},[],"An SWG can tell you that a user visited ChatGPT, but it cannot tell you whether they pasted your company's source code into the prompt. That distinction — between knowing where data went and knowing what the user actually did — is the fundamental gap that browser-layer visibility exists to close, and it is exactly the gap that makes GenAI policies unenforceable without browser-layer tooling.",{"data":5075,"content":5076,"nodeType":866},{},[5077,5081,5086],{"data":5078,"marks":5079,"value":5080,"nodeType":865},{},[],"The use case data reflects this. When Omdia asked about the most important use cases for a secure browsing solution, ",{"data":5082,"marks":5083,"value":5085,"nodeType":865},{},[5084],{"type":887},"generative AI application security came in first at 59%",{"data":5087,"marks":5088,"value":5089,"nodeType":865},{},[],", followed by data loss prevention at 51% and general web security enhancement at 42%. The feature priorities tell a consistent story: AI-powered threat detection and response (52%) and advanced GenAI usage controls and monitoring (41%) were the top two capabilities organizations said would be most important in a purchase decision. ",{"data":5091,"content":5092,"nodeType":866},{},[5093],{"data":5094,"marks":5095,"value":5096,"nodeType":865},{},[],"AI is both the top threat concern and the top use case for browser security — and it is a browser problem at both ends, because every LLM interaction, every prompt containing sensitive data, and every AI agent authorization happens inside a browser session.",{"data":5098,"content":5099,"nodeType":879},{},[],{"data":5101,"content":5102,"nodeType":889},{},[5103],{"data":5104,"marks":5105,"value":5107,"nodeType":865},{},[5106],{"type":887},"5. Organizations that have deployed secure enterprise browser solutions are seeing real results",{"data":5109,"content":5110,"nodeType":866},{},[5111],{"data":5112,"marks":5113,"value":5114,"nodeType":865},{},[],"One of the most useful sections in Omdia's report is the benefits data — what organizations that have deployed SEB solutions are actually getting out of them.",{"data":5116,"content":5117,"nodeType":866},{},[5118,5122,5127],{"data":5119,"marks":5120,"value":5121,"nodeType":865},{},[],"The top realized benefit is ",{"data":5123,"marks":5124,"value":5126,"nodeType":865},{},[5125],{"type":887},"improved data security, cited by 58% of respondents",{"data":5128,"marks":5129,"value":5130,"nodeType":865},{},[],", followed by fewer security incidents (49%), better visibility and auditing (47%), improved user experience (44%), and simplified configuration and policy management (41%). The picture that emerges is not just a security story but an operational one: organizations are seeing fewer incidents, better visibility, and simpler management alongside the security outcomes.",{"data":5132,"content":5133,"nodeType":866},{},[5134],{"data":5135,"marks":5136,"value":5137,"nodeType":865},{},[],"The 49% who cite fewer security incidents as a realized benefit is the number that matters most here, because it directly connects SEB deployment to measurable risk reduction. Organizations aren't just buying tools and hoping — they're deploying them and seeing fewer successful attacks as a result.",{"data":5139,"content":5140,"nodeType":879},{},[],{"data":5142,"content":5143,"nodeType":889},{},[5144],{"data":5145,"marks":5146,"value":5148,"nodeType":865},{},[5147],{"type":887},"6. The market wants protection in existing browsers, not migration",{"data":5150,"content":5151,"nodeType":866},{},[5152,5156,5161],{"data":5153,"marks":5154,"value":5155,"nodeType":865},{},[],"When Omdia asked what attributes matter most in a secure enterprise browser solution, ",{"data":5157,"marks":5158,"value":5160,"nodeType":865},{},[5159],{"type":887},"\"ability to use existing browsers\" ranked as the fourth most important attribute at 48%",{"data":5162,"marks":5163,"value":5164,"nodeType":865},{},[]," — behind only integration with other security tools (57%), controls over generative AI application usage (53%), and centralized policy enforcement (52%). ",{"data":5166,"content":5167,"nodeType":866},{},[5168],{"data":5169,"marks":5170,"value":5171,"nodeType":865},{},[],"That 48% figure, combined with 80% of respondents saying they expect to use an SEB solution as an integrated or alongside component rather than a replacement for existing tools, points to a clear market preference: organizations want browser security that works with their existing browser estate, not a migration to a new one.",{"data":5173,"content":5174,"nodeType":866},{},[5175,5179,5188],{"data":5176,"marks":5177,"value":5178,"nodeType":865},{},[],"This is consistent with what we hear from security leaders directly. As ",{"data":5180,"content":5182,"nodeType":905},{"uri":5181},"https://pushsecurity.com/customer-stories",[5183],{"data":5184,"marks":5185,"value":5187,"nodeType":865},{},[5186],{"type":1070},"Josh Lemos put it: ",{"data":5189,"marks":5190,"value":5191,"nodeType":865},{},[],"\"We looked at the full-stack enterprise browser approach, but converging on a single platform was tough. Push gave me the security instrumentation and context I needed without onerous headwinds.\" The deployment model matters because it determines adoption velocity — and a tool that requires browser migration introduces friction that delays time to value.",{"data":5193,"content":5194,"nodeType":866},{},[5195,5199],{"data":5196,"marks":5197,"value":5198,"nodeType":865},{},[],"Push was built around this insight from day one. As the secure enterprise browser extension for security teams, Push turns any browser — managed or unmanaged, including agentic browsers — into a telemetry source and control point the moment it's installed. It has been rolled out to 100,000 users in under an hour during normal office hours with zero downtime. ",{"data":5200,"marks":5201,"value":5203,"nodeType":865},{},[5202],{"type":887},"That is a deployment model that matches what Omdia's respondents are asking for.",{"data":5205,"content":5206,"nodeType":879},{},[],{"data":5208,"content":5209,"nodeType":889},{},[5210],{"data":5211,"marks":5212,"value":5214,"nodeType":865},{},[5213],{"type":887},"7. Dedicated vendors lead over platform plays",{"data":5216,"content":5217,"nodeType":866},{},[5218,5222,5227],{"data":5219,"marks":5220,"value":5221,"nodeType":865},{},[],"When Omdia asked which category of vendor organizations primarily use or expect to use for secure enterprise browsing, ",{"data":5223,"marks":5224,"value":5226,"nodeType":865},{},[5225],{"type":887},"36% chose a dedicated SEB vendor",{"data":5228,"marks":5229,"value":5230,"nodeType":865},{},[]," — the largest single category. SASE/network security vendors came second at 29%, followed by traditional VDI/desktop virtualization vendors at 19% and endpoint platform vendors at 15%.",{"data":5232,"content":5233,"nodeType":866},{},[5234],{"data":5235,"marks":5236,"value":5237,"nodeType":865},{},[],"The dedicated category leads, and the reason isn't just first-mover advantage — it's architectural. The alternative paths each come with structural constraints. SASE and SSE platforms are network-centric: they see traffic metadata and enforce URL categorization, but they can't observe the rendered page inside a browser tab — the DOM structure, the script behavior, the credential entry that distinguishes a legitimate login from an AiTM reverse-proxy kit. ",{"data":5239,"content":5240,"nodeType":866},{},[5241],{"data":5242,"marks":5243,"value":5244,"nodeType":865},{},[],"Endpoint platforms that bolt on browser visibility are still anchored to the OS layer, solving for browser exploit prevention rather than in-session behavioral detection of the attacks that actually dominate — phishing, credential theft, session hijacking, extension compromise. And when large platform vendors acquire browser security capabilities, the integration work takes years rather than months, during which detection depth sits in a transitional state. ",{"data":5246,"content":5247,"nodeType":866},{},[5248],{"data":5249,"marks":5250,"value":5251,"nodeType":865},{},[],"Dedicated browser-native vendors start from a different premise entirely: the browser isn't a supplementary signal feeding into someone else's SASE pipeline or XDR correlation engine — it is the telemetry source and the control point. The browser is the only place where you get simultaneous visibility into both the attacker's technique and the employee's action within the same session, because the phishing page, the credential submission, the token exchange, and the data exfiltration all happen inside the same tab. No network appliance, endpoint agent, or identity provider log can see all of that, because none of them are present where the interaction occurs.",{"data":5253,"content":5254,"nodeType":866},{},[5255],{"data":5256,"marks":5257,"value":5258,"nodeType":865},{},[],"For security teams evaluating SEB solutions, the architecture matters more than the vendor category label. The capabilities Omdia's respondents ranked highest — integration with existing tools, GenAI controls, centralized policy enforcement, and the ability to use existing browsers — all point toward solutions that deliver detection depth through a lightweight deployment model, without browser migration and without the integration debt of a platform acquisition.",{"data":5260,"content":5261,"nodeType":879},{},[],{"data":5263,"content":5264,"nodeType":866},{},[5265],{"data":5266,"marks":5267,"value":5268,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. ",{"data":5270,"content":5271,"nodeType":866},{},[5272],{"data":5273,"marks":5274,"value":3677,"nodeType":865},{},[],{"data":5276,"content":5277,"nodeType":866},{},[5278,5281,5289],{"data":5279,"marks":5280,"value":21,"nodeType":865},{},[],{"data":5282,"content":5283,"nodeType":905},{"uri":1512},[5284],{"data":5285,"marks":5286,"value":5288,"nodeType":865},{},[5287],{"type":1070},"Book a live demo",{"data":5290,"marks":5291,"value":2997,"nodeType":865},{},[],"7 things Omdia's latest report tells us about the secure enterprise browser market","Unpacking the latest research report from Omdia and what it means for the secure enterprise browser market.","2026-05-13T00:00:00.000Z","7-things-omdias-latest-report-tells-us-about-the-secure-enterprise-browser-market",{"items":5297},[5298,5300],{"sys":5299,"name":297},{"id":2147},{"sys":5301,"name":4039},{"id":4038},{"items":5303},[5304],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":5305},{"url":3016},{"__typename":1544,"sys":5307,"content":5308,"title":3990,"synopsis":3991,"hashTags":59,"publishedDate":3000,"slug":3992,"tagsCollection":6129,"authorsCollection":6135},{"id":3019},{"json":5309},{"data":5310,"content":5311,"nodeType":1522},{},[5312,5334,5358,5391,5424,5429,5439,5442,5449,5491,5497,5516,5521,5524,5531,5555,5561,5568,5573,5576,5583,5589,5604,5610,5643,5649,5652,5659,5674,5716,5719,5726,5741,5756,5763,5769,5779,5789,5799,5809,5824,5831,5837,5840,5846,5852,5867,5870,5877,5892,6123],{"data":5313,"content":5314,"nodeType":866},{},[5315,5318,5324,5327,5331],{"data":5316,"marks":5317,"value":3030,"nodeType":865},{},[],{"data":5319,"content":5320,"nodeType":905},{"uri":2644},[5321],{"data":5322,"marks":5323,"value":2649,"nodeType":865},{},[],{"data":5325,"marks":5326,"value":3040,"nodeType":865},{},[],{"data":5328,"marks":5329,"value":3045,"nodeType":865},{},[5330],{"type":887},{"data":5332,"marks":5333,"value":3049,"nodeType":865},{},[],{"data":5335,"content":5336,"nodeType":866},{},[5337,5340,5346,5349,5355],{"data":5338,"marks":5339,"value":3056,"nodeType":865},{},[],{"data":5341,"content":5342,"nodeType":905},{"uri":3059},[5343],{"data":5344,"marks":5345,"value":3064,"nodeType":865},{},[],{"data":5347,"marks":5348,"value":3068,"nodeType":865},{},[],{"data":5350,"content":5351,"nodeType":905},{"uri":3071},[5352],{"data":5353,"marks":5354,"value":3076,"nodeType":865},{},[],{"data":5356,"marks":5357,"value":3080,"nodeType":865},{},[],{"data":5359,"content":5360,"nodeType":866},{},[5361,5364,5370,5373,5379,5382,5388],{"data":5362,"marks":5363,"value":3087,"nodeType":865},{},[],{"data":5365,"content":5366,"nodeType":905},{"uri":3090},[5367],{"data":5368,"marks":5369,"value":3095,"nodeType":865},{},[],{"data":5371,"marks":5372,"value":3099,"nodeType":865},{},[],{"data":5374,"content":5375,"nodeType":905},{"uri":3102},[5376],{"data":5377,"marks":5378,"value":3107,"nodeType":865},{},[],{"data":5380,"marks":5381,"value":3111,"nodeType":865},{},[],{"data":5383,"content":5384,"nodeType":905},{"uri":3114},[5385],{"data":5386,"marks":5387,"value":3119,"nodeType":865},{},[],{"data":5389,"marks":5390,"value":3123,"nodeType":865},{},[],{"data":5392,"content":5393,"nodeType":866},{},[5394,5397,5403,5406,5412,5415,5421],{"data":5395,"marks":5396,"value":3130,"nodeType":865},{},[],{"data":5398,"content":5399,"nodeType":905},{"uri":3133},[5400],{"data":5401,"marks":5402,"value":3138,"nodeType":865},{},[],{"data":5404,"marks":5405,"value":3142,"nodeType":865},{},[],{"data":5407,"content":5408,"nodeType":905},{"uri":3145},[5409],{"data":5410,"marks":5411,"value":3150,"nodeType":865},{},[],{"data":5413,"marks":5414,"value":3154,"nodeType":865},{},[],{"data":5416,"content":5417,"nodeType":905},{"uri":3157},[5418],{"data":5419,"marks":5420,"value":3162,"nodeType":865},{},[],{"data":5422,"marks":5423,"value":3166,"nodeType":865},{},[],{"data":5425,"content":5428,"nodeType":875},{"target":5426},{"sys":5427},{"id":3171,"type":872,"linkType":873},[],{"data":5430,"content":5431,"nodeType":866},{},[5432,5436],{"data":5433,"marks":5434,"value":3180,"nodeType":865},{},[5435],{"type":887},{"data":5437,"marks":5438,"value":3184,"nodeType":865},{},[],{"data":5440,"content":5441,"nodeType":879},{},[],{"data":5443,"content":5444,"nodeType":889},{},[5445],{"data":5446,"marks":5447,"value":3195,"nodeType":865},{},[5448],{"type":887},{"data":5450,"content":5451,"nodeType":866},{},[5452,5455,5461,5464,5470,5473,5479,5482,5488],{"data":5453,"marks":5454,"value":3202,"nodeType":865},{},[],{"data":5456,"content":5457,"nodeType":905},{"uri":3205},[5458],{"data":5459,"marks":5460,"value":3210,"nodeType":865},{},[],{"data":5462,"marks":5463,"value":1675,"nodeType":865},{},[],{"data":5465,"content":5466,"nodeType":905},{"uri":3216},[5467],{"data":5468,"marks":5469,"value":3221,"nodeType":865},{},[],{"data":5471,"marks":5472,"value":2095,"nodeType":865},{},[],{"data":5474,"content":5475,"nodeType":905},{"uri":3102},[5476],{"data":5477,"marks":5478,"value":3231,"nodeType":865},{},[],{"data":5480,"marks":5481,"value":3235,"nodeType":865},{},[],{"data":5483,"content":5484,"nodeType":905},{"uri":1078},[5485],{"data":5486,"marks":5487,"value":3242,"nodeType":865},{},[],{"data":5489,"marks":5490,"value":1193,"nodeType":865},{},[],{"data":5492,"content":5493,"nodeType":866},{},[5494],{"data":5495,"marks":5496,"value":3252,"nodeType":865},{},[],{"data":5498,"content":5499,"nodeType":866},{},[5500,5503,5509,5512],{"data":5501,"marks":5502,"value":3259,"nodeType":865},{},[],{"data":5504,"content":5505,"nodeType":905},{"uri":1078},[5506],{"data":5507,"marks":5508,"value":3266,"nodeType":865},{},[],{"data":5510,"marks":5511,"value":3270,"nodeType":865},{},[],{"data":5513,"marks":5514,"value":3275,"nodeType":865},{},[5515],{"type":887},{"data":5517,"content":5520,"nodeType":875},{"target":5518},{"sys":5519},{"id":3280,"type":872,"linkType":873},[],{"data":5522,"content":5523,"nodeType":879},{},[],{"data":5525,"content":5526,"nodeType":889},{},[5527],{"data":5528,"marks":5529,"value":3292,"nodeType":865},{},[5530],{"type":887},{"data":5532,"content":5533,"nodeType":866},{},[5534,5537,5543,5546,5552],{"data":5535,"marks":5536,"value":1061,"nodeType":865},{},[],{"data":5538,"content":5539,"nodeType":905},{"uri":2667},[5540],{"data":5541,"marks":5542,"value":3305,"nodeType":865},{},[],{"data":5544,"marks":5545,"value":3309,"nodeType":865},{},[],{"data":5547,"content":5548,"nodeType":905},{"uri":3114},[5549],{"data":5550,"marks":5551,"value":3316,"nodeType":865},{},[],{"data":5553,"marks":5554,"value":3320,"nodeType":865},{},[],{"data":5556,"content":5557,"nodeType":866},{},[5558],{"data":5559,"marks":5560,"value":3327,"nodeType":865},{},[],{"data":5562,"content":5563,"nodeType":866},{},[5564],{"data":5565,"marks":5566,"value":3335,"nodeType":865},{},[5567],{"type":887},{"data":5569,"content":5572,"nodeType":875},{"target":5570},{"sys":5571},{"id":3340,"type":872,"linkType":873},[],{"data":5574,"content":5575,"nodeType":879},{},[],{"data":5577,"content":5578,"nodeType":889},{},[5579],{"data":5580,"marks":5581,"value":3352,"nodeType":865},{},[5582],{"type":887},{"data":5584,"content":5585,"nodeType":866},{},[5586],{"data":5587,"marks":5588,"value":3359,"nodeType":865},{},[],{"data":5590,"content":5591,"nodeType":866},{},[5592,5595,5601],{"data":5593,"marks":5594,"value":1061,"nodeType":865},{},[],{"data":5596,"content":5597,"nodeType":905},{"uri":3368},[5598],{"data":5599,"marks":5600,"value":3373,"nodeType":865},{},[],{"data":5602,"marks":5603,"value":3377,"nodeType":865},{},[],{"data":5605,"content":5606,"nodeType":866},{},[5607],{"data":5608,"marks":5609,"value":3384,"nodeType":865},{},[],{"data":5611,"content":5612,"nodeType":866},{},[5613,5616,5622,5625,5631,5634,5640],{"data":5614,"marks":5615,"value":3391,"nodeType":865},{},[],{"data":5617,"content":5618,"nodeType":905},{"uri":3394},[5619],{"data":5620,"marks":5621,"value":3399,"nodeType":865},{},[],{"data":5623,"marks":5624,"value":3403,"nodeType":865},{},[],{"data":5626,"content":5627,"nodeType":905},{"uri":3406},[5628],{"data":5629,"marks":5630,"value":3411,"nodeType":865},{},[],{"data":5632,"marks":5633,"value":3415,"nodeType":865},{},[],{"data":5635,"content":5636,"nodeType":905},{"uri":3418},[5637],{"data":5638,"marks":5639,"value":3423,"nodeType":865},{},[],{"data":5641,"marks":5642,"value":3427,"nodeType":865},{},[],{"data":5644,"content":5645,"nodeType":866},{},[5646],{"data":5647,"marks":5648,"value":3434,"nodeType":865},{},[],{"data":5650,"content":5651,"nodeType":879},{},[],{"data":5653,"content":5654,"nodeType":889},{},[5655],{"data":5656,"marks":5657,"value":3445,"nodeType":865},{},[5658],{"type":887},{"data":5660,"content":5661,"nodeType":866},{},[5662,5665,5671],{"data":5663,"marks":5664,"value":3452,"nodeType":865},{},[],{"data":5666,"content":5667,"nodeType":905},{"uri":3455},[5668],{"data":5669,"marks":5670,"value":3460,"nodeType":865},{},[],{"data":5672,"marks":5673,"value":3464,"nodeType":865},{},[],{"data":5675,"content":5676,"nodeType":866},{},[5677,5680,5686,5689,5695,5698,5704,5707,5713],{"data":5678,"marks":5679,"value":3471,"nodeType":865},{},[],{"data":5681,"content":5682,"nodeType":905},{"uri":3474},[5683],{"data":5684,"marks":5685,"value":3479,"nodeType":865},{},[],{"data":5687,"marks":5688,"value":3483,"nodeType":865},{},[],{"data":5690,"content":5691,"nodeType":905},{"uri":3486},[5692],{"data":5693,"marks":5694,"value":3491,"nodeType":865},{},[],{"data":5696,"marks":5697,"value":3495,"nodeType":865},{},[],{"data":5699,"content":5700,"nodeType":905},{"uri":3498},[5701],{"data":5702,"marks":5703,"value":3503,"nodeType":865},{},[],{"data":5705,"marks":5706,"value":3507,"nodeType":865},{},[],{"data":5708,"content":5709,"nodeType":905},{"uri":3510},[5710],{"data":5711,"marks":5712,"value":3515,"nodeType":865},{},[],{"data":5714,"marks":5715,"value":3519,"nodeType":865},{},[],{"data":5717,"content":5718,"nodeType":879},{},[],{"data":5720,"content":5721,"nodeType":889},{},[5722],{"data":5723,"marks":5724,"value":3530,"nodeType":865},{},[5725],{"type":887},{"data":5727,"content":5728,"nodeType":866},{},[5729,5732,5738],{"data":5730,"marks":5731,"value":3537,"nodeType":865},{},[],{"data":5733,"content":5734,"nodeType":905},{"uri":1319},[5735],{"data":5736,"marks":5737,"value":3544,"nodeType":865},{},[],{"data":5739,"marks":5740,"value":3548,"nodeType":865},{},[],{"data":5742,"content":5743,"nodeType":866},{},[5744,5747,5753],{"data":5745,"marks":5746,"value":3555,"nodeType":865},{},[],{"data":5748,"content":5749,"nodeType":905},{"uri":3558},[5750],{"data":5751,"marks":5752,"value":315,"nodeType":865},{},[],{"data":5754,"marks":5755,"value":3566,"nodeType":865},{},[],{"data":5757,"content":5758,"nodeType":2315},{},[5759],{"data":5760,"marks":5761,"value":3574,"nodeType":865},{},[5762],{"type":887},{"data":5764,"content":5765,"nodeType":866},{},[5766],{"data":5767,"marks":5768,"value":3581,"nodeType":865},{},[],{"data":5770,"content":5771,"nodeType":866},{},[5772,5776],{"data":5773,"marks":5774,"value":3589,"nodeType":865},{},[5775],{"type":887},{"data":5777,"marks":5778,"value":3593,"nodeType":865},{},[],{"data":5780,"content":5781,"nodeType":866},{},[5782,5786],{"data":5783,"marks":5784,"value":3601,"nodeType":865},{},[5785],{"type":887},{"data":5787,"marks":5788,"value":3605,"nodeType":865},{},[],{"data":5790,"content":5791,"nodeType":866},{},[5792,5796],{"data":5793,"marks":5794,"value":3613,"nodeType":865},{},[5795],{"type":887},{"data":5797,"marks":5798,"value":3617,"nodeType":865},{},[],{"data":5800,"content":5801,"nodeType":866},{},[5802,5806],{"data":5803,"marks":5804,"value":3625,"nodeType":865},{},[5805],{"type":887},{"data":5807,"marks":5808,"value":3629,"nodeType":865},{},[],{"data":5810,"content":5811,"nodeType":866},{},[5812,5815,5821],{"data":5813,"marks":5814,"value":21,"nodeType":865},{},[],{"data":5816,"content":5817,"nodeType":905},{"uri":1307},[5818],{"data":5819,"marks":5820,"value":3642,"nodeType":865},{},[],{"data":5822,"marks":5823,"value":21,"nodeType":865},{},[],{"data":5825,"content":5826,"nodeType":2315},{},[5827],{"data":5828,"marks":5829,"value":3653,"nodeType":865},{},[5830],{"type":887},{"data":5832,"content":5833,"nodeType":866},{},[5834],{"data":5835,"marks":5836,"value":3660,"nodeType":865},{},[],{"data":5838,"content":5839,"nodeType":879},{},[],{"data":5841,"content":5842,"nodeType":866},{},[5843],{"data":5844,"marks":5845,"value":3670,"nodeType":865},{},[],{"data":5847,"content":5848,"nodeType":866},{},[5849],{"data":5850,"marks":5851,"value":3677,"nodeType":865},{},[],{"data":5853,"content":5854,"nodeType":866},{},[5855,5858,5864],{"data":5856,"marks":5857,"value":21,"nodeType":865},{},[],{"data":5859,"content":5860,"nodeType":905},{"uri":3686},[5861],{"data":5862,"marks":5863,"value":3691,"nodeType":865},{},[],{"data":5865,"marks":5866,"value":21,"nodeType":865},{},[],{"data":5868,"content":5869,"nodeType":879},{},[],{"data":5871,"content":5872,"nodeType":889},{},[5873],{"data":5874,"marks":5875,"value":3705,"nodeType":865},{},[5876],{"type":887},{"data":5878,"content":5879,"nodeType":866},{},[5880,5883,5889],{"data":5881,"marks":5882,"value":3712,"nodeType":865},{},[],{"data":5884,"content":5885,"nodeType":905},{"uri":2644},[5886],{"data":5887,"marks":5888,"value":3719,"nodeType":865},{},[],{"data":5890,"marks":5891,"value":3723,"nodeType":865},{},[],{"data":5893,"content":5894,"nodeType":3983},{},[5895,5938,5994,6037,6080],{"data":5896,"content":5897,"nodeType":3775},{},[5898,5908,5918,5928],{"data":5899,"content":5900,"nodeType":3741},{},[5901],{"data":5902,"content":5903,"nodeType":866},{},[5904],{"data":5905,"marks":5906,"value":3740,"nodeType":865},{},[5907],{"type":887},{"data":5909,"content":5910,"nodeType":3741},{},[5911],{"data":5912,"content":5913,"nodeType":866},{},[5914],{"data":5915,"marks":5916,"value":3752,"nodeType":865},{},[5917],{"type":887},{"data":5919,"content":5920,"nodeType":3741},{},[5921],{"data":5922,"content":5923,"nodeType":866},{},[5924],{"data":5925,"marks":5926,"value":3763,"nodeType":865},{},[5927],{"type":887},{"data":5929,"content":5930,"nodeType":3741},{},[5931],{"data":5932,"content":5933,"nodeType":866},{},[5934],{"data":5935,"marks":5936,"value":3774,"nodeType":865},{},[5937],{"type":887},{"data":5939,"content":5940,"nodeType":3775},{},[5941,5961,5970,5979],{"data":5942,"content":5943,"nodeType":3741},{},[5944],{"data":5945,"content":5946,"nodeType":866},{},[5947,5951,5954,5958],{"data":5948,"marks":5949,"value":3789,"nodeType":865},{},[5950],{"type":887},{"data":5952,"marks":5953,"value":3793,"nodeType":865},{},[],{"data":5955,"marks":5956,"value":3798,"nodeType":865},{},[5957],{"type":887},{"data":5959,"marks":5960,"value":3802,"nodeType":865},{},[],{"data":5962,"content":5963,"nodeType":3741},{},[5964],{"data":5965,"content":5966,"nodeType":866},{},[5967],{"data":5968,"marks":5969,"value":3812,"nodeType":865},{},[],{"data":5971,"content":5972,"nodeType":3741},{},[5973],{"data":5974,"content":5975,"nodeType":866},{},[5976],{"data":5977,"marks":5978,"value":3822,"nodeType":865},{},[],{"data":5980,"content":5981,"nodeType":3741},{},[5982,5988],{"data":5983,"content":5984,"nodeType":866},{},[5985],{"data":5986,"marks":5987,"value":3832,"nodeType":865},{},[],{"data":5989,"content":5990,"nodeType":866},{},[5991],{"data":5992,"marks":5993,"value":3839,"nodeType":865},{},[],{"data":5995,"content":5996,"nodeType":3775},{},[5997,6010,6019,6028],{"data":5998,"content":5999,"nodeType":3741},{},[6000],{"data":6001,"content":6002,"nodeType":866},{},[6003,6007],{"data":6004,"marks":6005,"value":3853,"nodeType":865},{},[6006],{"type":887},{"data":6008,"marks":6009,"value":3857,"nodeType":865},{},[],{"data":6011,"content":6012,"nodeType":3741},{},[6013],{"data":6014,"content":6015,"nodeType":866},{},[6016],{"data":6017,"marks":6018,"value":3867,"nodeType":865},{},[],{"data":6020,"content":6021,"nodeType":3741},{},[6022],{"data":6023,"content":6024,"nodeType":866},{},[6025],{"data":6026,"marks":6027,"value":3877,"nodeType":865},{},[],{"data":6029,"content":6030,"nodeType":3741},{},[6031],{"data":6032,"content":6033,"nodeType":866},{},[6034],{"data":6035,"marks":6036,"value":3887,"nodeType":865},{},[],{"data":6038,"content":6039,"nodeType":3775},{},[6040,6053,6062,6071],{"data":6041,"content":6042,"nodeType":3741},{},[6043],{"data":6044,"content":6045,"nodeType":866},{},[6046,6050],{"data":6047,"marks":6048,"value":3901,"nodeType":865},{},[6049],{"type":887},{"data":6051,"marks":6052,"value":3905,"nodeType":865},{},[],{"data":6054,"content":6055,"nodeType":3741},{},[6056],{"data":6057,"content":6058,"nodeType":866},{},[6059],{"data":6060,"marks":6061,"value":3915,"nodeType":865},{},[],{"data":6063,"content":6064,"nodeType":3741},{},[6065],{"data":6066,"content":6067,"nodeType":866},{},[6068],{"data":6069,"marks":6070,"value":3925,"nodeType":865},{},[],{"data":6072,"content":6073,"nodeType":3741},{},[6074],{"data":6075,"content":6076,"nodeType":866},{},[6077],{"data":6078,"marks":6079,"value":3935,"nodeType":865},{},[],{"data":6081,"content":6082,"nodeType":3775},{},[6083,6096,6105,6114],{"data":6084,"content":6085,"nodeType":3741},{},[6086],{"data":6087,"content":6088,"nodeType":866},{},[6089,6093],{"data":6090,"marks":6091,"value":3949,"nodeType":865},{},[6092],{"type":887},{"data":6094,"marks":6095,"value":3953,"nodeType":865},{},[],{"data":6097,"content":6098,"nodeType":3741},{},[6099],{"data":6100,"content":6101,"nodeType":866},{},[6102],{"data":6103,"marks":6104,"value":3812,"nodeType":865},{},[],{"data":6106,"content":6107,"nodeType":3741},{},[6108],{"data":6109,"content":6110,"nodeType":866},{},[6111],{"data":6112,"marks":6113,"value":3972,"nodeType":865},{},[],{"data":6115,"content":6116,"nodeType":3741},{},[6117],{"data":6118,"content":6119,"nodeType":866},{},[6120],{"data":6121,"marks":6122,"value":3982,"nodeType":865},{},[],{"data":6124,"content":6125,"nodeType":866},{},[6126],{"data":6127,"marks":6128,"value":21,"nodeType":865},{},[],{"items":6130},[6131,6133],{"sys":6132,"name":2144},{"id":2143},{"sys":6134,"name":342},{"id":3008},{"items":6136},[6137],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":6138},{"url":3016},{"__typename":1544,"sys":6140,"content":6142,"title":6647,"synopsis":6648,"hashTags":59,"publishedDate":6649,"slug":6650,"tagsCollection":6651,"authorsCollection":6657},{"id":6141},"2MWicW07sNEBp59wxYtAiC",{"json":6143},{"data":6144,"content":6145,"nodeType":1522},{},[6146,6154,6185,6191,6198,6217,6232,6235,6243,6258,6277,6302,6308,6324,6353,6359,6365,6381,6384,6392,6399,6407,6425,6441,6448,6473,6480,6488,6517,6524,6532,6539,6545,6548,6556,6563,6571,6577,6580,6588,6595,6602,6609,6621,6624,6630],{"data":6147,"content":6148,"nodeType":889},{},[6149],{"data":6150,"marks":6151,"value":6153,"nodeType":865},{},[6152],{"type":887},"The quantification problem nobody talks about",{"data":6155,"content":6156,"nodeType":866},{},[6157,6161,6169,6173,6181],{"data":6158,"marks":6159,"value":6160,"nodeType":865},{},[],"I was recently teaching ",{"data":6162,"content":6164,"nodeType":905},{"uri":6163},"https://www.sans.org/cyber-security-courses/cybersecurity-leaders/",[6165],{"data":6166,"marks":6167,"value":6168,"nodeType":865},{},[],"SANS LDR551",{"data":6170,"marks":6171,"value":6172,"nodeType":865},{},[],", where we cover some of the flawed approaches used in risk measurement and prioritization — for example, presenting ordinal data in a risk matrix as ratio data, implying that the matrix represents quantitative analysis when it’s more of a best guess. We then look at modeling using ",{"data":6174,"content":6176,"nodeType":905},{"uri":6175},"https://en.wikipedia.org/wiki/Loss_exceedance_curve",[6177],{"data":6178,"marks":6179,"value":6180,"nodeType":865},{},[],"Loss Exceedance Curves",{"data":6182,"marks":6183,"value":6184,"nodeType":865},{},[]," as a more accurate, if much more difficult, approach to quantitative risk assessment.",{"data":6186,"content":6190,"nodeType":875},{"target":6187},{"sys":6188},{"id":6189,"type":872,"linkType":873},"4S1wJUm6E1qvyZzwrl2DL",[],{"data":6192,"content":6193,"nodeType":866},{},[6194],{"data":6195,"marks":6196,"value":6197,"nodeType":865},{},[],"The only problem is, we rarely have the time or the data to construct such models. Ask a CISO how they measure risk for credential compromise and other account takeover attacks, and the answer will probably include one or more of the following: a risk assessment, a whiteboard, and a room full of smart people making educated guesses about attack frequency and control strength. ",{"data":6199,"content":6200,"nodeType":866},{},[6201,6205,6213],{"data":6202,"marks":6203,"value":6204,"nodeType":865},{},[],"That isn't a criticism — for most risk scenarios, expert elicitation is the best (and most convenient) available method. Breach cost data is sparse, threat actor behavior is unpredictable, and internal incident history is (ideally!) a limited sample. Quantitative risk frameworks like ",{"data":6206,"content":6208,"nodeType":905},{"uri":6207},"https://www.fairinstitute.org/",[6209],{"data":6210,"marks":6211,"value":6212,"nodeType":865},{},[],"FAIR",{"data":6214,"marks":6215,"value":6216,"nodeType":865},{},[]," give structure to that uncertainty, but they can't conjure data that just doesn't exist.",{"data":6218,"content":6219,"nodeType":866},{},[6220,6224,6229],{"data":6221,"marks":6222,"value":6223,"nodeType":865},{},[],"The results are usually estimates with wide confidence intervals and loss distributions that appear precise, but are hard to defend to a CFO or a board. Finance leaders have seen Monte Carlo simulations before; the capable ones will challenge the quality of the outputs if they doubt the quality of the inputs. ",{"data":6225,"marks":6226,"value":6228,"nodeType":865},{},[6227],{"type":887},"But with the right telemetry, we can get both",{"data":6230,"marks":6231,"value":1193,"nodeType":865},{},[],{"data":6233,"content":6234,"nodeType":879},{},[],{"data":6236,"content":6237,"nodeType":889},{},[6238],{"data":6239,"marks":6240,"value":6242,"nodeType":865},{},[6241],{"type":887},"Why the identity attack surface is uniquely measurable",{"data":6244,"content":6245,"nodeType":866},{},[6246,6250,6255],{"data":6247,"marks":6248,"value":6249,"nodeType":865},{},[],"We've written extensively about the shift to identity as a primary attack vector — and the evidence continues to stack up. Credential phishing, device code phishing, ClickFix, adversary-in-the-middle attacks, session hijacking, and SaaS account compromise now account for the majority of breach entry points in most enterprise environments. But the silver lining here is that this shift has created something valuable for risk quantification: ",{"data":6251,"marks":6252,"value":6254,"nodeType":865},{},[6253],{"type":2757},"a highly observable threat surface",{"data":6256,"marks":6257,"value":1193,"nodeType":865},{},[],{"data":6259,"content":6260,"nodeType":866},{},[6261,6265,6273],{"data":6262,"marks":6263,"value":6264,"nodeType":865},{},[],"Identity attacks execute ",{"data":6266,"content":6267,"nodeType":905},{"uri":1013},[6268],{"data":6269,"marks":6270,"value":6272,"nodeType":865},{},[6271],{"type":1070},"in the browser",{"data":6274,"marks":6275,"value":6276,"nodeType":865},{},[],". They leave traces in authentication flows, login behaviors, OAuth integrations, extension activity, and SaaS access patterns — all of which are captured in real time by the Push extension. Unlike network or endpoint attacks, where the signal is often binary and retroactive, browser-based identity threats generate continuous, high-frequency telemetry that maps directly onto the inputs that drive quantitative risk models.",{"data":6278,"content":6279,"nodeType":866},{},[6280,6284,6289,6293,6298],{"data":6281,"marks":6282,"value":6283,"nodeType":865},{},[],"This telemetry directly informs the hardest inputs in any quantitative risk model. One is ",{"data":6285,"marks":6286,"value":6288,"nodeType":865},{},[6287],{"type":887},"Threat Event Frequency (TEF)",{"data":6290,"marks":6291,"value":6292,"nodeType":865},{},[],": how often a threat agent acts against an asset in a given period. For identity risks, this can be answered in how many credential phishing attempts reached your users across all delivery channels (social media, email, malvertising, etc.), or how frequently your users authorize malicious or compromised SaaS apps. Browser-level telemetry can answer these questions with ",{"data":6294,"marks":6295,"value":6297,"nodeType":865},{},[6296],{"type":2757},"observed",{"data":6299,"marks":6300,"value":6301,"nodeType":865},{},[]," data rather than industry lookups and general benchmarks. ",{"data":6303,"content":6307,"nodeType":875},{"target":6304},{"sys":6305},{"id":6306,"type":872,"linkType":873},"EvjT68MCWW7nz5q86xe8S",[],{"data":6309,"content":6310,"nodeType":866},{},[6311,6315,6320],{"data":6312,"marks":6313,"value":6314,"nodeType":865},{},[],"The other input to risk modeling that's difficult to express in concrete terms is ",{"data":6316,"marks":6317,"value":6319,"nodeType":865},{},[6318],{"type":887},"vulnerability",{"data":6321,"marks":6322,"value":6323,"nodeType":865},{},[],": the probability a threat becomes a loss event or, more specifically, how likely it is that your controls will fail. ",{"data":6325,"content":6326,"nodeType":866},{},[6327,6331,6339,6343,6349],{"data":6328,"marks":6329,"value":6330,"nodeType":865},{},[],"This is where browser telemetry gets especially concrete. ",{"data":6332,"content":6334,"nodeType":905},{"uri":6333},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/",[6335],{"data":6336,"marks":6337,"value":6338,"nodeType":865},{},[],"Analysis of login telemetry across Push-monitored environments",{"data":6340,"marks":6341,"value":6342,"nodeType":865},{},[]," shows that 1 in 4 logins are still password-only (not SSO), 2 in 5 are not protected by MFA, and 1 in 5 use a weak, breached, or reused password. Many of these logins occur outside the visibility of a central IdP platform like Microsoft, Google or Okta — the result of downstream ",{"data":6344,"content":6345,"nodeType":905},{"uri":945},[6346],{"data":6347,"marks":6348,"value":950,"nodeType":865},{},[],{"data":6350,"marks":6351,"value":6352,"nodeType":865},{},[],". ",{"data":6354,"content":6358,"nodeType":875},{"target":6355},{"sys":6356},{"id":6357,"type":872,"linkType":873},"5GctExdVGjHRwKifiP00Fp",[],{"data":6360,"content":6364,"nodeType":875},{"target":6361},{"sys":6362},{"id":6363,"type":872,"linkType":873},"2mWToHCJcuB9FMwxxzd67F",[],{"data":6366,"content":6367,"nodeType":866},{},[6368,6372,6377],{"data":6369,"marks":6370,"value":6371,"nodeType":865},{},[],"In a FAIR-based model, TEF and vulnerability together determine ",{"data":6373,"marks":6374,"value":6376,"nodeType":865},{},[6375],{"type":887},"loss event frequency",{"data":6378,"marks":6379,"value":6380,"nodeType":865},{},[],": the foundational driver of the entire risk calculation. Using telemetry from your own environment as the basis for these calculations makes them far more accurate, and more likely to stand up to scrutiny.",{"data":6382,"content":6383,"nodeType":879},{},[],{"data":6385,"content":6386,"nodeType":889},{},[6387],{"data":6388,"marks":6389,"value":6391,"nodeType":865},{},[6390],{"type":887},"The attack surface is bigger than most models assume",{"data":6393,"content":6394,"nodeType":866},{},[6395],{"data":6396,"marks":6397,"value":6398,"nodeType":865},{},[],"One of the consistent failures in identity risk modeling is the tendency to model risks defenders can see, and leave the rest off the balance sheet. These omissions create a systematic understatement of exposure that browser-based telemetry can offset.",{"data":6400,"content":6401,"nodeType":2315},{},[6402],{"data":6403,"marks":6404,"value":6406,"nodeType":865},{},[6405],{"type":887},"Shadow AI and OAuth sprawl",{"data":6408,"content":6409,"nodeType":866},{},[6410,6413,6421],{"data":6411,"marks":6412,"value":21,"nodeType":865},{},[],{"data":6414,"content":6415,"nodeType":905},{"uri":3418},[6416],{"data":6417,"marks":6418,"value":6420,"nodeType":865},{},[6419],{"type":1070},"The Vercel breach in April 2026",{"data":6422,"marks":6423,"value":6424,"nodeType":865},{},[]," was the result of an OAuth connection to a third-party AI SaaS tool a developer connected into the organization's Google Workspace tenant (without admin approval). When the AI vendor was compromised, the attacker leveraged stored OAuth tokens to access downstream accounts, ultimately reaching internal dashboards, API keys, and source code. ",{"data":6426,"content":6427,"nodeType":866},{},[6428,6432,6437],{"data":6429,"marks":6430,"value":6431,"nodeType":865},{},[],"Push telemetry across customer environments shows an average of ",{"data":6433,"marks":6434,"value":6436,"nodeType":865},{},[6435],{"type":887},"17 unique AI app integrations per organization in Microsoft and Google alone",{"data":6438,"marks":6439,"value":6440,"nodeType":865},{},[],", most of which security teams would describe as unapproved. These generally don't appear in a conventional risk model that isn't looking for them.",{"data":6442,"content":6443,"nodeType":2315},{},[6444],{"data":6445,"marks":6446,"value":288,"nodeType":865},{},[6447],{"type":887},{"data":6449,"content":6450,"nodeType":866},{},[6451,6455,6464,6469],{"data":6452,"marks":6453,"value":21,"nodeType":865},{},[6454],{"type":887},{"data":6456,"content":6457,"nodeType":905},{"uri":2568},[6458],{"data":6459,"marks":6460,"value":6463,"nodeType":865},{},[6461,6462],{"type":1070},{"type":887},"Analysis of 20,000 unique extensions deployed across Push customer environments",{"data":6465,"marks":6466,"value":6468,"nodeType":865},{},[6467],{"type":887}," found that 46.76% have the permission combinations required for account takeover without user interaction. ",{"data":6470,"marks":6471,"value":6472,"nodeType":865},{},[],"The extensions carrying these permissions aren't flagged by risk scoring systems because the same permissions are used by ad blockers, password managers, and translation tools (the downside of relying on tools that rely on dubious scoring to assess extensions, but I digress). ",{"data":6474,"content":6475,"nodeType":866},{},[6476],{"data":6477,"marks":6478,"value":6479,"nodeType":865},{},[],"What matters for risk quantification isn't the permission set or an arbitrary score assigned by a vendor; it's whether the monitoring exists to detect when a previously-clean extension changes ownership, escalates permissions, or behaves anomalously. Without that monitoring, the exposure is real but unquantified.",{"data":6481,"content":6482,"nodeType":2315},{},[6483],{"data":6484,"marks":6485,"value":6487,"nodeType":865},{},[6486],{"type":887},"ClickFix and non-email delivery channels",{"data":6489,"content":6490,"nodeType":866},{},[6491,6495,6502,6506,6513],{"data":6492,"marks":6493,"value":6494,"nodeType":865},{},[],"ClickFix — where a malicious page silently writes a PowerShell or mshta command into the victim's clipboard and instructs them to paste it — was ",{"data":6496,"content":6497,"nodeType":905},{"uri":2381},[6498],{"data":6499,"marks":6500,"value":6501,"nodeType":865},{},[],"the most common initial access vector observed by Microsoft in 2025",{"data":6503,"marks":6504,"value":6505,"nodeType":865},{},[],", and CrowdStrike reported a",{"data":6507,"content":6508,"nodeType":905},{"uri":2393},[6509],{"data":6510,"marks":6511,"value":6512,"nodeType":865},{},[]," 563% increase in fake CAPTCHA lures",{"data":6514,"marks":6515,"value":6516,"nodeType":865},{},[]," (one of the most common ClickFix styles in which the user has to \"verify they're human\" by running a command on their machine). ",{"data":6518,"content":6519,"nodeType":866},{},[6520],{"data":6521,"marks":6522,"value":6523,"nodeType":865},{},[],"What makes this particularly relevant for risk quantification is the delivery channel: 4 in 5 ClickFix payloads intercepted by Push arrive via search engines, not email. A risk model that estimates threat event frequency from email-based phishing telemetry alone is structurally blind to an entire category of attack that has become one of the most prevalent initial access methods in the landscape.",{"data":6525,"content":6526,"nodeType":2315},{},[6527],{"data":6528,"marks":6529,"value":6531,"nodeType":865},{},[6530],{"type":887},"Authorization attacks",{"data":6533,"content":6534,"nodeType":866},{},[6535],{"data":6536,"marks":6537,"value":6538,"nodeType":865},{},[],"Device code phishing and OAuth consent abuse represent a slightly separate category of identity attack that most risk models don't account for because they operate after the authentication flow has already completed — meaning password strength, MFA coverage, and SSO adoption are irrelevant to whether the attack succeeds. ",{"data":6540,"content":6544,"nodeType":875},{"target":6541},{"sys":6542},{"id":6543,"type":872,"linkType":873},"7qtHmxCzBm5664jD6HsCwN",[],{"data":6546,"content":6547,"nodeType":879},{},[],{"data":6549,"content":6550,"nodeType":889},{},[6551],{"data":6552,"marks":6553,"value":6555,"nodeType":865},{},[6554],{"type":887},"The key lesson for CISOs",{"data":6557,"content":6558,"nodeType":866},{},[6559],{"data":6560,"marks":6561,"value":6562,"nodeType":865},{},[],"A risk model that measures identity vulnerability purely in terms of authentication hygiene at the IdP layer — how many accounts have MFA, how many use SSO — will correctly quantify one dimension of exposure while completely missing another that is growing faster and is structurally immune to the controls being measured.",{"data":6564,"content":6565,"nodeType":866},{},[6566],{"data":6567,"marks":6568,"value":6570,"nodeType":865},{},[6569],{"type":887},"For a CISO building a risk model, these aren't edge cases. They represent a real attack surface that doesn't show up in models built on conventional network, endpoint, and cloud telemetry. We aren't just talking about better inputs to risk modeling — we're talking about entirely new risk scenarios that aren't being modeled at all, supported by live data.",{"data":6572,"content":6576,"nodeType":875},{"target":6573},{"sys":6574},{"id":6575,"type":872,"linkType":873},"2ObEcO1gqz8lrOLCZzfpNw",[],{"data":6578,"content":6579,"nodeType":879},{},[],{"data":6581,"content":6582,"nodeType":2315},{},[6583],{"data":6584,"marks":6585,"value":6587,"nodeType":865},{},[6586],{"type":887},"Browser telemetry makes a CISO's life easier",{"data":6589,"content":6590,"nodeType":866},{},[6591],{"data":6592,"marks":6593,"value":6594,"nodeType":865},{},[],"Browser-based telemetry changes the conversation a CISO can have with a CFO or board. Instead of \"industry benchmarks suggest our expected annual loss from account compromise is somewhere in this range,\" the answer is, \"We can see how often these attacks are attempted against our users, and we can measure what percentage of our accounts have the controls in place to stop them,\" or \"We know how many shadow AI apps our users self-provision and share data with each month.\" ",{"data":6596,"content":6597,"nodeType":866},{},[6598],{"data":6599,"marks":6600,"value":6601,"nodeType":865},{},[],"Identity risk is only a piece of the quantification problem. Loss magnitude, regulatory exposure, and reputational impact are still extremely hard to estimate regardless of how good your frequency inputs are. ",{"data":6603,"content":6604,"nodeType":866},{},[6605],{"data":6606,"marks":6607,"value":6608,"nodeType":865},{},[],"But the identity attack surface is one of the few areas in security where measurement is genuinely achievable right now, and the gap between what most organizations are modeling and what's actually observable is significant. Shadow SaaS integrations, unapproved AI connections, browser extensions with excessive privileges — these are enumerable risks that don't appear in models built on network, endpoint, and cloud access telemetry alone. ",{"data":6610,"content":6611,"nodeType":866},{},[6612,6617],{"data":6613,"marks":6614,"value":6616,"nodeType":865},{},[6615],{"type":887},"The lesson for CISOs serious about quantitative risk management is this: the frameworks exist, the talent is available, and the bottleneck is almost always data quality. ",{"data":6618,"marks":6619,"value":6620,"nodeType":865},{},[],"Browser telemetry is a good example of the kind of high-fidelity, environment-specific measurement that closes that gap.",{"data":6622,"content":6623,"nodeType":879},{},[],{"data":6625,"content":6626,"nodeType":866},{},[6627],{"data":6628,"marks":6629,"value":3670,"nodeType":865},{},[],{"data":6631,"content":6632,"nodeType":866},{},[6633,6637,6644],{"data":6634,"marks":6635,"value":6636,"nodeType":865},{},[],"Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see. ",{"data":6638,"content":6640,"nodeType":905},{"uri":6639},"https://pushsecurity.com/book-demo/",[6641],{"data":6642,"marks":6643,"value":5288,"nodeType":865},{},[],{"data":6645,"marks":6646,"value":2997,"nodeType":865},{},[],"The CISO's data problem (and how browser telemetry can help)","How CISOs can use browser telemetry to support cyber risk quantification in areas where traditional data points fall short. ","2026-05-11T00:00:00.000Z","the-cisos-data-problem-and-how-browser-telemetry-can-help",{"items":6652},[6653,6655],{"sys":6654,"name":4039},{"id":4038},{"sys":6656,"name":342},{"id":3008},{"items":6658},[6659],{"fullName":4093,"firstName":4094,"jobTitle":4095,"profilePicture":6660},{"url":4097},"verizon-dbir-2026-review","blog/verizon-dbir-2026-review",{"json":6664},{"data":6665,"content":6666,"nodeType":1522},{},[6667],{"data":6668,"content":6669,"nodeType":866},{},[6670],{"data":6671,"marks":6672,"value":6673,"nodeType":865},{},[],"Verizon's 2026 Data Breach Investigations Report landed this week with the largest dataset in the report's 19-year history — more than 22,000 confirmed breaches across 145 countries, nearly double last year's count.","What we can learn from 2026's installment of the Verizon Data Breach Investigations Report.",{"id":6676,"publishedAt":6677},"7sZs2lHCTN8oYc2OIGCIQG","2026-08-12T12:00:55.865Z",{"items":6679},[6680,6682],{"sys":6681,"name":297},{"id":2147},{"sys":6683,"name":2144},{"id":2143},{"items":6685},[6686,6688,6690,6692,6694,6696,6698,6700,6702,6704,6706,6708,6710,6712,6714,6716,6718,6720,6722,6724,6726,6728,6730,6732],{"sys":6687,"name":279,"slug":280,"tier":31},{"id":276},{"sys":6689,"name":413,"slug":414,"tier":31},{"id":410},{"sys":6691,"name":642,"slug":643,"tier":31},{"id":639},{"sys":6693,"name":519,"slug":520,"tier":31},{"id":516},{"sys":6695,"name":297,"slug":298,"tier":31},{"id":294},{"sys":6697,"name":235,"slug":236,"tier":31},{"id":232},{"sys":6699,"name":422,"slug":423,"tier":45},{"id":419},{"sys":6701,"name":315,"slug":316,"tier":45},{"id":312},{"sys":6703,"name":324,"slug":325,"tier":45},{"id":321},{"sys":6705,"name":580,"slug":581,"tier":45},{"id":577},{"sys":6707,"name":537,"slug":538,"tier":45},{"id":534},{"sys":6709,"name":633,"slug":634,"tier":45},{"id":630},{"sys":6711,"name":261,"slug":262,"tier":45},{"id":258},{"sys":6713,"name":475,"slug":476,"tier":45},{"id":472},{"sys":6715,"name":333,"slug":334,"tier":45},{"id":330},{"sys":6717,"name":457,"slug":458,"tier":45},{"id":454},{"sys":6719,"name":288,"slug":289,"tier":45},{"id":285},{"sys":6721,"name":252,"slug":253,"tier":45},{"id":249},{"sys":6723,"name":607,"slug":608,"tier":45},{"id":604},{"sys":6725,"name":650,"slug":651,"tier":45},{"id":647},{"sys":6727,"name":244,"slug":245,"tier":45},{"id":241},{"sys":6729,"name":368,"slug":369,"tier":45},{"id":365},{"sys":6731,"name":571,"slug":572,"tier":45},{"id":568},{"sys":6733,"name":484,"slug":485,"tier":45},{"id":481},"hcNrtVGANdYvnes1Z8X1g9b6b_dm694k5qOhLd1GfaI",{"id":6736,"title":6737,"authorsCollection":6738,"content":6744,"extension":228,"faqItemsCollection":7490,"faqTitle":59,"featured":6,"hashTags":59,"meta":7492,"metaTitle":7493,"ogImage":59,"postType":7494,"publishedDate":7495,"relatedBlogPostsCollection":7496,"slug":10600,"stem":10601,"subtitle":59,"summary":10602,"synopsis":10613,"sys":10614,"tagsCollection":10617,"topicsCollection":10623,"__hash__":10659},"blog/blog/unpacking-the-latest-slh-campaign.json","Unpacking the latest SLH campaign — combining vishing with AiTM phishing to hijack SSO accounts",{"items":6739},[6740],{"fullName":3012,"firstName":3013,"jobTitle":3014,"socialLinks":6741,"profilePicture":6743},[6742],"https://www.linkedin.com/in/daniel-g-/",{"url":3016},{"json":6745,"links":7362},{"data":6746,"content":6747,"nodeType":1522},{},[6748,6765,6772,6779,6782,6790,6810,6830,6864,6870,6873,6881,6889,6896,6914,6921,6927,6933,6940,6947,6955,6962,6969,6975,6982,7002,7010,7017,7024,7044,7050,7069,7075,7082,7088,7091,7099,7106,7126,7133,7161,7168,7176,7179,7187,7194,7201,7207,7214,7259,7265,7272,7305,7311,7356],{"data":6749,"content":6750,"nodeType":866},{},[6751,6754,6761],{"data":6752,"marks":6753,"value":21,"nodeType":865},{},[],{"data":6755,"content":6756,"nodeType":905},{"uri":2644},[6757],{"data":6758,"marks":6759,"value":2649,"nodeType":865},{},[6760],{"type":1070},{"data":6762,"marks":6763,"value":6764,"nodeType":865},{},[]," are running a large-scale hybrid vishing plus AiTM phishing campaign across several industry verticals, targeting Okta, Entra, and Google SSO platforms. ",{"data":6766,"content":6767,"nodeType":866},{},[6768],{"data":6769,"marks":6770,"value":6771,"nodeType":865},{},[],"The attacks begin with the attacker calling their victim, impersonating IT staff from their company. They offer to help the employee set up passkeys for logging into the enterprise SSO service, tricking the victim into visiting a specially crafted adversary-in-the-middle phishing site that captures their SSO credentials, MFA codes, and ultimately live session access. ",{"data":6773,"content":6774,"nodeType":866},{},[6775],{"data":6776,"marks":6777,"value":6778,"nodeType":865},{},[],"Once an account is stolen, the attacker logs in to the SSO dashboard to see which platforms they have access to and then proceeds to steal data from them — with the ultimate goal of extorting victims. ",{"data":6780,"content":6781,"nodeType":879},{},[],{"data":6783,"content":6784,"nodeType":889},{},[6785],{"data":6786,"marks":6787,"value":6789,"nodeType":865},{},[6788],{"type":887},"What we know",{"data":6791,"content":6792,"nodeType":866},{},[6793,6797,6806],{"data":6794,"marks":6795,"value":6796,"nodeType":865},{},[],"To date, ",{"data":6798,"content":6800,"nodeType":905},{"uri":6799},"https://www.silentpush.com/blog/slsh-alert/",[6801],{"data":6802,"marks":6803,"value":6805,"nodeType":865},{},[6804],{"type":1070},"100+ companies have been targeted",{"data":6807,"marks":6808,"value":6809,"nodeType":865},{},[],", with infrastructure and domains impersonating their brand to be used in legit-looking campaigns against them. The reality is that the list of targets could be more extensive, and will continue to increase over time. ",{"data":6811,"content":6812,"nodeType":866},{},[6813,6817,6826],{"data":6814,"marks":6815,"value":6816,"nodeType":865},{},[],"SLH ",{"data":6818,"content":6820,"nodeType":905},{"uri":6819},"https://www.bleepingcomputer.com/news/security/shinyhunters-claim-to-be-behind-sso-account-data-theft-attacks/",[6821],{"data":6822,"marks":6823,"value":6825,"nodeType":865},{},[6824],{"type":1070},"claims to be using data stolen in previous breaches",{"data":6827,"marks":6828,"value":6829,"nodeType":865},{},[],", such as the widespread Salesforce data theft attacks reported in 2025, to identify and contact employees. This data includes phone numbers, job titles, names, and other details used to make the social engineering calls more convincing.",{"data":6831,"content":6832,"nodeType":866},{},[6833,6837,6842,6846,6851,6855,6860],{"data":6834,"marks":6835,"value":6836,"nodeType":865},{},[],"The group recently relaunched its Tor data leak site, which currently lists breaches at ",{"data":6838,"marks":6839,"value":6841,"nodeType":865},{},[6840],{"type":887},"Betterment",{"data":6843,"marks":6844,"value":6845,"nodeType":865},{},[]," (20 million records containing PII), ",{"data":6847,"marks":6848,"value":6850,"nodeType":865},{},[6849],{"type":887},"Crunchbase",{"data":6852,"marks":6853,"value":6854,"nodeType":865},{},[]," (2 million records containing PII), and ",{"data":6856,"marks":6857,"value":6859,"nodeType":865},{},[6858],{"type":887},"SoundCloud",{"data":6861,"marks":6862,"value":6863,"nodeType":865},{},[]," (30 million records containing PII). ",{"data":6865,"content":6869,"nodeType":875},{"target":6866},{"sys":6867},{"id":6868,"type":872,"linkType":873},"5scKHYJJleNklGAXNKVc7b",[],{"data":6871,"content":6872,"nodeType":879},{},[],{"data":6874,"content":6875,"nodeType":889},{},[6876],{"data":6877,"marks":6878,"value":6880,"nodeType":865},{},[6879],{"type":887},"What’s new?",{"data":6882,"content":6883,"nodeType":2315},{},[6884],{"data":6885,"marks":6886,"value":6888,"nodeType":865},{},[6887],{"type":887},"The best of both worlds? Vishing + AiTM phishing",{"data":6890,"content":6891,"nodeType":866},{},[6892],{"data":6893,"marks":6894,"value":6895,"nodeType":865},{},[],"SLH and threat actors affiliated with “The Com” are no stranger to voice phishing (vishing) or the use of MFA-bypassing Attacker-in-the-Middle (AitM) phishing kits. ",{"data":6897,"content":6898,"nodeType":866},{},[6899,6902,6910],{"data":6900,"marks":6901,"value":21,"nodeType":865},{},[],{"data":6903,"content":6904,"nodeType":905},{"uri":2644},[6905],{"data":6906,"marks":6907,"value":6909,"nodeType":865},{},[6908],{"type":1070},"SLH and it’s precursor groups",{"data":6911,"marks":6912,"value":6913,"nodeType":865},{},[]," leveraged vishing to great success in the form of help desk impersonation and password/MFA reset attacks as seen in the high profile Marks & Spencer, Co-Op, and Jaguar Land Rover attacks in 2025, as well as the Caesars and MGM attacks in 2023. MFA-bypassing phishing techniques have also long been a part of their arsenal, from the 2022 0ktapus phishing campaign to more recent use of modern AiTM phishing kits. ",{"data":6915,"content":6916,"nodeType":866},{},[6917],{"data":6918,"marks":6919,"value":6920,"nodeType":865},{},[],"But until now, we haven’t seen them used together. ",{"data":6922,"content":6926,"nodeType":875},{"target":6923},{"sys":6924},{"id":6925,"type":872,"linkType":873},"6poP5VM2ARrEvwKEG42HgK",[],{"data":6928,"content":6932,"nodeType":875},{"target":6929},{"sys":6930},{"id":6931,"type":872,"linkType":873},"1IDsaYD3H5MjvPS4ekcUhU",[],{"data":6934,"content":6935,"nodeType":866},{},[6936],{"data":6937,"marks":6938,"value":6939,"nodeType":865},{},[],"It makes sense to combine these methods. AiTM phishing kits are flexible, highly customizable, and can be used to target a broad range of apps — including all of the major IdP platforms used for SSO. Vishing on the other hand is proven to increase the effectiveness of social engineering attacks when performed by an effective operator — which SLH are proven to be (helped by predominantly native English speakers making up their membership, along with the use of effective voice phishing tools). ",{"data":6941,"content":6942,"nodeType":866},{},[6943],{"data":6944,"marks":6945,"value":6946,"nodeType":865},{},[],"Both vishing and AiTM phishing are identity-first methods that consciously evade traditional security tools and detection controls at the endpoint and network layer. This makes them highly effective in today’s IT environment. ",{"data":6948,"content":6949,"nodeType":2315},{},[6950],{"data":6951,"marks":6952,"value":6954,"nodeType":865},{},[6953],{"type":887},"A new kind of operator-driven AiTM kit",{"data":6956,"content":6957,"nodeType":866},{},[6958],{"data":6959,"marks":6960,"value":6961,"nodeType":865},{},[],"Another unique part about this campaign is that it uses a “live phishing panel” — i.e. a customizable phishing page controlled by the attacker in real time. This enables attackers to dynamically change what a victim sees on a phishing site while speaking to them on the phone. This allows them to guide victims through each step of the login and MFA authentication process.",{"data":6963,"content":6964,"nodeType":866},{},[6965],{"data":6966,"marks":6967,"value":6968,"nodeType":865},{},[],"This is principally to increase the victim’s likelihood of engaging with the phishing page. As you can see in the image below, there are several options that can be presented to the victim — including not just the normal phishing stages of entering credentials and passing MFA checks, but also post-compromise actions (e.g. creating a passkey that would then be controlled by the attacker for persistent access even if an account password is reset). ",{"data":6970,"content":6974,"nodeType":875},{"target":6971},{"sys":6972},{"id":6973,"type":872,"linkType":873},"73Y2n3tRkGFtfhrA2AVJyv",[],{"data":6976,"content":6977,"nodeType":866},{},[6978],{"data":6979,"marks":6980,"value":6981,"nodeType":865},{},[],"At the end of the authentication flow, the threat actor can choose to redirect their target to a “support ticket\" closure screen. This allows the threat actor to manually terminate the session once the compromise is complete while providing the targeted user with context that matches the \"IT support\" ruse. This further reduces the likelihood of post-hoc reporting by a suspicious victim.",{"data":6983,"content":6984,"nodeType":866},{},[6985,6989,6998],{"data":6986,"marks":6987,"value":6988,"nodeType":865},{},[],"Given that this modular, operator-controlled phishing kit is reportedly available “",{"data":6990,"content":6992,"nodeType":905},{"uri":6991},"https://www.okta.com/blog/threat-intelligence/phishing-kits-adapt-to-the-script-of-callers/",[6993],{"data":6994,"marks":6995,"value":6997,"nodeType":865},{},[6996],{"type":1070},"as a service",{"data":6999,"marks":7000,"value":7001,"nodeType":865},{},[],"” for criminals, we should expect to see much more of this in future. ",{"data":7003,"content":7004,"nodeType":2315},{},[7005],{"data":7006,"marks":7007,"value":7009,"nodeType":865},{},[7008],{"type":887},"0ktapus 2.0?",{"data":7011,"content":7012,"nodeType":866},{},[7013],{"data":7014,"marks":7015,"value":7016,"nodeType":865},{},[],"As we mentioned earlier, Scattered Spider made their reputation launching phishing attacks against Okta accounts in the 2022 0ktapus campaign. ",{"data":7018,"content":7019,"nodeType":866},{},[7020],{"data":7021,"marks":7022,"value":7023,"nodeType":865},{},[],"The vast majority of phishing attacks target IdP accounts because of the widespread access to downstream apps they grant via SSO. ",{"data":7025,"content":7026,"nodeType":866},{},[7027,7031,7040],{"data":7028,"marks":7029,"value":7030,"nodeType":865},{},[],"This comes at the same time as ",{"data":7032,"content":7034,"nodeType":905},{"uri":7033},"https://www.bleepingcomputer.com/news/security/fake-lastpass-emails-pose-as-password-vault-backup-alerts/",[7035],{"data":7036,"marks":7037,"value":7039,"nodeType":865},{},[7038],{"type":1070},"attackers running campaigns to target LastPass master passwords",{"data":7041,"marks":7042,"value":7043,"nodeType":865},{},[],". This provides a similar level of access to apps in the form of credentials (and sometimes saved passkeys). ",{"data":7045,"content":7049,"nodeType":875},{"target":7046},{"sys":7047},{"id":7048,"type":872,"linkType":873},"1vyu5WvdktTnC24TkVFqfs",[],{"data":7051,"content":7052,"nodeType":866},{},[7053,7057,7065],{"data":7054,"marks":7055,"value":7056,"nodeType":865},{},[],"Not only is this a goldmine for attackers looking to steal data or pivot to other systems to be able to launch further attacks (e.g. pivoting to cloud and on-prem services for ransomware deployment) but it’s a nightmare for incident responders. If an attacker can access an app and create a backdoor login method (AKA. a ",{"data":7058,"content":7059,"nodeType":905},{"uri":945},[7060],{"data":7061,"marks":7062,"value":7064,"nodeType":865},{},[7063],{"type":1070},"ghost login",{"data":7066,"marks":7067,"value":7068,"nodeType":865},{},[],") it can be very difficult for a security team to identify and clean them up. ",{"data":7070,"content":7074,"nodeType":875},{"target":7071},{"sys":7072},{"id":7073,"type":872,"linkType":873},"7tILkroPw9w0WLIo1bVV24",[],{"data":7076,"content":7077,"nodeType":866},{},[7078],{"data":7079,"marks":7080,"value":7081,"nodeType":865},{},[],"Check out the excerpt from one of our recent webinars below for more information. ",{"data":7083,"content":7087,"nodeType":875},{"target":7084},{"sys":7085},{"id":7086,"type":872,"linkType":873},"5IVkapjwLp1Ys14vXagQRD",[],{"data":7089,"content":7090,"nodeType":879},{},[],{"data":7092,"content":7093,"nodeType":889},{},[7094],{"data":7095,"marks":7096,"value":7098,"nodeType":865},{},[7097],{"type":887},"Impact analysis",{"data":7100,"content":7101,"nodeType":866},{},[7102],{"data":7103,"marks":7104,"value":7105,"nodeType":865},{},[],"This combination of methods is likely to increase the success of these malicious campaigns as well as reducing the likelihood of detection. ",{"data":7107,"content":7108,"nodeType":866},{},[7109,7113,7122],{"data":7110,"marks":7111,"value":7112,"nodeType":865},{},[],"It’s well documented that modern phishing attacks use a wide and ever-expanding range of ",{"data":7114,"content":7116,"nodeType":905},{"uri":7115},"https://pushsecurity.com/blog/phishing-detection-evasion-launch/",[7117],{"data":7118,"marks":7119,"value":7121,"nodeType":865},{},[7120],{"type":1070},"detection evasion techniques",{"data":7123,"marks":7124,"value":7125,"nodeType":865},{},[]," — from implementing legitimate bot protection technologies to prevent analysis, to only loading pages if the correct parameters are met — such as coming through a specific URL redirect path, and adhering to “normal” browser configs (excluding unusual browser window sizes and the presence of security analysis tools).",{"data":7127,"content":7128,"nodeType":866},{},[7129],{"data":7130,"marks":7131,"value":7132,"nodeType":865},{},[],"In this case, the malicious payload will only trigger in the event that the delivery is approved by an operator in real time. This means that anyone attempting to find and proactively block a phishing page based on indicators of known-bad is going to have a tough time finding and flagging them. If you haven’t got a community of security analysts sharing and tagging samples of malicious pages, it makes it really hard to find and block them at scale before they hit a victim. And if these convincing attacks aren’t being reported, they’re even less likely to be investigated. This is what we mean when we say that most phishing attacks today are effectively zero-day. ",{"data":7134,"content":7135,"nodeType":866},{},[7136,7140,7145,7149,7157],{"data":7137,"marks":7138,"value":7139,"nodeType":865},{},[],"In this case, it’s worth pointing out that the phone call is essentially the delivery vector for the phishing page. This means there’s no email to intercept and analyse. This isn’t new — ",{"data":7141,"marks":7142,"value":7144,"nodeType":865},{},[7143],{"type":887},"non-email vectors now account for more than 1 in 3 phishing attacks intercepted by Push",{"data":7146,"marks":7147,"value":7148,"nodeType":865},{},[],", ",{"data":7150,"content":7151,"nodeType":905},{"uri":1001},[7152],{"data":7153,"marks":7154,"value":7156,"nodeType":865},{},[7155],{"type":1070},"LinkedIn and Google Search being the top culprits",{"data":7158,"marks":7159,"value":7160,"nodeType":865},{},[],". This effectively cuts out the primary phishing detection surface for most organizations.",{"data":7162,"content":7163,"nodeType":866},{},[7164],{"data":7165,"marks":7166,"value":7167,"nodeType":865},{},[],"All this means that unless you’re able to detect and block these attacks in real time, organizations will find themselves unable to counter this evolving threat. ",{"data":7169,"content":7170,"nodeType":866},{},[7171],{"data":7172,"marks":7173,"value":7175,"nodeType":865},{},[7174],{"type":887},"The best/only way to do that is to be in the browser. ",{"data":7177,"content":7178,"nodeType":879},{},[],{"data":7180,"content":7181,"nodeType":889},{},[7182],{"data":7183,"marks":7184,"value":7186,"nodeType":865},{},[7185],{"type":887},"How Push stops the attack",{"data":7188,"content":7189,"nodeType":866},{},[7190],{"data":7191,"marks":7192,"value":7193,"nodeType":865},{},[],"As a browser-based detection and response tool, Push is perfectly positioned to detect and block attacks like this in real-time. ",{"data":7195,"content":7196,"nodeType":866},{},[7197],{"data":7198,"marks":7199,"value":7200,"nodeType":865},{},[],"Push harnesses deep browser telemetry to detect and block phishing based on behaviors, not static indicators. By analyzing how phishing pages behave and how users interact with them, Push uncovers fake pages, attempted credential theft, and phishing kits the moment they load in the browser — regardless of the delivery mechanism, and even when the attack has never been seen before. ",{"data":7202,"content":7206,"nodeType":875},{"target":7203},{"sys":7204},{"id":7205,"type":872,"linkType":873},"2TAKFM1rpETq4KtTY3FPIs",[],{"data":7208,"content":7209,"nodeType":866},{},[7210],{"data":7211,"marks":7212,"value":7213,"nodeType":865},{},[],"Push's browser-based controls include:",{"data":7215,"content":7216,"nodeType":2718},{},[7217,7238],{"data":7218,"content":7219,"nodeType":2654},{},[7220],{"data":7221,"content":7222,"nodeType":866},{},[7223,7226,7234],{"data":7224,"marks":7225,"value":21,"nodeType":865},{},[],{"data":7227,"content":7229,"nodeType":905},{"uri":7228},"https://pushsecurity.com/blog/introducing-sso-password-protection/",[7230],{"data":7231,"marks":7232,"value":7233,"nodeType":865},{},[],"Fingerprinting high-risk app passwords",{"data":7235,"marks":7236,"value":7237,"nodeType":865},{},[]," so they can only be used on a specific domain. Any attempt to reuse this password elsewhere (such as on a phishing site) results in the attempt being blocked. ",{"data":7239,"content":7240,"nodeType":2654},{},[7241],{"data":7242,"content":7243,"nodeType":866},{},[7244,7247,7255],{"data":7245,"marks":7246,"value":21,"nodeType":865},{},[],{"data":7248,"content":7250,"nodeType":905},{"uri":7249},"https://pushsecurity.com/blog/detecting-and-blocking-phishing-attacks-in-the-browser/",[7251],{"data":7252,"marks":7253,"value":7254,"nodeType":865},{},[],"Multiple browser-based checks",{"data":7256,"marks":7257,"value":7258,"nodeType":865},{},[]," looking for indicators of bad, such as cloned elements from legitimate websites, and an ever-growing number of detections relating to phishing kit behaviors and attributes as they are rendered on a page. ",{"data":7260,"content":7264,"nodeType":875},{"target":7261},{"sys":7262},{"id":7263,"type":872,"linkType":873},"4ESxxjTjNwNXGEW4DBcMVV",[],{"data":7266,"content":7267,"nodeType":866},{},[7268],{"data":7269,"marks":7270,"value":7271,"nodeType":865},{},[],"Because Push observes every login made in the browser, you can also use Push to find identities susceptible to phishing attacks, such as those not using phishing-resistant authentication methods (e.g. passkeys), to proactively improve your account hygiene and reduce your attack surface. ",{"data":7273,"content":7274,"nodeType":866},{},[7275,7279,7288,7292,7301],{"data":7276,"marks":7277,"value":7278,"nodeType":865},{},[],"Finally, you can also use our ",{"data":7280,"content":7282,"nodeType":905},{"uri":7281},"https://pushsecurity.com/blog/employee-identity-verification-codes-release/",[7283],{"data":7284,"marks":7285,"value":7287,"nodeType":865},{},[7286],{"type":1070},"employee verification codes",{"data":7289,"marks":7290,"value":7291,"nodeType":865},{},[]," feature as part of a layered defense — a simple, browser-based identity check that gives your employees a reliable way to confirm they’re talking to another employee from your organization. It enables employees to quickly verify that a caller is who they say they are by relaying a rotating 6-digit verification code displayed in every employee's browser via the Push extension. This is an effective way of combating ",{"data":7293,"content":7295,"nodeType":905},{"uri":7294},"https://pushsecurity.com/blog/scattered-spider-defending-against-help-desk-scams/",[7296],{"data":7297,"marks":7298,"value":7300,"nodeType":865},{},[7299],{"type":1070},"help desk scams",{"data":7302,"marks":7303,"value":7304,"nodeType":865},{},[]," too — another favorite of SLH. ",{"data":7306,"content":7310,"nodeType":875},{"target":7307},{"sys":7308},{"id":7309,"type":872,"linkType":873},"1TEpCjh8UGwmejgYSGC1by",[],{"data":7312,"content":7313,"nodeType":1649},{},[7314],{"data":7315,"content":7316,"nodeType":866},{},[7317,7321,7330,7333,7341,7345,7353],{"data":7318,"marks":7319,"value":7320,"nodeType":865},{},[],"Want to learn more about Push? ",{"data":7322,"content":7324,"nodeType":905},{"uri":7323},"https://pushsecurity.com/resources/product-brochure",[7325],{"data":7326,"marks":7327,"value":7329,"nodeType":865},{},[7328],{"type":1070},"Check out our latest product overview",{"data":7331,"marks":7332,"value":7148,"nodeType":865},{},[],{"data":7334,"content":7336,"nodeType":905},{"uri":7335},"https://pushsecurity.com/product-demo/",[7337],{"data":7338,"marks":7339,"value":7340,"nodeType":865},{},[],"visit our demo library",{"data":7342,"marks":7343,"value":7344,"nodeType":865},{},[],", or ",{"data":7346,"content":7347,"nodeType":905},{"uri":1512},[7348],{"data":7349,"marks":7350,"value":7352,"nodeType":865},{},[7351],{"type":1070},"book some time with one of our team for a live demo",{"data":7354,"marks":7355,"value":1193,"nodeType":865},{},[],{"data":7357,"content":7358,"nodeType":866},{},[7359],{"data":7360,"marks":7361,"value":21,"nodeType":865},{},[],{"entries":7363},{"hyperlink":7364,"inline":7365,"block":7366},[],[],[7367,7375,7382,7407,7415,7421,7445,7451,7476,7482],{"sys":7368,"__typename":4637,"title":7369,"caption":7370,"layoutMode":59,"file":7371},{"id":6868},"SLH TOR leak site with claimed victims.","SLH Tor leak site with claimed victims.",{"url":7372,"width":7373,"height":7374},"https://images.ctfassets.net/y1cdw1ablpvd/PoWJBZ3uyl94usKVv3zgr/ed5aefc88cf39fe354755c7b145564bf/image4.png",1284,588,{"sys":7376,"__typename":4637,"title":7377,"caption":7377,"layoutMode":59,"file":7378},{"id":6925},"Big picture view of Scattered Lapsus$ Hunters breaches since 2021.",{"url":7379,"width":7380,"height":7381},"https://images.ctfassets.net/y1cdw1ablpvd/415gvGUy6Ywr2zofY8Phpk/dc9a8461ef07c041fef4a7fb39d0a25b/Screenshot_2026-02-25_at_09.50.56.png",3414,1852,{"sys":7383,"__typename":4645,"content":7384,"name":7406,"title":59},{"id":6931},{"json":7385},{"data":7386,"content":7387,"nodeType":1522},{},[7388],{"data":7389,"content":7390,"nodeType":866},{},[7391,7395,7403],{"data":7392,"marks":7393,"value":7394,"nodeType":865},{},[],"Get the background on Scattered Lapsus$ Hunters, and how they relate to Scattered Spider, Lapsus$, ShinyHunters, and other Com-affiliated groups in our recent deep dive, unpacking related breaches dating back to 2021 ",{"data":7396,"content":7397,"nodeType":905},{"uri":2644},[7398],{"data":7399,"marks":7400,"value":7402,"nodeType":865},{},[7401],{"type":1070},"in our recent blog post",{"data":7404,"marks":7405,"value":1193,"nodeType":865},{},[],"SLH campaign insight box 1",{"sys":7408,"__typename":4637,"title":7409,"caption":7410,"layoutMode":59,"file":7411},{"id":6973},"What the operator sees in their phishing dashboard.","Phishing dashboard view provided by Okta Threat Intelligence.",{"url":7412,"width":7413,"height":7414},"https://images.ctfassets.net/y1cdw1ablpvd/3IvcYr8sCMsCbhnzG9OzJA/35e3bdcf6dcddb3c431600afe490fe7e/image5.png",1600,558,{"sys":7416,"__typename":4637,"title":7417,"caption":7417,"layoutMode":59,"file":7418},{"id":7048},"SSO panel examples in Entra and Okta.",{"url":7419,"width":4641,"height":7420},"https://images.ctfassets.net/y1cdw1ablpvd/31RIcvGgLz2fmHBYsZyEV5/4326e200aa8ba9879257c2f9b643cf08/image1.png",680,{"sys":7422,"__typename":4645,"content":7423,"name":7444,"title":59},{"id":7073},{"json":7424},{"data":7425,"content":7426,"nodeType":1522},{},[7427],{"data":7428,"content":7429,"nodeType":866},{},[7430,7433,7440],{"data":7431,"marks":7432,"value":21,"nodeType":865},{},[],{"data":7434,"content":7435,"nodeType":905},{"uri":3205},[7436],{"data":7437,"marks":7438,"value":7439,"nodeType":865},{},[],"Mandiant has reported",{"data":7441,"marks":7442,"value":7443,"nodeType":865},{},[]," how the attacker opportunistically pivots across accessible SaaS platforms (SharePoint, Salesforce, DocuSign, Slack), hunting for specific strings like “poc,” “confidential,” “salesforce,” and “vpn.” Notable tradecraft includes using ToogleBox Recall to delete MFA enrollment notifications from victims’ inboxes and leveraging PowerShell to bulk-download SharePoint content routed through commercial VPN services like Mullvad, Oxylabs, and NetNut. Check out their blog post for some example SaaS activity logs that can be used to investigate a potential compromise. ","SLH V2 insight box 1",{"sys":7446,"__typename":7447,"title":7448,"arcadeDemoUrl":7449,"playText":7450},{"id":7086},"ArcadeDemo","SSO Exploitation Demo","https://demo.arcade.software/pwGUZuoRdTLzfbWGZUDJ?embed","2 mins",{"sys":7452,"__typename":4645,"content":7453,"name":7475,"title":59},{"id":7205},{"json":7454},{"data":7455,"content":7456,"nodeType":1522},{},[7457],{"data":7458,"content":7459,"nodeType":866},{},[7460,7464,7471],{"data":7461,"marks":7462,"value":7463,"nodeType":865},{},[],"This even includes brand new techniques that have never been seen in the wild — such as ",{"data":7465,"content":7466,"nodeType":905},{"uri":2470},[7467],{"data":7468,"marks":7469,"value":1913,"nodeType":865},{},[7470],{"type":1070},{"data":7472,"marks":7473,"value":7474,"nodeType":865},{},[],", which we blocked the first time it was seen targeting our customers, before even realizing it was a new kind of attack.","SLH campaign insight box 2",{"sys":7477,"__typename":4637,"title":7478,"caption":7478,"layoutMode":59,"file":7479},{"id":7263},"Push blocks phishing pages using real-time, in-browser analysis — shutting the attack down before a compromise happens. ",{"url":7480,"width":4641,"height":7481},"https://images.ctfassets.net/y1cdw1ablpvd/6InFhVkJJOPhsojQoub04K/b43e32cfa0bdc423dc993e930ebe1ae2/image1.png",1125,{"sys":7483,"__typename":4637,"title":7484,"caption":7485,"layoutMode":59,"file":7486},{"id":7309},"Employee Verification Codes","Push provides a lightweight verification feature in every user’s browser — no additional apps or devices required.",{"url":7487,"width":7488,"height":7489},"https://images.ctfassets.net/y1cdw1ablpvd/41X6fkPJgqf14vO3O14TF3/e0cecdbdfaee1353f15ff77ecb6a55a8/Employee_verification_codes.png",2088,1240,{"items":7491},[],{},"Unpacking the latest SLH phishing campaign","threat-research","2026-01-28T00:00:00.000Z",{"items":7497},[7498,8327,9648],{"__typename":1544,"sys":7499,"content":7501,"title":8313,"synopsis":8314,"hashTags":59,"publishedDate":8315,"slug":8316,"tagsCollection":8317,"authorsCollection":8323},{"id":7500},"4jcVFrvGBtVXpKU3gDMaa2",{"json":7502},{"data":7503,"content":7504,"nodeType":1522},{},[7505,7523,7530,7536,7593,7600,7607,7610,7618,7625,7632,7688,7696,7703,7726,7733,7736,7744,7751,7758,7765,7772,7779,7786,7792,7800,7807,7826,7846,7849,7857,7864,7871,7878,7886,7905,7912,7918,7926,7946,7966,8079,8082,8090,8097,8104,8107,8115,8122,8129,8136,8203,8233,8236,8244,8251,8258,8265,8272,8301,8307],{"data":7506,"content":7507,"nodeType":866},{},[7508,7512,7519],{"data":7509,"marks":7510,"value":7511,"nodeType":865},{},[],"In December, the Push Security research team discovered and blocked a brand new attack technique that we coined ",{"data":7513,"content":7514,"nodeType":905},{"uri":1907},[7515],{"data":7516,"marks":7517,"value":1913,"nodeType":865},{},[7518],{"type":1070},{"data":7520,"marks":7521,"value":7522,"nodeType":865},{},[],". This technique merged ClickFix-style social engineering with OAuth consent phishing to hijack Microsoft accounts. ",{"data":7524,"content":7525,"nodeType":866},{},[7526],{"data":7527,"marks":7528,"value":7529,"nodeType":865},{},[],"We saw this attack running across a large network of compromised websites that attackers were injecting the malicious payload into, forming a large-scale campaign that was detected across multiple customer estates. ",{"data":7531,"content":7535,"nodeType":875},{"target":7532},{"sys":7533},{"id":7534,"type":872,"linkType":873},"603MWDqc9NsqkklIkfGNZN",[],{"data":7537,"content":7538,"nodeType":866},{},[7539,7543,7552,7556,7565,7568,7577,7580,7589],{"data":7540,"marks":7541,"value":7542,"nodeType":865},{},[],"ConsentFix got a pretty awesome response from the community in a very short space of time. Within days, ",{"data":7544,"content":7546,"nodeType":905},{"uri":7545},"https://www.youtube.com/watch?v=AAiiIY-Soak",[7547],{"data":7548,"marks":7549,"value":7551,"nodeType":865},{},[7550],{"type":1070},"John Hammond shared a new and improved version of the technique",{"data":7553,"marks":7554,"value":7555,"nodeType":865},{},[]," that he’d spun up in his own lab, while security researchers from ",{"data":7557,"content":7559,"nodeType":905},{"uri":7558},"https://medium.com/@nitashathakur/consentfix-poc-how-the-attack-works-end-to-end-4f8b656f977d",[7560],{"data":7561,"marks":7562,"value":7564,"nodeType":865},{},[7563],{"type":1070},"Microsoft",{"data":7566,"marks":7567,"value":7148,"nodeType":865},{},[],{"data":7569,"content":7571,"nodeType":905},{"uri":7570},"https://www.glueckkanja.com/en/posts/2025-12-31-vulnerability-consentfix",[7572],{"data":7573,"marks":7574,"value":7576,"nodeType":865},{},[7575],{"type":1070},"Glueck Kanja",{"data":7578,"marks":7579,"value":1454,"nodeType":865},{},[],{"data":7581,"content":7583,"nodeType":905},{"uri":7582},"https://msendpointmgr.com/2026/01/08/consentfix-quickfix/",[7584],{"data":7585,"marks":7586,"value":7588,"nodeType":865},{},[7587],{"type":1070},"other individual contributors",{"data":7590,"marks":7591,"value":7592,"nodeType":865},{},[]," all shared analysis and recommendations. ",{"data":7594,"content":7595,"nodeType":866},{},[7596],{"data":7597,"marks":7598,"value":7599,"nodeType":865},{},[],"In this blog, we’re sharing some new insights on the campaign, pulling together some of the top recommendations and resources shared across the community, and predicting what the future holds for this novel technique as it quickly enters the mainstream. ",{"data":7601,"content":7602,"nodeType":866},{},[7603],{"data":7604,"marks":7605,"value":7606,"nodeType":865},{},[],"First though, let’s quickly recap what ConsentFix is and how it works. ",{"data":7608,"content":7609,"nodeType":879},{},[],{"data":7611,"content":7612,"nodeType":889},{},[7613],{"data":7614,"marks":7615,"value":7617,"nodeType":865},{},[7616],{"type":887},"ConsentFix 101",{"data":7619,"content":7620,"nodeType":866},{},[7621],{"data":7622,"marks":7623,"value":7624,"nodeType":865},{},[],"ConsentFix is an attack technique that prompts the victim to share an OAuth authorization code with an attacker via a phishing page. The attacker then enters this code into a target application on their own device in order to complete the authorization handshake and take over the account. ",{"data":7626,"content":7627,"nodeType":866},{},[7628],{"data":7629,"marks":7630,"value":7631,"nodeType":865},{},[],"By hijacking OAuth, attackers can effectively bypass identity-layer controls like passwords and MFA — even phishing resistant authentication methods like passkeys have no impact on this attack, because it sidesteps the authentication process altogether. ",{"data":7633,"content":7634,"nodeType":866},{},[7635,7639,7648,7652,7660,7664,7673,7677,7685],{"data":7636,"marks":7637,"value":7638,"nodeType":865},{},[],"OAuth abuse attacks are not new. Techniques like ",{"data":7640,"content":7642,"nodeType":905},{"uri":7641},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/consent_phishing/description.md",[7643],{"data":7644,"marks":7645,"value":7647,"nodeType":865},{},[7646],{"type":1070},"consent phishing",{"data":7649,"marks":7650,"value":7651,"nodeType":865},{},[]," and ",{"data":7653,"content":7655,"nodeType":905},{"uri":7654},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/device_code_phishing/description.md",[7656],{"data":7657,"marks":7658,"value":1984,"nodeType":865},{},[7659],{"type":1070},{"data":7661,"marks":7662,"value":7663,"nodeType":865},{},[]," have been around for some time. However, these mainly focus on connecting your primary workspace account (e.g. Microsoft, Google, etc.) to a fraudulent, attacker-controlled application. But this is becoming increasingly difficult in core enterprise cloud environments like Azure due to ",{"data":7665,"content":7667,"nodeType":905},{"uri":7666},"https://learn.microsoft.com/en-us/microsoft-365/admin/misc/user-consent?view=o365-worldwide",[7668],{"data":7669,"marks":7670,"value":7672,"nodeType":865},{},[7671],{"type":1070},"stricter default configs",{"data":7674,"marks":7675,"value":7676,"nodeType":865},{},[],". That said, device code phishing still featured prominently in the recent ",{"data":7678,"content":7679,"nodeType":905},{"uri":2644},[7680],{"data":7681,"marks":7682,"value":7684,"nodeType":865},{},[7683],{"type":1070},"high-profile Salesforce attacks in 2025",{"data":7686,"marks":7687,"value":1193,"nodeType":865},{},[],{"data":7689,"content":7690,"nodeType":2315},{},[7691],{"data":7692,"marks":7693,"value":7695,"nodeType":865},{},[7694],{"type":887},"What makes ConsentFix so dangerous?",{"data":7697,"content":7698,"nodeType":866},{},[7699],{"data":7700,"marks":7701,"value":7702,"nodeType":865},{},[],"Unlike typical OAuth attacks, the novel ConsentFix approach enabled the attacker to target different types of application to what they usually go after — with big implications for detection and response. In this case, the attacker:",{"data":7704,"content":7705,"nodeType":2718},{},[7706,7716],{"data":7707,"content":7708,"nodeType":2654},{},[7709],{"data":7710,"content":7711,"nodeType":866},{},[7712],{"data":7713,"marks":7714,"value":7715,"nodeType":865},{},[],"Specifically targeted first-party Microsoft apps that cannot be restricted in the same way as third-party applications, and are pre-consented in every tenant (meaning users can authenticate to them without admin approval). ",{"data":7717,"content":7718,"nodeType":2654},{},[7719],{"data":7720,"content":7721,"nodeType":866},{},[7722],{"data":7723,"marks":7724,"value":7725,"nodeType":865},{},[],"Leveraged legacy scopes that are outside the scope of default logging to evade detection, and targeted scopes with known Conditional Access policy exclusions.",{"data":7727,"content":7728,"nodeType":866},{},[7729],{"data":7730,"marks":7731,"value":7732,"nodeType":865},{},[],"This means that default controls you’d expect to block malicious OAuth grants don’t apply, you may not have logging enabled to detect it if it did happen to you, and to top it off, conditional access policy exclusions mean that many organizations’ expected controls don’t work as intended in this case. ",{"data":7734,"content":7735,"nodeType":879},{},[],{"data":7737,"content":7738,"nodeType":889},{},[7739],{"data":7740,"marks":7741,"value":7743,"nodeType":865},{},[7742],{"type":887},"ConsentFix campaign recap",{"data":7745,"content":7746,"nodeType":866},{},[7747],{"data":7748,"marks":7749,"value":7750,"nodeType":865},{},[],"Let’s quickly recap how the ConsentFix campaign was implemented. ",{"data":7752,"content":7753,"nodeType":866},{},[7754],{"data":7755,"marks":7756,"value":7757,"nodeType":865},{},[],"The victim is served a page which requires that they verify that they are human by pasting a URL into the phishing page.",{"data":7759,"content":7760,"nodeType":866},{},[7761],{"data":7762,"marks":7763,"value":7764,"nodeType":865},{},[],"Clicking the “Sign In” button opens a legitimate Microsoft login page. If the user is already logged in (which they likely are if working in their normal browser) their account information is already pre-populated and they won’t need to authenticate again. ",{"data":7766,"content":7767,"nodeType":866},{},[7768],{"data":7769,"marks":7770,"value":7771,"nodeType":865},{},[],"Selecting their account redirects them to a localhost URL containing an OAuth authorization code — this is what they then post into the original phishing page to complete the attack. ",{"data":7773,"content":7774,"nodeType":866},{},[7775],{"data":7776,"marks":7777,"value":7778,"nodeType":865},{},[],"Once the attacker gets the URL, they can exchange it for an access token or refresh token for the particular application being targeted — in this case, Azure CLI.",{"data":7780,"content":7781,"nodeType":866},{},[7782],{"data":7783,"marks":7784,"value":7785,"nodeType":865},{},[],"The TL;DR is that the attacker is manually completing an authorization flow that happens when a user logs into Azure CLI — a a command line client that provides you with the ability to easily manage your Azure AD / Entra ID environment. Except in this case, they’re taking the victim’s information to log in on the attacker’s device instead. ",{"data":7787,"content":7791,"nodeType":875},{"target":7788},{"sys":7789},{"id":7790,"type":872,"linkType":873},"1eZOs7hXi9FzCE92QEP6xh",[],{"data":7793,"content":7794,"nodeType":2315},{},[7795],{"data":7796,"marks":7797,"value":7799,"nodeType":865},{},[7798],{"type":887},"Latest campaign details",{"data":7801,"content":7802,"nodeType":866},{},[7803],{"data":7804,"marks":7805,"value":7806,"nodeType":865},{},[],"Since we shared our blog post, we’ve had a number of additional details come to light about the campaign, which we’ve continued to track. ",{"data":7808,"content":7809,"nodeType":866},{},[7810,7814,7822],{"data":7811,"marks":7812,"value":7813,"nodeType":865},{},[],"It appears to be linked to Russian state-affiliated APT29, as corroborated by threat researchers we’ve been collaborating with. This is consistent with the ",{"data":7815,"content":7816,"nodeType":905},{"uri":1907},[7817],{"data":7818,"marks":7819,"value":7821,"nodeType":865},{},[7820],{"type":1070},"stealthy tactics we observed",{"data":7823,"marks":7824,"value":7825,"nodeType":865},{},[],", which go far beyond the run-of-the-mill detection evasion techniques we see used in criminal phishing campaigns. ",{"data":7827,"content":7828,"nodeType":866},{},[7829,7833,7842],{"data":7830,"marks":7831,"value":7832,"nodeType":865},{},[],"It shares many similarities with, and appears to be an evolution of, ",{"data":7834,"content":7836,"nodeType":905},{"uri":7835},"https://www.volexity.com/blog/2025/12/04/dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phishing-attacks/",[7837],{"data":7838,"marks":7839,"value":7841,"nodeType":865},{},[7840],{"type":1070},"this Russia-affiliated campaign identified by Volexity",{"data":7843,"marks":7844,"value":7845,"nodeType":865},{},[]," that featured a manual version of the attack — where they victim was social engineered via email into opening the Microsoft URL, copying the localhost response, and sending it back to the attacker via email. ",{"data":7847,"content":7848,"nodeType":879},{},[],{"data":7850,"content":7851,"nodeType":889},{},[7852],{"data":7853,"marks":7854,"value":7856,"nodeType":865},{},[7855],{"type":887},"Top contributions from the community",{"data":7858,"content":7859,"nodeType":866},{},[7860],{"data":7861,"marks":7862,"value":7863,"nodeType":865},{},[],"As we mentioned earlier, the community response to ConsentFix has been incredible. ",{"data":7865,"content":7866,"nodeType":866},{},[7867],{"data":7868,"marks":7869,"value":7870,"nodeType":865},{},[],"As ever, you get a lot of vendors covering the attack technique with “install our product” as the recommendation. This is to be expected, but it’s misleading when some of these vendors are pushing EDR products that would have absolutely no way of detecting or blocking the attack. ",{"data":7872,"content":7873,"nodeType":866},{},[7874],{"data":7875,"marks":7876,"value":7877,"nodeType":865},{},[],"But cutting through the marketing, a lot of really great resources and recommendations were shared. ",{"data":7879,"content":7880,"nodeType":2315},{},[7881],{"data":7882,"marks":7883,"value":7885,"nodeType":865},{},[7884],{"type":887},"V2.0 released by John Hammond",{"data":7887,"content":7888,"nodeType":866},{},[7889,7893,7901],{"data":7890,"marks":7891,"value":7892,"nodeType":865},{},[],"Within days, John Hammond ",{"data":7894,"content":7895,"nodeType":905},{"uri":7545},[7896],{"data":7897,"marks":7898,"value":7900,"nodeType":865},{},[7899],{"type":1070},"posted about ConsentFix on his Youtube channel",{"data":7902,"marks":7903,"value":7904,"nodeType":865},{},[],", where he showed off a slick improvement on the ConsentFix implementation used by attackers. In his version, the URL containing the Microsoft authorization code was generated in a pop-up browser window that could simply be drag-and-dropped into the phishing page. ",{"data":7906,"content":7907,"nodeType":866},{},[7908],{"data":7909,"marks":7910,"value":7911,"nodeType":865},{},[],"This implementation is way smoother, making it much more likely that a victim would fall for it. And this took a matter of days… ",{"data":7913,"content":7917,"nodeType":875},{"target":7914},{"sys":7915},{"id":7916,"type":872,"linkType":873},"59tfJDRhGThKD48Wjg7uY2",[],{"data":7919,"content":7920,"nodeType":2315},{},[7921],{"data":7922,"marks":7923,"value":7925,"nodeType":865},{},[7924],{"type":887},"Additional vulnerable first-party apps identified",{"data":7927,"content":7928,"nodeType":866},{},[7929,7933,7942],{"data":7930,"marks":7931,"value":7932,"nodeType":865},{},[],"Fabian Bader and Dirk-jan Mollema from Glueck Kanja have ",{"data":7934,"content":7936,"nodeType":905},{"uri":7935},"https://entrascopes.com/?bypass=true&authcodeFix=true",[7937],{"data":7938,"marks":7939,"value":7941,"nodeType":865},{},[7940],{"type":1070},"shared a great resource",{"data":7943,"marks":7944,"value":7945,"nodeType":865},{},[]," on wider first-party apps that are vulnerable to ConsentFix. ",{"data":7947,"content":7948,"nodeType":866},{},[7949,7953,7962],{"data":7950,"marks":7951,"value":7952,"nodeType":865},{},[],"In total, there are 11 apps vulnerable to ConsentFix that also have known ",{"data":7954,"content":7956,"nodeType":905},{"uri":7955},"https://cloudbrothers.info/conditional-access-bypasses/#documented-bypasses",[7957],{"data":7958,"marks":7959,"value":7961,"nodeType":865},{},[7960],{"type":1070},"Conditional Access exclusions",{"data":7963,"marks":7964,"value":7965,"nodeType":865},{},[]," (either for the app generally, or when specific scopes are requested for the app):",{"data":7967,"content":7968,"nodeType":2718},{},[7969,7979,7989,7999,8009,8019,8029,8039,8049,8059,8069],{"data":7970,"content":7971,"nodeType":2654},{},[7972],{"data":7973,"content":7974,"nodeType":866},{},[7975],{"data":7976,"marks":7977,"value":7978,"nodeType":865},{},[],"Microsoft Azure CLI: 04b07795-8ddb-461a-bbee-02f9e1bf7b46",{"data":7980,"content":7981,"nodeType":2654},{},[7982],{"data":7983,"content":7984,"nodeType":866},{},[7985],{"data":7986,"marks":7987,"value":7988,"nodeType":865},{},[],"Microsoft Azure PowerShell: 1950a258-227b-4e31-a9cf-717495945fc2",{"data":7990,"content":7991,"nodeType":2654},{},[7992],{"data":7993,"content":7994,"nodeType":866},{},[7995],{"data":7996,"marks":7997,"value":7998,"nodeType":865},{},[],"Microsoft Teams: 1fec8e78-bce4-4aaf-ab1b-5451cc387264",{"data":8000,"content":8001,"nodeType":2654},{},[8002],{"data":8003,"content":8004,"nodeType":866},{},[8005],{"data":8006,"marks":8007,"value":8008,"nodeType":865},{},[],"Microsoft Whiteboard Client: 57336123-6e14-4acc-8dcf-287b6088aa28",{"data":8010,"content":8011,"nodeType":2654},{},[8012],{"data":8013,"content":8014,"nodeType":866},{},[8015],{"data":8016,"marks":8017,"value":8018,"nodeType":865},{},[],"Microsoft Flow Mobile PROD-GCCH-CN: 57fcbcfa-7cee-4eb1-8b25-12d2030b4ee0",{"data":8020,"content":8021,"nodeType":2654},{},[8022],{"data":8023,"content":8024,"nodeType":866},{},[8025],{"data":8026,"marks":8027,"value":8028,"nodeType":865},{},[],"Enterprise Roaming and Backup: 60c8bde5-3167-4f92-8fdb-059f6176dc0",{"data":8030,"content":8031,"nodeType":2654},{},[8032],{"data":8033,"content":8034,"nodeType":866},{},[8035],{"data":8036,"marks":8037,"value":8038,"nodeType":865},{},[],"Visual Studio: 872cd9fa-d31f-45e0-9eab-6e460a02d1f1",{"data":8040,"content":8041,"nodeType":2654},{},[8042],{"data":8043,"content":8044,"nodeType":866},{},[8045],{"data":8046,"marks":8047,"value":8048,"nodeType":865},{},[],"Aadrm Admin Powershell: 90f610bf-206d-4950-b61d-37fa6fd1b224",{"data":8050,"content":8051,"nodeType":2654},{},[8052],{"data":8053,"content":8054,"nodeType":866},{},[8055],{"data":8056,"marks":8057,"value":8058,"nodeType":865},{},[],"Microsoft SharePoint Online Management Shell: 9bc3ab49-b65d-410a-85ad-de819febfddc",{"data":8060,"content":8061,"nodeType":2654},{},[8062],{"data":8063,"content":8064,"nodeType":866},{},[8065],{"data":8066,"marks":8067,"value":8068,"nodeType":865},{},[],"Microsoft Power Query for Excel: a672d62c-fc7b-4e81-a576-e60dc46e951d",{"data":8070,"content":8071,"nodeType":2654},{},[8072],{"data":8073,"content":8074,"nodeType":866},{},[8075],{"data":8076,"marks":8077,"value":8078,"nodeType":865},{},[],"Visual Studio Code: aebc6443-996d-45c2-90f0-388ff96faa56",{"data":8080,"content":8081,"nodeType":879},{},[],{"data":8083,"content":8084,"nodeType":889},{},[8085],{"data":8086,"marks":8087,"value":8089,"nodeType":865},{},[8088],{"type":887},"Predictions for ConsentFix",{"data":8091,"content":8092,"nodeType":866},{},[8093],{"data":8094,"marks":8095,"value":8096,"nodeType":865},{},[],"Based on the speed at which new iterations on the ConsentFix technique were shared by security researchers, and the breadth of apps and possible scopes that can be leveraged, both red teams and criminals will inevitably adopt ConsentFix into their arsenal of TTPs in the near future. It is likely that new ConsentFix variants will emerge imminently (if not already in circulation). ",{"data":8098,"content":8099,"nodeType":866},{},[8100],{"data":8101,"marks":8102,"value":8103,"nodeType":865},{},[],"All security teams responsible for protecting Microsoft environments should ensure that monitoring controls and mitigations are put in place as a matter of high priority. ",{"data":8105,"content":8106,"nodeType":879},{},[],{"data":8108,"content":8109,"nodeType":889},{},[8110],{"data":8111,"marks":8112,"value":8114,"nodeType":865},{},[8113],{"type":887},"Updated recommendations for security teams",{"data":8116,"content":8117,"nodeType":866},{},[8118],{"data":8119,"marks":8120,"value":8121,"nodeType":865},{},[],"As an entirely browser-native attack technique, many traditional security tools and data sources are of limited use when it comes to detecting or pre-emptively blocking this attack. At the same time, the attack exploits default Microsoft security configs to evade both prevention and detection controls.",{"data":8123,"content":8124,"nodeType":866},{},[8125],{"data":8126,"marks":8127,"value":8128,"nodeType":865},{},[],"To be able to tackle modern attacks like ConsentFix that occur entirely within the browser context, it is vital that organizations look to monitor the browser as a detection surface, hunt for signs of malicious activity, and block attacks in real-time — in the same way that you would expect EDR to work for endpoint attacks. ",{"data":8130,"content":8131,"nodeType":866},{},[8132],{"data":8133,"marks":8134,"value":8135,"nodeType":865},{},[],"For organizations relying on Microsoft logging as the sole line of defense against this attack, there are some new recommendations to add to the list thanks to the community response: ",{"data":8137,"content":8138,"nodeType":2718},{},[8139,8162,8172,8193],{"data":8140,"content":8141,"nodeType":2654},{},[8142],{"data":8143,"content":8144,"nodeType":866},{},[8145,8149,8158],{"data":8146,"marks":8147,"value":8148,"nodeType":865},{},[],"Ensure that logging for the deprecated ",{"data":8150,"content":8152,"nodeType":905},{"uri":8151},"https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/aadgraphactivitylogs",[8153],{"data":8154,"marks":8155,"value":8157,"nodeType":865},{},[8156],{"type":1070},"AADGraphActivityLogs",{"data":8159,"marks":8160,"value":8161,"nodeType":865},{},[]," is enabled.",{"data":8163,"content":8164,"nodeType":2654},{},[8165],{"data":8166,"content":8167,"nodeType":866},{},[8168],{"data":8169,"marks":8170,"value":8171,"nodeType":865},{},[],"Hunt in logs for the Application IDs highlighted above, along with the Resource IDs for Windows Azure Active Directory (00000002-0000-0000-c000-000000000000) and Microsoft Intune Checkin (26a4ae64-5862-427f-a9b0-044e62572a4f)",{"data":8173,"content":8174,"nodeType":2654},{},[8175],{"data":8176,"content":8177,"nodeType":866},{},[8178,8181,8189],{"data":8179,"marks":8180,"value":21,"nodeType":865},{},[],{"data":8182,"content":8183,"nodeType":905},{"uri":7582},[8184],{"data":8185,"marks":8186,"value":8188,"nodeType":865},{},[8187],{"type":1070},"Create Service Principals for each of the vulnerable apps and restrict the users that are authorized to access them",{"data":8190,"marks":8191,"value":8192,"nodeType":865},{},[]," to reduce the attack surface of users that can be phished with this method.",{"data":8194,"content":8195,"nodeType":2654},{},[8196],{"data":8197,"content":8198,"nodeType":866},{},[8199],{"data":8200,"marks":8201,"value":8202,"nodeType":865},{},[],"Block access to CLI tools via Conditional Access policy and issue exclusions for authorized users/groups. ",{"data":8204,"content":8205,"nodeType":866},{},[8206,8210,8219,8223,8230],{"data":8207,"marks":8208,"value":8209,"nodeType":865},{},[],"Additional resources that may be of use include community-created ",{"data":8211,"content":8213,"nodeType":905},{"uri":8212},"https://github.com/elastic/detection-rules/pull/5485",[8214],{"data":8215,"marks":8216,"value":8218,"nodeType":865},{},[8217],{"type":1070},"Elastic detection rules",{"data":8220,"marks":8221,"value":8222,"nodeType":865},{},[]," for ConsentFix and further mitigation and hunting guidance from ",{"data":8224,"content":8225,"nodeType":905},{"uri":7570},[8226],{"data":8227,"marks":8228,"value":7576,"nodeType":865},{},[8229],{"type":1070},{"data":8231,"marks":8232,"value":1711,"nodeType":865},{},[],{"data":8234,"content":8235,"nodeType":879},{},[],{"data":8237,"content":8238,"nodeType":889},{},[8239],{"data":8240,"marks":8241,"value":8243,"nodeType":865},{},[8242],{"type":887},"Learn more about Push Security",{"data":8245,"content":8246,"nodeType":866},{},[8247],{"data":8248,"marks":8249,"value":8250,"nodeType":865},{},[],"Even though this was a brand new technique, Push intercepted this attack and shut it down before customers could interact with it. ",{"data":8252,"content":8253,"nodeType":866},{},[8254],{"data":8255,"marks":8256,"value":8257,"nodeType":865},{},[],"Push tackles browser-based attacks using behavioral threat detection controls, powered by deep browser telemetry, to provide broad detection and blocking capabilities against attacks happening in the browser. This means analyzing the end-to-end process of a webpage loading/running in the browser, and how the user interacts with the page, to spot universal indicators of bad activity. ",{"data":8259,"content":8260,"nodeType":866},{},[8261],{"data":8262,"marks":8263,"value":8264,"nodeType":865},{},[],"This is the only reliable way to detect malicious websites in a world where IoC-based detections are trivial for attackers to get around. Rather than playing known-bad whac-a-mole, Push detects and blocks even zero-day browser threats in real time.",{"data":8266,"content":8267,"nodeType":866},{},[8268],{"data":8269,"marks":8270,"value":8271,"nodeType":865},{},[],"Push stops browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, ConsentFix, and session hijacking. You don’t need to wait until it all goes wrong either — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":8273,"content":8274,"nodeType":866},{},[8275,8279,8287,8291,8298],{"data":8276,"marks":8277,"value":8278,"nodeType":865},{},[],"To learn more about Push, ",{"data":8280,"content":8281,"nodeType":905},{"uri":7323},[8282],{"data":8283,"marks":8284,"value":8286,"nodeType":865},{},[8285],{"type":1070},"check out our latest product overview",{"data":8288,"marks":8289,"value":8290,"nodeType":865},{},[]," or ",{"data":8292,"content":8293,"nodeType":905},{"uri":1512},[8294],{"data":8295,"marks":8296,"value":7352,"nodeType":865},{},[8297],{"type":1070},{"data":8299,"marks":8300,"value":1193,"nodeType":865},{},[],{"data":8302,"content":8306,"nodeType":875},{"target":8303},{"sys":8304},{"id":8305,"type":872,"linkType":873},"4D7zpYAc1tTEAmn2hpkWPe",[],{"data":8308,"content":8309,"nodeType":866},{},[8310],{"data":8311,"marks":8312,"value":21,"nodeType":865},{},[],"ConsentFix debrief: latest community insights, recommendations, and predictions","New insights on the ConsentFix campaign stopped by Push.","2026-01-14T00:00:00.000Z","consentfix-debrief",{"items":8318},[8319,8321],{"sys":8320,"name":342},{"id":3008},{"sys":8322,"name":2144},{"id":2143},{"items":8324},[8325],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":8326},{"url":3016},{"__typename":1544,"sys":8328,"content":8330,"title":9630,"synopsis":9631,"hashTags":59,"publishedDate":9632,"slug":9633,"tagsCollection":9634,"authorsCollection":9640},{"id":8329},"37KWV8V5L3aNZBSx6JMd0Z",{"json":8331},{"data":8332,"content":8333,"nodeType":1522},{},[8334,8341,8348,8412,8419,8488,8494,8501,8508,8511,8518,8525,8532,8635,8654,8661,8703,8710,8717,8724,8757,8763,8795,8801,8808,8815,8848,8868,8871,8878,8884,8915,8922,8929,8936,8942,8949,8955,8970,9013,9019,9039,9042,9049,9055,9075,9082,9113,9133,9139,9160,9167,9174,9234,9241,9247,9262,9276,9297,9303,9324,9331,9334,9341,9347,9354,9361,9382,9388,9409,9415,9422,9455,9473,9476,9483,9489,9496,9517,9523,9538,9544,9551,9558,9577,9580,9587,9594,9601],{"data":8335,"content":8336,"nodeType":866},{},[8337],{"data":8338,"marks":8339,"value":8340,"nodeType":865},{},[],"Looking back over the year’s headlines and trending TTPs, it’s clear that 2025 was the year that browser-based account takeover techniques made the leap into the mainstream.",{"data":8342,"content":8343,"nodeType":866},{},[8344],{"data":8345,"marks":8346,"value":8347,"nodeType":865},{},[],"A few stats tell the story …",{"data":8349,"content":8350,"nodeType":2718},{},[8351,8372,8391],{"data":8352,"content":8353,"nodeType":2654},{},[8354],{"data":8355,"content":8356,"nodeType":866},{},[8357,8361,8368],{"data":8358,"marks":8359,"value":8360,"nodeType":865},{},[],"Identity-based attacks surged by 32% over the last year, and 97% of identity attacks were password-based, driven by a combination of credential leaks and infostealer malware. (",{"data":8362,"content":8364,"nodeType":905},{"uri":8363},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=1",[8365],{"data":8366,"marks":8367,"value":7564,"nodeType":865},{},[],{"data":8369,"marks":8370,"value":8371,"nodeType":865},{},[],")",{"data":8373,"content":8374,"nodeType":2654},{},[8375],{"data":8376,"content":8377,"nodeType":866},{},[8378,8382,8388],{"data":8379,"marks":8380,"value":8381,"nodeType":865},{},[],"ClickFix was the most common initial point of access for adversaries in the past year, accounting for a whopping 47% of observed attacks. (",{"data":8383,"content":8384,"nodeType":905},{"uri":8363},[8385],{"data":8386,"marks":8387,"value":7564,"nodeType":865},{},[],{"data":8389,"marks":8390,"value":8371,"nodeType":865},{},[],{"data":8392,"content":8393,"nodeType":2654},{},[8394],{"data":8395,"content":8396,"nodeType":866},{},[8397,8401,8409],{"data":8398,"marks":8399,"value":8400,"nodeType":865},{},[],"Pure malware-based attacks declined, as adversaries continued to shift from targeting endpoints to corporate identities. In the last year-plus, 79% of detections were malware-free, up from 40% in 2019. And abuse of valid accounts was responsible for more than one-third of all cloud-related incidents. (",{"data":8402,"content":8404,"nodeType":905},{"uri":8403},"https://www.crowdstrike.com/en-gb/global-threat-report/",[8405],{"data":8406,"marks":8407,"value":8408,"nodeType":865},{},[],"Crowdstrike",{"data":8410,"marks":8411,"value":8371,"nodeType":865},{},[],{"data":8413,"content":8414,"nodeType":866},{},[8415],{"data":8416,"marks":8417,"value":8418,"nodeType":865},{},[],"… and so do the headlines from 2025:",{"data":8420,"content":8421,"nodeType":2718},{},[8422,8441,8469],{"data":8423,"content":8424,"nodeType":2654},{},[8425],{"data":8426,"content":8427,"nodeType":866},{},[8428,8432,8437],{"data":8429,"marks":8430,"value":8431,"nodeType":865},{},[],"Attackers stole over ",{"data":8433,"marks":8434,"value":8436,"nodeType":865},{},[8435],{"type":887},"1.5 billion records",{"data":8438,"marks":8439,"value":8440,"nodeType":865},{},[]," from an estimated 1,000+ Salesforce tenants by exploiting integrations (Salesloft, Gainsight), phishing credentials, and by tricking users into installing a malicious OAuth app.",{"data":8442,"content":8443,"nodeType":2654},{},[8444],{"data":8445,"content":8446,"nodeType":866},{},[8447,8451,8456,8460,8465],{"data":8448,"marks":8449,"value":8450,"nodeType":865},{},[],"Marks & Spencer was hit with a help desk scam that led to a compromised Microsoft Entra account, followed by a ransomware deployment resulting in months of disruption, ",{"data":8452,"marks":8453,"value":8455,"nodeType":865},{},[8454],{"type":887},"$400M",{"data":8457,"marks":8458,"value":8459,"nodeType":865},{},[]," in lost profits, and around ",{"data":8461,"marks":8462,"value":8464,"nodeType":865},{},[8463],{"type":887},"$1.3B",{"data":8466,"marks":8467,"value":8468,"nodeType":865},{},[]," wiped off their stock market valuation at one stage.",{"data":8470,"content":8471,"nodeType":2654},{},[8472],{"data":8473,"content":8474,"nodeType":866},{},[8475,8479,8484],{"data":8476,"marks":8477,"value":8478,"nodeType":865},{},[],"Jaguar Land Rover was compromised via highly privileged admin accounts — another help desk scam targeting workforce credentials for initial access — resulting in months of disruption that led the UK government to underwrite a ",{"data":8480,"marks":8481,"value":8483,"nodeType":865},{},[8482],{"type":887},"$1.5B",{"data":8485,"marks":8486,"value":8487,"nodeType":865},{},[]," loan to alleviate the supply chain impact. This was the most economically consequential cyber attack yet recorded in a G7 economy.",{"data":8489,"content":8493,"nodeType":875},{"target":8490},{"sys":8491},{"id":8492,"type":872,"linkType":873},"v5YYnjP2NViOh6Ucxp2Fe",[],{"data":8495,"content":8496,"nodeType":866},{},[8497],{"data":8498,"marks":8499,"value":8500,"nodeType":865},{},[],"At Push, we’ve been closely tracking the evolution of browser-based attacks. Looking back at 2025, we’ve seen a notable increase in the sophistication and frequency of modern attack techniques methods like ClickFix, commodified phish kits that bypass MFA, malicious browser extensions, and many more. (Writing phish kit teardowns for the Push blog is practically a full-time job now.)",{"data":8502,"content":8503,"nodeType":866},{},[8504],{"data":8505,"marks":8506,"value":8507,"nodeType":865},{},[],"In this article, we’ll take a look at how real-world attacks and our own research drove the features we delivered for Push customers this year to take the fight to adversaries.",{"data":8509,"content":8510,"nodeType":879},{},[],{"data":8512,"content":8513,"nodeType":889},{},[8514],{"data":8515,"marks":8516,"value":8517,"nodeType":865},{},[],"Detecting and blocking increasingly sophisticated phishing-as-a-service tools",{"data":8519,"content":8520,"nodeType":2315},{},[8521],{"data":8522,"marks":8523,"value":8524,"nodeType":865},{},[],"What happened",{"data":8526,"content":8527,"nodeType":866},{},[8528],{"data":8529,"marks":8530,"value":8531,"nodeType":865},{},[],"The current state of the art for phishing centers on three core developments:",{"data":8533,"content":8534,"nodeType":2718},{},[8535,8565,8606],{"data":8536,"content":8537,"nodeType":2654},{},[8538],{"data":8539,"content":8540,"nodeType":866},{},[8541,8546,8550,8561],{"data":8542,"marks":8543,"value":8545,"nodeType":865},{},[8544],{"type":887},"Detection evasion: ",{"data":8547,"marks":8548,"value":8549,"nodeType":865},{},[],"Adversaries demonstrated a ",{"data":8551,"content":8555,"nodeType":8560},{"target":8552},{"sys":8553},{"id":8554,"type":872,"linkType":873},"4XZ6qCr8pjJvcD7hi09x2Y",[8556],{"data":8557,"marks":8558,"value":8559,"nodeType":865},{},[],"creative array of approaches","entry-hyperlink",{"data":8562,"marks":8563,"value":8564,"nodeType":865},{},[]," this year to hide their intentions from end-users and defenders, using methods such as sending phishing emails from legitimate services; serving phishing pages via malvertising and SEO poisoning; and obfuscating URLs. More sophisticated techniques used page-level obfuscation, cross-domain iframes, single-use links, and legitimate OIDC logins to evade detection and analysis from traditional tools.",{"data":8566,"content":8567,"nodeType":2654},{},[8568],{"data":8569,"content":8570,"nodeType":866},{},[8571,8576,8580,8589,8593,8603],{"data":8572,"marks":8573,"value":8575,"nodeType":865},{},[8574],{"type":887},"Multi-channel delivery of lures:",{"data":8577,"marks":8578,"value":8579,"nodeType":865},{},[]," Adversaries proved the truism of “phishing doesn’t just happen in the mailbox” this year by increasing their observed use of ",{"data":8581,"content":8585,"nodeType":8560},{"target":8582},{"sys":8583},{"id":8584,"type":872,"linkType":873},"72lLmy0CXnOp3LWOdcUguX",[8586],{"data":8587,"marks":8588,"value":441,"nodeType":865},{},[],{"data":8590,"marks":8591,"value":8592,"nodeType":865},{},[]," and SEO poisoning — techniques that place malicious pages within trusted contexts like the Google search engine results page — as well as the use of social media services like LinkedIn to ",{"data":8594,"content":8598,"nodeType":8560},{"target":8595},{"sys":8596},{"id":8597,"type":872,"linkType":873},"2yEhB2gFC2TJDLquVP3cg2",[8599],{"data":8600,"marks":8601,"value":8602,"nodeType":865},{},[],"deliver phishing lures",{"data":8604,"marks":8605,"value":6352,"nodeType":865},{},[],{"data":8607,"content":8608,"nodeType":2654},{},[8609],{"data":8610,"content":8611,"nodeType":866},{},[8612,8617,8621,8631],{"data":8613,"marks":8614,"value":8616,"nodeType":865},{},[8615],{"type":887},"Commodification of phishing toolkits:",{"data":8618,"marks":8619,"value":8620,"nodeType":865},{},[]," Phishing-as-a-service (PhaaS) kits have become another SaaS with their own supply chain, including developers of malicious tooling, operators who run the campaigns, and brokers who sell stolen credentials and tokens. The incentives for attackers are clear: quick ROI from targeting workforce identities, and out-of-the-box tools that make it easier to efficiently spin up new campaigns or try new techniques. As with any SaaS offering, the customer (attackers, in this case) benefits from rapid innovations they didn’t have to build. We saw this recently with the ",{"data":8622,"content":8626,"nodeType":8560},{"target":8623},{"sys":8624},{"id":8625,"type":872,"linkType":873},"6QLonRmBzbj9h88Y7jD0LU",[8627],{"data":8628,"marks":8629,"value":8630,"nodeType":865},{},[],"addition of a browser-in-the-browser (BitB) technique",{"data":8632,"marks":8633,"value":8634,"nodeType":865},{},[]," to the phish kit Sneaky2FA — a change that makes it even more effective.",{"data":8636,"content":8637,"nodeType":866},{},[8638,8642,8650],{"data":8639,"marks":8640,"value":8641,"nodeType":865},{},[],"In 2025, Push researchers tracked how each of these developments expanded in scope and sophistication. Check out our ",{"data":8643,"content":8645,"nodeType":905},{"uri":8644},"https://pushsecurity.github.io/phishing-techniques/",[8646],{"data":8647,"marks":8648,"value":8649,"nodeType":865},{},[],"phishing detection evasion techniques matrix",{"data":8651,"marks":8652,"value":8653,"nodeType":865},{},[]," on Github for more detail. ",{"data":8655,"content":8656,"nodeType":866},{},[8657],{"data":8658,"marks":8659,"value":8660,"nodeType":865},{},[],"The takeaways for security teams?",{"data":8662,"content":8663,"nodeType":2718},{},[8664,8674,8693],{"data":8665,"content":8666,"nodeType":2654},{},[8667],{"data":8668,"content":8669,"nodeType":866},{},[8670],{"data":8671,"marks":8672,"value":8673,"nodeType":865},{},[],"You can’t block your way to safety when adversaries are using the same legitimate apps that your employees use.",{"data":8675,"content":8676,"nodeType":2654},{},[8677],{"data":8678,"content":8679,"nodeType":866},{},[8680,8684,8689],{"data":8681,"marks":8682,"value":8683,"nodeType":865},{},[],"Similarly, while end-user training is important, it’s not reasonable to expect employees to know when a SharePoint document link is malicious when it looks identical to the ones they trust every day — because adversaries ",{"data":8685,"marks":8686,"value":8688,"nodeType":865},{},[8687],{"type":2757},"are using the legitimate service",{"data":8690,"marks":8691,"value":8692,"nodeType":865},{},[],". Push researchers have observed the abuse of hundreds of legitimate services in phishing attacks this year.",{"data":8694,"content":8695,"nodeType":2654},{},[8696],{"data":8697,"content":8698,"nodeType":866},{},[8699],{"data":8700,"marks":8701,"value":8702,"nodeType":865},{},[],"Security solutions need to be able to analyze real-time context and behavior, not rely solely on inferences from secondary characteristics like domain reputation.",{"data":8704,"content":8705,"nodeType":866},{},[8706],{"data":8707,"marks":8708,"value":8709,"nodeType":865},{},[],"Here's what we built to help defend organizations.",{"data":8711,"content":8712,"nodeType":2315},{},[8713],{"data":8714,"marks":8715,"value":8716,"nodeType":865},{},[],"What we built",{"data":8718,"content":8719,"nodeType":866},{},[8720],{"data":8721,"marks":8722,"value":8723,"nodeType":865},{},[],"The feature we built in 2025 that gave us unique insight into these TTPs is Push’s Detections capability. With Detections, you can:",{"data":8725,"content":8726,"nodeType":2718},{},[8727,8737,8747],{"data":8728,"content":8729,"nodeType":2654},{},[8730],{"data":8731,"content":8732,"nodeType":866},{},[8733],{"data":8734,"marks":8735,"value":8736,"nodeType":865},{},[],"Get alerted when Push detects a browser-based attack, and see how the Push agent responded to block the attack. The platform provides a front-end view for quick triage, and you can also pipe the detection events to your SIEM or other platform of choice.",{"data":8738,"content":8739,"nodeType":2654},{},[8740],{"data":8741,"content":8742,"nodeType":866},{},[8743],{"data":8744,"marks":8745,"value":8746,"nodeType":865},{},[],"Review a timeline of the incident: Where a phishing link originated; whether a user entered their credentials; what kind of phishkit was detected; and how Push responded (configurable based on your environment).",{"data":8748,"content":8749,"nodeType":2654},{},[8750],{"data":8751,"content":8752,"nodeType":866},{},[8753],{"data":8754,"marks":8755,"value":8756,"nodeType":865},{},[],"Get actionable telemetry and metadata about an incident, including a screenshot of the malicious page to see exactly what the user saw; intel about the involved domains, including when they were registered and if they’ve been scanned by urlscan before; and the blast radius of an attack, including other apps that shared a password with the potentially compromised account",{"data":8758,"content":8762,"nodeType":875},{"target":8759},{"sys":8760},{"id":8761,"type":872,"linkType":873},"5dygPaG3Gfw4Yeicffv6tV",[],{"data":8764,"content":8765,"nodeType":866},{},[8766,8770,8775,8778,8783,8786,8791],{"data":8767,"marks":8768,"value":8769,"nodeType":865},{},[],"This telemetry — combined with Push’s out-of-the-box controls like ",{"data":8771,"marks":8772,"value":8774,"nodeType":865},{},[8773],{"type":887},"Phishing tool detection",{"data":8776,"marks":8777,"value":7148,"nodeType":865},{},[],{"data":8779,"marks":8780,"value":8782,"nodeType":865},{},[8781],{"type":887},"Cloned login page detection",{"data":8784,"marks":8785,"value":1454,"nodeType":865},{},[],{"data":8787,"marks":8788,"value":8790,"nodeType":865},{},[8789],{"type":887},"Malicious copy and paste detection",{"data":8792,"marks":8793,"value":8794,"nodeType":865},{},[]," (aka ClickFix detection) — give you a seat on the user’s side of the equation, capturing real-time information about what users did and the TTPs of an attack so you can investigate and respond efficiently and confidently.",{"data":8796,"content":8800,"nodeType":875},{"target":8797},{"sys":8798},{"id":8799,"type":872,"linkType":873},"563fJFSgoLDOwSXSQ9Y0MM",[],{"data":8802,"content":8803,"nodeType":866},{},[8804],{"data":8805,"marks":8806,"value":8807,"nodeType":865},{},[],"With the visibility provided by this telemetry across Push’s install base, our R&D and Product teams have rapidly iterated all year on our detections to increase coverage and respond quickly to newly identified attack types.",{"data":8809,"content":8810,"nodeType":866},{},[8811],{"data":8812,"marks":8813,"value":8814,"nodeType":865},{},[],"This year, we also released:",{"data":8816,"content":8817,"nodeType":2718},{},[8818,8828,8838],{"data":8819,"content":8820,"nodeType":2654},{},[8821],{"data":8822,"content":8823,"nodeType":866},{},[8824],{"data":8825,"marks":8826,"value":8827,"nodeType":865},{},[],"Detections for new variants of cloned login pages and AiTM phish kits.",{"data":8829,"content":8830,"nodeType":2654},{},[8831],{"data":8832,"content":8833,"nodeType":866},{},[8834],{"data":8835,"marks":8836,"value":8837,"nodeType":865},{},[],"12+ pre-release detections focused on flagging emerging attacker techniques.",{"data":8839,"content":8840,"nodeType":2654},{},[8841],{"data":8842,"content":8843,"nodeType":866},{},[8844],{"data":8845,"marks":8846,"value":8847,"nodeType":865},{},[],"7+ first-class SIEM and SOAR integrations, to make it simpler to ingest Push telemetry and operationalize it.",{"data":8849,"content":8850,"nodeType":866},{},[8851,8855,8865],{"data":8852,"marks":8853,"value":8854,"nodeType":865},{},[],"Learn more about Push’s detections features in our ",{"data":8856,"content":8860,"nodeType":8560},{"target":8857},{"sys":8858},{"id":8859,"type":872,"linkType":873},"6OFdfAsoPUECeRAetWvedp",[8861],{"data":8862,"marks":8863,"value":8864,"nodeType":865},{},[],"blog article",{"data":8866,"marks":8867,"value":1193,"nodeType":865},{},[],{"data":8869,"content":8870,"nodeType":879},{},[],{"data":8872,"content":8873,"nodeType":889},{},[8874],{"data":8875,"marks":8876,"value":8877,"nodeType":865},{},[],"Detecting and blocking ClickFix-style malicious copy and paste attacks",{"data":8879,"content":8880,"nodeType":2315},{},[8881],{"data":8882,"marks":8883,"value":8524,"nodeType":865},{},[],{"data":8885,"content":8886,"nodeType":866},{},[8887,8891,8899,8903,8911],{"data":8888,"marks":8889,"value":8890,"nodeType":865},{},[],"ClickFix-style attacks left their mark in 2025, quickly becoming one of the most prevalent attack techniques — with ",{"data":8892,"content":8894,"nodeType":905},{"uri":8893},"https://www.scworld.com/news/clickfix-phishing-links-increased-nearly-400-in-12-months-report-says",[8895],{"data":8896,"marks":8897,"value":8898,"nodeType":865},{},[],"estimates",{"data":8900,"marks":8901,"value":8902,"nodeType":865},{},[]," of a 400 percent year-over-year increase, and another ",{"data":8904,"content":8906,"nodeType":905},{"uri":8905},"https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h12025.pdf",[8907],{"data":8908,"marks":8909,"value":8910,"nodeType":865},{},[],"report",{"data":8912,"marks":8913,"value":8914,"nodeType":865},{},[]," documenting a 517 percent growth in just the last 6 months of the year.",{"data":8916,"content":8917,"nodeType":866},{},[8918],{"data":8919,"marks":8920,"value":8921,"nodeType":865},{},[],"What is ClickFix? This attack technique prompts the user to solve some kind of problem or troubleshooting step in the browser — often presented as a CAPTCHA challenge. The key aspect of the attack is that it tricks users into running malicious commands on their device by copying malicious code from the page clipboard and running it locally. (The copy typically occurs  automatically via the page itself, but can also be performed manually by the user.)",{"data":8923,"content":8924,"nodeType":866},{},[8925],{"data":8926,"marks":8927,"value":8928,"nodeType":865},{},[],"These malicious copy and paste attacks are often used to deliver infostealer malware or remote access software, with the attacker’s end goal being stealing session cookies and credentials to facilitate attacks on business apps.",{"data":8930,"content":8931,"nodeType":866},{},[8932],{"data":8933,"marks":8934,"value":8935,"nodeType":865},{},[],"What’s especially challenging about this attack type is that it usually can only be detected after the fact — when a machine is already compromised, or malicious code attempts to execute (if EDR catches it). Even if it is detected, security teams are left flying blind when they try to determine the initial vector for the attack, and which other users might have been targeted.",{"data":8937,"content":8938,"nodeType":2315},{},[8939],{"data":8940,"marks":8941,"value":8716,"nodeType":865},{},[],{"data":8943,"content":8944,"nodeType":866},{},[8945],{"data":8946,"marks":8947,"value":8948,"nodeType":865},{},[],"Because of our position in the browser, Push is uniquely positioned to detect and block browser-native attacks like ClickFix and other forms of malicious copy and paste techniques. So that’s what we built.",{"data":8950,"content":8954,"nodeType":875},{"target":8951},{"sys":8952},{"id":8953,"type":872,"linkType":873},"56jVT7dbNqUGiSRTfTCQw2",[],{"data":8956,"content":8957,"nodeType":866},{},[8958,8962,8966],{"data":8959,"marks":8960,"value":8961,"nodeType":865},{},[],"With our ",{"data":8963,"marks":8964,"value":8790,"nodeType":865},{},[8965],{"type":887},{"data":8967,"marks":8968,"value":8969,"nodeType":865},{},[],", you can:",{"data":8971,"content":8972,"nodeType":2718},{},[8973,8983,8993,9003],{"data":8974,"content":8975,"nodeType":2654},{},[8976],{"data":8977,"content":8978,"nodeType":866},{},[8979],{"data":8980,"marks":8981,"value":8982,"nodeType":865},{},[],"Detect ClickFix-style attacks as soon as they target end-users, regardless of the delivery channel for the lure, or the specifics of the malware type and execution.",{"data":8984,"content":8985,"nodeType":2654},{},[8986],{"data":8987,"content":8988,"nodeType":866},{},[8989],{"data":8990,"marks":8991,"value":8992,"nodeType":865},{},[],"Block these attacks before the malicious code is copied to the clipboard.",{"data":8994,"content":8995,"nodeType":2654},{},[8996],{"data":8997,"content":8998,"nodeType":866},{},[8999],{"data":9000,"marks":9001,"value":9002,"nodeType":865},{},[],"Safely collect the payload for further investigation by your security team, and replace the clipboard contents with safe text as part of the blocking action.",{"data":9004,"content":9005,"nodeType":2654},{},[9006],{"data":9007,"content":9008,"nodeType":866},{},[9009],{"data":9010,"marks":9011,"value":9012,"nodeType":865},{},[],"Capture a detailed timeline of events to see how users were targeted and how the attack unfolded.",{"data":9014,"content":9018,"nodeType":875},{"target":9015},{"sys":9016},{"id":9017,"type":872,"linkType":873},"sALkMt8UbTZ2f34hKvGLj",[],{"data":9020,"content":9021,"nodeType":866},{},[9022,9026,9036],{"data":9023,"marks":9024,"value":9025,"nodeType":865},{},[],"Learn more about ClickFix detection in our ",{"data":9027,"content":9031,"nodeType":8560},{"target":9028},{"sys":9029},{"id":9030,"type":872,"linkType":873},"7jygmadjoz0asAHv7e5PuK",[9032],{"data":9033,"marks":9034,"value":9035,"nodeType":865},{},[],"documentation",{"data":9037,"marks":9038,"value":1193,"nodeType":865},{},[],{"data":9040,"content":9041,"nodeType":879},{},[],{"data":9043,"content":9044,"nodeType":889},{},[9045],{"data":9046,"marks":9047,"value":9048,"nodeType":865},{},[],"Getting ahead of breaches tied to stolen credentials and ghost logins",{"data":9050,"content":9051,"nodeType":2315},{},[9052],{"data":9053,"marks":9054,"value":8524,"nodeType":865},{},[],{"data":9056,"content":9057,"nodeType":866},{},[9058,9062,9072],{"data":9059,"marks":9060,"value":9061,"nodeType":865},{},[],"Starting in November 2024 and continuing through July 2025, adversaries linked to the HELLCAT threat group compromised Jira tenants belonging to 10 organizations using ",{"data":9063,"content":9067,"nodeType":8560},{"target":9064},{"sys":9065},{"id":9066,"type":872,"linkType":873},"gANCbeL9AnxmbGAE5HhyG",[9068],{"data":9069,"marks":9070,"value":9071,"nodeType":865},{},[],"stolen credentials",{"data":9073,"marks":9074,"value":6352,"nodeType":865},{},[],{"data":9076,"content":9077,"nodeType":866},{},[9078],{"data":9079,"marks":9080,"value":9081,"nodeType":865},{},[],"Business-critical applications like Jira are prime targets for attackers, who in this case dumped valuable data and then held it for ransom (or sold it on criminal marketplaces). Of course, this isn’t just a problem for Jira — data from Push’s initial deployment into customer environments shows that lots of critical apps lack basic controls like strong passwords and MFA.",{"data":9083,"content":9084,"nodeType":866},{},[9085,9089,9098,9102,9109],{"data":9086,"marks":9087,"value":9088,"nodeType":865},{},[],"The evolving threat group known as ",{"data":9090,"content":9094,"nodeType":8560},{"target":9091},{"sys":9092},{"id":9093,"type":872,"linkType":873},"2sFCww9xnI8okIxhtOaiY1",[9095],{"data":9096,"marks":9097,"value":2649,"nodeType":865},{},[],{"data":9099,"marks":9100,"value":9101,"nodeType":865},{},[]," has also embraced the use of stolen creds, session cookies, and unprotected local account logins — aka ",{"data":9103,"content":9105,"nodeType":905},{"uri":9104},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/ghost_logins/description.md",[9106],{"data":9107,"marks":9108,"value":950,"nodeType":865},{},[],{"data":9110,"marks":9111,"value":9112,"nodeType":865},{},[]," — to compromise large organizations.",{"data":9114,"content":9115,"nodeType":866},{},[9116,9120,9129],{"data":9117,"marks":9118,"value":9119,"nodeType":865},{},[],"In 2025, Red Hat’s GitLab instance was compromised due to a local account that essentially provided a backdoor to an otherwise secure and SSO-connected account — an attack reminiscent of the ",{"data":9121,"content":9125,"nodeType":8560},{"target":9122},{"sys":9123},{"id":9124,"type":872,"linkType":873},"PAPJPr3CIB6J20udYyy1r",[9126],{"data":9127,"marks":9128,"value":3119,"nodeType":865},{},[],{"data":9130,"marks":9131,"value":9132,"nodeType":865},{},[],", which targeted local logins that lacked MFA.",{"data":9134,"content":9135,"nodeType":2315},{},[9136],{"data":9137,"marks":9138,"value":8716,"nodeType":865},{},[],{"data":9140,"content":9141,"nodeType":866},{},[9142,9146,9156],{"data":9143,"marks":9144,"value":9145,"nodeType":865},{},[],"Push already provided the ability to detect stolen credentials being actively used by employees in your organization with our ",{"data":9147,"content":9151,"nodeType":8560},{"target":9148},{"sys":9149},{"id":9150,"type":872,"linkType":873},"6vCr4d3R1XA1E8dU883l7N",[9152],{"data":9153,"marks":9154,"value":9155,"nodeType":865},{},[],"Stolen credential detection control",{"data":9157,"marks":9158,"value":9159,"nodeType":865},{},[],". This provides an early-warning signal when Push finds a match between credentials for sale on criminal forums with those still being used by your employees, reducing some 99.5% of false positives we usually see with TI feed data.",{"data":9161,"content":9162,"nodeType":866},{},[9163],{"data":9164,"marks":9165,"value":9166,"nodeType":865},{},[],"With Push, you can also identify where employees are logging in with passwords on apps that otherwise should be using SAML, OIDC, or some other federated mechanism — aka the ghost login vulnerability.",{"data":9168,"content":9169,"nodeType":866},{},[9170],{"data":9171,"marks":9172,"value":9173,"nodeType":865},{},[],"This year, we made it easier for security teams to enforce two security fundamentals that help harden accounts and reduce the risk of ATO, even on unmanaged apps:",{"data":9175,"content":9176,"nodeType":2718},{},[9177,9206],{"data":9178,"content":9179,"nodeType":2654},{},[9180],{"data":9181,"content":9182,"nodeType":866},{},[9183,9188,9192,9202],{"data":9184,"marks":9185,"value":9187,"nodeType":865},{},[9186],{"type":887},"Strong password enforcement:",{"data":9189,"marks":9190,"value":9191,"nodeType":865},{},[]," With this control, you can prompt end-users to ",{"data":9193,"content":9197,"nodeType":8560},{"target":9194},{"sys":9195},{"id":9196,"type":872,"linkType":873},"5aB5x5VXrMv7PDmH0iiK0c",[9198],{"data":9199,"marks":9200,"value":9201,"nodeType":865},{},[],"fix an insecure password",{"data":9203,"marks":9204,"value":9205,"nodeType":865},{},[]," on all your workforce apps, even the ones you don’t centrally manage. ",{"data":9207,"content":9208,"nodeType":2654},{},[9209],{"data":9210,"content":9211,"nodeType":866},{},[9212,9217,9220,9230],{"data":9213,"marks":9214,"value":9216,"nodeType":865},{},[9215],{"type":887},"MFA enforcement:",{"data":9218,"marks":9219,"value":9191,"nodeType":865},{},[],{"data":9221,"content":9225,"nodeType":8560},{"target":9222},{"sys":9223},{"id":9224,"type":872,"linkType":873},"wikyVxlHwKUOKM9xo19eP",[9226],{"data":9227,"marks":9228,"value":9229,"nodeType":865},{},[],"register for MFA",{"data":9231,"marks":9232,"value":9233,"nodeType":865},{},[]," where Push detects it’s missing — again, even on unmanaged apps.",{"data":9235,"content":9236,"nodeType":866},{},[9237],{"data":9238,"marks":9239,"value":9240,"nodeType":865},{},[],"Both of these controls use in-browser banners to provide point-in-time guidance to users when they’re most likely to see it and act on it.",{"data":9242,"content":9246,"nodeType":875},{"target":9243},{"sys":9244},{"id":9245,"type":872,"linkType":873},"3XH0hnnhcZNI47PhdiD4q0",[],{"data":9248,"content":9249,"nodeType":866},{},[9250,9254,9259],{"data":9251,"marks":9252,"value":9253,"nodeType":865},{},[],"To address the pattern of adversaries moving from targeting hardened core apps such as identity providers to the likes of GitLab, Postman, Jira, and others containing valuable corporate data, we also expanded one of the Push platform’s core security controls called ",{"data":9255,"marks":9256,"value":9258,"nodeType":865},{},[9257],{"type":887},"Password protection",{"data":9260,"marks":9261,"value":1193,"nodeType":865},{},[],{"data":9263,"content":9264,"nodeType":866},{},[9265,9268,9272],{"data":9266,"marks":9267,"value":1061,"nodeType":865},{},[],{"data":9269,"marks":9270,"value":9258,"nodeType":865},{},[9271],{"type":887},{"data":9273,"marks":9274,"value":9275,"nodeType":865},{},[]," control previously could be applied only to IdP passwords, allowing you to essentially “pin” the credential for those systems so that it could never be entered on a phishing page or reused on any other app. ",{"data":9277,"content":9278,"nodeType":866},{},[9279,9283,9293],{"data":9280,"marks":9281,"value":9282,"nodeType":865},{},[],"We expanded that control to allow you to ",{"data":9284,"content":9288,"nodeType":8560},{"target":9285},{"sys":9286},{"id":9287,"type":872,"linkType":873},"6FYHbkcRUrtznPo7RarRsz",[9289],{"data":9290,"marks":9291,"value":9292,"nodeType":865},{},[],"protect passwords on any valuable app",{"data":9294,"marks":9295,"value":9296,"nodeType":865},{},[],", preventing account takeover through phished creds and reducing the blast radius of attacks when a compromised account has been reusing passwords on multiple applications.",{"data":9298,"content":9302,"nodeType":875},{"target":9299},{"sys":9300},{"id":9301,"type":872,"linkType":873},"74l82HIeaumFX4u9AMjj79",[],{"data":9304,"content":9305,"nodeType":866},{},[9306,9310,9320],{"data":9307,"marks":9308,"value":9309,"nodeType":865},{},[],"Push also now gives you visibility into where employees are ",{"data":9311,"content":9315,"nodeType":8560},{"target":9312},{"sys":9313},{"id":9314,"type":872,"linkType":873},"7uLeQ9twNl5RyNaWkkJNjd",[9316],{"data":9317,"marks":9318,"value":9319,"nodeType":865},{},[],"syncing their corporate browser profile",{"data":9321,"marks":9322,"value":9323,"nodeType":865},{},[]," to a personal profile, raising the risk of syncing corporate passwords to unmanaged devices — another vector for credential harvesting if those endpoints become compromised.",{"data":9325,"content":9326,"nodeType":866},{},[9327],{"data":9328,"marks":9329,"value":9330,"nodeType":865},{},[],"And of course, underlying all these features is the foundational visibility of all your apps, accounts, account vulnerabilities, and login methods that Push provides.",{"data":9332,"content":9333,"nodeType":879},{},[],{"data":9335,"content":9336,"nodeType":889},{},[9337],{"data":9338,"marks":9339,"value":9340,"nodeType":865},{},[],"Blocking malicious browser extensions",{"data":9342,"content":9343,"nodeType":2315},{},[9344],{"data":9345,"marks":9346,"value":8524,"nodeType":865},{},[],{"data":9348,"content":9349,"nodeType":866},{},[9350],{"data":9351,"marks":9352,"value":9353,"nodeType":865},{},[],"Getting visibility and control over all the browser extensions used across your workforce has long been a thorny problem for security teams. ",{"data":9355,"content":9356,"nodeType":866},{},[9357],{"data":9358,"marks":9359,"value":9360,"nodeType":865},{},[],"The possible solutions haven’t been great, either. Teams could either apply a blunt-force block for most or all extensions, or spend painstaking time trying to understand what was installed, why, and by whom, across all the browsers in the environment.",{"data":9362,"content":9363,"nodeType":866},{},[9364,9368,9378],{"data":9365,"marks":9366,"value":9367,"nodeType":865},{},[],"The urgency of solving this problem increased for many organizations this year after the December 2024 compromise of at least 35 Google Chrome extensions in a ",{"data":9369,"content":9373,"nodeType":8560},{"target":9370},{"sys":9371},{"id":9372,"type":872,"linkType":873},"6sprbTRpfnTJsP3mGR2gKa",[9374],{"data":9375,"marks":9376,"value":9377,"nodeType":865},{},[],"campaign targeting browser extension developers",{"data":9379,"marks":9380,"value":9381,"nodeType":865},{},[],". Cyberhaven’s extension was one of these, and the campaign inherited their name.",{"data":9383,"content":9384,"nodeType":2315},{},[9385],{"data":9386,"marks":9387,"value":8716,"nodeType":865},{},[],{"data":9389,"content":9390,"nodeType":866},{},[9391,9395,9405],{"data":9392,"marks":9393,"value":9394,"nodeType":865},{},[],"With Push, you can now get visibility across ",{"data":9396,"content":9400,"nodeType":8560},{"target":9397},{"sys":9398},{"id":9399,"type":872,"linkType":873},"3ibVBa6u0XfcXXDVtON5th",[9401],{"data":9402,"marks":9403,"value":9404,"nodeType":865},{},[],"all the browser extensions",{"data":9406,"marks":9407,"value":9408,"nodeType":865},{},[]," installed on employee browsers in your environment, and block the ones you don’t want.",{"data":9410,"content":9414,"nodeType":875},{"target":9411},{"sys":9412},{"id":9413,"type":872,"linkType":873},"5J5jdmwugy7yU8GGwxe7iH",[],{"data":9416,"content":9417,"nodeType":866},{},[9418],{"data":9419,"marks":9420,"value":9421,"nodeType":865},{},[],"You can also:",{"data":9423,"content":9424,"nodeType":2718},{},[9425,9435,9445],{"data":9426,"content":9427,"nodeType":2654},{},[9428],{"data":9429,"content":9430,"nodeType":866},{},[9431],{"data":9432,"marks":9433,"value":9434,"nodeType":865},{},[],"Review extensions with risky permissions.",{"data":9436,"content":9437,"nodeType":2654},{},[9438],{"data":9439,"content":9440,"nodeType":866},{},[9441],{"data":9442,"marks":9443,"value":9444,"nodeType":865},{},[],"Identify extensions with potentially suspicious installation methods, such as sideloaded or manually installed.",{"data":9446,"content":9447,"nodeType":2654},{},[9448],{"data":9449,"content":9450,"nodeType":866},{},[9451],{"data":9452,"marks":9453,"value":9454,"nodeType":865},{},[],"Block extensions based on user groups and browser profiles (e.g. profiles logged in with a company domain).",{"data":9456,"content":9457,"nodeType":866},{},[9458,9462,9470],{"data":9459,"marks":9460,"value":9461,"nodeType":865},{},[],"Learn more about extension visibility and management in our ",{"data":9463,"content":9466,"nodeType":8560},{"target":9464},{"sys":9465},{"id":9399,"type":872,"linkType":873},[9467],{"data":9468,"marks":9469,"value":9035,"nodeType":865},{},[],{"data":9471,"marks":9472,"value":1193,"nodeType":865},{},[],{"data":9474,"content":9475,"nodeType":879},{},[],{"data":9477,"content":9478,"nodeType":889},{},[9479],{"data":9480,"marks":9481,"value":9482,"nodeType":865},{},[],"Adding a layer of protection against help desk scams",{"data":9484,"content":9485,"nodeType":2315},{},[9486],{"data":9487,"marks":9488,"value":8524,"nodeType":865},{},[],{"data":9490,"content":9491,"nodeType":866},{},[9492],{"data":9493,"marks":9494,"value":9495,"nodeType":865},{},[],"Finally, another big theme in this year’s TTPs was the use of help desk social engineering to compromise organizations. ",{"data":9497,"content":9498,"nodeType":866},{},[9499,9503,9513],{"data":9500,"marks":9501,"value":9502,"nodeType":865},{},[],"Attackers like ",{"data":9504,"content":9508,"nodeType":8560},{"target":9505},{"sys":9506},{"id":9507,"type":872,"linkType":873},"wgpdyHDn9NcpIJNr7jnFp",[9509],{"data":9510,"marks":9511,"value":9512,"nodeType":865},{},[],"Scattered Spider",{"data":9514,"marks":9515,"value":9516,"nodeType":865},{},[]," — now known as part of the evolving cybercriminal group Scattered Lapsus$ Hunters — have targeted organizations including MGM Resorts and Marks & Spencer by convincing help desk staff to help them bypass MFA or reset credentials for accounts they then use to access corporate systems. ",{"data":9518,"content":9519,"nodeType":2315},{},[9520],{"data":9521,"marks":9522,"value":8716,"nodeType":865},{},[],{"data":9524,"content":9525,"nodeType":866},{},[9526,9530,9535],{"data":9527,"marks":9528,"value":9529,"nodeType":865},{},[],"To provide an additional layer of security when verifying employee identities during help desk interactions, Push introduced ",{"data":9531,"marks":9532,"value":9534,"nodeType":865},{},[9533],{"type":887},"Employee verification codes",{"data":9536,"marks":9537,"value":1193,"nodeType":865},{},[],{"data":9539,"content":9543,"nodeType":875},{"target":9540},{"sys":9541},{"id":9542,"type":872,"linkType":873},"19Baqh5QwbonzsR0EcaDS8",[],{"data":9545,"content":9546,"nodeType":866},{},[9547],{"data":9548,"marks":9549,"value":9550,"nodeType":865},{},[],"These are a rotating 6-digit verification code accessible via the Push Security extension dropdown. When an employee contacts your help desk, staff can use this code to help verify their identity before performing any sensitive account changes.",{"data":9552,"content":9553,"nodeType":866},{},[9554],{"data":9555,"marks":9556,"value":9557,"nodeType":865},{},[],"Employee verification codes are lightweight, rotate every 24 hours, and don’t require any additional apps or devices.",{"data":9559,"content":9560,"nodeType":866},{},[9561,9565,9574],{"data":9562,"marks":9563,"value":9564,"nodeType":865},{},[],"Learn more about verification codes in our ",{"data":9566,"content":9570,"nodeType":8560},{"target":9567},{"sys":9568},{"id":9569,"type":872,"linkType":873},"4rLP8wr6HnvBG2OzqYYKpF",[9571],{"data":9572,"marks":9573,"value":8864,"nodeType":865},{},[],{"data":9575,"marks":9576,"value":1193,"nodeType":865},{},[],{"data":9578,"content":9579,"nodeType":879},{},[],{"data":9581,"content":9582,"nodeType":889},{},[9583],{"data":9584,"marks":9585,"value":9586,"nodeType":865},{},[],"Learn more about Push",{"data":9588,"content":9589,"nodeType":866},{},[9590],{"data":9591,"marks":9592,"value":9593,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking. ",{"data":9595,"content":9596,"nodeType":866},{},[9597],{"data":9598,"marks":9599,"value":9600,"nodeType":865},{},[],"You don’t need to wait until it all goes wrong — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":9602,"content":9603,"nodeType":866},{},[9604,9608,9616,9620,9627],{"data":9605,"marks":9606,"value":9607,"nodeType":865},{},[],"To learn more about Push, check out our latest ",{"data":9609,"content":9611,"nodeType":905},{"uri":9610},"/resources/product-brochure",[9612],{"data":9613,"marks":9614,"value":9615,"nodeType":865},{},[],"product overview",{"data":9617,"marks":9618,"value":9619,"nodeType":865},{},[]," or book some time with one of our team for a ",{"data":9621,"content":9623,"nodeType":905},{"uri":9622},"/demo",[9624],{"data":9625,"marks":9626,"value":2993,"nodeType":865},{},[],{"data":9628,"marks":9629,"value":1193,"nodeType":865},{},[],"Taking the fight to attackers: Push’s top features of 2025","Here’s how real-world attacks and our own R&D informed what we built for Push customers over the last year.","2025-12-17T00:00:00.000Z","taking-the-fight-to-attackers-top-features-of-2025",{"items":9635},[9636,9638],{"sys":9637,"name":342},{"id":3008},{"sys":9639,"name":2144},{"id":2143},{"items":9641},[9642],{"fullName":9643,"firstName":9644,"jobTitle":9645,"profilePicture":9646},"Kelly Davenport","Kelly","Product Team",{"url":9647},"https://images.ctfassets.net/y1cdw1ablpvd/1hi8bEuVfn5sF57LivAq6d/9a3b82426c697d765e2e450e33a18424/kelly_profile_pic.jpeg",{"__typename":1544,"sys":9649,"content":9650,"title":10586,"synopsis":10587,"hashTags":59,"publishedDate":10588,"slug":10589,"tagsCollection":10590,"authorsCollection":10596},{"id":9093},{"json":9651},{"data":9652,"content":9653,"nodeType":1522},{},[9654,9661,9668,9675,9678,9686,9693,9700,9706,9713,9719,9738,9745,9757,9760,9768,9775,9791,9798,9810,9815,9818,9826,9834,9840,9849,9869,9878,9885,9894,9913,9922,9929,9938,9968,9977,9984,9993,10011,10017,10026,10033,10042,10082,10085,10093,10102,10122,10131,10138,10147,10179,10185,10194,10201,10207,10210,10217,10226,10233,10293,10299,10302,10309,10318,10325,10331,10334,10341,10348,10355,10421,10428,10491,10498,10501,10509,10516,10523,10529,10532,10539,10546,10553,10560],{"data":9655,"content":9656,"nodeType":866},{},[9657],{"data":9658,"marks":9659,"value":9660,"nodeType":865},{},[],"The biggest cybersecurity story this year (so far) has been the emergence of “Scattered Lapsus$ Hunters” and their record-breaking worldwide hacking spree. ",{"data":9662,"content":9663,"nodeType":866},{},[9664],{"data":9665,"marks":9666,"value":9667,"nodeType":865},{},[],"Scattered Lapsus$ Hunters is part of “The Com”, the name for the broad community of English-speaking cybercriminals with international criminal connections — including with nation-state sponsored groups. They are also known to collaborate with a range of cybercrime “as-a-Service” organizations for phishing, initial access, ransomware, and more. ",{"data":9669,"content":9670,"nodeType":866},{},[9671],{"data":9672,"marks":9673,"value":9674,"nodeType":865},{},[],"It’s difficult to pin down exactly who the individuals are that make up this criminal collective. But what is known is their MO — making money through extortion by means of account takeover, mass data theft, and ransomware deployment. ",{"data":9676,"content":9677,"nodeType":879},{},[],{"data":9679,"content":9680,"nodeType":889},{},[9681],{"data":9682,"marks":9683,"value":9685,"nodeType":865},{},[9684],{"type":887},"How did we get here? ",{"data":9687,"content":9688,"nodeType":866},{},[9689],{"data":9690,"marks":9691,"value":9692,"nodeType":865},{},[],"Earlier this year, the threat group known to most analysts as Scattered Spider (also tracked as 0ktapus, Octo Tempest, Scatter Swine, Muddled Libra, and UNC3944) re-emerged after a series of arrests in late 2024. ",{"data":9694,"content":9695,"nodeType":866},{},[9696],{"data":9697,"marks":9698,"value":9699,"nodeType":865},{},[],"This group has been active in peaks and troughs over the years, but are mainly known for high-profile ransomware attacks on Caesars and MGM Resorts in 2024. ",{"data":9701,"content":9705,"nodeType":875},{"target":9702},{"sys":9703},{"id":9704,"type":872,"linkType":873},"1Vt269d7n6IGMzOrJs1FDx",[],{"data":9707,"content":9708,"nodeType":866},{},[9709],{"data":9710,"marks":9711,"value":9712,"nodeType":865},{},[],"Scattered Spider hit the headlines again in April 2025 with attacks on UK retailers Marks & Spencer and Co-op, which resulted in significant, prolonged disruption, and a serious downstream impact on the retail supply chain. ",{"data":9714,"content":9718,"nodeType":875},{"target":9715},{"sys":9716},{"id":9717,"type":872,"linkType":873},"3kvcGV2zZZUPnM8IK04Y1O",[],{"data":9720,"content":9721,"nodeType":866},{},[9722,9726,9734],{"data":9723,"marks":9724,"value":9725,"nodeType":865},{},[],"It didn’t stop there, though. What followed was a wide-scale campaign targeting Salesforce customers, with the attackers claiming to have stolen ",{"data":9727,"content":9728,"nodeType":905},{"uri":3114},[9729],{"data":9730,"marks":9731,"value":9733,"nodeType":865},{},[9732],{"type":1070},"over 1.5 billion records from 1000+ companies",{"data":9735,"marks":9736,"value":9737,"nodeType":865},{},[]," across multiple verticals, including heavyweights like Google, Cloudflare, Workday, Adidas, FedEx, Disney, LVMH, and many more.",{"data":9739,"content":9740,"nodeType":866},{},[9741],{"data":9742,"marks":9743,"value":9744,"nodeType":865},{},[],"Around this time, the attackers began to refer to themselves as part of a wider collective, assuming the moniker “Scattered Lapsus$ Hunters” (a mash-up of names given by analysts and self-adopted by attackers — Scattered Spider, ShinyHunters, and Lapsus$).",{"data":9746,"content":9747,"nodeType":866},{},[9748,9752],{"data":9749,"marks":9750,"value":9751,"nodeType":865},{},[],"The most significant breach this year to-date impacted Jaguar Land Rover. A ransomware attack resulted in months of disruption that directly impacted the UK’s GDP, with the government underwriting a $1.5B loan to alleviate the supply chain impact. ",{"data":9753,"marks":9754,"value":9756,"nodeType":865},{},[9755],{"type":887},"In fact, this was the most economically consequential cyber attack yet recorded in a G7 economy. ",{"data":9758,"content":9759,"nodeType":879},{},[],{"data":9761,"content":9762,"nodeType":889},{},[9763],{"data":9764,"marks":9765,"value":9767,"nodeType":865},{},[9766],{"type":887},"2025 wasn’t a one-off",{"data":9769,"content":9770,"nodeType":866},{},[9771],{"data":9772,"marks":9773,"value":9774,"nodeType":865},{},[],"The developments through 2025 have presented a stronger picture than ever before that cybercriminal operations are heavily interlinked. Groups overlap considerably, and individuals freely move between different cells. ",{"data":9776,"content":9777,"nodeType":866},{},[9778,9782,9787],{"data":9779,"marks":9780,"value":9781,"nodeType":865},{},[],"When we scratch beneath the surface, this is evident in the tactics, techniques and procedures (TTPs) used by these attackers — even stretching as far back as 2021 with the initial rise of Lapsus$. This is not an accident. ",{"data":9783,"marks":9784,"value":9786,"nodeType":865},{},[9785],{"type":887},"The TTPs used show a conscious move by attackers to move away from environments that are well-protected by traditional security tools. ",{"data":9788,"marks":9789,"value":9790,"nodeType":865},{},[],"This means avoiding targeting endpoints with malware, and not relying on software-based exploits. Instead, these attackers look to take over apps and services directly over the internet. ",{"data":9792,"content":9793,"nodeType":866},{},[9794],{"data":9795,"marks":9796,"value":9797,"nodeType":865},{},[],"Most of the time, this is as simple as logging in to a SaaS app, or an enterprise SSO account (e.g. Microsoft, Okta, or Google) and dumping the data. For attackers that want to take it further, they can abuse the sprawl of interconnected apps that make up modern business IT, seeking out specific data or exploitable functionality. Or, they can leverage internet-accessible management portals to chart a path back to your on-premise assets, giving them everything they need to pivot toward more conventional methods such as ransomware deployment. ",{"data":9799,"content":9800,"nodeType":866},{},[9801,9805],{"data":9802,"marks":9803,"value":9804,"nodeType":865},{},[],"When we look at historical breaches, the pattern is clear. ",{"data":9806,"marks":9807,"value":9809,"nodeType":865},{},[9808],{"type":887},"Not one of the attacks attributed to Scattered Lapsus$ Hunters, or its predecessors, started with an endpoint or network attack — they all began with account takeover. ",{"data":9811,"content":9814,"nodeType":875},{"target":9812},{"sys":9813},{"id":6925,"type":872,"linkType":873},[],{"data":9816,"content":9817,"nodeType":879},{},[],{"data":9819,"content":9820,"nodeType":889},{},[9821],{"data":9822,"marks":9823,"value":9825,"nodeType":865},{},[9824],{"type":887},"TTP breakdown: Analyzing the top “Scattered Lapsus$ Hunters” breaches since 2021",{"data":9827,"content":9828,"nodeType":2315},{},[9829],{"data":9830,"marks":9831,"value":9833,"nodeType":865},{},[9832],{"type":887},"Phishing and stolen credentials",{"data":9835,"content":9839,"nodeType":875},{"target":9836},{"sys":9837},{"id":9838,"type":872,"linkType":873},"4SNOanDIdGZsvRRnMYQVSo",[],{"data":9841,"content":9842,"nodeType":866},{},[9843],{"data":9844,"marks":9845,"value":9848,"nodeType":865},{},[9846,9847],{"type":887},{"type":1070},"EA Games (2021)",{"data":9850,"content":9851,"nodeType":866},{},[9852,9856,9865],{"data":9853,"marks":9854,"value":9855,"nodeType":865},{},[],"Attackers used stolen session cookies to log into EA’s Slack instance, purchased on a criminal forum. Combined with ",{"data":9857,"content":9859,"nodeType":905},{"uri":9858},"https://pushsecurity.com/blog/phishing-slack-persistence/",[9860],{"data":9861,"marks":9862,"value":9864,"nodeType":865},{},[9863],{"type":1070},"social engineering via Slack",{"data":9866,"marks":9867,"value":9868,"nodeType":865},{},[],", this was used to steal 750GB of data, including video game source code. ",{"data":9870,"content":9871,"nodeType":866},{},[9872],{"data":9873,"marks":9874,"value":9877,"nodeType":865},{},[9875,9876],{"type":887},{"type":1070},"Nvidia (2022)",{"data":9879,"content":9880,"nodeType":866},{},[9881],{"data":9882,"marks":9883,"value":9884,"nodeType":865},{},[],"Attackers used stolen credentials to steal 1TB of data from Nvidia’s internal shares, including a significant amount of sensitive information about the designs of Nvidia graphics cards, source code, and the usernames and passwords of more than 71,000 Nvidia employees.",{"data":9886,"content":9887,"nodeType":866},{},[9888],{"data":9889,"marks":9890,"value":9893,"nodeType":865},{},[9891,9892],{"type":887},{"type":1070},"Microsoft (2022)",{"data":9895,"content":9896,"nodeType":866},{},[9897,9901,9909],{"data":9898,"marks":9899,"value":9900,"nodeType":865},{},[],"Attackers used stolen credentials combined with SIM swapping and ",{"data":9902,"content":9904,"nodeType":905},{"uri":9903},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/mfa_fatigue/description.md",[9905],{"data":9906,"marks":9907,"value":9908,"nodeType":865},{},[],"MFA fatigue",{"data":9910,"marks":9911,"value":9912,"nodeType":865},{},[]," attacks to steal Azure DevOps source code — leaked a 9GB archive of Microsoft source code – including ~90% of Bing and 45% of Cortana code. ",{"data":9914,"content":9915,"nodeType":866},{},[9916],{"data":9917,"marks":9918,"value":9921,"nodeType":865},{},[9919,9920],{"type":887},{"type":1070},"T-Mobile (2022)",{"data":9923,"content":9924,"nodeType":866},{},[9925],{"data":9926,"marks":9927,"value":9928,"nodeType":865},{},[],"Attackers used stolen credentials to establish initial access, coupled with social engineering T-Mobile staff into approving the attacker’s device for VPN access. This resulted in source code being stolen from over 30,000 repositories. ",{"data":9930,"content":9931,"nodeType":866},{},[9932],{"data":9933,"marks":9934,"value":9937,"nodeType":865},{},[9935,9936],{"type":887},{"type":1070},"Snowflake (165 customers) (2024)",{"data":9939,"content":9940,"nodeType":866},{},[9941,9945,9953,9957,9964],{"data":9942,"marks":9943,"value":9944,"nodeType":865},{},[],"Attackers targeted ",{"data":9946,"content":9947,"nodeType":905},{"uri":933},[9948],{"data":9949,"marks":9950,"value":9952,"nodeType":865},{},[9951],{"type":1070},"165 Snowflake customers",{"data":9954,"marks":9955,"value":9956,"nodeType":865},{},[]," using stolen credentials from credential breaches dating back as far as 2020. Due to widespread MFA gaps and the presence of ",{"data":9958,"content":9959,"nodeType":905},{"uri":9104},[9960],{"data":9961,"marks":9962,"value":950,"nodeType":865},{},[9963],{"type":1070},{"data":9965,"marks":9966,"value":9967,"nodeType":865},{},[],", attackers were able to simply log in to individual customer tenants, dump the data, and use it to extort the companies. In total, 9 public victims were named following the breach, with over 1B breached customer records. ",{"data":9969,"content":9970,"nodeType":866},{},[9971],{"data":9972,"marks":9973,"value":9976,"nodeType":865},{},[9974,9975],{"type":887},{"type":1070},"PowerSchool (2024)",{"data":9978,"content":9979,"nodeType":866},{},[9980],{"data":9981,"marks":9982,"value":9983,"nodeType":865},{},[],"Attackers gained access to a community-focused customer support portal, PowerSource, using compromised credentials and stole data using an \"export data manager\" customer support tool, stealing the data of 62.4 million students and 9.5 million teachers. PowerSchool paid an undisclosed ransom fee, but hackers returned later to extort schools and individuals separately anyway.",{"data":9985,"content":9986,"nodeType":866},{},[9987],{"data":9988,"marks":9989,"value":9992,"nodeType":865},{},[9990,9991],{"type":887},{"type":1070},"Red Hat (2025)",{"data":9994,"content":9995,"nodeType":866},{},[9996,10000,10007],{"data":9997,"marks":9998,"value":9999,"nodeType":865},{},[],"Attackers breached Red Hat’s GitLab instance via a compromised account — the result of ",{"data":10001,"content":10002,"nodeType":905},{"uri":9104},[10003],{"data":10004,"marks":10005,"value":950,"nodeType":865},{},[10006],{"type":1070},{"data":10008,"marks":10009,"value":10010,"nodeType":865},{},[]," providing a backdoor to access an otherwise secure, SSO-connected account. Stolen data included approximately 800 Customer Engagement Reports (CERs), authentication tokens, full database URIs, and other private information in Red Hat code and CERs, which they claimed to use to gain access to downstream customer infrastructure. ",{"data":10012,"content":10016,"nodeType":875},{"target":10013},{"sys":10014},{"id":10015,"type":872,"linkType":873},"G1V7d5Dvevmr9p0YXElPX",[],{"data":10018,"content":10019,"nodeType":866},{},[10020],{"data":10021,"marks":10022,"value":10025,"nodeType":865},{},[10023,10024],{"type":887},{"type":1070},"Discord (2025)",{"data":10027,"content":10028,"nodeType":866},{},[10029],{"data":10030,"marks":10031,"value":10032,"nodeType":865},{},[],"Attackers compromised a Zendesk customer support account, stealing 1.6TB of data. The hackers say this consisted of roughly 8.4 million tickets affecting 5.5 million unique users, and that about 580,000 users contained payment information.",{"data":10034,"content":10035,"nodeType":866},{},[10036],{"data":10037,"marks":10038,"value":10041,"nodeType":865},{},[10039,10040],{"type":887},{"type":1070},"SoundCloud, MatchGroup, Crunchbase, Betterment... (2026)",{"data":10043,"content":10044,"nodeType":866},{},[10045,10049,10056,10059,10067,10071,10078],{"data":10046,"marks":10047,"value":10048,"nodeType":865},{},[],"Scattered Lapsus$ Hunters have already claimed several public victims in 2026, with over 60 million breached records. ",{"data":10050,"content":10051,"nodeType":905},{"uri":6819},[10052],{"data":10053,"marks":10054,"value":10055,"nodeType":865},{},[],"SoundCloud, Betterment, Crunchbase",{"data":10057,"marks":10058,"value":7651,"nodeType":865},{},[],{"data":10060,"content":10062,"nodeType":905},{"uri":10061},"https://www.bleepingcomputer.com/news/security/match-group-breach-exposes-data-from-hinge-tinder-okcupid-and-match/",[10063],{"data":10064,"marks":10065,"value":10066,"nodeType":865},{},[],"MatchGroup",{"data":10068,"marks":10069,"value":10070,"nodeType":865},{},[]," have all reported breaches this month, powered by a brand ",{"data":10072,"content":10073,"nodeType":905},{"uri":2667},[10074],{"data":10075,"marks":10076,"value":10077,"nodeType":865},{},[],"new real-time-operated AiTM phishing kit",{"data":10079,"marks":10080,"value":10081,"nodeType":865},{},[]," targeting Okta, Entra, and Google SSO accounts. This is a developing situation, with more victims expected to be announced publicly soon.",{"data":10083,"content":10084,"nodeType":879},{},[],{"data":10086,"content":10087,"nodeType":2315},{},[10088],{"data":10089,"marks":10090,"value":10092,"nodeType":865},{},[10091],{"type":887},"Vishing and help desk scams",{"data":10094,"content":10095,"nodeType":866},{},[10096],{"data":10097,"marks":10098,"value":10101,"nodeType":865},{},[10099,10100],{"type":887},{"type":1070},"MGM Resorts & Caesars (2023)",{"data":10103,"content":10104,"nodeType":866},{},[10105,10109,10118],{"data":10106,"marks":10107,"value":10108,"nodeType":865},{},[],"MGM Resorts and Caesars were hit with twin breaches in 2023. Attackers socially engineered help desk personnel to take over accounts with Super Administrator privileges within MGM Resorts’ Okta tenant, which they then used to register a second, attacker-controlled IdP via ",{"data":10110,"content":10112,"nodeType":905},{"uri":10111},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/inbound_federation/description.md",[10113],{"data":10114,"marks":10115,"value":10117,"nodeType":865},{},[10116],{"type":1070},"inbound federation",{"data":10119,"marks":10120,"value":10121,"nodeType":865},{},[]," — granting comprehensive access that was used to deploy ransomware. ",{"data":10123,"content":10124,"nodeType":866},{},[10125],{"data":10126,"marks":10127,"value":10130,"nodeType":865},{},[10128,10129],{"type":887},{"type":1070},"Transport for London (2024)",{"data":10132,"content":10133,"nodeType":866},{},[10134],{"data":10135,"marks":10136,"value":10137,"nodeType":865},{},[],"Attackers socially engineered the Transport for London help desk to gain privileged access to the IT environment, resulting in prolonged disruption to key online services underpinning London’s public transport network, theft of 5,000 users bank details, and all 30,000 staff members having to reset their online credentials in person.",{"data":10139,"content":10140,"nodeType":866},{},[10141],{"data":10142,"marks":10143,"value":10146,"nodeType":865},{},[10144,10145],{"type":887},{"type":1070},"Marks & Spencer (2025)",{"data":10148,"content":10149,"nodeType":866},{},[10150,10154,10162,10166,10175],{"data":10151,"marks":10152,"value":10153,"nodeType":865},{},[],"Attackers compromised a Microsoft Entra account belonging to a privileged user via a ",{"data":10155,"content":10156,"nodeType":905},{"uri":7294},[10157],{"data":10158,"marks":10159,"value":10161,"nodeType":865},{},[10160],{"type":1070},"help desk scam",{"data":10163,"marks":10164,"value":10165,"nodeType":865},{},[],", which enabled them to steal sensitive data from cloud environments, as well as pivot to deploy ransomware via the ",{"data":10167,"content":10169,"nodeType":905},{"uri":10168},"https://cloud.google.com/blog/topics/threat-intelligence/vsphere-active-directory-integration-risks",[10170],{"data":10171,"marks":10172,"value":10174,"nodeType":865},{},[10173],{"type":1070},"VMware admin console",{"data":10176,"marks":10177,"value":10178,"nodeType":865},{},[],". This enabled ransomware to be deployed at the hypervisor layer, evading host-based protections like EDR. ",{"data":10180,"content":10184,"nodeType":875},{"target":10181},{"sys":10182},{"id":10183,"type":872,"linkType":873},"7hBdHG74NaA3bQfOMpYA9o",[],{"data":10186,"content":10187,"nodeType":866},{},[10188],{"data":10189,"marks":10190,"value":10193,"nodeType":865},{},[10191,10192],{"type":887},{"type":1070},"Jaguar Land Rover (2025)",{"data":10195,"content":10196,"nodeType":866},{},[10197],{"data":10198,"marks":10199,"value":10200,"nodeType":865},{},[],"Attackers compromised highly privileged admin accounts via a help desk scam, which they leveraged to access and deploy ransomware to all aspects of Jaguar’s business, from CAD and engineering software, to payments tracking, to customer car delivery, using similar techniques to the Marks & Spencer breach. ",{"data":10202,"content":10206,"nodeType":875},{"target":10203},{"sys":10204},{"id":10205,"type":872,"linkType":873},"6s1X2fo4K9EeVLBmHm4YXb",[],{"data":10208,"content":10209,"nodeType":879},{},[],{"data":10211,"content":10212,"nodeType":2315},{},[10213],{"data":10214,"marks":10215,"value":694,"nodeType":865},{},[10216],{"type":887},{"data":10218,"content":10219,"nodeType":866},{},[10220],{"data":10221,"marks":10222,"value":10225,"nodeType":865},{},[10223,10224],{"type":887},{"type":1070},"Salesforce & Salesloft (1000+ customers) (2025)",{"data":10227,"content":10228,"nodeType":866},{},[10229],{"data":10230,"marks":10231,"value":10232,"nodeType":865},{},[],"A vast campaign against Salesforce customers resulted in the compromise of 1000+ Salesforce tenants (according to the attacker) with more than 1.5 billion records stolen. This campaign can consisted of three phases:",{"data":10234,"content":10235,"nodeType":2718},{},[10236,10251,10266],{"data":10237,"content":10238,"nodeType":2654},{},[10239],{"data":10240,"content":10241,"nodeType":866},{},[10242,10247],{"data":10243,"marks":10244,"value":10246,"nodeType":865},{},[10245],{"type":887},"Phase 1:",{"data":10248,"marks":10249,"value":10250,"nodeType":865},{},[]," The attacker conducted a large-scale vishing campaign against Salesforce customers, calling up users and socially engineering them into connecting a malicious version of the “Data Loader” app into their tenant. This was in fact an attacker-controlled app that enabled data to be mass-exfiltrated via API. ",{"data":10252,"content":10253,"nodeType":2654},{},[10254],{"data":10255,"content":10256,"nodeType":866},{},[10257,10262],{"data":10258,"marks":10259,"value":10261,"nodeType":865},{},[10260],{"type":887},"Phase 2: ",{"data":10263,"marks":10264,"value":10265,"nodeType":865},{},[],"The attacker conducted a supply-chain compromise against customers of Salesloft. Users of Salesloft’s “Drift” integration were impacted by attackers stealing access tokens from Salesloft’s AWS environment. This integration allowed the attacker to steal data from customers that had deployed Drift to connected environments — namely, Salesforce, and Google Workspace. ",{"data":10267,"content":10268,"nodeType":2654},{},[10269],{"data":10270,"content":10271,"nodeType":866},{},[10272,10277,10281,10289],{"data":10273,"marks":10274,"value":10276,"nodeType":865},{},[10275],{"type":887},"Phase 3:",{"data":10278,"marks":10279,"value":10280,"nodeType":865},{},[]," The attacker then conducted a separate supply-chain compromise involving Gainsight (allegedly using OAuth tokens stolen in the Salesloft attack) which enabled them to ",{"data":10282,"content":10284,"nodeType":905},{"uri":10283},"https://www.bleepingcomputer.com/news/security/salesforce-investigates-customer-data-theft-via-gainsight-breach/",[10285],{"data":10286,"marks":10287,"value":10288,"nodeType":865},{},[],"breach a further 285 Salesforce instances",{"data":10290,"marks":10291,"value":10292,"nodeType":865},{},[]," using stolen OAuth tokens from Gainsight's integrations. ",{"data":10294,"content":10298,"nodeType":875},{"target":10295},{"sys":10296},{"id":10297,"type":872,"linkType":873},"3TwjpVKQ42SwQRhvGFbZdn",[],{"data":10300,"content":10301,"nodeType":879},{},[],{"data":10303,"content":10304,"nodeType":2315},{},[10305],{"data":10306,"marks":10307,"value":699,"nodeType":865},{},[10308],{"type":887},{"data":10310,"content":10311,"nodeType":866},{},[10312],{"data":10313,"marks":10314,"value":10317,"nodeType":865},{},[10315,10316],{"type":887},{"type":1070},"CyberHaven (2024)",{"data":10319,"content":10320,"nodeType":866},{},[10321],{"data":10322,"marks":10323,"value":10324,"nodeType":865},{},[],"Hackers phished a CyberHaven extension developer and uploaded a malicious version of the CyberHaven extension to the Chrome Web Store, leading to customer data breaches where installed in user browsers, impacting CyberHaven’s estimated ~400 business customers. This was part of a broader campaign that targeted 35 Chrome extensions, collectively impacting over 2.5 million users.",{"data":10326,"content":10330,"nodeType":875},{"target":10327},{"sys":10328},{"id":10329,"type":872,"linkType":873},"4ErDI0xi0Vj2Zrk8Qsb2NB",[],{"data":10332,"content":10333,"nodeType":879},{},[],{"data":10335,"content":10336,"nodeType":889},{},[10337],{"data":10338,"marks":10339,"value":1476,"nodeType":865},{},[10340],{"type":887},{"data":10342,"content":10343,"nodeType":866},{},[10344],{"data":10345,"marks":10346,"value":10347,"nodeType":865},{},[],"Scattered Lapsus$ Hunters are dominating the headlines right now, but they aren’t the only attackers using these modern techniques and consciously evading established security controls. ",{"data":10349,"content":10350,"nodeType":866},{},[10351],{"data":10352,"marks":10353,"value":10354,"nodeType":865},{},[],"Threat reports agree that attackers are steering away from traditional exploit and malware-driven breaches towards identities:",{"data":10356,"content":10357,"nodeType":2718},{},[10358,10378,10399],{"data":10359,"content":10360,"nodeType":2654},{},[10361],{"data":10362,"content":10363,"nodeType":866},{},[10364,10368,10375],{"data":10365,"marks":10366,"value":10367,"nodeType":865},{},[],"Identity-based attacks surged 32% in the last year, while 97% of identity attacks are password-based, driven by credential leaks and infostealer malware. (",{"data":10369,"content":10370,"nodeType":905},{"uri":8363},[10371],{"data":10372,"marks":10373,"value":7564,"nodeType":865},{},[10374],{"type":1070},{"data":10376,"marks":10377,"value":8371,"nodeType":865},{},[],{"data":10379,"content":10380,"nodeType":2654},{},[10381],{"data":10382,"content":10383,"nodeType":866},{},[10384,10388,10396],{"data":10385,"marks":10386,"value":10387,"nodeType":865},{},[],"79% of detections were malware-free in the last year, up from 40% in 2019. (",{"data":10389,"content":10390,"nodeType":905},{"uri":8403},[10391],{"data":10392,"marks":10393,"value":10395,"nodeType":865},{},[10394],{"type":1070},"CrowdStrike",{"data":10397,"marks":10398,"value":8371,"nodeType":865},{},[],{"data":10400,"content":10401,"nodeType":2654},{},[10402],{"data":10403,"content":10404,"nodeType":866},{},[10405,10409,10418],{"data":10406,"marks":10407,"value":10408,"nodeType":865},{},[],"Credential abuse and phishing combined accounted for 38% of breaches, making identity the primary breach vector observed. (",{"data":10410,"content":10412,"nodeType":905},{"uri":10411},"https://www.verizon.com/business/resources/reports/dbir/",[10413],{"data":10414,"marks":10415,"value":10417,"nodeType":865},{},[10416],{"type":1070},"Verizon",{"data":10419,"marks":10420,"value":8371,"nodeType":865},{},[],{"data":10422,"content":10423,"nodeType":866},{},[10424],{"data":10425,"marks":10426,"value":10427,"nodeType":865},{},[],"And other public breaches from this year alone demonstrate similar TTPs from outside of the Scattered Lapsus$ Hunters orbit:",{"data":10429,"content":10430,"nodeType":2718},{},[10431,10446,10461,10476],{"data":10432,"content":10433,"nodeType":2654},{},[10434],{"data":10435,"content":10436,"nodeType":866},{},[10437,10442],{"data":10438,"marks":10439,"value":10441,"nodeType":865},{},[10440],{"type":887},"Nikkei",{"data":10443,"marks":10444,"value":10445,"nodeType":865},{},[],": Japanese publishing giant Nikkei’s Slack messaging platform was compromised using stolen credentials, leaking the names, email addresses, and chat histories for 17,368 individuals registered on Slack.",{"data":10447,"content":10448,"nodeType":2654},{},[10449],{"data":10450,"content":10451,"nodeType":866},{},[10452,10457],{"data":10453,"marks":10454,"value":10456,"nodeType":865},{},[10455],{"type":887},"Evertec",{"data":10458,"marks":10459,"value":10460,"nodeType":865},{},[],": Hackers tried to steal $130 million from Evertec’s Brazilian subsidiary Sinqia S.A.after gaining unauthorized access to its environment on the central bank’s real-time payment system (Pix) using stolen credentials.",{"data":10462,"content":10463,"nodeType":2654},{},[10464],{"data":10465,"content":10466,"nodeType":866},{},[10467,10472],{"data":10468,"marks":10469,"value":10471,"nodeType":865},{},[10470],{"type":887},"Hy-Vee:",{"data":10473,"marks":10474,"value":10475,"nodeType":865},{},[]," Was hit with a data breach after hackers logged in with stolen credentials, exposing 53GB of sensitive data.",{"data":10477,"content":10478,"nodeType":2654},{},[10479],{"data":10480,"content":10481,"nodeType":866},{},[10482,10487],{"data":10483,"marks":10484,"value":10486,"nodeType":865},{},[10485],{"type":887},"Scania: ",{"data":10488,"marks":10489,"value":10490,"nodeType":865},{},[],"Automotive giant Scania confirmed it suffered a cybersecurity incident where threat actors used compromised credentials to breach its Financial Services systems and steal insurance claim documents.",{"data":10492,"content":10493,"nodeType":866},{},[10494],{"data":10495,"marks":10496,"value":10497,"nodeType":865},{},[],"Scattered Lapsus$ Hunters may be grabbing the headlines — but this a huge movement in a vast and flexible community of attackers. And criminals around the world are learning from their success. ",{"data":10499,"content":10500,"nodeType":879},{},[],{"data":10502,"content":10503,"nodeType":889},{},[10504],{"data":10505,"marks":10506,"value":10508,"nodeType":865},{},[10507],{"type":887},"Lessons learned",{"data":10510,"content":10511,"nodeType":866},{},[10512],{"data":10513,"marks":10514,"value":10515,"nodeType":865},{},[],"The common thread with all of these attacks is that they are evading established security controls by targeting applications directly, over the internet, via account takeover.",{"data":10517,"content":10518,"nodeType":866},{},[10519],{"data":10520,"marks":10521,"value":10522,"nodeType":865},{},[],"Clearly, the success of these attacks shows the limitations of multiple control layers. Endpoint and network layer controls have no visibility of this attack surface. Identity-focused controls are being undermined by ghost logins and shadow IT. And the limitations of cloud security controls in their ability to encompass all apps, and detect and stop malicious actions in real-time (that often blend in seamlessly with normal user activity). ",{"data":10524,"content":10528,"nodeType":875},{"target":10525},{"sys":10526},{"id":10527,"type":872,"linkType":873},"4Dg3fZEGf7ShyQJ8jlNDME",[],{"data":10530,"content":10531,"nodeType":879},{},[],{"data":10533,"content":10534,"nodeType":889},{},[10535],{"data":10536,"marks":10537,"value":3574,"nodeType":865},{},[10538],{"type":887},{"data":10540,"content":10541,"nodeType":866},{},[10542],{"data":10543,"marks":10544,"value":10545,"nodeType":865},{},[],"Stopping attacks that are designed to evade established controls is in our DNA — it’s the reason Push was founded. ",{"data":10547,"content":10548,"nodeType":866},{},[10549],{"data":10550,"marks":10551,"value":10552,"nodeType":865},{},[],"The browser is the gateway to to the apps and identities that attackers are now targeting, with many attacks taking place inside the user’s browser — whether that’s entering credentials onto a phishing page, approving a malicious OAuth grant, installing a risky browser extension, or insecurely accessing an app with a weak password and no MFA. ",{"data":10554,"content":10555,"nodeType":866},{},[10556],{"data":10557,"marks":10558,"value":10559,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive detection and response capabilities against attacks like AiTM phishing, credential stuffing, malicious browser extensions, malicious OAuth grants, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your attack surface.",{"data":10561,"content":10562,"nodeType":866},{},[10563,10566,10573,10576,10583],{"data":10564,"marks":10565,"value":8278,"nodeType":865},{},[],{"data":10567,"content":10568,"nodeType":905},{"uri":7323},[10569],{"data":10570,"marks":10571,"value":8286,"nodeType":865},{},[10572],{"type":1070},{"data":10574,"marks":10575,"value":8290,"nodeType":865},{},[],{"data":10577,"content":10578,"nodeType":905},{"uri":1512},[10579],{"data":10580,"marks":10581,"value":7352,"nodeType":865},{},[10582],{"type":1070},{"data":10584,"marks":10585,"value":1193,"nodeType":865},{},[],"\"Scattered Lapsus$ Hunters\" — how modern attackers exploit the gaps in your security stack ","How Scattered Lapsus$ Hunters breaches demonstrate the evolution of attacker TTPs, shaping the future of cyber attacks.","2025-11-13T00:00:00.000Z","scattered-lapsus-hunters",{"items":10591},[10592,10594],{"sys":10593,"name":2144},{"id":2143},{"sys":10595,"name":342},{"id":3008},{"items":10597},[10598],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":10599},{"url":3016},"unpacking-the-latest-slh-campaign","blog/unpacking-the-latest-slh-campaign",{"json":10603},{"data":10604,"content":10605,"nodeType":1522},{},[10606],{"data":10607,"content":10608,"nodeType":866},{},[10609],{"data":10610,"marks":10611,"value":10612,"nodeType":865},{},[],"Analyzing the latest Scattered Lapsus$ Hunters (SLH) phishing campaign targeting hundreds of organizations. ","Analyzing the latest Scattered Lapsus$ Hunters (SLH) phishing campaign targeting hundreds of organizations.\n",{"id":10615,"publishedAt":10616},"44DXq5ZkL9XQV5Fngto0XZ","2026-08-12T11:53:16.417Z",{"items":10618},[10619,10621],{"sys":10620,"name":2144},{"id":2143},{"sys":10622,"name":342},{"id":3008},{"items":10624},[10625,10627,10629,10631,10633,10635,10637,10639,10641,10643,10645,10647,10649,10651,10653,10655,10657],{"sys":10626,"name":279,"slug":280,"tier":31},{"id":276},{"sys":10628,"name":413,"slug":414,"tier":31},{"id":410},{"sys":10630,"name":519,"slug":520,"tier":31},{"id":516},{"sys":10632,"name":342,"slug":343,"tier":31},{"id":339},{"sys":10634,"name":642,"slug":643,"tier":31},{"id":639},{"sys":10636,"name":650,"slug":651,"tier":45},{"id":647},{"sys":10638,"name":261,"slug":262,"tier":45},{"id":258},{"sys":10640,"name":571,"slug":572,"tier":45},{"id":568},{"sys":10642,"name":466,"slug":467,"tier":45},{"id":463},{"sys":10644,"name":607,"slug":608,"tier":45},{"id":604},{"sys":10646,"name":511,"slug":512,"tier":45},{"id":508},{"sys":10648,"name":324,"slug":325,"tier":45},{"id":321},{"sys":10650,"name":475,"slug":476,"tier":45},{"id":472},{"sys":10652,"name":395,"slug":396,"tier":45},{"id":392},{"sys":10654,"name":493,"slug":494,"tier":45},{"id":490},{"sys":10656,"name":537,"slug":538,"tier":45},{"id":534},{"sys":10658,"name":404,"slug":405,"tier":45},{"id":401},"nlrbqqJFVIlz8E8KpfsQufXY-yj--6GLH62nM04r1CY",{"id":10661,"title":10586,"authorsCollection":10662,"content":10667,"extension":228,"faqItemsCollection":11651,"faqTitle":59,"featured":6,"hashTags":59,"meta":11653,"metaTitle":11654,"ogImage":59,"postType":7494,"publishedDate":10588,"relatedBlogPostsCollection":11655,"slug":10589,"stem":13463,"subtitle":59,"summary":13464,"synopsis":10587,"sys":13475,"tagsCollection":13477,"topicsCollection":13483,"__hash__":13515},"blog/blog/scattered-lapsus-hunters.json",{"items":10663},[10664],{"fullName":3012,"firstName":3013,"jobTitle":3014,"socialLinks":10665,"profilePicture":10666},[6742],{"url":3016},{"json":10668,"links":11483},{"data":10669,"content":10670,"nodeType":1522},{},[10671,10677,10683,10689,10692,10699,10705,10711,10716,10722,10727,10743,10749,10759,10762,10769,10775,10788,10794,10804,10809,10812,10819,10826,10831,10839,10855,10863,10869,10877,10892,10900,10906,10914,10940,10948,10954,10962,10978,10983,10991,10997,11005,11038,11041,11048,11056,11072,11080,11086,11094,11120,11125,11133,11139,11144,11147,11154,11162,11168,11219,11224,11227,11234,11242,11248,11253,11256,11263,11269,11275,11335,11341,11396,11402,11405,11412,11418,11424,11429,11432,11439,11445,11451,11457],{"data":10672,"content":10673,"nodeType":866},{},[10674],{"data":10675,"marks":10676,"value":9660,"nodeType":865},{},[],{"data":10678,"content":10679,"nodeType":866},{},[10680],{"data":10681,"marks":10682,"value":9667,"nodeType":865},{},[],{"data":10684,"content":10685,"nodeType":866},{},[10686],{"data":10687,"marks":10688,"value":9674,"nodeType":865},{},[],{"data":10690,"content":10691,"nodeType":879},{},[],{"data":10693,"content":10694,"nodeType":889},{},[10695],{"data":10696,"marks":10697,"value":9685,"nodeType":865},{},[10698],{"type":887},{"data":10700,"content":10701,"nodeType":866},{},[10702],{"data":10703,"marks":10704,"value":9692,"nodeType":865},{},[],{"data":10706,"content":10707,"nodeType":866},{},[10708],{"data":10709,"marks":10710,"value":9699,"nodeType":865},{},[],{"data":10712,"content":10715,"nodeType":875},{"target":10713},{"sys":10714},{"id":9704,"type":872,"linkType":873},[],{"data":10717,"content":10718,"nodeType":866},{},[10719],{"data":10720,"marks":10721,"value":9712,"nodeType":865},{},[],{"data":10723,"content":10726,"nodeType":875},{"target":10724},{"sys":10725},{"id":9717,"type":872,"linkType":873},[],{"data":10728,"content":10729,"nodeType":866},{},[10730,10733,10740],{"data":10731,"marks":10732,"value":9725,"nodeType":865},{},[],{"data":10734,"content":10735,"nodeType":905},{"uri":3114},[10736],{"data":10737,"marks":10738,"value":9733,"nodeType":865},{},[10739],{"type":1070},{"data":10741,"marks":10742,"value":9737,"nodeType":865},{},[],{"data":10744,"content":10745,"nodeType":866},{},[10746],{"data":10747,"marks":10748,"value":9744,"nodeType":865},{},[],{"data":10750,"content":10751,"nodeType":866},{},[10752,10755],{"data":10753,"marks":10754,"value":9751,"nodeType":865},{},[],{"data":10756,"marks":10757,"value":9756,"nodeType":865},{},[10758],{"type":887},{"data":10760,"content":10761,"nodeType":879},{},[],{"data":10763,"content":10764,"nodeType":889},{},[10765],{"data":10766,"marks":10767,"value":9767,"nodeType":865},{},[10768],{"type":887},{"data":10770,"content":10771,"nodeType":866},{},[10772],{"data":10773,"marks":10774,"value":9774,"nodeType":865},{},[],{"data":10776,"content":10777,"nodeType":866},{},[10778,10781,10785],{"data":10779,"marks":10780,"value":9781,"nodeType":865},{},[],{"data":10782,"marks":10783,"value":9786,"nodeType":865},{},[10784],{"type":887},{"data":10786,"marks":10787,"value":9790,"nodeType":865},{},[],{"data":10789,"content":10790,"nodeType":866},{},[10791],{"data":10792,"marks":10793,"value":9797,"nodeType":865},{},[],{"data":10795,"content":10796,"nodeType":866},{},[10797,10800],{"data":10798,"marks":10799,"value":9804,"nodeType":865},{},[],{"data":10801,"marks":10802,"value":9809,"nodeType":865},{},[10803],{"type":887},{"data":10805,"content":10808,"nodeType":875},{"target":10806},{"sys":10807},{"id":6925,"type":872,"linkType":873},[],{"data":10810,"content":10811,"nodeType":879},{},[],{"data":10813,"content":10814,"nodeType":889},{},[10815],{"data":10816,"marks":10817,"value":9825,"nodeType":865},{},[10818],{"type":887},{"data":10820,"content":10821,"nodeType":2315},{},[10822],{"data":10823,"marks":10824,"value":9833,"nodeType":865},{},[10825],{"type":887},{"data":10827,"content":10830,"nodeType":875},{"target":10828},{"sys":10829},{"id":9838,"type":872,"linkType":873},[],{"data":10832,"content":10833,"nodeType":866},{},[10834],{"data":10835,"marks":10836,"value":9848,"nodeType":865},{},[10837,10838],{"type":887},{"type":1070},{"data":10840,"content":10841,"nodeType":866},{},[10842,10845,10852],{"data":10843,"marks":10844,"value":9855,"nodeType":865},{},[],{"data":10846,"content":10847,"nodeType":905},{"uri":9858},[10848],{"data":10849,"marks":10850,"value":9864,"nodeType":865},{},[10851],{"type":1070},{"data":10853,"marks":10854,"value":9868,"nodeType":865},{},[],{"data":10856,"content":10857,"nodeType":866},{},[10858],{"data":10859,"marks":10860,"value":9877,"nodeType":865},{},[10861,10862],{"type":887},{"type":1070},{"data":10864,"content":10865,"nodeType":866},{},[10866],{"data":10867,"marks":10868,"value":9884,"nodeType":865},{},[],{"data":10870,"content":10871,"nodeType":866},{},[10872],{"data":10873,"marks":10874,"value":9893,"nodeType":865},{},[10875,10876],{"type":887},{"type":1070},{"data":10878,"content":10879,"nodeType":866},{},[10880,10883,10889],{"data":10881,"marks":10882,"value":9900,"nodeType":865},{},[],{"data":10884,"content":10885,"nodeType":905},{"uri":9903},[10886],{"data":10887,"marks":10888,"value":9908,"nodeType":865},{},[],{"data":10890,"marks":10891,"value":9912,"nodeType":865},{},[],{"data":10893,"content":10894,"nodeType":866},{},[10895],{"data":10896,"marks":10897,"value":9921,"nodeType":865},{},[10898,10899],{"type":887},{"type":1070},{"data":10901,"content":10902,"nodeType":866},{},[10903],{"data":10904,"marks":10905,"value":9928,"nodeType":865},{},[],{"data":10907,"content":10908,"nodeType":866},{},[10909],{"data":10910,"marks":10911,"value":9937,"nodeType":865},{},[10912,10913],{"type":887},{"type":1070},{"data":10915,"content":10916,"nodeType":866},{},[10917,10920,10927,10930,10937],{"data":10918,"marks":10919,"value":9944,"nodeType":865},{},[],{"data":10921,"content":10922,"nodeType":905},{"uri":933},[10923],{"data":10924,"marks":10925,"value":9952,"nodeType":865},{},[10926],{"type":1070},{"data":10928,"marks":10929,"value":9956,"nodeType":865},{},[],{"data":10931,"content":10932,"nodeType":905},{"uri":9104},[10933],{"data":10934,"marks":10935,"value":950,"nodeType":865},{},[10936],{"type":1070},{"data":10938,"marks":10939,"value":9967,"nodeType":865},{},[],{"data":10941,"content":10942,"nodeType":866},{},[10943],{"data":10944,"marks":10945,"value":9976,"nodeType":865},{},[10946,10947],{"type":887},{"type":1070},{"data":10949,"content":10950,"nodeType":866},{},[10951],{"data":10952,"marks":10953,"value":9983,"nodeType":865},{},[],{"data":10955,"content":10956,"nodeType":866},{},[10957],{"data":10958,"marks":10959,"value":9992,"nodeType":865},{},[10960,10961],{"type":887},{"type":1070},{"data":10963,"content":10964,"nodeType":866},{},[10965,10968,10975],{"data":10966,"marks":10967,"value":9999,"nodeType":865},{},[],{"data":10969,"content":10970,"nodeType":905},{"uri":9104},[10971],{"data":10972,"marks":10973,"value":950,"nodeType":865},{},[10974],{"type":1070},{"data":10976,"marks":10977,"value":10010,"nodeType":865},{},[],{"data":10979,"content":10982,"nodeType":875},{"target":10980},{"sys":10981},{"id":10015,"type":872,"linkType":873},[],{"data":10984,"content":10985,"nodeType":866},{},[10986],{"data":10987,"marks":10988,"value":10025,"nodeType":865},{},[10989,10990],{"type":887},{"type":1070},{"data":10992,"content":10993,"nodeType":866},{},[10994],{"data":10995,"marks":10996,"value":10032,"nodeType":865},{},[],{"data":10998,"content":10999,"nodeType":866},{},[11000],{"data":11001,"marks":11002,"value":10041,"nodeType":865},{},[11003,11004],{"type":887},{"type":1070},{"data":11006,"content":11007,"nodeType":866},{},[11008,11011,11017,11020,11026,11029,11035],{"data":11009,"marks":11010,"value":10048,"nodeType":865},{},[],{"data":11012,"content":11013,"nodeType":905},{"uri":6819},[11014],{"data":11015,"marks":11016,"value":10055,"nodeType":865},{},[],{"data":11018,"marks":11019,"value":7651,"nodeType":865},{},[],{"data":11021,"content":11022,"nodeType":905},{"uri":10061},[11023],{"data":11024,"marks":11025,"value":10066,"nodeType":865},{},[],{"data":11027,"marks":11028,"value":10070,"nodeType":865},{},[],{"data":11030,"content":11031,"nodeType":905},{"uri":2667},[11032],{"data":11033,"marks":11034,"value":10077,"nodeType":865},{},[],{"data":11036,"marks":11037,"value":10081,"nodeType":865},{},[],{"data":11039,"content":11040,"nodeType":879},{},[],{"data":11042,"content":11043,"nodeType":2315},{},[11044],{"data":11045,"marks":11046,"value":10092,"nodeType":865},{},[11047],{"type":887},{"data":11049,"content":11050,"nodeType":866},{},[11051],{"data":11052,"marks":11053,"value":10101,"nodeType":865},{},[11054,11055],{"type":887},{"type":1070},{"data":11057,"content":11058,"nodeType":866},{},[11059,11062,11069],{"data":11060,"marks":11061,"value":10108,"nodeType":865},{},[],{"data":11063,"content":11064,"nodeType":905},{"uri":10111},[11065],{"data":11066,"marks":11067,"value":10117,"nodeType":865},{},[11068],{"type":1070},{"data":11070,"marks":11071,"value":10121,"nodeType":865},{},[],{"data":11073,"content":11074,"nodeType":866},{},[11075],{"data":11076,"marks":11077,"value":10130,"nodeType":865},{},[11078,11079],{"type":887},{"type":1070},{"data":11081,"content":11082,"nodeType":866},{},[11083],{"data":11084,"marks":11085,"value":10137,"nodeType":865},{},[],{"data":11087,"content":11088,"nodeType":866},{},[11089],{"data":11090,"marks":11091,"value":10146,"nodeType":865},{},[11092,11093],{"type":887},{"type":1070},{"data":11095,"content":11096,"nodeType":866},{},[11097,11100,11107,11110,11117],{"data":11098,"marks":11099,"value":10153,"nodeType":865},{},[],{"data":11101,"content":11102,"nodeType":905},{"uri":7294},[11103],{"data":11104,"marks":11105,"value":10161,"nodeType":865},{},[11106],{"type":1070},{"data":11108,"marks":11109,"value":10165,"nodeType":865},{},[],{"data":11111,"content":11112,"nodeType":905},{"uri":10168},[11113],{"data":11114,"marks":11115,"value":10174,"nodeType":865},{},[11116],{"type":1070},{"data":11118,"marks":11119,"value":10178,"nodeType":865},{},[],{"data":11121,"content":11124,"nodeType":875},{"target":11122},{"sys":11123},{"id":10183,"type":872,"linkType":873},[],{"data":11126,"content":11127,"nodeType":866},{},[11128],{"data":11129,"marks":11130,"value":10193,"nodeType":865},{},[11131,11132],{"type":887},{"type":1070},{"data":11134,"content":11135,"nodeType":866},{},[11136],{"data":11137,"marks":11138,"value":10200,"nodeType":865},{},[],{"data":11140,"content":11143,"nodeType":875},{"target":11141},{"sys":11142},{"id":10205,"type":872,"linkType":873},[],{"data":11145,"content":11146,"nodeType":879},{},[],{"data":11148,"content":11149,"nodeType":2315},{},[11150],{"data":11151,"marks":11152,"value":694,"nodeType":865},{},[11153],{"type":887},{"data":11155,"content":11156,"nodeType":866},{},[11157],{"data":11158,"marks":11159,"value":10225,"nodeType":865},{},[11160,11161],{"type":887},{"type":1070},{"data":11163,"content":11164,"nodeType":866},{},[11165],{"data":11166,"marks":11167,"value":10232,"nodeType":865},{},[],{"data":11169,"content":11170,"nodeType":2718},{},[11171,11184,11197],{"data":11172,"content":11173,"nodeType":2654},{},[11174],{"data":11175,"content":11176,"nodeType":866},{},[11177,11181],{"data":11178,"marks":11179,"value":10246,"nodeType":865},{},[11180],{"type":887},{"data":11182,"marks":11183,"value":10250,"nodeType":865},{},[],{"data":11185,"content":11186,"nodeType":2654},{},[11187],{"data":11188,"content":11189,"nodeType":866},{},[11190,11194],{"data":11191,"marks":11192,"value":10261,"nodeType":865},{},[11193],{"type":887},{"data":11195,"marks":11196,"value":10265,"nodeType":865},{},[],{"data":11198,"content":11199,"nodeType":2654},{},[11200],{"data":11201,"content":11202,"nodeType":866},{},[11203,11207,11210,11216],{"data":11204,"marks":11205,"value":10276,"nodeType":865},{},[11206],{"type":887},{"data":11208,"marks":11209,"value":10280,"nodeType":865},{},[],{"data":11211,"content":11212,"nodeType":905},{"uri":10283},[11213],{"data":11214,"marks":11215,"value":10288,"nodeType":865},{},[],{"data":11217,"marks":11218,"value":10292,"nodeType":865},{},[],{"data":11220,"content":11223,"nodeType":875},{"target":11221},{"sys":11222},{"id":10297,"type":872,"linkType":873},[],{"data":11225,"content":11226,"nodeType":879},{},[],{"data":11228,"content":11229,"nodeType":2315},{},[11230],{"data":11231,"marks":11232,"value":699,"nodeType":865},{},[11233],{"type":887},{"data":11235,"content":11236,"nodeType":866},{},[11237],{"data":11238,"marks":11239,"value":10317,"nodeType":865},{},[11240,11241],{"type":887},{"type":1070},{"data":11243,"content":11244,"nodeType":866},{},[11245],{"data":11246,"marks":11247,"value":10324,"nodeType":865},{},[],{"data":11249,"content":11252,"nodeType":875},{"target":11250},{"sys":11251},{"id":10329,"type":872,"linkType":873},[],{"data":11254,"content":11255,"nodeType":879},{},[],{"data":11257,"content":11258,"nodeType":889},{},[11259],{"data":11260,"marks":11261,"value":1476,"nodeType":865},{},[11262],{"type":887},{"data":11264,"content":11265,"nodeType":866},{},[11266],{"data":11267,"marks":11268,"value":10347,"nodeType":865},{},[],{"data":11270,"content":11271,"nodeType":866},{},[11272],{"data":11273,"marks":11274,"value":10354,"nodeType":865},{},[],{"data":11276,"content":11277,"nodeType":2718},{},[11278,11297,11316],{"data":11279,"content":11280,"nodeType":2654},{},[11281],{"data":11282,"content":11283,"nodeType":866},{},[11284,11287,11294],{"data":11285,"marks":11286,"value":10367,"nodeType":865},{},[],{"data":11288,"content":11289,"nodeType":905},{"uri":8363},[11290],{"data":11291,"marks":11292,"value":7564,"nodeType":865},{},[11293],{"type":1070},{"data":11295,"marks":11296,"value":8371,"nodeType":865},{},[],{"data":11298,"content":11299,"nodeType":2654},{},[11300],{"data":11301,"content":11302,"nodeType":866},{},[11303,11306,11313],{"data":11304,"marks":11305,"value":10387,"nodeType":865},{},[],{"data":11307,"content":11308,"nodeType":905},{"uri":8403},[11309],{"data":11310,"marks":11311,"value":10395,"nodeType":865},{},[11312],{"type":1070},{"data":11314,"marks":11315,"value":8371,"nodeType":865},{},[],{"data":11317,"content":11318,"nodeType":2654},{},[11319],{"data":11320,"content":11321,"nodeType":866},{},[11322,11325,11332],{"data":11323,"marks":11324,"value":10408,"nodeType":865},{},[],{"data":11326,"content":11327,"nodeType":905},{"uri":10411},[11328],{"data":11329,"marks":11330,"value":10417,"nodeType":865},{},[11331],{"type":1070},{"data":11333,"marks":11334,"value":8371,"nodeType":865},{},[],{"data":11336,"content":11337,"nodeType":866},{},[11338],{"data":11339,"marks":11340,"value":10427,"nodeType":865},{},[],{"data":11342,"content":11343,"nodeType":2718},{},[11344,11357,11370,11383],{"data":11345,"content":11346,"nodeType":2654},{},[11347],{"data":11348,"content":11349,"nodeType":866},{},[11350,11354],{"data":11351,"marks":11352,"value":10441,"nodeType":865},{},[11353],{"type":887},{"data":11355,"marks":11356,"value":10445,"nodeType":865},{},[],{"data":11358,"content":11359,"nodeType":2654},{},[11360],{"data":11361,"content":11362,"nodeType":866},{},[11363,11367],{"data":11364,"marks":11365,"value":10456,"nodeType":865},{},[11366],{"type":887},{"data":11368,"marks":11369,"value":10460,"nodeType":865},{},[],{"data":11371,"content":11372,"nodeType":2654},{},[11373],{"data":11374,"content":11375,"nodeType":866},{},[11376,11380],{"data":11377,"marks":11378,"value":10471,"nodeType":865},{},[11379],{"type":887},{"data":11381,"marks":11382,"value":10475,"nodeType":865},{},[],{"data":11384,"content":11385,"nodeType":2654},{},[11386],{"data":11387,"content":11388,"nodeType":866},{},[11389,11393],{"data":11390,"marks":11391,"value":10486,"nodeType":865},{},[11392],{"type":887},{"data":11394,"marks":11395,"value":10490,"nodeType":865},{},[],{"data":11397,"content":11398,"nodeType":866},{},[11399],{"data":11400,"marks":11401,"value":10497,"nodeType":865},{},[],{"data":11403,"content":11404,"nodeType":879},{},[],{"data":11406,"content":11407,"nodeType":889},{},[11408],{"data":11409,"marks":11410,"value":10508,"nodeType":865},{},[11411],{"type":887},{"data":11413,"content":11414,"nodeType":866},{},[11415],{"data":11416,"marks":11417,"value":10515,"nodeType":865},{},[],{"data":11419,"content":11420,"nodeType":866},{},[11421],{"data":11422,"marks":11423,"value":10522,"nodeType":865},{},[],{"data":11425,"content":11428,"nodeType":875},{"target":11426},{"sys":11427},{"id":10527,"type":872,"linkType":873},[],{"data":11430,"content":11431,"nodeType":879},{},[],{"data":11433,"content":11434,"nodeType":889},{},[11435],{"data":11436,"marks":11437,"value":3574,"nodeType":865},{},[11438],{"type":887},{"data":11440,"content":11441,"nodeType":866},{},[11442],{"data":11443,"marks":11444,"value":10545,"nodeType":865},{},[],{"data":11446,"content":11447,"nodeType":866},{},[11448],{"data":11449,"marks":11450,"value":10552,"nodeType":865},{},[],{"data":11452,"content":11453,"nodeType":866},{},[11454],{"data":11455,"marks":11456,"value":10559,"nodeType":865},{},[],{"data":11458,"content":11459,"nodeType":866},{},[11460,11463,11470,11473,11480],{"data":11461,"marks":11462,"value":8278,"nodeType":865},{},[],{"data":11464,"content":11465,"nodeType":905},{"uri":7323},[11466],{"data":11467,"marks":11468,"value":8286,"nodeType":865},{},[11469],{"type":1070},{"data":11471,"marks":11472,"value":8290,"nodeType":865},{},[],{"data":11474,"content":11475,"nodeType":905},{"uri":1512},[11476],{"data":11477,"marks":11478,"value":7352,"nodeType":865},{},[11479],{"type":1070},{"data":11481,"marks":11482,"value":1193,"nodeType":865},{},[],{"entries":11484},{"hyperlink":11485,"inline":11486,"block":11487},[],[],[11488,11502,11516,11519,11545,11559,11573,11598,11612,11626],{"sys":11489,"__typename":4645,"content":11490,"name":11501,"title":59},{"id":9704},{"json":11491},{"nodeType":1522,"data":11492,"content":11493},{},[11494],{"nodeType":866,"data":11495,"content":11496},{},[11497],{"nodeType":865,"value":11498,"marks":11499,"data":11500},"The MGM hack resulted in a 36-hour outage, a $100M hit to its Q3 results, one-time cyber consulting fees in the region of $10M, and a class-action lawsuit later settled for $45M. Less is known about Caesars, except that a ransom of $15M was paid in an attempt to prevent stolen data being leaked online.",[],{},"SLH insight box 1",{"sys":11503,"__typename":4645,"content":11504,"name":11515,"title":59},{"id":9717},{"json":11505},{"nodeType":1522,"data":11506,"content":11507},{},[11508],{"nodeType":866,"data":11509,"content":11510},{},[11511],{"nodeType":865,"value":11512,"marks":11513,"data":11514},"The Marks & Spencer ransomware breach resulted in online shopping services being taken offline, stores running low on products, £300M in lost profits, and almost £1B wiped off the company’s stock market valuation at one stage. Co-op proactively pulled the plug on their network to prevent further damage, lessening the impact to a still-sizeable £107m in lost profits.",[],{},"SLH insight box 2",{"sys":11517,"__typename":4637,"title":7377,"caption":7377,"layoutMode":59,"file":11518},{"id":6925},{"url":7379,"width":7380,"height":7381},{"sys":11520,"__typename":4645,"content":11521,"name":11544,"title":59},{"id":9838},{"json":11522},{"nodeType":1522,"data":11523,"content":11524},{},[11525],{"nodeType":866,"data":11526,"content":11527},{},[11528,11532,11540],{"nodeType":865,"value":11529,"marks":11530,"data":11531},"Stolen credentials were, and still are, one of the easiest ways in for an attacker. They're one of the most abundant resources available to attackers online, with billions leaked as a by-product of phishing, malware infections (infostealers), and data breaches, which are packaged up and resold to other criminals. Sure, ",[],{},{"nodeType":905,"data":11533,"content":11534},{"uri":964},[11535],{"nodeType":865,"value":11536,"marks":11537,"data":11539},"there’s a lot of noise in credential feeds",[11538],{"type":1070},{},{"nodeType":865,"value":11541,"marks":11542,"data":11543}," — but it only takes the attacker to get lucky once. And the steady stream of breaches are living proof of the MFA gaps waiting to be exploited.",[],{},"SLH insight box 3",{"sys":11546,"__typename":4645,"content":11547,"name":11558,"title":59},{"id":10015},{"json":11548},{"nodeType":1522,"data":11549,"content":11550},{},[11551],{"nodeType":866,"data":11552,"content":11553},{},[11554],{"nodeType":865,"value":11555,"marks":11556,"data":11557},"A group calling themselves “The Crimson Collective” originally claimed the breach, with Scattered Lapsus$ Hunters becoming the main voice behind the breach at the extortion phase — showing just how interconnected the ecosystem of cybercriminals is.",[],{},"SLH insight box 10",{"sys":11560,"__typename":4645,"content":11561,"name":11572,"title":59},{"id":10183},{"json":11562},{"nodeType":1522,"data":11563,"content":11564},{},[11565],{"nodeType":866,"data":11566,"content":11567},{},[11568],{"nodeType":865,"value":11569,"marks":11570,"data":11571},"An identical attack path was attempted against Co-op, but was detected early enough for the security team to pull the plug on their own network. This significantly reduced the disruption, although customer data was still taken by the attacker.",[],{},"SLH insight box 4",{"sys":11574,"__typename":4645,"content":11575,"name":11597,"title":59},{"id":10205},{"json":11576},{"nodeType":1522,"data":11577,"content":11578},{},[11579],{"nodeType":866,"data":11580,"content":11581},{},[11582,11585,11593],{"nodeType":865,"value":21,"marks":11583,"data":11584},[],{},{"nodeType":905,"data":11586,"content":11587},{"uri":3474},[11588],{"nodeType":865,"value":11589,"marks":11590,"data":11592},"Jaguar’s Jira tenant was breached",[11591],{"type":1070},{},{"nodeType":865,"value":11594,"marks":11595,"data":11596}," by the “Scattered Lapsus$ Hunters” affiliated “HellCat” group earlier in 2025, which led to an alleged ~350GB of data being stolen. It is highly likely that this inside information from Jira (a platform storing huge amounts of business process information, architectural diagrams, and even improperly stored credentials and secrets) was leveraged in the later ransomware breach.",[],{},"SLH insight box 5",{"sys":11599,"__typename":4645,"content":11600,"name":11611,"title":59},{"id":10297},{"json":11601},{"nodeType":1522,"data":11602,"content":11603},{},[11604],{"nodeType":866,"data":11605,"content":11606},{},[11607],{"nodeType":865,"value":11608,"marks":11609,"data":11610},"The Salesloft breach in fact originated from a developer’s GitHub account being phished, which enabled the attacker to pivot into AWS, steal access tokens, and pivot to downstream customer environments.",[],{},"SLH insight box 6",{"sys":11613,"__typename":4645,"content":11614,"name":11625,"title":59},{"id":10329},{"json":11615},{"nodeType":1522,"data":11616,"content":11617},{},[11618],{"nodeType":866,"data":11619,"content":11620},{},[11621],{"nodeType":865,"value":11622,"marks":11623,"data":11624},"While the CyberHaven attacks were conducted by an unknown threat group, the MO of the attacker — pursuing financial gain, bypassing traditional defenses — is very much in-line with the Scattered Lapsus$ Hunters TTPs observed. ",[],{},"SLH insight box 7",{"sys":11627,"__typename":4645,"content":11628,"name":11650,"title":59},{"id":10527},{"json":11629},{"nodeType":1522,"data":11630,"content":11631},{},[11632],{"nodeType":866,"data":11633,"content":11634},{},[11635,11639,11646],{"nodeType":865,"value":11636,"marks":11637,"data":11638},"One of the common threads from all of these breaches is the risk posed by ",[],{},{"nodeType":905,"data":11640,"content":11641},{"uri":7294},[11642],{"nodeType":865,"value":11643,"marks":11644,"data":11645},"help desk attacks",[],{},{"nodeType":865,"value":11647,"marks":11648,"data":11649},", but it’s easy to over-index here. Naturally, making it possible for help desk operators to reset MFA for all users (including accounts with dangerous privileges) is always going to be targeted — but is fairly easy to address in principle by requiring escalations for high-risk changes. What is more interesting is that the vast majority of the help desk attacks featured in this article involved a single provider that is now no longer contracted by a number of the victims.",[],{},"SLH insight box 8",{"items":11652},[],{},"Analyzing \"Scattered Lapsus$ Hunters\" breaches since 2021",{"items":11656},[11657,12321,12782],{"__typename":1544,"sys":11658,"content":11660,"title":12307,"synopsis":12308,"hashTags":59,"publishedDate":12309,"slug":12310,"tagsCollection":12311,"authorsCollection":12317},{"id":11659},"62Zyr35VUmijkpupWk3hoD",{"json":11661},{"data":11662,"content":11663,"nodeType":1522},{},[11664,11680,11687,11690,11698,11705,11712,11731,11737,11744,11751,11758,11765,11768,11776,11783,11789,11796,11804,11811,11818,11824,11844,11850,11857,11864,11871,11877,11880,11888,11906,11913,11945,11952,11959,11965,11972,11979,11986,11989,11997,12013,12019,12026,12033,12039,12046,12053,12056,12064,12071,12091,12135,12142,12149,12156,12159,12167,12174,12181,12188,12191,12199,12206,12237,12257,12264,12267,12275,12282,12289],{"data":11665,"content":11666,"nodeType":866},{},[11667,11671,11676],{"data":11668,"marks":11669,"value":11670,"nodeType":865},{},[],"The view that \"the browser is the new endpoint\" and \"the new battleground for cyber attacks\" is becoming increasingly advocated by security leaders. But what does this ",{"data":11672,"marks":11673,"value":11675,"nodeType":865},{},[11674],{"type":2757},"actually",{"data":11677,"marks":11678,"value":11679,"nodeType":865},{},[]," mean for security teams? ",{"data":11681,"content":11682,"nodeType":866},{},[11683],{"data":11684,"marks":11685,"value":11686,"nodeType":865},{},[],"In this article, we’re cutting out the jargon to explore what a browser-based attack is, and what’s required for effective detection and response. ",{"data":11688,"content":11689,"nodeType":879},{},[],{"data":11691,"content":11692,"nodeType":889},{},[11693],{"data":11694,"marks":11695,"value":11697,"nodeType":865},{},[11696],{"type":887},"What is the goal of a browser-based attack?   ",{"data":11699,"content":11700,"nodeType":866},{},[11701],{"data":11702,"marks":11703,"value":11704,"nodeType":865},{},[],"First, it’s important to establish what the point of a browser-based attack is.",{"data":11706,"content":11707,"nodeType":866},{},[11708],{"data":11709,"marks":11710,"value":11711,"nodeType":865},{},[],"In most scenarios, attackers don’t think of themselves as attacking your web browser. Their end-goal is to compromise your business apps and data. That means going after the third-party apps and services that are now the backbone of business IT — and therefore the top target for attackers. ",{"data":11713,"content":11714,"nodeType":866},{},[11715,11719,11727],{"data":11716,"marks":11717,"value":11718,"nodeType":865},{},[],"The most common attack path today sees attackers log into third-party services, dump the data, and monetize it through extortion. You need only look at last year’s ",{"data":11720,"content":11722,"nodeType":905},{"uri":11721},"https://pushsecurity.com/blog/snowflake-retro?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=article",[11723],{"data":11724,"marks":11725,"value":1143,"nodeType":865},{},[11726],{"type":1070},{"data":11728,"marks":11729,"value":11730,"nodeType":865},{},[]," customer breaches or the still-ongoing Salesforce attacks to see the impact.",{"data":11732,"content":11736,"nodeType":875},{"target":11733},{"sys":11734},{"id":11735,"type":872,"linkType":873},"5agrVXzEdwALmew2F5SPDp",[],{"data":11738,"content":11739,"nodeType":866},{},[11740],{"data":11741,"marks":11742,"value":11743,"nodeType":865},{},[],"The most logical way to do this is by targeting users of those apps. And because of the changes to working practices, your users are more accessible than ever to external attackers.",{"data":11745,"content":11746,"nodeType":866},{},[11747],{"data":11748,"marks":11749,"value":11750,"nodeType":865},{},[],"Once upon a time, email was the primary communication channel with the wider world, and work happened locally — on your device, and inside your locked-down network environment. This made email and the endpoint the highest priority from a security perspective. But now, with modern work happening across a network of decentralized internet apps, and more varied communication channels outside of email, it’s harder to stop users from interacting with malicious content (at least, without significantly impeding their ability to do their jobs).",{"data":11752,"content":11753,"nodeType":866},{},[11754],{"data":11755,"marks":11756,"value":11757,"nodeType":865},{},[],"Given that the browser is the place where business apps are accessed and used, it makes sense that attacks are increasingly playing out there too. ",{"data":11759,"content":11760,"nodeType":866},{},[11761],{"data":11762,"marks":11763,"value":11764,"nodeType":865},{},[],"With that covered off, let’s take a closer look at the most prevalent browser-based attack techniques being used by attackers in the wild today.",{"data":11766,"content":11767,"nodeType":879},{},[],{"data":11769,"content":11770,"nodeType":889},{},[11771],{"data":11772,"marks":11773,"value":11775,"nodeType":865},{},[11774],{"type":887},"The 6 key browser-based attacks that security teams need to know about",{"data":11777,"content":11778,"nodeType":866},{},[11779],{"data":11780,"marks":11781,"value":11782,"nodeType":865},{},[],"Attacks that target users in their web browsers have seen an unprecedented rise in recent years. ",{"data":11784,"content":11788,"nodeType":875},{"target":11785},{"sys":11786},{"id":11787,"type":872,"linkType":873},"4ogNqZdObSIJXavHP44lom",[],{"data":11790,"content":11791,"nodeType":866},{},[11792],{"data":11793,"marks":11794,"value":11795,"nodeType":865},{},[],"Here's our breakdown of the top 6 browser-based attacks that should be on every security team's radar right now. ",{"data":11797,"content":11798,"nodeType":2315},{},[11799],{"data":11800,"marks":11801,"value":11803,"nodeType":865},{},[11802],{"type":887},"1. Phishing for credentials and sessions",{"data":11805,"content":11806,"nodeType":866},{},[11807],{"data":11808,"marks":11809,"value":11810,"nodeType":865},{},[],"The most direct way for an attacker to compromise a business application is to phish a user of that app. You might not necessarily think of phishing as a browser-based attack, but that’s exactly what it is today. ",{"data":11812,"content":11813,"nodeType":866},{},[11814],{"data":11815,"marks":11816,"value":11817,"nodeType":865},{},[],"Phishing tooling and infrastructure has evolved a lot in the past decade, while the changes to business IT means there are both many more vectors for phishing attack delivery, and apps and identities to target. Attackers can deliver links over instant messenger apps, social media, SMS, malicious ads, and using in-app messenger functionality, as well as sending emails directly from SaaS services to bypass email-based checks. Likewise, there are now hundreds of apps per enterprise to target, with varying levels of account security configuration. ",{"data":11819,"content":11823,"nodeType":875},{"target":11820},{"sys":11821},{"id":11822,"type":872,"linkType":873},"3SrKOgpedLMQRpKIZqUQur",[],{"data":11825,"content":11826,"nodeType":866},{},[11827,11831,11840],{"data":11828,"marks":11829,"value":11830,"nodeType":865},{},[],"Whereas phishing was once entirely focused on credential theft, modern phishing attacks see the attacker intercept the victim’s session on the target app, using reverse-proxy Attacker-in-the-Middle kits that are the standard choice for attackers today. This means most forms of MFA can be bypassed, with the exception of passkeys (though attackers are finding ways to work around passkeys using ",{"data":11832,"content":11834,"nodeType":905},{"uri":11833},"https://pushsecurity.com/blog/mfa-downgrade-attacks/?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=article",[11835],{"data":11836,"marks":11837,"value":11839,"nodeType":865},{},[11838],{"type":1070},"downgrade attacks",{"data":11841,"marks":11842,"value":11843,"nodeType":865},{},[],"). ",{"data":11845,"content":11849,"nodeType":875},{"target":11846},{"sys":11847},{"id":11848,"type":872,"linkType":873},"2sOFEdAwQZjWOGzNAlGavb",[],{"data":11851,"content":11852,"nodeType":866},{},[11853],{"data":11854,"marks":11855,"value":11856,"nodeType":865},{},[],"There are other key differences to be aware of too. Today, phishing operates on an industrial scale, using an array of obfuscation and detection evasion techniques. The latest generation of fully customized AitM phishing kits are dynamically obfuscating the code that loads the web page, implementing custom bot protection (e.g. CAPTCHA or Cloudflare Turnstile), using runtime anti-analysis features, and using legitimate SaaS and cloud services to host and deliver phishing links to cover their tracks.",{"data":11858,"content":11859,"nodeType":866},{},[11860],{"data":11861,"marks":11862,"value":11863,"nodeType":865},{},[],"This means that traditional anti-phishing tools at the email and network layer are struggling to keep up, with many attacks evading email-based detections (or bypassing email altogether). At the same time, proxy-based solutions now see a garbled mess of JavaScript code without the necessary context of what is actually happening in the browser to be able to piece it together effectively. Even if they don’t realize it, this means many organizations are now relying solely on blocking known-bad sites and hosts — a wildly ineffective solution in 2025 with the rate that attackers refresh and rotate their phishing infrastructure. ",{"data":11865,"content":11866,"nodeType":866},{},[11867],{"data":11868,"marks":11869,"value":11870,"nodeType":865},{},[],"These changes make phishing more effective than ever, and increasingly difficult to detect and block without being able to observe and analyze web pages that a user interacts with in real time — something only possible with browser-level visibility. ",{"data":11872,"content":11876,"nodeType":875},{"target":11873},{"sys":11874},{"id":11875,"type":872,"linkType":873},"1II2kHyOZcShLsexx1TAgy",[],{"data":11878,"content":11879,"nodeType":879},{},[],{"data":11881,"content":11882,"nodeType":2315},{},[11883],{"data":11884,"marks":11885,"value":11887,"nodeType":865},{},[11886],{"type":887},"2. Malicious copy and paste (aka. ClickFix, FileFix, etc.)",{"data":11889,"content":11890,"nodeType":866},{},[11891,11895,11903],{"data":11892,"marks":11893,"value":11894,"nodeType":865},{},[],"One of the biggest security trends in the past year has been the emergence of the attack technique known as ",{"data":11896,"content":11898,"nodeType":905},{"uri":11897},"https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/",[11899],{"data":11900,"marks":11901,"value":315,"nodeType":865},{},[11902],{"type":1070},{"data":11904,"marks":11905,"value":1711,"nodeType":865},{},[],{"data":11907,"content":11908,"nodeType":866},{},[11909],{"data":11910,"marks":11911,"value":11912,"nodeType":865},{},[],"Originally known as “Fake CAPTCHA”, these attacks attempt to trick users into running malicious commands on their device — typically by solving some form of verification challenge in the browser. ",{"data":11914,"content":11915,"nodeType":866},{},[11916,11920,11929,11933,11942],{"data":11917,"marks":11918,"value":11919,"nodeType":865},{},[],"In reality, by solving the challenge, the victim is actually copying malicious code from the page clipboard and running it on their device. It typically gives the victim instructions that involve clicking prompts and copying, pasting, and running commands directly in the Windows Run dialog box, Terminal, or PowerShell. Variants such as ",{"data":11921,"content":11923,"nodeType":905},{"uri":11922},"https://mrd0x.com/filefix-clickfix-alternative/",[11924],{"data":11925,"marks":11926,"value":11928,"nodeType":865},{},[11927],{"type":1070},"FileFix",{"data":11930,"marks":11931,"value":11932,"nodeType":865},{},[]," have also emerged which instead uses the File Explorer Address Bar to execute OS commands, while recent examples have seen this attack branch out to ",{"data":11934,"content":11936,"nodeType":905},{"uri":11935},"https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/",[11937],{"data":11938,"marks":11939,"value":11941,"nodeType":865},{},[11940],{"type":1070},"Mac via the macOS terminal",{"data":11943,"marks":11944,"value":1193,"nodeType":865},{},[],{"data":11946,"content":11947,"nodeType":866},{},[11948],{"data":11949,"marks":11950,"value":11951,"nodeType":865},{},[],"Most commonly, these attacks are used to deliver infostealer malware, using stolen session cookies and credentials to access business apps and services. ",{"data":11953,"content":11954,"nodeType":866},{},[11955],{"data":11956,"marks":11957,"value":11958,"nodeType":865},{},[],"Like modern credential and session phishing, links to malicious pages are distributed over various delivery channels and using a variety of lures, including impersonating CAPTCHA, Cloudflare Turnstile, simulating an error loading a webpage, and many more. ",{"data":11960,"content":11964,"nodeType":875},{"target":11961},{"sys":11962},{"id":11963,"type":872,"linkType":873},"6O9YiOfhpGFCDsTil9F3On",[],{"data":11966,"content":11967,"nodeType":866},{},[11968],{"data":11969,"marks":11970,"value":11971,"nodeType":865},{},[],"The variance in lure, and differences between different versions of the same lure, can make it difficult to fingerprint and detect based on visual elements alone. Also, many of the same protections being used to obfuscate and prevent analysis of phishing pages also apply to ClickFix pages, making it equally challenging to detect and block them. ",{"data":11973,"content":11974,"nodeType":866},{},[11975],{"data":11976,"marks":11977,"value":11978,"nodeType":865},{},[],"This leaves most of the detection and blocking down to endpoint-layer controls around user-level code execution and malware running on a device. The quantity of ClickFix-related headlines in the news would indicate that endpoint controls are being routinely bypassed, or perhaps evaded altogether by targeting personal or BYOD devices. ",{"data":11980,"content":11981,"nodeType":866},{},[11982],{"data":11983,"marks":11984,"value":11985,"nodeType":865},{},[],"There is a significant opportunity to detect these attacks in the browser and stop them at the earliest opportunity, before they reach the endpoint. Every ClickFix attack and variant has a key action in common — malicious code is copied from the page’s clipboard. In some cases, this happens without any user interaction (where the only requirement on the user is to run code that has been silently copied behind the scenes), presenting a strong indicator of malicious behavior that can be observed in the browser. ",{"data":11987,"content":11988,"nodeType":879},{},[],{"data":11990,"content":11991,"nodeType":2315},{},[11992],{"data":11993,"marks":11994,"value":11996,"nodeType":865},{},[11995],{"type":887},"3. Malicious OAuth integrations",{"data":11998,"content":11999,"nodeType":866},{},[12000,12004,12010],{"data":12001,"marks":12002,"value":12003,"nodeType":865},{},[],"Malicious OAuth integrations are another way for attackers to compromise an app by tricking a user into authorizing an integration with a malicious, attacker-controlled app, with the level of data access and functionality dictated by the scopes authorized in the request. This is also known as ",{"data":12005,"content":12006,"nodeType":905},{"uri":7641},[12007],{"data":12008,"marks":12009,"value":7647,"nodeType":865},{},[],{"data":12011,"marks":12012,"value":6352,"nodeType":865},{},[],{"data":12014,"content":12018,"nodeType":875},{"target":12015},{"sys":12016},{"id":12017,"type":872,"linkType":873},"5JaP4WSfFsFSbvaa9BQBOq",[],{"data":12020,"content":12021,"nodeType":866},{},[12022],{"data":12023,"marks":12024,"value":12025,"nodeType":865},{},[],"This is an effective way for attackers to bypass hardened authentication and access controls by sidestepping the typical login process to take over an account and compromise business apps. This includes phishing-resistant MFA methods like passkeys — since the standard login process does not apply. ",{"data":12027,"content":12028,"nodeType":866},{},[12029],{"data":12030,"marks":12031,"value":12032,"nodeType":865},{},[],"A variant of this attack has dominated the headlines recently with the ongoing Salesforce breaches. In this scenario, the attacker tricked the victim into authorizing an attacker-controlled OAuth app via the device code authorization flow in Salesforce, which requires the user to enter an 8-digit code in place of a password or MFA factor.",{"data":12034,"content":12038,"nodeType":875},{"target":12035},{"sys":12036},{"id":12037,"type":872,"linkType":873},"3odEFcUcpKN553gHh2P5yr",[],{"data":12040,"content":12041,"nodeType":866},{},[12042],{"data":12043,"marks":12044,"value":12045,"nodeType":865},{},[],"Preventing malicious OAuth grants being authorized requires tight in-app management of user permissions and tenant security settings. This is no mean feat when considering the 100s of apps in use across the modern enterprise, many of which are not centrally managed by IT and security teams (or in some cases, are completely unknown to them). Even then, you’re limited by the controls made available by the app vendor. In this case, Salesforce has announced planned changes to OAuth app authorization in order to improve security prompted by these attacks — but many more apps with insecure configs exist for attackers to take advantage of in future. ",{"data":12047,"content":12048,"nodeType":866},{},[12049],{"data":12050,"marks":12051,"value":12052,"nodeType":865},{},[],"However, unlike app-specific integrations, browser-based security tools are well positioned to observe OAuth grants across all apps accessed in the browser — even the ones the security team doesn’t manage or know about, or without needing to pay for the app’s special security add-on to get visibility.",{"data":12054,"content":12055,"nodeType":879},{},[],{"data":12057,"content":12058,"nodeType":2315},{},[12059],{"data":12060,"marks":12061,"value":12063,"nodeType":865},{},[12062],{"type":887},"4. Malicious browser extensions",{"data":12065,"content":12066,"nodeType":866},{},[12067],{"data":12068,"marks":12069,"value":12070,"nodeType":865},{},[],"Malicious browser extensions are another way for attackers to compromise your business apps by observing and capturing logins as they happen, and/or extracting session cookies and credentials saved in the browser cache and password manager. ",{"data":12072,"content":12073,"nodeType":866},{},[12074,12078,12087],{"data":12075,"marks":12076,"value":12077,"nodeType":865},{},[],"Attackers do this by creating their own malicious extension and tricking your users into installing it, or taking over an existing extension to gain access to browsers where it is already installed (",{"data":12079,"content":12081,"nodeType":905},{"uri":12080},"https://secureannex.com/blog/buying-browser-extensions/",[12082],{"data":12083,"marks":12084,"value":12086,"nodeType":865},{},[12085],{"type":1070},"it’s very easy for attackers to buy and add malicious updates to existing extensions",{"data":12088,"marks":12089,"value":12090,"nodeType":865},{},[],", easily passing extension web store security checks). ",{"data":12092,"content":12093,"nodeType":866},{},[12094,12098,12107,12111,12120,12123,12132],{"data":12095,"marks":12096,"value":12097,"nodeType":865},{},[],"The news around extension-based compromises has been on the rise since the ",{"data":12099,"content":12101,"nodeType":905},{"uri":12100},"https://www.bleepingcomputer.com/news/security/new-details-reveal-how-hackers-hijacked-35-google-chrome-extensions/",[12102],{"data":12103,"marks":12104,"value":12106,"nodeType":865},{},[12105],{"type":1070},"Cyberhaven extension",{"data":12108,"marks":12109,"value":12110,"nodeType":865},{},[]," was hacked in December 2024, along with at least 35 other extensions. Since then, there has been regular reporting on data-stealing extensions ",{"data":12112,"content":12114,"nodeType":905},{"uri":12113},"https://www.bleepingcomputer.com/news/security/data-stealing-chrome-extensions-impersonate-fortinet-youtube-vpns/",[12115],{"data":12116,"marks":12117,"value":12119,"nodeType":865},{},[12118],{"type":1070},"impersonating legitimate brands",{"data":12121,"marks":12122,"value":1454,"nodeType":865},{},[],{"data":12124,"content":12126,"nodeType":905},{"uri":12125},"https://www.bleepingcomputer.com/news/security/chrome-extensions-with-6-million-installs-have-hidden-tracking-code/",[12127],{"data":12128,"marks":12129,"value":12131,"nodeType":865},{},[12130],{"type":1070},"impacting millions of users",{"data":12133,"marks":12134,"value":1193,"nodeType":865},{},[],{"data":12136,"content":12137,"nodeType":866},{},[12138],{"data":12139,"marks":12140,"value":12141,"nodeType":865},{},[],"Risky browser extension permissions include broad data access, the ability to modify website content, track user activity, capture screenshots, and manage tabs or network requests. Permissions like \"read and change all data on all websites\" or access to cookies and browsing history are particularly dangerous as they can be exploited for session hijacking, data theft, malware injection, or phishing.",{"data":12143,"content":12144,"nodeType":866},{},[12145],{"data":12146,"marks":12147,"value":12148,"nodeType":865},{},[],"Generally, your employees should not be randomly installing browser extensions unless pre-approved by your security team. The reality, however, is that many organizations have very little visibility of the extensions their employees are using, and the potential risk they’re exposed to as a result. ",{"data":12150,"content":12151,"nodeType":866},{},[12152],{"data":12153,"marks":12154,"value":12155,"nodeType":865},{},[],"To tackle malicious extensions, security tools operating in the browser can track the browser extensions deployed, highlight risky permissions, compare with known-malicious extensions, identify fraudulent/unofficial versions of a legitimate extension, and highlight other risky properties commonly associated with malicious extensions (e.g. “Developer” extensions). ",{"data":12157,"content":12158,"nodeType":879},{},[],{"data":12160,"content":12161,"nodeType":2315},{},[12162],{"data":12163,"marks":12164,"value":12166,"nodeType":865},{},[12165],{"type":887},"5. Malicious file delivery",{"data":12168,"content":12169,"nodeType":866},{},[12170],{"data":12171,"marks":12172,"value":12173,"nodeType":865},{},[],"Malicious files have been a core part of malware delivery and credential theft for many years. Just as non-email channels like malvertising and drive-by attacks are used to deliver phishing and ClickFix lures, malicious files are also distributed through similar means — leaving malicious file detection to basic known-bad checks, sandbox analysis using a proxy (not that useful in the context of sandbox-aware malware) or runtime analysis on the endpoint. ",{"data":12175,"content":12176,"nodeType":866},{},[12177],{"data":12178,"marks":12179,"value":12180,"nodeType":865},{},[],"This doesn’t just have to be malicious executables directly dropping malware onto the device. File downloads can also contain additional links taking the user to malicious content. In fact, one of the most common types of downloadable content are HTML Applications (HTAs), commonly used to spawn local phishing pages to stealthily capture credentials. More recently, attackers have been weaponizing SVG files for a similar purpose, running as self-contained phishing pages that render fake login portals entirely client-side. ",{"data":12182,"content":12183,"nodeType":866},{},[12184],{"data":12185,"marks":12186,"value":12187,"nodeType":865},{},[],"Even if malicious content cannot always be flagged from surface-level inspection of a file, recording file downloads in the browser is a useful addition to endpoint-based malware protection, and provides another layer of defense against file downloads that perform client-side attacks, or redirect the user to malicious web-based content. ",{"data":12189,"content":12190,"nodeType":879},{},[],{"data":12192,"content":12193,"nodeType":2315},{},[12194],{"data":12195,"marks":12196,"value":12198,"nodeType":865},{},[12197],{"type":887},"6. Stolen credentials and MFA gaps",{"data":12200,"content":12201,"nodeType":866},{},[12202],{"data":12203,"marks":12204,"value":12205,"nodeType":865},{},[],"This last one isn’t so much a browser-based attack, but it is a product of them. When credentials are stolen through phishing or infostealer malware they can be used to take over accounts missing MFA. ",{"data":12207,"content":12208,"nodeType":866},{},[12209,12213,12220,12224,12233],{"data":12210,"marks":12211,"value":12212,"nodeType":865},{},[],"This isn’t the most sophisticated attack, but it’s very effective. You need only look at last year’s ",{"data":12214,"content":12215,"nodeType":905},{"uri":11721},[12216],{"data":12217,"marks":12218,"value":1143,"nodeType":865},{},[12219],{"type":1070},{"data":12221,"marks":12222,"value":12223,"nodeType":865},{},[]," account compromises or the ",{"data":12225,"content":12227,"nodeType":905},{"uri":12226},"https://pushsecurity.com/blog/why-attackers-are-targeting-jira-with-stolen-credentials?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=article",[12228],{"data":12229,"marks":12230,"value":12232,"nodeType":865},{},[12231],{"type":1070},"Jira",{"data":12234,"marks":12235,"value":12236,"nodeType":865},{},[]," attacks earlier this year to see how attackers harness stolen credentials at scale. ",{"data":12238,"content":12239,"nodeType":866},{},[12240,12244,12253],{"data":12241,"marks":12242,"value":12243,"nodeType":865},{},[],"With the modern enterprise using hundreds of apps, the likelihood that an app hasn’t been configured for mandatory MFA (if possible) is high. And even when an app has been configured for SSO and connected to your primary corporate identity, ",{"data":12245,"content":12247,"nodeType":905},{"uri":12246},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=sidebar",[12248],{"data":12249,"marks":12250,"value":12252,"nodeType":865},{},[12251],{"type":1070},"local “ghost logins” can continue to exist",{"data":12254,"marks":12255,"value":12256,"nodeType":865},{},[],", accepting passwords with no MFA required. Just having visibility of your primary Identity Provider accounts (e.g. Google, Microsoft, Okta) and SSO-connected apps doesn't give you a full picture of your identity surface.",{"data":12258,"content":12259,"nodeType":866},{},[12260],{"data":12261,"marks":12262,"value":12263,"nodeType":865},{},[],"Logins can also be observed in the browser — in fact, it’s as close to a universal source of truth as you’re going to get about how your employees are actually logging in, which apps they’re using, and whether MFA is present, enabling security teams to find and fix vulnerable logins before they can be exploited by attackers. ",{"data":12265,"content":12266,"nodeType":879},{},[],{"data":12268,"content":12269,"nodeType":889},{},[12270],{"data":12271,"marks":12272,"value":12274,"nodeType":865},{},[12273],{"type":887},"Conclusion",{"data":12276,"content":12277,"nodeType":866},{},[12278],{"data":12279,"marks":12280,"value":12281,"nodeType":865},{},[],"Attacks are increasingly happening in the browser. That makes it the perfect place to detect and respond to these attacks. But right now, the browser is a blind-spot for most security teams. ",{"data":12283,"content":12284,"nodeType":866},{},[12285],{"data":12286,"marks":12287,"value":12288,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your identity attack surface.",{"data":12290,"content":12291,"nodeType":866},{},[12292,12296,12304],{"data":12293,"marks":12294,"value":12295,"nodeType":865},{},[],"If you want to learn more about how Push helps you to detect and stop attacks in the browser, ",{"data":12297,"content":12299,"nodeType":905},{"uri":12298},"https://pushsecurity.com/demo?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=article",[12300],{"data":12301,"marks":12302,"value":7352,"nodeType":865},{},[12303],{"type":1070},{"data":12305,"marks":12306,"value":1193,"nodeType":865},{},[],"6 browser-based attacks every security team should be prepared for","What security teams need to know about the browser-based attack techniques that are the leading cause of breaches.","2025-09-05T00:00:00.000Z","6-browser-based-attacks-every-security-team-should-be-prepared-for",{"items":12312},[12313,12315],{"sys":12314,"name":2144},{"id":2143},{"sys":12316,"name":342},{"id":3008},{"items":12318},[12319],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":12320},{"url":3016},{"__typename":1544,"sys":12322,"content":12324,"title":12768,"synopsis":12769,"hashTags":59,"publishedDate":12770,"slug":12771,"tagsCollection":12772,"authorsCollection":12778},{"id":12323},"4vPEPmjd8MOlARD7oXfOrj",{"json":12325},{"data":12326,"content":12327,"nodeType":1522},{},[12328,12345,12361,12367,12374,12381,12384,12392,12411,12418,12424,12431,12437,12444,12450,12457,12463,12470,12476,12479,12487,12505,12511,12519,12539,12547,12580,12587,12595,12615,12623,12643,12649,12652,12659,12679,12686,12692,12695,12703,12722,12729,12736,12742],{"data":12329,"content":12330,"nodeType":866},{},[12331,12335,12342],{"data":12332,"marks":12333,"value":12334,"nodeType":865},{},[],"Push recently detected and blocked a high-risk LinkedIn phishing attack that demonstrated a number of crafty (and increasingly common) ",{"data":12336,"content":12337,"nodeType":905},{"uri":1701},[12338],{"data":12339,"marks":12340,"value":7121,"nodeType":865},{},[12341],{"type":1070},{"data":12343,"marks":12344,"value":1711,"nodeType":865},{},[],{"data":12346,"content":12347,"nodeType":866},{},[12348,12352,12357],{"data":12349,"marks":12350,"value":12351,"nodeType":865},{},[],"Phishing via LinkedIn is increasingly common, although it often goes undetected and unreported. This is to be expected when most of the industry’s data on phishing attacks comes from email security vendors and tools. In contrast to email-centric reporting, ",{"data":12353,"marks":12354,"value":12356,"nodeType":865},{},[12355],{"type":887},"34% of the phishing attacks intercepted by Push last month came through non-email channels",{"data":12358,"marks":12359,"value":12360,"nodeType":865},{},[]," like social media, IM platforms, malicious search engine ads, and in-app communications. ",{"data":12362,"content":12366,"nodeType":875},{"target":12363},{"sys":12364},{"id":12365,"type":872,"linkType":873},"7i8panfdFUqW9wqYkd9uDc",[],{"data":12368,"content":12369,"nodeType":866},{},[12370],{"data":12371,"marks":12372,"value":12373,"nodeType":865},{},[],"Phishing via LinkedIn is a great way to catch victims unawares and evade traditionally email-based anti-phishing controls. While often used for work and commonly accessed from corporate devices, it sits outside the purview of enterprise security tools, exploiting a visibility and control blind spot. ",{"data":12375,"content":12376,"nodeType":866},{},[12377],{"data":12378,"marks":12379,"value":12380,"nodeType":865},{},[],"Let’s break it down. ",{"data":12382,"content":12383,"nodeType":879},{},[],{"data":12385,"content":12386,"nodeType":889},{},[12387],{"data":12388,"marks":12389,"value":12391,"nodeType":865},{},[12390],{"type":887},"Phishing attack breakdown",{"data":12393,"content":12394,"nodeType":866},{},[12395,12399,12407],{"data":12396,"marks":12397,"value":12398,"nodeType":865},{},[],"The victim was sent a malicious link via LinkedIn DM relating to a fake investment opportunity for executives ",{"data":12400,"content":12402,"nodeType":905},{"uri":12401},"https://www.bleepingcomputer.com/news/security/linkedin-phishing-targets-finance-execs-with-fake-board-invites/",[12403],{"data":12404,"marks":12405,"value":12406,"nodeType":865},{},[],"to join the executive board of a newly created \"Common Wealth\" investment fund.",{"data":12408,"marks":12409,"value":12410,"nodeType":865},{},[]," ",{"data":12412,"content":12413,"nodeType":866},{},[12414],{"data":12415,"marks":12416,"value":12417,"nodeType":865},{},[],"After clicking the link, they were redirected three times — via Google Search, and then payrails-canaccord[.]icu/(redacted) — before being sent to a custom landing page hosted on firebasestorage.googleapis[.]com/(redacted). ",{"data":12419,"content":12423,"nodeType":875},{"target":12420},{"sys":12421},{"id":12422,"type":872,"linkType":873},"65PeJOKzn6Ba7FDUQRae3Q",[],{"data":12425,"content":12426,"nodeType":866},{},[12427],{"data":12428,"marks":12429,"value":12430,"nodeType":865},{},[],"Upon clicking on one of the document links on the page, the victim is prompted to “view with Microsoft”. ",{"data":12432,"content":12436,"nodeType":875},{"target":12433},{"sys":12434},{"id":12435,"type":872,"linkType":873},"4f27KuwTRx1Do59rs3JoVl",[],{"data":12438,"content":12439,"nodeType":866},{},[12440],{"data":12441,"marks":12442,"value":12443,"nodeType":865},{},[],"The user is then met with a Cloudflare Turnstile gate challenge at login.kggpho[.]icu before the page will fully render, and malicious content is loaded. ",{"data":12445,"content":12449,"nodeType":875},{"target":12446},{"sys":12447},{"id":12448,"type":872,"linkType":873},"3lpVmLBZSocOSGdlCKhKnD",[],{"data":12451,"content":12452,"nodeType":866},{},[12453],{"data":12454,"marks":12455,"value":12456,"nodeType":865},{},[],"The Microsoft-impersonating AITM phishing page is then served to the victim. Entering credentials and completing the MFA check will result in their Microsoft session being stolen by the attacker. ",{"data":12458,"content":12462,"nodeType":875},{"target":12459},{"sys":12460},{"id":12461,"type":872,"linkType":873},"5FCa4EJwyux13K9KBT3nd4",[],{"data":12464,"content":12465,"nodeType":866},{},[12466],{"data":12467,"marks":12468,"value":12469,"nodeType":865},{},[],"You can see the full timeline of events in the Detection Timeline below. ",{"data":12471,"content":12475,"nodeType":875},{"target":12472},{"sys":12473},{"id":12474,"type":872,"linkType":873},"8lizkPJcGdZhtWFV2QEwQ",[],{"data":12477,"content":12478,"nodeType":879},{},[],{"data":12480,"content":12481,"nodeType":889},{},[12482],{"data":12483,"marks":12484,"value":12486,"nodeType":865},{},[12485],{"type":887},"Detection evasion techniques observed",{"data":12488,"content":12489,"nodeType":866},{},[12490,12494,12501],{"data":12491,"marks":12492,"value":12493,"nodeType":865},{},[],"The attacker used a number of ",{"data":12495,"content":12496,"nodeType":905},{"uri":1701},[12497],{"data":12498,"marks":12499,"value":7121,"nodeType":865},{},[12500],{"type":1070},{"data":12502,"marks":12503,"value":12504,"nodeType":865},{},[]," to prevent the phishing site being analysed and detected by security tools. ",{"data":12506,"content":12510,"nodeType":875},{"target":12507},{"sys":12508},{"id":12509,"type":872,"linkType":873},"7q9D1MREwTCCpnjvZZ5wk1",[],{"data":12512,"content":12513,"nodeType":2315},{},[12514],{"data":12515,"marks":12516,"value":12518,"nodeType":865},{},[12517],{"type":887},"LinkedIn delivery",{"data":12520,"content":12521,"nodeType":866},{},[12522,12526,12535],{"data":12523,"marks":12524,"value":12525,"nodeType":865},{},[],"As we mentioned above, sending phishing lures via ",{"data":12527,"content":12529,"nodeType":905},{"uri":12528},"https://phishing-techniques.pushsecurity.com/techniques/social-media/",[12530],{"data":12531,"marks":12532,"value":12534,"nodeType":865},{},[12533],{"type":1070},"social media apps",{"data":12536,"marks":12537,"value":12538,"nodeType":865},{},[]," like LinkedIn is a great way to reach employees in a place that they expect to be contacted by people outside of their organization. By evading the traditional phishing control point altogether (email) attackers significantly reduce the risk of interception. ",{"data":12540,"content":12541,"nodeType":2315},{},[12542],{"data":12543,"marks":12544,"value":12546,"nodeType":865},{},[12545],{"type":887},"Lengthy redirect chain through trusted sites",{"data":12548,"content":12549,"nodeType":866},{},[12550,12554,12563,12567,12576],{"data":12551,"marks":12552,"value":12553,"nodeType":865},{},[],"Attackers use ",{"data":12555,"content":12557,"nodeType":905},{"uri":12556},"https://phishing-techniques.pushsecurity.com/techniques/domain-rotation-redirection/",[12558],{"data":12559,"marks":12560,"value":12562,"nodeType":865},{},[12561],{"type":1070},"lengthy redirect chains",{"data":12564,"marks":12565,"value":12566,"nodeType":865},{},[]," in combination with hosting pages on ",{"data":12568,"content":12570,"nodeType":905},{"uri":12569},"https://phishing-techniques.pushsecurity.com/techniques/trusted-website-hosting/",[12571],{"data":12572,"marks":12573,"value":12575,"nodeType":865},{},[12574],{"type":1070},"legitimate, trusted sites",{"data":12577,"marks":12578,"value":12579,"nodeType":865},{},[]," (in this case Firebase, Google’s app development platform). This is a technique we see a lot, with various Google and Microsoft sites cropping up time and again, including Google Forms, Google Sites, Google Script, Google AMP, Microsoft Dynamics, SharePoint, Azure Front Door, and many more, all used by attackers as part of their phishing attacks. ",{"data":12581,"content":12582,"nodeType":866},{},[12583],{"data":12584,"marks":12585,"value":12586,"nodeType":865},{},[],"Legitimate services are less likely to be flagged by link analysis tools and effectively cloak the initial URL delivered to the victim to increase the chance of successful delivery of and access to the link, while many services are excluded from page scanning tools owing to their association with trusted domains. ",{"data":12588,"content":12589,"nodeType":2315},{},[12590],{"data":12591,"marks":12592,"value":12594,"nodeType":865},{},[12593],{"type":887},"Bot protection",{"data":12596,"content":12597,"nodeType":866},{},[12598,12602,12611],{"data":12599,"marks":12600,"value":12601,"nodeType":865},{},[],"Attackers are using common ",{"data":12603,"content":12605,"nodeType":905},{"uri":12604},"https://phishing-techniques.pushsecurity.com/techniques/bot-protection/",[12606],{"data":12607,"marks":12608,"value":12610,"nodeType":865},{},[12609],{"type":1070},"bot protection",{"data":12612,"marks":12613,"value":12614,"nodeType":865},{},[]," technologies like CAPTCHA and Cloudflare Turnstile to prevent security bots from accessing their web pages to be able to analyse them (and therefore block pages from being automatically flagged). This requires anyone visiting the page to pass a bot check/challenge before the page can be loaded, meaning the full page cannot be analysed by automated tools. ",{"data":12616,"content":12617,"nodeType":2315},{},[12618],{"data":12619,"marks":12620,"value":12622,"nodeType":865},{},[12621],{"type":887},"Page obfuscation",{"data":12624,"content":12625,"nodeType":866},{},[12626,12630,12639],{"data":12627,"marks":12628,"value":12629,"nodeType":865},{},[],"Phishing pages ",{"data":12631,"content":12633,"nodeType":905},{"uri":12632},"https://phishing-techniques.pushsecurity.com/techniques/page-obfuscation/",[12634],{"data":12635,"marks":12636,"value":12638,"nodeType":865},{},[12637],{"type":1070},"change and even randomize elements of the page",{"data":12640,"marks":12641,"value":12642,"nodeType":865},{},[]," to avoid static fingerprints and defeat comparison-based checks against real pages. This includes the page title, text, images, backgrounds, logos, favicons, etc. — all of which may be signatured components using web page analysis tools. These elements can even be embedded in an encoded form so it isn’t present in the initial HTML, and is instead dynamically set at runtime when loaded. As an example, you can see that the page randomly generated the tab header text.",{"data":12644,"content":12648,"nodeType":875},{"target":12645},{"sys":12646},{"id":12647,"type":872,"linkType":873},"2bbOZC9M4y69ACDy7bn209",[],{"data":12650,"content":12651,"nodeType":879},{},[],{"data":12653,"content":12654,"nodeType":889},{},[12655],{"data":12656,"marks":12657,"value":7098,"nodeType":865},{},[12658],{"type":887},{"data":12660,"content":12661,"nodeType":866},{},[12662,12666,12675],{"data":12663,"marks":12664,"value":12665,"nodeType":865},{},[],"We’re seeing ",{"data":12667,"content":12669,"nodeType":905},{"uri":12668},"https://pushsecurity.com/blog/how-push-stopped-a-high-risk-linkedin-spear-phishing-attack/",[12670],{"data":12671,"marks":12672,"value":12674,"nodeType":865},{},[12673],{"type":1070},"many phishing campaigns pivoting to social media apps like LinkedIn",{"data":12676,"marks":12677,"value":12678,"nodeType":865},{},[]," and organizations should be on guard against this attack vector, which is highly effective at evading common anti-phishing controls.  ",{"data":12680,"content":12681,"nodeType":866},{},[12682],{"data":12683,"marks":12684,"value":12685,"nodeType":865},{},[],"Just because the attack happens over LinkedIn doesn’t lessen the impact — these are corporate credentials and accounts being targeted, even if it is nominally a “personal” application. Taking over a core identity like a Microsoft or Google account can have wide-ranging consequences, putting data at risk in both core apps and any downstream apps that can be accessed via SSO from the compromised account. ",{"data":12687,"content":12691,"nodeType":875},{"target":12688},{"sys":12689},{"id":12690,"type":872,"linkType":873},"6QzB0BlVC5mstXwXHvy2c3",[],{"data":12693,"content":12694,"nodeType":879},{},[],{"data":12696,"content":12697,"nodeType":889},{},[12698],{"data":12699,"marks":12700,"value":12702,"nodeType":865},{},[12701],{"type":887},"How Push stopped the attack",{"data":12704,"content":12705,"nodeType":866},{},[12706,12710,12718],{"data":12707,"marks":12708,"value":12709,"nodeType":865},{},[],"Push doesn’t detect the redirect tricks or rely on outdated domain TI feeds. The reason we detect these attacks (which make it through all the other layers of phishing protection) is that Push sees what your users see. It doesn’t matter what ",{"data":12711,"content":12712,"nodeType":905},{"uri":1701},[12713],{"data":12714,"marks":12715,"value":12717,"nodeType":865},{},[12716],{"type":1070},"delivery channel or camouflage methods are used",{"data":12719,"marks":12720,"value":12721,"nodeType":865},{},[],", Push shuts the attack down in real time, as the user loads the malicious page in their web browser.",{"data":12723,"content":12724,"nodeType":866},{},[12725],{"data":12726,"marks":12727,"value":12728,"nodeType":865},{},[],"This isn’t all we do: Push’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, malicious OAuth grants, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":12730,"content":12731,"nodeType":866},{},[12732],{"data":12733,"marks":12734,"value":12735,"nodeType":865},{},[],"Check out the demo below to see Push detect and block this attack in real-time. ",{"data":12737,"content":12741,"nodeType":875},{"target":12738},{"sys":12739},{"id":12740,"type":872,"linkType":873},"5VsFECWlJ1HNGtC0jUcPjH",[],{"data":12743,"content":12744,"nodeType":866},{},[12745,12748,12755,12758,12765],{"data":12746,"marks":12747,"value":8278,"nodeType":865},{},[],{"data":12749,"content":12750,"nodeType":905},{"uri":7323},[12751],{"data":12752,"marks":12753,"value":8286,"nodeType":865},{},[12754],{"type":1070},{"data":12756,"marks":12757,"value":8290,"nodeType":865},{},[],{"data":12759,"content":12760,"nodeType":905},{"uri":1512},[12761],{"data":12762,"marks":12763,"value":7352,"nodeType":865},{},[12764],{"type":1070},{"data":12766,"marks":12767,"value":1193,"nodeType":865},{},[],"New phishing campaign identified targeting LinkedIn users","Diving into the latest sophisticated LinkedIn phishing campaign intercepted by Push. ","2025-10-30T00:00:00.000Z","new-phishing-campaign-identified-targeting-linkedin-users",{"items":12773},[12774,12776],{"sys":12775,"name":342},{"id":3008},{"sys":12777,"name":2144},{"id":2143},{"items":12779},[12780],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":12781},{"url":3016},{"__typename":1544,"sys":12783,"content":12785,"title":13445,"synopsis":13446,"hashTags":59,"publishedDate":13447,"slug":13448,"tagsCollection":13449,"authorsCollection":13455},{"id":12784},"7dqGkFzSMA00bIJ94rW4na",{"json":12786},{"data":12787,"content":12788,"nodeType":1522},{},[12789,12796,12803,12809,12834,12854,12857,12865,12872,12879,12887,12907,12910,12918,12925,12931,12938,12944,12947,12955,12962,12969,12992,12999,13032,13039,13047,13066,13073,13079,13106,13137,13145,13152,13159,13192,13195,13203,13222,13229,13252,13259,13265,13268,13276,13283,13410,13413,13421,13428],{"data":12790,"content":12791,"nodeType":866},{},[12792],{"data":12793,"marks":12794,"value":12795,"nodeType":865},{},[],"As awareness grows around many MFA methods being “phishable” (i.e. not phishing resistant), passwordless authentication methods are being increasingly advocated. ",{"data":12797,"content":12798,"nodeType":866},{},[12799],{"data":12800,"marks":12801,"value":12802,"nodeType":865},{},[],"This is a good thing. The most commonly used MFA factors (like SMS codes, push notifications, and app-based OTP) are routinely bypassed, with modern reverse-proxy phishing kits the most common method. ",{"data":12804,"content":12808,"nodeType":875},{"target":12805},{"sys":12806},{"id":12807,"type":872,"linkType":873},"ImwzE2R9qaHaqlWn0GqIa",[],{"data":12810,"content":12811,"nodeType":866},{},[12812,12816,12821,12825,12830],{"data":12813,"marks":12814,"value":12815,"nodeType":865},{},[],"Often referred to as a “passkey”, passwordless authentication typically consists of a hardware security device that is built-into your laptop (e.g. the fingerprint sensor on a laptop) or something you plug into your device (e.g. a Yubikey). Because passkey-based logins are domain-bound, trying to use a passkey for ",{"data":12817,"marks":12818,"value":12820,"nodeType":865},{},[12819],{"type":1070},"microsoft.com",{"data":12822,"marks":12823,"value":12824,"nodeType":865},{},[]," on ",{"data":12826,"marks":12827,"value":12829,"nodeType":865},{},[12828],{"type":1070},"phishing.com",{"data":12831,"marks":12832,"value":12833,"nodeType":865},{},[]," simply won’t generate the correct value to pass the authentication check, even when proxied using an AitM kit. ",{"data":12835,"content":12836,"nodeType":866},{},[12837,12841,12851],{"data":12838,"marks":12839,"value":12840,"nodeType":865},{},[],"However, attackers have realized that even as these new phishing-resistant methods are starting to become used, most users still have alternative MFA methods active. The attacker can then do what’s called a ",{"data":12842,"content":12844,"nodeType":905},{"uri":12843},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/mfa_downgrade/description.md",[12845],{"data":12846,"marks":12847,"value":12850,"nodeType":865},{},[12848,12849],{"type":1070},{"type":887},"downgrade attack",{"data":12852,"marks":12853,"value":1193,"nodeType":865},{},[],{"data":12855,"content":12856,"nodeType":879},{},[],{"data":12858,"content":12859,"nodeType":889},{},[12860],{"data":12861,"marks":12862,"value":12864,"nodeType":865},{},[12863],{"type":887},"Downgrade attacks 101",{"data":12866,"content":12867,"nodeType":866},{},[12868],{"data":12869,"marks":12870,"value":12871,"nodeType":865},{},[],"When conducting an Attacker-in-the-Middle phishing attack, the attacker doesn’t need to relay 100% of the messages accurately. Instead, they can alter some of them. The app might ask the user “You need to MFA — do you want to use your passkey, or your backup authenticator code?”, but the phishing website might modify this page to say “You need to MFA — use your backup authenticator code” not giving you the option to use your secure passkey. This is called a downgrade attack.",{"data":12873,"content":12874,"nodeType":866},{},[12875],{"data":12876,"marks":12877,"value":12878,"nodeType":865},{},[],"This can also be applied to accounts that use SSO as the default login method. In this scenario, the phish kit can select a backup username and password option to allow the phishing attack to proceed.  ",{"data":12880,"content":12881,"nodeType":866},{},[12882],{"data":12883,"marks":12884,"value":12886,"nodeType":865},{},[12885],{"type":887},"So, you have a situation where even if a phishing-resistant login method exists, the presence of a less secure backup method means the account is still vulnerable to phishing attacks. ",{"data":12888,"content":12889,"nodeType":866},{},[12890,12894,12903],{"data":12891,"marks":12892,"value":12893,"nodeType":865},{},[],"These attacks are effective across a number of sites and login methods that support passkey-based logins, for example, Windows Hello, Okta FastPass, and Google Workspace. As an example, here’s a link to a ",{"data":12895,"content":12897,"nodeType":905},{"uri":12896},"https://github.com/yudasm/WHfB-o365-Phishlet",[12898],{"data":12899,"marks":12900,"value":12902,"nodeType":865},{},[12901],{"type":1070},"custom phishlet for Evilginx",{"data":12904,"marks":12905,"value":12906,"nodeType":865},{},[]," targeting Windows Hello for Business. A small caveat is that changes made by Microsoft have since broken this plugin, but we were able to write our own custom phishlet to achieve the same outcome. ",{"data":12908,"content":12909,"nodeType":879},{},[],{"data":12911,"content":12912,"nodeType":889},{},[12913],{"data":12914,"marks":12915,"value":12917,"nodeType":865},{},[12916],{"type":887},"MFA downgrade in action",{"data":12919,"content":12920,"nodeType":866},{},[12921],{"data":12922,"marks":12923,"value":12924,"nodeType":865},{},[],"Check out the video below to see an example of using Evilginx with a custom phishlet to downgrade authentication for a Microsoft account using Windows Hello. ",{"data":12926,"content":12930,"nodeType":875},{"target":12927},{"sys":12928},{"id":12929,"type":872,"linkType":873},"54I3YQ2gK26a8FIocQ3WYT",[],{"data":12932,"content":12933,"nodeType":866},{},[12934],{"data":12935,"marks":12936,"value":12937,"nodeType":865},{},[],"We’ve encountered similar functionality in criminal phishing platforms we’ve investigated such as Tycoon — in this case, targeting Google accounts. This snippet is notable in that it includes JavaScript to abuse UI features to bypass passkeys.",{"data":12939,"content":12943,"nodeType":875},{"target":12940},{"sys":12941},{"id":12942,"type":872,"linkType":873},"5Vya1VApSisr0000HuTLY2",[],{"data":12945,"content":12946,"nodeType":879},{},[],{"data":12948,"content":12949,"nodeType":889},{},[12950],{"data":12951,"marks":12952,"value":12954,"nodeType":865},{},[12953],{"type":887},"Mitigations (and challenges)",{"data":12956,"content":12957,"nodeType":866},{},[12958],{"data":12959,"marks":12960,"value":12961,"nodeType":865},{},[],"MFA downgrade is made possible by the existence of backup authentication methods. So the obvious solution is to remove backup/unused login and MFA methods from your accounts, ensuring you’re accessing apps using SSO from a hardened Identity Provider (IdP) account (e.g. Okta, Entra, Google Workspace). ",{"data":12963,"content":12964,"nodeType":866},{},[12965],{"data":12966,"marks":12967,"value":12968,"nodeType":865},{},[],"In the ideal world, you’d be:",{"data":12970,"content":12971,"nodeType":2718},{},[12972,12982],{"data":12973,"content":12974,"nodeType":2654},{},[12975],{"data":12976,"content":12977,"nodeType":866},{},[12978],{"data":12979,"marks":12980,"value":12981,"nodeType":865},{},[],"Using only one IdP account, which you access via passkey, with no backup methods.",{"data":12983,"content":12984,"nodeType":2654},{},[12985],{"data":12986,"content":12987,"nodeType":866},{},[12988],{"data":12989,"marks":12990,"value":12991,"nodeType":865},{},[],"Accessing all business apps using SSO from your locked-down IdP account. ",{"data":12993,"content":12994,"nodeType":866},{},[12995],{"data":12996,"marks":12997,"value":12998,"nodeType":865},{},[],"The reality is way different, though. Because going totally passwordless is hard. It requires a large investment of time, money, and training for end-users. You’ll find many cautionary tales of companies starting on their passkey adoption journey and ultimately failing to make it a reality. This is largely because:",{"data":13000,"content":13001,"nodeType":2718},{},[13002,13012,13022],{"data":13003,"content":13004,"nodeType":2654},{},[13005],{"data":13006,"content":13007,"nodeType":866},{},[13008],{"data":13009,"marks":13010,"value":13011,"nodeType":865},{},[],"In environments with a mix of older and newer infrastructure, it can be challenging to get complete coverage. ",{"data":13013,"content":13014,"nodeType":2654},{},[13015],{"data":13016,"content":13017,"nodeType":866},{},[13018],{"data":13019,"marks":13020,"value":13021,"nodeType":865},{},[],"Not every device comes with an in-built biometric identification method, so you need to use a second device — which employees may struggle with (especially when they lose it and aren’t familiar with how to regain account access).",{"data":13023,"content":13024,"nodeType":2654},{},[13025],{"data":13026,"content":13027,"nodeType":866},{},[13028],{"data":13029,"marks":13030,"value":13031,"nodeType":865},{},[],"Most apps don’t allow you to log in directly with a passkey, meaning you need to SSO from your IdP account. But many apps don’t support every preferred SSO provider, and fail to provide SAML support, so there can be gaps.  ",{"data":13033,"content":13034,"nodeType":866},{},[13035],{"data":13036,"marks":13037,"value":13038,"nodeType":865},{},[],"And ultimately, because of the self-service, product-led growth fuelled nature of most online services today, it’s easy for users to slip back into using passwords — and hard for security teams to find and remove them (particularly if an app isn’t centrally managed). And the level of support that different apps provide users and administrators to secure how they access their services varies significantly. ",{"data":13040,"content":13041,"nodeType":2315},{},[13042],{"data":13043,"marks":13044,"value":13046,"nodeType":865},{},[13045],{"type":887},"Most apps make removing phishable authentication hard",{"data":13048,"content":13049,"nodeType":866},{},[13050,13054,13062],{"data":13051,"marks":13052,"value":13053,"nodeType":865},{},[],"While some providers are taking steps to go passwordless by default, which makes it easier to remove passwords (e.g. ",{"data":13055,"content":13057,"nodeType":905},{"uri":13056},"https://techcommunity.microsoft.com/blog/microsoft-entra-blog/introducing-password-removal-for-microsoft-accounts/2747280",[13058],{"data":13059,"marks":13060,"value":7564,"nodeType":865},{},[13061],{"type":1070},{"data":13063,"marks":13064,"value":13065,"nodeType":865},{},[]," recently made a big deal of its desire to get rid of passwords), the quality of identity security management functionality varies significantly from app to app. ",{"data":13067,"content":13068,"nodeType":866},{},[13069],{"data":13070,"marks":13071,"value":13072,"nodeType":865},{},[],"Many apps default to the most recently used or strongest login method, but very few automatically lock you in to using the strongest method available. Most of the time, these kinds of controls also need to be configured in the app — which can be challenging if your security team doesn’t manage it (or simply isn’t aware of it). ",{"data":13074,"content":13078,"nodeType":875},{"target":13075},{"sys":13076},{"id":13077,"type":872,"linkType":873},"4X9MR0CbSMltOmw767XNOm",[],{"data":13080,"content":13081,"nodeType":866},{},[13082,13086,13091,13095,13102],{"data":13083,"marks":13084,"value":13085,"nodeType":865},{},[],"Finally, configuring MFA is often an additive process — you start by adding a phone number, then you add an authenticator app or a passkey. Just like we find that most accounts with SSO ",{"data":13087,"marks":13088,"value":13090,"nodeType":865},{},[13089],{"type":887},"also",{"data":13092,"marks":13093,"value":13094,"nodeType":865},{},[]," have a password login configured (also known as ",{"data":13096,"content":13097,"nodeType":905},{"uri":9104},[13098],{"data":13099,"marks":13100,"value":950,"nodeType":865},{},[13101],{"type":1070},{"data":13103,"marks":13104,"value":13105,"nodeType":865},{},[],"), most accounts with MFA typically have multiple methods attached to their account. ",{"data":13107,"content":13108,"nodeType":866},{},[13109,13113,13122,13125,13133],{"data":13110,"marks":13111,"value":13112,"nodeType":865},{},[],"The result is that even if you can successfully lock down a handful of apps, many more will continue to be susceptible to phishing attacks using commonly available downgrade functionality. And as attackers diversify the apps they target (such as these recent examples targeting ",{"data":13114,"content":13116,"nodeType":905},{"uri":13115},"https://pushsecurity.com/blog/investigating-a-recent-malvertising-campaign-targeting-onfido-customers/",[13117],{"data":13118,"marks":13119,"value":13121,"nodeType":865},{},[13120],{"type":1070},"Onfido",{"data":13123,"marks":13124,"value":7651,"nodeType":865},{},[],{"data":13126,"content":13127,"nodeType":905},{"uri":1214},[13128],{"data":13129,"marks":13130,"value":13132,"nodeType":865},{},[13131],{"type":1070},"MailChimp",{"data":13134,"marks":13135,"value":13136,"nodeType":865},{},[],"), this becomes increasingly likely. ",{"data":13138,"content":13139,"nodeType":2315},{},[13140],{"data":13141,"marks":13142,"value":13144,"nodeType":865},{},[13143],{"type":887},"Conditional access is a useful mitigation if configured properly, but only on apps which support it",{"data":13146,"content":13147,"nodeType":866},{},[13148],{"data":13149,"marks":13150,"value":13151,"nodeType":865},{},[],"Conditional access policies are a useful last line of defense against account takeover attacks by denying logins that don't meet certain criteria, even if they user is able to authenticate. In larger IdP platforms that typically support more granular conditional access policies, this is a useful addition when configured correctly. However, many apps simply don't support conditional access, so will be vulnerable to attackers targeting them directly (as opposed to first logging into e.g. Microsoft or Google, and then accessing downstream apps via SSO). ",{"data":13153,"content":13154,"nodeType":866},{},[13155],{"data":13156,"marks":13157,"value":13158,"nodeType":865},{},[],"That said, locking down your core IdP platforms with robust conditional access should be a top priority for security teams. Useful policies that should be configured include:",{"data":13160,"content":13161,"nodeType":2718},{},[13162,13172,13182],{"data":13163,"content":13164,"nodeType":2654},{},[13165],{"data":13166,"content":13167,"nodeType":866},{},[13168],{"data":13169,"marks":13170,"value":13171,"nodeType":865},{},[],"Limiting logins to domain-joined devices.",{"data":13173,"content":13174,"nodeType":2654},{},[13175],{"data":13176,"content":13177,"nodeType":866},{},[13178],{"data":13179,"marks":13180,"value":13181,"nodeType":865},{},[],"Set phishing-resistant MFA as required. ",{"data":13183,"content":13184,"nodeType":2654},{},[13185],{"data":13186,"content":13187,"nodeType":866},{},[13188],{"data":13189,"marks":13190,"value":13191,"nodeType":865},{},[],"(Where possible) limit logins to trusted IP ranges. ",{"data":13193,"content":13194,"nodeType":879},{},[],{"data":13196,"content":13197,"nodeType":889},{},[13198],{"data":13199,"marks":13200,"value":13202,"nodeType":865},{},[13201],{"type":887},"Tackling MFA downgrade with Push Security",{"data":13204,"content":13205,"nodeType":866},{},[13206,13210,13218],{"data":13207,"marks":13208,"value":13209,"nodeType":865},{},[],"Phishing-resistant authentication methods like passkeys are key to the future of enterprise identity security, but organizations need to recognize that adopting passkeys isn’t a silver bullet. Ensuring that passkeys are the only authentication method supported by your business apps is no mean feat, considering ",{"data":13211,"content":13212,"nodeType":905},{"uri":6333},[13213],{"data":13214,"marks":13215,"value":13217,"nodeType":865},{},[13216],{"type":1070},"most organizations are using hundreds of them",{"data":13219,"marks":13220,"value":13221,"nodeType":865},{},[]," — all with their own specific ways of handling and administering identities. ",{"data":13223,"content":13224,"nodeType":866},{},[13225],{"data":13226,"marks":13227,"value":13228,"nodeType":865},{},[],"That’s why we support a layered defense, providing last-mile protection by:",{"data":13230,"content":13231,"nodeType":2718},{},[13232,13242],{"data":13233,"content":13234,"nodeType":2654},{},[13235],{"data":13236,"content":13237,"nodeType":866},{},[13238],{"data":13239,"marks":13240,"value":13241,"nodeType":865},{},[],"Intercepting and blocking phishing attacks in the browser to prevent AiTM attacks using downgrade techniques.",{"data":13243,"content":13244,"nodeType":2654},{},[13245],{"data":13246,"content":13247,"nodeType":866},{},[13248],{"data":13249,"marks":13250,"value":13251,"nodeType":865},{},[],"Identifying backup MFA and login methods across the business apps your employees use, so they can be removed (individually or through app-level configuration changes).",{"data":13253,"content":13254,"nodeType":866},{},[13255],{"data":13256,"marks":13257,"value":13258,"nodeType":865},{},[],"Here’s how it works.",{"data":13260,"content":13264,"nodeType":875},{"target":13261},{"sys":13262},{"id":13263,"type":872,"linkType":873},"2uvItnfaOQZHa4a9BIIhRn",[],{"data":13266,"content":13267,"nodeType":879},{},[],{"data":13269,"content":13270,"nodeType":889},{},[13271],{"data":13272,"marks":13273,"value":13275,"nodeType":865},{},[13274],{"type":887},"Further reading",{"data":13277,"content":13278,"nodeType":866},{},[13279],{"data":13280,"marks":13281,"value":13282,"nodeType":865},{},[],"MFA downgrade is just one method of getting into an otherwise locked-down account. Attackers are also finding ways to bypass the standard authentication process entirely, through: ",{"data":13284,"content":13285,"nodeType":2718},{},[13286,13321,13355,13375],{"data":13287,"content":13288,"nodeType":2654},{},[13289],{"data":13290,"content":13291,"nodeType":866},{},[13292,13295,13304,13308,13317],{"data":13293,"marks":13294,"value":21,"nodeType":865},{},[],{"data":13296,"content":13298,"nodeType":905},{"uri":13297},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/app_specific_password_phishing/description.md",[13299],{"data":13300,"marks":13301,"value":13303,"nodeType":865},{},[13302],{"type":1070},"App-specific password phishing",{"data":13305,"marks":13306,"value":13307,"nodeType":865},{},[],", where attackers can abuse functionality designed to enable users to log into apps that don’t support modern authentication. (",{"data":13309,"content":13311,"nodeType":905},{"uri":13310},"https://pushsecurity.com/blog/app-specific-password-phishing/",[13312],{"data":13313,"marks":13314,"value":13316,"nodeType":865},{},[13315],{"type":1070},"Read the article for more information here",{"data":13318,"marks":13319,"value":13320,"nodeType":865},{},[],").",{"data":13322,"content":13323,"nodeType":2654},{},[13324],{"data":13325,"content":13326,"nodeType":866},{},[13327,13330,13338,13342,13351],{"data":13328,"marks":13329,"value":21,"nodeType":865},{},[],{"data":13331,"content":13332,"nodeType":905},{"uri":7641},[13333],{"data":13334,"marks":13335,"value":13337,"nodeType":865},{},[13336],{"type":1070},"Consent phishing",{"data":13339,"marks":13340,"value":13341,"nodeType":865},{},[],", which sees the victim accept OAuth scopes for an attacker-controlled app integration granting access to the account without needing to directly compromise it. (",{"data":13343,"content":13345,"nodeType":905},{"uri":13344},"https://pushsecurity.com/blog/how-consent-phishing-is-evolving/",[13346],{"data":13347,"marks":13348,"value":13350,"nodeType":865},{},[13349],{"type":1070},"You can read more about recent examples here",{"data":13352,"marks":13353,"value":13354,"nodeType":865},{},[],".) ",{"data":13356,"content":13357,"nodeType":2654},{},[13358],{"data":13359,"content":13360,"nodeType":866},{},[13361,13364,13371],{"data":13362,"marks":13363,"value":21,"nodeType":865},{},[],{"data":13365,"content":13366,"nodeType":905},{"uri":7654},[13367],{"data":13368,"marks":13369,"value":360,"nodeType":865},{},[13370],{"type":1070},{"data":13372,"marks":13373,"value":13374,"nodeType":865},{},[],", functionally very similar to consent phishing but involving the victim entering a code for authorization. ",{"data":13376,"content":13377,"nodeType":2654},{},[13378],{"data":13379,"content":13380,"nodeType":866},{},[13381,13384,13393,13397,13406],{"data":13382,"marks":13383,"value":21,"nodeType":865},{},[],{"data":13385,"content":13387,"nodeType":905},{"uri":13386},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/cross-idp_impersonation/description.md",[13388],{"data":13389,"marks":13390,"value":13392,"nodeType":865},{},[13391],{"type":1070},"Cross-IdP impersonation",{"data":13394,"marks":13395,"value":13396,"nodeType":865},{},[],", which sees the attacker register a new IdP connected to the victim’s email account that can be used to access connected apps via SSO without directly compromising the primary IdP. (",{"data":13398,"content":13400,"nodeType":905},{"uri":13399},"https://pushsecurity.com/blog/a-new-class-of-phishing-verification-phishing-and-cross-idp-impersonation/",[13401],{"data":13402,"marks":13403,"value":13405,"nodeType":865},{},[13404],{"type":1070},"You can read more about this here",{"data":13407,"marks":13408,"value":13409,"nodeType":865},{},[],".)",{"data":13411,"content":13412,"nodeType":879},{},[],{"data":13414,"content":13415,"nodeType":889},{},[13416],{"data":13417,"marks":13418,"value":13420,"nodeType":865},{},[13419],{"type":887},"Learn more",{"data":13422,"content":13423,"nodeType":866},{},[13424],{"data":13425,"marks":13426,"value":13427,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use, like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more.",{"data":13429,"content":13430,"nodeType":866},{},[13431,13435,13442],{"data":13432,"marks":13433,"value":13434,"nodeType":865},{},[],"If you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":13436,"content":13437,"nodeType":905},{"uri":3686},[13438],{"data":13439,"marks":13440,"value":7352,"nodeType":865},{},[13441],{"type":1070},{"data":13443,"marks":13444,"value":1193,"nodeType":865},{},[],"MFA downgrade: How attackers are getting around phishing-resistant authentication","MFA downgrade attacks are an increasingly common technique used by attackers to bypass phishing-resistant authentication methods registered to an account.","2025-07-21T00:00:00.000Z","mfa-downgrade-attacks",{"items":13450},[13451,13453],{"sys":13452,"name":342},{"id":3008},{"sys":13454,"name":2144},{"id":2143},{"items":13456},[13457],{"fullName":13458,"firstName":13459,"jobTitle":13460,"profilePicture":13461},"Luke Jennings","Luke","Vice President, R&D",{"url":13462},"https://images.ctfassets.net/y1cdw1ablpvd/4Hosb4zKi1dA0PUyDLMe1h/27e09d894861f2196ba794037986fb08/T016S22KZ96-U02NVQM7ZD4-57761d542d83-512.jpeg","blog/scattered-lapsus-hunters",{"json":13465},{"data":13466,"content":13467,"nodeType":1522},{},[13468],{"data":13469,"content":13470,"nodeType":866},{},[13471],{"data":13472,"marks":13473,"value":13474,"nodeType":865},{},[],"In this blog post, we’ll be taking a closer look at the breaches linked to Scattered Lapsus$ Hunters, the evolution of TTPs that makes them so successful, and how they’re shaping the current and next generation of cyber criminals.",{"id":9093,"publishedAt":13476},"2026-08-12T11:53:35.368Z",{"items":13478},[13479,13481],{"sys":13480,"name":2144},{"id":2143},{"sys":13482,"name":342},{"id":3008},{"items":13484},[13485,13487,13489,13491,13493,13495,13497,13499,13501,13503,13505,13507,13509,13511,13513],{"sys":13486,"name":279,"slug":280,"tier":31},{"id":276},{"sys":13488,"name":413,"slug":414,"tier":31},{"id":410},{"sys":13490,"name":642,"slug":643,"tier":31},{"id":639},{"sys":13492,"name":650,"slug":651,"tier":45},{"id":647},{"sys":13494,"name":261,"slug":262,"tier":45},{"id":258},{"sys":13496,"name":404,"slug":405,"tier":45},{"id":401},{"sys":13498,"name":537,"slug":538,"tier":45},{"id":534},{"sys":13500,"name":333,"slug":334,"tier":45},{"id":330},{"sys":13502,"name":607,"slug":608,"tier":45},{"id":604},{"sys":13504,"name":484,"slug":485,"tier":45},{"id":481},{"sys":13506,"name":288,"slug":289,"tier":45},{"id":285},{"sys":13508,"name":422,"slug":423,"tier":45},{"id":419},{"sys":13510,"name":571,"slug":572,"tier":45},{"id":568},{"sys":13512,"name":528,"slug":529,"tier":45},{"id":525},{"sys":13514,"name":395,"slug":396,"tier":45},{"id":392},"cPGKjifHC8Xc0ke0Qls0IvBKrqcQS7B54QT7CK7Q1JI",{"id":13517,"title":13518,"authorsCollection":13519,"content":13524,"extension":228,"faqItemsCollection":14197,"faqTitle":59,"featured":6,"hashTags":59,"meta":14199,"metaTitle":14200,"ogImage":59,"postType":14201,"publishedDate":14202,"relatedBlogPostsCollection":14203,"slug":15701,"stem":15702,"subtitle":15703,"summary":15704,"synopsis":15715,"sys":15716,"tagsCollection":15719,"topicsCollection":15725,"__hash__":15755},"blog/blog/introducing-malicious-copy-paste-detection.json","Introducing malicious copy and paste detection",{"items":13520},[13521],{"fullName":3012,"firstName":3013,"jobTitle":3014,"socialLinks":13522,"profilePicture":13523},[6742],{"url":3016},{"json":13525,"links":14137},{"data":13526,"content":13527,"nodeType":1522},{},[13528,13569,13626,13642,13647,13654,13657,13665,13672,13679,13686,13704,13711,13717,13736,13742,13745,13753,13760,13768,13787,13794,13800,13807,13815,13822,13829,13835,13842,13875,13881,13889,13908,13915,13938,13945,13952,13958,13965,13968,13976,13990,14009,14016,14023,14030,14035,14043,14062,14065,14072,14079,14086,14093,14100,14126,14131],{"data":13529,"content":13530,"nodeType":866},{},[13531,13534,13541,13545,13553,13557,13565],{"data":13532,"marks":13533,"value":11894,"nodeType":865},{},[],{"data":13535,"content":13536,"nodeType":905},{"uri":11897},[13537],{"data":13538,"marks":13539,"value":315,"nodeType":865},{},[13540],{"type":1070},{"data":13542,"marks":13543,"value":13544,"nodeType":865},{},[],". Various reports indicate that ClickFix is fast becoming one of the most prevalent attack techniques this year, with ",{"data":13546,"content":13547,"nodeType":905},{"uri":8893},[13548],{"data":13549,"marks":13550,"value":13552,"nodeType":865},{},[13551],{"type":1070},"one study",{"data":13554,"marks":13555,"value":13556,"nodeType":865},{},[]," reporting that email-based ClickFix attacks have increased by 400% YOY, and ",{"data":13558,"content":13559,"nodeType":905},{"uri":8905},[13560],{"data":13561,"marks":13562,"value":13564,"nodeType":865},{},[13563],{"type":1070},"another",{"data":13566,"marks":13567,"value":13568,"nodeType":865},{},[]," highlighting a 517% increase in the past 6 months. ",{"data":13570,"content":13571,"nodeType":866},{},[13572,13576,13585,13588,13597,13600,13609,13613,13622],{"data":13573,"marks":13574,"value":13575,"nodeType":865},{},[],"ClickFix is known to be regularly used by the Interlock ransomware group and other prolific threat actors. A number of recent public data breaches have been linked to ClickFix attacks as the attack vector, such as ",{"data":13577,"content":13579,"nodeType":905},{"uri":13578},"https://www.bleepingcomputer.com/news/security/kettering-health-confirms-interlock-ransomware-behind-cyberattack/",[13580],{"data":13581,"marks":13582,"value":13584,"nodeType":865},{},[13583],{"type":1070},"Kettering Health",{"data":13586,"marks":13587,"value":7148,"nodeType":865},{},[],{"data":13589,"content":13591,"nodeType":905},{"uri":13590},"https://www.bleepingcomputer.com/news/security/interlock-ransomware-claims-davita-attack-leaks-stolen-data/",[13592],{"data":13593,"marks":13594,"value":13596,"nodeType":865},{},[13595],{"type":1070},"DaVita",{"data":13598,"marks":13599,"value":7148,"nodeType":865},{},[],{"data":13601,"content":13603,"nodeType":905},{"uri":13602},"https://www.infosecurity-magazine.com/news/st-paul-mayor-interlock-data-leak/",[13604],{"data":13605,"marks":13606,"value":13608,"nodeType":865},{},[13607],{"type":1070},"City of St. Paul, Minnesota",{"data":13610,"marks":13611,"value":13612,"nodeType":865},{},[],", and the ",{"data":13614,"content":13616,"nodeType":905},{"uri":13615},"https://www.blackfog.com/texas-tech-cyberattack-1-4m-records-compromised/",[13617],{"data":13618,"marks":13619,"value":13621,"nodeType":865},{},[13620],{"type":1070},"Texas Tech University Health Sciences Centers",{"data":13623,"marks":13624,"value":13625,"nodeType":865},{},[]," (with many more breaches likely to involve ClickFix where the attack vector wasn’t known or disclosed).",{"data":13627,"content":13628,"nodeType":866},{},[13629,13633,13638],{"data":13630,"marks":13631,"value":13632,"nodeType":865},{},[],"Push’s latest feature, ",{"data":13634,"marks":13635,"value":13637,"nodeType":865},{},[13636],{"type":887},"malicious copy and paste detection",{"data":13639,"marks":13640,"value":13641,"nodeType":865},{},[],", tackles ClickFix-style attacks at the earliest opportunity through browser-based detection, with a universally effective control that works regardless of the lure delivery channel, or page style and structure. ",{"data":13643,"content":13646,"nodeType":875},{"target":13644},{"sys":13645},{"id":9017,"type":872,"linkType":873},[],{"data":13648,"content":13649,"nodeType":866},{},[13650],{"data":13651,"marks":13652,"value":13653,"nodeType":865},{},[],"Before we get into the specifics of the feature, let’s take a look at what ClickFix is and why it poses a detection and response challenge to security teams.",{"data":13655,"content":13656,"nodeType":879},{},[],{"data":13658,"content":13659,"nodeType":889},{},[13660],{"data":13661,"marks":13662,"value":13664,"nodeType":865},{},[13663],{"type":887},"ClickFix 101",{"data":13666,"content":13667,"nodeType":866},{},[13668],{"data":13669,"marks":13670,"value":13671,"nodeType":865},{},[],"ClickFix attacks prompt the user to solve some kind of problem or challenge in the browser — most commonly a CAPTCHA, but also things like fixing an error on a webpage. The name is a little misleading though — the key factor in the attack is that they trick users into running malicious commands on their device by copying malicious code from the page clipboard and running it locally. (For simplicity we’ll keep calling it ClickFix, but we’re not happy about it.)",{"data":13673,"content":13674,"nodeType":866},{},[13675],{"data":13676,"marks":13677,"value":13678,"nodeType":865},{},[],"The copy action is either performed manually by the user, or automatically by the page. Manual copies typically include additional social engineering to lure the victim into hitting CTRL+C, while automatic copies are performed using JavaScript running on the page. Most ClickFix pages we've seen are automatic copies, which makes sense — fewer steps means the user is more likely to follow the instruction.",{"data":13680,"content":13681,"nodeType":866},{},[13682],{"data":13683,"marks":13684,"value":13685,"nodeType":865},{},[],"Most commonly, these attacks are used to deliver remote access software or infostealer malware using stolen session cookies and credentials to facilitate attacks on business apps and services. From there, the attacker simply dumps the data and holds the victim to ransom for its deletion — often dropping ransomware afterwards for double the extortion. ",{"data":13687,"content":13688,"nodeType":866},{},[13689,13693,13700],{"data":13690,"marks":13691,"value":13692,"nodeType":865},{},[],"The attack gives the victim instructions that involve clicking prompts and copying, pasting, and running commands directly in the Windows Run dialog box, Terminal, or PowerShell in order to “fix” the fake problem that they’re experiencing. Variants such as ",{"data":13694,"content":13695,"nodeType":905},{"uri":11922},[13696],{"data":13697,"marks":13698,"value":11928,"nodeType":865},{},[13699],{"type":1070},{"data":13701,"marks":13702,"value":13703,"nodeType":865},{},[]," have also emerged which instead use the File Explorer Address Bar to execute OS commands.",{"data":13705,"content":13706,"nodeType":866},{},[13707],{"data":13708,"marks":13709,"value":13710,"nodeType":865},{},[],"Links to malicious ClickFix pages are distributed over various delivery channels, with attacks shifting from traditional email-based delivery to social media, instant messaging apps, malicious ads in places like Google Search, and using in-app notifications and messages across numerous SaaS services. ",{"data":13712,"content":13716,"nodeType":875},{"target":13713},{"sys":13714},{"id":13715,"type":872,"linkType":873},"1I9ERDY2tuspw5zVMV5DbY",[],{"data":13718,"content":13719,"nodeType":866},{},[13720,13724,13732],{"data":13721,"marks":13722,"value":13723,"nodeType":865},{},[],"ClickFix comes in a variety of lures, including impersonating CAPTCHA, Cloudflare Turnstile, simulating an error loading a webpage, and many more. They have also been observed targeting a ",{"data":13725,"content":13727,"nodeType":905},{"uri":13726},"https://mhaggis.github.io/ClickGrab/techniques.html",[13728],{"data":13729,"marks":13730,"value":13731,"nodeType":865},{},[],"wide range of services",{"data":13733,"marks":13734,"value":13735,"nodeType":865},{},[]," to execute code. ",{"data":13737,"content":13741,"nodeType":875},{"target":13738},{"sys":13739},{"id":13740,"type":872,"linkType":873},"1SG52ta1hcBZ3gYDsSJvsm",[],{"data":13743,"content":13744,"nodeType":879},{},[],{"data":13746,"content":13747,"nodeType":889},{},[13748],{"data":13749,"marks":13750,"value":13752,"nodeType":865},{},[13751],{"type":887},"Why are ClickFix attacks so effective?",{"data":13754,"content":13755,"nodeType":866},{},[13756],{"data":13757,"marks":13758,"value":13759,"nodeType":865},{},[],"To understand the effectiveness of ClickFix-style attacks, we need to look more closely at the mechanisms that security teams have at their disposal to counter these attacks. ",{"data":13761,"content":13762,"nodeType":2315},{},[13763],{"data":13764,"marks":13765,"value":13767,"nodeType":865},{},[13766],{"type":887},"Detection challenges during delivery",{"data":13769,"content":13770,"nodeType":866},{},[13771,13775,13783],{"data":13772,"marks":13773,"value":13774,"nodeType":865},{},[],"We’ve written extensively about ",{"data":13776,"content":13777,"nodeType":905},{"uri":7115},[13778],{"data":13779,"marks":13780,"value":13782,"nodeType":865},{},[13781],{"type":1070},"the evolution in phishing techniques and tooling",{"data":13784,"marks":13785,"value":13786,"nodeType":865},{},[],", and what this means for the reliability of traditional detections at the network and endpoint layer. ",{"data":13788,"content":13789,"nodeType":866},{},[13790],{"data":13791,"marks":13792,"value":13793,"nodeType":865},{},[],"The latest generation of phishing pages are dynamically obfuscating the code that loads the web page, implementing custom bot protection (e.g. CAPTCHA or Cloudflare Turnstile), using runtime anti-analysis features, and using legitimate SaaS and cloud services to host and deliver phishing links to cover their tracks.",{"data":13795,"content":13796,"nodeType":866},{},[13797],{"data":13798,"marks":13799,"value":11863,"nodeType":865},{},[],{"data":13801,"content":13802,"nodeType":866},{},[13803],{"data":13804,"marks":13805,"value":13806,"nodeType":865},{},[],"In addition to the fact that ClickFix page styles and content can vary significantly, this means that detecting ClickFix delivery using traditional tooling is highly unreliable. ",{"data":13808,"content":13809,"nodeType":2315},{},[13810],{"data":13811,"marks":13812,"value":13814,"nodeType":865},{},[13813],{"type":887},"Detection challenges during execution",{"data":13816,"content":13817,"nodeType":866},{},[13818],{"data":13819,"marks":13820,"value":13821,"nodeType":865},{},[],"Most of the detection heavy lifting is being done at the endpoint, looking for user-level code execution and malware running on a device. ",{"data":13823,"content":13824,"nodeType":866},{},[13825],{"data":13826,"marks":13827,"value":13828,"nodeType":865},{},[],"However, the number of ClickFix-related headlines in the news would indicate that endpoint controls are being routinely bypassed, or perhaps evaded altogether by targeting personal or BYOD devices. ",{"data":13830,"content":13834,"nodeType":875},{"target":13831},{"sys":13832},{"id":13833,"type":872,"linkType":873},"pocty4OhER5EXr8BDwdzo",[],{"data":13836,"content":13837,"nodeType":866},{},[13838],{"data":13839,"marks":13840,"value":13841,"nodeType":865},{},[],"There are a number of reasons that endpoint-level ClickFix detections can be bypassed:",{"data":13843,"content":13844,"nodeType":2718},{},[13845,13855,13865],{"data":13846,"content":13847,"nodeType":2654},{},[13848],{"data":13849,"content":13850,"nodeType":866},{},[13851],{"data":13852,"marks":13853,"value":13854,"nodeType":865},{},[],"The step of downloading a file from the web is bypassed altogether. In a ClickFix/FileFix attack, the initial “dropper” is essentially a command string provided by the attacker and executed by legitimate system utilities. There is often no new executable file written to disk when the user runs the command. The final payload may be loaded directly into memory or injected into trusted programs (using living-off-the-land techniques). Without a file to quarantine, there's no \"Mark of the Web\" to make it appear suspicious. ",{"data":13856,"content":13857,"nodeType":2654},{},[13858],{"data":13859,"content":13860,"nodeType":866},{},[13861],{"data":13862,"marks":13863,"value":13864,"nodeType":865},{},[],"From the EDR’s point of view, a trusted parent process is launching a script – which might not immediately be judged as malicious, especially if the command is obfuscated or uses allowed system functions. Since the action is initiated by the user, it blends in with normal user-driven administration tasks. ",{"data":13866,"content":13867,"nodeType":2654},{},[13868],{"data":13869,"content":13870,"nodeType":866},{},[13871],{"data":13872,"marks":13873,"value":13874,"nodeType":865},{},[],"The PowerShell commands themselves might be obfuscated or broken into stages to avoid easy detection by heuristic rules. EDR telemetry might record that a PowerShell process ran, but without a known bad signature or a clear policy violation, it may not flag it immediately. ",{"data":13876,"content":13880,"nodeType":875},{"target":13877},{"sys":13878},{"id":13879,"type":872,"linkType":873},"6djGsqBFTHlLLITpTK7IMk",[],{"data":13882,"content":13883,"nodeType":2315},{},[13884],{"data":13885,"marks":13886,"value":13888,"nodeType":865},{},[13887],{"type":887},"Accessing ClickFix-style capabilities is easier than ever",{"data":13890,"content":13891,"nodeType":866},{},[13892,13896,13904],{"data":13893,"marks":13894,"value":13895,"nodeType":865},{},[],"This capability is increasingly available to all levels of threat actor, with ",{"data":13897,"content":13898,"nodeType":905},{"uri":11897},[13899],{"data":13900,"marks":13901,"value":13903,"nodeType":865},{},[13902],{"type":1070},"off-the-shelf options available",{"data":13905,"marks":13906,"value":13907,"nodeType":865},{},[]," in the form of ClickFix builders (also called “Win + R”) on popular hacker forums since late 2024. ",{"data":13909,"content":13910,"nodeType":866},{},[13911],{"data":13912,"marks":13913,"value":13914,"nodeType":865},{},[],"Attackers are bundling ClickFix builders into their existing kits to:",{"data":13916,"content":13917,"nodeType":2718},{},[13918,13928],{"data":13919,"content":13920,"nodeType":2654},{},[13921],{"data":13922,"content":13923,"nodeType":866},{},[13924],{"data":13925,"marks":13926,"value":13927,"nodeType":865},{},[],"Use pre-canned landing pages with various lures including Cloudflare. ",{"data":13929,"content":13930,"nodeType":2654},{},[13931],{"data":13932,"content":13933,"nodeType":866},{},[13934],{"data":13935,"marks":13936,"value":13937,"nodeType":865},{},[],"Offer construction of malicious commands that users will paste into the Windows Run dialog. ",{"data":13939,"content":13940,"nodeType":866},{},[13941],{"data":13942,"marks":13943,"value":13944,"nodeType":865},{},[],"These kits claim to guarantee antivirus and web protection bypass (some even promise that they can bypass Microsoft Defender SmartScreen), as well as payload persistence. The cost of subscription to such a service might be between US$200 to US$1,500 per month. ",{"data":13946,"content":13947,"nodeType":866},{},[13948],{"data":13949,"marks":13950,"value":13951,"nodeType":865},{},[],"In short, these capabilities are increasingly accessible to the general population of hackers, and it is increasingly in the interests of malware developers to offer premium hacker tools designed to bypass current detections. ",{"data":13953,"content":13957,"nodeType":875},{"target":13954},{"sys":13955},{"id":13956,"type":872,"linkType":873},"5hkRsOBZCOABAShCo8RjJg",[],{"data":13959,"content":13960,"nodeType":866},{},[13961],{"data":13962,"marks":13963,"value":13964,"nodeType":865},{},[],"In any case, relying on just-in-time detection at the point of execution is increasingly unreliable and will always be at the mercy of the cat-and-mouse game between attackers and defenders. Organizations employing custom detections looking for specific malware behavior are likely to have better success than those relying on out-of-the-box EDR configs, but this requires continual maintenance to be effective. ",{"data":13966,"content":13967,"nodeType":879},{},[],{"data":13969,"content":13970,"nodeType":889},{},[13971],{"data":13972,"marks":13973,"value":13975,"nodeType":865},{},[13974],{"type":887},"Solving ClickFix detection in the browser with Push",{"data":13977,"content":13978,"nodeType":866},{},[13979,13982,13986],{"data":13980,"marks":13981,"value":13632,"nodeType":865},{},[],{"data":13983,"marks":13984,"value":13637,"nodeType":865},{},[13985],{"type":887},{"data":13987,"marks":13988,"value":13989,"nodeType":865},{},[],", tackles ClickFix-style attacks at the earliest opportunity through browser-based detection and blocking, with a universally effective control that works regardless of the lure delivery channel, page style and structure, or the specifics of the malware type and execution.",{"data":13991,"content":13992,"nodeType":866},{},[13993,13997,14005],{"data":13994,"marks":13995,"value":13996,"nodeType":865},{},[],"A key part of our design philosophy is to find ways to universally detect attacker TTPs by analyzing generic attacker actions that can’t be avoided by the attacker. One of our best prior examples of this is with our ",{"data":13998,"content":13999,"nodeType":905},{"uri":7228},[14000],{"data":14001,"marks":14002,"value":14004,"nodeType":865},{},[14003],{"type":1070},"password protection feature",{"data":14006,"marks":14007,"value":14008,"nodeType":865},{},[],", which detects and blocks phishing attacks by triggering when a user attempts to enter a password that belongs to one domain on a different domain. ",{"data":14010,"content":14011,"nodeType":866},{},[14012],{"data":14013,"marks":14014,"value":14015,"nodeType":865},{},[],"In the case of ClickFix, every attack involves copying a malicious script from a page — a behavior the attacker can’t avoid.",{"data":14017,"content":14018,"nodeType":866},{},[14019],{"data":14020,"marks":14021,"value":14022,"nodeType":865},{},[],"Unlike heavy-handed DLP solutions that block copy-paste altogether, Push protects your employees without disrupting their user experience or hampering productivity. ",{"data":14024,"content":14025,"nodeType":866},{},[14026],{"data":14027,"marks":14028,"value":14029,"nodeType":865},{},[],"Check out the video below to see Push in action. ",{"data":14031,"content":14034,"nodeType":875},{"target":14032},{"sys":14033},{"id":9017,"type":872,"linkType":873},[],{"data":14036,"content":14037,"nodeType":2315},{},[14038],{"data":14039,"marks":14040,"value":14042,"nodeType":865},{},[14041],{"type":887},"Enable ClickFix detection in just a few clicks",{"data":14044,"content":14045,"nodeType":866},{},[14046,14050,14058],{"data":14047,"marks":14048,"value":14049,"nodeType":865},{},[],"Check out the ",{"data":14051,"content":14053,"nodeType":905},{"uri":14052},"https://pushsecurity.com/help/10141/#start",[14054],{"data":14055,"marks":14056,"value":14057,"nodeType":865},{},[],"help article",{"data":14059,"marks":14060,"value":14061,"nodeType":865},{},[]," for step-by-step instructions on how to enable the control. ",{"data":14063,"content":14064,"nodeType":879},{},[],{"data":14066,"content":14067,"nodeType":889},{},[14068],{"data":14069,"marks":14070,"value":9586,"nodeType":865},{},[14071],{"type":887},{"data":14073,"content":14074,"nodeType":866},{},[14075],{"data":14076,"marks":14077,"value":14078,"nodeType":865},{},[],"Push provides last mile protection against browser-based attacks, adding a net-new layer of technical protection in the browser. ",{"data":14080,"content":14081,"nodeType":866},{},[14082],{"data":14083,"marks":14084,"value":14085,"nodeType":865},{},[],"Right now, most organizations are left relying on user awareness. Faced with increasingly novel attack types, encountered all over the internet, users are being caught unawares — further reducing the efficacy of an already fragile control. ",{"data":14087,"content":14088,"nodeType":866},{},[14089],{"data":14090,"marks":14091,"value":14092,"nodeType":865},{},[],"By seeing what the user sees in the browser, as they see it, as well as monitoring for risky behaviors, Push provides a strong backstop against an ever-expanding landscape of browser-based exploits. ",{"data":14094,"content":14095,"nodeType":866},{},[14096],{"data":14097,"marks":14098,"value":14099,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, ClickFixing, malicious browser extensions, and session hijacking using stolen session tokens. You can also use Push to find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your identity attack surface.",{"data":14101,"content":14102,"nodeType":866},{},[14103,14106,14113,14116,14123],{"data":14104,"marks":14105,"value":8278,"nodeType":865},{},[],{"data":14107,"content":14108,"nodeType":905},{"uri":7323},[14109],{"data":14110,"marks":14111,"value":8286,"nodeType":865},{},[14112],{"type":1070},{"data":14114,"marks":14115,"value":8290,"nodeType":865},{},[],{"data":14117,"content":14118,"nodeType":905},{"uri":1512},[14119],{"data":14120,"marks":14121,"value":7352,"nodeType":865},{},[14122],{"type":1070},{"data":14124,"marks":14125,"value":1193,"nodeType":865},{},[],{"data":14127,"content":14130,"nodeType":875},{"target":14128},{"sys":14129},{"id":13879,"type":872,"linkType":873},[],{"data":14132,"content":14133,"nodeType":866},{},[14134],{"data":14135,"marks":14136,"value":21,"nodeType":865},{},[],{"entries":14138},{"hyperlink":14139,"inline":14140,"block":14141},[],[],[14142,14146,14153,14159,14185,14191],{"sys":14143,"__typename":7447,"title":14144,"arcadeDemoUrl":14145,"playText":7450},{"id":9017},"ClickFix Feature Release","https://demo.arcade.software/qhzGMAx2q3b6IRlHqBsB?embed",{"sys":14147,"__typename":4637,"title":14148,"caption":14148,"layoutMode":59,"file":14149},{"id":13715},"Phishing delivery channels have significantly expanded from the days of email-based phishing attacks",{"url":14150,"width":14151,"height":14152},"https://images.ctfassets.net/y1cdw1ablpvd/4l0xLRs8Z1w3aXMbzzyFPL/9cb4721c53379da31a4019371072a7ef/image1.png",1696,986,{"sys":14154,"__typename":4637,"title":14155,"caption":14155,"layoutMode":59,"file":14156},{"id":13740},"Examples of ClickFix lures used by attackers in the wild.",{"url":14157,"width":4641,"height":14158},"https://images.ctfassets.net/y1cdw1ablpvd/7AH10e5YpESPdIBIH4YjHO/e7d5553657b6b0f20d6ed563d69af1e4/image3.png",1955,{"sys":14160,"__typename":4645,"content":14161,"name":14184,"title":59},{"id":13833},{"json":14162},{"nodeType":1522,"data":14163,"content":14164},{},[14165],{"nodeType":866,"data":14166,"content":14167},{},[14168,14172,14181],{"nodeType":865,"value":14169,"marks":14170,"data":14171},"Attacks on BYOD or personal devices are increasingly leading to corporate breaches where email accounts are being used to sign into corporate browser profiles. This results in corporate credentials inadvertently saved and synced across devices being exposed in the breach (the most well-known example of this being in ",[],{},{"nodeType":905,"data":14173,"content":14175},{"uri":14174},"https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/?utm_source=chatgpt.com",[14176],{"nodeType":865,"value":14177,"marks":14178,"data":14180},"Okta’s 2023 support case management system breach",[14179],{"type":1070},{},{"nodeType":865,"value":13320,"marks":14182,"data":14183},[],{},"clickfix insight box 1",{"sys":14186,"__typename":1530,"type":1531,"ctaText":14187,"buttonLabel":14188,"buttonColour":14189,"buttonUrl":14190},{"id":13879},"Register for our webinar to learn more about the latest developments in ClickFix attacks and why they're so effective.","Register Now","sea blue","https://pushsecurity.com/webinar/clickfix",{"sys":14192,"__typename":4637,"title":14193,"caption":14193,"layoutMode":59,"file":14194},{"id":13956},"ClickFix builder screenshots. Source: Microsoft",{"url":14195,"width":4641,"height":14196},"https://images.ctfassets.net/y1cdw1ablpvd/2adTEIfv1YmEkXzzKA5UFC/47fd4025b72923dd0a1a16eb736e8980/image2.png",540,{"items":14198},[],{},"Detect ClickFix-style attacks in the browser","product-feature","2025-10-09T00:00:00.000Z",{"items":14204},[14205,14542,15201],{"__typename":1544,"sys":14206,"content":14208,"title":14525,"synopsis":14526,"hashTags":59,"publishedDate":14527,"slug":14528,"tagsCollection":14529,"authorsCollection":14535},{"id":14207},"4bYO5rVy9n2OO3vtMVQeda",{"json":14209},{"data":14210,"content":14211,"nodeType":1522},{},[14212,14219,14238,14254,14261,14268,14271,14278,14285,14338,14345,14351,14354,14361,14368,14375,14382,14389,14406,14412,14419,14426,14443,14449,14456,14463,14470,14477,14484,14487,14494,14513,14519],{"data":14213,"content":14214,"nodeType":889},{},[14215],{"data":14216,"marks":14217,"value":14218,"nodeType":865},{},[],"All phishing eventually leads to the browser",{"data":14220,"content":14221,"nodeType":866},{},[14222,14226,14235],{"data":14223,"marks":14224,"value":14225,"nodeType":865},{},[],"The best attack detection methods are those that focus on ",{"data":14227,"content":14229,"nodeType":905},{"uri":14228},"https://pushsecurity.com/blog/our-design-philosophy-detecting-what-matters/",[14230],{"data":14231,"marks":14232,"value":14234,"nodeType":865},{},[14233],{"type":1070},"detecting indicators that are difficult for attackers to change or obfuscate",{"data":14236,"marks":14237,"value":1711,"nodeType":865},{},[],{"data":14239,"content":14240,"nodeType":866},{},[14241,14245,14250],{"data":14242,"marks":14243,"value":14244,"nodeType":865},{},[],"For a credential phishing attack to succeed, the victim ",{"data":14246,"marks":14247,"value":14249,"nodeType":865},{},[14248],{"type":1070},"has",{"data":14251,"marks":14252,"value":14253,"nodeType":865},{},[]," to enter their password into a webpage. There’s no two-ways about it, attackers cannot change this. ",{"data":14255,"content":14256,"nodeType":866},{},[14257],{"data":14258,"marks":14259,"value":14260,"nodeType":865},{},[],"So it stands to reason that, if you can detect this user behavior, and block them from entering their password, then you can stop phishing. ",{"data":14262,"content":14263,"nodeType":866},{},[14264],{"data":14265,"marks":14266,"value":14267,"nodeType":865},{},[],"This is exactly what Push does.",{"data":14269,"content":14270,"nodeType":879},{},[],{"data":14272,"content":14273,"nodeType":2315},{},[14274],{"data":14275,"marks":14276,"value":14277,"nodeType":865},{},[],"Most anti-phishing tools are easily bypassed",{"data":14279,"content":14280,"nodeType":866},{},[14281],{"data":14282,"marks":14283,"value":14284,"nodeType":865},{},[],"Other anti-phishing tools rely on detecting elements of the attack that attackers can change and hide, such as domains or the webpage contents. Attackers use tricks to evade these detection, like:",{"data":14286,"content":14287,"nodeType":2718},{},[14288,14298,14308,14318,14328],{"data":14289,"content":14290,"nodeType":2654},{},[14291],{"data":14292,"content":14293,"nodeType":866},{},[14294],{"data":14295,"marks":14296,"value":14297,"nodeType":865},{},[],"Using Cloudflare Workers to block automatic analysis of their phishing site",{"data":14299,"content":14300,"nodeType":2654},{},[14301],{"data":14302,"content":14303,"nodeType":866},{},[14304],{"data":14305,"marks":14306,"value":14307,"nodeType":865},{},[],"Hacking a Wordpress blog to get a reputable domain that passes domain checks ",{"data":14309,"content":14310,"nodeType":2654},{},[14311],{"data":14312,"content":14313,"nodeType":866},{},[14314],{"data":14315,"marks":14316,"value":14317,"nodeType":865},{},[],"Using redirects and rotating the URLs delivered to the victim to bypass link analysis",{"data":14319,"content":14320,"nodeType":2654},{},[14321],{"data":14322,"content":14323,"nodeType":866},{},[14324],{"data":14325,"marks":14326,"value":14327,"nodeType":865},{},[],"Randomizing the HTML title for the web page to bypass blocklists ",{"data":14329,"content":14330,"nodeType":2654},{},[14331],{"data":14332,"content":14333,"nodeType":866},{},[14334],{"data":14335,"marks":14336,"value":14337,"nodeType":865},{},[],"One-time phishing links that only work the first time they are clicked",{"data":14339,"content":14340,"nodeType":866},{},[14341],{"data":14342,"marks":14343,"value":14344,"nodeType":865},{},[],"Push is putting an end to this game of cat and mouse, by keeping it really simple; you can’t phish someone who can’t put their password into a phishing page. ",{"data":14346,"content":14350,"nodeType":875},{"target":14347},{"sys":14348},{"id":14349,"type":872,"linkType":873},"6AwOZSpqaChmeksnj4SyWE",[],{"data":14352,"content":14353,"nodeType":879},{},[],{"data":14355,"content":14356,"nodeType":2315},{},[14357],{"data":14358,"marks":14359,"value":14360,"nodeType":865},{},[],"Domain-binding passwords",{"data":14362,"content":14363,"nodeType":866},{},[14364],{"data":14365,"marks":14366,"value":14367,"nodeType":865},{},[],"If you’re familiar with how passkeys are domain-bound, then think of what Push does as domain-binding passwords. We pin the password to its legitimate domain(s) and then don’t allow it to be entered into any webpage on any other domain. ",{"data":14369,"content":14370,"nodeType":866},{},[14371],{"data":14372,"marks":14373,"value":14374,"nodeType":865},{},[],"But just because you’ve stopped your users from being phished doesn’t mean you don’t want to know when attackers are attempting to phish your users and how. ",{"data":14376,"content":14377,"nodeType":866},{},[14378],{"data":14379,"marks":14380,"value":14381,"nodeType":865},{},[],"Push still inspects webpages to see if attackers are rendering cloned app login pages in the browser or if known AitM and BitM toolkits are being used. This way you don’t lose visibility of the unsuccessful attacks that are targeting your users. Think of it as a handy second and third layer of defense.",{"data":14383,"content":14384,"nodeType":866},{},[14385],{"data":14386,"marks":14387,"value":14388,"nodeType":865},{},[],"Lets run through a quick before and after example:",{"data":14390,"content":14391,"nodeType":2315},{},[14392,14396,14402],{"data":14393,"marks":14394,"value":14395,"nodeType":865},{},[],"Scenario 1: An attacker attempts to phish an employee that ",{"data":14397,"marks":14398,"value":14401,"nodeType":865},{},[14399,14400],{"type":1070},{"type":887},"doesn’t",{"data":14403,"marks":14404,"value":14405,"nodeType":865},{},[]," have Push deployed to their browser.",{"data":14407,"content":14411,"nodeType":875},{"target":14408},{"sys":14409},{"id":14410,"type":872,"linkType":873},"2CbGMUSJsP1mNeHkmpLl6N",[],{"data":14413,"content":14414,"nodeType":866},{},[14415],{"data":14416,"marks":14417,"value":14418,"nodeType":865},{},[],"Here, an attacker hacks a Wordpress blog to get a reputable domain and then runs a phishing toolkit on the webpage. They email one of your employees a link to it. Your SWG / email scanning solution inspects it in a sandbox but the phish kit detects this and redirects to a benign site so that it passes the inspection. ",{"data":14420,"content":14421,"nodeType":866},{},[14422],{"data":14423,"marks":14424,"value":14425,"nodeType":865},{},[],"Your user gets the email with the link and is now free to interact with the phishing page. They enter their credentials plus MFA code into the page and voila! The attacker steals them and is able to compromise the user’s account.  ",{"data":14427,"content":14428,"nodeType":2315},{},[14429,14433,14439],{"data":14430,"marks":14431,"value":14432,"nodeType":865},{},[],"Scenario 2: An attacker attempts to phish an employee that ",{"data":14434,"marks":14435,"value":14438,"nodeType":865},{},[14436,14437],{"type":1070},{"type":887},"does",{"data":14440,"marks":14441,"value":14442,"nodeType":865},{},[]," have Push deployed to their browser. ",{"data":14444,"content":14448,"nodeType":875},{"target":14445},{"sys":14446},{"id":14447,"type":872,"linkType":873},"77smnID1woCfFJrJPyTvKY",[],{"data":14450,"content":14451,"nodeType":866},{},[14452],{"data":14453,"marks":14454,"value":14455,"nodeType":865},{},[],"This time, the attacker uses the same phishing toolkit and domain from the first example. But in reality, they don’t have to send it to your employee using email, instead, they could use LinkedIn messenger, Slack, Teams, or any application that allows employees to communicate with each other. ",{"data":14457,"content":14458,"nodeType":866},{},[14459],{"data":14460,"marks":14461,"value":14462,"nodeType":865},{},[],"Like before, the user receives the link, opens it and starts to enter their credentials into the webpage. This time though, the Push browser extension inspects the webpage running in the user's browser. Push observes that the webpage is a login page and the user is entering their password into the page.",{"data":14464,"content":14465,"nodeType":866},{},[14466],{"data":14467,"marks":14468,"value":14469,"nodeType":865},{},[],"The first detection Push makes is checking that the password the user is entering matches the domain that password is pinned to. Since it doesn't match, based on this detection alone the user is automatically redirected to a blocking page. An important point to make here is that the password never leaves the user’s browser and the check is made using a shortened salted hash of the password.   ",{"data":14471,"content":14472,"nodeType":866},{},[14473],{"data":14474,"marks":14475,"value":14476,"nodeType":865},{},[],"The second detection Push makes is that the rendered web app is using a cloned app login page. The third detection is that a phishing toolkit is running in the web app code. ",{"data":14478,"content":14479,"nodeType":866},{},[14480],{"data":14481,"marks":14482,"value":14483,"nodeType":865},{},[],"In this particular scenario these second and third detections serve as useful context for understanding the nature of the phishing attack. But both will still redirect to a blocking page if they are triggered in isolation of the other phishing detections. ",{"data":14485,"content":14486,"nodeType":879},{},[],{"data":14488,"content":14489,"nodeType":889},{},[14490],{"data":14491,"marks":14492,"value":14493,"nodeType":865},{},[],"We don’t just stop phishing attacks",{"data":14495,"content":14496,"nodeType":866},{},[14497,14501,14509],{"data":14498,"marks":14499,"value":14500,"nodeType":865},{},[],"We also detect other identity-related attack techniques used to compromise user accounts. That includes credential stuffing, password spraying and session hijacking using stolen session tokens. If you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":14502,"content":14503,"nodeType":905},{"uri":3686},[14504],{"data":14505,"marks":14506,"value":14508,"nodeType":865},{},[14507],{"type":1070},"book some time with one of our team",{"data":14510,"marks":14511,"value":14512,"nodeType":865},{},[],".  ",{"data":14514,"content":14518,"nodeType":875},{"target":14515},{"sys":14516},{"id":14517,"type":872,"linkType":873},"2JSmYDaiAciOx7Z1MRuJlA",[],{"data":14520,"content":14521,"nodeType":866},{},[14522],{"data":14523,"marks":14524,"value":21,"nodeType":865},{},[],"Detecting and blocking phishing attacks in the browser","How Push detects and blocks phishing attempts in the browser – explained in less than two minutes. ","2024-10-23T00:00:00.000Z","detecting-and-blocking-phishing-attacks-in-the-browser",{"items":14530},[14531,14533],{"sys":14532,"name":2144},{"id":2143},{"sys":14534,"name":342},{"id":3008},{"items":14536},[14537],{"fullName":14538,"firstName":14539,"jobTitle":9645,"profilePicture":14540},"Alex Henshall","Alex",{"url":14541},"https://images.ctfassets.net/y1cdw1ablpvd/2rz3Pre3b1MexPIQ4hzPUe/0ef8a092b7e7df00fbce3f7d1ccb96d1/Alex_Henshall.jpeg",{"__typename":1544,"sys":14543,"content":14544,"title":15187,"synopsis":15188,"hashTags":59,"publishedDate":15189,"slug":15190,"tagsCollection":15191,"authorsCollection":15197},{"id":9224},{"json":14545},{"data":14546,"content":14547,"nodeType":1522},{},[14548,14554,14557,14564,14587,14618,14628,14646,14653,14659,14666,14682,14689,14692,14699,14706,14725,14732,14777,14784,14790,14796,14803,14836,14850,14853,14860,14867,14874,14881,14888,14895,14902,15010,15016,15031,15038,15053,15086,15101,15108,15123,15129,15136,15143,15149,15156,15162,15169],{"data":14549,"content":14553,"nodeType":875},{"target":14550},{"sys":14551},{"id":14552,"type":872,"linkType":873},"1hUpsNwuhEXwSPijvRflTq",[],{"data":14555,"content":14556,"nodeType":879},{},[],{"data":14558,"content":14559,"nodeType":866},{},[14560],{"data":14561,"marks":14562,"value":14563,"nodeType":865},{},[],"There are two things every security operations engineer can agree on:",{"data":14565,"content":14566,"nodeType":2718},{},[14567,14577],{"data":14568,"content":14569,"nodeType":2654},{},[14570],{"data":14571,"content":14572,"nodeType":866},{},[14573],{"data":14574,"marks":14575,"value":14576,"nodeType":865},{},[],"Get MFA on every account on every app.",{"data":14578,"content":14579,"nodeType":2654},{},[14580],{"data":14581,"content":14582,"nodeType":866},{},[14583],{"data":14584,"marks":14585,"value":14586,"nodeType":865},{},[],"This is stupidly harder to achieve than it seems.",{"data":14588,"content":14589,"nodeType":866},{},[14590,14594,14602,14606,14614],{"data":14591,"marks":14592,"value":14593,"nodeType":865},{},[],"The penalties for failing to solve this hard simple problem are abundantly clear. Stolen credentials accounted for roughly half of the initial access methods observed this year across 30,000+ attacks, according to Verizon’s 2024 ",{"data":14595,"content":14596,"nodeType":905},{"uri":10411},[14597],{"data":14598,"marks":14599,"value":14601,"nodeType":865},{},[14600],{"type":1070},"Data Breach Investigations Report",{"data":14603,"marks":14604,"value":14605,"nodeType":865},{},[],". And ",{"data":14607,"content":14609,"nodeType":905},{"uri":14608},"https://pushsecurity.com/blog/2024-identity-breaches/",[14610],{"data":14611,"marks":14612,"value":14613,"nodeType":865},{},[],"in a review of 30 publicly disclosed breaches involving identity attacks",{"data":14615,"marks":14616,"value":14617,"nodeType":865},{},[]," in 2024, we found that 73% (almost three-quarters) were the result of compromised credentials, with the rest the result of phishing. ",{"data":14619,"content":14620,"nodeType":1649},{},[14621],{"data":14622,"content":14623,"nodeType":866},{},[14624],{"data":14625,"marks":14626,"value":14627,"nodeType":865},{},[],"Three-quarters of publicly disclosed breaches involving identity attacks in 2024 involved compromised credentials and missing MFA.",{"data":14629,"content":14630,"nodeType":866},{},[14631,14635,14642],{"data":14632,"marks":14633,"value":14634,"nodeType":865},{},[],"In the case of the ",{"data":14636,"content":14637,"nodeType":905},{"uri":933},[14638],{"data":14639,"marks":14640,"value":938,"nodeType":865},{},[14641],{"type":1070},{"data":14643,"marks":14644,"value":14645,"nodeType":865},{},[]," earlier this year, a lack of MFA meant the difference between an enormous and murky firefight to clean up accounts breached with legitimate credentials, and a decent night’s sleep. The result was hundreds of millions of breached customer records, nine publicly named victims, and at least one ransom paid.",{"data":14647,"content":14648,"nodeType":866},{},[14649],{"data":14650,"marks":14651,"value":14652,"nodeType":865},{},[],"“Do you know how many accounts we have on this third-party service, who owns them, how many tenants, whether those creds are shared elsewhere, and their security posture?” is not a fun question to answer on a Friday. ",{"data":14654,"content":14658,"nodeType":875},{"target":14655},{"sys":14656},{"id":14657,"type":872,"linkType":873},"6hg6PLXWMZaEDnGekHEzmD",[],{"data":14660,"content":14661,"nodeType":866},{},[14662],{"data":14663,"marks":14664,"value":14665,"nodeType":865},{},[],"For SecOps teams we’ve helped here at Push that responded to incidents affecting third-party apps (like Snowflake), the first item on the recovery plan is to finally solve that hard simple problem: No more MFA gaps.",{"data":14667,"content":14668,"nodeType":866},{},[14669,14673,14678],{"data":14670,"marks":14671,"value":14672,"nodeType":865},{},[],"With our latest feature release, ",{"data":14674,"marks":14675,"value":14677,"nodeType":865},{},[14676],{"type":887},"MFA enforcement",{"data":14679,"marks":14680,"value":14681,"nodeType":865},{},[],", this is so much easier. With MFA enforcement, Push administrators can configure a control to prompt employees to enroll in MFA whenever Push detects that they’re not registered — even on apps that don’t natively provide any administrative enforcement option for MFA. This capability is made possible by the Push browser extension, which uses in-browser messaging and simple workflows to guide users right where they work.",{"data":14683,"content":14684,"nodeType":866},{},[14685],{"data":14686,"marks":14687,"value":14688,"nodeType":865},{},[],"In this article, we’ll cover how Push helps you identify and close MFA gaps, how our new enforcement feature is one part of that solution, and how you can test the platform yourself.",{"data":14690,"content":14691,"nodeType":879},{},[],{"data":14693,"content":14694,"nodeType":889},{},[14695],{"data":14696,"marks":14697,"value":14698,"nodeType":865},{},[],"Shining a light on MFA gaps",{"data":14700,"content":14701,"nodeType":866},{},[14702],{"data":14703,"marks":14704,"value":14705,"nodeType":865},{},[],"There’s no question that the rise of ubiquitous multi-factor authentication has been an enormous advance for defenders in cybersecurity. ",{"data":14707,"content":14708,"nodeType":866},{},[14709,14713,14722],{"data":14710,"marks":14711,"value":14712,"nodeType":865},{},[],"Yet several years into this journey, the problem of verifying and enforcing MFA coverage across an organization remains a bit of a ",{"data":14714,"content":14716,"nodeType":905},{"uri":14715},"https://en.wikipedia.org/wiki/Puzzle_box",[14717],{"data":14718,"marks":14719,"value":14721,"nodeType":865},{},[14720],{"type":1070},"puzzle box",{"data":14723,"marks":14724,"value":1193,"nodeType":865},{},[],{"data":14726,"content":14727,"nodeType":866},{},[14728],{"data":14729,"marks":14730,"value":14731,"nodeType":865},{},[],"Why is this?",{"data":14733,"content":14734,"nodeType":2718},{},[14735,14745,14755],{"data":14736,"content":14737,"nodeType":2654},{},[14738],{"data":14739,"content":14740,"nodeType":866},{},[14741],{"data":14742,"marks":14743,"value":14744,"nodeType":865},{},[],"Complex overlapping (and occasionally contradictory) configurations for enterprise MFA solutions can result in entire employee groups not registered for MFA, and other critical missing pieces.",{"data":14746,"content":14747,"nodeType":2654},{},[14748],{"data":14749,"content":14750,"nodeType":866},{},[14751],{"data":14752,"marks":14753,"value":14754,"nodeType":865},{},[],"With a sprawling ecosystem of both SSO-managed and unmanaged self-adopted SaaS, MFA coverage ends up looking more like a patchwork than a unified layer of protection. Security teams lack visibility of freemium and self-purchased apps, and when signup is simple, many users will naturally skip MFA registration to remove a layer of friction. The end result is often a suite of core apps managed via SSO that enforce MFA — and a lot of other unmanaged apps that don’t (true nightmare fodder).",{"data":14756,"content":14757,"nodeType":2654},{},[14758],{"data":14759,"content":14760,"nodeType":866},{},[14761,14765,14773],{"data":14762,"marks":14763,"value":14764,"nodeType":865},{},[],"Another annoying piece of the puzzle box: Even in organizations with a high adoption rate of phishing-resistant MFA methods, having backup MFA methods (and a lack of total visibility into all of those registered methods) can create situations where ",{"data":14766,"content":14767,"nodeType":905},{"uri":12843},[14768],{"data":14769,"marks":14770,"value":14772,"nodeType":865},{},[14771],{"type":1070},"MFA downgrade attacks",{"data":14774,"marks":14775,"value":14776,"nodeType":865},{},[]," are still possible. In MFA downgrade attacks, backup MFA methods that are less secure such as SMS or TOTP can be exploited, effectively bypassing more phishing-resistant methods.",{"data":14778,"content":14779,"nodeType":866},{},[14780],{"data":14781,"marks":14782,"value":14783,"nodeType":865},{},[],"The challenges of solving this puzzle are evident. ",{"data":14785,"content":14789,"nodeType":875},{"target":14786},{"sys":14787},{"id":14788,"type":872,"linkType":873},"2BBiFx8pHjSCeLTlP6n6da",[],{"data":14791,"content":14795,"nodeType":875},{"target":14792},{"sys":14793},{"id":14794,"type":872,"linkType":873},"2QnWVpPYRyJQaQ5TuKSSLp",[],{"data":14797,"content":14798,"nodeType":866},{},[14799],{"data":14800,"marks":14801,"value":14802,"nodeType":865},{},[],"To shine a light on MFA gaps, then, security teams need three things:",{"data":14804,"content":14805,"nodeType":2718},{},[14806,14816,14826],{"data":14807,"content":14808,"nodeType":2654},{},[14809],{"data":14810,"content":14811,"nodeType":866},{},[14812],{"data":14813,"marks":14814,"value":14815,"nodeType":865},{},[],"A full accounting of their identity attack surface, including accounts on unmanaged and freemium apps not on SSO.",{"data":14817,"content":14818,"nodeType":2654},{},[14819],{"data":14820,"content":14821,"nodeType":866},{},[14822],{"data":14823,"marks":14824,"value":14825,"nodeType":865},{},[],"A trustworthy out-of-band method for verifying MFA coverage, beyond the tangle of conditional access rules.",{"data":14827,"content":14828,"nodeType":2654},{},[14829],{"data":14830,"content":14831,"nodeType":866},{},[14832],{"data":14833,"marks":14834,"value":14835,"nodeType":865},{},[],"Visibility into which MFA methods are registered to a given account.",{"data":14837,"content":14838,"nodeType":866},{},[14839,14843,14847],{"data":14840,"marks":14841,"value":14842,"nodeType":865},{},[],"You can get all three with the Push platform. The missing piece we’ve now added is a way to automatically prompt employees to add MFA wherever it’s missing. Enter ",{"data":14844,"marks":14845,"value":14677,"nodeType":865},{},[14846],{"type":887},{"data":14848,"marks":14849,"value":1193,"nodeType":865},{},[],{"data":14851,"content":14852,"nodeType":879},{},[],{"data":14854,"content":14855,"nodeType":889},{},[14856],{"data":14857,"marks":14858,"value":14859,"nodeType":865},{},[],"How Push helps you ensure MFA coverage",{"data":14861,"content":14862,"nodeType":866},{},[14863],{"data":14864,"marks":14865,"value":14866,"nodeType":865},{},[],"Let’s take a look at a hypothetical incident response scenario to see how Push’s identity visibility and security controls help you ensure MFA coverage.",{"data":14868,"content":14869,"nodeType":866},{},[14870],{"data":14871,"marks":14872,"value":14873,"nodeType":865},{},[],"We’ll assume that prior to this incident, you had already deployed the Push browser extension, which you can install and enforce using any MDM solution, on all major browsers.",{"data":14875,"content":14876,"nodeType":866},{},[14877],{"data":14878,"marks":14879,"value":14880,"nodeType":865},{},[],"It’s a Friday afternoon (sorry).",{"data":14882,"content":14883,"nodeType":866},{},[14884],{"data":14885,"marks":14886,"value":14887,"nodeType":865},{},[],"News breaks that there’s been a suspected breach at a popular enterprise SaaS service.",{"data":14889,"content":14890,"nodeType":866},{},[14891],{"data":14892,"marks":14893,"value":14894,"nodeType":865},{},[],"You’re familiar with the service, but you don’t believe it’s a core managed app at your organization. Unfortunately, that does not mean you don’t have accounts (sorry again).",{"data":14896,"content":14897,"nodeType":866},{},[14898],{"data":14899,"marks":14900,"value":14901,"nodeType":865},{},[],"Using Push, you can:",{"data":14903,"content":14904,"nodeType":2718},{},[14905,14924,14934,14961,14988],{"data":14906,"content":14907,"nodeType":2654},{},[14908],{"data":14909,"content":14910,"nodeType":866},{},[14911,14915,14920],{"data":14912,"marks":14913,"value":14914,"nodeType":865},{},[],"Immediately check whether the Push extension has observed employee usage of the breached app. It will appear on the ",{"data":14916,"marks":14917,"value":14919,"nodeType":865},{},[14918],{"type":887},"Apps",{"data":14921,"marks":14922,"value":14923,"nodeType":865},{},[]," table. From this overview, you can see how many accounts Push has seen on that app and how they are accessing it (SSO vs. other methods, such as local password login).",{"data":14925,"content":14926,"nodeType":2654},{},[14927],{"data":14928,"content":14929,"nodeType":866},{},[14930],{"data":14931,"marks":14932,"value":14933,"nodeType":865},{},[],"For those accounts on the breached app, you can quickly see whether they have MFA, and which methods are registered. To determine MFA status, the Push extension uses the existing user’s active session on an app to query that account’s MFA registration status using the app’s own API, providing a trustworthy verification. ",{"data":14935,"content":14936,"nodeType":2654},{},[14937],{"data":14938,"content":14939,"nodeType":866},{},[14940,14944,14949,14953,14958],{"data":14941,"marks":14942,"value":14943,"nodeType":865},{},[],"You can also see whether the users’ passwords have any security issues, such as a verified stolen credential, or a password that’s weak or reused by filtering the ",{"data":14945,"marks":14946,"value":14948,"nodeType":865},{},[14947],{"type":887},"Accounts",{"data":14950,"marks":14951,"value":14952,"nodeType":865},{},[]," list for ",{"data":14954,"marks":14955,"value":14957,"nodeType":865},{},[14956],{"type":887},"Findings",{"data":14959,"marks":14960,"value":1193,"nodeType":865},{},[],{"data":14962,"content":14963,"nodeType":2654},{},[14964],{"data":14965,"content":14966,"nodeType":866},{},[14967,14971,14975,14979,14984],{"data":14968,"marks":14969,"value":14970,"nodeType":865},{},[],"For accounts that lack MFA, you can then configure the ",{"data":14972,"marks":14973,"value":14677,"nodeType":865},{},[14974],{"type":887},{"data":14976,"marks":14977,"value":14978,"nodeType":865},{},[]," control from the ",{"data":14980,"marks":14981,"value":14983,"nodeType":865},{},[14982],{"type":887},"Controls",{"data":14985,"marks":14986,"value":14987,"nodeType":865},{},[]," page. This will prompt employees who lack MFA to set it up whenever they next use the app. In parallel, you can reach out to affected employees through your preferred comms channel and ask them to immediately register for MFA and change their password on the app. ",{"data":14989,"content":14990,"nodeType":2654},{},[14991],{"data":14992,"content":14993,"nodeType":866},{},[14994,14998,15007],{"data":14995,"marks":14996,"value":14997,"nodeType":865},{},[],"Then use Push’s webhooks to monitor for MFA registrations and password changes to roll in, by querying the ",{"data":14999,"content":15001,"nodeType":905},{"uri":15000},"https://pushsecurity.redoc.ly/webhooks-v1#operation/login-event",[15002],{"data":15003,"marks":15004,"value":15006,"nodeType":865},{},[15005],{"type":1070},"Login event",{"data":15008,"marks":15009,"value":1193,"nodeType":865},{},[],{"data":15011,"content":15015,"nodeType":875},{"target":15012},{"sys":15013},{"id":15014,"type":872,"linkType":873},"4OVJU6FRSVU9j1WB9NGyJ4",[],{"data":15017,"content":15018,"nodeType":866},{},[15019,15023,15027],{"data":15020,"marks":15021,"value":15022,"nodeType":865},{},[],"By combining visibility of your workforce identities — including granular context on their MFA registration status, MFA methods, and password security, even on unmanaged apps — with in-browser controls like ",{"data":15024,"marks":15025,"value":14677,"nodeType":865},{},[15026],{"type":887},{"data":15028,"marks":15029,"value":15030,"nodeType":865},{},[],", Push helps security teams respond quickly and with assurance that they have the right information and tools to remediate the issue.",{"data":15032,"content":15033,"nodeType":889},{},[15034],{"data":15035,"marks":15036,"value":15037,"nodeType":865},{},[],"A closer look at MFA enforcement",{"data":15039,"content":15040,"nodeType":866},{},[15041,15045,15049],{"data":15042,"marks":15043,"value":15044,"nodeType":865},{},[],"With the in-browser ",{"data":15046,"marks":15047,"value":14677,"nodeType":865},{},[15048],{"type":887},{"data":15050,"marks":15051,"value":15052,"nodeType":865},{},[]," control, we chose this approach to close the loop on missing MFA issues because:",{"data":15054,"content":15055,"nodeType":2718},{},[15056,15066,15076],{"data":15057,"content":15058,"nodeType":2654},{},[15059],{"data":15060,"content":15061,"nodeType":866},{},[15062],{"data":15063,"marks":15064,"value":15065,"nodeType":865},{},[],"It meets users where they are, in the most relevant context where they can successfully address the issue.",{"data":15067,"content":15068,"nodeType":2654},{},[15069],{"data":15070,"content":15071,"nodeType":866},{},[15072],{"data":15073,"marks":15074,"value":15075,"nodeType":865},{},[],"It solves the problem of enforcing MFA on apps that are outside of administrative control — or that don’t provide any administrative controls to enforce MFA registration natively.",{"data":15077,"content":15078,"nodeType":2654},{},[15079],{"data":15080,"content":15081,"nodeType":866},{},[15082],{"data":15083,"marks":15084,"value":15085,"nodeType":865},{},[],"It’s tenant-agnostic. That means that you can enforce MFA for a given app on all tenants of that app, even those free-tier or test tenants that you don’t know about and have no control over.",{"data":15087,"content":15088,"nodeType":866},{},[15089,15093,15097],{"data":15090,"marks":15091,"value":15092,"nodeType":865},{},[],"As a happy side effect, your compliance team will thank you for finally allowing them to attest to where MFA is ",{"data":15094,"marks":15095,"value":11675,"nodeType":865},{},[15096],{"type":2757},{"data":15098,"marks":15099,"value":15100,"nodeType":865},{},[]," enforced — with verified results, visible at the account level in Push’s admin reporting — across your environment.",{"data":15102,"content":15103,"nodeType":866},{},[15104],{"data":15105,"marks":15106,"value":15107,"nodeType":865},{},[],"Here’s a closer look at how it works:",{"data":15109,"content":15110,"nodeType":866},{},[15111,15115,15119],{"data":15112,"marks":15113,"value":15114,"nodeType":865},{},[],"To enable MFA enforcement, use the configuration tile on the ",{"data":15116,"marks":15117,"value":14983,"nodeType":865},{},[15118],{"type":887},{"data":15120,"marks":15121,"value":15122,"nodeType":865},{},[]," page of the Push admin console and select which apps should require MFA registration. The control currently works with ~90 high-value apps, including Postman, Retool, Datadog, Atlassian, Okta, and others.",{"data":15124,"content":15128,"nodeType":875},{"target":15125},{"sys":15126},{"id":15127,"type":872,"linkType":873},"2sDbYZL4oJDxLMbYErJfIN",[],{"data":15130,"content":15131,"nodeType":866},{},[15132],{"data":15133,"marks":15134,"value":15135,"nodeType":865},{},[],"You can then customize the message the employees will see.",{"data":15137,"content":15138,"nodeType":866},{},[15139],{"data":15140,"marks":15141,"value":15142,"nodeType":865},{},[],"On the end-user side, employees will see a banner with your message as soon as they use an app where they lack MFA. ",{"data":15144,"content":15148,"nodeType":875},{"target":15145},{"sys":15146},{"id":15147,"type":872,"linkType":873},"37aH1maXXkF8DxgjUod5dn",[],{"data":15150,"content":15151,"nodeType":866},{},[15152],{"data":15153,"marks":15154,"value":15155,"nodeType":865},{},[],"To complete MFA registration, the user can go directly to the app’s MFA registration page from a link in the banner (Push provides this link automatically, where one exists). The extension will query the user’s MFA status regularly in the background and when MFA registration is completed, the banner will disappear and the Push platform will clear the “No MFA” security finding for that account.",{"data":15157,"content":15161,"nodeType":875},{"target":15158},{"sys":15159},{"id":15160,"type":872,"linkType":873},"3yb4KjhH3AbvvSnfMbNONr",[],{"data":15163,"content":15164,"nodeType":889},{},[15165],{"data":15166,"marks":15167,"value":15168,"nodeType":865},{},[],"Find out more",{"data":15170,"content":15171,"nodeType":866},{},[15172,15176,15183],{"data":15173,"marks":15174,"value":15175,"nodeType":865},{},[],"To test our MFA visibility and control features, ",{"data":15177,"content":15178,"nodeType":905},{"uri":9622},[15179],{"data":15180,"marks":15181,"value":15182,"nodeType":865},{},[],"request a demo",{"data":15184,"marks":15185,"value":15186,"nodeType":865},{},[]," from our team. We look forward to helping you finally turn the challenge of MFA coverage into a simple problem, easily solved.","No more hard simple problems: Enforce MFA on third-party apps with Push","Using Push to enforce MFA on third-party apps in the browser — even where MFA enforcement isn't supported by the app itself.","2025-01-16T00:00:00.000Z","enforce-mfa-on-third-party-apps",{"items":15192},[15193,15195],{"sys":15194,"name":297},{"id":2147},{"sys":15196,"name":342},{"id":3008},{"items":15198},[15199],{"fullName":9643,"firstName":9644,"jobTitle":9645,"profilePicture":15200},{"url":9647},{"__typename":1544,"sys":15202,"content":15204,"title":15687,"synopsis":15688,"hashTags":59,"publishedDate":15689,"slug":15690,"tagsCollection":15691,"authorsCollection":15697},{"id":15203},"6jYmU1ROpwI41mmzk7ioKd",{"json":15205},{"data":15206,"content":15207,"nodeType":1522},{},[15208,15215,15222,15225,15232,15266,15278,15303,15310,15313,15320,15327,15334,15340,15347,15376,15382,15389,15409,15415,15422,15428,15431,15438,15474,15481,15524,15531,15537,15544,15551,15554,15561,15568,15575,15594,15600,15607,15614,15621,15627,15634,15640,15643,15649,15656,15663],{"data":15209,"content":15210,"nodeType":866},{},[15211],{"data":15212,"marks":15213,"value":15214,"nodeType":865},{},[],"After more than two decades in cybersecurity, I’ve witnessed the evolution (and at times, devolution) of detection and response capabilities. I’ve sat in countless SOCs watching analysts drown in a sea of alerts, spent hours chasing false positives, and seen talented security professionals burn out from the relentless noise of low-fidelity detection systems. ",{"data":15216,"content":15217,"nodeType":866},{},[15218],{"data":15219,"marks":15220,"value":15221,"nodeType":865},{},[],"It’s a problem that’s reached crisis proportions, and it’s exactly why our approach to browser security represents not just a technological shift, but a philosophical one.",{"data":15223,"content":15224,"nodeType":879},{},[],{"data":15226,"content":15227,"nodeType":889},{},[15228],{"data":15229,"marks":15230,"value":15231,"nodeType":865},{},[],"The alert fatigue epidemic",{"data":15233,"content":15234,"nodeType":866},{},[15235,15239,15244,15248,15253,15257,15262],{"data":15236,"marks":15237,"value":15238,"nodeType":865},{},[],"Early in my career, getting ",{"data":15240,"marks":15241,"value":15243,"nodeType":865},{},[15242],{"type":2757},"any",{"data":15245,"marks":15246,"value":15247,"nodeType":865},{},[]," alert felt like a victory. We were flying blind outside of our small windows of network traffic. But as the industry matured, something troubling happened: we began equating ",{"data":15249,"marks":15250,"value":15252,"nodeType":865},{},[15251],{"type":887},"volume",{"data":15254,"marks":15255,"value":15256,"nodeType":865},{},[]," with ",{"data":15258,"marks":15259,"value":15261,"nodeType":865},{},[15260],{"type":887},"value",{"data":15263,"marks":15264,"value":15265,"nodeType":865},{},[],". Vendors started competing on how many alerts they could generate, how much data they could collect, and how comprehensive their “visibility” could be. ",{"data":15267,"content":15268,"nodeType":866},{},[15269,15273],{"data":15270,"marks":15271,"value":15272,"nodeType":865},{},[],"Security teams followed suit with operational metrics that captured how many alerts they’d resolved, how many “attacks” they’d stopped, and how many tickets they’d opened and closed in a given work cycle. But as many teams have now realized, ",{"data":15274,"marks":15275,"value":15277,"nodeType":865},{},[15276],{"type":887},"volume is a vanity metric; fidelity is what keeps you safe.",{"data":15279,"content":15280,"nodeType":866},{},[15281,15285,15294,15298],{"data":15282,"marks":15283,"value":15284,"nodeType":865},{},[],"In my course on ",{"data":15286,"content":15288,"nodeType":905},{"uri":15287},"https://www.sans.org/cyber-security-courses/building-leading-security-operations-centers",[15289],{"data":15290,"marks":15291,"value":15293,"nodeType":865},{},[15292],{"type":1070},"Building and Leading Security Operations teams",{"data":15295,"marks":15296,"value":15297,"nodeType":865},{},[],", we discuss the importance of analytic outcomes and addressing ineffective alerts to continuously improve fidelity. My students often find it hard to believe how much time and effort it takes to audit alert quality and implement continuous improvements on a large scale. This isn’t just an operational problem — it’s an existential threat to effective security. ",{"data":15299,"marks":15300,"value":15302,"nodeType":865},{},[15301],{"type":887},"When everything is an alert, nothing is. ",{"data":15304,"content":15305,"nodeType":866},{},[15306],{"data":15307,"marks":15308,"value":15309,"nodeType":865},{},[],"And while we have been busy focusing on more (and occasionally, better) detections at the endpoint and network layers, attackers have shifted to infrastructure that isn’t as well-instrumented: SaaS and the browser.",{"data":15311,"content":15312,"nodeType":879},{},[],{"data":15314,"content":15315,"nodeType":889},{},[15316],{"data":15317,"marks":15318,"value":15319,"nodeType":865},{},[],"The browser: a new frontier in detection and response",{"data":15321,"content":15322,"nodeType":866},{},[15323],{"data":15324,"marks":15325,"value":15326,"nodeType":865},{},[],"Today, the browser is the place where most cyber attacks happen. It’s where users interact with the applications that your business runs on, handle sensitive data, and unfortunately, where they encounter sophisticated phishing campaigns, credential harvesting attacks, and malicious downloads. ",{"data":15328,"content":15329,"nodeType":866},{},[15330],{"data":15331,"marks":15332,"value":15333,"nodeType":865},{},[],"Yet for most security teams, the browser remains a black box, obscured from the view from the network and the endpoint. Even worse, attack models often applied to detection engineering for endpoint or network-centric threats don’t really apply; modern identity attacks skip entire phases of the attack chain, eliminating many detection opportunities along the way. The modern attack path doesn’t need to touch the endpoint or your network at all — it can happen entirely over the internet. ",{"data":15335,"content":15339,"nodeType":875},{"target":15336},{"sys":15337},{"id":15338,"type":872,"linkType":873},"4wYYgbKmmVAZTF7niXJEGc",[],{"data":15341,"content":15342,"nodeType":2315},{},[15343],{"data":15344,"marks":15345,"value":15346,"nodeType":865},{},[],"Attackers are exploiting the detection gap",{"data":15348,"content":15349,"nodeType":866},{},[15350,15354,15361,15365,15372],{"data":15351,"marks":15352,"value":15353,"nodeType":865},{},[],"You only need to look at in-the-wild breaches such as last year’s ",{"data":15355,"content":15356,"nodeType":905},{"uri":933},[15357],{"data":15358,"marks":15359,"value":1143,"nodeType":865},{},[15360],{"type":1070},{"data":15362,"marks":15363,"value":15364,"nodeType":865},{},[]," attacks, or the recent ",{"data":15366,"content":15367,"nodeType":905},{"uri":3114},[15368],{"data":15369,"marks":15370,"value":1131,"nodeType":865},{},[15371],{"type":1070},{"data":15373,"marks":15374,"value":15375,"nodeType":865},{},[]," breaches to see the impact that attackers can have by executing attacks entirely over the internet, without touching traditional network devices or user endpoints. ",{"data":15377,"content":15381,"nodeType":875},{"target":15378},{"sys":15379},{"id":15380,"type":872,"linkType":873},"VfTps3SGKJDlhFcmh42d9",[],{"data":15383,"content":15384,"nodeType":866},{},[15385],{"data":15386,"marks":15387,"value":15388,"nodeType":865},{},[],"But even in the context of more “conventional” attacks (e.g. the classic route of compromising an endpoint, moving laterally through an environment, taking control of a domain, and deploying ransomware), most of the time, these attacks begin in the browser with identities and cloud apps rather than exploit-driven initial access — such as with the recent attacks on Marks & Spencer, Co-op, and Jaguar Land Rover. ",{"data":15390,"content":15391,"nodeType":866},{},[15392,15396,15405],{"data":15393,"marks":15394,"value":15395,"nodeType":865},{},[],"While the ",{"data":15397,"content":15399,"nodeType":905},{"uri":15398},"https://cloud.google.com/security/resources/insights/targeted-attack-lifecycle",[15400],{"data":15401,"marks":15402,"value":15404,"nodeType":865},{},[15403],{"type":1070},"attack cycle",{"data":15406,"marks":15407,"value":15408,"nodeType":865},{},[]," and similar mental models are valuable for planning in-depth detections of sophisticated, multi-stage attacks, focusing too heavily on them can lead to overlooked scenarios. These high-profile incidents have demonstrated the opportunity cost of neglecting visibility into attacks that don't perfectly align with these models. ",{"data":15410,"content":15414,"nodeType":875},{"target":15411},{"sys":15412},{"id":15413,"type":872,"linkType":873},"3TsKtoWuxQMFl1xd3w1j86",[],{"data":15416,"content":15417,"nodeType":866},{},[15418],{"data":15419,"marks":15420,"value":15421,"nodeType":865},{},[],"Just as endpoint detection and response revolutionized host-based security by providing visibility and control directly at the point of attack, browser-based security platforms can do the same for web-borne threats. It’s an important addition to the detection and response stack that illuminates a “missing middle” in modern attack investigations, and intervenes in real time, much like traditional EDR did for the endpoint years ago.",{"data":15423,"content":15427,"nodeType":875},{"target":15424},{"sys":15425},{"id":15426,"type":872,"linkType":873},"1eCXGC6U6SdzHmOH1gv24O",[],{"data":15429,"content":15430,"nodeType":879},{},[],{"data":15432,"content":15433,"nodeType":889},{},[15434],{"data":15435,"marks":15436,"value":15437,"nodeType":865},{},[],"High-fidelity detection: quality over quantity",{"data":15439,"content":15440,"nodeType":866},{},[15441,15445,15452,15456,15461,15465,15470],{"data":15442,"marks":15443,"value":15444,"nodeType":865},{},[],"Our ",{"data":15446,"content":15447,"nodeType":905},{"uri":14228},[15448],{"data":15449,"marks":15450,"value":15451,"nodeType":865},{},[],"design philosophy",{"data":15453,"marks":15454,"value":15455,"nodeType":865},{},[]," centers on a principle often overlooked in the security industry: prioritizing actionable problems for security teams. This involves differentiating between \"",{"data":15457,"marks":15458,"value":15460,"nodeType":865},{},[15459],{"type":887},"events",{"data":15462,"marks":15463,"value":15464,"nodeType":865},{},[],"\" – environment data that may or may not be useful – and \"",{"data":15466,"marks":15467,"value":15469,"nodeType":865},{},[15468],{"type":887},"detections",{"data":15471,"marks":15472,"value":15473,"nodeType":865},{},[],"\" – high-fidelity, actionable signals with a negligible false positive rate. We also empower our customers with the ability to intervene in real-time when there are high-confidence indicators of an attack. We focus on detecting not atomic indicators, but on attacker tooling and behaviors.",{"data":15475,"content":15476,"nodeType":866},{},[15477],{"data":15478,"marks":15479,"value":15480,"nodeType":865},{},[],"Compare this to traditional approaches that might generate alerts for:",{"data":15482,"content":15483,"nodeType":2718},{},[15484,15494,15504,15514],{"data":15485,"content":15486,"nodeType":2654},{},[15487],{"data":15488,"content":15489,"nodeType":866},{},[15490],{"data":15491,"marks":15492,"value":15493,"nodeType":865},{},[],"Visiting domains with low reputation scores (but not necessarily malicious)",{"data":15495,"content":15496,"nodeType":2654},{},[15497],{"data":15498,"content":15499,"nodeType":866},{},[15500],{"data":15501,"marks":15502,"value":15503,"nodeType":865},{},[],"Downloading files that match certain heuristics (but may be legitimate)",{"data":15505,"content":15506,"nodeType":2654},{},[15507],{"data":15508,"content":15509,"nodeType":866},{},[15510],{"data":15511,"marks":15512,"value":15513,"nodeType":865},{},[],"Accessing new web applications (that may be approved, or tacitly allowed, shadow IT)",{"data":15515,"content":15516,"nodeType":2654},{},[15517],{"data":15518,"content":15519,"nodeType":866},{},[15520],{"data":15521,"marks":15522,"value":15523,"nodeType":865},{},[],"Employee usernames, passwords, and email addresses for sale on the dark web (which may no longer be valid)",{"data":15525,"content":15526,"nodeType":866},{},[15527],{"data":15528,"marks":15529,"value":15530,"nodeType":865},{},[],"These low-fidelity alerts create work without providing solutions. They force analysts to become investigators rather than responders, spending precious time determining whether an alert represents a genuine threat rather than focusing on mitigation and recovery. ",{"data":15532,"content":15536,"nodeType":875},{"target":15533},{"sys":15534},{"id":15535,"type":872,"linkType":873},"4MydcqvHnWsziCOPUNC3YS",[],{"data":15538,"content":15539,"nodeType":866},{},[15540],{"data":15541,"marks":15542,"value":15543,"nodeType":865},{},[],"Poor quality detections also present an easy opportunity for security teams to commit a cardinal sin: disrupting users and business processes without a clear justification for doing so. User trust and support should always be treated as a finite resource, and every account locked, website blocked, and laptop reimaged chips away at that resource. ",{"data":15545,"content":15546,"nodeType":866},{},[15547],{"data":15548,"marks":15549,"value":15550,"nodeType":865},{},[],"Likewise, the more disruptive, the more likely users will look for ways around said controls. If your users are actively working against you, and feel you are preventing them from doing their jobs, they’ll always find new and unexpected ways around security blocks. ",{"data":15552,"content":15553,"nodeType":879},{},[],{"data":15555,"content":15556,"nodeType":889},{},[15557],{"data":15558,"marks":15559,"value":15560,"nodeType":865},{},[],"The SOC analyst's perspective",{"data":15562,"content":15563,"nodeType":866},{},[15564],{"data":15565,"marks":15566,"value":15567,"nodeType":865},{},[],"The most successful SOC analysts share a common trait: they’re extraordinarily good at quickly distinguishing signal from noise. But this skill shouldn’t be required! It’s a failure of our detection systems that we’re forcing human analysts to perform pattern matching that our technology should handle. ",{"data":15569,"content":15570,"nodeType":866},{},[15571],{"data":15572,"marks":15573,"value":15574,"nodeType":865},{},[],"But even for the most skilled analyst, it’s a tall order to ask your security team to also be experts in every cloud app your business relies on, making it even harder than normal to build context-driven alerts. Most of the time, the information required simply doesn't exist, with logs simply not available (generally, or at your product tier) or the work required to extract the logs and turn them into context-driven alerts hasn’t happened yet. If your team is under-resourced and drowning in low-fidelity alerts already, then realistically it might never happen. ",{"data":15576,"content":15577,"nodeType":866},{},[15578,15582,15590],{"data":15579,"marks":15580,"value":15581,"nodeType":865},{},[],"Effective browser security changes this dynamic. Instead of presenting analysts with hundreds of “suspicious web activity” alerts that require investigation, ",{"data":15583,"content":15584,"nodeType":905},{"uri":7249},[15585],{"data":15586,"marks":15587,"value":15589,"nodeType":865},{},[15588],{"type":1070},"our platform focuses on high-reliability indicators",{"data":15591,"marks":15592,"value":15593,"nodeType":865},{},[]," like whether a phishing kit was observed running on the page, or whether the page was cloned from a legitimate site. We even detect user behaviors that could indicate a risk in the context of a phishing attack, like when a user attempts to authenticate with credentials that have been previously used on another page — either a sign of credential reuse (bad) or a phishing attack (even worse) — at which point Push can be set to block the attack in real time. ",{"data":15595,"content":15599,"nodeType":875},{"target":15596},{"sys":15597},{"id":15598,"type":872,"linkType":873},"3998Iy2kp9MW0HFeqmo900",[],{"data":15601,"content":15602,"nodeType":2315},{},[15603],{"data":15604,"marks":15605,"value":15606,"nodeType":865},{},[],"Browser security provides a new layer of protection, reducing the risk of breach",{"data":15608,"content":15609,"nodeType":866},{},[15610],{"data":15611,"marks":15612,"value":15613,"nodeType":865},{},[],"Attack detection has always been a cat-and-mouse game. For years, attackers have grappled with endpoint and network security vendors. And sometimes, the attackers win. The fact is that a lot of attacker innovation has gone into sandbox aware malware, breaking detection signatures, disabling security tools, and so on.    ",{"data":15615,"content":15616,"nodeType":866},{},[15617],{"data":15618,"marks":15619,"value":15620,"nodeType":865},{},[],"But with so many attacks now passing through the browser, defending it enables badness to be filtered out before it reaches the endpoint or network controls that attackers are looking to consciously evade. By preventing malware being delivered, or identities from being compromised, attacks otherwise crafted to evade traditional security controls can be intercepted early — making the crucial difference in whether a breach happens or not.",{"data":15622,"content":15626,"nodeType":875},{"target":15623},{"sys":15624},{"id":15625,"type":872,"linkType":873},"4Bh7uOkeguNJFmJ1XUQ317",[],{"data":15628,"content":15629,"nodeType":866},{},[15630],{"data":15631,"marks":15632,"value":15633,"nodeType":865},{},[],"And when it comes to the cloud-centric attacks that attackers are finding so much success with today, this is in effect a net new capability. ",{"data":15635,"content":15639,"nodeType":875},{"target":15636},{"sys":15637},{"id":15638,"type":872,"linkType":873},"4JdaY8I3f6Ub2Kifc9Rsj9",[],{"data":15641,"content":15642,"nodeType":879},{},[],{"data":15644,"content":15645,"nodeType":889},{},[15646],{"data":15647,"marks":15648,"value":8243,"nodeType":865},{},[],{"data":15650,"content":15651,"nodeType":866},{},[15652],{"data":15653,"marks":15654,"value":15655,"nodeType":865},{},[],"The browser represents one of the most significant opportunities in cybersecurity today. As we continue to expand our browser-based security capabilities, we remain committed to this high-fidelity approach. We’re building features that not only detect and prevent attacks but also provide security teams with the rich telemetry they need to develop custom queries and detections.",{"data":15657,"content":15658,"nodeType":866},{},[15659],{"data":15660,"marks":15661,"value":15662,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against techniques like AiTM phishing, credential stuffing, ClickFixing, malicious browser extensions, and session hijacking using stolen session tokens. You can also use Push to find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your identity attack surface.",{"data":15664,"content":15665,"nodeType":866},{},[15666,15669,15675,15678,15684],{"data":15667,"marks":15668,"value":8278,"nodeType":865},{},[],{"data":15670,"content":15671,"nodeType":905},{"uri":7323},[15672],{"data":15673,"marks":15674,"value":8286,"nodeType":865},{},[],{"data":15676,"marks":15677,"value":8290,"nodeType":865},{},[],{"data":15679,"content":15680,"nodeType":905},{"uri":1512},[15681],{"data":15682,"marks":15683,"value":7352,"nodeType":865},{},[],{"data":15685,"marks":15686,"value":1193,"nodeType":865},{},[],"Fixing SecOps alert fatigue with browser telemetry","How browser data can improve detection fidelity and reduce alert fatigue, enabling SecOps teams to save time and detect more attacks.","2025-10-07T00:00:00.000Z","fixing-secops-alert-fatigue-with-browser-telemetry",{"items":15692},[15693,15695],{"sys":15694,"name":342},{"id":3008},{"sys":15696,"name":2144},{"id":2143},{"items":15698},[15699],{"fullName":4093,"firstName":4094,"jobTitle":4095,"profilePicture":15700},{"url":4097},"introducing-malicious-copy-paste-detection","blog/introducing-malicious-copy-paste-detection","Detect ClickFix-style attacks where users copy malicious scripts from their browser.",{"json":15705},{"data":15706,"content":15707,"nodeType":1522},{},[15708],{"data":15709,"content":15710,"nodeType":866},{},[15711],{"data":15712,"marks":15713,"value":15714,"nodeType":865},{},[],"ClickFix, FileFix, fake CAPTCHA — whatever you call it, users interacting with malicious scripts in their web browser is a fast-growing source of security breaches. To tackle this threat, Push now detects malware delivery in the browser, supporting a layered defense against endpoint attacks. ","Push now detects malware delivery in the browser, supporting a layered defense against endpoint attacks. ",{"id":15717,"publishedAt":15718},"1u8RJxC00HbBhCBVxcDnkK","2026-08-12T11:53:43.034Z",{"items":15720},[15721,15723],{"sys":15722,"name":342},{"id":3008},{"sys":15724,"name":2144},{"id":2143},{"items":15726},[15727,15729,15731,15733,15735,15737,15739,15741,15743,15745,15747,15749,15751,15753],{"sys":15728,"name":279,"slug":280,"tier":31},{"id":276},{"sys":15730,"name":342,"slug":343,"tier":31},{"id":339},{"sys":15732,"name":297,"slug":298,"tier":31},{"id":294},{"sys":15734,"name":519,"slug":520,"tier":31},{"id":516},{"sys":15736,"name":642,"slug":643,"tier":31},{"id":639},{"sys":15738,"name":315,"slug":316,"tier":45},{"id":312},{"sys":15740,"name":448,"slug":449,"tier":45},{"id":445},{"sys":15742,"name":377,"slug":378,"tier":45},{"id":374},{"sys":15744,"name":607,"slug":608,"tier":45},{"id":604},{"sys":15746,"name":475,"slug":476,"tier":45},{"id":472},{"sys":15748,"name":440,"slug":441,"tier":45},{"id":437},{"sys":15750,"name":422,"slug":423,"tier":45},{"id":419},{"sys":15752,"name":537,"slug":538,"tier":45},{"id":534},{"sys":15754,"name":351,"slug":352,"tier":45},{"id":348},"WhJoIJQgr5uOa_CBJjozZ6Xe_GSP57ObHYXigZLLKo0",{"id":15757,"title":15758,"authorsCollection":15759,"content":15764,"extension":228,"faqItemsCollection":16306,"faqTitle":59,"featured":6,"hashTags":59,"meta":16308,"metaTitle":16309,"ogImage":59,"postType":16310,"publishedDate":16311,"relatedBlogPostsCollection":16312,"slug":18387,"stem":18388,"subtitle":59,"summary":18389,"synopsis":18400,"sys":18401,"tagsCollection":18404,"topicsCollection":18410,"__hash__":18434},"blog/blog/how-cyber-breaches-are-driving-tighter-mfa-requirements-and-enforcement.json","How cyber breaches are driving tighter MFA requirements and enforcement",{"items":15760},[15761],{"fullName":3012,"firstName":3013,"jobTitle":3014,"socialLinks":15762,"profilePicture":15763},[6742],{"url":3016},{"json":15765,"links":16267},{"data":15766,"content":15767,"nodeType":1522},{},[15768,15775,15793,15800,15803,15811,15818,15825,15953,15960,15966,15969,15977,15984,15991,15998,16005,16013,16020,16027,16030,16038,16045,16052,16059,16065,16072,16100,16110,16116,16119,16127,16135,16142,16175,16181,16187,16193,16196,16204,16211,16230,16235,16241],{"data":15769,"content":15770,"nodeType":866},{},[15771],{"data":15772,"marks":15773,"value":15774,"nodeType":865},{},[],"Many security leaders would confidently say they have MFA deployed everywhere. But that confidence often disappears when a breach investigation begins. The reality? MFA coverage is far from complete.",{"data":15776,"content":15777,"nodeType":866},{},[15778,15782,15790],{"data":15779,"marks":15780,"value":15781,"nodeType":865},{},[],"MFA is inconsistently enforced across the modern identity surface. Logins without MFA frequently slip through the cracks, exposing critical access points to business systems and data. And attackers know it — as they demonstrated best in ",{"data":15783,"content":15784,"nodeType":905},{"uri":933},[15785],{"data":15786,"marks":15787,"value":15789,"nodeType":865},{},[15788],{"type":1070},"2024's infamous Snowflake breaches",{"data":15791,"marks":15792,"value":1711,"nodeType":865},{},[],{"data":15794,"content":15795,"nodeType":866},{},[15796],{"data":15797,"marks":15798,"value":15799,"nodeType":865},{},[],"Regulators and insurers are catching on, too. Where MFA was once considered best practice, it’s now an expectation; implied in some frameworks, explicitly required in others, and enforced more aggressively than ever before. Whether you’re trying to meet PCI DSS, HIPAA, or GDPR requirements, the question is no longer if you have MFA, it’s where and how it’s enforced — and can you prove it?",{"data":15801,"content":15802,"nodeType":879},{},[],{"data":15804,"content":15805,"nodeType":889},{},[15806],{"data":15807,"marks":15808,"value":15810,"nodeType":865},{},[15809],{"type":887},"Framework-by-framework breakdown: what they really say about MFA",{"data":15812,"content":15813,"nodeType":866},{},[15814],{"data":15815,"marks":15816,"value":15817,"nodeType":865},{},[],"MFA isn’t just a checkbox. It’s a regulatory expectation. While some frameworks spell that out clearly, others imply it in broader language. Either way, the enforcement trend is undeniable: organizations are being held accountable if MFA is missing.",{"data":15819,"content":15820,"nodeType":866},{},[15821],{"data":15822,"marks":15823,"value":15824,"nodeType":865},{},[],"Here’s how key frameworks treat MFA today:",{"data":15826,"content":15827,"nodeType":2718},{},[15828,15838,15861,15884,15933,15943],{"data":15829,"content":15830,"nodeType":2654},{},[15831],{"data":15832,"content":15833,"nodeType":866},{},[15834],{"data":15835,"marks":15836,"value":15837,"nodeType":865},{},[],"PCI DSS v4.0 requires mandatory MFA for all non-console administrative access and remote access to cardholder environments.",{"data":15839,"content":15840,"nodeType":2654},{},[15841],{"data":15842,"content":15843,"nodeType":866},{},[15844,15848,15857],{"data":15845,"marks":15846,"value":15847,"nodeType":865},{},[],"HIPAA doesn’t use the term “MFA” directly, but under the Security Rule, it mandates “reasonable and appropriate safeguards,” and the absence of MFA has led to audit findings and penalties — e.g. a US children’s hospital received a ",{"data":15849,"content":15851,"nodeType":905},{"uri":15850},"https://compliancy-group.com/childrens-hospital-colorado-fined-by-ocr/",[15852],{"data":15853,"marks":15854,"value":15856,"nodeType":865},{},[15855],{"type":1070},"$500,000",{"data":15858,"marks":15859,"value":15860,"nodeType":865},{},[]," HIPAA fine for insufficient MFA.",{"data":15862,"content":15863,"nodeType":2654},{},[15864],{"data":15865,"content":15866,"nodeType":866},{},[15867,15871,15880],{"data":15868,"marks":15869,"value":15870,"nodeType":865},{},[],"GDPR similarly focuses on “appropriate technical measures.” In 2023, the UK’s ICO fined a UK software company ",{"data":15872,"content":15874,"nodeType":905},{"uri":15873},"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/03/software-provider-fined-3m-following-2022-ransomware-attack/",[15875],{"data":15876,"marks":15877,"value":15879,"nodeType":865},{},[15878],{"type":1070},"£3.07 million",{"data":15881,"marks":15882,"value":15883,"nodeType":865},{},[]," for a breach involving missing MFA, setting a clear precedent.",{"data":15885,"content":15886,"nodeType":2654},{},[15887],{"data":15888,"content":15889,"nodeType":866},{},[15890,15894,15903,15907,15916,15920,15929],{"data":15891,"marks":15892,"value":15893,"nodeType":865},{},[],"NYDFS 500 is clear: MFA is required for all user access to covered systems, not just privileged accounts. MFA gaps resulted in a ",{"data":15895,"content":15897,"nodeType":905},{"uri":15896},"https://www.dfs.ny.gov/reports_and_publications/press_releases/pr202104141",[15898],{"data":15899,"marks":15900,"value":15902,"nodeType":865},{},[15901],{"type":1070},"$3 million settlement",{"data":15904,"marks":15905,"value":15906,"nodeType":865},{},[]," against a financial services company, a ",{"data":15908,"content":15910,"nodeType":905},{"uri":15909},"https://www.dfs.ny.gov/system/files/documents/2023/05/ea20230524_co_onemain.pdf",[15911],{"data":15912,"marks":15913,"value":15915,"nodeType":865},{},[15914],{"type":1070},"$4.2 million",{"data":15917,"marks":15918,"value":15919,"nodeType":865},{},[]," dollar fine against a personal loan provider, and a ",{"data":15921,"content":15923,"nodeType":905},{"uri":15922},"https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20241125",[15924],{"data":15925,"marks":15926,"value":15928,"nodeType":865},{},[15927],{"type":1070},"$1.55 million",{"data":15930,"marks":15931,"value":15932,"nodeType":865},{},[]," fine against an auto insurer.",{"data":15934,"content":15935,"nodeType":2654},{},[15936],{"data":15937,"content":15938,"nodeType":866},{},[15939],{"data":15940,"marks":15941,"value":15942,"nodeType":865},{},[],"NIST SP 800-63-3 and CISA’s EO 14028 elevate the standard further, calling for phishing-resistant MFA for federal systems and contractors.",{"data":15944,"content":15945,"nodeType":2654},{},[15946],{"data":15947,"content":15948,"nodeType":866},{},[15949],{"data":15950,"marks":15951,"value":15952,"nodeType":865},{},[],"Frameworks and standards like ISO/IEC 27001, CIS Controls v8, and SOC 2 increasingly expect MFA coverage to be demonstrated during audits and certification processes.",{"data":15954,"content":15955,"nodeType":866},{},[15956],{"data":15957,"marks":15958,"value":15959,"nodeType":865},{},[],"These frameworks vary in tone and scope, but the message is consistent across the board. MFA must be enforced, not just in theory.",{"data":15961,"content":15965,"nodeType":875},{"target":15962},{"sys":15963},{"id":15964,"type":872,"linkType":873},"7dOxw1w8Ut5WDBDOki20We",[],{"data":15967,"content":15968,"nodeType":879},{},[],{"data":15970,"content":15971,"nodeType":889},{},[15972],{"data":15973,"marks":15974,"value":15976,"nodeType":865},{},[15975],{"type":887},"Insurers are scrutinising MFA gaps too",{"data":15978,"content":15979,"nodeType":866},{},[15980],{"data":15981,"marks":15982,"value":15983,"nodeType":865},{},[],"It’s not just regulators getting stricter. Insurers are building in MFA as a minimum condition of insurance coverage. ",{"data":15985,"content":15986,"nodeType":866},{},[15987],{"data":15988,"marks":15989,"value":15990,"nodeType":865},{},[],"Organizations are incentivized to have MFA. Roughly 20-25% of cyber insurance premiums are dictated by the security controls in place: MFA, EDR, regular patching, etc. ",{"data":15992,"content":15993,"nodeType":866},{},[15994],{"data":15995,"marks":15996,"value":15997,"nodeType":865},{},[],"After a breach, insurers bring in incident response teams to analyze what happened. Their job is to determine how the attacker got in and whether the controls you claimed to have were actually in place. If the entry point had no effective MFA and your policy attested that it did, the insurer may treat that as misrepresentation.",{"data":15999,"content":16000,"nodeType":866},{},[16001],{"data":16002,"marks":16003,"value":16004,"nodeType":865},{},[],"If your self-attested MFA coverage doesn’t hold up under investigation, your provider may not be required to pay, and you’re left footing the bill for IR, recovery, legal fees, and business disruption.",{"data":16006,"content":16007,"nodeType":2315},{},[16008],{"data":16009,"marks":16010,"value":16012,"nodeType":865},{},[16011],{"type":887},"Case study: City of Hamilton, Ontario",{"data":16014,"content":16015,"nodeType":866},{},[16016],{"data":16017,"marks":16018,"value":16019,"nodeType":865},{},[],"The Canadian city of Hamilton, Ontario fell victim to a ransomware attack in February 2024. Attackers disabled nearly 80% of the city’s network and demanded a ransom of roughly $18.5 million in exchange for a decryption tool to unscramble the data.",{"data":16021,"content":16022,"nodeType":866},{},[16023],{"data":16024,"marks":16025,"value":16026,"nodeType":865},{},[],"They attempted to claim $5 million under their cyber insurance policy. After more than a year of dispute, the claim was denied because of MFA gaps — a condition of the coverage. Taxpayers were left to foot the $18.3 million bill, including cleanup, rebuild, and one-time consultancy fees.",{"data":16028,"content":16029,"nodeType":879},{},[],{"data":16031,"content":16032,"nodeType":889},{},[16033],{"data":16034,"marks":16035,"value":16037,"nodeType":865},{},[16036],{"type":887},"The future of compliance will be driven by cyber attacks",{"data":16039,"content":16040,"nodeType":866},{},[16041],{"data":16042,"marks":16043,"value":16044,"nodeType":865},{},[],"The direction of travel is consistent: frameworks are getting stricter, auditors are getting more technical, and enforcement is starting to hit data processors as well as controllers. ",{"data":16046,"content":16047,"nodeType":866},{},[16048],{"data":16049,"marks":16050,"value":16051,"nodeType":865},{},[],"But there’s more to it than that. In-the-wild breaches are exposing just how much business IT has evolved — and where security controls haven’t kept up. ",{"data":16053,"content":16054,"nodeType":866},{},[16055],{"data":16056,"marks":16057,"value":16058,"nodeType":865},{},[],"With the SaaS-ification of enterprise IT, core business systems aren’t locally deployed and centrally managed in the way they used to be. Instead, they’re logged into over the internet, via a web browser.",{"data":16060,"content":16064,"nodeType":875},{"target":16061},{"sys":16062},{"id":16063,"type":872,"linkType":873},"4h4hUYAghbZavOwjRTnBe2",[],{"data":16066,"content":16067,"nodeType":866},{},[16068],{"data":16069,"marks":16070,"value":16071,"nodeType":865},{},[],"So it’s not surprising that modern attackers are now targeting these apps directly. The most logical way to do this is by targeting users of those apps via identities — the vehicle by which apps are accessed and used. ",{"data":16073,"content":16074,"nodeType":866},{},[16075,16079,16087,16091,16096],{"data":16076,"marks":16077,"value":16078,"nodeType":865},{},[],"Sitting outside the typical security control boundary, it’s no surprise that this has become the soft underbelly in the crosshairs of attackers. Organizations are dealing with a vast and vulnerable attack surface consisting of ",{"data":16080,"content":16081,"nodeType":905},{"uri":6333},[16082],{"data":16083,"marks":16084,"value":16086,"nodeType":865},{},[16085],{"type":1070},"hundreds of applications, with thousands of accounts",{"data":16088,"marks":16089,"value":16090,"nodeType":865},{},[]," spread across the app estate. ",{"data":16092,"marks":16093,"value":16095,"nodeType":865},{},[16094],{"type":887},"2 in 5 of these accounts are missing MFA",{"data":16097,"marks":16098,"value":16099,"nodeType":865},{},[],", and many also have a password vulnerability (such as appearing in a password breach or compromised credential feed) that means they’re sitting ducks for an attacker, waiting to be exploited. ",{"data":16101,"content":16102,"nodeType":1649},{},[16103],{"data":16104,"content":16105,"nodeType":866},{},[16106],{"data":16107,"marks":16108,"value":16109,"nodeType":865},{},[],"Due to SaaS blind-spots, 2 in 5 accounts are missing MFA. ",{"data":16111,"content":16115,"nodeType":875},{"target":16112},{"sys":16113},{"id":16114,"type":872,"linkType":873},"3WFzina1t5j6bDlTlGQA0l",[],{"data":16117,"content":16118,"nodeType":879},{},[],{"data":16120,"content":16121,"nodeType":889},{},[16122],{"data":16123,"marks":16124,"value":16126,"nodeType":865},{},[16125],{"type":887},"What security teams can do about it",{"data":16128,"content":16129,"nodeType":2315},{},[16130],{"data":16131,"marks":16132,"value":16134,"nodeType":865},{},[16133],{"type":887},"Achieve complete MFA visibility and remediate gaps with Push Security",{"data":16136,"content":16137,"nodeType":866},{},[16138],{"data":16139,"marks":16140,"value":16141,"nodeType":865},{},[],"You can’t enforce identity policy if you can’t see where it breaks. Push gives you live, browser-based insight into how users actually authenticate – what apps they access, how they log in, and where protections like MFA fall short. Because Push runs natively in the browser, you get full coverage and built-in guardrails, without relying on app integrations, enabling you to:",{"data":16143,"content":16144,"nodeType":2718},{},[16145,16155,16165],{"data":16146,"content":16147,"nodeType":2654},{},[16148],{"data":16149,"content":16150,"nodeType":866},{},[16151],{"data":16152,"marks":16153,"value":16154,"nodeType":865},{},[],"Understand how identities are really used across apps",{"data":16156,"content":16157,"nodeType":2654},{},[16158],{"data":16159,"content":16160,"nodeType":866},{},[16161],{"data":16162,"marks":16163,"value":16164,"nodeType":865},{},[],"Catch misconfigurations, missing MFA, and accounts using vulnerable passwords",{"data":16166,"content":16167,"nodeType":2654},{},[16168],{"data":16169,"content":16170,"nodeType":866},{},[16171],{"data":16172,"marks":16173,"value":16174,"nodeType":865},{},[],"Guide users to fix issues before they become incidents",{"data":16176,"content":16180,"nodeType":875},{"target":16177},{"sys":16178},{"id":16179,"type":872,"linkType":873},"1axELRNRyXglrf81FEkDhb",[],{"data":16182,"content":16183,"nodeType":866},{},[16184],{"data":16185,"marks":16186,"value":21,"nodeType":865},{},[],{"data":16188,"content":16192,"nodeType":875},{"target":16189},{"sys":16190},{"id":16191,"type":872,"linkType":873},"2mpx0GOwIviUAdvLGitxua",[],{"data":16194,"content":16195,"nodeType":879},{},[],{"data":16197,"content":16198,"nodeType":2315},{},[16199],{"data":16200,"marks":16201,"value":16203,"nodeType":865},{},[16202],{"type":887},"Prepare your organization for the new world of browser-based attacks",{"data":16205,"content":16206,"nodeType":866},{},[16207],{"data":16208,"marks":16209,"value":16210,"nodeType":865},{},[],"As attacks continue to evolve, we can expect regulators, insurers, and policy-makers to follow. ",{"data":16212,"content":16213,"nodeType":866},{},[16214,16217,16226],{"data":16215,"marks":16216,"value":21,"nodeType":865},{},[],{"data":16218,"content":16220,"nodeType":905},{"uri":16219},"https://pushsecurity.com/blog/6-browser-based-attacks-every-security-team-should-be-prepared-for/",[16221],{"data":16222,"marks":16223,"value":16225,"nodeType":865},{},[16224],{"type":1070},"Attacks that target users in their web browsers have seen an unprecedented rise in recent years",{"data":16227,"marks":16228,"value":16229,"nodeType":865},{},[],", exploiting the biggest security blind-spot in the enterprise security stack. ",{"data":16231,"content":16234,"nodeType":875},{"target":16232},{"sys":16233},{"id":11787,"type":872,"linkType":873},[],{"data":16236,"content":16237,"nodeType":866},{},[16238],{"data":16239,"marks":16240,"value":12288,"nodeType":865},{},[],{"data":16242,"content":16243,"nodeType":866},{},[16244,16247,16254,16257,16264],{"data":16245,"marks":16246,"value":8278,"nodeType":865},{},[],{"data":16248,"content":16249,"nodeType":905},{"uri":7323},[16250],{"data":16251,"marks":16252,"value":8286,"nodeType":865},{},[16253],{"type":1070},{"data":16255,"marks":16256,"value":8290,"nodeType":865},{},[],{"data":16258,"content":16259,"nodeType":905},{"uri":1512},[16260],{"data":16261,"marks":16262,"value":7352,"nodeType":865},{},[16263],{"type":1070},{"data":16265,"marks":16266,"value":1193,"nodeType":865},{},[],{"entries":16268},{"hyperlink":16269,"inline":16270,"block":16271},[],[],[16272,16276,16283,16291,16295,16298],{"sys":16273,"__typename":1530,"type":1531,"ctaText":16274,"buttonLabel":151,"buttonColour":14189,"buttonUrl":16275},{"id":15964},"New whitepaper: Get the big picture on current MFA regulation and compliance","https://pushsecurity.com/resources/mfa-regulation-compliance",{"sys":16277,"__typename":4637,"title":16278,"caption":16278,"layoutMode":59,"file":16279},{"id":16063},"Attacks have shifted from targeting local networks to SaaS services, accessed through employee web browsers.",{"url":16280,"width":16281,"height":16282},"https://images.ctfassets.net/y1cdw1ablpvd/SadRsmdnNZofhrKddH01D/1ba16316bdfa666b2bc387d5b694e515/image2.png",1506,574,{"sys":16284,"__typename":4637,"title":16285,"caption":16286,"layoutMode":59,"file":16287},{"id":16114},"Infographic showing the identity vulnerability spread for a 1,000 seat organization","A 1,000 user organization has over 15,000 accounts with various configurations and associated vulnerabilities.",{"url":16288,"width":16289,"height":16290},"https://images.ctfassets.net/y1cdw1ablpvd/266iLQBVsJIQEx6dnUEVrZ/eb5b1be79b7b29365baf299053fddf42/Infographic.png",5480,3012,{"sys":16292,"__typename":7447,"title":16293,"arcadeDemoUrl":16294,"playText":7450},{"id":16179},"Find and close MFA gaps with Push Security","https://demo.arcade.software/qEDIGb9n7EEPCWFntm56?embed",{"sys":16296,"__typename":1530,"type":1531,"ctaText":16297,"buttonLabel":151,"buttonColour":1534,"buttonUrl":16275},{"id":16191},"Get our whitepaper to learn how attackers are exploiting MFA gaps and what security teams can do about it",{"sys":16299,"__typename":4637,"title":16300,"caption":16301,"layoutMode":59,"file":16302},{"id":11787},"Browser-based attacks like AITM phishing, ClickFix, and consent phishing have seen an unprecedented rise in recent years.","Browser-based attacks like AITM phishing, ClickFix, and consent phishing are the fastest-growing threats of 2025. ",{"url":16303,"width":16304,"height":16305},"https://images.ctfassets.net/y1cdw1ablpvd/1eCBgB8nNDu5955f1BwFO6/b80d5cb43c7acd75e1a670d4ae22b2ec/Browser-based_attacks_graphic__1_.png",2012,1272,{"items":16307},[],{},"How cyber breaches are driving tighter MFA requirements","regulation-and-compliance","2025-09-19T00:00:00.000Z",{"items":16313},[16314,16879,17683],{"__typename":1544,"sys":16315,"content":16316,"title":12307,"synopsis":12308,"hashTags":59,"publishedDate":12309,"slug":12310,"tagsCollection":16869,"authorsCollection":16875},{"id":11659},{"json":16317},{"data":16318,"content":16319,"nodeType":1522},{},[16320,16333,16339,16342,16349,16355,16361,16377,16382,16388,16394,16400,16406,16409,16416,16422,16427,16433,16440,16446,16452,16457,16473,16478,16484,16490,16496,16501,16504,16511,16527,16533,16559,16565,16571,16576,16582,16588,16594,16597,16604,16619,16624,16630,16636,16641,16647,16653,16656,16663,16669,16685,16721,16727,16733,16739,16742,16749,16755,16761,16767,16770,16777,16783,16809,16825,16831,16834,16841,16847,16853],{"data":16321,"content":16322,"nodeType":866},{},[16323,16326,16330],{"data":16324,"marks":16325,"value":11670,"nodeType":865},{},[],{"data":16327,"marks":16328,"value":11675,"nodeType":865},{},[16329],{"type":2757},{"data":16331,"marks":16332,"value":11679,"nodeType":865},{},[],{"data":16334,"content":16335,"nodeType":866},{},[16336],{"data":16337,"marks":16338,"value":11686,"nodeType":865},{},[],{"data":16340,"content":16341,"nodeType":879},{},[],{"data":16343,"content":16344,"nodeType":889},{},[16345],{"data":16346,"marks":16347,"value":11697,"nodeType":865},{},[16348],{"type":887},{"data":16350,"content":16351,"nodeType":866},{},[16352],{"data":16353,"marks":16354,"value":11704,"nodeType":865},{},[],{"data":16356,"content":16357,"nodeType":866},{},[16358],{"data":16359,"marks":16360,"value":11711,"nodeType":865},{},[],{"data":16362,"content":16363,"nodeType":866},{},[16364,16367,16374],{"data":16365,"marks":16366,"value":11718,"nodeType":865},{},[],{"data":16368,"content":16369,"nodeType":905},{"uri":11721},[16370],{"data":16371,"marks":16372,"value":1143,"nodeType":865},{},[16373],{"type":1070},{"data":16375,"marks":16376,"value":11730,"nodeType":865},{},[],{"data":16378,"content":16381,"nodeType":875},{"target":16379},{"sys":16380},{"id":11735,"type":872,"linkType":873},[],{"data":16383,"content":16384,"nodeType":866},{},[16385],{"data":16386,"marks":16387,"value":11743,"nodeType":865},{},[],{"data":16389,"content":16390,"nodeType":866},{},[16391],{"data":16392,"marks":16393,"value":11750,"nodeType":865},{},[],{"data":16395,"content":16396,"nodeType":866},{},[16397],{"data":16398,"marks":16399,"value":11757,"nodeType":865},{},[],{"data":16401,"content":16402,"nodeType":866},{},[16403],{"data":16404,"marks":16405,"value":11764,"nodeType":865},{},[],{"data":16407,"content":16408,"nodeType":879},{},[],{"data":16410,"content":16411,"nodeType":889},{},[16412],{"data":16413,"marks":16414,"value":11775,"nodeType":865},{},[16415],{"type":887},{"data":16417,"content":16418,"nodeType":866},{},[16419],{"data":16420,"marks":16421,"value":11782,"nodeType":865},{},[],{"data":16423,"content":16426,"nodeType":875},{"target":16424},{"sys":16425},{"id":11787,"type":872,"linkType":873},[],{"data":16428,"content":16429,"nodeType":866},{},[16430],{"data":16431,"marks":16432,"value":11795,"nodeType":865},{},[],{"data":16434,"content":16435,"nodeType":2315},{},[16436],{"data":16437,"marks":16438,"value":11803,"nodeType":865},{},[16439],{"type":887},{"data":16441,"content":16442,"nodeType":866},{},[16443],{"data":16444,"marks":16445,"value":11810,"nodeType":865},{},[],{"data":16447,"content":16448,"nodeType":866},{},[16449],{"data":16450,"marks":16451,"value":11817,"nodeType":865},{},[],{"data":16453,"content":16456,"nodeType":875},{"target":16454},{"sys":16455},{"id":11822,"type":872,"linkType":873},[],{"data":16458,"content":16459,"nodeType":866},{},[16460,16463,16470],{"data":16461,"marks":16462,"value":11830,"nodeType":865},{},[],{"data":16464,"content":16465,"nodeType":905},{"uri":11833},[16466],{"data":16467,"marks":16468,"value":11839,"nodeType":865},{},[16469],{"type":1070},{"data":16471,"marks":16472,"value":11843,"nodeType":865},{},[],{"data":16474,"content":16477,"nodeType":875},{"target":16475},{"sys":16476},{"id":11848,"type":872,"linkType":873},[],{"data":16479,"content":16480,"nodeType":866},{},[16481],{"data":16482,"marks":16483,"value":11856,"nodeType":865},{},[],{"data":16485,"content":16486,"nodeType":866},{},[16487],{"data":16488,"marks":16489,"value":11863,"nodeType":865},{},[],{"data":16491,"content":16492,"nodeType":866},{},[16493],{"data":16494,"marks":16495,"value":11870,"nodeType":865},{},[],{"data":16497,"content":16500,"nodeType":875},{"target":16498},{"sys":16499},{"id":11875,"type":872,"linkType":873},[],{"data":16502,"content":16503,"nodeType":879},{},[],{"data":16505,"content":16506,"nodeType":2315},{},[16507],{"data":16508,"marks":16509,"value":11887,"nodeType":865},{},[16510],{"type":887},{"data":16512,"content":16513,"nodeType":866},{},[16514,16517,16524],{"data":16515,"marks":16516,"value":11894,"nodeType":865},{},[],{"data":16518,"content":16519,"nodeType":905},{"uri":11897},[16520],{"data":16521,"marks":16522,"value":315,"nodeType":865},{},[16523],{"type":1070},{"data":16525,"marks":16526,"value":1711,"nodeType":865},{},[],{"data":16528,"content":16529,"nodeType":866},{},[16530],{"data":16531,"marks":16532,"value":11912,"nodeType":865},{},[],{"data":16534,"content":16535,"nodeType":866},{},[16536,16539,16546,16549,16556],{"data":16537,"marks":16538,"value":11919,"nodeType":865},{},[],{"data":16540,"content":16541,"nodeType":905},{"uri":11922},[16542],{"data":16543,"marks":16544,"value":11928,"nodeType":865},{},[16545],{"type":1070},{"data":16547,"marks":16548,"value":11932,"nodeType":865},{},[],{"data":16550,"content":16551,"nodeType":905},{"uri":11935},[16552],{"data":16553,"marks":16554,"value":11941,"nodeType":865},{},[16555],{"type":1070},{"data":16557,"marks":16558,"value":1193,"nodeType":865},{},[],{"data":16560,"content":16561,"nodeType":866},{},[16562],{"data":16563,"marks":16564,"value":11951,"nodeType":865},{},[],{"data":16566,"content":16567,"nodeType":866},{},[16568],{"data":16569,"marks":16570,"value":11958,"nodeType":865},{},[],{"data":16572,"content":16575,"nodeType":875},{"target":16573},{"sys":16574},{"id":11963,"type":872,"linkType":873},[],{"data":16577,"content":16578,"nodeType":866},{},[16579],{"data":16580,"marks":16581,"value":11971,"nodeType":865},{},[],{"data":16583,"content":16584,"nodeType":866},{},[16585],{"data":16586,"marks":16587,"value":11978,"nodeType":865},{},[],{"data":16589,"content":16590,"nodeType":866},{},[16591],{"data":16592,"marks":16593,"value":11985,"nodeType":865},{},[],{"data":16595,"content":16596,"nodeType":879},{},[],{"data":16598,"content":16599,"nodeType":2315},{},[16600],{"data":16601,"marks":16602,"value":11996,"nodeType":865},{},[16603],{"type":887},{"data":16605,"content":16606,"nodeType":866},{},[16607,16610,16616],{"data":16608,"marks":16609,"value":12003,"nodeType":865},{},[],{"data":16611,"content":16612,"nodeType":905},{"uri":7641},[16613],{"data":16614,"marks":16615,"value":7647,"nodeType":865},{},[],{"data":16617,"marks":16618,"value":6352,"nodeType":865},{},[],{"data":16620,"content":16623,"nodeType":875},{"target":16621},{"sys":16622},{"id":12017,"type":872,"linkType":873},[],{"data":16625,"content":16626,"nodeType":866},{},[16627],{"data":16628,"marks":16629,"value":12025,"nodeType":865},{},[],{"data":16631,"content":16632,"nodeType":866},{},[16633],{"data":16634,"marks":16635,"value":12032,"nodeType":865},{},[],{"data":16637,"content":16640,"nodeType":875},{"target":16638},{"sys":16639},{"id":12037,"type":872,"linkType":873},[],{"data":16642,"content":16643,"nodeType":866},{},[16644],{"data":16645,"marks":16646,"value":12045,"nodeType":865},{},[],{"data":16648,"content":16649,"nodeType":866},{},[16650],{"data":16651,"marks":16652,"value":12052,"nodeType":865},{},[],{"data":16654,"content":16655,"nodeType":879},{},[],{"data":16657,"content":16658,"nodeType":2315},{},[16659],{"data":16660,"marks":16661,"value":12063,"nodeType":865},{},[16662],{"type":887},{"data":16664,"content":16665,"nodeType":866},{},[16666],{"data":16667,"marks":16668,"value":12070,"nodeType":865},{},[],{"data":16670,"content":16671,"nodeType":866},{},[16672,16675,16682],{"data":16673,"marks":16674,"value":12077,"nodeType":865},{},[],{"data":16676,"content":16677,"nodeType":905},{"uri":12080},[16678],{"data":16679,"marks":16680,"value":12086,"nodeType":865},{},[16681],{"type":1070},{"data":16683,"marks":16684,"value":12090,"nodeType":865},{},[],{"data":16686,"content":16687,"nodeType":866},{},[16688,16691,16698,16701,16708,16711,16718],{"data":16689,"marks":16690,"value":12097,"nodeType":865},{},[],{"data":16692,"content":16693,"nodeType":905},{"uri":12100},[16694],{"data":16695,"marks":16696,"value":12106,"nodeType":865},{},[16697],{"type":1070},{"data":16699,"marks":16700,"value":12110,"nodeType":865},{},[],{"data":16702,"content":16703,"nodeType":905},{"uri":12113},[16704],{"data":16705,"marks":16706,"value":12119,"nodeType":865},{},[16707],{"type":1070},{"data":16709,"marks":16710,"value":1454,"nodeType":865},{},[],{"data":16712,"content":16713,"nodeType":905},{"uri":12125},[16714],{"data":16715,"marks":16716,"value":12131,"nodeType":865},{},[16717],{"type":1070},{"data":16719,"marks":16720,"value":1193,"nodeType":865},{},[],{"data":16722,"content":16723,"nodeType":866},{},[16724],{"data":16725,"marks":16726,"value":12141,"nodeType":865},{},[],{"data":16728,"content":16729,"nodeType":866},{},[16730],{"data":16731,"marks":16732,"value":12148,"nodeType":865},{},[],{"data":16734,"content":16735,"nodeType":866},{},[16736],{"data":16737,"marks":16738,"value":12155,"nodeType":865},{},[],{"data":16740,"content":16741,"nodeType":879},{},[],{"data":16743,"content":16744,"nodeType":2315},{},[16745],{"data":16746,"marks":16747,"value":12166,"nodeType":865},{},[16748],{"type":887},{"data":16750,"content":16751,"nodeType":866},{},[16752],{"data":16753,"marks":16754,"value":12173,"nodeType":865},{},[],{"data":16756,"content":16757,"nodeType":866},{},[16758],{"data":16759,"marks":16760,"value":12180,"nodeType":865},{},[],{"data":16762,"content":16763,"nodeType":866},{},[16764],{"data":16765,"marks":16766,"value":12187,"nodeType":865},{},[],{"data":16768,"content":16769,"nodeType":879},{},[],{"data":16771,"content":16772,"nodeType":2315},{},[16773],{"data":16774,"marks":16775,"value":12198,"nodeType":865},{},[16776],{"type":887},{"data":16778,"content":16779,"nodeType":866},{},[16780],{"data":16781,"marks":16782,"value":12205,"nodeType":865},{},[],{"data":16784,"content":16785,"nodeType":866},{},[16786,16789,16796,16799,16806],{"data":16787,"marks":16788,"value":12212,"nodeType":865},{},[],{"data":16790,"content":16791,"nodeType":905},{"uri":11721},[16792],{"data":16793,"marks":16794,"value":1143,"nodeType":865},{},[16795],{"type":1070},{"data":16797,"marks":16798,"value":12223,"nodeType":865},{},[],{"data":16800,"content":16801,"nodeType":905},{"uri":12226},[16802],{"data":16803,"marks":16804,"value":12232,"nodeType":865},{},[16805],{"type":1070},{"data":16807,"marks":16808,"value":12236,"nodeType":865},{},[],{"data":16810,"content":16811,"nodeType":866},{},[16812,16815,16822],{"data":16813,"marks":16814,"value":12243,"nodeType":865},{},[],{"data":16816,"content":16817,"nodeType":905},{"uri":12246},[16818],{"data":16819,"marks":16820,"value":12252,"nodeType":865},{},[16821],{"type":1070},{"data":16823,"marks":16824,"value":12256,"nodeType":865},{},[],{"data":16826,"content":16827,"nodeType":866},{},[16828],{"data":16829,"marks":16830,"value":12263,"nodeType":865},{},[],{"data":16832,"content":16833,"nodeType":879},{},[],{"data":16835,"content":16836,"nodeType":889},{},[16837],{"data":16838,"marks":16839,"value":12274,"nodeType":865},{},[16840],{"type":887},{"data":16842,"content":16843,"nodeType":866},{},[16844],{"data":16845,"marks":16846,"value":12281,"nodeType":865},{},[],{"data":16848,"content":16849,"nodeType":866},{},[16850],{"data":16851,"marks":16852,"value":12288,"nodeType":865},{},[],{"data":16854,"content":16855,"nodeType":866},{},[16856,16859,16866],{"data":16857,"marks":16858,"value":12295,"nodeType":865},{},[],{"data":16860,"content":16861,"nodeType":905},{"uri":12298},[16862],{"data":16863,"marks":16864,"value":7352,"nodeType":865},{},[16865],{"type":1070},{"data":16867,"marks":16868,"value":1193,"nodeType":865},{},[],{"items":16870},[16871,16873],{"sys":16872,"name":2144},{"id":2143},{"sys":16874,"name":342},{"id":3008},{"items":16876},[16877],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":16878},{"url":3016},{"__typename":1544,"sys":16880,"content":16881,"title":17671,"synopsis":17672,"hashTags":59,"publishedDate":17673,"slug":17674,"tagsCollection":17675,"authorsCollection":17679},{"id":9124},{"json":16882},{"data":16883,"content":16884,"nodeType":1522},{},[16885,16891,16911,16918,16925,16931,16934,16942,16949,16967,16978,16985,16992,16999,17092,17095,17103,17186,17192,17195,17203,17211,17218,17225,17233,17250,17257,17265,17272,17279,17287,17294,17301,17321,17327,17330,17338,17346,17353,17456,17463,17471,17478,17485,17491,17499,17506,17513,17520,17528,17535,17542,17549,17556,17562,17565,17573,17580,17613,17620,17639,17659,17665],{"data":16886,"content":16890,"nodeType":875},{"target":16887},{"sys":16888},{"id":16889,"type":872,"linkType":873},"1eBClNW4NOR66F0tl9h6lD",[],{"data":16892,"content":16893,"nodeType":866},{},[16894,16898,16907],{"data":16895,"marks":16896,"value":16897,"nodeType":865},{},[],"The attacks on Snowflake customers in 2024 collectively constituted the biggest cyber security event of the year in terms of the number of organizations and individuals affected (at least, if you exclude CrowdStrike causing a worldwide outage in July) — certainly, it was the largest perpetrated by a criminal group against commercial enterprises. It has been touted by some news outlets as ‘",{"data":16899,"content":16901,"nodeType":905},{"uri":16900},"https://www.wired.com/story/snowflake-breach-advanced-auto-parts-lendingtree/",[16902],{"data":16903,"marks":16904,"value":16906,"nodeType":865},{},[16905],{"type":1070},"one of the biggest breaches ever",{"data":16908,"marks":16909,"value":16910,"nodeType":865},{},[],"’.  ",{"data":16912,"content":16913,"nodeType":866},{},[16914],{"data":16915,"marks":16916,"value":16917,"nodeType":865},{},[],"Snowflake was a watershed moment that signalled the significant opportunity presented by identity attacks on cloud services. It demonstrated how comparatively unsophisticated methods (logging in to user accounts with stolen credentials and dumping the data) can have the same or greater impact as a traditional network or endpoint based cyber attack involving vulnerability exploitation, malware deployment, ransomware, etc. ",{"data":16919,"content":16920,"nodeType":866},{},[16921],{"data":16922,"marks":16923,"value":16924,"nodeType":865},{},[],"Here’s everything you need to know about the Snowflake attacks — and what you can do to protect yourself against the next Snowflake in the future.",{"data":16926,"content":16930,"nodeType":875},{"target":16927},{"sys":16928},{"id":16929,"type":872,"linkType":873},"4QoPUiP5q6Mwj1eWUZT15Q",[],{"data":16932,"content":16933,"nodeType":879},{},[],{"data":16935,"content":16936,"nodeType":889},{},[16937],{"data":16938,"marks":16939,"value":16941,"nodeType":865},{},[16940],{"type":887},"Snowflake: The facts",{"data":16943,"content":16944,"nodeType":866},{},[16945],{"data":16946,"marks":16947,"value":16948,"nodeType":865},{},[],"Cyber criminals associated with the threat group known as ShinyHunters claimed responsibility for breaching multiple organizations using Snowflake, a cloud-based data warehousing and analytics platform. ",{"data":16950,"content":16951,"nodeType":866},{},[16952,16956,16964],{"data":16953,"marks":16954,"value":16955,"nodeType":865},{},[],"ShinyHunters associates targeted ~165 organizations that were subjected to account takeover attacks using stolen credentials harvested from historical infostealer infections dating back as far as 2020, ",{"data":16957,"content":16958,"nodeType":905},{"uri":3455},[16959],{"data":16960,"marks":16961,"value":16963,"nodeType":865},{},[16962],{"type":1070},"according to Mandiant’s investigation",{"data":16965,"marks":16966,"value":1711,"nodeType":865},{},[],{"data":16968,"content":16969,"nodeType":1649},{},[16970],{"data":16971,"content":16972,"nodeType":866},{},[16973],{"data":16974,"marks":16975,"value":16977,"nodeType":865},{},[16976],{"type":887},">80% of the compromised accounts belonging to Snowflake customers had prior credential exposure. ",{"data":16979,"content":16980,"nodeType":866},{},[16981],{"data":16982,"marks":16983,"value":16984,"nodeType":865},{},[],"The impacted accounts lacked MFA, meaning successful authentication only required a valid username and password. As the Snowflake credentials found in infostealer malware credential dumps had not been rotated or updated, they remained valid and could be used to authenticate to user accounts on Snowflake tenants belonging to various customers.",{"data":16986,"content":16987,"nodeType":866},{},[16988],{"data":16989,"marks":16990,"value":16991,"nodeType":865},{},[],"As a data warehousing platform integrated with a range of connected cloud services, access to a customer’s Snowflake tenant provided attackers with large quantities of sensitive commercial and personal data that could be stolen and monetized by attackers in a variety of ways — such as by ransoming the victim organization, extorting individual end-customers, and selling the data on to other criminal organizations. ",{"data":16993,"content":16994,"nodeType":866},{},[16995],{"data":16996,"marks":16997,"value":16998,"nodeType":865},{},[],"In total, 9 public victims were named following the breach, collectively impacting hundreds of millions of people. ",{"data":17000,"content":17001,"nodeType":2718},{},[17002,17012,17022,17032,17042,17052,17062,17072,17082],{"data":17003,"content":17004,"nodeType":2654},{},[17005],{"data":17006,"content":17007,"nodeType":866},{},[17008],{"data":17009,"marks":17010,"value":17011,"nodeType":865},{},[],"Lending Tree: Sensitive data for over 190 million people available online including customer details, partial credit card numbers, insurance quotes and other information, being sold for $2m.",{"data":17013,"content":17014,"nodeType":2654},{},[17015],{"data":17016,"content":17017,"nodeType":866},{},[17018],{"data":17019,"marks":17020,"value":17021,"nodeType":865},{},[],"Truist Bank: Information belonging to 65,000 employees being sold online for $1m",{"data":17023,"content":17024,"nodeType":2654},{},[17025],{"data":17026,"content":17027,"nodeType":866},{},[17028],{"data":17029,"marks":17030,"value":17031,"nodeType":865},{},[],"Advance Auto Parts: 3TB of data for sale for $1.5 million. Affected 2.3 million people, as well as current and former employees and job applicants.",{"data":17033,"content":17034,"nodeType":2654},{},[17035],{"data":17036,"content":17037,"nodeType":866},{},[17038],{"data":17039,"marks":17040,"value":17041,"nodeType":865},{},[],"Pure Storage: Workspace with 11k customer records including company, email, LDAP username and software version numbers.",{"data":17043,"content":17044,"nodeType":2654},{},[17045],{"data":17046,"content":17047,"nodeType":866},{},[17048],{"data":17049,"marks":17050,"value":17051,"nodeType":865},{},[],"Los Angeles Unified: Student data, disability information, discipline details, and parent information, being sold online for $150k.",{"data":17053,"content":17054,"nodeType":2654},{},[17055],{"data":17056,"content":17057,"nodeType":866},{},[17058],{"data":17059,"marks":17060,"value":17061,"nodeType":865},{},[],"Neiman Marcus: 31m email addresses exposed alongside various personal information.",{"data":17063,"content":17064,"nodeType":2654},{},[17065],{"data":17066,"content":17067,"nodeType":866},{},[17068],{"data":17069,"marks":17070,"value":17071,"nodeType":865},{},[],"Santander: 30 million customer details for sale relating to customers of Santander Chile, Spain, and Uruguay.",{"data":17073,"content":17074,"nodeType":2654},{},[17075],{"data":17076,"content":17077,"nodeType":866},{},[17078],{"data":17079,"marks":17080,"value":17081,"nodeType":865},{},[],"Ticketmaster: 560 million customer details for sale, disruption to events and ticketing worldwide, increasing in scam ticket production.",{"data":17083,"content":17084,"nodeType":2654},{},[17085],{"data":17086,"content":17087,"nodeType":866},{},[17088],{"data":17089,"marks":17090,"value":17091,"nodeType":865},{},[],"AT&T: Call logs stolen for approximately 109 million customers (nearly all of its mobile customers). AT&T paid an undisclosed ransom fee. ",{"data":17093,"content":17094,"nodeType":879},{},[],{"data":17096,"content":17097,"nodeType":889},{},[17098],{"data":17099,"marks":17100,"value":17102,"nodeType":865},{},[17101],{"type":887},"The Snowflake attacks step-by-step",{"data":17104,"content":17105,"nodeType":2718},{},[17106,17116,17126,17136,17146,17156,17166,17176],{"data":17107,"content":17108,"nodeType":2654},{},[17109],{"data":17110,"content":17111,"nodeType":866},{},[17112],{"data":17113,"marks":17114,"value":17115,"nodeType":865},{},[],"Snowflake users were infected with infostealer malware that harvested credentials from user devices over an extended period via several infostealer malware variants, including; VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA and METASTEALER.",{"data":17117,"content":17118,"nodeType":2654},{},[17119],{"data":17120,"content":17121,"nodeType":866},{},[17122],{"data":17123,"marks":17124,"value":17125,"nodeType":865},{},[],"Credentials appeared on criminal marketplaces e.g. dark web forums and Telegram channels.",{"data":17127,"content":17128,"nodeType":2654},{},[17129],{"data":17130,"content":17131,"nodeType":866},{},[17132],{"data":17133,"marks":17134,"value":17135,"nodeType":865},{},[],"ShinyHunters saw the potential in targeting Snowflake users, based on the availability of credentials, number of customer organizations, and the value of the data that can be accessed in Snowflake. ",{"data":17137,"content":17138,"nodeType":2654},{},[17139],{"data":17140,"content":17141,"nodeType":866},{},[17142],{"data":17143,"marks":17144,"value":17145,"nodeType":865},{},[],"ShinyHunters embarked on a large-scale campaign targeting Snowflake customer accounts using previously breached credentials. ",{"data":17147,"content":17148,"nodeType":2654},{},[17149],{"data":17150,"content":17151,"nodeType":866},{},[17152],{"data":17153,"marks":17154,"value":17155,"nodeType":865},{},[],"ShinyHunters accessed user accounts that lacked MFA, belonging to approximately 165 Snowflake customers. ",{"data":17157,"content":17158,"nodeType":2654},{},[17159],{"data":17160,"content":17161,"nodeType":866},{},[17162],{"data":17163,"marks":17164,"value":17165,"nodeType":865},{},[],"ShinyHunters used SQL-based reconnaissance, staging, and data exfiltration techniques, expedited by custom hacker tooling developed specifically for Snowflake, to conduct attacks at scale.",{"data":17167,"content":17168,"nodeType":2654},{},[17169],{"data":17170,"content":17171,"nodeType":866},{},[17172],{"data":17173,"marks":17174,"value":17175,"nodeType":865},{},[],"ShinyHunters acquired massive quantities of Snowflake data based on the information that each customer stored in Snowflake or connected apps. ",{"data":17177,"content":17178,"nodeType":2654},{},[17179],{"data":17180,"content":17181,"nodeType":866},{},[17182],{"data":17183,"marks":17184,"value":17185,"nodeType":865},{},[],"ShinyHunters began attempts to extort Snowflake and end-customers using the data acquired.",{"data":17187,"content":17191,"nodeType":875},{"target":17188},{"sys":17189},{"id":17190,"type":872,"linkType":873},"2J92gFLs1wAAGC4nQTaiWu",[],{"data":17193,"content":17194,"nodeType":879},{},[],{"data":17196,"content":17197,"nodeType":889},{},[17198],{"data":17199,"marks":17200,"value":17202,"nodeType":865},{},[17201],{"type":887},"Why did the Snowflake breaches happen?",{"data":17204,"content":17205,"nodeType":2315},{},[17206],{"data":17207,"marks":17208,"value":17210,"nodeType":865},{},[17209],{"type":887},"Stolen credentials remained valid for years",{"data":17212,"content":17213,"nodeType":866},{},[17214],{"data":17215,"marks":17216,"value":17217,"nodeType":865},{},[],"The credentials used to access Snowflake accounts from historical infostealer infections had not been changed or rotated despite dating back as far as 2020, and remained valid. ",{"data":17219,"content":17220,"nodeType":866},{},[17221],{"data":17222,"marks":17223,"value":17224,"nodeType":865},{},[],"This highlights the potential risk of breached credentials already in the public domain, particularly in the case of cloud services like Snowflake that may not be subject to the same levels of credential hygiene as other traditional enterprise domain accounts. ",{"data":17226,"content":17227,"nodeType":2315},{},[17228],{"data":17229,"marks":17230,"value":17232,"nodeType":865},{},[17231],{"type":887},"Local logins lacked MFA ",{"data":17234,"content":17235,"nodeType":866},{},[17236,17240,17247],{"data":17237,"marks":17238,"value":17239,"nodeType":865},{},[],"Even where organizations were primarily encouraging employees to use SSO to access their Snowflake tenant, previously created local logins with a username and password continue to exist even after introducing SSO-based logins. Further, MFA was not globally enforceable at the application level, meaning that MFA was only set when logging into an IdP account for SSO, but not for local logins. We call this problem ",{"data":17241,"content":17242,"nodeType":905},{"uri":945},[17243],{"data":17244,"marks":17245,"value":950,"nodeType":865},{},[17246],{"type":1070},{"data":17248,"marks":17249,"value":1711,"nodeType":865},{},[],{"data":17251,"content":17252,"nodeType":866},{},[17253],{"data":17254,"marks":17255,"value":17256,"nodeType":865},{},[],"This meant that attackers were able to take over Snowflake accounts with only a single authentication factor (username & password). ",{"data":17258,"content":17259,"nodeType":2315},{},[17260],{"data":17261,"marks":17262,"value":17264,"nodeType":865},{},[17263],{"type":887},"Snowflake was a high-value target used by many organizations",{"data":17266,"content":17267,"nodeType":866},{},[17268],{"data":17269,"marks":17270,"value":17271,"nodeType":865},{},[],"As a data warehousing platform used by a vast number of organizations, Snowflake represented a high-value target based on the data typically stored within it, and the repeatable way in which Snowflake users could be targeted. ",{"data":17273,"content":17274,"nodeType":866},{},[17275],{"data":17276,"marks":17277,"value":17278,"nodeType":865},{},[],"The attacker followed a near identical process when targeting Snowflake victims, meaning it could be scripted and executed at scale, with attacks taking a matter of minutes. ",{"data":17280,"content":17281,"nodeType":2315},{},[17282],{"data":17283,"marks":17284,"value":17286,"nodeType":865},{},[17285],{"type":887},"Infostealer infections are driving credential availability",{"data":17288,"content":17289,"nodeType":866},{},[17290],{"data":17291,"marks":17292,"value":17293,"nodeType":865},{},[],"Infostealers are often seen as a low-priority issue, but are the primary source of stolen credentials used in campaigns like this one. ",{"data":17295,"content":17296,"nodeType":866},{},[17297],{"data":17298,"marks":17299,"value":17300,"nodeType":865},{},[],"EDR is a strong protection but is often bypassed by infostealers as attackers continually modify them to bypass security controls. Further, unmanaged devices such as those used by third-party contractors or BYOD employees often lack the robust controls applied to company-managed devices and are naturally more susceptible to infostealer attacks. And since browser profiles can be synced across devices, even personal device compromises can result in the capture of corporate credentials.  ",{"data":17302,"content":17303,"nodeType":866},{},[17304,17308,17317],{"data":17305,"marks":17306,"value":17307,"nodeType":865},{},[],"There is some suggestion that targeting key third-party suppliers – ",{"data":17309,"content":17311,"nodeType":905},{"uri":17310},"https://www.wired.com/story/epam-snowflake-ticketmaster-breach-shinyhunters/",[17312],{"data":17313,"marks":17314,"value":17316,"nodeType":865},{},[17315],{"type":1070},"such as EPAM Systems, a software engineering firm and Snowflake ‘Elite Tier Partner’",{"data":17318,"marks":17319,"value":17320,"nodeType":865},{},[]," – provided some of the access to Snowflake customers needed. It’s unclear what came first, but it’s possible (likely, even) that EPAM was identified as a target specifically because of its lucrative customer base and Snowflake credentials — adding another indicator that Snowflake was potentially a premeditated attack inspired by the availability of Snowflake credentials online.",{"data":17322,"content":17326,"nodeType":875},{"target":17323},{"sys":17324},{"id":17325,"type":872,"linkType":873},"4D0gjt5oJLNKJH8GzjP8Je",[],{"data":17328,"content":17329,"nodeType":879},{},[],{"data":17331,"content":17332,"nodeType":889},{},[17333],{"data":17334,"marks":17335,"value":17337,"nodeType":865},{},[17336],{"type":887},"Key takeaways from the Snowflake attacks",{"data":17339,"content":17340,"nodeType":2315},{},[17341],{"data":17342,"marks":17343,"value":17345,"nodeType":865},{},[17344],{"type":887},"Securing your IdP accounts is not enough",{"data":17347,"content":17348,"nodeType":866},{},[17349],{"data":17350,"marks":17351,"value":17352,"nodeType":865},{},[],"SSO can help reduce your identity attack surface, but it's not feasible to get every workforce identity behind it.",{"data":17354,"content":17355,"nodeType":2718},{},[17356,17379,17400,17434],{"data":17357,"content":17358,"nodeType":2654},{},[17359],{"data":17360,"content":17361,"nodeType":866},{},[17362,17366,17375],{"data":17363,"marks":17364,"value":17365,"nodeType":865},{},[],"Only 1 in 3 apps support SAML SSO, and those that offer it often charge more for it; the “",{"data":17367,"content":17369,"nodeType":905},{"uri":17368},"https://ssotax.org/",[17370],{"data":17371,"marks":17372,"value":17374,"nodeType":865},{},[17373],{"type":1070},"SSO tax",{"data":17376,"marks":17377,"value":17378,"nodeType":865},{},[],"”.",{"data":17380,"content":17381,"nodeType":2654},{},[17382],{"data":17383,"content":17384,"nodeType":866},{},[17385,17389,17397],{"data":17386,"marks":17387,"value":17388,"nodeType":865},{},[],"Many apps are self-adopted by employees, leaving security teams unaware and unable to enforce SSO.  The typical organization has ",{"data":17390,"content":17391,"nodeType":905},{"uri":6333},[17392],{"data":17393,"marks":17394,"value":17396,"nodeType":865},{},[17395],{"type":1070},"hundreds of apps and thousands of unmanaged identities outside of SSO",{"data":17398,"marks":17399,"value":1193,"nodeType":865},{},[],{"data":17401,"content":17402,"nodeType":2654},{},[17403],{"data":17404,"content":17405,"nodeType":866},{},[17406,17410,17417,17421,17430],{"data":17407,"marks":17408,"value":17409,"nodeType":865},{},[],"Most apps do not prevent users from creating additional \"",{"data":17411,"content":17412,"nodeType":905},{"uri":945},[17413],{"data":17414,"marks":17415,"value":7064,"nodeType":865},{},[17416],{"type":1070},{"data":17418,"marks":17419,"value":17420,"nodeType":865},{},[],"\" methods outside of SSO (especially by default), accounting for around ",{"data":17422,"content":17424,"nodeType":905},{"uri":17423},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/#id-identity-configurations-and-how-they-can-be-exploited_id-many-accounts-lack-the-most-basic-protections",[17425],{"data":17426,"marks":17427,"value":17429,"nodeType":865},{},[17428],{"type":1070},"10% of all identities",{"data":17431,"marks":17432,"value":17433,"nodeType":865},{},[]," observed by Push. ",{"data":17435,"content":17436,"nodeType":2654},{},[17437],{"data":17438,"content":17439,"nodeType":866},{},[17440,17444,17452],{"data":17441,"marks":17442,"value":17443,"nodeType":865},{},[],"In total, we identified that ",{"data":17445,"content":17446,"nodeType":905},{"uri":6333},[17447],{"data":17448,"marks":17449,"value":17451,"nodeType":865},{},[17450],{"type":1070},"37% (2 in 5) accounts have a password login set with no MFA",{"data":17453,"marks":17454,"value":17455,"nodeType":865},{},[],", while 9% have no MFA AND a weak, breached, or reused password.",{"data":17457,"content":17458,"nodeType":866},{},[17459],{"data":17460,"marks":17461,"value":17462,"nodeType":865},{},[],"So, relying on locked-down IdP accounts and maximising the use of SSO is an important pillar of an effective identity security strategy, but there will always be gaps. Unless you recognize this, you may be blindsided by attackers finding them before you do. ",{"data":17464,"content":17465,"nodeType":2315},{},[17466],{"data":17467,"marks":17468,"value":17470,"nodeType":865},{},[17469],{"type":887},"The threat of infostealers and stolen credentials needs to be taken seriously",{"data":17472,"content":17473,"nodeType":866},{},[17474],{"data":17475,"marks":17476,"value":17477,"nodeType":865},{},[],"Breached credentials appearing online is not always seen as a top priority for security teams, particularly when there’s so much noise from all of the outdated or simply erroneous findings (anyone that’s ever subscribed to a credential TI feed knows the pain of this). ",{"data":17479,"content":17480,"nodeType":866},{},[17481],{"data":17482,"marks":17483,"value":17484,"nodeType":865},{},[],"But Snowflake serves as a stark reminder that despite all the false positives, stolen credentials are sometimes valid — and when weaponized at-scale they can be a powerful tool for attackers. ",{"data":17486,"content":17490,"nodeType":875},{"target":17487},{"sys":17488},{"id":17489,"type":872,"linkType":873},"4EODpwKsqNivpvP2yMtZCd",[],{"data":17492,"content":17493,"nodeType":2315},{},[17494],{"data":17495,"marks":17496,"value":17498,"nodeType":865},{},[17497],{"type":887},"Don’t rely on third-parties to protect your identities for you",{"data":17500,"content":17501,"nodeType":866},{},[17502],{"data":17503,"marks":17504,"value":17505,"nodeType":865},{},[],"Snowflake came under fire following the attacks for not enabling MFA by default, or giving security teams sufficient tools to deal with the incident. ",{"data":17507,"content":17508,"nodeType":866},{},[17509],{"data":17510,"marks":17511,"value":17512,"nodeType":865},{},[],"This is perhaps justifiable, but is hardly the exception. Very few apps enforce MFA by default or provide a global MFA enforcement mechanism. Most don’t even provide audit logs (and when they do, the scope of logging is pretty limited). And we regularly encounter apps that don’t give you any information about account configuration as an admin — like which accounts have MFA, or the login methods that they’re using (e.g. SSO via SAML, SSO via OIDC, password, which IdPs are being used…) which is essential information to be able to secure your identity attack surface. ",{"data":17514,"content":17515,"nodeType":866},{},[17516],{"data":17517,"marks":17518,"value":17519,"nodeType":865},{},[],"Yes, it would be great if app vendors put security first and made controls available by default, for all customers (not just the premium ones). But in the absence of an industrywide shift toward security-first product development, it’s important that organizations don’t just point the finger at service providers — and take matters into their own hands when it comes to securing their user identities. ",{"data":17521,"content":17522,"nodeType":2315},{},[17523],{"data":17524,"marks":17525,"value":17527,"nodeType":865},{},[17526],{"type":887},"This isn’t a specific Snowflake problem — it could have been any application",{"data":17529,"content":17530,"nodeType":866},{},[17531],{"data":17532,"marks":17533,"value":17534,"nodeType":865},{},[],"While Snowflake was admittedly a high-value target because of the data it collected, apps with sensitive data (or with integrations connecting them to data collected in adjacent apps) are not in short supply. ",{"data":17536,"content":17537,"nodeType":866},{},[17538],{"data":17539,"marks":17540,"value":17541,"nodeType":865},{},[],"If we accept that many other apps are similarly desirable targets, then we should also consider that it’s unlikely that Snowflake is the only app that has valid credentials sitting around on the internet, waiting to be weaponized by criminals. Equally, it’s not the only app that doesn’t require mandatory MFA for user accounts, as we discussed above. The next Snowflake is likely to lurk in the same breached datasets, possibly even using the same credentials.",{"data":17543,"content":17544,"nodeType":866},{},[17545],{"data":17546,"marks":17547,"value":17548,"nodeType":865},{},[],"There’s been a clear increase in the number of infostealer and stolen credential related breaches and news stories since Snowflake as attackers wise up to the potential opportunity and start seeing the dollar signs. It would be naive to think that this was a one off event — the next Snowflake is probably not too far away. ",{"data":17550,"content":17551,"nodeType":866},{},[17552],{"data":17553,"marks":17554,"value":17555,"nodeType":865},{},[],"For a deep-dive analysis of the impact of Snowflake, check out our on-demand webinar from earlier this year.",{"data":17557,"content":17561,"nodeType":875},{"target":17558},{"sys":17559},{"id":17560,"type":872,"linkType":873},"7LkU5DqE9HJ1PQu9BTg6Mw",[],{"data":17563,"content":17564,"nodeType":879},{},[],{"data":17566,"content":17567,"nodeType":889},{},[17568],{"data":17569,"marks":17570,"value":17572,"nodeType":865},{},[17571],{"type":887},"How to protect yourself from the next Snowflake using Push",{"data":17574,"content":17575,"nodeType":866},{},[17576],{"data":17577,"marks":17578,"value":17579,"nodeType":865},{},[],"Organizations looking to reduce their exposure to account takeover using stolen credentials should look to:",{"data":17581,"content":17582,"nodeType":2718},{},[17583,17593,17603],{"data":17584,"content":17585,"nodeType":2654},{},[17586],{"data":17587,"content":17588,"nodeType":866},{},[17589],{"data":17590,"marks":17591,"value":17592,"nodeType":865},{},[],"Identify the apps being used across the business and locate vulnerable workforce identities using weak, breached, or reused credentials, and missing MFA. Where SSO is the preferred login method, local username & password logins should ideally be removed. ",{"data":17594,"content":17595,"nodeType":2654},{},[17596],{"data":17597,"content":17598,"nodeType":866},{},[17599],{"data":17600,"marks":17601,"value":17602,"nodeType":865},{},[],"Where credentials appear in third-party data breaches, verify where they are still valid and ensure that the credentials are changed. ",{"data":17604,"content":17605,"nodeType":2654},{},[17606],{"data":17607,"content":17608,"nodeType":866},{},[17609],{"data":17610,"marks":17611,"value":17612,"nodeType":865},{},[],"Detect unauthorized access to workforce identities where sessions are initiated or resumed from unusual or unexpected locations. It should be noted that while this is a fairly common feature for larger enterprise cloud platforms with configurable access control policies, this is not typically possible for most SaaS applications.  ",{"data":17614,"content":17615,"nodeType":866},{},[17616],{"data":17617,"marks":17618,"value":17619,"nodeType":865},{},[],"All of these use cases can be achieved using Push. The Push browser extension detects all logins performed in employee browsers, capturing granular information about the login method and MFA types used, and enriching this data by integrating with your preferred IdP.",{"data":17621,"content":17622,"nodeType":866},{},[17623,17627,17635],{"data":17624,"marks":17625,"value":17626,"nodeType":865},{},[],"Push’s ",{"data":17628,"content":17630,"nodeType":905},{"uri":17629},"https://pushsecurity.com/blog/verified-stolen-credential-detection",[17631],{"data":17632,"marks":17633,"value":17634,"nodeType":865},{},[],"verified stolen credential detection feature",{"data":17636,"marks":17637,"value":17638,"nodeType":865},{},[]," compares a k-anonymized hash of user passwords observed with stolen credential TI feeds to cut through the noise and identify where stolen credentials appearing online represent a genuine vulnerability.   ",{"data":17640,"content":17641,"nodeType":866},{},[17642,17646,17655],{"data":17643,"marks":17644,"value":17645,"nodeType":865},{},[],"On top of this, all logins made in browsers protected by the Push extension, across every app, are verified by ",{"data":17647,"content":17649,"nodeType":905},{"uri":17648},"https://pushsecurity.com/blog/introducing-session-token-theft-detection-why-browser-is-best/",[17650],{"data":17651,"marks":17652,"value":17654,"nodeType":865},{},[17653],{"type":1070},"adding a unique marker to the user agent string of the session",{"data":17656,"marks":17657,"value":17658,"nodeType":865},{},[],", which will then appear in your IdP logs. This means that any session occurring outside of the Push-protected estate can be flagged to your security team via SIEM alert — including where an attacker uses stolen credentials to log into an app from a browser without the Push extension running. ",{"data":17660,"content":17664,"nodeType":875},{"target":17661},{"sys":17662},{"id":17663,"type":872,"linkType":873},"3tqVk7Vr7pYLOEVukIJM2g",[],{"data":17666,"content":17667,"nodeType":866},{},[17668],{"data":17669,"marks":17670,"value":21,"nodeType":865},{},[],"Snowflake: Looking back on 2024’s landmark security event","165 Snowflake customers were targeted by criminals using stolen credentials from infostealer infections, impacting hundreds of millions of people. ","2024-11-29T00:00:00.000Z","snowflake-retro",{"items":17676},[17677],{"sys":17678,"name":2144},{"id":2143},{"items":17680},[17681],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":17682},{"url":3016},{"__typename":1544,"sys":17684,"content":17685,"title":18373,"synopsis":18374,"hashTags":59,"publishedDate":18375,"slug":18376,"tagsCollection":18377,"authorsCollection":18383},{"id":9066},{"json":17686},{"data":17687,"content":17688,"nodeType":1522},{},[17689,17705,17711,17717,17723,17726,17734,17741,17834,17840,17847,17854,17857,17865,17873,17880,17933,17941,17958,17987,17994,18002,18009,18015,18034,18050,18056,18063,18089,18096,18103,18136,18143,18150,18169,18172,18180,18187,18194,18201,18209,18229,18234,18242,18261,18279,18285,18293,18300,18318,18325,18331,18334,18342,18349,18356],{"data":17690,"content":17691,"nodeType":866},{},[17692,17696,17701],{"data":17693,"marks":17694,"value":17695,"nodeType":865},{},[],"Since late 2024, attackers have been targeting organizations using Jira, the project management tool, taking over user accounts using compromised credentials. This has resulted in ",{"data":17697,"marks":17698,"value":17700,"nodeType":865},{},[17699],{"type":887},"six public breaches in five months",{"data":17702,"marks":17703,"value":17704,"nodeType":865},{},[]," where criminals made off with sensitive data and documentation, profiting by extorting the victims and selling the data on criminal forums. ",{"data":17706,"content":17710,"nodeType":875},{"target":17707},{"sys":17708},{"id":17709,"type":872,"linkType":873},"3QJBi8NiId1CccFmJrp8pu",[],{"data":17712,"content":17713,"nodeType":866},{},[17714],{"data":17715,"marks":17716,"value":21,"nodeType":865},{},[],{"data":17718,"content":17722,"nodeType":875},{"target":17719},{"sys":17720},{"id":17721,"type":872,"linkType":873},"79uXXgsAuOK9dKwYQFb0d1",[],{"data":17724,"content":17725,"nodeType":879},{},[],{"data":17727,"content":17728,"nodeType":889},{},[17729],{"data":17730,"marks":17731,"value":17733,"nodeType":865},{},[17732],{"type":887},"What happened?",{"data":17735,"content":17736,"nodeType":866},{},[17737],{"data":17738,"marks":17739,"value":17740,"nodeType":865},{},[],"Six attacks where stolen credentials were used to compromise the victim’s Jira tenant have been reported since November 2024, all attributed to operators belonging to the HELLCAT threat group. ",{"data":17742,"content":17743,"nodeType":2718},{},[17744,17759,17774,17789,17804,17819],{"data":17745,"content":17746,"nodeType":2654},{},[17747],{"data":17748,"content":17749,"nodeType":866},{},[17750,17755],{"data":17751,"marks":17752,"value":17754,"nodeType":865},{},[17753],{"type":887},"Affinitiv (March 2025): ",{"data":17756,"marks":17757,"value":17758,"nodeType":865},{},[],"Attackers stole a database containing over 470k unique emails and 780k records from marketing data analytics provider Affinitiv. ",{"data":17760,"content":17761,"nodeType":2654},{},[17762],{"data":17763,"content":17764,"nodeType":866},{},[17765,17770],{"data":17766,"marks":17767,"value":17769,"nodeType":865},{},[17768],{"type":887},"Ascom (March 2025):",{"data":17771,"marks":17772,"value":17773,"nodeType":865},{},[]," Attackers stole 44GB of data including source code for multiple products, details about various projects, invoices, confidential documents, and issues from the ticketing system from global telecommunications provider Ascom.",{"data":17775,"content":17776,"nodeType":2654},{},[17777],{"data":17778,"content":17779,"nodeType":866},{},[17780,17785],{"data":17781,"marks":17782,"value":17784,"nodeType":865},{},[17783],{"type":887},"Jaguar Land Rover (March 2025):",{"data":17786,"marks":17787,"value":17788,"nodeType":865},{},[]," Attackers leaked ~700 internal documents totalling several GBs of data, including proprietary documents, source code, and employee and partner data, from vehicle manufacturer Jaguar Land Rover. The breach was linked to credentials stolen by infostealers in 2021. A second threat actor is now alleged to have re-compromized Jaguar using the same credentials and achieved a much bigger breach of ~350GB. ",{"data":17790,"content":17791,"nodeType":2654},{},[17792],{"data":17793,"content":17794,"nodeType":866},{},[17795,17800],{"data":17796,"marks":17797,"value":17799,"nodeType":865},{},[17798],{"type":887},"Orange (February 2025):",{"data":17801,"marks":17802,"value":17803,"nodeType":865},{},[]," Attackers stole almost 12,000 files totaling close to 6.5GB, which includes 380k unique email addresses, source code, invoices, contracts, customer and employee information, from telecommunications provider Orange. The attacker allegedly had access to the systems for over a month before exfiltrating company data.",{"data":17805,"content":17806,"nodeType":2654},{},[17807],{"data":17808,"content":17809,"nodeType":866},{},[17810,17815],{"data":17811,"marks":17812,"value":17814,"nodeType":865},{},[17813],{"type":887},"Telefonica (January 2025): ",{"data":17816,"marks":17817,"value":17818,"nodeType":865},{},[],"Attackers stole 2.3GB of documents, tickets, and various data from telecommunications provider Telefonica. ",{"data":17820,"content":17821,"nodeType":2654},{},[17822],{"data":17823,"content":17824,"nodeType":866},{},[17825,17830],{"data":17826,"marks":17827,"value":17829,"nodeType":865},{},[17828],{"type":887},"Schneider Electric (November 2024): ",{"data":17831,"marks":17832,"value":17833,"nodeType":865},{},[],"Attackers stole 40GB of data including 75k unique email addresses, from manufacturing provider Schneider Electric, demanding a ransom payment of $125k. ",{"data":17835,"content":17839,"nodeType":875},{"target":17836},{"sys":17837},{"id":17838,"type":872,"linkType":873},"1Hm5x8QlQnJsUPgFyCkeFO",[],{"data":17841,"content":17842,"nodeType":866},{},[17843],{"data":17844,"marks":17845,"value":17846,"nodeType":865},{},[],"So, hundreds of gigabytes of data and thousands of breached records — all from logging in with a single set of stolen credentials for each victim. There are clear signs that these attacks are ramping up in frequency and impact too, with three of the breaches occurring in March alone. ",{"data":17848,"content":17849,"nodeType":866},{},[17850],{"data":17851,"marks":17852,"value":17853,"nodeType":865},{},[],"These attacks all follow the same pattern, revolving around initial access to Jira accounts using compromised credentials. Once inside, the attacker has been reported to use integrated Atlassian tools like MiniOrange to scrape customer and employee data. After dumping the data, they attempt to extort a ransom payment for the deletion of the data, and when that fails, sell it on criminal marketplaces such as dark web forums and Telegram channels. HELLCAT is also responsible for a Ransomware-as-a-Service (RaaS) offering using a custom ransomware strain. ",{"data":17855,"content":17856,"nodeType":879},{},[],{"data":17858,"content":17859,"nodeType":889},{},[17860],{"data":17861,"marks":17862,"value":17864,"nodeType":865},{},[17863],{"type":887},"Why are attackers targeting Jira?",{"data":17866,"content":17867,"nodeType":2315},{},[17868],{"data":17869,"marks":17870,"value":17872,"nodeType":865},{},[17871],{"type":887},"It’s a goldmine for attackers",{"data":17874,"content":17875,"nodeType":866},{},[17876],{"data":17877,"marks":17878,"value":17879,"nodeType":865},{},[],"Apps like Jira are a goldmine for cyber attackers. For organizations using it, Jira is a central technology that underpins core business workflows. It’s used for pretty much all aspects of project management across functions, meaning it:",{"data":17881,"content":17882,"nodeType":2718},{},[17883,17893,17903,17913,17923],{"data":17884,"content":17885,"nodeType":2654},{},[17886],{"data":17887,"content":17888,"nodeType":866},{},[17889],{"data":17890,"marks":17891,"value":17892,"nodeType":865},{},[],"Stores huge amounts of sensitive data, from strategic business initiatives to sensitive customer data. ",{"data":17894,"content":17895,"nodeType":2654},{},[17896],{"data":17897,"content":17898,"nodeType":866},{},[17899],{"data":17900,"marks":17901,"value":17902,"nodeType":865},{},[],"Contains detailed information on IT infrastructure and architecture. It often acts as an issue tracker for vulnerabilities, and frequently contains credentials and secrets accidentally pasted into tickets, enabling lateral movement and further exploitation. ",{"data":17904,"content":17905,"nodeType":2654},{},[17906],{"data":17907,"content":17908,"nodeType":866},{},[17909],{"data":17910,"marks":17911,"value":17912,"nodeType":865},{},[],"Has deep integrations with other Cloud and DevOps technologies like GitHub repos (also a frequent target for attackers), Bitbucket, Jenkins, CircleCI, AWS, Azure, etc. ",{"data":17914,"content":17915,"nodeType":2654},{},[17916],{"data":17917,"content":17918,"nodeType":866},{},[17919],{"data":17920,"marks":17921,"value":17922,"nodeType":865},{},[],"Can be exploited using native functionality by, for example, creating automated workflows containing malicious scripts or deployments, or inserting malicious links into tickets to phish users in-app. ",{"data":17924,"content":17925,"nodeType":2654},{},[17926],{"data":17927,"content":17928,"nodeType":866},{},[17929],{"data":17930,"marks":17931,"value":17932,"nodeType":865},{},[],"Also provides access to the broader Atlassian suite through a compromised Jira account, e.g. Confluence, Bitbucket, Trello, Opsgenie, etc. ",{"data":17934,"content":17935,"nodeType":2315},{},[17936],{"data":17937,"marks":17938,"value":17940,"nodeType":865},{},[17939],{"type":887},"Compromised credentials are waiting to be exploited",{"data":17942,"content":17943,"nodeType":866},{},[17944,17947,17954],{"data":17945,"marks":17946,"value":21,"nodeType":865},{},[],{"data":17948,"content":17949,"nodeType":905},{"uri":10411},[17950],{"data":17951,"marks":17952,"value":17953,"nodeType":865},{},[],"Stolen credentials were the #1 attacker action in 2023/24",{"data":17955,"marks":17956,"value":17957,"nodeType":865},{},[],", and the breach vector for 80% of web app attacks. Not surprising when you consider the fact that billions of leaked credentials are in circulation online, and attackers can pick up the latest drop for as little as $10 on criminal forums. ",{"data":17959,"content":17960,"nodeType":866},{},[17961,17965,17973,17977,17983],{"data":17962,"marks":17963,"value":17964,"nodeType":865},{},[],"The criminal marketplace for stolen credentials is booming, fuelled by an unprecedented rise in infostealer activity as attackers look to replicate the success of ",{"data":17966,"content":17968,"nodeType":905},{"uri":17967},"https://pushsecurity.com/resources/2024-identity-attacks",[17969],{"data":17970,"marks":17971,"value":17972,"nodeType":865},{},[],"high profile breaches in 2024",{"data":17974,"marks":17975,"value":17976,"nodeType":865},{},[]," such as the attacks on ",{"data":17978,"content":17979,"nodeType":905},{"uri":933},[17980],{"data":17981,"marks":17982,"value":1143,"nodeType":865},{},[],{"data":17984,"marks":17985,"value":17986,"nodeType":865},{},[]," customers — where 165 customer tenants and hundreds of millions of breached records were compromised using credentials dating found in infostealer credential dumps dating as far back as 2020.",{"data":17988,"content":17989,"nodeType":866},{},[17990],{"data":17991,"marks":17992,"value":17993,"nodeType":865},{},[],"Like Snowflake, attackers have clearly noticed that compromised credentials are a reliable way to access Jira accounts. And the more these attacks succeed, the stronger the signal for other attackers to look for insecure identities. ",{"data":17995,"content":17996,"nodeType":2315},{},[17997],{"data":17998,"marks":17999,"value":18001,"nodeType":865},{},[18000],{"type":887},"But wait: This isn’t just a Jira problem",{"data":18003,"content":18004,"nodeType":866},{},[18005],{"data":18006,"marks":18007,"value":18008,"nodeType":865},{},[],"If an organization isn’t relying on Jira, they’re probably using a product with similar functionality such as ServiceNow, Asana, Zendesk, Notion, Oracle, etc. These alternatives are an equally viable target for attackers. ",{"data":18010,"content":18014,"nodeType":875},{"target":18011},{"sys":18012},{"id":18013,"type":872,"linkType":873},"4hgYhQiAykupZ6n7Js2zJA",[],{"data":18016,"content":18017,"nodeType":866},{},[18018,18022,18030],{"data":18019,"marks":18020,"value":18021,"nodeType":865},{},[],"Jira and many apps like it, fall into a category where it’s a core business app, but isn’t as well-secured (or can’t be configured as securely) as full enterprise cloud platforms — increasing the likelihood that accounts are using weak, breached, or reused credentials, and have gaps in MFA coverage. Again, there are clear similarities with the attacks on Snowflake customers last year. And more recently, breaches like ",{"data":18023,"content":18025,"nodeType":905},{"uri":18024},"https://www.bleepingcomputer.com/news/security/oracle-denies-data-breach-after-hacker-claims-theft-of-6-million-data-records/",[18026],{"data":18027,"marks":18028,"value":18029,"nodeType":865},{},[],"the theft of 6 million Oracle records",{"data":18031,"marks":18032,"value":18033,"nodeType":865},{},[]," (including  passwords) provide plenty of fuel for attackers looking to take advantage of unsecured accounts. ",{"data":18035,"content":18036,"nodeType":866},{},[18037,18041,18046],{"data":18038,"marks":18039,"value":18040,"nodeType":865},{},[],"Using Push data, we compared the posture of accounts that ",{"data":18042,"marks":18043,"value":18045,"nodeType":865},{},[18044],{"type":887},"use a password to log in",{"data":18047,"marks":18048,"value":18049,"nodeType":865},{},[]," when organizations first begin using our platform.",{"data":18051,"content":18055,"nodeType":875},{"target":18052},{"sys":18053},{"id":18054,"type":872,"linkType":873},"4xOUAqait2RG4IH00vh2RM",[],{"data":18057,"content":18058,"nodeType":866},{},[18059],{"data":18060,"marks":18061,"value":18062,"nodeType":865},{},[],"Clearly, this isn’t just a Jira problem — and it won’t be long before attackers take advantage. ",{"data":18064,"content":18065,"nodeType":866},{},[18066,18069,18077,18081,18086],{"data":18067,"marks":18068,"value":21,"nodeType":865},{},[],{"data":18070,"content":18071,"nodeType":905},{"uri":6333},[18072],{"data":18073,"marks":18074,"value":18076,"nodeType":865},{},[18075],{"type":1070},"These stats are in the ballpark of our average findings from across all apps",{"data":18078,"marks":18079,"value":18080,"nodeType":865},{},[]," — with 2 in 5 identities using a password to log in AND missing MFA, rising to 4 in 5 when a password is the sole login method. Considering the fact that organizations are using hundreds of apps (220+ on average), ",{"data":18082,"marks":18083,"value":18085,"nodeType":865},{},[18084],{"type":887},"there are many, many more apps that can be targeted in a similar way to Jira",{"data":18087,"marks":18088,"value":1711,"nodeType":865},{},[],{"data":18090,"content":18091,"nodeType":889},{},[18092],{"data":18093,"marks":18094,"value":18095,"nodeType":865},{},[],"Preventing account takeover with stolen credentials",{"data":18097,"content":18098,"nodeType":866},{},[18099],{"data":18100,"marks":18101,"value":18102,"nodeType":865},{},[],"To ensure that your workforce identities can’t be compromised using stolen credentials, you need to:",{"data":18104,"content":18105,"nodeType":2718},{},[18106,18116,18126],{"data":18107,"content":18108,"nodeType":2654},{},[18109],{"data":18110,"content":18111,"nodeType":866},{},[18112],{"data":18113,"marks":18114,"value":18115,"nodeType":865},{},[],"Ensure MFA is configured for all user accounts. ",{"data":18117,"content":18118,"nodeType":2654},{},[18119],{"data":18120,"content":18121,"nodeType":866},{},[18122],{"data":18123,"marks":18124,"value":18125,"nodeType":865},{},[],"Ensure employees are not using weak, breached, or stolen passwords. ",{"data":18127,"content":18128,"nodeType":2654},{},[18129],{"data":18130,"content":18131,"nodeType":866},{},[18132],{"data":18133,"marks":18134,"value":18135,"nodeType":865},{},[],"Where possible, ensure users are using SSO to log in via your preferred identity provider (IdP).",{"data":18137,"content":18138,"nodeType":866},{},[18139],{"data":18140,"marks":18141,"value":18142,"nodeType":865},{},[],"This is a tricky problem to solve in Jira itself. Jira doesn’t provide the capabilities to enforce these controls — to get access to some of the required functionality, like being able to require MFA for all users within your tenant, enforce SSO logins, or see if a user has MFA enabled, you need Atlassian Access — a separate tier of identity management product for Atlassian. Even then, you can’t do things like centrally administer password resets. ",{"data":18144,"content":18145,"nodeType":866},{},[18146],{"data":18147,"marks":18148,"value":18149,"nodeType":865},{},[],"And as we’ve pointed out — this isn’t just a Jira problem. Very few apps provide this level of identity visibility and control (even at the premium tier) — so what about when the next app hits the headlines? ",{"data":18151,"content":18152,"nodeType":866},{},[18153,18157,18165],{"data":18154,"marks":18155,"value":18156,"nodeType":865},{},[],"You could ingest a compromised credential TI feed to get some visibility of what’s out there, but then you’re relying on asking every user with a breached password to change it (not really reliable or enforceable!). When we ",{"data":18158,"content":18159,"nodeType":905},{"uri":964},[18160],{"data":18161,"marks":18162,"value":18164,"nodeType":865},{},[18163],{"type":1070},"recently reviewed a range of TI feeds against our identity data set",{"data":18166,"marks":18167,"value":18168,"nodeType":865},{},[],", we found that less than 1% of the data was valid — like looking for a needle in a haystack. ",{"data":18170,"content":18171,"nodeType":879},{},[],{"data":18173,"content":18174,"nodeType":889},{},[18175],{"data":18176,"marks":18177,"value":18179,"nodeType":865},{},[18178],{"type":887},"Prevent account takeover with Push",{"data":18181,"content":18182,"nodeType":866},{},[18183],{"data":18184,"marks":18185,"value":18186,"nodeType":865},{},[],"Thankfully, there’s a better way. Push provides layered controls to harden your workforce identities against credential attacks, as well as other methods of account takeover like MFA-bypass phishing and session hijacking. Our lightweight, browser-based solution can be deployed in minutes across your entire user base. ",{"data":18188,"content":18189,"nodeType":866},{},[18190],{"data":18191,"marks":18192,"value":18193,"nodeType":865},{},[],"So when a core business app like Jira comes under fire, you can quickly take action to prevent account takeover.  ",{"data":18195,"content":18196,"nodeType":866},{},[18197],{"data":18198,"marks":18199,"value":18200,"nodeType":865},{},[],"Here’s how Push users can protect themselves against the threat of stolen credentials:",{"data":18202,"content":18203,"nodeType":2315},{},[18204],{"data":18205,"marks":18206,"value":18208,"nodeType":865},{},[18207],{"type":887},"Step 1: Deploy MFA across all accounts",{"data":18210,"content":18211,"nodeType":866},{},[18212,18216,18225],{"data":18213,"marks":18214,"value":18215,"nodeType":865},{},[],"Whenever an application comes under heavy scrutiny from attackers, it’s a good idea to deploy MFA across all accounts as a first response action. ",{"data":18217,"content":18219,"nodeType":905},{"uri":18218},"https://pushsecurity.com/blog/enforce-mfa-on-third-party-apps/",[18220],{"data":18221,"marks":18222,"value":18224,"nodeType":865},{},[18223],{"type":1070},"Push enables you to quickly find and close MFA gaps",{"data":18226,"marks":18227,"value":18228,"nodeType":865},{},[]," by prompting the user to configure MFA when they log in to the app. ",{"data":18230,"content":18233,"nodeType":875},{"target":18231},{"sys":18232},{"id":15014,"type":872,"linkType":873},[],{"data":18235,"content":18236,"nodeType":2315},{},[18237],{"data":18238,"marks":18239,"value":18241,"nodeType":865},{},[18240],{"type":887},"Step 2: Detect when accounts are using stolen credentials and trigger a password change",{"data":18243,"content":18244,"nodeType":866},{},[18245,18249,18257],{"data":18246,"marks":18247,"value":18248,"nodeType":865},{},[],"Push integrates with commercial TI feeds to see ",{"data":18250,"content":18251,"nodeType":905},{"uri":964},[18252],{"data":18253,"marks":18254,"value":18256,"nodeType":865},{},[18255],{"type":1070},"when your employees are actually using a breached password to log in to one of their accounts",{"data":18258,"marks":18259,"value":18260,"nodeType":865},{},[],", eliminating manual triage. You can also bring your own TI feed to maximize its value. ",{"data":18262,"content":18263,"nodeType":866},{},[18264,18268,18276],{"data":18265,"marks":18266,"value":18267,"nodeType":865},{},[],"When a stolen credential (or any other password vulnerability) is found, the next time they log into the app they will be prompted to change it via the ",{"data":18269,"content":18271,"nodeType":905},{"uri":18270},"https://pushsecurity.com/blog/introducing-strong-password-enforcement/",[18272],{"data":18273,"marks":18274,"value":18275,"nodeType":865},{},[],"strong password enforcement feature",{"data":18277,"marks":18278,"value":1711,"nodeType":865},{},[],{"data":18280,"content":18284,"nodeType":875},{"target":18281},{"sys":18282},{"id":18283,"type":872,"linkType":873},"shpVOAMlk7OE1mWrE9h8S",[],{"data":18286,"content":18287,"nodeType":2315},{},[18288],{"data":18289,"marks":18290,"value":18292,"nodeType":865},{},[18291],{"type":887},"Step 3: Ensure employees are using SSO (and remediate ghost logins)",{"data":18294,"content":18295,"nodeType":866},{},[18296],{"data":18297,"marks":18298,"value":18299,"nodeType":865},{},[],"Once you’ve secured your accounts against the risk of immediate account takeover, you can harden them further by ensuring that accounts are using your preferred SSO method and IdP. ",{"data":18301,"content":18302,"nodeType":866},{},[18303,18307,18314],{"data":18304,"marks":18305,"value":18306,"nodeType":865},{},[],"[Insight box: It’s not enough to have users adopt SSO, however. Local username and password accounts can continue to exist and be used alongside SSO unless specifically configured (and configurable) within the app. These local accounts are a form of ",{"data":18308,"content":18309,"nodeType":905},{"uri":945},[18310],{"data":18311,"marks":18312,"value":7064,"nodeType":865},{},[18313],{"type":1070},{"data":18315,"marks":18316,"value":18317,"nodeType":865},{},[],", providing backdoor access to your business apps without needing to breach your locked-down IdP accounts used for SSO. This is why it’s important to have MFA set at the application level if local accounts are used — you can’t just rely on your IdP being securely configured.] ",{"data":18319,"content":18320,"nodeType":866},{},[18321],{"data":18322,"marks":18323,"value":18324,"nodeType":865},{},[],"Once you’ve migrated to SSO, it’s best practice to have your employees remove these local accounts so they don’t lie dormant for attackers to take advantage of in the future. You can set an app banner for all users accessing the app, instructing them to log in using SSO, and to disable their local password once they’ve done so.",{"data":18326,"content":18330,"nodeType":875},{"target":18327},{"sys":18328},{"id":18329,"type":872,"linkType":873},"606mt5mVoJGaMmk82mLIFH",[],{"data":18332,"content":18333,"nodeType":879},{},[],{"data":18335,"content":18336,"nodeType":889},{},[18337],{"data":18338,"marks":18339,"value":18341,"nodeType":865},{},[18340],{"type":887},"Protect and defend your entire identity attack surface",{"data":18343,"content":18344,"nodeType":866},{},[18345],{"data":18346,"marks":18347,"value":18348,"nodeType":865},{},[],"Push provides comprehensive identity attack detection and response capabilities across every app and workforce identity.    ",{"data":18350,"content":18351,"nodeType":866},{},[18352],{"data":18353,"marks":18354,"value":18355,"nodeType":865},{},[],"We stop attacks like MFA-bypass phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more. ",{"data":18357,"content":18358,"nodeType":866},{},[18359,18362,18369],{"data":18360,"marks":18361,"value":13434,"nodeType":865},{},[],{"data":18363,"content":18365,"nodeType":905},{"uri":18364},"https://pushsecurity.com/demo?utm_campaign=9983377-FY25Q1_Bleeping-Computer-Organic-Article&utm_source=bleepingcomputer&utm_medium=sponsored-content&utm_content=organic%20article",[18366],{"data":18367,"marks":18368,"value":14508,"nodeType":865},{},[],{"data":18370,"marks":18371,"value":18372,"nodeType":865},{},[]," for a live demo. ","6 breaches in 5 months: Why attackers are targeting Jira with stolen credentials","Attackers are persistently targeting Jira accounts with stolen credentials. What can we learn from this trend?","2025-03-25T00:00:00.000Z","why-attackers-are-targeting-jira-with-stolen-credentials",{"items":18378},[18379,18381],{"sys":18380,"name":2144},{"id":2143},{"sys":18382,"name":342},{"id":3008},{"items":18384},[18385],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":18386},{"url":3016},"how-cyber-breaches-are-driving-tighter-mfa-requirements-and-enforcement","blog/how-cyber-breaches-are-driving-tighter-mfa-requirements-and-enforcement",{"json":18390},{"data":18391,"content":18392,"nodeType":1522},{},[18393],{"data":18394,"content":18395,"nodeType":866},{},[18396],{"data":18397,"marks":18398,"value":18399,"nodeType":865},{},[],"MFA regulators, insurers, and policy-makers are getting tighter on their MFA requirements, fuelled by public cyber breaches. Here's what security teams need to know about the current regulatory and insurance landscape — and how the evolution of attacks is likely to influence the future of requirements.","MFA regulators, insurers, and policy-makers are getting tighter on their MFA requirements, fuelled by public cyber breaches. ",{"id":18402,"publishedAt":18403},"3YXrPQptEX3P0Hrd550its","2026-08-12T11:53:46.155Z",{"items":18405},[18406,18408],{"sys":18407,"name":2144},{"id":2143},{"sys":18409,"name":297},{"id":2147},{"items":18411},[18412,18414,18416,18418,18420,18422,18424,18426,18428,18430,18432],{"sys":18413,"name":413,"slug":414,"tier":31},{"id":410},{"sys":18415,"name":297,"slug":298,"tier":31},{"id":294},{"sys":18417,"name":545,"slug":546,"tier":31},{"id":542},{"sys":18419,"name":457,"slug":458,"tier":45},{"id":454},{"sys":18421,"name":528,"slug":529,"tier":45},{"id":525},{"sys":18423,"name":395,"slug":396,"tier":45},{"id":392},{"sys":18425,"name":589,"slug":590,"tier":45},{"id":586},{"sys":18427,"name":502,"slug":503,"tier":45},{"id":499},{"sys":18429,"name":333,"slug":334,"tier":45},{"id":330},{"sys":18431,"name":422,"slug":423,"tier":45},{"id":419},{"sys":18433,"name":537,"slug":538,"tier":45},{"id":534},"B6n0w2pD37D7Jhr1su0--8jAwHDJk6pJxvVZEzlg4XA",{"id":18436,"title":18437,"authorsCollection":18438,"content":18443,"extension":228,"faqItemsCollection":19305,"faqTitle":59,"featured":6,"hashTags":59,"meta":19307,"metaTitle":19308,"ogImage":19309,"postType":19311,"publishedDate":19312,"relatedBlogPostsCollection":19313,"slug":20892,"stem":20893,"subtitle":59,"summary":20894,"synopsis":20905,"sys":20906,"tagsCollection":20909,"topicsCollection":20915,"__hash__":20953},"blog/blog/key-takeaways-from-the-scattered-spider-attacks-on-insurance-firms.json","3 key takeaways from the Scattered Spider attacks on aviation & insurance firms",{"items":18439},[18440],{"fullName":3012,"firstName":3013,"jobTitle":3014,"socialLinks":18441,"profilePicture":18442},[6742],{"url":3016},{"json":18444,"links":19208},{"data":18445,"content":18446,"nodeType":1522},{},[18447,18453,18529,18536,18543,18546,18552,18559,18607,18614,18617,18624,18656,18760,18776,18782,18785,18792,18799,18805,18812,18819,18906,18913,18955,18963,18966,18973,18980,18987,18994,19001,19007,19010,19017,19037,19044,19067,19074,19077,19084,19091,19098,19104,19123,19128,19135,19142,19148,19151,19158,19178,19196,19202],{"data":18448,"content":18452,"nodeType":875},{"target":18449},{"sys":18450},{"id":18451,"type":872,"linkType":873},"6BjaSruVecmhn1NoHreRni",[],{"data":18454,"content":18455,"nodeType":866},{},[18456,18460,18469,18472,18481,18484,18493,18497,18505,18508,18516,18519,18526],{"data":18457,"marks":18458,"value":18459,"nodeType":865},{},[],"Scattered Spider continues to dominate the headlines, with the latest news linking the hackers to attacks on U.S. insurance giant ",{"data":18461,"content":18463,"nodeType":905},{"uri":18462},"https://www.bleepingcomputer.com/news/security/aflac-discloses-breach-amidst-scattered-spider-insurance-attacks/",[18464],{"data":18465,"marks":18466,"value":18468,"nodeType":865},{},[18467],{"type":1070},"Aflac",{"data":18470,"marks":18471,"value":7148,"nodeType":865},{},[],{"data":18473,"content":18475,"nodeType":905},{"uri":18474},"https://www.bleepingcomputer.com/news/security/google-warns-scattered-spider-hackers-now-target-us-insurance-companies/",[18476],{"data":18477,"marks":18478,"value":18480,"nodeType":865},{},[18479],{"type":1070},"Philadelphia Insurance Companies",{"data":18482,"marks":18483,"value":7148,"nodeType":865},{},[],{"data":18485,"content":18487,"nodeType":905},{"uri":18486},"https://www.bleepingcomputer.com/news/security/erie-insurance-confirms-cyberattack-behind-business-disruptions/amp/",[18488],{"data":18489,"marks":18490,"value":18492,"nodeType":865},{},[18491],{"type":1070},"Erie Insurance",{"data":18494,"marks":18495,"value":18496,"nodeType":865},{},[],", and most recently ",{"data":18498,"content":18500,"nodeType":905},{"uri":18499},"https://www.bleepingcomputer.com/news/security/qantas-is-being-extorted-in-recent-data-theft-cyberattack/",[18501],{"data":18502,"marks":18503,"value":18504,"nodeType":865},{},[],"Qantas",{"data":18506,"marks":18507,"value":7148,"nodeType":865},{},[],{"data":18509,"content":18511,"nodeType":905},{"uri":18510},"https://www.bleepingcomputer.com/news/security/scattered-spider-hackers-shift-focus-to-aviation-transportation-firms/",[18512],{"data":18513,"marks":18514,"value":18515,"nodeType":865},{},[],"Hawaiian Airlines",{"data":18517,"marks":18518,"value":7651,"nodeType":865},{},[],{"data":18520,"content":18521,"nodeType":905},{"uri":18510},[18522],{"data":18523,"marks":18524,"value":18525,"nodeType":865},{},[],"WestJet",{"data":18527,"marks":18528,"value":6352,"nodeType":865},{},[],{"data":18530,"content":18531,"nodeType":866},{},[18532],{"data":18533,"marks":18534,"value":18535,"nodeType":865},{},[],"This comes at the same time that Google Threat Intelligence Group shared that it “is now aware of multiple intrusions in the U.S. which bear the hallmarks of Scattered Spider activity”, specifically impacting the insurance industry. ",{"data":18537,"content":18538,"nodeType":866},{},[18539],{"data":18540,"marks":18541,"value":18542,"nodeType":865},{},[],"But what exactly does this mean? To answer this, let’s quickly recap how we got here and what a Scattered Spider attack looks like.  ",{"data":18544,"content":18545,"nodeType":879},{},[],{"data":18547,"content":18548,"nodeType":889},{},[18549],{"data":18550,"marks":18551,"value":9685,"nodeType":865},{},[],{"data":18553,"content":18554,"nodeType":866},{},[18555],{"data":18556,"marks":18557,"value":18558,"nodeType":865},{},[],"The criminal collective tracked by analysts as Scattered Spider has been active since 2022 and have been linked to a range of high-profile breaches, for example the attacks on Caesars and MGM Resorts in 2023, and Transport for London in 2024. ",{"data":18560,"content":18561,"nodeType":2718},{},[18562,18577,18592],{"data":18563,"content":18564,"nodeType":2654},{},[18565],{"data":18566,"content":18567,"nodeType":866},{},[18568,18573],{"data":18569,"marks":18570,"value":18572,"nodeType":865},{},[18571],{"type":887},"Caesars: ",{"data":18574,"marks":18575,"value":18576,"nodeType":865},{},[],"hackers impersonated an IT user and convinced an outsourced help desk to reset credentials, after which the attacker stole the customer loyalty program database and secured a $15m ransom payment. ",{"data":18578,"content":18579,"nodeType":2654},{},[18580],{"data":18581,"content":18582,"nodeType":866},{},[18583,18588],{"data":18584,"marks":18585,"value":18587,"nodeType":865},{},[18586],{"type":887},"MGM Resorts: ",{"data":18589,"marks":18590,"value":18591,"nodeType":865},{},[],"hackers used LinkedIn information to impersonate an employee and reset the employee’s credentials, resulting in a 6TB data theft. After MGM refused to pay, the attack eventually resulted in a 36-hour outage, a $100m hit, and a class-action lawsuit settled for $45m. ",{"data":18593,"content":18594,"nodeType":2654},{},[18595],{"data":18596,"content":18597,"nodeType":866},{},[18598,18603],{"data":18599,"marks":18600,"value":18602,"nodeType":865},{},[18601],{"type":887},"Transport for London:",{"data":18604,"marks":18605,"value":18606,"nodeType":865},{},[]," resulted in 5,000 users’ bank details exposed, 30,000 staff required to attend in-person appointments to verify their identities and reset passwords, and significant disruption to online services lasting for months.",{"data":18608,"content":18609,"nodeType":866},{},[18610],{"data":18611,"marks":18612,"value":18613,"nodeType":865},{},[],"The calling card in these attacks was the abuse of help desk processes to reset passwords and/or MFA factors used to access an account. The attacker simply calls up the help desk with enough information to impersonate an employee, asks them to send an MFA enrollment link for their new mobile device, and can then utilize self-service password reset functionality to take control of the account. Scarily simple. ",{"data":18615,"content":18616,"nodeType":879},{},[],{"data":18618,"content":18619,"nodeType":889},{},[18620],{"data":18621,"marks":18622,"value":18623,"nodeType":865},{},[],"Scattered Spider’s resurgence in 2025",{"data":18625,"content":18626,"nodeType":866},{},[18627,18631,18640,18643,18652],{"data":18628,"marks":18629,"value":18630,"nodeType":865},{},[],"This technique was reprised in a series of high-profile attacks in 2025, with major breaches of UK retailers ",{"data":18632,"content":18634,"nodeType":905},{"uri":18633},"https://www.bleepingcomputer.com/news/security/mands-says-customer-data-stolen-in-cyberattack-forces-password-resets/",[18635],{"data":18636,"marks":18637,"value":18639,"nodeType":865},{},[18638],{"type":1070},"Marks and Spencer",{"data":18641,"marks":18642,"value":7651,"nodeType":865},{},[],{"data":18644,"content":18646,"nodeType":905},{"uri":18645},"https://www.bleepingcomputer.com/news/security/co-op-confirms-data-theft-after-dragonforce-ransomware-claims-attack/",[18647],{"data":18648,"marks":18649,"value":18651,"nodeType":865},{},[18650],{"type":1070},"Co-op",{"data":18653,"marks":18654,"value":18655,"nodeType":865},{},[]," dominating the headlines. Both resulted in the loss of sensitive data and prolonged disruption to in-store and digital services, with M&S feeling the pain of £300m in lost profits and a share value hit approaching £1b, and a multimillion-pound class action lawsuit and possible ICO fines looming.",{"data":18657,"content":18658,"nodeType":866},{},[18659,18663,18672,18675,18684,18687,18696,18699,18708,18711,18720,18723,18732,18735,18744,18748,18756],{"data":18660,"marks":18661,"value":18662,"nodeType":865},{},[],"A series of attacks against retailers worldwide soon followed, at an unprecedented rate. ",{"data":18664,"content":18666,"nodeType":905},{"uri":18665},"https://www.bleepingcomputer.com/news/security/fashion-giant-dior-discloses-cyberattack-warns-of-data-breach/",[18667],{"data":18668,"marks":18669,"value":18671,"nodeType":865},{},[18670],{"type":1070},"Dior",{"data":18673,"marks":18674,"value":7148,"nodeType":865},{},[],{"data":18676,"content":18678,"nodeType":905},{"uri":18677},"https://www.bleepingcomputer.com/news/security/the-north-face-warns-customers-of-april-credential-stuffing-attack/",[18679],{"data":18680,"marks":18681,"value":18683,"nodeType":865},{},[18682],{"type":1070},"The North Face",{"data":18685,"marks":18686,"value":7148,"nodeType":865},{},[],{"data":18688,"content":18690,"nodeType":905},{"uri":18689},"https://www.bleepingcomputer.com/news/security/cartier-discloses-data-breach-amid-fashion-brand-cyberattacks/",[18691],{"data":18692,"marks":18693,"value":18695,"nodeType":865},{},[18694],{"type":1070},"Cartier",{"data":18697,"marks":18698,"value":7148,"nodeType":865},{},[],{"data":18700,"content":18702,"nodeType":905},{"uri":18701},"https://www.bleepingcomputer.com/news/security/victorias-secret-delays-earnings-release-after-security-incident/",[18703],{"data":18704,"marks":18705,"value":18707,"nodeType":865},{},[18706],{"type":1070},"Victoria’s Secret",{"data":18709,"marks":18710,"value":7148,"nodeType":865},{},[],{"data":18712,"content":18714,"nodeType":905},{"uri":18713},"https://www.bleepingcomputer.com/news/security/adidas-warns-of-data-breach-after-customer-service-provider-hack/",[18715],{"data":18716,"marks":18717,"value":18719,"nodeType":865},{},[18718],{"type":1070},"Adidas",{"data":18721,"marks":18722,"value":7148,"nodeType":865},{},[],{"data":18724,"content":18726,"nodeType":905},{"uri":18725},"https://www.scworld.com/brief/separate-ransomware-attacks-purportedly-hit-coca-cola-bottling-partner",[18727],{"data":18728,"marks":18729,"value":18731,"nodeType":865},{},[18730],{"type":1070},"Coca-Cola",{"data":18733,"marks":18734,"value":1454,"nodeType":865},{},[],{"data":18736,"content":18738,"nodeType":905},{"uri":18737},"https://www.bleepingcomputer.com/news/security/grocery-wholesale-giant-united-natural-foods-hit-by-cyberattack/",[18739],{"data":18740,"marks":18741,"value":18743,"nodeType":865},{},[18742],{"type":1070},"United Natural Foods",{"data":18745,"marks":18746,"value":18747,"nodeType":865},{},[]," were among the retailers to suffer a breach between May-June 2025. Unlike the ",{"data":18749,"content":18750,"nodeType":905},{"uri":933},[18751],{"data":18752,"marks":18753,"value":18755,"nodeType":865},{},[18754],{"type":1070},"mass Snowflake breaches in 2024",{"data":18757,"marks":18758,"value":18759,"nodeType":865},{},[]," (which targeted a single platform used by many organizations), these attacks are notable in that they are seemingly unrelated — they simply represent a concerted effort by attackers to target the retail sector. ",{"data":18761,"content":18762,"nodeType":866},{},[18763,18767,18772],{"data":18764,"marks":18765,"value":18766,"nodeType":865},{},[],"Less details have been provided about these attacks compared to the M&S and Co-op breaches, but a number of them specifically point to the use of ",{"data":18768,"marks":18769,"value":18771,"nodeType":865},{},[18770],{"type":887},"identity-based techniques",{"data":18773,"marks":18774,"value":18775,"nodeType":865},{},[]," as opposed to more traditional software exploits — another hallmark of Scattered Spider. This leads us to our first key takeaway…",{"data":18777,"content":18781,"nodeType":875},{"target":18778},{"sys":18779},{"id":18780,"type":872,"linkType":873},"2F2dpOkyXWnrKgFC3dSl67",[],{"data":18783,"content":18784,"nodeType":879},{},[],{"data":18786,"content":18787,"nodeType":889},{},[18788],{"data":18789,"marks":18790,"value":18791,"nodeType":865},{},[],"Takeaway #1: Identity-based TTPs are the new normal",{"data":18793,"content":18794,"nodeType":866},{},[18795],{"data":18796,"marks":18797,"value":18798,"nodeType":865},{},[],"Scattered Spider’s attacks are the latest in a growing number of identity-based breaches. When we look back at Scattered Spider’s TTP evolution, we can see that they have consistently exploited identity-based weaknesses in order to gain access to victim environments. ",{"data":18800,"content":18804,"nodeType":875},{"target":18801},{"sys":18802},{"id":18803,"type":872,"linkType":873},"2vs8WgO4gfGLxscjGMBSY6",[],{"data":18806,"content":18807,"nodeType":866},{},[18808],{"data":18809,"marks":18810,"value":18811,"nodeType":865},{},[],"Taking a step back, it’s worth thinking about how help desk scams fit into the wider toolkit of tactics, techniques and procedures (TTPs) used by threat actors like Scattered Spider. ",{"data":18813,"content":18814,"nodeType":866},{},[18815],{"data":18816,"marks":18817,"value":18818,"nodeType":865},{},[],"Scattered Spider has heavily relied on identity-based TTPs since they first emerged in 2022, following a repeatable path of bypassing MFA, achieving account takeover on privileged accounts, stealing data from cloud services, and deploying ransomware (principally in VMware environments). TTPs used by Scattered Spider include:",{"data":18820,"content":18821,"nodeType":2718},{},[18822,18832,18842,18863,18873,18883],{"data":18823,"content":18824,"nodeType":2654},{},[18825],{"data":18826,"content":18827,"nodeType":866},{},[18828],{"data":18829,"marks":18830,"value":18831,"nodeType":865},{},[],"Credential phishing via email and SMS (smishing) to harvest passwords en masse",{"data":18833,"content":18834,"nodeType":2654},{},[18835],{"data":18836,"content":18837,"nodeType":866},{},[18838],{"data":18839,"marks":18840,"value":18841,"nodeType":865},{},[],"Using SIM swapping (where you get the carrier to transfer a number to your attacker-controlled SIM card) to bypass SMS-based MFA",{"data":18843,"content":18844,"nodeType":2654},{},[18845],{"data":18846,"content":18847,"nodeType":866},{},[18848,18852,18859],{"data":18849,"marks":18850,"value":18851,"nodeType":865},{},[],"Using ",{"data":18853,"content":18854,"nodeType":905},{"uri":9903},[18855],{"data":18856,"marks":18857,"value":9908,"nodeType":865},{},[18858],{"type":1070},{"data":18860,"marks":18861,"value":18862,"nodeType":865},{},[]," (aka. push bombing) to bypass app-based push authentication",{"data":18864,"content":18865,"nodeType":2654},{},[18866],{"data":18867,"content":18868,"nodeType":866},{},[18869],{"data":18870,"marks":18871,"value":18872,"nodeType":865},{},[],"Using vishing (i.e. directly calling a victim to social engineer their MFA code, as opposed to a help desk attack)",{"data":18874,"content":18875,"nodeType":2654},{},[18876],{"data":18877,"content":18878,"nodeType":866},{},[18879],{"data":18880,"marks":18881,"value":18882,"nodeType":865},{},[],"Social engineering domain registrars to take control of the target organization’s DNS, hijacking their MX records and inbound mail, and using this to take over the company’s business app environments ",{"data":18884,"content":18885,"nodeType":2654},{},[18886],{"data":18887,"content":18888,"nodeType":866},{},[18889,18893,18902],{"data":18890,"marks":18891,"value":18892,"nodeType":865},{},[],"And latterly, using ",{"data":18894,"content":18896,"nodeType":905},{"uri":18895},"https://pushsecurity.com/blog/phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm/",[18897],{"data":18898,"marks":18899,"value":18901,"nodeType":865},{},[18900],{"type":1070},"MFA-bypass AiTM phishing kits like Evilginx",{"data":18903,"marks":18904,"value":18905,"nodeType":865},{},[]," to steal live user sessions",{"data":18907,"content":18908,"nodeType":866},{},[18909],{"data":18910,"marks":18911,"value":18912,"nodeType":865},{},[],"So, help desk scams are an important part of their toolkit, but it’s not the whole picture. Methods like AiTM phishing in particular have spiked in popularity this year as a reliable and scalable way of bypassing MFA and achieving account takeover.",{"data":18914,"content":18915,"nodeType":866},{},[18916,18920,18929,18932,18939,18943,18952],{"data":18917,"marks":18918,"value":18919,"nodeType":865},{},[],"It’s important not to think about these techniques as just a Scattered Spider trait either. After all, Scattered Spider is not a self-identified group — it’s a name given by analysts to patterns of activity. Given the series of arrests in 2024, it’s unlikely that the current incarnation of Scattered Spider is the same individuals behind the attacks in 2022-2024. And these identity-based attack patterns are shared across various self-named criminal groups like, ",{"data":18921,"content":18923,"nodeType":905},{"uri":18922},"https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf",[18924],{"data":18925,"marks":18926,"value":18928,"nodeType":865},{},[18927],{"type":1070},"Lapsus$, Yanluowang, Karakurt",{"data":18930,"marks":18931,"value":1454,"nodeType":865},{},[],{"data":18933,"content":18934,"nodeType":905},{"uri":933},[18935],{"data":18936,"marks":18937,"value":1071,"nodeType":865},{},[18938],{"type":1070},{"data":18940,"marks":18941,"value":18942,"nodeType":865},{},[],". Even Russian state-sponsored actors are ",{"data":18944,"content":18946,"nodeType":905},{"uri":18945},"https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/",[18947],{"data":18948,"marks":18949,"value":18951,"nodeType":865},{},[18950],{"type":1070},"increasingly using the kinds of techniques popularised by criminal groups",{"data":18953,"marks":18954,"value":1193,"nodeType":865},{},[],{"data":18956,"content":18957,"nodeType":866},{},[18958],{"data":18959,"marks":18960,"value":18962,"nodeType":865},{},[18961],{"type":887},"Simply, identity-based techniques are the new normal for attackers in 2025. ",{"data":18964,"content":18965,"nodeType":879},{},[],{"data":18967,"content":18968,"nodeType":889},{},[18969],{"data":18970,"marks":18971,"value":18972,"nodeType":865},{},[],"Takeaway #2: Help desk scams aren't new, but they're here to stay",{"data":18974,"content":18975,"nodeType":866},{},[18976],{"data":18977,"marks":18978,"value":18979,"nodeType":865},{},[],"As we established earlier, help desk scams are nothing new (we saw them in the Caesars, MGM Resorts, and Transport for London breaches to name a few). But they’re likely to become increasingly prevalent as Scattered Spider continues to demonstrate just how effective help desk scams are. ",{"data":18981,"content":18982,"nodeType":866},{},[18983],{"data":18984,"marks":18985,"value":18986,"nodeType":865},{},[],"One of the reasons they’re so effective is that most help desks have the same process for every account — it doesn’t matter who you’re impersonating or which account you’re trying to reset. So, attackers are specifically targeting accounts likely to have top tier admin privileges — meaning once they get in, progressing the attack is trivial and much of the typical privilege escalation and lateral movement is removed from the attack path. ",{"data":18988,"content":18989,"nodeType":866},{},[18990],{"data":18991,"marks":18992,"value":18993,"nodeType":865},{},[],"Help desks are a target for a reason. They’re “helpful” by nature. This is usually reflected in how they’re operated and performance measured — delays won’t help you to hit those SLAs! Ultimately, a process only works if employees are willing to adhere to it — and can’t be socially engineered to break it. Help desks that are removed from day-to-day operations (especially when outsourced or offshored) are also inherently susceptible to attacks where employees are impersonated. ",{"data":18995,"content":18996,"nodeType":866},{},[18997],{"data":18998,"marks":18999,"value":19000,"nodeType":865},{},[],"But, the attacks that organizations are experiencing at the moment should give security stakeholders plenty of ammunition as to why help desk reforms are vital to securing the business (and what can happen if you don’t make changes). ",{"data":19002,"content":19006,"nodeType":875},{"target":19003},{"sys":19004},{"id":19005,"type":872,"linkType":873},"5Z3J9QuPKesWShV4OGMrYt",[],{"data":19008,"content":19009,"nodeType":879},{},[],{"data":19011,"content":19012,"nodeType":889},{},[19013],{"data":19014,"marks":19015,"value":19016,"nodeType":865},{},[],"Takeaway #3: Scattered Spider are consciously evading established security controls",{"data":19018,"content":19019,"nodeType":866},{},[19020,19024,19029,19032],{"data":19021,"marks":19022,"value":19023,"nodeType":865},{},[],"So, there’s more to Scattered Spider’s toolkit than just help desk scams. In fact, their approach can be broadly classified as",{"data":19025,"marks":19026,"value":19028,"nodeType":865},{},[19027],{"type":887}," consciously evading established controls",{"data":19030,"marks":19031,"value":12410,"nodeType":865},{},[],{"data":19033,"marks":19034,"value":19036,"nodeType":865},{},[19035],{"type":887},"at the endpoint and network layer by targeting identities. ",{"data":19038,"content":19039,"nodeType":866},{},[19040],{"data":19041,"marks":19042,"value":19043,"nodeType":865},{},[],"From the point of account takeover, they also follow repeatable patterns:",{"data":19045,"content":19046,"nodeType":2718},{},[19047,19057],{"data":19048,"content":19049,"nodeType":2654},{},[19050],{"data":19051,"content":19052,"nodeType":866},{},[19053],{"data":19054,"marks":19055,"value":19056,"nodeType":865},{},[],"Harvesting and exfiltrating data from cloud and SaaS services, where monitoring is typically less consistent than traditional on-premise environments, and exfiltration often blends in with normal activity. Many organizations simply don’t have the logs or visibility to detect malicious activity in the cloud anyway, and Scattered Spider have also been seen tampering with cloud logs (e.g. filtering risky AWS CloudTrail logs, but not disabling it entirely so as not to raise suspicion).",{"data":19058,"content":19059,"nodeType":2654},{},[19060],{"data":19061,"content":19062,"nodeType":866},{},[19063],{"data":19064,"marks":19065,"value":19066,"nodeType":865},{},[],"Targeting VMware environments for ransomware deployment. They do this by adding their compromised user account to the VMware admins group in VCentre (if needed — they are going after accounts with top tier privileges by default). From here, they can access the VMware environment via the ESXi hypervisor layer, where security software is nonexistent — thereby bypassing EDR and other typical endpoint and host based controls you rely on to prevent ransomware execution. ",{"data":19068,"content":19069,"nodeType":866},{},[19070],{"data":19071,"marks":19072,"value":19073,"nodeType":865},{},[],"The key theme? Getting around your established security controls. ",{"data":19075,"content":19076,"nodeType":879},{},[],{"data":19078,"content":19079,"nodeType":889},{},[19080],{"data":19081,"marks":19082,"value":19083,"nodeType":865},{},[],"Stop identity attacks with Push Security",{"data":19085,"content":19086,"nodeType":866},{},[19087],{"data":19088,"marks":19089,"value":19090,"nodeType":865},{},[],"Modern attacks no longer take place on the endpoint or network — they target identities created and used via the web browser. This means that attacks increasingly take place in the browser (or rather, on resources your employees access through the browser). ",{"data":19092,"content":19093,"nodeType":866},{},[19094],{"data":19095,"marks":19096,"value":19097,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use, like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more. ",{"data":19099,"content":19103,"nodeType":875},{"target":19100},{"sys":19101},{"id":19102,"type":872,"linkType":873},"4atESpAAPAC0zP8CO4m8oa",[],{"data":19105,"content":19106,"nodeType":866},{},[19107,19111,19119],{"data":19108,"marks":19109,"value":19110,"nodeType":865},{},[],"To help combat help desk scams, Push recently released ",{"data":19112,"content":19113,"nodeType":905},{"uri":7281},[19114],{"data":19115,"marks":19116,"value":19118,"nodeType":865},{},[19117],{"type":887},"Employee Identity Verification Codes",{"data":19120,"marks":19121,"value":19122,"nodeType":865},{},[]," — a simple, browser-based identity check that gives your help desk a reliable way to confirm they’re talking to someone from your organization.",{"data":19124,"content":19127,"nodeType":875},{"target":19125},{"sys":19126},{"id":7309,"type":872,"linkType":873},[],{"data":19129,"content":19130,"nodeType":866},{},[19131],{"data":19132,"marks":19133,"value":19134,"nodeType":865},{},[],"It enables legitimate help desk callers to quickly verify that they’re in possession of their primary device (i.e. laptop) by relaying a rotating 6-digit verification code in their browser via the Push extension. This is a great way to securely confirm caller identity and sniff out fraudulent callers, and can be used as part of a phishing-resistant help desk process. ",{"data":19136,"content":19137,"nodeType":866},{},[19138],{"data":19139,"marks":19140,"value":19141,"nodeType":865},{},[],"Eric Rubin — a Senior Manager in GitLab’s Corporate Security team — has already rolled out Employee Identity Verification Codes across his workforce. Here’s what he had to say:",{"data":19143,"content":19147,"nodeType":875},{"target":19144},{"sys":19145},{"id":19146,"type":872,"linkType":873},"jHH13doHHHaqUUxHoBeKW",[],{"data":19149,"content":19150,"nodeType":879},{},[],{"data":19152,"content":19153,"nodeType":889},{},[19154],{"data":19155,"marks":19156,"value":19157,"nodeType":865},{},[],"Get started today!",{"data":19159,"content":19160,"nodeType":866},{},[19161,19165,19174],{"data":19162,"marks":19163,"value":19164,"nodeType":865},{},[],"You can use Employee Verification Codes as a free tool by installing the Push browser extension. Simply ",{"data":19166,"content":19168,"nodeType":905},{"uri":19167},"https://pushsecurity.com/free-tool/employee-verification-codes?utm_campaign=15408561-FY25Q2-Employee-verification-codes&utm_source=Sponsored-content&utm_content=bleepingcomputer",[19169],{"data":19170,"marks":19171,"value":19173,"nodeType":865},{},[19172],{"type":1070},"sign up for a trial account and you can deploy the extension organization-wide to make use of this feature.",{"data":19175,"marks":19176,"value":19177,"nodeType":865},{},[]," While you’re at it, you can trial Push’s full features for up to 10 users for free. ",{"data":19179,"content":19180,"nodeType":866},{},[19181,19185,19193],{"data":19182,"marks":19183,"value":19184,"nodeType":865},{},[],"Or if you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":19186,"content":19188,"nodeType":905},{"uri":19187},"https://pushsecurity.com/demo/?utm_campaign=12883224-FY25Q2_Scattered-Spider&utm_source=bleepingcomputer&utm_content=sponsored-article",[19189],{"data":19190,"marks":19191,"value":7352,"nodeType":865},{},[19192],{"type":1070},{"data":19194,"marks":19195,"value":1193,"nodeType":865},{},[],{"data":19197,"content":19201,"nodeType":875},{"target":19198},{"sys":19199},{"id":19200,"type":872,"linkType":873},"6Td0hDBYdeT8tlnnfwipmD",[],{"data":19203,"content":19204,"nodeType":866},{},[19205],{"data":19206,"marks":19207,"value":21,"nodeType":865},{},[],{"entries":19209},{"hyperlink":19210,"inline":19211,"block":19212},[],[],[19213,19250,19255,19261,19285,19290,19293,19300],{"sys":19214,"__typename":4645,"content":19215,"name":19249,"title":59},{"id":18451},{"json":19216},{"nodeType":1522,"data":19217,"content":19218},{},[19219],{"nodeType":866,"data":19220,"content":19221},{},[19222,19226,19234,19238,19245],{"nodeType":865,"value":19223,"marks":19224,"data":19225},"It's been a busy year for cyber criminals! This article has now been superseded with the rise to infamy of ",[],{},{"nodeType":905,"data":19227,"content":19229},{"uri":19228},"https://pushsecurity.com/blog/scattered-lapsus-hunters",[19230],{"nodeType":865,"value":19231,"marks":19232,"data":19233},"\"Scattered Lapsus$ Hunters\"",[],{},{"nodeType":865,"value":19235,"marks":19236,"data":19237},". The guidance and TTPs in this blog post still apply, but ",[],{},{"nodeType":905,"data":19239,"content":19240},{"uri":19228},[19241],{"nodeType":865,"value":19242,"marks":19243,"data":19244},"check out our new post",[],{},{"nodeType":865,"value":19246,"marks":19247,"data":19248}," for the full picture of Scattered Spider-linked breaches dating back to 2021. ",[],{},"SS insight box 1",{"sys":19251,"__typename":1530,"type":1531,"ctaText":19252,"buttonLabel":19253,"buttonColour":1534,"buttonUrl":19254},{"id":18780},"Learn about Scattered Spider's latest TTPs in our on-demand webinar","Watch on-demand","https://pushsecurity.com/webinar/scatteredspider",{"sys":19256,"__typename":4637,"title":19257,"caption":19257,"layoutMode":59,"file":19258},{"id":18803},"Scattered Spider initial access vectors in public breaches where the attack vector was disclosed.",{"url":19259,"width":4641,"height":19260},"https://images.ctfassets.net/y1cdw1ablpvd/7hJowGlrqAWDpGIag1xWX5/0ce85d41e117129c3db25ea4a09a5604/image3.png",1136,{"sys":19262,"__typename":4645,"content":19263,"name":19284,"title":59},{"id":19005},{"json":19264},{"nodeType":1522,"data":19265,"content":19266},{},[19267],{"nodeType":866,"data":19268,"content":19269},{},[19270,19273,19280],{"nodeType":865,"value":21,"marks":19271,"data":19272},[],{},{"nodeType":905,"data":19274,"content":19275},{"uri":7294},[19276],{"nodeType":865,"value":19277,"marks":19278,"data":19279},"Check out our recent blog post",[],{},{"nodeType":865,"value":19281,"marks":19282,"data":19283}," to learn more about help desk scams and how to protect your organization. ",[],{},"Scattered Spider Insurance Blog Insight Box 1",{"sys":19286,"__typename":4637,"title":19287,"caption":19287,"layoutMode":59,"file":19288},{"id":19102},"Push Security contributes to a layered defense against known Scattered Spider TTPs.",{"url":19289,"width":4641,"height":19260},"https://images.ctfassets.net/y1cdw1ablpvd/1l3phtTjFoQDleiOKYfrXn/ead73aef01e72f08885656d79521a27a/image3.png",{"sys":19291,"__typename":4637,"title":7484,"caption":7485,"layoutMode":59,"file":19292},{"id":7309},{"url":7487,"width":7488,"height":7489},{"sys":19294,"__typename":4637,"title":19295,"caption":59,"layoutMode":59,"file":19296},{"id":19146},"GitLab Quote",{"url":19297,"width":19298,"height":19299},"https://images.ctfassets.net/y1cdw1ablpvd/72pQc6jrPIdG2IMgv45Rf8/4ca5d7c9586d16fdfc0596813156c9b8/GitLab_Quote.png",2000,861,{"sys":19301,"__typename":1530,"type":1531,"ctaText":19302,"buttonLabel":19303,"buttonColour":1534,"buttonUrl":19304},{"id":19200},"Deploy Employee Verification Codes for free today and protect your help desk from Scattered Spider","Try it free","https://pushsecurity.com/free-tool/employee-verification-codes",{"items":19306},[],{},"Scattered Spider target aviation & insurance firms",{"url":19310},"https://images.ctfassets.net/y1cdw1ablpvd/mMbgUER8qJH3p4YF8CsAE/cfc45da4f29fb417a627be97335ab23e/Help_desk_verification_codes.png","breach-analysis","2025-06-30T00:00:00.000Z",{"items":19314},[19315,19900,20257],{"__typename":1544,"sys":19316,"content":19318,"title":19886,"synopsis":19887,"hashTags":59,"publishedDate":19888,"slug":19889,"tagsCollection":19890,"authorsCollection":19896},{"id":19317},"3ExexM6DB2QBOQrtbMrXnN",{"json":19319},{"data":19320,"content":19321,"nodeType":1522},{},[19322,19327,19355,19432,19497,19504,19507,19514,19521,19528,19544,19551,19558,19561,19568,19575,19582,19615,19622,19645,19652,19655,19662,19668,19687,19765,19772,19777,19780,19786,19792,19798,19803,19821,19826,19832,19835,19841,19859,19875,19880],{"data":19323,"content":19326,"nodeType":875},{"target":19324},{"sys":19325},{"id":18451,"type":872,"linkType":873},[],{"data":19328,"content":19329,"nodeType":866},{},[19330,19334,19341,19344,19351],{"data":19331,"marks":19332,"value":19333,"nodeType":865},{},[],"Scattered Spider have been busy. Major breaches of UK retailers ",{"data":19335,"content":19336,"nodeType":905},{"uri":18633},[19337],{"data":19338,"marks":19339,"value":18639,"nodeType":865},{},[19340],{"type":1070},{"data":19342,"marks":19343,"value":7651,"nodeType":865},{},[],{"data":19345,"content":19346,"nodeType":905},{"uri":18645},[19347],{"data":19348,"marks":19349,"value":18651,"nodeType":865},{},[19350],{"type":1070},{"data":19352,"marks":19353,"value":19354,"nodeType":865},{},[]," resulted in the loss of sensitive data and prolonged disruption to in-store and digital services, with M&S feeling the pain of £300m in lost profits and a share value hit approaching £1b, and a multimillion-pound class action lawsuit and possible ICO fines looming.",{"data":19356,"content":19357,"nodeType":866},{},[19358,19361,19368,19371,19378,19381,19388,19391,19398,19401,19408,19411,19418,19421,19428],{"data":19359,"marks":19360,"value":18662,"nodeType":865},{},[],{"data":19362,"content":19363,"nodeType":905},{"uri":18665},[19364],{"data":19365,"marks":19366,"value":18671,"nodeType":865},{},[19367],{"type":1070},{"data":19369,"marks":19370,"value":7148,"nodeType":865},{},[],{"data":19372,"content":19373,"nodeType":905},{"uri":18677},[19374],{"data":19375,"marks":19376,"value":18683,"nodeType":865},{},[19377],{"type":1070},{"data":19379,"marks":19380,"value":7148,"nodeType":865},{},[],{"data":19382,"content":19383,"nodeType":905},{"uri":18689},[19384],{"data":19385,"marks":19386,"value":18695,"nodeType":865},{},[19387],{"type":1070},{"data":19389,"marks":19390,"value":7148,"nodeType":865},{},[],{"data":19392,"content":19393,"nodeType":905},{"uri":18701},[19394],{"data":19395,"marks":19396,"value":18707,"nodeType":865},{},[19397],{"type":1070},{"data":19399,"marks":19400,"value":7148,"nodeType":865},{},[],{"data":19402,"content":19403,"nodeType":905},{"uri":18713},[19404],{"data":19405,"marks":19406,"value":18719,"nodeType":865},{},[19407],{"type":1070},{"data":19409,"marks":19410,"value":7148,"nodeType":865},{},[],{"data":19412,"content":19413,"nodeType":905},{"uri":18725},[19414],{"data":19415,"marks":19416,"value":18731,"nodeType":865},{},[19417],{"type":1070},{"data":19419,"marks":19420,"value":1454,"nodeType":865},{},[],{"data":19422,"content":19423,"nodeType":905},{"uri":18737},[19424],{"data":19425,"marks":19426,"value":18743,"nodeType":865},{},[19427],{"type":1070},{"data":19429,"marks":19430,"value":19431,"nodeType":865},{},[]," were among the retailers to suffer a breach between May-June 2025. ",{"data":19433,"content":19434,"nodeType":866},{},[19435,19439,19446,19449,19456,19460,19467,19470,19476,19479,19485,19488,19494],{"data":19436,"marks":19437,"value":19438,"nodeType":865},{},[],"The latest news links the hackers to attacks on ",{"data":19440,"content":19441,"nodeType":905},{"uri":18462},[19442],{"data":19443,"marks":19444,"value":18468,"nodeType":865},{},[19445],{"type":1070},{"data":19447,"marks":19448,"value":7148,"nodeType":865},{},[],{"data":19450,"content":19451,"nodeType":905},{"uri":18474},[19452],{"data":19453,"marks":19454,"value":18480,"nodeType":865},{},[19455],{"type":1070},{"data":19457,"marks":19458,"value":19459,"nodeType":865},{},[],",  ",{"data":19461,"content":19462,"nodeType":905},{"uri":18486},[19463],{"data":19464,"marks":19465,"value":18492,"nodeType":865},{},[19466],{"type":1070},{"data":19468,"marks":19469,"value":18496,"nodeType":865},{},[],{"data":19471,"content":19472,"nodeType":905},{"uri":18499},[19473],{"data":19474,"marks":19475,"value":18504,"nodeType":865},{},[],{"data":19477,"marks":19478,"value":7148,"nodeType":865},{},[],{"data":19480,"content":19481,"nodeType":905},{"uri":18510},[19482],{"data":19483,"marks":19484,"value":18515,"nodeType":865},{},[],{"data":19486,"marks":19487,"value":7651,"nodeType":865},{},[],{"data":19489,"content":19490,"nodeType":905},{"uri":18510},[19491],{"data":19492,"marks":19493,"value":18525,"nodeType":865},{},[],{"data":19495,"marks":19496,"value":6352,"nodeType":865},{},[],{"data":19498,"content":19499,"nodeType":866},{},[19500],{"data":19501,"marks":19502,"value":19503,"nodeType":865},{},[],"The top story from recent campaigns is the use of help desk scams. This typically involves the attacker calling up a company’s help desk with some level of information — at minimum, PII that allows them to impersonate their victim, and sometimes a password, leaning heavily on their native English-speaking abilities to trick the help desk operator into giving them access to a user account. ",{"data":19505,"content":19506,"nodeType":879},{},[],{"data":19508,"content":19509,"nodeType":889},{},[19510],{"data":19511,"marks":19512,"value":19513,"nodeType":865},{},[],"Help desk scams 101",{"data":19515,"content":19516,"nodeType":866},{},[19517],{"data":19518,"marks":19519,"value":19520,"nodeType":865},{},[],"The goal of a help desk scam is to get the help desk operator to reset the credentials and/or MFA used to access an account so the attacker can take control of it. They’ll use a variety of backstories and tactics to get that done, but most of the time it’s as simple as saying “I’ve got a new phone, can you remove my existing MFA and allow me to enroll a new one?”",{"data":19522,"content":19523,"nodeType":866},{},[19524],{"data":19525,"marks":19526,"value":19527,"nodeType":865},{},[],"From there, the attacker is then sent an MFA reset link via email or SMS. Usually, this would be sent to, for example, a number on file — but at this point, the attacker has already established trust and bypassed the help desk process to a degree. So asking “can you send it to this email address” or “I’ve actually got a new number too, can you send it to…” gets this sent directly to the attacker. ",{"data":19529,"content":19530,"nodeType":866},{},[19531,19535,19540],{"data":19532,"marks":19533,"value":19534,"nodeType":865},{},[],"At this point, it’s simply a case of using the self service password reset functionality for Okta or Entra (which you can get around because you now have the MFA factor to verify yourself) and ",{"data":19536,"marks":19537,"value":19539,"nodeType":865},{},[19538],{"type":2757},"voila",{"data":19541,"marks":19542,"value":19543,"nodeType":865},{},[],", the attacker has taken control of the account. ",{"data":19545,"content":19546,"nodeType":866},{},[19547],{"data":19548,"marks":19549,"value":19550,"nodeType":865},{},[],"And the best part? Most help desks have the same process for every account — it doesn’t matter who you’re impersonating or which account you’re trying to reset. So, attackers are specifically targeting accounts likely to have top tier admin privileges — meaning once they get in, progressing the attack is trivial and much of the typical privilege escalation and lateral movement is removed from the attack path. ",{"data":19552,"content":19553,"nodeType":866},{},[19554],{"data":19555,"marks":19556,"value":19557,"nodeType":865},{},[],"So, help desk scams have proved to be a reliable way of bypassing MFA and achieving account takeover — the foothold from which to launch the rest of an attack, such as stealing data, deploying ransomware, etc. ",{"data":19559,"content":19560,"nodeType":879},{},[],{"data":19562,"content":19563,"nodeType":889},{},[19564],{"data":19565,"marks":19566,"value":19567,"nodeType":865},{},[],"Avoiding help desk gotchas",{"data":19569,"content":19570,"nodeType":866},{},[19571],{"data":19572,"marks":19573,"value":19574,"nodeType":865},{},[],"There’s lots of advice for securing help desks being circulated, but much of the advice still results in a process that is either phishable or difficult to implement. ",{"data":19576,"content":19577,"nodeType":866},{},[19578],{"data":19579,"marks":19580,"value":19581,"nodeType":865},{},[],"Ultimately, organizations need to be prepared to introduce friction to their help desk process and either delay or deny requests in situations where there’s significant risk. So, for example, having a process for MFA reset that recognizes the risk associated with resetting a high-privileged account:",{"data":19583,"content":19584,"nodeType":2718},{},[19585,19595,19605],{"data":19586,"content":19587,"nodeType":2654},{},[19588],{"data":19589,"content":19590,"nodeType":866},{},[19591],{"data":19592,"marks":19593,"value":19594,"nodeType":865},{},[],"Require multi-party approval / escalation for admin-level account resets",{"data":19596,"content":19597,"nodeType":2654},{},[19598],{"data":19599,"content":19600,"nodeType":866},{},[19601],{"data":19602,"marks":19603,"value":19604,"nodeType":865},{},[],"Require in-person verification if the process can’t be followed remotely",{"data":19606,"content":19607,"nodeType":2654},{},[19608],{"data":19609,"content":19610,"nodeType":866},{},[19611],{"data":19612,"marks":19613,"value":19614,"nodeType":865},{},[],"Freeze self-service resets when suspicious behavior is encountered (this would require some kind of internal process and awareness training to raise the alarm if an attack is suspected)",{"data":19616,"content":19617,"nodeType":866},{},[19618],{"data":19619,"marks":19620,"value":19621,"nodeType":865},{},[],"And watch out for these gotchas: ",{"data":19623,"content":19624,"nodeType":2718},{},[19625,19635],{"data":19626,"content":19627,"nodeType":2654},{},[19628],{"data":19629,"content":19630,"nodeType":866},{},[19631],{"data":19632,"marks":19633,"value":19634,"nodeType":865},{},[],"If you receive a call, good practice is to terminate the call and dial the number on file for the employee. But, in a world of SIM swapping, this isn’t a foolproof solution — you could just be re-dialing the attacker. ",{"data":19636,"content":19637,"nodeType":2654},{},[19638],{"data":19639,"content":19640,"nodeType":866},{},[19641],{"data":19642,"marks":19643,"value":19644,"nodeType":865},{},[],"If your solution is to get the employee on camera, increasingly sophisticated deepfakes can thwart this approach.  ",{"data":19646,"content":19647,"nodeType":866},{},[19648],{"data":19649,"marks":19650,"value":19651,"nodeType":865},{},[],"But, help desks are a target for a reason. They’re “helpful” by nature. This is usually reflected in how they’re operated and performance measured — delays won’t help you to hit those SLAs! Ultimately, a process only works if employees are willing to adhere to it — and can’t be socially engineered to break it. Help desks that are removed from day-to-day operations (especially when outsourced or offshored) are also inherently susceptible to attacks where employees are impersonated. ",{"data":19653,"content":19654,"nodeType":879},{},[],{"data":19656,"content":19657,"nodeType":889},{},[19658],{"data":19659,"marks":19660,"value":19661,"nodeType":865},{},[],"Comparing help desk scams with other approaches",{"data":19663,"content":19664,"nodeType":866},{},[19665],{"data":19666,"marks":19667,"value":18811,"nodeType":865},{},[],{"data":19669,"content":19670,"nodeType":866},{},[19671,19674,19683],{"data":19672,"marks":19673,"value":21,"nodeType":865},{},[],{"data":19675,"content":19677,"nodeType":905},{"uri":19676},"https://pushsecurity.com/blog/scattered-spider-ttp-evolution-in-2025/",[19678],{"data":19679,"marks":19680,"value":19682,"nodeType":865},{},[19681],{"type":1070},"Scattered Spider has heavily relied on identity-based TTPs since they first emerged in 2022",{"data":19684,"marks":19685,"value":19686,"nodeType":865},{},[],", following a repeatable path of bypassing MFA, achieving account takeover on privileged accounts, stealing data from cloud services, and deploying ransomware (principally to VMware environments). ",{"data":19688,"content":19689,"nodeType":2718},{},[19690,19699,19708,19727,19736,19745],{"data":19691,"content":19692,"nodeType":2654},{},[19693],{"data":19694,"content":19695,"nodeType":866},{},[19696],{"data":19697,"marks":19698,"value":18831,"nodeType":865},{},[],{"data":19700,"content":19701,"nodeType":2654},{},[19702],{"data":19703,"content":19704,"nodeType":866},{},[19705],{"data":19706,"marks":19707,"value":18841,"nodeType":865},{},[],{"data":19709,"content":19710,"nodeType":2654},{},[19711],{"data":19712,"content":19713,"nodeType":866},{},[19714,19717,19724],{"data":19715,"marks":19716,"value":18851,"nodeType":865},{},[],{"data":19718,"content":19719,"nodeType":905},{"uri":9903},[19720],{"data":19721,"marks":19722,"value":9908,"nodeType":865},{},[19723],{"type":1070},{"data":19725,"marks":19726,"value":18862,"nodeType":865},{},[],{"data":19728,"content":19729,"nodeType":2654},{},[19730],{"data":19731,"content":19732,"nodeType":866},{},[19733],{"data":19734,"marks":19735,"value":18872,"nodeType":865},{},[],{"data":19737,"content":19738,"nodeType":2654},{},[19739],{"data":19740,"content":19741,"nodeType":866},{},[19742],{"data":19743,"marks":19744,"value":18882,"nodeType":865},{},[],{"data":19746,"content":19747,"nodeType":2654},{},[19748],{"data":19749,"content":19750,"nodeType":866},{},[19751,19754,19761],{"data":19752,"marks":19753,"value":18892,"nodeType":865},{},[],{"data":19755,"content":19756,"nodeType":905},{"uri":18895},[19757],{"data":19758,"marks":19759,"value":18901,"nodeType":865},{},[19760],{"type":1070},{"data":19762,"marks":19763,"value":19764,"nodeType":865},{},[]," to steal live user sessions, bypassing all common forms of MFA (with the exception of WebAuthn/FIDO2) ",{"data":19766,"content":19767,"nodeType":866},{},[19768],{"data":19769,"marks":19770,"value":19771,"nodeType":865},{},[],"So, help desk scams are an important part of their toolkit, but it’s not the whole picture. Methods like AiTM in particular have spiked in popularity this year as a reliable and scalable way of bypassing MFA and achieving account takeover, with attackers using these toolkits as the de facto standard, getting creative in their detection evasion methods and in some cases, evading standard delivery vectors like email altogether to ensure the success of their phishing campaigns. ",{"data":19773,"content":19776,"nodeType":875},{"target":19774},{"sys":19775},{"id":18780,"type":872,"linkType":873},[],{"data":19778,"content":19779,"nodeType":879},{},[],{"data":19781,"content":19782,"nodeType":889},{},[19783],{"data":19784,"marks":19785,"value":19083,"nodeType":865},{},[],{"data":19787,"content":19788,"nodeType":866},{},[19789],{"data":19790,"marks":19791,"value":19090,"nodeType":865},{},[],{"data":19793,"content":19794,"nodeType":866},{},[19795],{"data":19796,"marks":19797,"value":19097,"nodeType":865},{},[],{"data":19799,"content":19802,"nodeType":875},{"target":19800},{"sys":19801},{"id":19102,"type":872,"linkType":873},[],{"data":19804,"content":19805,"nodeType":866},{},[19806,19810,19818],{"data":19807,"marks":19808,"value":19809,"nodeType":865},{},[],"To help combat help desk scams, we recently released ",{"data":19811,"content":19812,"nodeType":905},{"uri":7281},[19813],{"data":19814,"marks":19815,"value":19118,"nodeType":865},{},[19816,19817],{"type":1070},{"type":887},{"data":19819,"marks":19820,"value":19122,"nodeType":865},{},[],{"data":19822,"content":19825,"nodeType":875},{"target":19823},{"sys":19824},{"id":7309,"type":872,"linkType":873},[],{"data":19827,"content":19828,"nodeType":866},{},[19829],{"data":19830,"marks":19831,"value":19134,"nodeType":865},{},[],{"data":19833,"content":19834,"nodeType":879},{},[],{"data":19836,"content":19837,"nodeType":889},{},[19838],{"data":19839,"marks":19840,"value":19157,"nodeType":865},{},[],{"data":19842,"content":19843,"nodeType":866},{},[19844,19847,19855],{"data":19845,"marks":19846,"value":19164,"nodeType":865},{},[],{"data":19848,"content":19849,"nodeType":905},{"uri":19304},[19850],{"data":19851,"marks":19852,"value":19854,"nodeType":865},{},[19853],{"type":1070},"sign up for a trial account and you can deploy the extension organization-wide to make use of this feature",{"data":19856,"marks":19857,"value":19858,"nodeType":865},{},[],". While you’re at it, you can trial Push’s full features for up to 10 users for free. ",{"data":19860,"content":19861,"nodeType":866},{},[19862,19865,19872],{"data":19863,"marks":19864,"value":19184,"nodeType":865},{},[],{"data":19866,"content":19867,"nodeType":905},{"uri":3686},[19868],{"data":19869,"marks":19870,"value":7352,"nodeType":865},{},[19871],{"type":1070},{"data":19873,"marks":19874,"value":1193,"nodeType":865},{},[],{"data":19876,"content":19879,"nodeType":875},{"target":19877},{"sys":19878},{"id":19200,"type":872,"linkType":873},[],{"data":19881,"content":19882,"nodeType":866},{},[19883],{"data":19884,"marks":19885,"value":21,"nodeType":865},{},[],"Scattered Spider: Understanding help desk scams and how to defend your organization","Scattered Spider has dominated the headlines in recent months with a consistent focus on help desk scams. Here's what you need to know to protect your business.","2025-06-27T00:00:00.000Z","scattered-spider-defending-against-help-desk-scams",{"items":19891},[19892,19894],{"sys":19893,"name":2144},{"id":2143},{"sys":19895,"name":342},{"id":3008},{"items":19897},[19898],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":19899},{"url":3016},{"__typename":1544,"sys":19901,"content":19902,"title":20245,"synopsis":20246,"hashTags":59,"publishedDate":20247,"slug":20248,"tagsCollection":20249,"authorsCollection":20253},{"id":9569},{"json":19903},{"data":19904,"content":19905,"nodeType":1522},{},[19906,19913,19920,19927,19933,19940,19973,19980,19987,19994,20000,20007,20014,20032,20037,20044,20064,20082,20089,20096,20103,20110,20117,20124,20131,20151,20158,20165,20171,20177,20184,20209,20215,20233,20239],{"data":19907,"content":19908,"nodeType":866},{},[19909],{"data":19910,"marks":19911,"value":19912,"nodeType":865},{},[],"Scattered Spider has shown the world the devastating effects attackers can achieve by socially engineering IT help desks into performing MFA resets so they can take over accounts on sensitive corporate apps. ",{"data":19914,"content":19915,"nodeType":866},{},[19916],{"data":19917,"marks":19918,"value":19919,"nodeType":865},{},[],"That’s why we’re introducing Employee Identity Verification Codes — a simple, browser-based identity check that gives your help desk a reliable way to confirm they’re talking to someone from your organization.",{"data":19921,"content":19922,"nodeType":866},{},[19923],{"data":19924,"marks":19925,"value":19926,"nodeType":865},{},[],"Push now provides your employees with a rotating 6-digit verification code in their browser via the Push Security extension. When an employee contacts your IT help desk to request an MFA reset or access recovery, the help desk can ask for this code to verify their identity — ensuring it’s really them, and not an attacker.",{"data":19928,"content":19932,"nodeType":875},{"target":19929},{"sys":19930},{"id":19931,"type":872,"linkType":873},"3PkiGgzwSt9Nb5rsGRiQVZ",[],{"data":19934,"content":19935,"nodeType":866},{},[19936],{"data":19937,"marks":19938,"value":19939,"nodeType":865},{},[],"The employee identity verification codes are:",{"data":19941,"content":19942,"nodeType":2718},{},[19943,19953,19963],{"data":19944,"content":19945,"nodeType":2654},{},[19946],{"data":19947,"content":19948,"nodeType":866},{},[19949],{"data":19950,"marks":19951,"value":19952,"nodeType":865},{},[],"Session-aware - generated in users’ browsers and only visible to them when they click on the Push Security extension icon in their browser toolbar.",{"data":19954,"content":19955,"nodeType":2654},{},[19956],{"data":19957,"content":19958,"nodeType":866},{},[19959],{"data":19960,"marks":19961,"value":19962,"nodeType":865},{},[],"Rotating: they change every 24 hours",{"data":19964,"content":19965,"nodeType":2654},{},[19966],{"data":19967,"content":19968,"nodeType":866},{},[19969],{"data":19970,"marks":19971,"value":19972,"nodeType":865},{},[],"Lightweight: no additional apps or devices required",{"data":19974,"content":19975,"nodeType":866},{},[19976],{"data":19977,"marks":19978,"value":19979,"nodeType":865},{},[],"It’s a fast, simple verification method — directly in the employee’s browser — that addresses a real-world threat.",{"data":19981,"content":19982,"nodeType":889},{},[19983],{"data":19984,"marks":19985,"value":19986,"nodeType":865},{},[],"We think it’s swell, but don’t just take our word for it …",{"data":19988,"content":19989,"nodeType":866},{},[19990],{"data":19991,"marks":19992,"value":19993,"nodeType":865},{},[],"Eric Rubin — a Senior Manager in GitLab’s Corporate Security team — has already rolled out Employee Identity Verification Codes across his workforce. Here’s what he had to say about it:",{"data":19995,"content":19999,"nodeType":875},{"target":19996},{"sys":19997},{"id":19998,"type":872,"linkType":873},"5ZLaA869NXpMjVwkswEyOB",[],{"data":20001,"content":20002,"nodeType":866},{},[20003],{"data":20004,"marks":20005,"value":20006,"nodeType":865},{},[],"Thank you, Eric!",{"data":20008,"content":20009,"nodeType":889},{},[20010],{"data":20011,"marks":20012,"value":20013,"nodeType":865},{},[],"Why are help desk identity verification methods so hot right now?",{"data":20015,"content":20016,"nodeType":866},{},[20017,20021,20028],{"data":20018,"marks":20019,"value":20020,"nodeType":865},{},[],"A number of the high-profile incidents attributed to the ",{"data":20022,"content":20023,"nodeType":905},{"uri":19676},[20024],{"data":20025,"marks":20026,"value":20027,"nodeType":865},{},[],"Scattered Spider cybercriminal group",{"data":20029,"marks":20030,"value":20031,"nodeType":865},{},[]," saw them socially engineer IT help desks into resetting MFA on employee accounts that they had already acquired valid credentials for. These compromised accounts were typically on IdP systems like Okta providing SSO access to large numbers of downstream applications.",{"data":20033,"content":20036,"nodeType":875},{"target":20034},{"sys":20035},{"id":18780,"type":872,"linkType":873},[],{"data":20038,"content":20039,"nodeType":2315},{},[20040],{"data":20041,"marks":20042,"value":20043,"nodeType":865},{},[],"Case study: The MGM Resorts breach",{"data":20045,"content":20046,"nodeType":866},{},[20047,20051,20060],{"data":20048,"marks":20049,"value":20050,"nodeType":865},{},[],"One of Scattered Spider’s most notorious and well-documented attacks was against ",{"data":20052,"content":20054,"nodeType":905},{"uri":20053},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-mgm-resorts-september-2023",[20055],{"data":20056,"marks":20057,"value":20059,"nodeType":865},{},[20058],{"type":1070},"MGM Resorts",{"data":20061,"marks":20062,"value":20063,"nodeType":865},{},[],". Scattered Spider socially engineered MGM Resorts’ help desk personnel to bypass MFA and log in to accounts for which they had acquired valid login credentials via credential phishing and historical infostealer compromises. ",{"data":20065,"content":20066,"nodeType":866},{},[20067,20071,20078],{"data":20068,"marks":20069,"value":20070,"nodeType":865},{},[],"They specifically targeted accounts with Super Administrator privileges within MGM Resorts’ Okta tenant, which they then used to register a second, attacker-controlled IdP via ",{"data":20072,"content":20073,"nodeType":905},{"uri":10111},[20074],{"data":20075,"marks":20076,"value":10117,"nodeType":865},{},[20077],{"type":1070},{"data":20079,"marks":20080,"value":20081,"nodeType":865},{},[],". This then enabled them to impersonate any user within the Okta tenant. ",{"data":20083,"content":20084,"nodeType":866},{},[20085],{"data":20086,"marks":20087,"value":20088,"nodeType":865},{},[],"The attackers were then able to abuse SSO access to downstream apps and platforms from various accounts, culminating in deployment of ransomware to around 100 ESXi servers and data exfiltration. ",{"data":20090,"content":20091,"nodeType":866},{},[20092],{"data":20093,"marks":20094,"value":20095,"nodeType":865},{},[],"The breach resulted in a 36-hour outage, a $100M hit to its Q3 results, one-time cyber consulting fees in the region of $10M, and a class-action lawsuit later settled for $45M. ",{"data":20097,"content":20098,"nodeType":2315},{},[20099],{"data":20100,"marks":20101,"value":20102,"nodeType":865},{},[],"Reassessing help desk verification processes",{"data":20104,"content":20105,"nodeType":866},{},[20106],{"data":20107,"marks":20108,"value":20109,"nodeType":865},{},[],"Scattered Spider’s high-profile attacks — including its most recent against UK retailers Marks & Spencer’s and the Co-op — has prompted many security teams to reassess the verification processes used by their IT help desks when an employee requests an MFA reset or access to sensitive applications. ",{"data":20111,"content":20112,"nodeType":866},{},[20113],{"data":20114,"marks":20115,"value":20116,"nodeType":865},{},[],"Initial guidance from across the industry included the use of call-back verification for any MFA or credential changes requested by an employee. However, Scattered Spider are also known to use SIM-swapping to trick mobile carriers into transferring a victim’s phone number to a SIM card controlled by the attacker - thereby allowing them to intercept verification calls. ",{"data":20118,"content":20119,"nodeType":889},{},[20120],{"data":20121,"marks":20122,"value":20123,"nodeType":865},{},[],"Simple verification using your employees’ browsers",{"data":20125,"content":20126,"nodeType":866},{},[20127],{"data":20128,"marks":20129,"value":20130,"nodeType":865},{},[],"Push already provides several controls that directly align to the other TTPs used by Scattered Spider. They include detecting stolen credentials, cloned login pages, AitM toolkits and compromised IdP sessions. ",{"data":20132,"content":20133,"nodeType":866},{},[20134,20138,20147],{"data":20135,"marks":20136,"value":20137,"nodeType":865},{},[],"(BTW, if this piques your interest, you can ",{"data":20139,"content":20141,"nodeType":905},{"uri":20140},"https://pushsecurity.com/resources?type=webinar#content",[20142],{"data":20143,"marks":20144,"value":20146,"nodeType":865},{},[20145],{"type":1070},"stream our latest webinar",{"data":20148,"marks":20149,"value":20150,"nodeType":865},{},[]," where we deep-dive into Scattered Spider, how their TTPs are evolving in 2025, and what Push is doing to protect organizations against them.) ",{"data":20152,"content":20153,"nodeType":866},{},[20154],{"data":20155,"marks":20156,"value":20157,"nodeType":865},{},[],"But to provide our customers with an additional layer of defense against the Scattered Spider attack chain, we wanted to see how we could make it harder for attackers to socially engineer IT help desks into gaining access to IdP systems and sensitive apps.",{"data":20159,"content":20160,"nodeType":866},{},[20161],{"data":20162,"marks":20163,"value":20164,"nodeType":865},{},[],"As so often is the case, the answer was staring us right in the face - we can use our browser extension. By placing a verification code in the details tray of every employees’ Push extension, they can use that to verify their identity with their help desk team.",{"data":20166,"content":20170,"nodeType":875},{"target":20167},{"sys":20168},{"id":20169,"type":872,"linkType":873},"4hRJVGqKGyOHJ8NSsQYWGP",[],{"data":20172,"content":20173,"nodeType":889},{},[20174],{"data":20175,"marks":20176,"value":19157,"nodeType":865},{},[],{"data":20178,"content":20179,"nodeType":866},{},[20180],{"data":20181,"marks":20182,"value":20183,"nodeType":865},{},[],"Employee verification codes is a Labs feature, which means it’s available on an early-access basis. We're particularly interested in hearing your feedback on how to develop this feature further.",{"data":20185,"content":20186,"nodeType":866},{},[20187,20191,20196,20200,20205],{"data":20188,"marks":20189,"value":20190,"nodeType":865},{},[],"You can enable Labs features by going to the ",{"data":20192,"marks":20193,"value":20195,"nodeType":865},{},[20194],{"type":887},"Settings",{"data":20197,"marks":20198,"value":20199,"nodeType":865},{},[]," page of the Push admin console and choosing the ",{"data":20201,"marks":20202,"value":20204,"nodeType":865},{},[20203],{"type":887},"Labs",{"data":20206,"marks":20207,"value":20208,"nodeType":865},{},[]," tab.",{"data":20210,"content":20214,"nodeType":875},{"target":20211},{"sys":20212},{"id":20213,"type":872,"linkType":873},"6TyqP2eOmalIF6RRoe476Y",[],{"data":20216,"content":20217,"nodeType":866},{},[20218,20222,20229],{"data":20219,"marks":20220,"value":20221,"nodeType":865},{},[],"If you’d like to find out more about this feature, and the other ways Push is stopping identity attacks in the browser, ",{"data":20223,"content":20224,"nodeType":905},{"uri":3686},[20225],{"data":20226,"marks":20227,"value":1517,"nodeType":865},{},[20228],{"type":1070},{"data":20230,"marks":20231,"value":20232,"nodeType":865},{},[]," with one of our team. ",{"data":20234,"content":20238,"nodeType":875},{"target":20235},{"sys":20236},{"id":20237,"type":872,"linkType":873},"7xBE9MrnMy3hfwIkhLhNhQ",[],{"data":20240,"content":20241,"nodeType":866},{},[20242],{"data":20243,"marks":20244,"value":21,"nodeType":865},{},[],"A simple, browser-based way to protect your help desk against social engineering","Push's new Employee Identity Verification Codes feature is a simple way for your help desk to confirm they’re talking to someone from your organization.\n","2025-06-19T00:00:00.000Z","employee-identity-verification-codes-release",{"items":20250},[20251],{"sys":20252,"name":297},{"id":2147},{"items":20254},[20255],{"fullName":14538,"firstName":14539,"jobTitle":9645,"profilePicture":20256},{"url":14541},{"__typename":1544,"sys":20258,"content":20260,"title":20875,"synopsis":20876,"hashTags":59,"publishedDate":20877,"slug":20878,"tagsCollection":20879,"authorsCollection":20885},{"id":20259},"XQHcBu5kiSBd6MMwICYI4",{"json":20261},{"data":20262,"content":20263,"nodeType":1522},{},[20264,20271,20278,20286,20315,20322,20328,20331,20339,20346,20353,20396,20403,20410,20413,20421,20428,20435,20442,20460,20467,20473,20481,20488,20495,20502,20508,20511,20519,20527,20534,20542,20549,20614,20621,20629,20636,20669,20677,20684,20692,20699,20707,20714,20767,20774,20777,20785,20792,20809,20842,20863,20869],{"data":20265,"content":20266,"nodeType":866},{},[20267],{"data":20268,"marks":20269,"value":20270,"nodeType":865},{},[],"Phishing has undergone a radical transformation. The laughably bad emails and fake PayPal logins of the past have given way to sophisticated campaigns engineered to slip through even the most hardened security stacks. ",{"data":20272,"content":20273,"nodeType":866},{},[20274],{"data":20275,"marks":20276,"value":20277,"nodeType":865},{},[],"Today’s phishing attacks are faster, more adaptable, and harder to catch with traditional tools. Email filters and threat intel still play an important role, but they’re often reacting to threats that are already in motion, and by the time a phishing link is flagged and blocklisted, someone has probably already clicked — and the attacker has moved onto their next set of links.",{"data":20279,"content":20280,"nodeType":866},{},[20281],{"data":20282,"marks":20283,"value":20285,"nodeType":865},{},[20284],{"type":887},"The problem isn’t that phishing has evolved. It’s that our defenses haven’t.",{"data":20287,"content":20288,"nodeType":866},{},[20289,20293,20302,20306,20311],{"data":20290,"marks":20291,"value":20292,"nodeType":865},{},[],"That’s where ",{"data":20294,"content":20296,"nodeType":905},{"uri":20295},"https://pushsecurity.com/uc/zero-day-phishing-protection",[20297],{"data":20298,"marks":20299,"value":20301,"nodeType":865},{},[20300],{"type":1070},"Push Security",{"data":20303,"marks":20304,"value":20305,"nodeType":865},{},[]," comes in. By embedding real-time detection directly into the browser, the very place where phishing attacks unfold, Push offers a fundamentally new way to stop phishing: ",{"data":20307,"marks":20308,"value":20310,"nodeType":865},{},[20309],{"type":2757},"as it happens",{"data":20312,"marks":20313,"value":20314,"nodeType":865},{},[],", regardless of whether or not the exact attack has ever been seen before. ",{"data":20316,"content":20317,"nodeType":866},{},[20318],{"data":20319,"marks":20320,"value":20321,"nodeType":865},{},[],"Check out the video to see how it works. ",{"data":20323,"content":20327,"nodeType":875},{"target":20324},{"sys":20325},{"id":20326,"type":872,"linkType":873},"4LaKobadjp19jjocLXcW4E",[],{"data":20329,"content":20330,"nodeType":879},{},[],{"data":20332,"content":20333,"nodeType":889},{},[20334],{"data":20335,"marks":20336,"value":20338,"nodeType":865},{},[20337],{"type":887},"The modern phishing playground",{"data":20340,"content":20341,"nodeType":866},{},[20342],{"data":20343,"marks":20344,"value":20345,"nodeType":865},{},[],"Phishing attacks today look nothing like the blunt instruments of a few years ago. These are fast, customized, and often completely ephemeral. A phishing domain might go live at 9 a.m., compromise scores of credentials, and be gone before lunch, long before it ever hits a threat intel feed.",{"data":20347,"content":20348,"nodeType":866},{},[20349],{"data":20350,"marks":20351,"value":20352,"nodeType":865},{},[],"Modern attackers use:",{"data":20354,"content":20355,"nodeType":2718},{},[20356,20366,20376,20386],{"data":20357,"content":20358,"nodeType":2654},{},[20359],{"data":20360,"content":20361,"nodeType":866},{},[20362],{"data":20363,"marks":20364,"value":20365,"nodeType":865},{},[],"Dynamic content and user-adaptive emails that can be easily changed based on the target’s identity and environment.",{"data":20367,"content":20368,"nodeType":2654},{},[20369],{"data":20370,"content":20371,"nodeType":866},{},[20372],{"data":20373,"marks":20374,"value":20375,"nodeType":865},{},[],"Obfuscated URLs hidden behind trusted services (like Google Sites), making reputation analysis less than reliable.",{"data":20377,"content":20378,"nodeType":2654},{},[20379],{"data":20380,"content":20381,"nodeType":866},{},[20382],{"data":20383,"marks":20384,"value":20385,"nodeType":865},{},[],"Real-time proxying tools to clone login flows and harvest credentials.",{"data":20387,"content":20388,"nodeType":2654},{},[20389],{"data":20390,"content":20391,"nodeType":866},{},[20392],{"data":20393,"marks":20394,"value":20395,"nodeType":865},{},[],"Rapid-fire infrastructure rotation, making the attack’s infrastructure almost impossible to track in time.",{"data":20397,"content":20398,"nodeType":866},{},[20399],{"data":20400,"marks":20401,"value":20402,"nodeType":865},{},[],"These attacks often bypass traditional defenses entirely, not because the tools are broken, but because they were designed for a different era, one where phishing pages lived for days or weeks, not minutes.",{"data":20404,"content":20405,"nodeType":866},{},[20406],{"data":20407,"marks":20408,"value":20409,"nodeType":865},{},[],"It’s not enough to know what was bad yesterday. You need to know what’s happening now.",{"data":20411,"content":20412,"nodeType":879},{},[],{"data":20414,"content":20415,"nodeType":889},{},[20416],{"data":20417,"marks":20418,"value":20420,"nodeType":865},{},[20419],{"type":887},"Why blocklists and perimeter defenses are falling behind",{"data":20422,"content":20423,"nodeType":866},{},[20424],{"data":20425,"marks":20426,"value":20427,"nodeType":865},{},[],"The security ecosystem has long depended on reputation-based systems: block the known bad, allow the rest. That worked when attackers reused infrastructure and relied on mass campaigns. Today’s adversaries have adapted.",{"data":20429,"content":20430,"nodeType":866},{},[20431],{"data":20432,"marks":20433,"value":20434,"nodeType":865},{},[],"Consider a scenario similar to the one from our video:",{"data":20436,"content":20437,"nodeType":866},{},[20438],{"data":20439,"marks":20440,"value":20441,"nodeType":865},{},[],"A staff member receives an email appearing to be from Microsoft Teams. It includes dynamic content that mirrors their actual environment, including their username, company logo, and real collaboration data. The embedded link takes them to a cloned Microsoft login page hosted on a benign-looking subdomain. The site is brand new. It’s not on any blocklist. Your email filter passes it. The employee logs in. Credentials and session tokens? Gone.",{"data":20443,"content":20444,"nodeType":866},{},[20445,20449,20456],{"data":20446,"marks":20447,"value":20448,"nodeType":865},{},[],"And that’s just step one. The attacker now pivots to connected apps like ",{"data":20450,"content":20451,"nodeType":905},{"uri":3474},[20452],{"data":20453,"marks":20454,"value":12232,"nodeType":865},{},[20455],{"type":1070},{"data":20457,"marks":20458,"value":20459,"nodeType":865},{},[],", Confluence, or AWS, moving laterally through your cloud environment using the compromised credentials.",{"data":20461,"content":20462,"nodeType":866},{},[20463],{"data":20464,"marks":20465,"value":20466,"nodeType":865},{},[],"Traditional tools often miss these threats not due to a lack of sophistication, but because they’re looking from the outside in. The browser is where the attack actually unfolds. Without visibility there, key indicators of compromise go undetected.",{"data":20468,"content":20472,"nodeType":875},{"target":20469},{"sys":20470},{"id":20471,"type":872,"linkType":873},"1UGu43QxCiYofkeGtOMp5J",[],{"data":20474,"content":20475,"nodeType":889},{},[20476],{"data":20477,"marks":20478,"value":20480,"nodeType":865},{},[20479],{"type":887},"Rethinking where phishing defense happens",{"data":20482,"content":20483,"nodeType":866},{},[20484],{"data":20485,"marks":20486,"value":20487,"nodeType":865},{},[],"Push changes where phishing protection happens, from upstream detection to point-of-interaction control. Instead of chasing malicious links through email gateways or external threat feeds, Push embeds lightweight, always-on protection directly, as users go about their work in the browser.",{"data":20489,"content":20490,"nodeType":866},{},[20491],{"data":20492,"marks":20493,"value":20494,"nodeType":865},{},[],"Push monitors what’s happening in each session: how pages are built, how they behave, and how users interact with them. That means it can recognize when a login prompt doesn’t match your identity provider or when a script behaves like part of a phishing toolkit.",{"data":20496,"content":20497,"nodeType":866},{},[20498],{"data":20499,"marks":20500,"value":20501,"nodeType":865},{},[],"When Push identifies something suspicious, it takes action right away. Logins are interrupted before any data is exposed. Users get clear guidance in-browser. And security teams receive detailed telemetry that shows exactly what happened, who was targeted, and how the threat was stopped.",{"data":20503,"content":20507,"nodeType":875},{"target":20504},{"sys":20505},{"id":20506,"type":872,"linkType":873},"7Hu3kypFWwJAGOuQp0kYmU",[],{"data":20509,"content":20510,"nodeType":879},{},[],{"data":20512,"content":20513,"nodeType":889},{},[20514],{"data":20515,"marks":20516,"value":20518,"nodeType":865},{},[20517],{"type":887},"The benefits of browser-native phishing defense",{"data":20520,"content":20521,"nodeType":2315},{},[20522],{"data":20523,"marks":20524,"value":20526,"nodeType":865},{},[20525],{"type":887},"True zero-day protection",{"data":20528,"content":20529,"nodeType":866},{},[20530],{"data":20531,"marks":20532,"value":20533,"nodeType":865},{},[],"Push doesn’t rely on known indicators of compromise. It evaluates the actual behavior and context of every session in real-time. Whether the phishing site was created 5 months ago or 5 minutes ago is irrelevant — Push detects it and shuts it down.",{"data":20535,"content":20536,"nodeType":2315},{},[20537],{"data":20538,"marks":20539,"value":20541,"nodeType":865},{},[20540],{"type":887},"Contextual threat detection",{"data":20543,"content":20544,"nodeType":866},{},[20545],{"data":20546,"marks":20547,"value":20548,"nodeType":865},{},[],"Because Push operates in the browser, it sees everything:",{"data":20550,"content":20551,"nodeType":2718},{},[20552,20562,20572,20594,20604],{"data":20553,"content":20554,"nodeType":2654},{},[20555],{"data":20556,"content":20557,"nodeType":866},{},[20558],{"data":20559,"marks":20560,"value":20561,"nodeType":865},{},[],"The page layout",{"data":20563,"content":20564,"nodeType":2654},{},[20565],{"data":20566,"content":20567,"nodeType":866},{},[20568],{"data":20569,"marks":20570,"value":20571,"nodeType":865},{},[],"Where the user came from",{"data":20573,"content":20574,"nodeType":2654},{},[20575],{"data":20576,"content":20577,"nodeType":866},{},[20578,20582,20591],{"data":20579,"marks":20580,"value":20581,"nodeType":865},{},[],"The password they enter ",{"data":20583,"content":20585,"nodeType":905},{"uri":20584},"https://pushsecurity.com/help/10043/#how-push-securely-analyzes-passwords",[20586],{"data":20587,"marks":20588,"value":20590,"nodeType":865},{},[20589],{"type":1070},"(as a salted, abbreviated hash)",{"data":20592,"marks":20593,"value":21,"nodeType":865},{},[],{"data":20595,"content":20596,"nodeType":2654},{},[20597],{"data":20598,"content":20599,"nodeType":866},{},[20600],{"data":20601,"marks":20602,"value":20603,"nodeType":865},{},[],"What scripts are running",{"data":20605,"content":20606,"nodeType":2654},{},[20607],{"data":20608,"content":20609,"nodeType":866},{},[20610],{"data":20611,"marks":20612,"value":20613,"nodeType":865},{},[],"And where credentials are being sent",{"data":20615,"content":20616,"nodeType":866},{},[20617],{"data":20618,"marks":20619,"value":20620,"nodeType":865},{},[],"This context enables Push to stop even well-camouflaged phishing attempts, including AitM attacks that bypass MFA.",{"data":20622,"content":20623,"nodeType":2315},{},[20624],{"data":20625,"marks":20626,"value":20628,"nodeType":865},{},[20627],{"type":887},"Real-time interception of malicious activity",{"data":20630,"content":20631,"nodeType":866},{},[20632],{"data":20633,"marks":20634,"value":20635,"nodeType":865},{},[],"As soon as a phishing attempt is confirmed, the response is immediate:",{"data":20637,"content":20638,"nodeType":2718},{},[20639,20649,20659],{"data":20640,"content":20641,"nodeType":2654},{},[20642],{"data":20643,"content":20644,"nodeType":866},{},[20645],{"data":20646,"marks":20647,"value":20648,"nodeType":865},{},[],"Credential entry is halted.",{"data":20650,"content":20651,"nodeType":2654},{},[20652],{"data":20653,"content":20654,"nodeType":866},{},[20655],{"data":20656,"marks":20657,"value":20658,"nodeType":865},{},[],"Sessions are revoked.",{"data":20660,"content":20661,"nodeType":2654},{},[20662],{"data":20663,"content":20664,"nodeType":866},{},[20665],{"data":20666,"marks":20667,"value":20668,"nodeType":865},{},[],"The user is protected without delay.",{"data":20670,"content":20671,"nodeType":2315},{},[20672],{"data":20673,"marks":20674,"value":20676,"nodeType":865},{},[20675],{"type":887},"Reduced incident response overhead",{"data":20678,"content":20679,"nodeType":866},{},[20680],{"data":20681,"marks":20682,"value":20683,"nodeType":865},{},[],"Most phishing attacks end in hours of IR and expensive cleanup. With Push, attacks don’t escalate beyond the initial click. That means fewer compromised accounts, fewer escalations, and less fatigue on your security team.",{"data":20685,"content":20686,"nodeType":2315},{},[20687],{"data":20688,"marks":20689,"value":20691,"nodeType":865},{},[20690],{"type":887},"Empowered, educated users",{"data":20693,"content":20694,"nodeType":866},{},[20695],{"data":20696,"marks":20697,"value":20698,"nodeType":865},{},[],"Push doesn’t just block phishing; it helps users learn from it. When someone interacts with a suspicious page, they get clear, actionable feedback right in the browser. Over time, these in-the-moment cues help build stronger phishing awareness across your workforce. Employee-facing messages are fully customizable to match the tone and style of your organization.",{"data":20700,"content":20701,"nodeType":2315},{},[20702],{"data":20703,"marks":20704,"value":20706,"nodeType":865},{},[20705],{"type":887},"A new paradigm for identity security",{"data":20708,"content":20709,"nodeType":866},{},[20710],{"data":20711,"marks":20712,"value":20713,"nodeType":865},{},[],"While phishing detection is core, Push also helps you defend your entire browser-based identity attack surface. That means protecting against other common forms of account compromise, like:",{"data":20715,"content":20716,"nodeType":2718},{},[20717,20727,20737,20747,20757],{"data":20718,"content":20719,"nodeType":2654},{},[20720],{"data":20721,"content":20722,"nodeType":866},{},[20723],{"data":20724,"marks":20725,"value":20726,"nodeType":865},{},[],"Employees using breached or reused passwords",{"data":20728,"content":20729,"nodeType":2654},{},[20730],{"data":20731,"content":20732,"nodeType":866},{},[20733],{"data":20734,"marks":20735,"value":20736,"nodeType":865},{},[],"Missing or misconfigured MFA",{"data":20738,"content":20739,"nodeType":2654},{},[20740],{"data":20741,"content":20742,"nodeType":866},{},[20743],{"data":20744,"marks":20745,"value":20746,"nodeType":865},{},[],"Ghost logins that bypass your identity provider",{"data":20748,"content":20749,"nodeType":2654},{},[20750],{"data":20751,"content":20752,"nodeType":866},{},[20753],{"data":20754,"marks":20755,"value":20756,"nodeType":865},{},[],"Token-based session hijacking",{"data":20758,"content":20759,"nodeType":2654},{},[20760],{"data":20761,"content":20762,"nodeType":866},{},[20763],{"data":20764,"marks":20765,"value":20766,"nodeType":865},{},[],"Shadow SaaS usage",{"data":20768,"content":20769,"nodeType":866},{},[20770],{"data":20771,"marks":20772,"value":20773,"nodeType":865},{},[],"Because Push runs directly in the browser, it gives you visibility across every app your employees access, whether it’s officially managed or not. And it doesn’t just alert, it actively helps you fix the issues, guiding users to take action when risks are found.",{"data":20775,"content":20776,"nodeType":879},{},[],{"data":20778,"content":20779,"nodeType":889},{},[20780],{"data":20781,"marks":20782,"value":20784,"nodeType":865},{},[20783],{"type":887},"Modern phishing requires a modern defense",{"data":20786,"content":20787,"nodeType":866},{},[20788],{"data":20789,"marks":20790,"value":20791,"nodeType":865},{},[],"Phishing is no longer an email problem. It’s not even just a domain reputation problem. It’s an identity attack problem, and the only place you can see those attacks in action is inside the browser.",{"data":20793,"content":20794,"nodeType":866},{},[20795,20799,20806],{"data":20796,"marks":20797,"value":20798,"nodeType":865},{},[],"Push Security gives you a new advantage: proactive, in-browser protection against modern phishing campaigns — ",{"data":20800,"content":20801,"nodeType":905},{"uri":20295},[20802],{"data":20803,"marks":20804,"value":20805,"nodeType":865},{},[],"even those with never-before-seen phishing sites",{"data":20807,"marks":20808,"value":1193,"nodeType":865},{},[],{"data":20810,"content":20811,"nodeType":2718},{},[20812,20822,20832],{"data":20813,"content":20814,"nodeType":2654},{},[20815],{"data":20816,"content":20817,"nodeType":866},{},[20818],{"data":20819,"marks":20820,"value":20821,"nodeType":865},{},[],"See the phish happen.",{"data":20823,"content":20824,"nodeType":2654},{},[20825],{"data":20826,"content":20827,"nodeType":866},{},[20828],{"data":20829,"marks":20830,"value":20831,"nodeType":865},{},[],"Stop it in real time.",{"data":20833,"content":20834,"nodeType":2654},{},[20835],{"data":20836,"content":20837,"nodeType":866},{},[20838],{"data":20839,"marks":20840,"value":20841,"nodeType":865},{},[],"Keep your workforce identities safe.",{"data":20843,"content":20844,"nodeType":866},{},[20845,20850,20858],{"data":20846,"marks":20847,"value":20849,"nodeType":865},{},[20848],{"type":887},"Want to see Push in action? ",{"data":20851,"content":20852,"nodeType":905},{"uri":3686},[20853],{"data":20854,"marks":20855,"value":20857,"nodeType":865},{},[20856],{"type":887},"Book a demo",{"data":20859,"marks":20860,"value":20862,"nodeType":865},{},[20861],{"type":887}," and watch a real-time phishing attack get stopped mid-flow.",{"data":20864,"content":20868,"nodeType":875},{"target":20865},{"sys":20866},{"id":20867,"type":872,"linkType":873},"7eSsPjEj178j3ViloaChbQ",[],{"data":20870,"content":20871,"nodeType":866},{},[20872],{"data":20873,"marks":20874,"value":21,"nodeType":865},{},[],"How browser-level controls change the fight against phishing","Attackers are routinely defeating conventional email, network, and endpoint-based security controls. Here's how browser controls can level the playing field.","2025-06-26T00:00:00.000Z","how-browser-level-controls-change-the-fight-against-phishing",{"items":20880},[20881,20883],{"sys":20882,"name":2144},{"id":2143},{"sys":20884,"name":342},{"id":3008},{"items":20886},[20887],{"fullName":20888,"firstName":20889,"jobTitle":9645,"profilePicture":20890},"Peyton Padfield","Peyton",{"url":20891},"https://images.ctfassets.net/y1cdw1ablpvd/1GU01HXElmc07nwi89qP3b/3188050420106c62e9df2ed4e4893b7f/1677005177901__1_.jpeg","key-takeaways-from-the-scattered-spider-attacks-on-insurance-firms","blog/key-takeaways-from-the-scattered-spider-attacks-on-insurance-firms",{"json":20895},{"data":20896,"content":20897,"nodeType":1522},{},[20898],{"data":20899,"content":20900,"nodeType":866},{},[20901],{"data":20902,"marks":20903,"value":20904,"nodeType":865},{},[],"Scattered Spider continues to dominate the headlines, with the latest news linking the hackers to attacks on U.S. insurance giant Aflac, Philadelphia Insurance Companies, Erie Insurance, Hawaiian Airlines, WestJet, and Qantas. Here's what you need to know to defend your organization. ","Scattered Spider continues to dominate the headlines, with attacks on aviation and insurance companies worldwide.",{"id":20907,"publishedAt":20908},"3JS30QKx42bLnGYZh5K9ZP","2026-08-12T11:54:01.317Z",{"items":20910},[20911,20913],{"sys":20912,"name":2144},{"id":2143},{"sys":20914,"name":342},{"id":3008},{"items":20916},[20917,20919,20921,20923,20925,20927,20929,20931,20933,20935,20937,20939,20941,20943,20945,20947,20949,20951],{"sys":20918,"name":279,"slug":280,"tier":31},{"id":276},{"sys":20920,"name":413,"slug":414,"tier":31},{"id":410},{"sys":20922,"name":519,"slug":520,"tier":31},{"id":516},{"sys":20924,"name":642,"slug":643,"tier":31},{"id":639},{"sys":20926,"name":342,"slug":343,"tier":31},{"id":339},{"sys":20928,"name":650,"slug":651,"tier":45},{"id":647},{"sys":20930,"name":261,"slug":262,"tier":45},{"id":258},{"sys":20932,"name":404,"slug":405,"tier":45},{"id":401},{"sys":20934,"name":528,"slug":529,"tier":45},{"id":525},{"sys":20936,"name":607,"slug":608,"tier":45},{"id":604},{"sys":20938,"name":466,"slug":467,"tier":45},{"id":463},{"sys":20940,"name":324,"slug":325,"tier":45},{"id":321},{"sys":20942,"name":333,"slug":334,"tier":45},{"id":330},{"sys":20944,"name":422,"slug":423,"tier":45},{"id":419},{"sys":20946,"name":571,"slug":572,"tier":45},{"id":568},{"sys":20948,"name":537,"slug":538,"tier":45},{"id":534},{"sys":20950,"name":457,"slug":458,"tier":45},{"id":454},{"sys":20952,"name":502,"slug":503,"tier":45},{"id":499},"EUQaIzN2danmdv-FjrFO_UhoqY0mW4m10bij_jFoR_I",{"id":20955,"title":19886,"authorsCollection":20956,"content":20961,"extension":228,"faqItemsCollection":21541,"faqTitle":59,"featured":6,"hashTags":59,"meta":21543,"metaTitle":21544,"ogImage":21545,"postType":7494,"publishedDate":19888,"relatedBlogPostsCollection":21546,"slug":19889,"stem":23738,"subtitle":59,"summary":23739,"synopsis":19887,"sys":23750,"tagsCollection":23752,"topicsCollection":23758,"__hash__":23790},"blog/blog/scattered-spider-defending-against-help-desk-scams.json",{"items":20957},[20958],{"fullName":3012,"firstName":3013,"jobTitle":3014,"socialLinks":20959,"profilePicture":20960},[6742],{"url":3016},{"json":20962,"links":21496},{"data":20963,"content":20964,"nodeType":1522},{},[20965,20970,20996,21072,21135,21141,21144,21150,21156,21162,21175,21181,21187,21190,21196,21202,21208,21238,21244,21265,21271,21274,21280,21286,21302,21379,21385,21390,21393,21399,21405,21411,21416,21433,21438,21444,21447,21453,21469,21485,21490],{"data":20966,"content":20969,"nodeType":875},{"target":20967},{"sys":20968},{"id":18451,"type":872,"linkType":873},[],{"data":20971,"content":20972,"nodeType":866},{},[20973,20976,20983,20986,20993],{"data":20974,"marks":20975,"value":19333,"nodeType":865},{},[],{"data":20977,"content":20978,"nodeType":905},{"uri":18633},[20979],{"data":20980,"marks":20981,"value":18639,"nodeType":865},{},[20982],{"type":1070},{"data":20984,"marks":20985,"value":7651,"nodeType":865},{},[],{"data":20987,"content":20988,"nodeType":905},{"uri":18645},[20989],{"data":20990,"marks":20991,"value":18651,"nodeType":865},{},[20992],{"type":1070},{"data":20994,"marks":20995,"value":19354,"nodeType":865},{},[],{"data":20997,"content":20998,"nodeType":866},{},[20999,21002,21009,21012,21019,21022,21029,21032,21039,21042,21049,21052,21059,21062,21069],{"data":21000,"marks":21001,"value":18662,"nodeType":865},{},[],{"data":21003,"content":21004,"nodeType":905},{"uri":18665},[21005],{"data":21006,"marks":21007,"value":18671,"nodeType":865},{},[21008],{"type":1070},{"data":21010,"marks":21011,"value":7148,"nodeType":865},{},[],{"data":21013,"content":21014,"nodeType":905},{"uri":18677},[21015],{"data":21016,"marks":21017,"value":18683,"nodeType":865},{},[21018],{"type":1070},{"data":21020,"marks":21021,"value":7148,"nodeType":865},{},[],{"data":21023,"content":21024,"nodeType":905},{"uri":18689},[21025],{"data":21026,"marks":21027,"value":18695,"nodeType":865},{},[21028],{"type":1070},{"data":21030,"marks":21031,"value":7148,"nodeType":865},{},[],{"data":21033,"content":21034,"nodeType":905},{"uri":18701},[21035],{"data":21036,"marks":21037,"value":18707,"nodeType":865},{},[21038],{"type":1070},{"data":21040,"marks":21041,"value":7148,"nodeType":865},{},[],{"data":21043,"content":21044,"nodeType":905},{"uri":18713},[21045],{"data":21046,"marks":21047,"value":18719,"nodeType":865},{},[21048],{"type":1070},{"data":21050,"marks":21051,"value":7148,"nodeType":865},{},[],{"data":21053,"content":21054,"nodeType":905},{"uri":18725},[21055],{"data":21056,"marks":21057,"value":18731,"nodeType":865},{},[21058],{"type":1070},{"data":21060,"marks":21061,"value":1454,"nodeType":865},{},[],{"data":21063,"content":21064,"nodeType":905},{"uri":18737},[21065],{"data":21066,"marks":21067,"value":18743,"nodeType":865},{},[21068],{"type":1070},{"data":21070,"marks":21071,"value":19431,"nodeType":865},{},[],{"data":21073,"content":21074,"nodeType":866},{},[21075,21078,21085,21088,21095,21098,21105,21108,21114,21117,21123,21126,21132],{"data":21076,"marks":21077,"value":19438,"nodeType":865},{},[],{"data":21079,"content":21080,"nodeType":905},{"uri":18462},[21081],{"data":21082,"marks":21083,"value":18468,"nodeType":865},{},[21084],{"type":1070},{"data":21086,"marks":21087,"value":7148,"nodeType":865},{},[],{"data":21089,"content":21090,"nodeType":905},{"uri":18474},[21091],{"data":21092,"marks":21093,"value":18480,"nodeType":865},{},[21094],{"type":1070},{"data":21096,"marks":21097,"value":19459,"nodeType":865},{},[],{"data":21099,"content":21100,"nodeType":905},{"uri":18486},[21101],{"data":21102,"marks":21103,"value":18492,"nodeType":865},{},[21104],{"type":1070},{"data":21106,"marks":21107,"value":18496,"nodeType":865},{},[],{"data":21109,"content":21110,"nodeType":905},{"uri":18499},[21111],{"data":21112,"marks":21113,"value":18504,"nodeType":865},{},[],{"data":21115,"marks":21116,"value":7148,"nodeType":865},{},[],{"data":21118,"content":21119,"nodeType":905},{"uri":18510},[21120],{"data":21121,"marks":21122,"value":18515,"nodeType":865},{},[],{"data":21124,"marks":21125,"value":7651,"nodeType":865},{},[],{"data":21127,"content":21128,"nodeType":905},{"uri":18510},[21129],{"data":21130,"marks":21131,"value":18525,"nodeType":865},{},[],{"data":21133,"marks":21134,"value":6352,"nodeType":865},{},[],{"data":21136,"content":21137,"nodeType":866},{},[21138],{"data":21139,"marks":21140,"value":19503,"nodeType":865},{},[],{"data":21142,"content":21143,"nodeType":879},{},[],{"data":21145,"content":21146,"nodeType":889},{},[21147],{"data":21148,"marks":21149,"value":19513,"nodeType":865},{},[],{"data":21151,"content":21152,"nodeType":866},{},[21153],{"data":21154,"marks":21155,"value":19520,"nodeType":865},{},[],{"data":21157,"content":21158,"nodeType":866},{},[21159],{"data":21160,"marks":21161,"value":19527,"nodeType":865},{},[],{"data":21163,"content":21164,"nodeType":866},{},[21165,21168,21172],{"data":21166,"marks":21167,"value":19534,"nodeType":865},{},[],{"data":21169,"marks":21170,"value":19539,"nodeType":865},{},[21171],{"type":2757},{"data":21173,"marks":21174,"value":19543,"nodeType":865},{},[],{"data":21176,"content":21177,"nodeType":866},{},[21178],{"data":21179,"marks":21180,"value":19550,"nodeType":865},{},[],{"data":21182,"content":21183,"nodeType":866},{},[21184],{"data":21185,"marks":21186,"value":19557,"nodeType":865},{},[],{"data":21188,"content":21189,"nodeType":879},{},[],{"data":21191,"content":21192,"nodeType":889},{},[21193],{"data":21194,"marks":21195,"value":19567,"nodeType":865},{},[],{"data":21197,"content":21198,"nodeType":866},{},[21199],{"data":21200,"marks":21201,"value":19574,"nodeType":865},{},[],{"data":21203,"content":21204,"nodeType":866},{},[21205],{"data":21206,"marks":21207,"value":19581,"nodeType":865},{},[],{"data":21209,"content":21210,"nodeType":2718},{},[21211,21220,21229],{"data":21212,"content":21213,"nodeType":2654},{},[21214],{"data":21215,"content":21216,"nodeType":866},{},[21217],{"data":21218,"marks":21219,"value":19594,"nodeType":865},{},[],{"data":21221,"content":21222,"nodeType":2654},{},[21223],{"data":21224,"content":21225,"nodeType":866},{},[21226],{"data":21227,"marks":21228,"value":19604,"nodeType":865},{},[],{"data":21230,"content":21231,"nodeType":2654},{},[21232],{"data":21233,"content":21234,"nodeType":866},{},[21235],{"data":21236,"marks":21237,"value":19614,"nodeType":865},{},[],{"data":21239,"content":21240,"nodeType":866},{},[21241],{"data":21242,"marks":21243,"value":19621,"nodeType":865},{},[],{"data":21245,"content":21246,"nodeType":2718},{},[21247,21256],{"data":21248,"content":21249,"nodeType":2654},{},[21250],{"data":21251,"content":21252,"nodeType":866},{},[21253],{"data":21254,"marks":21255,"value":19634,"nodeType":865},{},[],{"data":21257,"content":21258,"nodeType":2654},{},[21259],{"data":21260,"content":21261,"nodeType":866},{},[21262],{"data":21263,"marks":21264,"value":19644,"nodeType":865},{},[],{"data":21266,"content":21267,"nodeType":866},{},[21268],{"data":21269,"marks":21270,"value":19651,"nodeType":865},{},[],{"data":21272,"content":21273,"nodeType":879},{},[],{"data":21275,"content":21276,"nodeType":889},{},[21277],{"data":21278,"marks":21279,"value":19661,"nodeType":865},{},[],{"data":21281,"content":21282,"nodeType":866},{},[21283],{"data":21284,"marks":21285,"value":18811,"nodeType":865},{},[],{"data":21287,"content":21288,"nodeType":866},{},[21289,21292,21299],{"data":21290,"marks":21291,"value":21,"nodeType":865},{},[],{"data":21293,"content":21294,"nodeType":905},{"uri":19676},[21295],{"data":21296,"marks":21297,"value":19682,"nodeType":865},{},[21298],{"type":1070},{"data":21300,"marks":21301,"value":19686,"nodeType":865},{},[],{"data":21303,"content":21304,"nodeType":2718},{},[21305,21314,21323,21342,21351,21360],{"data":21306,"content":21307,"nodeType":2654},{},[21308],{"data":21309,"content":21310,"nodeType":866},{},[21311],{"data":21312,"marks":21313,"value":18831,"nodeType":865},{},[],{"data":21315,"content":21316,"nodeType":2654},{},[21317],{"data":21318,"content":21319,"nodeType":866},{},[21320],{"data":21321,"marks":21322,"value":18841,"nodeType":865},{},[],{"data":21324,"content":21325,"nodeType":2654},{},[21326],{"data":21327,"content":21328,"nodeType":866},{},[21329,21332,21339],{"data":21330,"marks":21331,"value":18851,"nodeType":865},{},[],{"data":21333,"content":21334,"nodeType":905},{"uri":9903},[21335],{"data":21336,"marks":21337,"value":9908,"nodeType":865},{},[21338],{"type":1070},{"data":21340,"marks":21341,"value":18862,"nodeType":865},{},[],{"data":21343,"content":21344,"nodeType":2654},{},[21345],{"data":21346,"content":21347,"nodeType":866},{},[21348],{"data":21349,"marks":21350,"value":18872,"nodeType":865},{},[],{"data":21352,"content":21353,"nodeType":2654},{},[21354],{"data":21355,"content":21356,"nodeType":866},{},[21357],{"data":21358,"marks":21359,"value":18882,"nodeType":865},{},[],{"data":21361,"content":21362,"nodeType":2654},{},[21363],{"data":21364,"content":21365,"nodeType":866},{},[21366,21369,21376],{"data":21367,"marks":21368,"value":18892,"nodeType":865},{},[],{"data":21370,"content":21371,"nodeType":905},{"uri":18895},[21372],{"data":21373,"marks":21374,"value":18901,"nodeType":865},{},[21375],{"type":1070},{"data":21377,"marks":21378,"value":19764,"nodeType":865},{},[],{"data":21380,"content":21381,"nodeType":866},{},[21382],{"data":21383,"marks":21384,"value":19771,"nodeType":865},{},[],{"data":21386,"content":21389,"nodeType":875},{"target":21387},{"sys":21388},{"id":18780,"type":872,"linkType":873},[],{"data":21391,"content":21392,"nodeType":879},{},[],{"data":21394,"content":21395,"nodeType":889},{},[21396],{"data":21397,"marks":21398,"value":19083,"nodeType":865},{},[],{"data":21400,"content":21401,"nodeType":866},{},[21402],{"data":21403,"marks":21404,"value":19090,"nodeType":865},{},[],{"data":21406,"content":21407,"nodeType":866},{},[21408],{"data":21409,"marks":21410,"value":19097,"nodeType":865},{},[],{"data":21412,"content":21415,"nodeType":875},{"target":21413},{"sys":21414},{"id":19102,"type":872,"linkType":873},[],{"data":21417,"content":21418,"nodeType":866},{},[21419,21422,21430],{"data":21420,"marks":21421,"value":19809,"nodeType":865},{},[],{"data":21423,"content":21424,"nodeType":905},{"uri":7281},[21425],{"data":21426,"marks":21427,"value":19118,"nodeType":865},{},[21428,21429],{"type":1070},{"type":887},{"data":21431,"marks":21432,"value":19122,"nodeType":865},{},[],{"data":21434,"content":21437,"nodeType":875},{"target":21435},{"sys":21436},{"id":7309,"type":872,"linkType":873},[],{"data":21439,"content":21440,"nodeType":866},{},[21441],{"data":21442,"marks":21443,"value":19134,"nodeType":865},{},[],{"data":21445,"content":21446,"nodeType":879},{},[],{"data":21448,"content":21449,"nodeType":889},{},[21450],{"data":21451,"marks":21452,"value":19157,"nodeType":865},{},[],{"data":21454,"content":21455,"nodeType":866},{},[21456,21459,21466],{"data":21457,"marks":21458,"value":19164,"nodeType":865},{},[],{"data":21460,"content":21461,"nodeType":905},{"uri":19304},[21462],{"data":21463,"marks":21464,"value":19854,"nodeType":865},{},[21465],{"type":1070},{"data":21467,"marks":21468,"value":19858,"nodeType":865},{},[],{"data":21470,"content":21471,"nodeType":866},{},[21472,21475,21482],{"data":21473,"marks":21474,"value":19184,"nodeType":865},{},[],{"data":21476,"content":21477,"nodeType":905},{"uri":3686},[21478],{"data":21479,"marks":21480,"value":7352,"nodeType":865},{},[21481],{"type":1070},{"data":21483,"marks":21484,"value":1193,"nodeType":865},{},[],{"data":21486,"content":21489,"nodeType":875},{"target":21487},{"sys":21488},{"id":19200,"type":872,"linkType":873},[],{"data":21491,"content":21492,"nodeType":866},{},[21493],{"data":21494,"marks":21495,"value":21,"nodeType":865},{},[],{"entries":21497},{"hyperlink":21498,"inline":21499,"block":21500},[],[],[21501,21531,21533,21536,21539],{"sys":21502,"__typename":4645,"content":21503,"name":19249,"title":59},{"id":18451},{"json":21504},{"nodeType":1522,"data":21505,"content":21506},{},[21507],{"nodeType":866,"data":21508,"content":21509},{},[21510,21513,21519,21522,21528],{"nodeType":865,"value":19223,"marks":21511,"data":21512},[],{},{"nodeType":905,"data":21514,"content":21515},{"uri":19228},[21516],{"nodeType":865,"value":19231,"marks":21517,"data":21518},[],{},{"nodeType":865,"value":19235,"marks":21520,"data":21521},[],{},{"nodeType":905,"data":21523,"content":21524},{"uri":19228},[21525],{"nodeType":865,"value":19242,"marks":21526,"data":21527},[],{},{"nodeType":865,"value":19246,"marks":21529,"data":21530},[],{},{"sys":21532,"__typename":1530,"type":1531,"ctaText":19252,"buttonLabel":19253,"buttonColour":1534,"buttonUrl":19254},{"id":18780},{"sys":21534,"__typename":4637,"title":19287,"caption":19287,"layoutMode":59,"file":21535},{"id":19102},{"url":19289,"width":4641,"height":19260},{"sys":21537,"__typename":4637,"title":7484,"caption":7485,"layoutMode":59,"file":21538},{"id":7309},{"url":7487,"width":7488,"height":7489},{"sys":21540,"__typename":1530,"type":1531,"ctaText":19302,"buttonLabel":19303,"buttonColour":1534,"buttonUrl":19304},{"id":19200},{"items":21542},[],{},"How to protect your organization from help desk scams",{"url":19310},{"items":21547},[21548,22101,22406],{"__typename":1544,"sys":21549,"content":21550,"title":20875,"synopsis":20876,"hashTags":59,"publishedDate":20877,"slug":20878,"tagsCollection":22091,"authorsCollection":22097},{"id":20259},{"json":21551},{"data":21552,"content":21553,"nodeType":1522},{},[21554,21560,21566,21573,21596,21602,21607,21610,21617,21623,21629,21668,21674,21680,21683,21690,21696,21702,21708,21724,21730,21735,21742,21748,21754,21760,21765,21768,21775,21782,21788,21795,21801,21859,21865,21872,21878,21908,21915,21921,21928,21934,21941,21947,21995,22001,22004,22011,22017,22032,22062,22080,22085],{"data":21555,"content":21556,"nodeType":866},{},[21557],{"data":21558,"marks":21559,"value":20270,"nodeType":865},{},[],{"data":21561,"content":21562,"nodeType":866},{},[21563],{"data":21564,"marks":21565,"value":20277,"nodeType":865},{},[],{"data":21567,"content":21568,"nodeType":866},{},[21569],{"data":21570,"marks":21571,"value":20285,"nodeType":865},{},[21572],{"type":887},{"data":21574,"content":21575,"nodeType":866},{},[21576,21579,21586,21589,21593],{"data":21577,"marks":21578,"value":20292,"nodeType":865},{},[],{"data":21580,"content":21581,"nodeType":905},{"uri":20295},[21582],{"data":21583,"marks":21584,"value":20301,"nodeType":865},{},[21585],{"type":1070},{"data":21587,"marks":21588,"value":20305,"nodeType":865},{},[],{"data":21590,"marks":21591,"value":20310,"nodeType":865},{},[21592],{"type":2757},{"data":21594,"marks":21595,"value":20314,"nodeType":865},{},[],{"data":21597,"content":21598,"nodeType":866},{},[21599],{"data":21600,"marks":21601,"value":20321,"nodeType":865},{},[],{"data":21603,"content":21606,"nodeType":875},{"target":21604},{"sys":21605},{"id":20326,"type":872,"linkType":873},[],{"data":21608,"content":21609,"nodeType":879},{},[],{"data":21611,"content":21612,"nodeType":889},{},[21613],{"data":21614,"marks":21615,"value":20338,"nodeType":865},{},[21616],{"type":887},{"data":21618,"content":21619,"nodeType":866},{},[21620],{"data":21621,"marks":21622,"value":20345,"nodeType":865},{},[],{"data":21624,"content":21625,"nodeType":866},{},[21626],{"data":21627,"marks":21628,"value":20352,"nodeType":865},{},[],{"data":21630,"content":21631,"nodeType":2718},{},[21632,21641,21650,21659],{"data":21633,"content":21634,"nodeType":2654},{},[21635],{"data":21636,"content":21637,"nodeType":866},{},[21638],{"data":21639,"marks":21640,"value":20365,"nodeType":865},{},[],{"data":21642,"content":21643,"nodeType":2654},{},[21644],{"data":21645,"content":21646,"nodeType":866},{},[21647],{"data":21648,"marks":21649,"value":20375,"nodeType":865},{},[],{"data":21651,"content":21652,"nodeType":2654},{},[21653],{"data":21654,"content":21655,"nodeType":866},{},[21656],{"data":21657,"marks":21658,"value":20385,"nodeType":865},{},[],{"data":21660,"content":21661,"nodeType":2654},{},[21662],{"data":21663,"content":21664,"nodeType":866},{},[21665],{"data":21666,"marks":21667,"value":20395,"nodeType":865},{},[],{"data":21669,"content":21670,"nodeType":866},{},[21671],{"data":21672,"marks":21673,"value":20402,"nodeType":865},{},[],{"data":21675,"content":21676,"nodeType":866},{},[21677],{"data":21678,"marks":21679,"value":20409,"nodeType":865},{},[],{"data":21681,"content":21682,"nodeType":879},{},[],{"data":21684,"content":21685,"nodeType":889},{},[21686],{"data":21687,"marks":21688,"value":20420,"nodeType":865},{},[21689],{"type":887},{"data":21691,"content":21692,"nodeType":866},{},[21693],{"data":21694,"marks":21695,"value":20427,"nodeType":865},{},[],{"data":21697,"content":21698,"nodeType":866},{},[21699],{"data":21700,"marks":21701,"value":20434,"nodeType":865},{},[],{"data":21703,"content":21704,"nodeType":866},{},[21705],{"data":21706,"marks":21707,"value":20441,"nodeType":865},{},[],{"data":21709,"content":21710,"nodeType":866},{},[21711,21714,21721],{"data":21712,"marks":21713,"value":20448,"nodeType":865},{},[],{"data":21715,"content":21716,"nodeType":905},{"uri":3474},[21717],{"data":21718,"marks":21719,"value":12232,"nodeType":865},{},[21720],{"type":1070},{"data":21722,"marks":21723,"value":20459,"nodeType":865},{},[],{"data":21725,"content":21726,"nodeType":866},{},[21727],{"data":21728,"marks":21729,"value":20466,"nodeType":865},{},[],{"data":21731,"content":21734,"nodeType":875},{"target":21732},{"sys":21733},{"id":20471,"type":872,"linkType":873},[],{"data":21736,"content":21737,"nodeType":889},{},[21738],{"data":21739,"marks":21740,"value":20480,"nodeType":865},{},[21741],{"type":887},{"data":21743,"content":21744,"nodeType":866},{},[21745],{"data":21746,"marks":21747,"value":20487,"nodeType":865},{},[],{"data":21749,"content":21750,"nodeType":866},{},[21751],{"data":21752,"marks":21753,"value":20494,"nodeType":865},{},[],{"data":21755,"content":21756,"nodeType":866},{},[21757],{"data":21758,"marks":21759,"value":20501,"nodeType":865},{},[],{"data":21761,"content":21764,"nodeType":875},{"target":21762},{"sys":21763},{"id":20506,"type":872,"linkType":873},[],{"data":21766,"content":21767,"nodeType":879},{},[],{"data":21769,"content":21770,"nodeType":889},{},[21771],{"data":21772,"marks":21773,"value":20518,"nodeType":865},{},[21774],{"type":887},{"data":21776,"content":21777,"nodeType":2315},{},[21778],{"data":21779,"marks":21780,"value":20526,"nodeType":865},{},[21781],{"type":887},{"data":21783,"content":21784,"nodeType":866},{},[21785],{"data":21786,"marks":21787,"value":20533,"nodeType":865},{},[],{"data":21789,"content":21790,"nodeType":2315},{},[21791],{"data":21792,"marks":21793,"value":20541,"nodeType":865},{},[21794],{"type":887},{"data":21796,"content":21797,"nodeType":866},{},[21798],{"data":21799,"marks":21800,"value":20548,"nodeType":865},{},[],{"data":21802,"content":21803,"nodeType":2718},{},[21804,21813,21822,21841,21850],{"data":21805,"content":21806,"nodeType":2654},{},[21807],{"data":21808,"content":21809,"nodeType":866},{},[21810],{"data":21811,"marks":21812,"value":20561,"nodeType":865},{},[],{"data":21814,"content":21815,"nodeType":2654},{},[21816],{"data":21817,"content":21818,"nodeType":866},{},[21819],{"data":21820,"marks":21821,"value":20571,"nodeType":865},{},[],{"data":21823,"content":21824,"nodeType":2654},{},[21825],{"data":21826,"content":21827,"nodeType":866},{},[21828,21831,21838],{"data":21829,"marks":21830,"value":20581,"nodeType":865},{},[],{"data":21832,"content":21833,"nodeType":905},{"uri":20584},[21834],{"data":21835,"marks":21836,"value":20590,"nodeType":865},{},[21837],{"type":1070},{"data":21839,"marks":21840,"value":21,"nodeType":865},{},[],{"data":21842,"content":21843,"nodeType":2654},{},[21844],{"data":21845,"content":21846,"nodeType":866},{},[21847],{"data":21848,"marks":21849,"value":20603,"nodeType":865},{},[],{"data":21851,"content":21852,"nodeType":2654},{},[21853],{"data":21854,"content":21855,"nodeType":866},{},[21856],{"data":21857,"marks":21858,"value":20613,"nodeType":865},{},[],{"data":21860,"content":21861,"nodeType":866},{},[21862],{"data":21863,"marks":21864,"value":20620,"nodeType":865},{},[],{"data":21866,"content":21867,"nodeType":2315},{},[21868],{"data":21869,"marks":21870,"value":20628,"nodeType":865},{},[21871],{"type":887},{"data":21873,"content":21874,"nodeType":866},{},[21875],{"data":21876,"marks":21877,"value":20635,"nodeType":865},{},[],{"data":21879,"content":21880,"nodeType":2718},{},[21881,21890,21899],{"data":21882,"content":21883,"nodeType":2654},{},[21884],{"data":21885,"content":21886,"nodeType":866},{},[21887],{"data":21888,"marks":21889,"value":20648,"nodeType":865},{},[],{"data":21891,"content":21892,"nodeType":2654},{},[21893],{"data":21894,"content":21895,"nodeType":866},{},[21896],{"data":21897,"marks":21898,"value":20658,"nodeType":865},{},[],{"data":21900,"content":21901,"nodeType":2654},{},[21902],{"data":21903,"content":21904,"nodeType":866},{},[21905],{"data":21906,"marks":21907,"value":20668,"nodeType":865},{},[],{"data":21909,"content":21910,"nodeType":2315},{},[21911],{"data":21912,"marks":21913,"value":20676,"nodeType":865},{},[21914],{"type":887},{"data":21916,"content":21917,"nodeType":866},{},[21918],{"data":21919,"marks":21920,"value":20683,"nodeType":865},{},[],{"data":21922,"content":21923,"nodeType":2315},{},[21924],{"data":21925,"marks":21926,"value":20691,"nodeType":865},{},[21927],{"type":887},{"data":21929,"content":21930,"nodeType":866},{},[21931],{"data":21932,"marks":21933,"value":20698,"nodeType":865},{},[],{"data":21935,"content":21936,"nodeType":2315},{},[21937],{"data":21938,"marks":21939,"value":20706,"nodeType":865},{},[21940],{"type":887},{"data":21942,"content":21943,"nodeType":866},{},[21944],{"data":21945,"marks":21946,"value":20713,"nodeType":865},{},[],{"data":21948,"content":21949,"nodeType":2718},{},[21950,21959,21968,21977,21986],{"data":21951,"content":21952,"nodeType":2654},{},[21953],{"data":21954,"content":21955,"nodeType":866},{},[21956],{"data":21957,"marks":21958,"value":20726,"nodeType":865},{},[],{"data":21960,"content":21961,"nodeType":2654},{},[21962],{"data":21963,"content":21964,"nodeType":866},{},[21965],{"data":21966,"marks":21967,"value":20736,"nodeType":865},{},[],{"data":21969,"content":21970,"nodeType":2654},{},[21971],{"data":21972,"content":21973,"nodeType":866},{},[21974],{"data":21975,"marks":21976,"value":20746,"nodeType":865},{},[],{"data":21978,"content":21979,"nodeType":2654},{},[21980],{"data":21981,"content":21982,"nodeType":866},{},[21983],{"data":21984,"marks":21985,"value":20756,"nodeType":865},{},[],{"data":21987,"content":21988,"nodeType":2654},{},[21989],{"data":21990,"content":21991,"nodeType":866},{},[21992],{"data":21993,"marks":21994,"value":20766,"nodeType":865},{},[],{"data":21996,"content":21997,"nodeType":866},{},[21998],{"data":21999,"marks":22000,"value":20773,"nodeType":865},{},[],{"data":22002,"content":22003,"nodeType":879},{},[],{"data":22005,"content":22006,"nodeType":889},{},[22007],{"data":22008,"marks":22009,"value":20784,"nodeType":865},{},[22010],{"type":887},{"data":22012,"content":22013,"nodeType":866},{},[22014],{"data":22015,"marks":22016,"value":20791,"nodeType":865},{},[],{"data":22018,"content":22019,"nodeType":866},{},[22020,22023,22029],{"data":22021,"marks":22022,"value":20798,"nodeType":865},{},[],{"data":22024,"content":22025,"nodeType":905},{"uri":20295},[22026],{"data":22027,"marks":22028,"value":20805,"nodeType":865},{},[],{"data":22030,"marks":22031,"value":1193,"nodeType":865},{},[],{"data":22033,"content":22034,"nodeType":2718},{},[22035,22044,22053],{"data":22036,"content":22037,"nodeType":2654},{},[22038],{"data":22039,"content":22040,"nodeType":866},{},[22041],{"data":22042,"marks":22043,"value":20821,"nodeType":865},{},[],{"data":22045,"content":22046,"nodeType":2654},{},[22047],{"data":22048,"content":22049,"nodeType":866},{},[22050],{"data":22051,"marks":22052,"value":20831,"nodeType":865},{},[],{"data":22054,"content":22055,"nodeType":2654},{},[22056],{"data":22057,"content":22058,"nodeType":866},{},[22059],{"data":22060,"marks":22061,"value":20841,"nodeType":865},{},[],{"data":22063,"content":22064,"nodeType":866},{},[22065,22069,22076],{"data":22066,"marks":22067,"value":20849,"nodeType":865},{},[22068],{"type":887},{"data":22070,"content":22071,"nodeType":905},{"uri":3686},[22072],{"data":22073,"marks":22074,"value":20857,"nodeType":865},{},[22075],{"type":887},{"data":22077,"marks":22078,"value":20862,"nodeType":865},{},[22079],{"type":887},{"data":22081,"content":22084,"nodeType":875},{"target":22082},{"sys":22083},{"id":20867,"type":872,"linkType":873},[],{"data":22086,"content":22087,"nodeType":866},{},[22088],{"data":22089,"marks":22090,"value":21,"nodeType":865},{},[],{"items":22092},[22093,22095],{"sys":22094,"name":2144},{"id":2143},{"sys":22096,"name":342},{"id":3008},{"items":22098},[22099],{"fullName":20888,"firstName":20889,"jobTitle":9645,"profilePicture":22100},{"url":20891},{"__typename":1544,"sys":22102,"content":22103,"title":20245,"synopsis":20246,"hashTags":59,"publishedDate":20247,"slug":20248,"tagsCollection":22398,"authorsCollection":22402},{"id":9569},{"json":22104},{"data":22105,"content":22106,"nodeType":1522},{},[22107,22113,22119,22125,22130,22136,22166,22172,22178,22184,22189,22195,22201,22216,22221,22227,22243,22259,22265,22271,22277,22283,22289,22295,22301,22317,22323,22329,22334,22340,22346,22366,22371,22387,22392],{"data":22108,"content":22109,"nodeType":866},{},[22110],{"data":22111,"marks":22112,"value":19912,"nodeType":865},{},[],{"data":22114,"content":22115,"nodeType":866},{},[22116],{"data":22117,"marks":22118,"value":19919,"nodeType":865},{},[],{"data":22120,"content":22121,"nodeType":866},{},[22122],{"data":22123,"marks":22124,"value":19926,"nodeType":865},{},[],{"data":22126,"content":22129,"nodeType":875},{"target":22127},{"sys":22128},{"id":19931,"type":872,"linkType":873},[],{"data":22131,"content":22132,"nodeType":866},{},[22133],{"data":22134,"marks":22135,"value":19939,"nodeType":865},{},[],{"data":22137,"content":22138,"nodeType":2718},{},[22139,22148,22157],{"data":22140,"content":22141,"nodeType":2654},{},[22142],{"data":22143,"content":22144,"nodeType":866},{},[22145],{"data":22146,"marks":22147,"value":19952,"nodeType":865},{},[],{"data":22149,"content":22150,"nodeType":2654},{},[22151],{"data":22152,"content":22153,"nodeType":866},{},[22154],{"data":22155,"marks":22156,"value":19962,"nodeType":865},{},[],{"data":22158,"content":22159,"nodeType":2654},{},[22160],{"data":22161,"content":22162,"nodeType":866},{},[22163],{"data":22164,"marks":22165,"value":19972,"nodeType":865},{},[],{"data":22167,"content":22168,"nodeType":866},{},[22169],{"data":22170,"marks":22171,"value":19979,"nodeType":865},{},[],{"data":22173,"content":22174,"nodeType":889},{},[22175],{"data":22176,"marks":22177,"value":19986,"nodeType":865},{},[],{"data":22179,"content":22180,"nodeType":866},{},[22181],{"data":22182,"marks":22183,"value":19993,"nodeType":865},{},[],{"data":22185,"content":22188,"nodeType":875},{"target":22186},{"sys":22187},{"id":19998,"type":872,"linkType":873},[],{"data":22190,"content":22191,"nodeType":866},{},[22192],{"data":22193,"marks":22194,"value":20006,"nodeType":865},{},[],{"data":22196,"content":22197,"nodeType":889},{},[22198],{"data":22199,"marks":22200,"value":20013,"nodeType":865},{},[],{"data":22202,"content":22203,"nodeType":866},{},[22204,22207,22213],{"data":22205,"marks":22206,"value":20020,"nodeType":865},{},[],{"data":22208,"content":22209,"nodeType":905},{"uri":19676},[22210],{"data":22211,"marks":22212,"value":20027,"nodeType":865},{},[],{"data":22214,"marks":22215,"value":20031,"nodeType":865},{},[],{"data":22217,"content":22220,"nodeType":875},{"target":22218},{"sys":22219},{"id":18780,"type":872,"linkType":873},[],{"data":22222,"content":22223,"nodeType":2315},{},[22224],{"data":22225,"marks":22226,"value":20043,"nodeType":865},{},[],{"data":22228,"content":22229,"nodeType":866},{},[22230,22233,22240],{"data":22231,"marks":22232,"value":20050,"nodeType":865},{},[],{"data":22234,"content":22235,"nodeType":905},{"uri":20053},[22236],{"data":22237,"marks":22238,"value":20059,"nodeType":865},{},[22239],{"type":1070},{"data":22241,"marks":22242,"value":20063,"nodeType":865},{},[],{"data":22244,"content":22245,"nodeType":866},{},[22246,22249,22256],{"data":22247,"marks":22248,"value":20070,"nodeType":865},{},[],{"data":22250,"content":22251,"nodeType":905},{"uri":10111},[22252],{"data":22253,"marks":22254,"value":10117,"nodeType":865},{},[22255],{"type":1070},{"data":22257,"marks":22258,"value":20081,"nodeType":865},{},[],{"data":22260,"content":22261,"nodeType":866},{},[22262],{"data":22263,"marks":22264,"value":20088,"nodeType":865},{},[],{"data":22266,"content":22267,"nodeType":866},{},[22268],{"data":22269,"marks":22270,"value":20095,"nodeType":865},{},[],{"data":22272,"content":22273,"nodeType":2315},{},[22274],{"data":22275,"marks":22276,"value":20102,"nodeType":865},{},[],{"data":22278,"content":22279,"nodeType":866},{},[22280],{"data":22281,"marks":22282,"value":20109,"nodeType":865},{},[],{"data":22284,"content":22285,"nodeType":866},{},[22286],{"data":22287,"marks":22288,"value":20116,"nodeType":865},{},[],{"data":22290,"content":22291,"nodeType":889},{},[22292],{"data":22293,"marks":22294,"value":20123,"nodeType":865},{},[],{"data":22296,"content":22297,"nodeType":866},{},[22298],{"data":22299,"marks":22300,"value":20130,"nodeType":865},{},[],{"data":22302,"content":22303,"nodeType":866},{},[22304,22307,22314],{"data":22305,"marks":22306,"value":20137,"nodeType":865},{},[],{"data":22308,"content":22309,"nodeType":905},{"uri":20140},[22310],{"data":22311,"marks":22312,"value":20146,"nodeType":865},{},[22313],{"type":1070},{"data":22315,"marks":22316,"value":20150,"nodeType":865},{},[],{"data":22318,"content":22319,"nodeType":866},{},[22320],{"data":22321,"marks":22322,"value":20157,"nodeType":865},{},[],{"data":22324,"content":22325,"nodeType":866},{},[22326],{"data":22327,"marks":22328,"value":20164,"nodeType":865},{},[],{"data":22330,"content":22333,"nodeType":875},{"target":22331},{"sys":22332},{"id":20169,"type":872,"linkType":873},[],{"data":22335,"content":22336,"nodeType":889},{},[22337],{"data":22338,"marks":22339,"value":19157,"nodeType":865},{},[],{"data":22341,"content":22342,"nodeType":866},{},[22343],{"data":22344,"marks":22345,"value":20183,"nodeType":865},{},[],{"data":22347,"content":22348,"nodeType":866},{},[22349,22352,22356,22359,22363],{"data":22350,"marks":22351,"value":20190,"nodeType":865},{},[],{"data":22353,"marks":22354,"value":20195,"nodeType":865},{},[22355],{"type":887},{"data":22357,"marks":22358,"value":20199,"nodeType":865},{},[],{"data":22360,"marks":22361,"value":20204,"nodeType":865},{},[22362],{"type":887},{"data":22364,"marks":22365,"value":20208,"nodeType":865},{},[],{"data":22367,"content":22370,"nodeType":875},{"target":22368},{"sys":22369},{"id":20213,"type":872,"linkType":873},[],{"data":22372,"content":22373,"nodeType":866},{},[22374,22377,22384],{"data":22375,"marks":22376,"value":20221,"nodeType":865},{},[],{"data":22378,"content":22379,"nodeType":905},{"uri":3686},[22380],{"data":22381,"marks":22382,"value":1517,"nodeType":865},{},[22383],{"type":1070},{"data":22385,"marks":22386,"value":20232,"nodeType":865},{},[],{"data":22388,"content":22391,"nodeType":875},{"target":22389},{"sys":22390},{"id":20237,"type":872,"linkType":873},[],{"data":22393,"content":22394,"nodeType":866},{},[22395],{"data":22396,"marks":22397,"value":21,"nodeType":865},{},[],{"items":22399},[22400],{"sys":22401,"name":297},{"id":2147},{"items":22403},[22404],{"fullName":14538,"firstName":14539,"jobTitle":9645,"profilePicture":22405},{"url":14541},{"__typename":1544,"sys":22407,"content":22408,"title":23724,"synopsis":23725,"hashTags":59,"publishedDate":23726,"slug":23727,"tagsCollection":23728,"authorsCollection":23734},{"id":9507},{"json":22409},{"data":22410,"content":22411,"nodeType":1522},{},[22412,22417,22425,22432,22460,22466,22474,22503,22545,22551,22559,22577,22583,22586,22594,22601,22607,22648,22779,22782,22790,22797,22805,22836,22842,22850,22870,22877,22883,22890,22896,22915,22923,22941,22949,22956,22963,22966,22974,22981,22987,22994,23002,23020,23027,23033,23041,23048,23055,23087,23093,23100,23108,23115,23121,23152,23160,23180,23187,23193,23201,23221,23228,23291,23297,23300,23308,23315,23322,23353,23356,23364,23372,23378,23385,23393,23399,23406,23413,23419,23426,23434,23441,23448,23455,23474,23492,23499,23506,23512,23519,23527,23534,23541,23547,23554,23562,23569,23576,23583,23589,23596,23604,23611,23629,23635,23642,23659,23664,23670,23686,23691,23694,23701,23708],{"data":22413,"content":22416,"nodeType":875},{"target":22414},{"sys":22415},{"id":18451,"type":872,"linkType":873},[],{"data":22418,"content":22419,"nodeType":889},{},[22420],{"data":22421,"marks":22422,"value":22424,"nodeType":865},{},[22423],{"type":887},"Background: Who are Scattered Spider?",{"data":22426,"content":22427,"nodeType":866},{},[22428],{"data":22429,"marks":22430,"value":22431,"nodeType":865},{},[],"Scattered Spider (also tracked as 0ktapus, Octo Tempest, Scatter Swine, Muddled Libra, and UNC3944) is a native English speaking, financially motivated criminal collective known for high-profile cyber breaches in recent years, including MoneyGram, Transport for London, Caesars, MGM Resorts, Clorox, DoorDash, Twilio, Reddit, Coinbase, MailChimp, Okta, HubSpot, Cloudflare, Activision, Pure Storage, and the ongoing Marks & Spencer, Co-op, and Harrods incidents.",{"data":22433,"content":22434,"nodeType":866},{},[22435,22439,22446,22449,22456],{"data":22436,"marks":22437,"value":22438,"nodeType":865},{},[],"Scattered Spider shares similar characteristics and TTPs with a number of named threat groups such as ",{"data":22440,"content":22441,"nodeType":905},{"uri":18922},[22442],{"data":22443,"marks":22444,"value":18928,"nodeType":865},{},[22445],{"type":1070},{"data":22447,"marks":22448,"value":1454,"nodeType":865},{},[],{"data":22450,"content":22451,"nodeType":905},{"uri":933},[22452],{"data":22453,"marks":22454,"value":1071,"nodeType":865},{},[22455],{"type":1070},{"data":22457,"marks":22458,"value":22459,"nodeType":865},{},[]," (behind the Snowflake attacks in 2024).",{"data":22461,"content":22465,"nodeType":875},{"target":22462},{"sys":22463},{"id":22464,"type":872,"linkType":873},"4sgT2Jw3iODUTdG2oPOrFC",[],{"data":22467,"content":22468,"nodeType":2315},{},[22469],{"data":22470,"marks":22471,"value":22473,"nodeType":865},{},[22472],{"type":887},"Case study: MGM Resorts",{"data":22475,"content":22476,"nodeType":866},{},[22477,22481,22488,22492,22499],{"data":22478,"marks":22479,"value":22480,"nodeType":865},{},[],"One of Scattered Spider’s most notorious and well-documented attacks was that affecting ",{"data":22482,"content":22483,"nodeType":905},{"uri":20053},[22484],{"data":22485,"marks":22486,"value":20059,"nodeType":865},{},[22487],{"type":1070},{"data":22489,"marks":22490,"value":22491,"nodeType":865},{},[],". Scattered Spider socially engineered MGM Resorts helpdesk personnel bypass MFA and log into accounts for which they had acquired valid login credentials for via credential phishing and historical infostealer compromises. They specifically targeted accounts with Super Administrator privileges within MGM Resorts’ Okta tenant, which they then used to register a second, attacker-controlled IdP via ",{"data":22493,"content":22494,"nodeType":905},{"uri":10111},[22495],{"data":22496,"marks":22497,"value":10117,"nodeType":865},{},[22498],{"type":1070},{"data":22500,"marks":22501,"value":22502,"nodeType":865},{},[],", which enabled them to impersonate any user within the Okta tenant. This then enabled them to abuse SSO access to downstream apps and platforms from various accounts, culminating in deployment of ransomware to around 100 ESXi servers and data exfiltration. ",{"data":22504,"content":22505,"nodeType":866},{},[22506,22510,22515,22519,22524,22528,22533,22537,22542],{"data":22507,"marks":22508,"value":22509,"nodeType":865},{},[],"The breach resulted in a ",{"data":22511,"marks":22512,"value":22514,"nodeType":865},{},[22513],{"type":887},"36-hour outage",{"data":22516,"marks":22517,"value":22518,"nodeType":865},{},[],", a ",{"data":22520,"marks":22521,"value":22523,"nodeType":865},{},[22522],{"type":887},"$100M ",{"data":22525,"marks":22526,"value":22527,"nodeType":865},{},[],"hit to its Q3 results, one-time cyber consulting fees in the region of ",{"data":22529,"marks":22530,"value":22532,"nodeType":865},{},[22531],{"type":887},"$10M",{"data":22534,"marks":22535,"value":22536,"nodeType":865},{},[],", and a class-action lawsuit later settled for ",{"data":22538,"marks":22539,"value":22541,"nodeType":865},{},[22540],{"type":887},"$45M",{"data":22543,"marks":22544,"value":1711,"nodeType":865},{},[],{"data":22546,"content":22550,"nodeType":875},{"target":22547},{"sys":22548},{"id":22549,"type":872,"linkType":873},"2vYvBXqFeKt7Ix0Ynh8cZu",[],{"data":22552,"content":22553,"nodeType":2315},{},[22554],{"data":22555,"marks":22556,"value":22558,"nodeType":865},{},[22557],{"type":887},"Case Study: Snowflake",{"data":22560,"content":22561,"nodeType":866},{},[22562,22566,22573],{"data":22563,"marks":22564,"value":22565,"nodeType":865},{},[],"Members of Scattered Spider have been affiliated with ShinyHunters, the group behind the ",{"data":22567,"content":22568,"nodeType":905},{"uri":933},[22569],{"data":22570,"marks":22571,"value":22572,"nodeType":865},{},[],"Snowflake breaches in mid-2024",{"data":22574,"marks":22575,"value":22576,"nodeType":865},{},[],". ShinyHunters associates targeted ~165 organizations that were subjected to account takeover attacks using stolen credentials harvested from historical infostealer infections dating back as far as 2020, according to Mandiant’s investigation. In total, 9 public victims were named following the breach, collectively impacting hundreds of millions of people. Snowflake was a watershed moment that signalled the significant opportunity presented by identity attacks on cloud services. It demonstrated how comparatively unsophisticated methods (logging in to user accounts with stolen credentials and dumping the data) can have the same or greater impact as a traditional network or endpoint based cyber attack involving vulnerability exploitation, malware deployment, ransomware, etc.",{"data":22578,"content":22582,"nodeType":875},{"target":22579},{"sys":22580},{"id":22581,"type":872,"linkType":873},"49nJMPQjQ37Mfr2yWA56P3",[],{"data":22584,"content":22585,"nodeType":879},{},[],{"data":22587,"content":22588,"nodeType":889},{},[22589],{"data":22590,"marks":22591,"value":22593,"nodeType":865},{},[22592],{"type":887},"Arrests haven’t slowed Scattered Spider",{"data":22595,"content":22596,"nodeType":866},{},[22597],{"data":22598,"marks":22599,"value":22600,"nodeType":865},{},[],"In late 2024 following the Transport for London attacks (which resulted in prolonged disruption to key online services underpinning London’s public transport network, theft of 5,000 users bank details, and all 30,000 staff members having to reset their online credentials in person) a series of arrests were made in the UK and USA. ",{"data":22602,"content":22606,"nodeType":875},{"target":22603},{"sys":22604},{"id":22605,"type":872,"linkType":873},"2X2nyhO2hOqm9f0Le4lDC5",[],{"data":22608,"content":22609,"nodeType":866},{},[22610,22614,22622,22625,22632,22635,22644],{"data":22611,"marks":22612,"value":22613,"nodeType":865},{},[],"However, this doesn’t seem to have impacted Scattered Spider’s ability to operate, with the ongoing campaign against UK retail companies including ",{"data":22615,"content":22617,"nodeType":905},{"uri":22616},"https://www.bleepingcomputer.com/news/security/marks-and-spencer-breach-linked-to-scattered-spider-ransomware-attack/",[22618],{"data":22619,"marks":22620,"value":18639,"nodeType":865},{},[22621],{"type":1070},{"data":22623,"marks":22624,"value":7148,"nodeType":865},{},[],{"data":22626,"content":22627,"nodeType":905},{"uri":18645},[22628],{"data":22629,"marks":22630,"value":18651,"nodeType":865},{},[22631],{"type":1070},{"data":22633,"marks":22634,"value":1454,"nodeType":865},{},[],{"data":22636,"content":22638,"nodeType":905},{"uri":22637},"https://www.bleepingcomputer.com/news/security/harrods-the-next-uk-retailer-targeted-in-a-cyberattack/",[22639],{"data":22640,"marks":22641,"value":22643,"nodeType":865},{},[22642],{"type":1070},"Harrods",{"data":22645,"marks":22646,"value":22647,"nodeType":865},{},[]," being strongly linked to Scattered Spider. Beginning on Easter weekend, the Marks and Spencer attack has had the biggest impact so far, resulting in severe disruption to the retailer with agency staff told not to come into work, online shopping services being taken offline, stores running low on products, £300M in lost profits, and almost £1B wiped off the company’s stock market valuation at one stage. ",{"data":22649,"content":22650,"nodeType":866},{},[22651,22654,22661,22664,22671,22674,22681,22684,22691,22694,22701,22704,22711,22714,22721,22725,22731,22734,22740,22743,22749,22752,22758,22761,22767,22770,22776],{"data":22652,"marks":22653,"value":18662,"nodeType":865},{},[],{"data":22655,"content":22656,"nodeType":905},{"uri":18665},[22657],{"data":22658,"marks":22659,"value":18671,"nodeType":865},{},[22660],{"type":1070},{"data":22662,"marks":22663,"value":7148,"nodeType":865},{},[],{"data":22665,"content":22666,"nodeType":905},{"uri":18677},[22667],{"data":22668,"marks":22669,"value":18683,"nodeType":865},{},[22670],{"type":1070},{"data":22672,"marks":22673,"value":7148,"nodeType":865},{},[],{"data":22675,"content":22676,"nodeType":905},{"uri":18689},[22677],{"data":22678,"marks":22679,"value":18695,"nodeType":865},{},[22680],{"type":1070},{"data":22682,"marks":22683,"value":7148,"nodeType":865},{},[],{"data":22685,"content":22686,"nodeType":905},{"uri":18701},[22687],{"data":22688,"marks":22689,"value":18707,"nodeType":865},{},[22690],{"type":1070},{"data":22692,"marks":22693,"value":7148,"nodeType":865},{},[],{"data":22695,"content":22696,"nodeType":905},{"uri":18713},[22697],{"data":22698,"marks":22699,"value":18719,"nodeType":865},{},[22700],{"type":1070},{"data":22702,"marks":22703,"value":7148,"nodeType":865},{},[],{"data":22705,"content":22706,"nodeType":905},{"uri":18725},[22707],{"data":22708,"marks":22709,"value":18731,"nodeType":865},{},[22710],{"type":1070},{"data":22712,"marks":22713,"value":1454,"nodeType":865},{},[],{"data":22715,"content":22716,"nodeType":905},{"uri":18737},[22717],{"data":22718,"marks":22719,"value":18743,"nodeType":865},{},[22720],{"type":1070},{"data":22722,"marks":22723,"value":22724,"nodeType":865},{},[]," were among the retailers to suffer a breach between May-June 2025. More recently, Scattered Spider has targeted U.S. insurance giant ",{"data":22726,"content":22727,"nodeType":905},{"uri":18462},[22728],{"data":22729,"marks":22730,"value":18468,"nodeType":865},{},[],{"data":22732,"marks":22733,"value":7148,"nodeType":865},{},[],{"data":22735,"content":22736,"nodeType":905},{"uri":18474},[22737],{"data":22738,"marks":22739,"value":18480,"nodeType":865},{},[],{"data":22741,"marks":22742,"value":7148,"nodeType":865},{},[],{"data":22744,"content":22745,"nodeType":905},{"uri":18486},[22746],{"data":22747,"marks":22748,"value":18492,"nodeType":865},{},[],{"data":22750,"marks":22751,"value":7148,"nodeType":865},{},[],{"data":22753,"content":22754,"nodeType":905},{"uri":18510},[22755],{"data":22756,"marks":22757,"value":18515,"nodeType":865},{},[],{"data":22759,"marks":22760,"value":7148,"nodeType":865},{},[],{"data":22762,"content":22763,"nodeType":905},{"uri":18510},[22764],{"data":22765,"marks":22766,"value":18525,"nodeType":865},{},[],{"data":22768,"marks":22769,"value":1454,"nodeType":865},{},[],{"data":22771,"content":22772,"nodeType":905},{"uri":18499},[22773],{"data":22774,"marks":22775,"value":18504,"nodeType":865},{},[],{"data":22777,"marks":22778,"value":1193,"nodeType":865},{},[],{"data":22780,"content":22781,"nodeType":879},{},[],{"data":22783,"content":22784,"nodeType":889},{},[22785],{"data":22786,"marks":22787,"value":22789,"nodeType":865},{},[22788],{"type":887},"Scattered Spider TTP analysis",{"data":22791,"content":22792,"nodeType":866},{},[22793],{"data":22794,"marks":22795,"value":22796,"nodeType":865},{},[],"Along with a clear MO (financial gain via data exfiltration and extortion) Scattered Spider has demonstrated a pattern of go-to TTPs over recent years. ",{"data":22798,"content":22799,"nodeType":2315},{},[22800],{"data":22801,"marks":22802,"value":22804,"nodeType":865},{},[22803],{"type":887},"Social engineering, help desk scams, and SIM swapping",{"data":22806,"content":22807,"nodeType":866},{},[22808,22812,22821,22824,22832],{"data":22809,"marks":22810,"value":22811,"nodeType":865},{},[],"The public breaches associated with Scattered Spider have predominantly featured social engineering heavy initial access, mainly through help desk scams where the attacker contacts support personnel specifically to bypass MFA for accounts where they have acquired valid credentials via credential phishing or infostealers, but cannot access the account due the additional layer of protection. They have similarly used ",{"data":22813,"content":22815,"nodeType":905},{"uri":22814},"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-sms-phishing-sim-swapping-ransomware/",[22816],{"data":22817,"marks":22818,"value":22820,"nodeType":865},{},[22819],{"type":1070},"SIM swapping, smishing",{"data":22822,"marks":22823,"value":7651,"nodeType":865},{},[],{"data":22825,"content":22826,"nodeType":905},{"uri":9903},[22827],{"data":22828,"marks":22829,"value":22831,"nodeType":865},{},[22830],{"type":1070},"MFA fatigue/push bombing",{"data":22833,"marks":22834,"value":22835,"nodeType":865},{},[]," to achieve account takeover.",{"data":22837,"content":22841,"nodeType":875},{"target":22838},{"sys":22839},{"id":22840,"type":872,"linkType":873},"2Z7qnaK4LXRhnQDvPT2ZXe",[],{"data":22843,"content":22844,"nodeType":2315},{},[22845],{"data":22846,"marks":22847,"value":22849,"nodeType":865},{},[22848],{"type":887},"Impersonating and targeting SaaS services",{"data":22851,"content":22852,"nodeType":866},{},[22853,22857,22866],{"data":22854,"marks":22855,"value":22856,"nodeType":865},{},[],"Scattered Spider have also been known to ",{"data":22858,"content":22860,"nodeType":905},{"uri":22859},"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications",[22861],{"data":22862,"marks":22863,"value":22865,"nodeType":865},{},[22864],{"type":1070},"target SaaS applications and cloud services",{"data":22867,"marks":22868,"value":22869,"nodeType":865},{},[]," — both as part of their phishing strategies by impersonating app providers, as well as in their lateral movement and exploitation when an identity has been compromised. This has included applications such as vCenter, CyberArk, SalesForce, Azure, CrowdStrike, AWS, and GCP. ",{"data":22871,"content":22872,"nodeType":866},{},[22873],{"data":22874,"marks":22875,"value":22876,"nodeType":865},{},[],"When conducting phishing campaigns, they’ve created custom domains for their phishing sites based on the organizations they are targeting: ",{"data":22878,"content":22882,"nodeType":875},{"target":22879},{"sys":22880},{"id":22881,"type":872,"linkType":873},"3ufdtfyJpZ4FUWbKR2yNNm",[],{"data":22884,"content":22885,"nodeType":866},{},[22886],{"data":22887,"marks":22888,"value":22889,"nodeType":865},{},[],"And they have impersonated many software brands — either as targets themselves, or as convincing third-parties to lure their targets to interact with. ",{"data":22891,"content":22895,"nodeType":875},{"target":22892},{"sys":22893},{"id":22894,"type":872,"linkType":873},"XgrG1qKwXrpd399BwkHiR",[],{"data":22897,"content":22898,"nodeType":866},{},[22899,22903,22912],{"data":22900,"marks":22901,"value":22902,"nodeType":865},{},[],"(Shout out to the excellent analysis by the folks at ",{"data":22904,"content":22906,"nodeType":905},{"uri":22905},"https://www.silentpush.com/blog/scattered-spider-2025/#h-new-scattered-spider-ttps-for-2025",[22907],{"data":22908,"marks":22909,"value":22911,"nodeType":865},{},[22910],{"type":1070},"Silent Push",{"data":22913,"marks":22914,"value":11843,"nodeType":865},{},[],{"data":22916,"content":22917,"nodeType":2315},{},[22918],{"data":22919,"marks":22920,"value":22922,"nodeType":865},{},[22921],{"type":887},"Targeting identity providers to abuse OAuth and SSO",{"data":22924,"content":22925,"nodeType":866},{},[22926,22930,22937],{"data":22927,"marks":22928,"value":22929,"nodeType":865},{},[],"A key part of this approach is abusing OAuth by targeting identity providers (IdPs) such as Okta and Microsoft Entra. By compromising IdP accounts with administrator privileges, Scattered Spider has leveraged techniques such as ",{"data":22931,"content":22932,"nodeType":905},{"uri":10111},[22933],{"data":22934,"marks":22935,"value":10117,"nodeType":865},{},[22936],{"type":1070},{"data":22938,"marks":22939,"value":22940,"nodeType":865},{},[]," to gain unrestricted access to the identities within the target IdP tenant (the equivalent of a full Active Directory compromise on-premise).",{"data":22942,"content":22943,"nodeType":2315},{},[22944],{"data":22945,"marks":22946,"value":22948,"nodeType":865},{},[22947],{"type":887},"Encryption of cloud servers and data theft for extortion",{"data":22950,"content":22951,"nodeType":866},{},[22952],{"data":22953,"marks":22954,"value":22955,"nodeType":865},{},[],"When executing the final stages of an attack, Scattered Spider first exfiltrates data through a variety of methods, even using SaaS services such as DropBox and FiveTran to extract copies of high-value service databases, such as SalesForce and ZenDesk, using API connectors. ",{"data":22957,"content":22958,"nodeType":866},{},[22959],{"data":22960,"marks":22961,"value":22962,"nodeType":865},{},[],"In a typical \"double-extortion\" style, they then deploy ransomware by targeting cloud server environments such as VMWare ESXi (specifically to avoid security tools by targeting the hypervisor layer). Scattered Spider have been known to act as affiliates for various ransomware operations, including RansomHub, Qilin, and DragonForce.",{"data":22964,"content":22965,"nodeType":879},{},[],{"data":22967,"content":22968,"nodeType":889},{},[22969],{"data":22970,"marks":22971,"value":22973,"nodeType":865},{},[22972],{"type":887},"Scattered Spider TTP evolution in 2025",{"data":22975,"content":22976,"nodeType":866},{},[22977],{"data":22978,"marks":22979,"value":22980,"nodeType":865},{},[],"In 2025, security researchers have observed a significant increase in Scattered Spider phishing activity, particularly in the form of MFA-bypassing Attacker-in-the-Middle (AiTM) phishing pages. ",{"data":22982,"content":22986,"nodeType":875},{"target":22983},{"sys":22984},{"id":22985,"type":872,"linkType":873},"2jH5TrpHueIE8qpU3lunJi",[],{"data":22988,"content":22989,"nodeType":866},{},[22990],{"data":22991,"marks":22992,"value":22993,"nodeType":865},{},[],"Along with this shift, a number of TTPs have been observed relating to detection evasion measures implemented on these phishing pages.",{"data":22995,"content":22996,"nodeType":2315},{},[22997],{"data":22998,"marks":22999,"value":23001,"nodeType":865},{},[23000],{"type":887},"Rapid phishing domain rotation",{"data":23003,"content":23004,"nodeType":866},{},[23005,23008,23016],{"data":23006,"marks":23007,"value":21,"nodeType":865},{},[],{"data":23009,"content":23010,"nodeType":905},{"uri":22905},[23011],{"data":23012,"marks":23013,"value":23015,"nodeType":865},{},[23014],{"type":1070},"According to researchers",{"data":23017,"marks":23018,"value":23019,"nodeType":865},{},[]," Scattered Spider have been observed using phishing pages hosted on short-lived domains that included specific keywords such as “okta,” “sso,” “help,” “hr,” “corp,” “my,” “internal,” “sso,” or “vpn,”, which were quickly operationalized within minutes of registering a domain. After a couple of hours, the domain would often be taken down by the registrar. However, as we’ve discussed in various blog posts, this is to be expected. Domains are highly disposable by nature and attackers plan to get through them in large numbers. They don’t need their phishing pages to live indefinitely — just as long as it takes for someone to be successfully phished.",{"data":23021,"content":23022,"nodeType":866},{},[23023],{"data":23024,"marks":23025,"value":23026,"nodeType":865},{},[],"You would expect these kinds of untrusted links to be flagged by enterprise security tools, but through clever use of obfuscation methods such as using legitimate apps to host the phishing link, using an initially benign link to a document or other source with the malicious link, or avoiding email as the delivery vector altogether, network and email-based controls are being routinely bypassed.  ",{"data":23028,"content":23032,"nodeType":875},{"target":23029},{"sys":23030},{"id":23031,"type":872,"linkType":873},"2DviJNOMbKgbcqwkNl0LDP",[],{"data":23034,"content":23035,"nodeType":2315},{},[23036],{"data":23037,"marks":23038,"value":23040,"nodeType":865},{},[23039],{"type":887},"Using custom subdomains that allow public registrations",{"data":23042,"content":23043,"nodeType":866},{},[23044],{"data":23045,"marks":23046,"value":23047,"nodeType":865},{},[],"Scattered Spider have been observed registering their malicious domains on publicly rentable subdomains such as it[.]com. This limits the information that can be gathered about the domain (for example, preventing WHOIS information from being accessed) ",{"data":23049,"content":23050,"nodeType":866},{},[23051],{"data":23052,"marks":23053,"value":23054,"nodeType":865},{},[],"This is incredibly deceptive to the user and will fool many people glancing at the link. It doesn’t look as obviously suspicious as the typical .xyz or .biz, and has the feel of a legitimate domain. As these convincing rentable subdomains start to appear online more frequently, it becomes easier for attackers to pick up convincing domain names with fewer obvious deviations from the real one, without needing to resort to special characters or other tactics that might be spotted. ",{"data":23056,"content":23057,"nodeType":866},{},[23058,23062,23070,23074,23083],{"data":23059,"marks":23060,"value":23061,"nodeType":865},{},[],"This is strikingly similar ",{"data":23063,"content":23064,"nodeType":905},{"uri":13115},[23065],{"data":23066,"marks":23067,"value":23069,"nodeType":865},{},[23068],{"type":1070},"to an attack we investigated recently",{"data":23071,"marks":23072,"value":23073,"nodeType":865},{},[],", where an attacker was using the us[.]com domain to impersonate Onfido, the digital identity platform. These malicious links were actually distributed via malicious advertising on Google, which is an increasingly popular tactic ",{"data":23075,"content":23077,"nodeType":905},{"uri":23076},"https://pushsecurity.com/blog/why-most-phishing-attacks-feel-like-a-zero-day/",[23078],{"data":23079,"marks":23080,"value":23082,"nodeType":865},{},[23081],{"type":1070},"to evade email and network detection controls",{"data":23084,"marks":23085,"value":23086,"nodeType":865},{},[]," for phishing links and pages. ",{"data":23088,"content":23092,"nodeType":875},{"target":23089},{"sys":23090},{"id":23091,"type":872,"linkType":873},"34ZpjuFhaSMC6MtjThQsnK",[],{"data":23094,"content":23095,"nodeType":866},{},[23096],{"data":23097,"marks":23098,"value":23099,"nodeType":865},{},[],"This comparison is also interesting when you consider…",{"data":23101,"content":23102,"nodeType":2315},{},[23103],{"data":23104,"marks":23105,"value":23107,"nodeType":865},{},[23106],{"type":887},"Using commercial AiTM toolkits like Evilginx to bypass MFA and evade detection",{"data":23109,"content":23110,"nodeType":866},{},[23111],{"data":23112,"marks":23113,"value":23114,"nodeType":865},{},[],"Scattered Spider have been observed frequently using Evilginx as their phishing kit of choice. Evilginx is a great choice for attackers looking to target non-standard web apps because it is capable of emulating a range of domains — it’s designed to be flexible and work for any page without generating a load of custom JavaScript that might stand out to security tools/analysts. See an example of Evilginx being used to phish a user below.",{"data":23116,"content":23120,"nodeType":875},{"target":23117},{"sys":23118},{"id":23119,"type":872,"linkType":873},"7IuP0mcRZJkL8YGNoZo5Dj",[],{"data":23122,"content":23123,"nodeType":866},{},[23124,23128,23137,23141,23148],{"data":23125,"marks":23126,"value":23127,"nodeType":865},{},[],"By default, Evilginx redirects any site visitor not following the correct url path or supplying the correct parameters to the YouTube video for Rick Astley’s “Never Gonna Give You Up” (aka “Rickrolling”). This behavior has been observed on Scattered Spider phishing sites. Interestingly, we also observed this in the Onfido malvertising example above, ",{"data":23129,"content":23131,"nodeType":905},{"uri":23130},"https://www.linkedin.com/feed/update/urn:li:activity:7323102794813505536?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7323102794813505536%2C7323308731813814272%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287323308731813814272%2Curn%3Ali%3Aactivity%3A7323102794813505536%29",[23132],{"data":23133,"marks":23134,"value":23136,"nodeType":865},{},[23135],{"type":1070},"while members of the infosec community",{"data":23138,"marks":23139,"value":23140,"nodeType":865},{},[]," are increasingly seeing phishing attacks with this behavior. (This example also features use of ",{"data":23142,"content":23143,"nodeType":905},{"uri":13344},[23144],{"data":23145,"marks":23146,"value":7647,"nodeType":865},{},[23147],{"type":1070},{"data":23149,"marks":23150,"value":23151,"nodeType":865},{},[]," to prevent analysis of the malicious link by hiding it behind a legit Microsoft app consent page, another detection evasion tactic). ",{"data":23153,"content":23154,"nodeType":2315},{},[23155],{"data":23156,"marks":23157,"value":23159,"nodeType":865},{},[23158],{"type":887},"Pre-populating victim information using targeted phishing links",{"data":23161,"content":23162,"nodeType":866},{},[23163,23167,23176],{"data":23164,"marks":23165,"value":23166,"nodeType":865},{},[],"A general trend that we’re seeing in the wild, also utilized by Scattered Spider, is phishing attacks becoming increasingly targeted. This includes using redirects to legitimate apps unless specific parameters are supplied, ",{"data":23168,"content":23170,"nodeType":905},{"uri":23169},"https://www.bleepingcomputer.com/news/security/phishing-kits-now-vet-victims-in-real-time-before-stealing-credentials/",[23171],{"data":23172,"marks":23173,"value":23175,"nodeType":865},{},[23174],{"type":1070},"only loading malicious content for specific usernames",{"data":23177,"marks":23178,"value":23179,"nodeType":865},{},[]," (and redirecting to benign sites otherwise) implementing the use of one-time phishing links (essentially magic links that work once for the victim, preventing security teams or tools from accessing the page to analyse it later), and pre-populating the victim information on the page to make it feel more genuine (you would expect a website you have visited and logged into before to pre-populate some of your details, like your username/email). ",{"data":23181,"content":23182,"nodeType":866},{},[23183],{"data":23184,"marks":23185,"value":23186,"nodeType":865},{},[],"See an example of this (along with a few of the detection evasion techniques we've mentioned) below. ",{"data":23188,"content":23192,"nodeType":875},{"target":23189},{"sys":23190},{"id":23191,"type":872,"linkType":873},"1zn1G6CutY0HBkXHUIo159",[],{"data":23194,"content":23195,"nodeType":2315},{},[23196],{"data":23197,"marks":23198,"value":23200,"nodeType":865},{},[23199],{"type":887},"Varying login pages to evade cloned page detections",{"data":23202,"content":23203,"nodeType":866},{},[23204,23208,23217],{"data":23205,"marks":23206,"value":23207,"nodeType":865},{},[],"Attackers are routinely using a ",{"data":23209,"content":23211,"nodeType":905},{"uri":23210},"https://pushsecurity.com/blog/how-aitm-phishing-kits-evade-detection-p2/",[23212],{"data":23213,"marks":23214,"value":23216,"nodeType":865},{},[23215],{"type":1070},"combination of visual and DOM-based obfuscation techniques",{"data":23218,"marks":23219,"value":23220,"nodeType":865},{},[]," to create convincing phishing pages that are different enough from the real page being impersonated so that detections based on cloned pages do not fire. ",{"data":23222,"content":23223,"nodeType":866},{},[23224],{"data":23225,"marks":23226,"value":23227,"nodeType":865},{},[],"While Okta accounts remain a key target for Scattered Spider, they are using a range of customized landing pages to target Okta accounts for various organizations at URLs like:",{"data":23229,"content":23230,"nodeType":2718},{},[23231,23241,23251,23261,23271,23281],{"data":23232,"content":23233,"nodeType":2654},{},[23234],{"data":23235,"content":23236,"nodeType":866},{},[23237],{"data":23238,"marks":23239,"value":23240,"nodeType":865},{},[],"corp-hubspot[.]com – HubSpot",{"data":23242,"content":23243,"nodeType":2654},{},[23244],{"data":23245,"content":23246,"nodeType":866},{},[23247],{"data":23248,"marks":23249,"value":23250,"nodeType":865},{},[],"morningstar-okta[.]com – Morningstar",{"data":23252,"content":23253,"nodeType":2654},{},[23254],{"data":23255,"content":23256,"nodeType":866},{},[23257],{"data":23258,"marks":23259,"value":23260,"nodeType":865},{},[],"pure-okta[.]com – Pure Storage",{"data":23262,"content":23263,"nodeType":2654},{},[23264],{"data":23265,"content":23266,"nodeType":866},{},[23267],{"data":23268,"marks":23269,"value":23270,"nodeType":865},{},[],"signin-nydig[.]com – New York Digital Investment Group",{"data":23272,"content":23273,"nodeType":2654},{},[23274],{"data":23275,"content":23276,"nodeType":866},{},[23277],{"data":23278,"marks":23279,"value":23280,"nodeType":865},{},[],"sso-instacart[.]com – Instacart",{"data":23282,"content":23283,"nodeType":2654},{},[23284],{"data":23285,"content":23286,"nodeType":866},{},[23287],{"data":23288,"marks":23289,"value":23290,"nodeType":865},{},[],"sts-vodafone[.]com – Vodafone",{"data":23292,"content":23296,"nodeType":875},{"target":23293},{"sys":23294},{"id":23295,"type":872,"linkType":873},"38EyQfvJWcqHukYq8rm8ap",[],{"data":23298,"content":23299,"nodeType":879},{},[],{"data":23301,"content":23302,"nodeType":889},{},[23303],{"data":23304,"marks":23305,"value":23307,"nodeType":865},{},[23306],{"type":887},"Defend your organization from Scattered Spider",{"data":23309,"content":23310,"nodeType":866},{},[23311],{"data":23312,"marks":23313,"value":23314,"nodeType":865},{},[],"Scattered Spider have proven to be a highly creative and adaptable threat group, using a range of identity-centric TTPs and evolving (or rather, adding to) their repertoire over time. ",{"data":23316,"content":23317,"nodeType":866},{},[23318],{"data":23319,"marks":23320,"value":23321,"nodeType":865},{},[],"Although Scattered Spider have a number of telltale actions and behaviors, like targeting and leveraging SaaS services, utilizing AiTM phishing kits like Evilginx to target IdP accounts like Okta, and deploying ransomware to cloud servers, they are able to flex their approach to take down their targets. ",{"data":23323,"content":23324,"nodeType":866},{},[23325,23329,23338,23342,23350],{"data":23326,"marks":23327,"value":23328,"nodeType":865},{},[],"Scattered Spider’s behavior demonstrates that they are extremely ",{"data":23330,"content":23332,"nodeType":905},{"uri":23331},"https://www.crowdstrike.com/en-us/resources/crowdcasts/cloud-threat-summit/",[23333],{"data":23334,"marks":23335,"value":23337,"nodeType":865},{},[23336],{"type":1070},"cloud-conscious",{"data":23339,"marks":23340,"value":23341,"nodeType":865},{},[]," (as many modern threat actors are) and are leveraging modern TTPs designed to evade traditional security controls and exploit blind-spots in enterprise security visibility. For example, by constantly rotating their phishing domains and pages, Scattered Spider (and many threat actors like them) are routinely evading common phishing detection controls, taking advantage of the limitations of ",{"data":23343,"content":23344,"nodeType":905},{"uri":23076},[23345],{"data":23346,"marks":23347,"value":23349,"nodeType":865},{},[23348],{"type":1070},"blocklist-driven approaches to phishing detection",{"data":23351,"marks":23352,"value":1711,"nodeType":865},{},[],{"data":23354,"content":23355,"nodeType":879},{},[],{"data":23357,"content":23358,"nodeType":889},{},[23359],{"data":23360,"marks":23361,"value":23363,"nodeType":865},{},[23362],{"type":887},"Aligning Push Security’s capabilities against Scattered Spider’s TTPs",{"data":23365,"content":23366,"nodeType":866},{},[23367],{"data":23368,"marks":23369,"value":23371,"nodeType":865},{},[23370],{"type":887},"Push provides a multi-layered set of detections and controls for defending against the TTPs known to be used by Scattered Spider. ",{"data":23373,"content":23377,"nodeType":875},{"target":23374},{"sys":23375},{"id":23376,"type":872,"linkType":873},"6aB3mLLXZIhrlyuCx2hOzY",[],{"data":23379,"content":23380,"nodeType":2315},{},[23381],{"data":23382,"marks":23383,"value":23384,"nodeType":865},{},[],"Detect and block AiTM phishing toolkits",{"data":23386,"content":23387,"nodeType":866},{},[23388],{"data":23389,"marks":23390,"value":23392,"nodeType":865},{},[23391],{"type":887},"The Push browser agent will detect when employees visit websites running MFA-bypassing phishing toolkits such as Evilginx. ",{"data":23394,"content":23398,"nodeType":875},{"target":23395},{"sys":23396},{"id":23397,"type":872,"linkType":873},"I19TQYItDFlaOgisrST6P",[],{"data":23400,"content":23401,"nodeType":866},{},[23402],{"data":23403,"marks":23404,"value":23405,"nodeType":865},{},[],"The Push browser agent analyzes the behavioral attributes of phishing tools, e.g. “something the toolkit does” vs. just a static signature like a URL path or domain.",{"data":23407,"content":23408,"nodeType":866},{},[23409],{"data":23410,"marks":23411,"value":23412,"nodeType":865},{},[],"Based on your configuration, Push can then warn or block employees from accessing those phishing sites using a customisable blocking page or banner.",{"data":23414,"content":23418,"nodeType":875},{"target":23415},{"sys":23416},{"id":23417,"type":872,"linkType":873},"4ixcEsEW4EyqckOTmP5Pbb",[],{"data":23420,"content":23421,"nodeType":2315},{},[23422],{"data":23423,"marks":23424,"value":23425,"nodeType":865},{},[],"Detect cloned login pages",{"data":23427,"content":23428,"nodeType":866},{},[23429],{"data":23430,"marks":23431,"value":23433,"nodeType":865},{},[23432],{"type":887},"The Push browser agent will detect when employees visit websites using cloned login screens to steal credentials - i.e. a cloned Okta login page.",{"data":23435,"content":23436,"nodeType":866},{},[23437],{"data":23438,"marks":23439,"value":23440,"nodeType":865},{},[],"Push does this by fingerprinting the page structure and resources of your legitimate login pages and monitoring for pages that are very similar.",{"data":23442,"content":23443,"nodeType":866},{},[23444],{"data":23445,"marks":23446,"value":23447,"nodeType":865},{},[],"Push will then emit a webhook event when it detects that an employee has visited a page that appears to be a clone of a legitimate login page.",{"data":23449,"content":23450,"nodeType":2315},{},[23451],{"data":23452,"marks":23453,"value":23454,"nodeType":865},{},[],"Pin your sensitive passwords to specific sites",{"data":23456,"content":23457,"nodeType":866},{},[23458,23463,23469],{"data":23459,"marks":23460,"value":23462,"nodeType":865},{},[23461],{"type":887},"The Push browser agent will detect when employees attempt to enter their IdP password (such as Okta) into webpages that ",{"data":23464,"marks":23465,"value":23468,"nodeType":865},{},[23466,23467],{"type":1070},{"type":887},"do not",{"data":23470,"marks":23471,"value":23473,"nodeType":865},{},[23472],{"type":887}," belong to that IdP.",{"data":23475,"content":23476,"nodeType":866},{},[23477,23481,23489],{"data":23478,"marks":23479,"value":23480,"nodeType":865},{},[],"When observing logins, the Push browser agent generates a salted partial hash of the user’s password, known as a fingerprint. This fingerprint is then stored locally in the browser to allow Push to perform password comparisons. You can read more about how the extension securely observes passwords in this ",{"data":23482,"content":23484,"nodeType":905},{"uri":23483},"https://pushsecurity.com/help/10065/#start",[23485],{"data":23486,"marks":23487,"value":14057,"nodeType":865},{},[23488],{"type":1070},{"data":23490,"marks":23491,"value":1193,"nodeType":865},{},[],{"data":23493,"content":23494,"nodeType":866},{},[23495],{"data":23496,"marks":23497,"value":23498,"nodeType":865},{},[],"To detect phishing attempts against Okta (and other identity providers), the Push browser agent compares the observed Okta password fingerprint to the known Okta fingerprint that already exists in local storage.",{"data":23500,"content":23501,"nodeType":866},{},[23502],{"data":23503,"marks":23504,"value":23505,"nodeType":865},{},[],"If an employee has entered their valid Okta password on a webpage that does not belong to Okta — i.e. a phishing page — Push will enforce the SSO password protection settings set by an administrator (block or warn). This serves as a second layer of defense when used in conjunction with AiTM and cloned login page detections. ",{"data":23507,"content":23511,"nodeType":875},{"target":23508},{"sys":23509},{"id":23510,"type":872,"linkType":873},"20FIoIyuQYxep3V4SFWdoK",[],{"data":23513,"content":23514,"nodeType":2315},{},[23515],{"data":23516,"marks":23517,"value":23518,"nodeType":865},{},[],"Detect compromised sessions",{"data":23520,"content":23521,"nodeType":866},{},[23522],{"data":23523,"marks":23524,"value":23526,"nodeType":865},{},[23525],{"type":887},"By correlating Push telemetry with Okta logs, Push can detect compromised Okta sessions originating from outside employees’ supported browsers. ",{"data":23528,"content":23529,"nodeType":866},{},[23530],{"data":23531,"marks":23532,"value":23533,"nodeType":865},{},[],"Using the Push browser agent, you can inject a unique marker into the User Agent string of Okta sessions that occur in browsers enrolled in Push.",{"data":23535,"content":23536,"nodeType":866},{},[23537],{"data":23538,"marks":23539,"value":23540,"nodeType":865},{},[],"By then comparing against Okta logs, you can identify sessions that both have the Push marker and those that lack the marker, the latter indicating the session is being used from a machine without the Push extension and therefore the session token may have been stolen.",{"data":23542,"content":23546,"nodeType":875},{"target":23543},{"sys":23544},{"id":23545,"type":872,"linkType":873},"1XNNkaoW64t3PPvC54KGXF",[],{"data":23548,"content":23549,"nodeType":2315},{},[23550],{"data":23551,"marks":23552,"value":23553,"nodeType":865},{},[],"Detect when employee credentials are stolen",{"data":23555,"content":23556,"nodeType":866},{},[23557],{"data":23558,"marks":23559,"value":23561,"nodeType":865},{},[23560],{"type":887},"Push will detect when valid credentials appear for sale on criminal forums. ",{"data":23563,"content":23564,"nodeType":866},{},[23565],{"data":23566,"marks":23567,"value":23568,"nodeType":865},{},[],"The Push platform detects valid, stolen credentials on criminal forums by ingesting threat intelligence data and then verifying which credentials flagged by TI sources are still being used by employees.",{"data":23570,"content":23571,"nodeType":866},{},[23572],{"data":23573,"marks":23574,"value":23575,"nodeType":865},{},[],"When suspected stolen credentials for the corporate domain are present, Push hashes and salts the passwords and then sends those fingerprints to the relevant browser agents for comparison. If the stolen credential fingerprint matches a known credential fingerprint observed to be in use by the Push browser agent, the platform returns a validated true positive alert.",{"data":23577,"content":23578,"nodeType":866},{},[23579],{"data":23580,"marks":23581,"value":23582,"nodeType":865},{},[],"You can choose to receive alerts for this detection via webhook, ChatOps notification, or in the Push admin console.",{"data":23584,"content":23588,"nodeType":875},{"target":23585},{"sys":23586},{"id":23587,"type":872,"linkType":873},"6wfLCTzvHeMzagyuEWGyJg",[],{"data":23590,"content":23591,"nodeType":2315},{},[23592],{"data":23593,"marks":23594,"value":23595,"nodeType":865},{},[],"Map login methods and remove ghost logins",{"data":23597,"content":23598,"nodeType":866},{},[23599],{"data":23600,"marks":23601,"value":23603,"nodeType":865},{},[23602],{"type":887},"Push maps all the identities used by employees to access workforce apps, including local, non-Okta identities. This data can be used to migrate more apps and accounts to Okta SSO and reduce the overall identity attack surface. ",{"data":23605,"content":23606,"nodeType":866},{},[23607],{"data":23608,"marks":23609,"value":23610,"nodeType":865},{},[],"The Push browser agent observes employees using their corporate identities to access work applications. Push customers gain accurate visibility across all Okta and non-Okta identities, the employees that are using them, the apps they are accessing and the authentication methods being used. ",{"data":23612,"content":23613,"nodeType":866},{},[23614,23618,23625],{"data":23615,"marks":23616,"value":23617,"nodeType":865},{},[],"Armed with this data, security teams can get more workforce apps and accounts behind SSO to reduce the overall identity attack surface, while removing any ",{"data":23619,"content":23620,"nodeType":905},{"uri":945},[23621],{"data":23622,"marks":23623,"value":950,"nodeType":865},{},[23624],{"type":1070},{"data":23626,"marks":23627,"value":23628,"nodeType":865},{},[]," that enable attackers to circumvent MFA by logging in directly to the app/page. ",{"data":23630,"content":23634,"nodeType":875},{"target":23631},{"sys":23632},{"id":23633,"type":872,"linkType":873},"dbDM075qSd4P3wnXuXX2Z",[],{"data":23636,"content":23637,"nodeType":2315},{},[23638],{"data":23639,"marks":23640,"value":23641,"nodeType":865},{},[],"Verify help desk caller identities with in-browser verification codes",{"data":23643,"content":23644,"nodeType":866},{},[23645,23648,23656],{"data":23646,"marks":23647,"value":19809,"nodeType":865},{},[],{"data":23649,"content":23650,"nodeType":905},{"uri":7281},[23651],{"data":23652,"marks":23653,"value":19118,"nodeType":865},{},[23654,23655],{"type":1070},{"type":887},{"data":23657,"marks":23658,"value":19122,"nodeType":865},{},[],{"data":23660,"content":23663,"nodeType":875},{"target":23661},{"sys":23662},{"id":7309,"type":872,"linkType":873},[],{"data":23665,"content":23666,"nodeType":866},{},[23667],{"data":23668,"marks":23669,"value":19134,"nodeType":865},{},[],{"data":23671,"content":23672,"nodeType":866},{},[23673,23676,23683],{"data":23674,"marks":23675,"value":19164,"nodeType":865},{},[],{"data":23677,"content":23678,"nodeType":905},{"uri":19304},[23679],{"data":23680,"marks":23681,"value":19854,"nodeType":865},{},[23682],{"type":1070},{"data":23684,"marks":23685,"value":19858,"nodeType":865},{},[],{"data":23687,"content":23690,"nodeType":875},{"target":23688},{"sys":23689},{"id":19200,"type":872,"linkType":873},[],{"data":23692,"content":23693,"nodeType":879},{},[],{"data":23695,"content":23696,"nodeType":889},{},[23697],{"data":23698,"marks":23699,"value":13420,"nodeType":865},{},[23700],{"type":887},{"data":23702,"content":23703,"nodeType":866},{},[23704],{"data":23705,"marks":23706,"value":23707,"nodeType":865},{},[],"It doesn’t stop there — Push provides comprehensive identity attack detection and response capabilities against techniques like credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more. ",{"data":23709,"content":23710,"nodeType":866},{},[23711,23714,23721],{"data":23712,"marks":23713,"value":13434,"nodeType":865},{},[],{"data":23715,"content":23717,"nodeType":905},{"uri":23716},"https://pushsecurity.com/demo?utm_campaign=12081956-FY25Q2_Hacker-News-Article&utm_source=thehackernews&utm_medium=sponsored&utm_content=external-article",[23718],{"data":23719,"marks":23720,"value":7352,"nodeType":865},{},[],{"data":23722,"marks":23723,"value":1193,"nodeType":865},{},[],"Scattered Spider: TTP evolution in 2025","How the notorious Scattered Spider cyber criminal group are switching up their TTPs in 2025 to bypass MFA and breach cloud services via account takeover.","2025-05-06T00:00:00.000Z","scattered-spider-ttp-evolution-in-2025",{"items":23729},[23730,23732],{"sys":23731,"name":2144},{"id":2143},{"sys":23733,"name":342},{"id":3008},{"items":23735},[23736],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":23737},{"url":3016},"blog/scattered-spider-defending-against-help-desk-scams",{"json":23740},{"data":23741,"content":23742,"nodeType":1522},{},[23743],{"data":23744,"content":23745,"nodeType":866},{},[23746],{"data":23747,"marks":23748,"value":23749,"nodeType":865},{},[],"Scattered Spider has dominated the headlines in recent months and has gained significant attention for its use of help desk scams. Here's how they work and what you can do to protect your organization. ",{"id":19317,"publishedAt":23751},"2026-08-12T11:54:03.755Z",{"items":23753},[23754,23756],{"sys":23755,"name":2144},{"id":2143},{"sys":23757,"name":342},{"id":3008},{"items":23759},[23760,23762,23764,23766,23768,23770,23772,23774,23776,23778,23780,23782,23784,23786,23788],{"sys":23761,"name":279,"slug":280,"tier":31},{"id":276},{"sys":23763,"name":413,"slug":414,"tier":31},{"id":410},{"sys":23765,"name":519,"slug":520,"tier":31},{"id":516},{"sys":23767,"name":642,"slug":643,"tier":31},{"id":639},{"sys":23769,"name":342,"slug":343,"tier":31},{"id":339},{"sys":23771,"name":650,"slug":651,"tier":45},{"id":647},{"sys":23773,"name":607,"slug":608,"tier":45},{"id":604},{"sys":23775,"name":466,"slug":467,"tier":45},{"id":463},{"sys":23777,"name":261,"slug":262,"tier":45},{"id":258},{"sys":23779,"name":324,"slug":325,"tier":45},{"id":321},{"sys":23781,"name":404,"slug":405,"tier":45},{"id":401},{"sys":23783,"name":571,"slug":572,"tier":45},{"id":568},{"sys":23785,"name":457,"slug":458,"tier":45},{"id":454},{"sys":23787,"name":537,"slug":538,"tier":45},{"id":534},{"sys":23789,"name":502,"slug":503,"tier":45},{"id":499},"yjH55ZXCaQvQjWDumXOTsjiEZ1Fw112-VkrcDK6-4V0",{"id":23792,"title":23724,"authorsCollection":23793,"content":23798,"extension":228,"faqItemsCollection":25224,"faqTitle":59,"featured":6,"hashTags":59,"meta":25226,"metaTitle":25227,"ogImage":25228,"postType":7494,"publishedDate":23726,"relatedBlogPostsCollection":25229,"slug":23727,"stem":26789,"subtitle":59,"summary":26790,"synopsis":23725,"sys":26801,"tagsCollection":26803,"topicsCollection":26809,"__hash__":26859},"blog/blog/scattered-spider-ttp-evolution-in-2025.json",{"items":23794},[23795],{"fullName":3012,"firstName":3013,"jobTitle":3014,"socialLinks":23796,"profilePicture":23797},[6742],{"url":3016},{"json":23799,"links":24957},{"data":23800,"content":23801,"nodeType":1522},{},[23802,23807,23814,23820,23846,23851,23858,23884,23918,23923,23930,23945,23950,23953,23960,23966,23971,24007,24137,24140,24147,24153,24160,24186,24191,24198,24214,24220,24225,24231,24236,24252,24259,24275,24282,24288,24294,24297,24304,24310,24315,24321,24328,24344,24350,24355,24362,24368,24374,24400,24405,24411,24418,24424,24429,24455,24462,24478,24484,24489,24496,24512,24518,24575,24580,24583,24590,24596,24602,24628,24631,24638,24645,24650,24656,24663,24668,24674,24680,24685,24691,24698,24704,24710,24716,24732,24748,24754,24760,24765,24771,24778,24784,24790,24795,24801,24808,24814,24820,24826,24831,24837,24844,24850,24866,24871,24877,24894,24899,24905,24921,24926,24929,24936,24942],{"data":23803,"content":23806,"nodeType":875},{"target":23804},{"sys":23805},{"id":18451,"type":872,"linkType":873},[],{"data":23808,"content":23809,"nodeType":889},{},[23810],{"data":23811,"marks":23812,"value":22424,"nodeType":865},{},[23813],{"type":887},{"data":23815,"content":23816,"nodeType":866},{},[23817],{"data":23818,"marks":23819,"value":22431,"nodeType":865},{},[],{"data":23821,"content":23822,"nodeType":866},{},[23823,23826,23833,23836,23843],{"data":23824,"marks":23825,"value":22438,"nodeType":865},{},[],{"data":23827,"content":23828,"nodeType":905},{"uri":18922},[23829],{"data":23830,"marks":23831,"value":18928,"nodeType":865},{},[23832],{"type":1070},{"data":23834,"marks":23835,"value":1454,"nodeType":865},{},[],{"data":23837,"content":23838,"nodeType":905},{"uri":933},[23839],{"data":23840,"marks":23841,"value":1071,"nodeType":865},{},[23842],{"type":1070},{"data":23844,"marks":23845,"value":22459,"nodeType":865},{},[],{"data":23847,"content":23850,"nodeType":875},{"target":23848},{"sys":23849},{"id":22464,"type":872,"linkType":873},[],{"data":23852,"content":23853,"nodeType":2315},{},[23854],{"data":23855,"marks":23856,"value":22473,"nodeType":865},{},[23857],{"type":887},{"data":23859,"content":23860,"nodeType":866},{},[23861,23864,23871,23874,23881],{"data":23862,"marks":23863,"value":22480,"nodeType":865},{},[],{"data":23865,"content":23866,"nodeType":905},{"uri":20053},[23867],{"data":23868,"marks":23869,"value":20059,"nodeType":865},{},[23870],{"type":1070},{"data":23872,"marks":23873,"value":22491,"nodeType":865},{},[],{"data":23875,"content":23876,"nodeType":905},{"uri":10111},[23877],{"data":23878,"marks":23879,"value":10117,"nodeType":865},{},[23880],{"type":1070},{"data":23882,"marks":23883,"value":22502,"nodeType":865},{},[],{"data":23885,"content":23886,"nodeType":866},{},[23887,23890,23894,23897,23901,23904,23908,23911,23915],{"data":23888,"marks":23889,"value":22509,"nodeType":865},{},[],{"data":23891,"marks":23892,"value":22514,"nodeType":865},{},[23893],{"type":887},{"data":23895,"marks":23896,"value":22518,"nodeType":865},{},[],{"data":23898,"marks":23899,"value":22523,"nodeType":865},{},[23900],{"type":887},{"data":23902,"marks":23903,"value":22527,"nodeType":865},{},[],{"data":23905,"marks":23906,"value":22532,"nodeType":865},{},[23907],{"type":887},{"data":23909,"marks":23910,"value":22536,"nodeType":865},{},[],{"data":23912,"marks":23913,"value":22541,"nodeType":865},{},[23914],{"type":887},{"data":23916,"marks":23917,"value":1711,"nodeType":865},{},[],{"data":23919,"content":23922,"nodeType":875},{"target":23920},{"sys":23921},{"id":22549,"type":872,"linkType":873},[],{"data":23924,"content":23925,"nodeType":2315},{},[23926],{"data":23927,"marks":23928,"value":22558,"nodeType":865},{},[23929],{"type":887},{"data":23931,"content":23932,"nodeType":866},{},[23933,23936,23942],{"data":23934,"marks":23935,"value":22565,"nodeType":865},{},[],{"data":23937,"content":23938,"nodeType":905},{"uri":933},[23939],{"data":23940,"marks":23941,"value":22572,"nodeType":865},{},[],{"data":23943,"marks":23944,"value":22576,"nodeType":865},{},[],{"data":23946,"content":23949,"nodeType":875},{"target":23947},{"sys":23948},{"id":22581,"type":872,"linkType":873},[],{"data":23951,"content":23952,"nodeType":879},{},[],{"data":23954,"content":23955,"nodeType":889},{},[23956],{"data":23957,"marks":23958,"value":22593,"nodeType":865},{},[23959],{"type":887},{"data":23961,"content":23962,"nodeType":866},{},[23963],{"data":23964,"marks":23965,"value":22600,"nodeType":865},{},[],{"data":23967,"content":23970,"nodeType":875},{"target":23968},{"sys":23969},{"id":22605,"type":872,"linkType":873},[],{"data":23972,"content":23973,"nodeType":866},{},[23974,23977,23984,23987,23994,23997,24004],{"data":23975,"marks":23976,"value":22613,"nodeType":865},{},[],{"data":23978,"content":23979,"nodeType":905},{"uri":22616},[23980],{"data":23981,"marks":23982,"value":18639,"nodeType":865},{},[23983],{"type":1070},{"data":23985,"marks":23986,"value":7148,"nodeType":865},{},[],{"data":23988,"content":23989,"nodeType":905},{"uri":18645},[23990],{"data":23991,"marks":23992,"value":18651,"nodeType":865},{},[23993],{"type":1070},{"data":23995,"marks":23996,"value":1454,"nodeType":865},{},[],{"data":23998,"content":23999,"nodeType":905},{"uri":22637},[24000],{"data":24001,"marks":24002,"value":22643,"nodeType":865},{},[24003],{"type":1070},{"data":24005,"marks":24006,"value":22647,"nodeType":865},{},[],{"data":24008,"content":24009,"nodeType":866},{},[24010,24013,24020,24023,24030,24033,24040,24043,24050,24053,24060,24063,24070,24073,24080,24083,24089,24092,24098,24101,24107,24110,24116,24119,24125,24128,24134],{"data":24011,"marks":24012,"value":18662,"nodeType":865},{},[],{"data":24014,"content":24015,"nodeType":905},{"uri":18665},[24016],{"data":24017,"marks":24018,"value":18671,"nodeType":865},{},[24019],{"type":1070},{"data":24021,"marks":24022,"value":7148,"nodeType":865},{},[],{"data":24024,"content":24025,"nodeType":905},{"uri":18677},[24026],{"data":24027,"marks":24028,"value":18683,"nodeType":865},{},[24029],{"type":1070},{"data":24031,"marks":24032,"value":7148,"nodeType":865},{},[],{"data":24034,"content":24035,"nodeType":905},{"uri":18689},[24036],{"data":24037,"marks":24038,"value":18695,"nodeType":865},{},[24039],{"type":1070},{"data":24041,"marks":24042,"value":7148,"nodeType":865},{},[],{"data":24044,"content":24045,"nodeType":905},{"uri":18701},[24046],{"data":24047,"marks":24048,"value":18707,"nodeType":865},{},[24049],{"type":1070},{"data":24051,"marks":24052,"value":7148,"nodeType":865},{},[],{"data":24054,"content":24055,"nodeType":905},{"uri":18713},[24056],{"data":24057,"marks":24058,"value":18719,"nodeType":865},{},[24059],{"type":1070},{"data":24061,"marks":24062,"value":7148,"nodeType":865},{},[],{"data":24064,"content":24065,"nodeType":905},{"uri":18725},[24066],{"data":24067,"marks":24068,"value":18731,"nodeType":865},{},[24069],{"type":1070},{"data":24071,"marks":24072,"value":1454,"nodeType":865},{},[],{"data":24074,"content":24075,"nodeType":905},{"uri":18737},[24076],{"data":24077,"marks":24078,"value":18743,"nodeType":865},{},[24079],{"type":1070},{"data":24081,"marks":24082,"value":22724,"nodeType":865},{},[],{"data":24084,"content":24085,"nodeType":905},{"uri":18462},[24086],{"data":24087,"marks":24088,"value":18468,"nodeType":865},{},[],{"data":24090,"marks":24091,"value":7148,"nodeType":865},{},[],{"data":24093,"content":24094,"nodeType":905},{"uri":18474},[24095],{"data":24096,"marks":24097,"value":18480,"nodeType":865},{},[],{"data":24099,"marks":24100,"value":7148,"nodeType":865},{},[],{"data":24102,"content":24103,"nodeType":905},{"uri":18486},[24104],{"data":24105,"marks":24106,"value":18492,"nodeType":865},{},[],{"data":24108,"marks":24109,"value":7148,"nodeType":865},{},[],{"data":24111,"content":24112,"nodeType":905},{"uri":18510},[24113],{"data":24114,"marks":24115,"value":18515,"nodeType":865},{},[],{"data":24117,"marks":24118,"value":7148,"nodeType":865},{},[],{"data":24120,"content":24121,"nodeType":905},{"uri":18510},[24122],{"data":24123,"marks":24124,"value":18525,"nodeType":865},{},[],{"data":24126,"marks":24127,"value":1454,"nodeType":865},{},[],{"data":24129,"content":24130,"nodeType":905},{"uri":18499},[24131],{"data":24132,"marks":24133,"value":18504,"nodeType":865},{},[],{"data":24135,"marks":24136,"value":1193,"nodeType":865},{},[],{"data":24138,"content":24139,"nodeType":879},{},[],{"data":24141,"content":24142,"nodeType":889},{},[24143],{"data":24144,"marks":24145,"value":22789,"nodeType":865},{},[24146],{"type":887},{"data":24148,"content":24149,"nodeType":866},{},[24150],{"data":24151,"marks":24152,"value":22796,"nodeType":865},{},[],{"data":24154,"content":24155,"nodeType":2315},{},[24156],{"data":24157,"marks":24158,"value":22804,"nodeType":865},{},[24159],{"type":887},{"data":24161,"content":24162,"nodeType":866},{},[24163,24166,24173,24176,24183],{"data":24164,"marks":24165,"value":22811,"nodeType":865},{},[],{"data":24167,"content":24168,"nodeType":905},{"uri":22814},[24169],{"data":24170,"marks":24171,"value":22820,"nodeType":865},{},[24172],{"type":1070},{"data":24174,"marks":24175,"value":7651,"nodeType":865},{},[],{"data":24177,"content":24178,"nodeType":905},{"uri":9903},[24179],{"data":24180,"marks":24181,"value":22831,"nodeType":865},{},[24182],{"type":1070},{"data":24184,"marks":24185,"value":22835,"nodeType":865},{},[],{"data":24187,"content":24190,"nodeType":875},{"target":24188},{"sys":24189},{"id":22840,"type":872,"linkType":873},[],{"data":24192,"content":24193,"nodeType":2315},{},[24194],{"data":24195,"marks":24196,"value":22849,"nodeType":865},{},[24197],{"type":887},{"data":24199,"content":24200,"nodeType":866},{},[24201,24204,24211],{"data":24202,"marks":24203,"value":22856,"nodeType":865},{},[],{"data":24205,"content":24206,"nodeType":905},{"uri":22859},[24207],{"data":24208,"marks":24209,"value":22865,"nodeType":865},{},[24210],{"type":1070},{"data":24212,"marks":24213,"value":22869,"nodeType":865},{},[],{"data":24215,"content":24216,"nodeType":866},{},[24217],{"data":24218,"marks":24219,"value":22876,"nodeType":865},{},[],{"data":24221,"content":24224,"nodeType":875},{"target":24222},{"sys":24223},{"id":22881,"type":872,"linkType":873},[],{"data":24226,"content":24227,"nodeType":866},{},[24228],{"data":24229,"marks":24230,"value":22889,"nodeType":865},{},[],{"data":24232,"content":24235,"nodeType":875},{"target":24233},{"sys":24234},{"id":22894,"type":872,"linkType":873},[],{"data":24237,"content":24238,"nodeType":866},{},[24239,24242,24249],{"data":24240,"marks":24241,"value":22902,"nodeType":865},{},[],{"data":24243,"content":24244,"nodeType":905},{"uri":22905},[24245],{"data":24246,"marks":24247,"value":22911,"nodeType":865},{},[24248],{"type":1070},{"data":24250,"marks":24251,"value":11843,"nodeType":865},{},[],{"data":24253,"content":24254,"nodeType":2315},{},[24255],{"data":24256,"marks":24257,"value":22922,"nodeType":865},{},[24258],{"type":887},{"data":24260,"content":24261,"nodeType":866},{},[24262,24265,24272],{"data":24263,"marks":24264,"value":22929,"nodeType":865},{},[],{"data":24266,"content":24267,"nodeType":905},{"uri":10111},[24268],{"data":24269,"marks":24270,"value":10117,"nodeType":865},{},[24271],{"type":1070},{"data":24273,"marks":24274,"value":22940,"nodeType":865},{},[],{"data":24276,"content":24277,"nodeType":2315},{},[24278],{"data":24279,"marks":24280,"value":22948,"nodeType":865},{},[24281],{"type":887},{"data":24283,"content":24284,"nodeType":866},{},[24285],{"data":24286,"marks":24287,"value":22955,"nodeType":865},{},[],{"data":24289,"content":24290,"nodeType":866},{},[24291],{"data":24292,"marks":24293,"value":22962,"nodeType":865},{},[],{"data":24295,"content":24296,"nodeType":879},{},[],{"data":24298,"content":24299,"nodeType":889},{},[24300],{"data":24301,"marks":24302,"value":22973,"nodeType":865},{},[24303],{"type":887},{"data":24305,"content":24306,"nodeType":866},{},[24307],{"data":24308,"marks":24309,"value":22980,"nodeType":865},{},[],{"data":24311,"content":24314,"nodeType":875},{"target":24312},{"sys":24313},{"id":22985,"type":872,"linkType":873},[],{"data":24316,"content":24317,"nodeType":866},{},[24318],{"data":24319,"marks":24320,"value":22993,"nodeType":865},{},[],{"data":24322,"content":24323,"nodeType":2315},{},[24324],{"data":24325,"marks":24326,"value":23001,"nodeType":865},{},[24327],{"type":887},{"data":24329,"content":24330,"nodeType":866},{},[24331,24334,24341],{"data":24332,"marks":24333,"value":21,"nodeType":865},{},[],{"data":24335,"content":24336,"nodeType":905},{"uri":22905},[24337],{"data":24338,"marks":24339,"value":23015,"nodeType":865},{},[24340],{"type":1070},{"data":24342,"marks":24343,"value":23019,"nodeType":865},{},[],{"data":24345,"content":24346,"nodeType":866},{},[24347],{"data":24348,"marks":24349,"value":23026,"nodeType":865},{},[],{"data":24351,"content":24354,"nodeType":875},{"target":24352},{"sys":24353},{"id":23031,"type":872,"linkType":873},[],{"data":24356,"content":24357,"nodeType":2315},{},[24358],{"data":24359,"marks":24360,"value":23040,"nodeType":865},{},[24361],{"type":887},{"data":24363,"content":24364,"nodeType":866},{},[24365],{"data":24366,"marks":24367,"value":23047,"nodeType":865},{},[],{"data":24369,"content":24370,"nodeType":866},{},[24371],{"data":24372,"marks":24373,"value":23054,"nodeType":865},{},[],{"data":24375,"content":24376,"nodeType":866},{},[24377,24380,24387,24390,24397],{"data":24378,"marks":24379,"value":23061,"nodeType":865},{},[],{"data":24381,"content":24382,"nodeType":905},{"uri":13115},[24383],{"data":24384,"marks":24385,"value":23069,"nodeType":865},{},[24386],{"type":1070},{"data":24388,"marks":24389,"value":23073,"nodeType":865},{},[],{"data":24391,"content":24392,"nodeType":905},{"uri":23076},[24393],{"data":24394,"marks":24395,"value":23082,"nodeType":865},{},[24396],{"type":1070},{"data":24398,"marks":24399,"value":23086,"nodeType":865},{},[],{"data":24401,"content":24404,"nodeType":875},{"target":24402},{"sys":24403},{"id":23091,"type":872,"linkType":873},[],{"data":24406,"content":24407,"nodeType":866},{},[24408],{"data":24409,"marks":24410,"value":23099,"nodeType":865},{},[],{"data":24412,"content":24413,"nodeType":2315},{},[24414],{"data":24415,"marks":24416,"value":23107,"nodeType":865},{},[24417],{"type":887},{"data":24419,"content":24420,"nodeType":866},{},[24421],{"data":24422,"marks":24423,"value":23114,"nodeType":865},{},[],{"data":24425,"content":24428,"nodeType":875},{"target":24426},{"sys":24427},{"id":23119,"type":872,"linkType":873},[],{"data":24430,"content":24431,"nodeType":866},{},[24432,24435,24442,24445,24452],{"data":24433,"marks":24434,"value":23127,"nodeType":865},{},[],{"data":24436,"content":24437,"nodeType":905},{"uri":23130},[24438],{"data":24439,"marks":24440,"value":23136,"nodeType":865},{},[24441],{"type":1070},{"data":24443,"marks":24444,"value":23140,"nodeType":865},{},[],{"data":24446,"content":24447,"nodeType":905},{"uri":13344},[24448],{"data":24449,"marks":24450,"value":7647,"nodeType":865},{},[24451],{"type":1070},{"data":24453,"marks":24454,"value":23151,"nodeType":865},{},[],{"data":24456,"content":24457,"nodeType":2315},{},[24458],{"data":24459,"marks":24460,"value":23159,"nodeType":865},{},[24461],{"type":887},{"data":24463,"content":24464,"nodeType":866},{},[24465,24468,24475],{"data":24466,"marks":24467,"value":23166,"nodeType":865},{},[],{"data":24469,"content":24470,"nodeType":905},{"uri":23169},[24471],{"data":24472,"marks":24473,"value":23175,"nodeType":865},{},[24474],{"type":1070},{"data":24476,"marks":24477,"value":23179,"nodeType":865},{},[],{"data":24479,"content":24480,"nodeType":866},{},[24481],{"data":24482,"marks":24483,"value":23186,"nodeType":865},{},[],{"data":24485,"content":24488,"nodeType":875},{"target":24486},{"sys":24487},{"id":23191,"type":872,"linkType":873},[],{"data":24490,"content":24491,"nodeType":2315},{},[24492],{"data":24493,"marks":24494,"value":23200,"nodeType":865},{},[24495],{"type":887},{"data":24497,"content":24498,"nodeType":866},{},[24499,24502,24509],{"data":24500,"marks":24501,"value":23207,"nodeType":865},{},[],{"data":24503,"content":24504,"nodeType":905},{"uri":23210},[24505],{"data":24506,"marks":24507,"value":23216,"nodeType":865},{},[24508],{"type":1070},{"data":24510,"marks":24511,"value":23220,"nodeType":865},{},[],{"data":24513,"content":24514,"nodeType":866},{},[24515],{"data":24516,"marks":24517,"value":23227,"nodeType":865},{},[],{"data":24519,"content":24520,"nodeType":2718},{},[24521,24530,24539,24548,24557,24566],{"data":24522,"content":24523,"nodeType":2654},{},[24524],{"data":24525,"content":24526,"nodeType":866},{},[24527],{"data":24528,"marks":24529,"value":23240,"nodeType":865},{},[],{"data":24531,"content":24532,"nodeType":2654},{},[24533],{"data":24534,"content":24535,"nodeType":866},{},[24536],{"data":24537,"marks":24538,"value":23250,"nodeType":865},{},[],{"data":24540,"content":24541,"nodeType":2654},{},[24542],{"data":24543,"content":24544,"nodeType":866},{},[24545],{"data":24546,"marks":24547,"value":23260,"nodeType":865},{},[],{"data":24549,"content":24550,"nodeType":2654},{},[24551],{"data":24552,"content":24553,"nodeType":866},{},[24554],{"data":24555,"marks":24556,"value":23270,"nodeType":865},{},[],{"data":24558,"content":24559,"nodeType":2654},{},[24560],{"data":24561,"content":24562,"nodeType":866},{},[24563],{"data":24564,"marks":24565,"value":23280,"nodeType":865},{},[],{"data":24567,"content":24568,"nodeType":2654},{},[24569],{"data":24570,"content":24571,"nodeType":866},{},[24572],{"data":24573,"marks":24574,"value":23290,"nodeType":865},{},[],{"data":24576,"content":24579,"nodeType":875},{"target":24577},{"sys":24578},{"id":23295,"type":872,"linkType":873},[],{"data":24581,"content":24582,"nodeType":879},{},[],{"data":24584,"content":24585,"nodeType":889},{},[24586],{"data":24587,"marks":24588,"value":23307,"nodeType":865},{},[24589],{"type":887},{"data":24591,"content":24592,"nodeType":866},{},[24593],{"data":24594,"marks":24595,"value":23314,"nodeType":865},{},[],{"data":24597,"content":24598,"nodeType":866},{},[24599],{"data":24600,"marks":24601,"value":23321,"nodeType":865},{},[],{"data":24603,"content":24604,"nodeType":866},{},[24605,24608,24615,24618,24625],{"data":24606,"marks":24607,"value":23328,"nodeType":865},{},[],{"data":24609,"content":24610,"nodeType":905},{"uri":23331},[24611],{"data":24612,"marks":24613,"value":23337,"nodeType":865},{},[24614],{"type":1070},{"data":24616,"marks":24617,"value":23341,"nodeType":865},{},[],{"data":24619,"content":24620,"nodeType":905},{"uri":23076},[24621],{"data":24622,"marks":24623,"value":23349,"nodeType":865},{},[24624],{"type":1070},{"data":24626,"marks":24627,"value":1711,"nodeType":865},{},[],{"data":24629,"content":24630,"nodeType":879},{},[],{"data":24632,"content":24633,"nodeType":889},{},[24634],{"data":24635,"marks":24636,"value":23363,"nodeType":865},{},[24637],{"type":887},{"data":24639,"content":24640,"nodeType":866},{},[24641],{"data":24642,"marks":24643,"value":23371,"nodeType":865},{},[24644],{"type":887},{"data":24646,"content":24649,"nodeType":875},{"target":24647},{"sys":24648},{"id":23376,"type":872,"linkType":873},[],{"data":24651,"content":24652,"nodeType":2315},{},[24653],{"data":24654,"marks":24655,"value":23384,"nodeType":865},{},[],{"data":24657,"content":24658,"nodeType":866},{},[24659],{"data":24660,"marks":24661,"value":23392,"nodeType":865},{},[24662],{"type":887},{"data":24664,"content":24667,"nodeType":875},{"target":24665},{"sys":24666},{"id":23397,"type":872,"linkType":873},[],{"data":24669,"content":24670,"nodeType":866},{},[24671],{"data":24672,"marks":24673,"value":23405,"nodeType":865},{},[],{"data":24675,"content":24676,"nodeType":866},{},[24677],{"data":24678,"marks":24679,"value":23412,"nodeType":865},{},[],{"data":24681,"content":24684,"nodeType":875},{"target":24682},{"sys":24683},{"id":23417,"type":872,"linkType":873},[],{"data":24686,"content":24687,"nodeType":2315},{},[24688],{"data":24689,"marks":24690,"value":23425,"nodeType":865},{},[],{"data":24692,"content":24693,"nodeType":866},{},[24694],{"data":24695,"marks":24696,"value":23433,"nodeType":865},{},[24697],{"type":887},{"data":24699,"content":24700,"nodeType":866},{},[24701],{"data":24702,"marks":24703,"value":23440,"nodeType":865},{},[],{"data":24705,"content":24706,"nodeType":866},{},[24707],{"data":24708,"marks":24709,"value":23447,"nodeType":865},{},[],{"data":24711,"content":24712,"nodeType":2315},{},[24713],{"data":24714,"marks":24715,"value":23454,"nodeType":865},{},[],{"data":24717,"content":24718,"nodeType":866},{},[24719,24723,24728],{"data":24720,"marks":24721,"value":23462,"nodeType":865},{},[24722],{"type":887},{"data":24724,"marks":24725,"value":23468,"nodeType":865},{},[24726,24727],{"type":1070},{"type":887},{"data":24729,"marks":24730,"value":23473,"nodeType":865},{},[24731],{"type":887},{"data":24733,"content":24734,"nodeType":866},{},[24735,24738,24745],{"data":24736,"marks":24737,"value":23480,"nodeType":865},{},[],{"data":24739,"content":24740,"nodeType":905},{"uri":23483},[24741],{"data":24742,"marks":24743,"value":14057,"nodeType":865},{},[24744],{"type":1070},{"data":24746,"marks":24747,"value":1193,"nodeType":865},{},[],{"data":24749,"content":24750,"nodeType":866},{},[24751],{"data":24752,"marks":24753,"value":23498,"nodeType":865},{},[],{"data":24755,"content":24756,"nodeType":866},{},[24757],{"data":24758,"marks":24759,"value":23505,"nodeType":865},{},[],{"data":24761,"content":24764,"nodeType":875},{"target":24762},{"sys":24763},{"id":23510,"type":872,"linkType":873},[],{"data":24766,"content":24767,"nodeType":2315},{},[24768],{"data":24769,"marks":24770,"value":23518,"nodeType":865},{},[],{"data":24772,"content":24773,"nodeType":866},{},[24774],{"data":24775,"marks":24776,"value":23526,"nodeType":865},{},[24777],{"type":887},{"data":24779,"content":24780,"nodeType":866},{},[24781],{"data":24782,"marks":24783,"value":23533,"nodeType":865},{},[],{"data":24785,"content":24786,"nodeType":866},{},[24787],{"data":24788,"marks":24789,"value":23540,"nodeType":865},{},[],{"data":24791,"content":24794,"nodeType":875},{"target":24792},{"sys":24793},{"id":23545,"type":872,"linkType":873},[],{"data":24796,"content":24797,"nodeType":2315},{},[24798],{"data":24799,"marks":24800,"value":23553,"nodeType":865},{},[],{"data":24802,"content":24803,"nodeType":866},{},[24804],{"data":24805,"marks":24806,"value":23561,"nodeType":865},{},[24807],{"type":887},{"data":24809,"content":24810,"nodeType":866},{},[24811],{"data":24812,"marks":24813,"value":23568,"nodeType":865},{},[],{"data":24815,"content":24816,"nodeType":866},{},[24817],{"data":24818,"marks":24819,"value":23575,"nodeType":865},{},[],{"data":24821,"content":24822,"nodeType":866},{},[24823],{"data":24824,"marks":24825,"value":23582,"nodeType":865},{},[],{"data":24827,"content":24830,"nodeType":875},{"target":24828},{"sys":24829},{"id":23587,"type":872,"linkType":873},[],{"data":24832,"content":24833,"nodeType":2315},{},[24834],{"data":24835,"marks":24836,"value":23595,"nodeType":865},{},[],{"data":24838,"content":24839,"nodeType":866},{},[24840],{"data":24841,"marks":24842,"value":23603,"nodeType":865},{},[24843],{"type":887},{"data":24845,"content":24846,"nodeType":866},{},[24847],{"data":24848,"marks":24849,"value":23610,"nodeType":865},{},[],{"data":24851,"content":24852,"nodeType":866},{},[24853,24856,24863],{"data":24854,"marks":24855,"value":23617,"nodeType":865},{},[],{"data":24857,"content":24858,"nodeType":905},{"uri":945},[24859],{"data":24860,"marks":24861,"value":950,"nodeType":865},{},[24862],{"type":1070},{"data":24864,"marks":24865,"value":23628,"nodeType":865},{},[],{"data":24867,"content":24870,"nodeType":875},{"target":24868},{"sys":24869},{"id":23633,"type":872,"linkType":873},[],{"data":24872,"content":24873,"nodeType":2315},{},[24874],{"data":24875,"marks":24876,"value":23641,"nodeType":865},{},[],{"data":24878,"content":24879,"nodeType":866},{},[24880,24883,24891],{"data":24881,"marks":24882,"value":19809,"nodeType":865},{},[],{"data":24884,"content":24885,"nodeType":905},{"uri":7281},[24886],{"data":24887,"marks":24888,"value":19118,"nodeType":865},{},[24889,24890],{"type":1070},{"type":887},{"data":24892,"marks":24893,"value":19122,"nodeType":865},{},[],{"data":24895,"content":24898,"nodeType":875},{"target":24896},{"sys":24897},{"id":7309,"type":872,"linkType":873},[],{"data":24900,"content":24901,"nodeType":866},{},[24902],{"data":24903,"marks":24904,"value":19134,"nodeType":865},{},[],{"data":24906,"content":24907,"nodeType":866},{},[24908,24911,24918],{"data":24909,"marks":24910,"value":19164,"nodeType":865},{},[],{"data":24912,"content":24913,"nodeType":905},{"uri":19304},[24914],{"data":24915,"marks":24916,"value":19854,"nodeType":865},{},[24917],{"type":1070},{"data":24919,"marks":24920,"value":19858,"nodeType":865},{},[],{"data":24922,"content":24925,"nodeType":875},{"target":24923},{"sys":24924},{"id":19200,"type":872,"linkType":873},[],{"data":24927,"content":24928,"nodeType":879},{},[],{"data":24930,"content":24931,"nodeType":889},{},[24932],{"data":24933,"marks":24934,"value":13420,"nodeType":865},{},[24935],{"type":887},{"data":24937,"content":24938,"nodeType":866},{},[24939],{"data":24940,"marks":24941,"value":23707,"nodeType":865},{},[],{"data":24943,"content":24944,"nodeType":866},{},[24945,24948,24954],{"data":24946,"marks":24947,"value":13434,"nodeType":865},{},[],{"data":24949,"content":24950,"nodeType":905},{"uri":23716},[24951],{"data":24952,"marks":24953,"value":7352,"nodeType":865},{},[],{"data":24955,"marks":24956,"value":1193,"nodeType":865},{},[],{"entries":24958},{"hyperlink":24959,"inline":24960,"block":24961},[],[],[24962,24992,25018,25046,25050,25064,25099,25113,25127,25135,25140,25147,25152,25156,25163,25168,25182,25190,25198,25204,25212,25219,25222],{"sys":24963,"__typename":4645,"content":24964,"name":19249,"title":59},{"id":18451},{"json":24965},{"nodeType":1522,"data":24966,"content":24967},{},[24968],{"nodeType":866,"data":24969,"content":24970},{},[24971,24974,24980,24983,24989],{"nodeType":865,"value":19223,"marks":24972,"data":24973},[],{},{"nodeType":905,"data":24975,"content":24976},{"uri":19228},[24977],{"nodeType":865,"value":19231,"marks":24978,"data":24979},[],{},{"nodeType":865,"value":19235,"marks":24981,"data":24982},[],{},{"nodeType":905,"data":24984,"content":24985},{"uri":19228},[24986],{"nodeType":865,"value":19242,"marks":24987,"data":24988},[],{},{"nodeType":865,"value":19246,"marks":24990,"data":24991},[],{},{"sys":24993,"__typename":4645,"content":24994,"name":25017,"title":59},{"id":22464},{"json":24995},{"nodeType":1522,"data":24996,"content":24997},{},[24998],{"nodeType":866,"data":24999,"content":25000},{},[25001,25005,25013],{"nodeType":865,"value":25002,"marks":25003,"data":25004},"With criminal hacker collectives being fluid in nature, Scattered Spider has also been associated with ",[],{},{"nodeType":905,"data":25006,"content":25007},{"uri":933},[25008],{"nodeType":865,"value":25009,"marks":25010,"data":25012},"the Snowflake attacks",[25011],{"type":1070},{},{"nodeType":865,"value":25014,"marks":25015,"data":25016}," attributed to the ShinyHunters group, which resulted in hundreds of millions of breached records from 9 public victims including AT&T, Ticketmaster, and Santander (with the full impact suggested to be around 165 organizations), monetized through ransom payments, extortion of individual victims, and resale of the data on criminal forums.",[],{},"Scattered Spider insight box 0",{"sys":25019,"__typename":4645,"content":25020,"name":25045,"title":59},{"id":22549},{"json":25021},{"nodeType":1522,"data":25022,"content":25023},{},[25024],{"nodeType":866,"data":25025,"content":25026},{},[25027,25032,25036,25041],{"nodeType":865,"value":25028,"marks":25029,"data":25031},"Caesars",[25030],{"type":887},{},{"nodeType":865,"value":25033,"marks":25034,"data":25035}," was also hit at the same time as MGM Resorts. Less is known about the Caesars attack, except that a ransom of ",[],{},{"nodeType":865,"value":25037,"marks":25038,"data":25040},"$15M",[25039],{"type":887},{},{"nodeType":865,"value":25042,"marks":25043,"data":25044}," was paid to Scattered Spider in an attempt to prevent stolen data being leaked online.",[],{},"Scattered Spider insight box 1",{"sys":25047,"__typename":1530,"type":1531,"ctaText":25048,"buttonLabel":25049,"buttonColour":1534,"buttonUrl":19254},{"id":22581},"Want to learn more from our security researchers? Watch our webinar on Scattered Spider's 2025 TTPs here. ","Stream On-Demand",{"sys":25051,"__typename":4645,"content":25052,"name":25063,"title":59},{"id":22605},{"json":25053},{"nodeType":1522,"data":25054,"content":25055},{},[25056],{"nodeType":866,"data":25057,"content":25058},{},[25059],{"nodeType":865,"value":25060,"marks":25061,"data":25062},"It's worth thinking about Scattered Spider less as a neatly identified group of individuals, but more as a pattern of activity and behaviors. For this reason, it's unlikely that arrests will have a definitive impact — the TTPs exhibited will continue to be used and refined by newcomers.  ",[],{},"Scattered Spider TTPs Insight Box 5",{"sys":25065,"__typename":4645,"content":25066,"name":25098,"title":59},{"id":22840},{"json":25067},{"nodeType":1522,"data":25068,"content":25069},{},[25070],{"nodeType":866,"data":25071,"content":25072},{},[25073,25077,25084,25088,25095],{"nodeType":865,"value":25074,"marks":25075,"data":25076},"Learn more about how Scattered Spider conducts help desk attacks ",[],{},{"nodeType":905,"data":25078,"content":25079},{"uri":7294},[25080],{"nodeType":865,"value":25081,"marks":25082,"data":25083},"in our recent blog pos",[],{},{"nodeType":865,"value":25085,"marks":25086,"data":25087},"t or by checking out ",[],{},{"nodeType":905,"data":25089,"content":25090},{"uri":19254},[25091],{"nodeType":865,"value":25092,"marks":25093,"data":25094},"our on-demand webinar — available to stream now",[],{},{"nodeType":865,"value":6352,"marks":25096,"data":25097},[],{},"Scattered Spider TTPs insight box 6",{"sys":25100,"__typename":4645,"content":25101,"name":25112,"title":59},{"id":22881},{"json":25102},{"nodeType":1522,"data":25103,"content":25104},{},[25105],{"nodeType":866,"data":25106,"content":25107},{},[25108],{"nodeType":865,"value":25109,"marks":25110,"data":25111},"Accenture, Aflac, Allstate, Ally Bank, Amica, Apple, AT&T, Athene, Audemars Piguet, Ballet Crypto, BCB Group, Bell, Bitcoin Suisse, Blockdaemon, Blockstream, Charter Communications, Chik-fil-A, Cincinnati Financial, Comcast Corporation, Core Scientific, Costco, Credit Karma, DoorDash, Fireblocks, Forbes, Gemini, Grayscale, H&R Block, Hanover Insurance, Harrow Health, Iliad, Instacart, Jackson Hewitt, Kemper, Louis Vuitton, Luno, Marsh, Mercury, Morningstar, Mutual of Omaha, Nansen, NGRAVE, New York Digital Investment Group, New York Life Insurance, News Corporation, Nike, Orange, P.F. Chang’s, Paxos, PNC Bank, Revolut, RiteAid, 7-Eleven, Singtel, Stargate Industries, Synchrony Bank, Synovus, T-Mobile, Telstra, TIAA, Transamerica, Twitter/X, UScellular, Verizon, Vodafone, WINDTRE, and Xapo Bank.",[],{},"Scattered Spider insight box 3",{"sys":25114,"__typename":4645,"content":25115,"name":25126,"title":59},{"id":22894},{"json":25116},{"nodeType":1522,"data":25117,"content":25118},{},[25119],{"nodeType":866,"data":25120,"content":25121},{},[25122],{"nodeType":865,"value":25123,"marks":25124,"data":25125},"ActiveCampaign, Ada CX, Alchemy, Asurion, Bandwith, Bird CRM, Campaign Monitor, Concentrix, Constant Contact, Corporate Tools, CTS, eClerx, Expedia Group, FalconX, FICO, Five9, Foundever, Freshworks, Genesis Trading, Givebutter, GoDaddy, HubSpot, Incode, Intercom, iQor, Iterable, Jumio, Klaviyo, LinkedIn, Mixpanel, Nuance Communications, Onfido, OnSolve, Podium, Pure Storage, Ripple, Roblox, Salesforce, Shipbob, Sinch, Socure, SPOC, Squarespace, TaskUs, TriVista, Twilio, Ulta Beauty, Upland Software, Wix, Workday, Ziff Davis, and 247[.]ai.",[],{},"Scattered Spider insight box 4",{"sys":25128,"__typename":4637,"title":25129,"caption":25130,"layoutMode":59,"file":25131},{"id":22985},"Scattered Spider image 1","Summary of Scattered Spider TTP evolution in the context of an end-to-end attack chain.",{"url":25132,"width":25133,"height":25134},"https://images.ctfassets.net/y1cdw1ablpvd/16ngVb8CXbn6jnv7CNeCs5/1d708ddda20413c228d1239f6739acae/Screenshot_2025-06-27_at_15.30.27.png",3376,1876,{"sys":25136,"__typename":1530,"type":1531,"ctaText":25137,"buttonLabel":25138,"buttonColour":1534,"buttonUrl":25139},{"id":23031},"Frustrated that phishing attacks are still so successful in 2025? Check out on-demand latest webinar where we analyze exactly why and where controls are failing.","Watch On-demand","https://pushsecurity.com/resources/phishing-2025",{"sys":25141,"__typename":4637,"title":25142,"caption":25143,"layoutMode":59,"file":25144},{"id":23091},"Scattered spider image 2","Comparing the it.com domain observed by security researchers with the us.com observed in our recent Onfido malvertising investigation.",{"url":25145,"width":4641,"height":25146},"https://images.ctfassets.net/y1cdw1ablpvd/36YNp6VD5QfqcFcB4actyT/e31cc1dad9f55d49e1d793711199a666/image1.png",791,{"sys":25148,"__typename":7447,"title":25149,"arcadeDemoUrl":25150,"playText":25151},{"id":23119},"Evilginx demo","https://demo.arcade.software/2OpOz9hyjfIu5o8KtAmI?embed","1 mins",{"sys":25153,"__typename":7447,"title":25154,"arcadeDemoUrl":25155,"playText":25151},{"id":23191},"Phishing Toolkit Detection Evasion Arcade","https://demo.arcade.software/tDUPQV1Nlaralf6VQHT2?embed",{"sys":25157,"__typename":4637,"title":25158,"caption":25159,"layoutMode":59,"file":25160},{"id":23295},"Scattered spider image 3","Scattered Spider Okta phishing pages impersonating various brands",{"url":25161,"width":25162,"height":4641},"https://images.ctfassets.net/y1cdw1ablpvd/7HWejTJs8g5dtoZLK2oqg7/72e3461a28811d0b80d6322f2f93a431/image3.png",1645,{"sys":25164,"__typename":4637,"title":25165,"caption":25166,"layoutMode":59,"file":25167},{"id":23376},"Push vs Scattered Spider","Push controls mapped against Scattered Spider TTPs.",{"url":19289,"width":4641,"height":19260},{"sys":25169,"__typename":4645,"content":25170,"name":25181,"title":59},{"id":23397},{"json":25171},{"nodeType":1522,"data":25172,"content":25173},{},[25174],{"nodeType":866,"data":25175,"content":25176},{},[25177],{"nodeType":865,"value":25178,"marks":25179,"data":25180},"To detect modern, sophisticated phishing kits like those used by Scattered Spider, organizations need to be able to detect and block phishing pages in real-time. Push’s browser-based approach intercepts phishing attacks as they happen — in employee browsers. Being in the browser delivers a lot of advantages when it comes to detecting and intercepting phishing attacks. You see the live webpage that the user sees, as they see it, meaning you have much better visibility of malicious elements running on the page. It also means that you can implement real-time controls that kick in when a malicious element is detected.",[],{},"Scattered Spider insight box 2",{"sys":25183,"__typename":4637,"title":25184,"caption":25185,"layoutMode":59,"file":25186},{"id":23417},"Phishing toolkit detection","Accessing pages running malicious phishing toolkits is automatically blocked. ",{"url":25187,"width":25188,"height":25189},"https://images.ctfassets.net/y1cdw1ablpvd/3ylgW0MDCCesBjQsoqjD4P/a8bc4df9a430aca6c725f913d2bc6444/image11.png",1440,767,{"sys":25191,"__typename":4637,"title":25192,"caption":25193,"layoutMode":59,"file":25194},{"id":23510},"Scattered spider image 4","Push detects and blocks when a password is used on a site it doesn't belong to.",{"url":25195,"width":25196,"height":25197},"https://images.ctfassets.net/y1cdw1ablpvd/3DsbAAM2GCMbyfBdENebFJ/89978c80fe97b46d2e80089b19d8cb73/image8.png",1920,1080,{"sys":25199,"__typename":4637,"title":25200,"caption":25200,"layoutMode":59,"file":25201},{"id":23545},"Detecting stolen sessions running on attacker machines. ",{"url":25202,"width":25188,"height":25203},"https://images.ctfassets.net/y1cdw1ablpvd/3Pp4bDB2FkGlHbOEt35j0j/49a92cf3c2f805850eff23bacd43818c/image8.png",398,{"sys":25205,"__typename":4637,"title":25206,"caption":25207,"layoutMode":59,"file":25208},{"id":23587},"Detecting stolen credentials in lastpass","Push shows where stolen credentials have been used to log into an account and the source of the leak",{"url":25209,"width":25210,"height":25211},"https://images.ctfassets.net/y1cdw1ablpvd/HYlWtjgQJdjOYgjmRVMf3/2444a1804ff5c75e88884d75c8735aa8/image8.png",697,668,{"sys":25213,"__typename":4637,"title":25214,"caption":25215,"layoutMode":59,"file":25216},{"id":23633},"Scattered spider image 5","Push identifies where multiple login methods are configured for a single account, as well as when the method was last observed, to surface ghost logins.",{"url":25217,"width":4641,"height":25218},"https://images.ctfassets.net/y1cdw1ablpvd/4LigZHBdaNgpK4vXjr80Ct/5c904257035d6507eff924bff131ced9/image5.png",887,{"sys":25220,"__typename":4637,"title":7484,"caption":7485,"layoutMode":59,"file":25221},{"id":7309},{"url":7487,"width":7488,"height":7489},{"sys":25223,"__typename":1530,"type":1531,"ctaText":19302,"buttonLabel":19303,"buttonColour":1534,"buttonUrl":19304},{"id":19200},{"items":25225},[],{},"How Scattered Spider TTPs are evolving in 2025",{"url":19310},{"items":25230},[25231,25536,26236],{"__typename":1544,"sys":25232,"content":25233,"title":20245,"synopsis":20246,"hashTags":59,"publishedDate":20247,"slug":20248,"tagsCollection":25528,"authorsCollection":25532},{"id":9569},{"json":25234},{"data":25235,"content":25236,"nodeType":1522},{},[25237,25243,25249,25255,25260,25266,25296,25302,25308,25314,25319,25325,25331,25346,25351,25357,25373,25389,25395,25401,25407,25413,25419,25425,25431,25447,25453,25459,25464,25470,25476,25496,25501,25517,25522],{"data":25238,"content":25239,"nodeType":866},{},[25240],{"data":25241,"marks":25242,"value":19912,"nodeType":865},{},[],{"data":25244,"content":25245,"nodeType":866},{},[25246],{"data":25247,"marks":25248,"value":19919,"nodeType":865},{},[],{"data":25250,"content":25251,"nodeType":866},{},[25252],{"data":25253,"marks":25254,"value":19926,"nodeType":865},{},[],{"data":25256,"content":25259,"nodeType":875},{"target":25257},{"sys":25258},{"id":19931,"type":872,"linkType":873},[],{"data":25261,"content":25262,"nodeType":866},{},[25263],{"data":25264,"marks":25265,"value":19939,"nodeType":865},{},[],{"data":25267,"content":25268,"nodeType":2718},{},[25269,25278,25287],{"data":25270,"content":25271,"nodeType":2654},{},[25272],{"data":25273,"content":25274,"nodeType":866},{},[25275],{"data":25276,"marks":25277,"value":19952,"nodeType":865},{},[],{"data":25279,"content":25280,"nodeType":2654},{},[25281],{"data":25282,"content":25283,"nodeType":866},{},[25284],{"data":25285,"marks":25286,"value":19962,"nodeType":865},{},[],{"data":25288,"content":25289,"nodeType":2654},{},[25290],{"data":25291,"content":25292,"nodeType":866},{},[25293],{"data":25294,"marks":25295,"value":19972,"nodeType":865},{},[],{"data":25297,"content":25298,"nodeType":866},{},[25299],{"data":25300,"marks":25301,"value":19979,"nodeType":865},{},[],{"data":25303,"content":25304,"nodeType":889},{},[25305],{"data":25306,"marks":25307,"value":19986,"nodeType":865},{},[],{"data":25309,"content":25310,"nodeType":866},{},[25311],{"data":25312,"marks":25313,"value":19993,"nodeType":865},{},[],{"data":25315,"content":25318,"nodeType":875},{"target":25316},{"sys":25317},{"id":19998,"type":872,"linkType":873},[],{"data":25320,"content":25321,"nodeType":866},{},[25322],{"data":25323,"marks":25324,"value":20006,"nodeType":865},{},[],{"data":25326,"content":25327,"nodeType":889},{},[25328],{"data":25329,"marks":25330,"value":20013,"nodeType":865},{},[],{"data":25332,"content":25333,"nodeType":866},{},[25334,25337,25343],{"data":25335,"marks":25336,"value":20020,"nodeType":865},{},[],{"data":25338,"content":25339,"nodeType":905},{"uri":19676},[25340],{"data":25341,"marks":25342,"value":20027,"nodeType":865},{},[],{"data":25344,"marks":25345,"value":20031,"nodeType":865},{},[],{"data":25347,"content":25350,"nodeType":875},{"target":25348},{"sys":25349},{"id":18780,"type":872,"linkType":873},[],{"data":25352,"content":25353,"nodeType":2315},{},[25354],{"data":25355,"marks":25356,"value":20043,"nodeType":865},{},[],{"data":25358,"content":25359,"nodeType":866},{},[25360,25363,25370],{"data":25361,"marks":25362,"value":20050,"nodeType":865},{},[],{"data":25364,"content":25365,"nodeType":905},{"uri":20053},[25366],{"data":25367,"marks":25368,"value":20059,"nodeType":865},{},[25369],{"type":1070},{"data":25371,"marks":25372,"value":20063,"nodeType":865},{},[],{"data":25374,"content":25375,"nodeType":866},{},[25376,25379,25386],{"data":25377,"marks":25378,"value":20070,"nodeType":865},{},[],{"data":25380,"content":25381,"nodeType":905},{"uri":10111},[25382],{"data":25383,"marks":25384,"value":10117,"nodeType":865},{},[25385],{"type":1070},{"data":25387,"marks":25388,"value":20081,"nodeType":865},{},[],{"data":25390,"content":25391,"nodeType":866},{},[25392],{"data":25393,"marks":25394,"value":20088,"nodeType":865},{},[],{"data":25396,"content":25397,"nodeType":866},{},[25398],{"data":25399,"marks":25400,"value":20095,"nodeType":865},{},[],{"data":25402,"content":25403,"nodeType":2315},{},[25404],{"data":25405,"marks":25406,"value":20102,"nodeType":865},{},[],{"data":25408,"content":25409,"nodeType":866},{},[25410],{"data":25411,"marks":25412,"value":20109,"nodeType":865},{},[],{"data":25414,"content":25415,"nodeType":866},{},[25416],{"data":25417,"marks":25418,"value":20116,"nodeType":865},{},[],{"data":25420,"content":25421,"nodeType":889},{},[25422],{"data":25423,"marks":25424,"value":20123,"nodeType":865},{},[],{"data":25426,"content":25427,"nodeType":866},{},[25428],{"data":25429,"marks":25430,"value":20130,"nodeType":865},{},[],{"data":25432,"content":25433,"nodeType":866},{},[25434,25437,25444],{"data":25435,"marks":25436,"value":20137,"nodeType":865},{},[],{"data":25438,"content":25439,"nodeType":905},{"uri":20140},[25440],{"data":25441,"marks":25442,"value":20146,"nodeType":865},{},[25443],{"type":1070},{"data":25445,"marks":25446,"value":20150,"nodeType":865},{},[],{"data":25448,"content":25449,"nodeType":866},{},[25450],{"data":25451,"marks":25452,"value":20157,"nodeType":865},{},[],{"data":25454,"content":25455,"nodeType":866},{},[25456],{"data":25457,"marks":25458,"value":20164,"nodeType":865},{},[],{"data":25460,"content":25463,"nodeType":875},{"target":25461},{"sys":25462},{"id":20169,"type":872,"linkType":873},[],{"data":25465,"content":25466,"nodeType":889},{},[25467],{"data":25468,"marks":25469,"value":19157,"nodeType":865},{},[],{"data":25471,"content":25472,"nodeType":866},{},[25473],{"data":25474,"marks":25475,"value":20183,"nodeType":865},{},[],{"data":25477,"content":25478,"nodeType":866},{},[25479,25482,25486,25489,25493],{"data":25480,"marks":25481,"value":20190,"nodeType":865},{},[],{"data":25483,"marks":25484,"value":20195,"nodeType":865},{},[25485],{"type":887},{"data":25487,"marks":25488,"value":20199,"nodeType":865},{},[],{"data":25490,"marks":25491,"value":20204,"nodeType":865},{},[25492],{"type":887},{"data":25494,"marks":25495,"value":20208,"nodeType":865},{},[],{"data":25497,"content":25500,"nodeType":875},{"target":25498},{"sys":25499},{"id":20213,"type":872,"linkType":873},[],{"data":25502,"content":25503,"nodeType":866},{},[25504,25507,25514],{"data":25505,"marks":25506,"value":20221,"nodeType":865},{},[],{"data":25508,"content":25509,"nodeType":905},{"uri":3686},[25510],{"data":25511,"marks":25512,"value":1517,"nodeType":865},{},[25513],{"type":1070},{"data":25515,"marks":25516,"value":20232,"nodeType":865},{},[],{"data":25518,"content":25521,"nodeType":875},{"target":25519},{"sys":25520},{"id":20237,"type":872,"linkType":873},[],{"data":25523,"content":25524,"nodeType":866},{},[25525],{"data":25526,"marks":25527,"value":21,"nodeType":865},{},[],{"items":25529},[25530],{"sys":25531,"name":297},{"id":2147},{"items":25533},[25534],{"fullName":14538,"firstName":14539,"jobTitle":9645,"profilePicture":25535},{"url":14541},{"__typename":1544,"sys":25537,"content":25538,"title":17671,"synopsis":17672,"hashTags":59,"publishedDate":17673,"slug":17674,"tagsCollection":26228,"authorsCollection":26232},{"id":9124},{"json":25539},{"data":25540,"content":25541,"nodeType":1522},{},[25542,25547,25563,25569,25575,25580,25583,25590,25596,25612,25622,25628,25634,25640,25724,25727,25734,25809,25814,25817,25824,25831,25837,25843,25850,25866,25872,25879,25885,25891,25898,25904,25910,25926,25931,25934,25941,25948,25954,26043,26049,26056,26062,26068,26073,26080,26086,26092,26098,26105,26111,26117,26123,26129,26134,26137,26144,26150,26180,26186,26201,26217,26222],{"data":25543,"content":25546,"nodeType":875},{"target":25544},{"sys":25545},{"id":16889,"type":872,"linkType":873},[],{"data":25548,"content":25549,"nodeType":866},{},[25550,25553,25560],{"data":25551,"marks":25552,"value":16897,"nodeType":865},{},[],{"data":25554,"content":25555,"nodeType":905},{"uri":16900},[25556],{"data":25557,"marks":25558,"value":16906,"nodeType":865},{},[25559],{"type":1070},{"data":25561,"marks":25562,"value":16910,"nodeType":865},{},[],{"data":25564,"content":25565,"nodeType":866},{},[25566],{"data":25567,"marks":25568,"value":16917,"nodeType":865},{},[],{"data":25570,"content":25571,"nodeType":866},{},[25572],{"data":25573,"marks":25574,"value":16924,"nodeType":865},{},[],{"data":25576,"content":25579,"nodeType":875},{"target":25577},{"sys":25578},{"id":16929,"type":872,"linkType":873},[],{"data":25581,"content":25582,"nodeType":879},{},[],{"data":25584,"content":25585,"nodeType":889},{},[25586],{"data":25587,"marks":25588,"value":16941,"nodeType":865},{},[25589],{"type":887},{"data":25591,"content":25592,"nodeType":866},{},[25593],{"data":25594,"marks":25595,"value":16948,"nodeType":865},{},[],{"data":25597,"content":25598,"nodeType":866},{},[25599,25602,25609],{"data":25600,"marks":25601,"value":16955,"nodeType":865},{},[],{"data":25603,"content":25604,"nodeType":905},{"uri":3455},[25605],{"data":25606,"marks":25607,"value":16963,"nodeType":865},{},[25608],{"type":1070},{"data":25610,"marks":25611,"value":1711,"nodeType":865},{},[],{"data":25613,"content":25614,"nodeType":1649},{},[25615],{"data":25616,"content":25617,"nodeType":866},{},[25618],{"data":25619,"marks":25620,"value":16977,"nodeType":865},{},[25621],{"type":887},{"data":25623,"content":25624,"nodeType":866},{},[25625],{"data":25626,"marks":25627,"value":16984,"nodeType":865},{},[],{"data":25629,"content":25630,"nodeType":866},{},[25631],{"data":25632,"marks":25633,"value":16991,"nodeType":865},{},[],{"data":25635,"content":25636,"nodeType":866},{},[25637],{"data":25638,"marks":25639,"value":16998,"nodeType":865},{},[],{"data":25641,"content":25642,"nodeType":2718},{},[25643,25652,25661,25670,25679,25688,25697,25706,25715],{"data":25644,"content":25645,"nodeType":2654},{},[25646],{"data":25647,"content":25648,"nodeType":866},{},[25649],{"data":25650,"marks":25651,"value":17011,"nodeType":865},{},[],{"data":25653,"content":25654,"nodeType":2654},{},[25655],{"data":25656,"content":25657,"nodeType":866},{},[25658],{"data":25659,"marks":25660,"value":17021,"nodeType":865},{},[],{"data":25662,"content":25663,"nodeType":2654},{},[25664],{"data":25665,"content":25666,"nodeType":866},{},[25667],{"data":25668,"marks":25669,"value":17031,"nodeType":865},{},[],{"data":25671,"content":25672,"nodeType":2654},{},[25673],{"data":25674,"content":25675,"nodeType":866},{},[25676],{"data":25677,"marks":25678,"value":17041,"nodeType":865},{},[],{"data":25680,"content":25681,"nodeType":2654},{},[25682],{"data":25683,"content":25684,"nodeType":866},{},[25685],{"data":25686,"marks":25687,"value":17051,"nodeType":865},{},[],{"data":25689,"content":25690,"nodeType":2654},{},[25691],{"data":25692,"content":25693,"nodeType":866},{},[25694],{"data":25695,"marks":25696,"value":17061,"nodeType":865},{},[],{"data":25698,"content":25699,"nodeType":2654},{},[25700],{"data":25701,"content":25702,"nodeType":866},{},[25703],{"data":25704,"marks":25705,"value":17071,"nodeType":865},{},[],{"data":25707,"content":25708,"nodeType":2654},{},[25709],{"data":25710,"content":25711,"nodeType":866},{},[25712],{"data":25713,"marks":25714,"value":17081,"nodeType":865},{},[],{"data":25716,"content":25717,"nodeType":2654},{},[25718],{"data":25719,"content":25720,"nodeType":866},{},[25721],{"data":25722,"marks":25723,"value":17091,"nodeType":865},{},[],{"data":25725,"content":25726,"nodeType":879},{},[],{"data":25728,"content":25729,"nodeType":889},{},[25730],{"data":25731,"marks":25732,"value":17102,"nodeType":865},{},[25733],{"type":887},{"data":25735,"content":25736,"nodeType":2718},{},[25737,25746,25755,25764,25773,25782,25791,25800],{"data":25738,"content":25739,"nodeType":2654},{},[25740],{"data":25741,"content":25742,"nodeType":866},{},[25743],{"data":25744,"marks":25745,"value":17115,"nodeType":865},{},[],{"data":25747,"content":25748,"nodeType":2654},{},[25749],{"data":25750,"content":25751,"nodeType":866},{},[25752],{"data":25753,"marks":25754,"value":17125,"nodeType":865},{},[],{"data":25756,"content":25757,"nodeType":2654},{},[25758],{"data":25759,"content":25760,"nodeType":866},{},[25761],{"data":25762,"marks":25763,"value":17135,"nodeType":865},{},[],{"data":25765,"content":25766,"nodeType":2654},{},[25767],{"data":25768,"content":25769,"nodeType":866},{},[25770],{"data":25771,"marks":25772,"value":17145,"nodeType":865},{},[],{"data":25774,"content":25775,"nodeType":2654},{},[25776],{"data":25777,"content":25778,"nodeType":866},{},[25779],{"data":25780,"marks":25781,"value":17155,"nodeType":865},{},[],{"data":25783,"content":25784,"nodeType":2654},{},[25785],{"data":25786,"content":25787,"nodeType":866},{},[25788],{"data":25789,"marks":25790,"value":17165,"nodeType":865},{},[],{"data":25792,"content":25793,"nodeType":2654},{},[25794],{"data":25795,"content":25796,"nodeType":866},{},[25797],{"data":25798,"marks":25799,"value":17175,"nodeType":865},{},[],{"data":25801,"content":25802,"nodeType":2654},{},[25803],{"data":25804,"content":25805,"nodeType":866},{},[25806],{"data":25807,"marks":25808,"value":17185,"nodeType":865},{},[],{"data":25810,"content":25813,"nodeType":875},{"target":25811},{"sys":25812},{"id":17190,"type":872,"linkType":873},[],{"data":25815,"content":25816,"nodeType":879},{},[],{"data":25818,"content":25819,"nodeType":889},{},[25820],{"data":25821,"marks":25822,"value":17202,"nodeType":865},{},[25823],{"type":887},{"data":25825,"content":25826,"nodeType":2315},{},[25827],{"data":25828,"marks":25829,"value":17210,"nodeType":865},{},[25830],{"type":887},{"data":25832,"content":25833,"nodeType":866},{},[25834],{"data":25835,"marks":25836,"value":17217,"nodeType":865},{},[],{"data":25838,"content":25839,"nodeType":866},{},[25840],{"data":25841,"marks":25842,"value":17224,"nodeType":865},{},[],{"data":25844,"content":25845,"nodeType":2315},{},[25846],{"data":25847,"marks":25848,"value":17232,"nodeType":865},{},[25849],{"type":887},{"data":25851,"content":25852,"nodeType":866},{},[25853,25856,25863],{"data":25854,"marks":25855,"value":17239,"nodeType":865},{},[],{"data":25857,"content":25858,"nodeType":905},{"uri":945},[25859],{"data":25860,"marks":25861,"value":950,"nodeType":865},{},[25862],{"type":1070},{"data":25864,"marks":25865,"value":1711,"nodeType":865},{},[],{"data":25867,"content":25868,"nodeType":866},{},[25869],{"data":25870,"marks":25871,"value":17256,"nodeType":865},{},[],{"data":25873,"content":25874,"nodeType":2315},{},[25875],{"data":25876,"marks":25877,"value":17264,"nodeType":865},{},[25878],{"type":887},{"data":25880,"content":25881,"nodeType":866},{},[25882],{"data":25883,"marks":25884,"value":17271,"nodeType":865},{},[],{"data":25886,"content":25887,"nodeType":866},{},[25888],{"data":25889,"marks":25890,"value":17278,"nodeType":865},{},[],{"data":25892,"content":25893,"nodeType":2315},{},[25894],{"data":25895,"marks":25896,"value":17286,"nodeType":865},{},[25897],{"type":887},{"data":25899,"content":25900,"nodeType":866},{},[25901],{"data":25902,"marks":25903,"value":17293,"nodeType":865},{},[],{"data":25905,"content":25906,"nodeType":866},{},[25907],{"data":25908,"marks":25909,"value":17300,"nodeType":865},{},[],{"data":25911,"content":25912,"nodeType":866},{},[25913,25916,25923],{"data":25914,"marks":25915,"value":17307,"nodeType":865},{},[],{"data":25917,"content":25918,"nodeType":905},{"uri":17310},[25919],{"data":25920,"marks":25921,"value":17316,"nodeType":865},{},[25922],{"type":1070},{"data":25924,"marks":25925,"value":17320,"nodeType":865},{},[],{"data":25927,"content":25930,"nodeType":875},{"target":25928},{"sys":25929},{"id":17325,"type":872,"linkType":873},[],{"data":25932,"content":25933,"nodeType":879},{},[],{"data":25935,"content":25936,"nodeType":889},{},[25937],{"data":25938,"marks":25939,"value":17337,"nodeType":865},{},[25940],{"type":887},{"data":25942,"content":25943,"nodeType":2315},{},[25944],{"data":25945,"marks":25946,"value":17345,"nodeType":865},{},[25947],{"type":887},{"data":25949,"content":25950,"nodeType":866},{},[25951],{"data":25952,"marks":25953,"value":17352,"nodeType":865},{},[],{"data":25955,"content":25956,"nodeType":2718},{},[25957,25976,25995,26024],{"data":25958,"content":25959,"nodeType":2654},{},[25960],{"data":25961,"content":25962,"nodeType":866},{},[25963,25966,25973],{"data":25964,"marks":25965,"value":17365,"nodeType":865},{},[],{"data":25967,"content":25968,"nodeType":905},{"uri":17368},[25969],{"data":25970,"marks":25971,"value":17374,"nodeType":865},{},[25972],{"type":1070},{"data":25974,"marks":25975,"value":17378,"nodeType":865},{},[],{"data":25977,"content":25978,"nodeType":2654},{},[25979],{"data":25980,"content":25981,"nodeType":866},{},[25982,25985,25992],{"data":25983,"marks":25984,"value":17388,"nodeType":865},{},[],{"data":25986,"content":25987,"nodeType":905},{"uri":6333},[25988],{"data":25989,"marks":25990,"value":17396,"nodeType":865},{},[25991],{"type":1070},{"data":25993,"marks":25994,"value":1193,"nodeType":865},{},[],{"data":25996,"content":25997,"nodeType":2654},{},[25998],{"data":25999,"content":26000,"nodeType":866},{},[26001,26004,26011,26014,26021],{"data":26002,"marks":26003,"value":17409,"nodeType":865},{},[],{"data":26005,"content":26006,"nodeType":905},{"uri":945},[26007],{"data":26008,"marks":26009,"value":7064,"nodeType":865},{},[26010],{"type":1070},{"data":26012,"marks":26013,"value":17420,"nodeType":865},{},[],{"data":26015,"content":26016,"nodeType":905},{"uri":17423},[26017],{"data":26018,"marks":26019,"value":17429,"nodeType":865},{},[26020],{"type":1070},{"data":26022,"marks":26023,"value":17433,"nodeType":865},{},[],{"data":26025,"content":26026,"nodeType":2654},{},[26027],{"data":26028,"content":26029,"nodeType":866},{},[26030,26033,26040],{"data":26031,"marks":26032,"value":17443,"nodeType":865},{},[],{"data":26034,"content":26035,"nodeType":905},{"uri":6333},[26036],{"data":26037,"marks":26038,"value":17451,"nodeType":865},{},[26039],{"type":1070},{"data":26041,"marks":26042,"value":17455,"nodeType":865},{},[],{"data":26044,"content":26045,"nodeType":866},{},[26046],{"data":26047,"marks":26048,"value":17462,"nodeType":865},{},[],{"data":26050,"content":26051,"nodeType":2315},{},[26052],{"data":26053,"marks":26054,"value":17470,"nodeType":865},{},[26055],{"type":887},{"data":26057,"content":26058,"nodeType":866},{},[26059],{"data":26060,"marks":26061,"value":17477,"nodeType":865},{},[],{"data":26063,"content":26064,"nodeType":866},{},[26065],{"data":26066,"marks":26067,"value":17484,"nodeType":865},{},[],{"data":26069,"content":26072,"nodeType":875},{"target":26070},{"sys":26071},{"id":17489,"type":872,"linkType":873},[],{"data":26074,"content":26075,"nodeType":2315},{},[26076],{"data":26077,"marks":26078,"value":17498,"nodeType":865},{},[26079],{"type":887},{"data":26081,"content":26082,"nodeType":866},{},[26083],{"data":26084,"marks":26085,"value":17505,"nodeType":865},{},[],{"data":26087,"content":26088,"nodeType":866},{},[26089],{"data":26090,"marks":26091,"value":17512,"nodeType":865},{},[],{"data":26093,"content":26094,"nodeType":866},{},[26095],{"data":26096,"marks":26097,"value":17519,"nodeType":865},{},[],{"data":26099,"content":26100,"nodeType":2315},{},[26101],{"data":26102,"marks":26103,"value":17527,"nodeType":865},{},[26104],{"type":887},{"data":26106,"content":26107,"nodeType":866},{},[26108],{"data":26109,"marks":26110,"value":17534,"nodeType":865},{},[],{"data":26112,"content":26113,"nodeType":866},{},[26114],{"data":26115,"marks":26116,"value":17541,"nodeType":865},{},[],{"data":26118,"content":26119,"nodeType":866},{},[26120],{"data":26121,"marks":26122,"value":17548,"nodeType":865},{},[],{"data":26124,"content":26125,"nodeType":866},{},[26126],{"data":26127,"marks":26128,"value":17555,"nodeType":865},{},[],{"data":26130,"content":26133,"nodeType":875},{"target":26131},{"sys":26132},{"id":17560,"type":872,"linkType":873},[],{"data":26135,"content":26136,"nodeType":879},{},[],{"data":26138,"content":26139,"nodeType":889},{},[26140],{"data":26141,"marks":26142,"value":17572,"nodeType":865},{},[26143],{"type":887},{"data":26145,"content":26146,"nodeType":866},{},[26147],{"data":26148,"marks":26149,"value":17579,"nodeType":865},{},[],{"data":26151,"content":26152,"nodeType":2718},{},[26153,26162,26171],{"data":26154,"content":26155,"nodeType":2654},{},[26156],{"data":26157,"content":26158,"nodeType":866},{},[26159],{"data":26160,"marks":26161,"value":17592,"nodeType":865},{},[],{"data":26163,"content":26164,"nodeType":2654},{},[26165],{"data":26166,"content":26167,"nodeType":866},{},[26168],{"data":26169,"marks":26170,"value":17602,"nodeType":865},{},[],{"data":26172,"content":26173,"nodeType":2654},{},[26174],{"data":26175,"content":26176,"nodeType":866},{},[26177],{"data":26178,"marks":26179,"value":17612,"nodeType":865},{},[],{"data":26181,"content":26182,"nodeType":866},{},[26183],{"data":26184,"marks":26185,"value":17619,"nodeType":865},{},[],{"data":26187,"content":26188,"nodeType":866},{},[26189,26192,26198],{"data":26190,"marks":26191,"value":17626,"nodeType":865},{},[],{"data":26193,"content":26194,"nodeType":905},{"uri":17629},[26195],{"data":26196,"marks":26197,"value":17634,"nodeType":865},{},[],{"data":26199,"marks":26200,"value":17638,"nodeType":865},{},[],{"data":26202,"content":26203,"nodeType":866},{},[26204,26207,26214],{"data":26205,"marks":26206,"value":17645,"nodeType":865},{},[],{"data":26208,"content":26209,"nodeType":905},{"uri":17648},[26210],{"data":26211,"marks":26212,"value":17654,"nodeType":865},{},[26213],{"type":1070},{"data":26215,"marks":26216,"value":17658,"nodeType":865},{},[],{"data":26218,"content":26221,"nodeType":875},{"target":26219},{"sys":26220},{"id":17663,"type":872,"linkType":873},[],{"data":26223,"content":26224,"nodeType":866},{},[26225],{"data":26226,"marks":26227,"value":21,"nodeType":865},{},[],{"items":26229},[26230],{"sys":26231,"name":2144},{"id":2143},{"items":26233},[26234],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":26235},{"url":3016},{"__typename":1544,"sys":26237,"content":26238,"title":20875,"synopsis":20876,"hashTags":59,"publishedDate":20877,"slug":20878,"tagsCollection":26779,"authorsCollection":26785},{"id":20259},{"json":26239},{"data":26240,"content":26241,"nodeType":1522},{},[26242,26248,26254,26261,26284,26290,26295,26298,26305,26311,26317,26356,26362,26368,26371,26378,26384,26390,26396,26412,26418,26423,26430,26436,26442,26448,26453,26456,26463,26470,26476,26483,26489,26547,26553,26560,26566,26596,26603,26609,26616,26622,26629,26635,26683,26689,26692,26699,26705,26720,26750,26768,26773],{"data":26243,"content":26244,"nodeType":866},{},[26245],{"data":26246,"marks":26247,"value":20270,"nodeType":865},{},[],{"data":26249,"content":26250,"nodeType":866},{},[26251],{"data":26252,"marks":26253,"value":20277,"nodeType":865},{},[],{"data":26255,"content":26256,"nodeType":866},{},[26257],{"data":26258,"marks":26259,"value":20285,"nodeType":865},{},[26260],{"type":887},{"data":26262,"content":26263,"nodeType":866},{},[26264,26267,26274,26277,26281],{"data":26265,"marks":26266,"value":20292,"nodeType":865},{},[],{"data":26268,"content":26269,"nodeType":905},{"uri":20295},[26270],{"data":26271,"marks":26272,"value":20301,"nodeType":865},{},[26273],{"type":1070},{"data":26275,"marks":26276,"value":20305,"nodeType":865},{},[],{"data":26278,"marks":26279,"value":20310,"nodeType":865},{},[26280],{"type":2757},{"data":26282,"marks":26283,"value":20314,"nodeType":865},{},[],{"data":26285,"content":26286,"nodeType":866},{},[26287],{"data":26288,"marks":26289,"value":20321,"nodeType":865},{},[],{"data":26291,"content":26294,"nodeType":875},{"target":26292},{"sys":26293},{"id":20326,"type":872,"linkType":873},[],{"data":26296,"content":26297,"nodeType":879},{},[],{"data":26299,"content":26300,"nodeType":889},{},[26301],{"data":26302,"marks":26303,"value":20338,"nodeType":865},{},[26304],{"type":887},{"data":26306,"content":26307,"nodeType":866},{},[26308],{"data":26309,"marks":26310,"value":20345,"nodeType":865},{},[],{"data":26312,"content":26313,"nodeType":866},{},[26314],{"data":26315,"marks":26316,"value":20352,"nodeType":865},{},[],{"data":26318,"content":26319,"nodeType":2718},{},[26320,26329,26338,26347],{"data":26321,"content":26322,"nodeType":2654},{},[26323],{"data":26324,"content":26325,"nodeType":866},{},[26326],{"data":26327,"marks":26328,"value":20365,"nodeType":865},{},[],{"data":26330,"content":26331,"nodeType":2654},{},[26332],{"data":26333,"content":26334,"nodeType":866},{},[26335],{"data":26336,"marks":26337,"value":20375,"nodeType":865},{},[],{"data":26339,"content":26340,"nodeType":2654},{},[26341],{"data":26342,"content":26343,"nodeType":866},{},[26344],{"data":26345,"marks":26346,"value":20385,"nodeType":865},{},[],{"data":26348,"content":26349,"nodeType":2654},{},[26350],{"data":26351,"content":26352,"nodeType":866},{},[26353],{"data":26354,"marks":26355,"value":20395,"nodeType":865},{},[],{"data":26357,"content":26358,"nodeType":866},{},[26359],{"data":26360,"marks":26361,"value":20402,"nodeType":865},{},[],{"data":26363,"content":26364,"nodeType":866},{},[26365],{"data":26366,"marks":26367,"value":20409,"nodeType":865},{},[],{"data":26369,"content":26370,"nodeType":879},{},[],{"data":26372,"content":26373,"nodeType":889},{},[26374],{"data":26375,"marks":26376,"value":20420,"nodeType":865},{},[26377],{"type":887},{"data":26379,"content":26380,"nodeType":866},{},[26381],{"data":26382,"marks":26383,"value":20427,"nodeType":865},{},[],{"data":26385,"content":26386,"nodeType":866},{},[26387],{"data":26388,"marks":26389,"value":20434,"nodeType":865},{},[],{"data":26391,"content":26392,"nodeType":866},{},[26393],{"data":26394,"marks":26395,"value":20441,"nodeType":865},{},[],{"data":26397,"content":26398,"nodeType":866},{},[26399,26402,26409],{"data":26400,"marks":26401,"value":20448,"nodeType":865},{},[],{"data":26403,"content":26404,"nodeType":905},{"uri":3474},[26405],{"data":26406,"marks":26407,"value":12232,"nodeType":865},{},[26408],{"type":1070},{"data":26410,"marks":26411,"value":20459,"nodeType":865},{},[],{"data":26413,"content":26414,"nodeType":866},{},[26415],{"data":26416,"marks":26417,"value":20466,"nodeType":865},{},[],{"data":26419,"content":26422,"nodeType":875},{"target":26420},{"sys":26421},{"id":20471,"type":872,"linkType":873},[],{"data":26424,"content":26425,"nodeType":889},{},[26426],{"data":26427,"marks":26428,"value":20480,"nodeType":865},{},[26429],{"type":887},{"data":26431,"content":26432,"nodeType":866},{},[26433],{"data":26434,"marks":26435,"value":20487,"nodeType":865},{},[],{"data":26437,"content":26438,"nodeType":866},{},[26439],{"data":26440,"marks":26441,"value":20494,"nodeType":865},{},[],{"data":26443,"content":26444,"nodeType":866},{},[26445],{"data":26446,"marks":26447,"value":20501,"nodeType":865},{},[],{"data":26449,"content":26452,"nodeType":875},{"target":26450},{"sys":26451},{"id":20506,"type":872,"linkType":873},[],{"data":26454,"content":26455,"nodeType":879},{},[],{"data":26457,"content":26458,"nodeType":889},{},[26459],{"data":26460,"marks":26461,"value":20518,"nodeType":865},{},[26462],{"type":887},{"data":26464,"content":26465,"nodeType":2315},{},[26466],{"data":26467,"marks":26468,"value":20526,"nodeType":865},{},[26469],{"type":887},{"data":26471,"content":26472,"nodeType":866},{},[26473],{"data":26474,"marks":26475,"value":20533,"nodeType":865},{},[],{"data":26477,"content":26478,"nodeType":2315},{},[26479],{"data":26480,"marks":26481,"value":20541,"nodeType":865},{},[26482],{"type":887},{"data":26484,"content":26485,"nodeType":866},{},[26486],{"data":26487,"marks":26488,"value":20548,"nodeType":865},{},[],{"data":26490,"content":26491,"nodeType":2718},{},[26492,26501,26510,26529,26538],{"data":26493,"content":26494,"nodeType":2654},{},[26495],{"data":26496,"content":26497,"nodeType":866},{},[26498],{"data":26499,"marks":26500,"value":20561,"nodeType":865},{},[],{"data":26502,"content":26503,"nodeType":2654},{},[26504],{"data":26505,"content":26506,"nodeType":866},{},[26507],{"data":26508,"marks":26509,"value":20571,"nodeType":865},{},[],{"data":26511,"content":26512,"nodeType":2654},{},[26513],{"data":26514,"content":26515,"nodeType":866},{},[26516,26519,26526],{"data":26517,"marks":26518,"value":20581,"nodeType":865},{},[],{"data":26520,"content":26521,"nodeType":905},{"uri":20584},[26522],{"data":26523,"marks":26524,"value":20590,"nodeType":865},{},[26525],{"type":1070},{"data":26527,"marks":26528,"value":21,"nodeType":865},{},[],{"data":26530,"content":26531,"nodeType":2654},{},[26532],{"data":26533,"content":26534,"nodeType":866},{},[26535],{"data":26536,"marks":26537,"value":20603,"nodeType":865},{},[],{"data":26539,"content":26540,"nodeType":2654},{},[26541],{"data":26542,"content":26543,"nodeType":866},{},[26544],{"data":26545,"marks":26546,"value":20613,"nodeType":865},{},[],{"data":26548,"content":26549,"nodeType":866},{},[26550],{"data":26551,"marks":26552,"value":20620,"nodeType":865},{},[],{"data":26554,"content":26555,"nodeType":2315},{},[26556],{"data":26557,"marks":26558,"value":20628,"nodeType":865},{},[26559],{"type":887},{"data":26561,"content":26562,"nodeType":866},{},[26563],{"data":26564,"marks":26565,"value":20635,"nodeType":865},{},[],{"data":26567,"content":26568,"nodeType":2718},{},[26569,26578,26587],{"data":26570,"content":26571,"nodeType":2654},{},[26572],{"data":26573,"content":26574,"nodeType":866},{},[26575],{"data":26576,"marks":26577,"value":20648,"nodeType":865},{},[],{"data":26579,"content":26580,"nodeType":2654},{},[26581],{"data":26582,"content":26583,"nodeType":866},{},[26584],{"data":26585,"marks":26586,"value":20658,"nodeType":865},{},[],{"data":26588,"content":26589,"nodeType":2654},{},[26590],{"data":26591,"content":26592,"nodeType":866},{},[26593],{"data":26594,"marks":26595,"value":20668,"nodeType":865},{},[],{"data":26597,"content":26598,"nodeType":2315},{},[26599],{"data":26600,"marks":26601,"value":20676,"nodeType":865},{},[26602],{"type":887},{"data":26604,"content":26605,"nodeType":866},{},[26606],{"data":26607,"marks":26608,"value":20683,"nodeType":865},{},[],{"data":26610,"content":26611,"nodeType":2315},{},[26612],{"data":26613,"marks":26614,"value":20691,"nodeType":865},{},[26615],{"type":887},{"data":26617,"content":26618,"nodeType":866},{},[26619],{"data":26620,"marks":26621,"value":20698,"nodeType":865},{},[],{"data":26623,"content":26624,"nodeType":2315},{},[26625],{"data":26626,"marks":26627,"value":20706,"nodeType":865},{},[26628],{"type":887},{"data":26630,"content":26631,"nodeType":866},{},[26632],{"data":26633,"marks":26634,"value":20713,"nodeType":865},{},[],{"data":26636,"content":26637,"nodeType":2718},{},[26638,26647,26656,26665,26674],{"data":26639,"content":26640,"nodeType":2654},{},[26641],{"data":26642,"content":26643,"nodeType":866},{},[26644],{"data":26645,"marks":26646,"value":20726,"nodeType":865},{},[],{"data":26648,"content":26649,"nodeType":2654},{},[26650],{"data":26651,"content":26652,"nodeType":866},{},[26653],{"data":26654,"marks":26655,"value":20736,"nodeType":865},{},[],{"data":26657,"content":26658,"nodeType":2654},{},[26659],{"data":26660,"content":26661,"nodeType":866},{},[26662],{"data":26663,"marks":26664,"value":20746,"nodeType":865},{},[],{"data":26666,"content":26667,"nodeType":2654},{},[26668],{"data":26669,"content":26670,"nodeType":866},{},[26671],{"data":26672,"marks":26673,"value":20756,"nodeType":865},{},[],{"data":26675,"content":26676,"nodeType":2654},{},[26677],{"data":26678,"content":26679,"nodeType":866},{},[26680],{"data":26681,"marks":26682,"value":20766,"nodeType":865},{},[],{"data":26684,"content":26685,"nodeType":866},{},[26686],{"data":26687,"marks":26688,"value":20773,"nodeType":865},{},[],{"data":26690,"content":26691,"nodeType":879},{},[],{"data":26693,"content":26694,"nodeType":889},{},[26695],{"data":26696,"marks":26697,"value":20784,"nodeType":865},{},[26698],{"type":887},{"data":26700,"content":26701,"nodeType":866},{},[26702],{"data":26703,"marks":26704,"value":20791,"nodeType":865},{},[],{"data":26706,"content":26707,"nodeType":866},{},[26708,26711,26717],{"data":26709,"marks":26710,"value":20798,"nodeType":865},{},[],{"data":26712,"content":26713,"nodeType":905},{"uri":20295},[26714],{"data":26715,"marks":26716,"value":20805,"nodeType":865},{},[],{"data":26718,"marks":26719,"value":1193,"nodeType":865},{},[],{"data":26721,"content":26722,"nodeType":2718},{},[26723,26732,26741],{"data":26724,"content":26725,"nodeType":2654},{},[26726],{"data":26727,"content":26728,"nodeType":866},{},[26729],{"data":26730,"marks":26731,"value":20821,"nodeType":865},{},[],{"data":26733,"content":26734,"nodeType":2654},{},[26735],{"data":26736,"content":26737,"nodeType":866},{},[26738],{"data":26739,"marks":26740,"value":20831,"nodeType":865},{},[],{"data":26742,"content":26743,"nodeType":2654},{},[26744],{"data":26745,"content":26746,"nodeType":866},{},[26747],{"data":26748,"marks":26749,"value":20841,"nodeType":865},{},[],{"data":26751,"content":26752,"nodeType":866},{},[26753,26757,26764],{"data":26754,"marks":26755,"value":20849,"nodeType":865},{},[26756],{"type":887},{"data":26758,"content":26759,"nodeType":905},{"uri":3686},[26760],{"data":26761,"marks":26762,"value":20857,"nodeType":865},{},[26763],{"type":887},{"data":26765,"marks":26766,"value":20862,"nodeType":865},{},[26767],{"type":887},{"data":26769,"content":26772,"nodeType":875},{"target":26770},{"sys":26771},{"id":20867,"type":872,"linkType":873},[],{"data":26774,"content":26775,"nodeType":866},{},[26776],{"data":26777,"marks":26778,"value":21,"nodeType":865},{},[],{"items":26780},[26781,26783],{"sys":26782,"name":2144},{"id":2143},{"sys":26784,"name":342},{"id":3008},{"items":26786},[26787],{"fullName":20888,"firstName":20889,"jobTitle":9645,"profilePicture":26788},{"url":20891},"blog/scattered-spider-ttp-evolution-in-2025",{"json":26791},{"data":26792,"content":26793,"nodeType":1522},{},[26794],{"data":26795,"content":26796,"nodeType":866},{},[26797],{"data":26798,"marks":26799,"value":26800,"nodeType":865},{},[],"How the notorious Scattered Spider cyber criminal group are evolving their TTPs in 2025 to bypass security controls like MFA and take over accounts on internet applications and services. ",{"id":9507,"publishedAt":26802},"2026-08-13T09:35:46.987Z",{"items":26804},[26805,26807],{"sys":26806,"name":2144},{"id":2143},{"sys":26808,"name":342},{"id":3008},{"items":26810},[26811,26813,26815,26817,26819,26821,26823,26825,26827,26829,26831,26833,26835,26837,26839,26841,26843,26845,26847,26849,26851,26853,26855,26857],{"sys":26812,"name":279,"slug":280,"tier":31},{"id":276},{"sys":26814,"name":413,"slug":414,"tier":31},{"id":410},{"sys":26816,"name":519,"slug":520,"tier":31},{"id":516},{"sys":26818,"name":642,"slug":643,"tier":31},{"id":639},{"sys":26820,"name":342,"slug":343,"tier":31},{"id":339},{"sys":26822,"name":545,"slug":546,"tier":31},{"id":542},{"sys":26824,"name":650,"slug":651,"tier":45},{"id":647},{"sys":26826,"name":261,"slug":262,"tier":45},{"id":258},{"sys":26828,"name":466,"slug":467,"tier":45},{"id":463},{"sys":26830,"name":404,"slug":405,"tier":45},{"id":401},{"sys":26832,"name":333,"slug":334,"tier":45},{"id":330},{"sys":26834,"name":324,"slug":325,"tier":45},{"id":321},{"sys":26836,"name":607,"slug":608,"tier":45},{"id":604},{"sys":26838,"name":422,"slug":423,"tier":45},{"id":419},{"sys":26840,"name":571,"slug":572,"tier":45},{"id":568},{"sys":26842,"name":395,"slug":396,"tier":45},{"id":392},{"sys":26844,"name":484,"slug":485,"tier":45},{"id":481},{"sys":26846,"name":537,"slug":538,"tier":45},{"id":534},{"sys":26848,"name":457,"slug":458,"tier":45},{"id":454},{"sys":26850,"name":511,"slug":512,"tier":45},{"id":508},{"sys":26852,"name":502,"slug":503,"tier":45},{"id":499},{"sys":26854,"name":475,"slug":476,"tier":45},{"id":472},{"sys":26856,"name":440,"slug":441,"tier":45},{"id":437},{"sys":26858,"name":528,"slug":529,"tier":45},{"id":525},"oLIODxEHsA2m841saCx3-KU2xiG-Qo5TlaPa70w1JEg",{"id":26861,"title":18373,"authorsCollection":26862,"content":26867,"extension":228,"faqItemsCollection":27573,"faqTitle":59,"featured":6,"hashTags":59,"meta":27575,"metaTitle":27576,"ogImage":27577,"postType":19311,"publishedDate":18375,"relatedBlogPostsCollection":27579,"slug":18376,"stem":29868,"subtitle":59,"summary":29869,"synopsis":18374,"sys":29879,"tagsCollection":29881,"topicsCollection":29887,"__hash__":29919},"blog/blog/why-attackers-are-targeting-jira-with-stolen-credentials.json",{"items":26863},[26864],{"fullName":3012,"firstName":3013,"jobTitle":3014,"socialLinks":26865,"profilePicture":26866},[6742],{"url":3016},{"json":26868,"links":27463},{"data":26869,"content":26870,"nodeType":1522},{},[26871,26884,26889,26895,26900,26903,26910,26916,26997,27002,27008,27014,27017,27024,27031,27037,27085,27092,27107,27131,27137,27144,27150,27155,27170,27183,27188,27194,27217,27223,27229,27259,27265,27271,27287,27290,27297,27303,27309,27315,27322,27338,27343,27350,27366,27381,27386,27393,27399,27415,27421,27426,27429,27436,27442,27448],{"data":26872,"content":26873,"nodeType":866},{},[26874,26877,26881],{"data":26875,"marks":26876,"value":17695,"nodeType":865},{},[],{"data":26878,"marks":26879,"value":17700,"nodeType":865},{},[26880],{"type":887},{"data":26882,"marks":26883,"value":17704,"nodeType":865},{},[],{"data":26885,"content":26888,"nodeType":875},{"target":26886},{"sys":26887},{"id":17709,"type":872,"linkType":873},[],{"data":26890,"content":26891,"nodeType":866},{},[26892],{"data":26893,"marks":26894,"value":21,"nodeType":865},{},[],{"data":26896,"content":26899,"nodeType":875},{"target":26897},{"sys":26898},{"id":17721,"type":872,"linkType":873},[],{"data":26901,"content":26902,"nodeType":879},{},[],{"data":26904,"content":26905,"nodeType":889},{},[26906],{"data":26907,"marks":26908,"value":17733,"nodeType":865},{},[26909],{"type":887},{"data":26911,"content":26912,"nodeType":866},{},[26913],{"data":26914,"marks":26915,"value":17740,"nodeType":865},{},[],{"data":26917,"content":26918,"nodeType":2718},{},[26919,26932,26945,26958,26971,26984],{"data":26920,"content":26921,"nodeType":2654},{},[26922],{"data":26923,"content":26924,"nodeType":866},{},[26925,26929],{"data":26926,"marks":26927,"value":17754,"nodeType":865},{},[26928],{"type":887},{"data":26930,"marks":26931,"value":17758,"nodeType":865},{},[],{"data":26933,"content":26934,"nodeType":2654},{},[26935],{"data":26936,"content":26937,"nodeType":866},{},[26938,26942],{"data":26939,"marks":26940,"value":17769,"nodeType":865},{},[26941],{"type":887},{"data":26943,"marks":26944,"value":17773,"nodeType":865},{},[],{"data":26946,"content":26947,"nodeType":2654},{},[26948],{"data":26949,"content":26950,"nodeType":866},{},[26951,26955],{"data":26952,"marks":26953,"value":17784,"nodeType":865},{},[26954],{"type":887},{"data":26956,"marks":26957,"value":17788,"nodeType":865},{},[],{"data":26959,"content":26960,"nodeType":2654},{},[26961],{"data":26962,"content":26963,"nodeType":866},{},[26964,26968],{"data":26965,"marks":26966,"value":17799,"nodeType":865},{},[26967],{"type":887},{"data":26969,"marks":26970,"value":17803,"nodeType":865},{},[],{"data":26972,"content":26973,"nodeType":2654},{},[26974],{"data":26975,"content":26976,"nodeType":866},{},[26977,26981],{"data":26978,"marks":26979,"value":17814,"nodeType":865},{},[26980],{"type":887},{"data":26982,"marks":26983,"value":17818,"nodeType":865},{},[],{"data":26985,"content":26986,"nodeType":2654},{},[26987],{"data":26988,"content":26989,"nodeType":866},{},[26990,26994],{"data":26991,"marks":26992,"value":17829,"nodeType":865},{},[26993],{"type":887},{"data":26995,"marks":26996,"value":17833,"nodeType":865},{},[],{"data":26998,"content":27001,"nodeType":875},{"target":26999},{"sys":27000},{"id":17838,"type":872,"linkType":873},[],{"data":27003,"content":27004,"nodeType":866},{},[27005],{"data":27006,"marks":27007,"value":17846,"nodeType":865},{},[],{"data":27009,"content":27010,"nodeType":866},{},[27011],{"data":27012,"marks":27013,"value":17853,"nodeType":865},{},[],{"data":27015,"content":27016,"nodeType":879},{},[],{"data":27018,"content":27019,"nodeType":889},{},[27020],{"data":27021,"marks":27022,"value":17864,"nodeType":865},{},[27023],{"type":887},{"data":27025,"content":27026,"nodeType":2315},{},[27027],{"data":27028,"marks":27029,"value":17872,"nodeType":865},{},[27030],{"type":887},{"data":27032,"content":27033,"nodeType":866},{},[27034],{"data":27035,"marks":27036,"value":17879,"nodeType":865},{},[],{"data":27038,"content":27039,"nodeType":2718},{},[27040,27049,27058,27067,27076],{"data":27041,"content":27042,"nodeType":2654},{},[27043],{"data":27044,"content":27045,"nodeType":866},{},[27046],{"data":27047,"marks":27048,"value":17892,"nodeType":865},{},[],{"data":27050,"content":27051,"nodeType":2654},{},[27052],{"data":27053,"content":27054,"nodeType":866},{},[27055],{"data":27056,"marks":27057,"value":17902,"nodeType":865},{},[],{"data":27059,"content":27060,"nodeType":2654},{},[27061],{"data":27062,"content":27063,"nodeType":866},{},[27064],{"data":27065,"marks":27066,"value":17912,"nodeType":865},{},[],{"data":27068,"content":27069,"nodeType":2654},{},[27070],{"data":27071,"content":27072,"nodeType":866},{},[27073],{"data":27074,"marks":27075,"value":17922,"nodeType":865},{},[],{"data":27077,"content":27078,"nodeType":2654},{},[27079],{"data":27080,"content":27081,"nodeType":866},{},[27082],{"data":27083,"marks":27084,"value":17932,"nodeType":865},{},[],{"data":27086,"content":27087,"nodeType":2315},{},[27088],{"data":27089,"marks":27090,"value":17940,"nodeType":865},{},[27091],{"type":887},{"data":27093,"content":27094,"nodeType":866},{},[27095,27098,27104],{"data":27096,"marks":27097,"value":21,"nodeType":865},{},[],{"data":27099,"content":27100,"nodeType":905},{"uri":10411},[27101],{"data":27102,"marks":27103,"value":17953,"nodeType":865},{},[],{"data":27105,"marks":27106,"value":17957,"nodeType":865},{},[],{"data":27108,"content":27109,"nodeType":866},{},[27110,27113,27119,27122,27128],{"data":27111,"marks":27112,"value":17964,"nodeType":865},{},[],{"data":27114,"content":27115,"nodeType":905},{"uri":17967},[27116],{"data":27117,"marks":27118,"value":17972,"nodeType":865},{},[],{"data":27120,"marks":27121,"value":17976,"nodeType":865},{},[],{"data":27123,"content":27124,"nodeType":905},{"uri":933},[27125],{"data":27126,"marks":27127,"value":1143,"nodeType":865},{},[],{"data":27129,"marks":27130,"value":17986,"nodeType":865},{},[],{"data":27132,"content":27133,"nodeType":866},{},[27134],{"data":27135,"marks":27136,"value":17993,"nodeType":865},{},[],{"data":27138,"content":27139,"nodeType":2315},{},[27140],{"data":27141,"marks":27142,"value":18001,"nodeType":865},{},[27143],{"type":887},{"data":27145,"content":27146,"nodeType":866},{},[27147],{"data":27148,"marks":27149,"value":18008,"nodeType":865},{},[],{"data":27151,"content":27154,"nodeType":875},{"target":27152},{"sys":27153},{"id":18013,"type":872,"linkType":873},[],{"data":27156,"content":27157,"nodeType":866},{},[27158,27161,27167],{"data":27159,"marks":27160,"value":18021,"nodeType":865},{},[],{"data":27162,"content":27163,"nodeType":905},{"uri":18024},[27164],{"data":27165,"marks":27166,"value":18029,"nodeType":865},{},[],{"data":27168,"marks":27169,"value":18033,"nodeType":865},{},[],{"data":27171,"content":27172,"nodeType":866},{},[27173,27176,27180],{"data":27174,"marks":27175,"value":18040,"nodeType":865},{},[],{"data":27177,"marks":27178,"value":18045,"nodeType":865},{},[27179],{"type":887},{"data":27181,"marks":27182,"value":18049,"nodeType":865},{},[],{"data":27184,"content":27187,"nodeType":875},{"target":27185},{"sys":27186},{"id":18054,"type":872,"linkType":873},[],{"data":27189,"content":27190,"nodeType":866},{},[27191],{"data":27192,"marks":27193,"value":18062,"nodeType":865},{},[],{"data":27195,"content":27196,"nodeType":866},{},[27197,27200,27207,27210,27214],{"data":27198,"marks":27199,"value":21,"nodeType":865},{},[],{"data":27201,"content":27202,"nodeType":905},{"uri":6333},[27203],{"data":27204,"marks":27205,"value":18076,"nodeType":865},{},[27206],{"type":1070},{"data":27208,"marks":27209,"value":18080,"nodeType":865},{},[],{"data":27211,"marks":27212,"value":18085,"nodeType":865},{},[27213],{"type":887},{"data":27215,"marks":27216,"value":1711,"nodeType":865},{},[],{"data":27218,"content":27219,"nodeType":889},{},[27220],{"data":27221,"marks":27222,"value":18095,"nodeType":865},{},[],{"data":27224,"content":27225,"nodeType":866},{},[27226],{"data":27227,"marks":27228,"value":18102,"nodeType":865},{},[],{"data":27230,"content":27231,"nodeType":2718},{},[27232,27241,27250],{"data":27233,"content":27234,"nodeType":2654},{},[27235],{"data":27236,"content":27237,"nodeType":866},{},[27238],{"data":27239,"marks":27240,"value":18115,"nodeType":865},{},[],{"data":27242,"content":27243,"nodeType":2654},{},[27244],{"data":27245,"content":27246,"nodeType":866},{},[27247],{"data":27248,"marks":27249,"value":18125,"nodeType":865},{},[],{"data":27251,"content":27252,"nodeType":2654},{},[27253],{"data":27254,"content":27255,"nodeType":866},{},[27256],{"data":27257,"marks":27258,"value":18135,"nodeType":865},{},[],{"data":27260,"content":27261,"nodeType":866},{},[27262],{"data":27263,"marks":27264,"value":18142,"nodeType":865},{},[],{"data":27266,"content":27267,"nodeType":866},{},[27268],{"data":27269,"marks":27270,"value":18149,"nodeType":865},{},[],{"data":27272,"content":27273,"nodeType":866},{},[27274,27277,27284],{"data":27275,"marks":27276,"value":18156,"nodeType":865},{},[],{"data":27278,"content":27279,"nodeType":905},{"uri":964},[27280],{"data":27281,"marks":27282,"value":18164,"nodeType":865},{},[27283],{"type":1070},{"data":27285,"marks":27286,"value":18168,"nodeType":865},{},[],{"data":27288,"content":27289,"nodeType":879},{},[],{"data":27291,"content":27292,"nodeType":889},{},[27293],{"data":27294,"marks":27295,"value":18179,"nodeType":865},{},[27296],{"type":887},{"data":27298,"content":27299,"nodeType":866},{},[27300],{"data":27301,"marks":27302,"value":18186,"nodeType":865},{},[],{"data":27304,"content":27305,"nodeType":866},{},[27306],{"data":27307,"marks":27308,"value":18193,"nodeType":865},{},[],{"data":27310,"content":27311,"nodeType":866},{},[27312],{"data":27313,"marks":27314,"value":18200,"nodeType":865},{},[],{"data":27316,"content":27317,"nodeType":2315},{},[27318],{"data":27319,"marks":27320,"value":18208,"nodeType":865},{},[27321],{"type":887},{"data":27323,"content":27324,"nodeType":866},{},[27325,27328,27335],{"data":27326,"marks":27327,"value":18215,"nodeType":865},{},[],{"data":27329,"content":27330,"nodeType":905},{"uri":18218},[27331],{"data":27332,"marks":27333,"value":18224,"nodeType":865},{},[27334],{"type":1070},{"data":27336,"marks":27337,"value":18228,"nodeType":865},{},[],{"data":27339,"content":27342,"nodeType":875},{"target":27340},{"sys":27341},{"id":15014,"type":872,"linkType":873},[],{"data":27344,"content":27345,"nodeType":2315},{},[27346],{"data":27347,"marks":27348,"value":18241,"nodeType":865},{},[27349],{"type":887},{"data":27351,"content":27352,"nodeType":866},{},[27353,27356,27363],{"data":27354,"marks":27355,"value":18248,"nodeType":865},{},[],{"data":27357,"content":27358,"nodeType":905},{"uri":964},[27359],{"data":27360,"marks":27361,"value":18256,"nodeType":865},{},[27362],{"type":1070},{"data":27364,"marks":27365,"value":18260,"nodeType":865},{},[],{"data":27367,"content":27368,"nodeType":866},{},[27369,27372,27378],{"data":27370,"marks":27371,"value":18267,"nodeType":865},{},[],{"data":27373,"content":27374,"nodeType":905},{"uri":18270},[27375],{"data":27376,"marks":27377,"value":18275,"nodeType":865},{},[],{"data":27379,"marks":27380,"value":1711,"nodeType":865},{},[],{"data":27382,"content":27385,"nodeType":875},{"target":27383},{"sys":27384},{"id":18283,"type":872,"linkType":873},[],{"data":27387,"content":27388,"nodeType":2315},{},[27389],{"data":27390,"marks":27391,"value":18292,"nodeType":865},{},[27392],{"type":887},{"data":27394,"content":27395,"nodeType":866},{},[27396],{"data":27397,"marks":27398,"value":18299,"nodeType":865},{},[],{"data":27400,"content":27401,"nodeType":866},{},[27402,27405,27412],{"data":27403,"marks":27404,"value":18306,"nodeType":865},{},[],{"data":27406,"content":27407,"nodeType":905},{"uri":945},[27408],{"data":27409,"marks":27410,"value":7064,"nodeType":865},{},[27411],{"type":1070},{"data":27413,"marks":27414,"value":18317,"nodeType":865},{},[],{"data":27416,"content":27417,"nodeType":866},{},[27418],{"data":27419,"marks":27420,"value":18324,"nodeType":865},{},[],{"data":27422,"content":27425,"nodeType":875},{"target":27423},{"sys":27424},{"id":18329,"type":872,"linkType":873},[],{"data":27427,"content":27428,"nodeType":879},{},[],{"data":27430,"content":27431,"nodeType":889},{},[27432],{"data":27433,"marks":27434,"value":18341,"nodeType":865},{},[27435],{"type":887},{"data":27437,"content":27438,"nodeType":866},{},[27439],{"data":27440,"marks":27441,"value":18348,"nodeType":865},{},[],{"data":27443,"content":27444,"nodeType":866},{},[27445],{"data":27446,"marks":27447,"value":18355,"nodeType":865},{},[],{"data":27449,"content":27450,"nodeType":866},{},[27451,27454,27460],{"data":27452,"marks":27453,"value":13434,"nodeType":865},{},[],{"data":27455,"content":27456,"nodeType":905},{"uri":18364},[27457],{"data":27458,"marks":27459,"value":14508,"nodeType":865},{},[],{"data":27461,"marks":27462,"value":18372,"nodeType":865},{},[],{"entries":27464},{"hyperlink":27465,"inline":27466,"block":27467},[],[],[27468,27477,27521,27527,27554,27561,27565,27569],{"sys":27469,"__typename":27470,"title":27471,"youTubeUrl":27472,"imagePlaceholder":27473},{"id":17709},"ExternalVideo","Hellcat video","https://www.youtube.com/watch?v=jHm6wpT6mYg",{"url":27474,"width":27475,"height":27476},"https://images.ctfassets.net/y1cdw1ablpvd/5cdcvDUhgAmEpo6kMOdu9I/8abb264bf8ce77b3d7453bcbc8c09783/Slide_Front_Cover__50_.png",3840,2160,{"sys":27478,"__typename":4645,"content":27479,"name":27520,"title":59},{"id":17721},{"json":27480},{"nodeType":1522,"data":27481,"content":27482},{},[27483,27502],{"nodeType":866,"data":27484,"content":27485},{},[27486,27490,27498],{"nodeType":865,"value":27487,"marks":27488,"data":27489},"Update 1: Since first writing this article, ",[],{},{"nodeType":905,"data":27491,"content":27493},{"uri":27492},"https://hackread.com/hellcat-ransomware-firms-infostealer-stolen-jira-credentials/",[27494],{"nodeType":865,"value":27495,"marks":27496,"data":27497},"four more victims have been claimed by Hellcat",[],{},{"nodeType":865,"value":27499,"marks":27500,"data":27501}," (all involving Jira breaches), bringing the total to 10 breaches in 6 months. This further indicates that this is a fast moving issue and attackers are undertaking a concerted campaign against Jira accounts — that isn't going away anytime soon. ",[],{},{"nodeType":866,"data":27503,"content":27504},{},[27505,27509,27517],{"nodeType":865,"value":27506,"marks":27507,"data":27508},"Update 2: Jira attacks conducted by Hellcat have continued into July ",[],{},{"nodeType":905,"data":27510,"content":27512},{"uri":27511},"https://www.bleepingcomputer.com/news/security/hacker-leaks-telef-nica-data-allegedly-stolen-in-a-new-breach/",[27513],{"nodeType":865,"value":27514,"marks":27515,"data":27516},"with the latest victim claimed by the attackers.",[],{},{"nodeType":865,"value":12410,"marks":27518,"data":27519},[],{},"Hellcat insight box",{"sys":27522,"__typename":4637,"title":27523,"caption":27524,"layoutMode":59,"file":27525},{"id":17838},"Hellcat timeline of Jira breaches","Attacks targeting Jira using stolen credentials are ramping up",{"url":27526,"width":25196,"height":25197},"https://images.ctfassets.net/y1cdw1ablpvd/1BqkoZww9MTs41whLVPMTj/ee67f53ff51c24b7d36066641e879583/hellcat_social_graphic.png",{"sys":27528,"__typename":4645,"content":27529,"name":27553,"title":59},{"id":18013},{"json":27530},{"data":27531,"content":27532,"nodeType":1522},{},[27533],{"data":27534,"content":27535,"nodeType":866},{},[27536,27540,27549],{"data":27537,"marks":27538,"value":27539,"nodeType":865},{},[],"Attackers are already targeting these apps — we recently saw ServiceNow servers being exploited by threat groups — but actually given that most organizations access ServiceNow as a cloud app, it’s easier to go the route of identity attacks. Remember when a ",{"data":27541,"content":27543,"nodeType":905},{"uri":27542},"https://pushsecurity.com/blog/learning-from-the-servicenow-disclosure/",[27544],{"data":27545,"marks":27546,"value":27548,"nodeType":865},{},[27547],{"type":1070},"security researcher logged into Microsoft’s ServiceNow tenant with stolen credentials",{"data":27550,"marks":27551,"value":27552,"nodeType":865},{},[],", accessing 1,000s of support ticket descriptions and attachments, and 250k+ employee emails?","Jira blog insight box",{"sys":27555,"__typename":4637,"title":27556,"caption":27557,"layoutMode":59,"file":27558},{"id":18054},"Comparing password vulnerabilities in Jira and other platforms","Table: What % of accounts with a password are vulnerable to account takeover through (1) MFA gaps and (2) using a breached, weak, or reused password. ",{"url":27559,"width":7381,"height":27560},"https://images.ctfassets.net/y1cdw1ablpvd/2oPkACCXFwWoIuMLfOGOkA/f676624ddce5651b09f6a768a8dd2c70/Screenshot_2025-03-24_at_10.46.49.png",678,{"sys":27562,"__typename":7447,"title":27563,"arcadeDemoUrl":27564,"playText":7450},{"id":15014},"Close MFA gaps with Push","https://demo.arcade.software/eP35OjAoajgNud5qqMGf?embed",{"sys":27566,"__typename":7447,"title":27567,"arcadeDemoUrl":27568,"playText":7450},{"id":18283},"Arcade: Find and remediate password vulnerabilities in Atlassian","https://demo.arcade.software/O5HwAmXSXboyKZkkO6XS?embed",{"sys":27570,"__typename":7447,"title":27571,"arcadeDemoUrl":27572,"playText":7450},{"id":18329},"Create an App Banner guiding users to log in via SSO","https://demo.arcade.software/D8BrC6k3x919TcOid0qc?embed",{"items":27574},[],{},"Why attackers are targeting Jira with stolen credentials",{"url":27578},"https://images.ctfassets.net/y1cdw1ablpvd/2IqfH1VLMma3YrbSX29q2Q/0b87ae386387e2ceaed097baf7321257/hellcat_social_graphic.png",{"items":27580},[27581,28578,29278],{"__typename":1544,"sys":27582,"content":27583,"title":28565,"synopsis":28566,"hashTags":59,"publishedDate":18375,"slug":28567,"tagsCollection":28568,"authorsCollection":28574},{"id":9196},{"json":27584},{"data":27585,"content":27586,"nodeType":1522},{},[27587,27606,27613,27620,27627,27634,27640,27647,27663,27666,27673,27680,27687,27694,27704,27711,27718,27725,27733,27740,27811,27823,27830,27838,27845,27902,27914,27921,27926,27934,27941,27974,27997,28004,28014,28017,28024,28044,28051,28084,28091,28098,28105,28111,28114,28121,28128,28136,28143,28150,28165,28171,28179,28186,28192,28200,28220,28227,28260,28280,28285,28305,28325,28333,28340,28347,28353,28371,28374,28382,28397,28404,28410,28459,28464,28471,28478,28521,28524,28532,28539,28542,28548],{"data":27588,"content":27589,"nodeType":866},{},[27590,27594,27603],{"data":27591,"marks":27592,"value":27593,"nodeType":865},{},[],"It wasn’t supposed to be like this. Passwords were supposed to be dead (just ask ",{"data":27595,"content":27597,"nodeType":905},{"uri":27596},"https://www.cnet.com/news/privacy/gates-predicts-death-of-the-password/",[27598],{"data":27599,"marks":27600,"value":27602,"nodeType":865},{},[27601],{"type":1070},"Bill Gates",{"data":27604,"marks":27605,"value":13320,"nodeType":865},{},[],{"data":27607,"content":27608,"nodeType":866},{},[27609],{"data":27610,"marks":27611,"value":27612,"nodeType":865},{},[],"Instead, hardworking security pros are left to sit around in community center basements drinking mediocre coffee and commiserating.",{"data":27614,"content":27615,"nodeType":866},{},[27616],{"data":27617,"marks":27618,"value":27619,"nodeType":865},{},[],"“I admit it. My users still use passwords.”",{"data":27621,"content":27622,"nodeType":866},{},[27623],{"data":27624,"marks":27625,"value":27626,"nodeType":865},{},[],"“Yeah, mine too. I’ve been telling people we’re rolling out passkeys for three years now. I’m not sure how much longer I can keep this up …”",{"data":27628,"content":27629,"nodeType":866},{},[27630],{"data":27631,"marks":27632,"value":27633,"nodeType":865},{},[],"Somber nodding all around. Hugs. A few chocolate-chip cookies on paper napkins.",{"data":27635,"content":27639,"nodeType":875},{"target":27636},{"sys":27637},{"id":27638,"type":872,"linkType":873},"4Wt29DxSSczFt5THWkuIiS",[],{"data":27641,"content":27642,"nodeType":866},{},[27643],{"data":27644,"marks":27645,"value":27646,"nodeType":865},{},[],"This is a no-judgment zone here at Push Security. So let’s take a look at why we’re still stuck with passwords, how attackers are increasingly exploiting weak credentials to infiltrate organizations, and how Push can help you get visibility and control of all your workforce identities.",{"data":27648,"content":27649,"nodeType":866},{},[27650,27654,27659],{"data":27651,"marks":27652,"value":27653,"nodeType":865},{},[],"We’ll also cover how you can use Push’s latest feature, ",{"data":27655,"marks":27656,"value":27658,"nodeType":865},{},[27657],{"type":887},"Strong password enforcement",{"data":27660,"marks":27661,"value":27662,"nodeType":865},{},[],", to require that employees use strong, unique passwords. Push automatically detects when employees have weak, reused, or stolen passwords and then guides them to update their password using in-browser messaging — even on apps that don’t natively support administrative control of password posture.",{"data":27664,"content":27665,"nodeType":879},{},[],{"data":27667,"content":27668,"nodeType":889},{},[27669],{"data":27670,"marks":27671,"value":27672,"nodeType":865},{},[],"3 reasons why we’re still stuck with passwords",{"data":27674,"content":27675,"nodeType":866},{},[27676],{"data":27677,"marks":27678,"value":27679,"nodeType":865},{},[],"At the risk of preaching to the choir, let’s review why we’re still stuck with passwords. ",{"data":27681,"content":27682,"nodeType":866},{},[27683],{"data":27684,"marks":27685,"value":27686,"nodeType":865},{},[],"It’s worth stating the Push perspective up front: We’re not here to push the narrative that you must completely get rid of passwords. To begin with, it’s not easy to get rid of them. Like the imaginary scene from the passwordless support group, we’ve lived the reality of this.",{"data":27688,"content":27689,"nodeType":866},{},[27690],{"data":27691,"marks":27692,"value":27693,"nodeType":865},{},[],"What we observe across our install base for the Push browser agent reinforces this reality. For the last 1 million or so logins that Push recorded, more than a quarter (26%) were password logins.",{"data":27695,"content":27696,"nodeType":1649},{},[27697],{"data":27698,"content":27699,"nodeType":866},{},[27700],{"data":27701,"marks":27702,"value":27703,"nodeType":865},{},[],"For the last 1M+ logins that the Push browser agent observed, more than a quarter were password logins.",{"data":27705,"content":27706,"nodeType":866},{},[27707],{"data":27708,"marks":27709,"value":27710,"nodeType":865},{},[],"Of those password logins, 18% had a security issue with the password — reused, easily guessable, already leaked in a public breach list, or actively for sale in criminal forums.",{"data":27712,"content":27713,"nodeType":866},{},[27714],{"data":27715,"marks":27716,"value":27717,"nodeType":865},{},[],"Yet when strong, unique passwords are used in conjunction with MFA, they can provide a powerful line of defense. Indeed, in cases where onboarding an app to SSO isn’t possible (for reasons we’ll cover below), a strong, unique password plus MFA is the most pragmatic solution you can achieve.",{"data":27719,"content":27720,"nodeType":866},{},[27721],{"data":27722,"marks":27723,"value":27724,"nodeType":865},{},[],"Here’s why bad passwords persist, and why it matters.",{"data":27726,"content":27727,"nodeType":2315},{},[27728],{"data":27729,"marks":27730,"value":27732,"nodeType":865},{},[27731],{"type":887},"Systemic reasons",{"data":27734,"content":27735,"nodeType":866},{},[27736],{"data":27737,"marks":27738,"value":27739,"nodeType":865},{},[],"If we zoom out, there are several systemic reasons that contribute to the persistence of password security issues:",{"data":27741,"content":27742,"nodeType":2718},{},[27743,27770,27796],{"data":27744,"content":27745,"nodeType":2654},{},[27746],{"data":27747,"content":27748,"nodeType":866},{},[27749,27754,27758,27766],{"data":27750,"marks":27751,"value":27753,"nodeType":865},{},[27752],{"type":887},"Self-adoption of work apps",{"data":27755,"marks":27756,"value":27757,"nodeType":865},{},[]," makes it extremely difficult to know all the workforce identities that exist across your environment, let alone whether they’re using a secure authentication method, or the strength or uniqueness of their password. Push’s ",{"data":27759,"content":27760,"nodeType":905},{"uri":6333},[27761],{"data":27762,"marks":27763,"value":27765,"nodeType":865},{},[27764],{"type":1070},"own research",{"data":27767,"marks":27768,"value":27769,"nodeType":865},{},[]," shows that for an average organization, each employee has 15 identities.",{"data":27771,"content":27772,"nodeType":2654},{},[27773],{"data":27774,"content":27775,"nodeType":866},{},[27776,27781,27785,27792],{"data":27777,"marks":27778,"value":27780,"nodeType":865},{},[27779],{"type":887},"Apps optimize signups for low friction, not security.",{"data":27782,"marks":27783,"value":27784,"nodeType":865},{},[]," That often results in multiple authentication methods tied to any given account because local password accounts can still persist even after SSO onboarding — a phenomenon that we call ",{"data":27786,"content":27787,"nodeType":905},{"uri":9104},[27788],{"data":27789,"marks":27790,"value":950,"nodeType":865},{},[27791],{"type":1070},{"data":27793,"marks":27794,"value":27795,"nodeType":865},{},[]," because they provide attackers with a way around a company’s enterprise SSO solution. These local accounts represent a significant risk, and most are invisible. Which brings us to …",{"data":27797,"content":27798,"nodeType":2654},{},[27799],{"data":27800,"content":27801,"nodeType":866},{},[27802,27807],{"data":27803,"marks":27804,"value":27806,"nodeType":865},{},[27805],{"type":887},"Many apps provide very little information to admins about the posture of accounts",{"data":27808,"marks":27809,"value":27810,"nodeType":865},{},[]," on that service, and even fewer offer management options to address security issues on those accounts. Some services provide no information at all about which accounts can even access a given tenant.",{"data":27812,"content":27813,"nodeType":866},{},[27814,27819],{"data":27815,"marks":27816,"value":27818,"nodeType":865},{},[27817],{"type":887},"The impact: ",{"data":27820,"marks":27821,"value":27822,"nodeType":865},{},[],"These systemic factors contribute to what we see many organizations grappling with: Known visibility gaps in their workforce identities, which are scattered across many more third-party apps than they imagine, and unknown account security risks for both managed and unmanaged apps.",{"data":27824,"content":27825,"nodeType":866},{},[27826],{"data":27827,"marks":27828,"value":27829,"nodeType":865},{},[],"These gaps open up a large attack surface for organizations. The 2024 Verizon DBIR found that 79% of web application compromises were the result of breached creds, and researchers at IBM reported last year that they observed a 71% year-over-year increase in cyberattacks using stolen or compromised credentials.",{"data":27831,"content":27832,"nodeType":2315},{},[27833],{"data":27834,"marks":27835,"value":27837,"nodeType":865},{},[27836],{"type":887},"Technical reasons",{"data":27839,"content":27840,"nodeType":866},{},[27841],{"data":27842,"marks":27843,"value":27844,"nodeType":865},{},[],"There are also several technical reasons why bad passwords persist:",{"data":27846,"content":27847,"nodeType":2718},{},[27848,27875],{"data":27849,"content":27850,"nodeType":2654},{},[27851],{"data":27852,"content":27853,"nodeType":866},{},[27854,27857,27867,27871],{"data":27855,"marks":27856,"value":21,"nodeType":865},{},[],{"data":27858,"content":27860,"nodeType":905},{"uri":27859},"https://www.ncsc.gov.uk/blog-post/passkeys-not-perfect-getting-better",[27861],{"data":27862,"marks":27863,"value":27866,"nodeType":865},{},[27864,27865],{"type":1070},{"type":887},"Going passwordless is hard",{"data":27868,"marks":27869,"value":12410,"nodeType":865},{},[27870],{"type":887},{"data":27872,"marks":27873,"value":27874,"nodeType":865},{},[],"because it requires a large investment of time, money, and training for end-users. In environments with a mix of older and newer infrastructure, it can be challenging to get complete coverage, and employees may struggle with the transition to device-based authentication (especially when they lose their device and aren’t familiar with how to regain account access).",{"data":27876,"content":27877,"nodeType":2654},{},[27878],{"data":27879,"content":27880,"nodeType":866},{},[27881,27886,27890,27898],{"data":27882,"marks":27883,"value":27885,"nodeType":865},{},[27884],{"type":887},"Many apps do not even provide a SAML option",{"data":27887,"marks":27888,"value":27889,"nodeType":865},{},[],", making it difficult to onboard every business app to SSO even once you know about them all. Last we checked, only about 30% of commonly used work apps supported SAML. Even when apps do provide the option, many charge the infamous “",{"data":27891,"content":27893,"nodeType":905},{"uri":27892},"https://sso.tax/",[27894],{"data":27895,"marks":27896,"value":17374,"nodeType":865},{},[27897],{"type":1070},{"data":27899,"marks":27900,"value":27901,"nodeType":865},{},[],",” putting the feature behind enterprise plans.",{"data":27903,"content":27904,"nodeType":866},{},[27905,27910],{"data":27906,"marks":27907,"value":27909,"nodeType":865},{},[27908],{"type":887},"The impact:",{"data":27911,"marks":27912,"value":27913,"nodeType":865},{},[]," What ends up happening in many organizations is a patchwork of login methods, including passwords, passkeys, OIDC, and SAML. Looking at data from Push’s install base, we see on average around 15,000 accounts per 1,000 users, with 5,900+ outside of SSO — about 40%. ",{"data":27915,"content":27916,"nodeType":866},{},[27917],{"data":27918,"marks":27919,"value":27920,"nodeType":865},{},[],"That means more — not less — for a security and IT team to manage, often without the visibility or control they need to do so effectively.",{"data":27922,"content":27925,"nodeType":875},{"target":27923},{"sys":27924},{"id":14794,"type":872,"linkType":873},[],{"data":27927,"content":27928,"nodeType":2315},{},[27929],{"data":27930,"marks":27931,"value":27933,"nodeType":865},{},[27932],{"type":887},"Human reasons",{"data":27935,"content":27936,"nodeType":866},{},[27937],{"data":27938,"marks":27939,"value":27940,"nodeType":865},{},[],"Finally, there are a lot of human reasons why poor passwords persist, all of them familiar and intractable:",{"data":27942,"content":27943,"nodeType":2718},{},[27944,27959],{"data":27945,"content":27946,"nodeType":2654},{},[27947],{"data":27948,"content":27949,"nodeType":866},{},[27950,27955],{"data":27951,"marks":27952,"value":27954,"nodeType":865},{},[27953],{"type":887},"Password change fatigue",{"data":27956,"marks":27957,"value":27958,"nodeType":865},{},[],", resulting in weak and reused passwords — often driven by incomplete adoption of enterprise password managers or outdated password security policies that require users to rotate passwords frequently. ",{"data":27960,"content":27961,"nodeType":2654},{},[27962],{"data":27963,"content":27964,"nodeType":866},{},[27965,27970],{"data":27966,"marks":27967,"value":27969,"nodeType":865},{},[27968],{"type":887},"Shortcuts that busy humans take",{"data":27971,"marks":27972,"value":27973,"nodeType":865},{},[]," to get work done on a daily basis, including reusing passwords across personal and corporate accounts, storing passwords insecurely, and using easier-to-remember passwords over secure, complex ones.  ",{"data":27975,"content":27976,"nodeType":866},{},[27977,27981,27985,27993],{"data":27978,"marks":27979,"value":27909,"nodeType":865},{},[27980],{"type":887},{"data":27982,"marks":27983,"value":27984,"nodeType":865},{},[]," When there’s a large, complex, and largely invisible attack surface made up of these online corporate identities, adversaries profit. Just look at any of the ",{"data":27986,"content":27987,"nodeType":905},{"uri":17967},[27988],{"data":27989,"marks":27990,"value":27992,"nodeType":865},{},[27991],{"type":1070},"major identity attacks",{"data":27994,"marks":27995,"value":27996,"nodeType":865},{},[]," of the past year, some of which used password-spraying and credential-stuffing techniques to compromise accounts and pivot to high-value systems and data.",{"data":27998,"content":27999,"nodeType":866},{},[28000],{"data":28001,"marks":28002,"value":28003,"nodeType":865},{},[],"Password reuse also extends the blast radius for any account takeover incident when MFA is missing — a gap that occurs more often than you may think. Typically, 37% of logins observed by Push upon initial deployment into a new customer environment do not use any form of MFA.",{"data":28005,"content":28006,"nodeType":1649},{},[28007],{"data":28008,"content":28009,"nodeType":866},{},[28010],{"data":28011,"marks":28012,"value":28013,"nodeType":865},{},[],"2 in 5 logins observed by Push upon initial deployment into a new customer environment do not use any form of MFA.",{"data":28015,"content":28016,"nodeType":879},{},[],{"data":28018,"content":28019,"nodeType":889},{},[28020],{"data":28021,"marks":28022,"value":28023,"nodeType":865},{},[],"Why identity posture matters more in a SaaS-first world",{"data":28025,"content":28026,"nodeType":866},{},[28027,28031,28040],{"data":28028,"marks":28029,"value":28030,"nodeType":865},{},[],"When most work now happens via the browser on web-based applications, the stakes are even higher for preventing account takeover. That’s because the way that attacks occur in a SaaS environment is ",{"data":28032,"content":28034,"nodeType":905},{"uri":28033},"https://pushsecurity.com/blog/shifting-detection-left-for-more-effective-itdr/",[28035],{"data":28036,"marks":28037,"value":28039,"nodeType":865},{},[28038],{"type":1070},"very different",{"data":28041,"marks":28042,"value":28043,"nodeType":865},{},[]," from traditional network attacks, and there are few effective ways to detect and respond post-account compromise.",{"data":28045,"content":28046,"nodeType":866},{},[28047],{"data":28048,"marks":28049,"value":28050,"nodeType":865},{},[],"The average SaaS attack path looks like this:",{"data":28052,"content":28053,"nodeType":2718},{},[28054,28064,28074],{"data":28055,"content":28056,"nodeType":2654},{},[28057],{"data":28058,"content":28059,"nodeType":866},{},[28060],{"data":28061,"marks":28062,"value":28063,"nodeType":865},{},[],"Attackers gain control of legitimate employee accounts using stolen credentials or via password-spraying or credential-stuffing techniques.",{"data":28065,"content":28066,"nodeType":2654},{},[28067],{"data":28068,"content":28069,"nodeType":866},{},[28070],{"data":28071,"marks":28072,"value":28073,"nodeType":865},{},[],"Attackers exfiltrate data.",{"data":28075,"content":28076,"nodeType":2654},{},[28077],{"data":28078,"content":28079,"nodeType":866},{},[28080],{"data":28081,"marks":28082,"value":28083,"nodeType":865},{},[],"The end.",{"data":28085,"content":28086,"nodeType":866},{},[28087],{"data":28088,"marks":28089,"value":28090,"nodeType":865},{},[],"Compare that to traditional network or enterprise cloud attacks, which usually involve more complex lateral movement, privilege escalation, and defense evasion.",{"data":28092,"content":28093,"nodeType":866},{},[28094],{"data":28095,"marks":28096,"value":28097,"nodeType":865},{},[],"With limited log data and few response capabilities provided by most SaaS apps, security teams also have few good options to stop the damage of an account takeover once one has occurred. ",{"data":28099,"content":28100,"nodeType":866},{},[28101],{"data":28102,"marks":28103,"value":28104,"nodeType":865},{},[],"That’s why at Push, we advocate for “shifting left,” and preventing account takeover before it happens.",{"data":28106,"content":28110,"nodeType":875},{"target":28107},{"sys":28108},{"id":28109,"type":872,"linkType":873},"6wIzMu3jBhaas9jtpV48bz",[],{"data":28112,"content":28113,"nodeType":879},{},[],{"data":28115,"content":28116,"nodeType":889},{},[28117],{"data":28118,"marks":28119,"value":28120,"nodeType":865},{},[],"How Push helps you ensure strong passwords",{"data":28122,"content":28123,"nodeType":866},{},[28124],{"data":28125,"marks":28126,"value":28127,"nodeType":865},{},[],"There are four capabilities that security teams need in order to regain control over password security issues across their corporate accounts. Here’s how Push accomplishes each one.",{"data":28129,"content":28130,"nodeType":2315},{},[28131],{"data":28132,"marks":28133,"value":28135,"nodeType":865},{},[28134],{"type":887},"1. A reliable inventory of all the apps that employees are using, including work apps and internal apps.",{"data":28137,"content":28138,"nodeType":866},{},[28139],{"data":28140,"marks":28141,"value":28142,"nodeType":865},{},[],"Push achieves this by deploying a browser agent to employee browsers that can directly observe their login activity, which feeds the data back into an admin console (or your SIEM/SOAR or other third-party system). You can enforce the installation of the agent using any MDM solution, on all major browsers.",{"data":28144,"content":28145,"nodeType":866},{},[28146],{"data":28147,"marks":28148,"value":28149,"nodeType":865},{},[],"Once the agent is activated, it begins immediately capturing employee logins and produces a real-time inventory of all your work and internal apps. Because Push observes the login directly in the browser, it can identify all the apps and accounts being used by your employees — both managed and unmanaged (shadow IT).",{"data":28151,"content":28152,"nodeType":866},{},[28153,28157,28161],{"data":28154,"marks":28155,"value":28156,"nodeType":865},{},[],"You can also configure Push to monitor ",{"data":28158,"marks":28159,"value":15243,"nodeType":865},{},[28160],{"type":2757},{"data":28162,"marks":28163,"value":28164,"nodeType":865},{},[]," login to a work app, regardless of the associated email domain of the employee. This means you can monitor personal account logins to apps that are commonly used for work.",{"data":28166,"content":28170,"nodeType":875},{"target":28167},{"sys":28168},{"id":28169,"type":872,"linkType":873},"4ctCB7kBscj12BnfHhk3ro",[],{"data":28172,"content":28173,"nodeType":2315},{},[28174],{"data":28175,"marks":28176,"value":28178,"nodeType":865},{},[28177],{"type":887},"2. A way to identify the login methods an account is using, whether that’s SAML, OIDC, or password.",{"data":28180,"content":28181,"nodeType":866},{},[28182],{"data":28183,"marks":28184,"value":28185,"nodeType":865},{},[],"Again, because Push observes the login event, it can analyze the authentication method or methods in use by a given account. Push tells you which SSO accounts still have passwords associated with them, and which authentication methods are being actively used.",{"data":28187,"content":28191,"nodeType":875},{"target":28188},{"sys":28189},{"id":28190,"type":872,"linkType":873},"pVD238hZ331gjWalDTM1q",[],{"data":28193,"content":28194,"nodeType":2315},{},[28195],{"data":28196,"marks":28197,"value":28199,"nodeType":865},{},[28198],{"type":887},"3. A method for analyzing whether an employee is using secure passwords on all their accounts.",{"data":28201,"content":28202,"nodeType":866},{},[28203,28207,28216],{"data":28204,"marks":28205,"value":28206,"nodeType":865},{},[],"Using Push, you can also check the posture of all your employee accounts. The browser agent accomplishes this by ",{"data":28208,"content":28210,"nodeType":905},{"uri":28209},"https://pushsecurity.com/help/10065#start",[28211],{"data":28212,"marks":28213,"value":28215,"nodeType":865},{},[28214],{"type":1070},"creating a salted hash",{"data":28217,"marks":28218,"value":28219,"nodeType":865},{},[]," of a user’s observed password and then taking the first 8 characters of that hash to store locally in the browser.",{"data":28221,"content":28222,"nodeType":866},{},[28223],{"data":28224,"marks":28225,"value":28226,"nodeType":865},{},[],"This allows Push to analyze whether the password is weak (comparing the hash to a list of 10,000 common basewords and common permutations); or reused across accounts.",{"data":28228,"content":28229,"nodeType":866},{},[28230,28234,28243,28247,28256],{"data":28231,"marks":28232,"value":28233,"nodeType":865},{},[],"Push can also identify when employee passwords have ",{"data":28235,"content":28237,"nodeType":905},{"uri":28236},"https://pushsecurity.com/help/10066#start",[28238],{"data":28239,"marks":28240,"value":28242,"nodeType":865},{},[28241],{"type":1070},"appeared in a public breach list",{"data":28244,"marks":28245,"value":28246,"nodeType":865},{},[]," using the Have I Been Pwned service, using a k-anonymized hash. Using similar secure methods, Push can detect when employees are sharing account credentials, whether they’re using a ",{"data":28248,"content":28250,"nodeType":905},{"uri":28249},"https://pushsecurity.com/help/10085/#start",[28251],{"data":28252,"marks":28253,"value":28255,"nodeType":865},{},[28254],{"type":1070},"password manager",{"data":28257,"marks":28258,"value":28259,"nodeType":865},{},[],", and which one.",{"data":28261,"content":28262,"nodeType":866},{},[28263,28267,28276],{"data":28264,"marks":28265,"value":28266,"nodeType":865},{},[],"Using Push’s ",{"data":28268,"content":28269,"nodeType":905},{"uri":964},[28270],{"data":28271,"marks":28272,"value":28275,"nodeType":865},{},[28273,28274],{"type":1070},{"type":887},"Stolen credentials detection",{"data":28277,"marks":28278,"value":28279,"nodeType":865},{},[]," feature, you can also get alerted when an employee is using credentials that match those for sale in criminal forums. Push integrates with commercial threat intelligence sources to perform these matches, and you can also bring your own TI using the Push REST API to perform additional checks for in-use stolen creds. This check still happens locally in the browser, so no hashes are sent to third-party systems.",{"data":28281,"content":28284,"nodeType":875},{"target":28282},{"sys":28283},{"id":23587,"type":872,"linkType":873},[],{"data":28286,"content":28287,"nodeType":866},{},[28288,28292,28301],{"data":28289,"marks":28290,"value":28291,"nodeType":865},{},[],"If you configure Push to also monitor for employees who are logging in to work apps using ",{"data":28293,"content":28295,"nodeType":905},{"uri":28294},"https://pushsecurity.com/help/10105#start",[28296],{"data":28297,"marks":28298,"value":28300,"nodeType":865},{},[28299],{"type":1070},"personal email addresses",{"data":28302,"marks":28303,"value":28304,"nodeType":865},{},[]," or any non-corporate email, Push can identify when personal accounts and work accounts are reusing passwords for the same work application.",{"data":28306,"content":28307,"nodeType":866},{},[28308,28312,28321],{"data":28309,"marks":28310,"value":28311,"nodeType":865},{},[],"Using the Push ",{"data":28313,"content":28315,"nodeType":905},{"uri":28314},"https://pushsecurity.com/help/audience/administrators/docs/getting-started/#api-and-webhooks",[28316],{"data":28317,"marks":28318,"value":28320,"nodeType":865},{},[28319],{"type":1070},"REST API and webhooks",{"data":28322,"marks":28323,"value":28324,"nodeType":865},{},[],", you can get alerted when Push raises a security finding for an account, and when a finding is resolved.",{"data":28326,"content":28327,"nodeType":2315},{},[28328],{"data":28329,"marks":28330,"value":28332,"nodeType":865},{},[28331],{"type":887},"4. The ability to solve any issues at scale, including remediating bad passwords and enforcing MFA, even on apps where the security team doesn’t have administrative control.",{"data":28334,"content":28335,"nodeType":866},{},[28336],{"data":28337,"marks":28338,"value":28339,"nodeType":865},{},[],"Finally, you can enforce self-remediation workflows using Push’s position in the browser, right where employees are working. ",{"data":28341,"content":28342,"nodeType":866},{},[28343],{"data":28344,"marks":28345,"value":28346,"nodeType":865},{},[],"Push recently released a new in-browser control to enforce strong passwords. It works by detecting when an employee has a password security issue, and then prompting them to update their password by displaying a customizable banner message when they log in to the affected account.",{"data":28348,"content":28352,"nodeType":875},{"target":28349},{"sys":28350},{"id":28351,"type":872,"linkType":873},"4IfBLaE66CJSsb5h44vSNp",[],{"data":28354,"content":28355,"nodeType":866},{},[28356,28360,28367],{"data":28357,"marks":28358,"value":28359,"nodeType":865},{},[],"This control complements an existing ",{"data":28361,"content":28362,"nodeType":905},{"uri":18218},[28363],{"data":28364,"marks":28365,"value":14677,"nodeType":865},{},[28366],{"type":1070},{"data":28368,"marks":28369,"value":28370,"nodeType":865},{},[]," guardrail, which uses a similar workflow to prompt employees to register for MFA on apps where it’s missing.",{"data":28372,"content":28373,"nodeType":879},{},[],{"data":28375,"content":28376,"nodeType":889},{},[28377],{"data":28378,"marks":28379,"value":28381,"nodeType":865},{},[28380],{"type":887},"A closer look at password enforcement",{"data":28383,"content":28384,"nodeType":866},{},[28385,28389,28393],{"data":28386,"marks":28387,"value":28388,"nodeType":865},{},[],"In the spirit of helping users do the right thing, we designed the",{"data":28390,"marks":28391,"value":12410,"nodeType":865},{},[28392],{"type":887},{"data":28394,"marks":28395,"value":28396,"nodeType":865},{},[],"password enforcement control to meet users where they are, in the most relevant context where they can fix the problem. ",{"data":28398,"content":28399,"nodeType":866},{},[28400],{"data":28401,"marks":28402,"value":28403,"nodeType":865},{},[],"Because this control is powered by the Push browser agent, security teams don’t need administrative control over every app where password accounts exist — which often isn’t practical for all the reasons we reviewed earlier. Instead, they can use Push to prompt employees to fix the issue themselves.",{"data":28405,"content":28406,"nodeType":866},{},[28407],{"data":28408,"marks":28409,"value":15107,"nodeType":865},{},[],{"data":28411,"content":28412,"nodeType":2718},{},[28413,28439,28449],{"data":28414,"content":28415,"nodeType":2654},{},[28416],{"data":28417,"content":28418,"nodeType":866},{},[28419,28423,28427,28431,28435],{"data":28420,"marks":28421,"value":28422,"nodeType":865},{},[],"You can enable ",{"data":28424,"marks":28425,"value":27658,"nodeType":865},{},[28426],{"type":887},{"data":28428,"marks":28429,"value":28430,"nodeType":865},{},[]," from the tile on the ",{"data":28432,"marks":28433,"value":14983,"nodeType":865},{},[28434],{"type":887},{"data":28436,"marks":28437,"value":28438,"nodeType":865},{},[]," page of the Push admin console. ",{"data":28440,"content":28441,"nodeType":2654},{},[28442],{"data":28443,"content":28444,"nodeType":866},{},[28445],{"data":28446,"marks":28447,"value":28448,"nodeType":865},{},[],"Using the rule editor, select whether you want to apply the control for all employees, or just specific groups or individuals, and which apps it should apply to. You can also select which types of password security issues you want to prompt users about.",{"data":28450,"content":28451,"nodeType":2654},{},[28452],{"data":28453,"content":28454,"nodeType":866},{},[28455],{"data":28456,"marks":28457,"value":28458,"nodeType":865},{},[],"Then customize the message that employees will see. Push will then automatically display the banner based on your criteria. Where possible, Push will include a link in the banner that takes employees directly to the page in the app where they can change their password — or you can add a link yourself.",{"data":28460,"content":28463,"nodeType":875},{"target":28461},{"sys":28462},{"id":18283,"type":872,"linkType":873},[],{"data":28465,"content":28466,"nodeType":866},{},[28467],{"data":28468,"marks":28469,"value":28470,"nodeType":865},{},[],"Once the password has been changed and Push verifies that the new password is strong, you’ll see the security finding cleared from the account record in the admin console and the banner will no longer display to the end-user.",{"data":28472,"content":28473,"nodeType":866},{},[28474],{"data":28475,"marks":28476,"value":28477,"nodeType":865},{},[],"Push also sends webhook events when:",{"data":28479,"content":28480,"nodeType":2718},{},[28481,28491,28501,28511],{"data":28482,"content":28483,"nodeType":2654},{},[28484],{"data":28485,"content":28486,"nodeType":866},{},[28487],{"data":28488,"marks":28489,"value":28490,"nodeType":865},{},[],"A banner is displayed",{"data":28492,"content":28493,"nodeType":2654},{},[28494],{"data":28495,"content":28496,"nodeType":866},{},[28497],{"data":28498,"marks":28499,"value":28500,"nodeType":865},{},[],"A user clicks the link in the banner to take action",{"data":28502,"content":28503,"nodeType":2654},{},[28504],{"data":28505,"content":28506,"nodeType":866},{},[28507],{"data":28508,"marks":28509,"value":28510,"nodeType":865},{},[],"A password is updated",{"data":28512,"content":28513,"nodeType":2654},{},[28514],{"data":28515,"content":28516,"nodeType":866},{},[28517],{"data":28518,"marks":28519,"value":28520,"nodeType":865},{},[],"A password security finding is resolved",{"data":28522,"content":28523,"nodeType":879},{},[],{"data":28525,"content":28526,"nodeType":889},{},[28527],{"data":28528,"marks":28529,"value":28531,"nodeType":865},{},[28530],{"type":887},"Where to begin",{"data":28533,"content":28534,"nodeType":866},{},[28535],{"data":28536,"marks":28537,"value":28538,"nodeType":865},{},[],"Most organizations we work with deploy the Push agent first to get an initial understanding of their attack surface and account posture issues. Then we recommend enabling the one-two punch of MFA and strong password enforcement guardrails. You can use both controls in tandem, and Push will first seek to resolve the password issues on a given account, and then prompt the user to register for MFA.",{"data":28540,"content":28541,"nodeType":879},{},[],{"data":28543,"content":28544,"nodeType":889},{},[28545],{"data":28546,"marks":28547,"value":15168,"nodeType":865},{},[],{"data":28549,"content":28550,"nodeType":866},{},[28551,28555,28562],{"data":28552,"marks":28553,"value":28554,"nodeType":865},{},[],"If you want to learn more about how Push helps you to detect and defeat common identity attack techniques like AiTM phishing, credential stuffing, and session hijacking while improving your workforce identity posture, book some time with one of our team for a ",{"data":28556,"content":28557,"nodeType":905},{"uri":3686},[28558],{"data":28559,"marks":28560,"value":2993,"nodeType":865},{},[28561],{"type":1070},{"data":28563,"marks":28564,"value":1193,"nodeType":865},{},[],"Introducing Push password enforcement — for when weak passwords are still plaguing you","Detects when employees have weak, reused, or stolen passwords and guide them to update their password using in-browser messaging on any app. ","introducing-strong-password-enforcement",{"items":28569},[28570,28572],{"sys":28571,"name":297},{"id":2147},{"sys":28573,"name":2144},{"id":2143},{"items":28575},[28576],{"fullName":9643,"firstName":9644,"jobTitle":9645,"profilePicture":28577},{"url":9647},{"__typename":1544,"sys":28579,"content":28580,"title":17671,"synopsis":17672,"hashTags":59,"publishedDate":17673,"slug":17674,"tagsCollection":29270,"authorsCollection":29274},{"id":9124},{"json":28581},{"data":28582,"content":28583,"nodeType":1522},{},[28584,28589,28605,28611,28617,28622,28625,28632,28638,28654,28664,28670,28676,28682,28766,28769,28776,28851,28856,28859,28866,28873,28879,28885,28892,28908,28914,28921,28927,28933,28940,28946,28952,28968,28973,28976,28983,28990,28996,29085,29091,29098,29104,29110,29115,29122,29128,29134,29140,29147,29153,29159,29165,29171,29176,29179,29186,29192,29222,29228,29243,29259,29264],{"data":28585,"content":28588,"nodeType":875},{"target":28586},{"sys":28587},{"id":16889,"type":872,"linkType":873},[],{"data":28590,"content":28591,"nodeType":866},{},[28592,28595,28602],{"data":28593,"marks":28594,"value":16897,"nodeType":865},{},[],{"data":28596,"content":28597,"nodeType":905},{"uri":16900},[28598],{"data":28599,"marks":28600,"value":16906,"nodeType":865},{},[28601],{"type":1070},{"data":28603,"marks":28604,"value":16910,"nodeType":865},{},[],{"data":28606,"content":28607,"nodeType":866},{},[28608],{"data":28609,"marks":28610,"value":16917,"nodeType":865},{},[],{"data":28612,"content":28613,"nodeType":866},{},[28614],{"data":28615,"marks":28616,"value":16924,"nodeType":865},{},[],{"data":28618,"content":28621,"nodeType":875},{"target":28619},{"sys":28620},{"id":16929,"type":872,"linkType":873},[],{"data":28623,"content":28624,"nodeType":879},{},[],{"data":28626,"content":28627,"nodeType":889},{},[28628],{"data":28629,"marks":28630,"value":16941,"nodeType":865},{},[28631],{"type":887},{"data":28633,"content":28634,"nodeType":866},{},[28635],{"data":28636,"marks":28637,"value":16948,"nodeType":865},{},[],{"data":28639,"content":28640,"nodeType":866},{},[28641,28644,28651],{"data":28642,"marks":28643,"value":16955,"nodeType":865},{},[],{"data":28645,"content":28646,"nodeType":905},{"uri":3455},[28647],{"data":28648,"marks":28649,"value":16963,"nodeType":865},{},[28650],{"type":1070},{"data":28652,"marks":28653,"value":1711,"nodeType":865},{},[],{"data":28655,"content":28656,"nodeType":1649},{},[28657],{"data":28658,"content":28659,"nodeType":866},{},[28660],{"data":28661,"marks":28662,"value":16977,"nodeType":865},{},[28663],{"type":887},{"data":28665,"content":28666,"nodeType":866},{},[28667],{"data":28668,"marks":28669,"value":16984,"nodeType":865},{},[],{"data":28671,"content":28672,"nodeType":866},{},[28673],{"data":28674,"marks":28675,"value":16991,"nodeType":865},{},[],{"data":28677,"content":28678,"nodeType":866},{},[28679],{"data":28680,"marks":28681,"value":16998,"nodeType":865},{},[],{"data":28683,"content":28684,"nodeType":2718},{},[28685,28694,28703,28712,28721,28730,28739,28748,28757],{"data":28686,"content":28687,"nodeType":2654},{},[28688],{"data":28689,"content":28690,"nodeType":866},{},[28691],{"data":28692,"marks":28693,"value":17011,"nodeType":865},{},[],{"data":28695,"content":28696,"nodeType":2654},{},[28697],{"data":28698,"content":28699,"nodeType":866},{},[28700],{"data":28701,"marks":28702,"value":17021,"nodeType":865},{},[],{"data":28704,"content":28705,"nodeType":2654},{},[28706],{"data":28707,"content":28708,"nodeType":866},{},[28709],{"data":28710,"marks":28711,"value":17031,"nodeType":865},{},[],{"data":28713,"content":28714,"nodeType":2654},{},[28715],{"data":28716,"content":28717,"nodeType":866},{},[28718],{"data":28719,"marks":28720,"value":17041,"nodeType":865},{},[],{"data":28722,"content":28723,"nodeType":2654},{},[28724],{"data":28725,"content":28726,"nodeType":866},{},[28727],{"data":28728,"marks":28729,"value":17051,"nodeType":865},{},[],{"data":28731,"content":28732,"nodeType":2654},{},[28733],{"data":28734,"content":28735,"nodeType":866},{},[28736],{"data":28737,"marks":28738,"value":17061,"nodeType":865},{},[],{"data":28740,"content":28741,"nodeType":2654},{},[28742],{"data":28743,"content":28744,"nodeType":866},{},[28745],{"data":28746,"marks":28747,"value":17071,"nodeType":865},{},[],{"data":28749,"content":28750,"nodeType":2654},{},[28751],{"data":28752,"content":28753,"nodeType":866},{},[28754],{"data":28755,"marks":28756,"value":17081,"nodeType":865},{},[],{"data":28758,"content":28759,"nodeType":2654},{},[28760],{"data":28761,"content":28762,"nodeType":866},{},[28763],{"data":28764,"marks":28765,"value":17091,"nodeType":865},{},[],{"data":28767,"content":28768,"nodeType":879},{},[],{"data":28770,"content":28771,"nodeType":889},{},[28772],{"data":28773,"marks":28774,"value":17102,"nodeType":865},{},[28775],{"type":887},{"data":28777,"content":28778,"nodeType":2718},{},[28779,28788,28797,28806,28815,28824,28833,28842],{"data":28780,"content":28781,"nodeType":2654},{},[28782],{"data":28783,"content":28784,"nodeType":866},{},[28785],{"data":28786,"marks":28787,"value":17115,"nodeType":865},{},[],{"data":28789,"content":28790,"nodeType":2654},{},[28791],{"data":28792,"content":28793,"nodeType":866},{},[28794],{"data":28795,"marks":28796,"value":17125,"nodeType":865},{},[],{"data":28798,"content":28799,"nodeType":2654},{},[28800],{"data":28801,"content":28802,"nodeType":866},{},[28803],{"data":28804,"marks":28805,"value":17135,"nodeType":865},{},[],{"data":28807,"content":28808,"nodeType":2654},{},[28809],{"data":28810,"content":28811,"nodeType":866},{},[28812],{"data":28813,"marks":28814,"value":17145,"nodeType":865},{},[],{"data":28816,"content":28817,"nodeType":2654},{},[28818],{"data":28819,"content":28820,"nodeType":866},{},[28821],{"data":28822,"marks":28823,"value":17155,"nodeType":865},{},[],{"data":28825,"content":28826,"nodeType":2654},{},[28827],{"data":28828,"content":28829,"nodeType":866},{},[28830],{"data":28831,"marks":28832,"value":17165,"nodeType":865},{},[],{"data":28834,"content":28835,"nodeType":2654},{},[28836],{"data":28837,"content":28838,"nodeType":866},{},[28839],{"data":28840,"marks":28841,"value":17175,"nodeType":865},{},[],{"data":28843,"content":28844,"nodeType":2654},{},[28845],{"data":28846,"content":28847,"nodeType":866},{},[28848],{"data":28849,"marks":28850,"value":17185,"nodeType":865},{},[],{"data":28852,"content":28855,"nodeType":875},{"target":28853},{"sys":28854},{"id":17190,"type":872,"linkType":873},[],{"data":28857,"content":28858,"nodeType":879},{},[],{"data":28860,"content":28861,"nodeType":889},{},[28862],{"data":28863,"marks":28864,"value":17202,"nodeType":865},{},[28865],{"type":887},{"data":28867,"content":28868,"nodeType":2315},{},[28869],{"data":28870,"marks":28871,"value":17210,"nodeType":865},{},[28872],{"type":887},{"data":28874,"content":28875,"nodeType":866},{},[28876],{"data":28877,"marks":28878,"value":17217,"nodeType":865},{},[],{"data":28880,"content":28881,"nodeType":866},{},[28882],{"data":28883,"marks":28884,"value":17224,"nodeType":865},{},[],{"data":28886,"content":28887,"nodeType":2315},{},[28888],{"data":28889,"marks":28890,"value":17232,"nodeType":865},{},[28891],{"type":887},{"data":28893,"content":28894,"nodeType":866},{},[28895,28898,28905],{"data":28896,"marks":28897,"value":17239,"nodeType":865},{},[],{"data":28899,"content":28900,"nodeType":905},{"uri":945},[28901],{"data":28902,"marks":28903,"value":950,"nodeType":865},{},[28904],{"type":1070},{"data":28906,"marks":28907,"value":1711,"nodeType":865},{},[],{"data":28909,"content":28910,"nodeType":866},{},[28911],{"data":28912,"marks":28913,"value":17256,"nodeType":865},{},[],{"data":28915,"content":28916,"nodeType":2315},{},[28917],{"data":28918,"marks":28919,"value":17264,"nodeType":865},{},[28920],{"type":887},{"data":28922,"content":28923,"nodeType":866},{},[28924],{"data":28925,"marks":28926,"value":17271,"nodeType":865},{},[],{"data":28928,"content":28929,"nodeType":866},{},[28930],{"data":28931,"marks":28932,"value":17278,"nodeType":865},{},[],{"data":28934,"content":28935,"nodeType":2315},{},[28936],{"data":28937,"marks":28938,"value":17286,"nodeType":865},{},[28939],{"type":887},{"data":28941,"content":28942,"nodeType":866},{},[28943],{"data":28944,"marks":28945,"value":17293,"nodeType":865},{},[],{"data":28947,"content":28948,"nodeType":866},{},[28949],{"data":28950,"marks":28951,"value":17300,"nodeType":865},{},[],{"data":28953,"content":28954,"nodeType":866},{},[28955,28958,28965],{"data":28956,"marks":28957,"value":17307,"nodeType":865},{},[],{"data":28959,"content":28960,"nodeType":905},{"uri":17310},[28961],{"data":28962,"marks":28963,"value":17316,"nodeType":865},{},[28964],{"type":1070},{"data":28966,"marks":28967,"value":17320,"nodeType":865},{},[],{"data":28969,"content":28972,"nodeType":875},{"target":28970},{"sys":28971},{"id":17325,"type":872,"linkType":873},[],{"data":28974,"content":28975,"nodeType":879},{},[],{"data":28977,"content":28978,"nodeType":889},{},[28979],{"data":28980,"marks":28981,"value":17337,"nodeType":865},{},[28982],{"type":887},{"data":28984,"content":28985,"nodeType":2315},{},[28986],{"data":28987,"marks":28988,"value":17345,"nodeType":865},{},[28989],{"type":887},{"data":28991,"content":28992,"nodeType":866},{},[28993],{"data":28994,"marks":28995,"value":17352,"nodeType":865},{},[],{"data":28997,"content":28998,"nodeType":2718},{},[28999,29018,29037,29066],{"data":29000,"content":29001,"nodeType":2654},{},[29002],{"data":29003,"content":29004,"nodeType":866},{},[29005,29008,29015],{"data":29006,"marks":29007,"value":17365,"nodeType":865},{},[],{"data":29009,"content":29010,"nodeType":905},{"uri":17368},[29011],{"data":29012,"marks":29013,"value":17374,"nodeType":865},{},[29014],{"type":1070},{"data":29016,"marks":29017,"value":17378,"nodeType":865},{},[],{"data":29019,"content":29020,"nodeType":2654},{},[29021],{"data":29022,"content":29023,"nodeType":866},{},[29024,29027,29034],{"data":29025,"marks":29026,"value":17388,"nodeType":865},{},[],{"data":29028,"content":29029,"nodeType":905},{"uri":6333},[29030],{"data":29031,"marks":29032,"value":17396,"nodeType":865},{},[29033],{"type":1070},{"data":29035,"marks":29036,"value":1193,"nodeType":865},{},[],{"data":29038,"content":29039,"nodeType":2654},{},[29040],{"data":29041,"content":29042,"nodeType":866},{},[29043,29046,29053,29056,29063],{"data":29044,"marks":29045,"value":17409,"nodeType":865},{},[],{"data":29047,"content":29048,"nodeType":905},{"uri":945},[29049],{"data":29050,"marks":29051,"value":7064,"nodeType":865},{},[29052],{"type":1070},{"data":29054,"marks":29055,"value":17420,"nodeType":865},{},[],{"data":29057,"content":29058,"nodeType":905},{"uri":17423},[29059],{"data":29060,"marks":29061,"value":17429,"nodeType":865},{},[29062],{"type":1070},{"data":29064,"marks":29065,"value":17433,"nodeType":865},{},[],{"data":29067,"content":29068,"nodeType":2654},{},[29069],{"data":29070,"content":29071,"nodeType":866},{},[29072,29075,29082],{"data":29073,"marks":29074,"value":17443,"nodeType":865},{},[],{"data":29076,"content":29077,"nodeType":905},{"uri":6333},[29078],{"data":29079,"marks":29080,"value":17451,"nodeType":865},{},[29081],{"type":1070},{"data":29083,"marks":29084,"value":17455,"nodeType":865},{},[],{"data":29086,"content":29087,"nodeType":866},{},[29088],{"data":29089,"marks":29090,"value":17462,"nodeType":865},{},[],{"data":29092,"content":29093,"nodeType":2315},{},[29094],{"data":29095,"marks":29096,"value":17470,"nodeType":865},{},[29097],{"type":887},{"data":29099,"content":29100,"nodeType":866},{},[29101],{"data":29102,"marks":29103,"value":17477,"nodeType":865},{},[],{"data":29105,"content":29106,"nodeType":866},{},[29107],{"data":29108,"marks":29109,"value":17484,"nodeType":865},{},[],{"data":29111,"content":29114,"nodeType":875},{"target":29112},{"sys":29113},{"id":17489,"type":872,"linkType":873},[],{"data":29116,"content":29117,"nodeType":2315},{},[29118],{"data":29119,"marks":29120,"value":17498,"nodeType":865},{},[29121],{"type":887},{"data":29123,"content":29124,"nodeType":866},{},[29125],{"data":29126,"marks":29127,"value":17505,"nodeType":865},{},[],{"data":29129,"content":29130,"nodeType":866},{},[29131],{"data":29132,"marks":29133,"value":17512,"nodeType":865},{},[],{"data":29135,"content":29136,"nodeType":866},{},[29137],{"data":29138,"marks":29139,"value":17519,"nodeType":865},{},[],{"data":29141,"content":29142,"nodeType":2315},{},[29143],{"data":29144,"marks":29145,"value":17527,"nodeType":865},{},[29146],{"type":887},{"data":29148,"content":29149,"nodeType":866},{},[29150],{"data":29151,"marks":29152,"value":17534,"nodeType":865},{},[],{"data":29154,"content":29155,"nodeType":866},{},[29156],{"data":29157,"marks":29158,"value":17541,"nodeType":865},{},[],{"data":29160,"content":29161,"nodeType":866},{},[29162],{"data":29163,"marks":29164,"value":17548,"nodeType":865},{},[],{"data":29166,"content":29167,"nodeType":866},{},[29168],{"data":29169,"marks":29170,"value":17555,"nodeType":865},{},[],{"data":29172,"content":29175,"nodeType":875},{"target":29173},{"sys":29174},{"id":17560,"type":872,"linkType":873},[],{"data":29177,"content":29178,"nodeType":879},{},[],{"data":29180,"content":29181,"nodeType":889},{},[29182],{"data":29183,"marks":29184,"value":17572,"nodeType":865},{},[29185],{"type":887},{"data":29187,"content":29188,"nodeType":866},{},[29189],{"data":29190,"marks":29191,"value":17579,"nodeType":865},{},[],{"data":29193,"content":29194,"nodeType":2718},{},[29195,29204,29213],{"data":29196,"content":29197,"nodeType":2654},{},[29198],{"data":29199,"content":29200,"nodeType":866},{},[29201],{"data":29202,"marks":29203,"value":17592,"nodeType":865},{},[],{"data":29205,"content":29206,"nodeType":2654},{},[29207],{"data":29208,"content":29209,"nodeType":866},{},[29210],{"data":29211,"marks":29212,"value":17602,"nodeType":865},{},[],{"data":29214,"content":29215,"nodeType":2654},{},[29216],{"data":29217,"content":29218,"nodeType":866},{},[29219],{"data":29220,"marks":29221,"value":17612,"nodeType":865},{},[],{"data":29223,"content":29224,"nodeType":866},{},[29225],{"data":29226,"marks":29227,"value":17619,"nodeType":865},{},[],{"data":29229,"content":29230,"nodeType":866},{},[29231,29234,29240],{"data":29232,"marks":29233,"value":17626,"nodeType":865},{},[],{"data":29235,"content":29236,"nodeType":905},{"uri":17629},[29237],{"data":29238,"marks":29239,"value":17634,"nodeType":865},{},[],{"data":29241,"marks":29242,"value":17638,"nodeType":865},{},[],{"data":29244,"content":29245,"nodeType":866},{},[29246,29249,29256],{"data":29247,"marks":29248,"value":17645,"nodeType":865},{},[],{"data":29250,"content":29251,"nodeType":905},{"uri":17648},[29252],{"data":29253,"marks":29254,"value":17654,"nodeType":865},{},[29255],{"type":1070},{"data":29257,"marks":29258,"value":17658,"nodeType":865},{},[],{"data":29260,"content":29263,"nodeType":875},{"target":29261},{"sys":29262},{"id":17663,"type":872,"linkType":873},[],{"data":29265,"content":29266,"nodeType":866},{},[29267],{"data":29268,"marks":29269,"value":21,"nodeType":865},{},[],{"items":29271},[29272],{"sys":29273,"name":2144},{"id":2143},{"items":29275},[29276],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":29277},{"url":3016},{"__typename":1544,"sys":29279,"content":29281,"title":29854,"synopsis":29855,"hashTags":59,"publishedDate":29856,"slug":29857,"tagsCollection":29858,"authorsCollection":29864},{"id":29280},"3dndhjREJvJCbGRLseipak",{"json":29282},{"data":29283,"content":29284,"nodeType":1522},{},[29285,29305,29312,29319,29326,29333,29336,29344,29362,29369,29392,29399,29406,29413,29419,29422,29430,29437,29444,29451,29457,29460,29468,29475,29482,29489,29495,29498,29506,29513,29520,29526,29532,29535,29543,29550,29556,29562,29569,29572,29580,29587,29594,29601,29608,29641,29652,29658,29665,29668,29676,29683,29695,29703,29710,29717,29724,29747,29766,29769,29777,29784,29802,29808,29811,29819,29826,29843,29848],{"data":29286,"content":29287,"nodeType":866},{},[29288,29292,29301],{"data":29289,"marks":29290,"value":29291,"nodeType":865},{},[],"If you want the background on CUAs and OpenAI Operator ",{"data":29293,"content":29295,"nodeType":905},{"uri":29294},"https://pushsecurity.com/blog/considering-the-impact-of-computer-using-agents/",[29296],{"data":29297,"marks":29298,"value":29300,"nodeType":865},{},[29299],{"type":1070},"check out our recent blog post",{"data":29302,"marks":29303,"value":29304,"nodeType":865},{},[],". But, the TL;DR is that Computer-Using Agents (CUAs) are a new type of AI agent that drives your browser/OS for you. ",{"data":29306,"content":29307,"nodeType":866},{},[29308],{"data":29309,"marks":29310,"value":29311,"nodeType":865},{},[],"Unlike traditional AI models that are limited to text-based interactions, CUAs can actually use a web browser like a real person. Think of them as an advanced no-code automation platform driven by AI — capable of navigating login pages, entering credentials, and interacting with SaaS applications at scale. This is a huge leap forward from the most common malicious use cases we’ve seen for AI so far. ",{"data":29313,"content":29314,"nodeType":866},{},[29315],{"data":29316,"marks":29317,"value":29318,"nodeType":865},{},[],"At Push, we’re fully focused on stopping identity attacks. This meant that when we saw the release of Operator, we could only think of one question: How can attackers abuse this?",{"data":29320,"content":29321,"nodeType":866},{},[29322],{"data":29323,"marks":29324,"value":29325,"nodeType":865},{},[],"Full disclosure, this wasn’t an ‘LLM red team’ style exercise, or even anything close. We weren’t interested in verifying how securely data is stored (I mean who cares, these wouldn’t be our credentials if we were a real attacker, right?) and frankly we assumed that the in-app guardrails wouldn’t be robust enough to stop us. And within our first 30 minutes of testing, we were proved correct. ",{"data":29327,"content":29328,"nodeType":866},{},[29329],{"data":29330,"marks":29331,"value":29332,"nodeType":865},{},[],"Here’s what we found. ",{"data":29334,"content":29335,"nodeType":879},{},[],{"data":29337,"content":29338,"nodeType":889},{},[29339],{"data":29340,"marks":29341,"value":29343,"nodeType":865},{},[29342],{"type":887},"You can automate (almost) the entire identity kill chain ",{"data":29345,"content":29346,"nodeType":866},{},[29347,29351,29359],{"data":29348,"marks":29349,"value":29350,"nodeType":865},{},[],"For our test, we looked at how Operator could be applied to identity attacks across discrete Cyber Kill Chain stages and the associated Tactics, Techniques, and Procedures (TTPs) as per the ",{"data":29352,"content":29353,"nodeType":905},{"uri":2829},[29354],{"data":29355,"marks":29356,"value":29358,"nodeType":865},{},[29357],{"type":1070},"SaaS attacks matrix",{"data":29360,"marks":29361,"value":1711,"nodeType":865},{},[],{"data":29363,"content":29364,"nodeType":866},{},[29365],{"data":29366,"marks":29367,"value":29368,"nodeType":865},{},[],"One of the key challenges facing attackers when it comes to scaling identity attacks is that of targeting many different internet apps — all of which are:",{"data":29370,"content":29371,"nodeType":2718},{},[29372,29382],{"data":29373,"content":29374,"nodeType":2654},{},[29375],{"data":29376,"content":29377,"nodeType":866},{},[29378],{"data":29379,"marks":29380,"value":29381,"nodeType":865},{},[],"Complex and highly customized, with a graphically-driven interface that is different every time.",{"data":29383,"content":29384,"nodeType":2654},{},[29385],{"data":29386,"content":29387,"nodeType":866},{},[29388],{"data":29389,"marks":29390,"value":29391,"nodeType":865},{},[],"Specifically designed to prevent malicious automation with things like account lockouts and bot protections like CAPTCHA. ",{"data":29393,"content":29394,"nodeType":866},{},[29395],{"data":29396,"marks":29397,"value":29398,"nodeType":865},{},[],"This is a big change from traditional networks, where you could simply port scan and spray credentials, encountering the same protocols and services for every environment you wanted to target.",{"data":29400,"content":29401,"nodeType":866},{},[29402],{"data":29403,"marks":29404,"value":29405,"nodeType":865},{},[],"Now, every app requires custom tooling that needs to be maintained as apps/pages change. Considering that there are more than 40k SaaS apps, this is no small task. ",{"data":29407,"content":29408,"nodeType":866},{},[29409],{"data":29410,"marks":29411,"value":29412,"nodeType":865},{},[],"But we thought: could Operator solve this problem, without any custom development or tooling whatsoever? And what else can it automate following the initial account takeover? ",{"data":29414,"content":29418,"nodeType":875},{"target":29415},{"sys":29416},{"id":29417,"type":872,"linkType":873},"6169dNBRXvahtV8VRlxLCJ",[],{"data":29420,"content":29421,"nodeType":879},{},[],{"data":29423,"content":29424,"nodeType":889},{},[29425],{"data":29426,"marks":29427,"value":29429,"nodeType":865},{},[29428],{"type":887},"1: Reconnaissance",{"data":29431,"content":29432,"nodeType":866},{},[29433],{"data":29434,"marks":29435,"value":29436,"nodeType":865},{},[],"Recon in the world of SaaS means figuring out which SaaS apps an organization uses, how users authenticate, and where the weak spots are. ",{"data":29438,"content":29439,"nodeType":866},{},[29440],{"data":29441,"marks":29442,"value":29443,"nodeType":865},{},[],"For example, I asked Operator to check whether a company used BambooHR, Atlassian, or Dropbox. Within minutes, the AI had identified valid tenant names, login URLs, and authentication methods for each app.",{"data":29445,"content":29446,"nodeType":866},{},[29447],{"data":29448,"marks":29449,"value":29450,"nodeType":865},{},[],"While a human attacker might research a handful of targets in a day, a CUA can research thousands, tirelessly mapping out identity attack surfaces across a long list of target organizations.",{"data":29452,"content":29456,"nodeType":875},{"target":29453},{"sys":29454},{"id":29455,"type":872,"linkType":873},"6Bt0cyPStlzhDzMaSdBYUp",[],{"data":29458,"content":29459,"nodeType":879},{},[],{"data":29461,"content":29462,"nodeType":889},{},[29463],{"data":29464,"marks":29465,"value":29467,"nodeType":865},{},[29466],{"type":887},"2: Initial Access",{"data":29469,"content":29470,"nodeType":866},{},[29471],{"data":29472,"marks":29473,"value":29474,"nodeType":865},{},[],"Once you’ve established your targets, you can automate account takeover using compromised credentials. ",{"data":29476,"content":29477,"nodeType":866},{},[29478],{"data":29479,"marks":29480,"value":29481,"nodeType":865},{},[],"I asked Operator to try to login using a set of compromised credentials across five different apps. It navigated to each page, attempted to login, noted the success or failure (and why), and moved on to the next app in the list. ",{"data":29483,"content":29484,"nodeType":866},{},[29485],{"data":29486,"marks":29487,"value":29488,"nodeType":865},{},[],"Now imagine that same process, but scaled up to tens of thousands of apps at once — with no custom development required. That’s where things start getting interesting.",{"data":29490,"content":29494,"nodeType":875},{"target":29491},{"sys":29492},{"id":29493,"type":872,"linkType":873},"6jk6hKykuvc0YAA4CkP8C2",[],{"data":29496,"content":29497,"nodeType":879},{},[],{"data":29499,"content":29500,"nodeType":889},{},[29501],{"data":29502,"marks":29503,"value":29505,"nodeType":865},{},[29504],{"type":887},"3: Persistence",{"data":29507,"content":29508,"nodeType":866},{},[29509],{"data":29510,"marks":29511,"value":29512,"nodeType":865},{},[],"Once you take over an account, you might not be able to exploit it straight away — particularly if you’re looking to execute a broader campaign across apps/organizations. So, I asked Operator to establish persistence mechanisms that would enable me to return to the app later, even if the credentials were changed or additional auth factors were deployed. ",{"data":29514,"content":29515,"nodeType":866},{},[29516],{"data":29517,"marks":29518,"value":29519,"nodeType":865},{},[],"Operator was able to analyse wildly different apps/pages with different options for configuring ghost logins, and was able to do things like create an API key and record it for me — a really effective backdoor that is extremely difficult for security teams to detect. ",{"data":29521,"content":29525,"nodeType":875},{"target":29522},{"sys":29523},{"id":29524,"type":872,"linkType":873},"6jtmxq2tMJIBga3hxdeDZs",[],{"data":29527,"content":29531,"nodeType":875},{"target":29528},{"sys":29529},{"id":29530,"type":872,"linkType":873},"5XqqCMLn0udFeoc2CQkmy6",[],{"data":29533,"content":29534,"nodeType":879},{},[],{"data":29536,"content":29537,"nodeType":889},{},[29538],{"data":29539,"marks":29540,"value":29542,"nodeType":865},{},[29541],{"type":887},"4: Lateral Movement",{"data":29544,"content":29545,"nodeType":866},{},[29546],{"data":29547,"marks":29548,"value":29549,"nodeType":865},{},[],"Operator can be used to perform in-app changes which can lay the groundwork for lateral movement. One example of how this can be achieved is through SAMLjacking, effectively allowing the attacker to poison the malicious app tenant and use it as a watering hole to harvest SSO credentials. ",{"data":29551,"content":29555,"nodeType":875},{"target":29552},{"sys":29553},{"id":29554,"type":872,"linkType":873},"4GTS6iIlQ0nyMfTxhXQdEg",[],{"data":29557,"content":29561,"nodeType":875},{"target":29558},{"sys":29559},{"id":29560,"type":872,"linkType":873},"5awMBkBEQPtdVNtLOYiaCL",[],{"data":29563,"content":29564,"nodeType":866},{},[29565],{"data":29566,"marks":29567,"value":29568,"nodeType":865},{},[],"SAMLjacking is just one option though — you could also do things like identifying which OAuth integrations are already enabled that could be abused to access linked apps and accounts. ",{"data":29570,"content":29571,"nodeType":879},{},[],{"data":29573,"content":29574,"nodeType":889},{},[29575],{"data":29576,"marks":29577,"value":29579,"nodeType":865},{},[29578],{"type":887},"5: Collection & Exfiltration ",{"data":29581,"content":29582,"nodeType":866},{},[29583],{"data":29584,"marks":29585,"value":29586,"nodeType":865},{},[],"The final piece in the attack chain we looked at was the ability to automate actions-on-objectives. When targeting SaaS, this typically involves dumping app data. ",{"data":29588,"content":29589,"nodeType":866},{},[29590],{"data":29591,"marks":29592,"value":29593,"nodeType":865},{},[],"We found it would be possible to trigger things like takeout services, but this would involve an email export of the data being sent to the victim — meaning we’d need to also compromise their mailbox, and it would probably raise the alarm if noticed. ",{"data":29595,"content":29596,"nodeType":866},{},[29597],{"data":29598,"marks":29599,"value":29600,"nodeType":865},{},[],"Simply downloading the data directly doesn’t work too well with Operator either — downloads are stored in the VM and aren’t easy to extract (for now, anyway).",{"data":29602,"content":29603,"nodeType":866},{},[29604],{"data":29605,"marks":29606,"value":29607,"nodeType":865},{},[],"But this got us thinking:",{"data":29609,"content":29610,"nodeType":2718},{},[29611,29621,29631],{"data":29612,"content":29613,"nodeType":2654},{},[29614],{"data":29615,"content":29616,"nodeType":866},{},[29617],{"data":29618,"marks":29619,"value":29620,"nodeType":865},{},[],"Mass data exfiltration is more likely to raise the alarm than the sharing of sensitive data only.",{"data":29622,"content":29623,"nodeType":2654},{},[29624],{"data":29625,"content":29626,"nodeType":866},{},[29627],{"data":29628,"marks":29629,"value":29630,"nodeType":865},{},[],"Often, much of the data stolen by attackers is pretty low-value and noisy — attackers often don’t really understand the value of what they’ve taken, or how to use/leverage it (particularly when targeting organizations in specialist fields). ",{"data":29632,"content":29633,"nodeType":2654},{},[29634],{"data":29635,"content":29636,"nodeType":866},{},[29637],{"data":29638,"marks":29639,"value":29640,"nodeType":865},{},[],"So what if you could use Operator to understand the data you’ve accessed before dumping it, and stealthily take only what you’re interested in? ",{"data":29642,"content":29643,"nodeType":866},{},[29644,29648],{"data":29645,"marks":29646,"value":29647,"nodeType":865},{},[],"So, w",{"data":29649,"marks":29650,"value":29651,"nodeType":865},{},[],"e asked Operator to analyse data in a compromised Google Drive and report back on what it found. It was able to trawl through looking for specific data of value and report its findings back for us to act on. ",{"data":29653,"content":29657,"nodeType":875},{"target":29654},{"sys":29655},{"id":29656,"type":872,"linkType":873},"VAb39fl1Otlj07dkbDmpU",[],{"data":29659,"content":29660,"nodeType":866},{},[29661],{"data":29662,"marks":29663,"value":29664,"nodeType":865},{},[],"At this point, we could have also asked Operator to create sharing links for those files and record them for us (in case our access was revoked in future). ",{"data":29666,"content":29667,"nodeType":879},{},[],{"data":29669,"content":29670,"nodeType":889},{},[29671],{"data":29672,"marks":29673,"value":29675,"nodeType":865},{},[29674],{"type":887},"Evaluating Operator",{"data":29677,"content":29678,"nodeType":866},{},[29679],{"data":29680,"marks":29681,"value":29682,"nodeType":865},{},[],"Operator clearly demonstrated that it can be used to perform malicious tasks throughout the identity attack kill chain, for every site we directed it at, without requiring custom tool development. Though we didn’t conduct an exhaustive review, we were able to trivially bypass prompt restrictions. And although Operator was meant to hand back over to the user for some actions (like logging, completing CAPTCHAs, etc.) it could be convinced to perform these tasks autonomously. ",{"data":29684,"content":29685,"nodeType":866},{},[29686,29690],{"data":29687,"marks":29688,"value":29689,"nodeType":865},{},[],"It’s important to come back to the point that this isn’t impressive or useful because of the complexity of the tasks — on a 1:1 basis, a human operator will outperform Operator. ",{"data":29691,"marks":29692,"value":29694,"nodeType":865},{},[29693],{"type":887},"The key benefit is the ability to scale these actions across hundreds or even thousands of apps. ",{"data":29696,"content":29697,"nodeType":2315},{},[29698],{"data":29699,"marks":29700,"value":29702,"nodeType":865},{},[29701],{"type":887},"The best (worst?) is still to come",{"data":29704,"content":29705,"nodeType":866},{},[29706],{"data":29707,"marks":29708,"value":29709,"nodeType":865},{},[],"Yes, Operator is a bit slow at the moment, and can get confused when handling long and large tasks with complex instructions. And overall usage is capped, which might prevent attackers from scaling their identity surface discovery and exploitation infinitely (though we didn’t hit any limits during our testing). But let’s remember, it’s not even in V1 yet … ",{"data":29711,"content":29712,"nodeType":866},{},[29713],{"data":29714,"marks":29715,"value":29716,"nodeType":865},{},[],"Operator (and the underlying CUA tech) will inevitably get better. If you can integrate Operator within a tool framework to cover off some of its limitations, and orchestrate Operator windows to perform tasks simultaneously via API (functionality that exists for ChatGPT already) then this kind of CUA tech becomes something that can be very easily abused by attackers. And ultimately, competing CUA products (even inherently malicious ones) will emerge over time, increasing the scope for abuse. ",{"data":29718,"content":29719,"nodeType":866},{},[29720],{"data":29721,"marks":29722,"value":29723,"nodeType":865},{},[],"And what then? There are dual consequences:",{"data":29725,"content":29726,"nodeType":2718},{},[29727,29737],{"data":29728,"content":29729,"nodeType":2654},{},[29730],{"data":29731,"content":29732,"nodeType":866},{},[29733],{"data":29734,"marks":29735,"value":29736,"nodeType":865},{},[],"Lower skilled attackers with fewer resources will be able to harness identity attacks and exploit identity vulnerabilities at scale, with out-of-the-box capabilities.",{"data":29738,"content":29739,"nodeType":2654},{},[29740],{"data":29741,"content":29742,"nodeType":866},{},[29743],{"data":29744,"marks":29745,"value":29746,"nodeType":865},{},[],"More advanced attackers will be able to scale their operations, a bit like being a red team manager of a fleet of AI interns — they handle the grunt work while you’re freed up to perform more complex tasks, only stepping in when you need to. ",{"data":29748,"content":29749,"nodeType":1649},{},[29750],{"data":29751,"content":29752,"nodeType":866},{},[29753,29757,29762],{"data":29754,"marks":29755,"value":29756,"nodeType":865},{},[],"CUAs mean attackers can scale their operations, ",{"data":29758,"marks":29759,"value":29761,"nodeType":865},{},[29760],{"type":887},"a bit like being a red team manager of a fleet of AI interns",{"data":29763,"marks":29764,"value":29765,"nodeType":865},{},[]," — they handle the grunt work while you’re freed up to perform more complex tasks, only stepping in when you need to. ",{"data":29767,"content":29768,"nodeType":879},{},[],{"data":29770,"content":29771,"nodeType":889},{},[29772],{"data":29773,"marks":29774,"value":29776,"nodeType":865},{},[29775],{"type":887},"The verdict",{"data":29778,"content":29779,"nodeType":866},{},[29780],{"data":29781,"marks":29782,"value":29783,"nodeType":865},{},[],"CUA technology has huge implications for the ability of attackers to discover and exploit identity vulnerabilities at-scale. ",{"data":29785,"content":29786,"nodeType":866},{},[29787,29791,29799],{"data":29788,"marks":29789,"value":29790,"nodeType":865},{},[],"The biggest impact that we identified was in terms of credential attacks — and in particular the ability of attackers to leverage compromised credentials and systemic vulnerabilities like credential reuse — which we’ve discussed in more detail ",{"data":29792,"content":29794,"nodeType":905},{"uri":29793},"https://pushsecurity.com/blog/how-new-ai-agents-will-transform-credential-stuffing-attacks/",[29795],{"data":29796,"marks":29797,"value":29798,"nodeType":865},{},[],"in this blog post",{"data":29800,"marks":29801,"value":1711,"nodeType":865},{},[],{"data":29803,"content":29807,"nodeType":875},{"target":29804},{"sys":29805},{"id":29806,"type":872,"linkType":873},"5wczyTsTFu9VshpzxJylgX",[],{"data":29809,"content":29810,"nodeType":879},{},[],{"data":29812,"content":29813,"nodeType":889},{},[29814],{"data":29815,"marks":29816,"value":29818,"nodeType":865},{},[29817],{"type":887},"What you can do about it",{"data":29820,"content":29821,"nodeType":866},{},[29822],{"data":29823,"marks":29824,"value":29825,"nodeType":865},{},[],"Thankfully, no new anti-AI capabilities are required — but it’s more important than ever that organizations look to defend their identity attack surface and find and fix identity vulnerabilities before attackers can take advantage of them. ",{"data":29827,"content":29828,"nodeType":866},{},[29829,29832,29839],{"data":29830,"marks":29831,"value":21,"nodeType":865},{},[],{"data":29833,"content":29834,"nodeType":905},{"uri":3686},[29835],{"data":29836,"marks":29837,"value":20857,"nodeType":865},{},[29838],{"type":1070},{"data":29840,"marks":29841,"value":29842,"nodeType":865},{},[]," to find out how Push helps organizations to find and fix identity vulnerabilities at-scale, and intercept identity attacks as they happen in employee browsers. ",{"data":29844,"content":29847,"nodeType":875},{"target":29845},{"sys":29846},{"id":29417,"type":872,"linkType":873},[],{"data":29849,"content":29850,"nodeType":866},{},[29851],{"data":29852,"marks":29853,"value":21,"nodeType":865},{},[],"5 ways attackers can use Computer-Using Agents to automate identity attacks","We're back with part 2 of our research into OpenAI Operator to share our findings on how it can be used to automate identity attacks. ","2025-03-13T00:00:00.000Z","5-ways-attackers-can-use-computer-using-agents-to-automate-identity-attacks",{"items":29859},[29860,29862],{"sys":29861,"name":2144},{"id":2143},{"sys":29863,"name":297},{"id":2147},{"items":29865},[29866],{"fullName":13458,"firstName":13459,"jobTitle":13460,"profilePicture":29867},{"url":13462},"blog/why-attackers-are-targeting-jira-with-stolen-credentials",{"json":29870},{"data":29871,"content":29872,"nodeType":1522},{},[29873],{"data":29874,"content":29875,"nodeType":866},{},[29876],{"data":29877,"marks":29878,"value":18374,"nodeType":865},{},[],{"id":9066,"publishedAt":29880},"2026-08-12T11:54:22.609Z",{"items":29882},[29883,29885],{"sys":29884,"name":2144},{"id":2143},{"sys":29886,"name":342},{"id":3008},{"items":29888},[29889,29891,29893,29895,29897,29899,29901,29903,29905,29907,29909,29911,29913,29915,29917],{"sys":29890,"name":413,"slug":414,"tier":31},{"id":410},{"sys":29892,"name":545,"slug":546,"tier":31},{"id":542},{"sys":29894,"name":279,"slug":280,"tier":31},{"id":276},{"sys":29896,"name":642,"slug":643,"tier":31},{"id":639},{"sys":29898,"name":342,"slug":343,"tier":31},{"id":339},{"sys":29900,"name":297,"slug":298,"tier":31},{"id":294},{"sys":29902,"name":333,"slug":334,"tier":45},{"id":330},{"sys":29904,"name":422,"slug":423,"tier":45},{"id":419},{"sys":29906,"name":528,"slug":529,"tier":45},{"id":525},{"sys":29908,"name":502,"slug":503,"tier":45},{"id":499},{"sys":29910,"name":395,"slug":396,"tier":45},{"id":392},{"sys":29912,"name":457,"slug":458,"tier":45},{"id":454},{"sys":29914,"name":537,"slug":538,"tier":45},{"id":534},{"sys":29916,"name":571,"slug":572,"tier":45},{"id":568},{"sys":29918,"name":324,"slug":325,"tier":45},{"id":321},"vu91m-UCmH2QlKrLtEKhi6TrmA1ZaTVt_DvLlT1QYvc",{"id":29921,"title":29922,"authorsCollection":29923,"content":29928,"extension":228,"faqItemsCollection":30572,"faqTitle":59,"featured":6,"hashTags":59,"meta":30574,"metaTitle":30575,"ogImage":30576,"postType":19311,"publishedDate":30577,"relatedBlogPostsCollection":30578,"slug":33160,"stem":33161,"subtitle":59,"summary":33162,"synopsis":33172,"sys":33173,"tagsCollection":33176,"topicsCollection":33180,"__hash__":33212},"blog/blog/2024-identity-breaches.json","Looking back on identity-based breaches in 2024",{"items":29924},[29925],{"fullName":3012,"firstName":3013,"jobTitle":3014,"socialLinks":29926,"profilePicture":29927},[6742],{"url":3016},{"json":29929,"links":30548},{"data":29930,"content":29931,"nodeType":1522},{},[29932,29939,29946,29953,29972,29979,29986,29989,29997,30004,30011,30018,30024,30031,30034,30042,30049,30056,30063,30070,30076,30083,30086,30094,30102,30109,30116,30123,30142,30150,30157,30164,30171,30178,30186,30193,30200,30206,30209,30217,30224,30231,30238,30245,30252,30255,30263,30270,30277,30284,30291,30298,30409,30425,30432,30438,30441,30449,30456,30524,30531],{"data":29933,"content":29934,"nodeType":866},{},[29935],{"data":29936,"marks":29937,"value":29938,"nodeType":865},{},[],"2024 was an unprecedented year in terms of the impact of identity-based attacks. Or that’s what it felt like anyway, so I decided to trawl through a year of news to see if reality stacked up. ",{"data":29940,"content":29941,"nodeType":866},{},[29942],{"data":29943,"marks":29944,"value":29945,"nodeType":865},{},[],"My main obstacles here were the ever-disappointing levels of public information disclosure for cyber breaches. Even where breaches are disclosed, it’s rare that any public information contains the nature of the initial access vector (though I can’t say I’m surprised — it’s hard to argue the ‘highly sophisticated’ nature of a breach that involved stolen credentials and no MFA). ",{"data":29947,"content":29948,"nodeType":866},{},[29949],{"data":29950,"marks":29951,"value":29952,"nodeType":865},{},[],"Publicly disclosed breaches are just the tip of the iceberg, and with the rise in data theft and extortion over more disruptive attacks (e.g. ransomware), there is often no obvious service interruption indicating that an incident has taken place. This makes it more likely that these situations can be settled quietly or smoothed over, without hitting the headlines. ",{"data":29954,"content":29955,"nodeType":866},{},[29956,29960,29969],{"data":29957,"marks":29958,"value":29959,"nodeType":865},{},[],"That said, the requirement that US companies submit a Form-8K for breaches of a material nature does appear to have increased the number of voluntary declarations (inside the US, at least) and the growing willingness of the SEC to prosecute negligent or misleading behavior is also a considerable motivator, such as ",{"data":29961,"content":29963,"nodeType":905},{"uri":29962},"https://www.bleepingcomputer.com/news/security/sec-charges-tech-companies-for-downplaying-solarwinds-breaches/",[29964],{"data":29965,"marks":29966,"value":29968,"nodeType":865},{},[29967],{"type":1070},"the recent prosecution of companies for misleading investors about the impact of the 2020 SolarWinds Orion hack",{"data":29970,"marks":29971,"value":1193,"nodeType":865},{},[],{"data":29973,"content":29974,"nodeType":866},{},[29975],{"data":29976,"marks":29977,"value":29978,"nodeType":865},{},[],"Despite all this, I totalled 30 breaches that were the result of an identity-based initial access vector, such as phishing, credential stuffing, social engineering, session hijacking, etc. To make the list, it had to have appeared in the public domain, confirmed by the victim or an authoritative source, and the breach vector had to have been named. ",{"data":29980,"content":29981,"nodeType":866},{},[29982],{"data":29983,"marks":29984,"value":29985,"nodeType":865},{},[],"Public identity-related breaches in 2024 resulted in hundreds of millions of breached customer records (with the final impact of many still yet to appear in the public domain).",{"data":29987,"content":29988,"nodeType":879},{},[],{"data":29990,"content":29991,"nodeType":889},{},[29992],{"data":29993,"marks":29994,"value":29996,"nodeType":865},{},[29995],{"type":887},"What is an identity attack?",{"data":29998,"content":29999,"nodeType":866},{},[30000],{"data":30001,"marks":30002,"value":30003,"nodeType":865},{},[],"First, what do we mean by identity attack? ",{"data":30005,"content":30006,"nodeType":866},{},[30007],{"data":30008,"marks":30009,"value":30010,"nodeType":865},{},[],"An identity attack is any attack (regardless of the steps that follow) involving identity-based techniques, such as phishing, credential stuffing, and session hijacking, to log into an account/service. Basically, where identity is the initial breach vector.",{"data":30012,"content":30013,"nodeType":866},{},[30014],{"data":30015,"marks":30016,"value":30017,"nodeType":865},{},[],"The length and complexity of the overall attack chain will vary. For example, a SaaS-based account takeover where the attacker logs in and dumps the data from the app is naturally going to be more direct than a scenario in which an identity-based compromise leads to the takeover of an endpoint or device in a traditional networking environment. ",{"data":30019,"content":30023,"nodeType":875},{"target":30020},{"sys":30021},{"id":30022,"type":872,"linkType":873},"SCbhb6dzXnaKUianhgLEL",[],{"data":30025,"content":30026,"nodeType":866},{},[30027],{"data":30028,"marks":30029,"value":30030,"nodeType":865},{},[],"In 2024, we’ve seen examples of both SaaS-based account takeover as well as identity attacks being used for initial access to more traditional networks, often resulting in ransomware deployment.",{"data":30032,"content":30033,"nodeType":879},{},[],{"data":30035,"content":30036,"nodeType":889},{},[30037],{"data":30038,"marks":30039,"value":30041,"nodeType":865},{},[30040],{"type":887},"Breakdown of public identity breaches in 2024",{"data":30043,"content":30044,"nodeType":866},{},[30045],{"data":30046,"marks":30047,"value":30048,"nodeType":865},{},[],"It’s always tricky to gauge the impact of a cyber breach, particularly when considering the limited information typically shared. Different types of breach are easier to assess than others — for example, any breach involving extortion/ransom payment has a clear cost associated. Regulator fines and penalties are also clear cut. But aside from these, you’re looking at the extent of any disruption/downtime, recovery costs, and the like. Long term, indirect impacts such as the loss of customer confidence are naturally tricky to estimate. ",{"data":30050,"content":30051,"nodeType":866},{},[30052],{"data":30053,"marks":30054,"value":30055,"nodeType":865},{},[],"However, many identity breaches don’t even have these metrics to go by. The general shift toward data theft only (as opposed to ransomware deployment) continued in 2024, and many of the public identity breaches reflect this. In these attacks, attackers steal data to extort a ransom payment, blackmail end-customers, and/or sell the data via underground criminal marketplaces. ",{"data":30057,"content":30058,"nodeType":866},{},[30059],{"data":30060,"marks":30061,"value":30062,"nodeType":865},{},[],"The one consistent metric we do have is the number of breached records, which is available in many (but not all) cases. Some organizations have attempted to calculate the financial impact per breached record. Most notably IBMs annual ‘Cost of a Data Breach’ report estimates the average data breach to cost $4.88m, and the cost per compromised record to be $169. But when applied to the sheer magnitude of 2024’s biggest attacks (in the region of hundreds of millions of breached records) the figures quickly reach unbelievable levels. ",{"data":30064,"content":30065,"nodeType":866},{},[30066],{"data":30067,"marks":30068,"value":30069,"nodeType":865},{},[],"All this is to say: It’s hard to pin down the relative impact of data breaches. But with the information available (profile of the victim organization, type of data impacted, number of customers impacted) it’s possible to provide a finger-in-the-air assessment — which is what I’ve attempted to do below. Here, we can see the overall month-by-month impact of public identity breaches, dated from when they were first reported (or using dates provided in said reports). ",{"data":30071,"content":30075,"nodeType":875},{"target":30072},{"sys":30073},{"id":30074,"type":872,"linkType":873},"2XYuNqLuKhZbISb4II9IW4",[],{"data":30077,"content":30078,"nodeType":866},{},[30079],{"data":30080,"marks":30081,"value":30082,"nodeType":865},{},[],"Let’s take a closer look at the most notable breaches (and why they were especially significant). ",{"data":30084,"content":30085,"nodeType":879},{},[],{"data":30087,"content":30088,"nodeType":889},{},[30089],{"data":30090,"marks":30091,"value":30093,"nodeType":865},{},[30092],{"type":887},"Top 3 public identity-related breaches in 2024",{"data":30095,"content":30096,"nodeType":2315},{},[30097],{"data":30098,"marks":30099,"value":30101,"nodeType":865},{},[30100],{"type":887},"#3: Microsoft — January 2024",{"data":30103,"content":30104,"nodeType":866},{},[30105],{"data":30106,"marks":30107,"value":30108,"nodeType":865},{},[],"The threat group known as APT29, associated with the Russian SVR intelligence service, utilized password spray attacks that successfully compromised a non-production tenant account that did not have multi-factor authentication (MFA) enabled. They then leveraged this account to compromise a ‘test’ OAuth application that had elevated access to the Microsoft corporate environment. This was then used to access the email accounts of Microsoft employees. ",{"data":30110,"content":30111,"nodeType":866},{},[30112],{"data":30113,"marks":30114,"value":30115,"nodeType":865},{},[],"The attacks then continued throughout the year using information stolen from Microsoft mailboxes, with password spraying attacks increasing tenfold since the initial attack, resulting in the further compromise of source code repositories. ",{"data":30117,"content":30118,"nodeType":866},{},[30119],{"data":30120,"marks":30121,"value":30122,"nodeType":865},{},[],"Microsoft has shared limited information about the breach, but despite this it caused a significant stir. We can expect the number of email accounts compromised to be significant, given that it was later suggested that at least 100 external organizations had been contacted by Microsoft regarding their communications being breached (we only know this because 100-ish organizations reported the email as spam). The list of companies impacted included both public and private sector organizations, from major enterprises to government agencies in the US and other countries. ",{"data":30124,"content":30125,"nodeType":866},{},[30126,30130,30138],{"data":30127,"marks":30128,"value":30129,"nodeType":865},{},[],"Microsoft’s challenges with credential management didn’t end here either, ",{"data":30131,"content":30132,"nodeType":905},{"uri":27542},[30133],{"data":30134,"marks":30135,"value":30137,"nodeType":865},{},[30136],{"type":1070},"with bug bounty hunters able to use stolen credentials from a TI platform to breach Microsoft’s ServiceNow tenant",{"data":30139,"marks":30140,"value":30141,"nodeType":865},{},[],", accessing 1,000s of support ticket descriptions and attachments, and 250k+ employee emails.",{"data":30143,"content":30144,"nodeType":2315},{},[30145],{"data":30146,"marks":30147,"value":30149,"nodeType":865},{},[30148],{"type":887},"#2: Change Healthcare — February 2024",{"data":30151,"content":30152,"nodeType":866},{},[30153],{"data":30154,"marks":30155,"value":30156,"nodeType":865},{},[],"In February, attackers stole 6TB of data from UnitedHealth subsidiary Change Healthcare as part of a severe ransomware attack that caused massive disruption to the US healthcare industry. This impacted a wide range of critical services used by healthcare providers across the U.S., including payment processing, prescription writing, and insurance claims, and caused financial damages estimated at $872 million. The attack impacted the personal medical data of over 100M customers. ",{"data":30158,"content":30159,"nodeType":866},{},[30160],{"data":30161,"marks":30162,"value":30163,"nodeType":865},{},[],"The attacker used stolen credentials to breach the company's Citrix remote access service, which did not have multi-factor authentication enabled, as the initial breach vector for the attack. ",{"data":30165,"content":30166,"nodeType":866},{},[30167],{"data":30168,"marks":30169,"value":30170,"nodeType":865},{},[],"Following the attack, the organization's IT team replaced thousands of laptops, rotated credentials, and completely rebuilt Change Healthcare's data center network and core services.",{"data":30172,"content":30173,"nodeType":866},{},[30174],{"data":30175,"marks":30176,"value":30177,"nodeType":865},{},[],"The UnitedHealth Group admitted to paying a ransom demand to receive a decryptor and for the threat actors to delete the stolen data. The ransom payment was allegedly $22 million, according to the BlackCat ransomware affiliate who conducted the attack.",{"data":30179,"content":30180,"nodeType":2315},{},[30181],{"data":30182,"marks":30183,"value":30185,"nodeType":865},{},[30184],{"type":887},"#1: Snowflake — April-June 2024",{"data":30187,"content":30188,"nodeType":866},{},[30189],{"data":30190,"marks":30191,"value":30192,"nodeType":865},{},[],"165 organizations around the world were targeted using stolen credentials gathered from infostealer infections dating back to 2020. The impacted accounts lacked MFA, meaning successful authentication only required a valid username and password. As the Snowflake credentials found in infostealer malware credential dumps had not been rotated or updated, they remained valid and could be used to authenticate to user accounts on Snowflake tenants belonging to various customers. It has been touted by some news outlets as ‘one of the biggest breaches ever’. ",{"data":30194,"content":30195,"nodeType":866},{},[30196],{"data":30197,"marks":30198,"value":30199,"nodeType":865},{},[],"In total, nine public victims were named following the breach, collectively impacting hundreds of millions of their respective customers. Data was put up for sale on criminal forums for fees ranging from $150k to $2m per organization, while AT&T was also confirmed as paying an undisclosed ransom fee. ",{"data":30201,"content":30205,"nodeType":875},{"target":30202},{"sys":30203},{"id":30204,"type":872,"linkType":873},"68txz4KkLmCX2hF9QySUZs",[],{"data":30207,"content":30208,"nodeType":879},{},[],{"data":30210,"content":30211,"nodeType":889},{},[30212],{"data":30213,"marks":30214,"value":30216,"nodeType":865},{},[30215],{"type":887},"Identity attacks vs. other attacks in 2024",{"data":30218,"content":30219,"nodeType":866},{},[30220],{"data":30221,"marks":30222,"value":30223,"nodeType":865},{},[],"In many ways, 2024 was a year of identity attacks. The attacks on Snowflake customers was unarguably one of (if not the most) significant cyber security event of the year (at least, if you exclude CrowdStrike causing a worldwide outage in July) — certainly, it was the largest perpetrated by a criminal group against commercial enterprises. ",{"data":30225,"content":30226,"nodeType":866},{},[30227],{"data":30228,"marks":30229,"value":30230,"nodeType":865},{},[],"Arguably the biggest non-identity story of the year was the Chinese state-sponsored “Salt Typhoon” campaign against global telecommunications firms, with at least nine major providers compromised — including AT&T, Verizon, and T-Mobile. The group reportedly focused on infiltrating telecommunications infrastructure to steal text messages, phone call information, and voicemails from targeted people. The threat actors also targeted the wiretapping platforms used by the US government, raising serious national security concerns.",{"data":30232,"content":30233,"nodeType":866},{},[30234],{"data":30235,"marks":30236,"value":30237,"nodeType":865},{},[],"Undoubtedly this was one of the biggest intelligence compromises in US history and is of major significance. But it’s also arguable that identity attacks had a more widespread commercial impact in 2024 when we look at the big picture.   ",{"data":30239,"content":30240,"nodeType":866},{},[30241],{"data":30242,"marks":30243,"value":30244,"nodeType":865},{},[],"Attacks on edge networking devices were also incredibly prominent, as were very much interlinked with the targeting of telecommunications infrastructure. A barrage of 0-days generated a huge amount of concern about the software security practices of many vendors. ",{"data":30246,"content":30247,"nodeType":866},{},[30248],{"data":30249,"marks":30250,"value":30251,"nodeType":865},{},[],"But despite these honorable mentions, the runaway threat of the year was an identity-based one… ",{"data":30253,"content":30254,"nodeType":879},{},[],{"data":30256,"content":30257,"nodeType":889},{},[30258],{"data":30259,"marks":30260,"value":30262,"nodeType":865},{},[30261],{"type":887},"Threat of the year: Infostealers",{"data":30264,"content":30265,"nodeType":866},{},[30266],{"data":30267,"marks":30268,"value":30269,"nodeType":865},{},[],"2024 saw an unprecedented rise in the role of infostealers. The played a huge role in the attacks on Snowflake customers, where 80% of the accounts were targeted using credentials found in infostealer infections. ",{"data":30271,"content":30272,"nodeType":866},{},[30273],{"data":30274,"marks":30275,"value":30276,"nodeType":865},{},[],"News relating to new infostealer variants and distributions campaigns came thick and fast in 2024, as attackers sought to harvest credentials from victims to use as part of their own malicious campaigns, or to sell on to other criminals on underground marketplaces for compromised credentials. Attackers leaned into alternative distribution channels, branching away from email-based campaigns to target victims via gaming forums, Facebook ads, and YouTube video descriptions. GitHub was also continuously targeted as a malware distribution mechanism throughout the year — and the majority of the time it was to push infostealers. ",{"data":30278,"content":30279,"nodeType":866},{},[30280],{"data":30281,"marks":30282,"value":30283,"nodeType":865},{},[],"Infostealers are the weapon of choice for attackers looking to harvest credentials at scale. Compared to credential harvesting phishing campaigns, infostealers target a much broader range of credentials, taking everything saved in the victim’s browser (and often also from local apps, including password managers).",{"data":30285,"content":30286,"nodeType":866},{},[30287],{"data":30288,"marks":30289,"value":30290,"nodeType":865},{},[],"Infostealers are nothing new, but have historically been seen as a problem affecting less secure personal devices and accounts. But 2024 has demonstrated that infostealers are finding ways to harvest business data — by finding ways around controls like EDR, and because of the ways that personal and business identities and accounts are converging in the modern workplace. For example, it’s not uncommon for employees to log into their personal Google account on their work device (and vice versa), inadvertently saving corporate credentials to their personal password store — which is later compromised through an infostealer infection on a personal device. ",{"data":30292,"content":30293,"nodeType":866},{},[30294],{"data":30295,"marks":30296,"value":30297,"nodeType":865},{},[],"The impact of infostealers (and the resulting stolen credentials and session cookies) is underlined by various figures:",{"data":30299,"content":30300,"nodeType":2718},{},[30301,30322,30344,30366,30387],{"data":30302,"content":30303,"nodeType":2654},{},[30304],{"data":30305,"content":30306,"nodeType":866},{},[30307,30311,30319],{"data":30308,"marks":30309,"value":30310,"nodeType":865},{},[],"79% of web application compromises were the result of breached credentials (",{"data":30312,"content":30314,"nodeType":905},{"uri":30313},"https://www.verizon.com/business/en-gb/resources/reports/dbir/",[30315],{"data":30316,"marks":30317,"value":10417,"nodeType":865},{},[30318],{"type":1070},{"data":30320,"marks":30321,"value":13320,"nodeType":865},{},[],{"data":30323,"content":30324,"nodeType":2654},{},[30325],{"data":30326,"content":30327,"nodeType":866},{},[30328,30332,30341],{"data":30329,"marks":30330,"value":30331,"nodeType":865},{},[],"Infostealer activity increased by 266% in 2023, while the number of attacks featuring valid credentials saw a 71% increase year-over-year (",{"data":30333,"content":30335,"nodeType":905},{"uri":30334},"https://www.ibm.com/downloads/cas/L0GKXDWJ",[30336],{"data":30337,"marks":30338,"value":30340,"nodeType":865},{},[30339],{"type":1070},"IBM",{"data":30342,"marks":30343,"value":13320,"nodeType":865},{},[],{"data":30345,"content":30346,"nodeType":2654},{},[30347],{"data":30348,"content":30349,"nodeType":866},{},[30350,30354,30363],{"data":30351,"marks":30352,"value":30353,"nodeType":865},{},[],"Nearly half of the malware detected last year targeted victims’ data specifically, and the majority of that malware was classified as infostealers (",{"data":30355,"content":30357,"nodeType":905},{"uri":30356},"https://news.sophos.com/en-us/2024/03/12/2024-sophos-threat-report/",[30358],{"data":30359,"marks":30360,"value":30362,"nodeType":865},{},[30361],{"type":1070},"Sophos",{"data":30364,"marks":30365,"value":13320,"nodeType":865},{},[],{"data":30367,"content":30368,"nodeType":2654},{},[30369],{"data":30370,"content":30371,"nodeType":866},{},[30372,30376,30384],{"data":30373,"marks":30374,"value":30375,"nodeType":865},{},[],"39,000 session token attacks are detected per day (",{"data":30377,"content":30379,"nodeType":905},{"uri":30378},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Microsoft%20Digital%20Defense%20Report%202024%20%281%29.pdf",[30380],{"data":30381,"marks":30382,"value":7564,"nodeType":865},{},[30383],{"type":1070},{"data":30385,"marks":30386,"value":13320,"nodeType":865},{},[],{"data":30388,"content":30389,"nodeType":2654},{},[30390],{"data":30391,"content":30392,"nodeType":866},{},[30393,30397,30406],{"data":30394,"marks":30395,"value":30396,"nodeType":865},{},[],"Attacks on session cookies happen at the same rough order of magnitude as password-based attacks (",{"data":30398,"content":30400,"nodeType":905},{"uri":30399},"https://github.com/WICG/dbsc/issues/13#issuecomment-1977657864",[30401],{"data":30402,"marks":30403,"value":30405,"nodeType":865},{},[30404],{"type":1070},"Google",{"data":30407,"marks":30408,"value":13320,"nodeType":865},{},[],{"data":30410,"content":30411,"nodeType":866},{},[30412,30416,30421],{"data":30413,"marks":30414,"value":30415,"nodeType":865},{},[],"And of the confirmed identity-based breaches in the public domain that we identified, ",{"data":30417,"marks":30418,"value":30420,"nodeType":865},{},[30419],{"type":887},"a whopping 73% were the result of compromised credentials ",{"data":30422,"marks":30423,"value":30424,"nodeType":865},{},[],"(the rest were phishing attacks). ",{"data":30426,"content":30427,"nodeType":866},{},[30428],{"data":30429,"marks":30430,"value":30431,"nodeType":865},{},[],"As the primary source of compromised credentials, it’s fair to say that infostealers deserve the top spot for 2024.",{"data":30433,"content":30437,"nodeType":875},{"target":30434},{"sys":30435},{"id":30436,"type":872,"linkType":873},"7mMQEYQTXKAajIGFviDJKt",[],{"data":30439,"content":30440,"nodeType":879},{},[],{"data":30442,"content":30443,"nodeType":889},{},[30444],{"data":30445,"marks":30446,"value":30448,"nodeType":865},{},[30447],{"type":887},"Defend against infostealers with Push",{"data":30450,"content":30451,"nodeType":866},{},[30452],{"data":30453,"marks":30454,"value":30455,"nodeType":865},{},[],"As a browser-based identity security platform designed to stop identity attacks, Push helps organizations to defend against the rise in infostealers by:",{"data":30457,"content":30458,"nodeType":2718},{},[30459,30493,30514],{"data":30460,"content":30461,"nodeType":2654},{},[30462],{"data":30463,"content":30464,"nodeType":866},{},[30465,30468,30476,30480,30489],{"data":30466,"marks":30467,"value":21,"nodeType":865},{},[],{"data":30469,"content":30470,"nodeType":905},{"uri":964},[30471],{"data":30472,"marks":30473,"value":30475,"nodeType":865},{},[30474],{"type":1070},"Alerting you whenever the valid credentials your employees are using appear in a compromised credential data feed",{"data":30477,"marks":30478,"value":30479,"nodeType":865},{},[],", which can be leveraged to ",{"data":30481,"content":30483,"nodeType":905},{"uri":30482},"https://pushsecurity.com/blog/automating-sso-password-resets-using-push/",[30484],{"data":30485,"marks":30486,"value":30488,"nodeType":865},{},[30487],{"type":1070},"trigger automated password resets",{"data":30490,"marks":30491,"value":30492,"nodeType":865},{},[]," whenever an event fires and is received by your SIEM tool.",{"data":30494,"content":30495,"nodeType":2654},{},[30496],{"data":30497,"content":30498,"nodeType":866},{},[30499,30502,30510],{"data":30500,"marks":30501,"value":21,"nodeType":865},{},[],{"data":30503,"content":30504,"nodeType":905},{"uri":17648},[30505],{"data":30506,"marks":30507,"value":30509,"nodeType":865},{},[30508],{"type":1070},"Detecting session hijacking attacks using stolen cookies to identify when an attacker logs into an app",{"data":30511,"marks":30512,"value":30513,"nodeType":865},{},[]," from an unmanaged device without the Push browser extension — this can also be used to detect suspicious access in general!",{"data":30515,"content":30516,"nodeType":2654},{},[30517],{"data":30518,"content":30519,"nodeType":866},{},[30520],{"data":30521,"marks":30522,"value":30523,"nodeType":865},{},[],"Enabling you to enforce MFA the next time an employee logs into an app (even when the app itself doesn’t allow you to enforce mandatory MFA) — particularly handy if a weak, breached, or reused password is detected for their account!  ",{"data":30525,"content":30526,"nodeType":866},{},[30527],{"data":30528,"marks":30529,"value":30530,"nodeType":865},{},[],"And much, much more. ",{"data":30532,"content":30533,"nodeType":866},{},[30534,30538,30545],{"data":30535,"marks":30536,"value":30537,"nodeType":865},{},[],"If you’d like to explore the platform yourself and discover more of our great features, you can ",{"data":30539,"content":30540,"nodeType":905},{"uri":1512},[30541],{"data":30542,"marks":30543,"value":15182,"nodeType":865},{},[30544],{"type":1070},{"data":30546,"marks":30547,"value":1193,"nodeType":865},{},[],{"entries":30549},{"hyperlink":30550,"inline":30551,"block":30552},[],[],[30553,30557,30564,30567],{"sys":30554,"__typename":1530,"type":1531,"ctaText":30555,"buttonLabel":30556,"buttonColour":1534,"buttonUrl":28033},{"id":30022},"Learn about how attack paths are changing with the shift to SaaS-based IT here","Read the blog",{"sys":30558,"__typename":4637,"title":30559,"caption":30560,"layoutMode":59,"file":30561},{"id":30074},"Identity-related breaches in 2024","Bold names are particularly notable for their significance and impact. A snowflake symbol indicates that the victim was impacted as part of the wider campaign against Snowflake customers. Dollar sign indicates that a ransom payment was confirmed.",{"url":30562,"width":25196,"height":30563},"https://images.ctfassets.net/y1cdw1ablpvd/6AYqSpjNFFdEHnjviy5R7y/c1566a4f95e3c4d547abddba22ea2fd2/2024_identity_attacks__1_.png",1150,{"sys":30565,"__typename":1530,"type":1531,"ctaText":30566,"buttonLabel":30556,"buttonColour":14189,"buttonUrl":933},{"id":30204},"Read more about the Snowflake incident in our blog post",{"sys":30568,"__typename":1530,"type":1531,"ctaText":30569,"buttonLabel":30556,"buttonColour":30570,"buttonUrl":30571},{"id":30436},"For more information on the rise of infostealers, check out our deep-dive here","orange","https://pushsecurity.com/blog/what-the-rise-of-infostealers-says-about-identity-attacks/",{"items":30573},[],{},"Public breaches from identity attacks in 2024",{"url":30562},"2025-01-10T00:00:00.000Z",{"items":30579},[30580,31291,31639],{"__typename":1544,"sys":30581,"content":30582,"title":31275,"synopsis":31276,"hashTags":59,"publishedDate":31277,"slug":31278,"tagsCollection":31279,"authorsCollection":31287},{"id":9150},{"json":30583},{"data":30584,"content":30585,"nodeType":1522},{},[30586,30592,30595,30611,30618,30625,30631,30638,30656,30675,30682,30688,30695,30698,30705,30712,30719,30726,30733,30740,30773,30779,30786,30789,30796,30803,30918,30925,30943,30950,30968,30975,30995,31002,31020,31023,31030,31037,31044,31075,31082,31089,31107,31113,31120,31127,31133,31140,31202,31209,31216,31223,31230,31237,31240,31247,31264,31269],{"data":30587,"content":30591,"nodeType":875},{"target":30588},{"sys":30589},{"id":30590,"type":872,"linkType":873},"HcoxuG8EK0w5uFQlN0hbh",[],{"data":30593,"content":30594,"nodeType":879},{},[],{"data":30596,"content":30597,"nodeType":866},{},[30598,30602,30607],{"data":30599,"marks":30600,"value":30601,"nodeType":865},{},[],"While ",{"data":30603,"marks":30604,"value":30606,"nodeType":865},{},[30605],{"type":2757},"striking",{"data":30608,"marks":30609,"value":30610,"nodeType":865},{},[]," gold sure feels good, mining for gold doesn’t. All that sifting for a few grains of value. ",{"data":30612,"content":30613,"nodeType":866},{},[30614],{"data":30615,"marks":30616,"value":30617,"nodeType":865},{},[],"If you’ve ever tried to make use of a TI feed on stolen credentials, you’ll know exactly how this feels. Yet the need to identify signal from noise is obvious. When it matters, it really matters. ",{"data":30619,"content":30620,"nodeType":866},{},[30621],{"data":30622,"marks":30623,"value":30624,"nodeType":865},{},[],"While there’s an enormous volume of TI data available on stolen creds, data trustworthiness is much harder to establish. Are these creds still in use? Are they in use on company applications? And without trust in the data, it’s harder to take action.",{"data":30626,"content":30630,"nodeType":875},{"target":30627},{"sys":30628},{"id":30629,"type":872,"linkType":873},"4unFZadFrWEQsiHsD3YAEo",[],{"data":30632,"content":30633,"nodeType":866},{},[30634],{"data":30635,"marks":30636,"value":30637,"nodeType":865},{},[],"We set out to solve this problem at Push and ended up flipping the script on conventional approaches to evaluating TI on stolen credentials. (Lay down your shovel, friend.)",{"data":30639,"content":30640,"nodeType":1649},{},[30641],{"data":30642,"content":30643,"nodeType":866},{},[30644,30648,30653],{"data":30645,"marks":30646,"value":30647,"nodeType":865},{},[],"With our latest release, Push takes TI on stolen credentials sourced from criminal forums and compares it to the actual credentials still being used across customer environments, ",{"data":30649,"marks":30650,"value":30652,"nodeType":865},{},[30651],{"type":887},"alerting on validated true positives only",{"data":30654,"marks":30655,"value":6352,"nodeType":865},{},[],{"data":30657,"content":30658,"nodeType":866},{},[30659,30663,30671],{"data":30660,"marks":30661,"value":30662,"nodeType":865},{},[],"As of January 2025, you can also bring your own TI to the Push platform. Using the ",{"data":30664,"content":30666,"nodeType":905},{"uri":30665},"https://pushsecurity.redoc.ly/rest-v1#tag/Stolen-credential-detection",[30667],{"data":30668,"marks":30669,"value":30670,"nodeType":865},{},[],"Push REST API",{"data":30672,"marks":30673,"value":30674,"nodeType":865},{},[],", you can share stolen credential reports you receive from your existing vendors and task the Push browser agent with finding the ones still in use by employees.",{"data":30676,"content":30677,"nodeType":866},{},[30678],{"data":30679,"marks":30680,"value":30681,"nodeType":865},{},[],"Call it the “dirt in, gold out” model for TI feeds.",{"data":30683,"content":30687,"nodeType":875},{"target":30684},{"sys":30685},{"id":30686,"type":872,"linkType":873},"5VtuerdMpP4U9yL7pjrb4P",[],{"data":30689,"content":30690,"nodeType":866},{},[30691],{"data":30692,"marks":30693,"value":30694,"nodeType":865},{},[],"In this article, we’ll cover some of the challenges with threat intel on stolen credentials, why the rise of infostealers has added urgency to determining the trustworthiness of this category of threat, and how Push’s approach of validating stolen credentials cuts through uncertainty. ",{"data":30696,"content":30697,"nodeType":879},{},[],{"data":30699,"content":30700,"nodeType":889},{},[30701],{"data":30702,"marks":30703,"value":30704,"nodeType":865},{},[],"Why actionable intel on creds is hard",{"data":30706,"content":30707,"nodeType":866},{},[30708],{"data":30709,"marks":30710,"value":30711,"nodeType":865},{},[],"Both threat actors and security teams have ready access to information on stolen credentials, with obviously opposite goals. There is now a robust economy for this data, driven in part by both the success of attacks using stolen creds, and the SaaS-ification of business software. In the past, security teams could audit their Active Directory passwords. Today, many if not most corporate credentials are stored in apps that do not provide that level of visibility.",{"data":30713,"content":30714,"nodeType":866},{},[30715],{"data":30716,"marks":30717,"value":30718,"nodeType":865},{},[],"So when it comes to stolen credential TI, the challenge is not the availability of data — dozens of vendors already do the hard work of establishing presences in these forums in order to collect and disseminate information on credentials such as usernames, passwords, cookies, and API keys that have been stolen through data breaches, phishing attacks, infostealers, or other methods. ",{"data":30720,"content":30721,"nodeType":2315},{},[30722],{"data":30723,"marks":30724,"value":30725,"nodeType":865},{},[],"Too much data, not enough context",{"data":30727,"content":30728,"nodeType":866},{},[30729],{"data":30730,"marks":30731,"value":30732,"nodeType":865},{},[],"Rather, the difficulty is determining which information to act on. Finding the gold, in other words.",{"data":30734,"content":30735,"nodeType":866},{},[30736],{"data":30737,"marks":30738,"value":30739,"nodeType":865},{},[],"TI on stolen credentials often suffers from:",{"data":30741,"content":30742,"nodeType":2718},{},[30743,30758],{"data":30744,"content":30745,"nodeType":2654},{},[30746],{"data":30747,"content":30748,"nodeType":866},{},[30749,30754],{"data":30750,"marks":30751,"value":30753,"nodeType":865},{},[30752],{"type":887},"Data overload:",{"data":30755,"marks":30756,"value":30757,"nodeType":865},{},[]," The double bind of TI is especially evident here — once you know about a potential true positive, you feel obligated to investigate, yet the scale of the information and the high incidence of outdated or incomplete information can pose a risk of desensitizing the SOC or wasting dozens of hours of time investigating what turn out to be false positives, especially when that time could have been better spent on in-depth threat hunting.",{"data":30759,"content":30760,"nodeType":2654},{},[30761],{"data":30762,"content":30763,"nodeType":866},{},[30764,30769],{"data":30765,"marks":30766,"value":30768,"nodeType":865},{},[30767],{"type":887},"Minimal context:",{"data":30770,"marks":30771,"value":30772,"nodeType":865},{},[]," Intelligence is often incomplete or out of date. TI feeds may present stolen passwords as new breaches, but the data is actually a recycled combolist (aggregated list of lists) rather than a new incident. In some situations, infostealer threat intel can stem from a personal device that was compromised and once accessed corporate assets, but is no longer active or using that password. Then there are the false negatives, where you get an alert for stolen credentials on a core app following a breach, and the creds are no longer in use there — but they are still being used on a different high-value app. ",{"data":30774,"content":30778,"nodeType":875},{"target":30775},{"sys":30776},{"id":30777,"type":872,"linkType":873},"40ZWbzJFQLRjCAaFCA0YLS",[],{"data":30780,"content":30781,"nodeType":866},{},[30782],{"data":30783,"marks":30784,"value":30785,"nodeType":865},{},[],"Despite these challenges, there is still a strong case for incorporating TI on stolen creds into your cyber defense practice for one important reason: Attackers are increasingly using stolen credentials to compromise organizations.",{"data":30787,"content":30788,"nodeType":879},{},[],{"data":30790,"content":30791,"nodeType":889},{},[30792],{"data":30793,"marks":30794,"value":30795,"nodeType":865},{},[],"The commodification of stolen creds in the age of infostealers",{"data":30797,"content":30798,"nodeType":866},{},[30799],{"data":30800,"marks":30801,"value":30802,"nodeType":865},{},[],"A few headline stats on how ubiquitous stolen credential exploitation has become:",{"data":30804,"content":30805,"nodeType":2718},{},[30806,30827,30849,30872,30908],{"data":30807,"content":30808,"nodeType":2654},{},[30809],{"data":30810,"content":30811,"nodeType":866},{},[30812,30815,30823],{"data":30813,"marks":30814,"value":1061,"nodeType":865},{},[],{"data":30816,"content":30817,"nodeType":905},{"uri":30313},[30818],{"data":30819,"marks":30820,"value":30822,"nodeType":865},{},[30821],{"type":1070},"2024 Verizon DBIR",{"data":30824,"marks":30825,"value":30826,"nodeType":865},{},[]," found that 79% of web application compromises were the result of breached credentials.",{"data":30828,"content":30829,"nodeType":2654},{},[30830],{"data":30831,"content":30832,"nodeType":866},{},[30833,30836,30845],{"data":30834,"marks":30835,"value":21,"nodeType":865},{},[],{"data":30837,"content":30839,"nodeType":905},{"uri":30838},"https://www.ibm.com/reports/threat-intelligence",[30840],{"data":30841,"marks":30842,"value":30844,"nodeType":865},{},[30843],{"type":1070},"Researchers at IBM",{"data":30846,"marks":30847,"value":30848,"nodeType":865},{},[]," identified a 71% year-over-year increase in cyberattacks using stolen or compromised credentials. This jump made stolen creds the No. 1 source of initial access for cyberattacks in their study. They also found a 266% uptick in the last year in the use of infostealers — malware designed to capture passwords, cookies, and other credential data.",{"data":30850,"content":30851,"nodeType":2654},{},[30852],{"data":30853,"content":30854,"nodeType":866},{},[30855,30859,30868],{"data":30856,"marks":30857,"value":30858,"nodeType":865},{},[],"Researchers at threat intelligence provider ",{"data":30860,"content":30862,"nodeType":905},{"uri":30861},"https://go.recordedfuture.com/hubfs/reports/ta-2024-0321.pdf",[30863],{"data":30864,"marks":30865,"value":30867,"nodeType":865},{},[30866],{"type":1070},"Recorded Future",{"data":30869,"marks":30870,"value":30871,"nodeType":865},{},[]," found a 135% increase last year in the number of harvested credentials among their data sources, and a 166% increase in credentials that included cookies, providing an easy way for attackers to bypass MFA protections.",{"data":30873,"content":30874,"nodeType":2654},{},[30875],{"data":30876,"content":30877,"nodeType":866},{},[30878,30882,30891,30895,30904],{"data":30879,"marks":30880,"value":30881,"nodeType":865},{},[],"Meanwhile, Mandiant’s last two ",{"data":30883,"content":30885,"nodeType":905},{"uri":30884},"https://cloud.google.com/security/resources/m-trends",[30886],{"data":30887,"marks":30888,"value":30890,"nodeType":865},{},[30889],{"type":1070},"M-Trends reports",{"data":30892,"marks":30893,"value":30894,"nodeType":865},{},[]," found that stolen creds were the third and fourth most-used initial intrusion method of the last two years. Cisco Talos researchers found that the ",{"data":30896,"content":30898,"nodeType":905},{"uri":30897},"https://blog.talosintelligence.com/cisco-talos-2023-year-in-review/",[30899],{"data":30900,"marks":30901,"value":30903,"nodeType":865},{},[30902],{"type":1070},"use of valid accounts",{"data":30905,"marks":30906,"value":30907,"nodeType":865},{},[]," was the second-most common attack technique they observed last year.",{"data":30909,"content":30910,"nodeType":2654},{},[30911],{"data":30912,"content":30913,"nodeType":866},{},[30914],{"data":30915,"marks":30916,"value":30917,"nodeType":865},{},[],"Push’s own review of the 25 most notable public identity-related breaches over the last year found that 23 were tied to stolen credentials.",{"data":30919,"content":30920,"nodeType":866},{},[30921],{"data":30922,"marks":30923,"value":30924,"nodeType":865},{},[],"What’s not immediately obvious from these statistics is that not only are credential-based attacks becoming more common, but they’re also becoming easier for attackers to execute.",{"data":30926,"content":30927,"nodeType":866},{},[30928,30931,30939],{"data":30929,"marks":30930,"value":21,"nodeType":865},{},[],{"data":30932,"content":30933,"nodeType":905},{"uri":30838},[30934],{"data":30935,"marks":30936,"value":30938,"nodeType":865},{},[30937],{"type":1070},"IBM X-Force researchers",{"data":30940,"marks":30941,"value":30942,"nodeType":865},{},[]," have found that credentials for cloud accounts account for 90% of all cloud assets for sale on the dark web, making them readily accessible. Price tags can be as low as $10.",{"data":30944,"content":30945,"nodeType":2315},{},[30946],{"data":30947,"marks":30948,"value":30949,"nodeType":865},{},[],"The rise of infostealers has supercharged the stolen credential marketplace",{"data":30951,"content":30952,"nodeType":866},{},[30953,30957,30965],{"data":30954,"marks":30955,"value":30956,"nodeType":865},{},[],"One category of threat — infostealer malware — has emerged as an especially successful avenue of compromise. While infostealers aren’t new, they have developed alongside what is now a robust economy for stolen credentials (think: dedicated Telegram channels advertising stolen data from the most popular infostealers), making them a fruitful option for attackers. For a deeper dive on the rise of infostealers, see our ",{"data":30958,"content":30959,"nodeType":905},{"uri":30571},[30960],{"data":30961,"marks":30962,"value":30964,"nodeType":865},{},[30963],{"type":1070},"previous article",{"data":30966,"marks":30967,"value":1193,"nodeType":865},{},[],{"data":30969,"content":30970,"nodeType":866},{},[30971],{"data":30972,"marks":30973,"value":30974,"nodeType":865},{},[],"Once attackers gain possession of stolen creds, they have plenty of soft targets. For organizations with a large amount of SaaS — a percentage of which will always be unmanaged shadow IT or freemium — the risk is heightened because all attackers need to do is log in to potentially hundreds of services, dump the data they find (including additional creds in some cases), and profit. ",{"data":30976,"content":30977,"nodeType":866},{},[30978,30982,30991],{"data":30979,"marks":30980,"value":30981,"nodeType":865},{},[],"In other words, the average attack path for SaaS is shorter and occurs in-app, often using legitimate workflows, making it therefore harder to detect than traditional network exploits. We discuss this phenomenon in our ",{"data":30983,"content":30984,"nodeType":905},{"uri":28033},[30985],{"data":30986,"marks":30987,"value":30990,"nodeType":865},{},[30988,30989],{"type":1070},{"type":887},"shifting detection left",{"data":30992,"marks":30993,"value":30994,"nodeType":865},{},[]," article.",{"data":30996,"content":30997,"nodeType":866},{},[30998],{"data":30999,"marks":31000,"value":31001,"nodeType":865},{},[],"Our take: We haven’t yet seen the peak of identity attacks that leverage compromised credentials. The opportunities for attackers are too numerous, and front-line defenses like MFA are still not widely enough enforced, particularly on unmanaged apps used for work.",{"data":31003,"content":31004,"nodeType":866},{},[31005,31009,31016],{"data":31006,"marks":31007,"value":31008,"nodeType":865},{},[],"Push Security’s ",{"data":31010,"content":31011,"nodeType":905},{"uri":6333},[31012],{"data":31013,"marks":31014,"value":27765,"nodeType":865},{},[31015],{"type":1070},{"data":31017,"marks":31018,"value":31019,"nodeType":865},{},[]," has found that 37% of corporate identities are using passwords with no MFA. For attackers in possession of stolen creds, these are easy marks.",{"data":31021,"content":31022,"nodeType":879},{},[],{"data":31024,"content":31025,"nodeType":889},{},[31026],{"data":31027,"marks":31028,"value":31029,"nodeType":865},{},[],"How Push detects stolen creds with high confidence",{"data":31031,"content":31032,"nodeType":866},{},[31033],{"data":31034,"marks":31035,"value":31036,"nodeType":865},{},[],"Now let’s take a look at how Push’s approach to this problem is different.",{"data":31038,"content":31039,"nodeType":866},{},[31040],{"data":31041,"marks":31042,"value":31043,"nodeType":865},{},[],"If you’re not familiar with the Push platform, a bit of context will be useful here: Push uses a browser agent deployed to employee browsers (we support all major browsers) to prevent, detect, and block identity attacks. ",{"data":31045,"content":31046,"nodeType":866},{},[31047,31051,31059,31063,31071],{"data":31048,"marks":31049,"value":31050,"nodeType":865},{},[],"In addition to enforcing ",{"data":31052,"content":31053,"nodeType":905},{"uri":1295},[31054],{"data":31055,"marks":31056,"value":31058,"nodeType":865},{},[31057],{"type":1070},"security controls",{"data":31060,"marks":31061,"value":31062,"nodeType":865},{},[]," in the browser, Push also assesses the strength of end-user passwords by ",{"data":31064,"content":31065,"nodeType":905},{"uri":28209},[31066],{"data":31067,"marks":31068,"value":31070,"nodeType":865},{},[31069],{"type":1070},"creating and analyzing",{"data":31072,"marks":31073,"value":31074,"nodeType":865},{},[]," a truncated, salted SHA256 hash of the password for a given account. This is called a password fingerprint. These k-anonymized fingerprints are never seen by Push’s back-end and exist only in local browser extension storage.",{"data":31076,"content":31077,"nodeType":866},{},[31078],{"data":31079,"marks":31080,"value":31081,"nodeType":865},{},[],"This approach gives Push a directly observable source of truth for corporate credentials, and that data point turns out to be the key to flipping the script on how threat intelligence on stolen credentials is typically evaluated.",{"data":31083,"content":31084,"nodeType":866},{},[31085],{"data":31086,"marks":31087,"value":31088,"nodeType":865},{},[],"In the past, evaluating TI on stolen creds meant performing traditional intelligence assessments, such as confidence level based on factors like the intel source and whether the data was still current. Only after determining whether the information was high-confidence could you take action.",{"data":31090,"content":31091,"nodeType":866},{},[31092,31096,31103],{"data":31093,"marks":31094,"value":31095,"nodeType":865},{},[],"It’s worth noting, too, that the age of TI alone is not enough of an indicator to determine whether to take action. With the ",{"data":31097,"content":31098,"nodeType":905},{"uri":933},[31099],{"data":31100,"marks":31101,"value":31102,"nodeType":865},{},[],"Snowflake breach earlier this year",{"data":31104,"marks":31105,"value":31106,"nodeType":865},{},[],", we saw how even older credentials posed a threat of account takeover where these creds were still in use. In the case of Snowflake, the attacker used credentials sourced from historical infostealer campaigns, some dating as far back as 2020.",{"data":31108,"content":31112,"nodeType":875},{"target":31109},{"sys":31110},{"id":31111,"type":872,"linkType":873},"2lSZ7HbZfLmSFXneCnVJzY",[],{"data":31114,"content":31115,"nodeType":2315},{},[31116],{"data":31117,"marks":31118,"value":31119,"nodeType":865},{},[],"Forget about time-consuming manual TI validation and get straight to the true positives",{"data":31121,"content":31122,"nodeType":866},{},[31123],{"data":31124,"marks":31125,"value":31126,"nodeType":865},{},[],"With Push, the platform now can analyze threat intelligence on stolen credentials and alert when there’s a validated match among current credentials in use in your environment. This method works regardless of the source of the data or its age. This method also finds the needles in the haystack — situations where threat intel flags a stolen credential on one app, but that credential is also in use on several other apps. ",{"data":31128,"content":31132,"nodeType":875},{"target":31129},{"sys":31130},{"id":31131,"type":872,"linkType":873},"7GSFasHfHb3UgpgF8pZ2N2",[],{"data":31134,"content":31135,"nodeType":866},{},[31136],{"data":31137,"marks":31138,"value":31139,"nodeType":865},{},[],"Here’s how it works:",{"data":31141,"content":31142,"nodeType":2718},{},[31143,31163,31173,31183,31193],{"data":31144,"content":31145,"nodeType":2654},{},[31146],{"data":31147,"content":31148,"nodeType":866},{},[31149,31153,31160],{"data":31150,"marks":31151,"value":31152,"nodeType":865},{},[],"Push receives TI on stolen credentials from vendor feeds. Use the feeds that Push supplies (at no additional cost for Push customers), or, additionally, bring your own TI by supplying stolen credential reports via the ",{"data":31154,"content":31156,"nodeType":905},{"uri":31155},"https://pushsecurity.redoc.ly/rest-v1#operation/post-controls-stolenCredentials",[31157],{"data":31158,"marks":31159,"value":30670,"nodeType":865},{},[],{"data":31161,"marks":31162,"value":6352,"nodeType":865},{},[],{"data":31164,"content":31165,"nodeType":2654},{},[31166],{"data":31167,"content":31168,"nodeType":866},{},[31169],{"data":31170,"marks":31171,"value":31172,"nodeType":865},{},[],"For each customer environment, Push checks for customer domains in the data set.",{"data":31174,"content":31175,"nodeType":2654},{},[31176],{"data":31177,"content":31178,"nodeType":866},{},[31179],{"data":31180,"marks":31181,"value":31182,"nodeType":865},{},[],"When suspected stolen creds for a customer environment are present, Push hashes and salts the passwords and then sends those fingerprints to the relevant browser agents for comparison. ",{"data":31184,"content":31185,"nodeType":2654},{},[31186],{"data":31187,"content":31188,"nodeType":866},{},[31189],{"data":31190,"marks":31191,"value":31192,"nodeType":865},{},[],"If the stolen credential fingerprint matches a known credential fingerprint observed to be in use by the Push browser agent, the platform returns a validated true positive alert. Note that Push can alert on a validated true positive regardless of which platform the TI source indicated was the source of the stolen cred, allowing you to find those compromised credentials in use across any of your apps.",{"data":31194,"content":31195,"nodeType":2654},{},[31196],{"data":31197,"content":31198,"nodeType":866},{},[31199],{"data":31200,"marks":31201,"value":23582,"nodeType":865},{},[],{"data":31203,"content":31204,"nodeType":866},{},[31205],{"data":31206,"marks":31207,"value":31208,"nodeType":865},{},[],"From there, security teams can take action to reset passwords, identify potentially compromised devices, or perform other investigations.",{"data":31210,"content":31211,"nodeType":866},{},[31212],{"data":31213,"marks":31214,"value":31215,"nodeType":865},{},[],"By comparing all possible matches to only those credentials that are still in use, Push eliminates time-consuming validation exercises. In essence, the provenance of the intel no longer matters; only the true positives do.",{"data":31217,"content":31218,"nodeType":2315},{},[31219],{"data":31220,"marks":31221,"value":31222,"nodeType":865},{},[],"Bring your own TI",{"data":31224,"content":31225,"nodeType":866},{},[31226],{"data":31227,"marks":31228,"value":31229,"nodeType":865},{},[],"With verified stolen credential detection, you can also extract a lot more value from your existing threat intelligence feeds by sharing stolen creds reports with the Push platform via API. ",{"data":31231,"content":31232,"nodeType":866},{},[31233],{"data":31234,"marks":31235,"value":31236,"nodeType":865},{},[],"This allows Push to perform the same checks to compare the reports to observed password fingerprints and flag only the true positives — eliminating the time-consuming work of manual triage, investigation, and end-user follow-up for your security team.",{"data":31238,"content":31239,"nodeType":879},{},[],{"data":31241,"content":31242,"nodeType":889},{},[31243],{"data":31244,"marks":31245,"value":31246,"nodeType":865},{},[],"Try Push for yourself",{"data":31248,"content":31249,"nodeType":866},{},[31250,31254,31261],{"data":31251,"marks":31252,"value":31253,"nodeType":865},{},[],"The validated stolen credential detections feature is available at no additional cost for all Push customers. If you’d like to explore the platform yourself, ",{"data":31255,"content":31256,"nodeType":905},{"uri":3686},[31257],{"data":31258,"marks":31259,"value":15182,"nodeType":865},{},[31260],{"type":1070},{"data":31262,"marks":31263,"value":1711,"nodeType":865},{},[],{"data":31265,"content":31268,"nodeType":875},{"target":31266},{"sys":31267},{"id":17663,"type":872,"linkType":873},[],{"data":31270,"content":31271,"nodeType":866},{},[31272],{"data":31273,"marks":31274,"value":21,"nodeType":865},{},[],"Eliminate false positives with verified stolen credential detections using Push","Push now compares user passwords with TI feeds to alert you when valid credentials are available on the clearweb and darkweb.","2024-12-03T00:00:00.000Z","verified-stolen-credential-detection",{"items":31280},[31281,31285],{"sys":31282,"name":31284},{"id":31283},"5jk0kqjSdSK2L0YiistQjY","Release notes",{"sys":31286,"name":342},{"id":3008},{"items":31288},[31289],{"fullName":9643,"firstName":9644,"jobTitle":9645,"profilePicture":31290},{"url":9647},{"__typename":1544,"sys":31292,"content":31294,"title":31621,"synopsis":31622,"hashTags":59,"publishedDate":31623,"slug":31624,"tagsCollection":31625,"authorsCollection":31631},{"id":31293},"75wcCkoZEKwEMl7zBmDMtT",{"json":31295},{"data":31296,"content":31297,"nodeType":1522},{},[31298,31305,31312,31331,31350,31373,31380,31396,31403,31410,31417,31420,31427,31447,31465,31471,31491,31498,31505,31511,31518,31524,31557,31564,31583,31586,31593,31603,31609,31615],{"data":31299,"content":31300,"nodeType":889},{},[31301],{"data":31302,"marks":31303,"value":31304,"nodeType":865},{},[],"Preventing credential attacks with automated password resets ",{"data":31306,"content":31307,"nodeType":866},{},[31308],{"data":31309,"marks":31310,"value":31311,"nodeType":865},{},[],"Preventing credential attacks is not an easy task, especially if you’re a member of the security team tasked with protecting some of your organization’s most valued assets: SSO identities.",{"data":31313,"content":31314,"nodeType":866},{},[31315,31319,31328],{"data":31316,"marks":31317,"value":31318,"nodeType":865},{},[],"IdP accounts such as a user’s Okta, Entra, or Google Workspace login are the most lucrative identities that an attacker can take over. By compromising an SSO identity, attackers not only gain access to the account itself, but also any downstream apps accessed via SSO – and the juicy data and functionality stored there. This was evidenced earlier this year when ",{"data":31320,"content":31322,"nodeType":905},{"uri":31321},"https://www.bleepingcomputer.com/news/security/okta-warns-of-unprecedented-credential-stuffing-attacks-on-customers/",[31323],{"data":31324,"marks":31325,"value":31327,"nodeType":865},{},[31326],{"type":1070},"Okta users experienced unprecedented levels of credential stuffing attacks",{"data":31329,"marks":31330,"value":1711,"nodeType":865},{},[],{"data":31332,"content":31333,"nodeType":866},{},[31334,31338,31346],{"data":31335,"marks":31336,"value":31337,"nodeType":865},{},[],"You might also be surprised to learn that even these most critical accounts have serious security gaps. For example, ",{"data":31339,"content":31340,"nodeType":905},{"uri":6333},[31341],{"data":31342,"marks":31343,"value":31345,"nodeType":865},{},[31344],{"type":1070},"in a recent study we identified that",{"data":31347,"marks":31348,"value":31349,"nodeType":865},{},[],":",{"data":31351,"content":31352,"nodeType":2718},{},[31353,31363],{"data":31354,"content":31355,"nodeType":2654},{},[31356],{"data":31357,"content":31358,"nodeType":866},{},[31359],{"data":31360,"marks":31361,"value":31362,"nodeType":865},{},[],"1 in 5 IdP accounts does not have an MFA method set, leaving them exposed to single-factor compromises using stolen credentials.",{"data":31364,"content":31365,"nodeType":2654},{},[31366],{"data":31367,"content":31368,"nodeType":866},{},[31369],{"data":31370,"marks":31371,"value":31372,"nodeType":865},{},[],"10% of IdP accounts share a password that is used to access other identities. (We’re not talking about the actual SSO process here – many users will use the same password as they do to log into their Okta or Entra as they do personal accounts such as shopping or food delivery. Yes, really.)  ",{"data":31374,"content":31375,"nodeType":866},{},[31376],{"data":31377,"marks":31378,"value":31379,"nodeType":865},{},[],"It’s a constant worry that your CFO’s Microsoft, Google, or Okta credentials are going to show up in the next big darkweb password dump. Ideally you’d want to prevent users from reusing passwords across multiple services. That’s why your information security policy is mandating password manager use, right?",{"data":31381,"content":31382,"nodeType":866},{},[31383,31387,31392],{"data":31384,"marks":31385,"value":31386,"nodeType":865},{},[],"No matter how many policies you have in place, ",{"data":31388,"marks":31389,"value":31391,"nodeType":865},{},[31390],{"type":1070},"people will inevitably use the same passwords across multiple services",{"data":31393,"marks":31394,"value":31395,"nodeType":865},{},[],". But who can blame them? Having to remember multiple passwords is a drag, especially when they find they can’t log into their company’s password manager from their home computers… The next best thing is to just reuse your Entra or Okta password across all services, right?!",{"data":31397,"content":31398,"nodeType":866},{},[31399],{"data":31400,"marks":31401,"value":31402,"nodeType":865},{},[],"At Push we realize that mistakes happen. That's why it's important to look out for when critical credentials are entered into a dodgy ecommerce platform, or the next entry lands on haveibeenpwnd.com.",{"data":31404,"content":31405,"nodeType":866},{},[31406],{"data":31407,"marks":31408,"value":31409,"nodeType":865},{},[],"By quickly forcing a password change when an SSO password is reused or breached, we can minimize the chance of it being abused by attackers. ",{"data":31411,"content":31412,"nodeType":866},{},[31413],{"data":31414,"marks":31415,"value":31416,"nodeType":865},{},[],"But how will you know when a password is reused or compromised? ",{"data":31418,"content":31419,"nodeType":879},{},[],{"data":31421,"content":31422,"nodeType":889},{},[31423],{"data":31424,"marks":31425,"value":31426,"nodeType":865},{},[],"Using Push data to alert on password vulnerabilities ",{"data":31428,"content":31429,"nodeType":866},{},[31430,31434,31443],{"data":31431,"marks":31432,"value":31433,"nodeType":865},{},[],"Enter the Push browser extension. Push fingerprints passwords (",{"data":31435,"content":31437,"nodeType":905},{"uri":31436},"https://pushsecurity.com/help/how-does-the-push-browser-extension-securely-track-reused-passwords",[31438],{"data":31439,"marks":31440,"value":31442,"nodeType":865},{},[31441],{"type":1070},"in a safe way",{"data":31444,"marks":31445,"value":31446,"nodeType":865},{},[],") as they are used by employees to access apps in their browsers. ",{"data":31448,"content":31449,"nodeType":866},{},[31450,31454,31462],{"data":31451,"marks":31452,"value":31453,"nodeType":865},{},[],"When a user logs into an app using credentials that they’ve previously used to login to another account, Push fires off an alert. ",{"data":31455,"content":31456,"nodeType":905},{"uri":964},[31457],{"data":31458,"marks":31459,"value":31461,"nodeType":865},{},[31460],{"type":1070},"We can also detect when an active password is stolen and appears on a criminal forum",{"data":31463,"marks":31464,"value":1711,"nodeType":865},{},[],{"data":31466,"content":31470,"nodeType":875},{"target":31467},{"sys":31468},{"id":31469,"type":872,"linkType":873},"5He3FB0NT3D3lcbwiVtn02",[],{"data":31472,"content":31473,"nodeType":866},{},[31474,31478,31487],{"data":31475,"marks":31476,"value":31477,"nodeType":865},{},[],"If you’ve ",{"data":31479,"content":31481,"nodeType":905},{"uri":31480},"https://pushsecurity.com/help/audience/administrators/docs/connect-to-siem-or-soar/#start",[31482],{"data":31483,"marks":31484,"value":31486,"nodeType":865},{},[31485],{"type":1070},"connected Push to your SIEM or SOAR",{"data":31488,"marks":31489,"value":31490,"nodeType":865},{},[],", you’ll be able to create a workflow to respond automatically. ",{"data":31492,"content":31493,"nodeType":2315},{},[31494],{"data":31495,"marks":31496,"value":31497,"nodeType":865},{},[],"Automating password resets in your SIEM using Push webhooks",{"data":31499,"content":31500,"nodeType":866},{},[31501],{"data":31502,"marks":31503,"value":31504,"nodeType":865},{},[],"You can automate password resets for accounts by ingesting this information via webhook into a SIEM, generating an alert. This in turn can fire off another webhook or workflow that sets the ‘force password change on next logon’ attribute on the user’s account.",{"data":31506,"content":31510,"nodeType":875},{"target":31507},{"sys":31508},{"id":31509,"type":872,"linkType":873},"5WFLIVm4DWcuH7a6owQlR1",[],{"data":31512,"content":31513,"nodeType":866},{},[31514],{"data":31515,"marks":31516,"value":31517,"nodeType":865},{},[],"Below is some POC python code we use internally. This is specific to Google Workspace, but the general logic should apply to any IdP that allows you to perform these actions via API calls.",{"data":31519,"content":31523,"nodeType":875},{"target":31520},{"sys":31521},{"id":31522,"type":872,"linkType":873},"4YNirRo8BlRrgGKwwzXE8R",[],{"data":31525,"content":31526,"nodeType":866},{},[31527,31531,31540,31544,31553],{"data":31528,"marks":31529,"value":31530,"nodeType":865},{},[],"You can perform similar functions in Microsoft Entra ID by modifying the user's ",{"data":31532,"content":31534,"nodeType":905},{"uri":31533},"https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http#:~:text=DisablePasswordExpiration%2C%20DisableStrongPassword.-,passwordProfile,-PasswordProfile",[31535],{"data":31536,"marks":31537,"value":31539,"nodeType":865},{},[31538],{"type":1070},"passwordProfile",{"data":31541,"marks":31542,"value":31543,"nodeType":865},{},[]," attribute via Microsoft Graph API, or in Okta via the ",{"data":31545,"content":31547,"nodeType":905},{"uri":31546},"https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserCred/#tag/UserCred/operation/expirePassword",[31548],{"data":31549,"marks":31550,"value":31552,"nodeType":865},{},[31551],{"type":1070},"expire_password",{"data":31554,"marks":31555,"value":31556,"nodeType":865},{},[]," API endpoint.",{"data":31558,"content":31559,"nodeType":866},{},[31560],{"data":31561,"marks":31562,"value":31563,"nodeType":865},{},[],"You aren’t limited to just IdP accounts either – any app with an API that provides this functionality can be configured for automated password resets using Push data. ",{"data":31565,"content":31566,"nodeType":866},{},[31567,31571,31579],{"data":31568,"marks":31569,"value":31570,"nodeType":865},{},[],"We also use SSO password data to ",{"data":31572,"content":31573,"nodeType":905},{"uri":7228},[31574],{"data":31575,"marks":31576,"value":31578,"nodeType":865},{},[31577],{"type":1070},"prevent users from entering their SSO credentials into phishing sites",{"data":31580,"marks":31581,"value":31582,"nodeType":865},{},[],", providing strong anti-phishing protection that is extremely hard for attackers to bypass. ",{"data":31584,"content":31585,"nodeType":879},{},[],{"data":31587,"content":31588,"nodeType":889},{},[31589],{"data":31590,"marks":31591,"value":31592,"nodeType":865},{},[],"Preventing attackers from exploiting vulnerable credentials has never been easier",{"data":31594,"content":31595,"nodeType":866},{},[31596,31600],{"data":31597,"marks":31598,"value":31599,"nodeType":865},{},[],"This is just one of the possible SecOps use cases that Push streamlines and levels up for security teams. ",{"data":31601,"marks":31602,"value":4607,"nodeType":865},{},[],{"data":31604,"content":31605,"nodeType":866},{},[31606],{"data":31607,"marks":31608,"value":3677,"nodeType":865},{},[],{"data":31610,"content":31614,"nodeType":875},{"target":31611},{"sys":31612},{"id":31613,"type":872,"linkType":873},"11p9wnGrZHqp3XPpThHFk3",[],{"data":31616,"content":31617,"nodeType":866},{},[31618],{"data":31619,"marks":31620,"value":21,"nodeType":865},{},[],"Automating SSO password resets using Push","Using Push to automate password resets for your most critical identities when a password vulnerability is detected.","2024-12-13T00:00:00.000Z","automating-sso-password-resets-using-push",{"items":31626},[31627,31629],{"sys":31628,"name":297},{"id":2147},{"sys":31630,"name":342},{"id":3008},{"items":31632},[31633],{"fullName":31634,"firstName":31635,"jobTitle":31636,"profilePicture":31637},"Johann Scheepers","Johann","Senior Security Engineer",{"url":31638},"https://images.ctfassets.net/y1cdw1ablpvd/75IEOH93vR0hbvxuqTu1m3/f6222745ee6892ea07bc18727a5a5ae7/T016S22KZ96-U02LU3SKC2D-e1e755770536-512.png",{"__typename":1544,"sys":31640,"content":31642,"title":33148,"synopsis":33149,"hashTags":59,"publishedDate":33150,"slug":33151,"tagsCollection":33152,"authorsCollection":33156},{"id":31641},"3lWfiuAMsVecxVyEKiwV0c",{"json":31643},{"data":31644,"content":31645,"nodeType":1522},{},[31646,31653,31660,31676,31682,31701,31708,31715,31718,31725,31732,31812,31819,31826,31833,31840,31847,31854,31868,31874,31958,31965,31972,32008,32015,32021,32028,32044,32154,32178,32184,32191,32207,32213,32216,32223,32230,32245,32252,32259,32266,32289,32310,32316,32323,32330,32337,32353,32359,32395,32401,32408,32438,32450,32457,32464,32471,32521,32528,32534,32541,32544,32551,32558,32565,32572,32626,32640,32691,32722,32729,32794,32800,32807,32860,32879,32886,32901,32939,32946,32953,32960,32987,32993,32996,33003,33010,33017,33129,33136,33142],{"data":31647,"content":31648,"nodeType":889},{},[31649],{"data":31650,"marks":31651,"value":31652,"nodeType":865},{},[],"The journey ahead",{"data":31654,"content":31655,"nodeType":866},{},[31656],{"data":31657,"marks":31658,"value":31659,"nodeType":865},{},[],"So you’ve chosen Push to accompany you on your identity security journey. Good choice! We’ve got (threat) hunting supplies and a sturdy raft. It’s risky to go alone, though, so take this map with you.",{"data":31661,"content":31662,"nodeType":866},{},[31663,31667,31672],{"data":31664,"marks":31665,"value":31666,"nodeType":865},{},[],"Inspired by the classic 1980s video game* ",{"data":31668,"marks":31669,"value":31671,"nodeType":865},{},[31670],{"type":2757},"Oregon Trail",{"data":31673,"marks":31674,"value":31675,"nodeType":865},{},[],", we’ve put together the following guide for intrepid security teams who are traveling across potentially unknown territory as they uncover their identity attack surface, including shadow identities and apps, and secure it against modern identity attacks.",{"data":31677,"content":31681,"nodeType":875},{"target":31678},{"sys":31679},{"id":31680,"type":872,"linkType":873},"3Ys8l6lqQcWOFX5O6QSulO",[],{"data":31683,"content":31684,"nodeType":866},{},[31685,31689,31697],{"data":31686,"marks":31687,"value":31688,"nodeType":865},{},[],"(*For Push fans outside the U.S., Oregon Trail followed a group of pioneers as they attempted to cross the continent in a covered wagon, avoiding wild animals and hunting for food along the way. The ",{"data":31690,"content":31692,"nodeType":905},{"uri":31691},"https://knowyourmeme.com/memes/subcultures/the-oregon-trail",[31693],{"data":31694,"marks":31695,"value":31696,"nodeType":865},{},[],"memes",{"data":31698,"marks":31699,"value":31700,"nodeType":865},{},[]," now outlive the game, but we remember it fondly.)",{"data":31702,"content":31703,"nodeType":866},{},[31704],{"data":31705,"marks":31706,"value":31707,"nodeType":865},{},[],"In this guide, we’ll provide advice on what you can accomplish in your first three months after deploying Push to your workforce, transforming your employees’ browsers into a reliable control point to enforce a strong identity posture and stop account takeover.",{"data":31709,"content":31710,"nodeType":866},{},[31711],{"data":31712,"marks":31713,"value":31714,"nodeType":865},{},[],"In your first 90 days using Push, you can go far. Let’s take a look.",{"data":31716,"content":31717,"nodeType":879},{},[],{"data":31719,"content":31720,"nodeType":889},{},[31721],{"data":31722,"marks":31723,"value":31724,"nodeType":865},{},[],"First 30 days: Get intel and secure against bears",{"data":31726,"content":31727,"nodeType":866},{},[31728],{"data":31729,"marks":31730,"value":31731,"nodeType":865},{},[],"This guide assumes you’ve identified a few identity security goals already. These probably include things like:",{"data":31733,"content":31734,"nodeType":2718},{},[31735,31758,31782,31792,31802],{"data":31736,"content":31737,"nodeType":2654},{},[31738],{"data":31739,"content":31740,"nodeType":866},{},[31741,31745,31755],{"data":31742,"marks":31743,"value":31744,"nodeType":865},{},[],"Closing gaps in existing security controls to protect against MFA bypass attacks like Adversary-in-the-Middle ",{"data":31746,"content":31750,"nodeType":8560},{"target":31747},{"sys":31748},{"id":31749,"type":872,"linkType":873},"11C3shj5SlkS8sAd3AlYDp",[31751],{"data":31752,"marks":31753,"value":31754,"nodeType":865},{},[],"(AiTM) phishing toolkits",{"data":31756,"marks":31757,"value":1193,"nodeType":865},{},[],{"data":31759,"content":31760,"nodeType":2654},{},[31761],{"data":31762,"content":31763,"nodeType":866},{},[31764,31768,31778],{"data":31765,"marks":31766,"value":31767,"nodeType":865},{},[],"Increasing ",{"data":31769,"content":31773,"nodeType":8560},{"target":31770},{"sys":31771},{"id":31772,"type":872,"linkType":873},"1qegIy4rMdm5XZXnIEoKpE",[31774],{"data":31775,"marks":31776,"value":31777,"nodeType":865},{},[],"visibility of user activity",{"data":31779,"marks":31780,"value":31781,"nodeType":865},{},[]," in the browser to identify and respond to threats.",{"data":31783,"content":31784,"nodeType":2654},{},[31785],{"data":31786,"content":31787,"nodeType":866},{},[31788],{"data":31789,"marks":31790,"value":31791,"nodeType":865},{},[],"Using federated SSO-based logins over password-based logins to limit the number of identities created, and removing unused login methods.",{"data":31793,"content":31794,"nodeType":2654},{},[31795],{"data":31796,"content":31797,"nodeType":866},{},[31798],{"data":31799,"marks":31800,"value":31801,"nodeType":865},{},[],"Implementing phishing-resistant authentication methods, and removing phishable ones.",{"data":31803,"content":31804,"nodeType":2654},{},[31805],{"data":31806,"content":31807,"nodeType":866},{},[31808],{"data":31809,"marks":31810,"value":31811,"nodeType":865},{},[],"Where password use cannot be avoided, ensuring good hygiene (no weak, reused, or breached passwords) and phishing-resistant MFA factors.",{"data":31813,"content":31814,"nodeType":866},{},[31815],{"data":31816,"marks":31817,"value":31818,"nodeType":865},{},[],"Then, once you’ve deployed the Push browser extension to your browser ecosystem, invited your security team to the Push admin console, and begun collecting behavioral and identity posture data from your employees’ login activity, you’re ready to embark.",{"data":31820,"content":31821,"nodeType":866},{},[31822],{"data":31823,"marks":31824,"value":31825,"nodeType":865},{},[],"Right away, you can set up your first out-of-the-box security control to provide novel and effective protection against adversary-in-the-middle (AiTM) phishing toolkits such as Evilginx, EvilNoVNC, and others.",{"data":31827,"content":31828,"nodeType":866},{},[31829],{"data":31830,"marks":31831,"value":31832,"nodeType":865},{},[],"It’s the identity security equivalent of bear deterrent (something sadly lacking on the Oregon Trail), and it takes just a couple of minutes.",{"data":31834,"content":31835,"nodeType":866},{},[31836],{"data":31837,"marks":31838,"value":31839,"nodeType":865},{},[],"You can also set additional security controls in Monitor mode and begin collecting valuable insights from your users’ account and app activity.",{"data":31841,"content":31842,"nodeType":866},{},[31843],{"data":31844,"marks":31845,"value":31846,"nodeType":865},{},[],"Here’s what we recommend for your first 30 days using Push:",{"data":31848,"content":31849,"nodeType":2315},{},[31850],{"data":31851,"marks":31852,"value":31853,"nodeType":865},{},[],"Enable phishing tool detection in Warn or Block mode",{"data":31855,"content":31856,"nodeType":866},{},[31857,31861,31865],{"data":31858,"marks":31859,"value":31860,"nodeType":865},{},[],"Begin protecting employees from adversary-in-the-middle phishing from AitM tools by enabling ",{"data":31862,"marks":31863,"value":8774,"nodeType":865},{},[31864],{"type":887},{"data":31866,"marks":31867,"value":1193,"nodeType":865},{},[],{"data":31869,"content":31873,"nodeType":875},{"target":31870},{"sys":31871},{"id":31872,"type":872,"linkType":873},"2ylIkR0JXHkFStGuCFRjlN",[],{"data":31875,"content":31876,"nodeType":2718},{},[31877,31919,31929,31939],{"data":31878,"content":31879,"nodeType":2654},{},[31880],{"data":31881,"content":31882,"nodeType":866},{},[31883,31887,31891,31895,31899,31903,31908,31911,31916],{"data":31884,"marks":31885,"value":31886,"nodeType":865},{},[],"From the ",{"data":31888,"marks":31889,"value":14983,"nodeType":865},{},[31890],{"type":887},{"data":31892,"marks":31893,"value":31894,"nodeType":865},{},[]," page in the Push admin console, select ",{"data":31896,"marks":31897,"value":8774,"nodeType":865},{},[31898],{"type":887},{"data":31900,"marks":31901,"value":31902,"nodeType":865},{},[]," and set the mode to ",{"data":31904,"marks":31905,"value":31907,"nodeType":865},{},[31906],{"type":887},"Warn",{"data":31909,"marks":31910,"value":8290,"nodeType":865},{},[],{"data":31912,"marks":31913,"value":31915,"nodeType":865},{},[31914],{"type":887},"Block",{"data":31917,"marks":31918,"value":1193,"nodeType":865},{},[],{"data":31920,"content":31921,"nodeType":2654},{},[31922],{"data":31923,"content":31924,"nodeType":866},{},[31925],{"data":31926,"marks":31927,"value":31928,"nodeType":865},{},[],"Customize the message that employees will see if they encounter a malicious site.",{"data":31930,"content":31931,"nodeType":2654},{},[31932],{"data":31933,"content":31934,"nodeType":866},{},[31935],{"data":31936,"marks":31937,"value":31938,"nodeType":865},{},[],"Add domains to the ignore list if you wish to ignore enforcing the control on specific domains or encounter any domains that trigger false positives.",{"data":31940,"content":31941,"nodeType":2654},{},[31942],{"data":31943,"content":31944,"nodeType":866},{},[31945,31949,31954],{"data":31946,"marks":31947,"value":31948,"nodeType":865},{},[],"You can monitor the ",{"data":31950,"marks":31951,"value":31953,"nodeType":865},{},[31952],{"type":887},"Events",{"data":31955,"marks":31956,"value":31957,"nodeType":865},{},[]," page (or send Push events to an external SIEM or SOAR) to see when the control is triggered.",{"data":31959,"content":31960,"nodeType":866},{},[31961],{"data":31962,"marks":31963,"value":31964,"nodeType":865},{},[],"You may also wish to communicate with your end-users to let them know you’re enabling a new security protection to stop phishing attacks and that if they encounter a malicious site, they’ll see a warning.",{"data":31966,"content":31967,"nodeType":2315},{},[31968],{"data":31969,"marks":31970,"value":31971,"nodeType":865},{},[],"Check for verified stolen credentials",{"data":31973,"content":31974,"nodeType":866},{},[31975,31979,31987,31991,31996,32000,32005],{"data":31976,"marks":31977,"value":31978,"nodeType":865},{},[],"Push uses threat intelligence sources to compare suspected ",{"data":31980,"content":31983,"nodeType":8560},{"target":31981},{"sys":31982},{"id":9150,"type":872,"linkType":873},[31984],{"data":31985,"marks":31986,"value":9071,"nodeType":865},{},[],{"data":31988,"marks":31989,"value":31990,"nodeType":865},{},[]," to those still actively in use across your workforce identities. You don’t need to configure anything for this feature, and you can check for any verified true positives by viewing the ",{"data":31992,"marks":31993,"value":31995,"nodeType":865},{},[31994],{"type":887},"Vulnerable identities",{"data":31997,"marks":31998,"value":31999,"nodeType":865},{},[]," section of the ",{"data":32001,"marks":32002,"value":32004,"nodeType":865},{},[32003],{"type":887},"Dashboard",{"data":32006,"marks":32007,"value":6352,"nodeType":865},{},[],{"data":32009,"content":32010,"nodeType":866},{},[32011],{"data":32012,"marks":32013,"value":32014,"nodeType":865},{},[],"We recommend investigating immediately and taking action to remediate any accounts with verified stolen credentials.",{"data":32016,"content":32020,"nodeType":875},{"target":32017},{"sys":32018},{"id":32019,"type":872,"linkType":873},"150dE4aTzofOwFXJCtGkJF",[],{"data":32022,"content":32023,"nodeType":2315},{},[32024],{"data":32025,"marks":32026,"value":32027,"nodeType":865},{},[],"Enable additional security controls in Monitor mode",{"data":32029,"content":32030,"nodeType":866},{},[32031,32035,32040],{"data":32032,"marks":32033,"value":32034,"nodeType":865},{},[],"Next, set up additional security controls in ",{"data":32036,"marks":32037,"value":32039,"nodeType":865},{},[32038],{"type":887},"Monitor",{"data":32041,"marks":32042,"value":32043,"nodeType":865},{},[]," mode so you can begin finetuning your configuration or adding to ignore lists. A few details to keep in mind:",{"data":32045,"content":32046,"nodeType":2718},{},[32047,32085,32108,32131],{"data":32048,"content":32049,"nodeType":2654},{},[32050],{"data":32051,"content":32052,"nodeType":866},{},[32053,32058,32062,32073,32077,32081],{"data":32054,"marks":32055,"value":32057,"nodeType":865},{},[32056],{"type":887},"For all controls",{"data":32059,"marks":32060,"value":32061,"nodeType":865},{},[],", update your ",{"data":32063,"content":32067,"nodeType":8560},{"target":32064},{"sys":32065},{"id":32066,"type":872,"linkType":873},"2q4iZicL3D85XGTsYZ5mgK",[32068],{"data":32069,"marks":32070,"value":32072,"nodeType":865},{},[32071],{"type":887},"Custom login URLs",{"data":32074,"marks":32075,"value":32076,"nodeType":865},{},[]," list on the ",{"data":32078,"marks":32079,"value":20195,"nodeType":865},{},[32080],{"type":887},{"data":32082,"marks":32083,"value":32084,"nodeType":865},{},[]," page to include any custom URLs you use for your identity provider or other important apps, so that Push can correctly identify those logins as belonging to your IdP (or other app).",{"data":32086,"content":32087,"nodeType":2654},{},[32088],{"data":32089,"content":32090,"nodeType":866},{},[32091,32096,32100,32104],{"data":32092,"marks":32093,"value":32095,"nodeType":865},{},[32094],{"type":887},"For SSO password protection",{"data":32097,"marks":32098,"value":32099,"nodeType":865},{},[],", we recommend starting in ",{"data":32101,"marks":32102,"value":32039,"nodeType":865},{},[32103],{"type":887},{"data":32105,"marks":32106,"value":32107,"nodeType":865},{},[]," so you can identify any sites in your environment that cause false positives, such as sites that are configured to legitimately allow use of SSO credentials. Then add these sites to your ignore list. By running in monitor mode for a few weeks, you can also get a sense of how often employees are reusing their corporate IdP credentials on other sites where they shouldn’t, such as personal apps.",{"data":32109,"content":32110,"nodeType":2654},{},[32111],{"data":32112,"content":32113,"nodeType":866},{},[32114,32119,32123,32127],{"data":32115,"marks":32116,"value":32118,"nodeType":865},{},[32117],{"type":887},"For cloned login page detection",{"data":32120,"marks":32121,"value":32122,"nodeType":865},{},[],", set the mode to ",{"data":32124,"marks":32125,"value":32039,"nodeType":865},{},[32126],{"type":887},{"data":32128,"marks":32129,"value":32130,"nodeType":865},{},[]," to receive events when employees visit a site using a cloned login screen for important apps including your identity provider.",{"data":32132,"content":32133,"nodeType":2654},{},[32134],{"data":32135,"content":32136,"nodeType":866},{},[32137,32142,32146,32150],{"data":32138,"marks":32139,"value":32141,"nodeType":865},{},[32140],{"type":887},"For URL blocking",{"data":32143,"marks":32144,"value":32145,"nodeType":865},{},[],", test a blocked URL or begin compiling a list of URLs you wish to block, such as AiTM sites discovered through phishing sites you find while using the ",{"data":32147,"marks":32148,"value":8774,"nodeType":865},{},[32149],{"type":887},{"data":32151,"marks":32152,"value":32153,"nodeType":865},{},[]," feature.",{"data":32155,"content":32156,"nodeType":866},{},[32157,32161,32165,32169,32174],{"data":32158,"marks":32159,"value":32160,"nodeType":865},{},[],"To see events generated by these controls, filter the ",{"data":32162,"marks":32163,"value":31953,"nodeType":865},{},[32164],{"type":887},{"data":32166,"marks":32167,"value":32168,"nodeType":865},{},[]," page. Go to the filters icon, then select ",{"data":32170,"marks":32171,"value":32173,"nodeType":865},{},[32172],{"type":887},"Events > By type",{"data":32175,"marks":32176,"value":32177,"nodeType":865},{},[]," from the dropdown and choose the specific control to see associated events.",{"data":32179,"content":32183,"nodeType":875},{"target":32180},{"sys":32181},{"id":32182,"type":872,"linkType":873},"2M0Cjc2Wo9L7c9rIQebx0S",[],{"data":32185,"content":32186,"nodeType":2315},{},[32187],{"data":32188,"marks":32189,"value":32190,"nodeType":865},{},[],"Set up alerts for your security team",{"data":32192,"content":32193,"nodeType":866},{},[32194,32198,32203],{"data":32195,"marks":32196,"value":32197,"nodeType":865},{},[],"Push can send notifications of interesting employee activity to a Microsoft Teams or Slack channel so you can stay on top of new apps and account security findings. In the admin console, go to the ",{"data":32199,"marks":32200,"value":32202,"nodeType":865},{},[32201],{"type":887},"ChatOps",{"data":32204,"marks":32205,"value":32206,"nodeType":865},{},[]," page and integrate your Teams or Slack instance, then enable topics you wish to get notified about.",{"data":32208,"content":32212,"nodeType":875},{"target":32209},{"sys":32210},{"id":32211,"type":872,"linkType":873},"OObhJQA1HMcmwBvpWfmC7",[],{"data":32214,"content":32215,"nodeType":879},{},[],{"data":32217,"content":32218,"nodeType":889},{},[32219],{"data":32220,"marks":32221,"value":32222,"nodeType":865},{},[],"First 60 days: Go (threat) hunting",{"data":32224,"content":32225,"nodeType":866},{},[32226],{"data":32227,"marks":32228,"value":32229,"nodeType":865},{},[],"Now you’re ready to survey the landscape and see where there are dangers hiding among your workforce identities such as missing MFA or SSO, unused accounts, compromised passwords, and unsanctioned or untrustworthy apps and integrations. ",{"data":32231,"content":32232,"nodeType":866},{},[32233,32237,32241],{"data":32234,"marks":32235,"value":32236,"nodeType":865},{},[],"Luckily, Push doesn’t make you forage for the important information. Use the ",{"data":32238,"marks":32239,"value":32004,"nodeType":865},{},[32240],{"type":887},{"data":32242,"marks":32243,"value":32244,"nodeType":865},{},[]," in the Push admin console to pinpoint vulnerable identities and see SSO trends and other insights.",{"data":32246,"content":32247,"nodeType":866},{},[32248],{"data":32249,"marks":32250,"value":32251,"nodeType":865},{},[],"After getting a baseline understanding of your ecosystem, you can begin translating your security policies into actionable controls by preparing end-users and creating the foundation for control configuration rules.",{"data":32253,"content":32254,"nodeType":866},{},[32255],{"data":32256,"marks":32257,"value":32258,"nodeType":865},{},[],"Here’s what we recommend for your second month using Push:",{"data":32260,"content":32261,"nodeType":2315},{},[32262],{"data":32263,"marks":32264,"value":32265,"nodeType":865},{},[],"Understand which identities are most vulnerable to account takeover",{"data":32267,"content":32268,"nodeType":866},{},[32269,32273,32277,32281,32285],{"data":32270,"marks":32271,"value":32272,"nodeType":865},{},[],"On the ",{"data":32274,"marks":32275,"value":32004,"nodeType":865},{},[32276],{"type":887},{"data":32278,"marks":32279,"value":32280,"nodeType":865},{},[],", you can identify which identities are most at risk because they use a leaked, reused, or weak password and lack MFA by referencing the ",{"data":32282,"marks":32283,"value":31995,"nodeType":865},{},[32284],{"type":887},{"data":32286,"marks":32287,"value":32288,"nodeType":865},{},[]," section.",{"data":32290,"content":32291,"nodeType":866},{},[32292,32297,32301,32306],{"data":32293,"marks":32294,"value":32296,"nodeType":865},{},[32295],{"type":887},"Tip: ",{"data":32298,"marks":32299,"value":32300,"nodeType":865},{},[],"Toggle the view to ",{"data":32302,"marks":32303,"value":32305,"nodeType":865},{},[32304],{"type":887},"All identities",{"data":32307,"marks":32308,"value":32309,"nodeType":865},{},[]," if you are not yet using the sensitivity labels for apps to get a full picture of your data.",{"data":32311,"content":32315,"nodeType":875},{"target":32312},{"sys":32313},{"id":32314,"type":872,"linkType":873},"4xPy4cr18jk7JV7TWqnmoy",[],{"data":32317,"content":32318,"nodeType":866},{},[32319],{"data":32320,"marks":32321,"value":32322,"nodeType":865},{},[],"Select each slice of the chart to go to a filtered list of the accounts with those security issues. You can then evaluate which accounts pose the biggest risk, whether they belong to high-sensitivity apps or high-value roles, such as admins or executives, or whether there are any data patterns, such as a cluster of account issues that belong to specific teams, that will help you decide on a remediation strategy.",{"data":32324,"content":32325,"nodeType":866},{},[32326],{"data":32327,"marks":32328,"value":32329,"nodeType":865},{},[],"As mentioned earlier, we recommend taking immediate action for any accounts with verified stolen credentials, especially those that also lack MFA protection.",{"data":32331,"content":32332,"nodeType":2315},{},[32333],{"data":32334,"marks":32335,"value":32336,"nodeType":865},{},[],"Check your SSO coverage",{"data":32338,"content":32339,"nodeType":866},{},[32340,32344,32349],{"data":32341,"marks":32342,"value":32343,"nodeType":865},{},[],"On the Dashboard, you can also start to see your ",{"data":32345,"marks":32346,"value":32348,"nodeType":865},{},[32347],{"type":887},"SSO trends",{"data":32350,"marks":32351,"value":32352,"nodeType":865},{},[],". Use this section of the dashboard to see a breakdown of login methods for your accounts (SAML, OIDC, or non-SSO).",{"data":32354,"content":32358,"nodeType":875},{"target":32355},{"sys":32356},{"id":32357,"type":872,"linkType":873},"6GbX5cV4wOerwFeqKKAolC",[],{"data":32360,"content":32361,"nodeType":866},{},[32362,32366,32370,32374,32379,32383,32392],{"data":32363,"marks":32364,"value":32365,"nodeType":865},{},[],"You can look at more granular information on the ",{"data":32367,"marks":32368,"value":14948,"nodeType":865},{},[32369],{"type":887},{"data":32371,"marks":32372,"value":32373,"nodeType":865},{},[]," page by filtering by ",{"data":32375,"marks":32376,"value":32378,"nodeType":865},{},[32377],{"type":887},"Login method",{"data":32380,"marks":32381,"value":32382,"nodeType":865},{},[],". For example, you may wish to view accounts that have used both password and SAML login methods to identify local accounts on high-value apps that should be using SSO only — otherwise known as ",{"data":32384,"content":32388,"nodeType":8560},{"target":32385},{"sys":32386},{"id":32387,"type":872,"linkType":873},"174u87EYeKMKHzYYxBLlHO",[32389],{"data":32390,"marks":32391,"value":950,"nodeType":865},{},[],{"data":32393,"marks":32394,"value":1193,"nodeType":865},{},[],{"data":32396,"content":32400,"nodeType":875},{"target":32397},{"sys":32398},{"id":32399,"type":872,"linkType":873},"68Sfs2MmpkdISb4rnoTCzW",[],{"data":32402,"content":32403,"nodeType":2315},{},[32404],{"data":32405,"marks":32406,"value":32407,"nodeType":865},{},[],"Review patterns in employee activity",{"data":32409,"content":32410,"nodeType":866},{},[32411,32415,32419,32422,32427,32430,32434],{"data":32412,"marks":32413,"value":32414,"nodeType":865},{},[],"Using the ",{"data":32416,"marks":32417,"value":14919,"nodeType":865},{},[32418],{"type":887},{"data":32420,"marks":32421,"value":7148,"nodeType":865},{},[],{"data":32423,"marks":32424,"value":32426,"nodeType":865},{},[32425],{"type":887},"Employees",{"data":32428,"marks":32429,"value":1454,"nodeType":865},{},[],{"data":32431,"marks":32432,"value":14948,"nodeType":865},{},[32433],{"type":887},{"data":32435,"marks":32436,"value":32437,"nodeType":865},{},[]," pages, you can then get a sense of which apps employees are accessing, using which login methods, whether they’re registered for MFA (and which MFA methods are registered on the account), whether they’re using a password manager, and where there are account security issues such as weak, reused, or shared passwords.",{"data":32439,"content":32440,"nodeType":866},{},[32441,32446],{"data":32442,"marks":32443,"value":32445,"nodeType":865},{},[32444],{"type":887},"Tip:",{"data":32447,"marks":32448,"value":32449,"nodeType":865},{},[]," Use the filters on these pages to zero in on issues of interest, such as password logins, account security findings, or weak MFA methods.",{"data":32451,"content":32452,"nodeType":2315},{},[32453],{"data":32454,"marks":32455,"value":32456,"nodeType":865},{},[],"Put your security policies into practice",{"data":32458,"content":32459,"nodeType":866},{},[32460],{"data":32461,"marks":32462,"value":32463,"nodeType":865},{},[],"Equipped with this context, now you’re ready to lay the foundation for remediation and blocking controls, putting your security policies into practice.",{"data":32465,"content":32466,"nodeType":866},{},[32467],{"data":32468,"marks":32469,"value":32470,"nodeType":865},{},[],"At this stage, we recommend that you:",{"data":32472,"content":32473,"nodeType":2718},{},[32474,32501,32511],{"data":32475,"content":32476,"nodeType":2654},{},[32477],{"data":32478,"content":32479,"nodeType":866},{},[32480,32484,32489,32492,32497],{"data":32481,"marks":32482,"value":32483,"nodeType":865},{},[],"Set the ",{"data":32485,"marks":32486,"value":32488,"nodeType":865},{},[32487],{"type":887},"Approval status",{"data":32490,"marks":32491,"value":7651,"nodeType":865},{},[],{"data":32493,"marks":32494,"value":32496,"nodeType":865},{},[32495],{"type":887},"Sensitivity level",{"data":32498,"marks":32499,"value":32500,"nodeType":865},{},[]," of your apps using the provided categories in Push.",{"data":32502,"content":32503,"nodeType":2654},{},[32504],{"data":32505,"content":32506,"nodeType":866},{},[32507],{"data":32508,"marks":32509,"value":32510,"nodeType":865},{},[],"Create employee groups (which can be done manually or via API to match your existing directory groups) and assign employees to them based on department or job function.",{"data":32512,"content":32513,"nodeType":2654},{},[32514],{"data":32515,"content":32516,"nodeType":866},{},[32517],{"data":32518,"marks":32519,"value":32520,"nodeType":865},{},[],"Create custom labels for apps as needed.",{"data":32522,"content":32523,"nodeType":866},{},[32524],{"data":32525,"marks":32526,"value":32527,"nodeType":865},{},[],"By adding this metadata, you’ll be able to use these classifications when configuring rules for how to apply your desired security controls.",{"data":32529,"content":32533,"nodeType":875},{"target":32530},{"sys":32531},{"id":32532,"type":872,"linkType":873},"pCIPMrpBAWlmqFoKxTL8P",[],{"data":32535,"content":32536,"nodeType":866},{},[32537],{"data":32538,"marks":32539,"value":32540,"nodeType":865},{},[],"Before enabling end-user remediation and blocking controls, which we cover in the next section, you may also wish to let your employees know what they should expect to see in terms of self-remediation workflows or other employee-facing guidance in their browser.",{"data":32542,"content":32543,"nodeType":879},{},[],{"data":32545,"content":32546,"nodeType":889},{},[32547],{"data":32548,"marks":32549,"value":32550,"nodeType":865},{},[],"First 90 days: Remediate issues and arrive safely",{"data":32552,"content":32553,"nodeType":866},{},[32554],{"data":32555,"marks":32556,"value":32557,"nodeType":865},{},[],"With your team prepared and your rifle well-oiled, you’re ready to pick off security issues like SSO password phishing; missing MFA; and use of unsanctioned apps.",{"data":32559,"content":32560,"nodeType":866},{},[32561],{"data":32562,"marks":32563,"value":32564,"nodeType":865},{},[],"Here’s what we recommend for your third month using Push:",{"data":32566,"content":32567,"nodeType":2315},{},[32568],{"data":32569,"marks":32570,"value":32571,"nodeType":865},{},[],"Move security controls out of Monitor mode to Warn or Block",{"data":32573,"content":32574,"nodeType":866},{},[32575,32579,32584,32588,32592,32595,32599,32603,32607,32611,32615,32618,32622],{"data":32576,"marks":32577,"value":32578,"nodeType":865},{},[],"Once you’ve informed your employees and curated your ignore list, you’re ready to move security controls such as ",{"data":32580,"marks":32581,"value":32583,"nodeType":865},{},[32582],{"type":887},"SSO password protection",{"data":32585,"marks":32586,"value":32587,"nodeType":865},{},[]," into ",{"data":32589,"marks":32590,"value":31907,"nodeType":865},{},[32591],{"type":887},{"data":32593,"marks":32594,"value":8290,"nodeType":865},{},[],{"data":32596,"marks":32597,"value":31915,"nodeType":865},{},[32598],{"type":887},{"data":32600,"marks":32601,"value":32602,"nodeType":865},{},[]," mode. (If you have not already set the ",{"data":32604,"marks":32605,"value":8774,"nodeType":865},{},[32606],{"type":887},{"data":32608,"marks":32609,"value":32610,"nodeType":865},{},[]," control to ",{"data":32612,"marks":32613,"value":31907,"nodeType":865},{},[32614],{"type":887},{"data":32616,"marks":32617,"value":8290,"nodeType":865},{},[],{"data":32619,"marks":32620,"value":31915,"nodeType":865},{},[32621],{"type":887},{"data":32623,"marks":32624,"value":32625,"nodeType":865},{},[],", now is also a good time to do that.)",{"data":32627,"content":32628,"nodeType":866},{},[32629,32632,32636],{"data":32630,"marks":32631,"value":31886,"nodeType":865},{},[],{"data":32633,"marks":32634,"value":14983,"nodeType":865},{},[32635],{"type":887},{"data":32637,"marks":32638,"value":32639,"nodeType":865},{},[]," page of the admin console:",{"data":32641,"content":32642,"nodeType":2718},{},[32643,32661,32671,32681],{"data":32644,"content":32645,"nodeType":2654},{},[32646],{"data":32647,"content":32648,"nodeType":866},{},[32649,32653,32658],{"data":32650,"marks":32651,"value":32652,"nodeType":865},{},[],"Open the tile for the given control and update the ",{"data":32654,"marks":32655,"value":32657,"nodeType":865},{},[32656],{"type":887},"Mode",{"data":32659,"marks":32660,"value":1193,"nodeType":865},{},[],{"data":32662,"content":32663,"nodeType":2654},{},[32664],{"data":32665,"content":32666,"nodeType":866},{},[32667],{"data":32668,"marks":32669,"value":32670,"nodeType":865},{},[],"Create a custom message that employees will see when the control is triggered.",{"data":32672,"content":32673,"nodeType":2654},{},[32674],{"data":32675,"content":32676,"nodeType":866},{},[32677],{"data":32678,"marks":32679,"value":32680,"nodeType":865},{},[],"Save the configuration.",{"data":32682,"content":32683,"nodeType":2654},{},[32684],{"data":32685,"content":32686,"nodeType":866},{},[32687],{"data":32688,"marks":32689,"value":32690,"nodeType":865},{},[],"If possible, we also recommend consuming the webhook events generated when these controls are triggered in your SIEM or other alerting platform so you have good visibility.",{"data":32692,"content":32693,"nodeType":866},{},[32694,32698,32702,32705,32709,32713,32718],{"data":32695,"marks":32696,"value":32697,"nodeType":865},{},[],"If you’ve found any malicious sites using the ",{"data":32699,"marks":32700,"value":8774,"nodeType":865},{},[32701],{"type":887},{"data":32703,"marks":32704,"value":8290,"nodeType":865},{},[],{"data":32706,"marks":32707,"value":8782,"nodeType":865},{},[32708],{"type":887},{"data":32710,"marks":32711,"value":32712,"nodeType":865},{},[]," control, you may also wish to update your blocklist using the ",{"data":32714,"marks":32715,"value":32717,"nodeType":865},{},[32716],{"type":887},"URL blocking",{"data":32719,"marks":32720,"value":32721,"nodeType":865},{},[]," control. ",{"data":32723,"content":32724,"nodeType":2315},{},[32725],{"data":32726,"marks":32727,"value":32728,"nodeType":865},{},[],"Implement banners to guide secure employee behavior",{"data":32730,"content":32731,"nodeType":866},{},[32732,32736,32741,32745,32750,32753,32758,32761,32766,32769,32773,32777,32781,32785,32790],{"data":32733,"marks":32734,"value":32735,"nodeType":865},{},[],"Depending on your security goals, you may want to implement in-browser guidance for employees in the form of ",{"data":32737,"marks":32738,"value":32740,"nodeType":865},{},[32739],{"type":887},"App banners",{"data":32742,"marks":32743,"value":32744,"nodeType":865},{},[],". You can configure a banner in ",{"data":32746,"marks":32747,"value":32749,"nodeType":865},{},[32748],{"type":887},"Inform",{"data":32751,"marks":32752,"value":7148,"nodeType":865},{},[],{"data":32754,"marks":32755,"value":32757,"nodeType":865},{},[32756],{"type":887},"Acknowledge",{"data":32759,"marks":32760,"value":7148,"nodeType":865},{},[],{"data":32762,"marks":32763,"value":32765,"nodeType":865},{},[32764],{"type":887},"Reason",{"data":32767,"marks":32768,"value":7344,"nodeType":865},{},[],{"data":32770,"marks":32771,"value":31915,"nodeType":865},{},[32772],{"type":887},{"data":32774,"marks":32775,"value":32776,"nodeType":865},{},[]," modes from the ",{"data":32778,"marks":32779,"value":14983,"nodeType":865},{},[32780],{"type":887},{"data":32782,"marks":32783,"value":32784,"nodeType":865},{},[]," page. Use the ",{"data":32786,"marks":32787,"value":32789,"nodeType":865},{},[32788],{"type":887},"Rules",{"data":32791,"marks":32792,"value":32793,"nodeType":865},{},[]," feature to specify which employees or employee groups should see a banner, and which apps to apply it to.",{"data":32795,"content":32799,"nodeType":875},{"target":32796},{"sys":32797},{"id":32798,"type":872,"linkType":873},"2rVWMTYrjShEdrswkzobJe",[],{"data":32801,"content":32802,"nodeType":866},{},[32803],{"data":32804,"marks":32805,"value":32806,"nodeType":865},{},[],"Common use cases include:",{"data":32808,"content":32809,"nodeType":2718},{},[32810,32820,32830,32840,32850],{"data":32811,"content":32812,"nodeType":2654},{},[32813],{"data":32814,"content":32815,"nodeType":866},{},[32816],{"data":32817,"marks":32818,"value":32819,"nodeType":865},{},[],"Blocking an app while you investigate a potential data breach.",{"data":32821,"content":32822,"nodeType":2654},{},[32823],{"data":32824,"content":32825,"nodeType":866},{},[32826],{"data":32827,"marks":32828,"value":32829,"nodeType":865},{},[],"Blocking unapproved apps, such as a file-sharing service that’s not approved for storing sensitive information.",{"data":32831,"content":32832,"nodeType":2654},{},[32833],{"data":32834,"content":32835,"nodeType":866},{},[32836],{"data":32837,"marks":32838,"value":32839,"nodeType":865},{},[],"Requiring employees to acknowledge your GenAI policy before using GenAI apps.",{"data":32841,"content":32842,"nodeType":2654},{},[32843],{"data":32844,"content":32845,"nodeType":866},{},[32846],{"data":32847,"marks":32848,"value":32849,"nodeType":865},{},[],"Reminding employees to use SSO for SAML-enabled apps rather than a local account password.",{"data":32851,"content":32852,"nodeType":2654},{},[32853],{"data":32854,"content":32855,"nodeType":866},{},[32856],{"data":32857,"marks":32858,"value":32859,"nodeType":865},{},[],"Asking employees not to use an app before it can be reviewed by the security team, for apps not yet in your inventory.",{"data":32861,"content":32862,"nodeType":866},{},[32863,32867,32871,32875],{"data":32864,"marks":32865,"value":32445,"nodeType":865},{},[32866],{"type":887},{"data":32868,"marks":32869,"value":32870,"nodeType":865},{},[]," You can monitor employee engagement with app banners on the ",{"data":32872,"marks":32873,"value":31953,"nodeType":865},{},[32874],{"type":887},{"data":32876,"marks":32877,"value":32878,"nodeType":865},{},[]," page and send webhook events for when a banner is displayed or interacted with to your SIEM or SOAR.",{"data":32880,"content":32881,"nodeType":2315},{},[32882],{"data":32883,"marks":32884,"value":32885,"nodeType":865},{},[],"Enforce MFA on high-value apps",{"data":32887,"content":32888,"nodeType":866},{},[32889,32893,32897],{"data":32890,"marks":32891,"value":32892,"nodeType":865},{},[],"If you’ve identified accounts on important apps that lack MFA, you can prompt employees to add an MFA method using ",{"data":32894,"marks":32895,"value":14677,"nodeType":865},{},[32896],{"type":887},{"data":32898,"marks":32899,"value":32900,"nodeType":865},{},[],". This control uses an in-browser message to direct employees to register for MFA on apps where they lack it. This control is enabled on a per-app basis, so you can decide where you want to prompt for MFA registration.",{"data":32902,"content":32903,"nodeType":2718},{},[32904,32929],{"data":32905,"content":32906,"nodeType":2654},{},[32907],{"data":32908,"content":32909,"nodeType":866},{},[32910,32913,32917,32921,32925],{"data":32911,"marks":32912,"value":31886,"nodeType":865},{},[],{"data":32914,"marks":32915,"value":14983,"nodeType":865},{},[32916],{"type":887},{"data":32918,"marks":32919,"value":32920,"nodeType":865},{},[]," page, select the ",{"data":32922,"marks":32923,"value":14677,"nodeType":865},{},[32924],{"type":887},{"data":32926,"marks":32927,"value":32928,"nodeType":865},{},[]," tile.",{"data":32930,"content":32931,"nodeType":2654},{},[32932],{"data":32933,"content":32934,"nodeType":866},{},[32935],{"data":32936,"marks":32937,"value":32938,"nodeType":865},{},[],"Customize the message to employees, if you like.",{"data":32940,"content":32941,"nodeType":866},{},[32942],{"data":32943,"marks":32944,"value":32945,"nodeType":865},{},[],"image",{"data":32947,"content":32948,"nodeType":2315},{},[32949],{"data":32950,"marks":32951,"value":32952,"nodeType":865},{},[],"Send events to your SIEM or SOAR",{"data":32954,"content":32955,"nodeType":866},{},[32956],{"data":32957,"marks":32958,"value":32959,"nodeType":865},{},[],"To stay informed about end-user activity, findings, and controls on the Push platform, we recommend consuming events important to your security strategy in your SIEM, SOAR, or other similar alerting or automation platform.",{"data":32961,"content":32962,"nodeType":866},{},[32963,32967,32971,32975,32983],{"data":32964,"marks":32965,"value":32966,"nodeType":865},{},[],"Use the ",{"data":32968,"marks":32969,"value":31953,"nodeType":865},{},[32970],{"type":887},{"data":32972,"marks":32973,"value":32974,"nodeType":865},{},[]," page in the admin console to get familiar with the data structure of events, as well as the volume of events, and then review our ",{"data":32976,"content":32978,"nodeType":905},{"uri":32977},"/help/audience/administrators/docs/getting-started/#api-and-webhooks",[32979],{"data":32980,"marks":32981,"value":32982,"nodeType":865},{},[],"REST API and webhooks documentation",{"data":32984,"marks":32985,"value":32986,"nodeType":865},{},[]," for details on which entities, activities, control events, and audit logs you can consume.",{"data":32988,"content":32992,"nodeType":875},{"target":32989},{"sys":32990},{"id":32991,"type":872,"linkType":873},"1oG13vQ3AGP5i6TD24dnjs",[],{"data":32994,"content":32995,"nodeType":879},{},[],{"data":32997,"content":32998,"nodeType":889},{},[32999],{"data":33000,"marks":33001,"value":33002,"nodeType":865},{},[],"Next: Chart your own course",{"data":33004,"content":33005,"nodeType":866},{},[33006],{"data":33007,"marks":33008,"value":33009,"nodeType":865},{},[],"In your first 90 days and beyond, you can also begin creating custom workflows in your SIEM or SOAR platform to take Push’s browser and user activity telemetry and transform it into the triggers for solving specific problems in your environment.",{"data":33011,"content":33012,"nodeType":866},{},[33013],{"data":33014,"marks":33015,"value":33016,"nodeType":865},{},[],"Here are some ideas for what you can accomplish using Push’s REST API and webhooks:",{"data":33018,"content":33019,"nodeType":2718},{},[33020,33035,33050,33065,33080,33099,33114],{"data":33021,"content":33022,"nodeType":2654},{},[33023],{"data":33024,"content":33025,"nodeType":866},{},[33026,33031],{"data":33027,"marks":33028,"value":33030,"nodeType":865},{},[33029],{"type":887},"Harden identities and reduce account compromise",{"data":33032,"marks":33033,"value":33034,"nodeType":865},{},[],", such as alerting you when passwords are identified in public data breaches or when employees are using an unapproved app or when an SSO app is accessed via local account.",{"data":33036,"content":33037,"nodeType":2654},{},[33038],{"data":33039,"content":33040,"nodeType":866},{},[33041,33046],{"data":33042,"marks":33043,"value":33045,"nodeType":865},{},[33044],{"type":887},"Monitor for suspicious activity or high-risk changes",{"data":33047,"marks":33048,"value":33049,"nodeType":865},{},[],", such as checking for MFA method changes, or flagging when employees reuse corporate SSO passwords or visit sites running phishing malware.",{"data":33051,"content":33052,"nodeType":2654},{},[33053],{"data":33054,"content":33055,"nodeType":866},{},[33056,33061],{"data":33057,"marks":33058,"value":33060,"nodeType":865},{},[33059],{"type":887},"Investigate indicators of compromise",{"data":33062,"marks":33063,"value":33064,"nodeType":865},{},[],", such as correlating login events with platform logs, searching for recent signups to risky apps, or identifying post-compromise lateral movement opportunities.",{"data":33066,"content":33067,"nodeType":2654},{},[33068],{"data":33069,"content":33070,"nodeType":866},{},[33071,33076],{"data":33072,"marks":33073,"value":33075,"nodeType":865},{},[33074],{"type":887},"Force-reset an IdP password",{"data":33077,"marks":33078,"value":33079,"nodeType":865},{},[]," if Push finds a compromised password on an employee account.",{"data":33081,"content":33082,"nodeType":2654},{},[33083],{"data":33084,"content":33085,"nodeType":866},{},[33086,33090,33095],{"data":33087,"marks":33088,"value":33089,"nodeType":865},{},[],"Automate a workflow showing you all the",{"data":33091,"marks":33092,"value":33094,"nodeType":865},{},[33093],{"type":887}," accounts and apps used by an employee you’re offboarding",{"data":33096,"marks":33097,"value":33098,"nodeType":865},{},[],", and their account login methods.",{"data":33100,"content":33101,"nodeType":2654},{},[33102],{"data":33103,"content":33104,"nodeType":866},{},[33105,33110],{"data":33106,"marks":33107,"value":33109,"nodeType":865},{},[33108],{"type":887},"Automate a workflow to revoke licenses",{"data":33111,"marks":33112,"value":33113,"nodeType":865},{},[]," on SaaS after a period of inactivity, saving money.",{"data":33115,"content":33116,"nodeType":2654},{},[33117],{"data":33118,"content":33119,"nodeType":866},{},[33120,33125],{"data":33121,"marks":33122,"value":33124,"nodeType":865},{},[33123],{"type":887},"Build an approved apps list",{"data":33126,"marks":33127,"value":33128,"nodeType":865},{},[]," in your company wiki, synced from Push’s source of truth.",{"data":33130,"content":33131,"nodeType":866},{},[33132],{"data":33133,"marks":33134,"value":33135,"nodeType":865},{},[],"If you’ve made it this far, congratulations! You did not die of identity attacks.",{"data":33137,"content":33141,"nodeType":875},{"target":33138},{"sys":33139},{"id":33140,"type":872,"linkType":873},"4B7JIz8Iy7kp83vWLEVgOw",[],{"data":33143,"content":33144,"nodeType":866},{},[33145],{"data":33146,"marks":33147,"value":21,"nodeType":865},{},[],"River crossing: What you can accomplish in your first 90 days with Push Security","We’ve put together the following guide for intrepid security teams as they use Push to secure against modern identity attacks.","2024-12-09T00:00:00.000Z","navigating-your-first-90-days-with-push",{"items":33153},[33154],{"sys":33155,"name":297},{"id":2147},{"items":33157},[33158],{"fullName":9643,"firstName":9644,"jobTitle":9645,"profilePicture":33159},{"url":9647},"2024-identity-breaches","blog/2024-identity-breaches",{"json":33163},{"data":33164,"content":33165,"nodeType":1522},{},[33166],{"data":33167,"content":33168,"nodeType":866},{},[33169],{"data":33170,"marks":33171,"value":33172,"nodeType":865},{},[],"Reviewing public breaches that stemmed from identity attacks in 2024. ",{"id":33174,"publishedAt":33175},"1pJdOGN0dOd3BKVqO4CxHh","2026-08-12T11:54:37.036Z",{"items":33177},[33178],{"sys":33179,"name":2144},{"id":2143},{"items":33181},[33182,33184,33186,33188,33190,33192,33194,33196,33198,33200,33202,33204,33206,33208,33210],{"sys":33183,"name":413,"slug":414,"tier":31},{"id":410},{"sys":33185,"name":279,"slug":280,"tier":31},{"id":276},{"sys":33187,"name":642,"slug":643,"tier":31},{"id":639},{"sys":33189,"name":519,"slug":520,"tier":31},{"id":516},{"sys":33191,"name":333,"slug":334,"tier":45},{"id":330},{"sys":33193,"name":571,"slug":572,"tier":45},{"id":568},{"sys":33195,"name":466,"slug":467,"tier":45},{"id":463},{"sys":33197,"name":422,"slug":423,"tier":45},{"id":419},{"sys":33199,"name":537,"slug":538,"tier":45},{"id":534},{"sys":33201,"name":457,"slug":458,"tier":45},{"id":454},{"sys":33203,"name":528,"slug":529,"tier":45},{"id":525},{"sys":33205,"name":484,"slug":485,"tier":45},{"id":481},{"sys":33207,"name":607,"slug":608,"tier":45},{"id":604},{"sys":33209,"name":324,"slug":325,"tier":45},{"id":321},{"sys":33211,"name":502,"slug":503,"tier":45},{"id":499},"VKsWCNKqzgmNE7XqbeneH2izG7XkHw5SQLg2SCLeDzY",{"id":33214,"title":33215,"authorsCollection":33216,"content":33221,"extension":228,"faqItemsCollection":34383,"faqTitle":59,"featured":6,"hashTags":59,"meta":34385,"metaTitle":34386,"ogImage":59,"postType":7494,"publishedDate":34387,"relatedBlogPostsCollection":34388,"slug":36314,"stem":36315,"subtitle":59,"summary":36316,"synopsis":36327,"sys":36328,"tagsCollection":36331,"topicsCollection":36337,"__hash__":36377},"blog/blog/what-the-rise-of-infostealers-says-about-identity-attacks.json","What the rise of infostealers says about identity attacks",{"items":33217},[33218],{"fullName":3012,"firstName":3013,"jobTitle":3014,"socialLinks":33219,"profilePicture":33220},[6742],{"url":3016},{"json":33222,"links":34361},{"data":33223,"content":33224,"nodeType":1522},{},[33225,33256,33268,33284,33291,33298,33301,33308,33315,33439,33446,33453,33547,33554,33561,33614,33621,33644,33701,33704,33711,33730,33750,33757,33776,33783,33795,33798,33805,33812,33860,33867,33874,33892,33895,33902,33909,33916,33935,33942,33949,33956,33974,33981,33988,33995,34002,34021,34028,34035,34042,34049,34080,34086,34089,34096,34103,34109,34116,34123,34146,34153,34160,34203,34219,34238,34244,34251,34258,34265,34297,34342,34349,34355],{"data":33226,"content":33227,"nodeType":866},{},[33228,33232,33240,33244,33252],{"data":33229,"marks":33230,"value":33231,"nodeType":865},{},[],"Infostealer malware seems to be grabbing the headlines right now. It’s easy to see why, too, after laying claim to one of the ",{"data":33233,"content":33234,"nodeType":905},{"uri":16900},[33235],{"data":33236,"marks":33237,"value":33239,"nodeType":865},{},[33238],{"type":1070},"biggest breaches in history",{"data":33241,"marks":33242,"value":33243,"nodeType":865},{},[],". The ",{"data":33245,"content":33246,"nodeType":905},{"uri":2708},[33247],{"data":33248,"marks":33249,"value":33251,"nodeType":865},{},[33250],{"type":1070},"recent attacks on Snowflake customers",{"data":33253,"marks":33254,"value":33255,"nodeType":865},{},[]," saw ~165 businesses compromised using stolen credentials, resulting in millions of breached customer records, with the full impact still emerging. ",{"data":33257,"content":33258,"nodeType":866},{},[33259,33263],{"data":33260,"marks":33261,"value":33262,"nodeType":865},{},[],"Notably, ",{"data":33264,"marks":33265,"value":33267,"nodeType":865},{},[33266],{"type":887},"80% of the credentials used to access Snowflake customer accounts had found their way online after being stolen in infostealer infections – dating back as early as 2020. ",{"data":33269,"content":33270,"nodeType":866},{},[33271,33275,33280],{"data":33272,"marks":33273,"value":33274,"nodeType":865},{},[],"The Snowflake situation is a reminder of how lucrative stolen credentials can be for attackers – and how the cybercrime ecosystem has tilted as a result. As the saying goes nowadays, ",{"data":33276,"marks":33277,"value":33279,"nodeType":865},{},[33278],{"type":887},"hackers don’t hack in, they log in",{"data":33281,"marks":33282,"value":33283,"nodeType":865},{},[],". Stolen credentials are the lowest hanging fruit available to attackers, and their appetite (and the ecosystem needed to feed it) is insatiable. As an attacker, the prospect of picking up access to a major enterprise for just $10 or less (or even for free) is hard to resist – why wouldn’t you buy a ticket and take the gamble?  ",{"data":33285,"content":33286,"nodeType":866},{},[33287],{"data":33288,"marks":33289,"value":33290,"nodeType":865},{},[],"Infostealers are a huge part of the shift toward identity attacks. Along with phishing, infostealers are the primary mechanism for attackers to harvest credentials. Unlike phishing, infostealers can collect a large number of credentials (and other helpful data saved in the browser) in one fell swoop. But, they do have limitations. For example, you would expect any credible EDR to detect and block these attacks. And yet, the success of the attacks on Snowflake customers show us that gaps are being found and exploited.  ",{"data":33292,"content":33293,"nodeType":866},{},[33294],{"data":33295,"marks":33296,"value":33297,"nodeType":865},{},[],"In this article, we’ll look at the history of infostealers, how they work, and what the trends show us about how the cybercrime ecosystem is leaning into the opportunity they present.    ",{"data":33299,"content":33300,"nodeType":879},{},[],{"data":33302,"content":33303,"nodeType":889},{},[33304],{"data":33305,"marks":33306,"value":33307,"nodeType":865},{},[],"The state of infostealers today",{"data":33309,"content":33310,"nodeType":866},{},[33311],{"data":33312,"marks":33313,"value":33314,"nodeType":865},{},[],"Infostealers, and the mass credential harvesting they enable, are a big part of the rise in identity attacks. The stats support this, as:",{"data":33316,"content":33317,"nodeType":2718},{},[33318,33340,33359,33380,33400,33419],{"data":33319,"content":33320,"nodeType":2654},{},[33321],{"data":33322,"content":33323,"nodeType":866},{},[33324,33328,33337],{"data":33325,"marks":33326,"value":33327,"nodeType":865},{},[],"One million new stealer logs are distributed every month, with an estimated 3-5% containing credentials and session cookies to corporate IT environments (",{"data":33329,"content":33331,"nodeType":905},{"uri":33330},"https://www.bleepingcomputer.com/news/security/single-sign-on-and-the-cybercrime-ecosystem/",[33332],{"data":33333,"marks":33334,"value":33336,"nodeType":865},{},[33335],{"type":1070},"Flare",{"data":33338,"marks":33339,"value":13320,"nodeType":865},{},[],{"data":33341,"content":33342,"nodeType":2654},{},[33343],{"data":33344,"content":33345,"nodeType":866},{},[33346,33349,33356],{"data":33347,"marks":33348,"value":30331,"nodeType":865},{},[],{"data":33350,"content":33351,"nodeType":905},{"uri":30334},[33352],{"data":33353,"marks":33354,"value":30340,"nodeType":865},{},[33355],{"type":1070},{"data":33357,"marks":33358,"value":13320,"nodeType":865},{},[],{"data":33360,"content":33361,"nodeType":2654},{},[33362],{"data":33363,"content":33364,"nodeType":866},{},[33365,33369,33377],{"data":33366,"marks":33367,"value":33368,"nodeType":865},{},[],"147,000 token replay attacks were detected by Microsoft in 2023, an 111% increase year-over-year (",{"data":33370,"content":33372,"nodeType":905},{"uri":33371},"https://techcommunity.microsoft.com/t5/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/ba-p/4062700",[33373],{"data":33374,"marks":33375,"value":7564,"nodeType":865},{},[33376],{"type":1070},{"data":33378,"marks":33379,"value":11843,"nodeType":865},{},[],{"data":33381,"content":33382,"nodeType":2654},{},[33383],{"data":33384,"content":33385,"nodeType":866},{},[33386,33390,33397],{"data":33387,"marks":33388,"value":33389,"nodeType":865},{},[],"Over 1000 credentials are posted online per day, per marketplace with an average sale price of $10, and 65% posted less than one day after being collected (",{"data":33391,"content":33392,"nodeType":905},{"uri":30313},[33393],{"data":33394,"marks":33395,"value":10417,"nodeType":865},{},[33396],{"type":1070},{"data":33398,"marks":33399,"value":13320,"nodeType":865},{},[],{"data":33401,"content":33402,"nodeType":2654},{},[33403],{"data":33404,"content":33405,"nodeType":866},{},[33406,33410,33416],{"data":33407,"marks":33408,"value":33409,"nodeType":865},{},[],"Nearly half of the malware detected last year by Sophos targeted victims’ data specifically, and the majority of that malware was classified as infostealers (",{"data":33411,"content":33412,"nodeType":905},{"uri":30356},[33413],{"data":33414,"marks":33415,"value":30362,"nodeType":865},{},[],{"data":33417,"marks":33418,"value":13320,"nodeType":865},{},[],{"data":33420,"content":33421,"nodeType":2654},{},[33422],{"data":33423,"content":33424,"nodeType":866},{},[33425,33429,33436],{"data":33426,"marks":33427,"value":33428,"nodeType":865},{},[],"Attacks on session cookies happen at the same order of magnitude as password-based attacks (",{"data":33430,"content":33431,"nodeType":905},{"uri":30399},[33432],{"data":33433,"marks":33434,"value":30405,"nodeType":865},{},[33435],{"type":1070},{"data":33437,"marks":33438,"value":13320,"nodeType":865},{},[],{"data":33440,"content":33441,"nodeType":2315},{},[33442],{"data":33443,"marks":33444,"value":33445,"nodeType":865},{},[],"How did we get here?",{"data":33447,"content":33448,"nodeType":866},{},[33449],{"data":33450,"marks":33451,"value":33452,"nodeType":865},{},[],"Let’s go back to the beginning. When they first emerged, infostealers were designed to steal online banking and credit card information. The most notable early example comes from as far back as 2006 with the ZeuS trojan. After the ZeuS source code was leaked in March 2011, the creation of multiple variants boosted the popularity of this type of malware and inspired the development of infostealers with increasingly sophisticated capabilities.",{"data":33454,"content":33455,"nodeType":866},{},[33456,33460,33469,33473,33482,33486,33495,33498,33507,33510,33519,33522,33531,33534,33543],{"data":33457,"marks":33458,"value":33459,"nodeType":865},{},[],"Modern infostealers rose to prominence in around 2018 with the emergence of ",{"data":33461,"content":33463,"nodeType":905},{"uri":33462},"https://malpedia.caad.fkie.fraunhofer.de/details/win.arkei_stealer",[33464],{"data":33465,"marks":33466,"value":33468,"nodeType":865},{},[33467],{"type":1070},"Arkei",{"data":33470,"marks":33471,"value":33472,"nodeType":865},{},[],", which quickly spawned the more popular ",{"data":33474,"content":33476,"nodeType":905},{"uri":33475},"https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar",[33477],{"data":33478,"marks":33479,"value":33481,"nodeType":865},{},[33480],{"type":1070},"Vidar",{"data":33483,"marks":33484,"value":33485,"nodeType":865},{},[]," stealer. Today, some of the most popular families are ",{"data":33487,"content":33489,"nodeType":905},{"uri":33488},"https://malpedia.caad.fkie.fraunhofer.de/details/win.risepro",[33490],{"data":33491,"marks":33492,"value":33494,"nodeType":865},{},[33493],{"type":1070},"RisePro",{"data":33496,"marks":33497,"value":7148,"nodeType":865},{},[],{"data":33499,"content":33501,"nodeType":905},{"uri":33500},"https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer",[33502],{"data":33503,"marks":33504,"value":33506,"nodeType":865},{},[33505],{"type":1070},"RedLine",{"data":33508,"marks":33509,"value":7148,"nodeType":865},{},[],{"data":33511,"content":33513,"nodeType":905},{"uri":33512},"https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc",[33514],{"data":33515,"marks":33516,"value":33518,"nodeType":865},{},[33517],{"type":1070},"StealC",{"data":33520,"marks":33521,"value":7148,"nodeType":865},{},[],{"data":33523,"content":33525,"nodeType":905},{"uri":33524},"https://malpedia.caad.fkie.fraunhofer.de/details/win.raccoon",[33526],{"data":33527,"marks":33528,"value":33530,"nodeType":865},{},[33529],{"type":1070},"Raccoon",{"data":33532,"marks":33533,"value":1454,"nodeType":865},{},[],{"data":33535,"content":33537,"nodeType":905},{"uri":33536},"https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma",[33538],{"data":33539,"marks":33540,"value":33542,"nodeType":865},{},[33541],{"type":1070},"Lumma",{"data":33544,"marks":33545,"value":33546,"nodeType":865},{},[],", with new variants and families appearing all the time. ",{"data":33548,"content":33549,"nodeType":866},{},[33550],{"data":33551,"marks":33552,"value":33553,"nodeType":865},{},[],"Infostealers are used by all manner of threat actors of varying levels of sophistication. For larger groups with sufficient resources, the creation of new, custom stealers and malware packages is a common tactic to attempt to evade detection. ",{"data":33555,"content":33556,"nodeType":866},{},[33557],{"data":33558,"marks":33559,"value":33560,"nodeType":865},{},[],"But despite all the variants, infostealers do have common capabilities and characteristics, such as:",{"data":33562,"content":33563,"nodeType":2718},{},[33564,33574,33584,33594,33604],{"data":33565,"content":33566,"nodeType":2654},{},[33567],{"data":33568,"content":33569,"nodeType":866},{},[33570],{"data":33571,"marks":33572,"value":33573,"nodeType":865},{},[],"Extracting information from the browsers of a compromised device, such as passwords, cookies, autofill information, downloaded file information.",{"data":33575,"content":33576,"nodeType":2654},{},[33577],{"data":33578,"content":33579,"nodeType":866},{},[33580],{"data":33581,"marks":33582,"value":33583,"nodeType":865},{},[],"Snapshotting the desktop and system inventory, with details such as the username, location data, hardware configuration, and information regarding installed security software.",{"data":33585,"content":33586,"nodeType":2654},{},[33587],{"data":33588,"content":33589,"nodeType":866},{},[33590],{"data":33591,"marks":33592,"value":33593,"nodeType":865},{},[],"Sending stolen data back to a C2 server.",{"data":33595,"content":33596,"nodeType":2654},{},[33597],{"data":33598,"content":33599,"nodeType":866},{},[33600],{"data":33601,"marks":33602,"value":33603,"nodeType":865},{},[],"Facilitating the deployment of additional tools and malware as part of a package. ",{"data":33605,"content":33606,"nodeType":2654},{},[33607],{"data":33608,"content":33609,"nodeType":866},{},[33610],{"data":33611,"marks":33612,"value":33613,"nodeType":865},{},[],"Often (but not always) self-terminating once complete, leaving little trace on the victim machine and no ongoing behavior that might be detected. ",{"data":33615,"content":33616,"nodeType":866},{},[33617],{"data":33618,"marks":33619,"value":33620,"nodeType":865},{},[],"Infostealers are distributed in similar ways to other types of malware, such as:",{"data":33622,"content":33623,"nodeType":2718},{},[33624,33634],{"data":33625,"content":33626,"nodeType":2654},{},[33627],{"data":33628,"content":33629,"nodeType":866},{},[33630],{"data":33631,"marks":33632,"value":33633,"nodeType":865},{},[],"Delivery of malicious executable files via phishing emails or by having a victim download content from a malicious website. ",{"data":33635,"content":33636,"nodeType":2654},{},[33637],{"data":33638,"content":33639,"nodeType":866},{},[33640],{"data":33641,"marks":33642,"value":33643,"nodeType":865},{},[],"‘Drive-by’ style attacks where the victim has only to visit an infected website.",{"data":33645,"content":33646,"nodeType":866},{},[33647,33651,33660,33663,33672,33675,33684,33688,33697],{"data":33648,"marks":33649,"value":33650,"nodeType":865},{},[],"They’re typically spread via malvertising, P2P downloads, and deceptive software download sites. ",{"data":33652,"content":33654,"nodeType":905},{"uri":33653},"https://www.bleepingcomputer.com/news/security/fake-cheat-lures-gamers-into-spreading-infostealer-malware/",[33655],{"data":33656,"marks":33657,"value":33659,"nodeType":865},{},[33658],{"type":1070},"Gaming forums",{"data":33661,"marks":33662,"value":7148,"nodeType":865},{},[],{"data":33664,"content":33666,"nodeType":905},{"uri":33665},"https://cybersecuritynews.com/facebook-account-hijack-malware/",[33667],{"data":33668,"marks":33669,"value":33671,"nodeType":865},{},[33670],{"type":1070},"Facebook ads",{"data":33673,"marks":33674,"value":1454,"nodeType":865},{},[],{"data":33676,"content":33678,"nodeType":905},{"uri":33677},"https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube",[33679],{"data":33680,"marks":33681,"value":33683,"nodeType":865},{},[33682],{"type":1070},"YouTube video descriptions",{"data":33685,"marks":33686,"value":33687,"nodeType":865},{},[]," are popular locations for malicious links, but recent examples also include ",{"data":33689,"content":33691,"nodeType":905},{"uri":33690},"https://www.bleepingcomputer.com/news/security/over-3-000-github-accounts-used-by-malware-distribution-service/",[33692],{"data":33693,"marks":33694,"value":33696,"nodeType":865},{},[33695],{"type":1070},"complex malware distribution networks on GitHub",{"data":33698,"marks":33699,"value":33700,"nodeType":865},{},[]," – such as the recent campaign from ‘Stargazer Goblin’ with more than 3,000 fake accounts creating and promoting hundreds of fake repositories to increase their apparent legitimacy and make them more likely to appear on GitHub's trending section.",{"data":33702,"content":33703,"nodeType":879},{},[],{"data":33705,"content":33706,"nodeType":889},{},[33707],{"data":33708,"marks":33709,"value":33710,"nodeType":865},{},[],"Infostealers are key to the cybercrime ecosystem",{"data":33712,"content":33713,"nodeType":866},{},[33714,33718,33726],{"data":33715,"marks":33716,"value":33717,"nodeType":865},{},[],"After being stolen, ",{"data":33719,"content":33720,"nodeType":905},{"uri":33330},[33721],{"data":33722,"marks":33723,"value":33725,"nodeType":865},{},[33724],{"type":1070},"infostealer data inevitably finds its way onto hacker forums and marketplaces",{"data":33727,"marks":33728,"value":33729,"nodeType":865},{},[],", both on the clearweb and darkweb. Popular infostealers have their own dedicated Telegram channels to advertise and sell stolen data. Private channels also exist, with the channel owner distributing tens of thousands of logs per week to a limited number of threat actors who pay $200-$400 for access to the channel. This allows them to get ‘first pick’ of stolen logs, which are later shared through public Telegram channels. ",{"data":33731,"content":33732,"nodeType":866},{},[33733,33737,33746],{"data":33734,"marks":33735,"value":33736,"nodeType":865},{},[],"Public data eventually makes its way onto services such as Have I Been Pwned (HIBP), which gives individuals and security teams some visibility of which credentials have been compromised. For example, ",{"data":33738,"content":33740,"nodeType":905},{"uri":33739},"https://www.troyhunt.com/telegram-combolists-and-361m-email-addresses/",[33741],{"data":33742,"marks":33743,"value":33745,"nodeType":865},{},[33744],{"type":1070},"in June, Troy Hunt (creator of HIBP) wrote",{"data":33747,"marks":33748,"value":33749,"nodeType":865},{},[]," about the impact of channels like Telegram and the sale of combolists (username, password, login portal URL), after being sent 122GB of data scraped out of thousands of Telegram channels, containing 361M unique email addresses (of which 151M had never been seen in HIBP before). ",{"data":33751,"content":33752,"nodeType":866},{},[33753],{"data":33754,"marks":33755,"value":33756,"nodeType":865},{},[],"The cybercrime ecosystem is complex, with a developed supply chain and organizations fulfilling different roles as a result: from malware-as-a-service developers, to initial access brokers, to the operators that actually conduct the attacks (be they ransomware, data theft, etc.) – and many, many other roles in between. Sometimes, a single group and/or its affiliates will conduct the full chain, but this is far less common today. ",{"data":33758,"content":33759,"nodeType":866},{},[33760,33763,33772],{"data":33761,"marks":33762,"value":21,"nodeType":865},{},[],{"data":33764,"content":33766,"nodeType":905},{"uri":33765},"https://www.secureworks.com/research/the-growing-threat-from-infostealers",[33767],{"data":33768,"marks":33769,"value":33771,"nodeType":865},{},[33770],{"type":1070},"Infostealers are often sold by malware developers to other attackers as a monthly subscription service.",{"data":33773,"marks":33774,"value":33775,"nodeType":865},{},[]," The price can range from $50 to over $1,000 USD per month for access to a stealer command and control (C2) server operated by the developer. The service often features a range of support functions, including multiple ways to view, download, and share stolen data. Self-hosted stealer C2 servers are also available and are usually sold for a flat fee. ",{"data":33777,"content":33778,"nodeType":866},{},[33779],{"data":33780,"marks":33781,"value":33782,"nodeType":865},{},[],"There’s also evidence that there is an element of target coordination – with one marketplace, Russian Market, allowing users to ‘preorder’ credentials for a $1,000 USD deposit from 2022. ",{"data":33784,"content":33785,"nodeType":866},{},[33786,33791],{"data":33787,"marks":33788,"value":33790,"nodeType":865},{},[33789],{"type":887},"So what? Well, there's evidently an abundance of breached data already online, and attackers have the tools readily available to have this pile grow exponentially bigger and more useful.",{"data":33792,"marks":33793,"value":33794,"nodeType":865},{},[]," It’s also probably more coordinated than we like to admit – a particularly intimidating prospect in the wake of Snowflake, which will no doubt have many criminals smelling blood in the water. ",{"data":33796,"content":33797,"nodeType":879},{},[],{"data":33799,"content":33800,"nodeType":889},{},[33801],{"data":33802,"marks":33803,"value":33804,"nodeType":865},{},[],"How can stolen data be abused by attackers? ",{"data":33806,"content":33807,"nodeType":866},{},[33808],{"data":33809,"marks":33810,"value":33811,"nodeType":865},{},[],"It’s pretty obvious that attackers getting access to all of your passwords and session cookies is bad, but there is a clear value hierarchy from a corporate security perspective. So, from highest to lowest risk:",{"data":33813,"content":33814,"nodeType":2718},{},[33815,33830,33845],{"data":33816,"content":33817,"nodeType":2654},{},[33818],{"data":33819,"content":33820,"nodeType":866},{},[33821,33826],{"data":33822,"marks":33823,"value":33825,"nodeType":865},{},[33824],{"type":887},"Stolen session cookies",{"data":33827,"marks":33828,"value":33829,"nodeType":865},{},[]," simply need to be imported into an attacker’s browser to resume an active session on an app. That means access can be gained without needing to enter a username and password, or pass any MFA checks. ",{"data":33831,"content":33832,"nodeType":2654},{},[33833],{"data":33834,"content":33835,"nodeType":866},{},[33836,33841],{"data":33837,"marks":33838,"value":33840,"nodeType":865},{},[33839],{"type":887},"Stolen usernames, passwords",{"data":33842,"marks":33843,"value":33844,"nodeType":865},{},[],", and login page URLs can be used to access any accounts that lack MFA. ",{"data":33846,"content":33847,"nodeType":2654},{},[33848],{"data":33849,"content":33850,"nodeType":866},{},[33851,33856],{"data":33852,"marks":33853,"value":33855,"nodeType":865},{},[33854],{"type":887},"Stolen autofill data",{"data":33857,"marks":33858,"value":33859,"nodeType":865},{},[]," can be used to gather other valuable information that could be useful for impersonating the victim when speaking to social engineering IT support staff, for example to reset or remove MFA.",{"data":33861,"content":33862,"nodeType":866},{},[33863],{"data":33864,"marks":33865,"value":33866,"nodeType":865},{},[],"Naturally, stolen session cookies are the most valuable prize, but they are often valid for only a limited time before the user must re-authenticate, and active sessions can often be terminated by security admins. Unfortunately, it’s not that uncommon for sessions to last for up to a month, or even sometimes indefinitely.",{"data":33868,"content":33869,"nodeType":866},{},[33870],{"data":33871,"marks":33872,"value":33873,"nodeType":865},{},[],"Stolen usernames and passwords are a different story. As the Snowflake breaches demonstrate, passwords can remain valid for years after a breach, particularly in the world of SaaS apps where mandatory password rotation is not as common as for a user’s primary domain account.",{"data":33875,"content":33876,"nodeType":866},{},[33877,33881,33888],{"data":33878,"marks":33879,"value":33880,"nodeType":865},{},[],"There’s also the problem of ",{"data":33882,"content":33883,"nodeType":905},{"uri":945},[33884],{"data":33885,"marks":33886,"value":950,"nodeType":865},{},[33887],{"type":1070},{"data":33889,"marks":33890,"value":33891,"nodeType":865},{},[]," – where a local login with a username and password (and probably lacking MFA) can exist alongside other, more secure login methods such as SSO. Given the fact that many apps are self-adopted by users, these accounts continue to exist even when an app is subsequently added to SSO via the chosen IdP, meaning they can fly under the radar of security teams. ",{"data":33893,"content":33894,"nodeType":879},{},[],{"data":33896,"content":33897,"nodeType":889},{},[33898],{"data":33899,"marks":33900,"value":33901,"nodeType":865},{},[],"Should you be concerned about infostealers?",{"data":33903,"content":33904,"nodeType":866},{},[33905],{"data":33906,"marks":33907,"value":33908,"nodeType":865},{},[],"It’s commonly thought that infostealers are primarily a concern for unmanaged devices that lack security controls common to corporate IT, such as EDR. But there’s a couple of reasons why corporate users are also at risk:",{"data":33910,"content":33911,"nodeType":2315},{},[33912],{"data":33913,"marks":33914,"value":33915,"nodeType":865},{},[],"EDR can be bypassed",{"data":33917,"content":33918,"nodeType":866},{},[33919,33923,33932],{"data":33920,"marks":33921,"value":33922,"nodeType":865},{},[],"EDR is seen as the go-to solution for defending against infostealer malware. However, attackers are always looking for ways to get around security controls by obfuscating malicious behavior and evading signature-based checks. For example, ",{"data":33924,"content":33926,"nodeType":905},{"uri":33925},"https://thehackernews.com/2024/07/microsoft-defender-flaw-exploited-to.html",[33927],{"data":33928,"marks":33929,"value":33931,"nodeType":865},{},[33930],{"type":1070},"a flaw in Microsoft Defender SmartScreen was recently exploited to deliver infostealer malware",{"data":33933,"marks":33934,"value":1193,"nodeType":865},{},[],{"data":33936,"content":33937,"nodeType":866},{},[33938],{"data":33939,"marks":33940,"value":33941,"nodeType":865},{},[],"Getting total coverage across your endpoint estate is notoriously difficult, if not totally unrealistic. Unless the malware is stopped on execution, then data will inevitably be stolen, and will continue to be taken until stopped (or it self-terminates). And once an attacker has stolen employee credentials or sessions, the credential stuffing and session hijacking attacks that come next won’t touch the endpoint. For those reasons, you can’t rely on EDR as a single line of defense against infostealers.",{"data":33943,"content":33944,"nodeType":2315},{},[33945],{"data":33946,"marks":33947,"value":33948,"nodeType":865},{},[],"Unmanaged devices such as BYOD or third-parties are vulnerable",{"data":33950,"content":33951,"nodeType":866},{},[33952],{"data":33953,"marks":33954,"value":33955,"nodeType":865},{},[],"Companies that support BYOD often have less secure configurations than those with fully managed devices. The same applies to third-party contractors, who often use their own devices to access company systems on a temporary basis. ",{"data":33957,"content":33958,"nodeType":866},{},[33959,33963,33970],{"data":33960,"marks":33961,"value":33962,"nodeType":865},{},[],"This issue was acutely felt in the Snowflake attacks: There is some suggestion that targeting key third-party suppliers – ",{"data":33964,"content":33965,"nodeType":905},{"uri":17310},[33966],{"data":33967,"marks":33968,"value":17316,"nodeType":865},{},[33969],{"type":1070},{"data":33971,"marks":33972,"value":33973,"nodeType":865},{},[]," – yielded some of the access needed. It’s unclear what came first, but it’s possible (likely, even) that EPAM was identified as a target specifically because of its lucrative customer base – third-parties are a known weak point for red teamers, so it would be foolish to assume that attackers don’t also think this way. It’s possible too that EPAM were specifically targeted because of their Snowflake chops – adding another indicator that Snowflake was potentially a premeditated attack inspired by the availability of Snowflake credentials online. ",{"data":33975,"content":33976,"nodeType":2315},{},[33977],{"data":33978,"marks":33979,"value":33980,"nodeType":865},{},[],"Browser profiles can be synced across devices, increasing the blast radius",{"data":33982,"content":33983,"nodeType":866},{},[33984],{"data":33985,"marks":33986,"value":33987,"nodeType":865},{},[],"It’s not uncommon for employees to access their personal email accounts from company devices. When accessing any browser, you are typically prompted to sign in with your account credentials (e.g. your Google account). If a user signs into a browser on a company device with a personal account, you’re usually prompted to sync your account across devices. This usually means that any saved passwords, search history, and settings are shared across devices. ",{"data":33989,"content":33990,"nodeType":866},{},[33991],{"data":33992,"marks":33993,"value":33994,"nodeType":865},{},[],"Naturally, this means that if a personal device is compromised where you’re also logged into the browser profile, then an infostealer will be able to harvest information saved into that profile across devices.",{"data":33996,"content":33997,"nodeType":866},{},[33998],{"data":33999,"marks":34000,"value":34001,"nodeType":865},{},[],"Even when using separate browser profiles for work and personal, it’s easy for the two to converge, or to slip into using the wrong profile. Accessing personal accounts (or at least synchronizing data across accounts) is usually a workplace policy violation, but it’s unfortunately all too common. ",{"data":34003,"content":34004,"nodeType":866},{},[34005,34009,34018],{"data":34006,"marks":34007,"value":34008,"nodeType":865},{},[],"Previous vulnerabilities have exacerbated this problem, such as ",{"data":34010,"content":34012,"nodeType":905},{"uri":34011},"https://thehackernews.com/2024/01/malware-using-google-multilogin-exploit.html",[34013],{"data":34014,"marks":34015,"value":34017,"nodeType":865},{},[34016],{"type":1070},"an exploit affecting Google MultiLogin to maintain access to synced accounts even after a password reset",{"data":34019,"marks":34020,"value":1711,"nodeType":865},{},[],{"data":34022,"content":34023,"nodeType":2315},{},[34024],{"data":34025,"marks":34026,"value":34027,"nodeType":865},{},[],"Are infostealers a bigger problem than credential phishing? ",{"data":34029,"content":34030,"nodeType":866},{},[34031],{"data":34032,"marks":34033,"value":34034,"nodeType":865},{},[],"The short answer is: No. The longer answer is: They are both part of the bigger problem of identity attacks, and attackers can wield both approaches simultaneously. ",{"data":34036,"content":34037,"nodeType":866},{},[34038],{"data":34039,"marks":34040,"value":34041,"nodeType":865},{},[],"While they are delivered to victims in similar ways to phishing links, most organizations are arguably better protected against infostealers than modern phishing attacks because endpoint security controls provide another layer of protection, in theory – whereas modern phishing attacks don’t necessarily involve the delivery of malware that executes on the device. ",{"data":34043,"content":34044,"nodeType":866},{},[34045],{"data":34046,"marks":34047,"value":34048,"nodeType":865},{},[],"Infostealers arguably provide more bang for the attacker’s buck, grabbing a stack of credentials and useful data in one go. In contrast, phishing is usually much more targeted, and involves the compromise of a narrower set of credentials – typically focusing on a particular site or app. ",{"data":34050,"content":34051,"nodeType":866},{},[34052,34056,34065,34069,34076],{"data":34053,"marks":34054,"value":34055,"nodeType":865},{},[],"It’s worth focusing on the TTP, not the particular tool being used: The attacker technique here is ",{"data":34057,"content":34059,"nodeType":905},{"uri":34058},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/session_cookie_theft/description.md",[34060],{"data":34061,"marks":34062,"value":34064,"nodeType":865},{},[34063],{"type":1070},"session cookie theft",{"data":34066,"marks":34067,"value":34068,"nodeType":865},{},[],", and subsequently session hijacking by importing the cookie into the attacker’s browser. Both infostealers and ",{"data":34070,"content":34071,"nodeType":905},{"uri":18895},[34072],{"data":34073,"marks":34074,"value":34075,"nodeType":865},{},[],"modern phishing attacks",{"data":34077,"marks":34078,"value":34079,"nodeType":865},{},[]," involve the theft of session tokens, and so are valid means to achieve this end. In fact, there’s nothing to stop threat groups from employing both simultaneously.",{"data":34081,"content":34085,"nodeType":875},{"target":34082},{"sys":34083},{"id":34084,"type":872,"linkType":873},"7fil6aaQDFfJGYUnQ14k10",[],{"data":34087,"content":34088,"nodeType":879},{},[],{"data":34090,"content":34091,"nodeType":889},{},[34092],{"data":34093,"marks":34094,"value":34095,"nodeType":865},{},[],"Infostealers in action",{"data":34097,"content":34098,"nodeType":866},{},[34099],{"data":34100,"marks":34101,"value":34102,"nodeType":865},{},[],"Check out the video demo below to see the attack chain in action from the point of an infostealer compromise, showing session cookie theft, reimporting the cookies into the attacker's browser, and evading policy-based controls in M365. It also shows the targeting of downstream apps that are usually accessed via SSO in the context of both a Microsoft Entra and Okta compromise.",{"data":34104,"content":34108,"nodeType":875},{"target":34105},{"sys":34106},{"id":34107,"type":872,"linkType":873},"4J7LqqjQX2W52AbmcVmjUt",[],{"data":34110,"content":34111,"nodeType":889},{},[34112],{"data":34113,"marks":34114,"value":34115,"nodeType":865},{},[],"What can organizations do about the infostealer threat? ",{"data":34117,"content":34118,"nodeType":866},{},[34119],{"data":34120,"marks":34121,"value":34122,"nodeType":865},{},[],"Security teams should have two main concerns:",{"data":34124,"content":34125,"nodeType":2718},{},[34126,34136],{"data":34127,"content":34128,"nodeType":2654},{},[34129],{"data":34130,"content":34131,"nodeType":866},{},[34132],{"data":34133,"marks":34134,"value":34135,"nodeType":865},{},[],"Data that is already out there from historical data dumps, but is still valid. ",{"data":34137,"content":34138,"nodeType":2654},{},[34139],{"data":34140,"content":34141,"nodeType":866},{},[34142],{"data":34143,"marks":34144,"value":34145,"nodeType":865},{},[],"Data in private channels that attackers could use in the future, that you are blind to. ",{"data":34147,"content":34148,"nodeType":866},{},[34149],{"data":34150,"marks":34151,"value":34152,"nodeType":865},{},[],"As always, the root-cause of the problem is a lack of meaningful visibility of what apps your employees are using (including those outside your IdP) and whether the associated identities are configured securely. ",{"data":34154,"content":34155,"nodeType":866},{},[34156],{"data":34157,"marks":34158,"value":34159,"nodeType":865},{},[],"A layered, defense-in-depth approach is required to resolve the issue, by:",{"data":34161,"content":34162,"nodeType":2718},{},[34163,34173,34183,34193],{"data":34164,"content":34165,"nodeType":2654},{},[34166],{"data":34167,"content":34168,"nodeType":866},{},[34169],{"data":34170,"marks":34171,"value":34172,"nodeType":865},{},[],"Deploying MFA across all your identities and apps, including any local logins that can’t be put behind SSO. ",{"data":34174,"content":34175,"nodeType":2654},{},[34176],{"data":34177,"content":34178,"nodeType":866},{},[34179],{"data":34180,"marks":34181,"value":34182,"nodeType":865},{},[],"Configuring time-limited session lifetimes for all apps to ensure that any stolen session tokens can only be used temporarily. ",{"data":34184,"content":34185,"nodeType":2654},{},[34186],{"data":34187,"content":34188,"nodeType":866},{},[34189],{"data":34190,"marks":34191,"value":34192,"nodeType":865},{},[],"Ensuring that employees don’t access or synchronize personal accounts on their work devices, as well as limiting non-work activities on their work device as much as possible.",{"data":34194,"content":34195,"nodeType":2654},{},[34196],{"data":34197,"content":34198,"nodeType":866},{},[34199],{"data":34200,"marks":34201,"value":34202,"nodeType":865},{},[],"Implementing a robust EDR/MDR solution to detect and respond to malware compromises on user devices. ",{"data":34204,"content":34205,"nodeType":866},{},[34206,34210,34215],{"data":34207,"marks":34208,"value":34209,"nodeType":865},{},[],"Organizations also have the option of investing in a commercial TI feed to detect and report data breaches affecting employees. But in our experience, these feeds contain ",{"data":34211,"marks":34212,"value":34214,"nodeType":865},{},[34213],{"type":887},"a lot ",{"data":34216,"marks":34217,"value":34218,"nodeType":865},{},[],"of false positives – so unless you have password visibility for employee accounts across apps, it’s going to waste a chunk of valuable time for you and your employees.",{"data":34220,"content":34221,"nodeType":866},{},[34222,34226,34234],{"data":34223,"marks":34224,"value":34225,"nodeType":865},{},[],"It would be remiss of us not to mention our recently released ",{"data":34227,"content":34228,"nodeType":905},{"uri":17648},[34229],{"data":34230,"marks":34231,"value":34233,"nodeType":865},{},[34232],{"type":1070},"session token theft detection feature",{"data":34235,"marks":34236,"value":34237,"nodeType":865},{},[]," that identifies session token theft by adding telemetry to the user agent string – using the power of our browser agent to create a new high-fidelity signal for security teams. It can also be applied more generally to detect any session taking place in an unmanaged browser – so you can use it to spot unauthorized access to company apps in general, too.  ",{"data":34239,"content":34243,"nodeType":875},{"target":34240},{"sys":34241},{"id":34242,"type":872,"linkType":873},"3XgpqEGzZSD2J0uvnCg5D8",[],{"data":34245,"content":34246,"nodeType":2315},{},[34247],{"data":34248,"marks":34249,"value":34250,"nodeType":865},{},[],"What’s next for infostealers?",{"data":34252,"content":34253,"nodeType":866},{},[34254],{"data":34255,"marks":34256,"value":34257,"nodeType":865},{},[],"All the signs point to the fact that infostealers will continue being a useful tool in the attacker’s arsenal. The Snowflake attacks in particular are both a warning for defenders and encouragement for attackers. It's also a good reminder that while infostealers were once used to harvest things like VPN creds to pivot to the internal network, they're now largely used to target third-party services over the internet. ",{"data":34259,"content":34260,"nodeType":866},{},[34261],{"data":34262,"marks":34263,"value":34264,"nodeType":865},{},[],"To evade EDR, it’s likely that we’ll see a growing number of families and variants used by individual groups, or better ‘enterprise’ capabilities from malware-as-a-service vendors. ",{"data":34266,"content":34267,"nodeType":866},{},[34268,34272,34281,34285,34293],{"data":34269,"marks":34270,"value":34271,"nodeType":865},{},[],"One notable quirk is that, to date, infostealers have not really branched out from targeting browsers. Take the example of password manager apps – you would think this would be an obvious target, right? But, they’re not usually targeted (",{"data":34273,"content":34275,"nodeType":905},{"uri":34274},"https://securitysenses.com/posts/malware-targeting-password-managers",[34276],{"data":34277,"marks":34278,"value":34280,"nodeType":865},{},[34279],{"type":1070},"with some exceptions",{"data":34282,"marks":34283,"value":34284,"nodeType":865},{},[],"). And when they do, ",{"data":34286,"content":34287,"nodeType":905},{"uri":34274},[34288],{"data":34289,"marks":34290,"value":34292,"nodeType":865},{},[34291],{"type":1070},"they work by eavesdropping on the password manager’s browser extension in action",{"data":34294,"marks":34295,"value":34296,"nodeType":865},{},[]," – meaning they are intercepted one-at-a-time as the user uses them, rather than targeting the password manager directly and exporting the saved passwords all at once. It will be interesting to see whether these capabilities are added in the future. ",{"data":34298,"content":34299,"nodeType":866},{},[34300,34304,34313,34316,34325,34329,34338],{"data":34301,"marks":34302,"value":34303,"nodeType":865},{},[],"On the other hand, there are defensive security developments that could reduce the ability of attackers to leverage things like stolen session tokens, such as ",{"data":34305,"content":34307,"nodeType":905},{"uri":34306},"https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection",[34308],{"data":34309,"marks":34310,"value":34312,"nodeType":865},{},[34311],{"type":1070},"Microsoft’s token binding feature in Entra",{"data":34314,"marks":34315,"value":7344,"nodeType":865},{},[],{"data":34317,"content":34319,"nodeType":905},{"uri":34318},"https://blog.chromium.org/2024/04/fighting-cookie-theft-using-device.html",[34320],{"data":34321,"marks":34322,"value":34324,"nodeType":865},{},[34323],{"type":1070},"Google’s device bound session cookies",{"data":34326,"marks":34327,"value":34328,"nodeType":865},{},[],". Google also released an ",{"data":34330,"content":34332,"nodeType":905},{"uri":34331},"https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html?m=1",[34333],{"data":34334,"marks":34335,"value":34337,"nodeType":865},{},[34336],{"type":1070},"app-bound encryption feature",{"data":34339,"marks":34340,"value":34341,"nodeType":865},{},[],", which adds additional protection against infostealers attempting to steal browser data in Chrome if the underlying Windows device is compromised. ",{"data":34343,"content":34344,"nodeType":866},{},[34345],{"data":34346,"marks":34347,"value":34348,"nodeType":865},{},[],"That said, mature versions of these controls are still years away, and while session cookie theft is a key risk of infostealers, it’s not the only risk – so alternative controls and mitigations remain valuable to security teams in the present. ",{"data":34350,"content":34354,"nodeType":875},{"target":34351},{"sys":34352},{"id":34353,"type":872,"linkType":873},"5loTnpvwGD3kaKMXBp23hZ",[],{"data":34356,"content":34357,"nodeType":866},{},[34358],{"data":34359,"marks":34360,"value":21,"nodeType":865},{},[],{"entries":34362},{"hyperlink":34363,"inline":34364,"block":34365},[],[],[34366,34370,34376,34379],{"sys":34367,"__typename":1530,"type":1531,"ctaText":34368,"buttonLabel":34369,"buttonColour":14189,"buttonUrl":18895},{"id":34084},"Learn more about modern AitM and BitM phishing toolkits","Read the Blog",{"sys":34371,"__typename":27470,"title":34372,"youTubeUrl":34373,"imagePlaceholder":34374},{"id":34107},"Session hijacking using stolen session cookies","https://www.youtube.com/watch?v=RlSweA5UfYw",{"url":34375,"width":25196,"height":25197},"https://images.ctfassets.net/y1cdw1ablpvd/4ONwBrDgXX7NdfkMoIVu8v/775f0c1646e90220b2df9fe17ec30690/Slide_16_9_-_44__2_.png",{"sys":34377,"__typename":1530,"type":1531,"ctaText":34378,"buttonLabel":34369,"buttonColour":1534,"buttonUrl":17648},{"id":34242},"Learn more about how we use browser telemetry to detect and stop session token theft",{"sys":34380,"__typename":1530,"type":1531,"ctaText":34381,"buttonLabel":19253,"buttonColour":1534,"buttonUrl":34382},{"id":34353},"Check out our on-demand webinar for everything you need to know about infostealers and session hijacking","https://pushsecurity.com/resources/video/infostealers-webinar-ondemand/",{"items":34384},[],{},"How infostealers fuel breaches with stolen creds and cookies","2024-07-31T00:00:00.000Z",{"items":34389},[34390,34971,35477],{"__typename":1544,"sys":34391,"content":34392,"title":34957,"synopsis":34958,"hashTags":59,"publishedDate":34959,"slug":34960,"tagsCollection":34961,"authorsCollection":34967},{"id":31749},{"json":34393},{"data":34394,"content":34395,"nodeType":1522},{},[34396,34416,34435,34442,34448,34455,34462,34469,34476,34485,34504,34511,34518,34525,34531,34538,34570,34577,34584,34591,34598,34604,34611,34618,34625,34656,34662,34669,34676,34707,34713,34720,34727,34734,34741,34747,34753,34760,34767,34774,34780,34787,34794,34801,34808,34827,34843,34849,34856,34863,34869,34876,34895,34901,34908,34935,34942,34949],{"data":34397,"content":34398,"nodeType":866},{},[34399,34403,34412],{"data":34400,"marks":34401,"value":34402,"nodeType":865},{},[],"It’s been well reported that ",{"data":34404,"content":34406,"nodeType":905},{"uri":34405},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/",[34407],{"data":34408,"marks":34409,"value":34411,"nodeType":865},{},[34410],{"type":1070},"identity attacks are on the rise",{"data":34413,"marks":34414,"value":34415,"nodeType":865},{},[],", and constantly evolving phishing tools and techniques are a big part of this. In particular, the increasing prevalence of MFA has led to AitM phishing attacks becoming much more common. The threat intelligence industry naturally wants to locate and shutdown all the phishing servers – but the phishers are fighting back.",{"data":34417,"content":34418,"nodeType":866},{},[34419,34423,34431],{"data":34420,"marks":34421,"value":34422,"nodeType":865},{},[],"Before we dive into how AitM phishing kits evade detection, you should check out our earlier blog post on ‘",{"data":34424,"content":34425,"nodeType":905},{"uri":18895},[34426],{"data":34427,"marks":34428,"value":34430,"nodeType":865},{},[34429],{"type":1070},"Phishing 2.0 – how phishing toolkits are evolving with AitM",{"data":34432,"marks":34433,"value":34434,"nodeType":865},{},[],"’ if you want to get up to speed with what these toolkits are, and why attackers are using them more regularly. ",{"data":34436,"content":34437,"nodeType":866},{},[34438],{"data":34439,"marks":34440,"value":34441,"nodeType":865},{},[],"In this blog post, we’re going to look at a recent instance of the NakedPages AitM phishing toolkit and some of the steps it takes to frustrate detection and analysis. In particular, we’ll look at how malicious activity is obfuscated through the use of legitimate SaaS services. NakedPages uses a range of different techniques and so serves as a good case study as to how AitM toolkits are being designed to evade detection.",{"data":34443,"content":34447,"nodeType":875},{"target":34444},{"sys":34445},{"id":34446,"type":872,"linkType":873},"2Qcn2nNRXVkdqqxGO8lDZf",[],{"data":34449,"content":34450,"nodeType":866},{},[34451],{"data":34452,"marks":34453,"value":34454,"nodeType":865},{},[],"Before we dive in, it’s useful to keep in mind that while there is a lot of complication here, most of this happens in seconds and is transparent to the intended victim accessing from a real browser.",{"data":34456,"content":34457,"nodeType":889},{},[34458],{"data":34459,"marks":34460,"value":34461,"nodeType":865},{},[],"Step 1: Cloudflare Workers for the initial gateway",{"data":34463,"content":34464,"nodeType":866},{},[34465],{"data":34466,"marks":34467,"value":34468,"nodeType":865},{},[],"A key feature of the NakedPages kit is that it has several stages and redirections and, in order for it to operate as intended, the target has to arrive at the beginning. The first step involves visiting a URL that is simply a Cloudflare Worker. Cloudflare Workers are a serverless execution environment, a bit like AWS lambdas.",{"data":34470,"content":34471,"nodeType":866},{},[34472],{"data":34473,"marks":34474,"value":34475,"nodeType":865},{},[],"The benefit to the attacker is that this gives them a highly reputable primary domain as it is one owned and operated by Cloudflare. Flagging recently registered or uncategorized/rare domains for further analysis won’t work for this. For example, the URL used in this instance was the following:",{"data":34477,"content":34478,"nodeType":866},{},[34479],{"data":34480,"marks":34481,"value":34484,"nodeType":865},{},[34482],{"type":34483},"code","hxxps://226028cc.502f135e3e036e726fba22d4.workers.dev",{"data":34486,"content":34487,"nodeType":866},{},[34488,34492,34501],{"data":34489,"marks":34490,"value":34491,"nodeType":865},{},[],"For other examples of Cloudflare Workers being abused for phishing, ",{"data":34493,"content":34495,"nodeType":905},{"uri":34494},"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/its-raining-phish-and-scams-how-cloudflare-pages-dev-and-workers-dev-domains-get-abused/",[34496],{"data":34497,"marks":34498,"value":34500,"nodeType":865},{},[34499],{"type":1070},"check out this blog post from Trustwave",{"data":34502,"marks":34503,"value":1193,"nodeType":865},{},[],{"data":34505,"content":34506,"nodeType":889},{},[34507],{"data":34508,"marks":34509,"value":34510,"nodeType":865},{},[],"Step 2: Cloudflare Turnstile for bot detection",{"data":34512,"content":34513,"nodeType":866},{},[34514],{"data":34515,"marks":34516,"value":34517,"nodeType":865},{},[],"The only purpose of the Cloudflare Worker is to act as a bot gateway to prevent automated analysis getting further than this point. For this it uses Cloudflare Turnstile. Turnstile is a highly effective tool for detecting the difference between bots and human users as a replacement for CAPTCHAs used by websites across the world. ",{"data":34519,"content":34520,"nodeType":866},{},[34521],{"data":34522,"marks":34523,"value":34524,"nodeType":865},{},[],"If it doesn’t work transparently then you’ll probably see something like this:",{"data":34526,"content":34530,"nodeType":875},{"target":34527},{"sys":34528},{"id":34529,"type":872,"linkType":873},"4XNxLbiZf3xUK1WeFDjjxl",[],{"data":34532,"content":34533,"nodeType":866},{},[34534],{"data":34535,"marks":34536,"value":34537,"nodeType":865},{},[],"However, who else wants to keep out the bots? Well, phishers of course! There are many sandbox environments and other automated platforms out there, visiting every URL they come across in the search for malicious behavior. This stops many of them in their tracks as they never get past the Turnstile check. ",{"data":34539,"content":34540,"nodeType":866},{},[34541,34545,34554,34558,34567],{"data":34542,"marks":34543,"value":34544,"nodeType":865},{},[],"Malicious use of Turnstile use has become much more common now. Examples include other criminal kits ",{"data":34546,"content":34548,"nodeType":905},{"uri":34547},"https://blog.sekoia.io/tycoon-2fa-an-in-depth-analysis-of-the-latest-version-of-the-aitm-phishing-kit/",[34549],{"data":34550,"marks":34551,"value":34553,"nodeType":865},{},[34552],{"type":1070},"such as Tycoon",{"data":34555,"marks":34556,"value":34557,"nodeType":865},{},[],", as well as ",{"data":34559,"content":34561,"nodeType":905},{"uri":34560},"https://fin3ss3g0d.net/index.php/2024/04/08/evilgophishs-approach-to-advanced-bot-detection-with-cloudflare-turnstile/",[34562],{"data":34563,"marks":34564,"value":34566,"nodeType":865},{},[34565],{"type":1070},"open-source phishing tools focused on red teaming",{"data":34568,"marks":34569,"value":6352,"nodeType":865},{},[],{"data":34571,"content":34572,"nodeType":889},{},[34573],{"data":34574,"marks":34575,"value":34576,"nodeType":865},{},[],"Step 3: Required URL parameters and custom auth headers",{"data":34578,"content":34579,"nodeType":866},{},[34580],{"data":34581,"marks":34582,"value":34583,"nodeType":865},{},[],"If you get past Turnstile, then you’ll finally be redirected to a more conventionally suspicious domain. However, you’ll need to supply the correct URL parameters and headers, or that request might behave differently. ",{"data":34585,"content":34586,"nodeType":866},{},[34587],{"data":34588,"marks":34589,"value":34590,"nodeType":865},{},[],"Suspicious domains can be found and interrogated through other means, such as observing new domain registrations or certificate transparency logs. In this case, the phishers add other steps involving required URL parameters and custom headers. This means that a defender who knows the domain name can’t discover the malicious behavior just by making a simple HTTP(S) request to the domain.",{"data":34592,"content":34593,"nodeType":866},{},[34594],{"data":34595,"marks":34596,"value":34597,"nodeType":865},{},[],"The following code snippet shows how this operates. Bonus points for spotting how they actually forgot to implement their own RSA encryption function and instead send their “encrypted” user agents in clear text:",{"data":34599,"content":34603,"nodeType":875},{"target":34600},{"sys":34601},{"id":34602,"type":872,"linkType":873},"45aif31bot9phquQPkz20p",[],{"data":34605,"content":34606,"nodeType":889},{},[34607],{"data":34608,"marks":34609,"value":34610,"nodeType":865},{},[],"Step 4: Requiring JavaScript execution",{"data":34612,"content":34613,"nodeType":866},{},[34614],{"data":34615,"marks":34616,"value":34617,"nodeType":865},{},[],"Another aspect of the previous step is that it requires JavaScript to execute. That means defensive techniques that simply make HTTP(S) requests and scrape content will not automatically be able to follow the link without allowing JavaScript execution. This forces the use of dynamic sandbox techniques that actually load a DOM, as it’s almost impossible for static analysis to generically solve this problem.",{"data":34619,"content":34620,"nodeType":889},{},[34621],{"data":34622,"marks":34623,"value":34624,"nodeType":865},{},[],"Step 5: Redirecting to legitimate domains",{"data":34626,"content":34627,"nodeType":866},{},[34628,34632,34640,34644,34653],{"data":34629,"marks":34630,"value":34631,"nodeType":865},{},[],"Attackers will also redirect to legitimate domains to mask their activity. Let’s say a defender has visited the attacker’s malicious domain without executing JavaScript or supplying the correct URL parameters. The attacker doesn’t want to activate their malicious phishing behavior at this point, so they need to do something benign instead. In this case, they simply redirect to ",{"data":34633,"content":34635,"nodeType":905},{"uri":34634},"https://example.com",[34636],{"data":34637,"marks":34638,"value":34634,"nodeType":865},{},[34639],{"type":1070},{"data":34641,"marks":34642,"value":34643,"nodeType":865},{},[],". Interestingly, ",{"data":34645,"content":34647,"nodeType":905},{"uri":34646},"https://www.youtube.com/watch?v=-W-LxcbUxI4&t=643s",[34648],{"data":34649,"marks":34650,"value":34652,"nodeType":865},{},[34651],{"type":1070},"EvilProxy has also been seen redirecting to example.com too",{"data":34654,"marks":34655,"value":31349,"nodeType":865},{},[],{"data":34657,"content":34661,"nodeType":875},{"target":34658},{"sys":34659},{"id":34660,"type":872,"linkType":873},"450Y7W1uXVkKSps5y0xhBe",[],{"data":34663,"content":34664,"nodeType":889},{},[34665],{"data":34666,"marks":34667,"value":34668,"nodeType":865},{},[],"Step 6: HTTP referer header masking",{"data":34670,"content":34671,"nodeType":866},{},[34672],{"data":34673,"marks":34674,"value":34675,"nodeType":865},{},[],"Maintainers of legitimate websites often look at the HTTP referer header to see where they are being linked from. This is often a critical task for businesses, particularly for things like marketing. However, what if employees spot strange redirects coming in from suspicious looking domains like the ones used by this phishing kit? Perhaps they might investigate those domains and/or tip off relevant security vendors and organizations. ",{"data":34677,"content":34678,"nodeType":866},{},[34679,34683,34691,34695,34703],{"data":34680,"marks":34681,"value":34682,"nodeType":865},{},[],"Unless, of course, you were to use a service to mask the HTTP referrer – which is exactly what the phishing kit does in this case. NakedPages makes use of ",{"data":34684,"content":34686,"nodeType":905},{"uri":34685},"https://href.li/",[34687],{"data":34688,"marks":34689,"value":34685,"nodeType":865},{},[34690],{"type":1070},{"data":34692,"marks":34693,"value":34694,"nodeType":865},{},[]," as a service to strip the referral to ensure the redirection is performed anonymously. Rather conveniently, it seems the default example that ",{"data":34696,"content":34698,"nodeType":905},{"uri":34697},"https://href.li",[34699],{"data":34700,"marks":34701,"value":34697,"nodeType":865},{},[34702],{"type":1070},{"data":34704,"marks":34705,"value":34706,"nodeType":865},{},[]," uses is… example.com:",{"data":34708,"content":34712,"nodeType":875},{"target":34709},{"sys":34710},{"id":34711,"type":872,"linkType":873},"78xFQwTG1r0YWGJ24iEdYP",[],{"data":34714,"content":34715,"nodeType":889},{},[34716],{"data":34717,"marks":34718,"value":34719,"nodeType":865},{},[],"Step 7: Loading balanced domains",{"data":34721,"content":34722,"nodeType":866},{},[34723],{"data":34724,"marks":34725,"value":34726,"nodeType":865},{},[],"You’re probably thinking: Step 7? Surely, if a victim’s browser has finally made it this far then the attackers would just serve up the malicious phishing content at this point, right? Well, we aren’t quite done yet. These initial gateway servers are one of the most important components to keep undetected, as existing phishing campaigns and (as yet unread) emails will be leading to them.",{"data":34728,"content":34729,"nodeType":866},{},[34730],{"data":34731,"marks":34732,"value":34733,"nodeType":865},{},[],"Once we get to the more obviously malicious phishing activity, there is a higher chance of detection and user reports. In this case the phishing kit actually retrieves a new URL to redirect to, along with a suitable JWT authentication parameter. The benefit of this is that when URLs/hostnames get flagged as malicious, blocked or otherwise taken down, the phishing kit can just redirect to other hostnames, and the attacker’s can keep updating with new URLs over time. ",{"data":34735,"content":34736,"nodeType":866},{},[34737],{"data":34738,"marks":34739,"value":34740,"nodeType":865},{},[],"Below we can see an example of the response containing a URL, with a JWT auth parameter:",{"data":34742,"content":34746,"nodeType":875},{"target":34743},{"sys":34744},{"id":34745,"type":872,"linkType":873},"4NpH7V5oEdTASNNJsqCJ47",[],{"data":34748,"content":34752,"nodeType":875},{"target":34749},{"sys":34750},{"id":34751,"type":872,"linkType":873},"7oqkrhNXtyOlJMEz0BZyLo",[],{"data":34754,"content":34755,"nodeType":866},{},[34756],{"data":34757,"marks":34758,"value":34759,"nodeType":865},{},[],"Automating this request in this example brings back around 20 different primary domains used for the final phishing attack. These domains are rotated over time as some are blocked and new ones are created.",{"data":34761,"content":34762,"nodeType":889},{},[34763],{"data":34764,"marks":34765,"value":34766,"nodeType":865},{},[],"Step 8: Breaking login page signatures",{"data":34768,"content":34769,"nodeType":866},{},[34770],{"data":34771,"marks":34772,"value":34773,"nodeType":865},{},[],"If all the previous checks have passed then a victim user is finally presented with a phishing page. The attacker has most closely emulated the sign-on page for live.com for Outlook in this case, though it also has some aspects from a business Microsoft login too, as we can see in the examples below:",{"data":34775,"content":34779,"nodeType":875},{"target":34776},{"sys":34777},{"id":34778,"type":872,"linkType":873},"2Ez0fgAlmkrisdQGWfL6CV",[],{"data":34781,"content":34782,"nodeType":866},{},[34783],{"data":34784,"marks":34785,"value":34786,"nodeType":865},{},[],"However, one obvious change can be seen in the HTML title in the tab header. This normally says something like “Sign in to Outlook” or “Sign in to your account”. In this case, the phishing kit has randomized the HTML title. \n\nOne super easy way to detect websites pretending to be common login pages that have 1:1 cloned the website or are performing full reverse proxy AiTM techniques would be to search for obvious HTML content like this. Not many legitimate websites should have an HTML title of “Sign in to Outlook” other than Microsoft’s own legitimate domains for it, right?",{"data":34788,"content":34789,"nodeType":866},{},[34790],{"data":34791,"marks":34792,"value":34793,"nodeType":865},{},[],"Taking a closer look, we’ll see that the HTML, DOM and JavaScript etc. differ quite significantly from the true login pages, even if the visual appearance is very similar. One reason for this is to make it harder for defenders to simply signature on specific aspects of commonly spoofed login pages.",{"data":34795,"content":34796,"nodeType":889},{},[34797],{"data":34798,"marks":34799,"value":34800,"nodeType":865},{},[],"Step 9: B2B targeting",{"data":34802,"content":34803,"nodeType":866},{},[34804],{"data":34805,"marks":34806,"value":34807,"nodeType":865},{},[],"The final interesting aspect of this particular example is that it modifies its behavior during the login process depending on whether a personal Microsoft account or an organization account is used.",{"data":34809,"content":34810,"nodeType":866},{},[34811,34815,34823],{"data":34812,"marks":34813,"value":34814,"nodeType":865},{},[],"When entering an email address associated with a personal Microsoft account, or picking ‘personal account’ when prompted after entering an email address that is used for both purposes, the server will return a 302 redirect and send the user to ",{"data":34816,"content":34818,"nodeType":905},{"uri":34817},"https://login.live.com/",[34819],{"data":34820,"marks":34821,"value":34817,"nodeType":865},{},[34822],{"type":1070},{"data":34824,"marks":34825,"value":34826,"nodeType":865},{},[]," where they can then re-enter their credentials and login to Microsoft legitimately if they continue. This reduces the potential for detection further as no AitM phishing login will actually occur.",{"data":34828,"content":34829,"nodeType":866},{},[34830,34834,34839],{"data":34831,"marks":34832,"value":34833,"nodeType":865},{},[],"On the other hand, when using an organization account the phishing process continues as expected. ",{"data":34835,"marks":34836,"value":34838,"nodeType":865},{},[34837],{"type":887},"This phishing campaign is exclusively targeting corp accounts",{"data":34840,"marks":34841,"value":34842,"nodeType":865},{},[]," and you could almost say it has a B2B (or is that A2B?) rather than B2C business model.  ",{"data":34844,"content":34845,"nodeType":889},{},[34846],{"data":34847,"marks":34848,"value":12274,"nodeType":865},{},[],{"data":34850,"content":34851,"nodeType":866},{},[34852],{"data":34853,"marks":34854,"value":34855,"nodeType":865},{},[],"As you may have guessed from the extremely suspicious domains in use and examples of sloppy coding (like forgetting to implement an encryption function) the NakedPages kit is far from sophisticated. Despite this, the tricks that attackers are using to make detection and analysis more difficult seem to be quite effective when used in a layered model. ",{"data":34857,"content":34858,"nodeType":866},{},[34859],{"data":34860,"marks":34861,"value":34862,"nodeType":865},{},[],"For example, at the time of writing this particular Worker had been up for at least two days and was currently only triggering 1 detection on VirusTotal. ",{"data":34864,"content":34868,"nodeType":875},{"target":34865},{"sys":34866},{"id":34867,"type":872,"linkType":873},"1mIOpDtmgcMasK6dEhRHsm",[],{"data":34870,"content":34871,"nodeType":866},{},[34872],{"data":34873,"marks":34874,"value":34875,"nodeType":865},{},[],"One key takeaway is that it’s near impossible to stay on top of all the phishing servers on the internet. Even the untargeted mass campaigns will initially be missed by TI feeds, let alone the targeted ones. ",{"data":34877,"content":34878,"nodeType":866},{},[34879,34883,34891],{"data":34880,"marks":34881,"value":34882,"nodeType":865},{},[],"The best foot forward for resilience against these attacks is through the use of domain-bound MFA methods like WebAuthn. Common MFA methods like OTPs, SMS, push notifications etc. are routinely bypassed using ",{"data":34884,"content":34885,"nodeType":905},{"uri":18895},[34886],{"data":34887,"marks":34888,"value":34890,"nodeType":865},{},[34889],{"type":1070},"AitM techniques that proxy the MFA authentication as well",{"data":34892,"marks":34893,"value":34894,"nodeType":865},{},[],". Even if you are one of the few who use phishing-resistant MFA methods like WebAuthn or other passkeys, the devil is in the detail and we’ve seen MFA downgrade attacks being used to bypass them by choosing a phishable method that’s also active.",{"data":34896,"content":34900,"nodeType":875},{"target":34897},{"sys":34898},{"id":34899,"type":872,"linkType":873},"17lSgRFD6fDzRUn9eOHJg6",[],{"data":34902,"content":34903,"nodeType":889},{},[34904],{"data":34905,"marks":34906,"value":34907,"nodeType":865},{},[],"P.S. How did we detect this?",{"data":34909,"content":34910,"nodeType":866},{},[34911,34915,34920,34924,34932],{"data":34912,"marks":34913,"value":34914,"nodeType":865},{},[],"After all that, you might be wondering how we managed to automate a process to generically pass through all these detection evasion techniques – ",{"data":34916,"marks":34917,"value":34919,"nodeType":865},{},[34918],{"type":887},"well the short answer is: We didn’t.",{"data":34921,"marks":34922,"value":34923,"nodeType":865},{},[]," Instead, we detected the act of an employee ",{"data":34925,"content":34926,"nodeType":905},{"uri":7228},[34927],{"data":34928,"marks":34929,"value":34931,"nodeType":865},{},[34930],{"type":1070},"attempting to put their Microsoft password into a website that wasn’t Microsoft",{"data":34933,"marks":34934,"value":1193,"nodeType":865},{},[],{"data":34936,"content":34937,"nodeType":866},{},[34938],{"data":34939,"marks":34940,"value":34941,"nodeType":865},{},[],"The TTP for phishing is effectively “trick someone into putting their valid credentials into the wrong site” – so detecting that behavior directly (the action of entering a legit password into the wrong site) can be a lot simpler and more effective than playing the cat-and-mouse detection → detection-evasion game.",{"data":34943,"content":34944,"nodeType":866},{},[34945],{"data":34946,"marks":34947,"value":34948,"nodeType":865},{},[],"Having said that, if you’re interested, here are the domain IOCs for this campaign:",{"data":34950,"content":34951,"nodeType":866},{},[34952],{"data":34953,"marks":34954,"value":34956,"nodeType":865},{},[34955],{"type":34483},"226028cc[.]502f135e3e036e726fba22d4[.]workers[.]dev\nacevoorgukmembership[.]buzz\nalerteditorroyalsocietyorgnz[.]buzz\nandymarshallsgeniuslocidigestghostiomghostio[.]buzz\nblogresponseinsperitycom[.]buzz\ncampaigneventbritecomnoreply[.]buzz\ncharityexcellencer1technologytrustnewsorg[.]buzz\nclerkenwelldesignweekcomnoreply[.]buzz\nconfirminfothetrainlinecomauto[.]buzz\nhealthestatejournalcomnoreply[.]buzz\nmentalhealthdesignandbuildcomnoreply[.]buzz\nnoreplynotificationswhoopcom[.]buzz\nstepexhibitionscomeventsupport[.]buzz\ntheathletice1theathleticcom[.]buzz\nthekakahoonssubstackcom[.]buzz","How AitM phishing kits evade detection","Taking a closer look at the steps that AitM phishing kits take to hide from the prying eyes of security teams and threat intelligence vendors.","2024-07-23T00:00:00.000Z","how-aitm-phishing-kits-evade-detection",{"items":34962},[34963,34965],{"sys":34964,"name":342},{"id":3008},{"sys":34966,"name":2144},{"id":2143},{"items":34968},[34969],{"fullName":13458,"firstName":13459,"jobTitle":13460,"profilePicture":34970},{"url":13462},{"__typename":1544,"sys":34972,"content":34974,"title":35463,"synopsis":35464,"hashTags":59,"publishedDate":35465,"slug":35466,"tagsCollection":35467,"authorsCollection":35473},{"id":34973},"6Uvqu6LcWzOVfA9mxtu841",{"json":34975},{"data":34976,"content":34977,"nodeType":1522},{},[34978,34984,34991,35024,35031,35051,35058,35104,35111,35118,35125,35131,35138,35225,35232,35239,35262,35269,35276,35283,35290,35297,35303,35353,35360,35366,35384,35390,35397,35404,35411,35418,35425,35432,35439,35445],{"data":34979,"content":34983,"nodeType":875},{"target":34980},{"sys":34981},{"id":34982,"type":872,"linkType":873},"2HffP4X7owzpfj41jnzXmV",[],{"data":34985,"content":34986,"nodeType":866},{},[34987],{"data":34988,"marks":34989,"value":34990,"nodeType":865},{},[],"To detect session token theft, you need three things:",{"data":34992,"content":34993,"nodeType":2718},{},[34994,35004,35014],{"data":34995,"content":34996,"nodeType":2654},{},[34997],{"data":34998,"content":34999,"nodeType":866},{},[35000],{"data":35001,"marks":35002,"value":35003,"nodeType":865},{},[],"Robust logs that provide an identifier to help tie activity to a specific session",{"data":35005,"content":35006,"nodeType":2654},{},[35007],{"data":35008,"content":35009,"nodeType":866},{},[35010],{"data":35011,"marks":35012,"value":35013,"nodeType":865},{},[],"A well-oiled SOC to correlate observed activity in those logs",{"data":35015,"content":35016,"nodeType":2654},{},[35017],{"data":35018,"content":35019,"nodeType":866},{},[35020],{"data":35021,"marks":35022,"value":35023,"nodeType":865},{},[],"And telemetry to tie those logs to a trusted endpoint",{"data":35025,"content":35026,"nodeType":866},{},[35027],{"data":35028,"marks":35029,"value":35030,"nodeType":865},{},[],"The only problem? That third thing didn’t really exist. So we created it.",{"data":35032,"content":35033,"nodeType":866},{},[35034,35038,35047],{"data":35035,"marks":35036,"value":35037,"nodeType":865},{},[],"In this article, we’ll cover how Push’s recently released ",{"data":35039,"content":35041,"nodeType":905},{"uri":35040},"https://pushsecurity.com/help/10114#start",[35042],{"data":35043,"marks":35044,"value":35046,"nodeType":865},{},[35045],{"type":1070},"session theft detection",{"data":35048,"marks":35049,"value":35050,"nodeType":865},{},[]," feature works, why we built it, and why the unique control point provided by a browser agent unlocks new capabilities for blue teams fighting the effects of infostealer malware and other stolen credential-based attacks.",{"data":35052,"content":35053,"nodeType":889},{},[35054],{"data":35055,"marks":35056,"value":35057,"nodeType":865},{},[],"(You probably already know) Why this matters",{"data":35059,"content":35060,"nodeType":866},{},[35061,35065,35074,35078,35087,35091,35100],{"data":35062,"marks":35063,"value":35064,"nodeType":865},{},[],"Session token theft is a ",{"data":35066,"content":35068,"nodeType":905},{"uri":35067},"https://owasp.org/www-community/attacks/Session_hijacking_attack",[35069],{"data":35070,"marks":35071,"value":35073,"nodeType":865},{},[35072],{"type":1070},"session hijacking",{"data":35075,"marks":35076,"value":35077,"nodeType":865},{},[]," technique where endpoint malware is used to extract sessions from an endpoint, and until recently it was ",{"data":35079,"content":35081,"nodeType":905},{"uri":35080},"https://www.microsoft.com/en-us/security/blog/2022/11/16/token-tactics-how-to-prevent-detect-and-respond-to-cloud-token-theft/",[35082],{"data":35083,"marks":35084,"value":35086,"nodeType":865},{},[35085],{"type":1070},"relatively rare",{"data":35088,"marks":35089,"value":35090,"nodeType":865},{},[],". It’s easier to ",{"data":35092,"content":35094,"nodeType":905},{"uri":35093},"https://pushsecurity.com/blog/what-is-credential-stuffing/",[35095],{"data":35096,"marks":35097,"value":35099,"nodeType":865},{},[35098],{"type":1070},"gain access via a password",{"data":35101,"marks":35102,"value":35103,"nodeType":865},{},[]," than it is to steal a session cookie. ",{"data":35105,"content":35106,"nodeType":866},{},[35107],{"data":35108,"marks":35109,"value":35110,"nodeType":865},{},[],"But there’s an inverse relationship between session-based attacks and MFA adoption. As MFA becomes widespread, adversaries turn to new effective methods of initial entry.",{"data":35112,"content":35113,"nodeType":866},{},[35114],{"data":35115,"marks":35116,"value":35117,"nodeType":865},{},[],"An increasingly common approach involves the use of infostealer malware, which can extract saved credentials, browser cookies, cryptowallets, and other valuable data from the infected endpoint.",{"data":35119,"content":35120,"nodeType":866},{},[35121],{"data":35122,"marks":35123,"value":35124,"nodeType":865},{},[],"Using stolen tokens, adversaries don’t need to bypass MFA directly. They can simply import the tokens into their browser and assume an already authorized session.",{"data":35126,"content":35130,"nodeType":875},{"target":35127},{"sys":35128},{"id":35129,"type":872,"linkType":873},"66B5MBFIhbmky7VuLGbuM3",[],{"data":35132,"content":35133,"nodeType":866},{},[35134],{"data":35135,"marks":35136,"value":35137,"nodeType":865},{},[],"A few recent stats show the scope of the problem:",{"data":35139,"content":35140,"nodeType":2718},{},[35141,35162,35184,35205],{"data":35142,"content":35143,"nodeType":2654},{},[35144],{"data":35145,"content":35146,"nodeType":866},{},[35147,35151,35159],{"data":35148,"marks":35149,"value":35150,"nodeType":865},{},[],"Nearly half of the malware detected last year by Sophos targeted victims’ data specifically, and the majority of that malware was classified as infostealers. Source: ",{"data":35152,"content":35153,"nodeType":905},{"uri":30356},[35154],{"data":35155,"marks":35156,"value":35158,"nodeType":865},{},[35157],{"type":1070},"2024 Sophos Threat Report",{"data":35160,"marks":35161,"value":21,"nodeType":865},{},[],{"data":35163,"content":35164,"nodeType":2654},{},[35165],{"data":35166,"content":35167,"nodeType":866},{},[35168,35172,35181],{"data":35169,"marks":35170,"value":35171,"nodeType":865},{},[],"Information-stealing malware accounted for nearly 10 percent of activity that Red Canary was able to associate with named threats last year. They also found a rise in stealer malware targeting macOS compared to previous years. Source: ",{"data":35173,"content":35175,"nodeType":905},{"uri":35174},"https://redcanary.com/threat-detection-report/trends/info-stealers/",[35176],{"data":35177,"marks":35178,"value":35180,"nodeType":865},{},[35179],{"type":1070},"2024 Red Canary Threat Detection Report",{"data":35182,"marks":35183,"value":21,"nodeType":865},{},[],{"data":35185,"content":35186,"nodeType":2654},{},[35187],{"data":35188,"content":35189,"nodeType":866},{},[35190,35194,35202],{"data":35191,"marks":35192,"value":35193,"nodeType":865},{},[],"Stolen credentials continued to rank as the top initial access method for breaches analyzed by Verizon. Source: ",{"data":35195,"content":35196,"nodeType":905},{"uri":10411},[35197],{"data":35198,"marks":35199,"value":35201,"nodeType":865},{},[35200],{"type":1070},"2024 Data Breach Investigations Report",{"data":35203,"marks":35204,"value":21,"nodeType":865},{},[],{"data":35206,"content":35207,"nodeType":2654},{},[35208],{"data":35209,"content":35210,"nodeType":866},{},[35211,35215,35222],{"data":35212,"marks":35213,"value":35214,"nodeType":865},{},[],"The number of token replay attacks is increasing, with Microsoft detecting 147,000 attacks in 2023, a 111% increase year-over-year. Source: ",{"data":35216,"content":35217,"nodeType":905},{"uri":33371},[35218],{"data":35219,"marks":35220,"value":35221,"nodeType":865},{},[],"Microsoft Blog",{"data":35223,"marks":35224,"value":21,"nodeType":865},{},[],{"data":35226,"content":35227,"nodeType":889},{},[35228],{"data":35229,"marks":35230,"value":35231,"nodeType":865},{},[],"What's missing from current defenses",{"data":35233,"content":35234,"nodeType":866},{},[35235],{"data":35236,"marks":35237,"value":35238,"nodeType":865},{},[],"When defending against infostealer malware or other forms of session and credential theft, there are a few common challenges that organizations may face:",{"data":35240,"content":35241,"nodeType":2718},{},[35242,35252],{"data":35243,"content":35244,"nodeType":2654},{},[35245],{"data":35246,"content":35247,"nodeType":866},{},[35248],{"data":35249,"marks":35250,"value":35251,"nodeType":865},{},[],"Their endpoint security tooling doesn’t provide complete coverage across their device fleet, though they thought it did.",{"data":35253,"content":35254,"nodeType":2654},{},[35255],{"data":35256,"content":35257,"nodeType":866},{},[35258],{"data":35259,"marks":35260,"value":35261,"nodeType":865},{},[],"The malware is good enough to evade EDR detection, or it was able to execute and exfiltrate sessions or other data before it was stopped.",{"data":35263,"content":35264,"nodeType":866},{},[35265],{"data":35266,"marks":35267,"value":35268,"nodeType":865},{},[],"Existing approaches to detecting stolen sessions also pose a noisy problem. Relying on IP-based or geolocation-based signals can result in frequent false positives. (And not all identity provider logs include a session identifier that you can use to perform correlations in the first place.)",{"data":35270,"content":35271,"nodeType":866},{},[35272],{"data":35273,"marks":35274,"value":35275,"nodeType":865},{},[],"The missing piece is a trusted signal for legitimate sessions that you can use to correlate with other data in order to identify unexpected activity that indicates a compromised identity and device.",{"data":35277,"content":35278,"nodeType":889},{},[35279],{"data":35280,"marks":35281,"value":35282,"nodeType":865},{},[],"Generating unique telemetry via the browser",{"data":35284,"content":35285,"nodeType":866},{},[35286],{"data":35287,"marks":35288,"value":35289,"nodeType":865},{},[],"Push’s solution to detecting stolen sessions falls into the category of “so simple, why didn’t this already exist?”",{"data":35291,"content":35292,"nodeType":866},{},[35293],{"data":35294,"marks":35295,"value":35296,"nodeType":865},{},[],"The answer: Because you need to be in the browser to do it. The Push browser agent sits in a unique position that we can leverage to provide telemetry that otherwise would be extremely difficult to create.",{"data":35298,"content":35299,"nodeType":866},{},[35300],{"data":35301,"marks":35302,"value":31139,"nodeType":865},{},[],{"data":35304,"content":35305,"nodeType":2718},{},[35306,35316,35326],{"data":35307,"content":35308,"nodeType":2654},{},[35309],{"data":35310,"content":35311,"nodeType":866},{},[35312],{"data":35313,"marks":35314,"value":35315,"nodeType":865},{},[],"Via the Push browser agent, Push injects a unique marker into the user agent string of sessions that occur in browsers enrolled in Push.",{"data":35317,"content":35318,"nodeType":2654},{},[35319],{"data":35320,"content":35321,"nodeType":866},{},[35322],{"data":35323,"marks":35324,"value":35325,"nodeType":865},{},[],"Administrators then add the list of domains where they wish to inject the marker into sessions, such as an identity provider like Okta or Microsoft.",{"data":35327,"content":35328,"nodeType":2654},{},[35329],{"data":35330,"content":35331,"nodeType":866},{},[35332,35336,35340,35344,35349],{"data":35333,"marks":35334,"value":35335,"nodeType":865},{},[],"By analyzing logs from the IdP, you can identify activity from the same session that both ",{"data":35337,"marks":35338,"value":14249,"nodeType":865},{},[35339],{"type":2757},{"data":35341,"marks":35342,"value":35343,"nodeType":865},{},[]," the Push marker and that ",{"data":35345,"marks":35346,"value":35348,"nodeType":865},{},[35347],{"type":2757},"lacks",{"data":35350,"marks":35351,"value":35352,"nodeType":865},{},[]," the marker. This can only ever happen when a session is extracted from a browser and maliciously imported into a different browser.",{"data":35354,"content":35355,"nodeType":866},{},[35356],{"data":35357,"marks":35358,"value":35359,"nodeType":865},{},[],"This is a high-fidelity signal that a stolen session token is in use.",{"data":35361,"content":35365,"nodeType":875},{"target":35362},{"sys":35363},{"id":35364,"type":872,"linkType":873},"3zQamWSaZFIbMUhQZtM2II",[],{"data":35367,"content":35368,"nodeType":866},{},[35369,35373,35381],{"data":35370,"marks":35371,"value":35372,"nodeType":865},{},[],"Learn more about configuring this feature in our ",{"data":35374,"content":35375,"nodeType":905},{"uri":35040},[35376],{"data":35377,"marks":35378,"value":35380,"nodeType":865},{},[35379],{"type":1070},"Help Center",{"data":35382,"marks":35383,"value":1193,"nodeType":865},{},[],{"data":35385,"content":35389,"nodeType":875},{"target":35386},{"sys":35387},{"id":35388,"type":872,"linkType":873},"35dpGqNY6cTM0fSQRflLiO",[],{"data":35391,"content":35392,"nodeType":889},{},[35393],{"data":35394,"marks":35395,"value":35396,"nodeType":865},{},[],"Unlocking new capabilities for blue teams",{"data":35398,"content":35399,"nodeType":866},{},[35400],{"data":35401,"marks":35402,"value":35403,"nodeType":865},{},[],"As we’ve said before, we see browser telemetry and browser-based controls as the missing piece in security strategies to stop identity attacks — particularly for modern organizations with complex identity ecosystems that span IdPs, SaaS apps, OAuth-connected apps, and more.",{"data":35405,"content":35406,"nodeType":866},{},[35407],{"data":35408,"marks":35409,"value":35410,"nodeType":865},{},[],"Where the browser agent approach particularly shines is that it’s application-agnostic. ",{"data":35412,"content":35413,"nodeType":866},{},[35414],{"data":35415,"marks":35416,"value":35417,"nodeType":865},{},[],"As long as the app you want to monitor provides robust logs, you can inject the Push-supplied marker into any session on any app. ",{"data":35419,"content":35420,"nodeType":866},{},[35421],{"data":35422,"marks":35423,"value":35424,"nodeType":865},{},[],"This allows you to detect suspicious activity even on internal corporate assets, such as an intranet. ",{"data":35426,"content":35427,"nodeType":866},{},[35428],{"data":35429,"marks":35430,"value":35431,"nodeType":865},{},[],"A tidy side effect is that you can also use this feature to identify unmanaged devices accessing sensitive corporate internal resources because they will lack the Push browser agent-supplied marker.",{"data":35433,"content":35434,"nodeType":866},{},[35435],{"data":35436,"marks":35437,"value":35438,"nodeType":865},{},[],"There are probably a few other creative use cases for this feature, so we look forward to seeing what you come up with!",{"data":35440,"content":35441,"nodeType":889},{},[35442],{"data":35443,"marks":35444,"value":15168,"nodeType":865},{},[],{"data":35446,"content":35447,"nodeType":866},{},[35448,35452,35459],{"data":35449,"marks":35450,"value":35451,"nodeType":865},{},[],"To see Push in action, ",{"data":35453,"content":35454,"nodeType":905},{"uri":3686},[35455],{"data":35456,"marks":35457,"value":1517,"nodeType":865},{},[35458],{"type":1070},{"data":35460,"marks":35461,"value":35462,"nodeType":865},{},[],". We’ll be happy to show you this feature, along with how we discover all the apps your employees are using, even the ones not behind SSO, and how we detect vulnerable identities and stop identity attacks with browser-based controls.","Introducing session token theft detection: Why browser is best","Push's browser agent identifies session token theft by adding telemetry to the user agent string to create a new high-fidelity signal for your security team.","2024-06-25T00:00:00.000Z","introducing-session-token-theft-detection-why-browser-is-best",{"items":35468},[35469,35471],{"sys":35470,"name":342},{"id":3008},{"sys":35472,"name":31284},{"id":31283},{"items":35474},[35475],{"fullName":9643,"firstName":9644,"jobTitle":9645,"profilePicture":35476},{"url":9647},{"__typename":1544,"sys":35478,"content":35479,"title":36300,"synopsis":36301,"hashTags":59,"publishedDate":36302,"slug":36303,"tagsCollection":36304,"authorsCollection":36310},{"id":32387},{"json":35480},{"data":35481,"content":35482,"nodeType":1522},{},[35483,35490,35497,35504,35534,35541,35548,35565,35572,35579,35597,35604,35611,35618,35624,35631,35674,35681,35688,35695,35718,35725,35732,35739,35787,35794,35801,35808,35815,35827,35834,35842,35849,35882,35889,35896,35903,35910,35971,35979,35986,35993,36027,36034,36042,36049,36056,36068,36084,36116,36134,36141,36158,36165,36172,36190,36197,36204,36211,36244,36251,36270,36288,36294],{"data":35484,"content":35485,"nodeType":866},{},[35486],{"data":35487,"marks":35488,"value":35489,"nodeType":865},{},[],"Identity attacks like phishing, credential stuffing, and session hijacking are now the leading cause of cyber security breaches, as attackers shift their attention to the sprawl of third-party applications and services that has become the backbone of business IT. ",{"data":35491,"content":35492,"nodeType":866},{},[35493],{"data":35494,"marks":35495,"value":35496,"nodeType":865},{},[],"The attacker’s goal in these attacks is account takeover: logging into a user account to access your company app tenant. From there, the attacker can usually achieve all of their objectives from inside the compromised app, usually involving dumping sensitive data with which to hold the company to ransom, or selling the data on underground criminal marketplaces. ",{"data":35498,"content":35499,"nodeType":866},{},[35500],{"data":35501,"marks":35502,"value":35503,"nodeType":865},{},[],"These attack techniques have been commonplace for over a decade — but the shift in attack context away from attacking endpoints (user devices and servers) to cloud services is seeing something of an identity attack renaissance. ",{"data":35505,"content":35506,"nodeType":866},{},[35507,35510,35517,35521,35530],{"data":35508,"marks":35509,"value":21,"nodeType":865},{},[],{"data":35511,"content":35512,"nodeType":905},{"uri":9104},[35513],{"data":35514,"marks":35515,"value":395,"nodeType":865},{},[35516],{"type":1070},{"data":35518,"marks":35519,"value":35520,"nodeType":865},{},[]," are one of the leading factors in successful ",{"data":35522,"content":35524,"nodeType":905},{"uri":35523},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/credential_stuffing/description.md",[35525],{"data":35526,"marks":35527,"value":35529,"nodeType":865},{},[35528],{"type":1070},"credential stuffing",{"data":35531,"marks":35532,"value":35533,"nodeType":865},{},[]," attacks driving account takeover.",{"data":35535,"content":35536,"nodeType":889},{},[35537],{"data":35538,"marks":35539,"value":35540,"nodeType":865},{},[],"Ghost logins 101",{"data":35542,"content":35543,"nodeType":866},{},[35544],{"data":35545,"marks":35546,"value":35547,"nodeType":865},{},[],"Simply put, ghost logins are often-forgotten alternative login methods that are tricky for security teams to manage and secure — because they don’t know about them. Because of this, they’re likely to possess weak configurations that make them susceptible to account takeover attacks. ",{"data":35549,"content":35550,"nodeType":866},{},[35551,35555,35562],{"data":35552,"marks":35553,"value":35554,"nodeType":865},{},[],"We found that ",{"data":35556,"content":35557,"nodeType":905},{"uri":6333},[35558],{"data":35559,"marks":35560,"value":35561,"nodeType":865},{},[],"ghost logins are present in ~10% of the accounts per organization",{"data":35563,"marks":35564,"value":6352,"nodeType":865},{},[],{"data":35566,"content":35567,"nodeType":2315},{},[35568],{"data":35569,"marks":35570,"value":35571,"nodeType":865},{},[],"Why do ghost logins exist?",{"data":35573,"content":35574,"nodeType":866},{},[35575],{"data":35576,"marks":35577,"value":35578,"nodeType":865},{},[],"Identity management used to be something that was centrally contained and managed using an enterprise identity service like Active Directory. Most users probably only had one or two identities that you really cared about: the one they used to log into their company laptop and domain, and maybe also to log into a VPN. ",{"data":35580,"content":35581,"nodeType":866},{},[35582,35586,35593],{"data":35583,"marks":35584,"value":35585,"nodeType":865},{},[],"Now, there are ",{"data":35587,"content":35588,"nodeType":905},{"uri":6333},[35589],{"data":35590,"marks":35591,"value":35592,"nodeType":865},{},[],"200+ business apps in use per company, creating 1000s of sprawled identities",{"data":35594,"marks":35595,"value":35596,"nodeType":865},{},[]," across an ecosystem of business apps and services accessed over the internet.",{"data":35598,"content":35599,"nodeType":866},{},[35600],{"data":35601,"marks":35602,"value":35603,"nodeType":865},{},[],"Most businesses have tried to solve this problem with single sign on (SSO). The logic being that if you can use a single set of credentials (and therefore, a single identity) to access all of your business apps, and then secure those credentials with MFA, then this problem goes away. However…",{"data":35605,"content":35606,"nodeType":2315},{},[35607],{"data":35608,"marks":35609,"value":35610,"nodeType":865},{},[],"SSO expectations versus reality",{"data":35612,"content":35613,"nodeType":866},{},[35614],{"data":35615,"marks":35616,"value":35617,"nodeType":865},{},[],"Unfortunately, the reality of SSO implementation is flawed. Most apps accept multiple login methods that can be configured — and used — simultaneously (yes, most apps don’t have proper session controls).  ",{"data":35619,"content":35623,"nodeType":875},{"target":35620},{"sys":35621},{"id":35622,"type":872,"linkType":873},"3sOz3HkiyJpY9nFtGCWEOV",[],{"data":35625,"content":35626,"nodeType":866},{},[35627],{"data":35628,"marks":35629,"value":35630,"nodeType":865},{},[],"This is made worse by the fact that:",{"data":35632,"content":35633,"nodeType":2718},{},[35634,35644,35654,35664],{"data":35635,"content":35636,"nodeType":2654},{},[35637],{"data":35638,"content":35639,"nodeType":866},{},[35640],{"data":35641,"marks":35642,"value":35643,"nodeType":865},{},[],"Most apps can't be locked down to restrict which login methods are accepted.",{"data":35645,"content":35646,"nodeType":2654},{},[35647],{"data":35648,"content":35649,"nodeType":866},{},[35650],{"data":35651,"marks":35652,"value":35653,"nodeType":865},{},[],"Users often self-adopt apps, and default to a username and password (and typically miss out MFA). ",{"data":35655,"content":35656,"nodeType":2654},{},[35657],{"data":35658,"content":35659,"nodeType":866},{},[35660],{"data":35661,"marks":35662,"value":35663,"nodeType":865},{},[],"SSO isn’t always possible if you aren’t using a supported IdP — and only one in three apps support SAML, the preferred enterprise-grade protocol.",{"data":35665,"content":35666,"nodeType":2654},{},[35667],{"data":35668,"content":35669,"nodeType":866},{},[35670],{"data":35671,"marks":35672,"value":35673,"nodeType":865},{},[],"Even where SSO is possible, configuring an app for SSO doesn't automatically delete any legacy local logins.",{"data":35675,"content":35676,"nodeType":866},{},[35677],{"data":35678,"marks":35679,"value":35680,"nodeType":865},{},[],"Inevitably, this means that there are many situations in which users will create local accounts — typically with a username and password, and without MFA. This is how ghost logins are born.",{"data":35682,"content":35683,"nodeType":2315},{},[35684],{"data":35685,"marks":35686,"value":35687,"nodeType":865},{},[],"How are ghost logins created? ",{"data":35689,"content":35690,"nodeType":866},{},[35691],{"data":35692,"marks":35693,"value":35694,"nodeType":865},{},[],"Ghost logins can be created in the following ways:",{"data":35696,"content":35697,"nodeType":2718},{},[35698,35708],{"data":35699,"content":35700,"nodeType":2654},{},[35701],{"data":35702,"content":35703,"nodeType":866},{},[35704],{"data":35705,"marks":35706,"value":35707,"nodeType":865},{},[],"A user self-adopts an app, setting up an account with a local username and password. The app is later adopted companywide and brought under SSO. This creates an additional SSO login method, likely as the default, but the local login will continue to exist unless explicitly disabled or deleted. ",{"data":35709,"content":35710,"nodeType":2654},{},[35711],{"data":35712,"content":35713,"nodeType":866},{},[35714],{"data":35715,"marks":35716,"value":35717,"nodeType":865},{},[],"Secondary/backup login methods can often be added later in the app settings after logging in. This includes things like setting up a secondary email to send a login link to, or setting up API access to remove the need to authenticate altogether. ",{"data":35719,"content":35720,"nodeType":866},{},[35721],{"data":35722,"marks":35723,"value":35724,"nodeType":865},{},[],"So, ghost logins are very easily introduced through the normal course of app adoption and use by employees. ",{"data":35726,"content":35727,"nodeType":2315},{},[35728],{"data":35729,"marks":35730,"value":35731,"nodeType":865},{},[],"Why do ghost logins pose a risk? ",{"data":35733,"content":35734,"nodeType":866},{},[35735],{"data":35736,"marks":35737,"value":35738,"nodeType":865},{},[],"Ghost logins pose a risk for a number of reasons, as they: ",{"data":35740,"content":35741,"nodeType":2718},{},[35742,35757,35772],{"data":35743,"content":35744,"nodeType":2654},{},[35745],{"data":35746,"content":35747,"nodeType":866},{},[35748,35753],{"data":35749,"marks":35750,"value":35752,"nodeType":865},{},[35751],{"type":887},"Typically have less secure configurations ",{"data":35754,"marks":35755,"value":35756,"nodeType":865},{},[],"than your preferred login method – and may be missing key controls like MFA.  ",{"data":35758,"content":35759,"nodeType":2654},{},[35760],{"data":35761,"content":35762,"nodeType":866},{},[35763,35768],{"data":35764,"marks":35765,"value":35767,"nodeType":865},{},[35766],{"type":887},"Are effectively shadow logins",{"data":35769,"marks":35770,"value":35771,"nodeType":865},{},[]," – IT/security don’t know about them, and if using an IdP as your primary identity security interface, they won’t necessarily be visible without taking a deeper look at individual apps. ",{"data":35773,"content":35774,"nodeType":2654},{},[35775],{"data":35776,"content":35777,"nodeType":866},{},[35778,35783],{"data":35779,"marks":35780,"value":35782,"nodeType":865},{},[35781],{"type":887},"Can be used simultaneously with SSO",{"data":35784,"marks":35785,"value":35786,"nodeType":865},{},[]," – so you can have an unrestricted number of concurrent sessions with SSO and non SSO logins active at the same time, without the user being kicked out of the previous session.",{"data":35788,"content":35789,"nodeType":866},{},[35790],{"data":35791,"marks":35792,"value":35793,"nodeType":865},{},[],"Ghost logins provide opportunities for attackers to bypass security controls for initial access and persistence in an application (which we’ll come onto in more detail later). They also provide an opportunity for malicious insiders, e.g. a disgruntled employee, to access systems even after SSO access is revoked. If the security team relies on IdP logs to audit app logins, these accounts can go undetected.",{"data":35795,"content":35796,"nodeType":866},{},[35797],{"data":35798,"marks":35799,"value":35800,"nodeType":865},{},[],"To be able to identify them, you’d need to log into the app admin dashboard. But depending on how the app was adopted, you (as a security admin) may not even be an app-level admin — it’s not unusual for individual teams to administer their own apps. And even if you do have access, it’s not always easy (or possible) to gather this level of information about user account configuration. ",{"data":35802,"content":35803,"nodeType":866},{},[35804],{"data":35805,"marks":35806,"value":35807,"nodeType":865},{},[],"It’s very easy to see how these vulnerable login methods can be overlooked by security teams – let’s look at how they can be identified and exploited by attackers. ",{"data":35809,"content":35810,"nodeType":889},{},[35811],{"data":35812,"marks":35813,"value":35814,"nodeType":865},{},[],"How can ghost logins be exploited by attackers?",{"data":35816,"content":35817,"nodeType":866},{},[35818,35823],{"data":35819,"marks":35820,"value":35822,"nodeType":865},{},[35821],{"type":887},"Let’s take an example scenario:",{"data":35824,"marks":35825,"value":35826,"nodeType":865},{},[]," You’re using an IdP solution like Okta or Microsoft/Entra with SAML SSO as the default login method for your core business apps. Via your IdP you require MFA when authenticating to your IdP apps page, and also potentially when signing into an individual connected app. ",{"data":35828,"content":35829,"nodeType":866},{},[35830],{"data":35831,"marks":35832,"value":35833,"nodeType":865},{},[],"However, you only recently introduced your IdP solution, and your users previously accessed this app with a local username and password. Although you asked your users to configure MFA in the app itself, not all of them did. And when you deployed your IdP solution, you didn’t manually unset all the local password-based logins for the apps you connected to it. ",{"data":35835,"content":35836,"nodeType":866},{},[35837],{"data":35838,"marks":35839,"value":35841,"nodeType":865},{},[35840],{"type":887},"Unknown to you, there are now hundreds of local accounts for core business apps which lack MFA. ",{"data":35843,"content":35844,"nodeType":866},{},[35845],{"data":35846,"marks":35847,"value":35848,"nodeType":865},{},[],"There are two main scenarios in which ghost logins can be utilized by an attacker:",{"data":35850,"content":35851,"nodeType":2718},{},[35852,35867],{"data":35853,"content":35854,"nodeType":2654},{},[35855],{"data":35856,"content":35857,"nodeType":866},{},[35858,35863],{"data":35859,"marks":35860,"value":35862,"nodeType":865},{},[35861],{"type":887},"To bypass robustly configured login methods",{"data":35864,"marks":35865,"value":35866,"nodeType":865},{},[]," such as SSO to compromise an app identity during the initial access phase of an attack. ",{"data":35868,"content":35869,"nodeType":2654},{},[35870],{"data":35871,"content":35872,"nodeType":866},{},[35873,35878],{"data":35874,"marks":35875,"value":35877,"nodeType":865},{},[35876],{"type":887},"To create additional login methods for an already compromised account to ensure persistent access",{"data":35879,"marks":35880,"value":35881,"nodeType":865},{},[]," – even if the original compromised login method is revoked or disabled. This could be either the result of compromising an identity belonging to a specific app, or having previously compromised an IdP account (e.g. Okta).",{"data":35883,"content":35884,"nodeType":866},{},[35885],{"data":35886,"marks":35887,"value":35888,"nodeType":865},{},[],"Let's look at these use cases in more detail. ",{"data":35890,"content":35891,"nodeType":2315},{},[35892],{"data":35893,"marks":35894,"value":35895,"nodeType":865},{},[],"Ghost logins for initial access",{"data":35897,"content":35898,"nodeType":866},{},[35899],{"data":35900,"marks":35901,"value":35902,"nodeType":865},{},[],"Arguably the most dangerous use case for ghost logins is to conduct credential attacks against accounts using a username and password. Logins with a weak or guessable password, or a reused password that has appeared in a public data breach dump, are primed for account takeover. ",{"data":35904,"content":35905,"nodeType":866},{},[35906],{"data":35907,"marks":35908,"value":35909,"nodeType":865},{},[],"The cyber crime ecosystem is leaning toward the theft, sale, and use of stolen credentials (not just emails and passwords, but session tokens too). ",{"data":35911,"content":35912,"nodeType":2718},{},[35913,35933,35952],{"data":35914,"content":35915,"nodeType":2654},{},[35916],{"data":35917,"content":35918,"nodeType":866},{},[35919,35923,35930],{"data":35920,"marks":35921,"value":35922,"nodeType":865},{},[],"There are 600 million identity attacks per day, with 99% involving passwords (",{"data":35924,"content":35925,"nodeType":905},{"uri":30378},[35926],{"data":35927,"marks":35928,"value":7564,"nodeType":865},{},[35929],{"type":1070},{"data":35931,"marks":35932,"value":13320,"nodeType":865},{},[],{"data":35934,"content":35935,"nodeType":2654},{},[35936],{"data":35937,"content":35938,"nodeType":866},{},[35939,35942,35949],{"data":35940,"marks":35941,"value":33389,"nodeType":865},{},[],{"data":35943,"content":35944,"nodeType":905},{"uri":30313},[35945],{"data":35946,"marks":35947,"value":10417,"nodeType":865},{},[35948],{"type":1070},{"data":35950,"marks":35951,"value":13320,"nodeType":865},{},[],{"data":35953,"content":35954,"nodeType":2654},{},[35955],{"data":35956,"content":35957,"nodeType":866},{},[35958,35961,35968],{"data":35959,"marks":35960,"value":33327,"nodeType":865},{},[],{"data":35962,"content":35963,"nodeType":905},{"uri":33330},[35964],{"data":35965,"marks":35966,"value":33336,"nodeType":865},{},[35967],{"type":1070},{"data":35969,"marks":35970,"value":13320,"nodeType":865},{},[],{"data":35972,"content":35973,"nodeType":866},{},[35974],{"data":35975,"marks":35976,"value":35978,"nodeType":865},{},[35977],{"type":887},"So, it’s easier than ever for attackers to gather breached credentials and weaponize them at scale. ",{"data":35980,"content":35981,"nodeType":866},{},[35982],{"data":35983,"marks":35984,"value":35985,"nodeType":865},{},[],"Realistically, any username and password combination for addresses belonging to a specific organization/domain can be attempted on any app. Breached credential data will often provide a strong indicator of other apps also in use for that organization. And for apps with a custom tenant URL (that cannot be easily guessed) data dumps often helpfully include the URLs for those login pages, too.  ",{"data":35987,"content":35988,"nodeType":866},{},[35989],{"data":35990,"marks":35991,"value":35992,"nodeType":865},{},[],"The risk posed by the massive amounts of leaked credentials available is heightened because: ",{"data":35994,"content":35995,"nodeType":2718},{},[35996,36017],{"data":35997,"content":35998,"nodeType":2654},{},[35999],{"data":36000,"content":36001,"nodeType":866},{},[36002,36006,36013],{"data":36003,"marks":36004,"value":36005,"nodeType":865},{},[],"Many employees reuse passwords, with ",{"data":36007,"content":36008,"nodeType":905},{"uri":6333},[36009],{"data":36010,"marks":36011,"value":36012,"nodeType":865},{},[],"~9% of all accounts using a breached, weak, or reused password",{"data":36014,"marks":36015,"value":36016,"nodeType":865},{},[],". This isn’t just for low-risk apps either, and includes the reuse of highly sensitive IdP creds. ",{"data":36018,"content":36019,"nodeType":2654},{},[36020],{"data":36021,"content":36022,"nodeType":866},{},[36023],{"data":36024,"marks":36025,"value":36026,"nodeType":865},{},[],"Organizations don’t typically rotate or enforce changes to SaaS app passwords in the same way they might for company account/device login connected to Active Directory.  ",{"data":36028,"content":36029,"nodeType":866},{},[36030],{"data":36031,"marks":36032,"value":36033,"nodeType":865},{},[],"Ghost logins aren’t limited to just username and password either. For example, a breached social account such as Facebook or Google can result in a broader compromise if those accounts have been connected to any corporate apps.   ",{"data":36035,"content":36036,"nodeType":866},{},[36037],{"data":36038,"marks":36039,"value":36041,"nodeType":865},{},[36040],{"type":887},"So, exploiting ghost logins can be a highly effective method for attackers to gain initial access to a user account from which to launch further attacks.  ",{"data":36043,"content":36044,"nodeType":2315},{},[36045],{"data":36046,"marks":36047,"value":36048,"nodeType":865},{},[],"Ghost logins for persistence and defense evasion",{"data":36050,"content":36051,"nodeType":866},{},[36052],{"data":36053,"marks":36054,"value":36055,"nodeType":865},{},[],"Now, we’ll take a look at how attackers can leverage ghost logins as part of the later stages of an attack, having already established an initial foothold via account compromise. ",{"data":36057,"content":36058,"nodeType":866},{},[36059,36063],{"data":36060,"marks":36061,"value":36062,"nodeType":865},{},[],"If an organization has a reasonable level of security monitoring in-place (depending on log availability from the particular app vendor), or a victim receives a notification about an unusual login (e.g. from a new device or unusual IP) then access to an account can be short-lived. ",{"data":36064,"marks":36065,"value":36067,"nodeType":865},{},[36066],{"type":887},"However, ghost logins can provide attackers with the tools to maintain persistent access to a compromised account, even if the initial compromised login method is disabled or revoked. ",{"data":36069,"content":36070,"nodeType":866},{},[36071,36075,36080],{"data":36072,"marks":36073,"value":36074,"nodeType":865},{},[],"For example, if a social login is used to access an account, an adversary may be able to configure a separate username/password login, or even (though much less commonly) connect a second social account that the adversary controls. This allows the adversary to maintain persistent access to the user account ",{"data":36076,"marks":36077,"value":36079,"nodeType":865},{},[36078],{"type":887},"even in the event of password changes or MFA changes",{"data":36081,"marks":36082,"value":36083,"nodeType":865},{},[],". The attack will go unnoticed if the victim organization relies on SSO logs for auditing access to SaaS applications because the attack bypasses SSO, as the login remains local to the SaaS app or, in the case of an OIDC SSO login, the adversary’s own social account.",{"data":36085,"content":36086,"nodeType":866},{},[36087,36091,36100,36104,36113],{"data":36088,"marks":36089,"value":36090,"nodeType":865},{},[],"Another quirk is that it’s common for ordinary users to become app-level admins when an app is self-adopted by an individual or team. If an attacker is able to gain control of such an account, it can then be used to target other users without needing to deliver phishing links by hijacking SAML-based authentication. In this scenario, users attempting to sign in using SAML SSO are directed it to an attacker-controlled tenant in a watering hole attack (also known as ",{"data":36092,"content":36094,"nodeType":905},{"uri":36093},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/samljacking/description.md",[36095],{"data":36096,"marks":36097,"value":36099,"nodeType":865},{},[36098],{"type":1070},"SAMLjacking",{"data":36101,"marks":36102,"value":36103,"nodeType":865},{},[],", which you can ",{"data":36105,"content":36107,"nodeType":905},{"uri":36106},"https://pushsecurity.com/blog/samljacking-a-poisoned-tenant/",[36108],{"data":36109,"marks":36110,"value":36112,"nodeType":865},{},[36111],{"type":1070},"read more about in another blog post",{"data":36114,"marks":36115,"value":11843,"nodeType":865},{},[],{"data":36117,"content":36118,"nodeType":866},{},[36119,36123,36131],{"data":36120,"marks":36121,"value":36122,"nodeType":865},{},[],"If you're curious as to how an attacker might be able to compromise an IdP account such as Okta, ",{"data":36124,"content":36125,"nodeType":905},{"uri":18895},[36126],{"data":36127,"marks":36128,"value":36130,"nodeType":865},{},[36129],{"type":1070},"you should check out our blog post on AitM and BitM phishing techniques",{"data":36132,"marks":36133,"value":14512,"nodeType":865},{},[],{"data":36135,"content":36136,"nodeType":889},{},[36137],{"data":36138,"marks":36139,"value":36140,"nodeType":865},{},[],"Case study: Snowflake",{"data":36142,"content":36143,"nodeType":866},{},[36144,36147,36154],{"data":36145,"marks":36146,"value":1061,"nodeType":865},{},[],{"data":36148,"content":36149,"nodeType":905},{"uri":2708},[36150],{"data":36151,"marks":36152,"value":36153,"nodeType":865},{},[],"recent attacks on 165 Snowflake customers",{"data":36155,"marks":36156,"value":36157,"nodeType":865},{},[],", resulting in hundreds of millions of breached customer records, were the product of a credential stuffing campaign using stolen credentials from infostealer infections dating back to 2020. ",{"data":36159,"content":36160,"nodeType":866},{},[36161],{"data":36162,"marks":36163,"value":36164,"nodeType":865},{},[],"The industry response to Snowflake was typical: check whether Snowflake has been set up for SSO, and if so, job done — we’re protected by MFA.",{"data":36166,"content":36167,"nodeType":866},{},[36168],{"data":36169,"marks":36170,"value":36171,"nodeType":865},{},[],"The reality was that MFA was not — and could not — be centrally enforced for username and password accounts. Even if MFA was applied at the IdP level for SSO logins, it was not enforced for local username and password logins. It needed to be opted-into by the user. ",{"data":36173,"content":36174,"nodeType":866},{},[36175,36179,36187],{"data":36176,"marks":36177,"value":36178,"nodeType":865},{},[],"This meant the most logical thing to do was to disable local accounts. But because Snowflake is essentially a cloud-hosted SQL database, there was no easy-to-use GUI to access local account config data. Once you’d managed to get an admin account with the right permissions, you needed to run various commands to find and unset the accounts. ",{"data":36180,"content":36182,"nodeType":905},{"uri":36181},"https://pushsecurity.com/resources/video/demonstrating-ghost-logins-in-snowflake-and-how-to-remediate-them/",[36183],{"data":36184,"marks":36185,"value":36186,"nodeType":865},{},[],"But if you didn’t have the exact type of admin account, misleading results would be returned — and even after you had fixed the vulnerability it took hours to update the database. ",{"data":36188,"marks":36189,"value":21,"nodeType":865},{},[],{"data":36191,"content":36192,"nodeType":866},{},[36193],{"data":36194,"marks":36195,"value":36196,"nodeType":865},{},[],"This meant that organizations were exposed to these attacks for a prolonged period, and were left uncertain as to whether they had addressed the vulnerabilities or not. ",{"data":36198,"content":36199,"nodeType":889},{},[36200],{"data":36201,"marks":36202,"value":36203,"nodeType":865},{},[],"Using Push to find and fix ghost logins across your app inventory",{"data":36205,"content":36206,"nodeType":866},{},[36207],{"data":36208,"marks":36209,"value":36210,"nodeType":865},{},[],"Finding and fixing ghost logins is a challenge for most organizations. Since you can’t rely on the view provided by your IdP, you need to:",{"data":36212,"content":36213,"nodeType":2718},{},[36214,36224,36234],{"data":36215,"content":36216,"nodeType":2654},{},[36217],{"data":36218,"content":36219,"nodeType":866},{},[36220],{"data":36221,"marks":36222,"value":36223,"nodeType":865},{},[],"Discover the apps in use across your organization",{"data":36225,"content":36226,"nodeType":2654},{},[36227],{"data":36228,"content":36229,"nodeType":866},{},[36230],{"data":36231,"marks":36232,"value":36233,"nodeType":865},{},[],"Get admin rights, audit each app, and unset any local credentials (enforcing MFA at the app-level too if you can, for good measure)",{"data":36235,"content":36236,"nodeType":2654},{},[36237],{"data":36238,"content":36239,"nodeType":866},{},[36240],{"data":36241,"marks":36242,"value":36243,"nodeType":865},{},[],"Configure the app to prevent local accounts being created (again, if possible)",{"data":36245,"content":36246,"nodeType":866},{},[36247],{"data":36248,"marks":36249,"value":36250,"nodeType":865},{},[],"Not only is this a sisyphean task with continually moving goalposts, but depending on which apps you use, and how they’ve been designed, it may not be possible to remediate every instance of ghost logins. For that reason, it’s important to also invest in your identity threat detection and response capabilities — for when, not if, an account takeover attempt occurs. ",{"data":36252,"content":36253,"nodeType":866},{},[36254,36258,36267],{"data":36255,"marks":36256,"value":36257,"nodeType":865},{},[],"Push helps organizations to defend against ghost logins and other identity threats with a defense-in-depth approach: Using a browser-based agent to generate visibility of all logins (not just via IdP logs) while also detecting, intercepting, and shutting down account takeover attempts via phishing, credential stuffing, and session hijacking. ",{"data":36259,"content":36261,"nodeType":905},{"uri":36260},"https://pushsecurity.com/",[36262],{"data":36263,"marks":36264,"value":36266,"nodeType":865},{},[36265],{"type":1070},"Learn more here.",{"data":36268,"marks":36269,"value":21,"nodeType":865},{},[],{"data":36271,"content":36272,"nodeType":866},{},[36273,36277,36285],{"data":36274,"marks":36275,"value":36276,"nodeType":865},{},[],"And if you'd like to learn more about ghost logins and other identity attack techniques, ",{"data":36278,"content":36280,"nodeType":905},{"uri":36279},"https://github.com/pushsecurity/saas-attacks?tab=readme-ov-file",[36281],{"data":36282,"marks":36283,"value":36284,"nodeType":865},{},[],"check out the SaaS attack matrix on GitHub",{"data":36286,"marks":36287,"value":6352,"nodeType":865},{},[],{"data":36289,"content":36293,"nodeType":875},{"target":36290},{"sys":36291},{"id":36292,"type":872,"linkType":873},"1VMpMgZvx9hgps2OoxCTmF",[],{"data":36295,"content":36296,"nodeType":866},{},[36297],{"data":36298,"marks":36299,"value":21,"nodeType":865},{},[],"Ghost logins: When forgotten identities come back to haunt you","How ghost logins can be used by cyber attackers for account takeover and persistence.","2024-07-10T00:00:00.000Z","ghost-logins-when-forgotten-identities-come-back-to-haunt-you",{"items":36305},[36306,36308],{"sys":36307,"name":2144},{"id":2143},{"sys":36309,"name":342},{"id":3008},{"items":36311},[36312],{"fullName":3012,"firstName":3013,"jobTitle":3014,"profilePicture":36313},{"url":3016},"what-the-rise-of-infostealers-says-about-identity-attacks","blog/what-the-rise-of-infostealers-says-about-identity-attacks",{"json":36317},{"data":36318,"content":36319,"nodeType":1522},{},[36320],{"data":36321,"content":36322,"nodeType":866},{},[36323],{"data":36324,"marks":36325,"value":36326,"nodeType":865},{},[],"Infostealers seem to have become an overnight celebrity, having been previously shrugged off by enterprises with bigger fish to fry. The reality is that infostealers haven’t necessarily changed – but the world that they inhabit and how stolen data is used has.  ","What the rise in popularity of infostealers tells us about the cybercrime ecosystem and the shift toward identity attacks. ",{"id":36329,"publishedAt":36330},"4OrixXXLxRmSDxa7PF9gfM","2026-08-12T11:55:07.366Z",{"items":36332},[36333,36335],{"sys":36334,"name":2144},{"id":2143},{"sys":36336,"name":342},{"id":3008},{"items":36338},[36339,36341,36343,36345,36347,36349,36351,36353,36355,36357,36359,36361,36363,36365,36367,36369,36371,36373,36375],{"sys":36340,"name":279,"slug":280,"tier":31},{"id":276},{"sys":36342,"name":413,"slug":414,"tier":31},{"id":410},{"sys":36344,"name":642,"slug":643,"tier":31},{"id":639},{"sys":36346,"name":342,"slug":343,"tier":31},{"id":339},{"sys":36348,"name":519,"slug":520,"tier":31},{"id":516},{"sys":36350,"name":422,"slug":423,"tier":45},{"id":419},{"sys":36352,"name":333,"slug":334,"tier":45},{"id":330},{"sys":36354,"name":404,"slug":405,"tier":45},{"id":401},{"sys":36356,"name":571,"slug":572,"tier":45},{"id":568},{"sys":36358,"name":395,"slug":396,"tier":45},{"id":392},{"sys":36360,"name":448,"slug":449,"tier":45},{"id":445},{"sys":36362,"name":377,"slug":378,"tier":45},{"id":374},{"sys":36364,"name":528,"slug":529,"tier":45},{"id":525},{"sys":36366,"name":440,"slug":441,"tier":45},{"id":437},{"sys":36368,"name":502,"slug":503,"tier":45},{"id":499},{"sys":36370,"name":457,"slug":458,"tier":45},{"id":454},{"sys":36372,"name":537,"slug":538,"tier":45},{"id":534},{"sys":36374,"name":633,"slug":634,"tier":45},{"id":630},{"sys":36376,"name":607,"slug":608,"tier":45},{"id":604},"boUmh78SvCFSf6ZZgGkEQDAnKYwTjYN1VqCF_IIHTHc",{"id":36379,"title":36380,"authorsCollection":36381,"content":36386,"extension":228,"faqItemsCollection":39347,"faqTitle":59,"featured":6,"hashTags":59,"meta":39349,"metaTitle":39350,"ogImage":39351,"postType":7494,"publishedDate":39353,"relatedBlogPostsCollection":39354,"slug":40166,"stem":40167,"subtitle":59,"summary":40168,"synopsis":40183,"sys":40184,"tagsCollection":40187,"topicsCollection":40193,"__hash__":40235},"blog/blog/identity-attacks-in-the-wild.json","Tracking identity-based attacks in the wild",{"items":36382},[36383],{"fullName":3012,"firstName":3013,"jobTitle":3014,"socialLinks":36384,"profilePicture":36385},[6742],{"url":3016},{"json":36387,"links":39334},{"data":36388,"content":36389,"nodeType":1522},{},[36390,36397,36429,36436,36442,36449,36469,36492,36499,36506,36531,36547,36554,36566,36573,36576,36583,36590,36606,36618,36629,36659,36662,36669,36687,36694,36702,36794,36801,36937,36944,37062,37069,37076,37249,37256,37263,37346,37349,37356,37363,37370,37433,37440,37473,37480,37523,37529,37535,37771,37777,37785,37792,37795,37802,37809,37816,37869,37876,37919,37926,37959,37965,37971,38137,38143,38151,38158,38166,38173,38181,38188,38191,38198,38205,38212,38275,38282,38315,38322,38355,38361,38367,38473,38476,38483,38490,38497,38560,38567,38600,38607,38640,38646,38652,38827,38830,38837,38844,38851,38924,38931,38964,38971,39004,39010,39016,39248,39251,39258,39265,39272,39279,39282,39289,39296,39303,39306,39313,39320,39327],{"data":36391,"content":36392,"nodeType":889},{},[36393],{"data":36394,"marks":36395,"value":36396,"nodeType":865},{},[],"Browser-based Identity attacks on the rise?",{"data":36398,"content":36399,"nodeType":866},{},[36400,36404,36413,36417,36426],{"data":36401,"marks":36402,"value":36403,"nodeType":865},{},[],"Identity has been recorded as the #1 cyber attack vector since forever. You don’t have to look particularly hard to find statistics to support this. In 2023, one source reports that ",{"data":36405,"content":36407,"nodeType":905},{"uri":36406},"https://www.csoonline.com/article/648894/identity-based-security-threats-are-growing-rapidly-report.html",[36408],{"data":36409,"marks":36410,"value":36412,"nodeType":865},{},[36411],{"type":1070},"4/5 breaches involved identity and compromised credentials",{"data":36414,"marks":36415,"value":36416,"nodeType":865},{},[],", while another suggests that ",{"data":36418,"content":36420,"nodeType":905},{"uri":36419},"https://rakgarg.substack.com/p/identity-crisis-the-biggest-prize",[36421],{"data":36422,"marks":36423,"value":36425,"nodeType":865},{},[36424],{"type":1070},"75% of breaches are caused by mismanaged identity, access, or privileges",{"data":36427,"marks":36428,"value":1193,"nodeType":865},{},[],{"data":36430,"content":36431,"nodeType":866},{},[36432],{"data":36433,"marks":36434,"value":36435,"nodeType":865},{},[],"Phishing, social engineering, credential stuffing, and business email compromise have morphed into a homogenous understanding of identity threats that are generally tackled through a combination of email security tooling, content access controls, and user awareness. ",{"data":36437,"content":36441,"nodeType":875},{"target":36438},{"sys":36439},{"id":36440,"type":872,"linkType":873},"5NRWvCl0xsoWcpgHbcQIkf",[],{"data":36443,"content":36444,"nodeType":866},{},[36445],{"data":36446,"marks":36447,"value":36448,"nodeType":865},{},[],"The fact that such attacks have been reported as the top security threat for so long probably means that people pay less attention to identity threats. Ransomware grabs the headlines, and rightly so in many cases, but phishing feels like a “known known” that we have a plan for (even if the plan often fails). ",{"data":36450,"content":36451,"nodeType":866},{},[36452,36456,36465],{"data":36453,"marks":36454,"value":36455,"nodeType":865},{},[],"In fact, there’s a problem with messaging generally. The ",{"data":36457,"content":36459,"nodeType":905},{"uri":36458},"https://www.verizon.com/business/resources/T78/reports/data-breach-investigation-report_2015.pdf",[36460],{"data":36461,"marks":36462,"value":36464,"nodeType":865},{},[36463],{"type":1070},"2015 Verizon DBIR",{"data":36466,"marks":36467,"value":36468,"nodeType":865},{},[]," contains plenty of stats that still ring largely true today. For example:",{"data":36470,"content":36471,"nodeType":2718},{},[36472,36482],{"data":36473,"content":36474,"nodeType":2654},{},[36475],{"data":36476,"content":36477,"nodeType":866},{},[36478],{"data":36479,"marks":36480,"value":36481,"nodeType":865},{},[],"In the 2013 DBIR, phishing was associated with over 95% of incidents attributed to state sponsored actors, and for two years running, more than two-thirds of incidents have featured phishing",{"data":36483,"content":36484,"nodeType":2654},{},[36485],{"data":36486,"content":36487,"nodeType":866},{},[36488],{"data":36489,"marks":36490,"value":36491,"nodeType":865},{},[],"In 60% of cases, attackers are able to compromise an organization within minutes",{"data":36493,"content":36494,"nodeType":866},{},[36495],{"data":36496,"marks":36497,"value":36498,"nodeType":865},{},[],"Remove the dates and a lot of the report still stands up. ",{"data":36500,"content":36501,"nodeType":2315},{},[36502],{"data":36503,"marks":36504,"value":36505,"nodeType":865},{},[],"Bad then, worse now",{"data":36507,"content":36508,"nodeType":866},{},[36509,36513,36518,36522,36527],{"data":36510,"marks":36511,"value":36512,"nodeType":865},{},[],"But browser-based identity attacks ",{"data":36514,"marks":36515,"value":36517,"nodeType":865},{},[36516],{"type":887},"are",{"data":36519,"marks":36520,"value":36521,"nodeType":865},{},[]," worse than they used to be. Yes, credential stuffing, phishing, and SIM swapping may not be the most sophisticated attacks, but they remain as effective as ever. ",{"data":36523,"marks":36524,"value":36526,"nodeType":865},{},[36525],{"type":2757},"As the saying goes, if it ain’t broke — don’t fix it.",{"data":36528,"marks":36529,"value":36530,"nodeType":865},{},[]," ",{"data":36532,"content":36533,"nodeType":866},{},[36534,36538,36543],{"data":36535,"marks":36536,"value":36537,"nodeType":865},{},[],"Recent attacks have moved toward a broader targeting of the ",{"data":36539,"marks":36540,"value":36542,"nodeType":865},{},[36541],{"type":887},"identity infrastructure",{"data":36544,"marks":36545,"value":36546,"nodeType":865},{},[],". While phishing and social engineering was once primarily a delivery mechanism for malicious payloads to be executed on endpoint, it is now used to harvest credentials and secrets for identity-based attacks against cloud apps and services. ",{"data":36548,"content":36549,"nodeType":866},{},[36550],{"data":36551,"marks":36552,"value":36553,"nodeType":865},{},[],"And because businesses have migrated to more cloud-based services and infrastructure, the compromise of an identity now has different consequences.",{"data":36555,"content":36556,"nodeType":866},{},[36557,36561],{"data":36558,"marks":36559,"value":36560,"nodeType":865},{},[],"The data and functionality that attackers seek has moved off endpoints and internal networks and onto cloud systems and SaaS applications, which organizations are using in large numbers (tens to hundreds). The modern way of working means that applications are more often than not directly exposed to the internet — and the only thing needed to access these apps are identities. ",{"data":36562,"marks":36563,"value":36565,"nodeType":865},{},[36564],{"type":887},"Naturally, it's much harder to stop credential stuffing attacks against 100 SaaS apps than the single centralized external VPN/webmail endpoint of yesteryear. ",{"data":36567,"content":36568,"nodeType":866},{},[36569],{"data":36570,"marks":36571,"value":36572,"nodeType":865},{},[],"It’s clear that stats alone don’t adequately capture the identity threat. So we have to look beyond the numbers to find out why. ",{"data":36574,"content":36575,"nodeType":879},{},[],{"data":36577,"content":36578,"nodeType":889},{},[36579],{"data":36580,"marks":36581,"value":36582,"nodeType":865},{},[],"Using this resource",{"data":36584,"content":36585,"nodeType":866},{},[36586],{"data":36587,"marks":36588,"value":36589,"nodeType":865},{},[],"To cut through some of the noise, we’ve compiled this list of reported attacks and explored what they mean for the identity threat landscape. ",{"data":36591,"content":36592,"nodeType":866},{},[36593,36597,36602],{"data":36594,"marks":36595,"value":36596,"nodeType":865},{},[],"This is not intended to be an exhaustive list of all attacks involving the compromise of digital identities (the list would be endless!). Nor is it something you should read all in one go (unless you ",{"data":36598,"marks":36599,"value":36601,"nodeType":865},{},[36600],{"type":2757},"really",{"data":36603,"marks":36604,"value":36605,"nodeType":865},{},[]," want to, we won’t stop you). We want it to be a resource that you can refer back to, that we will continue to update as new attacks are recorded. ",{"data":36607,"content":36608,"nodeType":866},{},[36609,36613],{"data":36610,"marks":36611,"value":36612,"nodeType":865},{},[],"In this context we define identity attacks as ",{"data":36614,"marks":36615,"value":36617,"nodeType":865},{},[36616],{"type":887},"attacks targeting cloud identities and their associated identity management systems, protocols, applications, and infrastructure. ",{"data":36619,"content":36620,"nodeType":866},{},[36621,36625],{"data":36622,"marks":36623,"value":36624,"nodeType":865},{},[],"The attacks recorded below are high profile examples of browser-based identity attacks",{"data":36626,"marks":36627,"value":36628,"nodeType":865},{},[]," that demonstrate how threat actors are leveraging the cloud identity plane to evade established cyber defenses and traverse new attack paths to achieve their goals. We’ve focused on attacks targeting identity infrastructure itself that are notable for their bypassing of traditional environments and established controls (e.g. Networkless or SaaS-to-SaaS attack paths). ",{"data":36630,"content":36631,"nodeType":866},{},[36632,36636,36643,36647,36656],{"data":36633,"marks":36634,"value":36635,"nodeType":865},{},[],"As with all publicly disclosed breaches, the level of detail and transparency we see varies. Where possible, we've mapped the threat actor Tactics, Techniques and Procedures to our ",{"data":36637,"content":36638,"nodeType":905},{"uri":2206},[36639],{"data":36640,"marks":36641,"value":2211,"nodeType":865},{},[36642],{"type":1070},{"data":36644,"marks":36645,"value":36646,"nodeType":865},{},[]," (previously the SaaS Attack Matrix). To learn more about SaaS attack techniques ",{"data":36648,"content":36650,"nodeType":905},{"uri":36649},"https://pushsecurity.com/blog/saas-attack-techniques/#id-problems-with-observing-saas-attacks",[36651],{"data":36652,"marks":36653,"value":36655,"nodeType":865},{},[36654],{"type":1070},"read the blog",{"data":36657,"marks":36658,"value":6352,"nodeType":865},{},[],{"data":36660,"content":36661,"nodeType":879},{},[],{"data":36663,"content":36664,"nodeType":889},{},[36665],{"data":36666,"marks":36667,"value":36668,"nodeType":865},{},[],"Snowflake – June 2024",{"data":36670,"content":36671,"nodeType":866},{},[36672,36676,36684],{"data":36673,"marks":36674,"value":36675,"nodeType":865},{},[],"The threat group known as ShinyHunters (also tracked as UNC5537) has claimed responsibility for breaching multiple organizations using Snowflake, a cloud-based data warehousing and analytics platform. The breach stems from the historical compromise of credentials used to access customer-specific Snowflake tenants, via infostealer infections. These credentials were used as part of a targeted campaign against Snowflake customers, which was exacerbated by the widespread absence of MFA due to the lack of MFA enforcement by default. At the time of writing, approximately 165 customers have been impacted globally ",{"data":36677,"content":36678,"nodeType":905},{"uri":3455},[36679],{"data":36680,"marks":36681,"value":36683,"nodeType":865},{},[36682],{"type":1070},"according to a report by Mandiant",{"data":36685,"marks":36686,"value":1711,"nodeType":865},{},[],{"data":36688,"content":36689,"nodeType":2315},{},[36690],{"data":36691,"marks":36692,"value":36693,"nodeType":865},{},[],"How did Snowflake get breached?",{"data":36695,"content":36696,"nodeType":866},{},[36697],{"data":36698,"marks":36699,"value":36701,"nodeType":865},{},[36700],{"type":2757},"It’s worth noting that customers/users of Snowflake were breached via their Snowflake tenants, and no central breach of Snowflake's own systems occurred.",{"data":36703,"content":36704,"nodeType":2718},{},[36705,36715,36737,36747,36756,36765,36774,36784],{"data":36706,"content":36707,"nodeType":2654},{},[36708],{"data":36709,"content":36710,"nodeType":866},{},[36711],{"data":36712,"marks":36713,"value":36714,"nodeType":865},{},[],"Snowflake users were infected with infostealer malware that harvested credentials from user devices over an extended period. The threat actor used Snowflake customer credentials that were previously exposed via several infostealer malware variants, including; VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA and METASTEALER.",{"data":36716,"content":36717,"nodeType":2654},{},[36718],{"data":36719,"content":36720,"nodeType":866},{},[36721,36725,36733],{"data":36722,"marks":36723,"value":36724,"nodeType":865},{},[],"Credentials appeared on criminal marketplaces e.g. dark web forums and ",{"data":36726,"content":36727,"nodeType":905},{"uri":33739},[36728],{"data":36729,"marks":36730,"value":36732,"nodeType":865},{},[36731],{"type":1070},"Telegram channels",{"data":36734,"marks":36735,"value":36736,"nodeType":865},{},[]," as combolists (username, password, and login portal combinations). ",{"data":36738,"content":36739,"nodeType":2654},{},[36740],{"data":36741,"content":36742,"nodeType":866},{},[36743],{"data":36744,"marks":36745,"value":36746,"nodeType":865},{},[],"Criminal groups (either ShinyHunters or another organization) saw the potential in targeting Snowflake users, based on the availability of credentials, number of customer organizations, and the value of the data that can be accessed in Snowflake. ",{"data":36748,"content":36749,"nodeType":2654},{},[36750],{"data":36751,"content":36752,"nodeType":866},{},[36753],{"data":36754,"marks":36755,"value":17145,"nodeType":865},{},[],{"data":36757,"content":36758,"nodeType":2654},{},[36759],{"data":36760,"content":36761,"nodeType":866},{},[36762],{"data":36763,"marks":36764,"value":17155,"nodeType":865},{},[],{"data":36766,"content":36767,"nodeType":2654},{},[36768],{"data":36769,"content":36770,"nodeType":866},{},[36771],{"data":36772,"marks":36773,"value":17165,"nodeType":865},{},[],{"data":36775,"content":36776,"nodeType":2654},{},[36777],{"data":36778,"content":36779,"nodeType":866},{},[36780],{"data":36781,"marks":36782,"value":36783,"nodeType":865},{},[],"ShinyHunters acquired massive quantities of Snowflake data based on the information that each customer stored in Snowflake or connected apps. The most sensitive data declared so far pertains to end-customers of each victim, for example PII, bank account and card information, etc.  ",{"data":36785,"content":36786,"nodeType":2654},{},[36787],{"data":36788,"content":36789,"nodeType":866},{},[36790],{"data":36791,"marks":36792,"value":36793,"nodeType":865},{},[],"ShinyHunters began attempts to extort Snowflake and end-customers using the data acquired. ",{"data":36795,"content":36796,"nodeType":2315},{},[36797],{"data":36798,"marks":36799,"value":36800,"nodeType":865},{},[],"What was the impact of the Snowflake breach?",{"data":36802,"content":36803,"nodeType":2718},{},[36804,36823,36852,36880,36899,36918],{"data":36805,"content":36806,"nodeType":2654},{},[36807],{"data":36808,"content":36809,"nodeType":866},{},[36810,36814,36819],{"data":36811,"marks":36812,"value":36813,"nodeType":865},{},[],"Approximately ",{"data":36815,"marks":36816,"value":36818,"nodeType":865},{},[36817],{"type":887},"165 victims were identified by Mandiant",{"data":36820,"marks":36821,"value":36822,"nodeType":865},{},[],". Organizations are gradually coming forward to declare the breach and release customer communications accordingly, but not all victims have been named.",{"data":36824,"content":36825,"nodeType":2654},{},[36826],{"data":36827,"content":36828,"nodeType":866},{},[36829,36833,36838,36842,36849],{"data":36830,"marks":36831,"value":36832,"nodeType":865},{},[],"Based on the figures being suggested so far, the impact upon end-customers is huge, with the data of ",{"data":36834,"marks":36835,"value":36837,"nodeType":865},{},[36836],{"type":887},"hundreds of millions of people exposed",{"data":36839,"marks":36840,"value":36841,"nodeType":865},{},[],", and has been touted by some news outlets as ‘",{"data":36843,"content":36844,"nodeType":905},{"uri":16900},[36845],{"data":36846,"marks":36847,"value":16906,"nodeType":865},{},[36848],{"type":1070},{"data":36850,"marks":36851,"value":16910,"nodeType":865},{},[],{"data":36853,"content":36854,"nodeType":2654},{},[36855],{"data":36856,"content":36857,"nodeType":866},{},[36858,36862,36867,36871,36876],{"data":36859,"marks":36860,"value":36861,"nodeType":865},{},[],"The impact on the affected businesses is largely unknown at this stage. It’s clear that the victims will suffer ",{"data":36863,"marks":36864,"value":36866,"nodeType":865},{},[36865],{"type":887},"reputational damage",{"data":36868,"marks":36869,"value":36870,"nodeType":865},{},[]," based on the extent of their individual breaches, and possibly face other ",{"data":36872,"marks":36873,"value":36875,"nodeType":865},{},[36874],{"type":887},"penalties and sanctions",{"data":36877,"marks":36878,"value":36879,"nodeType":865},{},[]," if they are found to be at fault by their respective regulators and/or national information security authorities. ",{"data":36881,"content":36882,"nodeType":2654},{},[36883],{"data":36884,"content":36885,"nodeType":866},{},[36886,36890,36895],{"data":36887,"marks":36888,"value":36889,"nodeType":865},{},[],"The impact upon individuals will be significant, with high potential for further targeting in terms of ",{"data":36891,"marks":36892,"value":36894,"nodeType":865},{},[36893],{"type":887},"identity theft, blackmail, financial crime",{"data":36896,"marks":36897,"value":36898,"nodeType":865},{},[],", etc.  ",{"data":36900,"content":36901,"nodeType":2654},{},[36902],{"data":36903,"content":36904,"nodeType":866},{},[36905,36909,36914],{"data":36906,"marks":36907,"value":36908,"nodeType":865},{},[],"It is unclear what data has been exposed in addition to personal data affecting end-customers. If other sensitive commercial or business data pertaining to ",{"data":36910,"marks":36911,"value":36913,"nodeType":865},{},[36912],{"type":887},"Intellectual Property",{"data":36915,"marks":36916,"value":36917,"nodeType":865},{},[]," has been exposed then this data may also be sold on via other nefarious channels, with a potential future impact.",{"data":36919,"content":36920,"nodeType":2654},{},[36921],{"data":36922,"content":36923,"nodeType":866},{},[36924,36928,36933],{"data":36925,"marks":36926,"value":36927,"nodeType":865},{},[],"Given the lack of MFA for the compromised accounts, there has been a general criticism of the ‘opt-in’ nature of MFA for SaaS services, with many security professionals suggesting that ",{"data":36929,"marks":36930,"value":36932,"nodeType":865},{},[36931],{"type":887},"Snowflake should enforce MFA by default",{"data":36934,"marks":36935,"value":36936,"nodeType":865},{},[]," given the critical nature of the service. ",{"data":36938,"content":36939,"nodeType":2315},{},[36940],{"data":36941,"marks":36942,"value":36943,"nodeType":865},{},[],"What stands out in the Snowflake breach?",{"data":36945,"content":36946,"nodeType":2718},{},[36947,36966,37007,37034],{"data":36948,"content":36949,"nodeType":2654},{},[36950],{"data":36951,"content":36952,"nodeType":866},{},[36953,36957,36962],{"data":36954,"marks":36955,"value":36956,"nodeType":865},{},[],"The breach ",{"data":36958,"marks":36959,"value":36961,"nodeType":865},{},[36960],{"type":887},"was achieved by using stolen credentials dating back as far as 2020",{"data":36963,"marks":36964,"value":36965,"nodeType":865},{},[],", that had not been rotated or changed. This indicates that many of the credentials used were not necessarily the result of any recent data sharing. This highlights the potential risk of breached credentials already in the public domain; particularly in the case of cloud services that may not be subject to the same levels of credential hygiene as other traditional network logins. ",{"data":36967,"content":36968,"nodeType":2654},{},[36969],{"data":36970,"content":36971,"nodeType":866},{},[36972,36976,36984,36987,36992,36996,37004],{"data":36973,"marks":36974,"value":36975,"nodeType":865},{},[],"Much of the industry response has focused on ensuring that accounts are using SSO (and therefore are protected by MFA at the IdP level). However, due to the existence of ",{"data":36977,"content":36979,"nodeType":905},{"uri":36978},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/ghost-logins",[36980],{"data":36981,"marks":36982,"value":950,"nodeType":865},{},[36983],{"type":1070},{"data":36985,"marks":36986,"value":7148,"nodeType":865},{},[],{"data":36988,"marks":36989,"value":36991,"nodeType":865},{},[36990],{"type":887},"local logins without MFA can exist simultaneously with the SSO login unless expressly disabled",{"data":36993,"marks":36994,"value":36995,"nodeType":865},{},[],". Organizations using Snowflake that are looking to lock down their accounts can ",{"data":36997,"content":36998,"nodeType":905},{"uri":36181},[36999],{"data":37000,"marks":37001,"value":37003,"nodeType":865},{},[37002],{"type":1070},"watch our recent demo of how to effectively remediate this vulnerability in Snowflake",{"data":37005,"marks":37006,"value":14512,"nodeType":865},{},[],{"data":37008,"content":37009,"nodeType":2654},{},[37010],{"data":37011,"content":37012,"nodeType":866},{},[37013,37018,37022,37030],{"data":37014,"marks":37015,"value":37017,"nodeType":865},{},[37016],{"type":887},"80% of the credentials were gathered through infostealer malware",{"data":37019,"marks":37020,"value":37021,"nodeType":865},{},[],". Typically, this occurs when unmanaged devices are used to access company resources, or personal browser profiles are synchronized on both work and personal devices. Malware deployed to an insecure personal device can then access and steal credentials for company resources. This situation usually occurs when working with third-party contractors on a BYOD basis; ",{"data":37023,"content":37024,"nodeType":905},{"uri":17310},[37025],{"data":37026,"marks":37027,"value":37029,"nodeType":865},{},[37028],{"type":1070},"a recent article indicates that Ukraine-based EPAM Systems",{"data":37031,"marks":37032,"value":37033,"nodeType":865},{},[],", an engineering and digital service provider and “Elite Tier Partner” of Snowflake, was one such organization breached in this way. Organizations consuming Snowflake-related services from EPAM were then subsequently affected, as the compromise of EPAM users granted access to a large number of Snowflake credentials for various company tenants.  ",{"data":37035,"content":37036,"nodeType":2654},{},[37037],{"data":37038,"content":37039,"nodeType":866},{},[37040,37044,37049,37053,37058],{"data":37041,"marks":37042,"value":37043,"nodeType":865},{},[],"While attacker activity has focused on Snowflake to date, the success of this attack will signal the potential for further credential based attacks against similar apps. ",{"data":37045,"marks":37046,"value":37048,"nodeType":865},{},[37047],{"type":887},"There may already be a 'Snowflake 2.0' among the credentials already available online",{"data":37050,"marks":37051,"value":37052,"nodeType":865},{},[],". Further, credentials can be used against a wide range of apps to capitalize on potential ",{"data":37054,"marks":37055,"value":37057,"nodeType":865},{},[37056],{"type":887},"password reuse (which we see for 1 in 3 employees)",{"data":37059,"marks":37060,"value":37061,"nodeType":865},{},[],", so the exact creds for a particular app don’t have to be explicitly breached, so long as the domain for the login portal can be guessed or has been exposed elsewhere.   ",{"data":37063,"content":37064,"nodeType":2315},{},[37065],{"data":37066,"marks":37067,"value":37068,"nodeType":865},{},[],"Browser & Identity Attacks Matrix mapping",{"data":37070,"content":37071,"nodeType":866},{},[37072],{"data":37073,"marks":37074,"value":37075,"nodeType":865},{},[],"For more information on each TTP please navigate to the entries linked in the table below. ",{"data":37077,"content":37078,"nodeType":3983},{},[37079,37123,37185],{"data":37080,"content":37081,"nodeType":3775},{},[37082,37093,37103,37113],{"data":37083,"content":37084,"nodeType":37092},{},[37085],{"data":37086,"content":37087,"nodeType":866},{},[37088],{"data":37089,"marks":37090,"value":37091,"nodeType":865},{},[],"ID","table-header-cell",{"data":37094,"content":37095,"nodeType":37092},{},[37096],{"data":37097,"content":37098,"nodeType":866},{},[37099],{"data":37100,"marks":37101,"value":37102,"nodeType":865},{},[],"Name",{"data":37104,"content":37105,"nodeType":37092},{},[37106],{"data":37107,"content":37108,"nodeType":866},{},[37109],{"data":37110,"marks":37111,"value":37112,"nodeType":865},{},[],"Stage",{"data":37114,"content":37115,"nodeType":37092},{},[37116],{"data":37117,"content":37118,"nodeType":866},{},[37119],{"data":37120,"marks":37121,"value":37122,"nodeType":865},{},[],"Description",{"data":37124,"content":37125,"nodeType":3775},{},[37126,37146,37165,37175],{"data":37127,"content":37128,"nodeType":3741},{},[37129],{"data":37130,"content":37131,"nodeType":866},{},[37132,37135,37143],{"data":37133,"marks":37134,"value":21,"nodeType":865},{},[],{"data":37136,"content":37137,"nodeType":905},{"uri":9104},[37138],{"data":37139,"marks":37140,"value":37142,"nodeType":865},{},[37141],{"type":1070},"SAT1017",{"data":37144,"marks":37145,"value":21,"nodeType":865},{},[],{"data":37147,"content":37148,"nodeType":3741},{},[37149],{"data":37150,"content":37151,"nodeType":866},{},[37152,37155,37162],{"data":37153,"marks":37154,"value":21,"nodeType":865},{},[],{"data":37156,"content":37157,"nodeType":905},{"uri":36978},[37158],{"data":37159,"marks":37160,"value":395,"nodeType":865},{},[37161],{"type":1070},{"data":37163,"marks":37164,"value":21,"nodeType":865},{},[],{"data":37166,"content":37167,"nodeType":3741},{},[37168],{"data":37169,"content":37170,"nodeType":866},{},[37171],{"data":37172,"marks":37173,"value":37174,"nodeType":865},{},[],"Initial Access; Persistence; Defense Evasion",{"data":37176,"content":37177,"nodeType":3741},{},[37178],{"data":37179,"content":37180,"nodeType":866},{},[37181],{"data":37182,"marks":37183,"value":37184,"nodeType":865},{},[],"Abusing non-SSO additional login methods such as password-based authentication (local to the SaaS app), social logins, API access, etc. ",{"data":37186,"content":37187,"nodeType":3775},{},[37188,37208,37229,37239],{"data":37189,"content":37190,"nodeType":3741},{},[37191],{"data":37192,"content":37193,"nodeType":866},{},[37194,37197,37205],{"data":37195,"marks":37196,"value":21,"nodeType":865},{},[],{"data":37198,"content":37199,"nodeType":905},{"uri":34058},[37200],{"data":37201,"marks":37202,"value":37204,"nodeType":865},{},[37203],{"type":1070},"SAT1044",{"data":37206,"marks":37207,"value":21,"nodeType":865},{},[],{"data":37209,"content":37210,"nodeType":3741},{},[37211],{"data":37212,"content":37213,"nodeType":866},{},[37214,37217,37226],{"data":37215,"marks":37216,"value":21,"nodeType":865},{},[],{"data":37218,"content":37220,"nodeType":905},{"uri":37219},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/session-cookie-theft",[37221],{"data":37222,"marks":37223,"value":37225,"nodeType":865},{},[37224],{"type":1070},"Session cookie theft",{"data":37227,"marks":37228,"value":21,"nodeType":865},{},[],{"data":37230,"content":37231,"nodeType":3741},{},[37232],{"data":37233,"content":37234,"nodeType":866},{},[37235],{"data":37236,"marks":37237,"value":37238,"nodeType":865},{},[],"Lateral Movement; Defense Evasion",{"data":37240,"content":37241,"nodeType":3741},{},[37242],{"data":37243,"content":37244,"nodeType":866},{},[37245],{"data":37246,"marks":37247,"value":37248,"nodeType":865},{},[],"Session cookies are used to pivot from an endpoint compromise and laterally move to downstream SaaS applications.",{"data":37250,"content":37251,"nodeType":2315},{},[37252],{"data":37253,"marks":37254,"value":37255,"nodeType":865},{},[],"Related breaches",{"data":37257,"content":37258,"nodeType":866},{},[37259],{"data":37260,"marks":37261,"value":37262,"nodeType":865},{},[],"Named victims are listed below:",{"data":37264,"content":37265,"nodeType":2718},{},[37266,37276,37286,37296,37306,37316,37326,37336],{"data":37267,"content":37268,"nodeType":2654},{},[37269],{"data":37270,"content":37271,"nodeType":866},{},[37272],{"data":37273,"marks":37274,"value":37275,"nodeType":865},{},[],"Ticketmaster",{"data":37277,"content":37278,"nodeType":2654},{},[37279],{"data":37280,"content":37281,"nodeType":866},{},[37282],{"data":37283,"marks":37284,"value":37285,"nodeType":865},{},[],"Santander",{"data":37287,"content":37288,"nodeType":2654},{},[37289],{"data":37290,"content":37291,"nodeType":866},{},[37292],{"data":37293,"marks":37294,"value":37295,"nodeType":865},{},[],"Neiman Marcus",{"data":37297,"content":37298,"nodeType":2654},{},[37299],{"data":37300,"content":37301,"nodeType":866},{},[37302],{"data":37303,"marks":37304,"value":37305,"nodeType":865},{},[],"Los Angeles Unified",{"data":37307,"content":37308,"nodeType":2654},{},[37309],{"data":37310,"content":37311,"nodeType":866},{},[37312],{"data":37313,"marks":37314,"value":37315,"nodeType":865},{},[],"Pure Storage",{"data":37317,"content":37318,"nodeType":2654},{},[37319],{"data":37320,"content":37321,"nodeType":866},{},[37322],{"data":37323,"marks":37324,"value":37325,"nodeType":865},{},[],"Advance Auto Parts",{"data":37327,"content":37328,"nodeType":2654},{},[37329],{"data":37330,"content":37331,"nodeType":866},{},[37332],{"data":37333,"marks":37334,"value":37335,"nodeType":865},{},[],"Truist Bank",{"data":37337,"content":37338,"nodeType":2654},{},[37339],{"data":37340,"content":37341,"nodeType":866},{},[37342],{"data":37343,"marks":37344,"value":37345,"nodeType":865},{},[],"Lending Tree",{"data":37347,"content":37348,"nodeType":879},{},[],{"data":37350,"content":37351,"nodeType":889},{},[37352],{"data":37353,"marks":37354,"value":37355,"nodeType":865},{},[],"Microsoft — January 2024",{"data":37357,"content":37358,"nodeType":866},{},[37359],{"data":37360,"marks":37361,"value":37362,"nodeType":865},{},[],"The threat group known as APT29 (also known as “The Dukes”, “Cozy Bear”, and labeled “Midnight Blizzard” by Microsoft) executed a cleverly executed password-guessing attack to compromise test cloud identities that were also lacking MFA. Attackers then leveraged this access to compromise some OAuth applications that allowed lateral movement to Microsoft’s corporate environment and the creation of other malicious OAuth applications to achieve persistence.",{"data":37364,"content":37365,"nodeType":2315},{},[37366],{"data":37367,"marks":37368,"value":37369,"nodeType":865},{},[],"How did Microsoft get breached?",{"data":37371,"content":37372,"nodeType":2718},{},[37373,37383,37393,37403,37413,37423],{"data":37374,"content":37375,"nodeType":2654},{},[37376],{"data":37377,"content":37378,"nodeType":866},{},[37379],{"data":37380,"marks":37381,"value":37382,"nodeType":865},{},[],"APT29 utilized password spraying / credential stuffing attacks to compromise test cloud identities that were also lacking MFA, attached to a non-production test tenant.",{"data":37384,"content":37385,"nodeType":2654},{},[37386],{"data":37387,"content":37388,"nodeType":866},{},[37389],{"data":37390,"marks":37391,"value":37392,"nodeType":865},{},[],"APT29 leveraged their initial access to the test tenant to identify and compromise a test OAuth application that had access to the Microsoft corporate environment by leveraging permissive Entra ID roles in the test tenant.",{"data":37394,"content":37395,"nodeType":2654},{},[37396],{"data":37397,"content":37398,"nodeType":866},{},[37399],{"data":37400,"marks":37401,"value":37402,"nodeType":865},{},[],"APT29 used the existing configurations to access the Microsoft corporate Entra ID tenant whereupon the app registration from the test tenant was installed as a service principal in the corporate tenant, granting the equivalent of global admin rights.",{"data":37404,"content":37405,"nodeType":2654},{},[37406],{"data":37407,"content":37408,"nodeType":866},{},[37409],{"data":37410,"marks":37411,"value":37412,"nodeType":865},{},[],"Using these new permissions, APT29 registered additional malicious OAuth applications in the Microsoft corporate environment, and created a new user in the Microsoft corporate tenant to grant consent to the new malicious OAuth apps, thereby achieving persistent access to the environment.",{"data":37414,"content":37415,"nodeType":2654},{},[37416],{"data":37417,"content":37418,"nodeType":866},{},[37419],{"data":37420,"marks":37421,"value":37422,"nodeType":865},{},[],"APT29 leveraged the elevated (maximum) privileges assigned to the ‘test’ app service principal to grant app roles to other newly created app service principals, granting them the Office 365 Exchange Online full_access_as_app role in the corporate tenant, which allows access to mailboxes.",{"data":37424,"content":37425,"nodeType":2654},{},[37426],{"data":37427,"content":37428,"nodeType":866},{},[37429],{"data":37430,"marks":37431,"value":37432,"nodeType":865},{},[],"APT29 leveraged these malicious OAuth applications to authenticate to Microsoft Exchange Online and target Microsoft corporate email accounts.",{"data":37434,"content":37435,"nodeType":2315},{},[37436],{"data":37437,"marks":37438,"value":37439,"nodeType":865},{},[],"What was the impact of the Microsoft breach?",{"data":37441,"content":37442,"nodeType":2718},{},[37443,37453,37463],{"data":37444,"content":37445,"nodeType":2654},{},[37446],{"data":37447,"content":37448,"nodeType":866},{},[37449],{"data":37450,"marks":37451,"value":37452,"nodeType":865},{},[],"APT29 had access to Microsoft corporate email accounts, including members of the senior leadership team and employees in the cybersecurity, legal, and other functions, resulting in sensitive data leakage.",{"data":37454,"content":37455,"nodeType":2654},{},[37456],{"data":37457,"content":37458,"nodeType":866},{},[37459],{"data":37460,"marks":37461,"value":37462,"nodeType":865},{},[],"Microsoft has not disclosed any further impacts at this time, but it is likely that the adversary had complete, unmitigated control of the Microsoft corporate tenant for a period of time, with global administrator level access.",{"data":37464,"content":37465,"nodeType":2654},{},[37466],{"data":37467,"content":37468,"nodeType":866},{},[37469],{"data":37470,"marks":37471,"value":37472,"nodeType":865},{},[],"Since the initial attack there has been evidence of continued targeting, with password spraying attacks reportedly increasing tenfold, likely informed by stolen information.",{"data":37474,"content":37475,"nodeType":2315},{},[37476],{"data":37477,"marks":37478,"value":37479,"nodeType":865},{},[],"What stands out in the Microsoft breach?",{"data":37481,"content":37482,"nodeType":2718},{},[37483,37493,37503,37513],{"data":37484,"content":37485,"nodeType":2654},{},[37486],{"data":37487,"content":37488,"nodeType":866},{},[37489],{"data":37490,"marks":37491,"value":37492,"nodeType":865},{},[],"The attack was covert and targeted, with APT29 tailoring the attack to a limited number of accounts and using a low number of attempts to evade detection and avoid account blocks based on the volume of failures.",{"data":37494,"content":37495,"nodeType":2654},{},[37496],{"data":37497,"content":37498,"nodeType":866},{},[37499],{"data":37500,"marks":37501,"value":37502,"nodeType":865},{},[],"APT29 used residential proxy networks when interacting with the compromised tenant and, subsequently, with Exchange Online to obfuscate the source of their attack and avoid impossible travel detections. ",{"data":37504,"content":37505,"nodeType":2654},{},[37506],{"data":37507,"content":37508,"nodeType":866},{},[37509],{"data":37510,"marks":37511,"value":37512,"nodeType":865},{},[],"APT29 demonstrated mature and in-depth understanding of cloud infrastructure, protocols, and workflows, particularly in terms of privilege escalation and lateral movement.",{"data":37514,"content":37515,"nodeType":2654},{},[37516],{"data":37517,"content":37518,"nodeType":866},{},[37519],{"data":37520,"marks":37521,"value":37522,"nodeType":865},{},[],"If even Microsoft (an organization with pretty much unrivaled security resources) can’t ensure that all their accounts are protected by MFA and that there are no weak links between test/dev and prod systems, this should be a wake-up call for any company that thinks their MFA implementation is flawless. ",{"data":37524,"content":37525,"nodeType":2315},{},[37526],{"data":37527,"marks":37528,"value":37068,"nodeType":865},{},[],{"data":37530,"content":37531,"nodeType":866},{},[37532],{"data":37533,"marks":37534,"value":37075,"nodeType":865},{},[],{"data":37536,"content":37537,"nodeType":3983},{},[37538,37578,37641,37706],{"data":37539,"content":37540,"nodeType":3775},{},[37541,37550,37560,37569],{"data":37542,"content":37543,"nodeType":37092},{},[37544],{"data":37545,"content":37546,"nodeType":866},{},[37547],{"data":37548,"marks":37549,"value":37091,"nodeType":865},{},[],{"data":37551,"content":37552,"nodeType":37092},{},[37553],{"data":37554,"content":37555,"nodeType":866},{},[37556],{"data":37557,"marks":37558,"value":37559,"nodeType":865},{},[],"Technique",{"data":37561,"content":37562,"nodeType":37092},{},[37563],{"data":37564,"content":37565,"nodeType":866},{},[37566],{"data":37567,"marks":37568,"value":37112,"nodeType":865},{},[],{"data":37570,"content":37571,"nodeType":37092},{},[37572],{"data":37573,"content":37574,"nodeType":866},{},[37575],{"data":37576,"marks":37577,"value":37122,"nodeType":865},{},[],{"data":37579,"content":37580,"nodeType":3775},{},[37581,37601,37621,37631],{"data":37582,"content":37583,"nodeType":3741},{},[37584],{"data":37585,"content":37586,"nodeType":866},{},[37587,37590,37598],{"data":37588,"marks":37589,"value":21,"nodeType":865},{},[],{"data":37591,"content":37592,"nodeType":905},{"uri":35523},[37593],{"data":37594,"marks":37595,"value":37597,"nodeType":865},{},[37596],{"type":1070},"SAT1011",{"data":37599,"marks":37600,"value":21,"nodeType":865},{},[],{"data":37602,"content":37603,"nodeType":3741},{},[37604],{"data":37605,"content":37606,"nodeType":866},{},[37607,37610,37618],{"data":37608,"marks":37609,"value":21,"nodeType":865},{},[],{"data":37611,"content":37613,"nodeType":905},{"uri":37612},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/credential-stuffing",[37614],{"data":37615,"marks":37616,"value":333,"nodeType":865},{},[37617],{"type":1070},{"data":37619,"marks":37620,"value":21,"nodeType":865},{},[],{"data":37622,"content":37623,"nodeType":3741},{},[37624],{"data":37625,"content":37626,"nodeType":866},{},[37627],{"data":37628,"marks":37629,"value":37630,"nodeType":865},{},[],"Initial Access",{"data":37632,"content":37633,"nodeType":3741},{},[37634],{"data":37635,"content":37636,"nodeType":866},{},[37637],{"data":37638,"marks":37639,"value":37640,"nodeType":865},{},[],"Attempt to authenticate to a SaaS account by guessing a large number of passwords ",{"data":37642,"content":37643,"nodeType":3775},{},[37644,37665,37686,37696],{"data":37645,"content":37646,"nodeType":3741},{},[37647],{"data":37648,"content":37649,"nodeType":866},{},[37650,37653,37662],{"data":37651,"marks":37652,"value":21,"nodeType":865},{},[],{"data":37654,"content":37656,"nodeType":905},{"uri":37655},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/oauth_tokens/description.md",[37657],{"data":37658,"marks":37659,"value":37661,"nodeType":865},{},[37660],{"type":1070},"SAT1027",{"data":37663,"marks":37664,"value":21,"nodeType":865},{},[],{"data":37666,"content":37667,"nodeType":3741},{},[37668],{"data":37669,"content":37670,"nodeType":866},{},[37671,37674,37683],{"data":37672,"marks":37673,"value":21,"nodeType":865},{},[],{"data":37675,"content":37677,"nodeType":905},{"uri":37676},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/oauth-tokens",[37678],{"data":37679,"marks":37680,"value":37682,"nodeType":865},{},[37681],{"type":1070},"OAuth tokens",{"data":37684,"marks":37685,"value":21,"nodeType":865},{},[],{"data":37687,"content":37688,"nodeType":3741},{},[37689],{"data":37690,"content":37691,"nodeType":866},{},[37692],{"data":37693,"marks":37694,"value":37695,"nodeType":865},{},[],"Execution; Persistence; Defense Evasion",{"data":37697,"content":37698,"nodeType":3741},{},[37699],{"data":37700,"content":37701,"nodeType":866},{},[37702],{"data":37703,"marks":37704,"value":37705,"nodeType":865},{},[],"Use a malicious OAuth app to create an OAuth token, using arbitrary permissions to maintain long-term programmatic access to a compromised user account.",{"data":37707,"content":37708,"nodeType":3775},{},[37709,37730,37751,37761],{"data":37710,"content":37711,"nodeType":3741},{},[37712],{"data":37713,"content":37714,"nodeType":866},{},[37715,37718,37727],{"data":37716,"marks":37717,"value":21,"nodeType":865},{},[],{"data":37719,"content":37721,"nodeType":905},{"uri":37720},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/abuse_existing_oauth_integrations/description.md",[37722],{"data":37723,"marks":37724,"value":37726,"nodeType":865},{},[37725],{"type":1070},"SAT1001",{"data":37728,"marks":37729,"value":21,"nodeType":865},{},[],{"data":37731,"content":37732,"nodeType":3741},{},[37733],{"data":37734,"content":37735,"nodeType":866},{},[37736,37739,37748],{"data":37737,"marks":37738,"value":21,"nodeType":865},{},[],{"data":37740,"content":37742,"nodeType":905},{"uri":37741},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/abuse-existing-oauth-integrations",[37743],{"data":37744,"marks":37745,"value":37747,"nodeType":865},{},[37746],{"type":1070},"Abuse existing OAuth integrations",{"data":37749,"marks":37750,"value":21,"nodeType":865},{},[],{"data":37752,"content":37753,"nodeType":3741},{},[37754],{"data":37755,"content":37756,"nodeType":866},{},[37757],{"data":37758,"marks":37759,"value":37760,"nodeType":865},{},[],"Privilege Escalation;\nLateral Movement",{"data":37762,"content":37763,"nodeType":3741},{},[37764],{"data":37765,"content":37766,"nodeType":866},{},[37767],{"data":37768,"marks":37769,"value":37770,"nodeType":865},{},[],"If an adversary compromises a SaaS account integrated with other apps, they can escalate privileges and move laterally to other apps.",{"data":37772,"content":37773,"nodeType":2315},{},[37774],{"data":37775,"marks":37776,"value":37255,"nodeType":865},{},[],{"data":37778,"content":37779,"nodeType":866},{},[37780],{"data":37781,"marks":37782,"value":37784,"nodeType":865},{},[37783],{"type":887},"Hewlett Packard Enterprise (HPE) — May 2023",{"data":37786,"content":37787,"nodeType":866},{},[37788],{"data":37789,"marks":37790,"value":37791,"nodeType":865},{},[],"At the time of the Microsoft breach becoming public knowledge, HPE disclosed that they had become aware of a historical incident in Dec 2023, involving unauthorized access to and exfiltration of a limited number of SharePoint files as early as May 2023. Hackers accessed and exfiltrated data from HPE mailboxes belonging to individuals in the cybersecurity, go-to-market, business segments, and other functions. No further information is available on the techniques used or impact of the breach. ",{"data":37793,"content":37794,"nodeType":879},{},[],{"data":37796,"content":37797,"nodeType":889},{},[37798],{"data":37799,"marks":37800,"value":37801,"nodeType":865},{},[],"Okta — October 2023",{"data":37803,"content":37804,"nodeType":866},{},[37805],{"data":37806,"marks":37807,"value":37808,"nodeType":865},{},[],"An unknown threat group compromised an Okta employee's personal Google account that was being used on a company-managed device, granting the threat actor access to a service account for Okta’s customer support system, that included session tokens for 134 customers. This was then used to hijack the legitimate Okta sessions of five customers. ",{"data":37810,"content":37811,"nodeType":2315},{},[37812],{"data":37813,"marks":37814,"value":37815,"nodeType":865},{},[],"How did Okta get breached?",{"data":37817,"content":37818,"nodeType":2718},{},[37819,37829,37839,37849,37859],{"data":37820,"content":37821,"nodeType":2654},{},[37822],{"data":37823,"content":37824,"nodeType":866},{},[37825],{"data":37826,"marks":37827,"value":37828,"nodeType":865},{},[],"The threat actor compromised a personal Google account that the user had accessed from their Okta-managed work device by signing into their personal profile from the Chrome browser.",{"data":37830,"content":37831,"nodeType":2654},{},[37832],{"data":37833,"content":37834,"nodeType":866},{},[37835],{"data":37836,"marks":37837,"value":37838,"nodeType":865},{},[],"The personal account credentials are likely to have been compromised in a historical data breach and did not have MFA enabled.",{"data":37840,"content":37841,"nodeType":2654},{},[37842],{"data":37843,"content":37844,"nodeType":866},{},[37845],{"data":37846,"marks":37847,"value":37848,"nodeType":865},{},[],"The username and password of a service account for Okta’s customer support system had been saved into the employee’s personal Google account and was therefore compromised.",{"data":37850,"content":37851,"nodeType":2654},{},[37852],{"data":37853,"content":37854,"nodeType":866},{},[37855],{"data":37856,"marks":37857,"value":37858,"nodeType":865},{},[],"The threat actor was able to access the service account by logging in using the stolen credentials, which again likely did not have MFA deployed as a service account.",{"data":37860,"content":37861,"nodeType":2654},{},[37862],{"data":37863,"content":37864,"nodeType":866},{},[37865],{"data":37866,"marks":37867,"value":37868,"nodeType":865},{},[],"The threat actor was able to use session tokens in the HAR files to impersonate staff and hijack the legitimate Okta sessions of five customers, including 1Password, BeyondTrust, and Cloudflare.",{"data":37870,"content":37871,"nodeType":2315},{},[37872],{"data":37873,"marks":37874,"value":37875,"nodeType":865},{},[],"What was the impact of the Okta breach?",{"data":37877,"content":37878,"nodeType":2718},{},[37879,37889,37899,37909],{"data":37880,"content":37881,"nodeType":2654},{},[37882],{"data":37883,"content":37884,"nodeType":866},{},[37885],{"data":37886,"marks":37887,"value":37888,"nodeType":865},{},[],"The threat actor gained unauthorized access to files inside Okta’s customer support system associated with 134 Okta customers.",{"data":37890,"content":37891,"nodeType":2654},{},[37892],{"data":37893,"content":37894,"nodeType":866},{},[37895],{"data":37896,"marks":37897,"value":37898,"nodeType":865},{},[],"The threat actor was able to use these session tokens to hijack the legitimate Okta sessions of 5 (publicly disclosed) customers.",{"data":37900,"content":37901,"nodeType":2654},{},[37902],{"data":37903,"content":37904,"nodeType":866},{},[37905],{"data":37906,"marks":37907,"value":37908,"nodeType":865},{},[],"Okta originally claimed the breach had impacted only 1% of customers, but later found that a report run and downloaded by the threat actor contained the names and email addresses of all 18,400 Okta customer support users, as well as some Okta employee information, meaning 100% of customer support users were impacted.",{"data":37910,"content":37911,"nodeType":2654},{},[37912],{"data":37913,"content":37914,"nodeType":866},{},[37915],{"data":37916,"marks":37917,"value":37918,"nodeType":865},{},[],"Okta users are at higher risk of phishing and credential stuffing attacks based on the data stolen by the threat actor, increasing the importance of robust MFA implementation.",{"data":37920,"content":37921,"nodeType":2315},{},[37922],{"data":37923,"marks":37924,"value":37925,"nodeType":865},{},[],"What stands out in the Okta breach?",{"data":37927,"content":37928,"nodeType":2718},{},[37929,37939,37949],{"data":37930,"content":37931,"nodeType":2654},{},[37932],{"data":37933,"content":37934,"nodeType":866},{},[37935],{"data":37936,"marks":37937,"value":37938,"nodeType":865},{},[],"This attack demonstrates the risk associated with cloud Identity Providers and the potential goldmine that they are to attackers. Much in the same way that the manufacturers of physical and virtual network appliances are continuously probed for software vulnerabilities, cloud IdPs like Okta present a huge potential opportunity, both in terms of targeting specific organizational instances as well as the Okta organization. This attack showcases the possibility of third-party supply chain attacks to target downstream organizations using IdP services. ",{"data":37940,"content":37941,"nodeType":2654},{},[37942],{"data":37943,"content":37944,"nodeType":866},{},[37945],{"data":37946,"marks":37947,"value":37948,"nodeType":865},{},[],"Similar to the Microsoft breach, gaps were discovered and exploited in Okta’s MFA coverage and implementation, highlighting that there are gaps in even the most mature organizations. ",{"data":37950,"content":37951,"nodeType":2654},{},[37952],{"data":37953,"content":37954,"nodeType":866},{},[37955],{"data":37956,"marks":37957,"value":37958,"nodeType":865},{},[],"The subsequent attack on Cloudflare (see below) and the scale of the recovery effort demonstrates the significant operational overhead in responding to and recovering from a breach of identity infrastructure, with a similar or greater scale than a traditional Active Directory compromise. While addressing the incident, Cloudflare's staff rotated all production credentials (over 5,000 unique ones), physically segmented test and staging systems, performed forensic triage on 4,893 systems, reimaged and rebooted all systems on the company's global network, including all Atlassian servers (Jira, Confluence, and Bitbucket) and machines accessed by the threat actor. All equipment in Cloudflare's Brazil data center, which was unsuccessfully targeted by the threat actor, was later returned to the manufacturers to ensure that the data center was secure.",{"data":37960,"content":37961,"nodeType":2315},{},[37962],{"data":37963,"marks":37964,"value":37068,"nodeType":865},{},[],{"data":37966,"content":37967,"nodeType":866},{},[37968],{"data":37969,"marks":37970,"value":37075,"nodeType":865},{},[],{"data":37972,"content":37973,"nodeType":3983},{},[37974,38013,38072],{"data":37975,"content":37976,"nodeType":3775},{},[37977,37986,37995,38004],{"data":37978,"content":37979,"nodeType":37092},{},[37980],{"data":37981,"content":37982,"nodeType":866},{},[37983],{"data":37984,"marks":37985,"value":37091,"nodeType":865},{},[],{"data":37987,"content":37988,"nodeType":37092},{},[37989],{"data":37990,"content":37991,"nodeType":866},{},[37992],{"data":37993,"marks":37994,"value":37559,"nodeType":865},{},[],{"data":37996,"content":37997,"nodeType":37092},{},[37998],{"data":37999,"content":38000,"nodeType":866},{},[38001],{"data":38002,"marks":38003,"value":37112,"nodeType":865},{},[],{"data":38005,"content":38006,"nodeType":37092},{},[38007],{"data":38008,"content":38009,"nodeType":866},{},[38010],{"data":38011,"marks":38012,"value":37122,"nodeType":865},{},[],{"data":38014,"content":38015,"nodeType":3775},{},[38016,38035,38054,38063],{"data":38017,"content":38018,"nodeType":3741},{},[38019],{"data":38020,"content":38021,"nodeType":866},{},[38022,38025,38032],{"data":38023,"marks":38024,"value":21,"nodeType":865},{},[],{"data":38026,"content":38027,"nodeType":905},{"uri":35523},[38028],{"data":38029,"marks":38030,"value":37597,"nodeType":865},{},[38031],{"type":1070},{"data":38033,"marks":38034,"value":21,"nodeType":865},{},[],{"data":38036,"content":38037,"nodeType":3741},{},[38038],{"data":38039,"content":38040,"nodeType":866},{},[38041,38044,38051],{"data":38042,"marks":38043,"value":21,"nodeType":865},{},[],{"data":38045,"content":38046,"nodeType":905},{"uri":37612},[38047],{"data":38048,"marks":38049,"value":333,"nodeType":865},{},[38050],{"type":1070},{"data":38052,"marks":38053,"value":21,"nodeType":865},{},[],{"data":38055,"content":38056,"nodeType":3741},{},[38057],{"data":38058,"content":38059,"nodeType":866},{},[38060],{"data":38061,"marks":38062,"value":37630,"nodeType":865},{},[],{"data":38064,"content":38065,"nodeType":3741},{},[38066],{"data":38067,"content":38068,"nodeType":866},{},[38069],{"data":38070,"marks":38071,"value":37640,"nodeType":865},{},[],{"data":38073,"content":38074,"nodeType":3775},{},[38075,38096,38117,38127],{"data":38076,"content":38077,"nodeType":3741},{},[38078],{"data":38079,"content":38080,"nodeType":866},{},[38081,38084,38093],{"data":38082,"marks":38083,"value":21,"nodeType":865},{},[],{"data":38085,"content":38087,"nodeType":905},{"uri":38086},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/password_scraping/description.md",[38088],{"data":38089,"marks":38090,"value":38092,"nodeType":865},{},[38091],{"type":1070},"SAT1028",{"data":38094,"marks":38095,"value":21,"nodeType":865},{},[],{"data":38097,"content":38098,"nodeType":3741},{},[38099],{"data":38100,"content":38101,"nodeType":866},{},[38102,38105,38114],{"data":38103,"marks":38104,"value":21,"nodeType":865},{},[],{"data":38106,"content":38108,"nodeType":905},{"uri":38107},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/password-scraping",[38109],{"data":38110,"marks":38111,"value":38113,"nodeType":865},{},[38112],{"type":1070},"Password Scraping",{"data":38115,"marks":38116,"value":21,"nodeType":865},{},[],{"data":38118,"content":38119,"nodeType":3741},{},[38120],{"data":38121,"content":38122,"nodeType":866},{},[38123],{"data":38124,"marks":38125,"value":38126,"nodeType":865},{},[],"Credential Access",{"data":38128,"content":38129,"nodeType":3741},{},[38130],{"data":38131,"content":38132,"nodeType":866},{},[38133],{"data":38134,"marks":38135,"value":38136,"nodeType":865},{},[],"Collection of credentials and secrets from repositories e.g. password managers, SaaS file stores, etc.",{"data":38138,"content":38139,"nodeType":2315},{},[38140],{"data":38141,"marks":38142,"value":37255,"nodeType":865},{},[],{"data":38144,"content":38145,"nodeType":866},{},[38146],{"data":38147,"marks":38148,"value":38150,"nodeType":865},{},[38149],{"type":887},"Cloudflare — November 2023",{"data":38152,"content":38153,"nodeType":866},{},[38154],{"data":38155,"marks":38156,"value":38157,"nodeType":865},{},[],"The threat actor used tokens and credentials that had not been rotated to breach Cloudflare’s internal Atlassian server and access its Confluence wiki, Jira bug database, and Bitbucket source code management system. The threat actor first gained access to Cloudflare's self-hosted Atlassian server and then accessed the company's Confluence and Jira systems following a reconnaissance stage. Cloudflare says that this breach did not impact customer data or systems or the provision of services.",{"data":38159,"content":38160,"nodeType":866},{},[38161],{"data":38162,"marks":38163,"value":38165,"nodeType":865},{},[38164],{"type":887},"1Password — October 2023",{"data":38167,"content":38168,"nodeType":866},{},[38169],{"data":38170,"marks":38171,"value":38172,"nodeType":865},{},[],"1Password reported unsolicited activity in their Okta environment which was traced to a suspicious IP address. Later it was confirmed that an threat actor had accessed 1Password’s Okta environment using administrative privileges. They attempted to access the IT team member’s user dashboard, but that attempt was blocked by Okta. They also requested a report of administrative users, which was identified as suspicious and triggered an investigation. 1Password says it terminated the activity, investigated, and found no compromise of user data or other sensitive systems, either employee-facing or user-facing.",{"data":38174,"content":38175,"nodeType":866},{},[38176],{"data":38177,"marks":38178,"value":38180,"nodeType":865},{},[38179],{"type":887},"BeyondTrust - October 2023",{"data":38182,"content":38183,"nodeType":866},{},[38184],{"data":38185,"marks":38186,"value":38187,"nodeType":865},{},[],"BeyondTrust security teams detected an identity-centric attack on an in-house Okta administrator account. BeyondTrust blocked all access to the threat actor, and verified that they did not gain access to any systems. BeyondTrust has confirmed that there was no additional exposure to our internal systems or BeyondTrust’s customers.",{"data":38189,"content":38190,"nodeType":879},{},[],{"data":38192,"content":38193,"nodeType":889},{},[38194],{"data":38195,"marks":38196,"value":38197,"nodeType":865},{},[],"MGM Resorts — September 2023",{"data":38199,"content":38200,"nodeType":866},{},[38201],{"data":38202,"marks":38203,"value":38204,"nodeType":865},{},[],"The threat group known as Scattered Spider socially engineered MGM help desk personnel to grant ‘super admin’ access to the Okta tenant, which was then used to steal data and deploy ransomware, resulting in significant business disruption. ",{"data":38206,"content":38207,"nodeType":2315},{},[38208],{"data":38209,"marks":38210,"value":38211,"nodeType":865},{},[],"How did MGM get breached?",{"data":38213,"content":38214,"nodeType":2718},{},[38215,38225,38235,38245,38255,38265],{"data":38216,"content":38217,"nodeType":2654},{},[38218],{"data":38219,"content":38220,"nodeType":866},{},[38221],{"data":38222,"marks":38223,"value":38224,"nodeType":865},{},[],"Scattered Spider researched MGM employees on LinkedIn to identify individuals likely to have privileged Okta access, specifically Super Administrator privileges. ",{"data":38226,"content":38227,"nodeType":2654},{},[38228],{"data":38229,"content":38230,"nodeType":866},{},[38231],{"data":38232,"marks":38233,"value":38234,"nodeType":865},{},[],"Scattered Spider contacted the IT help desk impersonating an employee with a privileged account asking for an authentication reset (password and MFA).",{"data":38236,"content":38237,"nodeType":2654},{},[38238],{"data":38239,"content":38240,"nodeType":866},{},[38241],{"data":38242,"marks":38243,"value":38244,"nodeType":865},{},[],"With privileged access, the compromised Super Administrator accounts were used to assign higher privileges to other accounts, circumventing MFA by removing enrolled authenticators and/or removing MFA from authentication policies.",{"data":38246,"content":38247,"nodeType":2654},{},[38248],{"data":38249,"content":38250,"nodeType":866},{},[38251],{"data":38252,"marks":38253,"value":38254,"nodeType":865},{},[],"Scattered Spider registered a second, attacker-controlled IdP via Org2Org using inbound federation, granting the ability to impersonate users and access applications on their behalf. By matching the username of target accounts in the second IdP to the original, the attacker was able to SSO into target applications. ",{"data":38256,"content":38257,"nodeType":2654},{},[38258],{"data":38259,"content":38260,"nodeType":866},{},[38261],{"data":38262,"marks":38263,"value":38264,"nodeType":865},{},[],"Through inbound federation, Scattered Spider obtained global admin rights in Azure, effectively granting full control over connected systems and granting domain admin privileges in target environments.",{"data":38266,"content":38267,"nodeType":2654},{},[38268],{"data":38269,"content":38270,"nodeType":866},{},[38271],{"data":38272,"marks":38273,"value":38274,"nodeType":865},{},[],"Scattered Spider deployed encryption software to around 100 ESXi servers and exfiltrated data, disrupting core business operations.",{"data":38276,"content":38277,"nodeType":2315},{},[38278],{"data":38279,"marks":38280,"value":38281,"nodeType":865},{},[],"What was the impact of the MGM breach?",{"data":38283,"content":38284,"nodeType":2718},{},[38285,38295,38305],{"data":38286,"content":38287,"nodeType":2654},{},[38288],{"data":38289,"content":38290,"nodeType":866},{},[38291],{"data":38292,"marks":38293,"value":38294,"nodeType":865},{},[],"Led to a 36-hour outage of multiple MGM IT systems and affected a number of its casinos on the Las Vegas strip, including the Bellagio, Excalibur, Luxor, Mandalay Bay and New York New York.",{"data":38296,"content":38297,"nodeType":2654},{},[38298],{"data":38299,"content":38300,"nodeType":866},{},[38301],{"data":38302,"marks":38303,"value":38304,"nodeType":865},{},[],"Personal data compromise of an unspecified number of customers including various contact information, dates of births, genders, driver’s license numbers, social security numbers, and passport information. ",{"data":38306,"content":38307,"nodeType":2654},{},[38308],{"data":38309,"content":38310,"nodeType":866},{},[38311],{"data":38312,"marks":38313,"value":38314,"nodeType":865},{},[],"MGM reported that the attack would cause a $100 million hit to its third-quarter results, including $10 million in one-time cyber security consulting fees. ",{"data":38316,"content":38317,"nodeType":2315},{},[38318],{"data":38319,"marks":38320,"value":38321,"nodeType":865},{},[],"What stands out in the MGM breach?",{"data":38323,"content":38324,"nodeType":2718},{},[38325,38335,38345],{"data":38326,"content":38327,"nodeType":2654},{},[38328],{"data":38329,"content":38330,"nodeType":866},{},[38331],{"data":38332,"marks":38333,"value":38334,"nodeType":865},{},[],"The MGM breach demonstrates how financially motivated organized criminal groups are specifically targeting the identity infrastructure of an organization (e.g. the chosen IdP solution) and leveraging cloud-native functionality. ",{"data":38336,"content":38337,"nodeType":2654},{},[38338],{"data":38339,"content":38340,"nodeType":866},{},[38341],{"data":38342,"marks":38343,"value":38344,"nodeType":865},{},[],"The MGM breach is notable for being a hybrid attack that ended in what has become a typical “actions on objective” for ransomware operators and their affiliates - the propagation of malware and encryption of core business servers. In this way attackers are leveraging the newer functionality that cloud services provide them to target non-cloud/on-premise resources. This potentially indicates that attackers see cloud applications and services as the path of least resistance to achieving their goals, exploiting more limited security team visibility and understanding of these services compared to more traditional (now well protected) targets. ",{"data":38346,"content":38347,"nodeType":2654},{},[38348],{"data":38349,"content":38350,"nodeType":866},{},[38351],{"data":38352,"marks":38353,"value":38354,"nodeType":865},{},[],"While attackers were focused on taking control of the cloud IdP, the initial access vector was notable for being a more traditional method (vishing) to bypass the need to acquire credentials (password and MFA token). This type of technique remains consistently effective, regardless of the technology landscape and whether MFA is correctly implemented or not.    ",{"data":38356,"content":38357,"nodeType":2315},{},[38358],{"data":38359,"marks":38360,"value":37068,"nodeType":865},{},[],{"data":38362,"content":38363,"nodeType":866},{},[38364],{"data":38365,"marks":38366,"value":37075,"nodeType":865},{},[],{"data":38368,"content":38369,"nodeType":3983},{},[38370,38409],{"data":38371,"content":38372,"nodeType":3775},{},[38373,38382,38391,38400],{"data":38374,"content":38375,"nodeType":37092},{},[38376],{"data":38377,"content":38378,"nodeType":866},{},[38379],{"data":38380,"marks":38381,"value":37091,"nodeType":865},{},[],{"data":38383,"content":38384,"nodeType":37092},{},[38385],{"data":38386,"content":38387,"nodeType":866},{},[38388],{"data":38389,"marks":38390,"value":37559,"nodeType":865},{},[],{"data":38392,"content":38393,"nodeType":37092},{},[38394],{"data":38395,"content":38396,"nodeType":866},{},[38397],{"data":38398,"marks":38399,"value":37112,"nodeType":865},{},[],{"data":38401,"content":38402,"nodeType":37092},{},[38403],{"data":38404,"content":38405,"nodeType":866},{},[38406],{"data":38407,"marks":38408,"value":37122,"nodeType":865},{},[],{"data":38410,"content":38411,"nodeType":3775},{},[38412,38432,38453,38463],{"data":38413,"content":38414,"nodeType":3741},{},[38415],{"data":38416,"content":38417,"nodeType":866},{},[38418,38421,38429],{"data":38419,"marks":38420,"value":21,"nodeType":865},{},[],{"data":38422,"content":38423,"nodeType":905},{"uri":10111},[38424],{"data":38425,"marks":38426,"value":38428,"nodeType":865},{},[38427],{"type":1070},"SAT1041",{"data":38430,"marks":38431,"value":21,"nodeType":865},{},[],{"data":38433,"content":38434,"nodeType":3741},{},[38435],{"data":38436,"content":38437,"nodeType":866},{},[38438,38441,38450],{"data":38439,"marks":38440,"value":21,"nodeType":865},{},[],{"data":38442,"content":38444,"nodeType":905},{"uri":38443},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/inbound-federation",[38445],{"data":38446,"marks":38447,"value":38449,"nodeType":865},{},[38448],{"type":1070},"Inbound Federation",{"data":38451,"marks":38452,"value":21,"nodeType":865},{},[],{"data":38454,"content":38455,"nodeType":3741},{},[38456],{"data":38457,"content":38458,"nodeType":866},{},[38459],{"data":38460,"marks":38461,"value":38462,"nodeType":865},{},[],"Persistence; Lateral Movement",{"data":38464,"content":38465,"nodeType":3741},{},[38466],{"data":38467,"content":38468,"nodeType":866},{},[38469],{"data":38470,"marks":38471,"value":38472,"nodeType":865},{},[],"Inbound federation allows users to login to a target identity provider by authenticating with a source identity provider",{"data":38474,"content":38475,"nodeType":879},{},[],{"data":38477,"content":38478,"nodeType":889},{},[38479],{"data":38480,"marks":38481,"value":38482,"nodeType":865},{},[],"Retool — August 2023",{"data":38484,"content":38485,"nodeType":866},{},[38486],{"data":38487,"marks":38488,"value":38489,"nodeType":865},{},[],"Software development company Retool disclosed that the accounts of 27 of its cloud customers were compromised following a targeted SMS-based social engineering attack, which was enabled by Google Authenticator’s default synchronization of MFA tokens with the associated Google account.  ",{"data":38491,"content":38492,"nodeType":2315},{},[38493],{"data":38494,"marks":38495,"value":38496,"nodeType":865},{},[],"How did Retool get breached?",{"data":38498,"content":38499,"nodeType":2718},{},[38500,38510,38520,38530,38540,38550],{"data":38501,"content":38502,"nodeType":2654},{},[38503],{"data":38504,"content":38505,"nodeType":866},{},[38506],{"data":38507,"marks":38508,"value":38509,"nodeType":865},{},[],"The threat actor launched a targeted SMS-based phishing campaign against Retool employees with a custom lure relating to their workplace healthcare coverage.",{"data":38511,"content":38512,"nodeType":2654},{},[38513],{"data":38514,"content":38515,"nodeType":866},{},[38516],{"data":38517,"marks":38518,"value":38519,"nodeType":865},{},[],"The timing coincided with a recently announced migration of logins to Okta, and the message contained a url disguised to look like their internal identity portal.",{"data":38521,"content":38522,"nodeType":2654},{},[38523],{"data":38524,"content":38525,"nodeType":866},{},[38526],{"data":38527,"marks":38528,"value":38529,"nodeType":865},{},[],"After logging into the fake portal – which included an MFA form – the threat actor called the employee impersonating an IT team member, deepfaking the IT employee’s real voice and using real information about the company to build trust.",{"data":38531,"content":38532,"nodeType":2654},{},[38533],{"data":38534,"content":38535,"nodeType":866},{},[38536],{"data":38537,"marks":38538,"value":38539,"nodeType":865},{},[],"The phished employee shared an MFA OTP token which allowed the threat actor to add their own personal device to the employee’s Okta account and enabled their own Okta MFA from that point forward.",{"data":38541,"content":38542,"nodeType":2654},{},[38543],{"data":38544,"content":38545,"nodeType":866},{},[38546],{"data":38547,"marks":38548,"value":38549,"nodeType":865},{},[],"Due to the Google Authenticator synchronization feature that syncs MFA codes to the cloud by default, meaning that access to a Google account immediately gave access to all MFA tokens held within that account.",{"data":38551,"content":38552,"nodeType":2654},{},[38553],{"data":38554,"content":38555,"nodeType":866},{},[38556],{"data":38557,"marks":38558,"value":38559,"nodeType":865},{},[],"This enabled the threat actor to take over a number of identities associated with a range of target apps and change the credentials.",{"data":38561,"content":38562,"nodeType":2315},{},[38563],{"data":38564,"marks":38565,"value":38566,"nodeType":865},{},[],"What was the impact of the Retool breach?",{"data":38568,"content":38569,"nodeType":2718},{},[38570,38580,38590],{"data":38571,"content":38572,"nodeType":2654},{},[38573],{"data":38574,"content":38575,"nodeType":866},{},[38576],{"data":38577,"marks":38578,"value":38579,"nodeType":865},{},[],"A total of 27 customers were impacted, with the threat actor specifically targeting customers in the Crypto industry.",{"data":38581,"content":38582,"nodeType":2654},{},[38583],{"data":38584,"content":38585,"nodeType":866},{},[38586],{"data":38587,"marks":38588,"value":38589,"nodeType":865},{},[],"After taking over the accounts, the threat actor was observed gathering information and exploring the Retool apps.",{"data":38591,"content":38592,"nodeType":2654},{},[38593],{"data":38594,"content":38595,"nodeType":866},{},[38596],{"data":38597,"marks":38598,"value":38599,"nodeType":865},{},[],"After learning of the attack, Retool revoked all internal authenticated sessions (Okta, GSuite, etc.) for employees, locked down access to the affected accounts, notified the affected customers, and restored their accounts to their original state.",{"data":38601,"content":38602,"nodeType":2315},{},[38603],{"data":38604,"marks":38605,"value":38606,"nodeType":865},{},[],"What stands out in the Retool breach?",{"data":38608,"content":38609,"nodeType":2718},{},[38610,38620,38630],{"data":38611,"content":38612,"nodeType":2654},{},[38613],{"data":38614,"content":38615,"nodeType":866},{},[38616],{"data":38617,"marks":38618,"value":38619,"nodeType":865},{},[],"Like the MGM breach, the Retool breach demonstrates how financially motivated organized criminal groups are specifically targeting the identity infrastructure of an organization (e.g. the chosen IdP solution) and leveraging cloud-native functionality. ",{"data":38621,"content":38622,"nodeType":2654},{},[38623],{"data":38624,"content":38625,"nodeType":866},{},[38626],{"data":38627,"marks":38628,"value":38629,"nodeType":865},{},[],"A further similarity with the MGM breach, while attackers were focused on taking control of the cloud IdP, the initial access vector was notable for being a more traditional method (SMS phishing in this case) to bypass the need to acquire credentials (password and MFA token). This type of technique remains consistently effective, regardless of the technology landscape and whether MFA is correctly implemented or not.    ",{"data":38631,"content":38632,"nodeType":2654},{},[38633],{"data":38634,"content":38635,"nodeType":866},{},[38636],{"data":38637,"marks":38638,"value":38639,"nodeType":865},{},[],"In this case, the attacker abused inherent weaknesses in Google Authenticator, which came under fire following the breach for its default synchronization of MFA codes to the cloud when connected to an account, in order to move laterally and compromise other target apps. ",{"data":38641,"content":38642,"nodeType":2315},{},[38643],{"data":38644,"marks":38645,"value":37068,"nodeType":865},{},[],{"data":38647,"content":38648,"nodeType":866},{},[38649],{"data":38650,"marks":38651,"value":37075,"nodeType":865},{},[],{"data":38653,"content":38654,"nodeType":3983},{},[38655,38694,38760],{"data":38656,"content":38657,"nodeType":3775},{},[38658,38667,38676,38685],{"data":38659,"content":38660,"nodeType":37092},{},[38661],{"data":38662,"content":38663,"nodeType":866},{},[38664],{"data":38665,"marks":38666,"value":37091,"nodeType":865},{},[],{"data":38668,"content":38669,"nodeType":37092},{},[38670],{"data":38671,"content":38672,"nodeType":866},{},[38673],{"data":38674,"marks":38675,"value":37559,"nodeType":865},{},[],{"data":38677,"content":38678,"nodeType":37092},{},[38679],{"data":38680,"content":38681,"nodeType":866},{},[38682],{"data":38683,"marks":38684,"value":37112,"nodeType":865},{},[],{"data":38686,"content":38687,"nodeType":37092},{},[38688],{"data":38689,"content":38690,"nodeType":866},{},[38691],{"data":38692,"marks":38693,"value":37122,"nodeType":865},{},[],{"data":38695,"content":38696,"nodeType":3775},{},[38697,38719,38741,38750],{"data":38698,"content":38699,"nodeType":3741},{},[38700],{"data":38701,"content":38702,"nodeType":866},{},[38703,38707,38716],{"data":38704,"marks":38705,"value":21,"nodeType":865},{},[38706],{"type":1070},{"data":38708,"content":38710,"nodeType":905},{"uri":38709},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/aitm_phishing/description.md",[38711],{"data":38712,"marks":38713,"value":38715,"nodeType":865},{},[38714],{"type":1070},"SAT1042",{"data":38717,"marks":38718,"value":21,"nodeType":865},{},[],{"data":38720,"content":38721,"nodeType":3741},{},[38722],{"data":38723,"content":38724,"nodeType":866},{},[38725,38729,38738],{"data":38726,"marks":38727,"value":21,"nodeType":865},{},[38728],{"type":1070},{"data":38730,"content":38732,"nodeType":905},{"uri":38731},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/aitm-phishing",[38733],{"data":38734,"marks":38735,"value":38737,"nodeType":865},{},[38736],{"type":1070},"AiTM Phishing",{"data":38739,"marks":38740,"value":21,"nodeType":865},{},[],{"data":38742,"content":38743,"nodeType":3741},{},[38744],{"data":38745,"content":38746,"nodeType":866},{},[38747],{"data":38748,"marks":38749,"value":37630,"nodeType":865},{},[],{"data":38751,"content":38752,"nodeType":3741},{},[38753],{"data":38754,"content":38755,"nodeType":866},{},[38756],{"data":38757,"marks":38758,"value":38759,"nodeType":865},{},[],"Attacker-in-the-Middle (AiTM) phishing uses dedicated tooling to act as a web proxy between the victim and a legitimate login portal for an application the victim has access to, principally to make it easier to defeat MFA protection.",{"data":38761,"content":38762,"nodeType":3775},{},[38763,38784,38807,38817],{"data":38764,"content":38765,"nodeType":3741},{},[38766],{"data":38767,"content":38768,"nodeType":866},{},[38769,38772,38781],{"data":38770,"marks":38771,"value":21,"nodeType":865},{},[],{"data":38773,"content":38775,"nodeType":905},{"uri":38774},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/device_enrollment/description.md",[38776],{"data":38777,"marks":38778,"value":38780,"nodeType":865},{},[38779],{"type":1070},"SAT1043",{"data":38782,"marks":38783,"value":21,"nodeType":865},{},[],{"data":38785,"content":38786,"nodeType":3741},{},[38787],{"data":38788,"content":38789,"nodeType":866},{},[38790,38794,38803],{"data":38791,"marks":38792,"value":21,"nodeType":865},{},[38793],{"type":1070},{"data":38795,"content":38797,"nodeType":905},{"uri":38796},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/device-enrollment",[38798],{"data":38799,"marks":38800,"value":38802,"nodeType":865},{},[38801],{"type":1070},"Device Enrollment",{"data":38804,"marks":38805,"value":21,"nodeType":865},{},[38806],{"type":1070},{"data":38808,"content":38809,"nodeType":3741},{},[38810],{"data":38811,"content":38812,"nodeType":866},{},[38813],{"data":38814,"marks":38815,"value":38816,"nodeType":865},{},[],"Initial Access; Persistence",{"data":38818,"content":38819,"nodeType":3741},{},[38820],{"data":38821,"content":38822,"nodeType":866},{},[38823],{"data":38824,"marks":38825,"value":38826,"nodeType":865},{},[],"Enrollment of a new MFA device in order to allow an adversary to complete MFA challenges for future authentication. ",{"data":38828,"content":38829,"nodeType":879},{},[],{"data":38831,"content":38832,"nodeType":889},{},[38833],{"data":38834,"marks":38835,"value":38836,"nodeType":865},{},[],"GitHub / Heroku / Travis-CI / npm — April 2022",{"data":38838,"content":38839,"nodeType":866},{},[38840],{"data":38841,"marks":38842,"value":38843,"nodeType":865},{},[],"An unknown threat actor used stolen OAuth user tokens (issued to Heroku and Travis-CI) to download data from private repositories. The threat actor then compromised an internal Heroku customer database as well as accessed and stole data from dozens of downstream organizations using Heroku and Travis-CI-maintained OAuth apps.",{"data":38845,"content":38846,"nodeType":2315},{},[38847],{"data":38848,"marks":38849,"value":38850,"nodeType":865},{},[],"How did they get breached?",{"data":38852,"content":38853,"nodeType":2718},{},[38854,38864,38874,38884,38894,38904,38914],{"data":38855,"content":38856,"nodeType":2654},{},[38857],{"data":38858,"content":38859,"nodeType":866},{},[38860],{"data":38861,"marks":38862,"value":38863,"nodeType":865},{},[],"The threat actor obtained access to two third-party OAuth integrators, Heroku and Travis-CI, accessing databases and downloading stored customer GitHub integration OAuth tokens. These tokens had earlier been used by Travis-CI and Heroku OAuth applications to integrate with GitHub to deploy applications.",{"data":38865,"content":38866,"nodeType":2654},{},[38867],{"data":38868,"content":38869,"nodeType":866},{},[38870],{"data":38871,"marks":38872,"value":38873,"nodeType":865},{},[],"Access to the environment was gained by leveraging a compromised token for a Heroku machine account, but it is not disclosed how the threat actor achieved this. ",{"data":38875,"content":38876,"nodeType":2654},{},[38877],{"data":38878,"content":38879,"nodeType":866},{},[38880],{"data":38881,"marks":38882,"value":38883,"nodeType":865},{},[],"The threat actor authenticated to the GitHub API using the stolen OAuth tokens issued to Heroku and Travis CI.",{"data":38885,"content":38886,"nodeType":2654},{},[38887],{"data":38888,"content":38889,"nodeType":866},{},[38890],{"data":38891,"marks":38892,"value":38893,"nodeType":865},{},[],"For users who had the affected Heroku or Travis CI OAuth apps authorized in their GitHub accounts, the threat actor listed all the user's organizations.",{"data":38895,"content":38896,"nodeType":2654},{},[38897],{"data":38898,"content":38899,"nodeType":866},{},[38900],{"data":38901,"marks":38902,"value":38903,"nodeType":865},{},[],"The threat actor then selected targets based on the listed organizations.",{"data":38905,"content":38906,"nodeType":2654},{},[38907],{"data":38908,"content":38909,"nodeType":866},{},[38910],{"data":38911,"marks":38912,"value":38913,"nodeType":865},{},[],"The threat actor listed the private repositories for user accounts of interest and proceeded to clone private repositories of interest.",{"data":38915,"content":38916,"nodeType":2654},{},[38917],{"data":38918,"content":38919,"nodeType":866},{},[38920],{"data":38921,"marks":38922,"value":38923,"nodeType":865},{},[],"GitHub identified unauthorized access to their npm production infrastructure using a compromised AWS API key, obtained by the threat actor when they downloaded a set of private npm repositories using a stolen OAuth token from one of the two affected third-party OAuth applications.",{"data":38925,"content":38926,"nodeType":2315},{},[38927],{"data":38928,"marks":38929,"value":38930,"nodeType":865},{},[],"What was the impact?",{"data":38932,"content":38933,"nodeType":2718},{},[38934,38944,38954],{"data":38935,"content":38936,"nodeType":2654},{},[38937],{"data":38938,"content":38939,"nodeType":866},{},[38940],{"data":38941,"marks":38942,"value":38943,"nodeType":865},{},[],"By stealing these OAuth tokens, the threat actor could access and download data from GitHub repositories belonging to those who authorized the compromised Heroku or Travis CI OAuth apps with their accounts. ",{"data":38945,"content":38946,"nodeType":2654},{},[38947],{"data":38948,"content":38949,"nodeType":866},{},[38950],{"data":38951,"marks":38952,"value":38953,"nodeType":865},{},[],"The threat actor was able to mine the downloaded private repositories for secrets that could be used to pivot to other infrastructure, stealing data from dozens of organizations. ",{"data":38955,"content":38956,"nodeType":2654},{},[38957],{"data":38958,"content":38959,"nodeType":866},{},[38960],{"data":38961,"marks":38962,"value":38963,"nodeType":865},{},[],"In addition to user repo’s downstream, the compromised token for a Heroku machine account obtained by threat actors also allowed unauthorized access into Heroku's internal database of customer accounts, enabling the threat actor to extract the hashed and salted passwords. ",{"data":38965,"content":38966,"nodeType":2315},{},[38967],{"data":38968,"marks":38969,"value":38970,"nodeType":865},{},[],"What stands out in the Github breach?",{"data":38972,"content":38973,"nodeType":2718},{},[38974,38984,38994],{"data":38975,"content":38976,"nodeType":2654},{},[38977],{"data":38978,"content":38979,"nodeType":866},{},[38980],{"data":38981,"marks":38982,"value":38983,"nodeType":865},{},[],"Similar to the Okta breach, this attack showcases the possibility of third-party supply chain attacks to target downstream organizations using cloud SaaS services. In this case, targeting OAuth integrators as opposed to IdP providers, but with a similar goal and impact of compromising the real target organizations downstream. ",{"data":38985,"content":38986,"nodeType":2654},{},[38987],{"data":38988,"content":38989,"nodeType":866},{},[38990],{"data":38991,"marks":38992,"value":38993,"nodeType":865},{},[],"Applications like Github are an obvious target for attackers due to their widespread adoption. There have been numerous attacks leveraging Github as the vehicle for attacks by compromising repo’s to insert malicious code, or registering malicious copycat repo’s to dupe users into using them. ",{"data":38995,"content":38996,"nodeType":2654},{},[38997],{"data":38998,"content":38999,"nodeType":866},{},[39000],{"data":39001,"marks":39002,"value":39003,"nodeType":865},{},[],"Unlike the attacks abusing the functionality of Github (repo poisoning) which target the legitimate developer processes when using the app, this attack could have been prevented at the identity layer before the attacker was able to breach the Heroku/Travis-CI accounts. ",{"data":39005,"content":39006,"nodeType":2315},{},[39007],{"data":39008,"marks":39009,"value":37068,"nodeType":865},{},[],{"data":39011,"content":39012,"nodeType":866},{},[39013],{"data":39014,"marks":39015,"value":37075,"nodeType":865},{},[],{"data":39017,"content":39018,"nodeType":3983},{},[39019,39058,39118,39183],{"data":39020,"content":39021,"nodeType":3775},{},[39022,39031,39040,39049],{"data":39023,"content":39024,"nodeType":37092},{},[39025],{"data":39026,"content":39027,"nodeType":866},{},[39028],{"data":39029,"marks":39030,"value":37091,"nodeType":865},{},[],{"data":39032,"content":39033,"nodeType":37092},{},[39034],{"data":39035,"content":39036,"nodeType":866},{},[39037],{"data":39038,"marks":39039,"value":37559,"nodeType":865},{},[],{"data":39041,"content":39042,"nodeType":37092},{},[39043],{"data":39044,"content":39045,"nodeType":866},{},[39046],{"data":39047,"marks":39048,"value":37112,"nodeType":865},{},[],{"data":39050,"content":39051,"nodeType":37092},{},[39052],{"data":39053,"content":39054,"nodeType":866},{},[39055],{"data":39056,"marks":39057,"value":37122,"nodeType":865},{},[],{"data":39059,"content":39060,"nodeType":3775},{},[39061,39080,39099,39109],{"data":39062,"content":39063,"nodeType":3741},{},[39064],{"data":39065,"content":39066,"nodeType":866},{},[39067,39070,39077],{"data":39068,"marks":39069,"value":21,"nodeType":865},{},[],{"data":39071,"content":39072,"nodeType":905},{"uri":37720},[39073],{"data":39074,"marks":39075,"value":37726,"nodeType":865},{},[39076],{"type":1070},{"data":39078,"marks":39079,"value":21,"nodeType":865},{},[],{"data":39081,"content":39082,"nodeType":3741},{},[39083],{"data":39084,"content":39085,"nodeType":866},{},[39086,39089,39096],{"data":39087,"marks":39088,"value":21,"nodeType":865},{},[],{"data":39090,"content":39091,"nodeType":905},{"uri":37741},[39092],{"data":39093,"marks":39094,"value":37747,"nodeType":865},{},[39095],{"type":1070},{"data":39097,"marks":39098,"value":21,"nodeType":865},{},[],{"data":39100,"content":39101,"nodeType":3741},{},[39102],{"data":39103,"content":39104,"nodeType":866},{},[39105],{"data":39106,"marks":39107,"value":39108,"nodeType":865},{},[],"Privilege Escalation; Lateral Movement",{"data":39110,"content":39111,"nodeType":3741},{},[39112],{"data":39113,"content":39114,"nodeType":866},{},[39115],{"data":39116,"marks":39117,"value":37770,"nodeType":865},{},[],{"data":39119,"content":39120,"nodeType":3775},{},[39121,39142,39163,39173],{"data":39122,"content":39123,"nodeType":3741},{},[39124],{"data":39125,"content":39126,"nodeType":866},{},[39127,39130,39139],{"data":39128,"marks":39129,"value":21,"nodeType":865},{},[],{"data":39131,"content":39133,"nodeType":905},{"uri":39132},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/api_keys/description.md",[39134],{"data":39135,"marks":39136,"value":39138,"nodeType":865},{},[39137],{"type":1070},"SAT1004",{"data":39140,"marks":39141,"value":21,"nodeType":865},{},[],{"data":39143,"content":39144,"nodeType":3741},{},[39145],{"data":39146,"content":39147,"nodeType":866},{},[39148,39151,39160],{"data":39149,"marks":39150,"value":21,"nodeType":865},{},[],{"data":39152,"content":39154,"nodeType":905},{"uri":39153},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/api-keys",[39155],{"data":39156,"marks":39157,"value":39159,"nodeType":865},{},[39158],{"type":1070},"API keys",{"data":39161,"marks":39162,"value":21,"nodeType":865},{},[],{"data":39164,"content":39165,"nodeType":3741},{},[39166],{"data":39167,"content":39168,"nodeType":866},{},[39169],{"data":39170,"marks":39171,"value":39172,"nodeType":865},{},[],"Persistence; Defense Evasion",{"data":39174,"content":39175,"nodeType":3741},{},[39176],{"data":39177,"content":39178,"nodeType":866},{},[39179],{"data":39180,"marks":39181,"value":39182,"nodeType":865},{},[],"An adversary that has compromised an account could then read existing API keys from the app settings, if the app allows this, or create a new API key.",{"data":39184,"content":39185,"nodeType":3775},{},[39186,39207,39228,39238],{"data":39187,"content":39188,"nodeType":3741},{},[39189],{"data":39190,"content":39191,"nodeType":866},{},[39192,39195,39204],{"data":39193,"marks":39194,"value":21,"nodeType":865},{},[],{"data":39196,"content":39198,"nodeType":905},{"uri":39197},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/app_directory_lookup/description.md#app-directory-lookup",[39199],{"data":39200,"marks":39201,"value":39203,"nodeType":865},{},[39202],{"type":1070},"SAT1006",{"data":39205,"marks":39206,"value":21,"nodeType":865},{},[],{"data":39208,"content":39209,"nodeType":3741},{},[39210],{"data":39211,"content":39212,"nodeType":866},{},[39213,39216,39225],{"data":39214,"marks":39215,"value":21,"nodeType":865},{},[],{"data":39217,"content":39219,"nodeType":905},{"uri":39218},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/app-directory-lookup",[39220],{"data":39221,"marks":39222,"value":39224,"nodeType":865},{},[39223],{"type":1070},"App directory lookup",{"data":39226,"marks":39227,"value":21,"nodeType":865},{},[],{"data":39229,"content":39230,"nodeType":3741},{},[39231],{"data":39232,"content":39233,"nodeType":866},{},[39234],{"data":39235,"marks":39236,"value":39237,"nodeType":865},{},[],"Discovery",{"data":39239,"content":39240,"nodeType":3741},{},[39241],{"data":39242,"content":39243,"nodeType":866},{},[39244],{"data":39245,"marks":39246,"value":39247,"nodeType":865},{},[],"An adversary who has gained a foothold via a SaaS app could download the list of users accessible to them in order to better target attacks against other users.",{"data":39249,"content":39250,"nodeType":879},{},[],{"data":39252,"content":39253,"nodeType":889},{},[39254],{"data":39255,"marks":39256,"value":39257,"nodeType":865},{},[],"Other notable attacks",{"data":39259,"content":39260,"nodeType":2315},{},[39261],{"data":39262,"marks":39263,"value":39264,"nodeType":865},{},[],"SEC X hack — January 2024",{"data":39266,"content":39267,"nodeType":866},{},[39268],{"data":39269,"marks":39270,"value":39271,"nodeType":865},{},[],"The X account for the U.S. Securities and Exchange Commission was victim to a SIM swapping attack, whereupon the attacker used the social media platform to issue a fake announcement on the approval of Bitcoin ETFs on security exchanges.",{"data":39273,"content":39274,"nodeType":866},{},[39275],{"data":39276,"marks":39277,"value":39278,"nodeType":865},{},[],"Once the threat actors controlled the number, they reset the password for the @SECGov account, and created the fake announcement. The SEC also confirmed that multi-factor authentication was not enabled on the account, as they had asked X support to disable it when they encountered problems logging into the account.",{"data":39280,"content":39281,"nodeType":879},{},[],{"data":39283,"content":39284,"nodeType":2315},{},[39285],{"data":39286,"marks":39287,"value":39288,"nodeType":865},{},[],"Mandiant X hack — January 2024",{"data":39290,"content":39291,"nodeType":866},{},[39292],{"data":39293,"marks":39294,"value":39295,"nodeType":865},{},[],"The X account for Mandiant was hacked by a Drainer-as-a-Service (DaaS) gang in a brute force attack. MFA was not enabled on the account. The threat actor used the social media account to share links redirecting to a phishing page to steal cryptocurrency. ",{"data":39297,"content":39298,"nodeType":866},{},[39299],{"data":39300,"marks":39301,"value":39302,"nodeType":865},{},[],"The attacker used a wallet drainer dubbed CLINKSINK. This same drainer has been used since December to steal funds and tokens from users of Solana cryptocurrency as part of a large-scale campaign involving at least 35 affiliate IDs linked to a shared DaaS.",{"data":39304,"content":39305,"nodeType":879},{},[],{"data":39307,"content":39308,"nodeType":2315},{},[39309],{"data":39310,"marks":39311,"value":39312,"nodeType":865},{},[],"23andMe data breach — April 2023",{"data":39314,"content":39315,"nodeType":866},{},[39316],{"data":39317,"marks":39318,"value":39319,"nodeType":865},{},[],"Genetic testing provider 23andMe confirmed that hackers downloaded the data of 6.9 million people of the existing 14 million customers after breaching around 14,000 user accounts. ",{"data":39321,"content":39322,"nodeType":866},{},[39323],{"data":39324,"marks":39325,"value":39326,"nodeType":865},{},[],"The attacker stole health reports and raw genotype data of customers affected by a credential stuffing attack that went unnoticed for five months, from April 29 to September 27. ",{"data":39328,"content":39329,"nodeType":866},{},[39330],{"data":39331,"marks":39332,"value":39333,"nodeType":865},{},[],"The credentials used by the attackers to breach the customers' accounts were stolen in other data breaches or used on previously compromised online platforms, and targeted accounts without MFA. ",{"entries":39335},{"hyperlink":39336,"inline":39337,"block":39338},[],[],[39339],{"sys":39340,"__typename":4637,"title":39341,"caption":39342,"layoutMode":59,"file":39343},{"id":36440},"Table of identity attacks - IDSA 2023. Includes phishing, social engineering, brute forcing, password spraying, credential stuffing, stolen credentials, third party attack, adversary in the middle AITM, insider attack","Breakdown of identity attacks from a 2023 IDSA whitepaper",{"url":39344,"width":39345,"height":39346},"https://images.ctfassets.net/y1cdw1ablpvd/2Pu4DMeLHGxRVEiqLUPtuB/f7841fe0868c7c541dd10b7ab8361d31/Image_19-03-2024_at_15.55.jpeg",2190,1210,{"items":39348},[],{},"Identity-based attack techniques as seen in public breaches",{"url":39352},"https://images.ctfassets.net/y1cdw1ablpvd/1vYl5tHrkQcrL0ALGifUCo/76a7ec344f380305a39b4edd1b992ccb/Alt_blog_image.png","2024-03-21T00:00:00.000Z",{"items":39355},[39356],{"__typename":1544,"sys":39357,"content":39359,"title":40148,"synopsis":40149,"hashTags":59,"publishedDate":40150,"slug":40151,"tagsCollection":40152,"authorsCollection":40158},{"id":39358},"6VZQJzQ2FNetGNMEjiuXB2",{"json":39360},{"data":39361,"content":39362,"nodeType":1522},{},[39363,39370,39377,39384,39391,39398,39405,39411,39428,39435,39480,39487,39494,39537,39557,39564,39571,39578,39598,39618,39625,39658,39665,39685,39692,39699,39729,39749,39756,39762,39769,39776,39783,39790,39797,39804,39811,39818,39825,39832,39839,39846,39862,39869,39939,39946,39953,39982,39997,40004,40011,40018,40051,40071,40078,40085,40092,40099,40118,40136,40142],{"data":39364,"content":39365,"nodeType":866},{},[39366],{"data":39367,"marks":39368,"value":39369,"nodeType":865},{},[],"Our goal at Push is simple — to stop identity attacks. Today, the vast majority of identity vulnerabilities exist in the context of SaaS apps. ",{"data":39371,"content":39372,"nodeType":866},{},[39373],{"data":39374,"marks":39375,"value":39376,"nodeType":865},{},[],"The reasons for this are clear: Security teams have reduced central oversight and control over SaaS apps than they are used to, these apps exist in large numbers per company, and the identities that are used to access these apps are... complicated, to say the least. Securing hundreds of apps, with thousands of associated identities, is therefore no mean feat. ",{"data":39378,"content":39379,"nodeType":866},{},[39380],{"data":39381,"marks":39382,"value":39383,"nodeType":865},{},[],"Securing SaaS use means building controls that are easy to use, easy to understand — and ultimately effective. Not just effective against the hand-wavy concept of “SaaS attacks,” but specific techniques — the most common techniques that are likely to cause real damage.",{"data":39385,"content":39386,"nodeType":866},{},[39387],{"data":39388,"marks":39389,"value":39390,"nodeType":865},{},[],"To talk about this, we need to have a shared understanding of what these techniques are. To get that conversation going, we’ve pulled together all the techniques we're aware of, and our research team has even added a bunch of new ones.",{"data":39392,"content":39393,"nodeType":889},{},[39394],{"data":39395,"marks":39396,"value":39397,"nodeType":865},{},[],"The SaaS attack matrix",{"data":39399,"content":39400,"nodeType":866},{},[39401],{"data":39402,"marks":39403,"value":39404,"nodeType":865},{},[],"We’ve taken inspiration from the MITRE ATT&CK framework (certainly intended as the sincerest form of flattery), but wanted to make a conscious break away from the endpoint-focused ATT&CK techniques and instead focus on techniques that are SaaS-specific. In fact, these techniques don’t touch endpoints (so they bypass EDR) or customer networks (so they bypass network detection) — so we’re calling them networkless attacks.",{"data":39406,"content":39410,"nodeType":875},{"target":39407},{"sys":39408},{"id":39409,"type":872,"linkType":873},"768Zv5gTVHyu5rbzJAzL4F",[],{"data":39412,"content":39413,"nodeType":866},{},[39414,39418,39425],{"data":39415,"marks":39416,"value":39417,"nodeType":865},{},[],"You can find more detailed descriptions of these techniques (and hopefully PRs for some we missed) on ",{"data":39419,"content":39420,"nodeType":905},{"uri":2829},[39421],{"data":39422,"marks":39423,"value":2834,"nodeType":865},{},[39424],{"type":1070},{"data":39426,"marks":39427,"value":1193,"nodeType":865},{},[],{"data":39429,"content":39430,"nodeType":866},{},[39431],{"data":39432,"marks":39433,"value":39434,"nodeType":865},{},[],"Since we’re not targeting endpoints, let’s talk about the new targets: The accounts/identities on SaaS apps. We found it was useful to think about these identities not as standalone isolated islands — but much more like a graph; less a single web-server on the internet and more like many Windows endpoints on an Active Directory. ",{"data":39436,"content":39437,"nodeType":866},{},[39438,39442,39451,39454,39463,39467,39476],{"data":39439,"marks":39440,"value":39441,"nodeType":865},{},[],"You can leverage this access to an identity on a trusted platform to target (so laterally move or escalate privilege to) other users or identities. For example, attacks like using access to SaaS apps to ",{"data":39443,"content":39445,"nodeType":905},{"uri":39444},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/in-app_phishing/description.md",[39446],{"data":39447,"marks":39448,"value":39450,"nodeType":865},{},[39449],{"type":1070},"phish other employees through comments",{"data":39452,"marks":39453,"value":7651,"nodeType":865},{},[],{"data":39455,"content":39457,"nodeType":905},{"uri":39456},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/im_user_spoofing/description.md",[39458],{"data":39459,"marks":39460,"value":39462,"nodeType":865},{},[39461],{"type":1070},"spoofing users on IM platforms",{"data":39464,"marks":39465,"value":39466,"nodeType":865},{},[]," to social engineer them there — or perhaps ",{"data":39468,"content":39470,"nodeType":905},{"uri":39469},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/link_backdooring/description.md",[39471],{"data":39472,"marks":39473,"value":39475,"nodeType":865},{},[39474],{"type":1070},"backdooring links",{"data":39477,"marks":39478,"value":39479,"nodeType":865},{},[]," in documents.",{"data":39481,"content":39482,"nodeType":866},{},[39483],{"data":39484,"marks":39485,"value":39486,"nodeType":865},{},[],"In this case, unusually, it’s not the data in these hundreds of SaaS apps that create risk, and you need to consider low-risk (from a data perspective) apps as a vector to pivot to higher-risk apps in your estate.",{"data":39488,"content":39489,"nodeType":2315},{},[39490],{"data":39491,"marks":39492,"value":39493,"nodeType":865},{},[],"Initial access and poisoned tenants",{"data":39495,"content":39496,"nodeType":866},{},[39497,39501,39508,39511,39520,39524,39533],{"data":39498,"marks":39499,"value":39500,"nodeType":865},{},[],"Attacks like ",{"data":39502,"content":39503,"nodeType":905},{"uri":35523},[39504],{"data":39505,"marks":39506,"value":35529,"nodeType":865},{},[39507],{"type":1070},{"data":39509,"marks":39510,"value":7651,"nodeType":865},{},[],{"data":39512,"content":39514,"nodeType":905},{"uri":39513},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/email_phishing/description.md",[39515],{"data":39516,"marks":39517,"value":39519,"nodeType":865},{},[39518],{"type":1070},"email phishing",{"data":39521,"marks":39522,"value":39523,"nodeType":865},{},[]," that get you initial access to SaaS apps are fairly well known — because they work and are widely used. We’re also starting to see tools and attacks that suggest that ",{"data":39525,"content":39527,"nodeType":905},{"uri":39526},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/im_phishing/description.md",[39528],{"data":39529,"marks":39530,"value":39532,"nodeType":865},{},[39531],{"type":1070},"phishing employees through these IM apps",{"data":39534,"marks":39535,"value":39536,"nodeType":865},{},[]," is about to go mainstream.",{"data":39538,"content":39539,"nodeType":866},{},[39540,39544,39553],{"data":39541,"marks":39542,"value":39543,"nodeType":865},{},[],"Another interesting attack is a spin on the classic waterhole attack called a ",{"data":39545,"content":39547,"nodeType":905},{"uri":39546},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/poisoned_tenants/description.md",[39548],{"data":39549,"marks":39550,"value":39552,"nodeType":865},{},[39551],{"type":1070},"poisoned tenant",{"data":39554,"marks":39555,"value":39556,"nodeType":865},{},[],". Rather than attacking a customer tenant for a SaaS app, the attacker lures employees into joining an attacker-controlled tenant. ",{"data":39558,"content":39559,"nodeType":866},{},[39560],{"data":39561,"marks":39562,"value":39563,"nodeType":865},{},[],"SaaS apps allow anyone to name app tenants (a.k.a. spaces, teams, or instances) anything they like — including your company name. Attackers send invites to your employees from within the app with a customized message explaining why they should join this new tenant (or sign up to the app if they are not already a user). ",{"data":39565,"content":39566,"nodeType":866},{},[39567],{"data":39568,"marks":39569,"value":39570,"nodeType":865},{},[],"Attackers might even pay for premium licenses in the app to further entice employees to join. The attacker then waits for the employee to upload sensitive data or create integrations with other company apps containing crown jewels.",{"data":39572,"content":39573,"nodeType":2315},{},[39574],{"data":39575,"marks":39576,"value":39577,"nodeType":865},{},[],"Living-off-the-(SaaS)-land to persist and avoid detection",{"data":39579,"content":39580,"nodeType":866},{},[39581,39585,39594],{"data":39582,"marks":39583,"value":39584,"nodeType":865},{},[],"In the endpoint world, a favorite technique is the use of legit OS utilities or ",{"data":39586,"content":39588,"nodeType":905},{"uri":39587},"https://lolbas-project.github.io",[39589],{"data":39590,"marks":39591,"value":39593,"nodeType":865},{},[39592],{"type":1070},"LOLBaS",{"data":39595,"marks":39596,"value":39597,"nodeType":865},{},[]," (Living-Off-the-Land Binaries and Scripts), which are often signed Microsoft utilities. Perhaps the most well-known example is executing scripts through PowerShell rather than building custom malware. That isn’t as useful these days, but there was a time when PowerShell was routinely used to bypass AV, EDR, and even app allow-listing.",{"data":39599,"content":39600,"nodeType":866},{},[39601,39605,39614],{"data":39602,"marks":39603,"value":39604,"nodeType":865},{},[],"In that same living-off-the-land mindset, an attacker trying to maintain access to each SaaS app they compromise using custom OAuth integration apps might instead choose to use legit SaaS apps that specialize in workflow automation to create ",{"data":39606,"content":39608,"nodeType":905},{"uri":39607},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/shadow_workflows/description.md",[39609],{"data":39610,"marks":39611,"value":39613,"nodeType":865},{},[39612],{"type":1070},"shadow workflows",{"data":39615,"marks":39616,"value":39617,"nodeType":865},{},[],". Utilizing legit SaaS apps also means they can hide in plain sight from incident responders, instead of having to rely on unverified or unpublished integrations.",{"data":39619,"content":39620,"nodeType":866},{},[39621],{"data":39622,"marks":39623,"value":39624,"nodeType":865},{},[],"Perhaps the best example here is using a well-known automation app like Zapier, which claims to have more than 5,000 integrations. These integrations are often verified, approved, and connected to a trusted vendor (Zapier). An attacker might create workflows to:",{"data":39626,"content":39627,"nodeType":2718},{},[39628,39638,39648],{"data":39629,"content":39630,"nodeType":2654},{},[39631],{"data":39632,"content":39633,"nodeType":866},{},[39634],{"data":39635,"marks":39636,"value":39637,"nodeType":865},{},[],"Do daily data exfiltration from a victim’s data lake.",{"data":39639,"content":39640,"nodeType":2654},{},[39641],{"data":39642,"content":39643,"nodeType":866},{},[39644],{"data":39645,"marks":39646,"value":39647,"nodeType":865},{},[],"Configure a webhook that adds malicious accounts to a Github repo on demand.",{"data":39649,"content":39650,"nodeType":2654},{},[39651],{"data":39652,"content":39653,"nodeType":866},{},[39654],{"data":39655,"marks":39656,"value":39657,"nodeType":865},{},[],"Automatically find and replace bank account numbers in emails to the finance team.",{"data":39659,"content":39660,"nodeType":866},{},[39661],{"data":39662,"marks":39663,"value":39664,"nodeType":865},{},[],"All appear as legitimate Zapier integrations. But, before you put in alerts specifically for Zapier, know that it’s one of dozens of apps that support these kinds of offensive workflows.",{"data":39666,"content":39667,"nodeType":866},{},[39668,39672,39681],{"data":39669,"marks":39670,"value":39671,"nodeType":865},{},[],"A sneaky attacker might go further and use an ",{"data":39673,"content":39675,"nodeType":905},{"uri":39674},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/evil_twin_integrations/description.md",[39676],{"data":39677,"marks":39678,"value":39680,"nodeType":865},{},[39679],{"type":1070},"evil twin integration",{"data":39682,"marks":39683,"value":39684,"nodeType":865},{},[]," to make another instance of an existing integration — making this backdoor almost impossible to discover.",{"data":39686,"content":39687,"nodeType":2315},{},[39688],{"data":39689,"marks":39690,"value":39691,"nodeType":865},{},[],"Features or vulnerabilities?",{"data":39693,"content":39694,"nodeType":866},{},[39695],{"data":39696,"marks":39697,"value":39698,"nodeType":865},{},[],"When looking for attack techniques, you’re typically going after features that have weaknesses you can abuse rather than bugs in a single app that will be patched. ",{"data":39700,"content":39701,"nodeType":866},{},[39702,39706,39715,39718,39725],{"data":39703,"marks":39704,"value":39705,"nodeType":865},{},[],"It’s pretty common for SaaS apps to skip email verification or allow multiple simultaneous authentication methods. Both of these are conscious design choices in the name of lowering the friction of account creation and reducing customer support. However, these features make techniques like ",{"data":39707,"content":39709,"nodeType":905},{"uri":39708},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/account_ambushing/description.md",[39710],{"data":39711,"marks":39712,"value":39714,"nodeType":865},{},[39713],{"type":1070},"account ambushing",{"data":39716,"marks":39717,"value":7651,"nodeType":865},{},[],{"data":39719,"content":39720,"nodeType":905},{"uri":9104},[39721],{"data":39722,"marks":39723,"value":950,"nodeType":865},{},[39724],{"type":1070},{"data":39726,"marks":39727,"value":39728,"nodeType":865},{},[]," possible. If these attacks become widespread, these might come to be seen more as bugs rather than a positive feature for users.",{"data":39730,"content":39731,"nodeType":866},{},[39732,39736,39745],{"data":39733,"marks":39734,"value":39735,"nodeType":865},{},[],"In other cases, the bugs are serious enough and hard enough to patch that they’re worth noting as a technique. The recently disclosed (and perfectly named) ",{"data":39737,"content":39739,"nodeType":905},{"uri":39738},"https://www.descope.com/blog/post/noauth",[39740],{"data":39741,"marks":39742,"value":39744,"nodeType":865},{},[39743],{"type":1070},"nOAuth",{"data":39746,"marks":39747,"value":39748,"nodeType":865},{},[]," bug fits this bill. ",{"data":39750,"content":39751,"nodeType":866},{},[39752],{"data":39753,"marks":39754,"value":39755,"nodeType":865},{},[],"The bug arises from a confusion between an email identity and email metadata field in Microsoft integrations and without a central fix from MS (the fix isn’t trivial), these bugs are likely to be discovered and re-occur on third-party OAuth apps for a while to come.",{"data":39757,"content":39761,"nodeType":875},{"target":39758},{"sys":39759},{"id":39760,"type":872,"linkType":873},"6iKFd9Qys2SSuNqKVQB7ka",[],{"data":39763,"content":39764,"nodeType":889},{},[39765],{"data":39766,"marks":39767,"value":39768,"nodeType":865},{},[],"The SaaS market is driving these offensive techniques",{"data":39770,"content":39771,"nodeType":866},{},[39772],{"data":39773,"marks":39774,"value":39775,"nodeType":865},{},[],"SaaS apps are basically web apps that are run in the cloud and accessed from endpoints, so then WebApp, endpoint, and cloud security should cover all of SaaS, right? ",{"data":39777,"content":39778,"nodeType":866},{},[39779],{"data":39780,"marks":39781,"value":39782,"nodeType":865},{},[],"That was our assumption when we started, but what we found instead was that SaaS marketing practices are driving a lot of pretty interesting techniques that you don’t run into in standalone web apps.",{"data":39784,"content":39785,"nodeType":2315},{},[39786],{"data":39787,"marks":39788,"value":39789,"nodeType":865},{},[],"Modern SaaS is easy to adopt, easy to use, low friction, low cost, low overhead",{"data":39791,"content":39792,"nodeType":866},{},[39793],{"data":39794,"marks":39795,"value":39796,"nodeType":865},{},[],"Making apps easy to sign up for and low effort to support means you need to make some interesting choices when it comes to designing account creation and recovery flows. ",{"data":39798,"content":39799,"nodeType":866},{},[39800],{"data":39801,"marks":39802,"value":39803,"nodeType":865},{},[],"Many apps allow users to sign into apps using multiple methods, easily invite collaborators (internal and external) and avoid any additional friction during the signup process. ",{"data":39805,"content":39806,"nodeType":866},{},[39807],{"data":39808,"marks":39809,"value":39810,"nodeType":865},{},[],"For example, many apps avoid verifying new account email addresses. This is not laziness, these are conscious design choices — not driven by security clearly, but not accidents.",{"data":39812,"content":39813,"nodeType":2315},{},[39814],{"data":39815,"marks":39816,"value":39817,"nodeType":865},{},[],"Modern SaaS is highly integrated",{"data":39819,"content":39820,"nodeType":866},{},[39821],{"data":39822,"marks":39823,"value":39824,"nodeType":865},{},[],"Most SaaS apps are trying to build app marketplaces or perform well in other apps' marketplaces (often both), and it’s rare these days to find apps that don’t integrate with other apps. ",{"data":39826,"content":39827,"nodeType":866},{},[39828],{"data":39829,"marks":39830,"value":39831,"nodeType":865},{},[],"OAuth has become the de facto standard protocol for doing this, and most users have become quite used to approving OAuth2.0 consent flows. These integrations have opened up lots of incredibly useful doors for attackers to persist access and move laterally across SaaS apps that few incident response teams have run into yet. These tokens don’t expire when you reset passwords, aren’t protected by MFA, and actions they performed are rarely logged. ",{"data":39833,"content":39834,"nodeType":866},{},[39835],{"data":39836,"marks":39837,"value":39838,"nodeType":865},{},[],"These are not bugs or oversights but rather a consequence of how these APIs are intended to be used (by machines, not human adversaries).",{"data":39840,"content":39841,"nodeType":889},{},[39842],{"data":39843,"marks":39844,"value":39845,"nodeType":865},{},[],"Problems with observing SaaS attacks ",{"data":39847,"content":39848,"nodeType":866},{},[39849,39853,39858],{"data":39850,"marks":39851,"value":39852,"nodeType":865},{},[],"This research begs one question above others: ",{"data":39854,"marks":39855,"value":39857,"nodeType":865},{},[39856],{"type":2757},"“Are we seeing these attacks in the wild?",{"data":39859,"marks":39860,"value":39861,"nodeType":865},{},[],"” ",{"data":39863,"content":39864,"nodeType":2315},{},[39865],{"data":39866,"marks":39867,"value":39868,"nodeType":865},{},[],"Yes, definitely",{"data":39870,"content":39871,"nodeType":866},{},[39872,39876,39885,39888,39897,39901,39910,39914,39922,39926,39935],{"data":39873,"marks":39874,"value":39875,"nodeType":865},{},[],"For some of the better-known techniques, like credential stuffing and email phishing, the answer is an easy yes. Stats from ",{"data":39877,"content":39879,"nodeType":905},{"uri":39878},"https://www.microsoft.com/en-us/security/blog/2023/05/04/how-microsoft-can-help-you-go-passwordless-this-world-password-day/",[39880],{"data":39881,"marks":39882,"value":39884,"nodeType":865},{},[39883],{"type":1070},"Microsoft (1,287 password attacks every second)",{"data":39886,"marks":39887,"value":7651,"nodeType":865},{},[],{"data":39889,"content":39891,"nodeType":905},{"uri":39890},"https://auth0.com/blog/top-insights-from-our-2022-state-of-secure-identity-report/",[39892],{"data":39893,"marks":39894,"value":39896,"nodeType":865},{},[39895],{"type":1070},"Auth0 (a third of their traffic is credential stuffing)",{"data":39898,"marks":39899,"value":39900,"nodeType":865},{},[]," speaks volumes. Other sources like the ",{"data":39902,"content":39904,"nodeType":905},{"uri":39903},"https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2022/cyber-security-breaches-survey-2022",[39905],{"data":39906,"marks":39907,"value":39909,"nodeType":865},{},[39908],{"type":1070},"NCSC's Cyber Security Breaches Survey 2022",{"data":39911,"marks":39912,"value":39913,"nodeType":865},{},[]," and the ",{"data":39915,"content":39916,"nodeType":905},{"uri":10411},[39917],{"data":39918,"marks":39919,"value":39921,"nodeType":865},{},[39920],{"type":1070},"Verizon 2023 Data Breach Investigations Report",{"data":39923,"marks":39924,"value":39925,"nodeType":865},{},[]," suggest that phishing is also a major cause of SaaS breaches. Anecdotal reports from colleagues in the Incident Response field suggest that malicious mail forwarding rules are seen a lot, something which is supported by the ",{"data":39927,"content":39929,"nodeType":905},{"uri":39928},"https://expel.com/expel-quarterly-threat-report/",[39930],{"data":39931,"marks":39932,"value":39934,"nodeType":865},{},[39933],{"type":1070},"Expel Quarterly Threat Report for Q1 2023",{"data":39936,"marks":39937,"value":39938,"nodeType":865},{},[]," (see page 6).",{"data":39940,"content":39941,"nodeType":866},{},[39942],{"data":39943,"marks":39944,"value":39945,"nodeType":865},{},[],"The takeaway is that the current focus for defenders should be to ensure users have good phishing-resistant account security in place — make sure you have basics like strong unique passwords and MFA in place across your entire SaaS estate.",{"data":39947,"content":39948,"nodeType":2315},{},[39949],{"data":39950,"marks":39951,"value":39952,"nodeType":865},{},[],"For newer OAuth attacks, it’s a lot less clear …",{"data":39954,"content":39955,"nodeType":866},{},[39956,39960,39965,39969,39978],{"data":39957,"marks":39958,"value":39959,"nodeType":865},{},[],"Other techniques like consent phishing have been discussed in some breach disclosures like the ",{"data":39961,"marks":39962,"value":39964,"nodeType":865},{},[39963],{"type":1070},"2020 SANS breach",{"data":39966,"marks":39967,"value":39968,"nodeType":865},{},[],". These OAuth techniques also pop up in the news (for example, the ",{"data":39970,"content":39972,"nodeType":905},{"uri":39971},"https://www.bleepingcomputer.com/news/security/github-how-stolen-oauth-tokens-helped-breach-dozens-of-orgs/",[39973],{"data":39974,"marks":39975,"value":39977,"nodeType":865},{},[39976],{"type":1070},"2022 Github/Heroku/Travis-CI breach",{"data":39979,"marks":39980,"value":39981,"nodeType":865},{},[]," where GitHub accounts were breached using stolen Heroku and Travis-CI OAuth tokens). ",{"data":39983,"content":39984,"nodeType":866},{},[39985,39989,39994],{"data":39986,"marks":39987,"value":39988,"nodeType":865},{},[],"That said, none of these techniques come up as frequently as their usefulness would suggest. This means one of two things: ",{"data":39990,"marks":39991,"value":39993,"nodeType":865},{},[39992],{"type":2757},"Either attackers aren’t yet using them widely, or they are and we aren’t detecting them",{"data":39995,"marks":39996,"value":1193,"nodeType":865},{},[],{"data":39998,"content":39999,"nodeType":866},{},[40000],{"data":40001,"marks":40002,"value":40003,"nodeType":865},{},[],"There is certainly a case to be made that attackers simply don’t need these newer techniques yet. Many organizations don’t have a way of discovering SaaS use in their organization yet, never mind breached accounts, so new persistence techniques might be a bit more than necessary at the moment.",{"data":40005,"content":40006,"nodeType":2315},{},[40007],{"data":40008,"marks":40009,"value":40010,"nodeType":865},{},[],"But would we know if it was happening?",{"data":40012,"content":40013,"nodeType":866},{},[40014],{"data":40015,"marks":40016,"value":40017,"nodeType":865},{},[],"On the other hand, there is certainly the possibility that these attacks are increasingly used, but are simply not being discovered. A strong argument in favor of this view is the difficulty in investigating these attacks. Very few SaaS apps provide enough logging capability to discover these attacks as a customer. This is true even for the biggest, most mature apps like Office 365 and Google Workspace unless you are on top license tiers. This is doubly true for attacks that use OAuth, with many apps providing no insight or details into actions made using OAuth-authenticated APIs. ",{"data":40019,"content":40020,"nodeType":866},{},[40021,40025,40034,40038,40047],{"data":40022,"marks":40023,"value":40024,"nodeType":865},{},[],"This suggests only the SaaS providers for these apps are really in a position to discover and investigate them. This does ring true when you consider that ",{"data":40026,"content":40028,"nodeType":905},{"uri":40027},"https://blog.heroku.com/april-2022-incident-review",[40029],{"data":40030,"marks":40031,"value":40033,"nodeType":865},{},[40032],{"type":1070},"Heroku",{"data":40035,"marks":40036,"value":40037,"nodeType":865},{},[]," relied heavily on Github during the investigation (and in one case even the detection of) their 2022 breaches, and the same seems true for a similar breach affecting ",{"data":40039,"content":40041,"nodeType":905},{"uri":40040},"https://circleci.com/blog/jan-4-2023-incident-report/",[40042],{"data":40043,"marks":40044,"value":40046,"nodeType":865},{},[40045],{"type":1070},"CircleCI",{"data":40048,"marks":40049,"value":40050,"nodeType":865},{},[]," later that year. Github and CircleCI’s customers prompted the investigation after seeing strange behavior, but Github had access to the logs to investigate. It’s difficult to imagine that most or even many SaaS vendors have the resources or inclination to run these investigations effectively as GitHub appears to have.",{"data":40052,"content":40053,"nodeType":866},{},[40054,40058,40068],{"data":40055,"marks":40056,"value":40057,"nodeType":865},{},[],"So, are these attacks happening in the real world? My best guess is it’s a little bit of column A and a little bit of column B — there are likely not so many of these attacks happening yet, and when they do, I suspect the vast majority go undetected. ",{"data":40059,"content":40061,"nodeType":905},{"uri":40060},"https://www.youtube.com/watch?v=j95kNwZw8YY",[40062],{"data":40063,"marks":40064,"value":40067,"nodeType":865},{},[40065,40066],{"type":1070},{"type":2757},"But that’s just like my opinion, man.",{"data":40069,"marks":40070,"value":21,"nodeType":865},{},[],{"data":40072,"content":40073,"nodeType":866},{},[40074],{"data":40075,"marks":40076,"value":40077,"nodeType":865},{},[],"This is part of the reason we think enabling red teamers to try these techniques in anger is useful — this is the time-proven way to understand these risks.",{"data":40079,"content":40080,"nodeType":889},{},[40081],{"data":40082,"marks":40083,"value":40084,"nodeType":865},{},[],"What’s next?",{"data":40086,"content":40087,"nodeType":866},{},[40088],{"data":40089,"marks":40090,"value":40091,"nodeType":865},{},[],"We’ve barely scratched the surface, but perhaps there is enough here to get the discussion going. From past experience, discussion may not be enough, and it’s likely that live offensive work like penetration tests or more likely red team exercises will be required to make the risks of using these techniques real for the wider security community. ",{"data":40093,"content":40094,"nodeType":866},{},[40095],{"data":40096,"marks":40097,"value":40098,"nodeType":865},{},[],"After all, seeing is believing. We think some more practical examples and tools to help red  teamers use these techniques on engagements will help drive awareness forward, so we’ll be looking to build out this content.",{"data":40100,"content":40101,"nodeType":866},{},[40102,40106,40115],{"data":40103,"marks":40104,"value":40105,"nodeType":865},{},[],"We’ve started with pure networkless attacks that don’t touch customer networks or endpoints, but there are many useful techniques to connect the old endpoint world to the SaaS world. Consider stealing OAuth tokens from a thick client on an endpoint, or using a ",{"data":40107,"content":40109,"nodeType":905},{"uri":40108},"https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/",[40110],{"data":40111,"marks":40112,"value":40114,"nodeType":865},{},[40113],{"type":1070},"backdoored GitHub repo to get code execution on endpoints",{"data":40116,"marks":40117,"value":1193,"nodeType":865},{},[],{"data":40119,"content":40120,"nodeType":866},{},[40121,40125,40132],{"data":40122,"marks":40123,"value":40124,"nodeType":865},{},[],"Help us all better understand how widespread these attacks are by sharing some war stories. We’d love some comments, discussions, or PRs on ",{"data":40126,"content":40127,"nodeType":905},{"uri":2829},[40128],{"data":40129,"marks":40130,"value":2834,"nodeType":865},{},[40131],{"type":1070},{"data":40133,"marks":40134,"value":40135,"nodeType":865},{},[],"!",{"data":40137,"content":40141,"nodeType":875},{"target":40138},{"sys":40139},{"id":40140,"type":872,"linkType":873},"2y0INxqAi594O7rCAVKhTI",[],{"data":40143,"content":40144,"nodeType":866},{},[40145],{"data":40146,"marks":40147,"value":21,"nodeType":865},{},[],"Let’s talk about SaaS attack techniques","Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face.","2023-07-27T00:00:00.000Z","saas-attack-techniques",{"items":40153},[40154,40156],{"sys":40155,"name":2144},{"id":2143},{"sys":40157,"name":342},{"id":3008},{"items":40159},[40160],{"fullName":40161,"firstName":40162,"jobTitle":40163,"profilePicture":40164},"Jacques Louw","Jacques","Co-founder / CRO",{"url":40165},"https://images.ctfassets.net/y1cdw1ablpvd/39m8bektV23lnCRcEq0G8h/2a08f6276a50744f1a4b499b273f6bb2/Push_Founders_at_Cahoots_October_28_2022_by_Doug_Coombe-21.jpg","identity-attacks-in-the-wild","blog/identity-attacks-in-the-wild",{"json":40169},{"data":40170,"content":40171,"nodeType":1522},{},[40172],{"data":40173,"content":40174,"nodeType":866},{},[40175,40179],{"data":40176,"marks":40177,"value":40178,"nodeType":865},{},[],"To help organizations keep track of how browser-based identity attacks are evolving, we've put together this index of recent breaches",{"data":40180,"marks":40181,"value":40182,"nodeType":865},{},[],". In particular we’re focused on tracking attacks in the public domain that demonstrate the very latest techniques being used in the wild, such as those targeting identity infrastructure itself. ","To help organizations keep track of how browser-based identity attacks are evolving, we've put together this index of recent breaches.",{"id":40185,"publishedAt":40186},"6XIts2UEnrsJDki8gKDXyI","2026-08-12T11:55:31.114Z",{"items":40188},[40189,40191],{"sys":40190,"name":2144},{"id":2143},{"sys":40192,"name":342},{"id":3008},{"items":40194},[40195,40197,40199,40201,40203,40205,40207,40209,40211,40213,40215,40217,40219,40221,40223,40225,40227,40229,40231,40233],{"sys":40196,"name":279,"slug":280,"tier":31},{"id":276},{"sys":40198,"name":413,"slug":414,"tier":31},{"id":410},{"sys":40200,"name":642,"slug":643,"tier":31},{"id":639},{"sys":40202,"name":519,"slug":520,"tier":31},{"id":516},{"sys":40204,"name":545,"slug":546,"tier":31},{"id":542},{"sys":40206,"name":342,"slug":343,"tier":31},{"id":339},{"sys":40208,"name":404,"slug":405,"tier":45},{"id":401},{"sys":40210,"name":528,"slug":529,"tier":45},{"id":525},{"sys":40212,"name":333,"slug":334,"tier":45},{"id":330},{"sys":40214,"name":422,"slug":423,"tier":45},{"id":419},{"sys":40216,"name":395,"slug":396,"tier":45},{"id":392},{"sys":40218,"name":571,"slug":572,"tier":45},{"id":568},{"sys":40220,"name":484,"slug":485,"tier":45},{"id":481},{"sys":40222,"name":466,"slug":467,"tier":45},{"id":463},{"sys":40224,"name":607,"slug":608,"tier":45},{"id":604},{"sys":40226,"name":261,"slug":262,"tier":45},{"id":258},{"sys":40228,"name":650,"slug":651,"tier":45},{"id":647},{"sys":40230,"name":537,"slug":538,"tier":45},{"id":534},{"sys":40232,"name":457,"slug":458,"tier":45},{"id":454},{"sys":40234,"name":633,"slug":634,"tier":45},{"id":630},"c-hSrKEun_EGXMqcYVqzCOnSLH9sxoS6TEl8VMIrNjA",1787040105826]